linux内核启动流程（上）

由内核Makefile分析可知，

文件linux/arch/arm/boot/compressed/head.S是linux内核启动过程执行的第一个文件。

.align

start:

.type start,#function //type指定start这个符号是函数类型

.rept 8

mov r0, r0 //空操作，重复八次

.endr

b 1f //跳转

.word 0x016f2818 @ Magic numbers to help the loader

//魔数0x016f2818是在bootloader中用于判断zImage的存在,这是内核和bootloader约定好的。

.word start @ absolute load/run zImage address

.word _edata @ zImage end address

1: mov r7, r1 @ save architecture ID //bootloader 传递过来的r1 r2

mov r8, r2 @ save atags pointer

//r1和r2中分别存放着由bootloader传递过来的architecture ID和指向标记列表的指针

#ifndef __ARM_ARCH_2__

* Booting from Angel - need to enter SVC mode and disable

* FIQs/IRQs (numeric definitions from angel arm.h source).

* We only do this if we were in user mode on entry.

mrs r2, cpsr @ get current mode

tst r2, #3 @ not user?

bne not_angel

mov r0, #0x17 @ angel_SWIreason_EnterSVC

swi 0x123456 @ angel_SWI_ARM

not_angel:

mrs r2, cpsr @ turn off interrupts to

orr r2, r2, #0xc0 @ prevent angel from running

msr cpsr_c, r2 //关闭IRQ FIQ

#else

teqp pc, #0x0c000003 @ turn off interrupts

#endif

.text

adr r0, LC0 //下面有解释

ldmia r0, {r1, r2, r3, r4, r5, r6, ip, sp}

subs r0, r0, r1 @ calculate the delta offset 获取偏移量

@ if delta is zero, we are

beq not_relocated @ running at the address we

@ were linked at.

//如果内核没有进行搬移，就跳转。一般是需要的

* We're running at a different address. We need to fix

* up various pointers:

* r5 - zImage base address

* r6 - GOT start

* ip - GOT end

add r5, r5, r0 //修改内核映像基地址

add r6, r6, r0 //修改got表的起始和结束地址

add ip, ip, r0

其中LC0表是链接文件（arch/arm/boot/compressed/vmlinux.lds）的各段入口。源码如下：

OUTPUT_ARCH(arm)

ENTRY(_start)

SECTIONS

{

. = 0;

_text = .;

.text : {

_start = .;

*(.start)

*(.text)

*(.text.*)

*(.fixup)

*(.gnu.warning)

*(.rodata)

*(.rodata.*)

*(.glue_7)

*(.glue_7t)

*(.piggydata)

. = ALIGN(4);

}

_etext = .;

_got_start = .;

.got : { *(.got) }

_got_end = .;

.got.plt : { *(.got.plt) }

.data : { *(.data) }

_edata = .;

. = ALIGN(4);

__bss_start = .;

.bss : { *(.bss) }

_end = .;

.stack (NOLOAD) : { *(.stack) }

.stab 0 : { *(.stab) }

.stabstr 0 : { *(.stabstr) }

.stab.excl 0 : { *(.stab.excl) }

.stab.exclstr 0 : { *(.stab.exclstr) }

.stab.index 0 : { *(.stab.index) }

.stab.indexstr 0 : { *(.stab.indexstr) }

.comment 0 : { *(.comment) }

}

依次是.text .got .data .bss .stack .stab，另外连接地址都是位置无关的，即都是以0地址为偏移的。

而此时内核已被bootloader搬移，链接地址应该加上这个偏移。

#ifndef CONFIG_ZBOOT_ROM

* If we're running fully PIC === CONFIG_ZBOOT_ROM = n,

* we need to fix up pointers into the BSS region.

* r2 - BSS start

* r3 - BSS end

* sp - stack pointer

add r2, r2, r0 //修改bss段和堆栈的地址

add r3, r3, r0

add sp, sp, r0

* Relocate all entries in the GOT table.

1: ldr r1, [r6, #0] @ relocate entries in the GOT 重定位got表

add r1, r1, r0 @ table. This fixes up the

str r1, [r6], #4 @ C references.

cmp r6, ip

blo 1b //bhs 大于等于跳转，bls小于等于跳转，blo不相等跳转

#else

* Relocate entries in the GOT table. We only relocate

* the entries that are outside the (relocated) BSS region.

