{"id":932,"date":"2011-02-12T00:21:58","date_gmt":"2011-02-11T14:21:58","guid":{"rendered":"http:\/\/brnz.org\/hbr\/?p=932"},"modified":"2011-02-12T00:21:58","modified_gmt":"2011-02-11T14:21:58","slug":"assembly-primer-parts-1-2-and-3-arm","status":"publish","type":"post","link":"https:\/\/brnz.org\/hbr\/?p=932","title":{"rendered":"Assembly Primer Parts 1, 2 and 3 &#8212; ARM"},"content":{"rendered":"<p>I had started a <a href=\"https:\/\/brnz.org\/hbr\/?page_id=737\">series of posts on assembly programming<\/a> for the Cell BE PPU and SPU, based on the <a href=\"http:\/\/tools.securitytube.net\/index.php?title=Open_Security_Training\">assembly primer video series from securitytube.net<\/a>. I have recently acquired a Nokia N900, and so thought I might take the opportunity to continue the series with a look at the ARM processor as well.<\/p>\n<p>Wikipedia lists the N900&#8217;s processor as a Texas Instruments OMAP3430,\t600MHz \tARMv7 Cortex-A8. I&#8217;m not at all familiar with the processor family, so I&#8217;ll be attempting to find out what all of this means as I go :P<\/p>\n<p>I&#8217;ve set up a cross compiler on my desktop machine using Gentoo&#8217;s neat crossdev tool (built using <strong>crossdev -t arm-linux-gnueabi<\/strong>). The toolchain builds a functional Hello, World!<\/p>\n<p>(I note that scratchbox appears to be the standard tool\/environment used to build apps for Maemo &#8212; I may take a closer look at that at a later date)<\/p>\n<p>I have whatever the latest public &#8216;stable&#8217; Maemo 5 release is on the N900 (PR 1.3, I think),\u00a0 with an <strong>apt-get install<\/strong> <strong>openssh<\/strong> <strong>gdb<\/strong> &#8212; thus far, enough to &#8220;debug&#8221; a functional Hello, World!<\/p>\n<p>What follows are some details of the Cortex-A8 architecture present in the N900, particularly in how it differs from IA32, as presented in the videos <a href=\"http:\/\/www.securitytube.net\/Assembly-Primer-for-Hackers-%28Part-1%29-System-Organization-video.aspx\">Part 1 &#8212; System Organisation<\/a>, <a href=\"http:\/\/www.securitytube.net\/Assembly-Primer-for-Hackers-%28Part-2%29-Virtual-Memory-Organization-video.aspx\">Part 2 &#8212; Virtual Memory Organization<\/a> and <a href=\"http:\/\/www.securitytube.net\/Assembly-Primer-for-Hackers-%28Part-3%29-GDB-Usage-Primer-video.aspx\">Part 3 &#8212; GDB Usage Primer<\/a>. I&#8217;ve packed them all into this post because gdb usage and Linux system usage are largely the same on ARM as they are on PPC and IA32.<\/p>\n<p>Most of the following information comes from the <a href=\"http:\/\/infocenter.arm.com\/help\/index.jsp?topic=\/com.arm.doc.ddi0406b\/index.html\">ARM Architecture Reference Manual<\/a>.<\/p>\n<p>(The number of possible configurations of ARM hardware makes it interesting at times to work out exactly which features are present in my particular processor. From what I can tell, the N900&#8217;s Cortex-A8 is ARMv7-A and includes VFPv3 half, single and double precision float support, and NEON (aka Advanced SIMD). I expect I&#8217;ll find out more when I actually start to try and program the thing. As to which gcc -march, -mcpu or -mfpu options are most correct for the N900 &#8212; I have no idea.)<\/p>\n<h2>1. Registers<\/h2>\n<h3>Integer<\/h3>\n<p>There are sixteen 32bit ARM core registers, R0 to R15, where R0&#8211;R12 are for general use. R13 contains the stack pointer (SP), R14 is the link register (LR), and R15 is the program counter (PC).<\/p>\n<p>The current program status register (CSPR) contains various status and control bits.<\/p>\n<h3>VFPv3 (Floating point) &amp; NEON (Advanced SIMD)<\/h3>\n<p>There are thrirty two doubleword (64bit) registers, that can be referenced in a number of ways.<\/p>\n<p>NEON instructions can access these as thirty two doubleword registers (D0&#8211;D31) or as sixteen quadword registers (Q0&#8211;Q15), able to be used interchangeably.<\/p>\n<p>VFP instructions can view the same registers as 32 doubleword registers (again, D0&#8211;D31) or as 32 single word registers (S0&#8211;S31). The single word view is packed into the first 16 doubleword registers.