SlideShare uma empresa Scribd logo
1 de 72
嵌入式處理器架構與程式設計
王建民
中央研究院 資訊所
2008年 7月
2
Contents
 Introduction
 Computer Architecture
 ARM Architecture
 Development Tools
 GNU Development Tools
 ARM Instruction Set
 ARM Assembly Language
 ARM Assembly Programming
 GNU ARM ToolChain
 Interrupts and Monitor
Lecture 10
Interrupts and Monitor
4
Outline
 Exception Handling and Software Interrupts
 ELF: Executable and Linking Format
 ARM Monitor and Program Loading
5
Normal Program Flow vs. Exception
 Normally, programs execute sequentially (with a
few branches to make life interesting)
 Normally, programs execute in user mode
 Exceptions and interrupts break the sequential
flow of a program, jumping to architecturally-
defined memory locations
 In ARM, SoftWare Interrupt (SWI) is the “system
call” exception
6
ARM Exceptions
 Types of ARM exceptions
 Reset: when CPU reset pin is asserted
 undefined instruction: when CPU tries to execute an
undefined op-code
 software interrupt: when CPU executes the SWI
instruction
 prefetch abort: when CPU tries to execute an
instruction pre-fetched from an illegal address
 data abort: when data transfer instruction tries to read
or write at an illegal address
 IRQ: when CPU's external interrupt request pin is
asserted
 FIQ: when CPU's external fast interrupt request pin is
asserted
7
The Programmer’s Model
 Processor Modes (of interest)
 User: the “normal” program execution mode.
 IRQ: used for general-purpose interrupt handling.
 Supervisor: a protected mode for the operating system.
 The Register Set
 Registers R0-R15 + CPSR
 R13: Stack Pointer (by convention)
 R14: Link Register (hardwired)
 R15: Program Counter where bits 0:1 are ignored
(hardwired)
8
Terminology
 The terms exception and interrupt are often
confused
 Exception usually refers to an internal CPU event
 floating point overflow
 MMU fault (e.g., page fault)
 trap (SWI)
 Interrupt usually refers to an external I/O event
 I/O device request
 reset
 In the ARM architecture manuals, the two terms
are mixed together
9
What do SWIs do?
 SWIs (often called software traps) allow a user
program to “call” the OS that is, SWIs are how
system calls are implemented.
 When SWIs execute, the processor changes modes
(from User to Supervisor mode on the ARM) and
disables interrupts.
10
SWI Example
 Types of SWIs in ARM Angel (axd or armsd)
 SWI_WriteC(SWI 0) Write a byte to the debug
channel
 SWI_Write0(SWI 2) Write the nullterminated
string to debug channel
 SWI_ReadC(SWI 4) Read a byte from the debug
channel
 SWI_Exit(SWI 0x11) Halt emulation this is how a
program exits
 SWI_EnterOS(SWI 0x16) Put the processor in
supervisor mode
 SWI_Clock(SWI 0x61) Return the number of centi-
seconds
 SWI_Time(SWI 0x63) Return the number of secs
since Jan. 1, 1970
11
What happens on an SWI?1
 The ARM architecture defines a Vector Table indexed by
exception type
 One SWI, CPU does the following: PC <0x08
 Also, sets LR_svc, SPSR_svc, CPSR (supervisor mode,
no IRQ)
ADD r0,r0,r1
SWI 0x10
SUB r2,r2,r0
USER Program to R_Handler
to U_Handler
to S_Handler
to P_Handler
to D_Handler
...
to I_Handler
to F_Handler
Vector Table (spring board)
starting at 0x00 in memory
0x00
0x04
0x08
0x0c
0x10
0x14
0x18
0x1c
(Reset
(Undef instr.)
(SWI)
(Prefetch abort)
(Data abort)
(Reserved)
(IRQ)
(FIQ)
SWI Handler
1
12
What happens on an SWI?2
 Not enough space in the table (only one instruction per
entry) to hold all of the code for the SWI handler function
 This one instruction must transfer control to appropriate
SWI Handler
 Several options are presented in the next slide
ADD r0,r0,r1
SWI 0x10
SUB r2,r2,r0
USER Program to R_Handler
to U_Handler
to S_Handler
to P_Handler
to D_Handler
...
to I_Handler
to F_Handler
Vector Table (spring board)
starting at 0x00 in memory
0x00
0x04
0x08
0x0c
0x10
0x14
0x18
0x1c
(Reset
(Undef instr.)
(SWI)
(Prefetch abort)
(Data abort)
(Reserved)
(IRQ)
(FIQ)
SWI Handler
2
13
“Vectoring” Exceptions to Handlers
 Option of choice: Load PC from jump table (shown below)
 Another option: Direct branch (limited range)
ADD r0,r0,r1
SWI 0x10
SUB r2,r2,r0
USER Program LDR pc, pc, 0x100
LDR pc, pc, 0x100
LDR pc, pc, 0x100
LDR pc, pc, 0x100
LDR pc, pc, 0x100
LDR pc, pc, 0x100
LDR pc, pc, 0x100
LDR pc, pc, 0x100
Vector Table (spring board)
starting at 0x00 in memory
0x00
0x04
0x08
0x0c
0x10
0x14
0x18
0x1c
SWI Handler
(S_Handler)
2
&A_Handler
&U_Handler
&S_Handler
&P_Handler
...
“Jump” Table
0x108
0x10c
0x110
0x114
...
Why 0x110?
14
What happens on SWI completion?
 Vectoring to the S_Handler starts executing the SWI
handler
 When the handler is done, it returns to the program at the
instruction following the SWI
 MOVS restores the original CPSR as well as changing pc
ADD r0,r0,r1
SWI 0x10
SUB r2,r2,r0
USER Program to R_Handler
to U_Handler
to S_Handler
to P_Handler
to D_Handler
...
to I_Handler
to F_Handler
Vector Table (spring board)
starting at 0x00 in memory
0x00
0x04
0x08
0x0c
0x10
0x14
0x18
0x1c
(Reset
(Undef instr.)
(SWI)
(Prefetch abort)
(Data abort)
(Reserved)
(IRQ)
(FIQ)
3 MOVS pc, lr
SWI Handler
(S_Handler)
15
How to determine the SWI number?
 All SWIs go to 0x08
ADD r0,r0,r1
SWI 0x10
SUB r2,r2,r0
USER Program to R_Handler
to U_Handler
to S_Handler
to P_Handler
to D_Handler
...
to I_Handler
to F_Handler
Vector Table (spring board)
starting at 0x00 in memory
0x00
0x04
0x08
0x0c
0x10
0x14
0x18
0x1c
(Reset
(Undef instr.)
(SWI)
(Prefetch abort)
(Data abort)
(Reserved)
(IRQ)
(FIQ)
SWI Handler must
serve as clearing
house for different
SWIs
MOVS pc, lr
SWI Handler
(S_Handler)
16
SWI Instruction Format
 Example: SWI 0x18
24-bit “comment” field (ignored by processor)
1 1 1 1
cond
0
23
24
27
31 28
SWI number
17
Executing SWI Instruction
On SWI, the processor
(1) copies CPSR to SPSR_SVC
(2) set the CPSR mode bits to supervisor mode
(3) sets the CPSR IRQ to disable
(4) stores the value (PC + 4) into LR_SVC
(5) forces PC to 0x08
ADD r0,r0,r1
SWI 0x10
SUB r2,r2,r0
USER Program to R_Handler
to U_Handler
to S_Handler
to P_Handler
to D_Handler
...
to I_Handler
to F_Handler
Vector Table (spring board)
starting at 0x00 in memory
0x00
0x04
0x08
0x0c
0x10
0x14
0x18
0x1c
(Reset
(Undef instr.)
(SWI)
(Prefetch abort)
(Data abort)
(Reserved)
(IRQ)
(FIQ)
LDR r0,[lr,#4]
BIC r0,r0,#0xff000000
R0 holds SWI number
MOVS pc, lr
SWI Handler
(S_Handler)
24-bit “comment” field (ignored by processor)
1 1 1 1
cond
18
Jump to “Service Routine”
ADD r0,r0,r1
SWI 0x10
SUB r2,r2,r0
USER Program to R_Handler
to U_Handler
to S_Handler
to P_Handler
to D_Handler
...
to I_Handler
to F_Handler
Vector Table (spring board)
starting at 0x00 in memory
0x00
0x04
0x08
0x0c
0x10
0x14
0x18
0x1c
(Reset
(Undef instr.)
(SWI)
(Prefetch abort)
(Data abort)
(Reserved)
(IRQ)
(FIQ)
LDR r0,[lr,#4]
BIC r0,r0,#0xff000000
switch (r0){
case 0x00: service_SWI1();
case 0x01: service_SWI2();
case 0x02: service_SWI3();
…
}
MOVS pc, lr
SWI Handler
(S_Handler)
24-bit “comment” field (ignored by processor)
1 1 1 1
cond
On SWI, the processor
(1) copies CPSR to SPSR_SVC
(2) set the CPSR mode bits to supervisor mode
(3) sets the CPSR IRQ to disable
(4) stores the value (PC + 4) into LR_SVC
(5) forces PC to 0x08
19
Problem with The Current Handler
On SWI, the processor
(1) copies CPSR to SPSR_SVC
(2) set the CPSR mode bits to supervisor mode
(3) sets the CPSR IRQ to disable
(4) stores the value (PC + 4) into LR_SVC
(5) forces PC to 0x08
ADD r0,r0,r1
SWI 0x10
SUB r2,r2,r0
USER Program to R_Handler
to U_Handler
to S_Handler
to P_Handler
to D_Handler
...
to I_Handler
to F_Handler
Vector Table (spring board)
starting at 0x00 in memory
0x00
0x04
0x08
0x0c
0x10
0x14
0x18
0x1c
(Reset
(Undef instr.)
(SWI)
(Prefetch abort)
(Data abort)
(Reserved)
(IRQ)
(FIQ)
LDR r0,[lr,#4]
BIC r0,r0,#0xff000000
switch (r0){
case 0x00: service_SWI1();
case 0x01: service_SWI2();
case 0x02: service_SWI3();
…
}
MOVS pc, lr
SWI Handler
(S_Handler)
What was in R0? User program
may have been using this
register. Therefore, cannot just
use it must first save it
20
Full SWI Handler
S_Handler:
SUB sp, sp, #4 @ leave room on stack for SPSR
STMFD sp!, {r0r12, lr} @ store user's gp registers
MRS r2, spsr @ get SPSR into gp registers
STR r2, [sp, #14*4] @ store SPSR above gp registers
MOV r1, sp @ pointer to parameters on stack
LDR r0, [lr, #4] @ extract the SWI number
BIC r0,r0,#0xff000000 @ get SWI # by bit-masking
BL C_SWI_handler @ go to handler (see next slide)
LDR r2, [sp, #14*4] @ restore SPSR (NOT “sp!”)
MSR spsr_csxf, r2 @ csxf flags
LDMFD sp!, {r0r12, lr} @ unstack user's registers
ADD sp, sp, #4 @ remove space used to store SPSR
MOVS pc, lr @ return from handler
gp = general-purpose
SPSR is stored above gp registers since the registers
may contain system call parameters (sp in r1)
21
C_SWI_Handler
void C_SWI_handler(unsigned number, unsigned *regs)
{
switch (number){
case 0: /* SWI number 0 code */ break;
case 1: /* SWI number 1 code */ break;
...
case 0x100: puts(“SWI 0x100 trigged!n”);
break;
...
case XXX: /* SWI number XXX code */ break;
default:
} /* end switch */
} /* end C_SWI_handler() */
spsr_svc
lr_svc
r4
r3
r12
r11
r10
r9
r8
r7
r6
r5
r2
r1
r0
Previous sp_svc
sp_svc
regs[12]
regs[0] (also *regs)
22
Loading the Vector Table
/* For 18-349, the Vector Table will use the ``LDR PC, PC,
* offset'' springboard approach */
unsigned Install_Handler(unsigned int routine, unsigned int *vector)
{
unsigned int pcload_instr, old_handler, *soft_vector;
pcload_instr = *vector; /* read the Vector Table instr (LDR ...) */
pcload_instr &= 0xfff; /* compute offset of jump table entry */
pcload_instr += 0x8 + (unsigned)vector; /* == offset adjusted by PC
and prefetch */
soft_vector = (unsigned *)pcload_instr; /* address to load pc from */
old_handler = *soft_vector; /* remember the old handler */
*soft_vector = routine; /* set up new handler in jump table */
return (old_handler); /* return old handler address */
} /* end Install_Handler() */
Called as
Install_Handler ((unsigned) S_Handler, swivec);
where,
unsigned *swivec = (unsigned *) 0x08;
23
.text
.align 2
.global trigger
trigger:
STMFD sp!, {lr}
SWI #0x100
LDMFD sp!, {pc}
extern void S_Handler();
extern void trigger();
int main()
{
unsigned *swivec = (unsigned *) 0x08;
unsigned backup;
backup = Install_Handler ((unsigned) S_Handler, swivec);
trigger();
Install_Handler (backup, swivec);
}
Example: SWI Application
24
Exercise #3
 Write a service routine that receives a file name
from a trigger and display the first lines of the file
on the screen.
 Void service101(char *filename);
 Write a trigger that pass a file name as an
argument to the above service routine through
SWI #0x101.
 void trigger101(char *filename);
 Write a main program to perform a demonstration.
25
Outline
 Exception Handling and Software Interrupts
 ELF: Executable and Linking Format
 ARM Monitor and Program Loading
26
Introduction to ELF
 Executable and Linking Format
 Developed by Unix System Lab.
 Default binary format on Linux, Solaris 2.x, etc…
 Some of the capabilities of ELF are dynamic
linking, dynamic loading, imposing runtime
control on a program, and an improved method for