1: ldr r1, [r6, #0] @ relocate entries in the GOT

cmp r1, r2 @ entry < bss_start ||

cmphs r3, r1 @ _end < entry

addlo r1, r1, r0 @ table. This fixes up the

str r1, [r6], #4 @ C references.

cmp r6, ip

blo 1b

#endif

not_relocated: mov r0, #0

1: str r0, [r2], #4 @ clear bss 清bss段，所有arm程序都需要做这些

str r0, [r2], #4

cmp r2, r3

blo 1b

* The C runtime environment should now be setup

* sufficiently. Turn the cache on, set up some

* pointers, and start decompressing.

bl cache_on //打开cache

mov r1, sp @ malloc space above stack

add r2, sp, #0x10000 @ 64k max 解压函数需要的内存缓存

* Check to see if we will overwrite ourselves.

* r4 = final kernel address

* r5 = start of this image

* r2 = end of malloc space (and therefore this image)

* We basically want:

* r4 >= r2 -> OK

* r4 + image length <= r5 -> OK

cmp r4, r2 //r4现在在.text，而r2在.stack地址的后面，那个刚分配给解压函数的64K，显然r2>r4，所以不跳转。

bhs wont_overwrite //branch if higher or same

sub r3, sp, r5 @ > compressed kernel size 得到映像大小

add r0, r4, r3, lsl #2 @ allow for 4x expansion 将这个大小乘以4

cmp r0, r5

bls wont_overwrite

mov r5, r2 @ decompress after malloc space

mov r0, r5 //r5为映像解压后的起始地址，紧接着r2

mov r3, r7 //r7中存放的是architecture ID

bl decompress_kernel

add r0, r0, #127 + 128 @ alignment + stack

bic r0, r0, #127 @ align the kernel length 清除127位，与上面的128字节对齐

其中 decompress_kernel解压函数在arch/arm/boot/compressed/misc.c中。

ulg

decompress_kernel(ulg output_start, ulg free_mem_ptr_p, ulg free_mem_ptr_end_p,

int arch_id)

{

output_data = (uch *)output_start; /* Points to kernel start */解压后内核输出的起始地址

free_mem_ptr = free_mem_ptr_p; 解压函数缓存的起始地址

free_mem_ptr_end = free_mem_ptr_end_p; 解压函数缓存的结束地址

__machine_arch_type = arch_id; 体系结构ID

arch_decomp_setup();

makecrc();

putstr("Uncompressing Linux...");

gunzip();

putstr(" done, booting the kernel.\n"); //这个打印信息是不是很熟悉啊

return output_ptr;

}

此时，

r0：解压后内核的长度，后存放映像解压后的起始地址 mov r0, r5，重新指定为解压后内核的长度

r1：解压函数缓存的起始地址

r2：解压函数缓存的结束地址

r3：原来存映像大小，后来存放体系结构ID mov r3, r7

r4：内核执行地址

r5：映像解压后的起始地址 mov r5, r2

r6：处理器ID

r7：体系结构ID

r8：标记列表地址

r9-r14：corrupted

所以decompress_kernel函数带入的参数就是r0-r3

add r1, r5, r0 @ end of decompressed kernel r1：解压后内核代码的结束地址

adr r2, reloc_start //设定重定义的开始地址和结束地址

ldr r3, LC1

add r3, r2, r3

1: ldmia r2!, {r9 - r14} @ copy relocation code 拷贝内核重定位的代码，不至于被覆盖

stmia r1!, {r9 - r14}

ldmia r2!, {r9 - r14}

stmia r1!, {r9 - r14}

cmp r2, r3

blo 1b

add sp, r1, #128 @ relocate the stack 改变堆栈指针

bl cache_clean_flush 刷新cache

add pc, r5, r0 @ call relocation code 唤醒内核重定义的代码

* We're not in danger of overwriting ourselves. Do this the simple way.

