NET3001. Advanced Assembly

Transcription

1 NET3001 Advanced Assembly

2 Arrays and Indexing supposed we have an array of 16 bytes at 0x write a program that determines if the array contains the byte '0x12' set r0=1 if the byte is found plan: set r0=0... not found load r6 with 0 and count up to 16 load r7 with 0x at each point, get the byte at [0x r6] and compare it to 0x12 if it matches, set r0=0 and exit

3 Search for a Byte in C char recs[16]; // 0x8100 int i; // r6 int r0 = 0; for (i=0; i<16; i++) if (recs[i]==0x12) { r0 = 1; break; } // check for a match

4 Search for a Byte in asm.text.word 0x , _start.global main, _start.type _start,%function _start: main: mov r0, #0 ; set r0 = not found mov r6, #0 ; r6 is i, set to 0 ldr r7, =recs again: ldrb r1, [r7, r6] ; fetch cmp r1, #0x12 ; and test beq found_one add r6, #1 ; i++ cmp r6, #16 ; i<16 blo again ; repeat b done found_one: mov r0, #1 ; change r0 to found done: b done ; we're finished recs:.byte 1,2,3,1,2,3,0x10,0x12,4,3,2,1,5,6,7,8 NOTE: an alternate version uses ldrb r1, [r7], #1 // increment after

5 Search for a Byte Name Value Type Size Content _start 0x label;func 0 main 0x label 0 again 0x label 0 found_one 0x label 0 done 0x label recs 0x byte[] 16 1,2,3...

6 Search for a Byte.2 change the previous problem so that the address of the array is passed in R0, the search pattern is passed in R1 this is to prepare for turning it into a subroutine

7 Search for a Byte.text.word 0x , main.global main main: mov r3, #0 ; set r3 = not found mov r6, #0 ; r6 is i, set to 0 again: ldrb r2, [r0, r6] ; fetch cmp r2, r1 ; test beq found_one add r6, r6, #1 ; i++ cmp r6, #16 ; i<16 jlo again ; repeat jmp done found_one: mov r3, #1 ; set r3 = found done: jmp done.org 0x100 recs.byte 1,2,3,1,2,3,0x10,0x12,4,3,2,1,5,6,7,8

8 Testing and Branching in C code, we often need this if (r0<10) r0++; else r0 = 0; the assembly language equivalent would be cmp r0,#10 // sets the N,C,V,Z bits bge s1 // branch for 10 or more add r0,r0,#1 // do the <10 stuff b s2 // and jump over the else s1: mov r0,#0 // do the else s2: // and carry on on this slide, we treat r0 as signed

9 Branching in ARM, you have the following branches available to you: b branch (always) bcc/blo bcs/bhs bhi bls for unsigned numbers bgt bge blt ble bvs bvc beq bne bmi bpl bcs is the same as bhs bcc is the same as blo...use either for signed numbers almost never used; uses V bit equality; beq is the same as bz minus and plus; uses the N bit cbz cbnz you can check a reg and branch e.g. cbnz r0,loop_again* bl bx lr *limited use: reg must be r0...r7; can only jump fwd branch and link; call subroutine return from subroutine

10 Testing and Branching in C code, we often need this for (r0=0; r0<10; r0++) { show7seg(r0); delayonesec(); } the assembly language equivalent would be mov r0,#0 // start the for loop loopit: push {r0} // save it, the sub's may modify it bl show7seg // 2 subroutines bl delayonesec pop {r0} // get r0 back add r0,r0,#1 // r0++ cmp r0,#10 // sets the N,C,V,Z bits blo s1 // branch back for less than10 // and carry on on this page, we treat r0 as unsigned

11 Stack an area of RAM is put aside to hold an array of words with the call and ret instruction, we can implement subroutines stack data 0x2000.1FFC 0x2000.1FF8 0x2000.1FF4 0x2000.1FF0... bottom of stack available available sp = r13 0x2000.1FF8 points to the bottom of the stack [r13] points at valid data, aka bottom of stack [r13,#-2] points to next empty location

12 Stack to put data on the stack: push a register push {r?} which does the following sub r13, #4 easiest then store register into [r13] same as STR r?, [r13,#-4]! // subtract before to recover it pop into a register pop {r?} which does this LDR r?, [r13] add r13,#4 same as LDR r?, [r13], #4 // add after if you want to discard stack data add r13, #n ; n should be a multiple of 4

13 Multiple Registers on Stack ARM and Cortex-M3 allow us to save and restore multiple registers examples push {r0, r1, r2, r14} pop {r0, r1, r2, r14} r14 is pushed first, then r0 is pushed last during the pop, the opposite order is used: r0 is popped first, finally popping r14 note that you don't need to use the same register names on the pop pop {r0, r1, r2, pc} what does this do?

