Development tools and Programming for embedded processors

1
?????????????

• ???
• ????? ???
• 2008? 7?

2
Contents

• Introduction
• Computer Architecture
• ARM Architecture
• Development Tools
• GNU Development Tools
• ARM Instruction Set
• ARM Assembly Language
• ARM Assembly Programming
• GNU ARM ToolChain
• Interrupts and Monitor

3
Lecture 10Interrupts and Monitor
4
Outline

• Exception Handling and Software Interrupts
• ELF Executable and Linking Format
• ARM Monitor and Program Loading

5
Normal Program Flow vs. Exception

• Normally, programs execute sequentially (with a
  few branches to make life interesting)
• Normally, programs execute in user mode
• Exceptions and interrupts break the sequential
  flow of a program, jumping to architecturallydefi
  ned memory locations
• In ARM, SoftWare Interrupt (SWI) is the system
  call exception

6
ARM Exceptions

• Types of ARM exceptions
• Reset when CPU reset pin is asserted
• undefined instruction when CPU tries to execute
  an undefined op-code
• software interrupt when CPU executes the SWI
  instruction
• prefetch abort when CPU tries to execute an
  instruction pre-fetched from an illegal address
• data abort when data transfer instruction tries
  to read or write at an illegal address
• IRQ when CPU's external interrupt request pin is
  asserted
• FIQ when CPU's external fast interrupt request
  pin is asserted

7
The Programmers Model

• Processor Modes (of interest)
• User the normal program execution mode.
• IRQ used for general-purpose interrupt handling.
• Supervisor a protected mode for the operating
  system.
• The Register Set
• Registers R0-R15 CPSR
• R13 Stack Pointer (by convention)
• R14 Link Register (hardwired)
• R15 Program Counter where bits 01 are ignored
  (hardwired)

8
Terminology

• The terms exception and interrupt are often
  confused
• Exception usually refers to an internal CPU event
• floating point overflow
• MMU fault (e.g., page fault)
• trap (SWI)
• Interrupt usually refers to an external I/O event
• I/O device request
• reset
• In the ARM architecture manuals, the two terms
  are mixed together

9
What do SWIs do?

• SWIs (often called software traps) allow a user
  program to call the OS that is, SWIs are how
  system calls are implemented.
• When SWIs execute, the processor changes modes
  (from User to Supervisor mode on the ARM) and
  disables interrupts.

10
SWI Example

• Types of SWIs in ARM Angel (axd or armsd)
• SWI_WriteC(SWI 0) Write a byte to the debug
  channel
• SWI_Write0(SWI 2) Write the nullterminated
  string to debug channel
• SWI_ReadC(SWI 4) Read a byte from the debug
  channel
• SWI_Exit(SWI 0x11) Halt emulation this is how
  a program exits
• SWI_EnterOS(SWI 0x16) Put the processor in
  supervisor mode
• SWI_Clock(SWI 0x61) Return the number of
  centiseconds
• SWI_Time(SWI 0x63) Return the number of secs
  since Jan. 1, 1970

11
What happens on an SWI?1

• The ARM architecture defines a Vector Table
  indexed by exception type
• One SWI, CPU does the following PC lt0x08
• Also, sets LR_svc, SPSR_svc, CPSR (supervisor
  mode, no IRQ)

12
What happens on an SWI?2

• Not enough space in the table (only one
  instruction per entry) to hold all of the code
  for the SWI handler function
• This one instruction must transfer control to
  appropriate SWI Handler
• Several options are presented in the next slide

13
Vectoring Exceptions to Handlers

• Option of choice Load PC from jump table (shown
  below)
• Another option Direct branch (limited range)

14
What happens on SWI completion?

• Vectoring to the S_Handler starts executing the
  SWI handler
• When the handler is done, it returns to the
  program at the instruction following the SWI
• MOVS restores the original CPSR as well as
  changing pc

15
How to determine the SWI number?

• All SWIs go to 0x08

16
SWI Instruction Format

• Example SWI 0x18

17
Executing SWI Instruction

• On SWI, the processor
• (1) copies CPSR to SPSR_SVC
• (2) set the CPSR mode bits to supervisor mode
• (3) sets the CPSR IRQ to disable
• (4) stores the value (PC 4) into LR_SVC
• (5) forces PC to 0x08

