linux start kernel

查找对应arm架构下的arch/arm/kernel/vmlinux.lds.S, 找到入口点ENTRY(stext)，这个stext在arch/arm/kernel/head.S中定义，定义如下：

    .section ".text.head", "ax"
    .type   stext, %function
ENTRY(stext)
    msr cpsr_c, #PSR_F_BIT | PSR_I_BIT | SVC_MODE @ ensure svc mode  @ and irqs disabled
    mrc p15, 0, r9, c0, c0      @ get processor id
    bl  __lookup_processor_type     @ r5=procinfo r9=cpuid
    movs    r10, r5             @ invalid processor (r5=0)?
    beq __error_p           @ yes, error 'p'
    bl  __lookup_machine_type       @ r5=machinfo
    movs    r8, r5              @ invalid machine (r5=0)?
    beq __error_a           @ yes, error 'a'
    bl  __vet_atags
    bl  __create_page_tables

在进入到linux kernel时，需要确认在svc模式下，而且irq和fiq都是disable状态。

1.processor id

mrc p15, 0, r9, c0, c0      @ get processor id

arm的协处理器指令，通过对协处理器15 c0 c0操作获取processor id，存放到r9

    .type   __lookup_processor_type, %function
__lookup_processor_type:
    adr r3, 3f
    ldmda   r3, {r5 - r7}
    sub r3, r3, r7          @ get offset between virt&phys
    add r5, r5, r3          @ convert virt addresses to
    add r6, r6, r3          @ physical address space
1:  ldmia   r5, {r3, r4}            @ value, mask
    and r4, r4, r9          @ mask wanted bits
    teq r3, r4
    beq 2f
    add r5, r5, #PROC_INFO_SZ       @ sizeof(proc_info_list)
    cmp r5, r6
    blo 1b
    mov r5, #0              @ unknown processor
2:  mov pc, lr

/*
 * This provides a C-API version of the above function.
 */
ENTRY(lookup_processor_type)
    stmfd   sp!, {r4 - r7, r9, lr}
    mov r9, r0
    bl  __lookup_processor_type
    mov r0, r5
    ldmfd   sp!, {r4 - r7, r9, pc}

/*
 * Look in include/asm-arm/procinfo.h and arch/arm/kernel/arch.[ch] for
 * more information about the __proc_info and __arch_info structures.
 */
    .long   __proc_info_begin
    .long   __proc_info_end
3:  .long   .
    .long   __arch_info_begin
    .long   __arch_info_end

adr r3, 3f
将前面标号为3位置的地址存放到r3中，这条指令获取的地址是基于pc的偏移地址，也就是运行时的地址，属于位置无关码。

ldmda r3, {r5 - r7}
r3的地址确定，所以指令运行结束后
r5存的是符号__proc_info_begin的地址；
r6存放的是符号__proc_info_end的地址；
r7存放的是符号3f的地址，这里需要注意运行地址和链接地址的区别，r7中的存放的地址是链接时确定的标号地址，r3中存放的是运行时的地址。

__proc_info_begin和__proc_info_end是在arch/arm/kernel/vmlinux.lds.S中的init代码段中：

__proc_info_begin = .;
    *(.proc.info.init)
__proc_info_end = .;

linux kernel中使用struct proc_info_list 描述processor type，
在include/asm-arm/procinfo.h定义

struct proc_info_list {
    unsigned int        cpu_val;
    unsigned int        cpu_mask;
    unsigned long       __cpu_mm_mmu_flags; /* used by head.S */
    unsigned long       __cpu_io_mmu_flags; /* used by head.S */
    unsigned long       __cpu_flush;        /* used by head.S */
    const char      *arch_name;
    const char      *elf_name;
    unsigned int        elf_hwcap;
    const char      *cpu_name;
    struct processor    *proc;
    struct cpu_tlb_fns  *tlb;
    struct cpu_user_fns *user;
    struct cpu_cache_fns    *cache;
};

以arm-926为例，可以在arch/arm/mm/proc-arm926.S中找到定义。

    .section ".proc.info.init", #alloc, #execinstr

    .type   __arm926_proc_info,#object
__arm926_proc_info:
    .long   0x41069260          @ ARM926EJ-S (v5TEJ)
    .long   0xff0ffff0
    .long   PMD_TYPE_SECT | \
        PMD_SECT_BUFFERABLE | \
        PMD_SECT_CACHEABLE | \
        PMD_BIT4 | \
        PMD_SECT_AP_WRITE | \
        PMD_SECT_AP_READ
    .long   PMD_TYPE_SECT | \
        PMD_BIT4 | \
        PMD_SECT_AP_WRITE | \
        PMD_SECT_AP_READ
    b   __arm926_setup
    .long   cpu_arch_name
    .long   cpu_elf_name
    .long   HWCAP_SWP|HWCAP_HALF|HWCAP_THUMB|HWCAP_FAST_MULT|HWCAP_EDSP|HWCAP_JAVA
    .long   cpu_arm926_name
    .long   arm926_processor_functions
    .long   v4wbi_tlb_fns
    .long   v4wb_user_fns
    .long   arm926_cache_fns
    .size   __arm926_proc_info, . - __arm926_proc_info

