1.
嵌入式處理器架構與程式設計
王建民
中央研究院 資訊所
2008年 7月

2.
2
Contents
 Introduction
 Computer Architecture
 ARM Architecture
 Development Tools
 GNU Development Tools
 ARM Instruction Set
 ARM Assembly Language
 ARM Assembly Programming
 GNU ARM ToolChain
 Interrupts and Monitor

3.
Lecture 10
Interrupts and Monitor

4.
4
Outline
 Exception Handling and Software Interrupts
 ELF: Executable and Linking Format
 ARM Monitor and Program Loading

5.
5
Normal Program Flow vs. Exception
 Normally, programs execute sequentially (with a
few branches to make life interesting)
 Normally, programs execute in user mode
 Exceptions and interrupts break the sequential
flow of a program, jumping to architecturally-
defined memory locations
 In ARM, SoftWare Interrupt (SWI) is the “system
call” exception

6.
6
ARM Exceptions
 Types of ARM exceptions
 Reset: when CPU reset pin is asserted
 undefined instruction: when CPU tries to execute an
undefined op-code
 software interrupt: when CPU executes the SWI
instruction
 prefetch abort: when CPU tries to execute an
instruction pre-fetched from an illegal address
 data abort: when data transfer instruction tries to read
or write at an illegal address
 IRQ: when CPU's external interrupt request pin is
asserted
 FIQ: when CPU's external fast interrupt request pin is
asserted

7.
7
The Programmer’s Model
 Processor Modes (of interest)
 User: the “normal” program execution mode.
 IRQ: used for general-purpose interrupt handling.
 Supervisor: a protected mode for the operating system.
 The Register Set
 Registers R0-R15 + CPSR
 R13: Stack Pointer (by convention)
 R14: Link Register (hardwired)
 R15: Program Counter where bits 0:1 are ignored
(hardwired)

8.
8
Terminology
 The terms exception and interrupt are often
confused
 Exception usually refers to an internal CPU event
 floating point overflow
 MMU fault (e.g., page fault)
 trap (SWI)
 Interrupt usually refers to an external I/O event
 I/O device request
 reset
 In the ARM architecture manuals, the two terms
are mixed together

9.
9
What do SWIs do?
 SWIs (often called software traps) allow a user
program to “call” the OS that is, SWIs are how
system calls are implemented.
 When SWIs execute, the processor changes modes
(from User to Supervisor mode on the ARM) and
disables interrupts.

10.
10
SWI Example
 Types of SWIs in ARM Angel (axd or armsd)
 SWI_WriteC(SWI 0) Write a byte to the debug
channel
 SWI_Write0(SWI 2) Write the nullterminated
string to debug channel
 SWI_ReadC(SWI 4) Read a byte from the debug
channel
 SWI_Exit(SWI 0x11) Halt emulation this is how a
program exits
 SWI_EnterOS(SWI 0x16) Put the processor in
supervisor mode
 SWI_Clock(SWI 0x61) Return the number of centi-
seconds
 SWI_Time(SWI 0x63) Return the number of secs
since Jan. 1, 1970

11.
11
What happens on an SWI?1
 The ARM architecture defines a Vector Table indexed by
exception type
 One SWI, CPU does the following: PC <0x08
 Also, sets LR_svc, SPSR_svc, CPSR (supervisor mode,
no IRQ)
ADD r0,r0,r1
SWI 0x10
SUB r2,r2,r0
USER Program to R_Handler
to U_Handler
to S_Handler
to P_Handler
to D_Handler
...
to I_Handler
to F_Handler
Vector Table (spring board)
starting at 0x00 in memory
0x00
0x04
0x08
0x0c
0x10
0x14
0x18
0x1c
(Reset
(Undef instr.)
(SWI)
(Prefetch abort)
(Data abort)
(Reserved)
(IRQ)
(FIQ)
SWI Handler
1

12.
12
What happens on an SWI?2
 Not enough space in the table (only one instruction per
entry) to hold all of the code for the SWI handler function
 This one instruction must transfer control to appropriate
SWI Handler
 Several options are presented in the next slide
ADD r0,r0,r1
SWI 0x10
SUB r2,r2,r0
USER Program to R_Handler
to U_Handler
to S_Handler
to P_Handler
to D_Handler
...
to I_Handler
to F_Handler
Vector Table (spring board)
starting at 0x00 in memory
0x00
0x04
0x08
0x0c
0x10
0x14
0x18
0x1c
(Reset
(Undef instr.)
(SWI)
(Prefetch abort)
(Data abort)
(Reserved)
(IRQ)
(FIQ)
SWI Handler
2

13.
13
“Vectoring” Exceptions to Handlers
 Option of choice: Load PC from jump table (shown below)
 Another option: Direct branch (limited range)
ADD r0,r0,r1
SWI 0x10
SUB r2,r2,r0
USER Program LDR pc, pc, 0x100
LDR pc, pc, 0x100
LDR pc, pc, 0x100
LDR pc, pc, 0x100
LDR pc, pc, 0x100
LDR pc, pc, 0x100
LDR pc, pc, 0x100
LDR pc, pc, 0x100
Vector Table (spring board)
starting at 0x00 in memory
0x00
0x04
0x08
0x0c
0x10
0x14
0x18
0x1c
SWI Handler
(S_Handler)
2
&A_Handler
&U_Handler
&S_Handler
&P_Handler
...
“Jump” Table
0x108
0x10c
0x110
0x114
...
Why 0x110?

