嵌入式處理器架構與程式設計

嵌入式處理器架構與程式設計 王建民中央研究院資訊所 2008年 7月

Contents • Introduction • Computer Architecture • ARM Architecture • Development Tools • GNU Development Tools • ARM Instruction Set • ARM Assembly Language • ARM Assembly Programming • GNU ARM ToolChain • Interrupts and Monitor

Lecture 10Interrupts and Monitor

Outline • Exception Handling and Software Interrupts • ELF: Executable and Linking Format • ARM Monitor and Program Loading

Normal Program Flow vs. Exception • Normally, programs execute sequentially (with a few branches to make life interesting) • Normally, programs execute in user mode • Exceptions and interrupts break the sequential flow of a program, jumping to architecturallydefined memory locations • In ARM, SoftWare Interrupt (SWI) is the “system call” exception

ARM Exceptions • Types of ARM exceptions • Reset: when CPU reset pin is asserted • undefined instruction: when CPU tries to execute an undefined op-code • software interrupt: when CPU executes the SWI instruction • prefetch abort: when CPU tries to execute an instruction pre-fetched from an illegal address • data abort: when data transfer instruction tries to read or write at an illegal address • IRQ: when CPU's external interrupt request pin is asserted • FIQ: when CPU's external fast interrupt request pin is asserted

The Programmer’s Model • Processor Modes (of interest) • User: the “normal” program execution mode. • IRQ: used for general-purpose interrupt handling. • Supervisor: a protected mode for the operating system. • The Register Set • Registers R0-R15 + CPSR • R13: Stack Pointer (by convention) • R14: Link Register (hardwired) • R15: Program Counter where bits 0:1 are ignored (hardwired)

Terminology • The terms exception and interrupt are often confused • Exception usually refers to an internal CPU event • floating point overflow • MMU fault (e.g., page fault) • trap (SWI) • Interrupt usually refers to an external I/O event • I/O device request • reset • In the ARM architecture manuals, the two terms are mixed together

What do SWIs do? • SWIs (often called software traps) allow a user program to “call” the OS that is, SWIs are how system calls are implemented. • When SWIs execute, the processor changes modes (from User to Supervisor mode on the ARM) and disables interrupts.

SWI Example • Types of SWIs in ARM Angel (axd or armsd) • SWI_WriteC(SWI 0) Write a byte to the debug channel • SWI_Write0(SWI 2) Write the nullterminated string to debug channel • SWI_ReadC(SWI 4) Read a byte from the debug channel • SWI_Exit(SWI 0x11) Halt emulation this is how a program exits • SWI_EnterOS(SWI 0x16) Put the processor in supervisor mode • SWI_Clock(SWI 0x61) Return the number of centiseconds • SWI_Time(SWI 0x63) Return the number of secs since Jan. 1, 1970

USER Program SWI Handler ADD r0,r0,r1 SWI 0x10 SUB r2,r2,r0 Vector Table (spring board) starting at 0x00 in memory 1 0x00 0x04 0x08 0x0c 0x10 0x14 0x18 0x1c to R_Handler to U_Handler to S_Handler to P_Handler to D_Handler ... to I_Handler to F_Handler (Reset (Undef instr.) (SWI) (Prefetch abort) (Data abort) (Reserved) (IRQ) (FIQ) What happens on an SWI?1 • The ARM architecture defines a Vector Table indexed by exception type • One SWI, CPU does the following: PC <0x08 • Also, sets LR_svc, SPSR_svc, CPSR (supervisor mode, no IRQ)

USER Program SWI Handler ADD r0,r0,r1 SWI 0x10 SUB r2,r2,r0 2 Vector Table (spring board) starting at 0x00 in memory 0x00 0x04 0x08 0x0c 0x10 0x14 0x18 0x1c to R_Handler to U_Handler to S_Handler to P_Handler to D_Handler ... to I_Handler to F_Handler (Reset (Undef instr.) (SWI) (Prefetch abort) (Data abort) (Reserved) (IRQ) (FIQ) What happens on an SWI?2 • Not enough space in the table (only one instruction per entry) to hold all of the code for the SWI handler function • This one instruction must transfer control to appropriate SWI Handler • Several options are presented in the next slide