14 Subroutines the call instruction is used to invoke a subroutine call somewhere effectively mov r14, r15 mov r15, somewhere the next instruction comes from the new location the return address is in r14 (Link Reg) r15 is constantly being incremented; the r15 that is copied into r14 is already pointing ahead to the next instruction the ret instruction is just mov r15,r14

15 Subroutines using bl/lr/pc the call instruction is used to invoke a subroutine bl somewhere // branch and link effectively mov lr, pc mov pc, somewhere the next instruction comes from the new location the return address is on the stack the ret instruction is just MOV pc,lr or BX LR

16 Subroutines registers ram registers ram r15 r14 r ?? F4 0x FC 0x F8 0x F4 0x F0 0x EC 0x E9... in use in use in use free free free... r15 r14 r F4 0x FC 0x F8 0x F4 0x F0 0x EC 0x E9... in use in use in use free free free... 0x x call (bl) add r5,#1 0x x call (bl) add r5,#1

17 Subroutines registers ram registers ram r15 r14 r F4 0x FC 0x F8 0x F4 0x F0 0x EC 0x E9... in use in use in use free free free... r15 r14 r F0 0x FC 0x F8 0x F4 0x F0 0x EC 0x E9... in use in use in use free free... 0x push {lr} 0x push {lr} 0x mov r0,#3 0x mov r0,#3

18 Stack Usage in our projects, start the stack at 0x stack is used to hold registers that must be preserved over subroutine call subroutine return address usually temporary variables used in the subroutine

19 Stack Usage the caller preps the arguments in r0..r3 the caller calls the subroutine the subroutine makes space for the temp (local) variables on the stack in C // caller a=12; b='x'; c = dosomething(a,b); // subroutine int dosomething(int a, int b) { int d,e; d = a+b; e = a+d; return e; }

20 Stack Usage in asm // caller mov r0, #12 // put the number 12 on stack mov r1, #'X' // put the 'X' on the stack call #dosomething // puts the return addr on stk // in the subroutine sub sp, #8 // make room on the stack // a is in r0, b is in r1 add r2,r1,r0 // d = a+b str r2,[sp,#0] add r2,r2,r0 // e = d+a str r2,[sp,#4] ldr r0,[sp,#4] // prepare to return bx lr // same as mov pc, lr

21 Arguments, Locals & Return arguments are passed to routines by pushing values onto the stack above the frame pointer (the return address) by setting them into registers local variables can be created on the stack below the frame pointer can use registers return value passed back in a register ARM eabi arguments, locals and the return value must not be in global variables!!!

22 Subroutines (using registers) the C compiler uses registers in this manner information is passed into the subroutine in r0, r1, r2 and r3 if it needs more than 4 words, it puts the extra on the stack the return value is in r0 if it needs more than a word, it uses r0 and r1 r0, r1, r2, r3, r12 may be destroyed r4...r11 are preserved a statement like this is called the Application Binary Interface, ABI

23 Nested Subroutines in C int mult(int a, int b) { int c = 0; while (b--) c+=a; return c; } int pythag(int x, int y) { int z = mult(y,y) + mult(x,x); return z; } // caller int g=4, h=7; h = pythag(g,h);

24 Nested Subroutines in ASM /* int mult (int a, int b) multiply 2 small +ve numbers arguments passed in r0 & r1 c is r2 (destroyed) mult: mov r2, #0 mult_again: cmp r1, #0 return value in r0 */ // a is in r0, b is in r1 // while (b) beq mult_done sub r1,r1,#1 // b-- add r2, r2, r0 // c += a b mult_again mult_done: mov r0, r2 bx lr // return