SWI Handler (S_Handler)
LDR r0,lr,4 BIC r0,r0,0xff000000 R0 holds
SWI number
MOVS pc, lr
18
Jump to Service Routine

• On SWI, the processor
• (1) copies CPSR to SPSR_SVC
• (2) set the CPSR mode bits to supervisor mode
• (3) sets the CPSR IRQ to disable
• (4) stores the value (PC 4) into LR_SVC
• (5) forces PC to 0x08

SWI Handler (S_Handler)
LDR r0,lr,4 BIC r0,r0,0xff000000 switch
(r0) case 0x00 service_SWI1() case 0x01
service_SWI2() case 0x02 service_SWI3()
MOVS pc, lr
19
Problem with The Current Handler

• On SWI, the processor
• (1) copies CPSR to SPSR_SVC
• (2) set the CPSR mode bits to supervisor mode
• (3) sets the CPSR IRQ to disable
• (4) stores the value (PC 4) into LR_SVC
• (5) forces PC to 0x08

What was in R0? User program may have been using
this register. Therefore, cannot just use it
must first save it
SWI Handler (S_Handler)
LDR r0,lr,4 BIC r0,r0,0xff000000 switch
(r0) case 0x00 service_SWI1() case 0x01
service_SWI2() case 0x02 service_SWI3()
MOVS pc, lr
20
Full SWI Handler

• S_Handler
• SUB sp, sp, 4 _at_ leave room on stack for
  SPSR
• STMFD sp!, r0r12, lr _at_ store user's gp
  registers
• MRS r2, spsr _at_ get SPSR into gp registers
• STR r2, sp, 144 _at_ store SPSR above gp
  registers
• MOV r1, sp _at_ pointer to parameters on stack
• LDR r0, lr, 4 _at_ extract the SWI number
• BIC r0,r0,0xff000000 _at_ get SWI by
  bit-masking
• BL C_SWI_handler _at_ go to handler (see next
  slide)
• LDR r2, sp, 144 _at_ restore SPSR (NOT
  sp!)
• MSR spsr_csxf, r2 _at_ csxf flags
• LDMFD sp!, r0r12, lr _at_ unstack user's
  registers
• ADD sp, sp, 4 _at_ remove space used to store
  SPSR
• MOVS pc, lr _at_ return from handler

SPSR is stored above gp registers since the
registers may contain system call parameters (sp
in r1)
gp general-purpose
21
C_SWI_Handler

• void C_SWI_handler(unsigned number, unsigned
  regs)
• switch (number)
• case 0 / SWI number 0 code / break
• case 1 / SWI number 1 code / break
• ...
• case 0x100 puts(SWI 0x100 trigged!\n)
• break
• ...
• case XXX / SWI number XXX code / break
• default
• / end switch /
• / end C_SWI_handler() /

22
Loading the Vector Table

• / For 18-349, the Vector Table will use the
  LDR PC, PC,
• offset'' springboard approach /
• unsigned Install_Handler(unsigned int routine,
  unsigned int vector)
• unsigned int pcload_instr, old_handler,
  soft_vector
• pcload_instr vector / read the Vector
  Table instr (LDR ...) /
• pcload_instr 0xfff / compute offset of
  jump table entry /
• pcload_instr 0x8 (unsigned)vector /
  offset adjusted by PC
• 
  and prefetch /
• soft_vector (unsigned )pcload_instr /
  address to load pc from /
• old_handler soft_vector / remember the
  old handler /
• soft_vector routine / set up new
  handler in jump table /
• return (old_handler) / return old
  handler address /
• / end
  Install_Handler() /
• Called as
• Install_Handler ((unsigned) S_Handler, swivec)
• where,
• unsigned swivec (unsigned ) 0x08

23
Example SWI Application

• extern void S_Handler()
• extern void trigger()
• int main()
• unsigned swivec (unsigned ) 0x08
• unsigned backup
• backup Install_Handler ((unsigned)
  S_Handler, swivec)
• trigger()
• Install_Handler (backup, swivec)

.text .align 2 .global
trigger trigger STMFD sp!, lr
SWI 0x100 LDMFD sp!, pc
24
Exercise 3

• Write a service routine that receives a file name
  from a trigger and display the first lines of the
  file on the screen.
• Void service101(char filename)
• Write a trigger that pass a file name as an
  argument to the above service routine through SWI
  0x101.
• void trigger101(char filename)
• Write a main program to perform a demonstration.