Vector Table (spring board) starting at 0x00 in memory SWI Handler (S_Handler) 0x00 0x04 0x08 0x0c 0x10 0x14 0x18 0x1c LDR pc, pc, 0x100 LDR pc, pc, 0x100 LDR pc, pc, 0x100 LDR pc, pc, 0x100 LDR pc, pc, 0x100 LDR pc, pc, 0x100 LDR pc, pc, 0x100 LDR pc, pc, 0x100 USER Program 2 ADD r0,r0,r1 SWI 0x10 SUB r2,r2,r0 “Jump” Table 0x108 0x10c 0x110 0x114 ... &A_Handler &U_Handler &S_Handler &P_Handler ... Why 0x110? “Vectoring” Exceptions to Handlers • Option of choice: Load PC from jump table (shown below) • Another option: Direct branch (limited range)

USER Program SWI Handler (S_Handler) ADD r0,r0,r1 SWI 0x10 SUB r2,r2,r0 Vector Table (spring board) starting at 0x00 in memory 0x00 0x04 0x08 0x0c 0x10 0x14 0x18 0x1c to R_Handler to U_Handler to S_Handler to P_Handler to D_Handler ... to I_Handler to F_Handler (Reset (Undef instr.) (SWI) (Prefetch abort) (Data abort) (Reserved) (IRQ) (FIQ) MOVS pc, lr 3 What happens on SWI completion? • Vectoring to the S_Handler starts executing the SWI handler • When the handler is done, it returns to the program at the instruction following the SWI • MOVS restores the original CPSR as well as changing pc

USER Program SWI Handler (S_Handler) ADD r0,r0,r1 SWI 0x10 SUB r2,r2,r0 Vector Table (spring board) starting at 0x00 in memory SWI Handler must serve as clearing house for different SWIs 0x00 0x04 0x08 0x0c 0x10 0x14 0x18 0x1c to R_Handler to U_Handler to S_Handler to P_Handler to D_Handler ... to I_Handler to F_Handler (Reset (Undef instr.) (SWI) (Prefetch abort) (Data abort) (Reserved) (IRQ) (FIQ) MOVS pc, lr How to determine the SWI number? • AllSWIs go to 0x08

31 28 27 24 23 0 cond 1 1 1 1 24-bit “comment” field (ignored by processor) SWI number SWI Instruction Format • Example: SWI 0x18

cond 1 1 1 1 24-bit “comment” field (ignored by processor) USER Program ADD r0,r0,r1 SWI 0x10 SUB r2,r2,r0 Vector Table (spring board) starting at 0x00 in memory 0x00 0x04 0x08 0x0c 0x10 0x14 0x18 0x1c to R_Handler to U_Handler to S_Handler to P_Handler to D_Handler ... to I_Handler to F_Handler (Reset (Undef instr.) (SWI) (Prefetch abort) (Data abort) (Reserved) (IRQ) (FIQ) Executing SWI Instruction On SWI, the processor (1) copies CPSR to SPSR_SVC (2) set the CPSR mode bits to supervisor mode (3) sets the CPSR IRQ to disable (4) stores the value (PC + 4) into LR_SVC (5) forces PC to 0x08 SWI Handler (S_Handler) LDR r0,[lr,#4] BIC r0,r0,#0xff000000 R0 holds SWI number MOVS pc, lr

cond 1 1 1 1 24-bit “comment” field (ignored by processor) USER Program ADD r0,r0,r1 SWI 0x10 SUB r2,r2,r0 Vector Table (spring board) starting at 0x00 in memory 0x00 0x04 0x08 0x0c 0x10 0x14 0x18 0x1c to R_Handler to U_Handler to S_Handler to P_Handler to D_Handler ... to I_Handler to F_Handler (Reset (Undef instr.) (SWI) (Prefetch abort) (Data abort) (Reserved) (IRQ) (FIQ) Jump to “Service Routine” On SWI, the processor (1) copies CPSR to SPSR_SVC (2) set the CPSR mode bits to supervisor mode (3) sets the CPSR IRQ to disable (4) stores the value (PC + 4) into LR_SVC (5) forces PC to 0x08 SWI Handler (S_Handler) LDR r0,[lr,#4] BIC r0,r0,#0xff000000 switch (r0){ case 0x00: service_SWI1(); case 0x01: service_SWI2(); case 0x02: service_SWI3(); … } MOVS pc, lr

