ARM Cortex-R LDREXD/STREXD Atomicity Issues Between ISR and Task Contexts

ARM Cortex-R Atomic Double-Word Transfer Challenges Between ISR and Task

The ARM Cortex-R series processors, known for their real-time capabilities and robust interrupt handling, often require careful consideration when implementing atomic operations across different execution contexts. One such scenario involves the use of LDREXD (Load Exclusive Double-Word) and STREXD (Store Exclusive Double-Word) instructions to facilitate atomic double-word transfers between an Interrupt Service Routine (ISR) and a task running in normal mode. The challenge arises due to the interruptible nature of LDM/STM (Load/Store Multiple) instructions and the specific behavior of exclusive access instructions in ARM architectures.

In this scenario, the goal is to ensure that a double-word data transfer from an ISR to a task is atomic, meaning that the task either reads the complete, unmodified double-word or detects that the data has been updated by the ISR. The initial approach proposed in the discussion involves using STREXD in the ISR without retrying on failure and LDREXD followed by CLREX (Clear Exclusive) in the task. However, this approach raises several concerns regarding atomicity, lock management, and the potential for data corruption or loss.

The core issue revolves around the proper use of exclusive access instructions to ensure atomicity across different execution contexts. The ARM architecture provides LDREXD and STREXD for atomic double-word operations, but their behavior in the presence of interrupts and context switches requires careful handling. Misuse of these instructions can lead to subtle bugs, such as data races, lost updates, or deadlocks.

Memory Locking Mechanism and Exclusive Access Restrictions

The ARM architecture implements a memory locking mechanism to support atomic operations through exclusive access instructions. When a LDREXD instruction is executed, the processor marks a memory location as exclusive to the current processor core. This exclusive mark is cleared if another core or context writes to the same location, or if a STREXD instruction is executed, regardless of whether the store succeeds or fails. This mechanism ensures that atomic operations can be performed without the need for global locks, but it also imposes certain restrictions and requires careful programming to avoid pitfalls.

One critical restriction is that any STREXD instruction, regardless of the address it operates on, will clear the exclusive mark set by a previous LDREXD. This means that if an ISR executes a STREXD while a task is in the middle of an atomic sequence involving LDREXD and STREXD, the task’s exclusive mark will be cleared, causing its subsequent STREXD to fail. This behavior is documented in the ARM Architecture Reference Manual (ARMv7-R) under the section "A3.4.5 Load-Exclusive and Store-Exclusive usage restrictions."

Another important consideration is the scope of the exclusive mark. The ARM architecture does not specify a precise granularity for the exclusive mark, but it is generally understood to be a single bit per core. This means that the exclusive mark is not tied to a specific memory address but rather to the core’s state. As a result, any STREXD instruction executed by the same core will clear the exclusive mark, even if it operates on a different memory address. This behavior can lead to unexpected failures in atomic sequences if not properly accounted for.

The discussion also touches on the concept of "nesting" exclusive access instructions, where multiple LDREXD/STREXD pairs are executed in sequence. While some ARM implementations may allow nested exclusive access sequences, this is not guaranteed by the architecture and should be avoided. The ARM Architecture Reference Manual explicitly states that the behavior of nested exclusive access instructions is implementation-defined and may vary between different processor cores.

Implementing Robust Atomic Double-Word Transfers with LDREXD and STREXD

To implement robust atomic double-word transfers between an ISR and a task on an ARM Cortex-R processor, the following steps and considerations are recommended:

1. Foreground Process Handling of Atomic Sequences: The task (foreground process) should be responsible for initiating and completing the atomic sequence. This involves using LDREXD to load the double-word and STREXD to store it. If the STREXD fails, it indicates that the ISR has updated the data, and the task should retry the sequence.

2. ISR Handling of Data Updates: The ISR should use STREXD to update the double-word data. However, the ISR should not retry the STREXD if it fails, as this could lead to priority inversion or excessive interrupt latency. Instead, the ISR should rely on the task to detect the update and retry the atomic sequence.

3. Use of CLREX: The task should use CLREX to clear the exclusive mark after detecting a failed STREXD. This ensures that the task does not retain an outdated exclusive mark, which could interfere with subsequent atomic operations.

4. Avoiding Nested Exclusive Access Sequences: Nested LDREXD/STREXD sequences should be avoided, as their behavior is not guaranteed by the architecture. Instead, each atomic sequence should be self-contained and not rely on the state of previous exclusive access instructions.

5. Memory Barrier Usage: Appropriate memory barriers should be used to ensure that the order of memory operations is preserved across different execution contexts. This is particularly important in real-time systems where the timing of interrupts and task execution can affect the consistency of shared data.

6. Testing and Validation: Given the subtle nature of atomic operations and their interaction with interrupts, thorough testing and validation are essential. This includes stress testing the system under high interrupt loads and verifying that the atomic sequences behave as expected in all scenarios.

By following these guidelines, developers can implement robust and reliable atomic double-word transfers between ISRs and tasks on ARM Cortex-R processors. The key is to understand the behavior of exclusive access instructions and to design the system in a way that respects the architectural constraints and guarantees provided by the ARM architecture.

Example Implementation

Below is an example implementation of the described approach:

; Task (Foreground Process)
Task_Atomic_Read:
    LDREXD R0, R1, [R2]        ; Load double-word from memory address in R2
    STREXD R3, R4, R5, [R2]    ; Attempt to store double-word from R4, R5 to memory address in R2
    CMP R3, #0                 ; Check if STREXD succeeded
    BNE Task_Atomic_Read_Fail  ; If STREXD failed, jump to failure handler
    ; STREXD succeeded, continue processing
    ...

Task_Atomic_Read_Fail:
    CLREX                      ; Clear exclusive mark
    ; Retry the atomic sequence
    B Task_Atomic_Read

; ISR (Interrupt Service Routine)
ISR_Atomic_Write:
    STREXD R0, R1, R2, [R3]    ; Store double-word from R1, R2 to memory address in R3
    ; Do not retry if STREXD fails
    BX LR                      ; Return from ISR

This example demonstrates the proper use of LDREXD, STREXD, and CLREX to implement atomic double-word transfers between a task and an ISR. The task retries the atomic sequence if the STREXD fails, while the ISR does not retry the STREXD to avoid potential priority inversion or excessive interrupt latency.

Conclusion

Implementing atomic double-word transfers between an ISR and a task on an ARM Cortex-R processor requires a deep understanding of the exclusive access instructions and their behavior in different execution contexts. By following the guidelines and example implementation provided, developers can ensure that their systems are robust, reliable, and free from subtle bugs related to atomicity and memory consistency. Thorough testing and validation are essential to verify that the system behaves as expected under all conditions.