After executing a BX instruction to change into Thumb state, the ARM7TDMI is outputting addresses with A[0] set. Why is this?

The processor always produces a byte address, but instructions are either words (4 bytes) or halfwords (2 bytes) and data can be any size. When word aligned instructions are fetched from memory, A[1:0] are undefined and when halfword instructions are fetched, A[0] is undefined.

You should not rely on any particular value to be in these bits and the memory system should not look at those bits.

To give a little more detail about what actually happens (this is to help you understand the behavior - you don't need to know this, as the memory system should simply ignore these bits).

The ARM7TDMI will output some value on the A[] bus on every cycle. The internal control logic can choose from one of four address sources

• the PC (used only when the A[] value needs to be refreshed after performing a load or store instruction. Only bits [31:2] (ARM) or [31:1] (Thumb) are actually driven onto A[] and latches are used to hold whatever value was previously there for the bits A[1:0] or A[0]. This was done for backward compatibility with older ARM cores, which used these bits to store mode information.
• the ALU (used to calculate addresses for loads & stores and branches)
• the exception vector table
• the Address Incrementer which adds 2 or 4 to the previous address (used for LDM or STM instructions or for fetching instructions sequentially).

So, in the case of a BX instruction, the ALU is used to calculate the address (it calculates r0 + 0) which gives a result with bit 0 set. This address appears on the A[] bus. The subsequent instruction fetches use the incrementer to simply add 2 to the previous address, so bit 0 stays set.

If after changing into thumb state, you do a word aligned load or store instruction, for example, you may see that after that, bit 0 of the address bus is clear and stays clear for subsequent instruction fetches.

See also:

• How does the memory controller know whether the current access is aligned/non aligned word/halfword/byte?