* r4 = kernel execution address

* r7 = architecture ID

wont_overwrite: mov r0, r4 //假如内核映像没有被bootloader移动过，就会跳到此处

mov r3, r7

bl decompress_kernel

b call_kernel

.align 5

reloc_start: add r9, r5, r0 //r0+r5 = 解压后内核代码的结束地址加上128字节栈空间

sub r9, r9, #128 @ do not copy the stack

debug_reloc_start

mov r1, r4

.rept 4

ldmia r5!, {r0, r2, r3, r10 - r14} @ relocate kernel

stmia r1!, {r0, r2, r3, r10 - r14}

.endr

cmp r5, r9

blo 1b

add sp, r1, #128 @ relocate the stack

debug_reloc_end

call_kernel: bl cache_clean_flush

bl cache_off //关闭cache

mov r0, #0 @ must be zero 清零r0

mov r1, r7 @ restore architecture number

mov r2, r8 @ restore atags pointer

mov pc, r4 @ call kernel

//内核映像zImage是由压缩后的内核piggy.o，加上一段初始化及解压功能的代码组成的。

linux/arch/arm/kernel/head.S是linux内核映像解压后执行的第一个文件。

//PAGE_OFFSET = 0xc0000000; TEXT_OFFSET = 0x00008000;

//PHYS_OFFSET = 0xa0000000;

#define KERNEL_RAM_VADDR (PAGE_OFFSET + TEXT_OFFSET)

#define KERNEL_RAM_PADDR (PHYS_OFFSET + TEXT_OFFSET)

链接脚本文件arch/arm/kernel/vmlinux.lds指定了编译时程序段存放的位置。

OUTPUT_ARCH(arm)

ENTRY(stext) //这里对应head.S中的ENTRY(stext)

jiffies = jiffies_64;

SECTIONS

{

. = (0xc0000000) + 0x00008000;

.text.head : {

_stext = .;

_sinittext = .;

*(.text.head)

}

.init : { /* Init code and data */

*(.init.text) *(.cpuinit.text) *(.meminit.text)

_einittext = .;

__proc_info_begin = .;

*(.proc.info.init)

__proc_info_end = .;

__arch_info_begin = .;

*(.arch.info.init)

__arch_info_end = .;

__tagtable_begin = .;

*(.taglist.init)

__tagtable_end = .;

. = ALIGN(16);

__setup_start = .;

*(.init.setup)

__setup_end = .;

__early_begin = .;

*(.early_param.init)

__early_end = .;

__initcall_start = .;

……

}

.section是GNU ASM的语法。格式如下：

.section name[,"flags"[,@type]] 其中，name是必须的，flags是可选。

"ax"表示：a为section is allocatable,x为executable。

.section ".text.head", "ax"

.type stext, %function

ENTRY(stext) //kernel的入口点函数

//MSR:是ARM汇编指令，用来将数据copy到status register寄存器中。cpsr_c表示要操作

msr cpsr_c, #PSR_F_BIT | PSR_I_BIT | SVC_MODE @ ensure svc mode 禁止FIQ、IRQ，设定SVC模式

@ and irqs disabled

mrc p15, 0, r9, c0, c0 @ get processor id //可以去查看arm CPU ID各字段的涵义

bl __lookup_processor_type @ r5=procinfo r9=cpuid //检测cpu类型，如果支持，r5返回一个用来描述处理器结构体的地址，否则返回0.

movs r10, r5 @ invalid processor (r5=0)?

beq __error_p @ yes, error 'p'

bl __lookup_machine_type @ r5=machinfo //检测开发板类型，即machine ID，如果支持，r5返回一个用来描述开发板结构体的地址，否则返回0.

movs r8, r5 @ invalid machine (r5=0)?

beq __error_a @ yes, error 'a'

bl __vet_atags //检测bootloader传入的参数列表atags的合法性

bl __create_page_tables //创建初始页表

* The following calls CPU specific code in a position independent

* manner. See arch/arm/mm/proc-*.S for details. r10 = base of

* xxx_proc_info structure selected by __lookup_machine_type

* above. On return, the CPU will be ready for the MMU to be

* turned on, and r0 will hold the CPU control register value.

ldr r13, __switch_data @ address to jump to after //将列表__switch_data存到r13中，在head-common.S中。

@ mmu has been enabled

adr lr, __enable_mmu @ return (PIC) address //使能mmu

add pc, r10, #PROCINFO_INITFUNC

//r10中存放的基地址是从__lookup_processor_type中得到的，如上面movs r10, r5

ENTRY(secondary_startup)

