Microprocessor-Based Systems

This week…
Finish ARM assembly example from last time
Walk though of the ARM ISA
Software Development Tool Flow
Application Binary Interface (ABI)

Assembly example
data:
.byte 0x12, 20, 0x20, -1
func:
mov r0, #0
mov r4, #0
movw r1, #:lower16:data
movt r1, #:upper16:data
top: ldrb r2, [r1],#1
add r4, r4, r2
add r0, r0, #1
cmp r0, #4
bne top

Instructions used
mov
Moves data from register or immediate.
Or also from shifted register or immediate!
the mov assembly instruction maps to a bunch of different encodings!
If immediate it might be a 16-bit or 32-bit instruction
Not all values possible
why? (not greater than 232-1)
movw
Actually an alias to mov
“w” is “wide”
hints at 16-bit immediate

From the ARMv7-M Architecture Reference Manual
There are similar entries for
move immediate, move shifted
(which actually maps to different
instructions) etc.

ARM and Thumb Encodings:
Encoding T ? Thumb encoding.
Different processors have different encodings for a single instruction leading to several encodings, A1, A2, T1, T2, ....
The Thumb instruction set:
Each Thumb instruction is either a single 16-bit halfword, or a 32-bit instruction consisting of two consecutive halfwords, and have a corresponding 32-bit ARM instruction that has the same effect on the processor model.
Thumb instructions operate with the standard ARM register configuration, allowing excellent interoperability between ARM and Thumb states.
On execution, 16-bit Thumb instructions are decompressed to full 32-bit ARM instructions in real time, without performance loss.
Thumb code is typically 65% of the size of ARM code, and provides 160% of the performance of ARM code when running from a 16-bit memory system. Thumb, therefore, makes the corresponding core ideally suited to embedded applications with restricted memory bandwidth, where code density and footprint is important.
The different encoding of the same instructions of which one is ARM and another is Thumb would come from the encoding policy.

Directives
#:lower16:data
What does that do?
Why?
Note:
“data” is a label for a memory address!

Loads!
ldrb -- Load register byte
Note this takes an 8-bit value and moves it into a 32-bit location!
Zeros out the top 24 bits
ldrsb -- Load register signed byte
Note this also takes an 8-bit value and moves it into a 32-bit location!
Uses sign extension for the top 24 bits

Addressing Modes
Offset Addressing
Offset is added or subtracted from base register
Result used as effective address for memory access
[
,
]
Pre-indexed Addressing
Offset is applied to base register
Result used as effective address for memory access
Result written back into base register
[
,
]!
Post-indexed Addressing
The address from the base register is used as the EA
The offset is applied to the base and then written back
[
],

So what does the program _do_?
data:
.byte 0x12, 20, 0x20, -1
func:
mov r0, #0
mov r4, #0
movw r1, #:lower16:data
movt r1, #:upper16:data
top: ldrb r2, [r1],#1
add r4, r4, r2
add r0, r0, #1
cmp r0, #4
bne top
CMP Rn, Operand2 :
Compare the value in a register with Operand2 and update the condition flags on the result, but do not place the result in any register.
Condition flags ? These instructions update the N, Z, C and V flags according to the result.
The CMP instruction subtracts the value of Operand2 from the value in Rn. This is the same as a SUBS instruction, except that the result is discarded.
BNE (branch if not equal) ? cmp comes before branch operations
bne top ? jump to label “top” if r0 not equal to 4

This Week…
Finish ARM assembly example from last time
Walk though of the ARM ISA
Software Development Tool Flow
Application Binary Interface (ABI)

An ISA defines the hardware/software interface
A “contract” between architects and programmers
Register set
Instruction set
Addressing modes
Word size
Data formats
Operating modes
Condition codes

Major elements of an Instruction Set Architecture
(word size, registers, memory, endianess, conditions, instructions, addressing modes)
32-bits
32-bits
Endianess
mov r0, #4
ldr r1, [r0,#8]
r1=mem((r0)+8)
bne loop
subs r2, #1
Endianess

