0%

newlib 中的 crt0 流程分析

最近对 newlib 中的启动代码 crt0 产生了兴趣,于是就分析了下其代码。crt0 的源码位于 libgloss/arm/crt0.S,为了兼容各种 ARM 架构,crt0.S 中有大量的条件判断宏定义,对于只关心 ARMv7e-M 的我来说很是痛苦。刚好手上有个基于 STM32F412 的 mbed 工程用的是 crt0 的启动方式,参考 crt0.o 的反汇编我可以提炼出 crt0.S 中和 ARMv7e-M 相关的部分代码。

crt0.o 的反汇编如下:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
08008220 <_mainCRTStartup>:
8008220: 4b15 ldr r3, [pc, #84] ; (8008278 <_mainCRTStartup+0x58>)
8008222: 2b00 cmp r3, #0
8008224: bf08 it eq
8008226: 4b13 ldreq r3, [pc, #76] ; (8008274 <_mainCRTStartup+0x54>)
8008228: 469d mov sp, r3
800822a: f5a3 3a80 sub.w sl, r3, #65536 ; 0x10000
800822e: 2100 movs r1, #0
8008230: 468b mov fp, r1
8008232: 460f mov r7, r1
8008234: 4813 ldr r0, [pc, #76] ; (8008284 <_mainCRTStartup+0x64>)
8008236: 4a14 ldr r2, [pc, #80] ; (8008288 <_mainCRTStartup+0x68>)
8008238: 1a12 subs r2, r2, r0
800823a: f01c fcd7 bl 8024bec <memset>
800823e: 4b0f ldr r3, [pc, #60] ; (800827c <_mainCRTStartup+0x5c>)
8008240: 2b00 cmp r3, #0
8008242: d000 beq.n 8008246 <_mainCRTStartup+0x26>
8008244: 4798 blx r3
8008246: 4b0e ldr r3, [pc, #56] ; (8008280 <_mainCRTStartup+0x60>)
8008248: 2b00 cmp r3, #0
800824a: d000 beq.n 800824e <_mainCRTStartup+0x2e>
800824c: 4798 blx r3
800824e: 2000 movs r0, #0
8008250: 2100 movs r1, #0
8008252: 0004 movs r4, r0
8008254: 000d movs r5, r1
8008256: 480d ldr r0, [pc, #52] ; (800828c <_mainCRTStartup+0x6c>)
8008258: 2800 cmp r0, #0
800825a: d002 beq.n 8008262 <_mainCRTStartup+0x42>
800825c: 480c ldr r0, [pc, #48] ; (8008290 <_mainCRTStartup+0x70>)
800825e: f00f f868 bl 8017332 <__wrap_atexit>
8008262: f01c f805 bl 8024270 <__libc_init_array>
8008266: 0020 movs r0, r4
8008268: 0029 movs r1, r5
800826a: f00f f821 bl 80172b0 <__wrap_main>
800826e: f00f f85d bl 801732c <__wrap_exit>
8008272: bf00 nop
8008274: 00080000 .word 0x00080000
8008278: 20040000 .word 0x20040000
800827c: 00000000 .word 0x00000000
8008280: 080172a3 .word 0x080172a3
8008284: 20000c00 .word 0x20000c00
8008288: 2000ac58 .word 0x2000ac58
800828c: 08017333 .word 0x08017333
8008290: 00000000 .word 0x00000000

提炼后的 crt0.S 代码如下:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
    FUNC_START  _mainCRTStartup
FUNC_START _start
/* Start by setting up a stack */

/* Set up the stack pointer to a fixed value */
/* Changes by toralf:
- Allow linker script to provide stack via __stack symbol - see
defintion of .Lstack
- Provide "hooks" that may be used by the application to add
custom init code - see .Lhwinit and .Lswinit
- Go through all execution modes and set up stack for each of them.
Loosely based on init.s from ARM/Motorola example code.
Note: Mode switch via CPSR is not allowed once in non-privileged
mode, so we take care not to enter "User" to set up its sp,
and also skip most operations if already in that mode. */

ldr r3, .Lstack
cmp r3, #0

it eq

ldreq r3, .LC0
/* Note: This 'mov' is essential when starting in User, and ensures we
always get *some* sp value for the initial mode, even if we
have somehow missed it below (in which case it gets the same
value as FIQ - not ideal, but better than nothing.) */
mov sp, r3