……

第二个cpu的检测和设置。

下面主要来说说 __lookup_processor_type和 __lookup_machine_type。它们都在/arch/arm/kernel/head-common.S实现。

__lookup_processor_type 检测CPU

内核支持的，每一种CPU类型都由结构体proc_info_list来描述，在linux/include/asm-arm/procinfo.h定义

struct proc_info_list {

unsigned int cpu_val;

unsigned int cpu_mask;

unsigned long __cpu_mm_mmu_flags; /* used by head.S */

unsigned long __cpu_io_mmu_flags; /* used by head.S */

unsigned long __cpu_flush; /* used by head.S */

const char *arch_name;

const char *elf_name;

unsigned int elf_hwcap;

const char *cpu_name;

struct processor *proc;

struct cpu_tlb_fns *tlb;

struct cpu_user_fns *user;

struct cpu_cache_fns *cache;

};

对于我们的CPU来说，其对应的结构体在文件arch/arm/mm/proc-xsc3.S中

.section ".proc.info.init", #alloc, #execinstr

.type __xsc3_proc_info,#object

__xsc3_proc_info:

.long 0x69056000

.long 0xffffe000

.long PMD_TYPE_SECT | \

PMD_SECT_BUFFERABLE | \

PMD_SECT_CACHEABLE | \

PMD_SECT_AP_WRITE | \

PMD_SECT_AP_READ

.long PMD_TYPE_SECT | \

PMD_SECT_AP_WRITE | \

PMD_SECT_AP_READ

b __xsc3_setup

.long cpu_arch_name

.long cpu_elf_name

.long HWCAP_SWP|HWCAP_HALF|HWCAP_THUMB|HWCAP_FAST_MULT|HWCAP_EDSP

.long cpu_xsc3_name

.long xsc3_processor_functions

.long v4wbi_tlb_fns

.long xsc3_mc_user_fns

.long xsc3_cache_fns

.size __xsc3_proc_info, . - __xsc3_proc_info

不同的proc_info_list结构被用来支持不同的CPU，它们都定义在“.proc.info.init”段中。在链接文件arch/arm/kernel/vmlinux.lds中可知，

__proc_info_begin = .;

*(.proc.info.init)

__proc_info_end = .;

所有CPU类型对应的被初始化的proc_info_list结构体都放在__proc_info_begin和__proc_info_end之间。

* Read processor ID register (CP#15, CR0), and look up in the linker-built

* supported processor list. Note that we can't use the absolute addresses

* for the __proc_info lists since we aren't running with the MMU on

* (and therefore, we are not in the correct address space). We have to

* calculate the offset.

* r9 = cpuid

* Returns:

* r3, r4, r6 corrupted

* r5 = proc_info pointer in physical address space

* r9 = cpuid (preserved)

.type __lookup_processor_type, %function

__lookup_processor_type:

adr r3, 3f //r3：标记3处的物理地址 r7：标记3处的虚拟地址

ldmda r3, {r5 - r7} //过后减少装载 ldm是load multiple register的意思，它的作用是将[r3]对应的内存内容存储到r5,r6,r7寄存器中，每传递一次，r3递减4个字节

sub r3, r3, r7 @ get offset between virt&phys //得到虚拟地址和物理地址之间的offset

add r5, r5, r3 @ convert virt addresses to

add r6, r6, r3 @ physical address space 将r5和r6中保存的虚拟地址转变为物理地址

1: ldmia r5, {r3, r4} @ value, mask //r3=cpu_val r4=cpu_mask

and r4, r4, r9 @ mask wanted bits

teq r3, r4

beq 2f //如果匹配成功则返回

//PROC_INFO_SZ (proc_info_list结构的长度，在这等于48)，跳到下一个proc_info_list处

add r5, r5, #PROC_INFO_SZ @ sizeof(proc_info_list)

cmp r5, r6 //判断是否已经到了结构体proc_info_list存放区域的末尾__proc_info_end

blo 1b

mov r5, #0 @ unknown processor

2: mov pc, lr //子程序返回

* This provides a C-API version of the above function.