ARM Cortex-M3 ISA
Register Set
Address Space
Branching
Data processing
Load/Store
Exceptions
Miscellaneous
Instruction Set
32-bits
32-bits
Endianess
Endianess

Major elements of an Instruction Set Architecture
(word size, registers, memory, endianess, conditions, instructions, addressing modes)
32-bits
32-bits
Endianess
mov r0, #4
ldr r1, [r0,#8]
r1=mem((r0)+8)
bne loop
subs r2, #1
Endianess

Word Size
Perhaps most defining feature of an architecture
IA-32 (Intel Architecture, 32-bit)
Word size is what we’re referring to when we say
8-bit, 16-bit, 32-bit, or 64-bit machine, microcontroller, microprocessor, or computer
Determines the size of the addressable memory
A 32-bit machine can address 2^32 bytes
2^32 bytes = 4,294,967,296 bytes = 4GB
Note: just because you can address it doesn’t mean that there’s actually something there!
In embedded systems, tension between 8/16/32 bits
Code density/size/expressiveness
CPU performance/addressable memory

Word Size ? 32-bit ARM Architecture
ARM’s Thumb-2 adds 32-bit instructions to 16-bit ISA
Balance between 16-bit density and 32-bit performance
Course Focus

A quick comment on the ISA:
From: ARMv7-M Architecture Reference Manual

Major elements of an Instruction Set Architecture
(word size, registers, memory, endianess, conditions, instructions, addressing modes)
32-bits
32-bits
Endianess
mov r0, #4
ldr r1, [r0,#8]
r1=mem((r0)+8)
bne loop
subs r2, #1
Endianess

ARM Cortex-M3 Registers
R0-R12
General-purpose registers
Some 16-bit (Thumb) instruction only access R0-R7
R13 (SP, PSP, MSP)
Stack pointer(s)
More details on next slide
R14 (LR)
Link Register
When a subroutine is called, return address kept in LR
R15 (PC)
Holds the currently executing program address
Can be written to control program flow

Mode dependent
ARM Cortex-M3 Registers
Main SP (MSP) used by:
OS kernel
Exception handlers
App code w/ privileded access
Process SP (PSP) used by:
Base app code (when not running an exception handler)
Note: there are two stack pointers!
The Stack is a memory region within the program/process. This part of the memory gets allocated when a process is created. We use Stack for storing temporary data (local variables/environment variables)
When the processor pushes a new item onto the stack, it decrements the stack pointer and then writes the item to the new memory location.
The processor implements two stacks, the main stack and the process stack, with a pointer for each held in independent registers
When an application is started on an operating system and a process is created, MSP mostly used by OS kernel itself but PSP is mostly by application itself.

ARM Cortex-M3 Registers
xPSR
Program Status Register
Provides arithmetic and logic processing flags
We’ll return to these later
PRIMASK, FAULTMASK, BASEPRI
Interrupt mask registers
PRIMASK: disable all interrupts except NMI and hard fault
FAULTMASK: disable all interrupts except NMI
BASEPRI: Disable all interrupts of specific priority level or lower
We’ll return to these during the interrupt lectures
CONTROL (control register)
Define priviledged status and stack pointer selection (PSP, MSP)
The CONTROL register is one of the special registers implemented in the Cortex-M processors. This can be accessed using MSR and MRS instructions.

Major elements of an Instruction Set Architecture
(word size, registers, memory, endianess, conditions, instructions, addressing modes)
32-bits
32-bits
Endianess
mov r0, #4
ldr r1, [r0,#8]
r1=mem((r0)+8)
bne loop
subs r2, #1
Endianess

ARM Cortex-M3 Address Space / Memory Map
Unlike most previous ARM cores, the overall layout of the memory map of a device based around the Cortex-M3 is fixed. This allows easy porting of software between different systems based on the Cortex-M3. The address space is split into a number of different sections.

