mirror of
https://github.com/mytechnotalent/Embedded-Hacking.git
synced 2026-06-12 17:17:52 +02:00
Kevin Thomas
187 lines
6.5 KiB
Markdown
187 lines
6.5 KiB
Markdown
# Week 3 Quiz: RP2350 Architecture and Boot Sequence
|
||
|
||
## Instructions
|
||
Choose the best answer for each question. There is only one correct answer per question.
|
||
|
||
---
|
||
|
||
## Questions
|
||
|
||
### Question 1
|
||
What is the bootrom on the RP2350, and what is its primary purpose?
|
||
|
||
A) A 512 KB area of RAM used to cache frequently executed code
|
||
B) A 32 KB piece of code permanently burned into the chip that finds and loads your firmware
|
||
C) A configuration region in flash that stores Wi-Fi credentials
|
||
D) A special debug interface that only activates during BOOTSEL mode
|
||
|
||
> 📖 **Reference:** Week 3, Part 2 – "What is the Bootrom?" and "Key Bootrom Facts"
|
||
|
||
**Correct Answer: B**
|
||
|
||
---
|
||
|
||
### Question 2
|
||
What value is stored at offset `0x00` in the vector table (address `0x10000000`)?
|
||
|
||
A) The address of the `main()` function
|
||
B) The address of the NMI handler
|
||
C) The initial Stack Pointer value
|
||
D) The IMAGE_DEF magic start marker
|
||
|
||
> 📖 **Reference:** Week 3, Part 4 – "Vector Table Layout" (table)
|
||
|
||
**Correct Answer: C**
|
||
|
||
---
|
||
|
||
### Question 3
|
||
The reset handler address in the vector table is `0x1000015d` - an odd number. Why?
|
||
|
||
A) The address was misaligned during linking and the SDK automatically corrects it
|
||
B) The least significant bit (LSB) set to 1 signals to the processor that the code is in Thumb mode
|
||
C) Odd addresses are reserved for interrupt handlers by the ARM specification
|
||
D) The bootrom adds 1 to all addresses before storing them in the vector table
|
||
|
||
> 📖 **Reference:** Week 3, Part 4 – "Understanding Thumb Mode Addressing"
|
||
|
||
**Correct Answer: B**
|
||
|
||
---
|
||
|
||
### Question 4
|
||
What does the BSS section contain, and what value are its contents set to at startup?
|
||
|
||
A) Initialized global variables; copied from their flash values
|
||
B) Constant strings and read-only data; they remain unchanged
|
||
C) Uninitialized global/static variables; they are zeroed to 0
|
||
D) Stack frames for active functions; they are filled with 0xDEADBEEF
|
||
|
||
> 📖 **Reference:** Week 3, Part 11 – "What is BSS?"
|
||
|
||
**Correct Answer: C**
|
||
|
||
---
|
||
|
||
### Question 5
|
||
What CPUID register value indicates that the code is executing on Core 0 of the RP2350?
|
||
|
||
A) `0x1`
|
||
B) `0xd0000000`
|
||
C) `0x2`
|
||
D) `0x0`
|
||
|
||
> 📖 **Reference:** Week 3, Part 8, Step 5 – "Understanding the Reset Handler" (CPUID core value table)
|
||
|
||
**Correct Answer: D**
|
||
|
||
---
|
||
|
||
### Question 6
|
||
Which ARM assembly instruction does the reset handler use to conditionally skip Core 1's hold loop and continue with Core 0 startup?
|
||
|
||
A) `b.n` (branch always)
|
||
B) `cbz r0, <address>` (compare and branch if zero)
|
||
C) `blx r1` (branch with link and exchange)
|
||
D) `ldr r0, [r0, #0]` (load register)
|
||
|
||
> 📖 **Reference:** Week 3, Part 8, Step 4 – "Disassemble the Reset Handler" and Step 5 – "Understanding the Reset Handler"
|
||
|
||
**Correct Answer: B**
|
||
|
||
---
|
||
|
||
### Question 7
|
||
What happens to initialized global variables (e.g., `int counter = 42;`) during the startup phase before `main()` runs?
|
||
|
||
A) They are kept in flash and accessed directly from there via XIP
|
||
B) They are discarded and replaced with zero-initialized values
|
||
C) Their initial values are copied from flash to RAM by the reset handler's data copy phase
|
||
D) They are stored in the vector table for fast access
|
||
|
||
> 📖 **Reference:** Week 3, Part 10 – "What is the Data Copy Phase?"
