RP2040: Accessing the bootrom float library from inline assembler

[RotatingLlama]

Hello,

I've decided to try and implement something in assembly, in part because it'll be quite slow otherwise and in part just to learn something new. Unfortunately I've hit a stumbling block almost immediately: I need floating-point operations.

A bit of Googling tells me that the rp2040 has a convenient bootrom with optimised fp algorithms, which is what the C SDK uses. The problem I have is getting to it, because the branch instruction in the inline assembler only takes labels as its argument, and not memory addresses (such as the address where the bootrom is). I tried directly updating the pc register to point at the bootrom code, but this produces an error ('mov' expects at most r7).

Is there a way to branch to arbitrary memory locations from inline assembler? If not I'll find some other way of achieving my goals, but I'd like to know if I'm missing something here before I give up on the approach.

[Josverl]

to avoid us all guessing which assembler you are referring to it would be helpful if you could share a minimal example.

Possibly you are trying to use asm_thumb , but please confirm

@micropython.asm_thumb
def foo():
    ...

[RotatingLlama]

Thanks for your reply - here's my code so far. I'm trying to call a helper function at 0x00000018 which looks up the value in r0 and replaces it with the address of the function I'm looking for. Right now I'm just trying to get the helper function to work, but I have 3 issues:

1. I can't load immediate values greater than 0xff (but I've worked around this)
2. I can't branch to arbitrary memory locations, only labels (the topic of this thread)
3. Even with my mov( pc, r2 ) hack, the function just outputs 0 instead of an actual memory address as expected.

@micropython.asm_thumb
def test():
  
  b(ENTRY)
  
  # Input:  r1 = function code
  # Output: r0 = function address
  label(GET_ROM_FUN)
  #push({lr})
  mov( r0, 0x00000014 ) # Pointer to the rom_func_table.
  mov( r2, 0x00000018 ) # Pointer to the rom_table_lookup function.
  mov( pc, r2 ) # I'd like to use BLX here, instead of this hack
  #pop({pc})

  label(ENTRY)
  mov( r2, 0x61 )
  lsl( r2, r2, 8 )
  mov( r1, 0x74 )
  add( r1, r1, r2 )
  #mov( r1, 0x6174 )
  bl(GET_ROM_FUN) # Run the lookup function

print( test() )

If I try eg. bl(r2) I get "SyntaxError: label 'r2' not defined".

Problem 1 is because I'm a noob - if there's a simple answer to this I'd appreciate it, but it's not the topic of this thread.

Item 2 is my focus here: both my experience and the documentation seem to agree that all variants of the Branch instruction within inline thumb exclusively take labels and not raw memory addresses. I'd like to know if there's an elegant solution to this...

[RotatingLlama]

I realised that those 0x00000014 and 0x00000018 addresses are probably just the locations of pointers to the real data, so I tried dereferencing them before using them - which caused the board to lock up 🤦 I'm sure I'm still misunderstanding something fundamental - but then I should be using BL or BLX instead of mov( pc, r2 ) anyway, so hopefully the point is moot.

[RotatingLlama]

I figured it out. Thanks everyone who commented, for your help in pointing me in the right direction! For the sake of anyone else who comes across this, here's my code:

from array import array

# RP2040 datasheet
# https://pip-assets.raspberrypi.com/categories/814-rp2040/documents/RP-008371-DS-1-rp2040-datasheet.pdf

# Memory Locations (absolute)
_ROM_DATA_TABLE_PTR = const(0x16)
_HELPER_FN_PTR = const(0x18)

# Functions
_FTAN = const(0x44) # Ref rp2040 datasheet p139

@micropython.asm_thumb
def test(r0) -> int:
  
  b(ENTRY)
  
  # Retrieve the address of something in the ROM Data Table [ref rp2040 datasheet p132]
  #  Input: r1 = Lookup code
  # Output: r0 = Memory address
  label(ROM_DATA_TABLE)
  push({lr})
  mov( r0, _ROM_DATA_TABLE_PTR ) # Location of pointer to the lookup table.
  ldrh( r0, [r0,0] ) # Pointer to the lookup table (halfword)
  mov( r2, _HELPER_FN_PTR ) # Location of pointer to the helper function.
  ldrh( r2, [r2,0] ) # Pointer to the helper function (halfword)
  data(2, 0x4780 | 2 <<3) # BLX(r2) # Helper function puts memory address into r0
  pop({pc})
  