Major elements of an Instruction Set Architecture
(word size, registers, memory, endianess, conditions, instructions, addressing modes)
32-bits
32-bits
Endianess
mov r0, #4
ldr r1, [r0,#8]
r1=mem((r0)+8)
bne loop
subs r2, #1
Endianess

The endianess religious war: 289 years and counting!
Modern version
Danny Cohen
IEEE Computer, v14, #10
Published in 1981
Satire on CS religious war
Historical Inspiration
Jonathan Swift
Gulliver's Travels
Published in 1726
Satire on Henry-VIII’s split with the Church
Now a major motion picture!
Memory Value
Offset (LSB) (MSB)
====== ===========
uint8_t a = 1; 0x0000 01 02 FF 00
uint8_t b = 2;
uint16_t c = 255; // 0x00FF
uint32_t d = 0x12345678; 0x0004 78 56 34 12
Little-Endian
LSB is at lower address
Big-Endian
MSB is at lower address
Memory Value
Offset (LSB) (MSB)
====== ===========
uint8_t a = 1; 0x0000 01 02 00 FF
uint8_t b = 2;
uint16_t c = 255; // 0x00FF
uint32_t d = 0x12345678; 0x0004 12 34 56 78

Endian-ness
Endian-ness includes 2 types ?
Little endian : Little endian processors order bytes in memory with the least significant byte of a multi-byte value in the lowest-numbered memory location.
Big endian : Big endian architectures instead order them with the most significant byte at the lowest-numbered address.
The x86 architecture as well as several 8-bit architectures are little endian.
Most RISC architectures (SPARC, Power, PowerPC, MIPS) were originally big endian (ARM was little endian), but many (including ARM) are now configurable.
Endianness only applies to processors that allow individual addressing of units of data (such as bytes) that are smaller than the basic addressable machine word.
RISC ? Reduced Instruction Set Computer (exp. ARM)
CISC ? Complex Instruction Set Computer (x86 processors in most PCs)
Processors that have a RISC architecture typically require fewer transistors than those with a CISC architecture which improves cost, power consumption, and heat dissipation.

Addressing: Big Endian vs Little Endian
Endian-ness: ordering of bytes within a word
Little - increasing numeric significance with increasing memory addresses
Big – The opposite, most significant byte first
MIPS is big endian, x86 is little endian

ARM Cortex-M3 Memory Formats (Endian)
Default memory format for ARM CPUs: LITTLE ENDIAN
Processor contains a configuration pin BIGEND
Enables hardware system developer to select format:
Little Endian
Big Endian (BE-8)
Pin is sampled on reset
Cannot change endianness when out of reset
Source: [ARM TRM] ARM DDI 0337E, “Cortex-M3 Technical Reference Manual,” Revision r1p1, pg 67 (2-11).

Major elements of an Instruction Set Architecture
(word size, registers, memory, endianess, conditions, instructions, addressing modes)
32-bits
32-bits
Endianess
mov r0, #4
ldr r1, [r0,#8]
r1=mem((r0)+8)
bne loop
subs r2, #1
Endianess

Instruction encoding
Instructions are encoded in machine language opcodes
Sometimes
Necessary to hand generate opcodes
Necessary to verify if assembled code is correct
How? Refer to the “ARM ARM”
Instructions
movs r0, #10
movs r1, #0
Register Value Memory Value
001|00|000|00000010 (LSB) (MSB)
(msb) (lsb) 0a 20 00 21
001|00|001|00000000

Instruction Encoding
ADD immediate

Major elements of an Instruction Set Architecture
(word size, registers, memory, endianess, conditions, instructions, addressing modes)
32-bits
32-bits
Endianess
mov r0, #4
ldr r1, [r0,#8]
r1=mem((r0)+8)
bne loop
subs r2, #1
Endianess

Addressing Modes
Offset Addressing
Offset is added or subtracted from base register
Result used as effective address for memory access
[
,
]
Pre-indexed Addressing
Offset is applied to base register
Result used as effective address for memory access
Result written back into base register
[
,
]!
Post-indexed Addressing
The address from the base register is used as the EA
The offset is applied to the base and then written back
[
],

options
An immediate constant
#10
An index register
A shifted index register
, LSL #
Lots of weird options…