14.
14
What happens on SWI completion?
 Vectoring to the S_Handler starts executing the SWI
handler
 When the handler is done, it returns to the program at the
instruction following the SWI
 MOVS restores the original CPSR as well as changing pc
ADD r0,r0,r1
SWI 0x10
SUB r2,r2,r0
USER Program to R_Handler
to U_Handler
to S_Handler
to P_Handler
to D_Handler
...
to I_Handler
to F_Handler
Vector Table (spring board)
starting at 0x00 in memory
0x00
0x04
0x08
0x0c
0x10
0x14
0x18
0x1c
(Reset
(Undef instr.)
(SWI)
(Prefetch abort)
(Data abort)
(Reserved)
(IRQ)
(FIQ)
3 MOVS pc, lr
SWI Handler
(S_Handler)

15.
15
How to determine the SWI number?
 All SWIs go to 0x08
ADD r0,r0,r1
SWI 0x10
SUB r2,r2,r0
USER Program to R_Handler
to U_Handler
to S_Handler
to P_Handler
to D_Handler
...
to I_Handler
to F_Handler
Vector Table (spring board)
starting at 0x00 in memory
0x00
0x04
0x08
0x0c
0x10
0x14
0x18
0x1c
(Reset
(Undef instr.)
(SWI)
(Prefetch abort)
(Data abort)
(Reserved)
(IRQ)
(FIQ)
SWI Handler must
serve as clearing
house for different
SWIs
MOVS pc, lr
SWI Handler
(S_Handler)

16.
16
SWI Instruction Format
 Example: SWI 0x18
24-bit “comment” field (ignored by processor)
1 1 1 1
cond
0
23
24
27
31 28
SWI number

17.
17
Executing SWI Instruction
On SWI, the processor
(1) copies CPSR to SPSR_SVC
(2) set the CPSR mode bits to supervisor mode
(3) sets the CPSR IRQ to disable
(4) stores the value (PC + 4) into LR_SVC
(5) forces PC to 0x08
ADD r0,r0,r1
SWI 0x10
SUB r2,r2,r0
USER Program to R_Handler
to U_Handler
to S_Handler
to P_Handler
to D_Handler
...
to I_Handler
to F_Handler
Vector Table (spring board)
starting at 0x00 in memory
0x00
0x04
0x08
0x0c
0x10
0x14
0x18
0x1c
(Reset
(Undef instr.)
(SWI)
(Prefetch abort)
(Data abort)
(Reserved)
(IRQ)
(FIQ)
LDR r0,[lr,#4]
BIC r0,r0,#0xff000000
R0 holds SWI number
MOVS pc, lr
SWI Handler
(S_Handler)
24-bit “comment” field (ignored by processor)
1 1 1 1
cond

18.
18
Jump to “Service Routine”
ADD r0,r0,r1
SWI 0x10
SUB r2,r2,r0
USER Program to R_Handler
to U_Handler
to S_Handler
to P_Handler
to D_Handler
...
to I_Handler
to F_Handler
Vector Table (spring board)
starting at 0x00 in memory
0x00
0x04
0x08
0x0c
0x10
0x14
0x18
0x1c
(Reset
(Undef instr.)
(SWI)
(Prefetch abort)
(Data abort)
(Reserved)
(IRQ)
(FIQ)
LDR r0,[lr,#4]
BIC r0,r0,#0xff000000
switch (r0){
case 0x00: service_SWI1();
case 0x01: service_SWI2();
case 0x02: service_SWI3();
…
}
MOVS pc, lr
SWI Handler
(S_Handler)
24-bit “comment” field (ignored by processor)
1 1 1 1
cond
On SWI, the processor
(1) copies CPSR to SPSR_SVC
(2) set the CPSR mode bits to supervisor mode
(3) sets the CPSR IRQ to disable
(4) stores the value (PC + 4) into LR_SVC
(5) forces PC to 0x08

19.
19
Problem with The Current Handler
On SWI, the processor
(1) copies CPSR to SPSR_SVC
(2) set the CPSR mode bits to supervisor mode
(3) sets the CPSR IRQ to disable
(4) stores the value (PC + 4) into LR_SVC
(5) forces PC to 0x08
ADD r0,r0,r1
SWI 0x10
SUB r2,r2,r0
USER Program to R_Handler
to U_Handler
to S_Handler
to P_Handler
to D_Handler
...
to I_Handler
to F_Handler
Vector Table (spring board)
starting at 0x00 in memory
0x00
0x04
0x08
0x0c
0x10
0x14
0x18
0x1c
(Reset
(Undef instr.)
(SWI)
(Prefetch abort)
(Data abort)
(Reserved)
(IRQ)
(FIQ)
LDR r0,[lr,#4]
BIC r0,r0,#0xff000000
switch (r0){
case 0x00: service_SWI1();
case 0x01: service_SWI2();
case 0x02: service_SWI3();
…
}
MOVS pc, lr
SWI Handler
(S_Handler)
What was in R0? User program
may have been using this
register. Therefore, cannot just
use it must first save it