  # Get the Float Table location
  # Output: r0 = Pointer to float table
  label(GET_FLOAT_TABLE)
  push({lr})
  mov( r1, 0x53 ) # 'S'
  mov( r2, 0x46 ) # 'F'
  lsl( r2, r2, 8 )
  orr( r1, r2 ) # Float table lookup code => r1
  bl(ROM_DATA_TABLE) # Start address of SF table => r0
  pop({pc})
  
  
  # Main Routine
  label(ENTRY)
  mov( r4, r0 ) # Keep the buffer address in r4
  
  # Get the float table
  bl(GET_FLOAT_TABLE)
  mov( r7, r0 ) # Float table => r7
  
  # Run tan function
  ldr( r0, [ r4, 0 ] ) # buf[0] => r0
  ldr( r2, [ r7, _FTAN ] ) # Get tan function => r2
  data(2, 0x4780 | 2 <<3) # BLX(r2) # Run tan function
  str( r0, [ r4, 4 ] ) # Result => buf[1]

# Make an array to pass data into and out of the assembler code
buf = array('f',[0]*2) # Floats

# Input
buf[0] = 1.57

# Call the function, passing it the buffer.  Display whatever it leaves in r0
print(hex( test(buf) ))

# Display the buffer, now populated with the calculation result
print(buf)

[GitHubsSilverBullet]

You could try to encode the BLX manually
data(2, 0b010001111_0000_000 | REGNUM <<3) # BLX(REG)
or simpler data(2, 0x4780 | REGNUM <<3) # BLX(REG) instead.
Is it elegant? Certainly not.

[RotatingLlama]

Thanks! I'll try this later. If it assembles to the same code then it's better than the stack pointer thing I was doing.
Out of interest, how do you know to use the 2 and the 0x4780?

[GitHubsSilverBullet]

The ›2‹ is part of the micropython data instruction, meaning 16bit HALFWORDs are following.
The ›0x4780‹ is the binary encoding for the BLX thumb instruction with register 0, the shift operation ›or‹s it with the required register number at the appropriate position.

[peterhinch]

You could always cheat and use an RP2350 (Pico 2); this supports the asm_thumb FP instructions in hardware.

[RotatingLlama]

Haha, I'm aware! I didn't realise how much of a gap there was between the two chips (capability-wise) until I started looking into this low level stuff. The 2040 has some cool features too, though!

I'm sure there are a number of workarounds for the floating point thing, but (forgive the pun) that's not the point. I feel like I've identified a shortcoming of Micropython, so I want to document what the problem was (lack of arbitrary branching) and hopefully, a best-practice workaround that others can use.

[Josverl]

The documentation an asm_thumb does state in multiple locations that it only supports a subset of asm_thumb ( though apparently not in sufficient detail)
And given the Design Values, not supporting all is not a shortcoming per-se.

Adding clarity to the documentation for this case would surely be welcome.

[peterhinch]

asm_thumb and the docs were written for the Pyboard which supports Arm Thumb V7. RP2040 supports Arm Thumb V6. From the perspective of the MP subset the big difference is the lack of FP, but I think there are other differences around push/pop and the higher numbered registers. I forget the details. Re the subset it is quite a small (but capable) subset of V7.

The assembler has a means of defining inline data but it is very difficult to use this data in a program. I produced #1192 as a way to address this but it's long out of date. Some means of achieving this might enable jumps to arbitrary locations. As it is, the best way to input arbitrary 32 bit constants is via a Python array passed as an arg.

Adding clarity to the documentation for this case would surely be welcome.

True.

[RotatingLlama]

Valid points both, MP is certainly an impressive work and that's in large part due to the engineering tradeoffs that have been made. I can see the inline data functionality potentially being a good way to implement constants that aren't needed outside of the function...