Major elements of an Instruction Set Architecture
(word size, registers, memory, endianess, conditions, instructions, addressing modes)
32-bits
32-bits
Endianess
mov r0, #4
ldr r1, [r0,#8]
r1=mem((r0)+8)
bne loop
subs r2, #1
Endianess

Branch
Range ? offset range
BL ? Branch with link (copy the address of the next instruction into lr)
BLX ? Branch with link, and exchange instruction set (X for exchange to Thumb/ARM)
TBB [R0, R1] ; R1 is the index, R0 is the base address of the branch table ? branch to the R1th element of the table starting at R0 address

Branch examples
b target
Branch without link (i.e. no possibility of return) to target
The PC is not saved!
bl func
Branch with link (call) to function func
Store the return address in the link register (lr)
bx lr (Branch and exchange)
Use to return from a function
Moves the lr value into the pc
Could be a different register than lr as well
blx reg (Branch with Link and exchange)
Branch to address specified by reg
Save return address in lr
When using blx, makre sure lsb of reg is 1 (otherwise, the CPU will fault b/c it’s an attempt to go into the ARM state)

Branch examples (2)
blx label
Branch with link and exchange state. With immediate data, blx changes to ARM state. But since CM-3 does not support ARM state, this instruction causes a fault!
mov r15, r0
Branch to the address contained in r0
ldr r15, [r0]
Branch to the to address in memory specified by r0
Calling bl overwrites contents of lr!
So, save lr if your function needs to call a function!

Major elements of an Instruction Set Architecture
(word size, registers, memory, endianess, conditions, instructions, addressing modes)
32-bits
32-bits
Endianess
mov r0, #4
ldr r1, [r0,#8]
r1=mem((r0)+8)
bne loop
subs r2, #1
Endianess

Data processing instructions
ADR PC, imm ? The assembler generates an instruction that adds or subtracts a value to the PC.
CMP{cond} Rn, Operand2 (Rn-Operand2)
CMN{cond} Rn, Operand2 (Rn+Operand2)
The CMP instruction subtracts the value of Operand2 from the value in Rn. This is the same as a SUBS instruction, except that the result is discarded.
The CMN instruction adds the value of Operand2 to the value in Rn. This is the same as an ADDS instruction, except that the result is discarded.
Many, Many More!

Major elements of an Instruction Set Architecture
(word size, registers, memory, endianess, conditions, instructions, addressing modes)
32-bits
32-bits
Endianess
mov r0, #4
ldr r1, [r0,#8]
r1=mem((r0)+8)
bne loop
subs r2, #1
Endianess

Load/Store instructions
Exclusive access is for when a memory is shared between some processors. When making access as exclusive, it means only letting 1 processor to access that.
An application running unprivileged:
• means only OS can allocate system resources to the application, as either private or shared resources
• provides a degree of protection from other processes and tasks, and so helps protect the operating system from malfunctioning applications.

Miscellaneous instructions
For example:
CLREX ? clear the local record of the executing processor that an address has had a request for an exclusive access.
DMB ? Data Memory Barrier acts as a memory barrier. It ensures that all explicit memory accesses that appear in program order before the DMB instruction are observed before any explicit memory accesses that appear in program order after the DMB instruction. It does not affect the ordering of any other instructions executing on the processor.
.
.

ARMv7-M Architecture Reference Manual
ARMv7-M_ARM.pdf

Major elements of an Instruction Set Architecture
(word size, registers, memory, endianess, conditions, instructions, addressing modes)
32-bits
32-bits
Endianess
mov r0, #4
ldr r1, [r0,#8]
r1=mem((r0)+8)
bne loop
subs r2, #1
Endianess

Application Program Status Register (APSR)

Updating the APSR
SUB Rx, Ry
Rx = Rx - Ry
APSR unchanged
SUBS
Rx = Rx - Ry
APSR N, Z, C, V updated
ADD Rx, Ry
Rx = Rx + Ry
APSR unchanged
ADDS
Rx = Rx + Ry
APSR N, Z, C, V updated