creating shared libraries.
 The ELF representation of control data in an
object file is platform independent.
27
Three Types of ELF Files
 Relocatable file
 describes how it should be linked with other object files
to create an executable file or shared library.
 Executable file
 supplies information necessary for the operating system
to create a process image suitable for executing the
code and accessing the data contained within the file.
 Shared object file
 contains information needed in both static and dynamic
linking.
28
ELF File Format
 Two views for each of the three file types.
 Linking view and execution view
 These views support both the linking and
execution of a program.
 Linking view is partitioned by sections.
 Execution view is partitioned by segments.
 The ELF access library, libelf, provides
tools to extract and manipulate ELF object
files.
29
ELF File Format (cont.)
 Linking View Execution View
ELF header
Program header table
(optional)
Section 1
…
Section n
…
…
Section header table
ELF header
Program header table
Segment 1
…
Segment n
…
…
Section header table
(optional)
30
Example: readelf
 We can use “readelf” to output ELF information
 Example
 use “-e” option to read all header from the executable
file of “hello.c”
$ cat hello.c
/* hello.c, a simple example program */
#define GREETING "Hello, World!n"
int main()
{
puts(GREETING);
}
$ arm-elf-gcc –o hello.elf hello.c
$ arm-elf-readelf –e hello.elf
31
Example: ELF Header
ELF Header:
Magic: 7f 45 4c 46 01 01 01 61 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: ARM
ABI Version: 0
Type: EXEC (Executable file)
Machine: ARM
Version: 0x1
Entry point address: 0x8100
Start of program headers: 52 (bytes into file)
Start of section headers: 168152 (bytes into file)
Flags: 0x202, has entry point, GNU EABI, software FP
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 1
Size of section headers: 40 (bytes)
Number of section headers: 25
Section header string table index: 22
32
Example: Section Header
Section Headers:
[Nr] Name Type Addr Off Size ES Flg Lk Inf Al
[ 0] NULL 00000000 000000 000000 00 0 0 0
[ 1] .init PROGBITS 00008000 008000 000020 00 AX 0 0 4
[ 2] .text PROGBITS 00008020 008020 0030e8 00 AX 0 0 4
[ 3] .fini PROGBITS 0000b108 00b108 00001c 00 AX 0 0 4
[ 4] .rodata PROGBITS 0000b124 00b124 000020 00 A 0 0 4
[ 5] .data PROGBITS 0000b244 00b244 00092c 00 WA 0 0 4
[ 6] .eh_frame PROGBITS 0000bb70 00bb70 000004 00 A 0 0 4
[ 7] .ctors PROGBITS 0000bb74 00bb74 000008 00 WA 0 0 4
[ 8] .dtors PROGBITS 0000bb7c 00bb7c 000008 00 WA 0 0 4
[ 9] .jcr PROGBITS 0000bb84 00bb84 000004 00 WA 0 0 4
[10] .bss NOBITS 0000bb88 00bb88 00010c 00 WA 0 0 4
[11] .comment PROGBITS 00000000 00bb88 000288 00 0 0 1
[12] .debug_aranges PROGBITS 00000000 00be10 000420 00 0 0 8
[13] .debug_pubnames PROGBITS 00000000 00c230 000726 00 0 0 1
[14] .debug_info PROGBITS 00000000 00c956 011f48 00 0 0 1
[15] .debug_abbrev PROGBITS 00000000 01e89e 0031f4 00 0 0 1
[16] .debug_line PROGBITS 00000000 021a92 002a14 00 0 0 1
[17] .debug_frame PROGBITS 00000000 0244a8 000a14 00 0 0 4
[18] .debug_str PROGBITS 00000000 024ebc 001406 01 MS 0 0 1
[19] .debug_loc PROGBITS 00000000 0262c2 002be0 00 0 0 1
[20] .stack PROGBITS 00080000 028ea2 000000 00 W 0 0 1
[21] .debug_ranges PROGBITS 00000000 028ea2 000150 00 0 0 1
[22] .shstrtab STRTAB 00000000 028ff2 0000e3 00 0 0 1
[23] .symtab SYMTAB 00000000 0294c0 001590 10 24 ef 4
[24] .strtab STRTAB 00000000 02aa50 0007f9 00 0 0 1
Key to Flags:
W (write), A (alloc), X (execute), M (merge), S (strings)
I (info), L (link order), G (group), x (unknown)
O (extra OS processing required) o (OS specific), p (processor specific)
33
Example: Program Header
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
LOAD 0x008000 0x00008000 0x00008000 0x03b88 0x03c94 RWE 0x8000
Section to Segment mapping:
Segment Sections...
00 .init .text .fini .rodata .data .eh_frame .ctors .dtors .jcr .bss
34
Data Representation
 Support various processors with 8-bit bytes and
32-bit architectures.
 Intended to be extensible to larger or smaller
architecture.
Name Size Alignment Purpose
Elf32_Addr 4 4 Unsigned program address
Elf32_Half 2 2 Unsigned medium integer
Elf32_Off 4 4 Unsigned file offset
Elf32_Sword 4 4 Signed large integer
Elf32_Word 4 4 Unsigned large integer
unsigned char 1 1 Unsigned small integer
35
ELF Header1
 It is always the first section of the file.
 Describes the type of the object file .
 Its target architecture, and the version of ELF it is
using.
 The location of the Program Header table, Section
Header table, and String table along with
associated number and size of entries for each
table are also given.
 Contains the location of the first executable
instruction.
36
ELF Header2
#define EI_NIDENT 16
typedef struct {
unsigned char e_ident[EI_NIDENT];// file ID, interpretation
Elf32_Half e_type; // object file type
Elf32_Half e_machine; // target architecture
Elf32_Word e_version; // ELF version
Elf32_Addr e_entry; // starting virtual address
Elf32_Off e_phoff; // file offset to program header
Elf32_Off e_shoff; // file offset to section header
Elf32_Word e_flags; // processor-specific flags
Elf32_Half e_ehsize; // the ELF header’s size
Elf32_Half e_phentsize; // program header entry size
Elf32_Half e_phnum; // program header entry number
Elf32_Half e_shentsize; // section header entry size
Elf32_Half e_shnum; // section header entry number
Elf32_Half e_shtrndx; // section header index for string
} Elf32_Ehdr;
37
Section Header
 The section header table is an array of structures.
 A section header table index is a subscript into
this array.
 Each entry correlates to a section in the file.
 The entry provides the name, type, memory
image starting address, file offset, the section’s
size in bytes, alignment.
38
The Section Header Table
typedef struct {
Elf32_Word sh_name; // name of section, an index
Elf32_Word sh_type; // type of section
Elf32_Word sh_flags; // section-specific attributes
Elf32_Addr sh_addr; // memory location of section
Elf32_Off sh_offset; // file offset to section
Elf32_Word sh_size; // size of section
Elf32_Word sh_link; // section type, dependent
Elf32_Word sh_info; // extra information, dependent
Elf32_Word sh_addralign; // address alignment
Elf32_Word sh_entsize; // size of an entry in section
} Elf32_Shdr;
39
ELF Sections
 A number of types of sections described by
entries in the section header table.
 Sections can hold executable code, data, dynamic
linking information, debugging data, symbol
tables, relocation information, comments, string
tables, and notes.
40
Special Sections1
 Various sections in ELF are pre-defined.
 A list of special sections
 .bss un-initialized data
 .comment version control information
 .data and .data1 initialized data present
 .debug… information for symbolic debugging
 .dynamic dynamic linking information
 .dynstr strings needed for dynamic linking
 .hash symbol hash table
 .line line number information for debugging
41
Special Sections2
 A list of special sections (cont.)
 .note file notes
 .relname and .relaname
relocation data
 .rodata and .rodata1
read-only data
 .shstrtab section names
 .strtab the strings that represent the names
associated with symbol table entries
 .symtab symbol table
 .text executable instructions
42
String Table
 The object file uses these strings to represent
symbol and section names.
 The first and last byte is defined to hold a null
character.
 An empty string table section is permitted.
 Ex:
index +0 +1 +2 +3 +4 +5 +6 +7 +8 +9
0 0 n a m e . 0 V a r
10 i a b l e 0 a b l e
20 0 0 x x 0
43
Symbol Table
 Holds information needed to locate and relocate a
program’s symbolic definitions and references.
 A symbol table entry
typedef struct {
Elf32_Word st_name; // symbol name, an index
Elf32_Addr st_value; // symbol value
Elf32_Word st_size; // symbol size
unsigned char st_info; // symbol’s type and binding attributes
unsigned char st_other; // symbol visibility
Elf32_Half st_shndx; // relevant section header table index
} Elf32_Sym;
44
Program Header
 Program headers are meaningful only for
executable and shared object files.
 The program header table is an array of
structures, each describing a segment or other
information.
 An object file segment contains one or more
sections.
 A file specifies its own program header size with
the ELF header’s e_phentsize & e_phnum.
45
The Program Header Table
typedef struct {
Elf32_Word p_type; // type of the segment
Elf32_Off p_offset; // file offset to segment
Elf32_Addr p_vaddr; // virtual address of first byte
Elf32_Addr p_paddr; // segments’ physical address
Elf32_Word p_filesz; // size of file image of segment
Elf32_Word p_memsz; // size of memory image of segment
Elf32_Word p_flags; // segment-specific flags
Elf32_Word p_align; // alignment requirements
} Elf32_Phdr;
46
Executable Programs
 A program to be loaded by the system must have
at least one loadable segment.
 Segments are a way of grouping related sections.
 A process image is created by loading and
interpreting segments.
 Segment contents
 A segment comprises one or more sections.
 Text segments contain read-only instructions and data.
 Data segments contain writable data and instructions
47
ELF Segments
 Text segment example  Data segment example
.hash
.dynsym
.dynstr
.text
.rodata
.rel
.plt
.data
.dynamic
.got
.bss
48
Exercise #4
 Write a service routine that receives the name of
an ELF executable file as a parameter and display
the offset of program header on the screen.
 Void service102(char *filename);
 Write a trigger that pass a file name to the above
service routine through SWI #102.
 void trigger102(char *filename);
 Write a main program to perform a demonstration.
49
Outline
 Exception Handling and Software Interrupts
 ELF: Executable and Linking Format
 ARM Monitor and Program Loading
50
Overview of ARM Debug Monitor
 The ARM Debug Monitor is called “Angel”
(earlier versions called it the “Demon” – get it?)
 Provides
 lowlevel programming C library and debugging
environment
 When the X-board first boots, they load the demon
from flash memory (emulator pretends that this
happens)
 This activity is called “bootstrapping”
51
Memory Map of Demon
0x0000 CPU reset vector
0x0004 ...0x1c CPU undefined instruction ... CPU Fast Interrupt Vector
0x0020 ~1K Bytes for FIQ and FIQ mode stack
0x0400 256 bytes for IRQ mode stack
0x0500 256 bytes for Undefined mode stack
0x0600 256 bytes for Abort mode stack
0x0700 256 bytes for SVC mode stack
0x0800 Debug monitor private workspace
0x1000 Free for user-supplied Debug Monitor
0x2000 Floating Point Emulation Space
0x8000 Application Space
top of memory SWI_Getenv returns top of memory = 0x08000000
52
Monitor Program
 Provide Capability to
 Setup Hardware on startup
 Load and run programs
 Debug code
 Minimal OS functionality
 Many embedded systems are just
 Monitor + application
 Monitor still handles other types of interrupts (we'll
cover this later)
 l timer, I/O (e.g., keypad, switches, LED, LCD)
53
Example System
 Interrupt from external
devices