20.
20
Full SWI Handler
S_Handler:
SUB sp, sp, #4 @ leave room on stack for SPSR
STMFD sp!, {r0r12, lr} @ store user's gp registers
MRS r2, spsr @ get SPSR into gp registers
STR r2, [sp, #14*4] @ store SPSR above gp registers
MOV r1, sp @ pointer to parameters on stack
LDR r0, [lr, #4] @ extract the SWI number
BIC r0,r0,#0xff000000 @ get SWI # by bit-masking
BL C_SWI_handler @ go to handler (see next slide)
LDR r2, [sp, #14*4] @ restore SPSR (NOT “sp!”)
MSR spsr_csxf, r2 @ csxf flags
LDMFD sp!, {r0r12, lr} @ unstack user's registers
ADD sp, sp, #4 @ remove space used to store SPSR
MOVS pc, lr @ return from handler
gp = general-purpose
SPSR is stored above gp registers since the registers
may contain system call parameters (sp in r1)

21.
21
C_SWI_Handler
void C_SWI_handler(unsigned number, unsigned *regs)
{
switch (number){
case 0: /* SWI number 0 code */ break;
case 1: /* SWI number 1 code */ break;
...
case 0x100: puts(“SWI 0x100 trigged!n”);
break;
...
case XXX: /* SWI number XXX code */ break;
default:
} /* end switch */
} /* end C_SWI_handler() */
spsr_svc
lr_svc
r4
r3
r12
r11
r10
r9
r8
r7
r6
r5
r2
r1
r0
Previous sp_svc
sp_svc
regs[12]
regs[0] (also *regs)

22.
22
Loading the Vector Table
/* For 18-349, the Vector Table will use the ``LDR PC, PC,
* offset'' springboard approach */
unsigned Install_Handler(unsigned int routine, unsigned int *vector)
{
unsigned int pcload_instr, old_handler, *soft_vector;
pcload_instr = *vector; /* read the Vector Table instr (LDR ...) */
pcload_instr &= 0xfff; /* compute offset of jump table entry */
pcload_instr += 0x8 + (unsigned)vector; /* == offset adjusted by PC
and prefetch */
soft_vector = (unsigned *)pcload_instr; /* address to load pc from */
old_handler = *soft_vector; /* remember the old handler */
*soft_vector = routine; /* set up new handler in jump table */
return (old_handler); /* return old handler address */
} /* end Install_Handler() */
Called as
Install_Handler ((unsigned) S_Handler, swivec);
where,
unsigned *swivec = (unsigned *) 0x08;

23.
23
.text
.align 2
.global trigger
trigger:
STMFD sp!, {lr}
SWI #0x100
LDMFD sp!, {pc}
extern void S_Handler();
extern void trigger();
int main()
{
unsigned *swivec = (unsigned *) 0x08;
unsigned backup;
backup = Install_Handler ((unsigned) S_Handler, swivec);
trigger();
Install_Handler (backup, swivec);
}
Example: SWI Application

24.
24
Exercise #3
 Write a service routine that receives a file name
from a trigger and display the first lines of the file
on the screen.
 Void service101(char *filename);
 Write a trigger that pass a file name as an
argument to the above service routine through
SWI #0x101.
 void trigger101(char *filename);
 Write a main program to perform a demonstration.

25.
25
Outline
 Exception Handling and Software Interrupts
 ELF: Executable and Linking Format
 ARM Monitor and Program Loading

26.
26
Introduction to ELF
 Executable and Linking Format
 Developed by Unix System Lab.
 Default binary format on Linux, Solaris 2.x, etc…
 Some of the capabilities of ELF are dynamic
linking, dynamic loading, imposing runtime
control on a program, and an improved method for
creating shared libraries.
 The ELF representation of control data in an
object file is platform independent.

27.
27
Three Types of ELF Files
 Relocatable file
 describes how it should be linked with other object files
to create an executable file or shared library.
 Executable file
 supplies information necessary for the operating system
to create a process image suitable for executing the
code and accessing the data contained within the file.
 Shared object file
 contains information needed in both static and dynamic
linking.

28.
28
ELF File Format
 Two views for each of the three file types.
 Linking view and execution view
 These views support both the linking and
execution of a program.
 Linking view is partitioned by sections.
 Execution view is partitioned by segments.
 The ELF access library, libelf, provides
tools to extract and manipulate ELF object
files.

29.
29
ELF File Format (cont.)
 Linking View Execution View
ELF header
Program header table
(optional)
Section 1
…
Section n
…
…
Section header table
ELF header
Program header table
Segment 1
…
Segment n
…
…
Section header table
(optional)

30.
30
Example: readelf
 We can use “readelf” to output ELF information
 Example
 use “-e” option to read all header from the executable
file of “hello.c”
$ cat hello.c
/* hello.c, a simple example program */
#define GREETING "Hello, World!n"
int main()
{
puts(GREETING);
}
$ arm-elf-gcc –o hello.elf hello.c
$ arm-elf-readelf –e hello.elf