Overflow and carry in APSR
unsigned_sum = UInt(x) + UInt(y) + UInt(carry_in);
signed_sum = SInt(x) + SInt(y) + UInt(carry_in);
result = unsigned_sum
; // == signed_sum
carry_out = if UInt(result) == unsigned_sum then ’0’ else ’1’;
overflow = if SInt(result) == signed_sum then ’0’ else ’1’;

Conditional execution:
- EQ, NE, … are suffixes that add to other instructions (B+NE=BNE, ADDS+CS=ADDCS, …) and check their corresponding condition flags which make the original instruction conditional.
- Most ARM /Thumb instructions can be executed conditionally, based on the values of the APSR condition flags.
- The type of instruction that last updated the flags in the APSR determines the meaning of condition codes.

IT blocks
Conditional execution in C-M3 done in “IT” block
IT [T|E]*3
More on this later…

Conditional Execution on the ARM
ARM instruction can include conditional suffixes, e.g.
EQ, NE, GE, LT, GT, LE, …
Normally, such suffixes are used for branching (BNE)
However, other instructions can be conditionally executed
They must be inside of an IF-THEN block
When placed inside an IF-THEN block
Conditional execution (EQ, NE, GE,… suffix) and
Status register update (S suffix) can be used together
Conditional instructions use a special “IF-THEN” or “IT” block
IT (IF-THEN) blocks
Support conditional execution (e.g. ADDNE)
Without a branch penalty (e.g. BNE)
For no more than a few instructions (i.e. 1-4)

Conditional Execution using IT Instructions
In an IT block
Typically an instruction that updates the status register is exec’ed
Then, the first line of an IT instruction follows (of the form ITxyz)
Where each x, y, and z is replaced with “T”, “E”, or nothing (“”)
T’s must be first, then E’s (between 1 and 4 T’s and E’s in total)
Ex: IT, ITT, ITE, ITTT, ITTE, ITEE, ITTTT, ITTTE, ITTEE, ITEEE
Followed by 1-4 conditional instructions
where # of conditional instruction equals total # of T’s & E’s
IT
; IT instruction (
,
,
;
can be “T”, “E” or “”)
instr1
; 1st instruction (
; must be same as IT)
instr2
; 2nd instruction (can be
;
or
instr3
; 3rd instruction (can be
;
or
instr4
; 4th instruction (can be
;
or
Source: Joseph Yiu, “The Definitive Guide to the ARM Cortex-M3”, 2nd Ed., Newnes/Elsevier, © 2010.

Example of Conditional Execution using IT Instructions
IT
; IT instruction (
,
,
;
can be “T”, “E” or “”)
instr1
; 1st instruction (
; must be same as IT)
instr2
; 2nd instruction (can be
;
or
instr3
; 3rd instruction (can be
;
or
instr4
; 4th instruction (can be
;
or
CMP r1, r2 ; if r1 < r2 (less than, or LT)
ITTEE LT ; then execute 1st & 2nd instruction
; (indicated by 2 T’s)
; else execute 3rd and 4th instruction
; (indicated by 2 E’s)
SUBLT r2, r1 ; 1st instruction
LSRLT r2, #1 ; 2nd instruction
SUBGE r1, r2 ; 3rd instruction (GE opposite of LT)
LSRGE r1, #1 ; 4th instruction (GE opposite of LT)
Source: Joseph Yiu, “The Definitive Guide to the ARM Cortex-M3”, 2nd Ed., Newnes/Elsevier, © 2010.

The ARM architecture “books” for this class

...
start:
movs r0, #1
movs r1, #1
movs r2, #1
sub r0, r1
bne done
movs r2, #2
done:
b done
...
Exercise:
What is the value of r2 at done?

...
start:
movs r0, #1 // r0 ? 1, Z=0
movs r1, #1 // r1 ? 1, Z=0
movs r2, #1 // r2 ? 1, Z=0
sub r0, r1 // r0 ? r0-r1
// but Z flag untouched
// since sub vs subs
bne done // NE true when Z==0
// So, take the branch
movs r2, #2 // not executed
done:
b done // r2 is still 1
...
Solution:
What is the value of r2 at done?