25
Outline

• Exception Handling and Software Interrupts
• ELF Executable and Linking Format
• ARM Monitor and Program Loading

26
Introduction to ELF

• Executable and Linking Format
• Developed by Unix System Lab.
• Default binary format on Linux, Solaris 2.x, etc
• Some of the capabilities of ELF are dynamic
  linking, dynamic loading, imposing runtime
  control on a program, and an improved method for
  creating shared libraries.
• The ELF representation of control data in an
  object file is platform independent.

27
Three Types of ELF Files

• Relocatable file
• describes how it should be linked with other
  object files to create an executable file or
  shared library.
• Executable file
• supplies information necessary for the operating
  system to create a process image suitable for
  executing the code and accessing the data
  contained within the file.
• Shared object file
• contains information needed in both static and
  dynamic linking.

28
ELF File Format

• Two views for each of the three file types.
• Linking view and execution view
• These views support both the linking and
  execution of a program.
• Linking view is partitioned by sections.
• Execution view is partitioned by segments.
• The ELF access library, libelf, provides tools to
  extract and manipulate ELF object files.

29
ELF File Format (cont.)

• Linking View Execution View

ELF header
Program header table(optional)
Section 1

Section n


Section header table
ELF header
Program header table
Segment 1

Segment n


Section header table (optional)
30
Example readelf

• We can use readelf to output ELF information
• Example
• use -e option to read all header from the
  executable file of hello.c

cat hello.c / hello.c, a simple example
program / define GREETING "Hello, World!\n" int
main() puts(GREETING) arm-elf-gcc o
hello.elf hello.c arm-elf-readelf e hello.elf
31
Example ELF Header

• ELF Header
• Magic 7f 45 4c 46 01 01 01 61 00 00 00 00 00
  00 00 00
• Class ELF32
• Data 2's
  complement, little endian
• Version 1 (current)
• OS/ABI ARM
• ABI Version 0
• Type EXEC
  (Executable file)
• Machine ARM
• Version 0x1
• Entry point address 0x8100
• Start of program headers 52 (bytes
  into file)
• Start of section headers 168152
  (bytes into file)
• Flags 0x202, has
  entry point, GNU EABI, software FP
• Size of this header 52 (bytes)
• Size of program headers 32 (bytes)
• Number of program headers 1
• Size of section headers 40 (bytes)
• Number of section headers 25

32
Example Section Header

• Section Headers
• Nr Name Type Addr
  Off Size ES Flg Lk Inf Al
• 0 NULL 00000000
  000000 000000 00 0 0 0
• 1 .init PROGBITS 00008000
  008000 000020 00 AX 0 0 4
• 2 .text PROGBITS 00008020
  008020 0030e8 00 AX 0 0 4
• 3 .fini PROGBITS 0000b108
  00b108 00001c 00 AX 0 0 4
• 4 .rodata PROGBITS 0000b124
  00b124 000020 00 A 0 0 4
• 5 .data PROGBITS 0000b244
  00b244 00092c 00 WA 0 0 4
• 6 .eh_frame PROGBITS 0000bb70
  00bb70 000004 00 A 0 0 4
• 7 .ctors PROGBITS 0000bb74
  00bb74 000008 00 WA 0 0 4
• 8 .dtors PROGBITS 0000bb7c
  00bb7c 000008 00 WA 0 0 4
• 9 .jcr PROGBITS 0000bb84
  00bb84 000004 00 WA 0 0 4
• 10 .bss NOBITS 0000bb88
  00bb88 00010c 00 WA 0 0 4
• 11 .comment PROGBITS 00000000
  00bb88 000288 00 0 0 1
• 12 .debug_aranges PROGBITS 00000000
  00be10 000420 00 0 0 8
• 13 .debug_pubnames PROGBITS 00000000
  00c230 000726 00 0 0 1
• 14 .debug_info PROGBITS 00000000
  00c956 011f48 00 0 0 1
• 15 .debug_abbrev PROGBITS 00000000
  01e89e 0031f4 00 0 0 1
• 16 .debug_line PROGBITS 00000000
  021a92 002a14 00 0 0 1

33
Example Program Header

• Program Headers
• Type Offset VirtAddr PhysAddr
  FileSiz MemSiz Flg Align
• LOAD 0x008000 0x00008000 0x00008000
  0x03b88 0x03c94 RWE 0x8000
• Section to Segment mapping
• Segment Sections...
• 00 .init .text .fini .rodata .data
  .eh_frame .ctors .dtors .jcr .bss

34
Data Representation

• Support various processors with 8-bit bytes and
  32-bit architectures.
• Intended to be extensible to larger or smaller
  architecture.