 keyboards, timers, disk
drives
 We refer to each piece
of software as a
process
 Codes
 Program counter
 Registers
 Stack
 Other terms
 Task
 Thread
54
Debug Monitor SWIs
 Angel provides a number of SWIs that you can use
SWI_WriteC (0) Write a byte to the debug channel
SWI_Write0(2) Write the null-terminated string to debug channel
SWI_ReadC(4) Read a byte from the debug channel
SWI_Exit (0x11) Halt emulation this is how a program exits
SWI_EnterOS (0x16) Put the processor in supervisor mode
SWI_GetErrno (0x60) Returns (r0) the value of the C library err-no variable
SWI_Clock (0x61) Return the number of centi-seconds
SWI_Time (0x63) Return the number of seconds since Jan. 1, 1970
SWI_Remove (0x64) Deletes the file named by pointer in r0
SWI_Rename (0x65) Renames a file
SWI_Open (0x66) Open file (or device)
SWI_Close (0x68) Close a file (or device)
SWI_Write (0x69) Read a file
SWI_Read (0x6a) Write a file
SWI_Seek (0x6b) Seek to a specific location in a file
SWI_Flen (0x6c) Returns length of the file object
SWI_InstallHandler(0x70) installs a handler for a hardware exception
55
Program Loading
 Monitor reads program from ??? and puts it into
RAM
 Does it just copy the executable into RAM??
 Where does it put it??
 Who sets up the user stack??
 Who sets up the user heap??
56
ARM File Formats
 ARM supports many formats for executables
 Executable ARM Image Format (AIF)
 Non-executable ARM Image Format (AIF)
 ARM Object Format (AOF)
 ARM Object Library Format
 ARM Symbolic Debug Table Format
 ARM ELF
 Specialized version of ELF
 Each provides code + data + other information
 We will focus on ARM ELF
57
ARM ELF
 ARM ELF
 ELF (Executable and Linking
Format) header
 Image's code
 Image's initialized static data
 Debug and relocation
information (optional)
 We will use static linking
(no dynamic linking or
shared libraries)
ELF Header
Program Header Table
Segment 1
Segment 2
… …
Section Header Table
optional
ARM ELF File
58
Loading an Executable1
 Read the executable file
 ARMulator gets stuff from the native file system
 Loader uses the SWI_Open and SWI_Read Monitor
system calls
 Parse the header to determine the size of the image
 Starting location and image base
 Create new address space for program large
enough to hold text and data segments, along with
a stack segment
 Copy instructions and data from executable file
into the new address space
59
Loading an Executable2
 Zero-init the un-initialized data
 Copy arguments passed to the program onto the
stack
 Initializes machine registers
 Most registers cleared, but stack pointer assigned
address of 1st free stack location
 Jumps to start-up routine that copies program’s
arguments from stack to registers and sets the PC
 If main routine returns, start-up routine terminates
program with the SWI_Exit system call
60
Optional ARM ELF Components
 Compression
 Self-decompression code included in image
 Relocation
 Self relocation code included in image
 Debugging
 Symbol table for debugger use
 String tables for efficient allocation of strings
 Can have more than one section per segment
61
Starting a Program
 We discussed how an application's initial PC is set
 The loader gets the address of the starting instruction
from the object file header
 To start the program, the loader moves the specified
address into the PC
 Is main() the starting point?
 In other words, does the PC initially get set to the
address of main()?
 Let's look at an example
62
Listing from arm-elf-objdump1
Disassembly of section .init:
00008000 <_init>:
8000: e1a0c00d mov ip, sp
8004: e92ddff8 stmdb sp!, {r3, r4, r5, r6, r7, r8, r9, sl, fp, ip, lr, pc}
8008: e24cb004 sub fp, ip, #4 ; 0x4
800c: eb000023 bl 80a0 <frame_dummy>
8010: eb000c2d bl b0cc <__do_global_ctors_aux>
8014: e24bd028 sub sp, fp, #40 ; 0x28
8018: e89d6ff0 ldmia sp, {r4, r5, r6, r7, r8, r9, sl, fp, sp, lr}
801c: e1a0f00e mov pc, lr
Disassembly of section .text:
00008020 <__do_global_dtors_aux>:
8020: e92d4030 stmdb sp!, {r4, r5, lr}
8024: e59f505c ldr r5, [pc, #92] ; 8088 <.text+0x68>
8028: e5d53000 ldrb r3, [r5]
802c: e3530000 cmp r3, #0 ; 0x0
8030: 18bd8030 ldmneia sp!, {r4, r5, pc}
8034: e59f4050 ldr r4, [pc, #80] ; 808c <.text+0x6c>
8038: e5943000 ldr r3, [r4]
803c: e5932000 ldr r2, [r3]
8040: e3520000 cmp r2, #0 ; 0x0
8044: 0a000007 beq 8068 <__do_global_dtors_aux+0x48>
8048: e2833004 add r3, r3, #4 ; 0x4
Initialization code
63
Listing from arm-elf-objdump2
804c: e5843000 str r3, [r4]
8050: e1a0e00f mov lr, pc
8054: e12fff12 bx r2
8058: e5943000 ldr r3, [r4]
805c: e5932000 ldr r2, [r3]
8060: e3520000 cmp r2, #0 ; 0x0
8064: 1afffff7 bne 8048 <__do_global_dtors_aux+0x28>
8068: e59f3020 ldr r3, [pc, #32] ; 8090 <.text+0x70>
806c: e3530000 cmp r3, #0 ; 0x0
8070: 159f001c ldrne r0, [pc, #28] ; 8094 <.text+0x74>
8074: 11a0e00f movne lr, pc
8078: 112fff13 bxne r3
807c: e3a03001 mov r3, #1 ; 0x1
8080: e5c53000 strb r3, [r5]
8084: e8bd8030 ldmia sp!, {r4, r5, pc}
8088: 0000bb88 andeq fp, r0, r8, lsl #23
808c: 0000b248 andeq fp, r0, r8, asr #4
8090: 00000000 andeq r0, r0, r0
8094: 0000bb70 andeq fp, r0, r0, ror fp
00008098 <call___do_global_dtors_aux>:
8098: e52de004 str lr, [sp, #-4]!
809c: e49df004 ldr pc, [sp], #4
000080a0 <frame_dummy>:
64
Listing from arm-elf-objdump3
80a0: e59f303c ldr r3, [pc, #60] ; 80e4 <.text+0xc4>
80a4: e3530000 cmp r3, #0 ; 0x0
80a8: e52de004 str lr, [sp, #-4]!
80ac: e59f0034 ldr r0, [pc, #52] ; 80e8 <.text+0xc8>
80b0: e59f1034 ldr r1, [pc, #52] ; 80ec <.text+0xcc>
80b4: 11a0e00f movne lr, pc
80b8: 112fff13 bxne r3
80bc: e59f002c ldr r0, [pc, #44] ; 80f0 <.text+0xd0>
80c0: e5903000 ldr r3, [r0]
80c4: e3530000 cmp r3, #0 ; 0x0
80c8: e59f3024 ldr r3, [pc, #36] ; 80f4 <.text+0xd4>
80cc: 049df004 ldreq pc, [sp], #4
80d0: e3530000 cmp r3, #0 ; 0x0
80d4: 049df004 ldreq pc, [sp], #4
80d8: e1a0e00f mov lr, pc
80dc: e12fff13 bx r3
80e0: e49df004 ldr pc, [sp], #4
80e4: 00000000 andeq r0, r0, r0
80e8: 0000bb70 andeq fp, r0, r0, ror fp
80ec: 0000bb8c andeq fp, r0, ip, lsl #23
80f0: 0000bb84 andeq fp, r0, r4, lsl #23
80f4: 00000000 andeq r0, r0, r0
000080f8 <call_frame_dummy>:
80f8: e52de004 str lr, [sp, #-4]!
65
Listing from arm-elf-objdump4
80fc: e49df004 ldr pc, [sp], #4
00008100 <_mainCRTStartup>:
8100: e3a00016 mov r0, #22 ; 0x16
8104: e28f10e4 add r1, pc, #228 ; 0xe4
8108: ef123456 swi 0x00123456
810c: e59f00dc ldr r0, [pc, #220] ; 81f0 <.text+0x1d0>
8110: e590d008 ldr sp, [r0, #8]
8114: e590a00c ldr sl, [r0, #12]
8118: e28aac01 add sl, sl, #256 ; 0x100
811c: e3a01000 mov r1, #0 ; 0x0
8120: e1a0b001 mov fp, r1
8124: e1a07001 mov r7, r1
8128: e59f00c4 ldr r0, [pc, #196] ; 81f4 <.text+0x1d4>
812c: e59f20c4 ldr r2, [pc, #196] ; 81f8 <.text+0x1d8>
8130: e0422000 sub r2, r2, r0
8134: eb00004c bl 826c <memset>
8138: eb000152 bl 8688 <initialise_monitor_handles>
813c: e3a00015 mov r0, #21 ; 0x15
8140: e28f10b8 add r1, pc, #184 ; 0xb8
8144: ef123456 swi 0x00123456
8148: e59f10b0 ldr r1, [pc, #176] ; 8200 <.text+0x1e0>
814c: e3a00000 mov r0, #0 ; 0x0
8150: e92d0001 stmdb sp!, {r0}
8154: e4d13001 ldrb r3, [r1], #1
 Entry point
66
Listing from arm-elf-objdump5
8158: e3530000 cmp r3, #0 ; 0x0
815c: 0a000011 beq 81a8 <_mainCRTStartup+0xa8>
8160: e3530020 cmp r3, #32 ; 0x20
8164: 0afffffa beq 8154 <_mainCRTStartup+0x54>
8168: e3530022 cmp r3, #34 ; 0x22
816c: 13530027 cmpne r3, #39 ; 0x27
8170: 01a02003 moveq r2, r3
8174: 13a02020 movne r2, #32 ; 0x20
8178: 12411001 subne r1, r1, #1 ; 0x1
817c: e92d0002 stmdb sp!, {r1}
8180: e2800001 add r0, r0, #1 ; 0x1
8184: e4d13001 ldrb r3, [r1], #1
8188: e3530000 cmp r3, #0 ; 0x0
818c: 0a000005 beq 81a8 <_mainCRTStartup+0xa8>
8190: e1520003 cmp r2, r3
8194: 1afffffa bne 8184 <_mainCRTStartup+0x84>
8198: e3a02000 mov r2, #0 ; 0x0
819c: e2413001 sub r3, r1, #1 ; 0x1
81a0: e5c32000 strb r2, [r3]
81a4: eaffffea b 8154 <_mainCRTStartup+0x54>
81a8: e1a0100d mov r1, sp
81ac: e08d2100 add r2, sp, r0, lsl #2
81b0: e1a0300d mov r3, sp
81b4: e1520003 cmp r2, r3
81b8: 85124004 ldrhi r4, [r2, #-4]
67
Listing from arm-elf-objdump6
81bc: 85935000 ldrhi r5, [r3]
81c0: 85225004 strhi r5, [r2, #-4]!
81c4: 84834004 strhi r4, [r3], #4
81c8: 8afffff9 bhi 81b4 <_mainCRTStartup+0xb4>
81cc: e1a04000 mov r4, r0
81d0: e1a05001 mov r5, r1
81d4: e59f0020 ldr r0, [pc, #32] ; 81fc <.text+0x1dc>
81d8: eb000011 bl 8224 <atexit>
81dc: ebffff87 bl 8000 <_init>
81e0: e1a00004 mov r0, r4
81e4: e1a01005 mov r1, r5
81e8: eb000006 bl 8208 <main>
81ec: eb000011 bl 8238 <exit>
81f0: 0000b24c andeq fp, r0, ip, asr #4
81f4: 0000bb88 andeq fp, r0, r8, lsl #23
81f8: 0000bc94 muleq r0, r4, ip
81fc: 0000b108 andeq fp, r0, r8, lsl #2
8200: 0000b25c andeq fp, r0, ip, asr r2
8204: 000000ff streqd r0, [r0], -pc
00008208 <main>:
8208: e1a0c00d mov ip, sp
820c: e92dd800 stmdb sp!, {fp, ip, lr, pc}
8210: e24cb004 sub fp, ip, #4 ; 0x4
8214: e59f0004 ldr r0, [pc, #4] ; 8220 <.text+0x200>
 Call user’s main
 Call exit before quit
 Call init code
 The user’s main
68
Listing from arm-elf-objdump7
8218: eb000056 bl 8378 <puts>
821c: e89da800 ldmia sp, {fp, sp, pc}
8220: 0000b124 andeq fp, r0, r4, lsr #2
00008224 <atexit>:
8224: e1a01000 mov r1, r0
8228: e3a00000 mov r0, #0 ; 0x0
822c: e1a02000 mov r2, r0
8230: e1a03000 mov r3, r0
8234: ea000264 b 8bcc <__register_exitproc>
00008238 <exit>:
8238: e92d4010 stmdb sp!, {r4, lr}
823c: e3a01000 mov r1, #0 ; 0x0
8240: e1a04000 mov r4, r0
8244: eb000297 bl 8ca8 <__call_exitprocs>
8248: e59f3018 ldr r3, [pc, #24] ; 8268 <.text+0x248>
824c: e5930000 ldr r0, [r3]
8250: e590203c ldr r2, [r0, #60]
8254: e3520000 cmp r2, #0 ; 0x0
8258: 11a0e00f movne lr, pc
825c: 112fff12 bxne r2
8260: e1a00004 mov r0, r4
8264: eb000233 bl 8b38 <_exit>
8268: 0000b134 andeq fp, r0, r4, lsr r1
 Code on exit
69
Starting a C Program
 To get to main() takes hundreds of instructions!
 In a modern OS, it can take several thousands of
instructions!
 Why? Because the C compiler generates code for a
number of setup routines before the call to main().
 These setup routines handle the stack, data segments,
heap and other miscellaneous functions.
70
Starting an Assembly Program
 What about assembly code?
 If the assembly code interfaces to C code and the
ENTRY point is the C function main(), then the C
compiler will generate the setup code
 But, if the entire program is written in assembly OR
there is no C function called main(), then the setup code
is not generated.
 What does this mean for you?
 What's the SP register pointing to when you start your
program?
71
Assembly Example
.text
.align 2
.global _start
_start:
ldr r1, num1
ldr r0, num2
add r5, r1, r0
str r5, sum
mov pc, lr
num2: .word 0x7
num1: .word 0x5
sum: .space 0x4
72
Listing of Assembly Example
test.elf: file format elf32-littlearm
Disassembly of section .text:
00008000 <_start>:
8000: e59f1010 ldr r1, [pc, #16] ; 8018 <num1>
8004: e59f0008 ldr r0, [pc, #8] ; 8014 <num2>
8008: e0815000 add r5, r1, r0
800c: e58f5008 str r5, [pc, #8] ; 801c <sum>
8010: e1a0f00e mov pc, lr
00008014 <num2>:
8014: 00000007 andeq r0, r0, r7
00008018 <num1>:
8018: 00000005 andeq r0, r0, r5
0000801c <sum>:
801c: 00000000 andeq r0, r0, r0