31.
31
Example: ELF Header
ELF Header:
Magic: 7f 45 4c 46 01 01 01 61 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: ARM
ABI Version: 0
Type: EXEC (Executable file)
Machine: ARM
Version: 0x1
Entry point address: 0x8100
Start of program headers: 52 (bytes into file)
Start of section headers: 168152 (bytes into file)
Flags: 0x202, has entry point, GNU EABI, software FP
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 1
Size of section headers: 40 (bytes)
Number of section headers: 25
Section header string table index: 22

32.
32
Example: Section Header
Section Headers:
[Nr] Name Type Addr Off Size ES Flg Lk Inf Al
[ 0] NULL 00000000 000000 000000 00 0 0 0
[ 1] .init PROGBITS 00008000 008000 000020 00 AX 0 0 4
[ 2] .text PROGBITS 00008020 008020 0030e8 00 AX 0 0 4
[ 3] .fini PROGBITS 0000b108 00b108 00001c 00 AX 0 0 4
[ 4] .rodata PROGBITS 0000b124 00b124 000020 00 A 0 0 4
[ 5] .data PROGBITS 0000b244 00b244 00092c 00 WA 0 0 4
[ 6] .eh_frame PROGBITS 0000bb70 00bb70 000004 00 A 0 0 4
[ 7] .ctors PROGBITS 0000bb74 00bb74 000008 00 WA 0 0 4
[ 8] .dtors PROGBITS 0000bb7c 00bb7c 000008 00 WA 0 0 4
[ 9] .jcr PROGBITS 0000bb84 00bb84 000004 00 WA 0 0 4
[10] .bss NOBITS 0000bb88 00bb88 00010c 00 WA 0 0 4
[11] .comment PROGBITS 00000000 00bb88 000288 00 0 0 1
[12] .debug_aranges PROGBITS 00000000 00be10 000420 00 0 0 8
[13] .debug_pubnames PROGBITS 00000000 00c230 000726 00 0 0 1
[14] .debug_info PROGBITS 00000000 00c956 011f48 00 0 0 1
[15] .debug_abbrev PROGBITS 00000000 01e89e 0031f4 00 0 0 1
[16] .debug_line PROGBITS 00000000 021a92 002a14 00 0 0 1
[17] .debug_frame PROGBITS 00000000 0244a8 000a14 00 0 0 4
[18] .debug_str PROGBITS 00000000 024ebc 001406 01 MS 0 0 1
[19] .debug_loc PROGBITS 00000000 0262c2 002be0 00 0 0 1
[20] .stack PROGBITS 00080000 028ea2 000000 00 W 0 0 1
[21] .debug_ranges PROGBITS 00000000 028ea2 000150 00 0 0 1
[22] .shstrtab STRTAB 00000000 028ff2 0000e3 00 0 0 1
[23] .symtab SYMTAB 00000000 0294c0 001590 10 24 ef 4
[24] .strtab STRTAB 00000000 02aa50 0007f9 00 0 0 1
Key to Flags:
W (write), A (alloc), X (execute), M (merge), S (strings)
I (info), L (link order), G (group), x (unknown)
O (extra OS processing required) o (OS specific), p (processor specific)

33.
33
Example: Program Header
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
LOAD 0x008000 0x00008000 0x00008000 0x03b88 0x03c94 RWE 0x8000
Section to Segment mapping:
Segment Sections...
00 .init .text .fini .rodata .data .eh_frame .ctors .dtors .jcr .bss

34.
34
Data Representation
 Support various processors with 8-bit bytes and
32-bit architectures.
 Intended to be extensible to larger or smaller
architecture.
Name Size Alignment Purpose
Elf32_Addr 4 4 Unsigned program address
Elf32_Half 2 2 Unsigned medium integer
Elf32_Off 4 4 Unsigned file offset
Elf32_Sword 4 4 Signed large integer
Elf32_Word 4 4 Unsigned large integer
unsigned char 1 1 Unsigned small integer

35.
35
ELF Header1
 It is always the first section of the file.
 Describes the type of the object file .
 Its target architecture, and the version of ELF it is
using.
 The location of the Program Header table, Section
Header table, and String table along with
associated number and size of entries for each
table are also given.
 Contains the location of the first executable
instruction.

36.
36
ELF Header2
#define EI_NIDENT 16
typedef struct {
unsigned char e_ident[EI_NIDENT];// file ID, interpretation
Elf32_Half e_type; // object file type
Elf32_Half e_machine; // target architecture
Elf32_Word e_version; // ELF version
Elf32_Addr e_entry; // starting virtual address
Elf32_Off e_phoff; // file offset to program header
Elf32_Off e_shoff; // file offset to section header
Elf32_Word e_flags; // processor-specific flags
Elf32_Half e_ehsize; // the ELF header’s size
Elf32_Half e_phentsize; // program header entry size
Elf32_Half e_phnum; // program header entry number
Elf32_Half e_shentsize; // section header entry size
Elf32_Half e_shnum; // section header entry number
Elf32_Half e_shtrndx; // section header index for string
} Elf32_Ehdr;

37.
37
Section Header
 The section header table is an array of structures.
 A section header table index is a subscript into
this array.
 Each entry correlates to a section in the file.
 The entry provides the name, type, memory
image starting address, file offset, the section’s
size in bytes, alignment.