ENTRY(lookup_processor_type)

stmfd sp!, {r4 - r7, r9, lr}

mov r9, r0

bl __lookup_processor_type

mov r0, r5

ldmfd sp!, {r4 - r7, r9, pc}

* Look in include/asm-arm/procinfo.h and arch/arm/kernel/arch.[ch] for

* more information about the __proc_info and __arch_info structures.

.long __proc_info_begin

.long __proc_info_end

3: .long . //“.”表示当前这行代码编译链接后的虚拟地址

.long __arch_info_begin

.long __arch_info_end

__lookup_machine_type 检测开发板

与lookup_processor_type类似，每一个CPU平台都可能有其不一样的结构体，描述这个平台的结构体是machine_desc。这个结构体在文件/include/asm/mach/arch.h中定义

struct machine_desc {

* Note! The first four elements are used

* by assembler code in head.S, head-common.S

unsigned int nr; /* architecture number */

unsigned int phys_io; /* start of physical io */

unsigned int io_pg_offst; /* byte offset for io

* page tabe entry */

const char *name; /* architecture name */

unsigned long boot_params; /* tagged list */

unsigned int video_start; /* start of video RAM */

unsigned int video_end; /* end of video RAM */

unsigned int reserve_lp0 :1; /* never has lp0 */

unsigned int reserve_lp1 :1; /* never has lp1 */

unsigned int reserve_lp2 :1; /* never has lp2 */

unsigned int soft_reboot :1; /* soft reboot */

void (*fixup)(struct machine_desc *,

struct tag *, char **,

struct meminfo *);

void (*map_io)(void);/* IO mapping function */

void (*init_irq)(void);

struct sys_timer *timer; /* system tick timer */

void (*init_machine)(void);

};

对应的结构在文件arch/arm/mach-pxa/littleton.c

MACHINE_START(LITTLETON, "Marvell Form Factor Development Platform (aka Littleton)")

.phys_io = 0x40000000,

.boot_params = 0xa0000100,

.io_pg_offst = (io_p2v(0x40000000) >> 18) & 0xfffc,

.map_io = pxa_map_io,

.init_irq = pxa3xx_init_irq,

.timer = &pxa_timer,

.init_machine = littleton_init,

MACHINE_END

内核中对于每种支持的开发板都会使用宏MACHINE_START、MACHINE_END来定义一个machine_desc结构，宏MACHINE_START的具体定义也在文件/include/asm/mach/arch.h中。

#define MACHINE_START(_type,_name) \

static const struct machine_desc __mach_desc_##_type \

__used \

__attribute__((__section__(".arch.info.init"))) = { \

.nr = MACH_TYPE_##_type, \

.name = _name,

#define MACHINE_END \

};

#endif

* Lookup machine architecture in the linker-build list of architectures.

* Note that we can't use the absolute addresses for the __arch_info

* lists since we aren't running with the MMU on (and therefore, we are

* not in the correct address space). We have to calculate the offset.

* r1 = machine architecture number

* Returns:

* r3, r4, r6 corrupted

* r5 = mach_info pointer in physical address space

.type __lookup_machine_type, %function

__lookup_machine_type:

adr r3, 3b

ldmia r3, {r4, r5, r6}

sub r3, r3, r4 @ get offset between virt&phys

add r5, r5, r3 @ convert virt addresses to

add r6, r6, r3 @ physical address space

1: ldr r3, [r5, #MACHINFO_TYPE] @ get machine type

teq r3, r1 @ matches loader number?

beq 2f @ found

add r5, r5, #SIZEOF_MACHINE_DESC @ next machine_desc

cmp r5, r6

blo 1b

mov r5, #0 @ unknown machine

2: mov pc, lr

* This provides a C-API version of the above function.

