PM0264

Programming manual

STM32 Cortex®-M33 MCUs programming manual

Introduction
This programming manual provides information for application and system-level software developers. It gives a full description
of the STM32 Cortex®-M33 processor programming model, instruction set and core peripherals. The applicable products are
listed in the table below. The Cortex®-M33 processor is a high performance 32-bit processor designed for the microcontroller
and microprocessor market. It offers significant benefits to developers, including:
• Outstanding processing performance combined with fast interrupt handling.
• Enhanced system debug with extensive breakpoint and trace capabilities.
• Efficient processor core, system and memories.
• Instruction set extension for signal processing applications.
• Ultra-low power consumption with integrated sleep modes.
• Platform robustness with integrated memory protection unit.
• Extended security features with Security Extension for Armv8-M.

Table 1. Applicable products

Type Product Series

Microcontrollers STM32L5 Series, STM32U5 Series

PM0264 - Rev 2 - March 2022 www.st.com

For further information contact your local STMicroelectronics sales office.
 PM0264
About this document

1 About this document

This document provides information required for application and system-level software development. It does not
provide information on debug components, features, or operation.
This document applies to the STM32 MCUs that embed an Arm® Cortex®-M33 processor.
Note: Arm is a registered trademark of Arm Limited (or its subsidiaries) in the US and/or elsewhere.

This material is for microcontroller software and hardware engineers, including those who have no experience
with Arm cores.

1.1 Typographic conventions

The typographical conventions used in this document are:
italic Highlights important notes, introduces special terminology, denotes internal cross-references,
and citations.
bold Highlights interface elements, such as menu names. Denotes signal names. Also used for
terms in descriptive lists, where appropriate.
monospace Denotes text that you can enter at the keyboard, such as commands, file and program names,
and source code.
space Denotes a permitted abbreviation for a command or option. You can enter the underlined text
instead of the full command or option name.
monospace italic Denotes arguments to monospace text where the argument is to be replaced by a specific
value.
monospace bold Denotes language keywords when used outside example code.
<and> Encloses replaceable terms for assembler syntax where they appear in code or code
fragments. For example:
LDRSB<cond> <Rt>, [<Rn>, #<offset>]

1.2 List of abbreviations for registers

The following abbreviations are used in register descriptions:

read/write (rw) Software can read and write to these bits.

read-only (r) Software can only read these bits.
write-only (w) Software can only write to this bit.
Reading the bit returns the reset value.
read/clear (rc_w1) Software can read as well as clear this bit by writing 1.
Writing ‘0’ has no effect on the bit value.
read/clear (rc_w0) Software can read as well as clear this bit by writing 0.
Writing ‘1’ has no effect on the bit value.
toggle (t) Software can only toggle this bit by writing ‘1’. Writing ‘0’ has no effect.
Reserved (Res.) Reserved bit, must be kept at reset value.

1.3 About the Cortex®-M33 processor and core peripherals

The Cortex®-M33 processor is a high-performance 32-bit processor that is designed for the microcontroller
market. The processor offers outstanding performance, fast interrupt handling, and enhanced system debug with
extensive breakpoint and trace capabilities.
Other significant benefits to developers include:
• Efficient processor core, system, and memories.

PM0264 - Rev 2 page 2/232

 PM0264
About the Cortex®-M33 processor and core peripherals

• Instruction set extension for signal processing applications.

• Ultra-low power consumption with integrated sleep modes.
• Platform robustness with integrated memory protection unit (MPU).
• Extended security features with security extension for Armv8‑M.
The Cortex®-M33 processor is built on a high-performance processor core, with a 3-stage pipeline Harvard
architecture, making it ideal for demanding embedded applications. The in-order processor delivers exceptional
power efficiency through an efficient instruction set and extensively optimized design.
The Cortex®-M33 processor provides high-end processing hardware including:
• IEEE754-compliant single-precision floating-point computation.
• Single Instruction Multiple Data (SIMD) multiplication and multiply-with-accumulate capabilities.
• Saturating arithmetic and dedicated hardware division.

Figure 1. STM32 Cortex®-M33 processor implementation without the security extension

Interrupts

Processor

Nested Vector
Interrupt Controller
(NVIC)

Floating-point Unit (FPU)

Embedded Trace Debug

Processor core Macrocell (ETM) Interface

Data Watchpoint Trace

and Trace Unit (DWT) Interface

Breakpoint Unit
Memory Protection Unit (MPU)
ROM tables

Cross Trigger
Interface (CTI)

Bus matrix

AMBA5 AHB 5

Memory system

PM0264 - Rev 2 page 3/232

 PM0264
About the Cortex®-M33 processor and core peripherals

Figure 2. STM32 Cortex®-M33 processor implementation with the security extension

Interrupts

Processor

Nested Vector
Interrupt Controller
(NVIC)

Floating-point Unit (FPU)

Embedded Trace Debug

Processor core Macrocell (ETM) Interface

Data Watchpoint Trace

Memory Protection and Trace Unit (DWT) Interface

Security
Attribution Unit Breakpoint Unit
Implementation
Defined (SAU)
Attribution Unit ROM tables
(IDAU) Non-secure
Secure Memory Cross Trigger
Memory
Protection Unit Interface (CTI)
Protection Unit
(MPU_S)
(MPU_NS)

Bus matrix

AMBA5 AHB 5

Memory system

To facilitate the design of cost-sensitive devices, the STM32 Cortex®-M33 processor implements tightly-coupled
system components that reduce processor area while significantly improving interrupt handling and system
debug capabilities. The STM32 Cortex®-M33 processor implements the T32 instruction set based on STM32
Cortex®-M33-2 technology, ensuring high code density and reduced program memory requirements. The STM32
Cortex®-M33 processor instruction set provides the exceptional performance that is expected of a modern 32-bit
architecture, with better code density than most other architectures.
The STM32 Cortex®-M33 processor closely integrates a configurable Nested Vectored Interrupt Controller (NVIC)
to deliver industry-leading interrupt performance. The NVIC includes a non-maskable interrupt, and provides up to
256 interrupt priority levels for other interrupts. The tight integration of the processor core and NVIC provides fast
execution of Interrupt Service Routines (ISRs), which dramatically reduces interrupt latency. This reduced latency
is achieved through:
• The hardware stacking of registers.
• The ability to suspend load multiple and store multiple operations.
• Parallel instruction-side and data-side paths.
• Tail-chaining.
• Late-arriving interrupts.
Interrupt handlers do not require wrapping in assembler code, removing any code overhead from the ISRs. The
tail-chain optimization also significantly reduces the overhead when switching from one ISR to another.
To optimize low-power designs, the NVIC supports different sleep modes, including a deep sleep function that
enables the entire device to be rapidly powered down while still retaining program state.
To increase instruction throughput, the STM32 Cortex®-M33 processor can execute certain pairs of 16-bit
instructions simultaneously. This is called dual issue.

1.3.1 System-level interface

The Cortex®‑M33 processor provides multiple interfaces using Arm AMBA® technology to provide high speed, low
latency memory accesses.

PM0264 - Rev 2 page 4/232

 PM0264
About the Cortex®-M33 processor and core peripherals

1.3.2 Security Extension

The Armv8‑M Security Extension adds security through code and data protection features.
A processor with the Security Extension supports both Non-secure and Secure states, which are orthogonal to the
traditional thread and handler modes. The four modes of operation are:
• Non-secure Thread mode.
• Non-secure Handler mode.
• Secure Thread mode.
• Secure Handler mode.
When the Security Extension is implemented, the following happens:
• The processor resets into Secure state.
• Some registers are banked between Security states. There are two separate instances of the same register,
one in Secure state and one in Non-secure state.
• The architecture allows the Secure state to access the Non-secure versions of banked registers.
• Interrupts can be configured to target one of the two Security states.
• Some faults are banked between Security states or are configurable.
• Secure memory can only be accessed from Secure state.

1.3.3 Integrated configurable debug

The Cortex®‑M33 processor implements a complete hardware debug solution. This provides high system visibility
of the processor and memory through either a traditional JTAG port or a 2-pin Serial Wire Debug (SWD) port that
is ideal for microcontrollers and other small package devices. The MCU vendor determines the debug feature
configuration, therefore debug features can differ across different devices and families.
The processor provides instruction and data trace and profiling support. To enable simple and cost-effective
profiling of the resulting system events, a Serial Wire Viewer (SWV) can export a stream of software-generated
messages, data trace, and profiling information through a single pin.
The Breakpoint Unit (BPU) supports eight hardware breakpoint comparators and the Data Watchpoint and Trace
(DWT) eight watchpoint comparators, which debuggers can use.

1.3.4 Cortex®-M33 processor features and benefits summary

The Cortex®-M33 processor benefits include tight integration of system peripherals that reduces area and
development costs, T32 instruction set that combines high code density with 32-bit performance, and IEEE754-
compliant single-precision Floating-Point Unit (FPU).
Other processor features and benefits are:
• Power control optimization of system components.
• Integrated sleep modes for low power consumption.
• Armv8‑M Security Extension.
• Fast code execution permits slower processor clock or increases sleep mode time.
• Hardware integer division and fast multiply accumulate for digital signal processing.
• Saturating arithmetic for signal processing.
• Deterministic, high-performance interrupt handling for time-critical applications.
• MPU and SAU for safety-critical applications.
• Extensive debug and trace capabilities.

PM0264 - Rev 2 page 5/232

 PM0264
About the Cortex®-M33 processor and core peripherals

1.3.5 Cortex®-M33 processor core peripherals

The Cortex®-M33 processor has the following core peripherals:
Nested Vectored Interrupt The NVIC is an embedded interrupt controller that supports low-latency interrupt processing.
Controller
System Control Space The SCS is the programmer's model interface to the processor. It provides system
implementation information and system control.
System timer The system timer, SysTick, is a 24 bit count-down timer. Use this as a Real Time Operating
System (RTOS) tick timer or as a simple counter. In an implementation with the Security
Extension, there are two SysTicks, one Secure and one Non-secure.
Security Attribution Unit The SAU improves system security by defining security attributes for different regions. It
provides eight different regions and a default background region.
Memory Protection Unit The MPU improves system reliability by defining the memory attributes for different memory
regions. It provides up to 8 different regions, and an optional predefined background region.
There can be two MPUs, one Secure (8 regions) and one Non-secure (8 regions). Each MPU
can define memory attributes independently.
Floating-point Unit The Floating-point Unit (FPU) provides IEEE754-compliant operations on 32-bit single-
precision floating-point values.

PM0264 - Rev 2 page 6/232

 PM0264
The Cortex®-M33 processor

2 The Cortex®-M33 processor

This chapter provides the reference material for the Cortex®-M33 processor description in a User Guide.
It contains the following sections:

2.1 Programmer's model

The programmer's model describes the modes, privilege levels, Security states, stacks and core registers
available for software execution.

2.1.1 Processor modes and privilege levels for software execution

The processor modes are:
Thread mode Intended for applications.
The processor enters Thread mode out of reset and returns to Thread mode on completion of
an exception handler.
Handler mode Intended for OS execution.
All exceptions cause entry into Handler mode.

Privilege levels
There are two levels of privilege:
Unprivileged Software has limited access to system resources.
Privileged Software has full access to system resources, subject to security restrictions.

In Thread mode, the CONTROL register controls whether software execution is privileged or unprivileged. In
Handler mode, software execution is always privileged.
Only privileged software can write to the CONTROL register to change the privilege level for software execution in
Thread mode. Unprivileged software can use the SVC instruction to make a Supervisor Call to transfer control to
privileged software.

2.1.2 Security states

There are two Security states, Secure and Non-secure.
Security states are orthogonal to mode and privilege. Therefore each Security state supports execution in both
modes and both levels of privilege.

2.1.3 Core registers

The Cortex®‑M33 core registers comprise the general-purpose registers, stack pointer, link register, Program
Counter, and special registers.
The following figures and tables illustrate the core registers of the Cortex®‑M33 processor:
• Without the Security Extension.
• With the Security Extension.

PM0264 - Rev 2 page 7/232

 PM0264
Programmer's model

Figure 3. Core registers without the Security Extension

R0
R1
R2
R3
Low registers
R4
R5
R6 General purpose registers
R7
R8
R9
High registers R10 Banked stack pointers
R11
R12
Active Stack Pointer SP (R13) PSP MSP
Link Register LR (R14)
Program Counter PC (R15)
Combined Program Status Registers xPSR
PRIMASK
Exception mask registers FAULTMASK
Special registers BASIPRI
Control Register CONTROL

PSPLIM
Stack Pointer Limit registers
MSPLIM

Table 2. Core register set summary without the Security Extension

Required
Name Type(1) Reset value Description
privilege(2)

R0-R12 RW Either UNKNOWN Section 2.1.3.1 General-purpose registers

MSP RW Either -(3)

Section 2.1.3.2 Stack Pointer
PSP RW Either UNKNOWN

LR RW Either 0xFFFFFFFF Section 2.1.3.4 Link Register

PC RW Either -(3) Section 2.1.3.5 Program Counter

xPSR (includes
Section 2.1.3.6 Combined Program Status
APSR, IPSR, and RW Either -fn(4)
Register
EPSR)
Section 2.1.3.6.1 Application Program Status
APSR RW Either UNKNOWN
Register
Section 2.1.3.6.2 Interrupt Program Status
IPSR RO Privileged 00000000
Register
Section 2.1.3.6.3 Execution Program Status
EPSR RO Privileged -(4)
Register.
PRIMASK RW Privileged 00000000 Section 2.1.3.7.1 Priority Mask Register
FAULTMASK RW Privileged 00000000 Section 2.1.3.7.2 Fault Mask Register
BASEPRI RW Privileged 00000000 Section 2.1.3.7.3 Base Priority Mask Register
CONTROL RW Privileged 00000000 Section 2.1.3.8 CONTROL register
PSPLIM RW Privileged
00000000 Section 2.1.3.3 Stack limit registers
MSPLIM RW Privileged

1. Describes access type during program execution in Thread mode and Handler mode. Debug access can differ.
2. An entry of Either means privileged and unprivileged software can access the register.
3. Soft reset to the value retrieved by the reset handler
4. Bit[24] is the T-bit and is loaded from bit[0] of the reset vector. All other bits are reset to 0.

PM0264 - Rev 2 page 8/232

 PM0264
Programmer's model

Figure 4. Core registers with the Security Extension

R0
R1
R2
R3
Low registers
R4
R5
R6 General purpose registers
R7
R8
R9 Banked stack pointers
High registers R10
R11
R12 PSP_S PSP_NS
Active Stack Pointer SP (R13) MSP_S MSP_NS
Link Register LR (R14)
Program Counter PC (R15)
Combined Program Status Registers xPSR
PRIMASK PRIMASK_S PRIMASK_NS
Exception mask registers FAULTMASK FAULTMASK_S FAULTMASK_NS
Special registers BASIPRI BASIPRI_S BASIPRI_NS
Control Register CONTROL CONTROL_S CONTROL_NS

PSPLIM PSPLIM_S PSPLIM_NS

Stack Pointer Limit registers
MSPLIM MSPLIM_S MSPLIM_NS

Banked special registers

Table 3. Core register set summary with the Security Extension

Required
Name Type(1) Reset value Description
privilege(2)

R0-R12 RW Either UNKNOWN Section 2.1.3.1 General-purpose registers.

MSP_S Either
RW (3)
MSP_NS Either
Section 2.1.3.2 Stack Pointer
PSP_S Either
RW UNKNOWN
PSP_NS Either

LR RW Either UNKNOWN Section 2.1.3.4 Link Register

PC RW Either (3) Section 2.1.3.5 Program Counter

xPSR (includes APSR, (4) Section 2.1.3.6 Combined Program Status

RW Either
IPSR, and EPSR) Register
Section 2.1.3.6.1 Application Program Status
APSR RW Either UNKNOWN
Register.
Section 2.1.3.6.2 Interrupt Program Status
IPSR RO Privileged 0x00000000
Register

(4) Section 2.1.3.6.3 Execution Program Status

EPSR RO Privileged
Register
PRIMASK_S Privileged 0x00000000
RW Section 2.1.3.7.1 Priority Mask Register
PRIMASK_NS Privileged 0x00000000
FAULTMASK_S Privileged 0x00000000
RW Section 2.1.3.7.2 Fault Mask Register
FAULTMASK_NS Privileged 0x00000000
BASEPRI_S Privileged 0x00000000
RW Section 2.1.3.7.3 Base Priority Mask Register
BASEPRI_NS Privileged 0x00000000
CONTROL_S RW Privileged 0x00000000 Section 2.1.3.8 CONTROL register

PM0264 - Rev 2 page 9/232

 PM0264
Programmer's model

Required
Name Type(1) Reset value Description
privilege(2)

CONTROL_NS RW Privileged 0x00000000 Section 2.1.3.8 CONTROL register

MSPLIM_S Privileged 0x00000000

RW
MSPLIM_NS Privileged 0x00000000
Section 2.1.3.3 Stack limit registers
PSPLIM_S Privileged 0x00000000
RW
PSPLIM_NS Privileged 0x00000000

1. Describes access type during program execution in Thread mode and Handler mode. Debug access can differ.
2. An entry of Either means privileged and unprivileged software can access the register.
3. Soft reset to the value retrieved by the reset handler.
4. Bit[24] is the T-bit and is loaded from bit[0] of the reset vector. All other bits are reset to 0.

2.1.3.1 General-purpose registers

R0-R12 are 32-bit general-purpose registers for data operations.

2.1.3.2 Stack Pointer

The stack pointer (SP) is register R13.
The processor uses a full descending stack, meaning the Stack Pointer holds the address of the last stacked item
in memory. When the processor pushes a new item onto the stack, it decrements the Stack Pointer and then
writes the item to the new memory location.
When Security state is implemented, software must initialize MSP_NS.

Table 4. Stack pointer register without the Security Extension

Stack Stack pointer register

Main MSP
Process PSP

In Thread mode, the CONTROL.SPSEL bit indicates the stack pointer to use.
0 Main stack pointer (MSP). This is the reset value.
1 Process stack pointer (PSP)

Table 5. Stack pointer register with the Security Extension

Stack stack pointer register

Main MSP_S
Secure
Process PSP_S
Main MSP_NS
Non-secure
Process PSP_NS

PM0264 - Rev 2 page 10/232

 PM0264
Programmer's model

In Non-secure Thread mode, the CONTROL_NS.SPSEL bit indicates the stack pointer to use:
0 Main stack pointer (MSP_NS). This is the reset value.
1 Process stack pointer (PSP_NS).

In Non-secure Handler mode, the MSP_NS is always used.

In Secure Thread mode, the CONTROL_S.SPSEL bit indicates the stack pointer to use:
0 Main stack pointer (MSP_S). This is the reset value.
1 Process stack pointer (PSP_S).

In Secure Handler mode, the MSP_S is always used.

The current Security state of the processor determines whether the Secure or Non-secure stacks are used.
To ensure that stacks do not overrun, the processor has stack limit check registers that can be programmed to
define the bounds for each of the implemented stacks.

2.1.3.3 Stack limit registers

The stack limit registers define the lower limit for the corresponding stack. The processor raises an exception on
most instructions that attempt to update the stack pointer below its defined limit.
The Cortex®‑M33 processor has two stack limit registers, as the following table shows.
If the Security Extension is not implemented, the Cortex®‑M33 processor has two stack limit registers, as the
following table shows.

Table 6. Stack limit registers without the Security Extension

Stack Stack limit register

Main MSPLIM
Process PSPLIM

The Cortex®‑M33 processor has four stack limit registers, as the following table shows.

Table 7. Stack limit registers with the Security Extension

Security state Stack Stack limit register

Main MSPLIM_S
Secure
Process PSPLIM_S
Main MSPLIM_NS
Non-secure
Process PSPLIM_NS

Note: The four stack limit registers are banked between Security states.
See Table 2. Core register set summary without the Security Extension table for the stack limit registers attributes.
The bit assignments for the MSPLIM and PSPLIM registers are as follows:
31 3 2 0

LIMIT RES0

Table 8. MSPLIM and PSPLIM register bit assignments

Bits Name Function

Main stack limit or process stack limit address for the selected Security state. Limit address for the selected
[31:3] LIMIT
stack pointer.

PM0264 - Rev 2 page 11/232

 PM0264
Programmer's model

Bits Name Function

[2:0] - Reserved, res0.

2.1.3.4 Link Register

The Link Register (LR) is register R14. It stores the return information for subroutines, function calls, and
exceptions. On reset, the processor sets the LR value to 0xFFFFFFFF.

2.1.3.5 Program Counter

The Program Counter (PC) is register R15. It contains the current program address.
On reset, the processor loads the PC with the value of the reset vector defined in the vector table.

2.1.3.6 Combined Program Status Register

The Combined Program Status Register (xPSR) consists of the Application Program Status Register (APSR),
Interrupt Program Status Register (IPSR), and Execution Program Status Register (EPSR).
These registers are mutually exclusive bit fields in the 32-bit PSR. The bit assignments are as follows:
31 30 29 28 27 26 25 24 23 20 19 16 15 10 9 8 0

APSR N Z C V Q Reserved GE[3:0] Reserved

IPSR Reserved ISR_NUMBER

EPSR Reserved IT/ICI T Reserved IT/ICI Reserved

Access these registers individually or as a combination of any two or all three registers, using the register name
as an argument to the MSR or MRS instructions. For example:
• Read all the registers using PSR with the MRS instruction.
• Write to the APSR N, Z, C, V, and Q bits using APSR_nzcvq with the MSR instruction.
The PSR combinations and attributes are:

Table 9. xPSR register combinations

Register Type Combination

xPSR RW(1)(2) APSR, EPSR, and IPSR

IEPSR RO(2) EPSR and IPSR

IAPSR RW(1) APSR and IPSR

EAPSR RW(2) APSR and EPSR

1. The processor ignores writes to the IPSR bits.

2. Reads of the EPSR bits return zero, and the processor ignores writes to these bits.

See the MRS and MSR instruction descriptions for more information about how to access the Program Status
Registers.

2.1.3.6.1 Application Program Status Register

The APSR contains the current state of the condition flags from previous instruction executions.
See Table 2. Core register set summary without the Security Extension for the APSR attributes.
The APSR bit assignments are as follows:

Table 10. APSR bit assignments

Bits Name Description

[31] N Negative flag.

PM0264 - Rev 2 page 12/232

 PM0264
Programmer's model

Bits Name Description

[30] Z Zero flag.

[29] C Carry or borrow flag.
[28] V Overflow flag.
[27] Q DSP overflow and saturation flag.
[26:20] - Reserved.
[19:16] GE[3:0] Greater than or Equal flags. See Section 3.4.11 SEL for more information.
[15:0] - Reserved.

2.1.3.6.2 Interrupt Program Status Register

The IPSR contains the exception number of the current ISR.
The bit assignments are:

Table 11. IPSR bit assignments

Bits Name Function

[31:9] - Reserved.
This is the number of the current exception:
0 = Thread mode.
1 = Reset.
2 = NMI.
3 = HardFault.
4 = MemManage.
5 = BusFault.
6 = UsageFault
7 = SecureFault
8-10 = Reserved.
[8:0] Exception number 7-10 = Reserved.
11 = SVCall.
12 = DebugMonitor.
13 = Reserved.
14 = PendSV.
15 =SysTick
16 = IRQ0.
.
.
.
495 = IRQ479.

The active bits in the Exception number field depend on the number of interrupts implemented.
0-47 interrupts = [5:0].
48-111 interrupts = [6:0].
112-239 interrupts = [7:0].
240-479 interrupts = [8:0].

PM0264 - Rev 2 page 13/232

 PM0264
Programmer's model

2.1.3.6.3 Execution Program Status Register

The EPSR contains the Thumb state bit and the execution state bits for the If-Then (IT) instruction, and
Interruptible-Continuable Instruction (ICI) field for an interrupted load multiple or store multiple instruction.
See the Table 2. Core register set summary without the Security Extension for the EPSR attributes.
The following table shows the EPSR bit assignments.

Table 12. EPSR bit assignments

Bits Name Function

[31:27] - Reserved
[26:25], [15:10] ICI Interruptible-continuable instruction bits, see Section 2.1.3.6.4 Interruptible-continuable instructions

[26:25], [15:10] IT Indicates the execution state bits of the IT instruction, see Section 3.9.5 IT

[24] T Thumb state bit, see Section 2.1.3.6.6 Thumb state

[23:16] - Reserved
[9:0] - Reserved

Attempts to read the EPSR directly through application software using the MSR instruction always return zero.
Attempts to write the EPSR using the MSR instruction in application software are ignored.

2.1.3.6.4 Interruptible-continuable instructions

When an interrupt occurs during the execution of an LDM, STM, PUSH, POP, VLDM, VSTM, VPUSH, or VPOP
instruction, the processor can stop the load multiple or store multiple instruction operation temporarily, storing the
next register operand in the multiple operation to be transferred into EPSR[15:12].
After servicing the interrupt, the processor resumes execution of the load or store multiple, starting at the register
stored in EPSR[15:12].
When the EPSR holds ICI execution state, bits[26:25,11:10] are zero.
Note: There might be cases where the processor cannot pause and resume load or store multiple instructions in this
way. When this happens, the processor restarts the instruction from the beginning on return from the interrupt.
As a result, your software should never use load or store multiple instructions to memory that is not robust to
repeated accesses.

2.1.3.6.5 If-Then block

The If-Then block contains up to four instructions following an IT instruction. Each instruction in the block is
conditional. The conditions for the instructions are either all the same, or some can be the inverse of others.
Note: Interruptible-continuable operation is not supported when the load multiple or store multiple instructions are
located inside an If-Then block. In these cases, the processor can take an interrupt part-way through the load or
store multiple instruction, restarting it from the beginning on return from the interrupt.

2.1.3.6.6 Thumb state

The Cortex®‑M33 processor only supports execution of instructions in Thumb state.
The following can modify the T bit in the EPSR:
• Instructions BLX, BX, LDR pc, [], and POP{PC}.
• Restoration from the stacked xPSR value on an exception return.
• Bit[0] of the vector value on an exception entry or reset.
Attempting to execute instructions when the T bit is 0 results in a fault or lockup. See Section 2.6.4 Lockup for
more information.

2.1.3.7 Exception mask registers

The exception mask registers disable the handling of exceptions by the processor. For example, you might want
to disable exceptions when running timing critical tasks.

PM0264 - Rev 2 page 14/232

 PM0264
Programmer's model

To access the exception mask registers use the MSR and MRS instructions, or the CPS instruction to change the
value of PRIMASK.PM or FAULTMASK.FM.

2.1.3.7.1 Priority Mask Register

The PRIMASK register is intended to disable interrupts by preventing activation of all exceptions with configurable
priority in the current Security state.
See Table 2. Core register set summary without the Security Extension table for the PRIMASK attributes.
The bit assignments for the PRIMASK register are as follows:

31 1 0

RES0

PM

Table 13. PRIMASK register bit assignments

Bits Name Function

[31:1] - Reserved, res0.

Setting this bit to one boosts the current execution priority to 0, masking all exceptions with a programmable
priority.
Setting PRIMASK_S to one boosts the current execution priority to 0. If AIRCR.PRIS is:

[0] PM 0 Setting PRIMASK_NS to one boosts the current execution priority to 0.

1 Setting PRIMASK_NS to one boosts the current execution priority to 80.

When the current execution priority is boosted to a particular value, all exceptions with a lower or equal priority
are masked.

2.1.3.7.2 Fault Mask Register

The FAULTMASK register prevents activation of all exceptions with configurable priority and also some
exceptions with fixed priority depending on the value of AIRCR.BFHFNMINS and AIRCR.PRIS.
See Table 2. Core register set summary without the Security Extension table for the FAULTMASK register
attributes.
The bit assignments for the FAULTMASK register are as follows:

31 1 0

RES0

FM

PM0264 - Rev 2 page 15/232

 PM0264
Programmer's model

Table 14. FAULTMASK register bit assignments

Bits Name Function

[31:1] - Reserved, res0

When TrustZone is disabled, setting this bit to one boosts the current execution priority to -1, masking all
exceptions except NMI.
When TrustZone is enabled, setting this bit to one boosts the current execution priority to -1, masking all
exceptions with a lower priority. If
AIRCR.BFHFNMINS is:
Setting FAULTMASK_S to one boosts the current execution priority to -1.
If AIRCR.PRIS is:
[0] FM 0
0: Setting FAULTMASK_NS to one boosts the current execution priority to 0
1: Setting FAULTMASK_NS to one boosts the current execution priority to 80
Setting FAULTMASK_S to one boosts the current execution priority to -3.
1
Setting FAULTMASK_NS to one boosts the current execution priority to -1.

When the current execution priority is boosted to a particular value, all exceptions with a lower or equal
priority are masked.

2.1.3.7.3 Base Priority Mask Register

Use the BASEPRI register to change the priority level that is required for exception preemption.
See Table 2. Core register set summary without the Security Extension table for the BASEPRI register attributes.
The bit assignments for the BASEPRI register are as follows:

31 8 7 0

RES0 BASEPRI

Table 15. BASEPRI register bit assignments

Bits Name Function

[31:8] - Reserved, res0

Software can set BASEPRI to a priority number between 1 and the maximum supported priority number.
Software can set BASEPRI_S to a priority number between 1 and the maximum supported priority
number. If AIRCR.PRIS is:
Software can set BASEPRI_NS to a priority number between 1 and the
0
maximum supported priority number.

[7:0] BASEPRI (1) Software can set BASEPRI_NS to a priority number between 1 and the
maximum supported priority number. The value in BASEPRI_NS is then
1 mapped to the bottom half of the priority range, so that the current execution
priority is boosted to the mapped-to value in the bottom half of the priority
range.

When the current execution priority is boosted to a particular value, all exceptions with a lower priority
are masked. Writing 0 to BASEPRI disables base priority boosting.

1. This field is similar to the priority fields in the interrupt priority registers. If the device implements only bits[7:M] of this field,
bits[M-1:0] read as zero and ignore writes. See Section 4.2.7 Interrupt Priority Registers for more information. Remember
that higher priority field values correspond to lower exception priorities.

2.1.3.8 CONTROL register

The CONTROL register controls the stack that is used, the privilege level for software execution when the core is
in Thread mode and indicates whether the FPU state is active.

PM0264 - Rev 2 page 16/232

 PM0264
Programmer's model

See Table 2. Core register set summary without the Security Extension table for the CONTROL register attributes.
This register is banked between Security states on a bit by bit basis.
The bit assignments for the CONTROL register are as follows:

31 4 3 2 1 0

RES0

SFPA nPRIV
FPCA SPSEL

Table 16. CONTROL register bit assignments

Bits Name Function

[31:4] - Reserved, res0

Indicates that the floating-point registers contain active state that belongs to the Secure state:
0 The floating-point registers do not contain state that belongs to the Secure state.
[3] SFPA
1 The floating-point registers contain state that belongs to the Secure state.

This bit is not banked between Security states and RAZ/WI from Non-secure state.
Indicates whether floating-point context is active:
0 No floating-point context active.

[2] FPCA 1 Floating-point context active.

This bit is used to determine whether to preserve floating-point state when processing an exception.
This bit is not banked between Security states.
Defines the currently active stack pointer:
0 MSP is the current stack pointer.
1 PSP is the current stack pointer.
[1] SPSEL
In Handler mode, this bit reads as zero and ignores writes. The Cortex®‑M33 core updates this bit
automatically on exception return.
This bit is banked between Security states.
Defines the Thread mode privilege level:
0 Privileged.
[0] nPRIV
1 Unprivileged.

This bit is banked between Security states.

Handler mode always uses the MSP, so the processor ignores explicit writes to the active stack pointer bit of the
CONTROL register when in Handler mode. The exception entry and return mechanisms automatically update the
CONTROL register based on the EXC_RETURN value.
In an OS environment, Arm® recommends that threads running in Thread mode use the process stack and the
kernel and exception handlers use the main stack.
By default, Thread mode uses the MSP. To switch the stack pointer that is used in Thread mode to the PSP,
either:
• Use the MSR instruction to set the CONTROL.SPSEL bit, the current active stack pointer bit, to 1.
• Perform an exception return to Thread mode with the appropriate EXC_RETURN value.
Note: When changing the stack pointer, software must use an ISB instruction immediately after the MSR instruction.
This ensures that instructions after the ISB instruction execute using the new stack pointer.

PM0264 - Rev 2 page 17/232

 PM0264
Cortex® M33 configurations

2.1.4 Exceptions and interrupts

The Cortex®‑M33 processor implements all the logic required to handle and prioritize interrupts and other
exceptions. Software can control this prioritization using the NVIC registers. All exceptions are vectored and
except for reset, handled in Handler mode. Exceptions can target either Security state.
The NVIC registers control interrupt handling.
Related reference
Section 4.2 Nested Vectored Interrupt Controller

2.1.5 Data types and data memory accesses

The Cortex®‑M33 processor manages all data memory accesses as little-endian.
The processor supports the following data types:
• 32-bit words.
• 16-bit halfwords.
• 8-bit bytes.
• 32-bit single-precision floating-point numbers.
• 64-bit double-precision floating-point numbers.

2.1.6 The Cortex Microcontroller Software Interface Standard

The Cortex Microcontroller Software Interface Standard (CMSIS) simplifies software development by enabling the
reuse of template code and the combination of CMSIS-compliant software components from various middleware
vendors. Vendors can expand the CMSIS to include their peripheral definitions and access functions for those
peripherals.
For a Cortex®‑M33 microcontroller system, the CMSIS defines:
• A common way to:
– Access peripheral registers.
– Define exception vectors.
• The names of:
– The registers of the core peripherals.
– The core exception vectors.
• A device-independent interface for RTOS kernels, including a debug channel.
The CMSIS includes address definitions and data structures for the core peripherals in the Cortex®‑M33
processor.
This document includes the register names defined by the CMSIS, and short descriptions of the CMSIS functions
that address the processor core and the core peripherals.
Note: This document uses the register short names that are defined by the CMSIS. In a few cases these short names
differ from the architectural short names that might be used in other documents.

2.2 Cortex® M33 configurations

Table 17 shows the configuration for the STM32L5 and STM32U5 Series Cortex® M33.

Table 17. STM32L5xx and STM32U5xx Cortex® M33 configuration

Features STM32L5xx STM32U5xx

Security extension (TrustZone®) Yes(1)

DSP Yes
Floating Point Unit Yes, single precision floating point unit
MPU MPU secure (8 regions), MPU non-secure (8 regions)
SAU 8 regions
Interrupt priority levels 8 16

PM0264 - Rev 2 page 18/232

 PM0264
Memory model

Features STM32L5xx STM32U5xx

Number of IRQ 109 Up to 141
WIC Not implemented
CTI Yes
Debug JTAG and serial-wire debug ports 8 breakpoints and 4 watchpoints.
ITM support Data trace (DWT), and instrumentation trace (ITM)
ETM support Instruction trace interface

1. The TrustZone® is enabled by setting the TZEN option bit.

2.3 Memory model

The Cortex®-M33 processor has a fixed default memory map that provides up to 4GB of addressable memory.

2.3.1 Processor memory map

The Cortex‑M33 processor memory map.

Figure 5. Cortex‑M33 processor memory map

0xFFFFFFFF

Vendor-specific
511MB
memory

0xE0100000
Private peripheralbus 0xE00FFFFF
1MB
0xE0000000
0xDFFFFFFF

External device 1.0GB

0xA0000000
0x9FFFFFFF

External RAM 1.0GB

0x60000000
0x5FFFFFFF

Peripheral 0.5GB

0x40000000
0x3FFFFFFF

SRAM 0.5GB

0x20000000
0x1FFFFFFF

Code 0.5GB

0x00000000

The processor reserves regions of the Private peripheral bus (PPB) address range for core peripheral registers.

PM0264 - Rev 2 page 19/232

 PM0264
Memory model

2.3.2 Memory regions, types, and attributes

The memory map and the programming of the Secure and Non-secure MPUs splits memory into regions. If your
implementation has an MPU or has the Security Extension MPUs, programming the relevant MPUs splits memory
into regions.
The memory types are:
Normal The processor can reorder transactions for efficiency, or perform Speculative reads.
Device The processor preserves transaction order relative to other transactions to Device memory.

The additional memory attributes include:

Shareable For a shareable memory region, the memory system might provide data synchronization
between bus masters in a system with multiple bus masters, for example, a processor with
a DMA controller.
If multiple bus masters can access a Non-shareable memory region, software must ensure data
coherency between the bus masters.
Device memory is always Shareable.
<This description is required only if the device is likely to be used in systems where memory is
shared between multiple processors.>
Execute Never (XN) Means that the processor prevents instruction accesses. A MemManage fault exception is
generated on executing an instruction fetched from an XN region of memory.

2.3.3 Device memory

Device memory must be used for memory regions that cover peripheral control registers. Some of the
optimizations that are permitted for Normal memory, such as access merging or repeating, can be unsafe for
a peripheral register.
The Device memory type has several attributes:
G or nG Gathering or non-Gathering. Multiple accesses to a device can be merged into a single
transaction except for operations with memory ordering semantics, for example, memory barrier
instructions, load acquire/store release.
R or nR Reordering or non-Reordering.
E or nE Early Write Acknowledgement or no Early Write Acknowledgement.

For the Cortex‑M33 processor, only two combinations of these attributes are valid:
• Device-nGnRnE.
• Device-nGnRE.
Note: • Device-nGnRnE is equivalent to Armv7‑M Strongly Ordered memory type
• Device-nGnRE is equivalent to Armv7‑M Device memory.
• Device-nGRE and Device-GRE are new to the Armv8‑M architecture.
Typically, peripheral control registers must be either Device-nGnRE or Device-nGnRnE to prevent reordering of
the transactions in the programming sequences.
Note: Device memory is shareable, and must not be cached.

2.3.4 Secure memory system and memory partitioning

In an implementation with the Security Extension, the Security Attribution Unit (SAU) and Implementation Defined
Attribution Unit (IDAU) partition the 4GB memory space into Secure and Non-secure memory regions.
Note: The partitioning of the memory into Secure and Non-secure regions is independent of the Security state that the
processor executes in. See Section 2.5 Security state switches for more information on Security state.
Secure memory Secure addresses are used for memory and peripherals that are only accessible by Secure
partitioning software or Secure masters. Transactions are deemed to be secure if they are to an address
that is defined as Secure. Illegitimate accesses that are made by Non-secure software to
Secure memory are blocked and raise an exception.

PM0264 - Rev 2 page 20/232

 PM0264
Memory model

Non-secure Callable (NSC) NSC is a special type of Secure location that is permitted to hold an SG instruction to enable
software to transition from Non-secure to Secure state. The inclusion of NSC memory locations
removes the need for Secure software creators to allow for the accidental inclusion of SG
instructions, or data sharing encoding values, in normal Secure memory by restricting the
functionality of the SG instruction to NSC memory only.

Non-secure (NS) Non-secure addresses are used for memory and peripherals accessible by all software running
on the device.
Transactions are deemed to be Non-secure if they are to an address that is defined as Non-
Secure.
Note: Transactions are deemed to be Non-secure even if secure software performs the access.
Memory accesses initiated by Secure software to regions marked as Non-secure in the SAU
IDAU are marked as Non-secure on the AHB bus.

The MPU is banked between Secure and Non-secure memory. For instructions fetches, addresses that are
Secure are subject to the Secure MPU settings. Addresses that are Non-secure are subject to the Non-secure
MPU settings. For data loads and data stores, accesses depend on the Security state of the processor. For
example, if the processor is in Secure state the access is subject to the Secure MPU settings. If the processor is
in Non-secure state the access is subject to the Non-secure MPU settings.

2.3.5 Behavior of memory accesses

Summary of the behavior of accesses to each region in the memory map.

Table 18. Memory access behavior

Address range Memory region Memory type  Shareability XN Description

Executable region for program code.

0x00000000-0x1FFFFFFF Code Normal Non-shareable -
You can also put data here.
Executable region for data. You can
0x20000000-0x3FFFFFFF SRAM Normal Non-shareable -
also put code here.
Device,
0x40000000-0x5FFFFFFF Peripheral Shareable XN On-chip device memory.
nGnRE
0x60000000-0x9FFFFFFF RAM Normal Non-shareable - Executable region for data.
Device,
0xA0000000-0xDFFFFFFF External device  Shareable XN External device memory.
nGnRE
This region includes the SCS, NVIC,
Private Peripheral Device,
0xE0000000-0xE003FFFF Shareable XN MPU, SAU, BPU, ITM, and DWT
Bus nGnRnE
registers.
This region is for debug components
Device,
0xE0040000-0xE0043FFF Device Shareable XN and can include the ETM, CTI, and
nGnRnE
TPIU configuration registers or none.
Private Peripheral Device,
0xE0044000-0xE00FFFFFF Shareable XN This region includes the ROM tables.
Bus nGnRnE
Device,
0xE0100000-0xFFFFFFFFF Vendor_SYS Shareable XN Vendor specific.
nGnRE

Note: For more information on memory types, see Section 2.3.2 Memory regions, types, and attributes.
The Code, SRAM, and RAM regions can hold programs.
The MPU can override the default memory access behavior described in this section.

2.3.5.1 Additional memory access constraints for caches and shared memory
When a system includes caches or shared memory, some memory regions have additional access constraints,
and some regions are subdivided.
This behavior is shown by the following table:

PM0264 - Rev 2 page 21/232

 PM0264
Memory model

Table 19. Memory region shareability and cache policies

Address range Memory region Memory type  Shareability  Cache policy 

0x00000000-0x1FFFFFFF Code Normal - WT 

0x20000000-0x3FFFFFFF SRAM Normal - WBWA

0x40000000-0x5FFFFFFF Peripheral  Device Shareable -

0x60000000-0x7FFFFFFF WBWA
RAM Normal -
0x80000000-0x9FFFFFFF WT
0xA0000000-0xDFFFFFFF External device  Device Shareable -
0xE0000000-0xE003FFFF Private Peripheral Bus Device Shareable -
0xE0040000-0xE0043FFF Device Device Shareable -
0xE0044000-0xE00EFFFF Private Peripheral Bus - Shareable Device
0xF0000000-0xFFFFFFFF Vendor_SYS Device Shareable Device
Note: For more information on memory types and shareability, see Section 2.3.2 Memory regions, types, and
attributes.

2.3.6 Software ordering of memory accesses

The order of instructions in the program flow does not always guarantee the order of the corresponding memory
transactions.
In the Cortex‑M33 processor this behavior can occur because of two reasons:
• Memory or devices in the memory map might have different wait states.
• Some memory accesses associated with instruction fetches are speculative.
Section 2.3.3 Device memory describes the cases where the memory system guarantees the order of
memory accesses. Otherwise, if the order of memory accesses is critical, software must include memory barrier
instructions to force that ordering.
The processor provides the following memory barrier instructions:
DMB The Data Memory Barrier (DMB) instruction ensures that outstanding memory transactions
complete before subsequent memory transactions.
DSB The Data Synchronization Barrier (DSB) instruction ensures that outstanding memory
transactions complete before subsequent instructions execute.
ISB The Instruction Synchronization Barrier (ISB) ensures that the effect of any context-changing
operations is recognizable by subsequent instructions.

The following are examples of using memory barrier instructions:

Exception vector and If the program changes an entry in the vector table, and then enables the corresponding
vector table programming exception, use a DMB instruction between the operations. This ensures that if the exception is
taken immediately after being enabled, then the processor uses the new exception vector.
If the program updates the value of the VTOR, use a DMB instruction to ensure that the new
vector table is used for subsequent exceptions.
Self-modifying code If a program contains self-modifying code, use a DSB instruction followed by an ISB instruction
immediately after the code modification in the program. This ensures subsequent instruction
execution uses the updated program.
Memory map switching If the system contains a memory map switching mechanism, use a DSB instruction followed
by an ISB instruction after switching the memory map. This ensures subsequent instruction
execution uses the updated memory map.
MPU programming Use a DSB followed by an ISB instruction or exception return to ensure that the new MPU
configuration is used by subsequent instructions.
SAU programming Use a DSB followed by an ISB instruction or exception return to ensure that the SAU
configuration is used by subsequent instructions.

PM0264 - Rev 2 page 22/232

 PM0264
Memory model

2.3.7 Memory endianness

The processor views memory as a linear collection of bytes numbered in ascending order from zero. For example,
bytes 0-3 hold the first stored word, and bytes 4-7 hold the second stored word. Little-endian format in Figure 6
describes how words of data are stored in memory.
Little-endian format
In little-endian format, the processor stores the least significant byte (lsbyte) of a word at the lowest-numbered
byte, and the most significant byte (msbyte) at the highest-numbered byte.

Figure 6. Little-endian example

Memory Register
7 0

31 24 23 16 15 8 7 0
Address A B0 lsbyte B3 B2 B1 B0

A+1 B1

A+2 B2

A+3 B3 msbyte

2.3.8 Synchronization primitives

The instruction set support for the processor includes pairs of synchronization primitives. These provide a non-
blocking mechanism that a thread or process can use to obtain exclusive access to a memory location. Software
can use them to implement semaphores or an exclusive read-modify-write memory sequence.

Instructions in synchronization primitives

A pair of synchronization primitives contains the following:
A Load-Exclusive Used to read the value of a memory location, requesting exclusive access to that location.
instruction
A Store-Exclusive Used to attempt to write to the same memory location, returning a status bit to a register. If this
instruction bit is:

0 It indicates that the thread or process gained exclusive access to the memory, and the
write succeeded.

1 It indicates that the thread or process did not gain exclusive access to the memory, and no
write was performed.

Load-Exclusive and Store-Exclusive instructions

The pairs of Load-Exclusive and Store-Exclusive instructions are:
• The word instructions:
– LDAEX and STLEX.
– LDREX and STREX.
• The halfword instructions:
– LDAEXH and STLEXH.
– LDREXH and STREXH.
• The byte instructions:
– LDAEXB and STLEXB.
– LDREXB and STREXB.

PM0264 - Rev 2 page 23/232

 PM0264
Memory model

Performing an exclusive read-modify-write

Software must use a Load-Exclusive instruction with the corresponding Store-Exclusive instruction.
To perform an exclusive read-modify-write of a memory location, the software must:
1. Use a Load-Exclusive instruction to read the value of the location.
2. Modify the value, as required.
3. Use a Store-Exclusive instruction to attempt to write the new value back to the memory location.
4. Test the returned status bit. If this bit is:
0 The read-modify-write completed successfully.
1 No write was performed. This indicates that the value returned at step 1 might be out of date.
The software must retry the entire read-modify-write sequence.

Implementing a semaphore
The software can use the synchronization primitives to implement a semaphore as follows:
1. Use a Load-Exclusive instruction to read from the semaphore address to check whether the semaphore is
free.
2. If the semaphore is free, use a Store-Exclusive to write the claim value to the semaphore address.
3. If the returned status bit from step 2 indicates that the Store-Exclusive succeeded, then the software has
claimed the semaphore. However, if the Store-Exclusive failed, another process might have claimed the
semaphore after the software performed step 1.

Exclusive tags
The processor includes an exclusive access monitor, that tags the fact that the processor has executed a
Load-Exclusive instruction. If the processor is part of a multiprocessor system with a global monitor, and the
address is in a shared region of memory, then the system also globally tags the memory locations that are
addressed by exclusive accesses by each processor.
The processor clears its exclusive access tag if:
• It executes a CLREX instruction.
• It executes a STREX or STLEX instruction, regardless of whether the write succeeds.
• An exception occurs. This means that the processor can resolve semaphore conflicts between different
threads.
In a multiprocessor implementation:
• Executing a CLREX instruction clears only the local exclusive access tag for the processor.
• Executing a STREX or STLEX instruction, or an exception, clears the local exclusive access tags for the
processor.
• Executing a STREX or STLEX instruction to a Shareable memory region can also clear the global exclusive
access tags for the processor in the system.
For more information about the synchronization primitive instructions, see Section 3.12.10 LDREX and STREX
and Section 3.12.12 CLREX.
A global exclusive access can be performed:
• In a Shared region if the MPU is implemented.
• By setting ACTLR.EXTEXCLALL. In this case, exclusive information is always sent externally.
In any other case, exclusive information is not sent on the AHB bus, HEXCL is 0, and only the local monitor is
used.
If HEXCL is sent externally and there is no exclusive monitor for the corresponding memory region, then STREX
and STLEX fails.

2.3.9 Programming hints for the synchronization primitives

ISO/IEC C cannot directly generate the exclusive access instructions. CMSIS provides intrinsic functions for
generation of these instructions.

PM0264 - Rev 2 page 24/232

 PM0264
Exception model

Table 20. CMSIS functions for exclusive access instructions

Instruction CMSIS function

LDAEX uint16_t __LDAEX (volatile uint16_t * ptr)

LDAEXB uint8_t __LDAEXB (volatile uint8_t * ptr)
LDAEXH uint16_t __LDAEXH (volatile uint16_t * ptr)
LDREX uint32_t __LDREXW (uint32_t *addr)
LDREXB uint8_t __LDREXB (uint8_t *addr)
LDREXH uint16_t __LDREXH (uint16_t *addr)
STLEX uint16_t __STLEX (uint16_t value, volatile uint16_t * ptr)
STLEXB uint8_t __STLEXB (uint8_t value, volatile uint8_t * ptr)
STLEXH uint16_t __STLEXH (uint16_t value, volatile uint16_t * ptr)
STREX uint32_t __STREXW (uint32_t value, uint32_t *addr)
STREXB uint8_t __STREXB (uint8_t value, uint8_t *addr)
STREXH uint16_t __STREXH (uint16_t value, uint16_t *addr)
CLREX void __CLREX (void)

For example:
uint16_t value;
uint16_t *address = 0x20001002;
value = __LDREXH (address); // load 16-bit value from memory address 0x20001002

2.4 Exception model

This section contains information about different parts of the exception model such as exception types, exception
priorities and exception states.

2.4.1 Exception states

Each exception is in one of the following states.

Inactive The exception is not active and not pending.

Pending The exception is waiting to be serviced by the processor.
An interrupt request from a peripheral or from software can change the state of the
corresponding interrupt to pending.
Active An exception is being serviced by the processor but has not completed.
Note: An exception handler can interrupt the execution of another exception handler. In this case, both exceptions are
in the active state.
Active and The exception is being serviced by the processor and there is a pending exception from the
pending same source.

2.4.2 Exception types

This section describes the exception types for a processor with and without the Security Extension.
Reset The exception model treats reset as a special form of exception. When reset is asserted,
the operation of the processor stops, potentially at any point in an instruction. When either
power-on or warm reset is deasserted, execution restarts from the address provided by the
reset entry in the vector table. Execution restarts as privileged execution in Secure state in
Thread mode.
This exception is not banked between Security states.

PM0264 - Rev 2 page 25/232

 PM0264
Exception model

NMI A Non-Maskable Interrupt (NMI) can be signaled by a peripheral or triggered by software. It is

permanently enabled and has a fixed priority of -2. NMI can only be preempted by reset and,
when it is Non-secure, by a Secure HardFault.
If AIRCR.BFHFNMINS=0, then the NMI is Secure.
If AIRCR.BFHFNMINS=1, then NMI is Non-secure.
HardFault A HardFault is an exception that occurs because of an error during normal or exception
processing. HardFaults have a fixed priority of at least -1, meaning they have higher priority
than any exception with configurable priority.
This exception is not banked between Security states.
If AIRCR.BFHFNMINS=0, HardFault handles all faults that are unable to preempt the current
execution. The HardFault handler is always Secure.
If AIRCR.BFHFNMINS=1, HardFault handles faults that target Non-secure state that are unable
to preempt the current execution.
HardFaults that specifically target the Secure state when AIRCR.BFHFNMINS is set to 1 have
a priority of -3 to ensure they can preempt any execution. A Secure HardFault at Priority -3 is
only enabled when AIRCR.BFHFNMINS is set to 1. Secure HardFault handles Secure faults
that are unable to preempt current execution.
MemManage A MemManage fault is an exception that occurs because of a memory protection violation,
compared to the MPU or the fixed memory protection constraints, for both instruction and data
memory transactions. This fault is always used to abort instruction accesses to Execute Never
(XN) memory regions.
This exception is banked between Security states.
BusFault A BusFault is an exception that occurs because of a memory-related violation for an instruction
or data memory transaction. This might be from an error that is detected on a bus in the
memory system.
This exception is not banked between Security states.
If BFHFNMINS=0, BusFaults target the Secure state.
If BFHFNMINS=1, BusFaults target the Non-secure state.
UsageFault A UsageFault is an exception that occurs because of a fault related to instruction execution.
This includes:
• An undefined instruction.
• An illegal unaligned access.
• Invalid state on instruction execution.
• An error on exception return.
The following can cause a UsageFault when the core is configured by software to report them:
• An unaligned address on word and halfword memory access.
• Division by zero.
This exception is banked between Security states.
SecureFault This exception is triggered by the various security checks that are performed. It is triggered, for
example, when jumping from Non-secure code to an address in Secure code that is not marked
as a valid entry point. Most systems choose to treat a SecureFault as a terminal condition that
either halts or restarts the system. Any other handling of the SecureFault must be checked
carefully to make sure that it does not inadvertently introduce a security vulnerability.
SecureFaults always target the Secure state.
SVCall A Supervisor Call (SVC) is an exception that is triggered by the SVC instruction. In an OS
environment, applications can use SVC instructions to access OS kernel functions and device
drivers.
This exception is banked between Security states.
DebugMonitor A DebugMonitor exception. If Halting debug is disabled and the debug monitor is enabled, a
debug event causes a DebugMonitor exception when the group priority of the DebugMonitor
exception is greater than the current execution priority.

PM0264 - Rev 2 page 26/232

 PM0264
Exception model

PendSV PendSV is an asynchronous request for system-level service. In an OS environment, use

PendSV for context switching when no other exception is active.
This exception is banked between Security states.
SysTick A SysTick exception is an exception the system timer generates when it reaches zero. Software
can also generate a SysTick exception. In an OS environment, the processor can use this
exception as a system tick.
This exception is banked between Security states.
Interrupt (IRQ) An interrupt, or IRQ, is an exception signaled by a peripheral, or generated by a software
request. All interrupts are asynchronous to instruction execution. In the system, peripherals use
interrupts to communicate with the processor.
This exception is not banked between Security states. Secure code can assign each interrupt
to Secure or Non-secure state. By default all interrupts are assigned to Secure state.

Table 21. Properties of the different exception types with the Security Extension

Exception
IRQ number 
number  (see Exception type Priority Vector address Activation
(see notes)
notes)

1 - Reset -4, the highest 0x00000004 Asynchronous

2 -14 NMI -2 0x00000008 Asynchronous
Secure HardFault when
-3
AIRCR.BFHFNMINS is 1
3 -13 Secure HardFault when 0x0000000C Synchronous
-1
AIRCR.BFHFNMINS is 0
HardFault -1
4 -12 MemManage Configurable  0x00000010 Synchronous
5 -11 BusFault Configurable  0x00000014 Synchronous
6 -10 UsageFault Configurable  0x00000018 Synchronous
7 -9 SecureFault Configurable 0x0000001C Synchronous
8-10 - Reserved - - -
11 -5 SVCall Configurable  0x0000002C Synchronous
12 -4 DebugMonitor Configurable 0x00000030 Synchronous
13 - Reserved - - -
14 -2 PendSV Configurable  0x00000038 Asynchronous
15 -1 SysTick Configurable 0x0000003C Asynchronous
0x00000040 and
16 and above 0 and above Interrupt (IRQ) Configurable  above. Increasing in Asynchronous
steps of 4

Note: • To simplify the software layer, the CMSIS only uses IRQ numbers. It uses negative values for exceptions
other than interrupts. The IPSR returns the Exception number, see Section 2.1.3.6.2 Interrupt Program
Status Register.
• For configurable priority values, see Section 4.2.7 Interrupt Priority Registers.
For an asynchronous exception, other than reset, the processor can execute extra instructions between the
moment the exception is triggered and the moment the processor enters the exception handler.
Privileged software can disable the exceptions that have configurable priority, as shown in the table above.
An exception that targets Secure state cannot be disabled by Non-secure code.

PM0264 - Rev 2 page 27/232

 PM0264
Exception model

Reset The exception model treats reset as a special form of exception. When either power-on or
warm reset is asserted, the operation of the processor stops, potentially at any point in an
instruction. When reset is deasserted, execution restarts from the address provided by the
reset entry in the vector table. Execution restarts as privileged execution in Thread mode.
NMI A Non-Maskable Interrupt (NMI) can be signaled by a peripheral or triggered by software. This
is the highest priority exception other than reset. It is permanently enabled and has a fixed
priority of -2. NMIs cannot be masked or preempted by any exception other than Reset.
HardFault A HardFault is an exception that occurs because of an error during exception processing, or
because an exception cannot be managed by any other exception mechanism. HardFaults
have a fixed priority of -1, meaning they have higher priority than any exception with
configurable priority.
MemManage A MemManage fault is an exception that occurs because of a memory protection violation,
compared to the MPU or the fixed memory protection constraints, for both instruction and data
memory transactions. This fault is always used to abort instruction accesses to Execute Never
(XN) memory regions.
BusFault A BusFault is an exception that occurs because of a memory-related fault for an instruction or
data memory transaction. This might be from an error that is detected on a bus in the memory
system.
UsageFault A UsageFault is an exception that occurs because of a fault related to instruction execution.
This includes:
• An undefined instruction.
• An illegal unaligned access.
• Invalid state on instruction execution.
• An error on exception return.
The following can cause a UsageFault when the core is configured by software to report them:
• An unaligned address on word and halfword memory access.
• Division by zero.
SVCall A Supervisor Call (SVC) is an exception that is triggered by the SVC instruction. In an OS
environment, applications can use SVC instructions to access OS kernel functions and device
drivers.
DebugMonitor A DebugMonitor exception. If Halting debug is disabled and the debug monitor is enabled, a
debug event causes a DebugMonitor exception when the group priority of the DebugMonitor
exception is greater than the current execution priority.
PendSV PendSV is an asynchronous request for system-level service. In an OS environment, use
PendSV for context switching when no other exception is active.
SysTick A SysTick exception is an exception the system timer generates when it reaches zero. Software
can also generate a SysTick exception. In an OS environment, the processor can use this
exception as a system tick.
Interrupt (IRQ) An interrupt, or IRQ, is an exception signaled by a peripheral, or generated by a software
request. All interrupts are asynchronous to instruction execution. In the system, peripherals use
interrupts to communicate with the processor.