Name Size Alignment Purpose
Elf32_Addr 4 4 Unsigned program address
Elf32_Half 2 2 Unsigned medium integer
Elf32_Off 4 4 Unsigned file offset
Elf32_Sword 4 4 Signed large integer
Elf32_Word 4 4 Unsigned large integer
unsigned char 1 1 Unsigned small integer
35
ELF Header1

• It is always the first section of the file.
• Describes the type of the object file .
• Its target architecture, and the version of ELF
  it is using.
• The location of the Program Header table, Section
  Header table, and String table along with
  associated number and size of entries for each
  table are also given.
• Contains the location of the first executable
  instruction.

36
ELF Header2

• define EI_NIDENT 16
• typedef struct
• unsigned char e_identEI_NIDENT// file ID,
  interpretation
• Elf32_Half e_type // object file type
• Elf32_Half e_machine // target architecture
• Elf32_Word e_version // ELF version
• Elf32_Addr e_entry // starting virtual
  address
• Elf32_Off e_phoff // file offset to program
  header
• Elf32_Off e_shoff // file offset to section
  header
• Elf32_Word e_flags // processor-specific
  flags
• Elf32_Half e_ehsize // the ELF headers size
• Elf32_Half e_phentsize // program header
  entry size
• Elf32_Half e_phnum // program header entry
  number
• Elf32_Half e_shentsize // section header
  entry size
• Elf32_Half e_shnum // section header entry
  number
• Elf32_Half e_shtrndx // section header
  index for string
• Elf32_Ehdr

37
Section Header

• The section header table is an array of
  structures.
• A section header table index is a subscript into
  this array.
• Each entry correlates to a section in the file.
• The entry provides the name, type, memory image
  starting address, file offset, the sections size
  in bytes, alignment.

38
The Section Header Table

• typedef struct
• Elf32_Word sh_name // name of section, an
  index
• Elf32_Word sh_type // type of section
• Elf32_Word sh_flags // section-specific
  attributes
• Elf32_Addr sh_addr // memory location of
  section
• Elf32_Off sh_offset // file offset to section
• Elf32_Word sh_size // size of section
• Elf32_Word sh_link // section type, dependent
• Elf32_Word sh_info // extra information,
  dependent
• Elf32_Word sh_addralign // address alignment
• Elf32_Word sh_entsize // size of an entry in
  section
• Elf32_Shdr

39
ELF Sections

• A number of types of sections described by
  entries in the section header table.
• Sections can hold executable code, data, dynamic
  linking information, debugging data, symbol
  tables, relocation information, comments, string
  tables, and notes.

40
Special Sections1

• Various sections in ELF are pre-defined.
• A list of special sections
• .bss un-initialized data
• .comment version control information
• .data and .data1 initialized data present
• .debug information for symbolic debugging
• .dynamic dynamic linking information
• .dynstr strings needed for dynamic linking
• .hash symbol hash table
• .line line number information for debugging

41
Special Sections2

• A list of special sections (cont.)
• .note file notes
• .relname and .relaname
• relocation data
• .rodata and .rodata1
• read-only data
• .shstrtab section names
• .strtab the strings that represent the names
• associated with symbol table entries
• .symtab symbol table
• .text executable instructions

42
String Table

• The object file uses these strings to represent
  symbol and section names.
• The first and last byte is defined to hold a null
  character.
• An empty string table section is permitted.
• Ex

index 0 1 2 3 4 5 6 7 8 9
0 \0 n a m e . \0 V a r
10 i a b l e \0 a b l e
20 \0 \0 x x \0
43
Symbol Table

• Holds information needed to locate and relocate a
  programs symbolic definitions and references.
• A symbol table entry

typedef struct Elf32_Word st_name //
symbol name, an index Elf32_Addr st_value //
symbol value Elf32_Word st_size // symbol
size unsigned char st_info // symbols type
and binding attributes unsigned char st_other
// symbol visibility Elf32_Half st_shndx //
relevant section header table index Elf32_Sym
44
Program Header

• Program headers are meaningful only for
  executable and shared object files.
• The program header table is an array of
  structures, each describing a segment or other
  information.
• An object file segment contains one or more
  sections.
• A file specifies its own program header size with
  the ELF headers e_phentsize e_phnum.