Mais conteúdo relacionado

Semelhante a arm_exp.ppt

Arm teaching material
Arm teaching materialArm teaching material
Arm teaching material
John Williams
 
Troubleshooting linux-kernel-modules-and-device-drivers-1233050713693744-1
Troubleshooting linux-kernel-modules-and-device-drivers-1233050713693744-1Troubleshooting linux-kernel-modules-and-device-drivers-1233050713693744-1
Troubleshooting linux-kernel-modules-and-device-drivers-1233050713693744-1
Jagadisha Maiya
 
Systemsoftwarenotes 100929171256-phpapp02 2
Systemsoftwarenotes 100929171256-phpapp02 2Systemsoftwarenotes 100929171256-phpapp02 2
Systemsoftwarenotes 100929171256-phpapp02 2
Khaja Dileef
 

Semelhante a arm_exp.ppt (20)

Arm teaching material
Arm teaching materialArm teaching material
Arm teaching material
 
Arm architecture
Arm architectureArm architecture
Arm architecture
 
Assembly programming
Assembly programmingAssembly programming
Assembly programming
 
Soc
SocSoc
Soc
 
W8_2: Inside the UoS Educational Processor
W8_2: Inside the UoS Educational ProcessorW8_2: Inside the UoS Educational Processor
W8_2: Inside the UoS Educational Processor
 
W10: Interrupts
W10: InterruptsW10: Interrupts
W10: Interrupts
 
Lecture8
Lecture8Lecture8
Lecture8
 
07-arm_overview.ppt
07-arm_overview.ppt07-arm_overview.ppt
07-arm_overview.ppt
 
Arm architecture overview
Arm architecture overviewArm architecture overview
Arm architecture overview
 
Troubleshooting Linux Kernel Modules And Device Drivers
Troubleshooting Linux Kernel Modules And Device DriversTroubleshooting Linux Kernel Modules And Device Drivers
Troubleshooting Linux Kernel Modules And Device Drivers
 
Troubleshooting linux-kernel-modules-and-device-drivers-1233050713693744-1
Troubleshooting linux-kernel-modules-and-device-drivers-1233050713693744-1Troubleshooting linux-kernel-modules-and-device-drivers-1233050713693744-1
Troubleshooting linux-kernel-modules-and-device-drivers-1233050713693744-1
 
ARM Introduction
ARM IntroductionARM Introduction
ARM Introduction
 
07-arm_overview.ppt
07-arm_overview.ppt07-arm_overview.ppt
07-arm_overview.ppt
 
arm-intro.ppt
arm-intro.pptarm-intro.ppt
arm-intro.ppt
 
W8_1: Intro to UoS Educational Processor
W8_1: Intro to UoS Educational ProcessorW8_1: Intro to UoS Educational Processor
W8_1: Intro to UoS Educational Processor
 
The ARM Architecture: ARM : ARM Architecture
The ARM Architecture: ARM : ARM ArchitectureThe ARM Architecture: ARM : ARM Architecture
The ARM Architecture: ARM : ARM Architecture
 
Arm
ArmArm
Arm
 
ARM.ppt
ARM.pptARM.ppt
ARM.ppt
 
Systemsoftwarenotes 100929171256-phpapp02 2
Systemsoftwarenotes 100929171256-phpapp02 2Systemsoftwarenotes 100929171256-phpapp02 2
Systemsoftwarenotes 100929171256-phpapp02 2
 
The hardware of the Mcs 51 microcontroller
 The hardware of the Mcs 51 microcontroller The hardware of the Mcs 51 microcontroller
The hardware of the Mcs 51 microcontroller
 

Último

Call Girls In RT Nagar ☎ 7737669865 🥵 Book Your One night Stand
Call Girls In RT Nagar ☎ 7737669865 🥵 Book Your One night StandCall Girls In RT Nagar ☎ 7737669865 🥵 Book Your One night Stand
Call Girls In RT Nagar ☎ 7737669865 🥵 Book Your One night Stand
amitlee9823
 
Call Now ≽ 9953056974 ≼🔝 Call Girls In Yusuf Sarai ≼🔝 Delhi door step delevry≼🔝
Call Now ≽ 9953056974 ≼🔝 Call Girls In Yusuf Sarai ≼🔝 Delhi door step delevry≼🔝Call Now ≽ 9953056974 ≼🔝 Call Girls In Yusuf Sarai ≼🔝 Delhi door step delevry≼🔝
Call Now ≽ 9953056974 ≼🔝 Call Girls In Yusuf Sarai ≼🔝 Delhi door step delevry≼🔝
9953056974 Low Rate Call Girls In Saket, Delhi NCR
 
CHEAP Call Girls in Vinay Nagar (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICE
CHEAP Call Girls in Vinay Nagar (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICECHEAP Call Girls in Vinay Nagar (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICE
CHEAP Call Girls in Vinay Nagar (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICE
9953056974 Low Rate Call Girls In Saket, Delhi NCR
 
CHEAP Call Girls in Ashok Nagar (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICE
CHEAP Call Girls in Ashok Nagar  (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICECHEAP Call Girls in Ashok Nagar  (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICE
CHEAP Call Girls in Ashok Nagar (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICE
9953056974 Low Rate Call Girls In Saket, Delhi NCR
 
Makarba ( Call Girls ) Ahmedabad ✔ 6297143586 ✔ Hot Model With Sexy Bhabi Rea...
Makarba ( Call Girls ) Ahmedabad ✔ 6297143586 ✔ Hot Model With Sexy Bhabi Rea...Makarba ( Call Girls ) Ahmedabad ✔ 6297143586 ✔ Hot Model With Sexy Bhabi Rea...
Makarba ( Call Girls ) Ahmedabad ✔ 6297143586 ✔ Hot Model With Sexy Bhabi Rea...
Naicy mandal
 
CHEAP Call Girls in Hauz Quazi (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICE
CHEAP Call Girls in Hauz Quazi  (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICECHEAP Call Girls in Hauz Quazi  (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICE
CHEAP Call Girls in Hauz Quazi (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICE
9953056974 Low Rate Call Girls In Saket, Delhi NCR
 
一比一定(购)新西兰林肯大学毕业证(Lincoln毕业证)成绩单学位证
一比一定(购)新西兰林肯大学毕业证(Lincoln毕业证)成绩单学位证一比一定(购)新西兰林肯大学毕业证(Lincoln毕业证)成绩单学位证
一比一定(购)新西兰林肯大学毕业证(Lincoln毕业证)成绩单学位证
wpkuukw
 
Call Girls Banashankari Just Call 👗 7737669865 👗 Top Class Call Girl Service ...
Call Girls Banashankari Just Call 👗 7737669865 👗 Top Class Call Girl Service ...Call Girls Banashankari Just Call 👗 7737669865 👗 Top Class Call Girl Service ...
Call Girls Banashankari Just Call 👗 7737669865 👗 Top Class Call Girl Service ...
amitlee9823
 
怎样办理斯威本科技大学毕业证(SUT毕业证书)成绩单留信认证
怎样办理斯威本科技大学毕业证(SUT毕业证书)成绩单留信认证怎样办理斯威本科技大学毕业证(SUT毕业证书)成绩单留信认证
怎样办理斯威本科技大学毕业证(SUT毕业证书)成绩单留信认证
tufbav
 
➥🔝 7737669865 🔝▻ Vijayawada Call-girls in Women Seeking Men 🔝Vijayawada🔝 E...
➥🔝 7737669865 🔝▻ Vijayawada Call-girls in Women Seeking Men  🔝Vijayawada🔝   E...➥🔝 7737669865 🔝▻ Vijayawada Call-girls in Women Seeking Men  🔝Vijayawada🔝   E...
➥🔝 7737669865 🔝▻ Vijayawada Call-girls in Women Seeking Men 🔝Vijayawada🔝 E...
amitlee9823
 
Escorts Service Sanjay Nagar ☎ 7737669865☎ Book Your One night Stand (Bangalore)
Escorts Service Sanjay Nagar ☎ 7737669865☎ Book Your One night Stand (Bangalore)Escorts Service Sanjay Nagar ☎ 7737669865☎ Book Your One night Stand (Bangalore)
Escorts Service Sanjay Nagar ☎ 7737669865☎ Book Your One night Stand (Bangalore)
amitlee9823
 

Último (20)

Call Girls In RT Nagar ☎ 7737669865 🥵 Book Your One night Stand
Call Girls In RT Nagar ☎ 7737669865 🥵 Book Your One night StandCall Girls In RT Nagar ☎ 7737669865 🥵 Book Your One night Stand
Call Girls In RT Nagar ☎ 7737669865 🥵 Book Your One night Stand
 
NO1 Verified Amil Baba In Karachi Kala Jadu In Karachi Amil baba In Karachi A...
NO1 Verified Amil Baba In Karachi Kala Jadu In Karachi Amil baba In Karachi A...NO1 Verified Amil Baba In Karachi Kala Jadu In Karachi Amil baba In Karachi A...
NO1 Verified Amil Baba In Karachi Kala Jadu In Karachi Amil baba In Karachi A...
 