Table 22. Properties of the different exception type without the Security Extensions

Exception number  IRQ number 

Exception type Priority Vector address Activation
(see notes) (see notes)

1 - Reset -4, the highest 0x00000004 Asynchronous

2 -14 NMI -2 0x00000008 Asynchronous
3 -13 HardFault -1 0x0000000C Synchronous
4 -12 MemManage Configurable  0x00000010 Synchronous

PM0264 - Rev 2 page 28/232

 PM0264
Exception model

Exception number  IRQ number 

Exception type Priority Vector address Activation
(see notes) (see notes)

Synchronous when
5 -11 BusFault Configurable  0x00000014 precise, asynchronous
when imprecise
6 -10 UsageFault Configurable  0x00000018 Synchronous
7-10 - Reserved - - -
11 -5 SVCall Configurable  0x0000002C Synchronous
12 -4 DebugMonitor Configurable 0x00000030 Synchronous
13 - Reserved - - -
14 -2 PendSV Configurable  0x00000038 Asynchronous
15 -1 SysTick Configurable 0x0000003C Asynchronous
0x00000040 and above.
16 and above 0 and above Interrupt (IRQ) Configurable  Asynchronous
Increasing in steps of 4

Note: • To simplify the software layer, the CMSIS only uses IRQ numbers. It uses negative values for exceptions
other than interrupts. The IPSR returns the Exception number, see Section 2.1.3.6.2 Interrupt Program
Status Register.
• For configurable priority values, see Section 4.2.7 Interrupt Priority Registers.
For an asynchronous exception, other than reset, the processor can execute extra instructions between the
moment the exception is triggered and the moment the processor enters the exception handler.
Privileged software can disable the exceptions that have configurable priority, as shown in the table above.

2.4.3 Exception handlers

The exception handlers are the following:
Interrupt Service Routines Interrupts IRQ0-IRQ479 are the exceptions that are handled by ISRs.
(ISRs) Each interrupt is configured by Secure software in Secure or Non-secure state, using
NVIC_ITNS.
Fault handler The fault handler handles the following exceptions:
• HardFault.
• MemManage.
• BusFault.
• UsageFault.
• SecureFault.
There can be separate MemManage and UsageFault handlers in Secure and Non-secure state.
The AIRCR.BFHFNMINS bit controls the target state for HardFault and BusFault. SecureFault
always targets Secure State.
System handlers The system handlers handle the following system exceptions:
• NMI.
• PendSV.
• SVCall.
• SysTick.
Most system handlers can be banked with separate handlers between Secure and Non-secure
state. The AIRCR.BFHFNMINS bit controls the target state for NMI.

PM0264 - Rev 2 page 29/232

 PM0264
Exception model

2.4.4 Vector table

The Vector Table Offset Register (VTOR) in the System Control Block (SCB) determines the starting address of
the vector table. The VTOR is banked so there is a VTOR_S and a VTOR_NS. The initial values of VTOR_S
and VTOR_NS are system design specific. The vector table used depends on the target state of the exception.
For exceptions targeting the Secure state, VTOR_S is used. For exceptions targeting the Non-secure state,
VTOR_NS is used. The Vector Table Offset Register (VTOR) in the System Control Block (SCB) determines the
starting address of the vector table.
The following figure shows the order of the exception vectors in the vector table. The least-significant bit of each
vector is 1, indicating that the exception handler is written in Thumb code.

Figure 7. Vector table

Exception number IRQ number Vector Offset

463 479 . IRQ479 0x7BC

.
. . . .
. . .
. . .

18 2 IRQ2 0x48
17 1 IRQ1 0x44
16 0 IRQ0 0x40
15 -1 SysTick 0x3C
14 -2 PendSV 0x38
13 Reserved 0x30
12 -4 DebugMonitor
11 -5 SVCall 0x2C
10
9
Reserved
8
7
6 -11 UsageFault 0x18
5 -12 BusFaults 0x14
4 -13 MemManage 0x10
3 -13 HardFault 0x0C
2 -14 NMI 0x08
1 Reset 0x04
Initial SP value 0x00

On system reset the vector table is set to the value of the external INITNSVTOR bus. Privileged software can
write to VTOR to relocate the vector table start address to a different memory location, in the range 0x00000000
to 0xFFFFFF80, assuming access is allowed by the external LOCKNSVTOR pin.
The silicon vendor must configure the required alignment, which depends on the number of interrupts
implemented. The minimum alignment is 32 words, enough for up to 16 interrupts. For more interrupts, adjust
the alignment by rounding up to the next power of two. For example, if you require 21 interrupts, the alignment
must be on a 64-word boundary because the required table size is 37 words, and the next power of two is 64.

The following figure shows the order of the exception vectors in the Secure and Non-secure vector tables. The
least-significant bit of each vector is 1, indicating that the exception handler is written in Thumb code.

PM0264 - Rev 2 page 30/232

 PM0264
Exception model

Figure 8. Vector table

Exception number IRQ number Secure Vector Non-secure Vector Offset

463 479 IRQ479 . IRQ479 0x7BC

.
. . . .
. . .
. . .

18 2 IRQ2 IRQ2 0x48

17 1 IRQ1 IRQ1 0x44
16 0 IRQ0 IRQ0 0x40
15 -1 SysTick_S SysTick_NS 0x3C
14 -2 PendSV_S PendSV_NS 0x38
13 Reserved Reserved 0x30
12 -3 DebugMonitor DebugMonitor
11 -5 SVCall_S SVCall_NS 0x2C
10
9 Reserved
Reserved
8
7 -9 SecureFault 0x1C
6 -11 UsageFault_S UsageFault_NS 0x18
5 -12 BusFault_S BusFault_NS 0x14
4 -13 MemManage_S MemManage_NS 0x10
3 -13 HardFault_S HardFault_NS 0x0C
2 -14 NMI_S NMI_NS 0x08
1 Reset 0x04
Initial SP value 0x00

Because reset always targets Secure state, the Non-secure Reset and Non-secure Initial SP value are ignored by
the hardware.
On system reset, the Non-secure vector table is set to the value of the external INITNSVTOR bus, and
the Secure vector table is set to the value of the external INITSVTOR bus. Privileged software can write to
VTOR_S and VTOR_NS to relocate the vector table start address to a different memory location, in the range
0x00000000 to 0xFFFFFF80, assuming access is allowed by the external LOCKNSVTOR and LOCKSVTAIRCR
pins respectively.
The silicon vendor must configure the required alignment of the vector tables, which depends on the number of
interrupts implemented. The minimum alignment is 32 words, enough for up to 16 interrupts. For more interrupts,
adjust the alignment by rounding up to the next power of two. For example, if you require 21 interrupts, the
alignment must be on a 64-word boundary because the required table size is 37 words, and the next power of two
is 64.

2.4.5 Exception priorities

All exceptions have an assigned priority that is used to control both pre-emption and prioritization between
pending exceptions. A lower priority value indicates a higher priority. You can configure priorities for all exceptions
except Reset, HardFault, and NMI.
If software does not configure any priorities, then all exceptions with a configurable priority have a priority of 0. For
information about configuring exception priorities, see:
• Section 4.3.10 System Handler Priority Registers.
• Section 4.2.7 Interrupt Priority Registers.
Note: Configurable priorities are in the range 0-255. The Reset, HardFault, and NMI exceptions, with fixed negative
priority values always have higher priority than any other exception.
<Directions for licensee: The 0-255 number is a licensee-configured value. If the device implements fewer than
8 bits of priority, the licensee must change the number 0-255 to 127, 63, 31, 15 or 7 to correspond to the number
of bits implemented (7 down to 3 respectively).>
For configurable priority exceptions, the target Security state also affects the programmed priority. Depending on
the value of AIRCR.PRIS, the priority can be extended.

PM0264 - Rev 2 page 31/232

 PM0264
Exception model

In Table 23, the values in columns 2 and 3 must match, and increase from zero in increments of 32. The values in
column 4 start from 128 and increase in increments of 16.

Table 23. Extended priority when the number of interrupt priority levels is 8

Non-secure priority when AIRCR.PRIS Non-secure priority when AIRCR.PRIS

Priority value [7:5] Secure priority
=0 =1

0 0 0 128
1 32 32 144
2 64 64 160
3 96 96 176
4 128 128 192
5 160 160 208
6 192 192 224
7 224 224 240

In Table 24, the values in columns 2 and 3 must match, and increase from zero in increments of 16. The values in
column 4 start from 128 and increase in increments of 8.

Table 24. Extended priority when the number of interrupt priority levels is 16

Non-secure priority when AIRCR.PRIS Non-secure priority when AIRCR.PRIS

Priority value [7:4] Secure priority
=0 =1

0 0 0 128
1 16 16 136
2 32 32 144
3 48 48 152
4 64 64 160
5 80 80 168
6 96 96 176
7 112 112 184
8 128 128 192
9 144 144 200
10 160 160 208
11 176 176 216
12 192 192 224
13 208 208 232
14 224 224 240
15 240 240 248

Assigning a higher priority value to IRQ[0] and a lower priority value to IRQ[1] means that IRQ[1] has higher
priority than IRQ[0]. If both IRQ[1] and IRQ[0] are asserted, IRQ[1] is processed before IRQ[0].
If multiple pending exceptions have the same priority, the pending exception with the lowest exception number
takes precedence. For example, if both IRQ[0] and IRQ[1] are pending and have the same priority, then IRQ[0] is
processed before IRQ[1].
When the processor is executing an exception handler, the exception handler is preempted if a higher priority
exception occurs. If an exception occurs with the same priority as the exception being handled, the handler is not
preempted, irrespective of the exception number. However, the status of the new interrupt changes to pending.

PM0264 - Rev 2 page 32/232

 PM0264
Exception model

2.4.6 Interrupt priority grouping

To increase priority control in systems with interrupts, the NVIC supports priority grouping. This divides each
interrupt priority register entry into two fields, an upper field that defines the group priority, and a lower field that
defines a subpriority within the group.
Only the group priority determines pre-emption of interrupt exceptions. When the processor is executing an
interrupt exception handler, another interrupt with the same group priority as the interrupt being handled does not
pre-empt the handler.
If multiple pending interrupts have the same group priority, the subpriority field determines the order in which they
are processed. If multiple pending interrupts have the same group priority and subpriority, the interrupt with the
lowest IRQ number is processed first.
If a pending Secure exception and a pending Non-secure exception both have the same group priority field value,
the same subpriority field value, and the same exception number, the Secure exception takes precedence.

2.4.7 Exception entry and return

Descriptions of exception handling use the following terms.
Preemption An exception can preempt the current execution if its priority is higher than the current
execution priority.
When one exception preempts another, the exceptions are called nested exceptions.
Return This occurs when the exception handler is completed.
The processor pops the stack and restores the processor state to the state it had before the
interrupt occurred.
Tail-chaining This mechanism speeds up exception servicing. On completion of an exception handler or
during the return operation, if there is a pending exception that meets the requirements
for exception entry, then the stack pop is skipped and control transfers directly to the new
exception handler.
Late arriving interrupts This mechanism speeds up preemption. If a higher priority exception occurs during state
saving for a previous exception, the processor switches to handle the higher priority exception
and initiates the vector fetch for that exception. State saving may be affected by the late
arrival depending on the stacking requirements of the original exception and the late-arriving
exception. On return from the exception handler of the late-arriving exception, the normal
tail-chaining rules apply.

2.4.7.1 Exception entry

Exception entry occurs when there is a pending exception with sufficient priority and either the processor is in
Thread mode, or the new exception is of higher priority than the exception being handled, in which case the new
exception preempts the original exception.
When one exception preempts another, the exceptions are nested.
Sufficient priority means that the exception has higher priority than any limits set by the mask registers. An
exception with lower priority than this is pending but is not handled by the processor.
When the processor takes an exception, unless the exception is a tail-chained or a late-arriving exception, the
processor pushes information onto the current stack. This operation is referred to as stacking and the structure of
the data stacked is referred as the stack frame.
If the floating-point context is active, the Cortex‑M33 processor can automatically stack the architected floating-
point state on exception entry. The following figure shows the Cortex‑M33 processor stack frame layout when an
interrupt or an exception is preserved on the stack:
• with floating-point state.
• without floating-point state.
Note: Where stack space for floating-point state is not allocated, the stack frame is the same as that of Armv8‑M
implementations without an FPU.

PM0264 - Rev 2 page 33/232

 PM0264
Exception model

Figure 9. Stack frame when an interrupt or an exception is preserved on the stack with or without
floating-point state

SP offset 0x68 Original SP† SP offset 0x20 Original SP††

0x64 Reserved 0x1C xPSR
0x60 FPSCR 0x18 PC
0x5C S15 0x14 LR (R14)
0x58 S14 0x10 R12
State context
0x54 S13 0x0C R3
0x50 S12 0x08 R2
0x4C S11 0x04 R1
0x48 S10 0x00 R0
0x44 S9
FP context Exception frame without
0x40 S8
floating-point storage
0x3C S7
0x38 S6
0x34 S5
0x30 S4
0x2C S3
0x28 S2
0x24 S1
0x20 S0
0x1C xPSR
0x18 PC
0x14 LR (R14)
0x10 R12
State context
0x0C R3
0x08 R2
0x04 R1
0x00 R0

Exception frame with

floating-point storage
††
†
Or at offset 0x6C if at a word-aligned but not Or at offset 0x24 if at a word-aligned but not
doubleword-aligned address. doubleword-aligned address.

When a Non-secure exception preempts a Secure context, additional context is saved onto the stack and the
stacked registers are cleared to ensure no Secure data is available to Non-secure software.
If the Security Extension is implemented, when a Non-secure exception preempts software running in a Secure
state, additional context is saved onto the stack and the stacked registers are cleared to ensure no Secure data is
available to Non-secure software, as the following figure shows.

Figure 10. Stack frame extended to save additional context when the Security Extension is implemented

SP offset 0x48 Original SP†

0x44 xPSR
0x40 PC
0x3C LR (R14)
0x38 R12
State context
0x34 R3
0x30 R2
0x2C R1
0x28 R0
0x24 R11
0x20 R10
0x1C R9
0x18 R8
0x14 R7 Additional
0x10 R6 state context
0x0C R5
0x08 R4
0x04 Reserved
0x00 Integrity signature New SP

†
Or at offset 0x4C if at a word-aligned but not
doubleword-aligned address.

PM0264 - Rev 2 page 34/232

 PM0264
Exception model

If the floating-point context is active, the Cortex‑M33 processor automatically stacks floating-point state in the
stack frame. There are two frame formats that contain floating-point context. If an exception is taken from Secure
state and FPCCR.TS is set, the additional floating-point context is stacked. In all other cases, only the standard
floating-point context is stacked, as the following figure shows.
Note: The conditions that trigger saving additional FP context are different from those that trigger additional integer
context.

Figure 11. Extended exception stack frame

Stack frame for Secure floating-point state when FPCCR.TS = 1 Stack frame for Secure floating-point state when FPCCR.TS = 0

SP offset 0xD0 Original SP† SP offset 0x90 Original SP††

0xCC S31 0x8C Reserved
0xC8 S30 0x88 FPSCR
0xC4 S29 0x84 S15
0xC0 S28 0x80 S14
0xBC S27 0x7C S13
0xB8 S26 0x78 S12
0xB4 S25 0x74 S11
0xB0 S24 0x70 S10
Additional FP context
0xAC S23 0x6C S9
FP context
0xA8 S22 0x68 S8
0xA4 S21 0x64 S7
0xA0 S20 0x60 S6
0x9C S19 0x5C S5
0x98 S18 0x58 S4
0x94 S17 0x54 S3
0x90 S16 0x50 S2
0x8C Reserved 0x4C S1
0x88 FPSCR 0x48 S0
0x84 S15 0x44 xPSR
0x80 S14 0x40 PC
0x7C S13 0x3C LR (R14)
0x78 S12 0x38 R12
State context
0x74 S11 0x34 R3
0x70 S10 0x30 R2
0x6C S9 0x2C R1
FP context
0x68 S8 0x28 R0
0x64 S7 0x24 R11
0x60 S6 0x20 R10
0x5C S5 0x1C R9
0x58 S4 0x18 R8
0x54 S3 0x14 R7
Additional state context
0x50 S2 0x10 R6
0x4C S1 0x0C R5
0x48 S0 0x08 R4
0x44 xPSR 0x04 Reserved
0x40 PC 0x00 Integrity signature New SP
0x3C LR (R14)
0x38 R12
State context
0x34 R3
0x30 R2
0x2C R1
0x28 R0
0x24 R11
0x20 R10
0x1C R9
0x18 R8
0x14 R7
Additional state context
0x10 R6
0x0C R5 †
Or at offset 0xD4 if at a word-aligned but not doubleword-aligned address.
0x08 R4
0x04 Reserved ††
Or at offset 0x94 if at a word-aligned but not doubleword-aligned address.
0x00 Integrity signature New SP

PM0264 - Rev 2 page 35/232

 PM0264
Exception model

The Stack pointer of the interrupted thread or handler is always used for stacking the state before the exception is
taken. For example if an exception is taken from Secure state to a Non-secure handler the Secure stack pointer is
used to save the state.
Immediately after stacking, the stack pointer indicates the lowest address in the stack frame.
The stack frame includes the return address. This is the address of the next instruction in the interrupted program.
This value is restored to the PC at exception return so that the interrupted program resumes.
In parallel to the stacking operation, the processor performs a vector fetch that reads the exception handler start
address from the vector table. When stacking is complete, the processor starts executing the exception handler.
At the same time, the processor writes an EXC_RETURN value to the LR. This value is used to trigger exception
return when the exception handler is complete.
If no higher priority exception occurs during exception entry, the processor starts executing the exception handler
and automatically changes the status of the corresponding pending interrupt to active.
If another higher priority exception occurs during exception entry, the processor starts executing the exception
handler for this exception and does not change the pending status of the earlier exception. This is the late arrival
case.

2.4.7.2 Exception return

Exception return occurs when the processor is in Handler mode and execution of one of the following instructions
attempts to set the PC to an EXC_RETURN value:
• A POP or LDM instruction that loads the PC.
• An LDR instruction that loads the PC
• A BX instruction using any register.

The processor saves an EXC_RETURN value to the LR on exception entry. The exception mechanism relies on
this value to detect when the processor has completed an exception handler. When the processor loads a value
matching this pattern to the PC it detects that the operation is not a normal branch operation and, instead, that the
exception is complete. As a result, it starts the exception return sequence. Bits[6:0] of the EXC_RETURN value
indicate the required return stack, processor mode, Security state, and stack frame as the following table shows.

Table 25. Exception return behavior

Bits Name Function

Indicates that this is an EXC_RETURN value.

[31:24] PREFIX
This field reads as 0b11111111.
[23:7] - Reserved, RES1.
Indicates whether registers have been pushed to a Secure or Non-secure stack.
[6] S 0 Non-secure stack used.
1 Secure stack used.
Indicates whether the default stacking rules apply, or whether the callee registers are already on the stack.
[5] DCRS 0 Stacking of the callee saved registers is skipped.
1 Default rules for stacking the callee registers are followed.
In a PE with the Main and Floating-point Extensions:
0 The PE allocated space on the stack for FP context.
[4] FType
1 The PE did not allocate space on the stack for FP context.

In a PE without the Floating-point Extension, this bit is Reserved, RES1.

Indicates the mode that was stacked from.
[3] Mode 0 Handler mode.
1 Thread mode.
[2] SPSEL Indicates which stack contains the exception stack frame.

PM0264 - Rev 2 page 36/232

 PM0264
Security state switches

Bits Name Function

0 Main stack pointer.
1 Process stack pointer.
[1] - Reserved, RES0.
Indicates the Security state the exception was taken to.
[0] ES 0 Non-secure.
1 Secure.

The processor saves an EXC_RETURN value to the LR on exception entry. The exception mechanism relies on
this value to detect when the processor has completed an exception handler. When the processor loads a value
matching this pattern to the PC it detects that the operation is not a normal branch operation and, instead, that the
exception is complete. As a result, it starts the exception return sequence. Bits[6:0] of the EXC_RETURN value
indicate the required return stack, processor mode, and stack frame as the following table shows.

Table 26. Exception return behavior

Bits Name Function

Indicates that this is an EXC_RETURN value.

[31:24] PREFIX
This field reads as 0b11111111.
[23:7] - Reserved, RES1.
[6] - Reserved, RES0.
[5] - Reserved, RES1.
In a PE with the Main and Floating-point Extensions:
0 The PE allocated space on the stack for FP context.
[4] FType
1 The PE did not allocate space on the stack for FP context.

In a PE without the Floating-point Extension, this bit is Reserved, RES1.

Indicates the mode that was stacked from.
[3] Mode 0 Handler mode.
1 Thread mode.
Indicates which stack contains the exception stack frame.
[2] SPSEL 0 Main stack pointer.
1 Process stack pointer.
[1:0] - Reserved, RES0.

2.5 Security state switches

The following table presents the possible security transitions, the instructions that can cause them, and any faults
that may be generated.

Table 27. Security state transitions

Current Security attribute of the

Security state change
Security state branch target address

Change to Non-secure state if the branch was a BXNS or BLXNS instruction,

Secure Non-secure with the lsb of its target address set to 0.
Otherwise, a SecureFault is generated.

Secure and Non-secure Change to Secure state if the branch target address contains an SG
Non-secure
callable instruction.

PM0264 - Rev 2 page 37/232

 PM0264
Fault handling

Current Security attribute of the

Security state change
Security state branch target address
If the target address does not contain an SG a SecureFault is generated.
Secure and not Non-secure
Non-secure A SecureFault is generated.
callable

The following figure shows the Security state transitions:

Figure 12. Security state transitions

BLXNS-call to Non-secure function

BL to SG-call to entry function

Non-secure
Secure state
state

BXNS-return from entry function

BX to FNC_RETURN-return from Non-secure function

Secure software can call a Non-secure function using the BLXNS instruction. When this happens, the LR is set to
a special value called FNC_RETURN, and the return address and XPSR is saved onto the Secure stack. Return
from Non-secure state to Secure state is triggered when one of the following instructions attempts to set the PC to
an FNC_RETURN value:
• A POP or LDM instruction that loads the PC.
• An LDR instruction that loads the PC.
• A BX instruction using any register.
When a return from Non-secure state to Secure state occurs the processor restores the program counter and
XPSR from the Secure stack.
Any scenario not listed in the table triggers a SecureFault. For example:
• Sequential instructions that cross security attributes from Secure to Non-secure.
• A 32-bit instruction fetch that crosses regions with different security attributes.

2.6 Fault handling

Faults can occur on instruction fetches, instruction execution, and data accesses. When a fault occurs,
information about the cause of the fault is recorded in various registers, according to the type of fault. Faults
are a subset of the exceptions.
Faults are generated by:
• A bus error on:
– An instruction fetch or vector table load.
– A data access.
• An internally-detected error such as an undefined instruction.
• Attempting to execute an instruction from a memory region marked as Execute Never (XN).
• A privilege violation or an attempt to access an unmanaged region causing an MPU fault.
• A security violation.

2.6.1 Fault types reference table

The table shows the types of fault, the handler used for the fault, the corresponding fault status register, and the
register bit that indicates that the fault has occurred.

PM0264 - Rev 2 page 38/232

 PM0264
Fault handling

Table 28. Faults

Fault Handler Bit name Fault status register

Bus error on a vector read VECTTBL

HardFault Section 4.3.13 HardFault Status Register
Fault escalated to a hard fault FORCED
MPU or default memory map mismatch: - -

On instruction access IACCVIOL (1)

On data access DACCVIOL
MemManage Section 4.3.12.1 MemManage Fault Status
During exception stacking MSTKERR
Register
During exception unstacking MUNSKERR
During lazy floating-point state preservation MLSPERR
Bus error: - -
During exception stacking STKERR
During exception unstacking UNSTKERR
During instruction prefetch BusFault IBUSERR
Section 4.3.12.2 BusFault Status Register
During lazy floating-point state preservation LSPERR
Precise data bus error PRECISERR
Imprecise data bus error IMPRECISERR
Undefined instruction UNDEFINSTR
Attempt to enter an invalid instruction set state 
(2) INVSTATE

Invalid EXC_RETURN value INVPC Section 4.3.12.3 UsageFault Status

UsageFault
Register
Illegal unaligned load or store UNALIGNED
Stack overflow flag STKOF
Divide By 0 DIVBYZERO
Lazy state error flag LSERR
Lazy state preservation error flag LSPERR
Invalid transition flag INVTRAN
Attribution unit violation flag SecureFault AUVIOL Section 4.5.7 Secure Fault Status Register
Invalid exception return flag INVER
Invalid integrity signature flag INVIS
Invalid entry point INVEP

1. Occurs on an access to an XN region even if the processor does not include an MPU or the MPU is disabled.
2. Attempting to use an instruction set other than the T32 instruction set or returns to a non load/store-multiple instruction with
ICI continuation.

2.6.2 Fault escalation to HardFault

All fault exceptions other than HardFault have configurable exception priority. Software can disable execution of
the handlers for these faults.
Usually, the exception priority, together with the values of the exception mask registers, determines whether the
processor enters the fault handler, and whether a fault handler can preempt another fault handler.
In some situations, a fault with configurable priority is treated as a HardFault. This is called priority escalation, and
the fault is described as escalated to HardFault. Escalation to HardFault occurs when:
• A fault handler causes the same kind of fault as the one it is servicing. This escalation to HardFault occurs
because a fault handler cannot preempt itself; it must have the same priority as the current execution priority
level.

PM0264 - Rev 2 page 39/232

 PM0264
Fault handling

• A fault handler causes a fault with the same or lower priority as the fault it is servicing. This is because the
handler for the new fault cannot preempt the currently executing fault handler.
• An exception handler causes a fault for which the priority is the same as or lower than the currently
executing exception.
• A fault occurs and the handler for that fault is not enabled.
If a BusFault occurs during a stack push when entering a BusFault handler, the BusFault does not escalate to a
HardFault. This means that if a corrupted stack causes a fault, the fault handler executes even though the stack
push for the handler failed. The fault handler operates but the stack contents are corrupted.
The faults and fixed priority exceptions are also designated as Secure or Non-secure under the control of
AIRCR.BFHFMNINS. When AIRCR.BFHFMNINS is set to:
0 BusFaults and fixed priority exceptions are designated as Secure. The exceptions retain the
prioritization of HardFault at -1 and NMI at -2.
1 BusFaults and fixed priority exceptions are designated as Non-secure. In this case, Secure
HardFault is introduced at priority -3 to ensure that faults that target Secure state are
recognized.

The Non-secure state cannot inhibit BusFaults and fixed priority exceptions which target Secure state. Therefore
when faults and fixed priority exceptions are Secure, Non-secure FAULTMASK (FAULTMASK_NS) only inhibits
programmable priority exceptions, making it equivalent to Non-secure PRIMASK (PRIMASK_NS).
Non-secure programmable priority exceptions are mapped to the regular priority range 0-255, if AIRCR.PRIS is
clear. Non-secure programmable priority exceptions are mapped to the bottom half the regular priority range,
128-255, if AIRCR.PRIS is set to 1. Therefore the FAULTMASK_NS sets the execution priority to 0 or 80,
according to AIRCR.PRIS, to mask the Non-secure programmable priority exception only.
When BusFaults and fixed priority exceptions are Secure, FAULTMASK_S sets execution priority to -1 to inhibit
everything up to and including HardFault.
When BusFaults and fixed priority exceptions are designated as Non-secure, FAULTMASK_NS boosts priority to
-1 to inhibit everything up to Non-secure HardFault at priority -1, while FAULTMASK_S boosts priority to -3 to
inhibit all faults and fixed priority exceptions including the Secure HardFault at priority -3.
Note: Only Reset can preempt the fixed priority Secure HardFault when AIRCR.BFHFNMINS is set to 1. A Secure
HardFault when AIRCR.BFHFNMINS is set to 1 can preempt any exception other than Reset. A Secure
HardFault when AIRCR.BFHFNMINS is set to 0 can preempt any exception other than Reset, NMI, or another
HardFault.

2.6.3 Fault status registers and fault address registers

The fault status registers indicate the cause of a fault. For BusFaults, and MemManage faults, the fault address
register indicates the address that is accessed by the operation that caused the fault. The fault status registers
indicate the cause of a fault. For BusFaults, SecureFaults, and MemManage faults, the fault address register
indicates the address that is accessed by the operation that caused the fault.
The processor has two physical fault address registers. One shared between the MMFAR_S, SFAR, and BFAR
(only if AIRCR.BFHFNMINS is set to 0), and the other shared between the MMFAR_NS and BFAR (only if
AIRCR.BFHFNMINS is set to 1). These are targeted by Secure and Non-secure faults respectively.
The processor has one physical fault address register. It is shared between the MMFAR and BFAR.
For each physical fault address register, it is only possible to report the address of one fault at a time. Each fault
address register is updated when one of the *FARVALID bits is set for their respective faults in the associated
*FSR register. Any fault that targets a fault address register with one of its *FARVALID bits already set does not
update the fault address. The *FARVALID bits must be cleared before another fault address can be reported.
The following table shows the fault status and fault address registers.

Table 29. Fault status and fault address registers

Handler Status register name Address register name Register description

HardFault HFSR - Section 4.3.13 HardFault Status Register

Section 4.3.12.1 MemManage Fault Status Register
MemManage MMFSR(1) MMFAR(1)
Section 4.3.14 MemManage Fault Address Register

PM0264 - Rev 2 page 40/232

 PM0264
Power management

Handler Status register name Address register name Register description

Section 4.3.12.2 BusFault Status Register

BusFault BFSR BFAR
Section 4.3.15 BusFault Address Register

UsageFault UFSR(1) - Section 4.3.12.3 UsageFault Status Register

Section 4.5.7 Secure Fault Status Register

SecureFault SFSR SFAR
Section 4.5.8 Secure Fault Address Register

1. MMFSR, MMFAR, and UFSR are banked between Security states.

2.6.4 Lockup
The processor enters a lockup state if a fault occurs when it cannot be serviced or escalated. When the processor
is in lockup state, it does not execute any instructions.
The processor remains in lockup state until either:
• It is reset.
• Preemption by a higher priority exception occurs.
• It is halted by a debugger.
Note: If lockup state occurs from a Secure HardFault when AIRCR.BFHFNMINS is set to 1 or the NMI handler, a
subsequent NMI does not cause the processor to leave lockup state.

2.7 Power management

The Cortex‑M33 processor supports modes for sleep and deep sleep that reduce power consumption. Sleep
mode stops the processor clock. Deep sleep mode stops the system clock and switches off the PLL and flash
memory.
The SCR.SLEEPDEEP bit selects which sleep mode is used. For more information about the behavior of the
sleep modes, see Section 4.3.8 System Control Register.

2.7.1 Entering sleep mode

The system can generate spurious wakeup events. Therefore, software must be able to put the processor back
into sleep mode after such an event. A program might have an idle loop to put the processor back to sleep mode.

2.7.1.1 Wait for interrupt

The wait for interrupt instruction, WFI, causes immediate entry to sleep mode unless the wakeup condition is true.
When the processor executes a WFI instruction, it stops executing instructions and enters sleep mode.

2.7.1.2 Wait for event

The wait for event instruction, WFE, causes entry to sleep mode depending on the value of a one-bit event
register.
When the processor executes a WFE instruction, it checks the value of the event register:
0 The processor stops executing instructions and enters sleep mode.
1 The processor clears the register to 0 and continues executing instructions without entering
sleep mode.

If the event register is 1, it indicates that the processor must not enter sleep mode on execution of a WFE
instruction. Typically, this is because an external event signal is asserted, or a processor in the system has
executed an SEV instruction.

2.7.1.3 Sleep-on-exit
If the SLEEPONEXIT bit of the SCR is set to 1, when the processor completes the execution of all exception
handlers, it immediately enters sleep mode without restoring the Thread context from the stack. Use this
mechanism in applications that only require the processor to run when an exception occurs.

PM0264 - Rev 2 page 41/232

 PM0264
Power management

2.7.2 Wakeup from sleep mode

The conditions for the processor to wake up depend on the mechanism that causes it to enter sleep mode.

2.7.2.1 Wakeup from WFI or sleep-on-exit

Normally, the processor wakes up only when it detects an exception with sufficient priority to cause exception
entry. Some embedded systems might have to execute system restore tasks after the processor wakes up, and
before it executes an interrupt handler. To achieve this set the PRIMASK bit to 1 and the FAULTMASK bit to 0.
If an interrupt arrives that is enabled and has a higher priority than the current exception priority, the processor
wakes up but does not execute the interrupt handler until the processor sets PRIMASK to zero.

2.7.2.2 Wakeup from WFE

Conditions which cause the processor to wakeup from WFE.
The processor wakes up if:
• It detects an exception with sufficient priority to cause exception entry.
• It detects an external event signal.
• In a multiprocessor system, another processor in the system executes an SEV instruction.
In addition, if the SEVONPEND bit in the SCR is set to 1, any new pending interrupt triggers an event and wakes
up the processor, even if the interrupt is disabled or has insufficient priority to cause exception entry.

2.7.3 The external event input

The processor provides an external event input signal. Peripherals can drive this signal, either to wake the
processor from WFE, or to set the internal WFE event register to 1 to indicate that the processor must not enter
sleep mode on a later WFE instruction.

2.7.4 Power management programming hints

ISO/IEC C cannot directly generate the WFI and WFE instructions.
The CMSIS provides the following functions for these instructions:
void __WFE(void) // Wait for Event
void __WFI(void) // Wait for Interrupt

PM0264 - Rev 2 page 42/232

 PM0264
The Cortex®-M33 Instruction Set

3 The Cortex®-M33 Instruction Set

3.1 Instruction set summary

The T32 instruction set is supported by the Cortex‑M33 processor.
Note: In the following table:
• Angle brackets, <>, enclose alternative forms of the operand.
• Braces, {}, enclose optional operands.
• The Operands column is not exhaustive.
• Op2 is a flexible second operand that can be either a register or a constant.
• Most instructions can use an optional condition code suffix.
For more information on the instructions and operands, see the instruction descriptions.

Table 30. Cortex‑M33 instruction set summary

Mnemonic Operands Brief description Flags Page

Section 3.4.1 ADD, ADC, SUB,

ADC, ADCS {Rd,} Rn, Op2 Add with Carry N,Z,C,V
SBC, and RSB
Section 3.4.1 ADD, ADC, SUB,
ADD, ADDS {Rd,} Rn, Op2 Add N,Z,C,V
SBC, and RSB
Section 3.4.1 ADD, ADC, SUB,
ADD, ADDW {Rd,} Rn, #imm12 Add -
SBC, and RSB
ADR Rd, label Address to Register - Section 3.12.1 ADR

Section 3.4.2 AND, ORR, EOR, BIC,

AND, ANDS {Rd,} Rn, Op2 Logical AND N,Z,C
and ORN
Section 3.4.3 ASR, LSL, LSR, ROR,
ASR, ASRS Rd, Rm, <Rs|#n> Arithmetic Shift Right N,Z,C
and RRX
B {cond} label Branch {conditionally} - Section 3.9.2 B, BL, BX, and BLX

BFC Rd, #lsb, #width Bit Field Clear - Section 3.8.1 BFC and BFI

Rd, Rn, #lsb,

BFI Bit Field Insert - Section 3.8.1 BFC and BFI
#width
Section 3.4.2 AND, ORR, EOR, BIC,
BIC, BICS {Rd,} Rn, Op2 Bit Clear N,Z,C
and ORN
BKPT #imm8 Breakpoint - Section 3.11.1 BKPT

BL label Branch with Link - Section 3.9.2 B, BL, BX, and BLX

Branch indirect with Link

BLX Rm - Section 3.9.2 B, BL, BX, and BLX
and Exchange
Branch indirect with
BLXNS Rm Link and Exchange, Non- - Section 3.9.3 BXNS and BLXNS
secure
BX Rm Branch and Exchange - Section 3.9.2 B, BL, BX, and BLX

Branch and Exchange,

BXNS Rm - Section 3.9.3 BXNS and BLXNS
Non-secure
Compare and Branch on
CBNZ Rn, label - Section 3.9.4 CBZ and CBNZ
Non Zero
Compare and Branch on
CBZ Rn, label - Section 3.9.4 CBZ and CBNZ
Zero
CLREX - Clear Exclusive - Section 3.12.12 CLREX

CLZ Rd, Rm Count Leading Zeros - Section 3.4.4 CLZ

PM0264 - Rev 2 page 43/232

 PM0264
Instruction set summary

Mnemonic Operands Brief description Flags Page

CMN Rn, Op2 Compare Negative N,Z,C,V Section 3.4.5 CMP and CMN

CMP Rn, Op2 Compare N,Z,C,V Section 3.4.5 CMP and CMN

Change Processor State,

CPSID i - Section 3.11.2 CPS
Disable Interrupts
Change Processor State,
CPSIE i - Section 3.11.2 CPS
Enable Interrupts
DMB {opt} Data Memory Barrier - Section 3.11.4 DMB

Data Synchronization
DSB {opt} - Section 3.11.5 DSB
Barrier
Section 3.4.2 AND, ORR, EOR, BIC,
EOR, EORS {Rd,} Rn, Op2 Exclusive OR N,Z,C
and ORN
FLDMX (Decrement
Section 3.10.1 FLDMDBX,
FLDMDBX ,FLDMIAX Rn Before, Increment After) -
FLDMIAX
loads
FSTMX (Decrement
Section 3.10.2 FSTMDBX,
FSTMDBX,FSTMIAX Rn Before, Increment After) -
FSTMIAX
stores
Instruction
ISB {opt} - Section 3.11.6 ISB
Synchronization Barrier
IT - If Then condition block - Section 3.9.5 IT

LDA Rd, [Rn] Load-Acquire Word Section 3.12.9 LDA and STL

LDAB Rd, [Rn] Load-Acquire Byte Section 3.12.9 LDA and STL

Load-Acquire Exclusive
LDAEX Rd, [Rn] - Section 3.12.11 LDAEX and STLEX
Word
Load-Acquire Exclusive
LDAEXB Rd, [Rn] - Section 3.12.11 LDAEX and STLEX
Byte
Load-Acquire Exclusive
LDAEXH Rd, [Rn] - Section 3.12.11 LDAEX and STLEX
Halfword
LDAH Rd, [Rn] Load-Acquire Halfword - Section 3.12.9 LDA and STL

LDM Rn{!}, reglist Load Multiple - Section 3.12.6 LDM and STM

Load Multiple Decrement

LDMDB, LDMEA Rn{!}, reglist - Section 3.12.6 LDM and STM
Before
Load Multiple, Increment
LDMIA, LDMFD Rn{!}, reglist - Section 3.12.6 LDM and STM
After
Rt, [Rn, Rm {, Load Register Word Section 3.12.3 LDR and STR,
LDR -
LSL #shift}] (register offset) register offset

Load Register Word

LDR Rt, label - Section 3.12.5 LDR, PC‑relative
(literal)
Section 3.12.2 LDR
Rt, [Rn, Load Register Word
and STR, immediate offset,
LDR, LDRT (immediate offset, -
#offset] Section 3.12.4 LDR and STR,
unprivileged)
unprivileged
Rt, [Rn, Rm {, Load Register Byte Section 3.12.3 LDR and STR,
LDRB -
LSL #shift}] (register offset) register offset

LDRB Rt, label Load Register Byte (literal) - Section 3.12.5 LDR, PC‑relative

Section 3.12.2 LDR

Rt, [Rn, Load Register Byte
and STR, immediate offset,
LDRB, LDRBT (immediate offset, -
#offset] Section 3.12.4 LDR and STR,
unprivileged)
unprivileged

PM0264 - Rev 2 page 44/232

 PM0264
Instruction set summary

Mnemonic Operands Brief description Flags Page

Rt, Rt2, [Rn, Load Register Dual Section 3.12.2 LDR and STR,
LDRD -
#offset] (immediate offset) immediate offset

Load Register Dual (PC-

LDRD Rt, Rt2, label - Section 3.12.5 LDR, PC‑relative
relative)
Rt, [Rn,
LDREX Load Register Exclusive - Section 3.12.10 LDREX and STREX
#offset]
Load Register Exclusive
LDREXB Rt, [Rn] - Section 3.12.10 LDREX and STREX
Byte
Load Register Exclusive
LDREXH Rt, [Rn] - Section 3.12.10 LDREX and STREX
Halfword
Rt, [Rn, Rm {, Load Register Halfword Section 3.12.3 LDR and STR,
LDRH -
LSL #shift}] (register offset) register offset

Load Register Halfword

LDRH Rt, label - Section 3.12.5 LDR, PC‑relative
(literal)
Section 3.12.2 LDR
Rt, [Rn, Load Register Halfword
and STR, immediate offset,
LDRH, LDRHT (immediate offset, -
#offset] Section 3.12.4 LDR and STR,
unprivileged)
unprivileged
Rt, [Rn, Rm {, Load Register Signed Section 3.12.3 LDR and STR,
LDRSB -
LSL #shift}] Byte (register offset) register offset

Load Register Signed

LDRSB Rt, label - Section 3.12.5 LDR, PC‑relative
Byte (PC-relative)
Section 3.12.2 LDR
Rt, [Rn, Load Register Signed
and STR, immediate offset,
LDRSB, LDRSBT Byte (immediate offset, -
#offset] Section 3.12.4 LDR and STR,
unprivileged)
unprivileged
Rt, [Rn, Rm {, Load Register Signed Section 3.12.3 LDR and STR,
LDRSH -
LSL #shift}] Halfword (register offset) register offset

Load Register Signed

LDRSH Rt, label - Section 3.12.5 LDR, PC‑relative
Halfword (PC-relative)
Section 3.12.2 LDR
Rt, [Rn, Load Register Signed
and STR, immediate offset,
LDRSH, LDRSHT Halfword (immediate -
#offset] Section 3.12.4 LDR and STR,
offset, unprivileged)
unprivileged
Section 3.4.3 ASR, LSL, LSR, ROR,
LSL, LSLS Rd, Rm, <Rs|#n> Logical Shift Left N,Z,C
and RRX
Section 3.4.3 ASR, LSL, LSR, ROR,
LSR, LSRS Rd, Rm, <Rs|#n> Logical Shift Right N,Z,C
and RRX
MLA Rd, Rn, Rm, Ra Multiply Accumulate - Section 3.5.1 MUL, MLA, and MLS

MLS Rd, Rn, Rm, Ra Multiply and Subtract - Section 3.5.1 MUL, MLA, and MLS

MOV, MOVS Rd, Op2 Move N,Z,C Section 3.4.6 MOV and MVN

MOV, MOVS Rd, Rm Move (register) N,Z Section 3.4.6 MOV and MVN

MOVT Rd, #imm16 Move Top - Section 3.4.7 MOVT

MOVW Rd, #imm16 Move 16-bit constant N,Z,C Section 3.4.6 MOV and MVN

Move from Special

MRS Rd, spec_reg Register to general - Section 3.11.7 MRS
register
Move from general
MSR spec_reg, Rn register to Special - Section 3.11.8 MSR
Register

PM0264 - Rev 2 page 45/232

 PM0264
Instruction set summary

Mnemonic Operands Brief description Flags Page

MUL, MULS {Rd,} Rn, Rm Multiply N,Z Section 3.5.1 MUL, MLA, and MLS

MVN, MVNS Rd, Op2 Bitwise NOT N,Z,C Section 3.4.6 MOV and MVN

NOP - No Operation - Section 3.11.9 NOP

Section 3.4.2 AND, ORR, EOR, BIC,

ORN, ORNS {Rd,} Rn, Op2 Logical OR NOT N,Z,C
and ORN
Section 3.4.2 AND, ORR, EOR, BIC,
ORR, ORRS {Rd,} Rn, Op2 Logical OR N,Z,C
and ORN
{Rd,} Rn, Rm, {,
PKHTB, PKHBT Pack Halfword - Section 3.7.1 PKHBT and PKHTB
Op2}
PLD [Rn {, #offset}] Preload Data - Section 3.12.7 PLD

POP reglist Pop registers from stack - Section 3.12.8 PUSH and POP

PUSH reglist Push registers onto stack - Section 3.12.8 PUSH and POP

QADD {Rd,} Rn, Rm Saturating Add Q Section 3.6.3 QADD and QSUB

QADD16 {Rd,} Rn, Rm Saturating Add 16 - Section 3.6.3 QADD and QSUB

QADD8 {Rd,} Rn, Rm Saturating Add 8 - Section 3.6.3 QADD and QSUB

Saturating Add and

QASX {Rd,} Rn, Rm - Section 3.6.4 QASX and QSAX
Subtract with Exchange
Saturating Double and
QDADD {Rd,} Rn, Rm Q Section 3.6.5 QDADD and QDSUB
Add
Saturating Double and
QDSUB {Rd,} Rn, Rm Q Section 3.6.5 QDADD and QDSUB
Subtract
Saturating Subtract and
QSAX {Rd,} Rn, Rm - Section 3.6.4 QASX and QSAX
Add with Exchange
QSUB {Rd,} Rn, Rm Saturating Subtract Q Section 3.6.3 QADD and QSUB

QSUB16 {Rd,} Rn, Rm Saturating Subtract 16 - Section 3.6.3 QADD and QSUB

QSUB8 {Rd,} Rn, Rm Saturating Subtract 8 - Section 3.6.3 QADD and QSUB

Section 3.4.8 REV, REV16, REVSH,

RBIT Rd, Rn Reverse Bits -
and RBIT
Reverse byte order in a Section 3.4.8 REV, REV16, REVSH,
REV Rd, Rn -
word and RBIT
Reverse byte order in Section 3.4.8 REV, REV16, REVSH,
REV16 Rd, Rn -
each halfword and RBIT
Reverse byte order in
Section 3.4.8 REV, REV16, REVSH,
REVSH Rd, Rn bottom halfword and sign -
and RBIT
extend
Section 3.4.3 ASR, LSL, LSR, ROR,
ROR, RORS Rd, Rm, <Rs|#n> Rotate Right N,Z,C
and RRX
Section 3.4.3 ASR, LSL, LSR, ROR,
RRX, RRXS Rd, Rm Rotate Right with Extend N,Z,C
and RRX
Section 3.4.1 ADD, ADC, SUB,
RSB, RSBS {Rd,} Rn, Op2 Reverse Subtract N,Z,C,V
SBC, and RSB
SADD16 {Rd,} Rn, Rm Signed Add 16 GE Section 3.4.9 SADD16 and SADD8

SADD8 {Rd,} Rn, Rm Signed Add 8 GE Section 3.4.9 SADD16 and SADD8

Signed Add and Subtract

SASX {Rd,} Rn, Rm GE Section 3.4.10 SASX and SSAX
with Exchange
Section 3.4.1 ADD, ADC, SUB,
SBC, SBCS {Rd,} Rn, Op2 Subtract with Carry N,Z,C,V
SBC, and RSB

PM0264 - Rev 2 page 46/232

 PM0264
Instruction set summary

Mnemonic Operands Brief description Flags Page

Rd, Rn, #lsb,

SBFX Signed Bit Field Extract - Section 3.8.2 SBFX and UBFX
#width
SDIV {Rd,} Rn, Rm Signed Divide - Section 3.5.2 SDIV and UDIV

SEL {Rd,} Rn, Rm Select bytes GE Section 3.4.11 SEL

SEV - Send Event - Section 3.11.10 SEV

SG - Secure Gateway - Section 3.11.11 SG

Section 3.4.12 SHADD16 and

SHADD16 {Rd,} Rn, Rm Signed Halving Add 16 -
SHADD8
Section 3.4.12 SHADD16 and
SHADD8 {Rd,} Rn, Rm Signed Halving Add 8 -
SHADD8
Signed Halving Add and
SHASX {Rd,} Rn, Rm - Section 3.4.13 SHASX and SHSAX
Subtract with Exchange
Signed Halving Subtract
SHSAX {Rd,} Rn, Rm - Section 3.4.13 SHASX and SHSAX
and Add with Exchange
Signed Halving Subtract Section 3.4.14 SHSUB16 and
SHSUB16 {Rd,} Rn, Rm -
16 SHSUB8
Section 3.4.14 SHSUB16 and
SHSUB8 {Rd,} Rn, Rm Signed Halving Subtract 8 -
SHSUB8
SMLABB, Section 3.5.3 SMLAWB, SMLAWT,
Signed Multiply
SMLABT, Rd, Rn, Rm, Ra Q SMLABB, SMLABT, SMLATB, and
Accumulate halfwords
SMLATB, SMLATT SMLATT

Signed Multiply
SMLAD, SMLADX Rd, Rn, Rm, Ra Q Section 3.5.4 SMLAD and SMLADX
Accumulate Dual

RdLo, RdHi, Rn, Signed Multiply

Section 3.5.11 UMULL, UMAAL,
SMLAL Accumulate Long (32 × 32 -
Rm UMLAL, SMULL, and SMLAL
+ 64), 64-bit result
SMLALBB,
SMLALBT, RdLo, RdHi, Rn, Signed Multiply Section 3.5.5 SMLALD, SMLALDX,
Accumulate Long, - SMLALBB, SMLALBT, SMLALTB,
SMLALTB, Rm
halfwords and SMLALTT
SMLALTT

SMLALD, RdLo, RdHi, Rn, Section 3.5.5 SMLALD, SMLALDX,

Signed Multiply
- SMLALBB, SMLALBT, SMLALTB,
SMLALDX Rm Accumulate Long Dual
and SMLALTT
Signed Multiply Section 3.5.3 SMLAWB, SMLAWT,
SMLAWB, SMLAWT Rd, Rn, Rm, Ra Accumulate, word by Q SMLABB, SMLABT, SMLATB, and
halfword SMLATT
Signed Multiply Subtract
SMLSD, SMLSDX Rd, Rn, Rm, Ra Q Section 3.5.6 SMLSD and SMLSLD
Dual
SMLSLD, RdLo, RdHi, Rn, Signed Multiply Subtract
- Section 3.5.6 SMLSD and SMLSLD
SMLSLDX Rm Long Dual

Signed Most Significant

SMMLA, SMMLAR Rd, Rn, Rm, Ra - Section 3.5.7 SMMLA and SMMLS
Word Multiply Accumulate
Signed Most Significant
SMMLS, SMMLSR Rd, Rn, Rm, Ra - Section 3.5.7 SMMLA and SMMLS
Word Multiply Subtract
Signed Most Significant
SMMUL, SMMULR Rd, Rn, Rm - Section 3.5.8 SMMUL
Word Multiply
SMUAD, SMUADX {Rd,} Rn, Rm Signed Dual Multiply Add Q. Section 3.5.9 SMUAD and SMUSD

SMULBB,
Signed Multiply
SMULBT, {Rd,} Rn, Rm - Section 3.5.10 SMUL and SMULW
(halfwords)
SMULTB, SMULTT

PM0264 - Rev 2 page 47/232

 PM0264
Instruction set summary

Mnemonic Operands Brief description Flags Page

RdLo, RdHi, Rn, Signed Multiply Long (32 Section 3.5.11 UMULL, UMAAL,
SMULL -
Rm × 32), 64-bit result UMLAL, SMULL, and SMLAL

Signed Multiply word by

SMULWB, SMULWT {Rd,} Rn, Rm - Section 3.5.10 SMUL and SMULW
halfword
Signed Dual Multiply
SMUSD, SMUSDX {Rd,} Rn, Rm - Section 3.5.9 SMUAD and SMUSD
Subtract
Rd, #n, Rm
SSAT Signed Saturate Q Section 3.6.1 SSAT and USAT
{,shift #s}
SSAT16 Rd, #n, Rm Signed Saturate 16 Q Section 3.6.2 SSAT16 and USAT16

Signed Subtract and Add

SSAX {Rd,} Rn, Rm GE Section 3.4.10 SASX and SSAX
with Exchange
SSUB16 {Rd,} Rn, Rm Signed Subtract 16 GE Section 3.4.15 SSUB16 and SSUB8

SSUB8 {Rd,} Rn, Rm Signed Subtract 8 GE Section 3.4.15 SSUB16 and SSUB8

STL Rt, [Rn] Store-Release Word - Section 3.12.9 LDA and STL

STLB Rt, [Rn] Store-Release Byte - Section 3.12.9 LDA and STL

Store-Release Exclusive
STLEX Rt, Rt [Rn] - Section 3.12.11 LDAEX and STLEX
Word
Store-Release Exclusive
STLEXB Rt, Rt [Rn] - Section 3.12.11 LDAEX and STLEX
Byte
Store-Release Exclusive
STLEXH Rt, Rt [Rn] - Section 3.12.11 LDAEX and STLEX
Halfword
STLH Rt, [Rn] Store-Release Halfword - Section 3.12.9 LDA and STL

STM Rn{!}, reglist Store Multiple - Section 3.12.6 LDM and STM

Store Multiple Decrement

STMDB, STMEA Rn{!}, reglist - Section 3.12.6 LDM and STM
Before
Store Multiple Increment
STMIA, STMFD Rn{!}, reglist - Section 3.12.6 LDM and STM
After
Rt, [Rn, Rm {, Store Register Word Section 3.12.3 LDR and STR,
STR -
LSL #shift}] (register offset) register offset

Section 3.12.2 LDR

Rt, [Rn, Store Register Word
and STR, immediate offset,
STR, STRT (immediate offset, -
#offset] Section 3.12.4 LDR and STR,
unprivileged)
unprivileged
Rt, [Rn, Rm {, Store Register Byte Section 3.12.3 LDR and STR,
STRB -
LSL #shift}] (register offset) register offset

Section 3.12.2 LDR

Rt, [Rn, Store Register Byte
and STR, immediate offset,
STRB, STRBT (immediate offset, -
#offset] Section 3.12.4 LDR and STR,
unprivileged)
unprivileged
Rt, Rt2, [Rn, Store Register Dual two Section 3.12.2 LDR and STR,
STRD -
#offset] words immediate offset

Rd, Rt, [Rn,

STREX Store Register Exclusive - Section 3.12.10 LDREX and STREX
#offset]
Store Register Exclusive
STREXB Rd, Rt, [Rn] - Section 3.12.10 LDREX and STREX
Byte
Store Register Exclusive
STREXH Rd, Rt, [Rn] - Section 3.12.10 LDREX and STREX
Halfword
Rt, [Rn, Rm {, Store Register Halfword Section 3.12.3 LDR and STR,
STRH -
LSL #shift}] (register offset) register offset

PM0264 - Rev 2 page 48/232

 PM0264
Instruction set summary

Mnemonic Operands Brief description Flags Page

Section 3.12.2 LDR

Rt, [Rn, Store Register Halfword
and STR, immediate offset,
STRH, STRHT (immediate offset, -
#offset] Section 3.12.4 LDR and STR,
unprivileged)
unprivileged
Section 3.4.1 ADD, ADC, SUB,
SUB, SUBS {Rd,} Rn, Op2 Subtract N,Z,C,V
SBC, and RSB
Section 3.4.1 ADD, ADC, SUB,
SUB, SUBW {Rd,} Rn, #imm12 Subtract -
SBC, and RSB
SVC #imm Supervisor Call - Section 3.11.12 SVC

{Rd,} Rn, Rm Sign extend 8 bits to 32

SXTAB - Section 3.7.2 SXTA and UXTA
{,ROR #n} and Add

{Rd,} Rn, Rm Sign extend two 8-bit

SXTAB16 - Section 3.7.2 SXTA and UXTA
{,ROR #n} values to 16 and Add

{Rd,} Rn, Rm Sign extend 16 bits to 32

SXTAH - Section 3.7.2 SXTA and UXTA
{,ROR #n} and Add

Rd, Rm {,ROR
SXTB Sign extend 8 bits to 32 - Section 3.7.3 SXT and UXT
#n}
{Rd,} Rm {,ROR
SXTB16 Sign extend 8 bits to 16 - Section 3.7.3 SXT and UXT
#n}
{Rd,} Rm {,ROR Sign extend a Halfword to
SXTH - Section 3.7.3 SXT and UXT
#n} 32

TBB [Rn, Rm] Table Branch Byte - Section 3.9.6 TBB and TBH

[Rn, Rm, LSL

TBH Table Branch Halfword - Section 3.9.6 TBB and TBH
#1]
TEQ Rn, Op2 Test Equivalence N,Z,C Section 3.4.16 TST and TEQ

TST Rn, Op2 Test N,Z,C Section 3.4.16 TST and TEQ

Section 3.11.13 TT, TTT, TTA, and

TT Rd, [Rn] Test Target -
TTAT
Test Target Alternate Section 3.11.13 TT, TTT, TTA, and
TTA Rd, [Rn] -
Domain TTAT
Test Target Alternate Section 3.11.13 TT, TTT, TTA, and
TTAT Rd, [Rn] -
Domain Unprivileged TTAT
Section 3.11.13 TT, TTT, TTA, and
TTT Rd, [Rn] Test Target Unprivileged -
TTAT
UADD16 {Rd,} Rn, Rm Unsigned Add 16 GE Section 3.4.17 UADD16 and UADD8

UADD8 {Rd,} Rn, Rm Unsigned Add 8 GE Section 3.4.17 UADD16 and UADD8

Unsigned Add and

UASX {Rd,} Rn, Rm GE Section 3.4.18 UASX and USAX
Subtract with Exchange
Rd, Rn, #lsb,
UBFX Unsigned Bit Field Extract - Section 3.8.2 SBFX and UBFX
#width
UDF {c}{q} {#}imm Permanently Undefined. - Section 3.11.14 UDF

UDIV {Rd,} Rn, Rm Unsigned Divide - Section 3.5.2 SDIV and UDIV

Section 3.4.19 UHADD16 and

UHADD16 {Rd,} Rn, Rm Unsigned Halving Add 16 -
UHADD8
Section 3.4.19 UHADD16 and
UHADD8 {Rd,} Rn, Rm Unsigned Halving Add 8 -
UHADD8
Unsigned Halving Add and
UHASX {Rd,} Rn, Rm - Section 3.4.20 UHASX and UHSAX
Subtract with Exchange

PM0264 - Rev 2 page 49/232

 PM0264
Instruction set summary

Mnemonic Operands Brief description Flags Page

Unsigned Halving Subtract

UHSAX {Rd,} Rn, Rm - Section 3.4.20 UHASX and UHSAX
and Add with Exchange
Unsigned Halving Subtract Section 3.4.21 UHSUB16 and
UHSUB16 {Rd,} Rn, Rm -
16 UHSUB8
Unsigned Halving Subtract Section 3.4.21 UHSUB16 and
UHSUB8 {Rd,} Rn, Rm -
8 UHSUB8
Unsigned Multiply
RdLo, RdHi, Rn, Accumulate Accumulate Section 3.5.11 UMULL, UMAAL,
UMAAL -
Rm Long (32 × 32 + 32 + 32), UMLAL, SMULL, and SMLAL
64-bit result

RdLo, RdHi, Rn, Unsigned Multiply

Section 3.5.11 UMULL, UMAAL,
UMLAL Accumulate Long (32 × 32 -
Rm UMLAL, SMULL, and SMLAL
+ 64), 64-bit result
RdLo, RdHi, Rn, Unsigned Multiply Long Section 3.5.11 UMULL, UMAAL,
UMULL -
Rm (32 × 32), 64-bit result UMLAL, SMULL, and SMLAL