从上述代码中可以看到__arm926_proc_info被放在“.proc.info.init”段当中。

继续分析__lookup_processor_type，
sub r3, r3, r7
上面的分析我们可以知道r3中存储的是3f处的物理地址，而r7存储的是3f处的虚拟地址，这一行是计算当前程序运行的物理地址和虚拟地址的差值,将其保存到r3中。

    add r5, r5, r3          @ convert virt addresses to
    add r6, r6, r3          @ physical address space

将r5，r6存储的虚拟地址转换成物理地址，

    ldmia   r5, {r3, r4}            @ value, mask
    and r4, r4, r9          @ mask wanted bits
    teq r3, r4
    beq 2f
    add r5, r5, #PROC_INFO_SZ       @ sizeof(proc_info_list)
    cmp r5, r6
    blo 1b
    mov r5, #0              @ unknown processor
2:  mov pc, lr

对照struct proc_info_list结构体定义，可以知道r3，r4分别保存__arm926_proc_info中的cpu_val和cpu_mask;

r9中存储了processor id，与r4的cpu_mask进行逻辑与得到我们需要的值，然后和r3的cpu_val进行比较，如果相等则找到对应的processor id，然后返回。

如果没有找到，则继续寻找比较下一个proc_info，直到__proc_info_end结束，然后设置r5为0并返回，

    movs    r10, r5             @ invalid processor (r5=0)?
    beq __error_p           @ yes, error 'p'

如果r5为0，则跳转至__error_p错误处理。

2. machinfo

看完processor id，我们再来看看machinfo，linux kernel使用struct machine_desc结构体描述machine type，通过MACHINE_START来定义，例如：

MACHINE_START(SMDK2410, "SMDK2410") /* @TODO: request a new identifier and switch
                    * to SMDK2410 */
    /* Maintainer: Jonas Dietsche */
    .phys_io    = S3C2410_PA_UART,
    .io_pg_offst    = (((u32)S3C24XX_VA_UART) >> 18) & 0xfffc,
    .boot_params    = S3C2410_SDRAM_PA + 0x100,
    .map_io     = smdk2410_map_io,
    .init_irq   = s3c24xx_init_irq,
    .init_machine   = smdk2410_init,
    .timer      = &s3c24xx_timer,
MACHINE_END

__lookup_machine_type的汇编函数实现，
在arch/arm/kernel/head-common.S中定义。

    .long   __proc_info_begin
    .long   __proc_info_end
3:  .long   .
    .long   __arch_info_begin
    .long   __arch_info_end

/*
 * Lookup machine architecture in the linker-build list of architectures.
 * Note that we can't use the absolute addresses for the __arch_info
 * lists since we aren't running with the MMU on (and therefore, we are
 * not in the correct address space).  We have to calculate the offset.
 *
 *  r1 = machine architecture number
 * Returns:
 *  r3, r4, r6 corrupted
 *  r5 = mach_info pointer in physical address space
 */
    .type   __lookup_machine_type, %function
__lookup_machine_type:
    adr r3, 3b
    ldmia   r3, {r4, r5, r6}
    sub r3, r3, r4          @ get offset between virt&phys
    add r5, r5, r3          @ convert virt addresses to
    add r6, r6, r3          @ physical address space
1:  ldr r3, [r5, #MACHINFO_TYPE]    @ get machine type
    teq r3, r1              @ matches loader number?
    beq 2f              @ found
    add r5, r5, #SIZEOF_MACHINE_DESC    @ next machine_desc
    cmp r5, r6
    blo 1b
    mov r5, #0              @ unknown machine
2:  mov pc, lr

和分析processor type类似，
adr r3, 3b
把3b处的地址存入r3中，此处是物理地址；

ldmia r3, {r4, r5, r6}
把3b处开始的连续地址即3b处的地址，__arch_info_begin，__arch_info_end依次存入r4，r5，r6；

sub r3, r3, r4          @ get offset between virt&phys
add r5, r5, r3          @ convert virt addresses to
add r6, r6, r3          @ physical address space

计算物理地址和虚拟地址的偏移，并将r5，r6的虚拟地址转换为物理地址

1:  ldr r3, [r5, #MACHINFO_TYPE]    @ get machine type
    teq r3, r1              @ matches loader number?
    beq 2f              @ found
    add r5, r5, #SIZEOF_MACHINE_DESC    @ next machine_desc
    cmp r5, r6
    blo 1b
    mov r5, #0              @ unknown machine
2:  mov pc, lr

