mini2440利用uboot在内存中下载并运行裸机程序

转载请保留链接

1. 代码编写：

test.S
        sub sp, sp, #4
        str r14, [sp]

        ldr r0, =fmt

        mov r14, r15
        ldr r15, show

        ldr r14, [sp]
        add sp, sp, #4
        mov r15, r14

show:
        .word 0x33f962a8

fmt:
        .asciz "hello tauren.\n"

2. 代码编译链接

root@tauren:/code/test# arm-linux-as test.S -o test.o
root@tauren:/code/test# arm-linux-ld -Ttext=0x30008000 test.o -o test
root@tauren:/code/test# arm-linux-objcopy -I elf32-littlearm -O binary test /code/tftp/test.bin

3. u-boot代码的下载与执行

[MINI2440]# tftp 0x30008000 test.bin

[MINI2440]# go 0x30008000

4. 实验现象
U-Boot 2009.11 (Jan 05 2016 - 22:14:15)

 modified by tekkamanninja (tekkamanninja@163.com)
 Love Linux forever!!

I2C:   ready
DRAM:  64 MB
Flash:  2 MB
NAND:  128 MiB
Video: 240x320x16 20kHz 62Hz
In:    serial
Out:   serial
Err:   serial
Net:   dm9000
U-Boot 2009.11 (Jan 05 2016 - 22:14:15)
modified by tekkamanninja
(tekkamanninja@163.com)
Love Linux forever!!
[MINI2440]# tftp 0x30008000 test.bin
dm9000 i/o: 0x20000300, id: 0x90000a46
DM9000: running in 16 bit mode
MAC: 08:08:11:18:12:27
operating at 100M full duplex mode
Using dm9000 device
TFTP from server 192.168.1.110; our IP address is 192.168.1.108
Filename 'test.bin'.
Load address: 0x30008000
Loading: T #
done
Bytes transferred = 56 (38 hex)
[MINI2440]# go 0x30008000
## Starting application at 0x30008000 ...
hello tauren.
## Application terminated, rc = 0x0

5. 实验总结：

1) 代码中地址0x33f962a8代表的是uboot所对应的printf函数的地址，可以从u-boot.map中查询，只需要把字符串送至printf函数所在的地址即可实现信息打印。
2) 代码链接时指定了链接地址为0x30008000，利用arm-linux-objdump –d test反汇编可以看出，这个地址指的是DDR内存中的临时地址。
root@tauren:/code/test# arm-linux-objdump -d test

test:     file format elf32-littlearm


Disassembly of section .text:

30008000 <show-0x20>:
30008000:    e24dd004     sub    sp, sp, #4
30008004:    e58de000     str    lr, [sp]
30008008:    e59f0024     ldr    r0, [pc, #36]    ; 30008034 <fmt+0x10>
3000800c:    e1a0e00f     mov    lr, pc
30008010:    e59ff008     ldr    pc, [pc, #8]    ; 30008020 <show>
30008014:    e59de000     ldr    lr, [sp]
30008018:    e28dd004     add    sp, sp, #4
3000801c:    e1a0f00e     mov    pc, lr

30008020 <show>:
30008020:    33f962a8     .word    0x33f962a8

30008024 <fmt>:
30008024:    6c6c6568     .word    0x6c6c6568
30008028:    6174206f     .word    0x6174206f
3000802c:    6e657275     .word    0x6e657275
30008030:    00000a2e     .word    0x00000a2e
30008034:    30008024     .word    0x30008024
3) 链接出的test是elf格式文件，需要利用arm-linux-objcopy去掉头信息，elf32-littlearm指定小端模式。
4) 代码换成C语言 test.c
void (*show)(char *,...) = 0x33f962a8;
int main(void)
{
    show("hello world./n");
    return 0;
}
编译：
root@tauren:/code/test# arm-linux-gcc -c test.c -o test.o
root@tauren:/code/test# arm-linux-ld -Ttext=0x30008000 -nostdlib test.o -o test
root@tauren:/code/test# arm-linux-objcopy -I elf32-littlearm -O binary test /code/tftp/test.bin
下载：
[MINI2440]# tftp 0x30008000 test.bin
dm9000 i/o: 0x20000300, id: 0x90000a46
DM9000: running in 16 bit mode
MAC: 08:08:11:18:12:27
operating at 100M full duplex mode
Using dm9000 device
TFTP from server 192.168.1.110; our IP address is 192.168.1.108
Filename 'test.bin'.
Load address: 0x30008000
Loading: T ###
done
Bytes transferred = 32844 (804c hex)
[MINI2440]# go 0x30008000          
## Starting application at 0x30008000 ...
hello tauren.
## Application terminated, rc = 0x0