Unsigned Saturating Add

UQADD16 {Rd,} Rn, Rm - Section 3.6.7 UQADD and UQSUB
16
Unsigned Saturating Add
UQADD8 {Rd,} Rn, Rm - Section 3.6.7 UQADD and UQSUB
8
Unsigned Saturating Add
UQASX {Rd,} Rn, Rm and Subtract with - Section 3.6.6 UQASX and UQSAX
Exchange
Unsigned Saturating
UQSAX {Rd,} Rn, Rm Subtract and Add with - Section 3.6.6 UQASX and UQSAX
Exchange
Unsigned Saturating
UQSUB16 {Rd,} Rn, Rm - Section 3.6.7 UQADD and UQSUB
Subtract 16
Unsigned Saturating
UQSUB8 {Rd,} Rn, Rm - Section 3.6.7 UQADD and UQSUB
Subtract 8
Unsigned Sum of Absolute
USAD8 {Rd,} Rn, Rm - Section 3.4.22 USAD8
Differences
Unsigned Sum of
USADA8 Rd, Rn, Rm, Ra Absolute Differences and - Section 3.4.23 USADA8
Accumulate
Rd, #n, Rm{,shift
USAT Unsigned Saturate Q Section 3.6.1 SSAT and USAT
#s}, Ra
USAT16 Rd, #n, Rm Unsigned Saturate 16 Q Section 3.6.2 SSAT16 and USAT16

Unsigned Subtract and

USAX {Rd,} Rn, Rm GE Section 3.4.18 UASX and USAX
Add with Exchange
USUB16 {Rd,} Rn, Rm Unsigned Subtract 16 GE Section 3.4.24 USUB16 and USUB8

USUB8 {Rd,} Rn, Rm Unsigned Subtract 8 GE Section 3.4.24 USUB16 and USUB8

{Rd,} Rn, Rm Rotate, unsigned extend 8

UXTAB - Section 3.7.2 SXTA and UXTA
{,ROR #n} bits to 32 and Add

{Rd,} Rn, Rm Rotate, unsigned extend

UXTAB16 two 8-bit values to 16 and - Section 3.7.2 SXTA and UXTA
{,ROR #n}
Add
{Rd,} Rn, Rm Rotate, unsigned extend
UXTAH - Section 3.7.2 SXTA and UXTA
{,ROR #n} and Add Halfword

Rd, Rm {,ROR Unsigned zero-extend

UXTB - Section 3.7.3 SXT and UXT
#n} Byte

PM0264 - Rev 2 page 50/232

 PM0264
Instruction set summary

Mnemonic Operands Brief description Flags Page

{Rd,} Rm {,ROR Unsigned zero-extend

UXTB16 - Section 3.7.3 SXT and UXT
#n} Byte 16

Rd, Rm {,ROR Unsigned zero-extend

UXTH - Section 3.7.3 SXT and UXT
#n} Halfword

VABS .F32 Sd, Sm Floating-point Absolute - Section 3.10.3 VABS

.F32 {Sd,} Sn,

VADD Floating-point Add - Section 3.10.4 VADD
Sm
Compare two floating-
.F32 Sd, <<Sm| point registers, or one
VCMP N,Z,C,V Section 3.10.5 VCMP and VCMPE
#0.0> floating-point register and
zero
Compare two floating-
.F32 Sd, <<Sm| point registers, or one
VCMPE floating-point register and N,Z,C,V Section 3.10.5 VCMP and VCMPE
#0.0>
zero with Invalid Operation
check
.F32.Tm <Sd>, Convert from floating-point Section 3.10.6 VCVT and VCVTR
VCVT -
Sm to integer between floating-point and integer

.Td.F32 Sd, Sd, Convert from floating-point Section 3.10.7 VCVT between
VCVT -
#fbits to fixed point floating-point and fixed-point

Convert from floating-point

.Tm.F32 <Sd>, to integer with directed Section 3.10.35 VCVTA, VCVTM
VCVTA -
Sm rounding to nearest with VCVTN, and VCVTP
Ties Away
Convert half-precision
VCVTB VCVTT .F32.F16 Sd, Sm value to single-precision - Section 3.10.36 VCVTB and VCVTT
or double-precision
Convert single-precision
VCVTB VCVTT .F16.F32 Sd, Sm or double-precision - Section 3.10.36 VCVTB and VCVTT
register to half-precision
Convert from floating-point
.Tm.F32 <Sd>, to integer with directed Section 3.10.35 VCVTA, VCVTM
VCVTM -
Sm rounding towards Minus VCVTN, and VCVTP
infinity
Convert from floating-point
.Tm.F32 <Sd>, to integer with directed Section 3.10.35 VCVTA, VCVTM
VCVTN -
Sm rounding to nearest with VCVTN, and VCVTP
Ties to even
Convert from floating-point
.Tm.F32 <Sd>, to integer with directed Section 3.10.35 VCVTA, VCVTM
VCVTP -
Sm rounding towards Plus VCVTN, and VCVTP
infinity

.Tm.F32 <Sd>, Convert between floating-

Section 3.10.6 VCVT and VCVTR
VCVTR point and integer with -
Sm between floating-point and integer
rounding.
.F32 {Sd,} Sn,
VDIV Floating-point Divide - Section 3.10.8 VDIV
Sm
.F32 {Sd,} Sn, Floating-point Fused
VFMA - Section 3.10.9 VFMA and VFMS
Sm Multiply Accumulate

.F32 {Sd,} Sn, Floating-point Fused

VFMS - Section 3.10.9 VFMA and VFMS
Sm Multiply Subtract

.F32 {Sd,} Sn, Floating-point Fused

Section 3.10.10 VFNMA and
VFNMA Negate Multiply -
Sm VFNMS
Accumulate

PM0264 - Rev 2 page 51/232

 PM0264
Instruction set summary

Mnemonic Operands Brief description Flags Page

.F32 {Sd,} Sn, Floating-point Fused Section 3.10.10 VFNMA and

VFNMS -
Sm Negate Multiply Subtract VFNMS

{mode}{.size} Floating-point Load

VLDM Multiple extension - Section 3.10.11 VLDM
Rn{!}, list
registers

.F32 Sd, [<Rn> Floating-point Load an

VLDR extension register from - Section 3.10.12 VLDR
{, #offset}]
memory (immediate)
.F32 Sd, Load an extension register
VLDR - Section 3.10.12 VLDR
<label> from memory

.F32 Sd, Load an extension register

VLDR - Section 3.10.12 VLDR
[PC,#-0] from memory

Floating-point Lazy Load

VLLDM <c> Rn - Section 3.10.13 VLLDM
multiple
Floating-point Lazy Store
VLSTM <c> Rn - Section 3.10.14 VLSTM
multiple
Maximum of two
floating-point numbers Section 3.10.37 VMAXNM and
VMAXNM .F32 Sd, Sn, Sm -
with IEEE754-2008 NaN VMINNM
handling
Minimum of two floating-
point numbers with Section 3.10.37 VMAXNM and
VMINNM .F32 Sd, Sn, Sm -
IEEE754-2008 NaN VMINNM
handling
Floating-point Multiply
VMLA .F32 Sd, Sn, Sm - Section 3.10.15 VMLA and VMLS
Accumulate
Floating-point Multiply
VMLS .F32 Sd, Sn, Sm - Section 3.10.15 VMLA and VMLS
Subtract
<Sn|Rt>, <Rt| Copy core register to Section 3.10.19 VMOV core register
VMOV -
Sn> single-precision to single-precision

<Sm|Rt>, <Sm1| Section 3.10.20 VMOV two core

Copy two core registers to
VMOV Rt2>, <Rt|Sm>, - registers to two single-precision
two single-precision
<Rt2|Sm1> registers

{.size} Dd[x], Copy core register to Section 3.10.22 VMOV core register
VMOV -
Rt scalar to scalar

Copy scalar to core Section 3.10.18 VMOV scalar to

VMOV {.dt} Rt, Dn[x] -
register core register
Floating-point Move
VMOV .F32 Sd, #immm - Section 3.10.16 VMOV Immediate
immediate
Copies the contents of
VMOV .F32 Sd, Sd, Sm - Section 3.10.17 VMOV Register
one register to another
Floating-point Move
<Dm|Rt>, <Rt| transfers two words Section 3.10.21 VMOV two core
VMOV between two core - registers and a double-precision
Rt2>, <Rt2|Dm>
registers and a register
doubleword register
Move to core register
VMRS Rt, FPSCR from floating-point Special N,Z,C,V Section 3.10.23 VMRS
Register
Move to floating-point
VMSR FPSCR, Rt Special Register from core - Section 3.10.24 VMSR
register

PM0264 - Rev 2 page 52/232

 PM0264
Instruction set summary

Mnemonic Operands Brief description Flags Page

.F32 {Sd,} Sn,

VMUL Floating-point Multiply - Section 3.10.25 VMUL
Sm
VNEG .F32 Sd, Sm Floating-point Negate - Section 3.10.26 VNEG

Floating-point Multiply Section 3.10.27 VNMLA, VNMLS

VNMLA .F32 Sd, Sn, Sm -
Accumulate and Negate and VNMUL
Floating-point Multiply, Section 3.10.27 VNMLA, VNMLS
VNMLS .F32 Sd, Sn, Sm -
Subtract and Negate and VNMUL
.F32 {Sd,} Sn, Floating-point Multiply and Section 3.10.27 VNMLA, VNMLS
VNMUL -
Sm Negate and VNMUL

Load multiple consecutive

VPOP {.size} list floating-point registers - Section 3.10.28 VPOP
from the stack
Store multiple consecutive
VPUSH {.size} list floating-point registers to - Section 3.10.29 VPUSH
the stack
Float to integer in floating-
point format conversion Section 3.10.39 VRINTA, VRINTN,
VRINTA .F32 Sd, Sm -
with directed rounding to VRINTP, VRINTM, and VRINTZ
Nearest with Ties Away
Float to integer in floating-
point format conversion Section 3.10.39 VRINTA, VRINTN,
VRINTM .F32 Sd, Sm -
with directed rounding to VRINTP, VRINTM, and VRINTZ
Minus infinity
Float to integer in floating-
point format conversion Section 3.10.39 VRINTA, VRINTN,
VRINTN .F32 Sd, Sm -
with directed rounding to VRINTP, VRINTM, and VRINTZ
Nearest with Ties to even
Float to integer in floating-
point format conversion Section 3.10.39 VRINTA, VRINTN,
VRINTP .F32 Sd, Sm -
with directed rounding to VRINTP, VRINTM, and VRINTZ
Plus infinity
Float to integer in floating-
point format conversion Section 3.10.38 VRINTR and
VRINTR .F32 Sd, Sm -
with rounding towards VRINTX
value specified in FPSCR
Float to integer in floating-
point format conversion Section 3.10.38 VRINTR and
VRINTX .F32 Sd, Sm -
with rounding specified in VRINTX
FPSCR
Float to integer in floating-
point format conversion Section 3.10.39 VRINTA, VRINTN,
VRINTZ .F32 Sd, Sm -
with rounding towards VRINTP, VRINTM, and VRINTZ
Zero
Select register, alternative
VSEL .F32 Sd, Sn, Sm to a pair of conditional - Section 3.10.34 VSEL
VMOV
Calculates floating-point
VSQRT .F32 Sd, Sm - Section 3.10.30 VSQRT
Square Root
{mode}{.size} Floating-point Store
VSTM - Section 3.10.31 VSTM
Rn{!}, list Multiple

Floating-point Store
.F32 Sd, [Rn{, Register stores an
VSTR - Section 3.10.32 VSTR
#offset}] extension register to
memory

PM0264 - Rev 2 page 53/232

 PM0264
CMSIS functions

Mnemonic Operands Brief description Flags Page

F32 {Sd,} Sn,

VSUB Floating-point Subtract - Section 3.10.33 VSUB
Sm
WFE - Wait For Event - Section 3.11.15 WFE

WFI - Wait For Interrupt - Section 3.11.16 WFI

YIELD - Suspend task - Section 3.11.17 YIELD

3.1.1 Binary compatibility with other Cortex processors

The processor implements the T32 instruction set and features provided by the Armv8‑M architecture profile.
There are restrictions on moving code designed for processors that are implementations of the Armv6‑M or
Armv7‑M architectures.
If code designed for other Cortex‑M processors relies on memory protection, it cannot be moved to the
Cortex‑M33 processor. In this case, the memory protection scheme and driver code must be updated from
PMSAv7 to PMSAv8.
If code for the Armv7‑M processor relies on double-precision-floating point, it cannot be moved to the Cortex‑M33
processor. Any Armv7‑M code that uses double-precision arithmetic must be recompiled to use a software library,
or DP emulation if supported by the tools.
To ensure a smooth transition, Arm recommends that code designed to operate on other Cortex‑M profile
processor architectures obey the following rules and that you configure the Configuration and Control Register
(CCR) appropriately:
• Use word transfers only to access registers in the NVIC and System Control Space (SCS).
• Treat all unused SCS registers and register fields on the processor as Do-Not-Modify.
• Configure the following fields in the CCR:
– STKALIGN bit to 1.
– UNALIGN_TRP bit to 1.
– Leave all other bits in the CCR register at their original value.

3.2 CMSIS functions

ISO/IEC C code cannot directly access some Cortex-M33 processor instructions. Instead, intrinsic functions that
are provided by the CMSIS or a C compiler are used to generate them. If a C compiler does not support an
appropriate intrinsic function, you might have to use inline assembler to access some instructions.

3.2.1 List of CMSIS functions to generate some processor instructions

The CMSIS provides the following intrinsic functions that are provided to generate instructions that ISO/IEC C
code cannot directly access.

Table 31. CMSIS functions to generate some Cortex-M33 processor instructions

Instruction CMSIS function

BKPT void __BKPT

CLREX void __CLREX
CLZ uint8_t __CLZ (uint32_t value)
CPSID F void __disable_fault_irq(void)
CPSID I void __disable_irq(void)
CPSIE F void __enable_fault_irq(void)
CPSIE I void __enable_irq(void)
DMB void __DMB(void)
DSB void __DSB(void)

PM0264 - Rev 2 page 54/232

 PM0264
CMSIS functions

Instruction CMSIS function

ISB void __ISB(void)

LDA uint32_t __LDA (volatile uint32_t * ptr)
LDAB uint8_t __LDAB (volatile uint8_t * ptr)
LDAEX uint32_t __LDAEX (volatile uint32_t * ptr)
LDAEXB uint8_t __LDAEXB (volatile uint32_t * ptr)
LDAEXH uint16_t __LDAEXH (volatile uint32_t * ptr)
LDAH uint32_t __LDAH (volatile uint32_t * addr)
LDRT uint32_t __LDRT (uint32_t ptr)
NOP void __NOP (void)
RBIT uint32_t __RBIT(uint32_t int value)
REV uint32_t __REV(uint32_t int value)
REV16 uint32_t __REV16(uint32_t int value)
REVSH uint32_t __REVSH(uint32_t int value)
ROR uint32_t __ROR (uint32_t value, uint32_t shift)
RRX uint32_t __RRX (uint32_t value)
SEV void __SEV (void)
STL void __STL (uint32_t value, volatile uint32_t * ptr)
STLEX uint32_t __STLEX (uint16_t value, volatile uint32_t * ptr)
STLEXB uint32_t __STLEXB (uint16_t value, volatile uint8_t * ptr)
STLEXH uint32_t __STLEXH (uint16_t value, volatile uint16_t * ptr)
STLH void __STLH (uint16_t value, volatile uint16_t * ptr)
STREX uint32_t __STREXW (uint32_t value, uint32_t *addr)
STREXB uint32_t __STREXB (uint8_t value, uint8_t *addr)
STREXH uint32_t __STREXH (uint16_t value, uint16_t *addr)
WFE void __WFE(void)
WFI void __WFI(void)

3.2.2 CMSE
CMSE is the compiler support for the Security Extension (architecture intrinsics and options) and is part of the
Arm C Language (ACLE) specification.
CMSE features are required when developing software running in Secure state. This provides mechanisms to
define Secure entry points and enable the tool chain to generate correct instructions or support functions in the
program image.
The CMSE features are accessed using various attributes and intrinsics. Additional macros are also defined as
part of the CMSE.

3.2.3 CMSIS functions to access the special registers

List of functions that are provided by the CMSIS for accessing the special registers using MRS and MSR
instructions.

PM0264 - Rev 2 page 55/232

 PM0264
CMSIS functions

Table 32. CMSIS functions to access the special registers

Special register Access CMSIS function

Read uint32_t __get_PRIMASK (void)

PRIMASK
Write void __set_PRIMASK (uint32_t value)
Read uint32_t __get_FAULTMASK (void)
FAULTMASK
Write void __set_FAULTMASK (uint32_t value)
Read uint32_t __get_BASEPRI (void)
BASEPRI
Write void __set_BASEPRI (uint32_t value)
Read uint32_t __get_CONTROL (void)
CONTROL
Write void __set_CONTROL (uint32_t value)
Read uint32_t __get_MSP (void)
MSP
Write void __set_MSP (uint32_t TopOfMainStack)
Read uint32_t __get_PSP (void)
PSP
Write void __set_PSP (uint32_t TopOfProcStack)
APSR Read uint32_t __get_APSR (void)
IPSR Read uint32_t __get_IPSR (void)
xPSR Read uint32_t __get_xPSR (void)
BASEPRI_MAX Write void __set_BASEPRI_MAX (uint32_t basePri)
Read uint32_t __get_FPSCR (void)
FPSCR
Write void __set_FPSCR (uint32_t fpscr)
Read uint32_t __get_MSPLIM (void)
MSPLIM
Write void __set_MSPLIM (uint32_t MainStackPtrLimit)
Read uint32_t __get_PSPLIM (void)
PSPLIM
Write void __set_PSPLIM (uint32_t ProcStackPtrLimit)

3.2.4 CMSIS functions to access the Non-secure special registers

The CMSIS also provides several functions for accessing the Non-secure special registers in Secure state using
MRS and MSR instructions:

Table 33. CMSIS intrinsic functions to access the Non-secure special registers

Special register Access CMSIS function

Read uint32_t __TZ_get_PRIMASK_NS (void)

PRIMASK_NS
Write void __TZ_set_PRIMASK_NS (uint32_t value)
Read uint32_t __TZ_get_FAULTMASK_NS (void)
FAULTMASK_NS
Write void __TZ_set_FAULTMASK_NS (uint32_t value)
Read uint32_t __TZ_get_CONTROL_NS (void)
CONTROL_NS
Write void __TZ_set_CONTROL_NS (uint32_t value)
Read uint32_t __TZ_get_MSP_NS (void)
MSP_NS
Write void __TZ_set_MSP_NS (uint32_t TopOfMainStack)
Read uint32_t __TZ_get_PSP_NS (void)
PSP_NS
Write void __TZ_set_PSP_NS (uint32_t TopOfProcStack)

PM0264 - Rev 2 page 56/232

 PM0264
About the instruction descriptions

Special register Access CMSIS function

Read uint32_t __TZ_get_MSPLIM_NS (void)

MSPLIM_NS
Write void __TZ_set_MSPLIM_NS (uint32_t MainStackPtrLimit)
Read uint32_t __TZ_get_PSPLIM_NS (void)
PSPLIM_NS
Write void __TZ_set_PSPLIM_NS (uint32_t ProcStackPtrLimit)

3.3 About the instruction descriptions

The following sections give more information about using the instructions:
• Section 3.3.1 Operands
• Section 3.3.2 Restrictions when using PC or SP
• Section 3.3.3 Flexible second operand
• Section 3.3.4 Shift Operations
• Section 3.3.5 Address alignment
• Section 3.3.6 PC‑relative expressions
• Section 3.3.7 Conditional execution
• Section 3.3.8 Instruction width selection

3.3.1 Operands
An instruction operand can be an Arm register, a constant, or another instruction-specific parameter. Instructions
act on the operands and often store the result in a destination register. When there is a destination register in the
instruction, it is usually specified before the operands.
Operands in some instructions are flexible in that they can either be a register or a constant.

3.3.2 Restrictions when using PC or SP

Many instructions have restrictions on whether you can use the Program Counter (PC) or Stack Pointer (SP) for
the operands or destination register. See instruction descriptions for more information.
Note: • For correct operation of B{L}XNS, Rm[0] must be 0 for correct Secure to Non-secure transition.
• Bit[0] of any address you write to the PC with a BX, BLX, LDM, LDR, or POP instruction must be 1 for
correct execution, because this bit indicates the required instruction set, and the Cortex‑M33 processor
only supports T32 instructions.

3.3.3 Flexible second operand

Many general data processing instructions have a flexible second operand. This is shown as Operand2 in the
descriptions of the syntax of each instruction.
Operand2 can be:
• A constant.
• A register with optional shift.

3.3.3.1 Constant
Instruction form when specifying an Operand2 constant.
#constant
where constant can be:
• Any constant that can be produced by shifting an 8‑bit value left by any number of bits within a 32‑bit word.
• Any constant of the form 0x00XY00XY.
• Any constant of the form 0xXY00XY00.
• Any constant of the form 0xXYXYXYXY.
Note: In these constants, X and Y are hexadecimal digits.

PM0264 - Rev 2 page 57/232

 PM0264
About the instruction descriptions

In addition, in a small number of instructions, constant can take a wider range of values. These are described in
the individual instruction descriptions.
When an Operand2 constant is used with the instructions MOVS, MVNS, ANDS, ORRS, ORNS, EORS, BICS, TEQ or
TST, the carry flag is updated to bit[31] of the constant, if the constant is greater than 255 and can be produced by
shifting an 8-bit value. These instructions do not affect the carry flag if Operand2 is any other constant.

3.3.3.1.1 Instruction substitution

Your assembler might be able to produce an equivalent instruction in cases where you specify a constant that is
not permitted.
For example, an assembler might assemble the instruction CMP Rd, #0xFFFFFFFE as the equivalent instruction
CMN Rd, #0x2.

3.3.3.2 Register with optional shift

Instruction form when specifying an Operand2 register.
Rm {, shift}
Where:
Rm
Is the register holding the data for the second operand.
shift
Is an optional shift to be applied to Rm. It can be one of:

ASR #n
Arithmetic shift right n bits, 1 ≤ n ≤ 32.

LSL #n
Logical shift left n bits, 1 ≤ n ≤ 31.

LSR #n
Logical shift right n bits, 1 ≤ n ≤ 32.

ROR #n
Rotate right n bits, 1 ≤ n ≤ 31.

RRX
Shift right one bit and insert the carry flag into the most significant bit of the result.

-
If omitted, no shift occurs, equivalent to LSL #0.

If you omit the shift, or specify LSL #0, the instruction uses the value in Rm.
If you specify a shift, the shift is applied to the value in Rm, and the resulting 32-bit value is used by the
instruction. However, the contents in the register Rm remain unchanged. Specifying a register with shift also
updates the carry flag when used with certain instructions.

3.3.4 Shift Operations

Register shift operations move the bits in a register left or right by a specified number of bits, the shift length.
Register shift can be performed:
• Directly by the instructions ASR, LSR, LSL, ROR, and RRX, and the result is written to a destination register.
• During the calculation of Operand2 by the instructions that specify the second operand as a register with
shift. The result is used by the instruction.

PM0264 - Rev 2 page 58/232

 PM0264
About the instruction descriptions

The permitted shift lengths depend on the shift type and the instruction, see the individual instruction description
or the Flexible second operand. If the shift length is 0, no shift occurs. Register shift operations update the carry
flag except when the specified shift length is 0. The following sub-sections describe the various shift operations
and how they affect the carry flag. In these descriptions, Rm is the register containing the value to be shifted, and
n is the shift length.

3.3.4.1 ASR
Arithmetic shift right by n bits moves the left-hand 32-n bits of the register Rm, to the right by n places, into the
right-hand 32-n bits of the result. And it copies the original bit[31] of the register into the left‑hand n bits of the
result.
You can use the ASR #n operation to divide the value in the register Rm by 2n, with the result being rounded
towards negative-infinity.
When the instruction is ASRS or when ASR #n is used in Operand2 with the instructions MOVS, MVNS, ANDS,
ORRS, ORNS, EORS, BICS, TEQ or TST, the carry flag is updated to the last bit shifted out, bit[n-1], of the register
Rm.
Note: • If n is 32 or more, then all the bits in the result are set to the value of bit[31] of Rm.
• If n is 32 or more and the carry flag is updated, it is updated to the value of bit[31] of Rm.

Figure 13. ASR #3

Carry
Flag

31 5 4 3 2 1 0

3.3.4.2 LSR
Logical shift right by n bits moves the left-hand 32-n bits of the register Rm, to the right by n places, into the
right-hand 32-n bits of the result. And it sets the left‑hand n bits of the result to 0.
You can use the LSR #n operation to divide the value in the register Rm by 2n, if the value is regarded as an
unsigned integer.
When the instruction is LSRS or when LSR #n is used in Operand2 with the instructions MOVS, MVNS, ANDS, ORRS,
ORNS, EORS, BICS, TEQ or TST, the carry flag is updated to the last bit shifted out, bit[n-1], of the register Rm.
Note: • If n is 32 or more, then all the bits in the result are cleared to 0.
• If n is 33 or more and the carry flag is updated, it is updated to 0.

Figure 14. LSR #3

Carry
0 0 0 Flag

31 5 4 3 2 1 0

3.3.4.3 LSL
Logical shift left by n bits moves the right-hand 32-n bits of the register Rm, to the left by n places, into the
left-hand 32-n bits of the result. And it sets the right‑hand n bits of the result to 0.
You can use the LSL #n operation to multiply the value in the register Rm by 2n, if the value is regarded as an
unsigned integer or a two’s complement signed integer. Overflow can occur without warning.
When the instruction is LSLS or when LSL #n, with non-zero n, is used in Operand2 with the instructions MOVS,
MVNS, ANDS, ORRS, ORNS, EORS, BICS, TEQ or TST, the carry flag is updated to the last bit shifted out, bit[32-n],
of the register Rm. These instructions do not affect the carry flag when used with LSL #0.

PM0264 - Rev 2 page 59/232

 PM0264
About the instruction descriptions

Note: • If n is 32 or more, then all the bits in the result are cleared to 0.
• If n is 33 or more and the carry flag is updated, it is updated to 0.

Figure 15. LSL #3

0 0 0

31 5 4 3 2 1 0

Carry
Flag

3.3.4.4 ROR
Rotate right by n bits moves the left-hand 32-n bits of the register Rm, to the right by n places, into the right-hand
32-n bits of the result. And it moves the right‑hand n bits of the register into the left‑hand n bits of the result.
When the instruction is RORS or when ROR #n is used in Operand2 with the instructions MOVS, MVNS, ANDS,
ORRS, ORNS, EORS, BICS, TEQ or TST, the carry flag is updated to the last bit rotation, bit[n-1], of the register Rm.
Note: • If n is 32, then the value of the result is same as the value in Rm, and if the carry flag is updated, it is
updated to bit[31] of Rm.
• ROR with shift length, n, more than 32 is the same as ROR with shift length n-32.

Figure 16. ROR #3

Carry
Flag

31 5 4 3 2 1 0

3.3.4.5 RRX
Rotate right with extend moves the bits of the register Rm to the right by one bit. And it copies the carry flag into
bit[31] of the result.
When the instruction is RRXS or when RRX is used in Operand2 with the instructions MOVS, MVNS, ANDS, ORRS,
ORNS, EORS, BICS, TEQ or TST, the carry flag is updated to bit[0] of the register Rm.

Figure 17. RRX

Carry
Flag

31 30 1 0

3.3.5 Address alignment

An aligned access is an operation where a word-aligned address is used for a word, dual word, or multiple word
access, or where a halfword-aligned address is used for a halfword access. Byte accesses are always aligned.
The Cortex‑M33 processor supports unaligned access only for the following instructions:
• LDR, LDRT.
• LDRH, LDRHT.
• LDRSH, LDRSHT.
• STR, STRT.
• STRH, STRHT.

PM0264 - Rev 2 page 60/232

 PM0264
About the instruction descriptions

All other load and store instructions generate a UsageFault exception if they perform an unaligned access, and
therefore their accesses must be address aligned.
Unaligned accesses are usually slower than aligned accesses. In addition, some memory regions might not
support unaligned accesses. Therefore, Arm recommends that programmers ensure that accesses are aligned.
To trap accidental generation of unaligned accesses, use the UNALIGN_TRP bit in the Configuration and Control
Register.

3.3.6 PC‑relative expressions

A PC‑‑relative expression or label is a symbol that represents the address of an instruction or literal data. It is
represented in the instruction as the PC value plus or minus a numeric offset. The assembler calculates the
required offset from the label and the address of the current instruction. If the offset is too big, the assembler
produces an error.
Note: • For B, BL, CBNZ, and CBZ instructions, the value of the PC is the address of the current instruction plus 4
bytes.
• For all other instructions that use labels, the value of the PC is the address of the current instruction plus 4
bytes, with bit[1] of the result cleared to 0 to make it word-aligned.
• Your assembler might permit other syntaxes for PC-relative expressions, such as a label plus or minus a
number, or an expression of the form [PC, #number].

3.3.7 Conditional execution

Most data processing instructions can optionally update the condition flags in the Application Program Status
Register (APSR) according to the result of the operation. Some instructions update all flags, and some only
update a subset. If a flag is not updated, the original value is preserved. See the instruction descriptions for the
flags they affect.
You can execute an instruction conditionally, based on the condition flags set in another instruction, either:
• Immediately after the instruction that updated the flags.
• After any number of intervening instructions that have not updated the flags.
Conditional execution is available by using conditional branches or by adding condition code suffixes to
instructions. The condition code suffix enables the processor to test a condition based on the flags. If the
condition test of a conditional instruction fails, the instruction:
• Does not execute.
• Does not write any value to its destination register.
• Does not affect any of the flags.
• Does not generate any exception.
Conditional instructions, except for conditional branches, must be inside an If-Then instruction block. Depending
on the vendor, the assembler might automatically insert an IT instruction if you have conditional instructions
outside the IT block.
Use the CBZ and CBNZ instructions to compare the value of a register against zero and branch on the result.

PM0264 - Rev 2 page 61/232

 PM0264
About the instruction descriptions

3.3.7.1 The condition flags

The APSR contains the N, Z, C, and V condition flags.
N Set to 1 when the result of the operation was negative, cleared to 0 otherwise.
Z Set to 1 when the result of the operation was zero, cleared to 0 otherwise.
C Set to 1 when the operation resulted in a carry, cleared to 0 otherwise.
V Set to 1 when the operation caused overflow, cleared to 0 otherwise.

For more information about APSR, see Section 2.1.3.6.1 Application Program Status Register
The C condition flag is set in one of four ways:
• For an addition, including the comparison instruction CMN, C is set to 1 if the addition produced a carry (that
is, an unsigned overflow), and to 0 otherwise.
• For a subtraction, including the comparison instruction CMP, C is set to 0 if the subtraction produced a
borrow (that is, an unsigned underflow), and to 1 otherwise.
• For non-addition or subtractions that incorporate a shift operation, C is set to the last bit shifted out of the
value by the shifter.
• For other non-addition or subtractions, C is normally left unchanged. See the individual instruction
descriptions for any special cases.
Overflow occurs when the sign of the result, in bit[31], does not match the sign of the result had the operation
been performed at infinite precision. For example, the V condition flag can be set in one of four ways:
• If adding two negative values results in a positive value.
• If adding two positive values results in a negative value.
• If subtracting a positive value from a negative value generates a positive value.
• If subtracting a negative value from a positive value generates a negative value.
The Compare operations are identical to subtracting, for CMP, or adding, for CMN, except that the result is
discarded. See the instruction descriptions for more information.
Note: Most instructions update the status flags only if the S suffix is specified. See the instruction descriptions for more
information.

3.3.7.2 Condition code suffixes

The instructions that can be conditional have an optional condition code, shown in syntax descriptions as {cond}.
Conditional execution requires a preceding IT instruction. An instruction with a condition code is only executed if
the condition code flags in the APSR meet the specified condition.
You can use conditional execution with the IT instruction to reduce the number of branch instructions in code.
The following table also shows the relationship between condition code suffixes and the N, Z, C, and V flags.

Table 34. Condition code suffixes

Suffix Flags Meaning

EQ Z=1 Equal.

NE Z=0 Not equal.

CS or HS C=1 Higher or same, unsigned.

CC or LO C=0 Lower, unsigned.

MI N=1 Negative.

PL N=0 Positive or zero.

VS V=1 Overflow.

VC V=0 No overflow.

HI C = 1 and Z = 0 Higher, unsigned.

LS C = 0 or Z = 1 Lower or same, unsigned.

PM0264 - Rev 2 page 62/232

 PM0264
General data processing instructions

Suffix Flags Meaning

GE N=V Greater than or equal, signed.

LT N != V Less than, signed.

GT Z = 0 and N = V Greater than, signed.

LE Z = 1 and N != V Less than or equal, signed.

AL Can have any value Always. This is the default when no suffix is specified.

The following example shows the use of a conditional instruction to find the absolute value of a number. R0 =
abs(R1).
Absolute value MOVS R0, R1 ; R0 = R1, setting flags.
IT MI ; Skipping next instruction if value 0 or positive.
RSBMI R0, R0, #0 ; If negative, R0 = -R0.

The following example shows the use of conditional instructions to update the value of R4 if the signed values R0
is greater than R1 and R2 is greater than R3.
Compare and update value CMP R0, R1 ; Compare R0 and R1, setting flags.
ITT GT ; Skip next two instructions unless GT condition holds.
CMPGT R2, R3 ; If 'greater than', compare R2 and R3, setting flags.
MOVGT R4, R5 ; If still 'greater than', do R4 = R5.

3.3.8 Instruction width selection

There are many instructions that can generate either a 16-bit encoding or a 32-bit encoding depending on the
operands and destination register specified. For some of these instructions, you can force a specific instruction
size by using an instruction width suffix. The .W suffix forces a 32-bit instruction encoding. The .N suffix forces a
16-bit instruction encoding.
If you specify an instruction width suffix and the assembler cannot generate an instruction encoding of the
requested width, it generates an error.
Note: In some cases it might be necessary to specify the .W suffix, for example if the operand is the label of an
instruction or literal data, as in the case of branch instructions. This is because the assembler might not
automatically generate the right size encoding.
To use an instruction width suffix, place it immediately after the instruction mnemonic and condition code, if any.
The following example shows instructions with the instruction width suffix.
Instruction width selection BCS.W label ; Creates a 32-bit instruction even for a short branch.
ADDS.W R0, R0, R1 ; Creates a 32-bit instruction even though the same
; operation can be done by a 16-bit instruction.

3.4 General data processing instructions

Table 35 shows the data processing instructions:

Table 35. Data processing instructions

Mnemonic Brief description See

ADC Add with Carry Section 3.4.1 ADD, ADC, SUB, SBC, and RSB

ADD Add Section 3.4.1 ADD, ADC, SUB, SBC, and RSB

ADDW Add Section 3.4.1 ADD, ADC, SUB, SBC, and RSB

AND Logical AND Section 3.4.2 AND, ORR, EOR, BIC, and ORN

ASR Arithmetic Shift Right Section 3.4.3 ASR, LSL, LSR, ROR, and RRX

BIC Bit Clear Section 3.4.2 AND, ORR, EOR, BIC, and ORN

PM0264 - Rev 2 page 63/232

 PM0264
General data processing instructions

Mnemonic Brief description See

CLZ Count leading zeros Section 3.4.4 CLZ

CMN Compare Negative Section 3.4.5 CMP and CMN

CMP Compare Section 3.4.5 CMP and CMN

EOR Exclusive OR Section 3.4.2 AND, ORR, EOR, BIC, and ORN

LSL Logical Shift Left Section 3.4.3 ASR, LSL, LSR, ROR, and RRX

LSR Logical Shift Right Section 3.4.3 ASR, LSL, LSR, ROR, and RRX

MOV Move Section 3.4.6 MOV and MVN

MOVT Move Top Section 3.4.7 MOVT

MOVW Move 16-bit constant Section 3.4.6 MOV and MVN

MVN Move NOT Section 3.4.6 MOV and MVN

ORN Logical OR NOT Section 3.4.2 AND, ORR, EOR, BIC, and ORN

ORR Logical OR Section 3.4.2 AND, ORR, EOR, BIC, and ORN

RBIT Reverse Bits Section 3.4.8 REV, REV16, REVSH, and RBIT

REV Reverse byte order in a word Section 3.4.8 REV, REV16, REVSH, and RBIT

REV16 Reverse byte order in each halfword Section 3.4.8 REV, REV16, REVSH, and RBIT

REVSH Reverse byte order in bottom halfword and sign extend Section 3.4.8 REV, REV16, REVSH, and RBIT

ROR Rotate Right Section 3.4.3 ASR, LSL, LSR, ROR, and RRX

RRX Rotate Right with Extend Section 3.4.3 ASR, LSL, LSR, ROR, and RRX

RSB Reverse Subtract Section 3.4.1 ADD, ADC, SUB, SBC, and RSB

SADD16 Signed Add 16 Section 3.4.9 SADD16 and SADD8

SADD8 Signed Add 8 Section 3.4.9 SADD16 and SADD8

SASX Signed Add and Subtract with Exchange Section 3.4.10 SASX and SSAX

SEL Select bytes Section 3.4.11 SEL

SSAX Signed Subtract and Add with Exchange Section 3.4.10 SASX and SSAX

SBC Subtract with Carry Section 3.4.1 ADD, ADC, SUB, SBC, and RSB

SHADD16 Signed Halving Add 16 Section 3.4.12 SHADD16 and SHADD8

SHADD8 Signed Halving Add 8 Section 3.4.12 SHADD16 and SHADD8

SHASX Signed Halving Add and Subtract with Exchange Section 3.4.13 SHASX and SHSAX

SHSAX Signed Halving Subtract and Add with Exchange Section 3.4.13 SHASX and SHSAX

SHSUB16 Signed Halving Subtract 16 Section 3.4.14 SHSUB16 and SHSUB8

SHSUB8 Signed Halving Subtract 8 Section 3.4.14 SHSUB16 and SHSUB8

SSUB16 Signed Subtract 16 Section 3.4.15 SSUB16 and SSUB8

SSUB8 Signed Subtract 8 Section 3.4.15 SSUB16 and SSUB8

SUB Subtract Section 3.4.1 ADD, ADC, SUB, SBC, and RSB

SUBW Subtract Section 3.4.1 ADD, ADC, SUB, SBC, and RSB

TEQ Test Equivalence Section 3.4.16 TST and TEQ

TST Test Section 3.4.16 TST and TEQ

UADD16 Unsigned Add 16 Section 3.4.17 UADD16 and UADD8

UADD8 Unsigned Add 8 Section 3.4.17 UADD16 and UADD8

PM0264 - Rev 2 page 64/232

 PM0264
General data processing instructions

Mnemonic Brief description See

UASX Unsigned Add and Subtract with Exchange Section 3.4.18 UASX and USAX

USAX Unsigned Subtract and Add with Exchange Section 3.4.18 UASX and USAX

UHADD16 Unsigned Halving Add 16 Section 3.4.19 UHADD16 and UHADD8

UHADD8 Unsigned Halving Add 8 Section 3.4.19 UHADD16 and UHADD8

UHASX Unsigned Halving Add and Subtract with Exchange Section 3.4.20 UHASX and UHSAX

UHSAX Unsigned Halving Subtract and Add with Exchange Section 3.4.20 UHASX and UHSAX

UHSUB16 Unsigned Halving Subtract 16 Section 3.4.21 UHSUB16 and UHSUB8

UHSUB8 Unsigned Halving Subtract 8 Section 3.4.21 UHSUB16 and UHSUB8

USAD8 Unsigned Sum of Absolute Differences Section 3.4.22 USAD8

USADA8 Unsigned Sum of Absolute Differences and Accumulate Section 3.4.23 USADA8

USUB16 Unsigned Subtract 16 Section 3.4.24 USUB16 and USUB8

USUB8 Unsigned Subtract 8 Section 3.4.24 USUB16 and USUB8

3.4.1 ADD, ADC, SUB, SBC, and RSB

Add, Add with carry, Subtract, Subtract with carry, and Reverse Subtract.

op{S}{cond} {Rd,} Rn, Operand2 ; ADD; ADC; SBC; RSB

op{S|W}{cond} {Rd,} Rn, #imm12 ; ADD; SUB
Where:
op
Is one of:
ADD
Add.
ADC
Add with Carry.
SUB
Subtract.
SBC
Subtract with Carry.
RSB
Reverse Subtract.

S
Is an optional suffix. If S is specified, the condition code flags are updated on the result of the operation.
cond
Is an optional condition code.
Rd
Is the destination register. If Rd is omitted, the destination register is Rn.
Rn
Is the register holding the first operand.
Operand2
Is a flexible second operand.

PM0264 - Rev 2 page 65/232

 PM0264
General data processing instructions

imm12
Is any value in the range 0-4095.

Operation
The ADD instruction adds the value of Operand2 or imm12 to the value in Rn.
The ADC instruction adds the values in Rn and Operand2, together with the carry flag.
The SUB instruction subtracts the value of Operand2 or imm12 from the value in Rn.
The SBC instruction subtracts the value of Operand2 from the value in Rn. If the carry flag is clear, the result is
reduced by one.
The RSB instruction subtracts the value in Rn from the value of Operand2. This is useful because of the wide
range of options for Operand2.
Use ADC and SBC to synthesize multiword arithmetic.

Note: ADDW is equivalent to the ADD syntax that uses the imm12 operand. SUBW is equivalent to the SUB syntax that
uses the imm12 operand.

Restrictions
In these instructions:
• Operand2 must not be SP and must not be PC.
• Rd can be SP only in ADD and SUB, and only with the additional restrictions:
– Rn must also be SP.
– Any shift in Operand2 must be limited to a maximum of 3 bits using LSL.
• Rn can be SP only in ADD and SUB.
• Rd can be PC only in the ADD{cond} PC, PC, Rm instruction where:
– You must not specify the S suffix.
– Rm must not be PC and must not be SP.
– If the instruction is conditional, it must be the last instruction in the IT block.
• with the exception of the ADD{cond} PC, PC, Rm instruction, Rn can be PC only in ADD and SUB, and
only with the additional restrictions:
– You must not specify the S suffix.
– The second operand must be a constant in the range 0-4095.
Note: – When using the PC for an addition or a subtraction, bits[1:0] of the PC are rounded to 00 before
performing the calculation, making the base address for the calculation word-aligned.
– If you want to generate the address of an instruction, you have to adjust the constant based on the
value of the PC. Arm recommends that you use the ADR instruction instead of ADD or SUB with Rn
equal to the PC, because your assembler automatically calculates the correct constant for the ADR
instruction.
When Rd is PC in the ADD{cond} PC, PC, Rm instruction:
• Bit[0] of the value written to the PC is ignored.
• A branch occurs to the address created by forcing bit[0] of that value to 0.

Condition flags
If S is specified, these instructions update the N, Z, C and V flags according to the result.

ADD R2, R1, R3

SUBS R8, R6, #240 ; Sets the flags on the result.
RSB R4, R4, #1280 ; Subtracts contents of R4 from 1280.
ADCHI R11, R0, R3 ; Only executed if C flag set and Z.
; flag clear.

PM0264 - Rev 2 page 66/232

 PM0264
General data processing instructions

Multiword arithmetic examples

The following example shows two instructions that add a 64‑bit integer contained in R2 and R3 to another 64‑bit
integer contained in R0 and R1, and place the result in R4 and R5.
64-bit addition ADDS R4, R0, R2 ; Add the least significant words.
ADC R5, R1, R3 ; Add the most significant words with carry.

Multiword values do not have to use consecutive registers. The following example shows instructions that subtract
a 96‑bit integer contained in R9, R1, and R11 from another contained in R6, R2, and R8. The example stores the
result in R6, R9, and R2.
96-bit subtraction SUBS R6, R6, R9 ; Subtract the least significant words.
SBCS R9, R2, R1 ; Subtract the middle words with carry.
SBC R2, R8, R11 ; Subtract the most significant words with carry.

3.4.2 AND, ORR, EOR, BIC, and ORN

Logical AND, OR, Exclusive OR, Bit Clear, and OR NOT.
op{S}{cond} {Rd,} Rn, Operand2
Where:
op
Is one of:
AND
Logical AND.
ORR
Logical OR, or bit set.
EOR
Logical Exclusive OR.
BIC
Logical AND NOT, or bit clear.
ORN
Logical OR NOT.

S
Is an optional suffix. If S is specified, the condition code flags are updated on the result of the operation.
cond
Is an optional condition code.
Rd
Is the destination register. If Rd is omitted, the destination register is Rn.
Rn
Is the register holding the first operand.
Operand2
Is a flexible second operand.

Operation
The AND, EOR, and ORR instructions perform bitwise AND, Exclusive OR, and OR operations on the values in Rn
and Operand2.
The BIC instruction performs an AND operation on the bits in Rn with the complements of the corresponding bits
in the value of Operand2.

PM0264 - Rev 2 page 67/232

 PM0264
General data processing instructions

The ORN instruction performs an OR operation on the bits in Rn with the complements of the corresponding bits in
the value of Operand2.

Restrictions
Do not use SP and do not use PC.

Condition flags
If S is specified, these instructions:
• Update the N and Z flags according to the result.
• Can update the C flag during the calculation of Operand2.
• Do not affect the V flag.
AND R9, R2, #0xFF00
ORREQ R2, R0, R5
ANDS R9, R8, #0x19
EORS R7, R11, #0x18181818
BIC R0, R1, #0xab
ORN R7, R11, R14, ROR #4
ORNS R7, R11, R14, ASR #32

3.4.3 ASR, LSL, LSR, ROR, and RRX

Arithmetic Shift Right, Logical Shift Left, Logical Shift Right, Rotate Right, and Rotate Right with Extend.

op{S}{cond} Rd, Rm, Rs

op{S}{cond} Rd, Rm, #n
RRX{S}{cond} Rd, Rm
Where:
op
Is one of:
ASR
Arithmetic Shift Right.
LSL
Logical Shift Left.
LSR
Logical Shift Right.
ROR
Rotate Right.

S
Is an optional suffix. If S is specified, the condition code flags are updated on the result of the operation.
Rd
Is the destination register.
Rm
Is the register holding the value to be shifted.
Rs
Is the register holding the shift length to apply to the value in Rm. Only the least significant byte is used and can
be in the range 0-255.

PM0264 - Rev 2 page 68/232

 PM0264
General data processing instructions

n
Is the shift length. The range of shift length depends on the instruction:
ASR
Shift length from 1 to 32
LSL
Shift length from 0 to 31
LSR
Shift length from 1 to 32
ROR
Shift length from 1 to 31.

Note: MOVS Rd, Rm is the preferred syntax for LSLS Rd, Rm, #0.

Operation
ASR, LSL, LSR, and ROR move the bits in the register Rm to the left or right by the number of places specified by
constant n or register Rs.
RRX moves the bits in register Rm to the right by 1.
In all these instructions, the result is written to Rd, but the value in register Rm remains unchanged. For details on
what result is generated by the different instructions.

Restrictions
Do not use SP and do not use PC.

Condition flags
If S is specified:
• These instructions update the N, Z and C flags according to the result.
• The C flag is updated to the last bit shifted out, except when the shift length is 0.
ASR R7, R8, #9 ; Arithmetic shift right by 9 bits.
LSLS R1, R2, #3 ; Logical shift left by 3 bits with flag update.
LSR R4, R5, #6 ; Logical shift right by 6 bits.
ROR R4, R5, R6 ; Rotate right by the value in the bottom byte of R6.
RRX R4, R5 ; Rotate right with extend.

3.4.4 CLZ
Count Leading Zeros.

CLZ{cond} Rd, Rm
Where:
cond
Is an optional condition code.
Rd
Is the destination register.
Rm
Is the operand register.

Operation
The CLZ instruction counts the number of leading zeros in the value in Rm and returns the result in Rd. The result
value is 32 if no bits are set and zero if bit[31] is set.

PM0264 - Rev 2 page 69/232

 PM0264
General data processing instructions

Restrictions
Do not use SP and do not use PC.

Condition flags
This instruction does not change the flags.
CLZ R4,R9
CLZNE R2,R3

3.4.5 CMP and CMN

Compare and Compare Negative.

CMP{cond} Rn, Operand2

CMN{cond} Rn, Operand2
Where:
cond
Is an optional condition code.
Rn
Is the register holding the first operand.
Operand2
Is a flexible second operand.

Operation
These instructions compare the value in a register with Operand2. They update the condition flags on the result,
but do not write the result to a register.
The CMP instruction subtracts the value of Operand2 from the value in Rn. This is the same as a SUBS
instruction, except that the result is discarded.
The CMN instruction adds the value of Operand2 to the value in Rn. This is the same as an ADDS instruction,
except that the result is discarded.

Restrictions
In these instructions:
• Do not use PC.
• Operand2 must not be SP.

Condition flags
These instructions update the N, Z, C and V flags according to the result.
CMP R2, R9
CMN R0, #6400
CMPGT SP, R7, LSL #2

3.4.6 MOV and MVN

Move and Move NOT.

MOV{S}{cond} Rd, Operand2

MOV{S}{cond} Rd, Rm
MOV{W}{cond} Rd, #imm16
MVN{S}{cond} Rd, Operand2
Where:

PM0264 - Rev 2 page 70/232

 PM0264
General data processing instructions

S
Is an optional suffix. If S is specified, the condition code flags are updated on the result of the operation.
cond
Is an optional condition code.
Rd
Is the destination register.
Operand2
Is a flexible second operand.
Rm
The source register.
imm16
Is any value in the range 0-65535.

Operation
The MOV instruction copies the value of Operand2 into Rd.
When Operand2 in a MOV instruction is a register with a shift other than LSL #0, the preferred syntax is the
corresponding shift instruction:Also, the MOV instruction permits additional forms of Operand2 as synonyms for
shift instructions:
• ASR{S}{cond} Rd, Rm, #n is the preferred syntax for MOV{S}{cond} Rd, Rm, ASR #n.
• LSL{S}{cond} Rd, Rm, #n is the preferred syntax for MOV{S}{cond} Rd, Rm, LSL #n if n != 0.
• LSR{S}{cond} Rd, Rm, #n is the preferred syntax for MOV{S}{cond} Rd, Rm, LSR #n.
• ROR{S}{cond} Rd, Rm, #n is the preferred syntax for MOV{S}{cond} Rd, Rm, ROR #n.
• RRX{S}{cond} Rd, Rm is the preferred syntax for MOV{S}{cond} Rd, Rm, RRX.
• MOV{S}{cond} Rd, Rm, ASR Rs is a synonym for ASR{S}{cond} Rd, Rm, Rs.
• MOV{S}{cond} Rd, Rm, LSL Rs is a synonym for LSL{S}{cond} Rd, Rm, Rs.
• MOV{S}{cond} Rd, Rm, LSR Rs is a synonym for LSR{S}{cond} Rd, Rm, Rs.
• MOV{S}{cond} Rd, Rm, ROR Rs is a synonym for ROR{S}{cond} Rd, Rm, Rs.
The MVN instruction takes the value of Operand2, performs a bitwise logical NOT operation on the value, and
places the result into Rd.
Note: The MOVW instruction provides the same function as MOV, but is restricted to using the imm16 operand.

Restrictions
You can use SP and PC only in the MOV instruction, with the following restrictions:
• The second operand must be a register without shift.
• You must not specify the S suffix.
When Rd is PC in a MOV instruction:
• Bit[0] of the value written to the PC is ignored.
• A branch occurs to the address created by forcing bit[0] of that value to 0.
Note: Though it is possible to use MOV as a branch instruction, Arm strongly recommends the use of a BX or BLX
instruction to branch for software portability to the Arm instruction set.

Condition flags
If S is specified, these instructions:
• Update the N and Z flags according to the result.
• Can update the C flag during the calculation of Operand2.
• Do not affect the V flag.

PM0264 - Rev 2 page 71/232

 PM0264
General data processing instructions

MOVS R11, #0x000B ; Write value of 0x000B to R11, flags get updated.
MOV R1, #0xFA05 ; Write value of 0xFA05 to R1, flags are not updated.
MOVS R10, R12 ; Write value in R12 to R10, flags get updated.
MOV R3, #23 ; Write value of 23 to R3.
MOV R8, SP ; Write value of stack pointer to R8.
MVNS R2, #0xF ; Write value of 0xFFFFFFF0 (bitwise inverse of 0xF).
; to the R2 and update flags.

3.4.7 MOVT
Move Top.

MOVT{cond} Rd, #imm16

Where:
cond
Is an optional condition code.
Rd
Is the destination register.
imm16
Is a 16‑bit immediate constant and must be in the range 0-65535.

Operation
MOVT writes a 16‑bit immediate value, imm16, to the top halfword, Rd[31:16], of its destination register. The write
does not affect Rd[15:0].
The MOV, MOVT instruction pair enables you to generate any 32‑bit constant.

Restrictions
Rd must not be SP and must not be PC.

Condition flags
This instruction does not change the flags.
MOVT R3, #0xF123 ; Write 0xF123 to upper halfword of R3, lower halfword
; and APSR are unchanged.

3.4.8 REV, REV16, REVSH, and RBIT

Reverse bytes and Reverse bits.
op{cond} Rd, Rn
Where:
op
Is one of:
REV
Reverse byte order in a word.
REV16
Reverse byte order in each halfword independently.
REVSH
Reverse byte order in the bottom halfword, and sign extend to 32 bits.
RBIT
Reverse the bit order in a 32‑bit word.

PM0264 - Rev 2 page 72/232

 PM0264
General data processing instructions

cond
Is an optional condition code.
Rd
Is the destination register.
Rn
Is the register holding the operand.

Operation
Use these instructions to change endianness of data:
REV converts either:
• 32‑bit big‑endian data into little‑endian data.
• 32‑bit little‑endian data into big‑endian data.
REV16 converts either:
• 16‑bit big‑endian data into little‑endian data.
• 16‑bit little‑endian data into big‑endian data.
REVSH converts either:
• 16‑bit signed big‑endian data into 32‑bit signed little‑endian data.
• 16‑bit signed little‑endian data into 32‑bit signed big‑endian data.

Restrictions
Do not use SP and do not use PC.

Condition flags
These instructions do not change the flags.
REV R3, R7 ; Reverse byte order of value in R7 and write it to R3.
REV16 R0, R0 ; Reverse byte order of each 16-bit halfword in R0.
REVSH R0, R5 ; Reverse Signed Halfword.
REVHS R3, R7 ; Reverse with Higher or Same condition.
RBIT R7, R8 ; Reverse bit order of value in R8 and write the result to R7.

3.4.9 SADD16 and SADD8

Signed Add 16 and Signed Add 8.

op{cond} {Rd,} Rn, Rm

Where:
op
Is one of:
SADD16
Performs two 16-bit signed integer additions.
SADD8
Performs four 8-bit signed integer additions.

cond
Is an optional condition code.
Rd
Is the destination register. If Rd is omitted, the destination register is Rn.
Rn
Is the first operand register.

PM0264 - Rev 2 page 73/232

 PM0264
General data processing instructions

Rm
Is the second operand register.

Operation
Use these instructions to perform a halfword or byte add in parallel.
The SADD16 instruction:The SADD8 instruction:
1. Adds each halfword from the first operand to the corresponding halfword of the second operand.
2. Writes the result in the corresponding halfwords of the destination register.
1. Adds each byte of the first operand to the corresponding byte of the second operand.
2. Writes the result in the corresponding bytes of the destination register.

Restrictions
Do not use SP and do not use PC.

Condition flags
These instructions set the APSR.GE bits according to the results of the additions.
For SADD16:
if ConditionPassed() then
EncodingSpecificOperations();
sum1 = SInt(R[n]<15:0>) + SInt(R[m]<15:0>);
sum2 = SInt(R[n]<31:16>) + SInt(R[m]<31:16>);
R[d]<15:0> = sum1<15:0>;
R[d]<31:16> = sum2<15:0>;
APSR.GE<1:0> = if sum1 >= 0 then '11' else '00';
APSR.GE<3:2> = if sum2 >= 0 then '11' else '00';

For SADD8:
if ConditionPassed() then
EncodingSpecificOperations();
sum1 = SInt(R[n]<7:0>) + SInt(R[m]<7:0>);
sum2 = SInt(R[n]<15:8>) + SInt(R[m]<15:8>);
sum3 = SInt(R[n]<23:16>) + SInt(R[m]<23:16>);
sum4 = SInt(R[n]<31:24>) + SInt(R[m]<31:24>);
R[d]<7:0> = sum1<7:0>;
R[d]<15:8> = sum2<7:0>;
R[d]<23:16> = sum3<7:0>;
R[d]<31:24> = sum4<7:0>;
APSR.GE<0> = if sum1 >= 0 then '1' else '0';
APSR.GE<1> = if sum2 >= 0 then '1' else '0';
APSR.GE<2> = if sum3 >= 0 then '1' else '0';
APSR.GE<3> = if sum4 >= 0 then '1' else '0';

SADD16 R1, R0 ; Adds the halfwords in R0 to the corresponding halfwords of

; R1 and writes to corresponding halfword of R1.SADD8 R4, R0, R5
; Adds bytes of R0 to the corresponding byte in R5 and writes
; to the corresponding byte in R4.

3.4.10 SASX and SSAX

Signed Add and Subtract with Exchange and Signed Subtract and Add with Exchange.

op{cond} {Rd,} Rn, Rm

Where:

PM0264 - Rev 2 page 74/232

 PM0264
General data processing instructions

op
Is one of:
SASX
Signed Add and Subtract with Exchange.
SSAX
Signed Subtract and Add with Exchange.

cond
Is an optional condition code.
Rd
Is the destination register. If Rd is omitted, the destination register is Rn.
Rn
Is the first operand register.
Rm
Is the second operand register.

Operation
The SASX instruction:
1. Adds the signed top halfword of the first operand with the signed bottom halfword of the second operand.
2. Writes the signed result of the addition to the top halfword of the destination register.
3. Subtracts the signed bottom halfword of the second operand from the top signed halfword of the first
operand.
4. Writes the signed result of the subtraction to the bottom halfword of the destination register.
The SSAX instruction:
1. Subtracts the signed bottom halfword of the second operand from the top signed halfword of the first
operand.
2. Writes the signed result of the addition to the bottom halfword of the destination register.
3. Adds the signed top halfword of the first operand with the signed bottom halfword of the second operand.
4. Writes the signed result of the subtraction to the top halfword of the destination register.

Restrictions
Do not use SP and do not use PC.