ENTRY(lookup_machine_type)

stmfd sp!, {r4 - r6, lr}

mov r1, r0

bl __lookup_machine_type

mov r0, r5

ldmfd sp!, {r4 - r6, pc}

__vet_atags 检测参数列表

//检查bootloader传入的参数列表atags的合法性。

先看看结构体在include/asm-arm/setup.h

struct tag {

struct tag_header hdr;

union {

struct tag_core core;

struct tag_mem32 mem;

struct tag_videotext videotext;

struct tag_ramdisk ramdisk;

struct tag_initrd initrd;

struct tag_serialnr serialnr;

struct tag_revision revision;

struct tag_videolfb videolfb;

struct tag_cmdline cmdline;

* Acorn specific

struct tag_acorn acorn;

* DC21285 specific

struct tag_memclk memclk;

} u;

};

struct tag_header {

__u32 size;

__u32 tag;

};

//其中 size：表示整个 tag 结构体的大小(用字的个数来表示，而不是字节的个数)，等于

tag_header的大小加上 u联合体的大小。

#define ATAG_CORE 0x54410001 atag开始

#define ATAG_NONE 0x00000000 atag结束

#define ATAG_CORE_SIZE ((2*4 + 3*4) >> 2)

/* Determine validity of the r2 atags pointer. The heuristic requires

* that the pointer be aligned, in the first 16k of physical RAM and

* that the ATAG_CORE marker is first and present. Future revisions

* of this function may be more lenient with the physical address and

* may also be able to move the ATAGS block if necessary.

* r8 = machinfo

* Returns:

* r2 either valid atags pointer, or zero

* r5, r6 corrupted

.type __vet_atags, %function

__vet_atags:

tst r2, #0x3 @ aligned? //r2指向该参数链表的起始位置，此处判断它是否字对齐

bne 1f

ldr r5, [r2, #0] @ is first tag ATAG_CORE? 获取第一个tag结构的size

subs r5, r5, #ATAG_CORE_SIZE //比较长度是否有效

bne 1f

ldr r5, [r2, #4] //获取第一个tag结构体的标记

ldr r6, =ATAG_CORE

cmp r5, r6 //判断第一个tag标记是不是ATAG_CORE

bne 1f

mov pc, lr @ atag pointer is ok

1: mov r2, #0

mov pc, lr

__create_page_tables 建立页表

* Setup the initial page tables. We only setup the barest

* amount which are required to get the kernel running, which

* generally means mapping in the kernel code.

* r8 = machinfo

* r9 = cpuid

* r10 = procinfo

* Returns:

* r0, r3, r6, r7 corrupted

* r4 = physical page table address

.type __create_page_tables, %function

__create_page_tables:

pgtbl r4 @ page table address 转换表的物理基地址

* Clear the 16K level 1 swapper page table //为内核代码存储区域创建页表，首先将内核起始地址-0x4000~内核起始地址之间的16K 存储器清0，将创建的页表存于此处。

mov r0, r4

mov r3, #0

add r6, r0, #0x4000

1: str r3, [r0], #4

str r3, [r0], #4

teq r0, r6

bne 1b

ldr r7, [r10, #PROCINFO_MM_MMUFLAGS] @ mm_mmuflags //从proc_info_list结构中获取字段__cpu_mm_mmu_flags，该字段包含了存储空间访问权限等

* Create identity mapping for first MB of kernel to

* cater for the MMU enable. This identity mapping

* will be removed by paging_init(). We use our current program

* counter to determine corresponding section base address.

mov r6, pc, lsr #20 @ start of kernel section

orr r3, r7, r6, lsl #20 @ flags + kernel base

str r3, [r4, r6, lsl #2] @ identity mapping

* Now setup the pagetables for our kernel direct

* mapped region.

add r0, r4, #(KERNEL_START & 0xff000000) >> 18

str r3, [r0, #(KERNEL_START & 0x00f00000) >> 18]! r0存放转换表的起始地址

ldr r6, =(KERNEL_END - 1) //获取内核结束地址

add r0, r0, #4 //计算第一个地址条目存放的地址

add r6, r4, r6, lsr #18 //计算最好一个地址条目存放的位置

1: cmp r0, r6

add r3, r3, #1 << 20

strls r3, [r0], #4

bls 1b

#ifdef CONFIG_XIP_KERNEL //如果是XIP就进行以下映射，这只是将内核代码存储的空间重新映射

* Map some ram to cover our .data and .bss areas.

orr r3, r7, #(KERNEL_RAM_PADDR & 0xff000000)

.if (KERNEL_RAM_PADDR & 0x00f00000)

orr r3, r3, #(KERNEL_RAM_PADDR & 0x00f00000)