38.
38
The Section Header Table
typedef struct {
Elf32_Word sh_name; // name of section, an index
Elf32_Word sh_type; // type of section
Elf32_Word sh_flags; // section-specific attributes
Elf32_Addr sh_addr; // memory location of section
Elf32_Off sh_offset; // file offset to section
Elf32_Word sh_size; // size of section
Elf32_Word sh_link; // section type, dependent
Elf32_Word sh_info; // extra information, dependent
Elf32_Word sh_addralign; // address alignment
Elf32_Word sh_entsize; // size of an entry in section
} Elf32_Shdr;

39.
39
ELF Sections
 A number of types of sections described by
entries in the section header table.
 Sections can hold executable code, data, dynamic
linking information, debugging data, symbol
tables, relocation information, comments, string
tables, and notes.

40.
40
Special Sections1
 Various sections in ELF are pre-defined.
 A list of special sections
 .bss un-initialized data
 .comment version control information
 .data and .data1 initialized data present
 .debug… information for symbolic debugging
 .dynamic dynamic linking information
 .dynstr strings needed for dynamic linking
 .hash symbol hash table
 .line line number information for debugging

41.
41
Special Sections2
 A list of special sections (cont.)
 .note file notes
 .relname and .relaname
relocation data
 .rodata and .rodata1
read-only data
 .shstrtab section names
 .strtab the strings that represent the names
associated with symbol table entries
 .symtab symbol table
 .text executable instructions

42.
42
String Table
 The object file uses these strings to represent
symbol and section names.
 The first and last byte is defined to hold a null
character.
 An empty string table section is permitted.
 Ex:
index +0 +1 +2 +3 +4 +5 +6 +7 +8 +9
0 0 n a m e . 0 V a r
10 i a b l e 0 a b l e
20 0 0 x x 0

43.
43
Symbol Table
 Holds information needed to locate and relocate a
program’s symbolic definitions and references.
 A symbol table entry
typedef struct {
Elf32_Word st_name; // symbol name, an index
Elf32_Addr st_value; // symbol value
Elf32_Word st_size; // symbol size
unsigned char st_info; // symbol’s type and binding attributes
unsigned char st_other; // symbol visibility
Elf32_Half st_shndx; // relevant section header table index
} Elf32_Sym;

44.
44
Program Header
 Program headers are meaningful only for
executable and shared object files.
 The program header table is an array of
structures, each describing a segment or other
information.
 An object file segment contains one or more
sections.
 A file specifies its own program header size with
the ELF header’s e_phentsize & e_phnum.

45.
45
The Program Header Table
typedef struct {
Elf32_Word p_type; // type of the segment
Elf32_Off p_offset; // file offset to segment
Elf32_Addr p_vaddr; // virtual address of first byte
Elf32_Addr p_paddr; // segments’ physical address
Elf32_Word p_filesz; // size of file image of segment
Elf32_Word p_memsz; // size of memory image of segment
Elf32_Word p_flags; // segment-specific flags
Elf32_Word p_align; // alignment requirements
} Elf32_Phdr;

46.
46
Executable Programs
 A program to be loaded by the system must have
at least one loadable segment.
 Segments are a way of grouping related sections.
 A process image is created by loading and
interpreting segments.
 Segment contents
 A segment comprises one or more sections.
 Text segments contain read-only instructions and data.
 Data segments contain writable data and instructions

47.
47
ELF Segments
 Text segment example  Data segment example
.hash
.dynsym
.dynstr
.text
.rodata
.rel
.plt
.data
.dynamic
.got
.bss

48.
48
Exercise #4
 Write a service routine that receives the name of
an ELF executable file as a parameter and display
the offset of program header on the screen.
 Void service102(char *filename);
 Write a trigger that pass a file name to the above
service routine through SWI #102.
 void trigger102(char *filename);
 Write a main program to perform a demonstration.

49.
49
Outline
 Exception Handling and Software Interrupts
 ELF: Executable and Linking Format
 ARM Monitor and Program Loading

50.
50
Overview of ARM Debug Monitor
 The ARM Debug Monitor is called “Angel”
(earlier versions called it the “Demon” – get it?)
 Provides
 lowlevel programming C library and debugging
environment
 When the X-board first boots, they load the demon
from flash memory (emulator pretends that this
happens)
 This activity is called “bootstrapping”

51.
51
Memory Map of Demon
0x0000 CPU reset vector
0x0004 ...0x1c CPU undefined instruction ... CPU Fast Interrupt Vector
0x0020 ~1K Bytes for FIQ and FIQ mode stack
0x0400 256 bytes for IRQ mode stack
0x0500 256 bytes for Undefined mode stack
0x0600 256 bytes for Abort mode stack
0x0700 256 bytes for SVC mode stack
0x0800 Debug monitor private workspace
0x1000 Free for user-supplied Debug Monitor
0x2000 Floating Point Emulation Space
0x8000 Application Space
top of memory SWI_Getenv returns top of memory = 0x08000000

52.
52
Monitor Program
 Provide Capability to
 Setup Hardware on startup
 Load and run programs
 Debug code
 Minimal OS functionality
 Many embedded systems are just
 Monitor + application
 Monitor still handles other types of interrupts (we'll
cover this later)
 l timer, I/O (e.g., keypad, switches, LED, LCD)