45
The Program Header Table

• typedef struct
• Elf32_Word p_type // type of the segment
• Elf32_Off p_offset // file offset to segment
• Elf32_Addr p_vaddr // virtual address of
  first byte
• Elf32_Addr p_paddr // segments physical
  address
• Elf32_Word p_filesz // size of file image of
  segment
• Elf32_Word p_memsz // size of memory image of
  segment
• Elf32_Word p_flags // segment-specific flags
• Elf32_Word p_align // alignment requirements
• Elf32_Phdr

46
Executable Programs

• A program to be loaded by the system must have at
  least one loadable segment.
• Segments are a way of grouping related sections.
• A process image is created by loading and
  interpreting segments.
• Segment contents
• A segment comprises one or more sections.
• Text segments contain read-only instructions and
  data.
• Data segments contain writable data and
  instructions

47
ELF Segments

• Text segment example

• Data segment example

.hash
.dynsym
.dynstr
.text
.rodata
.rel
.plt
.data
.dynamic
.got
.bss
48
Exercise 4

• Write a service routine that receives the name of
  an ELF executable file as a parameter and display
  the offset of program header on the screen.
• Void service102(char filename)
• Write a trigger that pass a file name to the
  above service routine through SWI 102.
• void trigger102(char filename)
• Write a main program to perform a demonstration.

49
Outline

• Exception Handling and Software Interrupts
• ELF Executable and Linking Format
• ARM Monitor and Program Loading

50
Overview of ARM Debug Monitor

• The ARM Debug Monitor is called Angel (earlier
  versions called it the Demon get it?)
• Provides
• lowlevel programming C library and debugging
  environment
• When the X-board first boots, they load the demon
  from flash memory (emulator pretends that this
  happens)
• This activity is called bootstrapping

51
Memory Map of Demon

• 0x0000 CPU reset vector
• 0x0004 ...0x1c CPU undefined instruction ... CPU
  Fast Interrupt Vector
• 0x0020 1K Bytes for FIQ and FIQ mode stack
• 0x0400 256 bytes for IRQ mode stack
• 0x0500 256 bytes for Undefined mode stack
• 0x0600 256 bytes for Abort mode stack
• 0x0700 256 bytes for SVC mode stack
• 0x0800 Debug monitor private workspace
• 0x1000 Free for user-supplied Debug Monitor
• 0x2000 Floating Point Emulation Space
• 0x8000 Application Space
• top of memory SWI_Getenv returns top of memory
  0x08000000

52
Monitor Program

• Provide Capability to
• Setup Hardware on startup
• Load and run programs
• Debug code
• Minimal OS functionality
• Many embedded systems are just
• Monitor application
• Monitor still handles other types of interrupts
  (we'll cover this later)
• l timer, I/O (e.g., keypad, switches, LED, LCD)

53
Example System

• Interrupt from external devices
• keyboards, timers, disk drives

• We refer to each piece of software as a process
• Codes
• Program counter
• Registers
• Stack
• Other terms
• Task
• Thread

54
Debug Monitor SWIs

• Angel provides a number of SWIs that you can use
• SWI_WriteC (0) Write a byte to the debug
  channel
• SWI_Write0(2) Write the null-terminated string
  to debug channel
• SWI_ReadC(4) Read a byte from the debug channel
  
• SWI_Exit (0x11) Halt emulation this is how a
  program exits
• SWI_EnterOS (0x16) Put the processor in
  supervisor mode
• SWI_GetErrno (0x60) Returns (r0) the value of
  the C library err-no variable
• SWI_Clock (0x61) Return the number of
  centi-seconds
• SWI_Time (0x63) Return the number of seconds
  since Jan. 1, 1970
• SWI_Remove (0x64) Deletes the file named by
  pointer in r0
• SWI_Rename (0x65) Renames a file
• SWI_Open (0x66) Open file (or device)
• SWI_Close (0x68) Close a file (or device)
• SWI_Write (0x69) Read a file
• SWI_Read (0x6a) Write a file
• SWI_Seek (0x6b) Seek to a specific location in
  a file
• SWI_Flen (0x6c) Returns length of the file
  object
• SWI_InstallHandler(0x70) installs a handler for
  a hardware exception