.endif

add r0, r4, #(KERNEL_RAM_VADDR & 0xff000000) >> 18

str r3, [r0, #(KERNEL_RAM_VADDR & 0x00f00000) >> 18]!

ldr r6, =(_end - 1)

add r0, r0, #4

add r6, r4, r6, lsr #18

1: cmp r0, r6

add r3, r3, #1 << 20

strls r3, [r0], #4

bls 1b

#endif

* Then map first 1MB of ram in case it contains our boot params.映射开始的1M空间

add r0, r4, #PAGE_OFFSET >> 18

orr r6, r7, #(PHYS_OFFSET & 0xff000000)

.if (PHYS_OFFSET & 0x00f00000)

orr r6, r6, #(PHYS_OFFSET & 0x00f00000)

.endif

str r6, [r0]

#ifdef CONFIG_DEBUG_LL //下面是为了调试而做的相关映射，可以跳过

ldr r7, [r10, #PROCINFO_IO_MMUFLAGS] @ io_mmuflags

* Map in IO space for serial debugging.

* This allows debug messages to be output

* via a serial console before paging_init.

ldr r3, [r8, #MACHINFO_PGOFFIO]

add r0, r4, r3

rsb r3, r3, #0x4000 @ PTRS_PER_PGD*sizeof(long)

cmp r3, #0x0800 @ limit to 512MB

movhi r3, #0x0800

add r6, r0, r3

ldr r3, [r8, #MACHINFO_PHYSIO]

orr r3, r3, r7

1: str r3, [r0], #4

add r3, r3, #1 << 20

teq r0, r6

bne 1b

#if defined(CONFIG_ARCH_NETWINDER) || defined(CONFIG_ARCH_CATS)

* If we're using the NetWinder or CATS, we also need to map

* in the 16550-type serial port for the debug messages

add r0, r4, #0xff000000 >> 18

orr r3, r7, #0x7c000000

str r3, [r0]

#endif

#ifdef CONFIG_ARCH_RPC

* Map in screen at 0x02000000 & SCREEN2_BASE

* Similar reasons here - for debug. This is

* only for Acorn RiscPC architectures.

add r0, r4, #0x02000000 >> 18

orr r3, r7, #0x02000000

str r3, [r0]

add r0, r4, #0xd8000000 >> 18

str r3, [r0]

#endif

mov pc, lr

.ltorg

setup 禁止cache

在head.S中

add pc, r10, #PROCINFO_INITFUNC 就是调用__xsc3_setup。

.type __xsc3_setup, #function

__xsc3_setup:

mov r0, #PSR_F_BIT|PSR_I_BIT|SVC_MODE

msr cpsr_c, r0

mcr p15, 0, ip, c7, c7, 0 @ invalidate L1 caches and BTB

mcr p15, 0, ip, c7, c10, 4 @ data write barrier

mcr p15, 0, ip, c7, c5, 4 @ prefetch flush

mcr p15, 0, ip, c8, c7, 0 @ invalidate I and D TLBs

#if L2_CACHE_ENABLE

orr r4, r4, #0x18 @ cache the page table in L2

#endif

mcr p15, 0, r4, c2, c0, 0 @ load page table pointer

mov r0, #0 @ don't allow CP access

mcr p15, 0, r0, c15, c1, 0 @ write CP access register

mrc p15, 0, r0, c1, c0, 1 @ get auxiliary control reg

and r0, r0, #2 @ preserve bit P bit setting

#if L2_CACHE_ENABLE

orr r0, r0, #(1 << 10) @ enable L2 for LLR cache

#endif

mcr p15, 0, r0, c1, c0, 1 @ set auxiliary control reg

adr r5, xsc3_crval

ldmia r5, {r5, r6}

mrc p15, 0, r0, c1, c0, 0 @ get control register

bic r0, r0, r5 @ ..V. ..R. .... ..A.

orr r0, r0, r6 @ ..VI Z..S .... .C.M (mmu)

@ ...I Z..S .... .... (uc)

#if L2_CACHE_ENABLE

orr r0, r0, #0x04000000 @ L2 enable

#endif

mov pc, lr //跳到adr lr, __enable_mmu

.size __xsc3_setup, . - __xsc3_setup

.type xsc3_crval, #object

xsc3_crval:

crval clear=0x04002202, mmuset=0x00003905, ucset=0x00001900

__INITDATA

__enable_mmu 使能mmu

* Setup common bits before finally enabling the MMU. Essentially

* this is just loading the page table pointer and domain access

* registers.

