开始当然得要点汇编知识了
arm寄存器的两种名字
@ r0-r3 a1-a4
@ r4-r9 v1-v7
@ r10 sl
@ r11 fp
@ r12 ip
@ r13 sp
@ r14 lr
@ r15 pc
基本指令（没有什么深奥的知识，看注释秒懂）
mov r0, r1 @ r0 = r1
mov r0, #13 @ 数字还是存在于32位中,不可能很长,这时可以用伪指令
ldr r0, =1234 @ 1234存入r0
ldr r1, =0x2000000
ldr r0, [r1] @ r1所指向的地址中的内容存入r0
str r0, [r1] @ r0的值存入r1所指向的地址中去
ldr r2, str
ldr r3, str1
ldr r2, =str @ 不是r2 = 77777,而是r2 = 存放77777的地址（链接时确定的）
add r0, r1, r0 @ r0 = r1 + r0
sub r0, r1, r0 @ r0 = r1 - r0
str:
.word 77777 @ 4 Byte
str1:
.word 88888
重点来了，循序渐进介绍一下栈为何会这么做的
@ 0. apcs:fn调用完pc从lr里取回,注意arm有3级流水线
mov lr, pc
ldr pc, show
mov pc, lr
show:
.word 0x33f94aa8
@ 但这么做,如果之前还有函数调用,也势必要使用lr寄存器,lr所保存的值就被覆盖了
@ 1. 把前函数的lr的值放在内存中
ldr r5, =0x20000000
str lr, [r5]
mov lr, pc
ldr pc, show
ldr lr, [r5]
mov pc, lr
show:
.word 0x33f94aa8
@ 但这么做,如果r5在show函数中被使用,则出错
@ apcs中规定r0-r3一定被破坏,r4-r9(v1-v7)调用前后需保持一致,然而此时也没保证r5的值调用前后一致
@ 2. 于是乎有了堆栈
sub sp, sp, #4
str lr, [sp]
ldr r0, =fmt
mov lr, pc
ldr pc, show
ldr lr, [sp]
add sp, sp, #4
mov pc, lr
show:
.word 0x33f94aa8
fmt:
.asciz "hello world.\n" @ .ascii "hello world.\n\0"
@ 函数嵌套就挺麻烦,于是想到把sp也存入栈中
@ 3. ip(r12)存当前sp且也存入栈中
mov ip, sp
sub sp, sp, #8
str lr, [sp]
str ip, [sp, #4]
ldr r0, =fmt
mov lr, pc
ldr pc, show
mov sp, #555 @ sp的修改还是影响后续
ldr lr, [sp]
ldr ip, [sp, #4]
mov sp, ip
mov pc, lr
show:
.word 0x33f94aa8
fmt:
.asciz "hello world.\n" @ .ascii "hello world.\n\0"
@ 4. fp(r11) 当下的frame pointer也需要保存
mov ip, sp
sub sp, sp, #12
str lr, [sp]
str ip, [sp, #4]
str fp, [sp, #8]
sub fp, ip, #4
ldr r0, =fmt
mov lr, pc
ldr pc, show
mov sp, #555
ldr lr, [fp, #-8]
ldr ip, [fp, #-4]
ldr fp, [fp, #0]
mov sp, ip
mov pc, lr
show:
.word 0x33f94aa8
fmt:
.asciz "hello world.\n" @ .ascii "hello world.\n\0"
@ 5. 简写
aaa:
mov ip, sp
stmfd sp!, {fp, ip, lr, pc} @ stmdb sp!, {fp, ip, lr, pc} 不写!则sp不变,这个pc是调试信息
sub fp, ip, #4
bl test @ mov lr, pc @ ldr pc, test
sub sp, fp, #12
ldmfd sp, {fp, sp, pc}
test:
mov ip, sp
stmfd sp!, {fp, ip, lr, pc}
sub fp, ip, #4
ldr r0, =fmt
bl show
sub sp, fp, #12
ldmfd sp, {fp, sp, pc}
show:
.word 0x33f94aa8
fmt:
.asciz "hello world.\n"