获取machine_desc结构成员nr，并和r1进行比较，其中r1是uboot调用kernel入口地址时传入的参数。如果找到匹配直接返回，如果在“arch.info.init”段中都找不到，那就设置r5为0，然后返回进入错误处理。

3. vet_atags

检测bootloader传入参数链表atags的合法性。

    .type   __vet_atags, %function
__vet_atags:
    tst r2, #0x3            @ aligned?
    bne 1f

    ldr r5, [r2, #0]            @ is first tag ATAG_CORE?
    subs    r5, r5, #ATAG_CORE_SIZE
    bne 1f
    ldr r5, [r2, #4]
    ldr r6, =ATAG_CORE
    cmp r5, r6
    bne 1f

    mov pc, lr              @ atag pointer is ok

1:  mov r2, #0
    mov pc, lr

首先检测参数链表指针是否对齐，然后检测第一个tag长度是否合法，是不是ATAG_CORE，如果正常直接返回，如果有其中某一项不正常，则将参数设置为0然后返回。

相关结构定义如下：

struct tag {
    struct  tag_header  hdr;
    union {
        struct tag_core  core;
        struct tag_mem32   mem;
        struct tag_videotext videotext;
        struct tag_ramdisk  ramdisk;
        struct tag_initrd     initrd;
        struct tag_serialnr     serialnr;
        struct tag_revision  revision;
        struct tag_videolfb  videolfb;
        struct tag_cmdline  cmdline;
        struct tag_acorn       acorn;
        struct tag_memclk    memclk;
    } u;
};

struct tag_header { 
    u32 size;   
    u32 tag; 
}; 

size=(sizeof(tag->tag_header)+sizeof(tag->u.core))>>2
#define ATAG_CORE_SIZE ((2*4 + 3*4) >> 2)

4.__create_page_tables

首先来看ARM MMU所支持的虚实地址转换机制，下图所示虚地址VA的[20-31]位和CP15 CR2的[14-31]位共同构成一个地址，这个虚拟地址里存放的是一级页表项，表项中section base address对应virtual address的table index，由此找到虚拟地址对应的物理地址。

下面看下代码是如何实现创建页表的，函数定义如下：

    .macro  pgtbl, rd
    ldr \rd, =(KERNEL_RAM_PADDR - 0x4000)
    .endm

    .type   __create_page_tables, %function
__create_page_tables:
    pgtbl   r4              @ page table address 

/*
 * Clear the 16K level 1 swapper page table
 */
    mov r0, r4
    mov r3, #0
    add r6, r0, #0x4000
1:  str r3, [r0], #4
    str r3, [r0], #4
    str r3, [r0], #4
    str r3, [r0], #4
    teq r0, r6
    bne 1b

为页表存放预留16K区域并清零，后面需要通过协处理器指令进行设置。

ldr r7, [r10, #PROCINFO_MM_MMUFLAGS] @ mm_mmuflags

获得proc_info_list的__cpu_mm_mmu_flags的值，并存储到 r7中。

mov r6, pc, lsr #20         @ start of kernel section,
orr r3, r7, r6, lsl #20     @ flags + kernel base
str r3, [r4, r6, lsl #2]        @ identity mapping

通过PC值高12位得到kernel的section基地址，
r3 = r7 | (r6 << 20) @ kernel base + mmu flag
设置页表项，并将该页表项数据存放对应的页表中，具体是 *（r4 + r6 << 2） = r3

    /*
     * Now setup the pagetables for our kernel direct
     * mapped region.
     */
    add r0, r4,  #(KERNEL_START & 0xff000000) >> 18 
    str r3, [r0, #(KERNEL_START & 0x00f00000) >> 18]!

r0 存放转换表的起始位置

    ldr r6, =(KERNEL_END - 1)

r6 存放kernel_end虚拟地址

    add r0, r0, #4

此后依次递增

add r6, r4, r6, lsr #18

计算最后一条存放的地址，存放在r6中

1:      cmp r0, r6
        add r3, r3, #1 << 20
        strls   r3, [r0], #4
        bls 1b

从开始位置到结束，依次填充页表项，一个页表项代表了1MB空间的映射关系。XIP宏相关的映射我们直接跳过。

    /*
     * Then map first 1MB of ram in case it contains our boot params.
     */
    add r0, r4, #PAGE_OFFSET >> 18
    orr r6, r7, #(PHYS_OFFSET & 0xff000000)
    .if (PHYS_OFFSET & 0x00f00000)
    orr r6, r6, #(PHYS_OFFSET & 0x00f00000)
    .endif
    str r6, [r0]

    mov pc, lr
    .ltorg

设置RAM的第一MB虚拟地址的页表，映射完成之后如下图所示

4.调用平台特定的 __cpu_flush 函数

mmu页表配置完成后，在开启mmu前还需要完成很多操作，比如清除ICache，DCache，wrtiebuffer，TLB等，这些都可以通过CP15来完成。

代码如下：

    ldr r13, __switch_data      @ address to jump to after
                        @ mmu has been enabled
    adr lr, __enable_mmu        @ return (PIC) address
    add pc, r10, #PROCINFO_INITFUNC