Today…
Finish ARM assembly example from last time
Walk though of the ARM ISA
Software Development Tool Flow
Application Binary Interface (ABI)

The ARM software tools “books” for this class

How does an assembly language program
get turned into an executable program image?
Assembly
files (.s)
Object
files (.o)
as
(assembler)
ld
(linker)
Memory
layout
Linker
script (.ld)
Executable
image file
Binary program
file (.bin)
Disassembled
code (.lst)
objcopy
objdump

What are the real GNU executable names for the ARM?
Just add the prefix “arm-none-eabi-” prefix
Assembler (as)
arm-none-eabi-as
Linker (ld)
arm-none-eabi-ld
Object copy (objcopy)
arm-none-eabi-objcopy
Object dump (objdump)
arm-none-eabi-objdump
C Compiler (gcc)
arm-none-eabi-gcc
C++ Compiler (g++)
arm-none-eabi-g++
Tools Tutorial: The GNU Linker
http://web.eecs.umich.edu/~prabal/teaching/resources/eecs373/Linker.pdf

Real-world example
To the terminal! Example code online:
https://github.com/brghena/eecs373_toolchain_examples)
First, get the code. Open a shell and type:
$ git clone https://github.com/brghena/eecs373_toolchain_examples
Next, find the example and look at the Makefile and .s
$ cd eecs373_toolchain_examples/example
$ cat Makefile
$ cat example.s
Assemble the code* and look at the .lst, .o, .out files
$ make
$ cat example.lst
$ hexdump example.o
$ hexdump example.out
* You’ll need to have the tools installed. Two useful links:
https://launchpad.net/gcc-arm-embedded/+download
http://web.eecs.umich.edu/~prabal/teaching/resources/eecs373/Linker.pdf

$ arm-none-eabi-as -mcpu=cortex-m3 -mthumb example1.s -o example1.o
How are assembly files assembled?
$ arm-none-eabi-as
Useful options
-mcpu
-mthumb
-o

example.bin : example.o
arm-none-eabi-ld example.o -Ttext 0x0 -o example.out
arm-none-eabi-objdump -S example.out > example.lst
arm-none-eabi-objcopy -Obinary example.out example.bin
example.o : example.s
arm-none-eabi-as example.s -o example.o
clean :
rm -f *.o
rm -f *.out
rm -f *.bin
rm -f *.lst
A simple Makefile example

.equ STACK_TOP, 0x20000800
.text
.syntax unified
.thumb
.global _start
.type start, %function
_start:
.word STACK_TOP, start
start:
movs r0, #10
movs r1, #0
loop:
adds r1, r0
subs r0, #1
bne loop
deadloop:
b deadloop
.end
A “real” ARM assembly language program for GNU

.equ STACK_TOP, 0x20000800 /* Equates symbol to value */
.text /* Tells AS to assemble region */
.syntax unified /* Means language is ARM UAL */
.thumb /* Means ARM ISA is Thumb */
.global _start /* .global exposes symbol */
/* _start label is the beginning
...of the program region */
.type start, %function /* Specifies start is a function */
/* start label is reset handler */
_start:
.word STACK_TOP, start /* Inserts word 0x20000800 */
/* Inserts word (start) */
start:
movs r0, #10 /* We’ve seen the rest ... */
movs r1, #0
loop:
adds r1, r0
subs r0, #1
bne loop
deadloop:
b deadloop
.end
What’s it all mean?