USER Program ADD r0,r0,r1 SWI 0x10 SUB r2,r2,r0 Vector Table (spring board) starting at 0x00 in memory 0x00 0x04 0x08 0x0c 0x10 0x14 0x18 0x1c to R_Handler to U_Handler to S_Handler to P_Handler to D_Handler ... to I_Handler to F_Handler (Reset (Undef instr.) (SWI) (Prefetch abort) (Data abort) (Reserved) (IRQ) (FIQ) Problem with The Current Handler On SWI, the processor (1) copies CPSR to SPSR_SVC (2) set the CPSR mode bits to supervisor mode (3) sets the CPSR IRQ to disable (4) stores the value (PC + 4) into LR_SVC (5) forces PC to 0x08 What was in R0? User program may have been using this register. Therefore, cannot just use it must first save it SWI Handler (S_Handler) LDR r0,[lr,#4] BIC r0,r0,#0xff000000 switch (r0){ case 0x00: service_SWI1(); case 0x01: service_SWI2(); case 0x02: service_SWI3(); … } MOVS pc, lr

Full SWI Handler S_Handler: SUB sp,sp, #4 @leave room on stack for SPSR STMFD sp!, {r0r12, lr} @store user's gp registers MRS r2, spsr@get SPSR into gp registers STR r2, [sp, #14*4] @ store SPSR above gp registers MOV r1, sp @ pointer to parameters on stack LDR r0, [lr, #4] @ extract the SWI number BIC r0,r0,#0xff000000 @ get SWI # by bit-masking BL C_SWI_handler @ go to handler (see next slide) LDR r2, [sp, #14*4] @ restore SPSR(NOT “sp!”) MSR spsr_csxf, r2 @ csxf flags LDMFD sp!, {r0r12, lr} @ unstack user's registers ADD sp, sp, #4@ remove space used to store SPSR MOVS pc, lr @ return from handler SPSR is stored above gp registers since the registers may contain system call parameters (sp in r1) gp = general-purpose

Previous sp_svc spsr_svc lr_svc r12 regs[12] r11 r10 r9 r8 r7 r6 r5 r4 r3 r2 r1 sp_svc r0 regs[0] (also *regs) C_SWI_Handler void C_SWI_handler(unsigned number, unsigned *regs) { switch (number){ case 0: /* SWI number 0 code */ break; case 1: /* SWI number 1 code */ break; ... case 0x100: puts(“SWI 0x100 trigged!\n”); break; ... case XXX: /* SWI number XXX code */ break; default: } /* end switch */ } /* end C_SWI_handler() */

Loading the Vector Table /* For 18-349, the Vector Table will use the ``LDR PC, PC, * offset'' springboard approach */ unsigned Install_Handler(unsigned int routine, unsigned int *vector) { unsigned int pcload_instr, old_handler, *soft_vector; pcload_instr = *vector; /* read the Vector Table instr (LDR ...) */ pcload_instr &= 0xfff; /* compute offset of jump table entry */ pcload_instr += 0x8 + (unsigned)vector; /* == offset adjusted by PC and prefetch */ soft_vector = (unsigned *)pcload_instr; /* address to load pc from */ old_handler = *soft_vector; /* remember the old handler */ *soft_vector = routine; /* set up new handler in jump table */ return (old_handler); /* return old handler address */ } /* end Install_Handler() */ Called as Install_Handler ((unsigned) S_Handler, swivec); where, unsigned *swivec = (unsigned *) 0x08;

Example: SWI Application extern void S_Handler(); extern void trigger(); int main() { unsigned *swivec = (unsigned *) 0x08; unsigned backup; backup = Install_Handler ((unsigned) S_Handler, swivec); trigger(); Install_Handler (backup, swivec); } .text .align 2 .global trigger trigger: STMFD sp!, {lr} SWI #0x100 LDMFD sp!, {pc}

Exercise #3 • Write a service routine that receives a file name from a trigger and display the first lines of the file on the screen. • Void service101(char *filename); • Write a trigger that pass a file name as an argument to the above service routine through SWI #0x101. • void trigger101(char *filename); • Write a main program to perform a demonstration.

Introduction to ELF • Executable and Linking Format • Developed by Unix System Lab. • Default binary format on Linux, Solaris 2.x, etc… • Some of the capabilities of ELF are dynamic linking, dynamic loading, imposing runtime control on a program, and an improved method for creating shared libraries. • The ELF representation of control data in an object file is platform independent.

Three Types of ELF Files • Relocatable file • describes how it should be linked with other object files to create an executable file or shared library. • Executable file • supplies information necessary for the operating system to create a process image suitable for executing the code and accessing the data contained within the file. • Shared object file • contains information needed in both static and dynamic linking.

ELF File Format • Two views for each of the three file types. • Linking view and execution view • These views support both the linking and execution of a program. • Linking view is partitioned by sections. • Execution view is partitioned by segments. • The ELF access library, libelf, provides tools to extract and manipulate ELF object files.