<\/p>\n<p>Something like this pic (click to embiggen):<\/p>\n<p style=\"text-align: center;\"><a href=\"https:\/\/brnz.org\/hbr\/wp-content\/uploads\/2011\/02\/ARMv7_VFPv3_NEON_extension_registers.png\"><img loading=\"lazy\" class=\"size-large wp-image-935 aligncenter\" style=\"border: 1px solid black;\" title=\"ARMv7_VFPv3_NEON_extension_registers\" src=\"https:\/\/brnz.org\/hbr\/wp-content\/uploads\/2011\/02\/ARMv7_VFPv3_NEON_extension_registers-540x89.png\" alt=\"\" width=\"540\" height=\"89\" srcset=\"https:\/\/brnz.org\/hbr\/wp-content\/uploads\/2011\/02\/ARMv7_VFPv3_NEON_extension_registers-540x89.png 540w, https:\/\/brnz.org\/hbr\/wp-content\/uploads\/2011\/02\/ARMv7_VFPv3_NEON_extension_registers-300x49.png 300w, https:\/\/brnz.org\/hbr\/wp-content\/uploads\/2011\/02\/ARMv7_VFPv3_NEON_extension_registers.png 800w\" sizes=\"(max-width: 540px) 85vw, 540px\" \/><\/a><\/p>\n<p style=\"text-align: left;\">VFP in this core (apparently) supports single and double precision floating point data types and arithmetic, as well as half precision (possibly in two different formats&#8230;).<\/p>\n<p style=\"text-align: left;\">NEON instructions support accessing values in extension registers as<\/p>\n<ul>\n<li>8, 16, 32 or 64bit integer, signed or unsigned,<\/li>\n<li>16 or 32bit floating point values, and<\/li>\n<li>8 or 16bit polynomial values.<\/li>\n<\/ul>\n<p>There&#8217;s also a floating point status and control register (FPSCR).<\/p>\n<h2>2. Virtual Memory Organisation<\/h2>\n<p>On this platform, program text appears to be loaded at <strong>0x8000<\/strong>.<\/p>\n<p>After an <strong>echo 0 &gt; \/proc\/sys\/kernel\/randomize_va_space<\/strong>, the top of the stack appears to be <strong>0xbf000000<\/strong>.<\/p>\n<h2>3. SimpleDemo<\/h2>\n<p>Compared to the video, there are only a couple of small differences when running SimpleDemo in gdb on ARM.<\/p>\n<p>Obviously, the disassembly is not the same as for IA32. Rather than the <strong>call<\/strong> instructions noted in the video, you&#8217;ll see <strong>bl<\/strong> (Branch with Link) for the various functions called.<\/p>\n<p>Where the return address is stored on the stack for IA32, the link register (<strong>lr<\/strong> in <strong>info registers<\/strong> output) stores the return address for the current function, although <strong>lr<\/strong> will be pushed to the stack before another function is called.<\/p>\n<p>(From a cursory googling, it seems that to correctly displaying all VFP\/NEON registers requires gdb-7.2 &#8212; I&#8217;m running the 6.8-based build from the maemo repo. crossdev will build me a gdb I can run on my desktop PC &#8212; <strong>crossdev -t arm-linux-gnueabi &#8211;ex-gdb<\/strong> &#8212; but I believe I still need to build a newer <strong>gdbserver<\/strong> to run on the N900.)<\/p>\n<h3>Other assembly primer notes are linked <a href=\"..\/?page_id=737\">here<\/a>.<a href=\"..\/?page_id=737\"><br \/>\n<\/a><\/h3>\n<div id=\"_mcePaste\" style=\"position: absolute; left: -10000px; top: 861px; width: 1px; height: 1px; overflow: hidden;\"><!-- p { margin-bottom: 0.21cm; } --><\/p>\n<p class=\"western\" style=\"margin-bottom: 0cm; page-break-before: always;\"><strong><span style=\"font-family: Calibri,sans-serif;\"><span style=\"font-size: medium;\">Proposed updates for praypal.org.au\t\t\t\t\t   2011\/02\/11<\/span><\/span><\/strong><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>I had started a series of posts on assembly programming for the Cell BE PPU and SPU, based on the assembly primer video series from securitytube.net. I have recently acquired a Nokia N900, and so thought I might take the opportunity to continue the series with a look at the ARM processor as well. Wikipedia &hellip; <a href=\"https:\/\/brnz.org\/hbr\/?p=932\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Assembly Primer Parts 1, 2 and 3 &#8212; ARM&#8221;<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[5,26],"tags":[45,38],"_links":{"self":[{"href":"https:\/\/brnz.org\/hbr\/index.php?rest_route=\/wp\/v2\/posts\/932"}],"collection":[{"href":"https:\/\/brnz.org\/hbr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/brnz.org\/hbr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/brnz.org\/hbr\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/brnz.org\/hbr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=932"}],"version-history":[{"count":19,"href":"https:\/\/brnz.org\/hbr\/index.php?rest_route=\/wp\/v2\/posts\/932\/revisions"}],"predecessor-version":[{"id":1008,"href":"https:\/\/brnz.org\/hbr\/index.php?rest_route=\/wp\/v2\/posts\/932\/revisions\/1008"}],"wp:attachment":[{"href":"https:\/\/brnz.org\/hbr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=932"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/brnz.org\/hbr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=932"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/brnz.org\/hbr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=932"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}