.type __enable_mmu, %function

__enable_mmu:

#ifdef CONFIG_ALIGNMENT_TRAP

orr r0, r0, #CR_A

#else

bic r0, r0, #CR_A

#endif

#ifdef CONFIG_CPU_DCACHE_DISABLE

bic r0, r0, #CR_C //禁止数据cache

#endif

#ifdef CONFIG_CPU_BPREDICT_DISABLE

bic r0, r0, #CR_Z

#endif

#ifdef CONFIG_CPU_ICACHE_DISABLE

bic r0, r0, #CR_I //禁止指令cache

#endif

mov r5, #(domain_val(DOMAIN_USER, DOMAIN_MANAGER) | \

domain_val(DOMAIN_KERNEL, DOMAIN_MANAGER) | \

domain_val(DOMAIN_TABLE, DOMAIN_MANAGER) | \

domain_val(DOMAIN_IO, DOMAIN_CLIENT))

mcr p15, 0, r5, c3, c0, 0 @ load domain access register //将访问权限写入协处理器

mcr p15, 0, r4, c2, c0, 0 @ load page table pointer //将页表基地址写入基址寄存器C2

b __turn_mmu_on

* Enable the MMU. This completely changes the structure of the visible

* memory space. You will not be able to trace execution through this.

* If you have an enquiry about this, *please* check the linux-arm-kernel

* mailing list archives BEFORE sending another post to the list.

* r0 = cp#15 control register

* r13 = *virtual* address to jump to upon completion

* other registers depend on the function called upon completion

.align 5

.type __turn_mmu_on, %function

__turn_mmu_on:

mov r0, r0

mcr p15, 0, r0, c1, c0, 0 @ write control reg 写入懂控制寄存器，打开mmu，打开cache

mrc p15, 0, r3, c0, c0, 0 @ read id reg 读取ID寄存器

mov r3, r3

mov r3, r3 //空操作，等待前面所取得的指令得以执行

mov pc, r13 //程序跳转 ldr r13, __switch_data

__switch_data 数据转换

在文件linux/arch/arm/kernel/head-common.S中：

.type __switch_data, %object //定义一个对象

__switch_data:

.long __mmap_switched //跳转到__mmap_switched

.long __data_loc @ r4 数据存放地址

.long __data_start @ r5 数据开始地址

.long __bss_start @ r6 bss开始地址

.long _end @ r7 bss结束地址，也是内核结束地址

.long processor_id @ r4

.long __machine_arch_type @ r5

.long __atags_pointer @ r6

.long cr_alignment @ r7

.long init_thread_union + THREAD_START_SP @ sp

* The following fragment of code is executed with the MMU on in MMU mode,

* and uses absolute addresses; this is not position independent.

* r0 = cp#15 control register

* r1 = machine ID

* r2 = atags pointer

* r9 = processor ID

.type __mmap_switched, %function

__mmap_switched:

adr r3, __switch_data + 4

ldmia r3!, {r4, r5, r6, r7}

cmp r4, r5 @ Copy data segment if needed

1: cmpne r5, r6

ldrne fp, [r4], #4

strne fp, [r5], #4

bne 1b

mov fp, #0 @ Clear BSS (and zero fp)

1: cmp r6, r7

strcc fp, [r6],#4

bcc 1b

ldmia r3, {r4, r5, r6, r7, sp}

str r9, [r4] @ Save processor ID

str r1, [r5] @ Save machine type

str r2, [r6] @ Save atags pointer

bic r4, r0, #CR_A @ Clear 'A' bit

stmia r7, {r0, r4} @ Save control register values

b start_kernel

小结：

第一阶段主要做以下两个步骤：

1.连接内核时使用的虚拟地址，所以要设置页表，使能mmu，之前要确定是否支持cpu和开发板

2.调用C函数start_kernel的准备工作：复制数据段，清除bss段，设置栈指针，保存processor ID，保存machine type，调用start_kernel。

第一阶段到此结束。

秒客网

linux内核启动流程（上）

相关文章