53.
53
Example System
 Interrupt from external
devices
 keyboards, timers, disk
drives
 We refer to each piece
of software as a
process
 Codes
 Program counter
 Registers
 Stack
 Other terms
 Task
 Thread

54.
54
Debug Monitor SWIs
 Angel provides a number of SWIs that you can use
SWI_WriteC (0) Write a byte to the debug channel
SWI_Write0(2) Write the null-terminated string to debug channel
SWI_ReadC(4) Read a byte from the debug channel
SWI_Exit (0x11) Halt emulation this is how a program exits
SWI_EnterOS (0x16) Put the processor in supervisor mode
SWI_GetErrno (0x60) Returns (r0) the value of the C library err-no variable
SWI_Clock (0x61) Return the number of centi-seconds
SWI_Time (0x63) Return the number of seconds since Jan. 1, 1970
SWI_Remove (0x64) Deletes the file named by pointer in r0
SWI_Rename (0x65) Renames a file
SWI_Open (0x66) Open file (or device)
SWI_Close (0x68) Close a file (or device)
SWI_Write (0x69) Read a file
SWI_Read (0x6a) Write a file
SWI_Seek (0x6b) Seek to a specific location in a file
SWI_Flen (0x6c) Returns length of the file object
SWI_InstallHandler(0x70) installs a handler for a hardware exception

55.
55
Program Loading
 Monitor reads program from ??? and puts it into
RAM
 Does it just copy the executable into RAM??
 Where does it put it??
 Who sets up the user stack??
 Who sets up the user heap??

56.
56
ARM File Formats
 ARM supports many formats for executables
 Executable ARM Image Format (AIF)
 Non-executable ARM Image Format (AIF)
 ARM Object Format (AOF)
 ARM Object Library Format
 ARM Symbolic Debug Table Format
 ARM ELF
 Specialized version of ELF
 Each provides code + data + other information
 We will focus on ARM ELF

57.
57
ARM ELF
 ARM ELF
 ELF (Executable and Linking
Format) header
 Image's code
 Image's initialized static data
 Debug and relocation
information (optional)
 We will use static linking
(no dynamic linking or
shared libraries)
ELF Header
Program Header Table
Segment 1
Segment 2
… …
Section Header Table
optional
ARM ELF File

58.
58
Loading an Executable1
 Read the executable file
 ARMulator gets stuff from the native file system
 Loader uses the SWI_Open and SWI_Read Monitor
system calls
 Parse the header to determine the size of the image
 Starting location and image base
 Create new address space for program large
enough to hold text and data segments, along with
a stack segment
 Copy instructions and data from executable file
into the new address space

59.
59
Loading an Executable2
 Zero-init the un-initialized data
 Copy arguments passed to the program onto the
stack
 Initializes machine registers
 Most registers cleared, but stack pointer assigned
address of 1st free stack location
 Jumps to start-up routine that copies program’s
arguments from stack to registers and sets the PC
 If main routine returns, start-up routine terminates
program with the SWI_Exit system call

60.
60
Optional ARM ELF Components
 Compression
 Self-decompression code included in image
 Relocation
 Self relocation code included in image
 Debugging
 Symbol table for debugger use
 String tables for efficient allocation of strings
 Can have more than one section per segment

61.
61
Starting a Program
 We discussed how an application's initial PC is set
 The loader gets the address of the starting instruction
from the object file header
 To start the program, the loader moves the specified
address into the PC
 Is main() the starting point?
 In other words, does the PC initially get set to the
address of main()?
 Let's look at an example

62.
62
Listing from arm-elf-objdump1
Disassembly of section .init:
00008000 <_init>:
8000: e1a0c00d mov ip, sp
8004: e92ddff8 stmdb sp!, {r3, r4, r5, r6, r7, r8, r9, sl, fp, ip, lr, pc}
8008: e24cb004 sub fp, ip, #4 ; 0x4
800c: eb000023 bl 80a0 <frame_dummy>
8010: eb000c2d bl b0cc <__do_global_ctors_aux>
8014: e24bd028 sub sp, fp, #40 ; 0x28
8018: e89d6ff0 ldmia sp, {r4, r5, r6, r7, r8, r9, sl, fp, sp, lr}
801c: e1a0f00e mov pc, lr
Disassembly of section .text:
00008020 <__do_global_dtors_aux>:
8020: e92d4030 stmdb sp!, {r4, r5, lr}
8024: e59f505c ldr r5, [pc, #92] ; 8088 <.text+0x68>
8028: e5d53000 ldrb r3, [r5]
802c: e3530000 cmp r3, #0 ; 0x0
8030: 18bd8030 ldmneia sp!, {r4, r5, pc}
8034: e59f4050 ldr r4, [pc, #80] ; 808c <.text+0x6c>
8038: e5943000 ldr r3, [r4]
803c: e5932000 ldr r2, [r3]
8040: e3520000 cmp r2, #0 ; 0x0
8044: 0a000007 beq 8068 <__do_global_dtors_aux+0x48>
8048: e2833004 add r3, r3, #4 ; 0x4
Initialization code