Condition flags
These instructions set the APSR.GE bits according to the results.
For SASX:
if ConditionPassed() then
EncodingSpecificOperations();
diff = SInt(R[n]<15:0>) - SInt(R[m]<31:16>);
sum = SInt(R[n]<31:16>) + SInt(R[m]<15:0>);
R[d]<15:0> = diff<15:0>;
R[d]<31:16> = sum<15:0>;
APSR.GE<1:0> = if diff >= 0 then '11' else '00';
APSR.GE<3:2> = if sum >= 0 then '11' else '00';

For SSAX:

PM0264 - Rev 2 page 75/232

 PM0264
General data processing instructions

if ConditionPassed() then
EncodingSpecificOperations();
sum = SInt(R[n]<15:0>) + SInt(R[m]<31:16>);
diff = SInt(R[n]<31:16>) - SInt(R[m]<15:0>);
R[d]<15:0> = sum<15:0>;
R[d]<31:16> = diff<15:0>;
APSR.GE<1:0> = if sum >= 0 then '11' else '00';
APSR.GE<3:2> = if diff >= 0 then '11' else '00';

SASX R0, R4, R5 ; Adds top halfword of R4 to bottom halfword of R5 and

; writes to top halfword of R0.
; Subtracts bottom halfword of R5 from top halfword of R4
; and writes to bottom halfword of R0.
SSAX R7, R3, R2 ; Subtracts top halfword of R2 from bottom halfword of R3
; and writes to bottom halfword of R7.
; Adds top halfword of R3 with bottom halfword of R2 and
; writes to top halfword of R7.

3.4.11 SEL
Select bytes. Selects each byte of its result from either its first operand or its second operand, according to the
values of the GE flags.

SEL{cond} {Rd,} Rn, Rm

Where:
cond
Is an optional condition code.

Rd
Is the destination register. If Rd is omitted, the destination register is Rn.
Rn
Is the first operand register.
Rm
Is the second operand register.

Operation
The SEL instruction:
1. Reads the value of each bit of APSR.GE.
2. Depending on the value of APSR.GE, assigns the destination register the value of either the first or second
operand register.
The behavior is:
if ConditionPassed() then
EncodingSpecificOperations();
R[d]<7:0> = if APSR.GE<0> == '1' then R[n]<7:0> else R[m]<7:0>;
R[d]<15:8> = if APSR.GE<1> == '1' then R[n]<15:8> else R[m]<15:8>;
R[d]<23:16> = if APSR.GE<2> == '1' then R[n]<23:16> else R[m]<23:16>;
R[d]<31:24> = if APSR.GE<3> == '1' then R[n]<31:24> else R[m]<31:24>;

Restrictions
None.

Condition flags
These instructions do not change the flags.
SADD16 R0, R1, R2 ; Set GE bits based on result.
SEL R0, R0, R3 ; Select bytes from R0 or R3, based on GE.

PM0264 - Rev 2 page 76/232

 PM0264
General data processing instructions

3.4.12 SHADD16 and SHADD8

Signed Halving Add 16 and Signed Halving Add 8.

op{cond} {Rd,} Rn, Rm

Where:
op
Is one of:
SHADD16
Signed Halving Add 16.
SHADD8
Signed Halving Add 8.

cond
Is an optional condition code.
Rd
Is the destination register. If Rd is omitted, the destination register is Rn.
Rn
Is the first operand register.
Rm
Is the second operand register.

Operation
Use these instructions to add 16-bit and 8-bit data and then to halve the result before writing the result to the
destination register.
The SHADD16 instruction:The SHADD8 instruction:
1. Adds each halfword from the first operand to the corresponding halfword of the second operand.
2. Shuffles the result by one bit to the right, halving the data.
3. Writes the halfword results in the destination register.
1. Adds each byte of the first operand to the corresponding byte of the second operand.
2. Shuffles the result by one bit to the right, halving the data.
3. Writes the byte results in the destination register.

Restrictions
Do not use SP and do not use PC.

Condition flags
These instructions do not change the flags.
SHADD16 R1, R0 ; Adds halfwords in R0 to corresponding halfword of R1 and
; writes halved result to corresponding halfword in R1.
SHADD8 R4, R0, R5 ; Adds bytes of R0 to corresponding byte in R5 and
; writes halved result to corresponding byte in R4.

3.4.13 SHASX and SHSAX

Signed Halving Add and Subtract with Exchange and Signed Halving Subtract and Add with Exchange.

op{cond} {Rd,} Rn, Rm

Where:

PM0264 - Rev 2 page 77/232

 PM0264
General data processing instructions

op
Is one of:
SHASX
Add and Subtract with Exchange and Halving.
SHSAX
Subtract and Add with Exchange and Halving.

cond
Is an optional condition code.
Rd
Is the destination register. If Rd is omitted, the destination register is Rn.
Rn
Is the first operand register.
Rm
Is the second operand register.

Operation
The SHASX instruction:
1. Adds the top halfword of the first operand with the bottom halfword of the second operand.
2. Writes the halfword result of the addition to the top halfword of the destination register, shifted by one bit to
the right causing a divide by two, or halving.
3. Subtracts the top halfword of the second operand from the bottom highword of the first operand.
4. Writes the halfword result of the division in the bottom halfword of the destination register, shifted by one bit
to the right causing a divide by two, or halving.
The SHSAX instruction:
1. Subtracts the bottom halfword of the second operand from the top highword of the first operand.
2. Writes the halfword result of the addition to the bottom halfword of the destination register, shifted by one bit
to the right causing a divide by two, or halving.
3. Adds the bottom halfword of the first operand with the top halfword of the second operand.
4. Writes the halfword result of the division in the top halfword of the destination register, shifted by one bit to
the right causing a divide by two, or halving.

Restrictions
Do not use SP and do not use PC.

Condition flags
These instructions do not affect the condition code flags.
SHASX R7, R4, R2 ; Adds top halfword of R4 to bottom halfword of R2
; and writes halved result to top halfword of R7.
; Subtracts top halfword of R2 from bottom halfword of
; R4 and writes halved result to bottom halfword of R7.
SHSAX R0, R3, R5 ; Subtracts bottom halfword of R5 from top halfword
; of R3 and writes halved result to top halfword of R0.
; Adds top halfword of R5 to bottom halfword of R3 and
; writes halved result to bottom halfword of R0.

3.4.14 SHSUB16 and SHSUB8

Signed Halving Subtract 16 and Signed Halving Subtract 8.

op{cond} {Rd,} Rn, Rm

Where:

PM0264 - Rev 2 page 78/232

 PM0264
General data processing instructions

op
Is one of:
SHSUB16
Signed Halving Subtract 16.
SHSUB8
Signed Halving Subtract 8.

cond
Is an optional condition code.
Rd
Is the destination register. If Rd is omitted, the destination register is Rn.
Rn
Is the first operand register.
Rm
Is the second operand register.

Operation
Use these instructions to add 16-bit and 8-bit data and then to halve the result before writing the result to the
destination register.
The SHSUB16 instruction: The SHSUBB8 instruction:
1. Subtracts each halfword of the second operand from the corresponding halfwords of the first operand.
2. Shuffles the result by one bit to the right, halving the data.
3. Writes the halved halfword results in the destination register.
1. Subtracts each byte of the second operand from the corresponding byte of the first operand.
2. Shuffles the result by one bit to the right, halving the data.
3. Writes the corresponding signed byte results in the destination register.

Restrictions
Do not use SP and do not use PC.

Condition flags
These instructions do not change the flags.
SHSUB16 R1, R0 ; Subtracts halfwords in R0 from corresponding halfword
; of R1 and writes to corresponding halfword of R1.
SHSUB8 R4, R0, R5 ; Subtracts bytes of R0 from corresponding byte in R5,
; and writes to corresponding byte in R4.

3.4.15 SSUB16 and SSUB8

Signed Subtract 16 and Signed Subtract 8.

op{cond} {Rd,} Rn, Rm

Where:
op
Is one of:
SSUB16
Performs two 16-bit signed integer subtractions.
SSUB8
Performs four 8-bit signed integer subtractions.

PM0264 - Rev 2 page 79/232

 PM0264
General data processing instructions

cond
Is an optional condition code.
Rd
Is the destination register. If Rd is omitted, the destination register is Rn.
Rn
Is the first operand register.
Rm
Is the second operand register.

Operation
Use these instructions to change endianness of data.
The SSUB16 instruction:The SSUB8 instruction:
1. Subtracts each halfword from the second operand from the corresponding halfword of the first operand.
2. Writes the difference result of two signed halfwords in the corresponding halfword of the destination register.
1. Subtracts each byte of the second operand from the corresponding byte of the first operand.
2. Writes the difference result of four signed bytes in the corresponding byte of the destination register.

Restrictions
Do not use SP and do not use PC.

Condition flags
These instructions set the APSR.GE bits according to the results of the subtractions.
For SSUB16:
if ConditionPassed() then
EncodingSpecificOperations();
diff1 = SInt(R[n]<15:0>) - SInt(R[m]<15:0>);
diff2 = SInt(R[n]<31:16>) - SInt(R[m]<31:16>);
R[d]<15:0> = diff1<15:0>;
R[d]<31:16> = diff2<15:0>;

APSR.GE<1:0> = if diff1 >= 0 then '11' else '00';

APSR.GE<3:2> = if diff2 >= 0 then '11' else '00';

For SSUB8:
if ConditionPassed() then
EncodingSpecificOperations();
diff1 = SInt(R[n]<7:0>) - SInt(R[m]<7:0>);
diff2 = SInt(R[n]<15:8>) - SInt(R[m]<15:8>);
diff3 = SInt(R[n]<23:16>) - SInt(R[m]<23:16>);
diff4 = SInt(R[n]<31:24>) - SInt(R[m]<31:24>);
R[d]<7:0> = diff1<7:0>;
R[d]<15:8> = diff2<7:0>;
R[d]<23:16> = diff3<7:0>;
R[d]<31:24> = diff4<7:0>;
APSR.GE<0> = if diff1 >= 0 then '1' else '0';
APSR.GE<1> = if diff2 >= 0 then '1' else '0';
APSR.GE<2> = if diff3 >= 0 then '1' else '0';

APSR.GE<3> = if diff4 >= 0 then '1' else '0';

SSUB16 R1, R0 ; Subtracts halfwords in R0 from corresponding halfword of R1

; and writes to corresponding halfword of R1.
SSUB8 R4, R0, R5 ; Subtracts bytes of R5 from corresponding byte in
; R0, and writes to corresponding byte of R4.

PM0264 - Rev 2 page 80/232

 PM0264
General data processing instructions

3.4.16 TST and TEQ

Test bits and Test Equivalence.

TST{cond} Rn, Operand2

TEQ{cond} Rn, Operand2
Where:
cond
Is an optional condition code.
Rn
Is the first operand register.
Operand2
Is a flexible second operand.

Operation
These instructions test the value in a register against Operand2. They update the condition flags based on the
result, but do not write the result to a register.
The TST instruction performs a bitwise AND operation on the value in Rn and the value of Operand2. This is the
same as the ANDS instruction, except that it discards the result.
To test whether a bit of Rn is 0 or 1, use the TST instruction with an Operand2 constant that has that bit set to 1
and all other bits cleared to 0.
The TEQ instruction performs a bitwise Exclusive OR operation on the value in Rn and the value of Operand2.
This is the same as the EORS instruction, except that it discards the result.
Use the TEQ instruction to test if two values are equal without affecting the V or C flags.
TEQ is also useful for testing the sign of a value. After the comparison, the N flag is the logical Exclusive OR of the
sign bits of the two operands.

Restrictions
Do not use SP and do not use PC.

Condition flags
These instructions:
• Update the N and Z flags according to the result.
• Can update the C flag during the calculation of Operand2,
• Do not affect the V flag.
TST R0, #0x3F8 ; Perform bitwise AND of R0 value to 0x3F8,
; APSR is updated but result is discarded
TEQEQ R10, R9 ; Conditionally test if value in R10 is equal to
; value in R9, APSR is updated but result is discarded.

3.4.17 UADD16 and UADD8

Unsigned Add 16 and Unsigned Add 8.

op{cond} {Rd,} Rn, Rm

Where:
op
Is one of:
UADD16
Performs two 16-bit unsigned integer additions.
UADD8
Performs four 8-bit unsigned integer additions.

PM0264 - Rev 2 page 81/232

 PM0264
General data processing instructions

cond
Is an optional condition code.
Rd
Is the destination register. If Rd is omitted, the destination register is Rn.
Rn
Is the first operand register.
Rm
Is the second operand register.

Operation
Use these instructions to add 16- and 8-bit unsigned data.
The UADD16 instruction:
1. Adds each halfword from the first operand to the corresponding halfword of the second operand.
2. Writes the unsigned result in the corresponding halfwords of the destination register.
The UADD8 instruction:
1. Adds each byte of the first operand to the corresponding byte of the second operand.
2. Writes the unsigned result in the corresponding byte of the destination register.

Restrictions
Do not use SP and do not use PC.

Condition flags
These instructions set the APSR.GE bits according to the results of the additions.
For UADD16:
if ConditionPassed() then
EncodingSpecificOperations();
sum1 = UInt(R[n]<15:0>) + UInt(R[m]<15:0>);
sum2 = UInt(R[n]<31:16>) + UInt(R[m]<31:16>);
R[d]<15:0> = sum1<15:0>;
R[d]<31:16> = sum2<15:0>;
APSR.GE<1:0> = if sum1 >= 0x10000 then '11' else '00';
APSR.GE<3:2> = if sum2 >= 0x10000 then '11' else '00';

For UADD8:
if ConditionPassed() then
EncodingSpecificOperations();
sum1 = UInt(R[n]<7:0>) + UInt(R[m]<7:0>);
sum2 = UInt(R[n]<15:8>) + UInt(R[m]<15:8>);
sum3 = UInt(R[n]<23:16>) + UInt(R[m]<23:16>);
sum4 = UInt(R[n]<31:24>) + UInt(R[m]<31:24>);
R[d]<7:0> = sum1<7:0>;
R[d]<15:8> = sum2<7:0>;
R[d]<23:16> = sum3<7:0>;
R[d]<31:24> = sum4<7:0>;
APSR.GE<0> = if sum1 >= 0x100 then '1' else '0';
APSR.GE<1> = if sum2 >= 0x100 then '1' else '0';
APSR.GE<2> = if sum3 >= 0x100 then '1' else '0';
APSR.GE<3> = if sum4 >= 0x100 then '1' else '0';

UADD16 R1, R0 ; Adds halfwords in R0 to corresponding halfword of R1,

; writes to corresponding halfword of R1.
UADD8 R4, R0, R5 ; Adds bytes of R0 to corresponding byte in R5 and writes
; to corresponding byte in R4.

3.4.18 UASX and USAX

Unsigned Add and Subtract with Exchange and Unsigned Subtract and Add with Exchange.

PM0264 - Rev 2 page 82/232

 PM0264
General data processing instructions

op{cond} {Rd,} Rn, Rm

Where:
op
Is one of:
UASX
Add and Subtract with Exchange.
USAX
Subtract and Add with Exchange.

cond
Is an optional condition code.
Rd
Is the destination register. If Rd is omitted, the destination register is Rn.
Rn
Is the first operand register.
Rm
Is the second operand register.

Operation
The UASX instruction:
1. Subtracts the top halfword of the second operand from the bottom halfword of the first operand.
2. Writes the unsigned result from the subtraction to the bottom halfword of the destination register.
3. Adds the top halfword of the first operand with the bottom halfword of the second operand.
4. Writes the unsigned result of the addition to the top halfword of the destination register.
The USAX instruction:
1. Adds the bottom halfword of the first operand with the top halfword of the second operand.
2. Writes the unsigned result of the addition to the bottom halfword of the destination register.
3. Subtracts the bottom halfword of the second operand from the top halfword of the first operand.
4. Writes the unsigned result from the subtraction to the top halfword of the destination register.

Restrictions
Do not use SP and do not use PC.

Condition flags
These instructions set the APSR.GE bits according to the results.
For UASX:
if ConditionPassed() then
EncodingSpecificOperations();
diff = UInt(R[n]<15:0>) - UInt(R[m]<31:16>);
sum = UInt(R[n]<31:16>) + UInt(R[m]<15:0>);
R[d]<15:0> = diff<15:0>;
R[d]<31:16> = sum<15:0>;
APSR.GE<1:0> = if diff >= 0 then '11' else '00';
APSR.GE<3:2> = if sum >= 0x10000 then '11' else '00';

For USAX:

PM0264 - Rev 2 page 83/232

 PM0264
General data processing instructions

if ConditionPassed() then
EncodingSpecificOperations();
sum = UInt(R[n]<15:0>) + UInt(R[m]<31:16>);
diff = UInt(R[n]<31:16>) - UInt(R[m]<15:0>);
R[d]<15:0> = sum<15:0>;
R[d]<31:16> = diff<15:0>;
APSR.GE<1:0> = if sum >= 0x10000 then '11' else '00';
APSR.GE<3:2> = if diff >= 0 then '11' else '00';

UASX R0, R4, R5 ; Adds top halfword of R4 to bottom halfword of R5 and

; writes to top halfword of R0.
; Subtracts bottom halfword of R5 from top halfword of R0
; and writes to bottom halfword of R0.
USAX R7, R3, R2 ; Subtracts top halfword of R2 from bottom halfword of R3
; and writes to bottom halfword of R7.
; Adds top halfword of R3 to bottom halfword of R2 and
; writes to top halfword of R7.

3.4.19 UHADD16 and UHADD8

Unsigned Halving Add 16 and Unsigned Halving Add 8.

op{cond} {Rd,} Rn, Rm

Where:
op
Is one of:
UHADD16
Unsigned Halving Add 16.
UHADD8
Unsigned Halving Add 8.

cond
Is an optional condition code.
Rd
Is the destination register. If Rd is omitted, the destination register is Rn.
Rn
Is the register holding the first operand.
Rm
Is the register holding the second operand.

Operation
Use these instructions to add 16- and 8-bit data and then to halve the result before writing the result to the
destination register.
The UHADD16 instruction:
1. Adds each halfword from the first operand to the corresponding halfword of the second operand.
2. Shuffles the halfword result by one bit to the right, halving the data.
3. Writes the unsigned results to the corresponding halfword in the destination register.
The UHADD8 instruction:
1. Adds each byte of the first operand to the corresponding byte of the second operand.
2. Shuffles the byte result by one bit to the right, halving the data.
3. Writes the unsigned results in the corresponding byte in the destination register.

Restrictions
Do not use SP and do not use PC.

PM0264 - Rev 2 page 84/232

 PM0264
General data processing instructions

Condition flags
These instructions do not change the flags.
UHADD16 R7, R3 ; Adds halfwords in R7 to corresponding halfword of R3
; and writes halved result to corresponding halfword in R7.
UHADD8 R4, R0, R5 ; Adds bytes of R0 to corresponding byte in R5 and writes
; halved result to corresponding byte in R4.

3.4.20 UHASX and UHSAX

Unsigned Halving Add and Subtract with Exchange and Unsigned Halving Subtract and Add with Exchange.

op{cond} {Rd,} Rn, Rm

Where:
op
Is one of:
UHASX
Unsigned Halving Add and Subtract with Exchange.
UHSAX
Unsigned Halving Subtract and Add with Exchange.

cond
Is an optional condition code.
Rd
Is the destination register. If Rd is omitted, the destination register is Rn.
Rn
Is the first operand register.
Rm
Is the second operand register.

Operation
The UHASX instruction:
1. Adds the top halfword of the first operand with the bottom halfword of the second operand.
2. Shifts the result by one bit to the right causing a divide by two, or halving.
3. Writes the halfword result of the addition to the top halfword of the destination register.
4. Subtracts the top halfword of the second operand from the bottom halfword of the first operand.
5. Shifts the result by one bit to the right causing a divide by two, or halving.
6. Writes the halfword result of the subtraction in the bottom halfword of the destination register.
The UHSAX instruction:
1. Subtracts the bottom halfword of the second operand from the top halfword of the first operand.
2. Shifts the result by one bit to the right causing a divide by two, or halving.
3. Writes the halfword result of the subtraction in the top halfword of the destination register.
4. Adds the bottom halfword of the first operand with the top halfword of the second operand.
5. Shifts the result by one bit to the right causing a divide by two, or halving.
6. Writes the halfword result of the addition to the bottom halfword of the destination register.

Restrictions
Do not use SP and do not use PC.

PM0264 - Rev 2 page 85/232

 PM0264
General data processing instructions

Condition flags
These instructions do not affect the condition code flags.
UHASX R7, R4, R2 ; Adds top halfword of R4 with bottom halfword of R2
; and writes halved result to top halfword of R7.
; Subtracts top halfword of R2 from bottom halfword of
; R7 and writes halved result to bottom halfword of R7.
UHSAX R0, R3, R5 ; Subtracts bottom halfword of R5 from top halfword of
; R3 and writes halved result to top halfword of R0.
; Adds top halfword of R5 to bottom halfword of R3 and
; writes halved result to bottom halfword of R0.

3.4.21 UHSUB16 and UHSUB8

Unsigned Halving Subtract 16 and Unsigned Halving Subtract 8.

op{cond} {Rd,} Rn, Rm

Where:
op
Is one of:
UHSUB16
Performs two unsigned 16-bit integer subtractions, halves the results, and writes the results to the destination register.
UHSUB8
Performs four unsigned 8-bit integer subtractions, halves the results, and writes the results to the destination register.

cond
Is an optional condition code.
Rd
Is the destination register. If Rd is omitted, the destination register is Rn.
Rn
Is the first operand register.
Rm
Is the second operand register.

Operation
Use these instructions to add 16-bit and 8-bit data and then to halve the result before writing the result to the
destination register.
The UHSUB16 instruction:
1. Subtracts each halfword of the second operand from the corresponding halfword of the first operand.
2. Shuffles each halfword result to the right by one bit, halving the data.
3. Writes each unsigned halfword result to the corresponding halfwords in the destination register.
The UHSUB8 instruction:
1. Subtracts each byte of second operand from the corresponding byte of the first operand.
2. Shuffles each byte result by one bit to the right, halving the data.
3. Writes the unsigned byte results to the corresponding byte of the destination register.

Restrictions
Do not use SP and do not use PC.

Condition flags
These instructions do not change the flags.

PM0264 - Rev 2 page 86/232

 PM0264
General data processing instructions

UHSUB16 R1, R0 ; Subtracts halfwords in R0 from corresponding halfword of

; R1 and writes halved result to corresponding halfword in
; R1.
UHSUB8 R4, R0, R5 ; Subtracts bytes of R5 from corresponding byte in R0 and
; writes halved result to corresponding byte in R4.

3.4.22 USAD8
Unsigned Sum of Absolute Differences.

USAD8{cond} {Rd,} Rn, Rm

Where:
cond
Is an optional condition code.
Rd
Is the destination register. If Rd is omitted, the destination register is Rn.
Rn
Is the first operand register.
Rm
Is the second operand register.

Operation
The USAD8 instruction:
1. Subtracts each byte of the second operand register from the corresponding byte of the first operand register.
2. Adds the absolute values of the differences together.
3. Writes the result to the destination register.

Restrictions
Do not use SP and do not use PC.

Condition flags
These instructions do not change the flags.
USAD8 R1, R4, R0 ; Subtracts each byte in R0 from corresponding byte of R4
; adds the differences and writes to R1.
USAD8 R0, R5 ; Subtracts bytes of R5 from corresponding byte in R0,
; adds the differences and writes to R0.

3.4.23 USADA8
Unsigned Sum of Absolute Differences and Accumulate.

USADA8{cond} Rd, Rn, Rm, Ra

Where:
cond
Is an optional condition code.
Rd
Is the destination register.
Rn
Is the first operand register.
Rm
Is the second operand register.

PM0264 - Rev 2 page 87/232

 PM0264
General data processing instructions

Ra
Is the register that contains the accumulation value.

Operation
The USADA8 instruction:
1. Subtracts each byte of the second operand register from the corresponding byte of the first operand register.
2. Adds the unsigned absolute differences together.
3. Adds the accumulation value to the sum of the absolute differences.
4. Writes the result to the destination register.

Restrictions
Do not use SP and do not use PC.

Condition flags
These instructions do not change the flags.
USADA8 R1, R0, R6 ; Subtracts bytes in R0 from corresponding halfword of R1
; adds differences, adds value of R6, writes to R1.
USADA8 R4, R0, R5, R2 ; Subtracts bytes of R5 from corresponding byte in R0
; adds differences, adds value of R2 writes to R4.

3.4.24 USUB16 and USUB8

Unsigned Subtract 16 and Unsigned Subtract 8.

op{cond} {Rd,} Rn, Rm

Where:
op
Is one of:
USUB16
Unsigned Subtract 16.
USUB8
Unsigned Subtract 8.

cond
Is an optional condition code.
Rd
Is the destination register. If Rd is omitted, the destination register is Rn.
Rn
Is the first operand register.
Rm
Is the second operand register.

Operation
Use these instructions to subtract 16-bit and 8-bit data before writing the result to the destination register.
The USUB16 instruction:
1. Subtracts each halfword from the second operand register from the corresponding halfword of the first
operand register.
2. Writes the unsigned result in the corresponding halfwords of the destination register.
The USUB8 instruction:
1. Subtracts each byte of the second operand register from the corresponding byte of the first operand register.

PM0264 - Rev 2 page 88/232

 PM0264
Multiply and divide instructions

2. Writes the unsigned byte result in the corresponding byte of the destination register.

Restrictions
Do not use SP and do not use PC.

Condition flags
These instructions set the APSR.GE bits according to the results of the subtractions.
For USUB16:
if ConditionPassed() then
EncodingSpecificOperations();
diff1 = UInt(R[n]<15:0>) - UInt(R[m]<15:0>);
diff2 = UInt(R[n]<31:16>) - UInt(R[m]<31:16>);
R[d]<15:0> = diff1<15:0>;
R[d]<31:16> = diff2<15:0>;
APSR.GE<1:0> = if diff1 >= 0 then '11' else '00';
APSR.GE<3:2> = if diff2 >= 0 then '11' else '00';

For USUB8:
if ConditionPassed() then
EncodingSpecificOperations();
diff1 = UInt(R[n]<7:0>) - UInt(R[m]<7:0>);
diff2 = UInt(R[n]<15:8>) - UInt(R[m]<15:8>);
diff3 = UInt(R[n]<23:16>) - UInt(R[m]<23:16>);
diff4 = UInt(R[n]<31:24>) - UInt(R[m]<31:24>);
R[d]<7:0> = diff1<7:0>;
R[d]<15:8> = diff2<7:0>;
R[d]<23:16> = diff3<7:0>;
R[d]<31:24> = diff4<7:0>;
APSR.GE<0> = if diff1 >= 0 then '1' else '0';
APSR.GE<1> = if diff2 >= 0 then '1' else '0';
APSR.GE<2> = if diff3 >= 0 then '1' else '0';
APSR.GE<3> = if diff4 >= 0 then '1' else '0';

USUB16 R1, R0 ; Subtracts halfwords in R0 from corresponding halfword of R1

; and writes to corresponding halfword in R1.
USUB8 R4, R0, R5 ; Subtracts bytes of R5 from corresponding byte in R0 and
; writes to the corresponding byte in R4.

3.5 Multiply and divide instructions

Table 36 shows the multiply and divide instructions:

Table 36. Multiply and divide instructions

Mnemonic Brief description See

MLA Multiply with Accumulate, 32-bit result Section 3.5.1 MUL, MLA, and MLS

MLS Multiply and Subtract, 32-bit result Section 3.5.1 MUL, MLA, and MLS

MUL Multiply, 32-bit result Section 3.5.1 MUL, MLA, and MLS

SDIV Signed Divide Section 3.5.2 SDIV and UDIV

Section 3.5.3 SMLAWB, SMLAWT, SMLABB,

SMLA[B,T] Signed Multiply Accumulate (halfwords)
SMLABT, SMLATB, and SMLATT
SMLAD, SMLADX Signed Multiply Accumulate Dual Section 3.5.4 SMLAD and SMLADX

Signed Multiply with Accumulate (32 × 32 + 64), Section 3.5.11 UMULL, UMAAL, UMLAL, SMULL,
SMLAL
64-bit result and SMLAL
Section 3.5.5 SMLALD, SMLALDX, SMLALBB,
SMLAL[B,T] Signed Multiply Accumulate Long (halfwords)
SMLALBT, SMLALTB, and SMLALTT

PM0264 - Rev 2 page 89/232

 PM0264
Multiply and divide instructions

Mnemonic Brief description See

Section 3.5.5 SMLALD, SMLALDX, SMLALBB,

SMLALD, SMLALDX Signed Multiply Accumulate Long Dual
SMLALBT, SMLALTB, and SMLALTT
Section 3.5.3 SMLAWB, SMLAWT, SMLABB,
SMLAW[B|T] Signed Multiply Accumulate (word by halfword)
SMLABT, SMLATB, and SMLATT
SMLSD Signed Multiply Subtract Dual Section 3.5.6 SMLSD and SMLSLD

SMLSLD Signed Multiply Subtract Long Dual Section 3.5.6 SMLSD and SMLSLD

Signed Most Significant Word Multiply

SMMLA Section 3.5.7 SMMLA and SMMLS
Accumulate
SMMLS, SMMLSR Signed Most Significant Word Multiply Subtract Section 3.5.7 SMMLA and SMMLS

SMMUL, SMMULR Signed Most Significant Word Multiply Section 3.5.8 SMMUL

SMUAD, SMUADX Signed Dual Multiply Add Section 3.5.9 SMUAD and SMUSD

SMUL[B,T] Signed Multiply (word by halfword) Section 3.5.10 SMUL and SMULW

Section 3.5.11 UMULL, UMAAL, UMLAL, SMULL,

SMULL Signed Multiply (32 × 32), 64-bit result
and SMLAL
SMULWB, SMULWT Signed Multiply (word by halfword) Section 3.5.10 SMUL and SMULW

SMUSDX ,SMUSD Signed Dual Multiply Subtract Section 3.5.9 SMUAD and SMUSD

UDIV Unsigned Divide Section 3.5.2 SDIV and UDIV

Unsigned Multiply Accumulate Accumulate Long Section 3.5.11 UMULL, UMAAL, UMLAL, SMULL,
UMAAL
(32 × 32 + 32 + 32), 64-bit result and SMLAL
Unsigned Multiply with Accumulate (32 × 32 + Section 3.5.11 UMULL, UMAAL, UMLAL, SMULL,
UMLAL
64), 64-bit result and SMLAL
Section 3.5.11 UMULL, UMAAL, UMLAL, SMULL,
UMULL Unsigned Multiply (32 × 32), 64-bit result
and SMLAL

3.5.1 MUL, MLA, and MLS

Multiply, Multiply with Accumulate, and Multiply with Subtract, using 32‑bit operands, and producing a 32-bit
result.
MUL{S}{cond} {Rd,} Rn, Rm ; Multiply
MLA{cond} Rd, Rn, Rm, Ra ; Multiply with accumulate
MLS{cond} Rd, Rn, Rm, Ra ; Multiply with subtract
Where:
cond
Is an optional condition code.
S
Is an optional suffix. If S is specified, the condition code flags are updated on the result of the operation.
Rd
Is the destination register. If Rd is omitted, the destination register is Rn.
Rn, Rm
Are registers holding the values to be multiplied.
Ra
Is a register holding the value to be added or subtracted from.

Operation
The MUL instruction multiplies the values from Rn and Rm, and places the least significant 32 bits of the result in
Rd.

PM0264 - Rev 2 page 90/232

 PM0264
Multiply and divide instructions

The MLA instruction multiplies the values from Rn and Rm, adds the value from Ra, and places the least
significant 32 bits of the result in Rd.
The MLS instruction multiplies the values from Rn and Rm, subtracts the product from the value from Ra, and
places the least significant 32 bits of the result in Rd.
The results of these instructions do not depend on whether the operands are signed or unsigned.

Restrictions
In these instructions, do not use SP and do not use PC.
If you use the S suffix with the MUL instruction:
• Rd, Rn, and Rm must all be in the range R0-R7.
• Rd must be the same as Rm.
• You must not use the cond suffix.

Condition flags
The MLA instruction and MULS instructions:
• Only MULS instruction updates the N and Z flags according to the result.
• No other MUL, MLA, or MLS instruction affects the condition flags.
MUL R10, R2, R5 ; Multiply, R10 = R2 × R5
MLA R10, R2, R1, R5 ; Multiply with accumulate, R10 = (R2 × R1) + R5
MULS R0, R2, R2 ; Multiply with flag update, R0 = R2 × R2
MULLT R2, R3, R2 ; Conditionally multiply, R2 = R3 × R2
MLS R4, R5, R6, R7 ; Multiply with subtract, R4 = R7 - (R5 × R6)

3.5.2 SDIV and UDIV

Signed Divide and Unsigned Divide.

SDIV{cond} {Rd,} Rn, Rm

UDIV{cond} {Rd,} Rn, Rm
Where:
cond
Is an optional condition code.
Rd
Is the destination register. If Rd is omitted, the destination register is Rn.
Rn
Is the register holding the value to be divided.
Rm
Is a register holding the divisor.

Operation
The SDIV instruction performs a signed integer division of the value in Rn by the value in Rm.
The UDIV instruction performs an unsigned integer division of the value in Rn by the value in Rm.
For both instructions, if the value in Rn is not divisible by the value in Rm, the result is rounded towards zero.
For the Cortex‑M33 processor, the integer divide operation latency is in the range of 2-11 cycles.

Restrictions
Do not use SP and do not use PC.

Condition flags
These instructions do not change the flags.

PM0264 - Rev 2 page 91/232

 PM0264
Multiply and divide instructions

SDIV R0, R2, R4 ; Signed divide, R0 = R2/R4

UDIV R8, R8, R1 ; Unsigned divide, R8 = R8/R1

3.5.3 SMLAWB, SMLAWT, SMLABB, SMLABT, SMLATB, and SMLATT

Signed Multiply Accumulate (halfwords).

op{cond} Rd, Rn, Rm, Ra

Where:
op
Is one of:
SMLAWB
Signed Multiply Accumulate (word by halfword)
The bottom halfword, bits [15:0], of Rm is used.

SMLAWT
Signed Multiply Accumulate (word by halfword)
The top halfword, bits [31:16] of Rm is used.

SMLABB, SMLABT
Signed Multiply Accumulate Long (halfwords)
The bottom halfword, bits [15:0], of Rm is used.

SMLATB, SMLATT
Signed Multiply Accumulate Long (halfwords)
The top halfword, bits [31:16] of Rm is used.

cond
Is an optional condition code.
Rd
Is the destination register.
Rn, Rm
Are registers holding the values to be multiplied.
Ra
Is a register holding the value to be added or subtracted from.

Operation
The SMLABB, SMLABT, SMLATB, SMLATT instructions:
• Multiply the specified signed halfword, top or bottom, values from Rn and Rm.
• Add the value in Ra to the resulting 32-bit product.
• Write the result of the multiplication and addition in Rd.
The non-specified halfwords of the source registers are ignored.
The SMLAWB and SMLAWT instructions:
• Multiply the 32-bit signed values in Rn with:
– The top signed halfword of Rm, T instruction suffix.
– The bottom signed halfword of Rm, B instruction suffix.
• Add the 32-bit signed value in Ra to the top 32 bits of the 48-bit product
• Write the result of the multiplication and addition in Rd.
The bottom 16 bits of the 48-bit product are ignored.

PM0264 - Rev 2 page 92/232

 PM0264
Multiply and divide instructions

If overflow occurs during the addition of the accumulate value, the SMLAWB, SMLAWT, instruction sets the Q flag in
the APSR. No overflow can occur during the multiplication.

Restrictions
In these instructions, do not use SP and do not use PC.

Condition flags
If an overflow is detected, the Q flag is set.
SMLABB R5, R6, R4, R1 ; Multiplies bottom halfwords of R6 and R4, adds
; R1 and writes to R5.
SMLATB R5, R6, R4, R1 ; Multiplies top halfword of R6 with bottom halfword
; of R4, adds R1 and writes to R5.
SMLATT R5, R6, R4, R1 ; Multiplies top halfwords of R6 and R4, adds
; R1 and writes the sum to R5.
SMLABT R5, R6, R4, R1 ; Multiplies bottom halfword of R6 with top halfword
; of R4, adds R1 and writes to R5.
SMLABT R4, R3, R2 ; Multiplies bottom halfword of R4 with top halfword of
; R3, adds R2 and writes to R4.
SMLAWB R10, R2, R5, R3 ; Multiplies R2 with bottom halfword of R5, adds
; R3 to the result and writes top 32-bits to R10.
SMLAWT R10, R2, R1, R5 ; Multiplies R2 with top halfword of R1, adds R5
; and writes top 32-bits to R10.

3.5.4 SMLAD and SMLADX

Signed Multiply Accumulate Long Dual, Signed Multiply Accumulate Long Dual exchange.

op{X}{cond} Rd, Rn, Rm, Ra

Where:
op
Is one of:
SMLAD
Signed Multiply Accumulate Long Dual.
SMLADX
Signed Multiply Accumulate Long Dual exchange.
X specifies which halfword of the source register Rn is used as the multiply operand.
If X is omitted, the multiplications are bottom × bottom and top × top.
If X is present, the multiplications are bottom × top and top × bottom.

cond
Is an optional condition code.
Rd
Is the destination register.
Rn
Is the first operand register holding the values to be multiplied.
Rm
Is the second operand register.
Ra
Is the accumulate value.

Operation
The SMLAD and SMLADX instructions regard the two operands as four halfword 16-bit values.
The SMLAD instruction:

PM0264 - Rev 2 page 93/232

 PM0264
Multiply and divide instructions

1. Multiplies the top signed halfword value in Rn with the top signed halfword of Rm and the bottom signed
halfword value in Rn with the bottom signed halfword of Rm.
2. Adds both multiplication results to the signed 32-bit value in Ra.
3. Writes the 32-bit signed result of the multiplication and addition to Rd.
The SMLADX instruction:
1. Multiplies the top signed halfword value in Rn with the bottom signed halfword of Rm and the bottom signed
halfword value in Rn with the top signed halfword of Rm.
2. Adds both multiplication results to the signed 32-bit value in Ra.
3. Writes the 32-bit signed result of the multiplication and addition to Rd.

Restrictions
Do not use SP and do not use PC.

Condition flags
Sets the Q flag if the accumulate operation overflows.
SMLAD R10, R2, R1, R5 ; Multiplies two halfword values in R2 with
; corresponding halfwords in R1, adds R5 and writes to
; R10.
SMLALDX R0, R2, R4, R6 ; Multiplies top halfword of R2 with bottom halfword
; of R4, multiplies bottom halfword of R2 with top
; halfword of R4, adds R6 and writes to R0.

3.5.5 SMLALD, SMLALDX, SMLALBB, SMLALBT, SMLALTB, and SMLALTT

Signed Multiply Accumulate Long Dual and Signed Multiply Accumulate Long (halfwords).

op{cond} RdLo, RdHi, Rn, Rm

Where:
op
Is one of:
SMLALBB, SMLALBT
Signed Multiply Accumulate Long (halfwords, B and T).
B and T specify which halfword of the source registers Rn and Rm are used as the first and second multiply operand:
The bottom halfword, bits [15:0], of Rn is used.
SMLALBB: the bottom halfword, bits [15:0], of Rm is used. SMLALBT: the top halfword, bits [31:16], of Rm is used.
SMLALTB, SMLALTT
Signed Multiply Accumulate Long (halfwords, B and T).
The top halfword, bits [31:16], of Rn is used.
SMLALTB: the bottom halfword, bits [15:0], of Rm is used. SMLALTT: the top halfword, bits [31:16], of Rm is used.
SMLALD
Signed Multiply Accumulate Long Dual.
The multiplications are bottom × bottom and top × top.
SMLALDX
Signed Multiply Accumulate Long Dual reversed.
The multiplications are bottom × top and top × bottom.

cond
Is an optional condition code.

PM0264 - Rev 2 page 94/232

 PM0264
Multiply and divide instructions

RdHi, RdLo
Are the destination registers. RdLo is the lower 32 bits and RdHi is the upper 32 bits of the 64-bit integer. The
accumulating value for the lower and upper 32 bits are held in the RdLo and RdHi registers respectively.
Rn, Rm
Are registers holding the first and second operands.

Operation
• Multiplies the two’s complement signed word values from Rn and Rm.
• Adds the 64-bit value in RdLo and RdHi to the resulting 64-bit product.
• Writes the 64-bit result of the multiplication and addition in RdLo and RdHi.
The SMLALBB, SMLALBT, SMLALTB and SMLALTT instructions:
• Multiplies the specified signed halfword, Top or Bottom, values from Rn and Rm.
• Adds the resulting sign-extended 32-bit product to the 64-bit value in RdLo and RdHi.
• Writes the 64-bit result of the multiplication and addition in RdLo and RdHi.
The non-specified halfwords of the source registers are ignored.
The SMLALD and SMLALDX instructions interpret the values from Rn and Rm as four halfword two’s complement
signed 16-bit integers. These instructions:
• SMLALD multiplies the top signed halfword value of Rn with the top signed halfword of Rm and the bottom
signed halfword values of Rn with the bottom signed halfword of Rm.
• SMLALDX multiplies the top signed halfword value of Rn with the bottom signed halfword of Rm and the
bottom signed halfword values of Rn with the top signed halfword of Rm.
• Add the two multiplication results to the signed 64-bit value in RdLo and RdHi to create the resulting 64-bit
product.
• Write the 64-bit product in RdLo and RdHi.

Restrictions
In these instructions:
• Do not use SP and do not use PC.
• RdHi and RdLo must be different registers.

Condition flags
These instructions do not affect the condition code flags.
SMLALBT R2, R1, R6, R7 ; Multiplies bottom halfword of R6 with top
; halfword of R7, sign extends to 32-bit, adds
; R1:R2 and writes to R1:R2.
SMLALTB R2, R1, R6, R7 ; Multiplies top halfword of R6 with bottom
; halfword of R7,sign extends to 32-bit, adds R1:R2
; and writes to R1:R2.
SMLALD R6, R8, R5, R1 ; Multiplies top halfwords in R5 and R1 and bottom
; halfwords of R5 and R1, adds R8:R6 and writes to
; R8:R6.
SMLALDX R6, R8, R5, R1 ; Multiplies top halfword in R5 with bottom
; halfword of R1, and bottom halfword of R5 with
; top halfword of R1, adds R8:R6 and writes to
; R8:R6.

3.5.6 SMLSD and SMLSLD

Signed Multiply Subtract Dual and Signed Multiply Subtract Long Dual.

op{X}{cond} Rd, Rn, Rm, Ra ; SMLSD

op{X}{cond} RdLo, RdHi, Rn, Rm ; SMLSLD
Where:

PM0264 - Rev 2 page 95/232

 PM0264
Multiply and divide instructions

op
Is one of:
SMLSD
Signed Multiply Subtract Dual.
SMLSDX
Signed Multiply Subtract Dual reversed.
SMLSLD
Signed Multiply Subtract Long Dual.
SMLSLDX
Signed Multiply Subtract Long Dual reversed.

If X is present, the multiplications are bottom × top and top × bottom. If the X is omitted, the multiplications are
bottom × bottom and top × top.
cond
Is an optional condition code.
Rd
Is the destination register.
Rn, Rm
Are registers holding the first and second operands.
Ra
Is the register holding the accumulate value.
RdLo
Supplies the lower 32 bits of the accumulate value, and is the destination register for the lower 32 bits of the
result.
RdHi
Supplies the upper 32 bits of the accumulate value, and is the destination register for the upper 32 bits of the
result.

Operation
The SMLSD instruction interprets the values from the first and second operands as four signed halfwords. This
instruction:
• Optionally rotates the halfwords of the second operand.
• Performs two signed 16 × 16-bit halfword multiplications.
• Subtracts the result of the upper halfword multiplication from the result of the lower halfword multiplication.
• Adds the signed accumulate value to the result of the subtraction.
• Writes the result of the addition to the destination register.
The SMLSLD instruction interprets the values from Rn and Rm as four signed halfwords. This instruction:
• Optionally rotates the halfwords of the second operand.
• Performs two signed 16 × 16-bit halfword multiplications.
• Subtracts the result of the upper halfword multiplication from the result of the lower halfword multiplication.
• Adds the 64-bit value in RdHi and RdLo to the result of the subtraction.
• Writes the 64-bit result of the addition to the RdHi and RdLo.

Restrictions
In these instructions:
• Do not use SP and do not use PC.

PM0264 - Rev 2 page 96/232

 PM0264
Multiply and divide instructions

Condition flags
The SMLSD{X} instruction sets the Q flag if the accumulate operation overflows. Overflow cannot occur during the
multiplications or subtraction.
For the T32 instruction set, these instructions do not affect the condition code flags.
SMLSD R0, R4, R5, R6 ; Multiplies bottom halfword of R4 with bottom
; halfword of R5, multiplies top halfword of R4
; with top halfword of R5, subtracts second from
; first, adds R6, writes to R0.
SMLSDX R1, R3, R2, R0 ; Multiplies bottom halfword of R3 with top
; halfword of R2, multiplies top halfword of R3
; with bottom halfword of R2, subtracts second from
; first, adds R0, writes to R1.
SMLSLD R3, R6, R2, R7 ; Multiplies bottom halfword of R6 with bottom
; halfword of R2, multiplies top halfword of R6
; with top halfword of R2, subtracts second from
; first, adds R6:R3, writes to R6:R3.
SMLSLDX R3, R6, R2, R7 ; Multiplies bottom halfword of R6 with top
; halfword of R2, multiplies top halfword of R6
; with bottom halfword of R2, subtracts second from
; first, adds R6:R3, writes to R6:R3.

3.5.7 SMMLA and SMMLS

Signed Most Significant Word Multiply Accumulate and Signed Most Significant Word Multiply Subtract.

op{R}{cond} Rd, Rn, Rm, Ra

Where:
op
Is one of:
SMMLA
Signed Most Significant Word Multiply Accumulate.
SMMLS
Signed Most Significant Word Multiply Subtract.

R
If R is present, the result is rounded instead of being truncated. In this case the constant 0x80000000 is added to
the product before the top halfword is extracted.
cond
Is an optional condition code.
Rd
Is the destination register.
Rn, Rm
Are registers holding the first and second multiply operands.
Ra
Is the register holding the accumulate value.

Operation
The SMMLA instruction interprets the values from Rn and Rm as signed 32-bit words.
The SMMLA instruction:
• Multiplies the values in Rn and Rm.
• Optionally rounds the result by adding 0x80000000.
• Extracts the most significant 32 bits of the result.

PM0264 - Rev 2 page 97/232

 PM0264
Multiply and divide instructions

• Adds the value of Ra to the signed extracted value.

• Writes the result of the addition in Rd.
The SMMLS instruction interprets the values from Rn and Rm as signed 32-bit words.
The SMMLS instruction:
• Multiplies the values in Rn and Rm.
• Optionally rounds the result by adding 0x80000000.
• Extracts the most significant 32 bits of the result.
• Subtracts the extracted value of the result from the value in Ra.
• Writes the result of the subtraction in Rd.

Restrictions
In these instructions:
• Do not use SP and do not use PC.

Condition flags
These instructions do not affect the condition code flags.
SMMLA R0, R4, R5, R6 ; Multiplies R4 and R5, extracts top 32 bits, adds
; R6, truncates and writes to R0.
SMMLAR R6, R2, R1, R4 ; Multiplies R2 and R1, extracts top 32 bits, adds
; R4, rounds and writes to R6.
SMMLSR R3, R6, R2, R7 ; Multiplies R6 and R2, extracts top 32 bits,
; subtracts R7, rounds and writes to R3.
SMMLS R4, R5, R3, R8 ; Multiplies R5 and R3, extracts top 32 bits,
; subtracts R8, truncates and writes to R4.

3.5.8 SMMUL
Signed Most Significant Word Multiply.
op{R}{cond} Rd, Rn, Rm
Where:
op
Is one of:
SMMUL
Signed Most Significant Word Multiply.

R
If R is present, the result is rounded instead of being truncated. In this case the constant 0x80000000 is added to
the product before the top halfword is extracted.
cond
Is an optional condition code.
Rd
Is the destination register.
Rn, Rm
Are registers holding the first and second operands.

Operation
The SMMUL instruction interprets the values from Rn and Rm as two’s complement 32-bit signed integers. The
SMMUL instruction:
• Multiplies the values from Rn and Rm.
• Optionally rounds the result, otherwise truncates the result.
• Writes the most significant signed 32 bits of the result in Rd.

PM0264 - Rev 2 page 98/232

 PM0264
Multiply and divide instructions

Restrictions
In this instruction:
• Do not use SP and do not use PC.

Condition flags
This instruction does not affect the condition code flags.
SMMUL R0, R4, R5 ; Multiplies R4 and R5, truncates top 32 bits
; and writes to R0.
SMMULR R6, R2 ; Multiplies R6 and R2, rounds the top 32 bits
; and writes to R6.

3.5.9 SMUAD and SMUSD

Signed Dual Multiply Add and Signed Dual Multiply Subtract.

op{X}{cond} Rd, Rn, Rm

Where:
op
Is one of:
SMUAD
Signed Dual Multiply Add.
SMUADX
Signed Dual Multiply Add reversed.
SMUSD
Signed Dual Multiply Subtract.
SMUSDX
Signed Dual Multiply Subtract reversed.

If X is present, the multiplications are bottom × top and top × bottom. If the X is omitted, the multiplications are
bottom × bottom and top × top.
cond
Is an optional condition code.
Rd
Is the destination register.
Rn, Rm
Are registers holding the first and the second operands.

Operation
The SMUAD instruction interprets the values from the first and second operands as two signed halfwords in each
operand. This instruction:
• Optionally rotates the halfwords of the second operand.
• Performs two signed 16 × 16-bit multiplications.
• Adds the two multiplication results together.
• Writes the result of the addition to the destination register.
The SMUSD instruction interprets the values from the first and second operands as two’s complement signed
integers. This instruction:
• Optionally rotates the halfwords of the second operand.
• Performs two signed 16 × 16-bit multiplications.

PM0264 - Rev 2 page 99/232

 PM0264
Multiply and divide instructions

• Subtracts the result of the top halfword multiplication from the result of the bottom halfword multiplication.
• Writes the result of the subtraction to the destination register.

Restrictions
In these instructions:
• Do not use SP and do not use PC.

Condition flags
SMUAD, SMUADX set the Q flag if the addition overflows. The multiplications cannot overflow.

SMUAD R0, R4, R5 ; Multiplies bottom halfword of R4 with the bottom

; halfword of R5, adds multiplication of top halfword
; of R4 with top halfword of R5, writes to R0.
SMUADX R3, R7, R4 ; Multiplies bottom halfword of R7 with top halfword
; of R4, adds multiplication of top halfword of R7
; with bottom halfword of R4, writes to R3.
SMUSD R3, R6, R2 ; Multiplies bottom halfword of R4 with bottom halfword
; of R6, subtracts multiplication of top halfword of R6
; with top halfword of R3, writes to R3.
SMUSDX R4, R5, R3 ; Multiplies bottom halfword of R5 with top halfword of
; R3, subtracts multiplication of top halfword of R5
; with bottom halfword of R3, writes to R4.

3.5.10 SMUL and SMULW

Signed Multiply (halfwords) and Signed Multiply (word by halfword).

op{XY}{cond} Rd,Rn, Rm ; SMUL

op{Y}{cond} Rd. Rn, Rm ; SMULW
For SMUL{XY} only:
op
Is one of SMULBB, SMULBT, SMULTB, SMULTT:

SMUL{XY} Signed Multiply (halfwords)

X and Y specify which halfword of the source registers Rn and Rm is used as the first and second multiply
operand. If X is B, then the bottom halfword, bits [15:0] of Rn is used. If X is T, then the top halfword, bits [31:16]
of Rn is used. If Y is B, then the bottom halfword, bits [15:0], of Rm is used. If Y is T, then the top halfword, bits
[31:16], of Rm is used.

SMULW{Y} Signed Multiply (word by halfword)

Y specifies which halfword of the source register Rm is used as the second multiply operand. If Y is B, then the
bottom halfword (bits [15:0]) of Rm is used. If Y is T, then the top halfword (bits [31:16]) of Rm is used.

cond
Is an optional condition code.
Rd
Is the destination register.
Rn, Rm
Are registers holding the first and second operands.

Operation
The SMULBB, SMULTB, SMULBT and SMULTT instructions interprets the values from Rn and Rm as four signed
16-bit integers.
These instructions:

PM0264 - Rev 2 page 100/232

 PM0264
Multiply and divide instructions

• Multiply the specified signed halfword, Top or Bottom, values from Rn and Rm.
• Write the 32-bit result of the multiplication in Rd.
The SMULWT and SMULWB instructions interprets the values from Rn as a 32-bit signed integer and Rm as two
halfword 16-bit signed integers. These instructions:
• Multiply the first operand and the top, T suffix, or the bottom, B suffix, halfword of the second operand.
• Write the signed most significant 32 bits of the 48-bit result in the destination register.

Restrictions
In these instructions:
• Do not use SP and do not use PC.
• RdHi and RdLo must be different registers.
SMULBT R0, R4, R5 ; Multiplies the bottom halfword of R4 with the
; top halfword of R5, multiplies results and
; writes to R0.
SMULBB R0, R4, R5 ; Multiplies the bottom halfword of R4 with the
; bottom halfword of R5, multiplies results and
; writes to R0.
SMULTT R0, R4, R5 ; Multiplies the top halfword of R4 with the top
; halfword of R5, multiplies results and writes
; to R0.
SMULTB R0, R4, R5 ; Multiplies the top halfword of R4 with the
; bottom halfword of R5, multiplies results and
; and writes to R0.
SMULWT R4, R5, R3 ; Multiplies R5 with the top halfword of R3,
; extracts top 32 bits and writes to R4.
SMULWB R4, R5, R3 ; Multiplies R5 with the bottom halfword of R3,
; extracts top 32 bits and writes to R4.

3.5.11 UMULL, UMAAL, UMLAL, SMULL, and SMLAL

Signed and Unsigned Multiply Long, with optional Accumulate, using 32‑bit operands and producing a 64‑bit
result.

op{cond} RdLo, RdHi, Rn, Rm

Where:
op
Is one of:
UMULL
Unsigned Multiply Long.
UMLAL
Unsigned Multiply, with Accumulate Long.
UMAAL
Unsigned Long Multiply with Accumulate Accumulate.
SMULL
Signed Multiply Long.
SMLAL
Signed Multiply, with Accumulate Long.

cond
Is an optional condition code.
RdHi, RdLo
Are the destination registers. For UMLAL and SMLAL they also hold the accumulating value of the lower and
upper words respectively.

PM0264 - Rev 2 page 101/232

 PM0264
Saturating instructions

Rn, Rm
Are registers holding the operands.

Operation
The UMULL instruction interprets the values from Rn and Rm as unsigned integers. It multiplies these integers and
places the least significant 32 bits of the result in RdLo, and the most significant 32 bits of the result in RdHi.
The UMLAL instruction interprets the values from Rn and Rm as unsigned integers. It multiplies these integers,
adds the 64‑bit result to the 64‑bit unsigned integer contained in RdHi and RdLo, and writes the result back to
RdHi and RdLo.
The UMAAL instruction interprets the values from Rn and Rm as unsigned integers. It multiplies these integers,
adds the unsigned 32-bit integer in RdHi to the 64-bit result of the multiplication, adds the unsigned 32-bit integer
in RdLo to the 64-bit result of the addition, writes the top 32-bits of the result to RdHi and writes the lower 32-bits
of the result to RdLo.
The SMULL instruction interprets the values from Rn and Rm as two’s complement signed integers. It multiplies
these integers and places the least significant 32 bits of the result in RdLo, and the most significant 32 bits of the
result in RdHi.
The SMLAL instruction interprets the values from Rn and Rm as two’s complement signed integers. It multiplies
these integers, adds the 64‑bit result to the 64‑bit signed integer contained in RdHi and RdLo, and writes the
result back to RdHi and RdLo.

Restrictions
In these instructions:
• Do not use SP and do not use PC.
• RdHi and RdLo must be different registers.

Condition flags
These instructions do not affect the condition code flags.
UMULL R0, R4, R5, R6 ; Unsigned (R4,R0) = R5 × R6
SMLAL R4, R5, R3, R8 ; Signed (R5,R4) = (R5,R4) + R3 × R8

3.6 Saturating instructions

Table 37 shows the saturating instructions:

Table 37. Saturating instructions

Mnemonic Brief description See

QADD Saturating Add Section 3.6.3 QADD and QSUB

QASX Saturating Add and Subtract with Exchange Section 3.6.4 QASX and QSAX

QDADD Saturating Double and Add Section 3.6.5 QDADD and QDSUB

QDSUB Saturating Double and Subtract Section 3.6.5 QDADD and QDSUB

QSAX Saturating Subtract and Add with Exchange Section 3.6.4 QASX and QSAX

QSUB Saturating Subtract Section 3.6.3 QADD and QSUB

QSUB16 Saturating Subtract 16 Section 3.6.3 QADD and QSUB

SSAT Signed Saturate Section 3.6.1 SSAT and USAT

SSAT16 Signed Saturate Halfword Section 3.6.2 SSAT16 and USAT16

UQADD16 Unsigned Saturating Add 16 Section 3.6.7 UQADD and UQSUB

UQADD8 Unsigned Saturating Add 8 Section 3.6.7 UQADD and UQSUB

UQASX Unsigned Saturating Add and Subtract with Exchange Section 3.6.6 UQASX and UQSAX

PM0264 - Rev 2 page 102/232

 PM0264
Saturating instructions

Mnemonic Brief description See

UQSAX Unsigned Saturating Subtract and Add with Exchange Section 3.6.6 UQASX and UQSAX

UQSUB16 Unsigned Saturating Subtract 16 Section 3.6.7 UQADD and UQSUB

UQSUB8 Unsigned Saturating Subtract 8 Section 3.6.7 UQADD and UQSUB

USAT Unsigned Saturate Section 3.6.1 SSAT and USAT

USAT16 Unsigned Saturate Halfword Section 3.6.2 SSAT16 and USAT16

For signed n-bit saturation, this means that:

• If the value to be saturated is less than −2n−1, the result returned is −2n-1
• If the value to be saturated is greater than 2n−1−1, the result returned is 2n-1−1
• Otherwise, the result returned is the same as the value to be saturated.
For unsigned n-bit saturation, this means that:
• If the value to be saturated is less than 0, the result returned is 0
• If the value to be saturated is greater than 2n−1, the result returned is 2n−1
• Otherwise, the result returned is the same as the value to be saturated.
If the returned result is different from the value to be saturated, it is called saturation. If saturation occurs, the
instruction sets the Q flag to 1 in the APSR. Otherwise, it leaves the Q flag unchanged. To clear the Q flag to 0,
you must use the MSR instruction.
To read the state of the Q flag, use the MRS instruction.

