1

I have small application that compiles and runs well on my ARM Cortex M4. But when I disassemble binary file, that I flush, here is how first bytes look like:

00000000 <.data>:
  0:   20020000        andcs   r0, r2, r0
  4:   080003b5        stmdaeq r0, {r0, r2, r4, r5, r7, r8, r9}
  8:   08000345        stmdaeq r0, {r0, r2, r6, r8, r9}
  c:   08000351        stmdaeq r0, {r0, r4, r6, r8, r9}

080003b5 should be the address of Reset handler (I have .word Reset_Handler there), but disassembling ELF shows that Reset handler is actually located at 080003b4, which is 1 byte before:

080003b4 <Reset_Handler>:
  80003b4:  2100        movs    r1, #0
  80003b6:  e003        b.n 80003c0 <InitData>

(It's running in THUMB mode, I have 2byte instructions).

Even if I disassemble the binary file, it's located at 080003b4:

000003b4 <.data+0x3b4>:
  3b4:   2100            movs    r1, #0
  3b6:   e003            b.n     0x3c0

My question is, why does it point 1 byte after? This code surprisingly works on actual board. Even without disassembling, shouldn't instructions be aligned by 2 byte? how can address be 0x000003b5?

Zhani Baramidze
  • 1,407
  • 1
  • 13
  • 32
  • 1
    I believe the ARM requires aligned addresses for instructions, so `080003b5` is not correct for sure. But the least significant bit is probably used for thumb/full32 mode marking (your address then maybe means reset handler is "thumb" code at `080003b4`), can't recall how it was from head, and I'm not going to check CPU docs, so take is as a vague hint, which may be completely wrong. – Ped7g Nov 28 '16 at 10:44
  • 1
    It's been asked here many times in various forms, feel free to search for the most appropriate duplicate (I don't have time right now). In short, read up on how Thumb symbols/code addresses work with regard to interworking. – Notlikethat Nov 28 '16 at 10:52
  • 1
    When you use jump instruction, B, it needs to know if it's jumping to Thumb or ARM instruction, the odd address is to let it know it's Thumb. The LSBit is ignored anyway when it gets the jump address. – hesham_EE Nov 28 '16 at 14:03
  • 1
    Possible duplicate of [Linux Kernel - why a function's address in System.map is one byte preceding its address as seen in real time?](http://stackoverflow.com/questions/14120711/linux-kernel-why-a-functions-address-in-system-map-is-one-byte-preceding-its) – Notlikethat Nov 28 '16 at 22:22
  • 2
    And now I do have time; http://stackoverflow.com/q/38372214/3156750 http://stackoverflow.com/q/37239856/3156750 http://stackoverflow.com/q/15764833/3156750 http://stackoverflow.com/q/37004954/3156750 http://stackoverflow.com/q/16647084/3156750 http://stackoverflow.com/q/28110605/3156750 and so on... – Notlikethat Nov 28 '16 at 22:24

1 Answers1

3

Answer: ARM uses it for switching to THUMB mode.

Zhani Baramidze
  • 1,407
  • 1
  • 13
  • 32