ARM 的Thumb狀態(tài)測試
加入技術(shù)交流群
帶著這些問題，我就Thumb狀態(tài)寫了一個簡單的程序以作測試。測試平臺是ADS1.2，先貼上測試代碼。
GET2440addr.inc
AREAInit,CODE,READONLY
CODE32
ENTRY
EXPORT__ENTRY
__ENTRY
bResetHandler
bHandlerUndef;handlerforUndefinedmode
bHandlerSWI;handlerforSWIinterrupt
bHandlerPabort;handlerforPAbort
bHandlerDabort;handlerforDAbort
b.;reserved
bHandlerIRQ;handlerforIRQinterrupt
bHandlerFIQ;handlerforFIQinterrupt
HandlerFIQ
b.
HandlerIRQ
b.
HandlerUndef
b.
HandlerSWI
b.
HandlerDabort
b.
HandlerPabort
b.
ResetHandler
ldrr0,=WTCON;watchdogdisable
ldrr1,=0x0
strr1,[r0]
movr1,#0x34
ldrr0,=ThumbState+1
bxr0
CODE16
ThumbState
addr0,r0,r1
ldrr0,=HandlerFIQ
ldrr0,[r0]
ldrr0,=BackARM
bxr0
CODE32
ALIGN
BackARM
ldrr0,=GPFCON
ldrr1,=0x55aa
strr1,[r0]
ldrr0,=GPFDAT
ldrr1,=0x0
strr1,[r0];
b.
AREAInit,CODE,READONLY
CODE32
ENTRY
EXPORT__ENTRY
__ENTRY
bResetHandler
bHandlerUndef;handlerforUndefinedmode
bHandlerSWI;handlerforSWIinterrupt
bHandlerPabort;handlerforPAbort
bHandlerDabort;handlerforDAbort
b.;reserved
bHandlerIRQ;handlerforIRQinterrupt
bHandlerFIQ;handlerforFIQinterrupt
HandlerFIQ
b.
HandlerIRQ
b.
HandlerUndef
b.
HandlerSWI
b.
HandlerDabort
b.
HandlerPabort
b.
ResetHandler
ldrr0,=WTCON;watchdogdisable
ldrr1,=0x0
strr1,[r0]
movr1,#0x34
ldrr0,=ThumbState+1
bxr0
CODE16
ThumbState
addr0,r0,r1
ldrr0,=HandlerFIQ
ldrr0,[r0]
ldrr0,=BackARM
bxr0
CODE32
ALIGN
BackARM
ldrr0,=GPFCON
ldrr1,=0x55aa
strr1,[r0]
ldrr0,=GPFDAT
ldrr1,=0x0
strr1,[r0];
b.
END
我們在看一下反匯編代碼。
__ENTRY [0xea00c]bResetHandler
04 [0xea007]bHandlerUndef
08 [0xea007]bHandlerSWI
0c [0xea008]bHandlerPabort
10 [0xea006]bHandlerDabort
14 [0xeafffffe]b0x14;(__ENTRY+0x14)
18 [0xea001]bHandlerIRQ
1c [0xeaffffff]bHandlerFIQ
HandlerFIQ[0xeafffffe]bHandlerFIQ
HandlerIRQ [0xeafffffe]bHandlerIRQ
HandlerUndef[0xeafffffe]bHandlerUndef
HandlerSWI[0xeafffffe]bHandlerSWI
HandlerDabort[0xeafffffe]bHandlerDabort
HandlerPabort[0xeafffffe]bHandlerPabort
ResetHandler[0xe3a00453]movr0,#0x53
3c [0xe3a01]movr1,#0
40 [0xe5801]strr1,[r0,#0]
44 [0xe3a015d0]movr1,#0x34
48 [0xe59f0028]ldrr0,0x78;=#0x51
