arm - Beagleboard Qemu baremetal with UEFI

Question

I am trying to boot a freertos app from UEFI on Qemu

1. When i run the app from uboot, using the below commands it runs without any errors

   fatload mmc 0 80300000 rtosdemo.bin go 0x80300000

2. An uefi application loads the elf file at 0x80300000 and then I tried two options.

My boot.s file is below

`start:
_start:
_mainCRTStartup:
    ldr   r0, .LC6
    msr   CPSR_c, #MODE_UND|I_BIT|F_BIT /* Undefined Instruction */
    mov   sp, r0
    sub   r0, r0, #UND_STACK_SIZE
    msr   CPSR_c, #MODE_ABT|I_BIT|F_BIT /* Abort Mode */
    mov   sp, r0
    ...

` Disassembly file

`
80300000 <_undf-0x20>:
80300000:   ea001424    b   80305098 <start>
80300004:   e59ff014    ldr pc, [pc, #20]   ; 80300020 <_undf>
80300008:   e59ff014    ldr pc, [pc, #20]   ; 80300024 <_swi>
8030000c:   e59ff014    ldr pc, [pc, #20]   ; 80300028 <_pabt>
80300010:   e59ff014    ldr pc, [pc, #20]   ; 8030002c <_dabt>
...........
80305098 <start>:
80305098:   e59f00f4    ldr r0, [pc, #244]  ; 80305194 <endless_loop+0x18>
8030509c:   e321f0db    msr CPSR_c, #219    ; 0xdb
803050a0:   e1a0d000    mov sp, r0
803050a4:   e2400004    sub r0, r0, #4
`

1. use goto 0x80305098 which is the entry point addr specified in the elf file. Now it jumps to ldr r0, .. instruction but after that it just seems to be jumping some where in the middle of some function rather than stepping into msr instruction.

2. Since in uboot its jumping to 0x80300000, I tried by jumping to that addr, now it goes to instruction b 80305098 <start>, but after that instruction instead of jumping to 80305098 it just goes to the next instruction ldr pc, [pc, #20].

So any ideas on where I am going wrong?

EDIT: I updated boot.s to

start:
_start:
_mainCRTStartup:
    .thumb
thumb_entry_point:
    blx arm_entry_point
    .arm
arm_entry_point:
    ldr   r0, .LC6
    msr   CPSR_c, #MODE_UND|I_BIT|F_BIT /* Undefined Instruction Mode */
    mov   sp, r0

Now it works fine.

Answer 1

这是 ARM 代码，但听起来很像是在 Thumb 状态下跳转到的。这个词e59f00f4在 Thumb 中将被解释为lsls r4, r6, #3; b 0x80304bde（如果我的地址数学正确的话），这似乎与“在某个函数中间的某个地方跳转”一致。您可以通过检查 CPSR 的第 5 位来验证（假设您未处于用户模式） - 如果已设置，则您已进入 Thumb 状态。

如果是这种情况，那么“正确”的解决方案可能涉及使 UEFI 加载程序应用程序足够聪明，以执行正确类型的互通分支，但快速简便的破解方法是在某个地方放置一个 shim 仅用于初始条目，某事喜欢：

    .thumb
thumb_entry_point:
    blx  arm_entry_point
    .arm
arm_entry_point:
    b  start