Handling Instruction Skipping in ARM Cortex-M Exception Recovery

ARM Cortex-M BusFault and MemManage Fault Instruction Skipping

When developing firmware for ARM Cortex-M processors, encountering exceptions such as BusFault or MemManage Fault is not uncommon. These exceptions often arise due to invalid memory accesses, such as those caused by LDR (Load Register) or STR (Store Register) instructions attempting to access restricted or non-existent memory regions. A critical challenge in handling these exceptions is ensuring that the system can recover gracefully without re-executing the faulting instruction, which would lead to an infinite loop of exceptions. This post delves into the intricacies of skipping the faulting instruction in ARM Cortex-M processors, focusing on the difficulties in determining whether the instruction is 16-bit or 32-bit and providing a detailed guide on how to implement a robust solution.

Determining Instruction Length and Handling Fault Recovery

The primary issue revolves around the need to skip the faulting instruction during exception recovery. When a BusFault or MemManage Fault occurs, the processor saves the context, including the Program Counter (PC), onto the stack. Upon returning from the exception handler, the processor resumes execution from the saved PC, which points to the faulting instruction. To avoid re-executing the faulting instruction, the PC must be adjusted to point to the next instruction. However, this adjustment requires knowledge of the instruction length, which can be either 16-bit (Thumb) or 32-bit (Thumb-2). The Cortex-M processors exclusively use the Thumb instruction set, which includes both 16-bit and 32-bit instructions, making it challenging to determine the instruction length without decoding the instruction.

The difficulty in determining the instruction length stems from the variable-length nature of the Thumb instruction set. While the first 16 bits of an instruction can provide some indication of its length, certain instructions require additional decoding to confirm whether they are 16-bit or 32-bit. For example, LDR and STR instructions in Thumb-2 can be either 16-bit or 32-bit, depending on the addressing mode and the registers involved. This variability necessitates a method to accurately decode the instruction to determine its length before adjusting the PC.

Implementing Instruction Decoding and PC Adjustment

To address the challenge of skipping the faulting instruction, a systematic approach involving instruction decoding and PC adjustment is required. The following steps outline the process:

Instruction Decoding

The first step in skipping the faulting instruction is to decode the instruction to determine its length. This involves examining the first 16 bits of the instruction to identify whether it is a 16-bit or 32-bit instruction. The ARM Architecture Reference Manual provides detailed encoding information for Thumb instructions, which can be used to create a decoding routine. The decoding routine should check the opcode and other relevant bits in the instruction to determine its length. For example, certain bit patterns in the first 16 bits of the instruction can indicate whether it is a 16-bit or 32-bit instruction. If the instruction is determined to be 32-bit, the routine should read the next 16 bits to complete the decoding process.

PC Adjustment

Once the instruction length is determined, the next step is to adjust the PC to skip the faulting instruction. This involves modifying the saved PC on the stack to point to the next instruction. For a 16-bit instruction, the PC should be incremented by 2 bytes, while for a 32-bit instruction, the PC should be incremented by 4 bytes. The adjusted PC is then restored when the exception handler returns, allowing the processor to resume execution from the next instruction.

Handling Special Cases

In some cases, the faulting instruction may be part of a multi-instruction sequence, such as a load/store multiple (LDM/STM) instruction or a branch with link (BL) instruction. These instructions may require additional handling to ensure correct recovery. For example, in the case of a load/store multiple instruction, the PC adjustment should account for the number of registers being loaded or stored. Similarly, for a branch with link instruction, the return address should be adjusted to ensure that the correct instruction is executed after the branch.

Example Implementation

The following example demonstrates how to implement instruction decoding and PC adjustment in an exception handler for a Cortex-M processor:

void BusFault_Handler(void) {
    // Get the saved PC from the stack
    uint32_t *stack_ptr;
    asm volatile ("MRS %0, MSP" : "=r" (stack_ptr));
    uint32_t saved_pc = stack_ptr[6]; // PC is the 7th element in the stack frame

    // Read the faulting instruction
    uint16_t instr_low = *(uint16_t *)saved_pc;
    uint16_t instr_high = 0;

    // Determine if the instruction is 16-bit or 32-bit
    if ((instr_low & 0xF800) == 0xF800) {
        // 32-bit instruction
        instr_high = *(uint16_t *)(saved_pc + 2);
        // Adjust PC by 4 bytes
        saved_pc += 4;
    } else {
        // 16-bit instruction
        // Adjust PC by 2 bytes
        saved_pc += 2;
    }

    // Update the saved PC on the stack
    stack_ptr[6] = saved_pc;

    // Clear the fault status registers
    SCB->SHCSR |= SCB_SHCSR_BUSFAULTPENDED_Msk;
    SCB->CFSR |= SCB_CFSR_BUSFAULTSR_Msk;

    // Return from exception
    asm volatile ("BX LR");
}

In this example, the BusFault_Handler function retrieves the saved PC from the stack and reads the faulting instruction. The instruction is then decoded to determine its length, and the PC is adjusted accordingly. The adjusted PC is saved back to the stack, and the fault status registers are cleared before returning from the exception handler.

Considerations for Robust Implementation

While the above example provides a basic implementation, several considerations should be taken into account for a robust solution:

• Instruction Set Complexity: The Thumb instruction set includes a wide variety of instructions, some of which may require more complex decoding logic. The implementation should be tested with a comprehensive set of instructions to ensure correct decoding and PC adjustment.
• Exception Nesting: In systems where exceptions can be nested, care must be taken to ensure that the exception handler does not inadvertently modify the stack or PC of a higher-priority exception.
• Debugging and Testing: The implementation should be thoroughly tested in a controlled environment, with various fault scenarios simulated to ensure correct behavior. Debugging tools such as breakpoints and watchpoints can be used to verify the correct adjustment of the PC.
• Performance Impact: The instruction decoding and PC adjustment process adds overhead to the exception handler. In performance-critical systems, this overhead should be minimized to ensure timely recovery from exceptions.

Conclusion

Skipping the faulting instruction in ARM Cortex-M processors during exception recovery is a critical task that requires careful handling of the Program Counter and accurate decoding of the instruction set. By implementing a robust decoding routine and adjusting the PC based on the instruction length, developers can ensure that their systems recover gracefully from BusFault and MemManage Fault exceptions. The provided example and considerations serve as a foundation for developing a reliable exception recovery mechanism in Cortex-M based embedded systems.