63.
63
Listing from arm-elf-objdump2
804c: e5843000 str r3, [r4]
8050: e1a0e00f mov lr, pc
8054: e12fff12 bx r2
8058: e5943000 ldr r3, [r4]
805c: e5932000 ldr r2, [r3]
8060: e3520000 cmp r2, #0 ; 0x0
8064: 1afffff7 bne 8048 <__do_global_dtors_aux+0x28>
8068: e59f3020 ldr r3, [pc, #32] ; 8090 <.text+0x70>
806c: e3530000 cmp r3, #0 ; 0x0
8070: 159f001c ldrne r0, [pc, #28] ; 8094 <.text+0x74>
8074: 11a0e00f movne lr, pc
8078: 112fff13 bxne r3
807c: e3a03001 mov r3, #1 ; 0x1
8080: e5c53000 strb r3, [r5]
8084: e8bd8030 ldmia sp!, {r4, r5, pc}
8088: 0000bb88 andeq fp, r0, r8, lsl #23
808c: 0000b248 andeq fp, r0, r8, asr #4
8090: 00000000 andeq r0, r0, r0
8094: 0000bb70 andeq fp, r0, r0, ror fp
00008098 <call___do_global_dtors_aux>:
8098: e52de004 str lr, [sp, #-4]!
809c: e49df004 ldr pc, [sp], #4
000080a0 <frame_dummy>:

64.
64
Listing from arm-elf-objdump3
80a0: e59f303c ldr r3, [pc, #60] ; 80e4 <.text+0xc4>
80a4: e3530000 cmp r3, #0 ; 0x0
80a8: e52de004 str lr, [sp, #-4]!
80ac: e59f0034 ldr r0, [pc, #52] ; 80e8 <.text+0xc8>
80b0: e59f1034 ldr r1, [pc, #52] ; 80ec <.text+0xcc>
80b4: 11a0e00f movne lr, pc
80b8: 112fff13 bxne r3
80bc: e59f002c ldr r0, [pc, #44] ; 80f0 <.text+0xd0>
80c0: e5903000 ldr r3, [r0]
80c4: e3530000 cmp r3, #0 ; 0x0
80c8: e59f3024 ldr r3, [pc, #36] ; 80f4 <.text+0xd4>
80cc: 049df004 ldreq pc, [sp], #4
80d0: e3530000 cmp r3, #0 ; 0x0
80d4: 049df004 ldreq pc, [sp], #4
80d8: e1a0e00f mov lr, pc
80dc: e12fff13 bx r3
80e0: e49df004 ldr pc, [sp], #4
80e4: 00000000 andeq r0, r0, r0
80e8: 0000bb70 andeq fp, r0, r0, ror fp
80ec: 0000bb8c andeq fp, r0, ip, lsl #23
80f0: 0000bb84 andeq fp, r0, r4, lsl #23
80f4: 00000000 andeq r0, r0, r0
000080f8 <call_frame_dummy>:
80f8: e52de004 str lr, [sp, #-4]!

65.
65
Listing from arm-elf-objdump4
80fc: e49df004 ldr pc, [sp], #4
00008100 <_mainCRTStartup>:
8100: e3a00016 mov r0, #22 ; 0x16
8104: e28f10e4 add r1, pc, #228 ; 0xe4
8108: ef123456 swi 0x00123456
810c: e59f00dc ldr r0, [pc, #220] ; 81f0 <.text+0x1d0>
8110: e590d008 ldr sp, [r0, #8]
8114: e590a00c ldr sl, [r0, #12]
8118: e28aac01 add sl, sl, #256 ; 0x100
811c: e3a01000 mov r1, #0 ; 0x0
8120: e1a0b001 mov fp, r1
8124: e1a07001 mov r7, r1
8128: e59f00c4 ldr r0, [pc, #196] ; 81f4 <.text+0x1d4>
812c: e59f20c4 ldr r2, [pc, #196] ; 81f8 <.text+0x1d8>
8130: e0422000 sub r2, r2, r0
8134: eb00004c bl 826c <memset>
8138: eb000152 bl 8688 <initialise_monitor_handles>
813c: e3a00015 mov r0, #21 ; 0x15
8140: e28f10b8 add r1, pc, #184 ; 0xb8
8144: ef123456 swi 0x00123456
8148: e59f10b0 ldr r1, [pc, #176] ; 8200 <.text+0x1e0>
814c: e3a00000 mov r0, #0 ; 0x0
8150: e92d0001 stmdb sp!, {r0}
8154: e4d13001 ldrb r3, [r1], #1
 Entry point

66.
66
Listing from arm-elf-objdump5
8158: e3530000 cmp r3, #0 ; 0x0
815c: 0a000011 beq 81a8 <_mainCRTStartup+0xa8>
8160: e3530020 cmp r3, #32 ; 0x20
8164: 0afffffa beq 8154 <_mainCRTStartup+0x54>
8168: e3530022 cmp r3, #34 ; 0x22
816c: 13530027 cmpne r3, #39 ; 0x27
8170: 01a02003 moveq r2, r3
8174: 13a02020 movne r2, #32 ; 0x20
8178: 12411001 subne r1, r1, #1 ; 0x1
817c: e92d0002 stmdb sp!, {r1}
8180: e2800001 add r0, r0, #1 ; 0x1
8184: e4d13001 ldrb r3, [r1], #1
8188: e3530000 cmp r3, #0 ; 0x0
818c: 0a000005 beq 81a8 <_mainCRTStartup+0xa8>
8190: e1520003 cmp r2, r3
8194: 1afffffa bne 8184 <_mainCRTStartup+0x84>
8198: e3a02000 mov r2, #0 ; 0x0
819c: e2413001 sub r3, r1, #1 ; 0x1
81a0: e5c32000 strb r2, [r3]
81a4: eaffffea b 8154 <_mainCRTStartup+0x54>
81a8: e1a0100d mov r1, sp
81ac: e08d2100 add r2, sp, r0, lsl #2
81b0: e1a0300d mov r3, sp
81b4: e1520003 cmp r2, r3
81b8: 85124004 ldrhi r4, [r2, #-4]