25 Nested Subroutines in ASM (another version) /* int mult (int a, int b) multiply 2 small +ve numbers arguments passed in r0, r1 r4 is used as 'c' (r4 preserved) return value in r0 */ mult: // a is in r0, b is in r1 push {r4} // save r4 mov r4, #0 mult_again: cmp r1, #0 // while (b) jeq mult_done sub r1, r1, #1 // b-- add r4, r4, r0 // c += a b mult_again mult_done: mov r0, r4 pop {r4} bx lr // return

26 Nested Subroutines in ASM /* int pythag(int x, int y) return the sum of squares arguments passed in r0, r1 return value in r0 local z is on the stack; r2 is destroyed */ pythag: push {r0, r1, lr} // save x, y and return address sub sp,sp,#4 // make room for z // prepare to call subroutine "mult" mov r1, r0 // make both the same as x bl mult // mult(x,x) answer comes back in r0 str r0,[sp] // answer goes into z on stack ldr r0,[sp,#8] // get a copy of y // prepare to call "mult" again mov r1, r0 // both are copies of y bl mult // mult(y,y) answer comes back in r0 ldr r1,[sp] // get z back from the stack add r0, r0, r1 // sum is in r0 add sp,sp,#12 // throw away z and y and x pop {pc} // use the return address and go back

27 in ASM // main code.data g:.word 4 h:.word 7 result:.word 0 Nested Subroutines.text ldr r2, =g ldr r0, [r2] ldr r2, =h ldr r1, [r2] bl pythag // return value is in r0 ldr r2, =result str r0, [r2]

28 Frame Pointer inside a subroutine, it's a common technique to use a register (r7) to hold a stationary pointer to the stack as you push and pop data, r13/sp is constantly changing it's easier to use r7 as a basis to fetch variables naturally, if all subroutines use r7, it's important to save-and-restore r7 ; at entry push {r7, lr} ; at exit pop {r7, pc} // does an implicit return on a Pentium, we use ebp (extended base pointer)

29 Frame Pointer common usage suppose we have a subroutine like this int fancyprint(char* fmt, int ndigits, char decimal) { int a, b, c, d, e;...then the code... on the way into the subroutine push {r7, lr} // save both sub sp, #32 // make room for 8 words add r7,sp,#20 // then r7 is pointing midway up // there are 3 words above r7 and 5 words below the 3 above the line will be fmt, ndigits, and decimal the 5 below the line will be a,b,c,d,e

30 Frame Pointer at the end, we can use r7 to restore the sp ; at exit add sp, r7, #12 pop {r7, pc} // returns frame pointer is only commonly used when you're debugging final code for shipment often doesn't use frame pointer

31 Stack Usage with Frame Pointer ram ram ram FC F F F EC sp= FC old stack FC F F F EC sp= E8 old stack lr (ret addr) r7 4 = x = copy g 7 = y = copy h z (unknown) FC F F F EC sp= D4 old stack lr (ret addr) r7 4 7 z ret addr r7 4 = a = copy x 4 = b = copy x c (unknown) = h 4 = g = h 4 = g = h 4 =g

32 Stack Usage with Frame Pointer ram ram ram FC F F F EC sp= D4 old stack lr (ret addr) r =z ret addr r7 7 = a = copy y 7 = b = copy y c (unknown) FC F F F EC sp= E8 old stack lr (ret addr) r7 4 = x = copy g 7 = y = copy h 65 = z FC F F F EC sp= FC old stack = h 4 = g = h 4 = g = result 7 = h 4 = g

33 Nested Subroutines (using FP) in ASM /* int mult (int a, int b) multiply 2 small +ve numbers arguments passed r0=a, r0=b return value in r0 */ mult: // a is r0, b is r1 push {r7, lr} sub sp,#12 // room for a,b,c add r7,sp,#4 // pointing at b str r0,[sp,#8] // save a (could use [r7,#4]) str r1,[sp,#4] // save b (could use [r7]) mov r2, #0 // initialize c mult_again: cmp r1, #0 // while (b) beq mult_done sub r1, #1 // b-- add r2, r2, r0 // c += a b mult_again mult_done: mov r0, r2 // the answer add sp,r7,#8 // move stack to where it started pop {r7,pc} // return