分别设置sp，lr，pc，注意r10存储的是proc info的基地址， PROCINFO_INITFUNC 宏指xiang的是proc_info_list结构体中的成员函数__cpu_flush，这里也就是 b __arm926_setup函数

    .type   __arm926_setup, #function
__arm926_setup:
    mov r0, #0
    mcr p15, 0, r0, c7, c7      @ invalidate I,D caches on v4
    mcr p15, 0, r0, c7, c10, 4      @ drain write buffer on v4
#ifdef CONFIG_MMU
    mcr p15, 0, r0, c8, c7      @ invalidate I,D TLBs on v4
#endif

    adr r5, arm926_crval
    ldmia   r5, {r5, r6}
    mrc p15, 0, r0, c1, c0      @ get control register v4
    bic r0, r0, r5
    orr r0, r0, r6

    mov pc, lr
    .size   __arm926_setup, . - __arm926_setup

    .type   arm926_crval, #object
arm926_crval:
    crval   clear=0x00007f3f, mmuset=0x00003135, ucset=0x00001134

使数据cache，指令cache无效；使write buffer无效；使数据TLB，指令TLB无效；
获取arm926_crval地址，并存入r5，存入该地址连续8字节数据分别到r5, r6，
r5 = 0x00007f3f， r6 = 0x00003135.
通过cp15获取操作寄存器的值，并对mmu进行设置，然后返回进入__enable_mmu.

    .type   __enable_mmu, %function
__enable_mmu:
    mov r5, #(domain_val(DOMAIN_USER, DOMAIN_MANAGER) | \
              domain_val(DOMAIN_KERNEL, DOMAIN_MANAGER) | \
              domain_val(DOMAIN_TABLE, DOMAIN_MANAGER) | \
              domain_val(DOMAIN_IO, DOMAIN_CLIENT))
    mcr p15, 0, r5, c3, c0, 0       @ load domain access register
    mcr p15, 0, r4, c2, c0, 0       @ load page table pointer
    b   __turn_mmu_on

/*
 * Enable the MMU.  This completely changes the structure of the visible
 * memory space.  You will not be able to trace execution through this.
 * If you have an enquiry about this, *please* check the linux-arm-kernel
 * mailing list archives BEFORE sending another post to the list.
 *
 *  r0  = cp#15 control register
 *  r13 = *virtual* address to jump to upon completion
 *
 * other registers depend on the function called upon completion
 */
    .align  5
    .type   __turn_mmu_on, %function
__turn_mmu_on:
    mov r0, r0
    mcr p15, 0, r0, c1, c0, 0       @ write control reg
    mrc p15, 0, r3, c0, c0, 0       @ read id reg
    mov r3, r3
    mov r3, r3
    mov pc, r13

mmu的具体操作我们不在关心，这里主要看下最后一条指令

mov pc，r13

由此进入__switch_data，看下__switch_data的定义，

    .type   __switch_data, %object
__switch_data:
    .long   __mmap_switched
    .long   __data_loc          @ r4
    .long   __data_start            @ r5
    .long   __bss_start         @ r6
    .long   _end                @ r7
    .long   processor_id            @ r4
    .long   __machine_arch_type     @ r5
    .long   __atags_pointer         @ r6
    .long   cr_alignment            @ r7
    .long   init_thread_union + THREAD_START_SP @ sp

明显可以看出会调用到__mmap_switched.

    .type   __mmap_switched, %function
__mmap_switched:
    adr r3, __switch_data + 4

    ldmia   r3!, {r4, r5, r6, r7}
    cmp r4, r5              @ Copy data segment if needed
1:  cmpne   r5, r6
    ldrne   fp, [r4], #4
    strne   fp, [r5], #4
    bne 1b

    mov fp, #0              @ Clear BSS (and zero fp)
1:  cmp r6, r7
    strcc   fp, [r6],#4
    bcc 1b

    ldmia   r3, {r4, r5, r6, r7, sp}
    str r9, [r4]            @ Save processor ID
    str r1, [r5]            @ Save machine type
    str r2, [r6]            @ Save atags pointer
    bic r4, r0, #CR_A       @ Clear 'A' bit
    stmia   r7, {r0, r4}    @ Save control register values
    b   start_kernel

这里检测data段存储位置和数据开始位置是否不相等，是否需要搬运数据。清除bss段，并保存相关参数，最后进入start_kernel.