Firmware load instructions

[botmail242]

Posted on July 15, 2016 at 15:44

I have been dissecting my STM32L151's code. It starts at address 0800 0000 and consists of around 50 load instructions. After each load instruction, the value is shifted right by 0x20 and stored into R0. After each logic shift, another load instruction is issued and stored in R0 which erases the value of the previous logic shift. What is the board doing?

[botmail242]

Posted on July 15, 2016 at 15:46

Startup code: http://pastebin.com/zHz9v3bH

[Tesla DeLorean]

Posted on July 15, 2016 at 17:53

The vector table isn't code, it is a list of addresses. You should look it as 32-bit words, not as a disassembly.

Turn on the hex opcodes for your disassembly, it will make it easier to understand and see what is data and what is code.

08000000 0800DB48 dd $0800DB48
08000004 08008731 stmdaeq r0, {r0, r4, r5, r8, r9, r10, pc}
08000008 08000ACD dd $08000ACD
0800000C 08000ACF stmdaeq r0, {r0, r1, r2, r3, r6, r7, r9, r11}
08000010 08000AD3 stmdaeq r0, {r0, r1, r4, r6, r7, r9, r11}
08000014 08000AD7 stmdaeq r0, {r0, r1, r2, r4, r6, r7, r9, r11}
08000018 08000ADB stmdaeq r0, {r0, r1, r3, r4, r6, r7, r9, r11}
0800001C 00000000 andeq r0, r0, r0
08000020 00000000 andeq r0, r0, r0
08000024 00000000 andeq r0, r0, r0
08000028 00000000 andeq r0, r0, r0
0800002C 08000ADF stmdaeq r0, {r0, r1, r2, r3, r4, r6, r7, r9, r11}
08000030 08000AE1 stmdaeq r0, {r0, r5, r6, r7, r9, r11}
08000034 00000000 andeq r0, r0, r0
08000038 08000AE3 stmdaeq r0, {r0, r1, r5, r6, r7, r9, r11}
0800003C 08000AE5 stmdaeq r0, {r0, r2, r5, r6, r7, r9, r11}
08000040 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000044 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000048 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
0800004C 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000050 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000054 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000058 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
0800005C 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000060 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000064 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000068 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
0800006C 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000070 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000074 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000078 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
0800007C 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000080 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000084 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000088 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
0800008C 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000090 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000094 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000098 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
0800009C 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
080000A0 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
080000A4 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
080000A8 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
080000AC 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
080000B0 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
080000B4 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
080000B8 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
080000BC 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
080000C0 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
080000C4 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
080000C8 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
080000CC 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
080000D0 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
080000D4 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
080000D8 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
080000DC 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
080000E0 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
080000E4 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
080000E8 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
080000EC 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
080000F0 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
080000F4 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
080000F8 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
080000FC 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000100 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000104 08000AED stmdaeq r0, {r0, r2, r3, r5, r6, r7, r9, r11}
08000108 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
0800010C 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000110 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000114 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000118 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
0800011C 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000120 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000124 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000128 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
0800012C 08000AF5 stmdaeq r0, {r0, r2, r4, r5, r6, r7, r9, r11}
08000130 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000134 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000138 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
0800013C 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000140 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000144 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000148 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
0800014C 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000150 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000154 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000158 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
0800015C 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000160 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000164 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000168 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
0800016C 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000170 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000174 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000178 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
0800017C 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000180 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000184 0800874B stmdaeq r0, {r0, r1, r3, r6, r8, r9, r10, pc}
08000188 SUB16 sub_8000188:
08000188 F000 F802 bl sub_8000190
0800018C F000 F868 bl sub_8000260
08000190 SUB16 sub_8000190: ; Xref 8000188
08000190 A00A add r0, pc, #40 ; (adr r0, $80001BC=$0000B784)
08000192 E890 0C00 ldmia.w r0, {r10, r11}
08000196 4482 add r10, r0
08000198 4483 add r11, r0
0800019A F1AA 0701 sub.w r7, r10, #1 ; $1
0800019E 45DA cmp r10, r11
080001A0 D101 bne.n loc_80001A6
080001A2 F000 F85D bl sub_8000260
080001A6 LOC loc_80001A6: ; Xref 80001A0
080001A6 F2AF 0E09 subw lr, pc, #9 ; $9
080001AA E8BA 000F ldmia.w r10!, {r0, r1, r2, r3}
080001AE F013 0F01 tst.w r3, #1 ; $1
080001B2 BF18 it ne
080001B4 1AFB subs r3, r7, r3
080001B6 F043 0301 orr.w r3, r3, #1 ; $1
080001BA 4718 bx r3
080001BC 0000B784 dd $0000B784

[botmail242]

Posted on July 18, 2016 at 18:46

This post addresses the topic too http://stackoverflow.com/questions/6139952/what-is-the-booting-process-for-arm

[Tesla DeLorean]

Posted on July 18, 2016 at 20:10

Also, surprisingly, ARM has Technical Reference Manuals explaining how the processors actually function in all manner of circumstances.