3.6.1 SSAT and USAT

Signed Saturate and Unsigned Saturate to any bit position, with optional shift before saturating.

op{cond} Rd, #n, Rm {, shift #s}

Where:
op
Is one of:
SSAT
Saturates a signed value to a signed range.
USAT
Saturates a signed value to an unsigned range.

cond
Is an optional condition code.
Rd
Is the destination register.
n
Specifies the bit position to saturate to:
• n ranges from 1 to 32 for SSAT.
• n ranges from 0 to 31 for USAT.
Rm
Is the register containing the value to saturate.

PM0264 - Rev 2 page 103/232

 PM0264
Saturating instructions

shift #s
Is an optional shift applied to Rm before saturating. It must be one of the following:
ASR #s
where s is in the range 1-31.
LSL #s
where s is in the range 0-31.

Operation
These instructions saturate to a signed or unsigned n-bit value.
The SSAT instruction applies the specified shift, then saturates to the signed range −2n–1 ≤ x ≤ 2n–1−1.
The USAT instruction applies the specified shift, then saturates to the unsigned range 0 ≤ x ≤ 2n−1.

Restrictions
Do not use SP and do not use PC.

Condition flags
These instructions do not affect the condition code flags.
If saturation occurs, these instructions set the Q flag to 1.
SSAT R7, #16, R7, LSL #4 ; Logical shift left value in R7 by 4, then
; saturate it as a signed 16-bit value and
; write it back to R7.
USATNE R0, #7, R5 ; Conditionally saturate value in R5 as an
; unsigned 7 bit value and write it to R0.

3.6.2 SSAT16 and USAT16

Signed Saturate and Unsigned Saturate to any bit position for two halfwords.

op{cond} Rd, #n, Rm

Where:
op
Is one of:
SSAT16
Saturates a signed halfword value to a signed range.
USAT16
Saturates a signed halfword value to an unsigned range.

cond
Is an optional condition code.
Rd
Is the destination register.
n
Specifies the bit position to saturate to:
• n ranges from 1 to 16 for SSAT.
• n ranges from 0 to 15 for USAT.
Rm
Is the register containing the values to saturate.

PM0264 - Rev 2 page 104/232

 PM0264
Saturating instructions

Operation
The SSAT16 instruction:
1. Saturates two signed 16-bit halfword values of the register with the value to saturate from selected by the bit
position in n.
2. Writes the results as two signed 16-bit halfwords to the destination register.
The USAT16 instruction:
1. Saturates two unsigned 16-bit halfword values of the register with the value to saturate from selected by the
bit position in n.
2. Writes the results as two unsigned halfwords in the destination register.

Restrictions
Do not use SP and do not use PC.

Condition flags
These instructions do not affect the condition code flags.
If saturation occurs, these instructions set the Q flag to 1.
SSAT16 R7, #9, R2 ; Saturates the top and bottom highwords of R2
; as 9-bit values, writes to corresponding halfword
; of R7.

USAT16NE R0, #13, R5 ; Conditionally saturates the top and bottom

; halfwords of R5 as 13-bit values, writes to
; corresponding halfword of R0.

3.6.3 QADD and QSUB

Saturating Add and Saturating Subtract, signed.

op{cond} {Rd,} Rn, Rm

Where:
op
Is one of:
QADD
Saturating 32-bit add.
QADD8
Saturating four 8-bit integer additions.
QADD16
Saturating two 16-bit integer additions.
QSUB
Saturating 32-bit subtraction.
QSUB8
Saturating four 8-bit integer subtraction.
QSUB16
Saturating two 16-bit integer subtraction.

cond
Is an optional condition code.
Rd
Is the destination register. If Rd is omitted, the destination register is Rn.

PM0264 - Rev 2 page 105/232

 PM0264
Saturating instructions

Rn, Rm
Are registers holding the first and second operands.

Operation
These instructions add or subtract two, four or eight values from the first and second operands and then writes a
signed saturated value in the destination register.
The QADD and QSUB instructions apply the specified add or subtract, and then saturate the result to the signed
range −2n–1 ≤ x ≤ 2n–1−1, where x is given by the number of bits applied in the instruction, 32, 16 or 8.
If the returned result is different from the value to be saturated, it is called saturation. If saturation occurs, the
QADD and QSUB instructions set the Q flag to 1 in the APSR. Otherwise, it leaves the Q flag unchanged. The 8-bit
and 16-bit QADD and QSUB instructions always leave the Q flag unchanged.
To clear the Q flag to 0, you must use the MSR instruction.
To read the state of the Q flag, use the MRS instruction.

Restrictions
Do not use SP and do not use PC.

Condition flags
These instructions do not affect the condition code flags.
If saturation occurs, the QADD and QSUB instructions set the Q flag to 1.

QADD16 R7, R4, R2 ; Adds halfwords of R4 with corresponding halfword of

; R2, saturates to 16 bits and writes to corresponding
; halfword of R7.

QADD8 R3, R1, R6 ; Adds bytes of R1 to the corresponding bytes of R6,

; saturates to 8 bits and writes to corresponding byte of
; R3.

QSUB16 R4, R2, R3 ; Subtracts halfwords of R3 from corresponding halfword

; of R2, saturates to 16 bits, writes to corresponding
; halfword of R4.

QSUB8 R4, R2, R5 ; Subtracts bytes of R5 from the corresponding byte in

; R2, saturates to 8 bits, writes to corresponding byte of
; R4.

3.6.4 QASX and QSAX

Saturating Add and Subtract with Exchange and Saturating Subtract and Add with Exchange, signed.

op{cond} {Rd,} Rn, Rm

Where:
op
Is one of:
QASX
Add and Subtract with Exchange and Saturate.
QSAX
Subtract and Add with Exchange and Saturate.

cond
Is an optional condition code.
Rd
Is the destination register. If Rd is omitted, the destination register is Rn.

PM0264 - Rev 2 page 106/232

 PM0264
Saturating instructions

Rn, Rm
Are registers holding the first and second operands.

Operation
The QASX instruction:
1. Adds the top halfword of the source operand with the bottom halfword of the second operand.
2. Subtracts the top halfword of the second operand from the bottom highword of the first operand.
3. Saturates the result of the subtraction and writes a 16-bit signed integer in the range –215 ≤ x ≤ 215 – 1,
where x equals 16, to the bottom halfword of the destination register.
4. Saturates the results of the sum and writes a 16-bit signed integer in the range –215 ≤ x ≤ 215 – 1, where x
equals 16, to the top halfword of the destination register.
The QSAX instruction:
1. Subtracts the bottom halfword of the second operand from the top highword of the first operand.
2. Adds the bottom halfword of the source operand with the top halfword of the second operand.
3. Saturates the results of the sum and writes a 16-bit signed integer in the range –215 ≤ x ≤ 215 – 1, where x
equals 16, to the bottom halfword of the destination register.
4. Saturates the result of the subtraction and writes a 16-bit signed integer in the range –215 ≤ x ≤ 215 – 1,
where x equals 16, to the top halfword of the destination register.

Restrictions
Do not use SP and do not use PC.

Condition flags
These instructions do not affect the condition code flags.
QASX R7, R4, R2 ; Adds top halfword of R4 to bottom halfword of R2,
; saturates to 16 bits, writes to top halfword of R7
; Subtracts top highword of R2 from bottom halfword of
; R4, saturates to 16 bits and writes to bottom halfword
; of R7

QSAX R0, R3, R5 ; Subtracts bottom halfword of R5 from top halfword of

; R3, saturates to 16 bits, writes to top halfword of R0
; Adds bottom halfword of R3 to top halfword of R5,
; saturates to 16 bits, writes to bottom halfword of R0.

3.6.5 QDADD and QDSUB

Saturating Double and Add and Saturating Double and Subtract, signed.

op{cond} {Rd}, Rm, Rn

Where:
op
Is one of:
QDADD
Saturating Double and Add.
QDSUB
Saturating Double and Subtract.

cond
Is an optional condition code.
Rd
Is the destination register. If Rd is omitted, the destination register is Rn.

PM0264 - Rev 2 page 107/232

 PM0264
Saturating instructions

Rm, Rn
Are registers holding the first and second operands.

Operation
The QDADD instruction:
• Doubles the second operand value.
• Adds the result of the doubling to the signed saturated value in the first operand.
• Writes the result to the destination register.
The QDSUB instruction:
• Doubles the second operand value.
• Subtracts the doubled value from the signed saturated value in the first operand.
• Writes the result to the destination register.
Both the doubling and the addition or subtraction have their results saturated to the 32-bit signed integer range
–231 ≤ x ≤ 231– 1. If saturation occurs in either operation, it sets the Q flag in the APSR.

Restrictions
Do not use SP and do not use PC.

Condition flags
If saturation occurs, these instructions set the Q flag to 1.
QDADD R7, R4, R2 ; Doubles and saturates R4 to 32 bits, adds R2,
; saturates to 32 bits, writes to R7

QDSUB R0, R3, R5 ; Subtracts R3 doubled and saturated to 32 bits

; from R5, saturates to 32 bits, writes to R0.

3.6.6 UQASX and UQSAX

Saturating Add and Subtract with Exchange and Saturating Subtract and Add with Exchange, unsigned.

op{cond} {Rd,} Rn, Rm

Where:
type
Is one of:
UQASX
Add and Subtract with Exchange and Saturate.
UQSAX
Subtract and Add with Exchange and Saturate.

cond
Is an optional condition code.
Rd
Is the destination register. If Rd is omitted, the destination register is Rn.
Rn, Rm
Are registers holding the first and second operands.

Operation
The UQASX instruction:
1. Adds the bottom halfword of the source operand with the top halfword of the second operand.
2. Subtracts the bottom halfword of the second operand from the top highword of the first operand.

PM0264 - Rev 2 page 108/232

 PM0264
Saturating instructions

3. Saturates the results of the sum and writes a 16-bit unsigned integer in the range 0 ≤ x ≤ 216 – 1, where x
equals 16, to the top halfword of the destination register.
4. Saturates the result of the subtraction and writes a 16-bit unsigned integer in the range 0 ≤ x ≤ 216 – 1,
where x equals 16, to the bottom halfword of the destination register.
The UQSAX instruction:
1. Subtracts the bottom halfword of the second operand from the top highword of the first operand.
2. Adds the bottom halfword of the first operand with the top halfword of the second operand.
3. Saturates the result of the subtraction and writes a 16-bit unsigned integer in the range 0 ≤ x ≤ 216 – 1,
where x equals 16, to the top halfword of the destination register.
4. Saturates the results of the addition and writes a 16-bit unsigned integer in the range 0 ≤ x ≤ 216 – 1, where
x equals 16, to the bottom halfword of the destination register.

Restrictions
Do not use SP and do not use PC.

Condition flags
These instructions do not affect the condition code flags.
UQASX R7, R4, R2 ; Adds top halfword of R4 with bottom halfword of R2,
; saturates to 16 bits, writes to top halfword of R7
; Subtracts top halfword of R2 from bottom halfword of
; R4, saturates to 16 bits, writes to bottom halfword of R7
UQSAX R0, R3, R5 ; Subtracts bottom halfword of R5 from top halfword of R3,
; saturates to 16 bits, writes to top halfword of R0
; Adds bottom halfword of R4 to top halfword of R5
; saturates to 16 bits, writes to bottom halfword of R0.

3.6.7 UQADD and UQSUB

Saturating Add and Saturating Subtract Unsigned.

op{cond} {Rd,} Rn, Rm

Where:
op
Is one of:
UQADD8
Saturating four unsigned 8-bit integer additions.
UQADD16
Saturating two unsigned 16-bit integer additions.
UQSUB8
Saturating four unsigned 8-bit integer subtractions.
UQSUB16
Saturating two unsigned 16-bit integer subtractions.

cond
Is an optional condition code.
Rd
Is the destination register. If Rd is omitted, the destination register is Rn.
Rn, Rm
Are registers holding the first and second operands.

PM0264 - Rev 2 page 109/232

 PM0264
Packing and unpacking instructions

Operation
These instructions add or subtract two or four values and then writes an unsigned saturated value in the
destination register.
The UQADD16 instruction:
• Adds the respective top and bottom halfwords of the first and second operands.
• Saturates the result of the additions for each halfword in the destination register to the unsigned range 0 ≤ x
≤ 216−1, where x is 16.
The UQADD8 instruction:
• Adds each respective byte of the first and second operands.
• Saturates the result of the addition for each byte in the destination register to the unsigned range 0 ≤ x ≤
28−1, where x is 8.
The UQSUB16 instruction:
• Subtracts both halfwords of the second operand from the respective halfwords of the first operand.
• Saturates the result of the differences in the destination register to the unsigned range 0 ≤ x ≤ 216−1, where
x is 16.
The UQSUB8 instructions:
• Subtracts the respective bytes of the second operand from the respective bytes of the first operand.
• Saturates the results of the differences for each byte in the destination register to the unsigned range 0 ≤ x ≤
28−1, where x is 8.

Restrictions
Do not use SP and do not use PC.

Condition flags
These instructions do not affect the condition code flags.
UQADD16 R7, R4, R2 ; Adds halfwords in R4 to corresponding halfword in R2,
; saturates to 16 bits, writes to corresponding halfword
; of R7
UQADD8 R4, R2, R5 ; Adds bytes of R2 to corresponding byte of R5, saturates
; to 8 bits, writes to corresponding bytes of R4
UQSUB16 R6, R3, R0 ; Subtracts halfwords in R0 from corresponding halfword
; in R3, saturates to 16 bits, writes to corresponding
; halfword in R6
UQSUB8 R1, R5, R6 ; Subtracts bytes in R6 from corresponding byte of R5,
; saturates to 8 bits, writes to corresponding byte of R1.

3.7 Packing and unpacking instructions

Table 38 shows the instructions that operate on packing and unpacking data:

Table 38. Packing and unpacking instructions

Mnemonic Brief description See

PKH Pack Halfword Section 3.7.1 PKHBT and PKHTB

SXTAB Extend 8 bits to 32 and add Section 3.7.2 SXTA and UXTA

SXTAB16 Dual extend 8 bits to 16 and add Section 3.7.2 SXTA and UXTA

SXTAH Extend 16 bits to 32 and add Section 3.7.2 SXTA and UXTA

SXTB Sign extend a byte Section 3.7.3 SXT and UXT

SXTB16 Dual extend 8 bits to 16 and add Section 3.7.3 SXT and UXT

SXTH Sign extend a halfword Section 3.7.3 SXT and UXT

PM0264 - Rev 2 page 110/232

 PM0264
Packing and unpacking instructions

Mnemonic Brief description See

UXTAB Extend 8 bits to 32 and add Section 3.7.2 SXTA and UXTA

UXTAB16 Dual extend 8 bits to 16 and add Section 3.7.2 SXTA and UXTA

UXTAH Extend 16 bits to 32 and add Section 3.7.2 SXTA and UXTA

UXTB Zero extend a byte Section 3.7.3 SXT and UXT

UXTB16 Dual zero extend 8 bits to 16 and add Section 3.7.3 SXT and UXT

UXTH Zero extend a halfword Section 3.7.3 SXT and UXT

3.7.1 PKHBT and PKHTB

Pack Halfword.
op{cond} {Rd}, Rn, Rm {, LSL #imm} ;PKHBT
op{cond} {Rd}, Rn, Rm {, ASR #imm} ;PKHTB
Where:
op
Is one of:
PKHBT
Pack Halfword, bottom and top with shift.

PKHTB
Pack Halfword, top and bottom with shift.

cond
Is an optional condition code.
Rd
Is the destination register. If Rd is omitted, the destination register is Rn.
Rn
Is the first operand register.
Rm
Is the second operand register holding the value to be optionally shifted.
imm
Is the shift length. The type of shift length depends on the instruction:For PKHBT:
For PKHTB:
LSL
A left shift with a shift length from 1 to 31, 0 means no shift.

ASR
An arithmetic shift right with a shift length from 1 to 32, a shift of 32-bits is encoded as 0b00000.

Operation
The PKHBT instruction:
1. Writes the value of the bottom halfword of the first operand to the bottom halfword of the destination register.
2. If shifted, the shifted value of the second operand is written to the top halfword of the destination register.
The PKHTB instruction:
1. Writes the value of the top halfword of the first operand to the top halfword of the destination register.
2. If shifted, the shifted value of the second operand is written to the bottom halfword of the destination register.

PM0264 - Rev 2 page 111/232

 PM0264
Packing and unpacking instructions

Restrictions
Rd must not be SP and must not be PC.

Condition flags
This instruction does not change the flags.
PKHBT R3, R4, R5 LSL #0 ; Writes bottom halfword of R4 to bottom halfword of
; R3, writes top halfword of R5, unshifted, to top
; halfword of R3

PKHTB R4, R0, R2 ASR #1 ; Writes R2 shifted right by 1 bit to bottom halfword
; of R4, and writes top halfword of R0 to top
; halfword of R4.

3.7.2 SXTA and UXTA

Signed and Unsigned Extend and Add.
op{cond} {Rd,} Rn, Rm {, ROR #n}
Where:
op
Is one of:
SXTAB
Sign extends an 8‑bit value to a 32‑bit value and add.
SXTAH
Sign extends a 16‑bit value to a 32‑bit value and add.
SXTAB16
Sign extends two 8-bit values to two 16-bit values and add.
UXTAB
Zero extends an 8‑bit value to a 32‑bit value and add.
UXTAH
Zero extends a 16‑bit value to a 32‑bit value and add.
UXTAB16
Zero extends two 8-bit values to two 16-bit values and add.

cond
Is an optional condition code.
Rd
Is the destination register. If Rd is omitted, the destination register is Rn.
Rn
Is the first operand register.
Rm
Is the register holding the value to rotate and extend.

PM0264 - Rev 2 page 112/232

 PM0264
Packing and unpacking instructions

ROR #n
Is one of:
ROR #8
Value from Rm is rotated right 8 bits.
ROR #16
Value from Rm is rotated right 16 bits.
ROR #24
Value from Rm is rotated right 24 bits.

If ROR #n is omitted, no rotation is performed.

Operation
These instructions do the following:
1. Rotate the value from Rm right by 0, 8, 16 or 24 bits.
2. Extract bits from the resulting value:
– SXTAB extracts bits[7:0] from Rm and sign extends to 32 bits.
– UXTAB extracts bits[7:0] from Rm and zero extends to 32 bits.
– SXTAH extracts bits[15:0] from Rm and sign extends to 32 bits.
– UXTAH extracts bits[15:0] from Rm and zero extends to 32 bits.
– SXTAB16 extracts bits[7:0] from Rm and sign extends to 16 bits, and extracts bits [23:16] from Rm and
sign extends to 16 bits.
– UXTAB16 extracts bits[7:0] from Rm and zero extends to 16 bits, and extracts bits [23:16] from Rm and
zero extends to 16 bits.
3. Adds the signed or zero extended value to the word or corresponding halfword of Rn and writes the result in
Rd.

Restrictions
Do not use SP and do not use PC.

Condition flags
These instructions do not affect the flags.
SXTAH R4, R8, R6, ROR #16 ; Rotates R6 right by 16 bits, obtains bottom
; halfword, sign extends to 32 bits, adds R8,and
; writes to R4
UXTAB R3, R4, R10 ; Extracts bottom byte of R10 and zero extends to 32
; bits, adds R4, and writes to R3.

3.7.3 SXT and UXT

Sign extend and Zero extend.
SXTop{cond} Rd, Rn {, ROR #n}
UXTop{cond} Rd, Rn {, ROR #n}
Where:

PM0264 - Rev 2 page 113/232

 PM0264
Packing and unpacking instructions

op
Is one of:
SXTB
Sign extends an 8‑bit value to a 32‑bit value.
SXTH
Sign extends a 16‑bit value to a 32‑bit value.
SXTB16
Sign extends two 8-bit values to two 16-bit values.
UXTB
Zero extends an 8‑bit value to a 32‑bit value.
UXTH
Zero extends a 16‑bit value to a 32‑bit value.
UXTB16
Zero extends two 8-bit values to two 16-bit values.

cond
Is an optional condition code.
Rd
Is the destination register.
Rn
Is the register holding the value to extend.
ROR #n
Is one of:
ROR #8
Value from Rn is rotated right 8 bits.
ROR #16
Value from Rn is rotated right 16 bits.
ROR #24
Value from Rn is rotated right 24 bits.

If ROR #n is omitted, no rotation is performed.

Operation
These instructions do the following:
1. Rotate the value from Rn right by 0, 8, 16 or 24 bits.
2. Extract bits from the resulting value:
– SXTB extracts bits[7:0] and sign extends to 32 bits.
– UXTB extracts bits[7:0] and zero extends to 32 bits.
– SXTH extracts bits[15:0] and sign extends to 32 bits.
– UXTH extracts bits[15:0] and zero extends to 32 bits.
– SXTB16 extracts bits[7:0] and sign extends to 16 bits, and extracts bits [23:16] and sign extends to 16
bits.
– UXTB16 extracts bits[7:0] and zero extends to 16 bits, and extracts bits [23:16] and zero extends to 16
bits.

Restrictions
Do not use SP and do not use PC.

PM0264 - Rev 2 page 114/232

 PM0264
Bit field instructions

Condition flags
These instructions do not affect the flags.
SXTH R4, R6, ROR #16 ; Rotate R6 right by 16 bits, then obtain the lower
; halfword of the result and then sign extend to
; 32 bits and write the result to R4.
UXTB R3, R10 ; Extract lowest byte of the value in R10 and zero
; extend it, and write the result to R3.

3.8 Bit field instructions

Table 39 shows the instructions that operate on adjacent sets of bits in registers or bit fields:

Table 39. Bit field instructions

Mnemonic Brief description See

BFC Bit Field Clear Section 3.8.1 BFC and BFI

BFI Bit Field Insert Section 3.8.1 BFC and BFI

SBFX Signed Bit Field Extract Section 3.8.2 SBFX and UBFX

UBFX Unsigned Bit Field Extract Section 3.8.2 SBFX and UBFX

3.8.1 BFC and BFI

Bit Field Clear and Bit Field Insert.
BFC{cond} Rd, #lsb, #width
BFI{cond} Rd, Rn, #lsb, #width
Where:
cond
Is an optional condition code.
Rd
Is the destination register.
Rn
Is the source register.
lsb
Is the position of the least significant bit of the bit field. lsb must be in the range 0-31.
width
Is the width of the bit field and must be in the range 1-32−lsb.

Operation
BFC clears a bit field in a register. It clears width bits in Rd, starting at the low bit position lsb. Other bits in Rd
are unchanged.
BFI copies a bit field into one register from another register. It replaces width bits in Rd starting at the low bit
position lsb, with width bits from Rn starting at bit[0]. Other bits in Rd are unchanged.

Restrictions
Do not use SP and do not use PC.

Condition flags
These instructions do not affect the flags.

PM0264 - Rev 2 page 115/232

 PM0264
Branch and control instructions

BFC R4, #8, #12 ; Clear bit 8 to bit 19 (12 bits) of R4 to 0

BFI R9, R2, #8, #12 ; Replace bit 8 to bit 19 (12 bits) of R9 with
; bit 0 to bit 11 from R2.

3.8.2 SBFX and UBFX

Signed Bit Field Extract and Unsigned Bit Field Extract.
SBFX{cond} Rd, Rn, #lsb, #width
UBFX{cond} Rd, Rn, #lsb, #width
Where:
cond
Is an optional condition code.
Rd
Is the destination register.
Rn
Is the source register.
lsb
Is the position of the least significant bit of the bit field. lsb must be in the range 0-31.
width
Is the width of the bit field and must be in the range 1-32−lsb.

Operation
SBFX extracts a bit field from one register, sign extends it to 32 bits, and writes the result to the destination
register.
UBFX extracts a bit field from one register, zero extends it to 32 bits, and writes the result to the destination
register.

Restrictions
Do not use SP and do not use PC.

Condition flags
These instructions do not affect the flags.
SBFX R0, R1, #20, #4 ; Extract bit 20 to bit 23 (4 bits) from R1 and sign
; extend to 32 bits and then write the result to R0.
UBFX R8, R11, #9, #10 ; Extract bit 9 to bit 18 (10 bits) from R11 and zero
; extend to 32 bits and then write the result to R8.

3.9 Branch and control instructions

Reference material for the Cortex‑M33 processor branch and control instruction set.

3.9.1 List of branch and control instructions

An alphabetically ordered list of the branch and control instructions, with a brief description and link to the syntax
definition, operations, restrictions, and example usage for each instruction.

Table 40. Branch and control instructions

Mnemonic Brief description See

B Branch Section 3.9.2 B, BL, BX, and BLX

BL Branch with Link Section 3.9.2 B, BL, BX, and BLX

BLX Branch indirect with Link Section 3.9.2 B, BL, BX, and BLX

PM0264 - Rev 2 page 116/232

 PM0264
Branch and control instructions

Mnemonic Brief description See

BLXNS Branch indirect with Link, Non-secure Section 3.9.3 BXNS and BLXNS

BX Branch indirect Section 3.9.2 B, BL, BX, and BLX

BXNS Branch indirect, Non-secure Section 3.9.3 BXNS and BLXNS

CBNZ Compare and Branch if Non Zero Section 3.9.4 CBZ and CBNZ

CBZ Compare and Branch if Zero Section 3.9.4 CBZ and CBNZ

IT If‑Then Section 3.9.5 IT

TBB Table Branch Byte Section 3.9.6 TBB and TBH

TBH Table Branch Halfword Section 3.9.6 TBB and TBH

3.9.2 B, BL, BX, and BLX

Branch instructions.
B{cond} label
BL label
BX Rm
BLX Rm
Where:
cond
Is an optional condition code.
label
Is a PC-relative expression.
Rm
Is a register providing the address to branch to.

Operation
All these instructions cause a branch to the address indicated by label or contained in the register specified by Rm.
In addition:
• The BL and BLX instructions write the address of the next instruction to LR, the link register R14.
• The BX and BLX instructions result in a UsageFault exception if bit[0] of Rm is 0.
BL and BLX instructions also set bit[0] of the LR to 1. This ensures that the value is suitable for use by a
subsequent POP {PC} or BX instruction to perform a successful return branch.
The following table shows the ranges for the various branch instructions.

Table 41. Branch ranges

Instruction Branch range

B label −2KB to +2KB.

Bcond label −256 bytes to +254 bytes.

BL label −16MB to +16MB.

BX Rm Any value in register.

BLX Rm Any value in register.

Restrictions
In these instructions:
• Do not use SP or PC in the BX or BLX instruction.

PM0264 - Rev 2 page 117/232

 PM0264
Branch and control instructions

• For BX and BLX, bit[0] of Rm must be 1 for correct execution. Bit[0] is used to update the EPSR T-bit and is
discarded from the target address.
Note: Bcond is the only conditional instruction on the processor.
BX can be used an Exception or Function return.

Condition flags
These instructions do not change the flags.

Examples

B loopA ; Branch to loopA

BL funC ; Branch with link (Call) to function funC, return address
; stored in LR
BX LR ; Return from function call if LR contains a FUNC_RETURN value.
BLX R0 ; Branch with link and exchange (Call) to a address stored
; in R0
BEQ labelD ; Conditionally branch to labelD if last flag setting
; instruction set the Z flag, else do not branch.

3.9.3 BXNS and BLXNS

Branch and Exchange Non-secure and Branch with Link and Exchange Non-secure.
BXNS <Rm>
BLXNS <Rm>
Where:
Rm
Is a register containing an address to branch to.

Operation
The BLXNS instruction calls a subroutine at an address contained in Rm and conditionally causes a transition from
the Secure to the Non-secure state.
For both BXNS and BLXNS, Rm[0] indicates a transition to Non-secure state if value is 0, otherwise the target state
remains Secure. If transitioning to Non-secure, BLXNS pushes the return address and partial PSR to the Secure
stack and assigns R14 to a FNC_RETURN value.
These instructions are available for Secure state only. When the processor is in Non-secure state, these
instructions are UNDEFINED and triggers a UsageFault if executed.

Restrictions
PC and SP cannot be used for Rm.

Condition flags
These instructions do not change the flags.

Examples

LDR r0, =non_secure_function

MOVS r1, #1
BICS r0, r1 # Clear bit 0 of address in r0
BLXNS r0 ; Call Non-secure function. This sets r14 to FUNC_RETURN value

Note: For information about how to build a Secure image that uses a previously generated import library, see the Arm®
Compiler Software Development Guide.

3.9.4 CBZ and CBNZ

Compare and Branch on Zero, Compare and Branch on Non‑Zero.

PM0264 - Rev 2 page 118/232

 PM0264
Branch and control instructions

op{cond} Rn, label

Where:
cond
Is an optional condition code.
Rn
Is the register holding the operand.
label
Is the branch destination.

Operation
Use the CBZ or CBNZ instructions to avoid changing the condition code flags and to reduce the number of
instructions.
CBZ Rn, label does not change condition flags but is otherwise equivalent to:
CMP Rn, #0
BEQ label

CBNZ Rn, label does not change condition flags but is otherwise equivalent to:
CMP Rn, #0
BNE label

Restrictions
The restrictions are:
• Rn must be in the range of R0-R7.
• The branch destination must be within 4 to 130 bytes after the instruction.
• These instructions must not be used inside an IT block.

Condition flags
These instructions do not change the flags.
CBZ R5, target ; Forward branch if R5 is zero
CBNZ R0, target ; Forward branch if R0 is not zero

3.9.5 IT
If-Then condition instruction.
IT{x{y{z}}} cond
Where:
x
specifies the condition switch for the second instruction in the IT block.
y
Specifies the condition switch for the third instruction in the IT block.
z
Specifies the condition switch for the fourth instruction in the IT block.
cond
Specifies the condition for the first instruction in the IT block.

The condition switch for the second, third and fourth instruction in the IT block can be either:
T Then. Applies the condition cond to the instruction.
E Else. Applies the inverse condition of cond to the instruction.

PM0264 - Rev 2 page 119/232

 PM0264
Branch and control instructions

Note: It is possible to use AL (the always condition) for cond in an IT instruction. If this is done, all of the instructions
in the IT block must be unconditional, and each of x, y, and z must be T or omitted but not E.

Operation
The IT instruction makes up to four following instructions conditional. The conditions can be all the same, or
some of them can be the logical inverse of the others. The conditional instructions following the IT instruction
form the IT block.
The instructions in the IT block, including any branches, must specify the condition in the {cond} part of their
syntax.
Note: Your assembler might be able to generate the required IT instructions for conditional instructions automatically,
so that you do not have to write them yourself. See your assembler documentation for details.
A BKPT instruction in an IT block is always executed, even if its condition fails.
Exceptions can be taken between an IT instruction and the corresponding IT block, or within an IT block. Such an
exception results in entry to the appropriate exception handler, with suitable return information in LR and stacked
PSR.
Instructions designed for use for exception returns can be used as normal to return from the exception, and
execution of the IT block resumes correctly. This is the only way that a PC‑modifying instruction is permitted to
branch to an instruction in an IT block.

Restrictions
The following instructions are not permitted in an IT block:
• IT.
• CBZ and CBNZ.
• CPSID and CPSIE.
Other restrictions when using an IT block are:
• A branch or any instruction that modifies the PC must either be outside an IT block or must be the last
instruction inside the IT block. These are:
– ADD PC, PC, Rm.
– MOV PC, Rm.
– B, BL, BX, BLX.
– Any LDM, LDR, or POP instruction that writes to the PC.
– TBB and TBH.
• Do not branch to any instruction inside an IT block, except when returning from an exception handler.
• All conditional instructions except Bcond must be inside an IT block. Bcond can be either outside or inside
an IT block but has a larger branch range if it is inside one.
• Each instruction inside the IT block must specify a condition code suffix that is either the same or logical
inverse as for the other instructions in the block.
Note: Your assembler might place extra restrictions on the use of IT blocks, such as prohibiting the use of assembler
directives within them.

Condition flags
This instruction does not change the flags.

PM0264 - Rev 2 page 120/232

 PM0264
Branch and control instructions

ITTE NE ; Next 3 instructions are conditional

ANDNE R0, R0, R1 ; ANDNE does not update condition flags
ADDSNE R2, R2, #1 ; ADDSNE updates condition flags
MOVEQ R2, R3 ; Conditional move
CMP R0, #9 ; Convert R0 hex value (0 to 15) into ASCII
; ('0'-'9', 'A'-'F')
ITE GT ; Next 2 instructions are conditional
ADDGT R1, R0, #55 ; Convert 0xA -> 'A'
ADDLE R1, R0, #48 ; Convert 0x0 -> '0'
IT GT ; IT block with only one conditional instruction
ADDGT R1, R1, #1 ; Increment R1 conditionally ITTEE EQ
; Next 4 instructions are conditional
MOVEQ R0, R1 ; Conditional move
ADDEQ R2, R2, #10 ; Conditional add
ANDNE R3, R3, #1 ; Conditional AND
BNE.W dloop ; Branch instruction can only be used in the last
; instruction of an IT block
IT NE ; Next instruction is conditional
ADD R0, R0, R1 ; Syntax error: no condition code used in IT block

3.9.6 TBB and TBH

Table Branch Byte and Table Branch Halfword.
TBB [Rn, Rm]
TBH [Rn, Rm, LSL #1]
Where:
Rn
Is the register containing the address of the table of branch lengths.
If Rn is PC, then the address of the table is the address of the byte immediately following the TBB or TBH
instruction.
Rm
Is the index register. This contains an index into the table. For halfword tables, LSL #1 doubles the value in Rm
to form the right offset into the table.

Operation
These instructions cause a PC‑relative forward branch using a table of single byte offsets for TBB, or halfword
offsets for TBH. Rn provides a pointer to the table, and Rm supplies an index into the table. For TBB the branch
offset is the unsigned value of the byte returned from the table, and for TBH the branch offset is twice the
unsigned value of the halfword returned from the table. The branch occurs to the address at that offset from the
address of the byte immediately after the TBB or TBH instruction.

Restrictions
The restrictions are:
• Rn must not be SP.
• Rm must not be SP and must not be PC.
• When any of these instructions is used inside an IT block, it must be the last instruction of the IT block.

Condition flags
These instructions do not change the flags.

PM0264 - Rev 2 page 121/232

 PM0264
Floating-point instructions

ADR.W R0, BranchTable_Byte

TBB [R0, R1] ; R1 is the index, R0 is the base address of the
; branch table
Case1
; an instruction sequence follows
Case2
; an instruction sequence follows
Case3
; an instruction sequence follows
BranchTable_Byte
DCB 0 ; Case1 offset calculation
DCB ((Case2-Case1)/2) ; Case2 offset calculation
DCB ((Case3-Case1)/2) ; Case3 offset calculation
TBH [PC, R1, LSL #1] ; R1 is the index, PC is used as base of the
; branch table
BranchTable_H
DCW ((CaseA - BranchTable_H)/2) ; CaseA offset calculation
DCW ((CaseB - BranchTable_H)/2) ; CaseB offset calculation
DCW ((CaseC - BranchTable_H)/2) ; CaseC offset calculation
CaseA
; an instruction sequence follows
CaseB
; an instruction sequence follows
CaseC
; an instruction sequence follows

3.10 Floating-point instructions

This section provides the instruction set that the FPU uses.
Table 42 shows the floating-point instructions.
These instructions are only available if the FPU is included, and enabled, in the system. See Section 4.6.5 Code
sequence for enabling the FPU for information about enabling the floating-point unit.

Table 42. Floating-point instructions

Mnemonic Brief description See

FLDMX (Decrement Before) loads multiple extension

FLDMDBX Section 3.10.1 FLDMDBX, FLDMIAX
registers from consecutive memory locations
FLDMX (Increment After) loads multiple extension
FLDMIAX Section 3.10.1 FLDMDBX, FLDMIAX
registers from consecutive memory locations
FSTMX (Decrement Before) stores multiple extension
FSTMDBX Section 3.10.2 FSTMDBX, FSTMIAX
registers to consecutive memory locations
FSTMX (Increment After) stores multiple extension
FSTMIAX Section 3.10.2 FSTMDBX, FSTMIAX
registers to consecutive memory locations
VABS Floating-point Absolute Section 3.10.3 VABS

VADD Floating-point Add Section 3.10.4 VADD

Compare two floating-point registers, or one floating-

VCMP Section 3.10.5 VCMP and VCMPE
point register and zero
Compare two floating-point registers, or one floating-
VCMPE Section 3.10.5 VCMP and VCMPE
point register and zero with Invalid Operation check
Section 3.10.6 VCVT and VCVTR between
VCVT Convert between floating-point and integer
floating-point and integer
Section 3.10.7 VCVT between floating-point
VCVT Convert between floating-point and fixed point
and fixed-point
VCVTA, VCVTN, Section 3.10.35 VCVTA, VCVTM VCVTN,
Float to integer conversion with directed rounding
VCVTP, VCVTM and VCVTP

VCVTB Converts half-precision value to single-precision Section 3.10.36 VCVTB and VCVTT

PM0264 - Rev 2 page 122/232

 PM0264
Floating-point instructions

Mnemonic Brief description See

Section 3.10.6 VCVT and VCVTR between

VCVTR Convert between floating-point and integer with rounding
floating-point and integer
VCVTT Converts single-precision register to half-precision Section 3.10.36 VCVTB and VCVTT

VDIV Floating-point Divide Section 3.10.8 VDIV

VFMA Floating-point Fused Multiply Accumulate Section 3.10.9 VFMA and VFMS

VFMS Floating-point Fused Multiply Subtract Section 3.10.9 VFMA and VFMS

VFNMA Floating-point Fused Negate Multiply Accumulate Section 3.10.10 VFNMA and VFNMS

VFNMS Floating-point Fused Negate Multiply Subtract Section 3.10.10 VFNMA and VFNMS

VLDM Load Multiple extension registers Section 3.10.11 VLDM

VLDR Loads an extension register from memory Section 3.10.12 VLDR

VMAXNM, VMINNM Maximum, Minimum with IEEE754-2008 NaN handling Section 3.10.37 VMAXNM and VMINNM

VMLA Floating-point Multiply Accumulate Section 3.10.15 VMLA and VMLS

VMLS Floating-point Multiply Subtract Section 3.10.15 VMLA and VMLS

VMOV Floating-point Move Immediate Section 3.10.16 VMOV Immediate

VMOV Floating-point Move Register Section 3.10.17 VMOV Register

Section 3.10.19 VMOV core register to

VMOV Copy Arm core register to single-precision
single-precision
Section 3.10.20 VMOV two core registers to
VMOV Copy 2 Arm core registers to 2 single-precision
two single-precision registers
VMOV Copies between Arm core register to scalar Section 3.10.22 VMOV core register to scalar

VMOV Copies between Scalar to Arm core register Section 3.10.18 VMOV scalar to core register

Move to Arm core register from floating-point System

VMRS Section 3.10.23 VMRS
Register
Move to floating-point System Register from Arm Core
VMSR Section 3.10.24 VMSR
register
VMUL Multiply floating-point Section 3.10.25 VMUL

VNEG Floating-point negate Section 3.10.26 VNEG

Section 3.10.27 VNMLA, VNMLS and

VNMLA Floating-point multiply and add
VNMUL
Section 3.10.27 VNMLA, VNMLS and
VNMLS Floating-point multiply and subtract
VNMUL
Section 3.10.27 VNMLA, VNMLS and
VNMUL Floating-point multiply
VNMUL
VPOP Pop extension registers Section 3.10.28 VPOP

VPUSH Push extension registers Section 3.10.29 VPUSH

VRINTA,
Float to integer (in floating-point format) conversion with Section 3.10.39 VRINTA, VRINTN, VRINTP,
VRINTN,
directed rounding VRINTM, and VRINTZ
VRINTP, VRINTM
VRINTR, VRINTX Float to integer (in floating-point format) conversion Section 3.10.38 VRINTR and VRINTX

VSEL Select register, alternative to a pair of conditional VMOV Section 3.10.34 VSEL

VSQRT Floating-point square root Section 3.10.30 VSQRT

VSTM Store Multiple extension registers Section 3.10.31 VSTM

VSTR Stores an extension register to memory Section 3.10.32 VSTR

PM0264 - Rev 2 page 123/232

 PM0264
Floating-point instructions

Mnemonic Brief description See

VSUB Floating-point Subtract Section 3.10.33 VSUB

3.10.1 FLDMDBX, FLDMIAX

FLDMX (Decrement Before, Increment After) loads multiple extension registers from consecutive memory
locations using an address from a general-purpose register.
FLDMDBX{cond} Rn!, dreglist
FLDMIAX{cond} Rn{!}, dreglist
Where:
cond
Is an optional condition code.
Rn
Is the base register. If write-back is not specified, the PC can be used.
!
Specifies base register write-back.
dreglist
Is the list of consecutively numbered 64-bit SIMD and FP registers to be transferred. The list must contain at
least one register, all registers must be in the range D0-D15, and must not contain more than 16 registers.

Operation
FLDMX loads multiple SIMD and FP registers from consecutive locations in the Advanced SIMD and floating-point
register file using an address from a general-purpose register.
Arm deprecates use of FLDMDBX and FLDMIAX, except for disassembly purposes, and reassembly of
disassembled code.
Depending on settings in the CPACR and NSACR and the Security state and mode in which the instruction is
executed, an attempt to execute the instruction might be undefined.

3.10.2 FSTMDBX, FSTMIAX

FSTMX (Decrement Before, Increment After) stores multiple extension registers to consecutive memory locations
using an address from a general-purpose register.
FSTMDBX{c}{q} Rn!, dreglist
FSTMIAX{c}{q} Rn{!}, dreglist
Where:
cond
Is an optional condition code.
Rn
Is the base register. If write-back is not specified, the PC can be used. However, Arm deprecates use of the PC.
!
Specifies base register write-back.
dreglist
Is the list FP registers to be transferred. The list must contain at least one register, all registers must be in the
range D0-D15, and must not contain more than 16 registers.

Operation
FSTMX stores multiple SIMD and FP registers from the Advanced SIMD and floating-point register file to
consecutive locations using an address from a general-purpose register.
Arm deprecates use of FLDMDBX and FLDMIAX, except for disassembly purposes, and reassembly of
disassembled code.

PM0264 - Rev 2 page 124/232

 PM0264
Floating-point instructions

Depending on settings in the CPACR, NSACR, and FPEXC Registers, and the security state and mode in which
the instruction is executed, an attempt to execute the instruction might be undefined.

3.10.3 VABS
Floating-point Absolute.
VABS{cond}.F32 Sd, Sm
Where:
cond
Is an optional condition code.
Sd, Sm
Are the destination floating-point value and the operand floating-point value.

Operation
This instruction:
1. Takes the absolute value of the operand floating-point register.
2. Places the results in the destination floating-point register.

Restrictions
There are no restrictions.

Condition flags
This instruction does not change the flags.
VABS.F32 S4, S6

3.10.4 VADD
Floating-point Add.
VADD{cond}.F32 {Sd,} Sn, Sm
Where:
cond
Is an optional condition code.
Sd
Is the destination floating-point value.
Sn, Sm
Are the operand floating-point values.

Operation
This instruction:
1. Adds the values in the two floating-point operand registers.
2. Places the results in the destination floating-point register.
3. the results in the destination floating-point register.

Restrictions
There are no restrictions.

Condition flags
This instruction does not change the flags.
VADD.F32 S4, S6, S7

PM0264 - Rev 2 page 125/232

 PM0264
Floating-point instructions

3.10.5 VCMP and VCMPE

Compares two floating-point registers, or one floating-point register and zero.

VCMP{E}{cond}.F32 Sd, Sm|#0.0

VCMP{E}{cond}.F32 Sd, #0.0
Where:
cond
Is an optional condition code.
E
If present, any NaN operand causes an Invalid Operation exception. Otherwise, only a signaling NaN
causes the exception.
Sd
Is the floating-point operand to compare.
Sm|Dm
Is the floating-point operand that is compared with.

Operation
This instruction:
1. Compares either:
– Two floating-point registers.
– Or one floating-point register and zero.
2. Writes the result to the FPSCR flags.

Restrictions
This instruction can optionally raise an Invalid Operation exception if either operand is any type of NaN. It
always raises an Invalid Operation exception if either operand is a signaling NaN.

Condition flags
When this instruction writes the result to the FPSCR flags, the values are normally transferred to the Arm flags by
a subsequent VMRS instruction.

VCMP.F32 S4, #0.0VCMP.F32 S4, S2

3.10.6 VCVT and VCVTR between floating-point and integer

Converts a value in a register from floating-point to and from a 32-bit integer.

VCVT{R}{cond}.Tm.F32 Sd, Sm
VCVT{cond}.F32.Tm Sd, Sm
Where:
R
If R is specified, the operation uses the rounding mode specified by the FPSCR. If R is omitted. the operation
uses the Round towards Zero rounding mode.
cond
Is an optional condition code.
Tm
Is the data type for the operand. It must be one of:
• S32 signed 32-bit value.
• U32 unsigned 32-bit value.

PM0264 - Rev 2 page 126/232

 PM0264
Floating-point instructions

Sd, Sm
Are the destination register and the operand register.

Operation
These instructions:
1. Either:
– Convert a value in a register from floating-point value to a 32-bit integer.
– Convert from a 32-bit integer to floating-point value.
2. Place the result in a second register.
The floating-point to integer operation normally uses the Round towards Zero rounding mode, but can
optionally use the rounding mode specified by the FPSCR.
The integer to floating-point operation uses the rounding mode specified by the FPSCR.

Restrictions
There are no restrictions.

Condition flags
These instructions do not change the flags.

3.10.7 VCVT between floating-point and fixed-point

Converts a value in a register from floating-point to and from a 32-bit integer.
VCVT{cond}.Td.F32 Sd, Sd, #fbits
VCVT{cond}.F32.Td Sd, Sd, #fbits
Where:
cond
Is an optional condition code.
Td
Is the data type for the fixed-point number. It must be one of:
• S16 signed 16-bit value.
• U16 unsigned 16-bit value.
• S32 signed 32-bit value.
• U32 unsigned 32-bit value.
Sd
Is the destination register and the operand register.
fbits
Is the number of fraction bits in the fixed-point number:
• If Td is S16 or U16, fbits must be in the range 0-16.
• If Td is S32 or U32, fbits must be in the range 1-32.

Operation
This instruction:
1. Either
– Converts a value in a register from floating-point to fixed-point.
– Converts a value in a register from fixed-point to floating-point.
2. Places the result in a second register.
The floating-point values are single-precision or double-precision.
The fixed-point value can be 16-bit or 32-bit. Conversions from fixed-point values take their operand from the
low-order bits of the source register and ignore any remaining bits.

PM0264 - Rev 2 page 127/232

 PM0264
Floating-point instructions

Signed conversions to fixed-point values sign-extend the result value to the destination register width.
Unsigned conversions to fixed-point values zero-extend the result value to the destination register width.
The floating-point to fixed-point operation uses the Round towards Zero rounding mode. The fixed-point to
floating-point operation uses the Round to Nearest rounding mode.

Restrictions
There are no restrictions.

Condition flags
These instructions do not change the flags.

3.10.8 VDIV
Divides floating-point values.
VDIV{cond}.F32 {Sd,} Sn, Sm
Where:
cond
Is an optional condition code.
Sd
Is the destination register.
Sn, Sm
Are the operand registers.

Operation
This instruction:
1. Divides one floating-point value by another floating-point value.
2. Writes the result to the floating-point destination register.

Restrictions
There are no restrictions.

Condition flags
These instructions do not change the flags.

3.10.9 VFMA and VFMS

Floating-point Fused Multiply Accumulate and Subtract.
VFMA{cond}.F32 {Sd,} Sn, Sm
VFMS{cond}.F32 {Sd,} Sn, Sm
Where:
cond
Is an optional condition code.
Sd
Is the destination register.
Sn, Sm
Are the operand registers.

Operation
The VFMA instruction:
1. Multiplies the floating-point values in the operand registers.

PM0264 - Rev 2 page 128/232

 PM0264
Floating-point instructions

2. Accumulates the results into the destination register.

The result of the multiply is not rounded before the accumulation.
The VFMS instruction:
1. Negates the first operand register.
2. Multiplies the floating-point values of the first and second operand registers.
3. Adds the products to the destination register.
4. Places the results in the destination register.
The result of the multiply is not rounded before the addition.

Restrictions
There are no restrictions.

Condition flags
These instructions do not change the flags.

3.10.10 VFNMA and VFNMS

Floating-point Fused Negate Multiply Accumulate and Subtract.
VFNMA{cond}.F32 {Sd,} Sn, Sm
VFNMS{cond}.F32 {Sd,} Sn, Sm
Where:
cond
Is an optional condition code.
Sd
Is the destination register.
Sn, Sm
Are the operand registers.

Operation
The VFNMA instruction:
1. Negates the first floating-point operand register.
2. Multiplies the first floating-point operand with second floating-point operand.
3. Adds the negation of the floating -point destination register to the product
4. Places the result into the destination register.
The result of the multiply is not rounded before the addition.
The VFNMS instruction:
1. Multiplies the first floating-point operand with second floating-point operand.
2. Adds the negation of the floating-point value in the destination register to the product.
3. Places the result in the destination register.
The result of the multiply is not rounded before the addition.

Restrictions
There are no restrictions.

Condition flags
These instructions do not change the flags.

3.10.11 VLDM
Floating-point Load Multiple.

PM0264 - Rev 2 page 129/232

 PM0264
Floating-point instructions

VLDM{mode}{cond}{.size} Rn{!}, list

Where:
mode
Is the addressing mode:
IA
Increment after. The consecutive addresses start at the address specified in Rn.
DB
Decrement before. The consecutive addresses end before
the address specified in Rn.

cond
Is an optional condition code.
size
Is an optional data size specifier.
Rn
Is the base register. The SP can be used.
!
Is the command to the instruction to write a modified value back to Rn. This is required if mode == DB, and is
optional if mode == IA.
list
Is the list of extension registers to be loaded, as a list of consecutively numbered doubleword or singleword
registers, separated by commas and surrounded by brackets.

Operation
This instruction loads multiple extension registers from consecutive memory locations using an address from an
Arm core register as the base address.

Restrictions
The restrictions are:
• If size is present, it must be equal to the size in bits, 32 or 64, of the registers in list.
• For the base address, the SP can be used. In the Arm instruction set, if ! is not specified the PC can be
used.
• list must contain at least one register. If it contains doubleword registers, it must not contain more than 16
registers.
• If using the Decrement before addressing mode, the write back flag, !, must be appended to the base
register specification.

Condition flags
These instructions do not change the flags.
VLDMIA.F64 r1, {d3,d4,d5}

3.10.12 VLDR
Loads a single extension register from memory.
VLDR{cond}{.F<32|64>} <Sd|Dd>, [Rn {, #imm}]
VLDR{cond}{.F<32|64>} <Sd|Dd>, label
VLDR{cond}{.F<32|64>} <Sd|Dd>, [PC, #imm]
Where:

PM0264 - Rev 2 page 130/232

 PM0264
Floating-point instructions

cond
Is an optional condition code.
32, 64
Are the optional data size specifiers.
Dd
Is the destination register for a doubleword load.
Sd
Is the destination register for a singleword load.
Rn
Is the base register. The SP can be used.
imm
Is the + or - immediate offset used to form the address. Permitted address values are multiples of 4 in the range
0-1020.
label
Is the label of the literal data item to be loaded.

Operation
This instruction loads a single extension register from memory, using a base address from an Arm core register,
with an optional offset.

Restrictions
There are no restrictions.

Condition flags
These instructions do not change the flags.

3.10.13 VLLDM
Floating-point Lazy Load Multiple restores the contents of the Secure floating-point registers that were protected
by a VLSTM instruction, and marks the floating-point context as active.
VLLDM {cond}<Rn>
Where:
cond
Is an optional condition code.
Rn
Is the base register.

Operation
If the lazy state preservation set up by a previous VLSTM instruction is active (FPCCR.LSPACT == 1), this
instruction deactivates lazy state preservation and enables access to the Secure floating-point registers. If lazy
state preservation is inactive (FPCCR.LSPACT == 0), either because lazy state preservation was not enabled
(FPCCR.LSPEN == 0) or because a floating-point instruction caused the Secure floating-point register contents
to be stored to memory, this instruction loads the stored Secure floating-point register contents back into the
floating-point registers. If Secure floating-point is not in use (CONTROL_S.SFPA == 0), this instruction behaves
as a NOP. This instruction is only available in Secure state, and is UNDEFINED in Non-secure state. If the
Floating-point Extension is not implemented, this instruction is available in Secure state, but behaves as a NOP.

Restrictions
There are no restrictions.

PM0264 - Rev 2 page 131/232

 PM0264
Floating-point instructions

Condition flags
These instructions do not change the flags.

3.10.14 VLSTM
Floating-point Lazy Store Multiple stores the contents of Secure floating-point registers to a prepared stack frame,
and clears the Secure floating-point registers.
VLSTM {cond}<Rn>
Where:
cond
Is an optional condition code.
Rn
Is the base register.

Operation
If floating-point lazy preservation is enabled (FPCCR.LSPEN == 1), then the next time a floating-point instruction
other than VLSTM or VLLDM is executed:
• The contents of Secure floating-point registers are stored to memory.
• The Secure floating-point registers are cleared.
If Secure floating-point is not in use (CONTROL_S.SFPA == 0), this instruction behaves as a NOP.
This instruction is only available in Secure state, and is UNDEFINED in Non-secure state.
If the Floating-point Extension is not implemented, this instruction is available in Secure state, but behaves as a
NOP.

Restrictions
There are no restrictions.

Condition flags
These instructions do not change the flags.

3.10.15 VMLA and VMLS

Multiplies two floating-point values, and accumulates or subtracts the result.
VMLA{cond}.F32 Sd, Sn, Sm
VMLS{cond}.F32 Sd, Sn, Sm
Where:
cond
Is an optional condition code.
Sd
Is the destination floating-point value.
Sn, Sm
Are the operand floating-point values.

Operation
The floating-point Multiply Accumulate instruction:
1. Multiplies two floating-point values.
2. Adds the results to the destination floating-point value.
The floating-point Multiply Subtract instruction:
1. Multiplies two floating-point values.

PM0264 - Rev 2 page 132/232

 PM0264
Floating-point instructions

2. Subtracts the products from the destination floating-point value.

3. Places the results in the destination register.

Restrictions
There are no restrictions.

Condition flags
These instructions do not change the flags.

3.10.16 VMOV Immediate

Move floating-point Immediate.
VMOV{cond}.F32 Sd, #imm
Where:
cond
Is an optional condition code.
Sd
Is the destination register.
imm
Is a floating-point constant.

Operation
This instruction copies a constant value to a floating-point register.

Restrictions
There are no restrictions.

Condition flags
These instructions do not change the flags.

3.10.17 VMOV Register

Copies the contents of one register to another.
VMOV{cond}.F<32> Sd, Sm Dm
Where:
cond
Is an optional condition code.
Dd
Is the destination register, for a doubleword operation.
Dm
Is the source register, for a doubleword operation.
Sd
Is the destination register, for a singleword operation.
Sm
Is the source register, for a singleword operation.

Operation
This instruction copies the contents of one floating-point register to another.

PM0264 - Rev 2 page 133/232

 PM0264
Floating-point instructions

Restrictions
There are no restrictions.

Condition flags
These instructions do not change the flags.

3.10.18 VMOV scalar to core register

Transfers one word of a doubleword floating-point register to an Arm core register.
VMOV{cond} Rt, Dn[x]
Where:
cond
Is an optional condition code.
Rt
Is the destination Arm core register.
Dn
Is the 64-bit doubleword register.
x
Specifies which half of the doubleword register to use:
• If x is 0, use lower half of doubleword register.
• If x is 1, use upper half of doubleword register.

Operation
This instruction transfers one word from the upper or lower half of a doubleword floating-point register to an Arm
core register.

Restrictions
Rt cannot be PC or SP.

Condition flags
These instructions do not change the flags.

3.10.19 VMOV core register to single-precision

Transfers a single-precision register to and from an Arm core register.
VMOV{cond} Sn, Rt
VMOV{cond} Rt, Sn
Where:
cond
Is an optional condition code.
<Sn>
Is the single-precision floating-point register.
Rt
Is the Arm core register.

Operation
This instruction transfers:
• The contents of a single-precision register to an Arm core register.
• The contents of an Arm core register to a single-precision register.

PM0264 - Rev 2 page 134/232

 PM0264
Floating-point instructions

Restrictions
Rt cannot be PC or SP.

Condition flags
These instructions do not change the flags.

3.10.20 VMOV two core registers to two single-precision registers

Transfers two consecutively numbered single-precision registers to and from two Arm core registers.
VMOV{cond} Sm, Sm1, Rt, Rt2
VMOV{cond} Rt, Rt2, Sm, Sm1
Where:
cond
Is an optional condition code.
Sm
Is the first single-precision register.
Sm1
Is the second single-precision register. This is the next single-precision register after Sm.
Rt
Is the Arm core register that Sm is transferred to or from.
Rt2
Is the Arm core register that Sm1 is transferred to or from.

Operation
This instruction transfers:
• The contents of two consecutively numbered single-precision registers to two Arm core registers.
• The contents of two Arm core registers to a pair of single-precision registers.

Restrictions
The restrictions are:
• The floating-point registers must be contiguous, one after the other.
• The Arm core registers do not have to be contiguous.
• Rt cannot be PC or SP.

Condition flags
These instructions do not change the flags.

3.10.21 VMOV two core registers and a double-precision register

Transfers two words from two Arm core registers to a doubleword register, or from a doubleword register to two
Arm core registers.
VMOV{cond} Dm, Rt, Rt2
VMOV{cond} Rt, Rt2, Dm
Where:
cond
Is an optional condition code.
Dm
Is the double-precision register.

PM0264 - Rev 2 page 135/232

 PM0264
Floating-point instructions

Rt, Rt2
Are the two Arm core registers.

Operation
This instruction:
• Transfers two words from two Arm core registers to a doubleword register.
• Transfers a doubleword register to two Arm core registers.

Restrictions
There are no restrictions.

Condition flags
These instructions do not change the flags.

3.10.22 VMOV core register to scalar

Transfers one word to a floating-point register from an Arm core register.
VMOV{cond}{.32} Dd[x], Rt
Where:
cond
Is an optional condition code.
32
Is an optional data size specifier.
Dd[x]
Is the destination, where [x] defines which half of the doubleword is transferred, as follows:
• If x is 0, the lower half is extracted.
• If x is 1, the upper half is extracted.
Rt
Is the source Arm core register.

Operation
This instruction transfers one word to the upper or lower half of a doubleword floating-point register from an Arm
core register.

Restrictions
Rt cannot be PC or SP.

Condition flags
These instructions do not change the flags.

3.10.23 VMRS
Move to Arm Core register from floating-point System Register.
VMRS{cond} Rt, FPSCR
VMRS{cond} APSR_nzcv, FPSCR
Where:
cond
Is an optional condition code.
Rt
Is the destination Arm core register. This register can be R0-R14.

