30000018: eafffffe b 30000018
3000001c: e3a01453 mov r1, #1392508928 ; 0x53000000
30000020: e3a02000 mov r2, #0 ; 0x0
30000024: e5812000 str r2, [r1]
30000028: e1a0f00e mov pc, lr 3000002c
3000002c: e3a01000 mov r1, #0 ; 0x0
30000030: e3a02203 mov r2, #805306368 ; 0x30000000
30000034: e3a03a01 mov r3, #4096 ; 0x1000
30000038: e4914004 ldr r4, [r1], #4
3000003c: e4824004 str r4, [r2], #4
30000040: e1510003 cmp r1, r3
30000044: 1afffffb bne 30000038
30000048: e1a0f00e mov pc, lr 3000004c
3000004c: e3a01312 mov r1, #1207959552 ; 0x48000000
30000050: e28f2018 add r2, pc, #24 ; 0x18
30000054: e1a00000 nop (mov r0,r0)
30000058: e2813034 add r3, r1, #52 ; 0x34
3000005c: e4924004 ldr r4, [r2], #4
30000060: e4814004 str r4, [r1], #4
30000064: e1510003 cmp r1, r3
30000068: 1afffffb bne 3000005c
3000006c: e1a0f00e mov pc, lr 30000070
30000070: 22011110 .word 0x22011110
30000074: 00000700 .word 0x00000700
30000078: 00000700 .word 0x00000700
3000007c: 00000700 .word 0x00000700
30000080: 00000700 .word 0x00000700
30000084: 00000700 .word 0x00000700
30000088: 00000700 .word 0x00000700
3000008c: 00018005 .word 0x00018005
30000090: 00018005 .word 0x00018005
30000094: 008c07a3 .word 0x008c07a3
30000098: 000000b1 .word 0x000000b1
3000009c: 00000030 .word 0x00000030
300000a0: 00000030 .word 0x00000030
300000a4: 30000010 .word 0x30000010
300000a8: e1a00000 nop (mov r0,r0)
300000ac: e1a00000 nop (mov r0,r0) 300000b0
300000b0: e52db004 push {fp} ; (str fp, [sp, #-4]!)
300000b4: e28db000 add fp, sp, #0 ; 0x0
300000b8: e24dd00c sub sp, sp, #12 ; 0xc
300000bc: e50b0008 str r0, [fp, #-8]
300000c0: ea000002 b 300000d0
300000c4: e51b3008 ldr r3, [fp, #-8]
300000c8: e2433001 sub r3, r3, #1 ; 0x1
300000cc: e50b3008 str r3, [fp, #-8]
300000d0: e51b3008 ldr r3, [fp, #-8]
300000d4: e3530000 cmp r3, #0 ; 0x0
300000d8: 1afffff9 bne 300000c4
300000dc: e28bd000 add sp, fp, #0 ; 0x0
300000e0: e8bd0800 pop {fp}
300000e4: e12fff1e bx lr 300000e8
300000e8: e92d4800 push {fp, lr}
300000ec: e28db004 add fp, sp, #4 ; 0x4
300000f0: e24dd008 sub sp, sp, #8 ; 0x8
300000f4: e3a03000 mov r3, #0 ; 0x0
300000f8: e50b3008 str r3, [fp, #-8]
300000fc: e3a03456 mov r3, #1442840576 ; 0x56000000
30000100: e2833010 add r3, r3, #16 ; 0x10
30000104: e3a02b55 mov r2, #87040 ; 0x15400
30000108: e5832000 str r2, [r3]
3000010c: e3a00c75 mov r0, #29952 ; 0x7500
30000110: e2800030 add r0, r0, #48 ; 0x30
30000114: ebffffe5 bl 300000b0
30000118: e3a02456 mov r2, #1442840576 ; 0x56000000
3000011c: e2822014 add r2, r2, #20 ; 0x14
30000120: e51b3008 ldr r3, [fp, #-8]
30000124: e1a03283 lsl r3, r3, #5
30000128: e1e03003 mvn r3, r3
3000012c: e5823000 str r3, [r2]
30000130: e51b3008 ldr r3, [fp, #-8]
30000134: e2833001 add r3, r3, #1 ; 0x1
30000138: e50b3008 str r3, [fp, #-8]
3000013c: e51b3008 ldr r3, [fp, #-8]
30000140: e3530010 cmp r3, #16 ; 0x10
30000144: 1afffff0 bne 3000010c
30000148: e3a03000 mov r3, #0 ; 0x0
3000014c: e50b3008 str r3, [fp, #-8]
30000150: eaffffed b 3000010c
从代码中可以看出代码的地址的确是从0x30000000开始的。问题就来了,我们的NANDFlash地址不是从0x0开始的么?而且学过ARM的的人应该都知道,CPU上电之后都是从 地址0x0处开始取指令,而如今把代码段指定到0x30000000,CPU为什么还可以顺利启动并运行呢? 我的理解是,代码还是被下载到NANDFlash中,上电之后PC从0x0开始取指令,以上面的反汇编文件为例,以下开始的代码还是存在于地址0x0处
30000000: eb000005 bl 3000001c
30000004: eb000010 bl 3000004c
30000008: eb000007 bl 3000002c
3000000c: e59ff090 ldr pc, [pc, #144] ; 300000a4
以第一行指令来说明以下 其机器码为0xeb00005 翻译成二进制文件便是 11101011000000000000000000000101 (说明一下 机器码的格式为 [31:28]为条件码 [27:24]位为0b1010时表示 b跳转指令 为0b1011时 表示bl跳转指令 [23:0]表示偏移地址) 【使用b或bl跳转时,吓一条指令的地址是这样计算的:将指令中24位带符号的不嘛扩展为32位(扩展其符号位),将此32位数左移两位;将得到的值加到pc寄存器中,记得到目标地址】---摘自 《嵌入式Linux 应用开发完全手册》P39 第一行指令 的24位带符号补码为0x000005,扩展为32位便是0x00000005 左移两位得到 0x00010100 其值为 0x14 ,PC的值是当前指令的下两条指令的地址0x00000008加上得到的0x00000014,即0x0000001c,即是关闭看门口那条指令。此处易犯的错误是 这行指令第3,4列的 bl 3000001c,注意!这不是说跳到 地址0x3000001c处,绝对地址应按刚才那个步骤计算。 接着在完成了