{"id":633,"date":"2012-11-02T10:01:20","date_gmt":"2012-11-02T18:01:20","guid":{"rendered":"http:\/\/www.outflux.net\/blog\/?p=633"},"modified":"2012-11-09T14:46:41","modified_gmt":"2012-11-09T22:46:41","slug":"arm-assembly","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2012\/11\/02\/arm-assembly\/","title":{"rendered":"ARM assembly"},"content":{"rendered":"<p>While I&#8217;ve been skimming ARM assembly here and there, yesterday I actually had to write some from scratch to <a href=\"https:\/\/lkml.org\/lkml\/2012\/11\/1\/512\">hook up seccomp on ARM<\/a>. I got stumped for a while, and ended up using two references frequently:<\/p>\n<ul>\n<li><a href=\"http:\/\/infocenter.arm.com\/help\/index.jsp?topic=\/com.arm.doc.dui0473c\/CEGBHJCJ.html\">ARM Instruction Suffixes<\/a><\/li>\n<li><a href=\"http:\/\/www.coranac.com\/tonc\/text\/asm.htm\">Whirlwind Tour of ARM Assembly<\/a><\/li>\n<\/ul>\n<p>The suffix one is pretty interesting because ARM allows for instructions to be conditional, rather than being required to rely on branching, like x86. For example, if you wanted something like this in C:<\/p>\n<pre class=\"brush:c\">\r\n    if (i == 0)\r\n        i = 1;\r\n    i = i + 1;\r\n<\/pre>\n<p>In x86 assembly, you&#8217;d have a compare followed by a jump to skip the moving of the &#8220;1&#8221; value:<\/p>\n<pre class=\"brush:c\">\r\n    cmp %ecx, $0\r\n    jne 2\r\n    mov %ecx, $1\r\n2:  inc %ecx\r\n<\/pre>\n<p>In ARM assembly, you can make the move conditional with a suffix (&#8220;mov if equal&#8221;):<\/p>\n<pre class=\"brush:c\">\r\n    cmp   r2, #0\r\n    moveq r2, #1\r\n    add   r2, r2, #1\r\n<\/pre>\n<p>The real thing that stumped me yesterday, though, was the &#8220;!&#8221; suffix on load\/store. Mainly, I didn&#8217;t notice it was there until I&#8217;d stared at the objdump output and systematically trimmed away all other other code that wasn&#8217;t changing the behavior:<\/p>\n<pre class=\"brush:c\">\r\n    ldr r0, [sp, #OFFSET]\r\n    str r0, [sp, #OFFSET]!\r\n<\/pre>\n<p>I was reading this as &#8220;variable = variable;&#8221; and I thought I was going crazy; how could a self-assignment change the code at all? In the second reference above, I found the that the trailing &#8220;!&#8221; means &#8220;(pre)increment the base by the offset&#8221;. I was doing a meaningless assignment, but it had the side-effect of pushing the &#8220;sp&#8221; register forward, and suddenly it all made sense (I needed to unwind the stack). The actual solution I needed was:<\/p>\n<pre class=\"brush:c\">\r\n    add sp, sp, #S_OFF\r\n<\/pre>\n<p>Yay for a crash-course in actual ARM assembly. :)<\/p>\n<p>(And yes, I&#8217;m aware of x86&#8217;s &#8220;cmov&#8221;, but I just wanted to do a simple illustration. ARM can do conditional calls!)<\/p>\n<p style='text-align:left'>&copy; 2012, <a href=\"https:\/\/outflux.net\/blog\/\">Kees Cook<\/a>. This work is licensed under a <a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\">Creative Commons Attribution-ShareAlike 4.0 License<\/a>.<br \/><a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\"><img decoding=\"async\" alt=\"CC BY-SA 4.0\" style=\"border-width:0\" src=\"https:\/\/i.creativecommons.org\/l\/by-sa\/4.0\/88x31.png\" \/><\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"<p>While I&#8217;ve been skimming ARM assembly here and there, yesterday I actually had to write some from scratch to hook up seccomp on ARM. I got stumped for a while, and ended up using two references frequently: ARM Instruction Suffixes Whirlwind Tour of ARM Assembly The suffix one is pretty interesting because ARM allows for [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,20,3,14,19],"tags":[],"_links":{"self":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/633"}],"collection":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/comments?post=633"}],"version-history":[{"count":5,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/633\/revisions"}],"predecessor-version":[{"id":653,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/633\/revisions\/653"}],"wp:attachment":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/media?parent=633"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/categories?post=633"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/tags?post=633"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}