Embedded-Hacking/WEEKS/WEEK03/QUIZ03.md

Week 3 Quiz: RP2350 Architecture and Boot Sequence

Instructions

Choose the best answer for each question. There is only one correct answer per question.

---

Questions

Question 1

What is the bootrom on the RP2350, and what is its primary purpose?

A) A 512 KB area of RAM used to cache frequently executed code
B) A 32 KB piece of code permanently burned into the chip that finds and loads your firmware
C) A configuration region in flash that stores Wi-Fi credentials
D) A special debug interface that only activates during BOOTSEL mode

📖 Reference: Week 3, Part 2 – "What is the Bootrom?" and "Key Bootrom Facts"

Correct Answer: B

---

Question 2

What value is stored at offset 0x00 in the vector table (address 0x10000000)?

A) The address of the main() function
B) The address of the NMI handler
C) The initial Stack Pointer value
D) The IMAGE_DEF magic start marker

📖 Reference: Week 3, Part 4 – "Vector Table Layout" (table)

Correct Answer: C

---

Question 3

The reset handler address in the vector table is 0x1000015d - an odd number. Why?

A) The address was misaligned during linking and the SDK automatically corrects it
B) The least significant bit (LSB) set to 1 signals to the processor that the code is in Thumb mode
C) Odd addresses are reserved for interrupt handlers by the ARM specification
D) The bootrom adds 1 to all addresses before storing them in the vector table

📖 Reference: Week 3, Part 4 – "Understanding Thumb Mode Addressing"

Correct Answer: B

---

Question 4

What does the BSS section contain, and what value are its contents set to at startup?

A) Initialized global variables; copied from their flash values
B) Constant strings and read-only data; they remain unchanged
C) Uninitialized global/static variables; they are zeroed to 0
D) Stack frames for active functions; they are filled with 0xDEADBEEF

📖 Reference: Week 3, Part 11 – "What is BSS?"

Correct Answer: C

---

Question 5

What CPUID register value indicates that the code is executing on Core 0 of the RP2350?

A) 0x1
B) 0xd0000000
C) 0x2
D) 0x0

📖 Reference: Week 3, Part 8, Step 5 – "Understanding the Reset Handler" (CPUID core value table)

Correct Answer: D

---

Question 6

Which ARM assembly instruction does the reset handler use to conditionally skip Core 1's hold loop and continue with Core 0 startup?

A) b.n (branch always)
B) cbz r0, <address> (compare and branch if zero)
C) blx r1 (branch with link and exchange)
D) ldr r0, [r0, #0] (load register)

📖 Reference: Week 3, Part 8, Step 4 – "Disassemble the Reset Handler" and Step 5 – "Understanding the Reset Handler"

Correct Answer: B

---

Question 7

What happens to initialized global variables (e.g., int counter = 42;) during the startup phase before main() runs?

A) They are kept in flash and accessed directly from there via XIP
B) They are discarded and replaced with zero-initialized values
C) Their initial values are copied from flash to RAM by the reset handler's data copy phase
D) They are stored in the vector table for fast access

📖 Reference: Week 3, Part 10 – "What is the Data Copy Phase?"

Correct Answer: C

---

Question 8

What is the purpose of the IMAGE_DEF structure found at the start of a Pico 2 firmware binary?

A) It stores the compiled size of each function for Ghidra analysis
B) It is a marker that tells the bootrom there is valid firmware present at that location
C) It maps GPIO pin numbers to their hardware register addresses
D) It defines the initial values of all global variables

📖 Reference: Week 3, Part 2 – "The IMAGE_DEF Structure"

Correct Answer: B

---

Question 9

Based on the linker script, how is the initial stack pointer value of 0x20082000 calculated?

A) It is a fixed constant hard-coded into the bootrom
B) It is the start of SRAM (0x20000000) plus the total binary size
C) It is the SCRATCH_Y region origin (0x20081000) plus its length (0x1000)
D) It is the end of flash memory rounded up to the nearest 4 KB boundary

📖 Reference: Week 3, Part 5 – "Where Does the Stack Come From?"

Correct Answer: C

---

Question 10

What does a bkpt instruction do when executed by the RP2350 processor, and where is it used in the startup code?

A) It skips the next instruction; used to handle Thumb-mode alignment padding
B) It triggers a breakpoint halt; used in the default exception handlers for faults like HardFault
C) It broadcasts a reset signal to Core 1; used at the end of the BSS clear phase
D) It reads a byte from memory; used by the data copy phase to transfer initialized data

📖 Reference: Week 3, Part 12, Step 11 – "Look at the Default Exception Handlers"

Correct Answer: B

---

Answer Key

1. B - The bootrom is 32 KB of permanent on-chip ROM that finds and loads firmware
2. C - Offset 0x00 in the vector table holds the initial Stack Pointer value (0x20082000)
3. B - The LSB=1 in an ARM vector table address indicates Thumb mode code
4. C - BSS contains uninitialized global/static variables, all zeroed to 0 at startup
5. D - Core 0 has CPUID value 0; Core 1 has CPUID value 1
6. B - cbz r0, <address> branches if r0 is zero (Core 0), continuing normal startup
7. C - The reset handler's data copy phase copies initial values from flash to RAM
8. B - IMAGE_DEF contains magic markers that the bootrom checks to validate firmware
9. C - StackTop = SCRATCH_Y origin (0x20081000) + SCRATCH_Y length (0x1000) = 0x20082000
10. B - bkpt halts execution for the debugger; it is used as the default fault/exception handler

---

Scoring Guide

• 10 correct: Excellent! You have a strong grasp of Week 3 concepts
• 8-9 correct: Very good! Review the topics you missed
• 6-7 correct: Good start. Go back and review the key concepts
• 5 or fewer: Review the Week 3 material again and try the practice exercises

---

Topics Covered

This quiz tests your understanding of:

• The bootrom: what it is and what it does
• The vector table structure and its entries
• Thumb mode addressing and the LSB convention
• BSS section and zero initialization
• Multi-core startup: Core 0 vs Core 1 detection
• The cbz instruction and conditional branching
• Data copy phase: initialized variables from flash to RAM
• The IMAGE_DEF firmware validation marker
• Linker script memory regions and stack pointer calculation
• Default exception handlers and the bkpt instruction