PM0264 - Rev 2 page 136/232

 PM0264
Floating-point instructions

APSR_nzcv
Transfer floating-point flags to the APSR flags.

Operation
This instruction performs one of the following actions:
• Copies the value of the FPSCR to a general-purpose register.
• Copies the value of the FPSCR flag bits to the APSR N, Z, C, and V flags.

Restrictions
Rt cannot be PC or SP.

Condition flags
These instructions optionally change the N, Z, C, and V flags.

3.10.24 VMSR
Move to floating-point System Register from Arm Core register.
VMSR{cond} FPSCR, Rt
Where:
cond
Is an optional condition code.
Rt
Is the general-purpose register to be transferred to the FPSCR.

Operation
This instruction moves the value of a general-purpose register to the FPSCR.

Restrictions
Rt cannot be PC or SP.

Condition flags
This instruction updates the FPSCR.

3.10.25 VMUL
Floating-point Multiply.
VMUL{cond}.F32 {Sd,} Sn, Sm
Where:
cond
Is an optional condition code.
Sd
Is the destination floating-point value.
Sn, Sm
Are the operand floating-point values.

Operation
This instruction:
1. Multiplies two floating-point values.
2. Places the results in the destination register.

PM0264 - Rev 2 page 137/232

 PM0264
Floating-point instructions

Restrictions
There are no restrictions.

Condition flags
These instructions do not change the flags.

3.10.26 VNEG
Floating-point Negate.
VNEG{cond}.F32 Sd, Sm
Where:
cond
Is an optional condition code.
Sd
Is the destination floating-point value.
Sm
Is the operand floating-point value.

Operation
This instruction:
1. Negates a floating-point value.
2. Places the results in a second floating-point register.
The floating-point instruction inverts the sign bit.

Restrictions
There are no restrictions.

Condition flags
These instructions do not change the flags.

3.10.27 VNMLA, VNMLS and VNMUL

Floating-point multiply with negation followed by add or subtract.
VNMLA{cond}.F32 Sd, Sn, Sm
VNMLS{cond}.F32 Sd, Sn, Sm
VNMUL{cond}.F32 {Sd,} Sn, Sm
Where:
cond
Is an optional condition code.
Sd
Is the destination floating-point register.
Sn, Sm
Are the operand floating-point registers.

Operation
The VNMLA instruction:
1. Multiplies two floating-point register values.
2. Adds the negation of the floating-point value in the destination register to the negation of the product.
3. Writes the result back to the destination register.

PM0264 - Rev 2 page 138/232

 PM0264
Floating-point instructions

The VNMLS instruction:

1. Multiplies two floating-point register values.
2. Adds the negation of the floating-point value in the destination register to the product.
3. Writes the result back to the destination register.
The VNMUL instruction:
1. Multiplies together two floating-point register values.
2. Writes the negation of the result to the destination register.

Restrictions
There are no restrictions.

Condition flags
These instructions do not change the flags.

3.10.28 VPOP
Floating-point extension register Pop.
VPOP{cond}{.size} list
Where:
cond
Is an optional condition code.
size
Is an optional data size specifier. If present, it must be equal to the size in bits, 32 or 64, of the registers in list.
list
Is a list of extension registers to be loaded, as a list of consecutively numbered doubleword or singleword
registers, separated by commas and surrounded by brackets.

Operation
This instruction loads multiple consecutive extension registers from the stack.

Restrictions
list must contain at least one register, and not more than sixteen registers.

Condition flags
These instructions do not change the flags.

3.10.29 VPUSH
Floating-point extension register Push.
VPUSH{cond}{.size} list
Where:
cond
Is an optional condition code.
size
Is an optional data size specifier. If present, it must be equal to the size in bits, 32 or 64, of the registers in list.
list
Is a list of the extension registers to be stored, as a list of consecutively numbered doubleword or singleword
registers, separated by commas and surrounded by brackets.

PM0264 - Rev 2 page 139/232

 PM0264
Floating-point instructions

Operation
This instruction stores multiple consecutive extension registers to the stack.

Restrictions
list must contain at least one register, and not more than sixteen.

Condition flags
These instructions do not change the flags.

3.10.30 VSQRT
Floating-point Square Root.
VSQRT{cond}.F32 Sd, Sm
Where:
cond
Is an optional condition code.
Sd
Is the destination floating-point value.
Sm
Is the operand floating-point value.

Operation
This instruction:
• Calculates the square root of the value in a floating-point register.
• Writes the result to another floating-point register.

Restrictions
There are no restrictions.

Condition flags
These instructions do not change the flags.

3.10.31 VSTM
Floating-point Store Multiple.
VSTM{mode}{cond}{.size} Rn{!}, list
Where:
mode
Is the addressing mode:
• IA Increment After. The consecutive addresses start at the address specified in Rn. This is the default and
can be omitted.
• DB Decrement Before. The consecutive addresses end just before the address specified in Rn.
cond
Is an optional condition code.
size
Is an optional data size specifier. If present, it must be equal to the size in bits, 32 or 64, of the registers in list.
Rn
Is the base register. The SP can be used.

PM0264 - Rev 2 page 140/232

 PM0264
Floating-point instructions

!
Is the function that causes the instruction to write a modified value back to Rn. Required if mode == DB.
list
Is a list of the extension registers to be stored, as a list of consecutively numbered doubleword or singleword
registers, separated by commas and surrounded by brackets.

Operation
This instruction stores multiple extension registers to consecutive memory locations using a base address from an
Arm core register.

Restrictions
The restrictions are:
• list must contain at least one register. If it contains doubleword registers it must not contain more than 16
registers.
• Use of the PC as Rn is deprecated.

Condition flags
These instructions do not change the flags.

3.10.32 VSTR
Floating-point Store.
VSTR{cond}{.32} Sd, [Rn{, #imm}]
VSTR{cond}{.64} Dd, [Rn{, #imm}]
Where:
cond
Is an optional condition code.
32, 64
Are the optional data size specifiers.
Sd
Is the source register for a singleword store.
Dd
Is the source register for a doubleword store.
Rn
Is the base register. The SP can be used.
imm
Is the + or - immediate offset used to form the address. Values are multiples of 4 in the range 0-1020. imm can
be omitted, meaning an offset of +0.

Operation
This instruction stores a single extension register to memory, using an address from an Arm core register, with an
optional offset, defined in imm:

Restrictions
The use of PC for Rn is deprecated.

Condition flags
These instructions do not change the flags.

PM0264 - Rev 2 page 141/232

 PM0264
Floating-point instructions

3.10.33 VSUB
Floating-point Subtract.
VSUB{cond}.F32 {Sd,} Sn, Sm
Where:
cond
Is an optional condition code.
Sd
Is the destination floating-point value.
Sn, Sm
Are the operand floating-point values.

Operation
This instruction:
1. Subtracts one floating-point value from another floating-point value.
2. Places the results in the destination floating-point register.

Restrictions
There are no restrictions.

Condition flags
These instructions do not change the flags.

3.10.34 VSEL
Floating-point Conditional Select allows the destination register to take the value from either one or the other of
two source registers according to the condition codes in the APSR.
VSEL{cond}.F32 Sd, Sn, Sm
Where:
cond
Is an optional condition code. VSEL has a subset of the condition codes. The condition codes for VSEL are
limited to GE, GT, EQ and VS, with the effect that LT, LE, NE and VC is achievable by exchanging the source
operands.
Sd
Is the destination single-precision floating-point value.
Sn, Sm
Are the operand single-precision floating-point values.

Operation
Depending on the result of the condition code, this instruction moves either:
• Sn source register to the destination register.
• Sm source register to the destination register.
The behavior is:
EncodingSpecificOperations();
ExecuteFPCheck();

if dp_operation then
S[d] = if ConditionHolds(cond) then S[n] else S[m];

Restrictions
The VSEL instruction must not occur inside an IT block.

PM0264 - Rev 2 page 142/232

 PM0264
Floating-point instructions

Condition flags
This instruction does not change the flags.

3.10.35 VCVTA, VCVTM VCVTN, and VCVTP

Floating-point to integer conversion with directed rounding.
VCVT<rmode>.S32.F32 Sd, Sm
VCVT<rmode>.U32.F32 Sd, Sm
Where:
Sd
Is the destination single-precision or double-precision floating-point value.
Sm,
Are the operand single-precision or double-precision floating-point values.

<rmode>
Is one of:
A
Round to nearest ties away.
M
Round to nearest even.
N
Round towards plus infinity.
P
Round towards minus infinity.

Operation
These instructions:
1. Read the source register.
2. Convert to integer with directed rounding.
3. Write to the destination register.

Restrictions
There are no restrictions.

Condition flags
These instructions do not change the flags.

3.10.36 VCVTB and VCVTT

Converts between half-precision and single-precision without intermediate rounding.
VCVT{y}{cond}.F32.F16 Sd, Sm
VCVT{y}{cond}.F16.F32 Sd, Sm
Where:
y
Specifies which half of the operand register Sm or destination register Sd is used for the operand or destination:
• If y is B, then the bottom half, bits [15:0], of Sm or Sd is used.
• If y is T, then the top half, bits [31:16], of Sm or Sd is used.

PM0264 - Rev 2 page 143/232

 PM0264
Floating-point instructions

cond
Is an optional condition code.
Sd
Is the destination register.
Sm
Is the operand register.

Operation
This instruction with the .F16.F32 suffix:
1. Converts the half-precision value in the top or bottom half of a single-precision register to single-precision
value.
2. Writes the result to a single-precision register.
This instruction with the .F32.F16 suffix:
1. Converts the value in a single-precision register to half-precision value.
2. Writes the result into the top or bottom half of a single-precision register, preserving the other half of the
target register.

Restrictions
There are no restrictions.

Condition flags
These instructions do not change the flags.

3.10.37 VMAXNM and VMINNM

Return the minimum or the maximum of two floating-point numbers with NaN handling as specified by
IEEE754-2008.
VMAXNM.F32 Sd, Sn, Sm
VMINNM.F32 Sd, Sn, Sm
Where:
Sd
Is the destination single-precision floating-point value.
Sn, Sm
Are the operand single-precision floating-point values.

Operation
The VMAXNM instruction compares two source registers, and moves the largest to the destination register.
The VMINNM instruction compares two source registers, and moves the smallest to the destination register.

Restrictions
There are no restrictions.

Condition flags
These instructions do not change the flags.

3.10.38 VRINTR and VRINTX

Round a floating-point value to an integer in floating-point format.
VRINT{R,X}{cond}.F32 Sd, Sm
Where:

PM0264 - Rev 2 page 144/232

 PM0264
Floating-point instructions

cond
Is an optional condition code.
Sd
Is the destination floating-point value.
Sm
Are the operand floating-point values.

Operation
These instructions:
1. Read the source register.
2. Round to the nearest integer value in floating-point format using the rounding mode specified by the FPSCR.
A zero input gives a zero result with the same sign, an infinite input gives an infinite result with the same
sign, and a NaN is propagated as for normal arithmetic.
3. Write the result to the destination register.
4. For the VRINTX instruction only. Generate a floating-point exception if the result is not numerically equal to
the input value.

Restrictions
There are no restrictions.

Condition flags
These instructions do not change the flags.

3.10.39 VRINTA, VRINTN, VRINTP, VRINTM, and VRINTZ

Round a floating-point value to an integer in floating-point format using directed rounding.
VRINT<rmode>.F32 Sd, Sm
Where:
Sd
Is the destination single-precision floating-point value.
Sm
Are the operand single-precision floating-point values.

<rmode>
Is one of:
A
Round to nearest ties away.
N
Round to Nearest Even.
P
Round towards Plus Infinity.
M
Round towards Minus Infinity.
Z
Round towards Zero.

Operation
These instructions:
1. Read the source register.

PM0264 - Rev 2 page 145/232

 PM0264
Miscellaneous instructions

2. Round to the nearest integer value with a directed rounding mode specified by the instruction.
3. A zero input gives a zero result with the same sign, an infinite input gives an infinite result with the same
sign, and a NaN is propagated as for normal arithmetic.
4. Write the result to the destination register.

Restrictions
VRINTA, VRINTN, VRINTP and VRINTM cannot be conditional. VRINTZ can be conditional.

Condition flags
These instructions do not change the flags.

3.11 Miscellaneous instructions

Table 43 shows the remaining Cortex®-M33 instructions: .

Table 43. Miscellaneous instructions

Mnemonic Brief description See

BKPT Breakpoint Section 3.11.1 BKPT

CPSID Change Processor State, Disable Interrupts Section 3.11.2 CPS

CPSIE Change Processor State, Enable Interrupts Section 3.11.2 CPS

DMB Data Memory Barrier Section 3.11.4 DMB

DSB Data Synchronization Barrier Section 3.11.5 DSB

ISB Instruction Synchronization Barrier Section 3.11.6 ISB

MRS Move from special register to register Section 3.11.7 MRS

MSR Move from register to special register Section 3.11.8 MSR

NOP No Operation Section 3.11.9 NOP

SEV Send Event Section 3.11.10 SEV

SG Secure Gateway Section 3.11.11 SG

SVC Supervisor Call Section 3.11.12 SVC

TT Test Target Section 3.11.13 TT, TTT, TTA, and TTAT

TTT Test Target Unprivileged Section 3.11.13 TT, TTT, TTA, and TTAT

TTA Test Target Alternate Domain Section 3.11.13 TT, TTT, TTA, and TTAT

TTAT Test Target Alternate Domain Unprivileged Section 3.11.13 TT, TTT, TTA, and TTAT

WFE Wait For Event Section 3.11.15 WFE

WFI Wait For Interrupt Section 3.11.16 WFI

YIELD Yield Section 3.11.17 YIELD

3.11.1 BKPT
Breakpoint.
BKPT #imm
Where:
imm
Is an expression evaluating to an integer in the range 0-255 (8-bit value).

PM0264 - Rev 2 page 146/232

 PM0264
Miscellaneous instructions

Operation
The BKPT instruction causes the processor to enter Debug state if invasive debug is enabled. Debug tools can
use this to investigate system state when the instruction at a particular address is reached.
imm is ignored by the processor. If required, a debugger can use it to store additional information about the
breakpoint.
The BKPT instruction can be placed inside an IT block, but it executes unconditionally, unaffected by the condition
specified by the IT instruction.

Condition flags
This instruction does not change the flags.
BKPT #0x3 ; Breakpoint with immediate value set to 0x3 (debugger can
; extract the immediate value by locating it using the PC)

Note: Arm does not recommend the use of the BKPT instruction with an immediate value set to 0xAB for any purpose
other than Semi-hosting.

3.11.2 CPS
Change Processor State.
CPSeffect iflags
Where:
effect
Is one of:
IE
Clears the special purpose register.
ID
Sets the special purpose register.

iflags
Is a sequence of one or more flags:
i
Set or clear PRIMASK.
f
Set or clear FAULTMASK.

Operation
CPS changes the PRIMASK and FAULTMASK special register values.

Restrictions
The restrictions are:
• Use CPS only from privileged software. It has no effect if used in unprivileged software.
• CPS cannot be conditional and so must not be used inside an IT block.

Condition flags
This instruction does not change the condition flags.
CPSID i ; Disable interrupts and configurable fault handlers (set PRIMASK)
CPSID f ; Disable interrupts and all fault handlers (set FAULTMASK)
CPSIE i ; Enable interrupts and configurable fault handlers (clear PRIMASK)
CPSIE f ; Enable interrupts and fault handlers (clear FAULTMASK)

PM0264 - Rev 2 page 147/232

 PM0264
Miscellaneous instructions

3.11.3 CPY
Copy is a pre-Unified Assembler Language (UAL) synonym for MOV (register).
CPY Rd, Rn
This is equivalent to:
MOV Rd, Rn

3.11.4 DMB
Data Memory Barrier.
DMB{cond} {opt}
Where:
cond
Is an optional condition code.
opt
Specifies an optional limitation on the DMB operation. Values are:

SY
DMB operation ensures ordering of all accesses, encoded as opt == '1111'. Can be omitted.

All other encodings of opt are reserved. The corresponding instructions execute as system (SY) DMB operations,
but software must not rely on this behavior.

Operation
DMB acts as a data memory barrier. It ensures that all explicit memory accesses that appear, in program order,
before the DMB instruction are completed before any explicit memory accesses that appear, in program order,
after the DMB instruction. DMB does not affect the ordering or execution of instructions that do not access memory.

Condition flags
This instruction does not change the flags.
DMB ; Data Memory Barrier

3.11.5 DSB
Data Synchronization Barrier.
DSB{cond} {opt}
Where:
cond
Is an optional condition code.
opt
Specifies an optional limitation on the DSB operation. Values are:

SY
DSB operation ensures completion of all accesses, encoded as opt == '1111'. Can be omitted.

All other encodings of opt are reserved. The corresponding instructions execute as system (SY) DSB operations,
but software must not rely on this behavior.

Operation
DSB acts as a special data synchronization memory barrier. Instructions that come after the DSB, in program
order, do not execute until the DSB instruction completes. The DSB instruction completes when all explicit memory
accesses before it complete.

PM0264 - Rev 2 page 148/232

 PM0264
Miscellaneous instructions

Condition flags
This instruction does not change the flags.
DSB ; Data Synchronisation Barrier

3.11.6 ISB
Instruction Synchronization Barrier.
ISB{cond} {opt}
Where:
cond
Is an optional condition code.
opt
Specifies an optional limitation on the ISB operation. Values are:

SY
Fully system ISB operation, encoded as opt == '1111'. Can be omitted.

All other encodings of opt are reserved. The corresponding instructions execute as full system ISB operations,
but software must not rely on this behavior.

Operation
ISB acts as an instruction synchronization barrier. It flushes the pipeline of the processor, so that all instructions
following the ISB are fetched from cache or memory again, after the ISB instruction has been completed.

Condition flags
This instruction does not change the flags.
ISB ; Instruction Synchronisation Barrier

3.11.7 MRS
Move the contents of a special register to a general-purpose register.
MRS{cond} Rd, spec_reg
Where:
cond
Is an optional condition code.
Rd
Is the destination register.
spec_reg
Can be any of: APSR, IPSR, EPSR, IEPSR, IAPSR, EAPSR, PSR, MSP, PSP, PRIMASK, BASEPRI,
BASEPRI_MAX, FAULTMASK, CONTROL,MSP_NS, PSP_NS, MSPLIM, PSPLIM, MSPLIM_NS, PSPLIM_NS,
PRIMASK_NS, FAULTMASK_NS, and CONTROL_NS.
Note: All the EPSR and IPSR fields are zero when read by the MRS instruction.
An access to a register not ending in _NS returns the register associated with the current Security state.
Access to a register ending in _NS in Secure state returns the Non-secure register. Access to a register ending
in _NS in Non-secure state is RAZ/WI.

Operation
Use MRS in combination with MSR as part of a read‑modify‑write sequence for updating a PSR, for example to
clear the Q flag.

PM0264 - Rev 2 page 149/232

 PM0264
Miscellaneous instructions

In process swap code, the programmers model state of the process being swapped out must be saved, including
relevant PSR contents. Similarly, the state of the process being swapped in must also be restored. These
operations use MRS in the state-saving instruction sequence and MSR in the state-restoring instruction sequence.
Note: BASEPRI_MAX is an alias of BASEPRI when used with the MRS instruction.

Restrictions
Rd must not be SP and must not be PC.

Condition flags
This instruction does not change the flags.
MRS R0, PRIMASK ; Read PRIMASK value and write it to R0

3.11.8 MSR
Move the contents of a general‑purpose register into the specified special register.
MSR{cond} spec_reg, Rn
Where:
cond
Is an optional condition code.
Rn
Is the source register.
spec_reg
Can be any of: APSR_nzcvq, APSR_g, APSR_nzcvqg, MSP, PSP, PRIMASK, BASEPRI, BASEPRI_MAX,
FAULTMASK, CONTROL, MSP_NS, PSP_NS -MSPLIM, PSPLIM, MSPLIM_NS, PSPLIM_NS, PRIMASK_NS,
FAULTMASK_NS, and CONTROL_NS.
Note: You can use APSR to refer to APSR_nzcvq.

Operation
The register access operation in MSR depends on the privilege level. Unprivileged software can only access the
APSR, see the APSR bit assignments. Privileged software can access all special registers.
In unprivileged software writes to unallocated or execution state bits in the PSR are ignored.
Note: When you write to BASEPRI_MAX, the instruction writes to BASEPRI only if either:
• Rn is non-zero and the current BASEPRI value is 0.
• Rn is non-zero and less than the current BASEPRI value.
Note: An access to a register not ending in _NS writes the register associated with the current Security state. Access
to a register ending in _NS in Secure state writes the Non-secure register. Access to a register ending in _NS in
Non-secure state is RAZ/WI.

Restrictions
Rn must not be SP and must not be PC.

Condition flags
This instruction updates the flags explicitly based on the value in Rn.
MSR CONTROL, R1 ; Read R1 value and write it to the CONTROL register.

3.11.9 NOP
No Operation.
NOP{cond}

PM0264 - Rev 2 page 150/232

 PM0264
Miscellaneous instructions

Where:
cond
Is an optional condition code.

Operation
NOP does nothing. NOP is not necessarily a time‑consuming NOP. The processor might remove it from the pipeline
before it reaches the execution stage.
Use NOP for padding, for example to place the following instruction on a 64‑bit boundary.

Condition flags
This instruction does not change the flags.
NOP ; No operation

3.11.10 SEV
Send Event.
SEV{cond}
Where:
cond
Is an optional condition code.

Operation
SEV is a hint instruction that causes an event to be signaled to all processors within a multiprocessor system. It
also sets the local event register to 1.

Condition flags
This instruction does not change the flags.
SEV ; Send Event

3.11.11 SG
Secure Gateway.
SG

Operation
Secure Gateway marks a valid branch target for branches from Non-secure code that wants to call Secure code.
A linker is expected to generate a Secure Gateway operation as a part of the branch table for the Non-secure
Callable (NSC) region.
There is no C intrinsic function for SG. Secure Gateways are expected to be generated by linker or by assembly
programming. Arm does not expect software developers to insert a Secure Gateway instruction inside C or C++
program code.
Note: For information about how to build a Secure image that uses a previously generated import library, see the Arm®
Compiler Software Development Guide.

3.11.12 SVC
Supervisor Call.
SVC{cond} #imm
Where:
cond
Is an optional condition code.

PM0264 - Rev 2 page 151/232

 PM0264
Miscellaneous instructions

imm
Is an expression evaluating to an integer in the range 0‑255 (8‑bit value).

Operation
The SVC instruction causes the SVC exception.
imm is ignored by the processor. If required, it can be retrieved by the exception handler to determine what
service is being requested.

Condition flags
This instruction does not change the flags.
SVC #0x32 ; Supervisor Call (SVCall handler can extract the immediate value
; by locating it through the stacked PC)

3.11.13 TT, TTT, TTA, and TTAT

Test Target (Alternate Domain, Unprivileged).
{op}{cond} Rd, Rn
Where:
op
Is one of:
TT
Test Target (TT) queries the Security state and access permissions of a memory location.
TTT
Test Target Unprivileged (TTT) queries the Security state and access permissions of a memory location for an unprivileged
access to that location.
TTA
Test Target Alternate Domain (TTA) queries the Security state and access permissions of a memory location for a Non-secure
access to that location. These instructions are only valid when executing in Secure state, and are undefined if used from
Non-secure state.
TTAT
Test Target Alternate Domain Unprivileged (TTAT) queries the Security state and access permissions of a memory location for a
Non-secure and unprivileged access to that location. These instructions are only valid when executing in Secure state, and are
undefined if used from Non-secure state.

cond
Is an optional condition code.
Rd
Is the destination general-purpose register into which the status result of the target test is written.
Rn
Is the base register.

Operation
The instruction returns the Security state and access permissions in the destination register, the contents of which
are as follows:

Table 44. Security state and access permissions in the destination register

Bits Name Description

[7:0] MREGION The MPU region that the address maps to. This field is 0 if MRVALID is 0.

PM0264 - Rev 2 page 152/232

 PM0264
Miscellaneous instructions

Bits Name Description

. RAZ/WI The SAU region that the address maps to. This field is only valid if the instruction is executed
[15:8] -SREGION
from Secure state. This field is 0 if SRVALID is 0.
[16] MRVALID Set to 1 if the MREGION content is valid. Set to 0 if the MREGION content is invalid.
[17] -SRVALID . RAZ/WI Set to 1 if the SREGION content is valid. Set to 0 if the SREGION content is invalid.
Read accessibility. Set to 1 if the memory location can be read according to the permissions of the
[18] R selected MPU when operating in the current mode. For TTT and TTAT, this bit returns the permissions
for unprivileged access, regardless of whether the current mode is privileged or unprivileged.
Read/write accessibility. Set to 1 if the memory location can be read and written according to the
[19] RW
permissions of the selected MPU when operating in the current mode.
[31:20] - RAZ/WI
Equal to R AND NOT S. Can be used with the LSLS (immediate) instruction to check both the MPU and
[20] NSR SAU or IDAU permissions. This bit is only valid if the instruction is executed from Secure state and the R
field is valid.
Equal to RW AND NOT S. Can be used with the LSLS (immediate) instruction to check both the MPU
[21] NSRW and SAU or IDAU permissions. This bit is only valid if the instruction is executed from Secure state and
the RW field is valid.
Security. A value of 1 indicates that the memory location is Secure, and a value of 0 indicates that the
[22] S
memory location is Non-secure. This bit is only valid if the instruction is executed from Secure state.
IREGION valid flag. For a Secure request, indicates the validity of the IREGION field. Set to 1 if the
IREGION content is valid. Set to 0 if the IREGION content is invalid.
[23] IRVALID
This bit is always 0 if the IDAU cannot provide a region number, the address is exempt from security
attribution, or if the requesting TT instruction is executed from the Non-secure state.
IDAU region number. Indicates the IDAU region number containing the target address. This field is 0 if
[31:24] IREGION
IRVALID is 0.

Invalid fields are 0.

The MREGION field is invalid and 0 if any of the following conditions are true:
• The MPU is not present or MPU_CTRL.ENABLE is 0.
• The address did not match any enabled MPU regions.
• The address matched multiple MPU regions.
• TT was executed from an unprivileged mode, or TTA is executed and Non-secure state is unprivileged.
The R, RW, NSR, and NSRW bits are invalid and 0 if any of the following conditions are true:
• The address matched multiple MPU regions.
• TT is executed from an unprivileged mode, or TTA is executed and Non-secure state is unprivileged.

3.11.14 UDF
Permanently Undefined.
UDF{cond}.W {#}imm
Where:
imm
Is a:
• 8-bit unsigned immediate, in the range 0 to 255. The PE ignores the value of this constant.
• 16-bit unsigned immediate, in the range 0 to 65535. The PE ignores the value of this constant.
cond
Arm deprecates using any c value other than AL.

Operation
Permanently Undefined generates an Undefined Instruction UsageFault exception.

PM0264 - Rev 2 page 153/232

 PM0264
Miscellaneous instructions

3.11.15 WFE
Wait For Event.
WFE{cond}
Where:
cond
Is an optional condition code.

Operation
WFE is a hint instruction.
If the event register is 0, WFE suspends execution until one of the following events occurs:
• An exception, unless masked by the exception mask registers or the current priority level.
• An exception enters the Pending state, if SEVONPEND in the System Control Register is set.
• A Debug Entry request, if Debug is enabled.
• An event signaled by a peripheral or another processor in a multiprocessor system using the SEV instruction.
If the event register is 1, WFE clears it to 0 and returns immediately.

Condition flags
This instruction does not change the flags.
WFE ; Wait for event

3.11.16 WFI
Wait for Interrupt.
WFI{cond}
Where:
cond
Is an optional condition code.

Operation
WFI is a hint instruction that suspends execution until one of the following events occurs:
• A non-masked interrupt occurs and is taken.
• An interrupt masked by PRIMASK becomes pending.
• A Debug Entry request, if Debug is enabled.

Condition flags
This instruction does not change the flags.
WFI ; Wait for interrupt

3.11.17 YIELD
Yield
YIELD{cond}
Where:
cond
Is an optional condition code.

PM0264 - Rev 2 page 154/232

 PM0264
Memory access instructions

Operation
YIELD is a hint instruction that enables software with a multithreading capability to indicate to the hardware that a
task is being performed, which could be swapped out to improve overall system performance. Hardware can use
this hint to suspend and resume multiple code threads if it supports the capability.

Condition flags
This instruction does not change the flags.
YIELD; Suspend task

3.12 Memory access instructions

Table 45 shows the memory access instructions:

Table 45. Memory access instructions

Mnemonic Brief description See

ADR Generate PC-relative address Section 3.12.1 ADR

CLREX Clear Exclusive Section 3.12.12 CLREX

LDM{mode} Load Multiple registers Section 3.12.6 LDM and STM

LDA{type} Load-Acquire Section 3.12.9 LDA and STL

LDAEX Load-Acquire Exclusive Section 3.12.11 LDAEX and STLEX

LDR{type} Load Register using immediate offset Section 3.12.2 LDR and STR, immediate offset

LDR{type} Load Register using register offset Section 3.12.3 LDR and STR, register offset

LDR{type}T Load Register with unprivileged access Section 3.12.4 LDR and STR, unprivileged

LDR Load Register using PC-relative address Section 3.12.5 LDR, PC‑relative

LDRD Load Register Dual Section 3.12.2 LDR and STR, immediate offset

LDREX{type} Load Register Exclusive Section 3.12.10 LDREX and STREX

PLD Preload Data. Section 3.12.7 PLD

POP Pop registers from stack Section 3.12.8 PUSH and POP

PUSH Push registers onto stack Section 3.12.8 PUSH and POP

STL{mode} Store-Release Section 3.12.9 LDA and STL

STLEX Store Release Exclusive Section 3.12.11 LDAEX and STLEX

STM{mode} Store Multiple registers Section 3.12.6 LDM and STM

STR{type} Store Register using immediate offset Section 3.12.2 LDR and STR, immediate offset

STR{type} Store Register using register offset Section 3.12.3 LDR and STR, register offset

STR{type}T Store Register with unprivileged access Section 3.12.4 LDR and STR, unprivileged

STREX{type} Store Register Exclusive Section 3.12.10 LDREX and STREX

3.12.1 ADR
Generate PC-relative address.
ADR{cond} Rd, label
Where:

PM0264 - Rev 2 page 155/232

 PM0264
Memory access instructions

cond
Is an optional condition code.
Rd
Is the destination register.
label
Is a PC‑relative expression.

Operation
ADR generates an address by adding an immediate value to the PC, and writes the result to the destination
register.
ADR provides the means by which position‑independent code can be generated, because the address is
PC‑relative.
If you use ADR to generate a target address for a BX or BLX instruction, you must ensure that bit[0] of the address
you generate is set to1 for correct execution.
Values of label must be within the range of −4095 to +4095 from the address in the PC.
Note: You might have to use the .W suffix to get the maximum offset range or to generate addresses that are not
word-aligned.

Restrictions
Rd must not be SP and must not be PC.

Condition flags
This instruction does not change the flags.
ADR R1, TextMessage ; Write address value of a location labelled as
; TextMessage to R1.

3.12.2 LDR and STR, immediate offset

Load and Store with immediate offset, pre-indexed immediate offset, or post-indexed immediate offset.
op{type}{cond} Rt, [Rn {, #offset}] ; immediate offset
op{type}{cond} Rt, [Rn, #offset]! ; pre-indexed
op{type}{cond} Rt, [Rn], #offset ; post-indexed
opD{cond} Rt, Rt2, [Rn {, #offset}] ; immediate offset, two words
opD{cond} Rt, Rt2, [Rn, #offset]! ; pre-indexed, two words
opD{cond} Rt, Rt2, [Rn], #offset ; post-indexed, two words
Where:
op
Is one of:

LDR
Load Register.

STR
Store Register.

PM0264 - Rev 2 page 156/232

 PM0264
Memory access instructions

type
Is one of:
B
Unsigned byte, zero extend to 32 bits on loads.
SB
Signed byte, sign extend to 32 bits (LDR only).
H
Unsigned halfword, zero extend to 32 bits on loads.
SH
Signed halfword, sign extend to 32 bits (LDR only).
‑
Omit, for word.

cond
Is an optional condition code.
Rt
Is the register to load or store.
Rn
Is the register on which the memory address is based.
offset
Is an offset from Rn. If offset is omitted, the address is the contents of Rn.
Rt2
Is the additional register to load or store for two-word operations.

Operation
LDR instructions load one or two registers with a value from memory.
STR instructions store one or two register values to memory.
Load and store instructions with immediate offset can use the following addressing modes:
Offset addressing The offset value is added to or subtracted from the address obtained from the register Rn.
The result is used as the address for the memory access. The register Rn is unaltered. The
assembly language syntax for this mode is:
[Rn, #offset]

Pre-indexed addressing The offset value is added to or subtracted from the address obtained from the register Rn. The
result is used as the address for the memory access and written back into the register Rn. The
assembly language syntax for this mode is:
[Rn, #offset]!

Post-indexed addressing The address obtained from the register Rn is used as the address for the memory access. The
offset value is added to or subtracted from the address, and written back into the register Rn.
The assembly language syntax for this mode is:
[Rn], #offset

The value to load or store can be a byte, halfword, word, or two words. Bytes and halfwords can either be signed
or unsigned.
The following table shows the ranges of offset for immediate, pre-indexed and post-indexed forms.

PM0264 - Rev 2 page 157/232

 PM0264
Memory access instructions

Table 46. Offset ranges

Instruction type Immediate offset Pre-indexed Post-indexed

Word, halfword, signed

−255 to 4095 −255 to 255 −255 to 255
halfword, byte, or signed byte
multiple of 4 in the range −1020 multiple of 4 in the range multiple of 4 in the range
Two words
to 1020 −1020 to 1020 −1020 to 1020

Restrictions
For load instructions:
• Rt can be SP or PC for word loads only.
• Rt must be different from Rt2 for two-word loads.
• Rn must be different from Rt and Rt2 in the pre-indexed or post-indexed forms.
When Rt is PC in a word load instruction:
• Bit[0] of the loaded value must be 1 for correct execution.
• A branch occurs to the address created by changing bit[0] of the loaded value to 0.
• If the instruction is conditional, it must be the last instruction in the IT block.
For store instructions:
• Rt can be SP for word stores only.
• Rt must not be PC.
• Rn must not be PC.
• Rn must be different from Rt and Rt2 in the pre-indexed or post-indexed forms.

Condition flags
These instructions do not change the flags.
LDR R8, [R10] ; Loads R8 from the address in R10.
LDRNE R2, [R5, #960]! ; Loads (conditionally) R2 from a word
; 960 bytes above the address in R5, and
; increments R5 by 960.
STR R2, [R9,#const‑struc] ; const‑struc is an expression evaluating
; to a constant in the range 0‑4095.
STRH R3, [R4], #4 ; Store R3 as halfword data into address in
; R4, then increment R4 by 4.
LDRD R8, R9, [R3, #0x20] ; Load R8 from a word 32 bytes above the
; address in R3, and load R9 from a word 36
; bytes above the address in R3.
STRD R0, R1, [R8], #-16 ; Store R0 to address in R8, and store R1 to
; a word 4 bytes above the address in R8,
; and then decrement R8 by 16.

3.12.3 LDR and STR, register offset

Load and Store with register offset.
op{type}{cond} Rt, [Rn, Rm {, LSL #n}]
Where:
op
Is one of:

LDR
Load Register.

STR
Store Register.

PM0264 - Rev 2 page 158/232

 PM0264
Memory access instructions

type
Is one of:
B
Unsigned byte, zero extend to 32 bits on loads.
SB
Signed byte, sign extend to 32 bits (LDR only).
H
Unsigned halfword, zero extend to 32 bits on loads.
SH
Signed halfword, sign extend to 32 bits (LDR only).
‑
omit, for word.

cond
Is an optional condition code.
Rt
Is the register to load or store.
Rn
Is the register on which the memory address is based.
Rm
Is a register containing a value to be used as the offset.
LSL #n
Is an optional shift, with n in the range 0-3.

Operation
LDR instructions load a register with a value from memory.
STR instructions store a register value into memory.
The memory address to load from or store to is at an offset from the register Rn. The offset is specified by the
register Rm and can be shifted left by up to 3 bits using LSL.
The value to load or store can be a byte, halfword, or word. For load instructions, bytes and halfwords can either
be signed or unsigned.

Restrictions
In these instructions:
• Rn must not be PC.
• Rm must not be SP and must not be PC.
• Rt can be SP only for word loads and word stores.
• Rt can be PC only for word loads.
When Rt is PC in a word load instruction:
• Bit[0] of the loaded value must be 1 for correct execution, and a branch occurs to this halfword-aligned
address.
• If the instruction is conditional, it must be the last instruction in the IT block.

Condition flags
These instructions do not change the flags.

PM0264 - Rev 2 page 159/232

 PM0264
Memory access instructions

STR R0, [R5, R1] ; Store value of R0 into an address equal to

; sum of R5 and R1.
LDRSB R0, [R5, R1, LSL #1] ; Read byte value from an address equal to
; sum of R5 and two times R1, sign extended it
; to a word value and put it in R0.
STR R0, [R1, R2, LSL #2] ; Stores R0 to an address equal to sum of R1
; and four times R2.

3.12.4 LDR and STR, unprivileged

Load and Store with unprivileged access.
op{type}T{cond} Rt, [Rn {, #offset}]
Where:
op
Is one of:

LDR
Load Register.

STR
Store Register.

type
Is one of:
B
Unsigned byte, zero extend to 32 bits on loads.
SB
Signed byte, sign extend to 32 bits (LDR only).
H
Unsigned halfword, zero extend to 32 bits on loads.
SH
Signed halfword, sign extend to 32 bits (LDR only).
‑
Omit, for word.

cond
Is an optional condition code.
Rt
Is the register to load or store.
Rn
Is the register on which the memory address is based.
offset
Is an immediate offset from Rn and can be 0 to 255. If offset is omitted, the address is the value in Rn.

Operation
These load and store instructions perform the same function as the memory access instructions with immediate
offset. The difference is that these instructions have only unprivileged access even when used in privileged
software.
When used in unprivileged software, these instructions behave in exactly the same way as normal memory
access instructions with immediate offset.

PM0264 - Rev 2 page 160/232

 PM0264
Memory access instructions

Restrictions
In these instructions:
• Rn must not be PC.
• Rt must not be SP and must not be PC.

Condition flags
These instructions do not change the flags.
STRBTEQ R4, [R7] ; Conditionally store least significant byte in
; R4 to an address in R7, with unprivileged access.
LDRHT R2, [R2, #8] ; Load halfword value from an address equal to
; sum of R2 and 8 into R2, with unprivileged access.

3.12.5 LDR, PC‑relative

Load register from memory.
LDR{type}{cond} Rt, label
LDRD{cond} Rt, Rt2, label ; Load two words
Where:
type
Is one of:

B
Unsigned byte, zero extend to 32 bits.

SB
Signed byte, sign extend to 32 bits.

H
Unsigned halfword, zero extend to 32 bits.

SH
Signed halfword, sign extend to 32 bits.

‑
Omit, for word.

cond
Is an optional condition code.
Rt
Is the register to load or store.
Rt2
Is the second register to load or store.
label
Is a PC‑relative expression.

Operation
LDR loads a register with a value from a PC-relative memory address. The memory address is specified by a label
or by an offset from the PC.
The value to load or store can be a byte, halfword, or word. For load instructions, bytes and halfwords can either
be signed or unsigned.

PM0264 - Rev 2 page 161/232

 PM0264
Memory access instructions

label must be within a limited range of the current instruction. The following table shows the possible offsets
between label and the PC.

Table 47. Offset ranges

Instruction type Offset range

Word, halfword, signed halfword, byte, signed byte −4095 to 4095

Two words −1020 to 1020

Note: You might have to use the .W suffix to get the maximum offset range.

Restrictions
In these instructions:
• Rt can be SP or PC only for word loads.
• Rt2 must not be SP and must not be PC.
• Rt must be different from Rt2.
When Rt is PC in a word load instruction:
• Bit[0] of the loaded value must be 1 for correct execution, and a branch occurs to this halfword-aligned
address.
• If the instruction is conditional, it must be the last instruction in the IT block.

Condition flags
These instructions do not change the flags.
LDR R0, LookUpTable ; Load R0 with a word of data from an address
; labelled as LookUpTable.
LDRSB R7, localdata ; Load a byte value from an address labelled
; as localdata, sign extend it to a word
; value, and put it in R7.

3.12.6 LDM and STM

Load and Store Multiple registers.
op{addr_mode}{cond} Rn{!}, reglist
Where:
op
Is one of:

LDM
Load Multiple registers.

STM
Store Multiple registers.

addr_mode
Is any one of the following:
IA
Increment address After each access. This is the default.
DB
Decrement address Before each access.

cond
Is an optional condition code.

PM0264 - Rev 2 page 162/232

 PM0264
Memory access instructions

Rn
Is the register on which the memory addresses are based.
!
Is an optional write-back suffix. If ! is present the final address, that is loaded from or stored to, is written back
into Rn.
reglist
Is a list of one or more registers to be loaded or stored, enclosed in braces. It can contain register ranges. It
must be comma separated if it contains more than one register or register range.

LDMIA and LDMFD are synonyms for LDM. LDMFD refers to its use for popping data from Full Descending stacks.
LDMEA is a synonym for LDMDB, and refers to its use for popping data from Empty Ascending stacks.
STMIA and STMEA are synonyms for STM. STMEA refers to its use for pushing data onto Empty Ascending stacks.
STMFD is a synonym for STMDB, and refers to its use for pushing data onto Full Descending stacks.

Operation
LDM instructions load the registers in reglist with word values from memory addresses based on Rn.
STM instructions store the word values in the registers in reglist to memory addresses based on Rn.
For LDM, LDMIA, LDMFD, STM, STMIA, and STMEA the memory addresses used for the accesses are at 4-byte
intervals ranging from Rn to Rn + 4 * (n-1), where n is the number of registers in reglist. The accesses happens in
order of increasing register numbers, with the lowest numbered register using the lowest memory address and the
highest number register using the highest memory address. If the write-back suffix is specified, the value of Rn +
4 * (n-1) is written back to Rn.
For LDMDB, LDMEA, STMDB, and STMFD the memory addresses used for the accesses are at 4-byte intervals
ranging from Rn to Rn - 4 * (n-1), where n is the number of registers in reglist. The accesses happen in order
of decreasing register numbers, with the highest numbered register using the highest memory address and the
lowest number register using the lowest memory address. If the write-back suffix is specified, the value of Rn - 4 *
(n-1) is written back to Rn.
The PUSH and POP instructions can be expressed in this form.

Restrictions
In these instructions:
• Rn must not be PC.
• reglist must not contain SP.
• In any STM instruction, reglist must not contain PC.
• In any LDM instruction, reglist must not contain PC if it contains LR.
• reglist must not contain Rn if you specify the write-back suffix.
When PC is in reglist in an LDM instruction:
• Bit[0] of the value loaded to the PC must be 1 for correct execution, and a branch occurs to this halfword-
aligned address
• If the instruction is conditional, it must be the last instruction in the IT block.

Condition flags
These instructions do not change the flags.
LDM R8,{R0,R2,R9} ; LDMIA is a synonym for LDM.
STMDB R1!,{R3‑R6,R11,R12}

Incorrect examples

STM R5!,{R5,R4,R9} ; Value stored for R5 is unpredictable.

LDM R2, {} ; There must be at least one register in the list.

PM0264 - Rev 2 page 163/232

 PM0264
Memory access instructions

3.12.7 PLD
Preload Data.
PLD{cond} [Rn {, #imm}] ; Immediate
PLD{cond} [Rn, Rm {, LSL #shift}] ; Register
PLD{cond} label ; Literal
Where:
cond
Is an optional condition code.
Rn
Is the base register.
imm
Is the + or - immediate offset used to form the address. This offset can be omitted, meaning an offset of 0.
Rm
Is the optionally shifted offset register.
shift
Specifies the shift to apply to the value read from <Rm>, in the range 0-3. If this option is omitted, a shift by 0 is
assumed.
label
The label of the literal item that is likely to be accessed in the near future.

Operation
PLD signals the memory system that data memory accesses from a specified address are likely in the near
future. If the address is cacheable then the memory system responds by pre-loading the cache line containing
the specified address into the data cache. If the address is not cacheable, or the data cache is disabled, this
instruction behaves as no operation.

Restrictions
There are no restrictions.

Condition flags
These instructions do not change the flags.

3.12.8 PUSH and POP

Push registers onto, and pop registers off a full-descending stack.
PUSH{cond} reglist
POP{cond} reglist
Where:
cond
Is an optional condition code.
reglist
Is a non-empty list of registers, enclosed in braces. It can contain register ranges. It must be comma separated if
it contains more than one register or register range.

PUSH and POP are synonyms for STMDB and LDM (or LDMIA) with the memory addresses for the access based on
SP, and with the final address for the access written back to the SP. PUSH and POP are the preferred mnemonics
in these cases.

PM0264 - Rev 2 page 164/232

 PM0264
Memory access instructions

Operation
PUSH stores registers on the stack, with the lowest numbered register using the lowest memory address and the
highest numbered register using the highest memory address.
POP loads registers from the stack, with the lowest numbered register using the lowest memory address and the
highest numbered register using the highest memory address.
PUSH uses the value in the SP register minus four as the highest memory address, POP uses the value in the SP
register as the lowest memory address, implementing a full-descending stack. On completion, PUSH updates the
SP register to point to the location of the lowest store value, POP updates the SP register to point to the location
above the highest location loaded.
If a POP instruction includes PC in its reglist, a branch to this location is performed when the POP instruction has
completed. Bit[0] of the value read for the PC is used to update the APSR T-bit. This bit must be 1 to ensure
correct operation.

Restrictions
In these instructions:
• reglist must not contain SP.
• For the PUSH instruction, reglist must not contain PC.
• For the POP instruction, reglist must not contain PC if it contains LR.
When PC is in reglist in a POP instruction:
• Bit[0] of the value loaded to the PC must be 1 for correct execution, and a branch occurs to this halfword-
aligned address.
• If the instruction is conditional, it must be the last instruction in the IT block.

Condition flags
These instructions do not change the flags.
PUSH {R0,R4-R7} ; Push R0,R4,R5,R6,R7 onto the stack

PUSH {R2,LR} ; Push R2 and the link-register onto the stack

POP {R0,R6,PC} ; Pop r0,r6 and PC from the stack, then branch to the new PC.

3.12.9 LDA and STL

Load-Acquire and Store-Release.
op{type}{cond} Rt, [Rn]
Where:
op
Is one of:

LDA
Load-Acquire Register.

STL
Store-Release Register.

type
Is one of:
B
Unsigned byte, zero extend to 32 bits on loads.
H
Unsigned halfword, zero extend to 32 bits on loads..

PM0264 - Rev 2 page 165/232

 PM0264
Memory access instructions

cond
Is an optional condition code.
Rt
Is the register to load or store.
Rn
Is the register on which the memory address is based.

Operation
LDA, LDAB, and LDAH loads word, byte, and halfword data respectively from a memory address. If any loads
or stores appear after a load-acquire in program order, then all observers are guaranteed to observe the load-
acquire before observing the loads and stores. Loads and stores appearing before a load-acquire are unaffected.
STL, STLB, and STLH stores word, byte, and halfword data respectively to a memory address. If any loads or
stores appear before a store-release in program order, then all observers are guaranteed to observe the loads
and stores before observing the store-release. Loads and stores appearing after a store-release are unaffected.
In addition, if a store-release is followed by a load-acquire, each observer is guaranteed to observe them in
program order.
There is no requirement that a load-acquire and store-release be paired.
All store-release operations are multi-copy atomic, meaning that in a multiprocessing system, if one observer
observes a write to memory because of a store-release operation, then all observers observe it. Also, all
observers observe all such writes to the same location in the same order.

Restrictions
The address specified must be naturally aligned, or an alignment fault is generated.
The PC must not use SP for Rt.

Condition flags
These instructions do not change the flags.

3.12.10 LDREX and STREX

Load and Store Register Exclusive.
LDREX{cond} Rt, [Rn {, #offset}]
STREX{cond} Rd, Rt, [Rn {, #offset}]
LDREXB{cond} Rt, [Rn]
STREXB{cond} Rd, Rt, [Rn]
LDREXH{cond} Rt, [Rn]
STREXH{cond} Rd, Rt, [Rn]
Where:
cond
Is an optional condition code.
Rd
Is the destination register for the returned status.
Rt
Is the register to load or store.
Rn
Is the register on which the memory address is based.
offset
Is an optional offset applied to the value in Rn. If offset is omitted, the address is the value in Rn.

PM0264 - Rev 2 page 166/232

 PM0264
Memory access instructions

Operation
LDREX, LDREXB, and LDREXH load a word, byte, and halfword respectively from a memory address.
STREX, STREXB, and STREXH attempt to store a word, byte, and halfword respectively to a memory address. The
address used in any Store-Exclusive instruction must be the same as the address in the most recently executed
Load-exclusive instruction. The value stored by the Store-Exclusive instruction must also have the same data
size as the value loaded by the preceding Load-exclusive instruction. This means software must always use a
Load-exclusive instruction and a matching Store-Exclusive instruction to perform a synchronization operation.
If a Store-Exclusive instruction performs the store, it writes 0 to its destination register. If it does not perform the
store, it writes 1 to its destination register. If the Store-Exclusive instruction writes 0 to the destination register, it
is guaranteed that no other process in the system has accessed the memory location between the Load-exclusive
and Store-Exclusive instructions.
For reasons of performance, keep the number of instructions between corresponding Load-Exclusive and Store-
Exclusive instruction to a minimum.
Note: The result of executing a Store-Exclusive instruction to an address that is different from that used in the
preceding Load-Exclusive instruction is unpredictable.

Restrictions
In these instructions:
• Do not use PC.
• Do not use SP for Rd and Rt.
• For STREX, Rd must be different from both Rt and Rn.
• The value of offset must be a multiple of four in the range 0-1020.

Condition flags
These instructions do not change the flags.
MOV R1, #0x1 ; Initialize the ‘lock taken’ value
try
LDREX R0, [LockAddr] ; Load the lock value
CMP R0, #0 ; Is the lock free?
ITT EQ ; IT instruction for STREXEQ and CMPEQ
STREXEQ R0, R1, [LockAddr] ; Try and claim the lock
CMPEQ R0, #0 ; Did this succeed?
BNE try ; No – try again
.... ; Yes – we have the lock.

3.12.11 LDAEX and STLEX

Load-Acquire and Store Release Exclusive.
op{type} Rt, [Rn]
Where:
op
Is one of:

LDAEX
Load Register.

STLEX
Store Register.

PM0264 - Rev 2 page 167/232

 PM0264
Memory access instructions

type
Is one of:
B
Unsigned byte, zero extend to 32 bits on loads.
H
Unsigned halfword, zero extend to 32 bits on loads..

cond
is an optional condition code.
Rd
is the destination register for the returned status.
Rt
is the register to load or store.
Rn
is the register on which the memory address is based.

Operation
Load Register Exclusive calculates an address from a base register value and an immediate offset, loads a word
from memory, writes it to a register and:
• If the address has the Shared Memory attribute, marks the physical address as exclusive access for the
executing core in a global monitor.
• Causes the core that executes to indicate an active exclusive access in the local monitor.
• If any loads or stores appear after LDAEX in program order, then all observers are guaranteed to observe the
LDAEX before observing the loads and stores. Loads and stores appearing before LDAEX are unaffected.
Store Register Exclusive calculates an address from a base register value and an immediate offset, and stores a
word from a register to memory If the executing core has exclusive access to the memory addressed:
• Rd is the destination general-purpose register into which the status result of the store exclusive is written,
encoded in the Rd field. The value returned is:
0 If the operation updates memory.
1 If the operation fails to update memory.
• If any loads or stores appear before STLEX in program order, then all observers are guaranteed to observe
the loads and stores before observing the store-release. Loads and stores appearing after STLEX are
unaffected.
Note: All store-release operations are multi-copy atomic.

Restrictions
In these instructions:
• Do not use PC.
• Do not use SP for Rd and Rt.
• For STLEX, Rd must be different from both Rt and Rn.

Condition flags
These instructions do not change the flags.

PM0264 - Rev 2 page 168/232

 PM0264
Memory access instructions

lock
MOV R1, #0x1 ; Initialize the ‘lock taken’ value try
LDAEX R0, [LockAddr] ; Load the lock value
CMP R0, #0 ; Is the lock free?
BNE try ; No – try again
STREX R0, R1, [LockAddr] ; Try and claim the lock
CMP R0, #0 ; Did this succeed?
BNE try ; No – try again
; Yes – we have the lock.
unlock

MOV r1, #0
STL r1, [r0]

3.12.12 CLREX
Clear Exclusive.
CLREX{cond}
Where:
cond
Is an optional condition code.

Operation
Use CLREX to make the next STREX, STREXB, or STREXH instruction write 1 to its destination register and fail to
perform the store. CLREX enables compatibility with other Arm Cortex processors that have to force the failure of
the store exclusive if the exception occurs between a load-exclusive instruction and the matching store-exclusive
instruction in a synchronization operation. In Cortex-M processors, the local exclusive access monitor clears
automatically on an exception boundary, so exception handlers using CLREX are optional.

Condition flags
This instruction does not change the flags.
CLREX

PM0264 - Rev 2 page 169/232

 PM0264
Cortex®-M33 peripherals

4 Cortex®-M33 peripherals

4.1 About the Cortex®-M33 peripherals

The address map of the Private peripheral bus (PPB) is:

Table 48. Core peripheral register regions

Address Core peripheral Description

Includes the Interrupt Controller Type and Auxiliary

0xE000E000-0xE000E00F
Control registers
0xE000ED00-0xE000ED8F System control and ID registers Section 4.3 System Control Block
0xE000EDF0-0xE000EEFF Debug registers in the SCS
0xE000EF00-0xE000EF8F Includes the SW Trigger Interrupt Register
0xE000E010-0xE000E0FF System timer Section 4.4 System timer, SysTick
Nested Vectored Interrupt Controller
0xE000E100-0xE000ECFF Section 4.2 Nested Vectored Interrupt Controller
registers
Section 4.5.1 Security Attribution Unit
0xE000ED00-0xE000EDEF Security Attribution Unit
-
0xE000ED90-0xE000EDB8 Memory Protection Unit Section 4.5.9 Memory Protection Unit
0xE000EF30-0xE000EF44 Floating-Point Unit Section 4.6 Floating-Point Unit

1. Software can read the MPU Type Register at 0xE000ED90 to test for the presence of a Memory Protection Unit (MPU).

• The register type is described as follows:

RW Read and write.
RO Read-only.
WO Write-only.
RAZ Read As Zero.
WI Write Ignored.
• The required privilege gives the privilege level that is required to access the register, as follows:
Privileged Only privileged software can access the register.
Unprivileged Both unprivileged and privileged software can access the register.
• The peripheral registers are banked in Secure and Non-secure state. The Non-secure registers can be
accessed in Secure state by using an aliased address at offset 00020000 from the normal register address.
The alias locations are always RAZ/WI if accessed from Non-secure state.
Note: Attempting to access a privileged register from unprivileged software results in a BusFault.

4.2 Nested Vectored Interrupt Controller

This section describes the Nested Vectored Interrupt Controller (NVIC) and the registers it uses.
The NVIC supports:
• 1-480 interrupts.
• A programmable priority level of 0-255. A higher level corresponds to a lower priority, so level 0 is the
highest interrupt priority. In Non-secure state, the priority also depends on the value of AIRCR.PRIS.A
programmable priority level of 0-255. A higher level corresponds to a lower priority, so level 0 is the highest
interrupt priority.
• Level and pulse detection of interrupt signals.
• Interrupt tail-chaining.
• An external Non-Maskable Interrupt (NMI).

PM0264 - Rev 2 page 170/232

 PM0264
Nested Vectored Interrupt Controller

• Late arriving interrupts.

The processor automatically stacks its state on exception entry and unstacks this state on exception exit, with no
instruction overhead. This provides low latency exception handling.
The following table shows the hardware implementation of NVIC registers. In an implementation with the Security
Extension, register fields that are associated with interrupts designated as Secure in the ITNS register are always
RAZ/WI if accessed from Non-secure state.

Table 49. NVIC registers summary

Required
Address Name Type Reset value Description
privilege

0xE000E100-0xE000E13C NVIC_ISER0- RW Privileged 0x00000000 Section 4.2.2 Interrupt Set

NVIC_ISER15 Enable Registers

0XE000E180- 0xE000E1BC NVIC_ICER0- RW Privileged 0x00000000 Section 4.2.3 Interrupt Clear

NVIC_ICER15 Enable Registers
Section 4.2.4 Interrupt Set
0XE000E200- 0xE000E23C NVIC_ISPR0- RW Privileged 0x00000000 Pending Registers - Cortex-
NVIC_ISPR15
M33

0XE000E280- 0xE000E2BC NVIC_ICPR0- RW Privileged 0x00000000 Section 4.2.8 Interrupt Clear

NVIC_ICPR15 Pending Registers

0xE000E300-0xE000E33C NVIC_IABR0- RW Privileged 0x00000000 Section 4.2.5 Interrupt Active

NVIC_IABR15 Bit Registers

0xE000E380-0xE000E3BC NVIC_ITNS0- RW(1) Privileged 0x00000000

Section 4.2.6 Interrupt Target
NVIC_ITNS15 Non-secure Registers.