Top Rated Pune Call Girls Katraj ⟟ 6297143586 ⟟ Call Me For Genuine Sex Serv...
Top Rated  Pune Call Girls Katraj ⟟ 6297143586 ⟟ Call Me For Genuine Sex Serv...Top Rated  Pune Call Girls Katraj ⟟ 6297143586 ⟟ Call Me For Genuine Sex Serv...
Top Rated Pune Call Girls Katraj ⟟ 6297143586 ⟟ Call Me For Genuine Sex Serv...
 
Call Now ≽ 9953056974 ≼🔝 Call Girls In Yusuf Sarai ≼🔝 Delhi door step delevry≼🔝
Call Now ≽ 9953056974 ≼🔝 Call Girls In Yusuf Sarai ≼🔝 Delhi door step delevry≼🔝Call Now ≽ 9953056974 ≼🔝 Call Girls In Yusuf Sarai ≼🔝 Delhi door step delevry≼🔝
Call Now ≽ 9953056974 ≼🔝 Call Girls In Yusuf Sarai ≼🔝 Delhi door step delevry≼🔝
 
SM-N975F esquematico completo - reparación.pdf
SM-N975F esquematico completo - reparación.pdfSM-N975F esquematico completo - reparación.pdf
SM-N975F esquematico completo - reparación.pdf
 
(INDIRA) Call Girl Napur Call Now 8617697112 Napur Escorts 24x7
(INDIRA) Call Girl Napur Call Now 8617697112 Napur Escorts 24x7(INDIRA) Call Girl Napur Call Now 8617697112 Napur Escorts 24x7
(INDIRA) Call Girl Napur Call Now 8617697112 Napur Escorts 24x7
 
CHEAP Call Girls in Vinay Nagar (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICE
CHEAP Call Girls in Vinay Nagar (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICECHEAP Call Girls in Vinay Nagar (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICE
CHEAP Call Girls in Vinay Nagar (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICE
 
CHEAP Call Girls in Ashok Nagar (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICE
CHEAP Call Girls in Ashok Nagar  (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICECHEAP Call Girls in Ashok Nagar  (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICE
CHEAP Call Girls in Ashok Nagar (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICE
 
Sector 18, Noida Call girls :8448380779 Model Escorts | 100% verified
Sector 18, Noida Call girls :8448380779 Model Escorts | 100% verifiedSector 18, Noida Call girls :8448380779 Model Escorts | 100% verified
Sector 18, Noida Call girls :8448380779 Model Escorts | 100% verified
 
Call Girls in Vashi Escorts Services - 7738631006
Call Girls in Vashi Escorts Services - 7738631006Call Girls in Vashi Escorts Services - 7738631006
Call Girls in Vashi Escorts Services - 7738631006
 
Makarba ( Call Girls ) Ahmedabad ✔ 6297143586 ✔ Hot Model With Sexy Bhabi Rea...
Makarba ( Call Girls ) Ahmedabad ✔ 6297143586 ✔ Hot Model With Sexy Bhabi Rea...Makarba ( Call Girls ) Ahmedabad ✔ 6297143586 ✔ Hot Model With Sexy Bhabi Rea...
Makarba ( Call Girls ) Ahmedabad ✔ 6297143586 ✔ Hot Model With Sexy Bhabi Rea...
 
CHEAP Call Girls in Hauz Quazi (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICE
CHEAP Call Girls in Hauz Quazi  (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICECHEAP Call Girls in Hauz Quazi  (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICE
CHEAP Call Girls in Hauz Quazi (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICE
 
一比一定(购)新西兰林肯大学毕业证(Lincoln毕业证)成绩单学位证
一比一定(购)新西兰林肯大学毕业证(Lincoln毕业证)成绩单学位证一比一定(购)新西兰林肯大学毕业证(Lincoln毕业证)成绩单学位证
一比一定(购)新西兰林肯大学毕业证(Lincoln毕业证)成绩单学位证
 
Deira Dubai Escorts +0561951007 Escort Service in Dubai by Dubai Escort Girls
Deira Dubai Escorts +0561951007 Escort Service in Dubai by Dubai Escort GirlsDeira Dubai Escorts +0561951007 Escort Service in Dubai by Dubai Escort Girls
Deira Dubai Escorts +0561951007 Escort Service in Dubai by Dubai Escort Girls
 
Call Girls Banashankari Just Call 👗 7737669865 👗 Top Class Call Girl Service ...
Call Girls Banashankari Just Call 👗 7737669865 👗 Top Class Call Girl Service ...Call Girls Banashankari Just Call 👗 7737669865 👗 Top Class Call Girl Service ...
Call Girls Banashankari Just Call 👗 7737669865 👗 Top Class Call Girl Service ...
 
怎样办理斯威本科技大学毕业证(SUT毕业证书)成绩单留信认证
怎样办理斯威本科技大学毕业证(SUT毕业证书)成绩单留信认证怎样办理斯威本科技大学毕业证(SUT毕业证书)成绩单留信认证
怎样办理斯威本科技大学毕业证(SUT毕业证书)成绩单留信认证
 
➥🔝 7737669865 🔝▻ Vijayawada Call-girls in Women Seeking Men 🔝Vijayawada🔝 E...
➥🔝 7737669865 🔝▻ Vijayawada Call-girls in Women Seeking Men  🔝Vijayawada🔝   E...➥🔝 7737669865 🔝▻ Vijayawada Call-girls in Women Seeking Men  🔝Vijayawada🔝   E...
➥🔝 7737669865 🔝▻ Vijayawada Call-girls in Women Seeking Men 🔝Vijayawada🔝 E...
 
Escorts Service Sanjay Nagar ☎ 7737669865☎ Book Your One night Stand (Bangalore)
Escorts Service Sanjay Nagar ☎ 7737669865☎ Book Your One night Stand (Bangalore)Escorts Service Sanjay Nagar ☎ 7737669865☎ Book Your One night Stand (Bangalore)
Escorts Service Sanjay Nagar ☎ 7737669865☎ Book Your One night Stand (Bangalore)
 
Escorts Service Daryaganj - 9899900591 College Girls & Models 24/7
Escorts Service Daryaganj - 9899900591 College Girls & Models 24/7Escorts Service Daryaganj - 9899900591 College Girls & Models 24/7
Escorts Service Daryaganj - 9899900591 College Girls & Models 24/7
 
Pooja 9892124323, Call girls Services and Mumbai Escort Service Near Hotel Th...
Pooja 9892124323, Call girls Services and Mumbai Escort Service Near Hotel Th...Pooja 9892124323, Call girls Services and Mumbai Escort Service Near Hotel Th...
Pooja 9892124323, Call girls Services and Mumbai Escort Service Near Hotel Th...
 