55
Program Loading

• Monitor reads program from ??? and puts it into
  RAM
• Does it just copy the executable into RAM??
• Where does it put it??
• Who sets up the user stack??
• Who sets up the user heap??

56
ARM File Formats

• ARM supports many formats for executables
• Executable ARM Image Format (AIF)
• Non-executable ARM Image Format (AIF)
• ARM Object Format (AOF)
• ARM Object Library Format
• ARM Symbolic Debug Table Format
• ARM ELF
• Specialized version of ELF
• Each provides code data other information
• We will focus on ARM ELF

57
ARM ELF

• ARM ELF
• ELF (Executable and Linking Format) header
• Image's code
• Image's initialized static data
• Debug and relocation information (optional)
• We will use static linking (no dynamic linking or
  shared libraries)

ELF Header
Program Header Table
Segment 1
Segment 2

Section Header Table optional
ARM ELF File
58
Loading an Executable1

• Read the executable file
• ARMulator gets stuff from the native file system
• Loader uses the SWI_Open and SWI_Read Monitor
  system calls
• Parse the header to determine the size of the
  image
• Starting location and image base
• Create new address space for program large enough
  to hold text and data segments, along with a
  stack segment
• Copy instructions and data from executable file
  into the new address space

59
Loading an Executable2

• Zero-init the un-initialized data
• Copy arguments passed to the program onto the
  stack
• Initializes machine registers
• Most registers cleared, but stack pointer
  assigned address of 1st free stack location
• Jumps to start-up routine that copies programs
  arguments from stack to registers and sets the PC
• If main routine returns, start-up routine
  terminates program with the SWI_Exit system call

60
Optional ARM ELF Components

• Compression
• Self-decompression code included in image
• Relocation
• Self relocation code included in image
• Debugging
• Symbol table for debugger use
• String tables for efficient allocation of strings
  
• Can have more than one section per segment

61
Starting a Program

• We discussed how an application's initial PC is
  set
• The loader gets the address of the starting
  instruction from the object file header
• To start the program, the loader moves the
  specified address into the PC
• Is main() the starting point?
• In other words, does the PC initially get set to
  the address of main()?
• Let's look at an example

62
Listing from arm-elf-objdump1

• Disassembly of section .init
• 00008000 lt_initgt
• 8000 e1a0c00d mov ip, sp
• 8004 e92ddff8 stmdb sp!, r3, r4, r5, r6,
  r7, r8, r9, sl, fp, ip, lr, pc
• 8008 e24cb004 sub fp, ip, 4 0x4
• 800c eb000023 bl 80a0 ltframe_dummygt
• 8010 eb000c2d bl b0cc lt__do_global_ctors_aux
  gt
• 8014 e24bd028 sub sp, fp, 40 0x28
• 8018 e89d6ff0 ldmia sp, r4, r5, r6, r7,
  r8, r9, sl, fp, sp, lr
• 801c e1a0f00e mov pc, lr
• Disassembly of section .text
• 00008020 lt__do_global_dtors_auxgt
• 8020 e92d4030 stmdb sp!, r4, r5, lr
• 8024 e59f505c ldr r5, pc, 92 8088
  lt.text0x68gt
• 8028 e5d53000 ldrb r3, r5
• 802c e3530000 cmp r3, 0 0x0
• 8030 18bd8030 ldmneia sp!, r4, r5, pc