0xE000E400-0xE000E5DC NVIC_IPR0- RW Privileged 0x00000000 Section 4.2.7 Interrupt

NVIC_IPR119 Priority Registers

0xE000EF00 STIR WO Configurable(2) 0x00000000 Section 4.2.9 Software

Trigger Interrupt Register

1. ITNS is RAZ/WI from the Non-Secure state.

2. See the register description for more information.

4.2.1 Accessing the NVIC registers using CMSIS

CMSIS functions enable software portability between different Cortex‑M profile processors.
To access the NVIC registers when using CMSIS, use the following functions:

Table 50. CMSIS access NVIC functions

CMSIS function Description

void NVIC_SetPriorityGrouping (uint32_t

Set priority grouping
PriorityGroup)
uint32_t NVIC_GetPriorityGrouping (void) Read the priority grouping

void NVIC_EnableIRQ (IRQn_Type IRQn) Enable a device-specific interrupt

uint32_t NVIC_GetEnableIRQ (IRQn_Type IRQn) Get a device-specific interrupt enable status.

void NVIC_DisableIRQ (IRQn_Type IRQn) Disable a device-specific interrupt

uint32_t NVIC_GetPendingIRQ (IRQn_Type IRQn) Get the pending device-specific interrupt

void NVIC_SetPendingIRQ (IRQn_Type IRQn) Set a device-specific interrupt to pending

void NVIC_ClearPendingIRQ (IRQn_Type IRQn) Clear a device-specific interrupt from pending

uint32_t NVIC_GetActive (IRQn_Type IRQn) Get the device-specific interrupt active

void NVIC_SetPriority (IRQn_Type IRQn, uint32_t

Set the priority for an interrupt
priority)

PM0264 - Rev 2 page 171/232

 PM0264
Nested Vectored Interrupt Controller

CMSIS function Description

uint32_t NVIC_GetPriority (IRQn_Type IRQn) Get the priority of an interrupt

uint32_t NVIC_EncodePriority (uint32_t

PriorityGroup, uint32_t PreemptPriority, uint32_t Encodes priority
SubPriority)
void NVIC_DecodePriority (uint32_t Priority,
uint32_t PriorityGroup, uint32_t *pPreemptPriority, Decode the interrupt priority
uint32_t *pSubPriority)
uint32_t NVIC_GetVector (IRQn_Type IRQn) Read interrupt vector

void NVIC_SetVector (IRQn_Type IRQn, uint32_t

Modify interrupt vector
vector)
void NVIC_SystemReset (void) Reset the system

uint32_t NVIC_GetTargetState (IRQn_Type IRQn) Get interrupt target state

uint32_t NVIC_SetTargetState (IRQn_Type IRQn Set interrupt target state

uint32_t NVIC_ClearTargetState (IRQn_Type IRQn) Clear interrupt target state

Note: The input parameter IRQn is the IRQ number. For more information on CMSIS NVIC functions, see http://
arm-software.github.io/CMSIS_5/Core/html/group__NVIC__gr.html

4.2.2 Interrupt Set Enable Registers

The NVIC_ISER0-NVIC_ISER15 registers enable interrupts, and show which interrupts are enabled.
See the register summary in Section 4.2 Nested Vectored Interrupt Controller for the register attributes.
These registers are not banked between Security states. The register bits can be RAZ/WI depending on the value
of NVIC_ITNS.
The bit assignments are:

31 0

SETENA

Table 51. NVIC_ISERn bit assignments

Bits Name Function

Interrupt set-enable bits. For SETENA[m] in NVIC_ISERn, allows interrupt 32n + m to be accessed.
Write:
0 No effect.

[31:0] SETENA. 1 Enable interrupt 32n+m.

Read:
0 Interrupt 32n+m disabled.
1 Interrupt 32n+m enabled.

If a pending interrupt is enabled, the NVIC activates the interrupt based on its priority. If an interrupt is not
enabled, asserting its interrupt signal changes the interrupt state to pending, but the NVIC never activates the
interrupt, regardless of its priority.
The register bits can be RAZ/WI depending on the value of NVIC_ITNS

PM0264 - Rev 2 page 172/232

 PM0264
Nested Vectored Interrupt Controller

4.2.3 Interrupt Clear Enable Registers

The NVIC_ICER0-NVIC_ICER15 registers disable interrupts, and show which interrupts are enabled.
See the register summary in Section 4.2 Nested Vectored Interrupt Controller for the register attributes.
The register bits can be RAZ/WI from Non-secure state depending on the value of NVIC_ITNS.
These registers are not banked between Security states.
The bit assignments are:

31 0

CLRENA

Table 52. NVIC_ICERn bit assignments

Bits Name Function

Interrupt clear-enable bits. For SETENA[m] in NVIC_ICERn, allows interrupt 32n + m to be accessed.
Write:
0 No effect.

[31:0] CLRENA 1 Disable interrupt 32n+m.

Read:
0 Interrupt 32n+m disabled.
1 Interrupt 32n+m enabled.

4.2.4 Interrupt Set Pending Registers - Cortex-M33

The NVIC_ISPR0-NVIC_ISPR15 registers force interrupts into the pending state, and shows which interrupts are
pending.
See the register summary in Section 4.2 Nested Vectored Interrupt Controller for the register attributes.
The register bits can be RAZ/WI from Non-secure state depending on the value of NVIC_ITNS.
These registers are not banked between Security states.
The bit assignments are:

31 0

SETPEND

Table 53. NVIC_ISPRn bit assignments

Bits Name Function

Interrupt set-pending bits. For SETPEND[m] in NVIC_ISPRn, allows interrupt 32n + m to be accessed.
Write:
0 No effect.

[31:0] SETPEND 1 Pend interrupt 32n + m.

Read:
0 Interrupt 32n + m is not pending.
1 Interrupt 32n + m pending.

PM0264 - Rev 2 page 173/232

 PM0264
Nested Vectored Interrupt Controller

Note: Writing 1 to the NVIC_ISPR bit corresponding to:

• An interrupt that is pending has no effect.
• A disabled interrupt sets the state of that interrupt to pending.

4.2.5 Interrupt Active Bit Registers

The NVIC_IABR0-NVIC_IABR15 registers indicate the active state of each interrupt.
See the register summary in Section 4.2 Nested Vectored Interrupt Controller for the register attributes.
The register bits can be RAZ/WI depending on the value of NVIC_ITNS.
These registers are not banked between Security states.
The bit assignments are:

31 0

ACTIVE

Table 54. NVIC_IABRn bit assignments

Bits Name Function

Active state bits. For ACTIVE[m] in NVIC_IABRn, indicates the active state for interrupt 32n+m.
[31:0] ACTIVE 0 The interrupt is not active.
1 The interrupt is active.

4.2.6 Interrupt Target Non-secure Registers

The NVIC_ITNS0-NVIC_ITNS15 determine, for each group of 32 interrupts, whether each interrupt targets Non-
secure or Secure state. Otherwise, This register is RAZ/WI
See the register summary in Section 4.2 Nested Vectored Interrupt Controller for the register attributes.
This register is accessible from Secure state only.
The bit assignments are:

31 0

ITNS

Table 55. NVIC_ITNSn bit assignments

Bits Name Function

Interrupt Targets Non-secure bits. For ITNS[m] in NVIC_ITNSn, this field indicates and allows modification of
the target Security state for interrupt 32n+m.
[31:0] ITNS
0 The interrupt targets Secure state.
1 The interrupt targets Non-secure state.

4.2.7 Interrupt Priority Registers

The NVIC_IPR0-NVIC_IPR119 registers provide an 8-bit priority field for each interrupt. These registers are word,
halfword, and byte accessible.
See the register summary in Section 4.2 Nested Vectored Interrupt Controller for their attributes.
Each register holds four priority fields as shown:

PM0264 - Rev 2 page 174/232

 PM0264
Nested Vectored Interrupt Controller

31 24 23 16 15 8 7 0

NVIC_IPR119 PRI_479 PRI_478 PRI_477 PRI_476

. . .
...

NVIC_IPRn PRI_(4n+3) PRI_(4n+2) PRI_(4n+1) PRI_(4n)

. . .
...

NVIC_IPR0 PRI_3 PRI_2 PRI_1 PRI_0

Table 56. NVIC_IPRn bit assignments

Bits Name Function

Priority,
[31:24] byte offset
3
Priority,
[23:16] byte offset Each priority field holds a priority value. The priority depends on the value of PRIS for exceptions
2 targeting the Non-secure state. If the processor implements fewer than 8 bits of priority, then the least
significant bits of this field are res0. Each priority field holds a priority value. The lower the value, the
Priority, greater the priority of the corresponding interrupt. If the processor implements fewer than 8 bits of
[15:8] byte offset priority, then the least significant bits of this field are res0.
1
Priority,
[7:0] byte offset
0

See Section 4.2.1 Accessing the NVIC registers using CMSIS for more information about the access to the
interrupt priority array, which provides the software view of the interrupt priorities.
Find the NVIC_IPR number and byte offset for interrupt M as follows:
• The corresponding NVIC_IPR number, N, is given by N = M DIV 4.
• The byte offset of the required Priority field in this register is M MOD 4, where:
– Byte offset 0 refers to register bits[7:0].
– Byte offset 1 refers to register bits[15:8].
– Byte offset 2 refers to register bits[23:16].
– Byte offset 3 refers to register bits[31:24].
Priority values depend on the value of PRIS.
The register bits can be RAZ/WI depending on the value of NVIC_ITNS.
These registers are not banked between Security states.

4.2.8 Interrupt Clear Pending Registers

The NVIC_ICPR0-NVIC_ICPR15 registers remove the pending state from interrupts, and shows which interrupts
are pending.
See the register summary in Section 4.2 Nested Vectored Interrupt Controller for the register attributes.
The register bits can be RAZ/WI depending on the value of NVIC_ITNS.
These registers are not banked between Security states.
The bit assignments are:

31 0

CLRPEND

PM0264 - Rev 2 page 175/232

 PM0264
Nested Vectored Interrupt Controller

Table 57. NVIC_ICPRn bit assignments

Bits Name Function

Interrupt clear-pending bits.

Write:
0 No effect.

[31:0] CLRPEND 1 Clear pending state of interrupt 32n + m.

Read:
0 Interrupt 32n + m is not pending.
1 Interrupt 32n + m is pending.

Note: Writing 1 to an NVIC_ICPR bit does not affect the active state of the corresponding interrupt.

4.2.9 Software Trigger Interrupt Register

Write to the STIR to generate an interrupt from software.
When the USERSETMPEND bit in the CCR is set to 1, unprivileged software can access the STIR.
Note: Only privileged software can enable unprivileged access to the STIR.
See Section 4.2 Nested Vectored Interrupt Controller for the register attributes.
This register is not banked between Security states.
The bit assignments are:

31 9 8 0

RES0 INTID

Table 58. STIR bit assignments

Bits Field Function

[31:9] - Reserved, res0.

Interrupt ID of the interrupt to trigger, in the range 0-479. For example, a value of 0x03 specifies interrupt
[8:0] INTID
IRQ3.

4.2.10 Level-sensitive and pulse interrupts

The processor supports both level-sensitive and pulse interrupts. Pulse interrupts are also described as edge-
triggered interrupts.
A level-sensitive interrupt is held asserted until the peripheral deasserts the interrupt signal. Typically this
happens because the ISR accesses the peripheral, causing it to clear the interrupt request. A pulse interrupt
is an interrupt signal sampled synchronously on the rising edge of the processor clock. To ensure that the NVIC
detects the interrupt, the peripheral must assert the interrupt signal for at least one clock cycle, during which the
NVIC detects the pulse and latches the interrupt.
When the processor enters the ISR, it automatically removes the pending state from the interrupt.
For a level-sensitive interrupt, if the signal is not deasserted before the processor returns from the ISR, the
interrupt becomes pending again, and the processor must execute its ISR again. This means that the peripheral
can hold the interrupt signal asserted until it no longer requires servicing.
See <reference required> for details of which interrupts are level-sensitive and which are pulsed.

4.2.10.1 Hardware and software control of interrupts

The processor latches all interrupts. A peripheral interrupt becomes pending for one of the following reasons:
• The NVIC detects that the interrupt signal is active and the corresponding interrupt is not active.

PM0264 - Rev 2 page 176/232

 PM0264
System Control Block

• The NVIC detects a rising edge on the interrupt signal.

• Software writes to the corresponding Interrupt Set Enable Register bit.
A pending interrupt remains pending until one of the following occurs:
• The processor enters the ISR for the interrupt. This changes the state of the interrupt from pending to active.
Then:
– For a level-sensitive interrupt, when the processor returns from the ISR, the NVIC samples the interrupt
signal. If the signal is asserted, the state of the interrupt changes to pending, which might cause the
processor to immediately reenter the ISR. Otherwise, the state of the interrupt changes to inactive.
– For a pulse interrupt, the NVIC continues to monitor the interrupt signal, and if this is pulsed the state of
the interrupt changes to pending and active. In this case, when the processor returns from the ISR the
state of the interrupt changes to pending, which might cause the processor to immediately reenter the
ISR.
If the interrupt signal is not pulsed while the processor is in the ISR, when the processor returns from
the ISR the state of the interrupt changes to inactive.
• Software writes to the corresponding Interrupt Clear Pending Register bit.
For a level-sensitive interrupt, if the interrupt signal is still asserted, the state of the interrupt does not
change. Otherwise, the state of the interrupt changes to inactive.
For a pulse interrupt, state of the interrupt changes to:
– Inactive, if the state was pending.
– Active, if the state was active and pending.

4.2.11 NVIC usage hints and tips

Ensure that software uses correctly aligned register accesses. The processor does not support unaligned
accesses to NVIC registers.
An interrupt can enter pending state even if it is disabled. Disabling an interrupt only prevents the processor from
taking that interrupt.
Before programming VTOR to relocate the vector table, ensure that the vector table entries of the new vector
table are set up for fault handlers, NMI, and all enabled exceptions like interrupts.

4.2.11.1 NVIC programming hints

Software uses the CPSIE i and CPSID i instructions to enable and disable interrupts.
The CMSIS provides the following intrinsic functions for these instructions:
void __disable_irq(void) // Disable Interrupts
void __enable_irq(void) // Enable Interrupts

In addition, the CMSIS provides functions for NVIC control, listed in Section 4.2.1 Accessing the NVIC registers
using CMSIS.
The input parameter IRQn is the IRQ number, see Section 2.4.2 Exception types for more information. For more
information about these functions, see the CMSIS documentation.

4.3 System Control Block

The System Control Block (SCB) provides system implementation information and system control that includes
configuration, control, and reporting of system exceptions.
The system control block registers are:

Table 59. Summary of the system control block registers

Required Reset
Address Name Type Description
privilege value

E000E008 ACTLR RW Privileged 00000000 Section 4.3.3 Auxiliary Control Register

E000ED00 CPUID RO Privileged 0x410FD214 Section 4.3.4 CPUID Base Register

E000ED04 ICSR RW(1) Privileged 00000000 Section 4.3.5 Interrupt Control and State Register

PM0264 - Rev 2 page 177/232

 PM0264
System Control Block

Required Reset
Address Name Type Description
privilege value

E000ED08 VTOR RW Privileged UNKNOWN Section 4.3.6 Vector Table Offset Register

E000ED0C AIRCR RW(1) Privileged FA050000 Section 4.3.7 Application Interrupt and Reset Control Register

E000ED10 SCR RW Privileged 00000000 Section 4.3.8 System Control Register

E000ED14 CCR RW Privileged 0x00000201 Section 4.3.9 Configuration and Control Register
E000ED18 SHPR1 RW Privileged 00000000 Section 4.3.10.1 System Handler Priority Register 1

E000ED1C SHPR2 RW Privileged 00000000 Section 4.3.10.2 System Handler Priority Register 2

E000ED20 SHPR3 RW Privileged 00000000 Section 4.3.10.3 System Handler Priority Register 3
E000ED24 SHCSR RW Privileged 00000000 Section 4.3.11 System Handler Control and State Register
E000ED28 CFSR RW Privileged 00000000 Section 4.3.12 Configurable Fault Status Register

E000ED28 MMFSR(2) RW Privileged 00 Section 4.3.12.1 MemManage Fault Status Register

E000ED29 BFSR(2) RW Privileged 00 Section 4.3.12.2 BusFault Status Register

E000ED2A UFSR(2) RW Privileged 0000 Section 4.3.12.3 UsageFault Status Register

E000ED2C HFSR RW Privileged 00000000 Section 4.3.13 HardFault Status Register

E000ED34 MMFAR RW Privileged UNKNOWN Section 4.3.14 MemManage Fault Address Register
E000ED38 BFAR RW Privileged UNKNOWN Section 4.3.15 BusFault Address Register
E000ED3C AFSR RAZ/WI Privileged - Auxiliary Fault Status Register not implemented
E000ED8C NSACR RW Privileged UNKNOWN Section 4.3.2 Non-secure Access Control Register

1. See the register description for more information.

2. A subregister of the CFSR.

4.3.1 Coprocessor Access Control Register

The CPACR register specifies the access privileges for the FPU.
See System control block registers summary for the CPACR attributes.
In an implementation with the Security Extension, this field is banked between Security states.
The CPACR bit assignments are:

31 24 23 22 21 20 19 0

RES0 CP11 CP10 RES0

Table 60. CPACR bit assignments

Bits Name Function

[31:24] - Reserved, res0

CP11 Privilege. The value in this field is ignored.
[23:22] CP11
If the value of this bit is not programmed to the same value as the CP10 field, then the value is UNKNOWN.
CP10 Privilege. Defines the access rights for the floating-point functionality.
The possible values of this bit are:
00 All accesses to the FP Extension result in NOCP UsageFault.
[21:20] CP10 01 Unprivileged accesses to the FP Extension result in NOCP UsageFault.
11 Full access to the FP Extension.

All other values are reserved.

PM0264 - Rev 2 page 178/232

 PM0264
System Control Block

Bits Name Function

The features controlled by this field are the execution of any floating-point instruction and access to any
floating-point registers D0-D16.
[19:0] - Reserved, res0

4.3.2 Non-secure Access Control Register

The NSACR register defines the Non-secure access permissions for the FPU.
See Table 59. Summary of the system control block registers for the NSACR attributes.
This field is not banked between Security states.
The NSACR bit assignments are:
31 12 11 10 9 8 7 0

RES0 RES0

CP10
CP11

Table 61. NSACR bit assignments

Bits Name Function

[31:12] - Reserved, res0.

CP11 access. Enables Non-secure
access to the Floating-point Extension.
[11] CP11 Programming with a different value
other than that used for CP10 is
UNPREDICTABLE.
CP10 access. Enables Non-secure
access to the Floating-point Extension.
Non-secure accesses to
the Floating-point Extension
0
[10] CP10 generate a NOCP
UsageFault.
Non-secure access to
1 the Floating-point Extension
permitted.
[9:0] - Reserved, res0

4.3.3 Auxiliary Control Register

The ACTLR provides disable bits for the FPU exception outputs, dual-issue functionality, flushing of the trace
output from the ITM and DWT, Exclusive instruction control, out-of-order floating point instructions, and handling
interruptible instructions.
By default, this register is set to provide optimum performance from the Cortex‑M33 processor and does not
normally require modification.
See Table 59. Summary of the system control block registers for the ACTLR attributes.
This register is banked between Security states.
The ACTLR bit assignments are:

PM0264 - Rev 2 page 179/232

 PM0264
System Control Block

31 30 29 28 13 12 11 10 9 8 3 2 1 0

UNK/SBZP UNK/SBZP

EXTEXCLALL
UNK/SBZP
DISITMATBFLUSH
UNK/SBZP
FPEXCODIS
DISOOFP
DISFOLD
UNK/SBZP
DISMCYCINT

Table 62. ACTLR bit assignments

Bits Name Function

[31:30] - Reserved, UNK/SBZP

Normal operation. Memory requests on Code region AHB (C-AHB) or
System AHB (S-AHB) interfaces associated with LDREX and STREX
0
instructions only assert HEXCL and respond to HEXOKAY if the
address is shareable.
All memory requests on C-AHB or S-AHB interfaces associated
[29] EXTEXCLALL with LDREX and STREX instructions assert HEXCL and respond to
1
HEXOKAY irrespective of the shareable attribute associated with the
address.

Setting EXTEXCLALL allows external exclusive operations to be used in a configuration with no

MPU. This is because the default memory map does not include any shareable Normal memory.
[28:13] - Reserved. UNK/SBZP
Disables ITM and DWT ATB flush:
0 Normal operation.
[12] DISITMATBFLUSH
ITM and DWT ATB flush disabled. AFVALID is ignored and AFREADY
1
is held HIGH.
[11] - Reserved. UNK/SBZP
Disables FPU exception outputs:
[10] FPEXCODIS 0 Normal operation.
1 FPU exception outputs are disabled.
Disables floating-point instructions completing out of order with respect to the non-floating point
instructions:
[9] DISOOFP
0 Normal operation.
1 Floating-point instructions completing out of order are disabled.
[8:3] - Reserved. UNK/SBZP
Disables dual-issue functionality:
0 Normal operation.
[2] DISFOLD
Dual-issue functionality is disabled. Setting this bit reduces
1
performance.
[1] - Reserved. UNK/SBZP
Disables interruption of multi-cycle instructions:
0 Normal operation.
[0] DISMCYCINT
Disables interruption of multi-cycle instructions. This increases the
1 interrupt latency of the processor because load, store, multiply, and
divide operations complete before interrupt stacking occurs.

PM0264 - Rev 2 page 180/232

 PM0264
System Control Block

4.3.4 CPUID Base Register

The CPUID Base Register contains the processor part number, version, and implementation information.
See Table 59. Summary of the system control block registers for the CPUID attributes.
This register is not banked between Security states.
The bit assignments are:
31 24 23 20 19 16 15 4 3 0

Implementer Variant Constant PartNo Revision

Table 63. CPUID bit assignments

Bits Name Function

Implementer code:
[31:24] Implementer
0x41 Arm
Variant number, the n value in the rnpm product revision identifier:
[23:20] Variant
0 Revision 0
[19:16] Constant Reads as 0xF
Part number of the processor:
[15:4] PartNo
D21 Cortex‑M33
Revision number, the m value in the rnpm product revision identifier:
[3:0] Revision
2 Patch 2.

4.3.5 Interrupt Control and State Register

The ICSR provides a set-pending bit for the non-maskable interrupt exception, and set-pending and clear-pending
bits for the PendSV and SysTick exceptions.
The ICSR indicates:
• The exception number of the exception being processed.
• Whether there are pre-empted active exceptions.
• The exception number of the highest priority pending exception
• Whether any interrupts are pending.
See Table 59. Summary of the system control block registers for the ICSR attributes.
This register is banked between Security states on a bit by bit basis.
The ICSR bit assignments are:

31 30 29 28 27 26 25 24 23 22 21 20 12 11 10 9 8 0

VECTPENDING VECTACTIVE

PENDNMISET RES0 RES0

PENDNMICLR ISRPENDING RETTOBASE
RES0 Reserved for Debug use
PENDSVSET STTNS
PENDSVCLR PENDSTCLR
PENDSTSET

Table 64. ICSR bit assignments with the Security Extension

Bits Name type Function

NMI set-pending bit.

[31] PENDNMISET RW Write:
0 No effect.

PM0264 - Rev 2 page 181/232

 PM0264
System Control Block

Bits Name type Function

Changes NMI exception state to
1
pending.

Read:
0 NMI exception is not pending.

1 NMI exception is pending.

A read of this bit by the NMI exception handler

returns 1 only if the NMI signal is reasserted while the
processor is executing that handler.
If AIRCR.BFHFNMINS is zero this bit is RAZ/WI from
Non-secure state.
This bit is not banked between Security states.
Pend NMI clear bit.
Write:
0 No effect.

1 Clear pending status.

[30] PENDNMICLR WO
This bit is write-one-to-clear. Writes of zero are
ignored.
If AIRCR.BFHFNMINS is zero this bit is RAZ/WI from
Non-secure state.
This bit is not banked between Security states.
[29] - - Reserved, RES0
PendSV set-pending bit.
Write:
0 No effect.

Changes PendSV exception state to

1
pending.

[28] PENDSVSET RW Read:

0 PendSV exception is not pending.

1 PendSV exception is pending.

Writing 1 to this bit is the only way to set the PendSV

exception state to pending.
This bit is banked between Security states.
PendSV clear-pending bit.
Write:
0 No effect.
[27] PENDSVCLR WO
Removes the pending state from the
1
PendSV exception.

This bit is banked between Security states.

SysTick exception set-pending bit.
[26] PENDSTSET RW Write:
0 No effect.

PM0264 - Rev 2 page 182/232

 PM0264
System Control Block

Bits Name type Function

Changes SysTick exception state to
1
pending.

Read:
0 SysTick exception is not pending.

1 SysTick exception is pending.

This bit is banked between Security states.

SysTick exception clear-pending bit.
Write:
0 No effect.

[25] PENDSTCLR WO Removes the pending state from the

1
SysTick exception.

This bit is WO. On a register read, its value is

UNKNOWN.
This bit is not banked between Security states.
[24] STTNS RO RES0
This bit is reserved for Debug use and reads-as-zero
[23] Reserved for Debug use RO
when the processor is not in Debug.
Interrupt pending flag, excluding NMI and Faults:
0 Interrupt not pending.
[22] ISRPENDING RO
1 Interrupt not pending.

This bit is not banked between Security states.

[21] - - Reserved, RES0
Indicates the exception number of the highest priority
pending enabled exception:
0 No pending exceptions.

The exception number of the highest

Nonzero
[20:12] VECTPENDING RO priority pending enabled exception.

The value that this field indicates includes the effect of

the BASEPRI and FAULTMASK registers, but not any
effect of the PRIMASK register.
This field is not banked between Security states.
Indicates whether there are pre-empted active
exceptions:
There are pre-empted active exceptions
0
to execute.
[11] RETTOBASE RO
There are no active exceptions, or the
1 currently executing exception is the
only active exception.

This bit is not banked between Security states.

[10:9] - - Reserved, RES0
Contains the active exception number:
[8:0] VECTACTIVE(1) RO
0 Thread mode.

PM0264 - Rev 2 page 183/232

 PM0264
System Control Block

Bits Name type Function

The exception number(1) of the
1
currently active exception.

Note:
Subtract 16 from this value to obtain the CMSIS
IRQ number required to index into the Interrupt Clear-
Enable, Set-Enable, Clear-Pending, Set-Pending, or
Priority Registers, see Section 2.1.3.6.2 Interrupt
Program Status Register.
This field is not banked between Security states.

1. This is the same value as IPSR bits[8:0], see Section 2.1.3.6.2 Interrupt Program Status Register

When you write to the ICSR, the effect is unpredictable if you:

• Write 1 to the PENDSVSET bit and write 1 to the PENDSVCLR bit.
• Write 1 to the PENDSTSET bit and write 1 to the PENDSTCLR bit.

4.3.6 Vector Table Offset Register

The VTOR indicates the offset of the vector table base address from memory address 00000000.
See Table 59. Summary of the system control block registers for the VTOR attributes.
This register is not banked between Security states.
The VTOR bit assignments are:
31 7 6 0

TBLOFF RES0

<See the configurable information after the register description table for information about the
configuration of the boundary between TBLOFF field and the [6:0] field that follows.>

Table 65. VTOR bit assignments

Bits Name Function

Vector table base offset field. It contains bits[29:7] of the offset of the table base from the bottom of the
[31:7] TBLOFF memory map.<See the configurable information after this table for information about the configuration of this
field and the [6:0] field that follows.>.
[6:0] - Reserved, res0.

When setting TBLOFF, you must align the offset to the number of exception entries in the vector table. <Configure
the next statement to give the information required for your implementation, the statement reminds you of how
to determine the alignment requirement.> The minimum alignment is 32 words, enough for up to 16 interrupts.
For more interrupts, adjust the alignment by rounding up to the next power of two. For example, if you require 21
interrupts, the alignment must be on a 64-word boundary because the required table size is 37 words, and the
next power of two is 64.
Note: Table alignment requirements mean that bits[6:0] of the table offset are always zero.

4.3.7 Application Interrupt and Reset Control Register

The AIRCR provides sets or returns interrupt control and reset configuration.
See Table 59. Summary of the system control block registers for the AIRCR attributes.
To write to this register, you must write 0x5FA to the VECTKEY field, otherwise the processor ignores the write.
This register is banked between Security states on a bit by bit basis.
The AIRCR bit assignments are:

PM0264 - Rev 2 page 184/232

 PM0264
System Control Block

31 16 15 14 13 12 11 10 8 7 4 3 2 1 0
Read: VECTKEYSTAT
RES0 RES0
Write: VECTKEY

ENDIANNESS
PRIS
BFHFNMINS
PRIGROUP
SYSRESETREQS
SYSRESETREQ
VECTCLRACTIVE
RES0

Table 66. AIRCR bit assignments without the Security Extension

Bits Name type Function

Register key:
Read: VECTKEYSTAT Reads as 0xFA05.
[31:16] RW
Write: VECTKEY On writes, write 0x5FA to VECTKEY,
otherwise the write is ignored.
Data endianness bit:
[15] ENDIANNESS RO
0 Little-endian.
[14] PRIS RAZ/WI -
[13] BFHFNMINS RAO/WI -
[12:11] - - Reserved, RES0
Interrupt priority grouping field. This field
determines the split of group priority from
[10:8] PRIGROUP RW
subpriority, see Section 4.3.7.1 Binary
point.
[7:4] - - Reserved, RES0
[3] SYSRESETREQS RAZ/WI -
[2] SYSRESETREQ RAZ/WI -
Reserved for Debug use. This bit reads
as 0. When writing to the register you
[1] VECTCLRACTIVE WO
must write 0 to this bit, otherwise behavior
is UNPREDICTABLE.
[0] - - Reserved, RES0

Table 67. AIRCR bit assignments with the Security Extension

Bits Name type Function

Register key:
Reads as 0xFA05.
Read: VECTKEYSTAT
[31:16] RW On writes, write 0x5FA to VECTKEY,
Write: VECTKEY otherwise the write is ignored.
This Field is not banked between Security
states.
Data endianness bit:
0 Little-endian.
[15] ENDIANNESS RO
This bit is not banked between Security
states.

PM0264 - Rev 2 page 185/232

 PM0264
System Control Block

Bits Name type Function

Prioritize Secure exceptions. The value of

this bit defines whether Secure exception
priority boosting is enabled.

RW from Secure Priority ranges of Secure and

state and RAZ/WI 0 Non-secure exceptions are
from Non-secure identical.
[14] PRIS
state.
Non-secure exceptions are
RAZ/WI 1
de-prioritized.

This bit is not banked between Security

states.
BusFault, HardFault, and NMI Non-
secure enable. The value of this
bit defines whether BusFault and
NMI exceptions are Non-secure, and
whether exceptions target the Non-secure
HardFault exception.
The possible values are:
RW from Secure-
state and RO from BusFault, HardFault, and NMI
0
[13] BFHFNMINS Non-secure state. are Secure.

RAO/WI
BusFault and NMI are Non-
1 secure and exceptions can
target Non-secure HardFault.

This bit resets to 0.

This bit is not banked between Security
states.
[12:11] - - Reserved, RES0
Interrupt priority grouping field. This field
determines the split of group priority from
subpriority, see Section 4.3.7.1 Binary
[10:8] PRIGROUP RW point.
This bit is banked between Security
states.
[7:4] - - Reserved, RES0
System reset request, Secure state only.
The value of this bit defines whether the
SYSRESETREQ bit is functional for Non-
secure use:
SYSRESETREQ functionality
RW from Secure 0 is available to both Security
State and RAZ/WI states.
[3] SYSRESETREQS from Non-secure
state. SYSRESETREQ functionality
RAZ/WI 1 is only available to Secure
state.

This bit resets to zero on a Warm reset.

This bit is not banked between Security
states.
System reset request. This bit allows
RW if software or a debugger to request a
[2] SYSRESETREQ SYSRESETREQS system reset:
is 0. Do not request a system
0
reset.

PM0264 - Rev 2 page 186/232

 PM0264
System Control Block

Bits Name type Function

When
SYSRESETREQS
is set to 1, from 1 Request a system reset.
Non-secure state
this bit acts as This bit is not banked between Security
RAZ/WI. states.
RAZ/WI
Reserved for Debug use. This bit reads
as 0. When writing to the register you
must write 0 to this bit, otherwise behavior
[1] VECTCLRACTIVE WO is UNPREDICTABLE.
This bit is not banked between Security
states.
[0] - - Reserved, RES0

4.3.7.1 Binary point

The PRIGROUP field indicates the position of the binary point that splits the PRI_n fields in the Interrupt Priority
Registers into separate group priority and subpriority fields.
The following table shows how the PRIGROUP value controls this split. <If you implement fewer than 8 priority
bits you might require more explanation here, and want to remove invalid rows from the table, and modify the
entries in the number of columns.>

Table 68. Priority grouping

Interrupt priority level value, PRI_n[7:0] Number of

PRIGROUP Binary point(1) Group priority bits Subpriority bits Group priorities Subpriorities

0b000 bxxxxxxx.y [7:1] [0] 128 2

0b001 bxxxxxx.yy [7:2] [1:0] 64 4
0b010 bxxxxx.yyy [7:3] [2:0] 32 8
0b011 bxxxx.yyyy [7:4] [3:0] 16 16
0b100 bxxx.yyyyy [7:5] [4:0] 8 32
0b101 bxx.yyyyyy [7:6] [5:0] 4 64
0b110 bx.yyyyyyy [7] [6:0] 2 128
0b111 b.yyyyyyyy None [7:0] 1 256

1. PRI_n[7:0] field showing the binary point. x denotes a group priority field bit, and y denotes a subpriority field bit.

Note: Determining pre-emption of an exception uses only the group priority field.

4.3.8 System Control Register

The SCR controls features of entry to and exit from low-power state.
See Section 4.3 System Control Block for the SCR attributes.
This register is banked between Security states on a bit by bit basis.
The bit assignments are:
31 5 4 3 2 1 0

RES0

SEVONPEND
SLEEPDEEPS
SLEEPDEEP
SLEEPONEXIT
RES0

PM0264 - Rev 2 page 187/232

 PM0264
System Control Block

Table 69. AIRCR bit assignments with the Security Extension

Bits Name Function

[31:5] - Reserved, RES0

Send Event on Pending bit:
Only enabled interrupts or events
0 can wakeup the processor, disabled
interrupts are excluded.

Enabled events and all interrupts,

1 including disabled interrupts, can
wakeup the processor.
[4] SEVONPEND
When an event or interrupt enters pending state,
the event signal wakes up the processor from
WFE. If the processor is not waiting for an event,
the event is registered and affects the next WFE.
The processor also wakes up on execution of an
SEV instruction or an external event.
This bit is banked between Security states.
Controls whether the SLEEPDEEP bit is only
accessible from the Secure state:
The SLEEPDEEP bit accessible
0
from both Security states.

The SLEEPDEEP bit behaves as

[3] SLEEPDEEPS 1 RAZ/WI when accessed from the
Non-secure state.

This bit in only accessible from the Secure state,

and behaves as RAZ/WI when accessed from the
Nonsecure state.
This bit is not banked between Security states.
Controls whether the processor uses sleep or deep
sleep as its low-power mode:
0 Sleep
[2] SLEEPDEEP
1 Deep sleep

This bit is not banked between Security states.

Indicates sleep-on-exit when returning from
Handler mode to Thread mode:
Do not sleep when returning to
0
Thread mode.

Enter sleep, or deep sleep, on return

[1] SLEEPONEXIT 1
from an ISR.

Setting this bit to 1 enables an interrupt driven

application to avoid returning to an empty main
application.
This bit is banked between Security states.
[0] - Reserved, RES0

4.3.9 Configuration and Control Register

The CCR is a read-only register and indicates some aspects of the behavior of the processor.
This register is banked between Security states on a bit by bit basis.

PM0264 - Rev 2 page 188/232

 PM0264
System Control Block

The bit assignments for CCR are:

31 19 18 17 16 15 11 10 9 8 7 5 4 3 2 1 0

RES0 RES0 RES0

BP
IC
DC
STKOFHFNMIGN
RES1
BFHFNMIGN
DIV_0_TRP
UNALIGN_TRP
RES0
USERSETMPEND
RES1

Table 70. CCR bit assignments with the Security Extension

Bits Name Function

[31:19] - Reserved, RES0

[18] BP RAZ/WI.
[17] IC RAZ/WI.
[16] DC RAZ/WI.
[15:11] - Reserved, RES0
Controls the effect of a stack limit violation while
executing at a requested priority less than 0.
0 Stack limit faults not ignored.
[10] STKOFHFNMIGN
Stack limit faults at requested
1
priorities of less than 0 ignored.

This bit is banked between Security states.

[9] - Reserved, RES0
Determines the effect of precise bus faults on
handlers running at a requested priority less than
0.
0 Precise bus faults are not ignored.
[8] BFHFNMIGN
Precise bus faults at requested
1
priorities of less than 0 are ignored.

This bit is not banked between Security states.

[7:5] - Reserved, RES0
Divide by zero trap. Controls the generation of
a DIVBYZERO UsageFault when attempting to
perform integer division by zero.
DIVBYZERO UsageFault generation
0
disabled.
[4] DIV_0_TRP

DIVBYZERO UsageFault generation

1
enabled.

This bit is banked between Security states.

Controls the trapping of unaligned word or halfword
[3] UNALIGN_TRP accesses.
0 Unaligned trapping disabled.

PM0264 - Rev 2 page 189/232

 PM0264
System Control Block

Bits Name Function

1 Unaligned trapping enabled.

This bit is banked between Security states.

[2] - Reserved, RES0
User set main pending. Determines whether
unprivileged accesses are permitted to pend
interrupts from the STIR.
Unprivileged accesses to the STIR
0
generate a fault.
[1] USERSETMPEND

Unprivileged accesses to the STIR

1
are permitted.

This bit is banked between Security states.

[0] - Reserved, RES1

4.3.10 System Handler Priority Registers

The SHPR1-SHPR3 registers set the priority level, 0 to 255 of the exception handlers that have configurable
priority. SHPR1-SHPR3 are byte accessible.
See Table 59. Summary of the system control block registers for the SHPR1-SHPR3 attributes.
These registers are banked between Security states on a bit field by bit field basis.
The system fault handlers and the priority field and register for each handler are:

Table 71. System fault handler priority fields

Handler Field Register description

MemManage PRI_4
BusFault PRI_5
Section 4.3.10.1 System Handler Priority Register 1
UsageFault PRI_6
SecureFault PRI_7
SVCall PRI_11 Section 4.3.10.2 System Handler Priority Register 2
PendSV PRI_14
Section 4.3.10.3 System Handler Priority Register 3
SysTick PRI_15

Each PRI_n field is 8 bits wide, but the processor implements only bits[7:M] of each field, and bits[M-1:0] read as
zero and ignore writes.

4.3.10.1 System Handler Priority Register 1

Bit assignments for the SHPR1 register.
31 24 23 16 15 8 7 0

PRI_7 PRI_6 PRI_5 PRI_4

Table 72. SHPR1 register bit assignments

Bits Name Function Security state

Priority of system handler 7,

SecureFault PRI_7 is RAZ/WI from Non-
[31:24] PRI_7
secure state.
Always RAZ/WI

PM0264 - Rev 2 page 190/232

 PM0264
System Control Block

Bits Name Function Security state

Priority of system handler 6, PRI_6 is banked between

[23:16] PRI_6
UsageFault Security states.
PRI_5 is RAZ/WI from
Priority of system handler 5,
[15:8] PRI_5 Non-secure state if
BusFault
AIRCR.BFHFNMINS is 0.
Priority of system handler 4, PRI_4 is banked between
[7:0] PRI_4
MemManage Security states.

4.3.10.2 System Handler Priority Register 2

Bit assignments for the SHPR2 register.
31 24 23 0

PRI_11 Reserved

Table 73. SHPR2 register bit assignments

Bits Name Function Security state

Priority of system handler 11, PRI_11 is banked between

[31:24] PRI_11
SVCall Security states.
[23:0] - Reserved -

4.3.10.3 System Handler Priority Register 3

Bit assignments for the SHPR3 register.
31 24 23 16 15 0

PRI_15 PRI_14 Reserved

Table 74. SHPR3 register bit assignments

Bits Name Function Security state

Priority of system handler 15, PRI_15 is banked between

[31:24] PRI_15
SysTick exception Security states.
Priority of system handler 14, PRI_14 is is banked between
[23:16] PRI_14
PendSV Security states.
[15:0] - Reserved -

4.3.11 System Handler Control and State Register

The SHCSR enables the system handlers. It indicates the pending status of the BusFault, MemManage fault, and
SVC exceptions, and indicates the active status of the system handlers.
See Table 59. Summary of the system control block registers for the SHCSR attributes.
This register is banked between Security states on a bit by bit basis.
The SHCSR bit assignments are:
31 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

RES0 (0) (0)

HARDFAULTPENDED MEMFAULTACT
SECUREFAULTPENDED BUSFAULTACT
SECUREFAULTENA HARDFAULTACT
USGFAULTENA USGFAULTACT
BUSFAULTENA SECUREFAULTACT
MEMFAULTENA NMIACT
SVCALLPENDED SVCALLACT
BUSFAULTPENDED MONITORACT
MEMFAULTPENDED PENDSVACT
USGFAULTPENDED SYSTICKACT

PM0264 - Rev 2 page 191/232

 PM0264
System Control Block

Table 75. CCR bit assignments with the Security Extension

Bits Name Function

[31:22] - Reserved, RES0

[21] BP RAZ/WI.
[20] IC RAZ/WI.
[19] DC RAZ/WI.
[18] - Reserved, RES0
Controls the effect of a stack limit violation while
executing at a requested priority less than 0.
0 Stack limit faults not ignored.
[10] STKOFHFNMIGN
Stack limit faults at requested
1
priorities of less than 0 ignored.

This bit is banked between Security states.

[9] - Reserved, RES0
Determines the effect of precise bus faults on
handlers running at a requested priority less than
0.
0 Precise bus faults are not ignored.
[8] BFHFNMIGN
Precise bus faults at requested
1
priorities of less than 0 are ignored.

This bit is not banked between Security states.

[7:5] - Reserved, RES0
Divide by zero trap. Controls the generation of
a DIVBYZERO UsageFault when attempting to
perform integer division by zero.
DIVBYZERO UsageFault generation
0
disabled.
[4] DIV_0_TRP

DIVBYZERO UsageFault generation

1
enabled.

This bit is banked between Security states.

Controls the trapping of unaligned word or halfword
accesses.
0 Unaligned trapping disabled.
[3] UNALIGN_TRP
1 Unaligned trapping enabled.

This bit is banked between Security states.

[2] - Reserved, RES0
User set main pending. Determines whether
unprivileged accesses are permitted to pend
interrupts from the STIR.
Unprivileged accesses to the STIR
0
generate a fault.
[1] USERSETMPEND

Unprivileged accesses to the STIR

1
are permitted.

This bit is banked between Security states.

PM0264 - Rev 2 page 192/232

 PM0264
System Control Block

Bits Name Function

[0] - Reserved, RES1

If you disable a system handler and the corresponding fault occurs, the processor treats the fault as a hard fault.
You can write to this register to change the pending or active status of system exceptions. An OS kernel can write
to the active bits to perform a context switch that changes the current exception type.
Caution: • Software that changes the value of an active bit in this register without correct adjustment to the stacked
content can cause the processor to generate a fault exception. Ensure software that writes to this register
retains and t restores the current active status.
• After you have enabled the system handlers, if you have to change the value of a bit in this register you
must use a read-modify-write procedure. Using a read-modify-write procedure ensures that you change
only the required bit.

4.3.12 Configurable Fault Status Register

The CFSR indicates the cause of a MemManage fault, BusFault, or UsageFault.
See Table 59. Summary of the system control block registers for the CFSR attributes.
This register is banked between Security states on a bit by bit basis.
The CFSR bit assignments are:
31 16 15 8 7 0
Bus Fault Status Memory Management
Usage Fault Status Register
Register Fault Status Register

UFSR BFSR MMFSR

The CFSR is byte accessible. You can access the CFSR or its subregisters as follows:
• Access the complete CFSR with a word access to 0xE000ED28.
• Access the MMFSR with a byte access to 0xE000ED28.
• Access the MMFSR and BFSR with a halfword access to 0xE000ED28.
• Access the BFSR with a byte access to 0xE000ED29.
• Access the UFSR with a halfword access to 0xE000ED2A.

4.3.12.1 MemManage Fault Status Register

The MMFSR is a subregister of the CFSR. The flags in the MMFSR indicate the cause of memory access faults.
In an implementation with the Security Extension, this field is banked between Security states.
The bit assignments are:
7 6 5 4 3 2 1 0

MMARVALID IACCVIOL
RES0 DACCVIOL
MLSPERR RES0
MSTKERR MUNSTKERR

Table 76. MMFSR bit assignments

Bits Name Function

MemManage Fault Address Register (MMFAR) valid flag:

0 Value in MMFAR is not a valid fault address.
1 MMFAR holds a valid fault address.
[7] MMARVALID

If a MemManage fault occurs and is escalated to a HardFault because of priority, the HardFault handler
must set this bit to 0. This prevents problems on return to a stacked active MemManage fault handler
whose MMFAR value has been overwritten.

PM0264 - Rev 2 page 193/232

 PM0264
System Control Block

Bits Name Function

[6] - Reserved, res0.

0 No MemManage fault occurred during floating-point lazy state preservation.
[5] MLSPERR
1 A MemManage fault occurred during floating-point lazy state preservation.
MemManage fault on stacking for exception entry:
0 No stacking fault.
[4] MSTKERR 1 Stacking for an exception entry has caused one or more access violations.

When this bit is 1, the SP is still adjusted but the values in the context area on the stack might be
incorrect. The processor has not written a fault address to the MMFAR.
MemManage fault on unstacking for a return from exception:
0 No unstacking fault.
1 Unstack for an exception return has caused one or more access violations.
[3] MUNSTKERR

This fault is chained to the handler. This means that when this bit is 1, the original return stack is still
present. The processor has not adjusted the SP from the failing return, and has not performed a new
save. The processor has not written a fault address to the MMFAR.
[2] - Reserved, res0.
Data access violation flag:
0 No data access violation fault.
The processor attempted a load or store at a location that does not permit
[1] DACCVIOL 1
the operation.

When this bit is 1, the PC value stacked for the exception return points to the faulting instruction. The
processor has loaded the MMFAR with the address of the attempted access.
Instruction access violation flag:
0 No instruction access violation fault.
The processor attempted an instruction fetch from a location that does not
1
[0] IACCVIOL permit execution.

This fault occurs on any access to an XN region, even when the MPU is disabled.
When this bit is 1, the PC value stacked for the exception return points to the faulting instruction. The
processor has not written a fault address to the MMFAR.

Note: The MMFSR bits are sticky. This means as one or more fault occurs, the associated bits are set to 1. A bit that is
set to 1 is cleared to 0 only by writing 1 to that bit, or by a reset.

4.3.12.2 BusFault Status Register

The BFSR is a subregister of the CFSR. The flags in the BFSR indicate the cause of a bus access fault.
This field is not banked between Security states.
The bit assignments are:
7 6 5 4 3 2 1 0

BFARVALID IBUSERR
RES0 PRECISERR
LSPERR RES0
STKERR UNSTKERR

PM0264 - Rev 2 page 194/232

 PM0264
System Control Block

Table 77. BFSR bit assignments

Bits Name Function

BusFault Address Register (BFAR) valid flag:

0 Value in BFAR is not a valid fault address.
1 BFAR holds a valid fault address.

[7] BFARVALID
The processor sets this bit to 1 after a BusFault where the address is known. Other faults can set this bit
to 0, such as a MemManage fault occurring later.
If a BusFault occurs and is escalated to a hard fault because of priority, the hard fault handler must set
this bit to 0. This prevents problems if returning to a stacked active BusFault handler whose BFAR value
has been overwritten.
[6] - Reserved, res0.
0 No bus fault occurred during floating-point lazy state preservation.
[5] LSPERR
1 A bus fault occurred during floating-point lazy state preservation.
BusFault on stacking for exception entry:
0 No stacking fault.
[4] STKERR 1 Stacking for an exception entry has caused one or more BusFaults.

When the processor sets this bit to 1, the SP is still adjusted but the values in the context area on the
stack might be incorrect. The processor does not write a fault address to the BFAR.
BusFault on unstacking for a return from exception:
0 No unstacking fault.
1 Unstack for an exception return has caused one or more BusFaults.
[3] UNSTKERR

This fault is chained to the handler. This means that when the processor sets this bit to 1, the original
return stack is still present. The processor does not adjust the SP from the failing return, does not
performed a new save, and does not write a fault address to the BFAR.
[2] - Reserved, res0.
Precise data bus error:
0 No precise data bus error.
[1] PRECISERR A data bus error has occurred, and the PC value stacked for the exception
1
return points to the instruction that caused the fault.

When the processor sets this bit to 1, it writes the faulting address to the BFAR.
Instruction bus error:
0 No instruction bus error.
1 Instruction bus error.
[0] IBUSERR
The processor detects the instruction bus error on prefetching an instruction, but it sets the IBUSERR
flag to 1 only if it attempts to issue the faulting instruction.
When the processor sets this bit to 1, it does not write a fault address to the BFAR.

Note: The BFSR bits are sticky. This means as one or more fault occurs, the associated bits are set to 1. A bit that is
set to 1 is cleared to 0 only by writing 1 to that bit, or by a reset.

4.3.12.3 UsageFault Status Register

The UFSR is a subregister of the CFSR. The UFSR indicates the cause of a UsageFault.
In an implementation with the Security Extension, this field is banked between Security states.
The bit assignments are:

PM0264 - Rev 2 page 195/232

 PM0264
System Control Block

15 10 9 8 7 5 4 3 2 1 0

RES0 RES0

DIVBYZERO
UNALIGNED
STKOF
NOCP
INVPC
INVSTATE
UNDEFINSTR

Table 78. UFSR bit assignments

Bits Name Function

[15:10] - Reserved, res0.

Divide by zero flag. Sticky flag indicating whether an integer division by zero error has occurred. The
possible values of this bit are:
0 Error has not occurred.
[9] DIVBYZERO
1 Error has occurred.

This bit resets to zero.

Unaligned access flag. Sticky flag indicating whether an unaligned access error has occurred. The
possible values of this bit are:
0 Error has not occurred.
[8] UNALIGNED
1 Error has occurred.

This bit resets to zero.

[7:5] - Reserved, res0.
Stack overflow flag. Sticky flag indicating whether a stack overflow error has occurred. The possible
values of this bit are:
0 Error has not occurred.
[4] STKOF
1 Error has occurred.

This bit resets to zero.

No coprocessor flag. Sticky flag indicating whether a coprocessor disabled or not present error has
occurred. The possible values of this bit are:
0 Error has not occurred.
[3] NOCP
1 Error has occurred.

This bit resets to zero.

Invalid PC flag. Sticky flag indicating whether an integrity check error has occurred. The possible
values of this bit are:
0 Error has not occurred.
[2] INVPC
1 Error has occurred.

This bit resets to zero.

Invalid state flag. Sticky flag indicating whether an EPSR.T or EPSR.IT validity error has occurred.
The possible values of this bit are:
0 Error has not occurred.
[1] INVSTATE
1 Error has occurred.

This bit resets to zero.

Undefined instruction flag. Sticky flag indicating whether an undefined instruction error has occurred.
[0] UNDEFINSTR
The possible values of this bit are:

PM0264 - Rev 2 page 196/232

 PM0264
System Control Block

Bits Name Function

0 Error has not occurred.
1 Error has occurred.

This bit resets to zero.

Note: All the bits are sticky. This means as one or more fault occurs, the associated bits are set to 1. A bit that is set to
1 is cleared to 0 only by writing 1 to that bit, or by a reset.

4.3.13 HardFault Status Register

The HFSR gives information about events that activate the HardFault handler. The HFSR register is read, write to
clear. This means that bits in the register read normally, but writing 1 to any bit clears that bit to 0.
See Section 4.3 System Control Block for the HFSR attributes.
This register is not banked between Security states.
The HFSR bit assignments are:

31 30 29 2 1 0

RES0

FORCED VECTTBL
DEBUGEVT RES0

Table 79. HFSR bit assignments

Bits Name Function

Reserved for Debug use. When writing to the register you must write 1 to this bit, otherwise behavior is
[31] DEBUGEVT
unpredictable. If AIRCR.BFHFNMINS is zero this field is RAZ/WI from Non-secure state.
Indicates a forced HardFault, generated by escalation of a fault with configurable priority that cannot be
handled, either because of priority or because it is disabled:
0 No forced HardFault.
[30] FORCED
1 Forced HardFault.

When this bit is set to 1, the HardFault handler must read the other fault status registers to find the
cause of the fault. If AIRCR.BFHFNMINS is zero this field is RAZ/WI from Non-secure state.
[29:2] - Reserved, res0.
Indicates a HardFault on a vector table read during exception processing:
0 No HardFault on vector table read.
1 HardFault on vector table read.
[1] VECTTBL
This error is always handled by the HardFault handler.
When this bit is set to 1, the PC value stacked for the exception return points to the instruction that was
pre-empted by the exception. If AIRCR.BFHFNMINS is zero this field is RAZ/WI from Non-secure state.
[0] - Reserved, res0.

Note: The HFSR bits are sticky. This means as one or more fault occurs, the associated bits are set to 1. A bit that is
set to 1 is cleared to 0 only by writing 1 to that bit, or by a reset.

4.3.14 MemManage Fault Address Register

The MMFAR contains the address of the location that generated a MemManage fault.
See Table 59. Summary of the system control block registers for the MMFAR attributes.

PM0264 - Rev 2 page 197/232

 PM0264
System timer, SysTick

This register is banked between Security states.

The MMFAR bit assignments are:

Table 80. MMFAR bit assignments

Bits Name Function

When the MMARVALID bit of the MMFSR is set to 1, this field holds the address of the location that
[31:0] ADDRESS
generated the MemManage fault

When an unaligned access faults, the address is the actual address that faulted. Because a single read or write
instruction can be split into multiple aligned accesses, the fault address can be any address in the range of the
requested access size.
Flags in the MMFSR indicate the cause of the fault, and whether the value in the MMFAR is valid.

4.3.15 BusFault Address Register

The BFAR contains the address of the location that generated a BusFault.
See Table 59. Summary of the system control block registers for the BFAR attributes.
This field is not banked between Security states.
The BFAR bit assignments are:

Table 81. BFAR bit assignments

Bits Name Function

When the BFARVALID bit of the BFSR is set to 1, this field holds the address of the location that
[31:0] ADDRESS
generated the BusFault

When an unaligned access faults the address in the BFAR is the one requested by the instruction, even if it is not
the address of the fault.
Flags in the BFSR indicate the cause of the fault, and whether the value in the BFAR is valid.

4.3.16 System control block design hints and tips

Ensure software uses aligned accesses of the correct size to access the system control block registers:
• Except for the CFSR and SHPR1-SHPR3, it must use aligned word accesses.
• For the CFSR and SHPR1-SHPR3 it can use byte or aligned halfword or word accesses.
In a fault handler, to determine the true faulting address:
1. Read and save the MMFAR or BFAR value.
2. Read the MMARVALID bit in the MMFSR, or the BFARVALID bit in the BFSR. The MMFAR or BFAR
address is valid only if this bit is 1.
Software must follow this sequence because another higher priority exception might change the MMFAR or BFAR
value. For example, if a higher priority handler pre-empts the current fault handler, the other fault might change
the MMFAR or BFAR value.
In addition, the CMSIS provides a number of functions for system control, including:

Table 82. CMSIS function for system control

CMSIS system control function Description

void NVIC_SystemReset (void) Reset the system

4.4 System timer, SysTick

The processor has a 24-bit system timer, SysTick. In a implementation with Security Extension, there are two
24-bit system timers, a Non-secure SysTick timer and a Secure SysTick timer. In an implementation without the
Security Extension, only a single 24-bit system timer, SysTick is used.

PM0264 - Rev 2 page 198/232

 PM0264
System timer, SysTick

When enabled, each timer counts down from the reload value to zero, reloads (wraps to) the value in the
SYST_RVR on the next clock cycle, then decrements on subsequent clock cycles. Writing a value of zero to the
SYST_RVR disables the counter on the next wrap. When the counter transitions to zero, the COUNTFLAG status
bit is set to 1. Reading SYST_CSR clears the COUNTFLAG bit to 0. Writing to the SYST_CVR clears the register
and the COUNTFLAG status bit to 0. The write does not trigger the SysTick exception logic. Reading the register
returns its value at the time it is accessed.
Note: When the processor is halted for debugging, the counter does not decrement.
The system timer registers are:

Table 83. System timer registers summary

Address Name Type Reset value Description

E000E010 SYST_CSR RW 00000000 Section 4.4.1 SysTick Control and Status Register.
E000E014 SYST_RVR RW UNKNOWN Section 4.4.2 SysTick Reload Value Register.
E000E018 SYST_CVR RW UNKNOWN Section 4.4.3 SysTick Current Value Register.
C0000000
E000E01C SYST_CALIB RO Section 4.4.4 SysTick Calibration Value Register.
(SysTick calibration value) 

4.4.1 SysTick Control and Status Register

The SYST_CSR controls and provides status date for the SysTick timer.
See Section 4.4 System timer, SysTick for the SYST_CSR attributes.
This register is banked between Security states.
The bit assignments for SYST_CSR are:
31 17 16 15 3 2 1 0

RES0 RES0

COUNTFLAG CLKSOURCE
TICKINT
ENABLE

Table 84. SYST_CSR bit assignments

Bits Name Function

[31:17] - Reserved, res0.

[16] COUNTFLAG Returns 1 if timer counted to 0 since the last read of this register.
[15:3] - Reserved, res0.
Selects the SysTick timer clock source:
[2] CLKSOURCE 0 External reference clock.
1 Processor clock.
Enables SysTick exception request:
[1] TICKINT 0 Counting down to zero does not assert the SysTick exception request.
1 Counting down to zero asserts the SysTick exception request.
Enables the counter:
[0] ENABLE 0 Counter disabled.
1 Counter enabled.

4.4.2 SysTick Reload Value Register

The SYST_RVR specifies the SysTick timer counter reload value.
See Section 4.4 System timer, SysTick for the SYST_RVR attributes.

PM0264 - Rev 2 page 199/232

 PM0264
System timer, SysTick

This register is banked between Security states.

The bit assignments for SYST_RVR are:
31 24 23 0

RES0 RELOAD

Table 85. SYST_RVR bit assignments

Bits Name Function

[31:24] - Reserved, res0.

Value to load into the SYST_CVR when the counter is enabled and when it reaches 0, see
[23:0] RELOAD
Section 4.4.2.1 Calculating the RELOAD value.

4.4.2.1 Calculating the RELOAD value

The SYST_RVR specifies the SysTick timer counter reload value.
The RELOAD value can be any value in the range 0x00000001-0x00FFFFFF. You can program a value of 0, but
this has no effect because the SysTick exception request and COUNTFLAG are activated when counting from 1
to 0.
To generate a multi-shot timer with a period of N processor clock cycles, use a RELOAD value of N-1. For
example, if the SysTick interrupt is required every 100 clock pulses, set RELOAD to 99.

4.4.3 SysTick Current Value Register

The SYST_CVR contains the current value of the SysTick counter.
See Section 4.4 System timer, SysTick for the SYST_CVR attributes.
This register is banked between Security states.
The bit assignments for SYST_CVR:
31 24 23 0

RES0 CURRENT

Table 86. SYST_CVR bit assignments

Bits Name Function

[31:24] - Reserved, res0.

Reads the current value of the SysTick counter.
[23:0] CURRENT
A write of any value clears the field to 0, and also clears the SYST_CSR.COUNTFLAG bit to 0.