ELF File Format (cont.) • Linking View Execution View

Example: readelf • We can use “readelf” to output ELF information • Example • use “-e” option to read all header from the executable file of “hello.c” $ cat hello.c /* hello.c, a simple example program */ #define GREETING "Hello, World!\n" int main() { puts(GREETING); } $ arm-elf-gcc –o hello.elf hello.c $ arm-elf-readelf –e hello.elf

Example: ELF Header ELF Header: Magic: 7f 45 4c 46 01 01 01 61 00 00 00 00 00 00 00 00 Class: ELF32 Data: 2's complement, little endian Version: 1 (current) OS/ABI: ARM ABI Version: 0 Type: EXEC (Executable file) Machine: ARM Version: 0x1 Entry point address: 0x8100 Start of program headers: 52 (bytes into file) Start of section headers: 168152 (bytes into file) Flags: 0x202, has entry point, GNU EABI, software FP Size of this header: 52 (bytes) Size of program headers: 32 (bytes) Number of program headers: 1 Size of section headers: 40 (bytes) Number of section headers: 25 Section header string table index: 22

Example: Section Header Section Headers: [Nr] Name Type Addr Off Size ES Flg Lk Inf Al [ 0] NULL 00000000 000000 000000 00 0 0 0 [ 1] .init PROGBITS 00008000 008000 000020 00 AX 0 0 4 [ 2] .text PROGBITS 00008020 008020 0030e8 00 AX 0 0 4 [ 3] .fini PROGBITS 0000b108 00b108 00001c 00 AX 0 0 4 [ 4] .rodata PROGBITS 0000b124 00b124 000020 00 A 0 0 4 [ 5] .data PROGBITS 0000b244 00b244 00092c 00 WA 0 0 4 [ 6] .eh_frame PROGBITS 0000bb70 00bb70 000004 00 A 0 0 4 [ 7] .ctors PROGBITS 0000bb74 00bb74 000008 00 WA 0 0 4 [ 8] .dtors PROGBITS 0000bb7c 00bb7c 000008 00 WA 0 0 4 [ 9] .jcr PROGBITS 0000bb84 00bb84 000004 00 WA 0 0 4 [10] .bss NOBITS 0000bb88 00bb88 00010c 00 WA 0 0 4 [11] .comment PROGBITS 00000000 00bb88 000288 00 0 0 1 [12] .debug_aranges PROGBITS 00000000 00be10 000420 00 0 0 8 [13] .debug_pubnames PROGBITS 00000000 00c230 000726 00 0 0 1 [14] .debug_info PROGBITS 00000000 00c956 011f48 00 0 0 1 [15] .debug_abbrev PROGBITS 00000000 01e89e 0031f4 00 0 0 1 [16] .debug_line PROGBITS 00000000 021a92 002a14 00 0 0 1 [17] .debug_frame PROGBITS 00000000 0244a8 000a14 00 0 0 4 [18] .debug_str PROGBITS 00000000 024ebc 001406 01 MS 0 0 1 [19] .debug_loc PROGBITS 00000000 0262c2 002be0 00 0 0 1 [20] .stack PROGBITS 00080000 028ea2 000000 00 W 0 0 1 [21] .debug_ranges PROGBITS 00000000 028ea2 000150 00 0 0 1 [22] .shstrtab STRTAB 00000000 028ff2 0000e3 00 0 0 1 [23] .symtab SYMTAB 00000000 0294c0 001590 10 24 ef 4 [24] .strtab STRTAB 00000000 02aa50 0007f9 00 0 0 1 Key to Flags: W (write), A (alloc), X (execute), M (merge), S (strings) I (info), L (link order), G (group), x (unknown) O (extra OS processing required) o (OS specific), p (processor specific)

Example: Program Header Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align LOAD 0x008000 0x00008000 0x00008000 0x03b88 0x03c94 RWE 0x8000 Section to Segment mapping: Segment Sections... 00 .init .text .fini .rodata .data .eh_frame .ctors .dtors .jcr .bss

Data Representation • Support various processors with 8-bit bytes and 32-bit architectures. • Intended to be extensible to larger or smaller architecture.

ELF Header1 • It is always the first section of the file. • Describes the type of the object file . • Its target architecture, and the version of ELF it is using. • The location of the Program Header table, Section Header table, and String table along with associated number and size of entries for each table are also given. • Contains the location of the first executable instruction.