arm_exp.ppt

  • 2. 2 Contents  Introduction  Computer Architecture  ARM Architecture  Development Tools  GNU Development Tools  ARM Instruction Set  ARM Assembly Language  ARM Assembly Programming  GNU ARM ToolChain  Interrupts and Monitor
  • 4. 4 Outline  Exception Handling and Software Interrupts  ELF: Executable and Linking Format  ARM Monitor and Program Loading
  • 5. 5 Normal Program Flow vs. Exception  Normally, programs execute sequentially (with a few branches to make life interesting)  Normally, programs execute in user mode  Exceptions and interrupts break the sequential flow of a program, jumping to architecturally- defined memory locations  In ARM, SoftWare Interrupt (SWI) is the “system call” exception
  • 6. 6 ARM Exceptions  Types of ARM exceptions  Reset: when CPU reset pin is asserted  undefined instruction: when CPU tries to execute an undefined op-code  software interrupt: when CPU executes the SWI instruction  prefetch abort: when CPU tries to execute an instruction pre-fetched from an illegal address  data abort: when data transfer instruction tries to read or write at an illegal address  IRQ: when CPU's external interrupt request pin is asserted  FIQ: when CPU's external fast interrupt request pin is asserted
  • 7. 7 The Programmer’s Model  Processor Modes (of interest)  User: the “normal” program execution mode.  IRQ: used for general-purpose interrupt handling.  Supervisor: a protected mode for the operating system.  The Register Set  Registers R0-R15 + CPSR  R13: Stack Pointer (by convention)  R14: Link Register (hardwired)  R15: Program Counter where bits 0:1 are ignored (hardwired)
  • 8. 8 Terminology  The terms exception and interrupt are often confused  Exception usually refers to an internal CPU event  floating point overflow  MMU fault (e.g., page fault)  trap (SWI)  Interrupt usually refers to an external I/O event  I/O device request  reset  In the ARM architecture manuals, the two terms are mixed together
  • 9. 9 What do SWIs do?  SWIs (often called software traps) allow a user program to “call” the OS that is, SWIs are how system calls are implemented.  When SWIs execute, the processor changes modes (from User to Supervisor mode on the ARM) and disables interrupts.
  • 10. 10 SWI Example  Types of SWIs in ARM Angel (axd or armsd)  SWI_WriteC(SWI 0) Write a byte to the debug channel  SWI_Write0(SWI 2) Write the nullterminated string to debug channel  SWI_ReadC(SWI 4) Read a byte from the debug channel  SWI_Exit(SWI 0x11) Halt emulation this is how a program exits  SWI_EnterOS(SWI 0x16) Put the processor in supervisor mode  SWI_Clock(SWI 0x61) Return the number of centi- seconds  SWI_Time(SWI 0x63) Return the number of secs since Jan. 1, 1970
  • 11. 11 What happens on an SWI?1  The ARM architecture defines a Vector Table indexed by exception type  One SWI, CPU does the following: PC <0x08  Also, sets LR_svc, SPSR_svc, CPSR (supervisor mode, no IRQ) ADD r0,r0,r1 SWI 0x10 SUB r2,r2,r0 USER Program to R_Handler to U_Handler to S_Handler to P_Handler to D_Handler ... to I_Handler to F_Handler Vector Table (spring board) starting at 0x00 in memory 0x00 0x04 0x08 0x0c 0x10 0x14 0x18 0x1c (Reset (Undef instr.) (SWI) (Prefetch abort) (Data abort) (Reserved) (IRQ) (FIQ) SWI Handler 1
  • 12. 12 What happens on an SWI?2  Not enough space in the table (only one instruction per entry) to hold all of the code for the SWI handler function  This one instruction must transfer control to appropriate SWI Handler  Several options are presented in the next slide ADD r0,r0,r1 SWI 0x10 SUB r2,r2,r0 USER Program to R_Handler to U_Handler to S_Handler to P_Handler to D_Handler ... to I_Handler to F_Handler Vector Table (spring board) starting at 0x00 in memory 0x00 0x04 0x08 0x0c 0x10 0x14 0x18 0x1c (Reset (Undef instr.) (SWI) (Prefetch abort) (Data abort) (Reserved) (IRQ) (FIQ) SWI Handler 2
  • 13. 13 “Vectoring” Exceptions to Handlers  Option of choice: Load PC from jump table (shown below)  Another option: Direct branch (limited range) ADD r0,r0,r1 SWI 0x10 SUB r2,r2,r0 USER Program LDR pc, pc, 0x100 LDR pc, pc, 0x100 LDR pc, pc, 0x100 LDR pc, pc, 0x100 LDR pc, pc, 0x100 LDR pc, pc, 0x100 LDR pc, pc, 0x100 LDR pc, pc, 0x100 Vector Table (spring board) starting at 0x00 in memory 0x00 0x04 0x08 0x0c 0x10 0x14 0x18 0x1c SWI Handler (S_Handler) 2 &A_Handler &U_Handler &S_Handler &P_Handler ... “Jump” Table 0x108 0x10c 0x110 0x114 ... Why 0x110?
  • 14. 14 What happens on SWI completion?  Vectoring to the S_Handler starts executing the SWI handler  When the handler is done, it returns to the program at the instruction following the SWI  MOVS restores the original CPSR as well as changing pc ADD r0,r0,r1 SWI 0x10 SUB r2,r2,r0 USER Program to R_Handler to U_Handler to S_Handler to P_Handler to D_Handler ... to I_Handler to F_Handler Vector Table (spring board) starting at 0x00 in memory 0x00 0x04 0x08 0x0c 0x10 0x14 0x18 0x1c (Reset (Undef instr.) (SWI) (Prefetch abort) (Data abort) (Reserved) (IRQ) (FIQ) 3 MOVS pc, lr SWI Handler (S_Handler)
  • 15. 15 How to determine the SWI number?  All SWIs go to 0x08 ADD r0,r0,r1 SWI 0x10 SUB r2,r2,r0 USER Program to R_Handler to U_Handler to S_Handler to P_Handler to D_Handler ... to I_Handler to F_Handler Vector Table (spring board) starting at 0x00 in memory 0x00 0x04 0x08 0x0c 0x10 0x14 0x18 0x1c (Reset (Undef instr.) (SWI) (Prefetch abort) (Data abort) (Reserved) (IRQ) (FIQ) SWI Handler must serve as clearing house for different SWIs MOVS pc, lr SWI Handler (S_Handler)
  • 16. 16 SWI Instruction Format  Example: SWI 0x18 24-bit “comment” field (ignored by processor) 1 1 1 1 cond 0 23 24 27 31 28 SWI number
  • 17. 17 Executing SWI Instruction On SWI, the processor (1) copies CPSR to SPSR_SVC (2) set the CPSR mode bits to supervisor mode (3) sets the CPSR IRQ to disable (4) stores the value (PC + 4) into LR_SVC (5) forces PC to 0x08 ADD r0,r0,r1 SWI 0x10 SUB r2,r2,r0 USER Program to R_Handler to U_Handler to S_Handler to P_Handler to D_Handler ... to I_Handler to F_Handler Vector Table (spring board) starting at 0x00 in memory 0x00 0x04 0x08 0x0c 0x10 0x14 0x18 0x1c (Reset (Undef instr.) (SWI) (Prefetch abort) (Data abort) (Reserved) (IRQ) (FIQ) LDR r0,[lr,#4] BIC r0,r0,#0xff000000 R0 holds SWI number MOVS pc, lr SWI Handler (S_Handler) 24-bit “comment” field (ignored by processor) 1 1 1 1 cond
  • 18. 18 Jump to “Service Routine” ADD r0,r0,r1 SWI 0x10 SUB r2,r2,r0 USER Program to R_Handler to U_Handler to S_Handler to P_Handler to D_Handler ... to I_Handler to F_Handler Vector Table (spring board) starting at 0x00 in memory 0x00 0x04 0x08 0x0c 0x10 0x14 0x18 0x1c (Reset (Undef instr.) (SWI) (Prefetch abort) (Data abort) (Reserved) (IRQ) (FIQ) LDR r0,[lr,#4] BIC r0,r0,#0xff000000 switch (r0){ case 0x00: service_SWI1(); case 0x01: service_SWI2(); case 0x02: service_SWI3(); … } MOVS pc, lr SWI Handler (S_Handler) 24-bit “comment” field (ignored by processor) 1 1 1 1 cond On SWI, the processor (1) copies CPSR to SPSR_SVC (2) set the CPSR mode bits to supervisor mode (3) sets the CPSR IRQ to disable (4) stores the value (PC + 4) into LR_SVC (5) forces PC to 0x08
  • 19. 19 Problem with The Current Handler On SWI, the processor (1) copies CPSR to SPSR_SVC (2) set the CPSR mode bits to supervisor mode (3) sets the CPSR IRQ to disable (4) stores the value (PC + 4) into LR_SVC (5) forces PC to 0x08 ADD r0,r0,r1 SWI 0x10 SUB r2,r2,r0 USER Program to R_Handler to U_Handler to S_Handler to P_Handler to D_Handler ... to I_Handler to F_Handler Vector Table (spring board) starting at 0x00 in memory 0x00 0x04 0x08 0x0c 0x10 0x14 0x18 0x1c (Reset (Undef instr.) (SWI) (Prefetch abort) (Data abort) (Reserved) (IRQ) (FIQ) LDR r0,[lr,#4] BIC r0,r0,#0xff000000 switch (r0){ case 0x00: service_SWI1(); case 0x01: service_SWI2(); case 0x02: service_SWI3(); … } MOVS pc, lr SWI Handler (S_Handler) What was in R0? User program may have been using this register. Therefore, cannot just use it must first save it
  • 20. 20 Full SWI Handler S_Handler: SUB sp, sp, #4 @ leave room on stack for SPSR STMFD sp!, {r0r12, lr} @ store user's gp registers MRS r2, spsr @ get SPSR into gp registers STR r2, [sp, #14*4] @ store SPSR above gp registers MOV r1, sp @ pointer to parameters on stack LDR r0, [lr, #4] @ extract the SWI number BIC r0,r0,#0xff000000 @ get SWI # by bit-masking BL C_SWI_handler @ go to handler (see next slide) LDR r2, [sp, #14*4] @ restore SPSR (NOT “sp!”) MSR spsr_csxf, r2 @ csxf flags LDMFD sp!, {r0r12, lr} @ unstack user's registers ADD sp, sp, #4 @ remove space used to store SPSR MOVS pc, lr @ return from handler gp = general-purpose SPSR is stored above gp registers since the registers may contain system call parameters (sp in r1)
  • 21. 21 C_SWI_Handler void C_SWI_handler(unsigned number, unsigned *regs) { switch (number){ case 0: /* SWI number 0 code */ break; case 1: /* SWI number 1 code */ break; ... case 0x100: puts(“SWI 0x100 trigged!n”); break; ... case XXX: /* SWI number XXX code */ break; default: } /* end switch */ } /* end C_SWI_handler() */ spsr_svc lr_svc r4 r3 r12 r11 r10 r9 r8 r7 r6 r5 r2 r1 r0 Previous sp_svc sp_svc regs[12] regs[0] (also *regs)
  • 22. 22 Loading the Vector Table /* For 18-349, the Vector Table will use the ``LDR PC, PC, * offset'' springboard approach */ unsigned Install_Handler(unsigned int routine, unsigned int *vector) { unsigned int pcload_instr, old_handler, *soft_vector; pcload_instr = *vector; /* read the Vector Table instr (LDR ...) */ pcload_instr &= 0xfff; /* compute offset of jump table entry */ pcload_instr += 0x8 + (unsigned)vector; /* == offset adjusted by PC and prefetch */ soft_vector = (unsigned *)pcload_instr; /* address to load pc from */ old_handler = *soft_vector; /* remember the old handler */ *soft_vector = routine; /* set up new handler in jump table */ return (old_handler); /* return old handler address */ } /* end Install_Handler() */ Called as Install_Handler ((unsigned) S_Handler, swivec); where, unsigned *swivec = (unsigned *) 0x08;
  • 23. 23 .text .align 2 .global trigger trigger: STMFD sp!, {lr} SWI #0x100 LDMFD sp!, {pc} extern void S_Handler(); extern void trigger(); int main() { unsigned *swivec = (unsigned *) 0x08; unsigned backup; backup = Install_Handler ((unsigned) S_Handler, swivec); trigger(); Install_Handler (backup, swivec); } Example: SWI Application
  • 24. 24 Exercise #3  Write a service routine that receives a file name from a trigger and display the first lines of the file on the screen.  Void service101(char *filename);  Write a trigger that pass a file name as an argument to the above service routine through SWI #0x101.  void trigger101(char *filename);  Write a main program to perform a demonstration.
  • 25. 25 Outline  Exception Handling and Software Interrupts  ELF: Executable and Linking Format  ARM Monitor and Program Loading
  • 26. 26 Introduction to ELF  Executable and Linking Format  Developed by Unix System Lab.  Default binary format on Linux, Solaris 2.x, etc…  Some of the capabilities of ELF are dynamic linking, dynamic loading, imposing runtime control on a program, and an improved method for creating shared libraries.  The ELF representation of control data in an object file is platform independent.