67.
67
Listing from arm-elf-objdump6
81bc: 85935000 ldrhi r5, [r3]
81c0: 85225004 strhi r5, [r2, #-4]!
81c4: 84834004 strhi r4, [r3], #4
81c8: 8afffff9 bhi 81b4 <_mainCRTStartup+0xb4>
81cc: e1a04000 mov r4, r0
81d0: e1a05001 mov r5, r1
81d4: e59f0020 ldr r0, [pc, #32] ; 81fc <.text+0x1dc>
81d8: eb000011 bl 8224 <atexit>
81dc: ebffff87 bl 8000 <_init>
81e0: e1a00004 mov r0, r4
81e4: e1a01005 mov r1, r5
81e8: eb000006 bl 8208 <main>
81ec: eb000011 bl 8238 <exit>
81f0: 0000b24c andeq fp, r0, ip, asr #4
81f4: 0000bb88 andeq fp, r0, r8, lsl #23
81f8: 0000bc94 muleq r0, r4, ip
81fc: 0000b108 andeq fp, r0, r8, lsl #2
8200: 0000b25c andeq fp, r0, ip, asr r2
8204: 000000ff streqd r0, [r0], -pc
00008208 <main>:
8208: e1a0c00d mov ip, sp
820c: e92dd800 stmdb sp!, {fp, ip, lr, pc}
8210: e24cb004 sub fp, ip, #4 ; 0x4
8214: e59f0004 ldr r0, [pc, #4] ; 8220 <.text+0x200>
 Call user’s main
 Call exit before quit
 Call init code
 The user’s main

68.
68
Listing from arm-elf-objdump7
8218: eb000056 bl 8378 <puts>
821c: e89da800 ldmia sp, {fp, sp, pc}
8220: 0000b124 andeq fp, r0, r4, lsr #2
00008224 <atexit>:
8224: e1a01000 mov r1, r0
8228: e3a00000 mov r0, #0 ; 0x0
822c: e1a02000 mov r2, r0
8230: e1a03000 mov r3, r0
8234: ea000264 b 8bcc <__register_exitproc>
00008238 <exit>:
8238: e92d4010 stmdb sp!, {r4, lr}
823c: e3a01000 mov r1, #0 ; 0x0
8240: e1a04000 mov r4, r0
8244: eb000297 bl 8ca8 <__call_exitprocs>
8248: e59f3018 ldr r3, [pc, #24] ; 8268 <.text+0x248>
824c: e5930000 ldr r0, [r3]
8250: e590203c ldr r2, [r0, #60]
8254: e3520000 cmp r2, #0 ; 0x0
8258: 11a0e00f movne lr, pc
825c: 112fff12 bxne r2
8260: e1a00004 mov r0, r4
8264: eb000233 bl 8b38 <_exit>
8268: 0000b134 andeq fp, r0, r4, lsr r1
 Code on exit

69.
69
Starting a C Program
 To get to main() takes hundreds of instructions!
 In a modern OS, it can take several thousands of
instructions!
 Why? Because the C compiler generates code for a
number of setup routines before the call to main().
 These setup routines handle the stack, data segments,
heap and other miscellaneous functions.

70.
70
Starting an Assembly Program
 What about assembly code?
 If the assembly code interfaces to C code and the
ENTRY point is the C function main(), then the C
compiler will generate the setup code
 But, if the entire program is written in assembly OR
there is no C function called main(), then the setup code
is not generated.
 What does this mean for you?
 What's the SP register pointing to when you start your
program?

71.
71
Assembly Example
.text
.align 2
.global _start
_start:
ldr r1, num1
ldr r0, num2
add r5, r1, r0
str r5, sum
mov pc, lr
num2: .word 0x7
num1: .word 0x5
sum: .space 0x4

72.
72
Listing of Assembly Example
test.elf: file format elf32-littlearm
Disassembly of section .text:
00008000 <_start>:
8000: e59f1010 ldr r1, [pc, #16] ; 8018 <num1>
8004: e59f0008 ldr r0, [pc, #8] ; 8014 <num2>
8008: e0815000 add r5, r1, r0
800c: e58f5008 str r5, [pc, #8] ; 801c <sum>
8010: e1a0f00e mov pc, lr
00008014 <num2>:
8014: 00000007 andeq r0, r0, r7
00008018 <num1>:
8018: 00000005 andeq r0, r0, r5
0000801c <sum>:
801c: 00000000 andeq r0, r0, r0