• Initialization code

63
Listing from arm-elf-objdump2

• 804c e5843000 str r3, r4
• 8050 e1a0e00f mov lr, pc
• 8054 e12fff12 bx r2
• 8058 e5943000 ldr r3, r4
• 805c e5932000 ldr r2, r3
• 8060 e3520000 cmp r2, 0 0x0
• 8064 1afffff7 bne 8048 lt__do_global_dtors_au
  x0x28gt
• 8068 e59f3020 ldr r3, pc, 32 8090
  lt.text0x70gt
• 806c e3530000 cmp r3, 0 0x0
• 8070 159f001c ldrne r0, pc, 28 8094
  lt.text0x74gt
• 8074 11a0e00f movne lr, pc
• 8078 112fff13 bxne r3
• 807c e3a03001 mov r3, 1 0x1
• 8080 e5c53000 strb r3, r5
• 8084 e8bd8030 ldmia sp!, r4, r5, pc
• 8088 0000bb88 andeq fp, r0, r8, lsl 23
• 808c 0000b248 andeq fp, r0, r8, asr 4
• 8090 00000000 andeq r0, r0, r0
• 8094 0000bb70 andeq fp, r0, r0, ror fp

64
Listing from arm-elf-objdump3

• 80a0 e59f303c ldr r3, pc, 60 80e4
  lt.text0xc4gt
• 80a4 e3530000 cmp r3, 0 0x0
• 80a8 e52de004 str lr, sp, -4!
• 80ac e59f0034 ldr r0, pc, 52 80e8
  lt.text0xc8gt
• 80b0 e59f1034 ldr r1, pc, 52 80ec
  lt.text0xccgt
• 80b4 11a0e00f movne lr, pc
• 80b8 112fff13 bxne r3
• 80bc e59f002c ldr r0, pc, 44 80f0
  lt.text0xd0gt
• 80c0 e5903000 ldr r3, r0
• 80c4 e3530000 cmp r3, 0 0x0
• 80c8 e59f3024 ldr r3, pc, 36 80f4
  lt.text0xd4gt
• 80cc 049df004 ldreq pc, sp, 4
• 80d0 e3530000 cmp r3, 0 0x0
• 80d4 049df004 ldreq pc, sp, 4
• 80d8 e1a0e00f mov lr, pc
• 80dc e12fff13 bx r3
• 80e0 e49df004 ldr pc, sp, 4
• 80e4 00000000 andeq r0, r0, r0
• 80e8 0000bb70 andeq fp, r0, r0, ror fp

65
Listing from arm-elf-objdump4

• 80fc e49df004 ldr pc, sp, 4
• 00008100 lt_mainCRTStartupgt
• 8100 e3a00016 mov r0, 22 0x16
• 8104 e28f10e4 add r1, pc, 228 0xe4
• 8108 ef123456 swi 0x00123456
• 810c e59f00dc ldr r0, pc, 220 81f0
  lt.text0x1d0gt
• 8110 e590d008 ldr sp, r0, 8
• 8114 e590a00c ldr sl, r0, 12
• 8118 e28aac01 add sl, sl, 256 0x100
• 811c e3a01000 mov r1, 0 0x0
• 8120 e1a0b001 mov fp, r1
• 8124 e1a07001 mov r7, r1
• 8128 e59f00c4 ldr r0, pc, 196 81f4
  lt.text0x1d4gt
• 812c e59f20c4 ldr r2, pc, 196 81f8
  lt.text0x1d8gt
• 8130 e0422000 sub r2, r2, r0
• 8134 eb00004c bl 826c ltmemsetgt
• 8138 eb000152 bl 8688 ltinitialise_monitor_ha
  ndlesgt
• 813c e3a00015 mov r0, 21 0x15

? Entry point
66
Listing from arm-elf-objdump5

• 8158 e3530000 cmp r3, 0 0x0
• 815c 0a000011 beq 81a8 lt_mainCRTStartup0xa8
  gt
• 8160 e3530020 cmp r3, 32 0x20
• 8164 0afffffa beq 8154 lt_mainCRTStartup0x54
  gt
• 8168 e3530022 cmp r3, 34 0x22
• 816c 13530027 cmpne r3, 39 0x27
• 8170 01a02003 moveq r2, r3
• 8174 13a02020 movne r2, 32 0x20
• 8178 12411001 subne r1, r1, 1 0x1
• 817c e92d0002 stmdb sp!, r1
• 8180 e2800001 add r0, r0, 1 0x1
• 8184 e4d13001 ldrb r3, r1, 1
• 8188 e3530000 cmp r3, 0 0x0
• 818c 0a000005 beq 81a8 lt_mainCRTStartup0xa8
  gt
• 8190 e1520003 cmp r2, r3
• 8194 1afffffa bne 8184 lt_mainCRTStartup0x84
  gt
• 8198 e3a02000 mov r2, 0 0x0
• 819c e2413001 sub r3, r1, 1 0x1
• 81a0 e5c32000 strb r2, r3