  • 27. 27 Three Types of ELF Files  Relocatable file  describes how it should be linked with other object files to create an executable file or shared library.  Executable file  supplies information necessary for the operating system to create a process image suitable for executing the code and accessing the data contained within the file.  Shared object file  contains information needed in both static and dynamic linking.
  • 28. 28 ELF File Format  Two views for each of the three file types.  Linking view and execution view  These views support both the linking and execution of a program.  Linking view is partitioned by sections.  Execution view is partitioned by segments.  The ELF access library, libelf, provides tools to extract and manipulate ELF object files.
  • 29. 29 ELF File Format (cont.)  Linking View Execution View ELF header Program header table (optional) Section 1 … Section n … … Section header table ELF header Program header table Segment 1 … Segment n … … Section header table (optional)
  • 30. 30 Example: readelf  We can use “readelf” to output ELF information  Example  use “-e” option to read all header from the executable file of “hello.c” $ cat hello.c /* hello.c, a simple example program */ #define GREETING "Hello, World!n" int main() { puts(GREETING); } $ arm-elf-gcc –o hello.elf hello.c $ arm-elf-readelf –e hello.elf
  • 31. 31 Example: ELF Header ELF Header: Magic: 7f 45 4c 46 01 01 01 61 00 00 00 00 00 00 00 00 Class: ELF32 Data: 2's complement, little endian Version: 1 (current) OS/ABI: ARM ABI Version: 0 Type: EXEC (Executable file) Machine: ARM Version: 0x1 Entry point address: 0x8100 Start of program headers: 52 (bytes into file) Start of section headers: 168152 (bytes into file) Flags: 0x202, has entry point, GNU EABI, software FP Size of this header: 52 (bytes) Size of program headers: 32 (bytes) Number of program headers: 1 Size of section headers: 40 (bytes) Number of section headers: 25 Section header string table index: 22
  • 32. 32 Example: Section Header Section Headers: [Nr] Name Type Addr Off Size ES Flg Lk Inf Al [ 0] NULL 00000000 000000 000000 00 0 0 0 [ 1] .init PROGBITS 00008000 008000 000020 00 AX 0 0 4 [ 2] .text PROGBITS 00008020 008020 0030e8 00 AX 0 0 4 [ 3] .fini PROGBITS 0000b108 00b108 00001c 00 AX 0 0 4 [ 4] .rodata PROGBITS 0000b124 00b124 000020 00 A 0 0 4 [ 5] .data PROGBITS 0000b244 00b244 00092c 00 WA 0 0 4 [ 6] .eh_frame PROGBITS 0000bb70 00bb70 000004 00 A 0 0 4 [ 7] .ctors PROGBITS 0000bb74 00bb74 000008 00 WA 0 0 4 [ 8] .dtors PROGBITS 0000bb7c 00bb7c 000008 00 WA 0 0 4 [ 9] .jcr PROGBITS 0000bb84 00bb84 000004 00 WA 0 0 4 [10] .bss NOBITS 0000bb88 00bb88 00010c 00 WA 0 0 4 [11] .comment PROGBITS 00000000 00bb88 000288 00 0 0 1 [12] .debug_aranges PROGBITS 00000000 00be10 000420 00 0 0 8 [13] .debug_pubnames PROGBITS 00000000 00c230 000726 00 0 0 1 [14] .debug_info PROGBITS 00000000 00c956 011f48 00 0 0 1 [15] .debug_abbrev PROGBITS 00000000 01e89e 0031f4 00 0 0 1 [16] .debug_line PROGBITS 00000000 021a92 002a14 00 0 0 1 [17] .debug_frame PROGBITS 00000000 0244a8 000a14 00 0 0 4 [18] .debug_str PROGBITS 00000000 024ebc 001406 01 MS 0 0 1 [19] .debug_loc PROGBITS 00000000 0262c2 002be0 00 0 0 1 [20] .stack PROGBITS 00080000 028ea2 000000 00 W 0 0 1 [21] .debug_ranges PROGBITS 00000000 028ea2 000150 00 0 0 1 [22] .shstrtab STRTAB 00000000 028ff2 0000e3 00 0 0 1 [23] .symtab SYMTAB 00000000 0294c0 001590 10 24 ef 4 [24] .strtab STRTAB 00000000 02aa50 0007f9 00 0 0 1 Key to Flags: W (write), A (alloc), X (execute), M (merge), S (strings) I (info), L (link order), G (group), x (unknown) O (extra OS processing required) o (OS specific), p (processor specific)
  • 33. 33 Example: Program Header Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align LOAD 0x008000 0x00008000 0x00008000 0x03b88 0x03c94 RWE 0x8000 Section to Segment mapping: Segment Sections... 00 .init .text .fini .rodata .data .eh_frame .ctors .dtors .jcr .bss
  • 34. 34 Data Representation  Support various processors with 8-bit bytes and 32-bit architectures.  Intended to be extensible to larger or smaller architecture. Name Size Alignment Purpose Elf32_Addr 4 4 Unsigned program address Elf32_Half 2 2 Unsigned medium integer Elf32_Off 4 4 Unsigned file offset Elf32_Sword 4 4 Signed large integer Elf32_Word 4 4 Unsigned large integer unsigned char 1 1 Unsigned small integer
  • 35. 35 ELF Header1  It is always the first section of the file.  Describes the type of the object file .  Its target architecture, and the version of ELF it is using.  The location of the Program Header table, Section Header table, and String table along with associated number and size of entries for each table are also given.  Contains the location of the first executable instruction.
  • 36. 36 ELF Header2 #define EI_NIDENT 16 typedef struct { unsigned char e_ident[EI_NIDENT];// file ID, interpretation Elf32_Half e_type; // object file type Elf32_Half e_machine; // target architecture Elf32_Word e_version; // ELF version Elf32_Addr e_entry; // starting virtual address Elf32_Off e_phoff; // file offset to program header Elf32_Off e_shoff; // file offset to section header Elf32_Word e_flags; // processor-specific flags Elf32_Half e_ehsize; // the ELF header’s size Elf32_Half e_phentsize; // program header entry size Elf32_Half e_phnum; // program header entry number Elf32_Half e_shentsize; // section header entry size Elf32_Half e_shnum; // section header entry number Elf32_Half e_shtrndx; // section header index for string } Elf32_Ehdr;
  • 37. 37 Section Header  The section header table is an array of structures.  A section header table index is a subscript into this array.  Each entry correlates to a section in the file.  The entry provides the name, type, memory image starting address, file offset, the section’s size in bytes, alignment.
  • 38. 38 The Section Header Table typedef struct { Elf32_Word sh_name; // name of section, an index Elf32_Word sh_type; // type of section Elf32_Word sh_flags; // section-specific attributes Elf32_Addr sh_addr; // memory location of section Elf32_Off sh_offset; // file offset to section Elf32_Word sh_size; // size of section Elf32_Word sh_link; // section type, dependent Elf32_Word sh_info; // extra information, dependent Elf32_Word sh_addralign; // address alignment Elf32_Word sh_entsize; // size of an entry in section } Elf32_Shdr;
  • 39. 39 ELF Sections  A number of types of sections described by entries in the section header table.  Sections can hold executable code, data, dynamic linking information, debugging data, symbol tables, relocation information, comments, string tables, and notes.
  • 40. 40 Special Sections1  Various sections in ELF are pre-defined.  A list of special sections  .bss un-initialized data  .comment version control information  .data and .data1 initialized data present  .debug… information for symbolic debugging  .dynamic dynamic linking information  .dynstr strings needed for dynamic linking  .hash symbol hash table  .line line number information for debugging
  • 41. 41 Special Sections2  A list of special sections (cont.)  .note file notes  .relname and .relaname relocation data  .rodata and .rodata1 read-only data  .shstrtab section names  .strtab the strings that represent the names associated with symbol table entries  .symtab symbol table  .text executable instructions
  • 42. 42 String Table  The object file uses these strings to represent symbol and section names.  The first and last byte is defined to hold a null character.  An empty string table section is permitted.  Ex: index +0 +1 +2 +3 +4 +5 +6 +7 +8 +9 0 0 n a m e . 0 V a r 10 i a b l e 0 a b l e 20 0 0 x x 0
  • 43. 43 Symbol Table  Holds information needed to locate and relocate a program’s symbolic definitions and references.  A symbol table entry typedef struct { Elf32_Word st_name; // symbol name, an index Elf32_Addr st_value; // symbol value Elf32_Word st_size; // symbol size unsigned char st_info; // symbol’s type and binding attributes unsigned char st_other; // symbol visibility Elf32_Half st_shndx; // relevant section header table index } Elf32_Sym;
  • 44. 44 Program Header  Program headers are meaningful only for executable and shared object files.  The program header table is an array of structures, each describing a segment or other information.  An object file segment contains one or more sections.  A file specifies its own program header size with the ELF header’s e_phentsize & e_phnum.
  • 45. 45 The Program Header Table typedef struct { Elf32_Word p_type; // type of the segment Elf32_Off p_offset; // file offset to segment Elf32_Addr p_vaddr; // virtual address of first byte Elf32_Addr p_paddr; // segments’ physical address Elf32_Word p_filesz; // size of file image of segment Elf32_Word p_memsz; // size of memory image of segment Elf32_Word p_flags; // segment-specific flags Elf32_Word p_align; // alignment requirements } Elf32_Phdr;
  • 46. 46 Executable Programs  A program to be loaded by the system must have at least one loadable segment.  Segments are a way of grouping related sections.  A process image is created by loading and interpreting segments.  Segment contents  A segment comprises one or more sections.  Text segments contain read-only instructions and data.  Data segments contain writable data and instructions
  • 47. 47 ELF Segments  Text segment example  Data segment example .hash .dynsym .dynstr .text .rodata .rel .plt .data .dynamic .got .bss
  • 48. 48 Exercise #4  Write a service routine that receives the name of an ELF executable file as a parameter and display the offset of program header on the screen.  Void service102(char *filename);  Write a trigger that pass a file name to the above service routine through SWI #102.  void trigger102(char *filename);  Write a main program to perform a demonstration.
  • 49. 49 Outline  Exception Handling and Software Interrupts  ELF: Executable and Linking Format  ARM Monitor and Program Loading
  • 50. 50 Overview of ARM Debug Monitor  The ARM Debug Monitor is called “Angel” (earlier versions called it the “Demon” – get it?)  Provides  lowlevel programming C library and debugging environment  When the X-board first boots, they load the demon from flash memory (emulator pretends that this happens)  This activity is called “bootstrapping”
  • 51. 51 Memory Map of Demon 0x0000 CPU reset vector 0x0004 ...0x1c CPU undefined instruction ... CPU Fast Interrupt Vector 0x0020 ~1K Bytes for FIQ and FIQ mode stack 0x0400 256 bytes for IRQ mode stack 0x0500 256 bytes for Undefined mode stack 0x0600 256 bytes for Abort mode stack 0x0700 256 bytes for SVC mode stack 0x0800 Debug monitor private workspace 0x1000 Free for user-supplied Debug Monitor 0x2000 Floating Point Emulation Space 0x8000 Application Space top of memory SWI_Getenv returns top of memory = 0x08000000
  • 52. 52 Monitor Program  Provide Capability to  Setup Hardware on startup  Load and run programs  Debug code  Minimal OS functionality  Many embedded systems are just  Monitor + application  Monitor still handles other types of interrupts (we'll cover this later)  l timer, I/O (e.g., keypad, switches, LED, LCD)
