Tag: Assembly

These are my notes for where I can see PPC varying from ia32, as presented in the video Part 4 — Hello World.  Let me know if I’ve missed something important, obvious or got something wrong.

http://www.ibm.com/developerworks/library/l-ppc/ gives a good starting overview of PPC asm, including syscalls.  The syscall number goes into gpr0 and the args in gpr3 and following, so JustExit.s becomes:

.text
.globl _start

_start:
    li 0,1 # load 1 into reg 0
    li 3,0 # load 0 into reg 3
    sc     # system call

Simple enough.

Modifying the provided HelloWorldProgram.s example (and using the example from the above link) yields

.data

HelloWorldString:
    .ascii "Hello World\n"

.text

.globl _start

_start:
    # Load all the arguments for write ()

    li   0, 4  # syscall number of 4 (write)
    li   3, 1  # filenumber 1 (stdout)
    lis  4, HelloWorldString@ha   # load upper 16 bits of addr
    addi 4, 4, HelloWorldString@l # add lower 16 bits of addr
    li   5, 12 # length of string
    sc

    # exit the program
    li 0,1
    li 3,0
    sc

There’s some subtlety in the @ha and @l high and low parts of addresses that I don’t yet have my head around fully, but I’ll be coming back to this in a later part.

Previous assembly primer notes…

Part 1 — System Organization — PPC — SPU
Part 2 — Memory Organisation — SPU
Part 3 — GDB Usage Primer — PPC & SPU

I found the videos introducing assembly language here to be of interest as my own understanding and experience with assembly is quite limited.  The videos are focussed on the ia32 architecture and reverse engineering, particularly for security exploits, and while these aspects don’t really excite me, the videos are well made and clear and the “Assembly Primer for Hackers” videos cover general assembly programming and details of machine architecture that are more broadly applicable.

I thought it would be interesting to work from these videos and make some notes on applying the concepts to the Cell BE’s PPU and SPU.

The platform I’m using is Debian Sid on a PS3 (3.15 OtherOS) with the standard system toolchain.

These are my notes for where I can see the PPU varying from the ia32, as presented in the video Part 1 — System Organization.  Let me know if I’ve missed something important, obvious or got something wrong.

For reference, I’m using the PPC Architecture Books (also found in the Cell SDK) and documentation for the PPC64 ABI.

Registers

Branch Processor

• CR Condition Register — 32-bit. Provides a mechanism for testing (and branching). Eight 4-bit fields.
  • CR0–CR1 — Volatile condition code register fields
  • CR2–CR4 — Nonvolatile condition code register fields
  • CR5–CR7 — Volatile condition code register fields
• LR Link Register (volatile) — 64-bit.  Can be used to provide branch target address for Branch Conditional to Link Register instruction
• CTR Count Register (volatile) — 64-bit.  Can be used to hold a loop count that can be decremented during execution of Branch instructions containing appropriately coded BO field.  Also can be used to provide branch target address for the Branch Conditional to Count Register instruction.

Fixed-Pt Processing

• GPR0–GPR31 — 64-bit General Purpose registers. Byte, halfword, word or doubleword, depending on instruction flags.  Supports byte, halfword, word, doubleword operand fetches and stores to storage.
  • r0 — Volatile register used in function prologs
  • r1 — Stack frame pointer
  • r2 — TOC pointer
  • r3 — Volatile parameter and return value register
  • r4–r10 — Volatile registers used for function parameters
  • r11 — Volatile register used in calls by pointer and as an environment pointer for languages which require one
  • r12 — Volatile register used for exception handling and glink code
  • r13 — Reserved for use as system thread ID
  • r14–r31 — Nonvolatile registers used for local variables
• XER Fixed-Point Exception Register (volatile) — 64-bit.  Book I, p 32 has the details on this one.
• MSR Machine State Register — 64-bit.  Defines the state of the processor. See Book III, p 10.

Float-Pt Processing

• FPR0–FPR31 Floating-Point Registers — 64-bit. Single or double precision, depending on instruction flags.  Supports word and doubleword operand fetches and stores to storage.
  • f0 — Volatile scratch register
  • f1–f4 — Volatile floating point parameter and return value registers
  • f5–f13 — Volatile floating point parameter registers
  • f14–f31 — Nonvolatile registers
• FPSCR Floading-Point Status and Control Register (volatile) — 32-bit. Status and control bits. See Book1, pp 87–89.

VMX

• v0–v1 — Volatile scratch registers
• v2–v13 — Volatile vector parameters registers
• v14–v19 — Volatile scratch registers
• v20–v31 — Non-volatile registers
• vrsave — Non-volatile 32-bit register

Privileged

• SRR0 & SRR1 Machine Status Save/Restore registers — 64-bit. Used to store machine state when an interrupt occurs.
• DAR Data Address Register — 64-bit. Set by various interrupts to effective address associated with interrupt.
• DSISR Data Storage Interrupt Status Register — 32-bit. Set to indicate the cause of various interrupts.
• SPRG0–SPRG3 Software-use SPRs — 64-bit.  For use by privileged software.
• CTRL Control Register — 32-bit. Controls an external I/O pin.
• PVR Processor Version Register — 32-bit. Read-only.
• PIR Processor Identification Register — 32-bit.

(there’s some hypervisor regs not listed here, and probably others…)

Virtual Memory Model

• Default/standard location for .text appears to be 0x1000000
• stack starts at 0xffffffff