ELF Header2 #define EI_NIDENT 16 typedef struct { unsigned char e_ident[EI_NIDENT];// file ID, interpretation Elf32_Half e_type; // object file type Elf32_Half e_machine; // target architecture Elf32_Word e_version; // ELF version Elf32_Addr e_entry; // starting virtual address Elf32_Off e_phoff; // file offset to program header Elf32_Off e_shoff; // file offset to section header Elf32_Word e_flags; // processor-specific flags Elf32_Half e_ehsize; // the ELF header’s size Elf32_Half e_phentsize; // program header entry size Elf32_Half e_phnum; // program header entry number Elf32_Half e_shentsize; // section header entry size Elf32_Half e_shnum; // section header entry number Elf32_Half e_shtrndx; // section header index for string } Elf32_Ehdr;

Section Header • The section header table is an array of structures. • A section header table index is a subscript into this array. • Each entry correlates to a section in the file. • The entry provides the name, type, memory image starting address, file offset, the section’s size in bytes, alignment.

The Section Header Table typedef struct { Elf32_Word sh_name; // name of section, an index Elf32_Word sh_type; // type of section Elf32_Word sh_flags; // section-specific attributes Elf32_Addr sh_addr; // memory location of section Elf32_Off sh_offset; // file offset to section Elf32_Word sh_size; // size of section Elf32_Word sh_link; // section type, dependent Elf32_Word sh_info; // extra information, dependent Elf32_Word sh_addralign; // address alignment Elf32_Word sh_entsize; // size of an entry in section } Elf32_Shdr;

ELF Sections • A number of types of sections described by entries in the section header table. • Sections can hold executable code, data, dynamic linking information, debugging data, symbol tables, relocation information, comments, string tables, and notes.

Special Sections1 • Various sections in ELF are pre-defined. • A list of special sections • .bss un-initialized data • .comment version control information • .data and .data1 initialized data present • .debug… information for symbolic debugging • .dynamic dynamic linking information • .dynstr strings needed for dynamic linking • .hash symbol hash table • .line line number information for debugging

Special Sections2 • A list of special sections (cont.) • .note file notes • .relname and .relaname relocation data • .rodata and .rodata1 read-only data • .shstrtab section names • .strtab the strings that represent the names associated with symbol table entries • .symtab symbol table • .text executable instructions

String Table • The object file uses these strings to represent symbol and section names. • The first and last byte is defined to hold a null character. • An empty string table section is permitted. • Ex:

Symbol Table • Holds information needed to locate and relocate a program’s symbolic definitions and references. • A symbol table entry typedef struct { Elf32_Word st_name; // symbol name, an index Elf32_Addr st_value; // symbol value Elf32_Word st_size; // symbol size unsigned char st_info; // symbol’s type and binding attributes unsigned char st_other; // symbol visibility Elf32_Half st_shndx; // relevant section header table index } Elf32_Sym;

Program Header • Program headers are meaningful only for executable and shared object files. • The program header table is an array of structures, each describing a segment or other information. • An object file segment contains one or more sections. • A file specifies its own program header size with the ELF header’s e_phentsize & e_phnum.

The Program Header Table typedef struct { Elf32_Word p_type; // type of the segment Elf32_Off p_offset; // file offset to segment Elf32_Addr p_vaddr; // virtual address of first byte Elf32_Addr p_paddr; // segments’ physical address Elf32_Word p_filesz; // size of file image of segment Elf32_Word p_memsz; // size of memory image of segment Elf32_Word p_flags; // segment-specific flags Elf32_Word p_align; // alignment requirements } Elf32_Phdr;

Executable Programs • A program to be loaded by the system must have at least one loadable segment. • Segments are a way of grouping related sections. • A process image is created by loading and interpreting segments. • Segment contents • A segment comprises one or more sections. • Text segments contain read-only instructions and data. • Data segments contain writable data and instructions

Text segment example Data segment example ELF Segments

Exercise #4 • Write a service routine that receives the name of an ELF executable file as a parameter and display the offset of program header on the screen. • Void service102(char *filename); • Write a trigger that pass a file name to the above service routine through SWI #102. • void trigger102(char *filename); • Write a main program to perform a demonstration.

Overview of ARM Debug Monitor • The ARM Debug Monitor is called “Angel” (earlier versions called it the “Demon” – get it?) • Provides • lowlevel programming C library and debugging environment • When the X-board first boots, they load the demon from flash memory (emulator pretends that this happens) • This activity is called “bootstrapping”

嵌入式處理器架構與 程式設計