.LC23:
/* Setup a default stack-limit in-case the code has been
compiled with "-mapcs-stack-check". Hard-wiring this value
is not ideal, since there is currently no support for
checking that the heap and stack have not collided, or that
this default 64k is enough for the program being executed.
However, it ensures that this simple crt0 world will not
immediately cause an overflow event: */
sub sl, r3, #64 << 10 /* Still assumes 256bytes below sl */

/* Zero the memory in the .bss section. */
movs a2, #0 /* Second arg: fill value */
mov fp, a2 /* Null frame pointer */
mov r7, a2 /* Null frame pointer for Thumb */

ldr a1, .LC1 /* First arg: start of memory block */
ldr a3, .LC2
subs a3, a3, a1 /* Third arg: length of block */

bl memset

/* Changes by toralf: Taken from libgloss/m68k/crt0.S
* initialize target specific stuff. Only execute these
* functions it they exist.
*/
ldr r3, .Lhwinit
cmp r3, #0
beq .LC24
indirect_call r3
.LC24:
ldr r3, .Lswinit
cmp r3, #0
beq .LC25
indirect_call r3

.LC25:
movs r0, #0 /* no arguments */
movs r1, #0 /* no argv either */

/* Some arm/elf targets use the .init and .fini sections
to create constructors and destructors, and for these
targets we need to call the _init function and arrange
for _fini to be called at program exit. */
movs r4, r0
movs r5, r1e

/* Make reference to atexit weak to avoid unconditionally pulling in
support code. Refer to comments in __atexit.c for more details. */
ldr r0, .Latexit
cmp r0, #0
beq .Lweak_atexit

ldr r0, .Lfini
bl atexit
.Lweak_atexit:
bl _init
movs r0, r4
movs r1, r5

bl main

bl exit /* Should not return. */

/* For Thumb, constants must be after the code since only
positive offsets are supported for PC relative addresses. */
.LC0:
.word 0x80000 /* Top of RAM on the PIE board. */
.Lstack:
.word __stack
.Lhwinit:
.word ardware_init_hook
.Lswinit:
.word software_init_hook

/* Set up defaults for the above variables in the form of weak symbols
- so that application will link correctly, and get value 0 in
runtime (meaning "ignore setting") for the variables, when the user
does not provide the symbols. (The linker uses a weak symbol if,
and only if, a normal version of the same symbol isn't provided
e.g. by a linker script or another object file.) */

.weak __stack
.weak hardware_init_hook
.weak software_init_hook

.LC1:
.word __bss_start__
.LC2:
.word __bss_end__

.weak atexit
.Latexit:
.word atexit

/* Weak reference _fini in case of lite exit. */
.weak _fini
.Lfini:
.word _fini

crt0 启动流程如下:

  1. 设置 SP 为 __stack,若 __stack 未被用户定义,则使用默认的值(0x80000处的值)。
  2. 清空 .bss 段,起始地址为 bss_start__,结束地址为 __bss_end
  3. 若用户定义了 hardware_init_hook 和 software_init_hook ,则调用它们。
  4. 若用户定义了 atexit,则调用它,并将传递参数 _fini(_fini 被宏定义为 __libc_fini_array)。
  5. 调用 _init(_ini 被宏定义为 __libc_ini_array)。
  6. 调用 main(argc 和 argv 都等于 0)。
  7. 调用 exit。

其中 stack,__bss_start__ 和 __bss_end 必须被定义。

hardware_init_hook 和 software_init_hook 可以实现一些需要在 main 之前的功能。

aiexit,exit,_init 和 _fini 一般是和 C++ 的全局构造和析构有关,这个放在下一节来分析。

坚持原创技术分享,您的支持将鼓励我继续创作!