4c [0xe12fff10]bxr0
ThumbState [0x1840]addr0,r0,r1
52 [0x480a]ldrr0,0x7c;=#0x20
54 [0x6800]ldrr0,[r0,#0]
56 [0x480a]ldrr0,0x80;=#0x5c
58 [0x4700]bxr0
5a [0x0]dcw0x （說明：為了使下邊的CODE32代碼4字節(jié)對齊起到占位作用）
BackARM [0xe59f0020]ldrr0,0x84;=#0x56050
60 [0xe59f1020]ldrr1,0x88;=#0x055aa
64 [0xe5801]strr1,[r0,#0]
68 [0xe59f001c]ldrr0,0x8c;=#0x56054
6c [0xe3a01]movr1,#0
70 [0xe5801]strr1,[r0,#0]
74 [0xeafffffe]b0x74;(BackARM+0x18)
04 [0xea007]bHandlerUndef
08 [0xea007]bHandlerSWI
0c [0xea008]bHandlerPabort
10 [0xea006]bHandlerDabort
14 [0xeafffffe]b0x14;(__ENTRY+0x14)
18 [0xea001]bHandlerIRQ
1c [0xeaffffff]bHandlerFIQ
HandlerFIQ[0xeafffffe]bHandlerFIQ
HandlerIRQ [0xeafffffe]bHandlerIRQ
HandlerUndef[0xeafffffe]bHandlerUndef
HandlerSWI[0xeafffffe]bHandlerSWI
HandlerDabort[0xeafffffe]bHandlerDabort
HandlerPabort[0xeafffffe]bHandlerPabort
ResetHandler[0xe3a00453]movr0,#0x53
3c [0xe3a01]movr1,#0
40 [0xe5801]strr1,[r0,#0]
44 [0xe3a015d0]movr1,#0x34
48 [0xe59f0028]ldrr0,0x78;=#0x51
4c [0xe12fff10]bxr0
ThumbState [0x1840]addr0,r0,r1
52 [0x480a]ldrr0,0x7c;=#0x20
54 [0x6800]ldrr0,[r0,#0]
56 [0x480a]ldrr0,0x80;=#0x5c
58 [0x4700]bxr0
5a [0x0]dcw0x （說明：為了使下邊的CODE32代碼4字節(jié)對齊起到占位作用）
BackARM [0xe59f0020]ldrr0,0x84;=#0x56050
60 [0xe59f1020]ldrr1,0x88;=#0x055aa
64 [0xe5801]strr1,[r0,#0]
68 [0xe59f001c]ldrr0,0x8c;=#0x56054
6c [0xe3a01]movr1,#0
70 [0xe5801]strr1,[r0,#0]
74 [0xeafffffe]b0x74;(BackARM+0x18)
下邊，我再貼出用AXD調(diào)試過程中的現(xiàn)象。
mov r1,#0x34；運行后r1=0x34分析結(jié)果，"add r0,r0,r1；運行后r0=0x34051"說明加法運算是32位的，也就是說CPU在Thumb狀態(tài)還是32位的，還能說明寄存器也是32位的，并非16位的。"ldr r0,[r0]；運行后r0=0xeafffffe"也說明了寄存器仍然與ARM狀態(tài)一樣是32位的。
ldr r0,=ThumbState+1；運行后r0=x51
bxr0；跳轉(zhuǎn)到Thumbstate位置處執(zhí)行，并且切換處理器到Thumb狀態(tài)
CODE16
ThumbState；pc = x50
add r0,r0,r1；運行后r0=0x34051
ldr r0,=HandlerFIQ ；運行后r0=0x0x20
ldr r0,[r0]；運行后r0=0xeafffffe
ldr r0,=BackARM
bxr0
結(jié)論：雖然，ARM的Thumb狀態(tài)的指令是16位的，但是CPU還是32位的，而且寄存器也是32位的。所以，Thumb狀態(tài)最大的區(qū)別就是指令變成16位的，寄存器少了一點，其他沒什么變化。
附上ARM的Thumb狀態(tài)與ARM狀態(tài)寄存器的對應(yīng)關(guān)系圖
懂得的越多，越是無知
評論