4.4.4 SysTick Calibration Value Register

The SYST_CALIB register indicates the SysTick calibration value and parameters for the selected Security state.
See Section 4.4 System timer, SysTick for the SYST_CALIB attributes.
This register is banked between Security states.
The bit assignments for SYST_CALIB_S, SYST_CALIB_NS, and SYST_CALIB are:

31 30 29 24 23 0

RES0 TENMS

SKEW
NOREF

PM0264 - Rev 2 page 200/232

 PM0264
Security Attribution and Memory Protection

Table 87. SYST_CALIB register bit assignments

Bits Name Function

[31] NOREF Reads as one. Indicates that no separate reference clock is provided.
Reads as one. Calibration value for the 10ms inexact timing is not known because TENMS is not known.
[30] SKEW
This can affect the suitability of SysTick as a software real-time clock.
[29:24] - Reserved, res0.
[23:0] TENMS Reads as zero. Indicates that calibration value is not known.

If calibration information is not known, calculate the calibration value required from the frequency of the core clock
or external clock.

4.4.5 SysTick usage hints and tips

The interrupt controller clock updates the SysTick counter. If this clock signal is stopped for low-power mode, the
SysTick counter stops.
Ensure software uses word accesses to access the SysTick registers.
If the SysTick counter reload and current value are undefined at reset, the correct initialization sequence for the
SysTick counter is:
1. Program reload value.
2. Clear current value.
3. Program Control and Status register.

4.5 Security Attribution and Memory Protection

The processor has an Security Attribution Unit (SAU) and a Memory Protection Unit (MPU) that provide fine grain
memory control, enabling applications to use multiple privilege levels, separating and protecting code, data, and
stack on a task-by-task basis. Such requirements are becoming critical in many embedded applications such as
automotive systems.

4.5.1 Security Attribution Unit

The SAU determines the security of an address.
For instructions, the SAU returns the security attribute (Secure or Non-secure) and identifies whether the
instruction address is in a Non-secure callable region.
For data, the SAU returns the security attribute (Secure or Non-secure).
When a memory access is performed, the security of the address is verified by the SAU. Any address that
matches multiple SAU regions will be marked with the most secure attribute of the matching regions.
The following table shows a summary of the SAU registers.

Table 88. SAU registers summary

Address Name Type Reset value Description

See Section 4.5.2 Security Attribution Unit Control Register. This is

0xE000EDD0 SAU_CTRL RW 00000000 the reset value in Secure state. In Non-secure state, this register is
RAZ/WI.
See Section 4.5.3 Security Attribution Unit Type Register. This is
0xE000EDD4 SAU_TYPE RO 00000000 the reset value in Secure state. In Non-secure state, this register is
RAZ/WI. SAU_TYPE [7:0] reflects the number of SAU regions.
See Section 4.5.4 Security Attribution Unit Region Number Register.
0xE000EDD8 SAU_RNR RW UNKNOWN
In Non-secure state, this register is RAZ/WI.
See Section 4.5.5 Security Attribution Unit Region Base Address
0xE000EDDC SAU_RBAR RW UNKNOWN
Register. In Non-secure state, this register is RAZ/WI.
See Section 4.5.6 Security Attribution Unit Region Limit Address
0xE000EDE0 SAU_RLAR RW Bit[0] resets to 0. Register. This is the reset value in Secure state. In Non-secure state,
this register is RAZ/WI.

PM0264 - Rev 2 page 201/232

 PM0264
Security Attribution and Memory Protection

Address Name Type Reset value Description

Other bits reset
to an UNKNOWN
value.
See Section 4.5.7 Secure Fault Status Register. In Non-secure
0xE000EDE4 SFSR RW 00000000
state, this register is RAZ/WI.
See Section 4.5.8 Secure Fault Address Register. In Non-secure
0xE000EDE8 SFAR RW UNKNOWN
state, this register is RAZ/WI.

Note: • Only Privileged accesses to the SAU registers are permitted. Unprivileged accesses generate a fault.
• The SAU registers are word accessible only. Halfword and byte accesses are UNPREDICTABLE.
• The SAU registers are RAZ/WI when accessed from Non-secure state.
• The SAU registers are not banked between Security states.

4.5.2 Security Attribution Unit Control Register

The SAU_CTRL allows enabling of the Security Attribution Unit.
This register is RAZ/WI when accessed as Non-secure. This register is not banked between Security states.
The SAU_CTRL bit assignments are:

31 2 1 0

RES0

ALLNS
ENABLE

Table 89. SAU_CTRL bit assignments

Bits Name Function

[31:2] - Reserved, res0.

All Non-secure. When SAU_CTRL.ENABLE is 0 this bit controls if the memory is marked as Non-secure or
Secure.
The possible values of this bit are:
0 Memory is marked as Secure and is not Non-secure callable.
[1] ALLNS
1 Memory is marked as Non-secure.

This bit has no effect when SAU_ENABLE is 1.

Setting SAU_CTRL.ALLNS to 1 allows the security attribution of all addresses to be set by the IDAU in the
system.
Enable. Enables the SAU.
The possible values of this bit are:

[0] ENABLE 0 The SAU is disabled.

1 The SAU is enabled.

This bit is RAZ/WI when the Security Extension is implemented without an SAU region.

4.5.3 Security Attribution Unit Type Register

The SAU_TYPE indicates the number of regions implemented by the Security Attribution Unit.
This register is RAZ/WI when accessed as Non-secure. This register is not banked between Security states.
The SAU_TYPE bit assignments are:

PM0264 - Rev 2 page 202/232

 PM0264
Security Attribution and Memory Protection

31 87 0

RES0 SREGION

Table 90. SAU_TYPE bit assignments

Bits Name Function

[31:8] - Reserved, res0.

[7:0] SREGION SAU regions. The number of implemented SAU regions.

4.5.4 Security Attribution Unit Region Number Register

The SAU_RNR selects the region currently accessed by SAU_RBAR and SAU_RLAR.
This register is RAZ/WI when accessed as Non-secure. This register is not banked between Security states.
The SAU_RNR bit assignments are:

31 87 0

RES0 REGION

Table 91. SAU_RNR bit assignments

Bits Name Function

[31:8] - Reserved, res0.

Region number. Indicates the SAU region accessed by SAU_RBAR and SAU_RLAR.
If no SAU regions are implemented, this field is reserved. Writing a value corresponding to an
[7:0] REGION
unimplemented region is CONSTRAINED UNPREDICTABLE.
This field resets to an UNKNOWN value on a Warm reset.

4.5.5 Security Attribution Unit Region Base Address Register

The SAU_RBAR provides indirect read and write access to the base address of the currently selected SAU
region.
This register is RAZ/WI when accessed as Non-secure. This register is not banked between Security states.
The SAU_RBAR bit assignments are:

31 5 4 0

BADDR Reserved

Table 92. SAU_RBAR bit assignments

Bits Name Function

Base address. Holds bits[31:5] of the base address for the selected SAU region.
[31:5] BADDR
Bits[4:0] of the base address are defined as 0x00.
[4:0] - Reserved, res0.

4.5.6 Security Attribution Unit Region Limit Address Register

The SAU_RLAR provides indirect read and write access to the limit address of the currently selected SAU region.
This register is RAZ/WI when accessed as Non-secure. This register is not banked between Security states.
The SAU_RLAR bit assignments are:

PM0264 - Rev 2 page 203/232

 PM0264
Security Attribution and Memory Protection

31 5 4 2 1 0

LADDR

RES0
NSC
ENABLE

Table 93. SAU_RLAR bit assignments

Bits Name Function

Limit address. Holds bits[31:5] of the limit address for the selected SAU region.
[31:5] LADDR
Bits[4:0] of the limit address are defined as 0x1F.
[4:2] - Reserved, res0.
Non-secure callable. Controls whether Non-secure state is permitted to execute an SG instruction from this
region.

[1] NSC The possible values of this bit are:

0 Region is not Non-secure callable.
1 Region is Non-secure callable.
Enable. SAU region enable.
The possible values of this bit are:

[0] ENABLE 0 SAU region is enabled.

1 SAU region is disabled.

This bit reset to 0 on a Warm reset.

4.5.7 Secure Fault Status Register

The SFSR provides information about any security related faults.
This register is RAZ/WI when accessed as Non-secure. This register is not banked between Security states.
See Table 59. Summary of the system control block registers for the SFSR attributes.
The SFSR bit assignments are:

31 8 7 6 5 4 3 2 1 0

RES0

LSERR
SFARVALID
LSPERR
INVTRAN
AUVIOL
INVER
INVIS
INVEP

Table 94. SFSR bit assignments

Bits Name Function

[31:8] - Reserved, res0.

Lazy state error flag. Sticky flag indicating that an error occurred during lazy state activation or
deactivation. The possible values of this bit are:
[7] LSERR
0 Error has not occurred.
1 Error has occurred.

PM0264 - Rev 2 page 204/232

 PM0264
Security Attribution and Memory Protection

Bits Name Function

Secure fault address valid. This bit is set when the SFAR register contains a valid value. As with
similar fields, such as BFSR.BFARVALID and MMFSR.MMARVALID, this bit can be cleared by other
exceptions, such as BusFault. The possible values of this bit are:
[6] SFARVALID
0 SFAR content not valid.
1 SFAR content valid.
Lazy state preservation error flag. Stick flag indicating that an SAU or IDAU violation occurred during the
lazy preservation of floating-point state. The possible values of this bit are:
[5] LSPERR
0 Error has not occurred.
1 Error has occurred.
Invalid transition flag. Sticky flag indicating that an exception was raised due to a branch that was not
flagged as being domain crossing causing a transition from Secure to Non-secure memory. The possible
values of this bit are:
[4] INVTRAN
0 Error has not occurred.
1 Error has occurred.
Attribution unit violation flag. Sticky flag indicating that an attempt was made to access parts of the
address space that are marked as Secure with NS-Req for the transaction set to Non-secure. This bit is
not set if the violation occurred during:
• Lazy state preservation, see LSPERR.
[3] AUVIOL • Vector fetches.
The possible values of this bit are:
0 Error has not occurred.
1 Error has occurred.
Invalid exception return flag. This can be caused by EXC_RETURN.DCRS being set to 0 when returning
from an exception in the Non-secure state, or by EXC_RETURN.ES being set to 1 when returning from
an exception in the Non-secure state. The possible values of this bit are:
[2] INVER
0 Error has not occurred.
1 Error has occurred.
Invalid integrity signature flag. This bit is set if the integrity signature in an exception stack frame is found
to be invalid during the unstacking operation. The possible values of this bit are:
[1] INVIS
0 Error has not occurred.
1 Error has occurred.
Invalid entry point. This bit is set if a function call from the Non-secure state or exception targets a
non-SG instruction in the Secure state. This bit is also set if the target address is an SG instruction, but
there is no matching SAU/IDAU region with the NSC flag set. The possible values of this bit are:
[0] INVEP
0 Error has not occurred.
1 Error has occurred.

4.5.8 Secure Fault Address Register

The SFSR shows the address of the memory location that caused a security violation.
This register is RAZ/WI when accessed as Non-secure. This register is not banked between Security states.
The SFAR bit assignments are:
31 0

ADDRESS

PM0264 - Rev 2 page 205/232

 PM0264
Security Attribution and Memory Protection

Table 95. SFAR bit assignments

Bits Name Function

When the SFARVALID bit of the SFSR is set to 1, this field holds the address of an access that caused an
[31:0] ADDRESS
SAU violation.

4.5.9 Memory Protection Unit

The MPU is divided into eight regions and defines the location, size, access permissions, and memory attributes
of each region.
The MPU supports:
• Independent attribute settings for each region.
• Export of memory attributes to the system.
If the processor implements the Security Extension, it contains:
• One optional Secure MPU.
• One optional Non-secure MPU.
When memory regions overlap, the processor generates a fault if a core access hits the overlapping regions.
The MPU memory map is unified. This means instruction accesses and data accesses have the same region
settings.
If a program accesses a memory location that is prohibited by the MPU, the processor generates a MemManage
exception.
In an OS environment, the kernel can update the MPU region setting dynamically based on the process to be
executed. Typically, an embedded OS uses the MPU for memory protection.
Configuration of MPU regions is based on memory types, see Section 2.3.2 Memory regions, types, and
attributes.
The following table shows the possible MPU region attributes. These include Shareability and cache behavior
attributes that are not relevant to most microcontroller implementations.
See Section 4.5.20.1 MPU configuration for a microcontroller for guidelines for programming such an
implementation.

Table 96. Memory attributes summary

Memory type Shareability Other attributes Description

Used to access memory mapped peripherals.All accesses to

Device-nGnRnE Shareable - Device-nGnRnE memory occur in program order. All regions are
assumed to be shared.
Used to access memory mapped peripherals.Weaker ordering
Device-nGnRE Shareable -
than Device-nGnRnE.
Used to access memory mapped peripherals.Weaker ordering
Device-nGRE Shareable -
than Device-nGnRE.
Used to access memory mapped peripherals.Weaker ordering
Device-GRE Shareable -
than Device-nGRE.
Non-cacheable Write-
Normal Shareable Through Cacheable Normal memory that is shared between several processors.
Write-Back Cacheable
Non-cacheable Write-
Normal Non-Shareable Through Cacheable Normal memory that only a single processor uses.
Write-Back Cacheable

Use the MPU registers to define the MPU regions and their attributes.
The following table shows a summary of the MPU registers.

PM0264 - Rev 2 page 206/232

 PM0264
Security Attribution and Memory Protection

Table 97. MPU registers summary

Address Name Type Reset Value Description

The reset value is fixed

and depends on the
E000ED90 MPU_TYPE RO See Section 4.5.10 MPU Type Register.
value of bits[15:8] and
implementation options.
E000ED94 MPU_CTRL RW 00000000 See Section 4.5.11 MPU Control Register.
E000ED98 MPU_RNR RW UNKNOWN See Section 4.5.12 MPU Region Number Register.
See Section 4.5.13 MPU Region Base Address
E000ED9C MPU_RBAR RW UNKNOWN
Register.
See Section 4.5.15 MPU Region Limit Address
E000EDA0 MPU_RLAR RW UNKNOWN
Register.
See Section 4.5.14 MPU Region Base Address
E000EDA4 MPU_RBAR_A<n> RW UNKNOWN
Register Alias, n=1-3
See Section 4.5.16 MPU Region Limit Address
E000EDA8 MPU_RLAR_A<n> RW UNKNOWN
Register Alias, n=1-3.
E000EDC0 MPU_MAIR0 RW UNKNOWN See Section 4.5.17 MPU Memory Attribute Indirection
E000EDC4 MPU_MAIR1 RW UNKNOWN Registers 0 and 1.

4.5.10 MPU Type Register

The MPU_TYPE register indicates whether the MPU is present, and if so, how many regions it supports.
This register is banked between Security states.
In an implementation with the Security Extension, this register is banked between Security states.
The MPU_TYPE bit assignments are:
31 16 15 8 7 1 0

RES0 DREGION RES0

SEPARATE

Table 98. MPU_TYPE bit assignments

Bits Name Function

[31:16] - Reserved, res0.

Data regions. Number of regions supported by the MPU.
00 Zero regions if your device does not include the MPU.
[15:8] DREGION
Eight regions if your device includes the MPU. This value is implementation
08
defined.
[7:1] - Reserved, res0.
Indicates support for unified or separate instructions and data address regions.
[0] SEPARATE Armv8‑M only supports unified MPU regions.
0 Unified.

4.5.11 MPU Control Register

The MPU_CTRL register enables the MPU.
When the MPU is enabled, it controls whether the default memory map is enabled as a background region for
privileged accesses and whether the MPU is enabled for HardFaults, and NMIs.
This register is banked between Security states.
In an implementation with the Security Extension, this register is banked between Security states.
The MPU_CTRL bit assignments are:

PM0264 - Rev 2 page 207/232

 PM0264
Security Attribution and Memory Protection

31 3 2 1 0

RES0

PRIVDEFENA
HFNMIENA
ENABLE

Table 99. MPU_CTRL bit assignments

Bits Name Function

[31:3] - Reserved, res0.

Enables privileged software access to the default memory map.
When the MPU is enabled:
Disables use of the default memory map. Any memory access to a location
0
that is not covered by any enabled region causes a fault.
[2] PRIVDEFENA
Enables use of the default memory map as a background region for
1
privileged software accesses.

When enabled, the background region acts as if it has the lowest priority. Any region that is defined
and enabled has priority over this default map. If the MPU is disabled, the processor ignores this bit.
Enables the operation of MPU during HardFault and NMI handlers.
When the MPU is enabled:
MPU is disabled during HardFault and NMI handlers, regardless of the
[1] HFNMIENA 0
value of the ENABLE bit.
1 The MPU is enabled during HardFault and NMI handlers.

When the MPU is disabled, if this bit is set to 1 the behavior is UNPREDICTABLE.
Enables the MPU:
[0] ENABLE 0 MPU is disabled.
1 MPU is enabled.

XN and Device-nGnRnE rules always apply to the System Control Space regardless of the value of the ENABLE
bit.
When the ENABLE bit is set to 1, at least one region of the memory map must be enabled for the system to
function unless the PRIVDEFENA bit is set to 1. If the PRIVDEFENA bit is set to 1 and no regions are enabled,
then only privileged software can operate.
When the ENABLE bit is set to 0, the system uses the default memory map. This has the same behavior as if the
MPU is not implemented.
The default memory map applies to accesses from both privileged and unprivileged software.
When the MPU is enabled, accesses to the System Control Space and vector table are always permitted. Other
areas are accessible based on regions and whether PRIVDEFENA is set to 1.
Unless HFNMIENA is set to 1, the MPU is not enabled when the processor is executing the handler for an
exception with priority –1, –2, or –3. These priorities are only possible when handling a HardFault or NMI
exception. Setting the HFNMIENA bit to 1 enables the MPU when operating with these priorities.

4.5.12 MPU Region Number Register

The MPU_RNR selects the region currently accessed by MPU_RBAR and MPU_RLAR.
This register is banked between Security states.
In an implementation with the Security Extension, this register is banked between Security states.
The MPU_RNR bit assignments are:

PM0264 - Rev 2 page 208/232

 PM0264
Security Attribution and Memory Protection

31 8 7 0

RES0 REGION

Table 100. MPU_RNR bit assignments

Bits Name Function

[31:8] - Reserved, res0.

Regions. Indicates the memory region accessed by MPU_RBAR and PMU_RLAR.
[7:0] REGION If no MPU region is implemented, this field is reserved. Writing a value corresponding to an unimplemented
region is CONSTRAINED UNPREDICTABLE.

You must write the required region number to this register before accessing the MPU_RBAR or MPU_RLAR.

4.5.13 MPU Region Base Address Register

The MPU_RBAR defines the base address of the MPU region selected by the MPU_RNR.
This register is banked between Security states.
In an implementation with the Security Extension, this register is banked between Security states.
The MPU_RBAR bit assignments are:
31 5 4 3 2 1 0

BASE

SH
AP[2:1]
XN

Table 101. MPU_RBAR bit assignments

Bits Name Function

Contains bits[31:5] of the lower inclusive limit of the selected MPU memory region. This value is zero
[31:5] BASE
extended to provide the base address to be checked against.
Shareability. Defines the shareability domain of this region for Normal memory.
00 Non-shareable.
01 UNPREDICTABLE.

[4:3] SH 10 Outer shareable.

11 Inner Shareable.

All other values are reserved.

For any type of Device memory, the value of this field is ignored.
Access permissions.
00 Read/write by privileged code only.
[2:1] AP[2:1] 01 Read/write by any privilege level.
10 Read-only by privileged code only.
11 Read-only by any privilege level.
Execute Never. Defines whether code can be executed from this region.

[0] XN 0 Execution only permitted if read permitted.

1 Execution not permitted.

PM0264 - Rev 2 page 209/232

 PM0264
Security Attribution and Memory Protection

4.5.14 MPU Region Base Address Register Alias, n=1-3

The MPU_RBAR_A<n> provides indirect read and write access to the MPU base address register. Accessing
MPU_RBAR_A<n> is equivalent to setting MPU_RNR[7:2]:n[1:0] and then accessing MPU_RBAR for the Security
state.

4.5.15 MPU Region Limit Address Register

The MPU_RLAR defines the limit address of the MPU region selected by the MPU_RNR.
This register is banked between Security states.
In an implementation with the Security Extension, this register is banked between Security states.
The MPU_RLAR bit assignments are:
31 5 4 3 1 0

LIMIT AttrIndx EN

RES0

Table 102. MPU_RLAR bit assignments

Bits Name Function

Limit address. Contains bits[31:5] of the upper inclusive limit of the selected MPU memory region.
[31:5] LIMIT
This value is postfixed with 1F to provide the limit address to be checked against.
[4] - Reserved, res0.
[3:1] AttrIndx Attribute index. Associates a set of attributes in the MPU_MAIR0 and MPU_MAIR1 fields.
Enable. Region enable.
The possible values of this bit are:
[0] EN
0 Region disabled.
1 Region enabled.

4.5.16 MPU Region Limit Address Register Alias, n=1-3

The MPU_RLAR_A<n> provides indirect read and write access to the MPU limit address register. Accessing
MPU_RLAR_A<n> is equivalent to setting MPU_RNR[7:2]:n[1:0] and then accessing MPU_RLAR for the Security
state

4.5.17 MPU Memory Attribute Indirection Registers 0 and 1

The MPU_MAIR0 and MPU_MAIR1 provide the memory attribute encodings corresponding to the AttrIndex
values.
These registers are banked between Security states.
In an implementation with the Security Extension, these registers are is banked between Security states.
The MPU_MAIR0 bit assignments are:

31 24 23 16 15 8 7 0

Attr3 Attr2 Attr1 Attr0

Attr<n>, bits [8n+7:8n], for Memory attribute encoding for MPU regions with an AttrIndex of n.
n= 0 to 3.

The MPU_MAIR1 bit assignments are:

PM0264 - Rev 2 page 210/232

 PM0264
Security Attribution and Memory Protection

31 24 23 16 15 8 7 0

Attr7 Attr6 Attr5 Attr4

Attr<n>, bits Memory attribute encoding for MPU regions with an AttrIndex of n.
[8(n-4)+7:8(n-4)], for n = 4
to 7

MAIR_ATTR defines the memory attribute encoding used in MPU_MAIR0 and MPU_MAIR1, and the bit
assignments are:
When MAIR_ATTR[7:4] is 0000:

7 4 3 2 1 0

0000 00

Device

Table 103. MAIR_ATTR values for bits[3:2] when MAIR_ATTR[7:4] is 0000

Bits Name Function

Device attributes. Specifies the memory attributes for Device.The possible values of this field are:
00 Device-nGnRnE.
[3:2] Device 01 Device-nGnRE.
10 Device-nGRE.
11 Device-GRE.

When MAIR_ATTR[7:4] is not 0000:

7 4 3 0

Outer Inner

Table 104. MAIR_ATTR bit assignments when MAIR_ATTR[7:4] is not 0000

Bits Name Function

Outer attributes. Specifies the Outer memory attributes. The possible values of this field are:
Device memory. In this case, refer to Section 4.5.17 MPU Memory Attribute
0000
Indirection Registers 0 and 1.

00RW Normal memory, Outer write-through transient (RW is not 00).

0100 Normal memory, Outer non-cacheable.

[7:4] Outer
01RW Normal memory, Outer write-back transient (RW is not 00).

10RW Normal memory, Outer write-through non-transient.

11RW Normal memory, Outer write-back non-transient.

R and W specify the outer read and write allocation policy: 0 = do not allocate, 1 = allocate.
[3:0] Inner Inner attributes. Specifies the Inner memory attributes. The possible values of this field are:

PM0264 - Rev 2 page 211/232

 PM0264
Security Attribution and Memory Protection

Bits Name Function

0000 UNPREDICTABLE.

00RW Normal memory, Inner write-through transient (RW is not 00).

0100 Normal memory, Inner non-cacheable.

01RW Normal memory, Inner write-back transient (RW is not 00).

10RW Normal memory, Inner write-through non-transient.

11RW Normal memory, Inner write-back non-transient.

R and W specify the outer read and write allocation policy: 0 = do not allocate, 1 = allocate.

4.5.18 MPU mismatch

When access violates the MPU permissions, the processor generates a MemManage fault.

4.5.19 Updating protected memory regions

To update an MPU region, update the attributes in the MPU_RNR, MPU_RBAR and MPU_RLAR registers. To
update an SAU region, update the attributes in the SAU_RNR, SAU_RBAR and SAU_RLAR registers.
Updating an MPU region Simple code to configure one region:
; R1 = MPU region number
; R2 = base address, permissions and shareability
; R3 = limit address, attributes index and enable
LDR R0,=MPU_RNR
STR R1, [R0, #0x0] ; MPU_RNR
STR R2, [R0, #0x4] ; MPU_RBAR
STR R3, [R0, #0x8] ; MPU_RLAR

Software must use memory barrier instructions:

• Before MPU setup if there might be outstanding memory transfers, such as buffered
writes, that might be affected by the change in MPU settings.
• After MPU setup if it includes memory transfers that must use the new MPU settings.
If you want all the MPU memory access behavior to take effect immediately after the
programming sequence, use a DSB instruction and an ISB instruction.

Updating an SAU region Simple code to configure one region:

; R1 = SAU region number
; R2 = base address
; R3 = limit address, Non-secure callable attribute and enable
LDR R0,=SAU_RNR
STR R1, [R0, #0x0] ; SAU_RNR
STR R2, [R0, #0x4] ; SAU_RBAR
STR R3, [R0, #0x8] ; SAU_RLAR

Software must use memory barrier instructions:

• Before SAU setup if there might be outstanding memory transfers, such as buffered
writes, that might be affected by the change in SAU settings.
• After SAU setup if it includes memory transfers that must use the new SAU settings.
If you want all the SAU memory access behavior to take effect immediately after the
programming sequence, use a DSB instruction and an ISB instruction.

4.5.20 MPU design hints and tips

To update the attributes for an MPU region, update the MPU_RNR, MPU_RBAR, and MPU_RLAR registers.

PM0264 - Rev 2 page 212/232

 PM0264
Floating-Point Unit

To avoid unexpected behavior, disable the interrupts before updating the attributes of a region that the interrupt
handlers might access. When setting up the MPU, and if the MPU has previously been programmed, disable
unused regions to prevent any previous region settings from affecting the new MPU setup.

4.5.20.1 MPU configuration for a microcontroller

Usually, a microcontroller system has only a single processor and no caches.
In such a system, program the MPU as follows:

Table 105. Memory region attributes for a microcontroller

MAIR_ATTR.Outer
Memory region Shareability Memory type and attributes
MAIR_ATTRInner

Flash memory 0b1010 0 Normal memory, Non-shareable, Write-Through.

Internal SRAM 0b1010 1 Normal memory, Shareable, Write-Through.
External SRAM 0b1111 1 Normal memory, Shareable, Write-Back, write-allocate.
Peripherals 0b0000 - Always Shareable.

In most microcontroller implementations, the cache policy attributes do not affect the system behavior. However,
using these settings for the MPU regions makes the application code more portable. The values given are for
typical situations. In special systems, such as multiprocessor designs or designs with a separate DMA engine,
the shareability attribute might be important. In these cases, refer to the recommendations of the memory device
manufacturer.
Shareability attributes define whether the global monitor is used, or only the local monitor is used.

4.6 Floating-Point Unit

The Cortex‑M33 Floating-Point Unit (FPU) implements the FPv5 floating-point extensions.The FPU fully supports
single-precision add, subtract, multiply, divide, multiply and accumulate, and square root operations. It also
provides conversions between fixed-point and floating-point data formats, and floating-point constant instructions.
The FPU provides floating-point computation functionality that is compliant with the ANSI/IEEE Std 754-2008,
IEEE Standard for Binary Floating-Point Arithmetic, referred to as the IEEE 754 standard.
The FPU contains 32 single-precision extension registers, which you can also access as 16 doubleword registers
for load, store, and move operations.

Table 106. Floating-point system registers summary

Required
Address Name Type Reset Description
privilege

0xE000EF34 FPCCR RW Privileged 0xC0000000 Section 4.6.1 Floating-point Context Control Register
0xE000EF38 FPCAR RW Privileged - Section 4.6.2 Floating-point Context Address Register
- FPSCRy RW Unprivileged - Section 4.6.3 Floating-point Status Control Register
Section 4.6.4 Floating-point Default Status Control
0xE000EF3C FPDSCR RW Privileged 0x00000000
Register

4.6.1 Floating-point Context Control Register

The FPCCR register sets or returns FPU control data.
This register is banked between Security states on a bit by bit basis.
The FPCCR bit assignments are:

PM0264 - Rev 2 page 213/232

 PM0264
Floating-Point Unit

31 30 29 28 27 26 25 11 10 9 8 7 6 5 4 3 2 1 0

RES0 S

TS
CLRONRETS
CLRONRET
LSPENS
LSPEN
ASPEN
UFRDY
SPLIMVIOL
MONRDY
SFRDY
BFRDY
MMRDY
HFRDY
THREAD
USER
LSPACT

Table 107. FPCCR bit assignments with the Security Extension

Bits Name Function

Automatic state preservation enable. Enables CONTROL.FPCA setting on execution of a floating-

point instruction. This results in automatic hardware state preservation and restoration, for floating-
point context, on exception entry and exit. The possible values of this bit are:
Disable CONTROL.FPCA setting on execution of a floating-point
0
[31] ASPEN instruction.
Enable CONTROL.FPCA setting on execution of a floating-point
1
instruction.

This bit is banked between Security states.

Automatic state preservation enable. Enables lazy context save of floating-point state. The possible
values of this bit are:
0 Disable automatic lazy context save.
[30] LSPEN 1 Enable automatic lazy state preservation for floating-point context.

Writes to this bit from Non-secure state are ignored if LSPENS is set to one.
This bit is not banked between Security states.
Lazy state preservation enable Secure only. This bit controls whether the LSPEN bit is writeable from
the Non-secure state.
The possible values of this bit are:
[29] LSPENS 0 LSPEN is readable and writeable from both Security states.
LSPEN is readable from both Security states. Writes to LSPEN are ignored
1 from the Nonsecure
state.
Clear on return. Clear floating-point caller saved registers on exception return.
The possible values of this bit are:
0 Disabled.
1 Enabled.
[28] CLRONRET

When set to 1 the caller saved floating-point registers S0 to S15, and FPSCR are cleared on
exception return (including tail chaining) if CONTROL.FPCA is set to 1 and FPCCR_S.LSPACT is
set to 0.
This bit is not banked between Security states.
Clear on return Secure only. This bit controls whether the CLRONRET bit is writeable from the
[27] CLRONRETS
Non-secure state.

PM0264 - Rev 2 page 214/232

 PM0264
Floating-Point Unit

Bits Name Function

The possible values of this bit are:
0 The CLRONRET field is accessibly from both Security states.
1 The Non-secure view of the CLRONRET field is read-only.

This bit is RAZ/WI for a Non-secure state.

This bit is not banked between Security states.
Treat as Secure. Treat floating-point registers as Secure enable.
The possible values of this bit are:
0 Disabled.
1 Enabled.

[26] TS When set to 0 the floating-point registers are treated as Non-secure even when the core is in the
Secure state
and, therefore, the callee saved registers are never pushed to the stack. If the floating-point registers
never
contain data that needs to be protected, clearing this flag can reduce interrupt latency.
This bit is not banked between Security states.
[25-11] - Reserved, res0.
UsageFault ready. Indicates whether the software executing when the processor allocated the
floating-point stack frame was able to set the UsageFault exception to pending.
The possible values of this bit are:
[10] UFRDY 0 Not able to set the UsageFault exception to pending.
1 Able to set the UsageFault exception to pending.

This bit is banked between Security states.

Stack pointer limit violation. This bit indicates whether the floating-point context violates the stack
pointer limit that was active when lazy state preservation was activated. SPLIMVIOL modifies the lazy
floating-point state preservation behavior.
The possible values of this bit are:

[9] SPLIMVIOL 0 The existing behavior is retained.

The memory accesses associated with the floating-point state preservation
1 are not performed. If the floating-point is in Secure state and FPCCR.TS is
set to 1 the registers are still zeroed and the floating-point state is lost.

This bit is banked between Security states.

DebugMonitor ready. Indicates whether the software executing when the processor allocated the
floatingpoint stack frame was able to set the DebugMonitor exception to pending.
The possible values of this bit are:
0 Not able to set the DebugMonitor exception to pending.
[8] MONRDY
1 Able to set the DebugMonitor exception to pending.

If DEMCR.SDME is 1 in Non-secure state this bit is RAZ/WI.

This bit is not banked between Security states.
SecureFault ready.
If accessed from the Non-secure state, this bit behaves as RAZ/WI.

[7] SFRDY If accessed from the Secure state, this bit indicates whether the software executing (when the
processor allocated the floating-point stack frame) was able to set the SecureFault exception to
pending.
This bit is not banked between Security states.

PM0264 - Rev 2 page 215/232

 PM0264
Floating-Point Unit

Bits Name Function

BusFault ready. Indicates whether the software executing when the processor allocated the floating-
point stack frame was able to set the BusFault exception to pending.
The possible values of this bit are:
0 Not able to set the BusFault exception to pending.
[6] BFRDY
1 Able to set the BusFault exception to pending.

If in Non-secure state and AIRCR.BFHFNMINS is zero, this bit is RAZ/WI.

This bit is not banked between Security states.
MemManage ready. Indicates whether the software executing when the processor allocated the
floating-point stack frame was able to set the MemManage exception to pending.
The possible values of this bit are:
[5] MMRDY 0 Not able to set the MemManage exception to pending.
1 Able to set the MemManage exception to pending.

This bit is banked between Security states.

HardFault ready. Indicates whether the software executing when the processor allocated the floating-
point stack frame was able to set the HardFault exception to pending.
The possible values of this bit are:
0 Not able to set the HardFault exception to pending.
[4] HFRDY
1 Able to set the HardFault exception to pending.

If in Non-secure state and AIRCR.BFHFNMINS is zero, this bit is RAZ/WI.

This bit is not banked between Security states.
Thread mode. Indicates the processor mode when it allocated the floating-point stack frame.
The possible values of this bit are:
0 Handler mode.
[3] THREAD
1 Thread mode.

This bit is for fault handler information only and does not interact with the exception model.
This bit is banked between Security states.
Security status of the floating point context.
If accessed from the Non-secure state, this bit behaves as RAZ/WI.
This bit is updated whenever lazy state preservation is activated, or when a floating-point instruction is
[2] S executed.
The possible values of this bit are:
0 Indicates that the floating-point context belongs to the Non-secure state.
1 Indicates that the floating-point context belongs to the Secure state.
Indicates the privilege level of the software executing, when the processor allocated the floating point
stack.
The possible values of this bit are:
[1] USER 0 Privileged level.
1 Unprivileged level.

This bit is banked between Security states.

Lazy state preservation active. Indicates whether lazy preservation of the floating-point state is active.
The possible values of this bit are:
[0] LSPACT
0 Lazy state preservation is not active.
1 Lazy state preservation is active.

PM0264 - Rev 2 page 216/232

 PM0264
Floating-Point Unit

Bits Name Function

This bit is banked between Security states.

4.6.2 Floating-point Context Address Register

The FPCAR register holds the location of the unpopulated floating-point register space that is allocated on an
exception stack frame.
This register is banked between Security states.
The FPCAR bit assignments are:

31 3 2 0

ADDRESS

RES0

Table 108. FPCAR bit assignments

Bits Name Function

[31:3] ADDRESS The location of the unpopulated floating-point register space that is allocated on an exception stack frame.
[2:0] - Reserved, res0

4.6.3 Floating-point Status Control Register

The FPSCR register provides all necessary User level control of the floating-point system.
This register is not banked between Security states.
The FPSCR bit assignments are:
31 30 29 28 27 26 25 24 23 22 21 8 7 6 5 4 3 2 1 0

N Z C V RES0

RES0 RMode IDC IOC

AHP FZ RES0 DZC
DN IXC OFC
UFC

Table 109. FPSCR bit assignments

Bits Name Function

[31] N Condition code flags. Floating-point comparison operations update these flags:
[30] Z N Negative condition code flag.

[29] C Z Zero condition code flag.

C Carry condition code flag.
[28] V
V Overflow condition code flag.
[27] - Reserved, res0.
Alternative half-precision control bit:
[26] AHP 0 IEEE half-precision format selected.
1 Alternative half-precision format selected.
Default NaN mode control bit:
[25] DN 0 NaN operands propagate through to the output of a floating-point operation.
1 Any operation involving one or more NaNs returns the Default NaN.
[24] FZ Flush-to-zero mode control bit:

PM0264 - Rev 2 page 217/232

 PM0264
Floating-Point Unit

Bits Name Function

Flush-to-zero mode disabled. Behavior of the floating-point system is fully
0
compliant with the IEEE 754 standard.
1 Flush-to-zero mode enabled.
Rounding Mode control field. The encoding of this field is:
0b00 Round to Nearest (RN) mode.
0b01 Round towards Plus Infinity (RP) mode.
[23:22] RMode
0b10 Round towards Minus Infinity (RM) mode.
0b11 Round towards Zero (RZ) mode.

The specified rounding mode is used by almost all floating-point instructions.

[21:8] - Reserved, res0.
[7] IDC Input Denormal cumulative exception bit, see bits [4:0].
[6:5] - Reserved, res0.
[4] IXC Cumulative exception bits for floating-point exceptions, see also bit[7]. Each of these bits is set to 1 to
indicate that the corresponding exception has occurred since 0 was last written to it.
[3] UFC
IDC, bit[7] Input Denormal cumulative exception bit.
[2] OFC
IXC Inexact cumulative exception bit.
[1] DZC
UFC Underflow cumulative exception bit.
OFC Overflow cumulative exception bit.
[0] IOC DZC Division by Zero cumulative exception bit.
IOC Invalid Operation cumulative exception bit.

4.6.4 Floating-point Default Status Control Register

The FPDSCR register holds the default values for the floating-point status control data. The processor assigns the
floating-point status control data to the FPSCR when it creates a new floating-point context.
This register is banked between Security states.
The FPDSCR bit assignments are:

31 27 26 25 24 23 22 21 0

RES0 0 0 0 0 0 RES0

AHP RMode
DN FZ

Table 110. FPDSCR bit assignments

Bits Name Function

[31:27] - Reserved, res0

[26] AHP Default value for FPSCR.AHP
[25] DN Default value for FPSCR.DN
[24] FZ Default value for FPSCR.FZ
[23:22] RMode Default value for FPSCR.RMode
[21:0] - Reserved, res0

PM0264 - Rev 2 page 218/232

 PM0264
Floating-Point Unit

4.6.5 Code sequence for enabling the FPU

The FPU is disabled from reset. You must enable it before you can use any floating-point instructions. The code
sequence shows how to a enable the FPU in privileged mode. The core must be in privileged mode to read from
and write to the CPACR.
If the Security Extension is implemented, when the system boots up, the secure software should setup NSACR to
determine if the FPU (coprocessor 10 and 11) is accessible from Non-secure side. The Secure software should
also configure FPCCR to determine if the FPU is used by Secure software. After that, the FPU can be enabled.
Enabling the FPU CPACR EQU 0xE000ED88
LDR R0, =CPACR ; Read CPACR
LDR r1, [R0] ; Set bits 20-23 to enable CP10 and CP11
coprocessors
ORR R1, R1, #(0xF << 20)
STR R1, [R0] ; Write back the modified value to the CPACR
DSB
ISB ; Reset pipeline now the FPU is enabled.

PM0264 - Rev 2 page 219/232

 PM0264

Revision history
Table 111. Document revision history

Date Revision Changes

14-Feb-2020 1 Initial release.

Added support for STM32U5 Series.
Updated Section Introduction.
Updated Table 1. Applicable products.
Updated Section 2.2 Cortex® M33
configurations.
Updated Table 17. STM32L5xx and
STM32U5xx Cortex® M33 configuration.

07-Mar-2022 2 Updated Section 2.4.5 Exception

priorities.
Updated Table 23. Extended priority
when the number of interrupt priority
levels is 8.
Added Table 24. Extended priority when
the number of interrupt priority levels is
16 .
Updated Section 4.2.7 Interrupt Priority
Registers.

PM0264 - Rev 2 page 220/232

 PM0264
Contents

Contents
1 About this document . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1 Typographic conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.2 List of abbreviations for registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.3 About the Cortex®-M33 processor and core peripherals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.3.1 System-level interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.3.2 Security Extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.3.3 Integrated configurable debug. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.3.4 Cortex®-M33 processor features and benefits summary . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.3.5 Cortex®-M33 processor core peripherals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

2 The Cortex®-M33 processor. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

2.1 Programmer's model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.1.1 Processor modes and privilege levels for software execution . . . . . . . . . . . . . . . . . . . . . . . 7
2.1.2 Security states . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.1.3 Core registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.1.4 Exceptions and interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
2.1.5 Data types and data memory accesses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
2.1.6 The Cortex Microcontroller Software Interface Standard . . . . . . . . . . . . . . . . . . . . . . . . . . 18

2.2 Cortex® M33 configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

2.3 Memory model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
2.3.1 Processor memory map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
2.3.2 Memory regions, types, and attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
2.3.3 Device memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
2.3.4 Secure memory system and memory partitioning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
2.3.5 Behavior of memory accesses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
2.3.6 Software ordering of memory accesses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
2.3.7 Memory endianness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
2.3.8 Synchronization primitives. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
2.3.9 Programming hints for the synchronization primitives . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
2.4 Exception model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
2.4.1 Exception states . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
2.4.2 Exception types. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
2.4.3 Exception handlers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
2.4.4 Vector table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
2.4.5 Exception priorities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
2.4.6 Interrupt priority grouping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

PM0264 - Rev 2 page 221/232

 PM0264
Contents

2.4.7 Exception entry and return . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

2.5 Security state switches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
2.6 Fault handling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
2.6.1 Fault types reference table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
2.6.2 Fault escalation to HardFault . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
2.6.3 Fault status registers and fault address registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
2.6.4 Lockup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
2.7 Power management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
2.7.1 Entering sleep mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
2.7.2 Wakeup from sleep mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
2.7.3 The external event input . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
2.7.4 Power management programming hints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

3 The Cortex®-M33 Instruction Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .43

3.1 Instruction set summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
3.1.1 Binary compatibility with other Cortex processors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
3.2 CMSIS functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
3.2.1 List of CMSIS functions to generate some processor instructions . . . . . . . . . . . . . . . . . . . 54
3.2.2 CMSE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
3.2.3 CMSIS functions to access the special registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
3.2.4 CMSIS functions to access the Non-secure special registers . . . . . . . . . . . . . . . . . . . . . . 56
3.3 About the instruction descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
3.3.1 Operands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
3.3.2 Restrictions when using PC or SP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
3.3.3 Flexible second operand . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
3.3.4 Shift Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
3.3.5 Address alignment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
3.3.6 PC‑relative expressions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
3.3.7 Conditional execution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
3.3.8 Instruction width selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
3.4 General data processing instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
3.4.1 ADD, ADC, SUB, SBC, and RSB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
3.4.2 AND, ORR, EOR, BIC, and ORN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
3.4.3 ASR, LSL, LSR, ROR, and RRX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
3.4.4 CLZ. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
3.4.5 CMP and CMN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
3.4.6 MOV and MVN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
3.4.7 MOVT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72

PM0264 - Rev 2 page 222/232

 PM0264
Contents

3.4.8 REV, REV16, REVSH, and RBIT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72

3.4.9 SADD16 and SADD8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
3.4.10 SASX and SSAX. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
3.4.11 SEL. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
3.4.12 SHADD16 and SHADD8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
3.4.13 SHASX and SHSAX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
3.4.14 SHSUB16 and SHSUB8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
3.4.15 SSUB16 and SSUB8. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
3.4.16 TST and TEQ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
3.4.17 UADD16 and UADD8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
3.4.18 UASX and USAX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
3.4.19 UHADD16 and UHADD8. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
3.4.20 UHASX and UHSAX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
3.4.21 UHSUB16 and UHSUB8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
3.4.22 USAD8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
3.4.23 USADA8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
3.4.24 USUB16 and USUB8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
3.5 Multiply and divide instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
3.5.1 MUL, MLA, and MLS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
3.5.2 SDIV and UDIV . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
3.5.3 SMLAWB, SMLAWT, SMLABB, SMLABT, SMLATB, and SMLATT . . . . . . . . . . . . . . . . . . 92
3.5.4 SMLAD and SMLADX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
3.5.5 SMLALD, SMLALDX, SMLALBB, SMLALBT, SMLALTB, and SMLALTT . . . . . . . . . . . . . . 94
3.5.6 SMLSD and SMLSLD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
3.5.7 SMMLA and SMMLS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
3.5.8 SMMUL. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
3.5.9 SMUAD and SMUSD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
3.5.10 SMUL and SMULW . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100
3.5.11 UMULL, UMAAL, UMLAL, SMULL, and SMLAL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
3.6 Saturating instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
3.6.1 SSAT and USAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
3.6.2 SSAT16 and USAT16 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
3.6.3 QADD and QSUB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
3.6.4 QASX and QSAX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
3.6.5 QDADD and QDSUB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
3.6.6 UQASX and UQSAX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
3.6.7 UQADD and UQSUB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
3.7 Packing and unpacking instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110

PM0264 - Rev 2 page 223/232

 PM0264
Contents

3.7.1 PKHBT and PKHTB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111

3.7.2 SXTA and UXTA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
3.7.3 SXT and UXT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
3.8 Bit field instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
3.8.1 BFC and BFI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
3.8.2 SBFX and UBFX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
3.9 Branch and control instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
3.9.1 List of branch and control instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
3.9.2 B, BL, BX, and BLX. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
3.9.3 BXNS and BLXNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
3.9.4 CBZ and CBNZ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
3.9.5 IT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
3.9.6 TBB and TBH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
3.10 Floating-point instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
3.10.1 FLDMDBX, FLDMIAX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
3.10.2 FSTMDBX, FSTMIAX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
3.10.3 VABS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
3.10.4 VADD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
3.10.5 VCMP and VCMPE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
3.10.6 VCVT and VCVTR between floating-point and integer . . . . . . . . . . . . . . . . . . . . . . . . . . 126
3.10.7 VCVT between floating-point and fixed-point . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
3.10.8 VDIV . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
3.10.9 VFMA and VFMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
3.10.10 VFNMA and VFNMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
3.10.11 VLDM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
3.10.12 VLDR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
3.10.13 VLLDM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
3.10.14 VLSTM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
3.10.15 VMLA and VMLS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
3.10.16 VMOV Immediate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
3.10.17 VMOV Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
3.10.18 VMOV scalar to core register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134
3.10.19 VMOV core register to single-precision . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134
3.10.20 VMOV two core registers to two single-precision registers . . . . . . . . . . . . . . . . . . . . . . . 135
3.10.21 VMOV two core registers and a double-precision register . . . . . . . . . . . . . . . . . . . . . . . . 135
3.10.22 VMOV core register to scalar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
3.10.23 VMRS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
3.10.24 VMSR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137

PM0264 - Rev 2 page 224/232

 PM0264
Contents

3.10.25 VMUL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137

3.10.26 VNEG . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
3.10.27 VNMLA, VNMLS and VNMUL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
3.10.28 VPOP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139
3.10.29 VPUSH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139
3.10.30 VSQRT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
3.10.31 VSTM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
3.10.32 VSTR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
3.10.33 VSUB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
3.10.34 VSEL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
3.10.35 VCVTA, VCVTM VCVTN, and VCVTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
3.10.36 VCVTB and VCVTT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
3.10.37 VMAXNM and VMINNM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
3.10.38 VRINTR and VRINTX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
3.10.39 VRINTA, VRINTN, VRINTP, VRINTM, and VRINTZ . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
3.11 Miscellaneous instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146
3.11.1 BKPT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146
3.11.2 CPS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
3.11.3 CPY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
3.11.4 DMB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
3.11.5 DSB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
3.11.6 ISB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
3.11.7 MRS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
3.11.8 MSR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150
3.11.9 NOP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150
3.11.10 SEV . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151
3.11.11 SG . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151
3.11.12 SVC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151
3.11.13 TT, TTT, TTA, and TTAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
3.11.14 UDF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
3.11.15 WFE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154
3.11.16 WFI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154
3.11.17 YIELD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154
3.12 Memory access instructions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
3.12.1 ADR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
3.12.2 LDR and STR, immediate offset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
3.12.3 LDR and STR, register offset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
3.12.4 LDR and STR, unprivileged. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160

PM0264 - Rev 2 page 225/232

 PM0264
Contents

3.12.5 LDR, PC‑relative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161

3.12.6 LDM and STM. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
3.12.7 PLD. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164
3.12.8 PUSH and POP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164
3.12.9 LDA and STL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165
3.12.10 LDREX and STREX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
3.12.11 LDAEX and STLEX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167
3.12.12 CLREX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169

4 Cortex®-M33 peripherals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170

4.1 About the Cortex®-M33 peripherals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170
4.2 Nested Vectored Interrupt Controller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170
4.2.1 Accessing the NVIC registers using CMSIS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171
4.2.2 Interrupt Set Enable Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172
4.2.3 Interrupt Clear Enable Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173
4.2.4 Interrupt Set Pending Registers - Cortex-M33. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173
4.2.5 Interrupt Active Bit Registers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174
4.2.6 Interrupt Target Non-secure Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174
4.2.7 Interrupt Priority Registers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174
4.2.8 Interrupt Clear Pending Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175
4.2.9 Software Trigger Interrupt Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
4.2.10 Level-sensitive and pulse interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
4.2.11 NVIC usage hints and tips. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177
4.3 System Control Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177
4.3.1 Coprocessor Access Control Register. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178
4.3.2 Non-secure Access Control Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179
4.3.3 Auxiliary Control Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179
4.3.4 CPUID Base Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
4.3.5 Interrupt Control and State Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
4.3.6 Vector Table Offset Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
4.3.7 Application Interrupt and Reset Control Register. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
4.3.8 System Control Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187
4.3.9 Configuration and Control Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188
4.3.10 System Handler Priority Registers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190
4.3.11 System Handler Control and State Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191
4.3.12 Configurable Fault Status Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193
4.3.13 HardFault Status Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197
4.3.14 MemManage Fault Address Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197
4.3.15 BusFault Address Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198

PM0264 - Rev 2 page 226/232

 PM0264
Contents

4.3.16 System control block design hints and tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198

4.4 System timer, SysTick . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198
4.4.1 SysTick Control and Status Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199
4.4.2 SysTick Reload Value Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199
4.4.3 SysTick Current Value Register. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200
4.4.4 SysTick Calibration Value Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200
4.4.5 SysTick usage hints and tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201
4.5 Security Attribution and Memory Protection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201
4.5.1 Security Attribution Unit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201
4.5.2 Security Attribution Unit Control Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202
4.5.3 Security Attribution Unit Type Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202
4.5.4 Security Attribution Unit Region Number Register. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203
4.5.5 Security Attribution Unit Region Base Address Register . . . . . . . . . . . . . . . . . . . . . . . . . 203
4.5.6 Security Attribution Unit Region Limit Address Register . . . . . . . . . . . . . . . . . . . . . . . . . 203
4.5.7 Secure Fault Status Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204
4.5.8 Secure Fault Address Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205
4.5.9 Memory Protection Unit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206
4.5.10 MPU Type Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207
4.5.11 MPU Control Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207
4.5.12 MPU Region Number Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208
4.5.13 MPU Region Base Address Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209
4.5.14 MPU Region Base Address Register Alias, n=1-3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210
4.5.15 MPU Region Limit Address Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210
4.5.16 MPU Region Limit Address Register Alias, n=1-3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210
4.5.17 MPU Memory Attribute Indirection Registers 0 and 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 210
4.5.18 MPU mismatch. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212
4.5.19 Updating protected memory regions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212
4.5.20 MPU design hints and tips. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212
4.6 Floating-Point Unit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213
4.6.1 Floating-point Context Control Register. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213
4.6.2 Floating-point Context Address Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217
4.6.3 Floating-point Status Control Register. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217
4.6.4 Floating-point Default Status Control Register. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218
4.6.5 Code sequence for enabling the FPU . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219
Revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220
List of tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228
List of figures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231

PM0264 - Rev 2 page 227/232

 PM0264
List of tables

List of tables
Table 1. Applicable products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Table 2. Core register set summary without the Security Extension. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Table 3. Core register set summary with the Security Extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Table 4. Stack pointer register without the Security Extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Table 5. Stack pointer register with the Security Extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Table 6. Stack limit registers without the Security Extension. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Table 7. Stack limit registers with the Security Extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Table 8. MSPLIM and PSPLIM register bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Table 9. xPSR register combinations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Table 10. APSR bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Table 11. IPSR bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Table 12. EPSR bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Table 13. PRIMASK register bit assignments. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Table 14. FAULTMASK register bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Table 15. BASEPRI register bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Table 16. CONTROL register bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Table 17. STM32L5xx and STM32U5xx Cortex® M33 configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Table 18. Memory access behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Table 19. Memory region shareability and cache policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Table 20. CMSIS functions for exclusive access instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Table 21. Properties of the different exception types with the Security Extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Table 22. Properties of the different exception type without the Security Extensions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Table 23. Extended priority when the number of interrupt priority levels is 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Table 24. Extended priority when the number of interrupt priority levels is 16 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Table 25. Exception return behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Table 26. Exception return behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Table 27. Security state transitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Table 28. Faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Table 29. Fault status and fault address registers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Table 30. Cortex‑M33 instruction set summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Table 31. CMSIS functions to generate some Cortex-M33 processor instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Table 32. CMSIS functions to access the special registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Table 33. CMSIS intrinsic functions to access the Non-secure special registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Table 34. Condition code suffixes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Table 35. Data processing instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Table 36. Multiply and divide instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Table 37. Saturating instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Table 38. Packing and unpacking instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .110
Table 39. Bit field instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .115
Table 40. Branch and control instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .116
Table 41. Branch ranges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .117
Table 42. Floating-point instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
Table 43. Miscellaneous instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146
Table 44. Security state and access permissions in the destination register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
Table 45. Memory access instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
Table 46. Offset ranges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
Table 47. Offset ranges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
Table 48. Core peripheral register regions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170
Table 49. NVIC registers summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171
Table 50. CMSIS access NVIC functions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171
Table 51. NVIC_ISERn bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172
Table 52. NVIC_ICERn bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173
Table 53. NVIC_ISPRn bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173

PM0264 - Rev 2 page 228/232

 PM0264
List of tables

Table 54. NVIC_IABRn bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174

Table 55. NVIC_ITNSn bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174
Table 56. NVIC_IPRn bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175
Table 57. NVIC_ICPRn bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
Table 58. STIR bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
Table 59. Summary of the system control block registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177
Table 60. CPACR bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178
Table 61. NSACR bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179
Table 62. ACTLR bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180
Table 63. CPUID bit assignments. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
Table 64. ICSR bit assignments with the Security Extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
Table 65. VTOR bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
Table 66. AIRCR bit assignments without the Security Extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185
Table 67. AIRCR bit assignments with the Security Extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185
Table 68. Priority grouping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187
Table 69. AIRCR bit assignments with the Security Extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188
Table 70. CCR bit assignments with the Security Extension. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189
Table 71. System fault handler priority fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190
Table 72. SHPR1 register bit assignments. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190
Table 73. SHPR2 register bit assignments. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191
Table 74. SHPR3 register bit assignments. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191
Table 75. CCR bit assignments with the Security Extension. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192
Table 76. MMFSR bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193
Table 77. BFSR bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195
Table 78. UFSR bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196
Table 79. HFSR bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197
Table 80. MMFAR bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198
Table 81. BFAR bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198
Table 82. CMSIS function for system control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198
Table 83. System timer registers summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199
Table 84. SYST_CSR bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199
Table 85. SYST_RVR bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200
Table 86. SYST_CVR bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200
Table 87. SYST_CALIB register bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201
Table 88. SAU registers summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201
Table 89. SAU_CTRL bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202
Table 90. SAU_TYPE bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203
Table 91. SAU_RNR bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203
Table 92. SAU_RBAR bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203
Table 93. SAU_RLAR bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204
Table 94. SFSR bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204
Table 95. SFAR bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206
Table 96. Memory attributes summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206
Table 97. MPU registers summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207
Table 98. MPU_TYPE bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207
Table 99. MPU_CTRL bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208
Table 100. MPU_RNR bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209
Table 101. MPU_RBAR bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209
Table 102. MPU_RLAR bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210
Table 103. MAIR_ATTR values for bits[3:2] when MAIR_ATTR[7:4] is 0000. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .211
Table 104. MAIR_ATTR bit assignments when MAIR_ATTR[7:4] is not 0000 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .211
Table 105. Memory region attributes for a microcontroller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213
Table 106. Floating-point system registers summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213
Table 107. FPCCR bit assignments with the Security Extension. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214
Table 108. FPCAR bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217

PM0264 - Rev 2 page 229/232

 PM0264
List of tables

Table 109. FPSCR bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217

Table 110. FPDSCR bit assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218
Table 111. Document revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220

PM0264 - Rev 2 page 230/232

 PM0264
List of figures

List of figures
Figure 1. STM32 Cortex®-M33 processor implementation without the security extension . . . . . . . . . . . . . . . . . . . . . . . . 3
Figure 2. STM32 Cortex®-M33 processor implementation with the security extension . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Figure 3. Core registers without the Security Extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Figure 4. Core registers with the Security Extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Figure 5. Cortex‑M33 processor memory map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Figure 6. Little-endian example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Figure 7. Vector table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Figure 8. Vector table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Figure 9. Stack frame when an interrupt or an exception is preserved on the stack with or without floating-point state . . 34
Figure 10. Stack frame extended to save additional context when the Security Extension is implemented . . . . . . . . . . . . 34
Figure 11. Extended exception stack frame . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Figure 12. Security state transitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Figure 13. ASR #3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Figure 14. LSR #3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Figure 15. LSL #3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Figure 16. ROR #3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Figure 17. RRX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

PM0264 - Rev 2 page 231/232

 PM0264

IMPORTANT NOTICE – READ CAREFULLY

STMicroelectronics NV and its subsidiaries (“ST”) reserve the right to make changes, corrections, enhancements, modifications, and improvements to ST
products and/or to this document at any time without notice. Purchasers should obtain the latest relevant information on ST products before placing orders. ST
products are sold pursuant to ST’s terms and conditions of sale in place at the time of order acknowledgment.
Purchasers are solely responsible for the choice, selection, and use of ST products and ST assumes no liability for application assistance or the design of
purchasers’ products.
No license, express or implied, to any intellectual property right is granted by ST herein.
Resale of ST products with provisions different from the information set forth herein shall void any warranty granted by ST for such product.
ST and the ST logo are trademarks of ST. For additional information about ST trademarks, please refer to www.st.com/trademarks. All other product or service
names are the property of their respective owners.
Information in this document supersedes and replaces information previously supplied in any prior versions of this document.
© 2022 STMicroelectronics – All rights reserved

PM0264 - Rev 2 page 232/232