  • 53. 53 Example System  Interrupt from external devices  keyboards, timers, disk drives  We refer to each piece of software as a process  Codes  Program counter  Registers  Stack  Other terms  Task  Thread
  • 54. 54 Debug Monitor SWIs  Angel provides a number of SWIs that you can use SWI_WriteC (0) Write a byte to the debug channel SWI_Write0(2) Write the null-terminated string to debug channel SWI_ReadC(4) Read a byte from the debug channel SWI_Exit (0x11) Halt emulation this is how a program exits SWI_EnterOS (0x16) Put the processor in supervisor mode SWI_GetErrno (0x60) Returns (r0) the value of the C library err-no variable SWI_Clock (0x61) Return the number of centi-seconds SWI_Time (0x63) Return the number of seconds since Jan. 1, 1970 SWI_Remove (0x64) Deletes the file named by pointer in r0 SWI_Rename (0x65) Renames a file SWI_Open (0x66) Open file (or device) SWI_Close (0x68) Close a file (or device) SWI_Write (0x69) Read a file SWI_Read (0x6a) Write a file SWI_Seek (0x6b) Seek to a specific location in a file SWI_Flen (0x6c) Returns length of the file object SWI_InstallHandler(0x70) installs a handler for a hardware exception
  • 55. 55 Program Loading  Monitor reads program from ??? and puts it into RAM  Does it just copy the executable into RAM??  Where does it put it??  Who sets up the user stack??  Who sets up the user heap??
  • 56. 56 ARM File Formats  ARM supports many formats for executables  Executable ARM Image Format (AIF)  Non-executable ARM Image Format (AIF)  ARM Object Format (AOF)  ARM Object Library Format  ARM Symbolic Debug Table Format  ARM ELF  Specialized version of ELF  Each provides code + data + other information  We will focus on ARM ELF
  • 57. 57 ARM ELF  ARM ELF  ELF (Executable and Linking Format) header  Image's code  Image's initialized static data  Debug and relocation information (optional)  We will use static linking (no dynamic linking or shared libraries) ELF Header Program Header Table Segment 1 Segment 2 … … Section Header Table optional ARM ELF File
  • 58. 58 Loading an Executable1  Read the executable file  ARMulator gets stuff from the native file system  Loader uses the SWI_Open and SWI_Read Monitor system calls  Parse the header to determine the size of the image  Starting location and image base  Create new address space for program large enough to hold text and data segments, along with a stack segment  Copy instructions and data from executable file into the new address space
  • 59. 59 Loading an Executable2  Zero-init the un-initialized data  Copy arguments passed to the program onto the stack  Initializes machine registers  Most registers cleared, but stack pointer assigned address of 1st free stack location  Jumps to start-up routine that copies program’s arguments from stack to registers and sets the PC  If main routine returns, start-up routine terminates program with the SWI_Exit system call
  • 60. 60 Optional ARM ELF Components  Compression  Self-decompression code included in image  Relocation  Self relocation code included in image  Debugging  Symbol table for debugger use  String tables for efficient allocation of strings  Can have more than one section per segment
  • 61. 61 Starting a Program  We discussed how an application's initial PC is set  The loader gets the address of the starting instruction from the object file header  To start the program, the loader moves the specified address into the PC  Is main() the starting point?  In other words, does the PC initially get set to the address of main()?  Let's look at an example
  • 62. 62 Listing from arm-elf-objdump1 Disassembly of section .init: 00008000 <_init>: 8000: e1a0c00d mov ip, sp 8004: e92ddff8 stmdb sp!, {r3, r4, r5, r6, r7, r8, r9, sl, fp, ip, lr, pc} 8008: e24cb004 sub fp, ip, #4 ; 0x4 800c: eb000023 bl 80a0 <frame_dummy> 8010: eb000c2d bl b0cc <__do_global_ctors_aux> 8014: e24bd028 sub sp, fp, #40 ; 0x28 8018: e89d6ff0 ldmia sp, {r4, r5, r6, r7, r8, r9, sl, fp, sp, lr} 801c: e1a0f00e mov pc, lr Disassembly of section .text: 00008020 <__do_global_dtors_aux>: 8020: e92d4030 stmdb sp!, {r4, r5, lr} 8024: e59f505c ldr r5, [pc, #92] ; 8088 <.text+0x68> 8028: e5d53000 ldrb r3, [r5] 802c: e3530000 cmp r3, #0 ; 0x0 8030: 18bd8030 ldmneia sp!, {r4, r5, pc} 8034: e59f4050 ldr r4, [pc, #80] ; 808c <.text+0x6c> 8038: e5943000 ldr r3, [r4] 803c: e5932000 ldr r2, [r3] 8040: e3520000 cmp r2, #0 ; 0x0 8044: 0a000007 beq 8068 <__do_global_dtors_aux+0x48> 8048: e2833004 add r3, r3, #4 ; 0x4 Initialization code
  • 63. 63 Listing from arm-elf-objdump2 804c: e5843000 str r3, [r4] 8050: e1a0e00f mov lr, pc 8054: e12fff12 bx r2 8058: e5943000 ldr r3, [r4] 805c: e5932000 ldr r2, [r3] 8060: e3520000 cmp r2, #0 ; 0x0 8064: 1afffff7 bne 8048 <__do_global_dtors_aux+0x28> 8068: e59f3020 ldr r3, [pc, #32] ; 8090 <.text+0x70> 806c: e3530000 cmp r3, #0 ; 0x0 8070: 159f001c ldrne r0, [pc, #28] ; 8094 <.text+0x74> 8074: 11a0e00f movne lr, pc 8078: 112fff13 bxne r3 807c: e3a03001 mov r3, #1 ; 0x1 8080: e5c53000 strb r3, [r5] 8084: e8bd8030 ldmia sp!, {r4, r5, pc} 8088: 0000bb88 andeq fp, r0, r8, lsl #23 808c: 0000b248 andeq fp, r0, r8, asr #4 8090: 00000000 andeq r0, r0, r0 8094: 0000bb70 andeq fp, r0, r0, ror fp 00008098 <call___do_global_dtors_aux>: 8098: e52de004 str lr, [sp, #-4]! 809c: e49df004 ldr pc, [sp], #4 000080a0 <frame_dummy>:
  • 64. 64 Listing from arm-elf-objdump3 80a0: e59f303c ldr r3, [pc, #60] ; 80e4 <.text+0xc4> 80a4: e3530000 cmp r3, #0 ; 0x0 80a8: e52de004 str lr, [sp, #-4]! 80ac: e59f0034 ldr r0, [pc, #52] ; 80e8 <.text+0xc8> 80b0: e59f1034 ldr r1, [pc, #52] ; 80ec <.text+0xcc> 80b4: 11a0e00f movne lr, pc 80b8: 112fff13 bxne r3 80bc: e59f002c ldr r0, [pc, #44] ; 80f0 <.text+0xd0> 80c0: e5903000 ldr r3, [r0] 80c4: e3530000 cmp r3, #0 ; 0x0 80c8: e59f3024 ldr r3, [pc, #36] ; 80f4 <.text+0xd4> 80cc: 049df004 ldreq pc, [sp], #4 80d0: e3530000 cmp r3, #0 ; 0x0 80d4: 049df004 ldreq pc, [sp], #4 80d8: e1a0e00f mov lr, pc 80dc: e12fff13 bx r3 80e0: e49df004 ldr pc, [sp], #4 80e4: 00000000 andeq r0, r0, r0 80e8: 0000bb70 andeq fp, r0, r0, ror fp 80ec: 0000bb8c andeq fp, r0, ip, lsl #23 80f0: 0000bb84 andeq fp, r0, r4, lsl #23 80f4: 00000000 andeq r0, r0, r0 000080f8 <call_frame_dummy>: 80f8: e52de004 str lr, [sp, #-4]!
  • 65. 65 Listing from arm-elf-objdump4 80fc: e49df004 ldr pc, [sp], #4 00008100 <_mainCRTStartup>: 8100: e3a00016 mov r0, #22 ; 0x16 8104: e28f10e4 add r1, pc, #228 ; 0xe4 8108: ef123456 swi 0x00123456 810c: e59f00dc ldr r0, [pc, #220] ; 81f0 <.text+0x1d0> 8110: e590d008 ldr sp, [r0, #8] 8114: e590a00c ldr sl, [r0, #12] 8118: e28aac01 add sl, sl, #256 ; 0x100 811c: e3a01000 mov r1, #0 ; 0x0 8120: e1a0b001 mov fp, r1 8124: e1a07001 mov r7, r1 8128: e59f00c4 ldr r0, [pc, #196] ; 81f4 <.text+0x1d4> 812c: e59f20c4 ldr r2, [pc, #196] ; 81f8 <.text+0x1d8> 8130: e0422000 sub r2, r2, r0 8134: eb00004c bl 826c <memset> 8138: eb000152 bl 8688 <initialise_monitor_handles> 813c: e3a00015 mov r0, #21 ; 0x15 8140: e28f10b8 add r1, pc, #184 ; 0xb8 8144: ef123456 swi 0x00123456 8148: e59f10b0 ldr r1, [pc, #176] ; 8200 <.text+0x1e0> 814c: e3a00000 mov r0, #0 ; 0x0 8150: e92d0001 stmdb sp!, {r0} 8154: e4d13001 ldrb r3, [r1], #1  Entry point
  • 66. 66 Listing from arm-elf-objdump5 8158: e3530000 cmp r3, #0 ; 0x0 815c: 0a000011 beq 81a8 <_mainCRTStartup+0xa8> 8160: e3530020 cmp r3, #32 ; 0x20 8164: 0afffffa beq 8154 <_mainCRTStartup+0x54> 8168: e3530022 cmp r3, #34 ; 0x22 816c: 13530027 cmpne r3, #39 ; 0x27 8170: 01a02003 moveq r2, r3 8174: 13a02020 movne r2, #32 ; 0x20 8178: 12411001 subne r1, r1, #1 ; 0x1 817c: e92d0002 stmdb sp!, {r1} 8180: e2800001 add r0, r0, #1 ; 0x1 8184: e4d13001 ldrb r3, [r1], #1 8188: e3530000 cmp r3, #0 ; 0x0 818c: 0a000005 beq 81a8 <_mainCRTStartup+0xa8> 8190: e1520003 cmp r2, r3 8194: 1afffffa bne 8184 <_mainCRTStartup+0x84> 8198: e3a02000 mov r2, #0 ; 0x0 819c: e2413001 sub r3, r1, #1 ; 0x1 81a0: e5c32000 strb r2, [r3] 81a4: eaffffea b 8154 <_mainCRTStartup+0x54> 81a8: e1a0100d mov r1, sp 81ac: e08d2100 add r2, sp, r0, lsl #2 81b0: e1a0300d mov r3, sp 81b4: e1520003 cmp r2, r3 81b8: 85124004 ldrhi r4, [r2, #-4]
  • 67. 67 Listing from arm-elf-objdump6 81bc: 85935000 ldrhi r5, [r3] 81c0: 85225004 strhi r5, [r2, #-4]! 81c4: 84834004 strhi r4, [r3], #4 81c8: 8afffff9 bhi 81b4 <_mainCRTStartup+0xb4> 81cc: e1a04000 mov r4, r0 81d0: e1a05001 mov r5, r1 81d4: e59f0020 ldr r0, [pc, #32] ; 81fc <.text+0x1dc> 81d8: eb000011 bl 8224 <atexit> 81dc: ebffff87 bl 8000 <_init> 81e0: e1a00004 mov r0, r4 81e4: e1a01005 mov r1, r5 81e8: eb000006 bl 8208 <main> 81ec: eb000011 bl 8238 <exit> 81f0: 0000b24c andeq fp, r0, ip, asr #4 81f4: 0000bb88 andeq fp, r0, r8, lsl #23 81f8: 0000bc94 muleq r0, r4, ip 81fc: 0000b108 andeq fp, r0, r8, lsl #2 8200: 0000b25c andeq fp, r0, ip, asr r2 8204: 000000ff streqd r0, [r0], -pc 00008208 <main>: 8208: e1a0c00d mov ip, sp 820c: e92dd800 stmdb sp!, {fp, ip, lr, pc} 8210: e24cb004 sub fp, ip, #4 ; 0x4 8214: e59f0004 ldr r0, [pc, #4] ; 8220 <.text+0x200>  Call user’s main  Call exit before quit  Call init code  The user’s main
  • 68. 68 Listing from arm-elf-objdump7 8218: eb000056 bl 8378 <puts> 821c: e89da800 ldmia sp, {fp, sp, pc} 8220: 0000b124 andeq fp, r0, r4, lsr #2 00008224 <atexit>: 8224: e1a01000 mov r1, r0 8228: e3a00000 mov r0, #0 ; 0x0 822c: e1a02000 mov r2, r0 8230: e1a03000 mov r3, r0 8234: ea000264 b 8bcc <__register_exitproc> 00008238 <exit>: 8238: e92d4010 stmdb sp!, {r4, lr} 823c: e3a01000 mov r1, #0 ; 0x0 8240: e1a04000 mov r4, r0 8244: eb000297 bl 8ca8 <__call_exitprocs> 8248: e59f3018 ldr r3, [pc, #24] ; 8268 <.text+0x248> 824c: e5930000 ldr r0, [r3] 8250: e590203c ldr r2, [r0, #60] 8254: e3520000 cmp r2, #0 ; 0x0 8258: 11a0e00f movne lr, pc 825c: 112fff12 bxne r2 8260: e1a00004 mov r0, r4 8264: eb000233 bl 8b38 <_exit> 8268: 0000b134 andeq fp, r0, r4, lsr r1  Code on exit
  • 69. 69 Starting a C Program  To get to main() takes hundreds of instructions!  In a modern OS, it can take several thousands of instructions!  Why? Because the C compiler generates code for a number of setup routines before the call to main().  These setup routines handle the stack, data segments, heap and other miscellaneous functions.
  • 70. 70 Starting an Assembly Program  What about assembly code?  If the assembly code interfaces to C code and the ENTRY point is the C function main(), then the C compiler will generate the setup code  But, if the entire program is written in assembly OR there is no C function called main(), then the setup code is not generated.  What does this mean for you?  What's the SP register pointing to when you start your program?
  • 71. 71 Assembly Example .text .align 2 .global _start _start: ldr r1, num1 ldr r0, num2 add r5, r1, r0 str r5, sum mov pc, lr num2: .word 0x7 num1: .word 0x5 sum: .space 0x4
  • 72. 72 Listing of Assembly Example test.elf: file format elf32-littlearm Disassembly of section .text: 00008000 <_start>: 8000: e59f1010 ldr r1, [pc, #16] ; 8018 <num1> 8004: e59f0008 ldr r0, [pc, #8] ; 8014 <num2> 8008: e0815000 add r5, r1, r0 800c: e58f5008 str r5, [pc, #8] ; 801c <sum> 8010: e1a0f00e mov pc, lr 00008014 <num2>: 8014: 00000007 andeq r0, r0, r7 00008018 <num1>: 8018: 00000005 andeq r0, r0, r5 0000801c <sum>: 801c: 00000000 andeq r0, r0, r0