What information does the disassembled file provide?
.equ STACK_TOP, 0x20000800
.text
.syntax unified
.thumb
.global _start
.type start, %function
_start:
.word STACK_TOP, start
start:
movs r0, #10
movs r1, #0
loop:
adds r1, r0
subs r0, #1
bne loop
deadloop:
b deadloop
.end
example1.out: file format elf32-littlearm
Disassembly of section .text:
00000000 <_start>:
0: 20000800 .word 0x20000800
4: 00000009 .word 0x00000009
00000008
:
8: 200a movs r0, #10
a: 2100 movs r1, #0
0000000c
:
c: 1809 adds r1, r1, r0
e: 3801 subs r0, #1
10: d1fc bne.n c
00000012
:
12: e7fe b.n 12
all:
arm-none-eabi-as -mcpu=cortex-m3 -mthumb example1.s -o example1.o
arm-none-eabi-ld -Ttext 0x0 -o example1.out example1.o
arm-none-eabi-objcopy -Obinary example1.out example1.bin
arm-none-eabi-objdump -S example1.out > example1.lst

Linker script that puts all the code in the right places
OUTPUT_FORMAT("elf32-littlearm")
OUTPUT_ARCH(arm)
ENTRY(main)
MEMORY
{
/* SmartFusion internal eSRAM */
ram (rwx) : ORIGIN = 0x20000000, LENGTH = 64k
}
SECTIONS
{
.text :
{
. = ALIGN(4);
*(.text*)
. = ALIGN(4);
_etext = .;
} >ram
}
end = .;
Specifies little-endian arm in ELF format
Specifies ARM CPU
Start executing at label named “main”
We have 64k of memory starting at 0x20000000. You can read, write and execute out of it. We named it “ram”
“.” is a reference to the current memory location
First align to a word (4 byte) boundary
Place all sections that include .text at the start (* here is a wildcard)
Define a label named _etext to be the current address.
Put it all in the memory location defined by the ram symbol’s location.
More info: The GNU Linker
http://web.eecs.umich.edu/~prabal/teaching/resources/eecs373/Linker.pdf

How does a mixed C/Assembly program
get turned into a executable program image?
Assembly
files (.s)
Object
files (.o)
as
(assembler)
gcc
(compile
+ link)
Memory
layout
Linker
script (.ld)
Executable
image file
Binary program
file (.bin)
Disassembled
Code (.lst)
objcopy
objdump
ld
(linker)
Library object
files (.o)
C files (.c)

Real-world example: Mixing C and assembly code
To the terminal again! Example code online:
https://github.com/brghena/eecs373_toolchain_examples
$ git clone https://github.com/brghena/eecs373_toolchain_examples
Inline assembly
$ cd eecs373_toolchain_examples/inline_asm
$ cat cfile.c
Separate C and assembly
$ cd eecs373_toolchain_examples/inline_asm
$ cat asmfile.s
$ cat cfile.c
* You’ll need to have the tools installed. Two useful links:
https://launchpad.net/gcc-arm-embedded/+download
http://web.eecs.umich.edu/~prabal/teaching/resources/eecs373/Linker.pdf

Today…
Finish ARM assembly example from last time
Walk though of the ARM ISA
Software Development Tool Flow
Application Binary Interface (ABI)

When is this relevant?
The ABI establishes caller/callee responsibilities
Who saves which registers
How function parameters are passed
How return values are passed back
The ABI is a contract with the compiler
All assembled C code will follow this standard
You need to follow it if you want C and Assembly to work together correctly

Source: Procedure Call Standard for the ARM Architecture
http://web.eecs.umich.edu/~prabal/teaching/resources/eecs373/ARM-AAPCS-EABI-v2.08.pdf
From the Procedure Call Standard

ABI Basic Rules
A subroutine must preserve the contents of the registers r4-11 and SP
These are the callee save registers
Let’s be careful with r9 though
Arguments are passed though r0 to r3
These are the caller save registers
If we need more arguments, we put a pointer into memory in one of the registers
We’ll worry about that later
Return value is placed in r0
r0 and r1 if 64-bits
Allocate space on stack as needed. Use it as needed. Put it back when done…
Keep things word aligned*

Let’s write a simple ABI routine
int bob(int a, int b)
returns a2 + b2
Instructions you might need
add adds two values
mul multiplies two values
bx branch to register
Other useful facts
Stack grows down.
And pointed to by “sp”
Return address is held in “lr”