34 Nested Subroutines (using FP) in ASM /* int pythag(int x, int y) using frame pointer return the sum of squares arguments passed in on r0=x, r1=y return value in r0 */ pythag: push {r0, r1, r7, lr} // save x, y, fp and return address sub sp, #4 // make room for z add r7, sp, #4 // r7 points at y = [sp,#4] // z is at [r7,#-4] mov r1, r0 // do x first bl mult // x is already in r0, where we want it str r0, [r7,#-4] // save the result into z ldr r0, [r7] // fetch y from ram mov r1, r0 bl mult ldr r1, [r7,#-4] // recall z from ram add r0, r0, r1 // and add them...ready to return add sp, r7, #8 // put the stack back; throw away x,y pop {r7, pc} // and return

35 Nested Subroutines (using FP) in ASM...no change // main code.data g:.word 4 h:.word 7 result:.word 0.text ldr r2, =g ldr r0, [r2] ldr r2, =h ldr r1, [r2] bl pythag // return value is in r0 ldr r2, =result str r0, [r2]

36 there is less requirement for the above now that we have a proper EABI Subroutines in ASM are only complete if they include these comments: use a C prototype required! describe the arguments passed in and how they are passed the how is now optional describe the return value and how it is passed back the how is now optional list registers are affected optional

37 Stack Operations the operations on the stack can be described in terms of the basic machine instructions turns into push {r6, r8} sub sp, sp, #8 str r8, [sp, #4] str r6, [sp] // same as stmdb sp!,{r6,r8} // move the stack pointer down // save the data on the stack turns into pop {r9} ldr r9, [sp] // same as ldmia sp!,{r9} // get the data from the stack add sp, sp, #4 // move the stack pointer up or, more simply ldr r9, [sp], #4 // use indirect post increment

38 Stack Operations (cont'd) turns into bl dosomething // calling subroutine mov lr, pc // r14 <- r15 save the return address add pc, pc, #distance_to_dosomething // jump by stuffing r15 bx lr turns into mov pc, lr // return from subroutine //restore the return address

39 Stack Operations (cont'd) when an interrupt happens, the cpu does this: push {r0,r1,r2,r3,r12,lr,pc,psr} movw lr,#0xfffffff9 ldr pc,[vector_table_entry] at the end of interrupt bx lr // return from interrupt turns into // putting FFFF.FFF9 into PC is invalid, // so the CPU knows it's returning from // interrupt pop {r0,r1,r2,r3,r12,lr,pc,psr} // so we return to interrupted program

40 What is the EABI extended applications binary interface registers r4...r11 are preserved by subroutines arguments are passed to subroutines in r0,r1,r2,r3 return value from a subroutine is sent back in r0 r0/1/2/3 & r12 can be modified at any time stack on the way into subroutines is 8 byte aligned (ends in 3 0's) If you have nested subroutines, you will need to manage your r0,r1 data carefully!

41 Binary Operations: AND to extract only certain bits from a field AND the data with a bit mask with 1's where you want to keep the data for example, to extract bits 1 & 2, you can AND with the pattern #0x06 ( ) AND r0, r0, #0x06 in C, result = data & 0x06; to force certain bits to go low AND the data with the bit mask with 0's where you want to force a 0 for example, to force 0's into bits 5 & 6, you can AND with the pattern 0x9F ( ) in C, result = data & 0x9F; or result = data & ~0x60;

42 Binary Operations: OR, XOR to force certain bits high OR the data with a bit mask containing 1's where you want to force the bits up for example, to force bits 4 & 5 to be set high, you can OR the data with #0x30 ( ) in C, result = data 0x30; to force certain bits to change XOR the data with a bit mask containing 1's where you want the data to change for example, to force bit 0 to change, XOR the data with #0x01 ( ) in C, result = data ^ 1;

43 and r7, r7, #0xFFFFFFF8 bic r7, r7, #0x07 // does the same Binary Operations: Cortex special ops on the Cortex CPU the ORR operation just performs the OR the ORRS operation also sets the status bits: N,Z,C the OR operation is also known as bit-set BIS on some CPUs the AND operation just performs the AND the ANDS operation also sets the status bits: N,Z,C the TST operation only sets the status bits: N,Z,C does the same as AND, but doesn't save the result there is also the BIC to force certain bits low the setting argument includes the bits that you want to set low this is the opposite of the pattern you would use with an AND instruction there is also the BICS operation which sets the status bits

44 Binary Operations: Summary isolating bits force bits low force bits high change bits AND TST AND BIC ORR EOR save result does not modify status discard result modify status save result does not modify status save result do not modify status uses inverted pattern save result do not modify status save result does not modify status