67
Listing from arm-elf-objdump6

• 81bc 85935000 ldrhi r5, r3
• 81c0 85225004 strhi r5, r2, -4!
• 81c4 84834004 strhi r4, r3, 4
• 81c8 8afffff9 bhi 81b4 lt_mainCRTStartup0xb4
  gt
• 81cc e1a04000 mov r4, r0
• 81d0 e1a05001 mov r5, r1
• 81d4 e59f0020 ldr r0, pc, 32 81fc
  lt.text0x1dcgt
• 81d8 eb000011 bl 8224 ltatexitgt
• 81dc ebffff87 bl 8000 lt_initgt
• 81e0 e1a00004 mov r0, r4
• 81e4 e1a01005 mov r1, r5
• 81e8 eb000006 bl 8208 ltmaingt
• 81ec eb000011 bl 8238 ltexitgt
• 81f0 0000b24c andeq fp, r0, ip, asr 4
• 81f4 0000bb88 andeq fp, r0, r8, lsl 23
• 81f8 0000bc94 muleq r0, r4, ip
• 81fc 0000b108 andeq fp, r0, r8, lsl 2
• 8200 0000b25c andeq fp, r0, ip, asr r2
• 8204 000000ff streqd r0, r0, -pc

• Call init code

• Call users main
• Call exit before quit

? The users main
68
Listing from arm-elf-objdump7

• 8218 eb000056 bl 8378 ltputsgt
• 821c e89da800 ldmia sp, fp, sp, pc
• 8220 0000b124 andeq fp, r0, r4, lsr 2
• 00008224 ltatexitgt
• 8224 e1a01000 mov r1, r0
• 8228 e3a00000 mov r0, 0 0x0
• 822c e1a02000 mov r2, r0
• 8230 e1a03000 mov r3, r0
• 8234 ea000264 b 8bcc lt__register_exitprocgt
• 00008238 ltexitgt
• 8238 e92d4010 stmdb sp!, r4, lr
• 823c e3a01000 mov r1, 0 0x0
• 8240 e1a04000 mov r4, r0
• 8244 eb000297 bl 8ca8 lt__call_exitprocsgt
• 8248 e59f3018 ldr r3, pc, 24 8268
  lt.text0x248gt
• 824c e5930000 ldr r0, r3
• 8250 e590203c ldr r2, r0, 60

? Code on exit
69
Starting a C Program

• To get to main() takes hundreds of instructions!
• In a modern OS, it can take several thousands of
  instructions!
• Why? Because the C compiler generates code for a
  number of setup routines before the call to
  main().
• These setup routines handle the stack, data
  segments, heap and other miscellaneous functions.

70
Starting an Assembly Program

• What about assembly code?
• If the assembly code interfaces to C code and the
  ENTRY point is the C function main(), then the C
  compiler will generate the setup code
• But, if the entire program is written in assembly
  OR there is no C function called main(), then the
  setup code is not generated.
• What does this mean for you?
• What's the SP register pointing to when you start
  your program?

71
Assembly Example

• .text
• .align 2
• .global _start
• _start
• ldr r1, num1
• ldr r0, num2
• add r5, r1, r0
• str r5, sum
• mov pc, lr
• num2 .word 0x7
• num1 .word 0x5
• sum .space 0x4

72
Listing of Assembly Example

• test.elf file format elf32-littlearm
• Disassembly of section .text
• 00008000 lt_startgt
• 8000 e59f1010 ldr r1, pc,
  16 8018 ltnum1gt
• 8004 e59f0008 ldr r0, pc,
  8 8014 ltnum2gt
• 8008 e0815000 add r5, r1,
  r0
• 800c e58f5008 str r5, pc,
  8 801c ltsumgt
• 8010 e1a0f00e mov pc, lr
• 00008014 ltnum2gt
• 8014 00000007 andeq r0, r0,
  r7
• 00008018 ltnum1gt
• 8018 00000005 andeq r0, r0,
  r5
• 0000801c ltsumgt
• 801c 00000000 andeq r0, r0, r0