|
||
|
||
**Correct Answer: C**
|
||
|
||
---
|
||
|
||
### Question 8
|
||
What is the purpose of the IMAGE_DEF structure found at the start of a Pico 2 firmware binary?
|
||
|
||
A) It stores the compiled size of each function for Ghidra analysis
|
||
B) It is a marker that tells the bootrom there is valid firmware present at that location
|
||
C) It maps GPIO pin numbers to their hardware register addresses
|
||
D) It defines the initial values of all global variables
|
||
|
||
> 📖 **Reference:** Week 3, Part 2 – "The IMAGE_DEF Structure"
|
||
|
||
**Correct Answer: B**
|
||
|
||
---
|
||
|
||
### Question 9
|
||
Based on the linker script, how is the initial stack pointer value of `0x20082000` calculated?
|
||
|
||
A) It is a fixed constant hard-coded into the bootrom
|
||
B) It is the start of SRAM (`0x20000000`) plus the total binary size
|
||
C) It is the `SCRATCH_Y` region origin (`0x20081000`) plus its length (`0x1000`)
|
||
D) It is the end of flash memory rounded up to the nearest 4 KB boundary
|
||
|
||
> 📖 **Reference:** Week 3, Part 5 – "Where Does the Stack Come From?"
|
||
|
||
**Correct Answer: C**
|
||
|
||
---
|
||
|
||
### Question 10
|
||
What does a `bkpt` instruction do when executed by the RP2350 processor, and where is it used in the startup code?
|
||
|
||
A) It skips the next instruction; used to handle Thumb-mode alignment padding
|
||
B) It triggers a breakpoint halt; used in the default exception handlers for faults like HardFault
|
||
C) It broadcasts a reset signal to Core 1; used at the end of the BSS clear phase
|
||
D) It reads a byte from memory; used by the data copy phase to transfer initialized data
|
||
|
||
> 📖 **Reference:** Week 3, Part 12, Step 11 – "Look at the Default Exception Handlers"
|
||
|
||
**Correct Answer: B**
|
||
|
||
---
|
||
|
||
## Answer Key
|
||
|
||
1. B - The bootrom is 32 KB of permanent on-chip ROM that finds and loads firmware
|
||
2. C - Offset 0x00 in the vector table holds the initial Stack Pointer value (0x20082000)
|
||
3. B - The LSB=1 in an ARM vector table address indicates Thumb mode code
|
||
4. C - BSS contains uninitialized global/static variables, all zeroed to 0 at startup
|
||
5. D - Core 0 has CPUID value 0; Core 1 has CPUID value 1
|
||
6. B - `cbz r0, <address>` branches if r0 is zero (Core 0), continuing normal startup
|
||
7. C - The reset handler's data copy phase copies initial values from flash to RAM
|
||
8. B - IMAGE_DEF contains magic markers that the bootrom checks to validate firmware
|
||
9. C - StackTop = SCRATCH_Y origin (0x20081000) + SCRATCH_Y length (0x1000) = 0x20082000
|
||
10. B - `bkpt` halts execution for the debugger; it is used as the default fault/exception handler
|
||
|
||
---
|
||
|
||
## Scoring Guide
|
||
|
||
- **10 correct**: Excellent! You have a strong grasp of Week 3 concepts
|
||
- **8-9 correct**: Very good! Review the topics you missed
|
||
- **6-7 correct**: Good start. Go back and review the key concepts
|
||
- **5 or fewer**: Review the Week 3 material again and try the practice exercises
|
||
|
||
---
|
||
|
||
## Topics Covered
|
||
|
||
This quiz tests your understanding of:
|
||
- The bootrom: what it is and what it does
|
||
- The vector table structure and its entries
|
||
- Thumb mode addressing and the LSB convention
|
||
- BSS section and zero initialization
|
||
- Multi-core startup: Core 0 vs Core 1 detection
|
||
- The `cbz` instruction and conditional branching
|
||
- Data copy phase: initialized variables from flash to RAM
|
||
- The IMAGE_DEF firmware validation marker
|
||
- Linker script memory regions and stack pointer calculation
|
||
- Default exception handlers and the `bkpt` instruction
|