start_kernel之前的汇编代码分析

Boot中执行下面两句话之后，进入uclinux内核。

theKernel = (void (*)(int, int, unsigned int))((uint32_t)0x08003001);

theKernel(0, 2189, ((uint32_t)0x20000100));

首先来到0x0800 3000处，此时携带有三个参数，R0、R1、R2，分别是0,2189,0x2000 0100.

0x0800 3000对应着下面stext的汇编代码。

代码阅读说明：

① @后面的内容标示是注释语句

② ARM或者THUMB指令的选取，在\include\asm-arm\unified.h中，定义了使用ARM，THUMB为空

③ 偏移量#PROC_INFO_SZ等，在\include\asm\asm-offset.h中宏定义

1.1   head-mommu.S

文件在arch\arm\kernel\head-nommu.S，text.head段，有stext、__after_proc_init两段组成，内核从这里开始启动，然后通过各种调用，最终进入C语言的start_kernel函数，这段代码执行流程如下：

（1）       调用__lookup_processor_type，传入R9（CPU基址寄存器的值），成功后获得当前的proc_info结构体信息，地址放入R10；

（2）       调用__lookup_machine_type，BootLoader传给内核的R1值，成功后获得当前的machine_desc结构体信息，地址放入R8；

（3）       执行__v7m_setup，进行必要的初始化；

（4）       执行__switch_data，并最终跳转到C语言的start_kernel函数。

       .section ".text.head", "ax"

ENTRY(stext)

       cpsid       i                           @ disable interrupts       //cortex-M3特殊指令，关闭所有中断

       ldr   r9, =0xe000ed00                  @ CPUID register address

       ldr   r9, [r9]                         //CPUID基址寄存器，参考手册（周立功）-P80

       bl    __lookup_processor_type             @ r5=procinfo r9=cupid              //head-common.S

       movs       r10, r5                         @ invalid processor (r5=0)?

       beq  __error_p                            @ yes, error ‘p‘

       bl    __lookup_machine_type        @ r5=machinfo

       movs       r8, r5                           @ invalid machine (r5=0)?

       beq  __error_a                     @ yes, error ‘a‘

       badr lr, __after_proc_init              @ return (PIC) address         //提前暂存lr的值

 ARM(   add  pc, r10, #PROCINFO_INITFUNC       )      //R10处偏移16个字节，然后赋给PC

                                                                            //相当于跳转到下面的__v7m_setup

ENDPROC(stext)

__after_proc_init:

       ldr   pc,__switch_data           //将PC 指针赋值到__switch_data标号地址处，实际执行的

ENDPROC(__after_proc_init)      //是在__mmap_switched这个标号处

       .ltorg

#include "head-common.S"          //末尾包含下面的文件

1.2   head-common.S

文件在arch\arm\kernel\head-common.S，有__switch_data、__mmap_switched、__error_p、__error_a、__error、__lookup_processor_type、C语言的lookup_processor_type、__lookup_machine_type  、C语言的lookup_machine_type、__vet_atags等组成，这里只列出上面调用要使用的查找处理器类型和查找机器类型。

_lookup_processor_type:                     //r9是刚从CPU基址寄存器中取出的值

 ARM(   adr   r3, 3f             )      //执行此句后，r3的地址是后面标号3处的地址

 ARM(   ldmda     r3, {r5 - r7}   )//r5,r6,r7依次变为，__proc_info_begin，end，以及

                                                 //标号3处的末尾链接地址

       sub  r3, r3, r7               @ get offset between virt&phys    //这三行执行虚实地址转换

       add  r5, r5, r3               @ convert virt addresses to//r5是proc_info_list结构体地址

       add  r6, r6, r3               @ physical address space       //__proc_info_end的自己

1:    ldmia      r5, {r3, r4}                   @ value, mask              //r3是结构体的val变量

       and  r4, r4, r9               @ mask wanted bits              //r4是结构体的mask变量

       teq   r3, r4

       beq  2f                                                                   //相等转到后面的2标号处

       add  r5, r5, #PROC_INFO_SZ             @ sizeof(proc_info_list)       //宏定义在asm-offset.h

       cmp r5, r6             //结构体可能是个数组，需要全部查找，若r5的地址没有超出end

       blo   1b                  //的地址，则继续转到1处理，若最后没找到，r5变为空

       mov r5, #0                           @ unknown processor

2:    mov pc, lr

ENDPROC(__lookup_processor_type)

ENTRY(lookup_processor_type)

       stmfd      sp!, {r4 - r7, r9, lr}

       mov r9, r0             //提供C语言的API结构，r0是传入的参数

       bl    __lookup_processor_type

       mov r0, r5             //此处的R0是函数的返回值，即传出的参数

       ldmfd      sp!, {r4 - r7, r9, pc}

ENDPROC(lookup_processor_type)

       .long       __proc_info_begin        //arch/arm/kernel/vmlinux.lds.s中定义

       .long       __proc_info_end

3:    .long       .

       .long       __arch_info_begin

       .long       __arch_info_end

/*

 * Lookup machine architecture in the linker-build list of architectures.

 * Note that we can‘t use the absolute addresses for the __arch_info

 * lists since we aren‘t running with the MMU on (and therefore, we are

 * not in the correct address space).  We have to calculate the offset.

 *

 *  r1 = machine architecture number

 * Returns:

 *  r3, r4, r6 corrupted

 *  r5 = mach_info pointer in physical address space

 */

__lookup_machine_type:

       adr   r3, 3b

       ldmia      r3, {r4, r5, r6}       //r5是__arch_info_begin，r6是end

       sub  r3, r3, r4               @ get offset between virt&phys    //虚实地址转换

       add  r5, r5, r3               @ convert virt addresses to

       add  r6, r6, r3               @ physical address space

1:    ldr   r3, [r5, #MACHINFO_TYPE]      @ get machine type //结构体偏移字节数，见上面的注释

       teq   r3, r1                           @ matches loader number?    //与传递给内核的r1相同

       beq  2f                         @ found                                     //r3就是结构体中第一个变量nr

       add  r5, r5, #SIZEOF_MACHINE_DESC    @ next machine_desc

       cmp r5, r6

       blo   1b

       mov r5, #0                           @ unknown machine

2:    mov pc, lr

ENDPROC(__lookup_machine_type)

/*

 * This provides a C-API version of the above function.

 */

ENTRY(lookup_machine_type)

       stmfd      sp!, {r4 - r6, lr}

       mov r1, r0             //提供C语言的API结构，r0是传入的参数

       bl    __lookup_machine_type

       mov r0, r5             //此处的R0是函数的返回值，即传出的参数

       ldmfd      sp!, {r4 - r6, pc}

ENDPROC(lookup_machine_type)

1.2.1    lookup_processor_type

（1）vmlinux.lds.s

文件在arch\arm\kernel\ vmlinux.lds.s

__proc_info_begin = .;                 //include/asm-arm/procinfo.h中定义

               *(.proc.info.init)

__proc_info_end = .;

__arch_info_begin = .;                 //include/asm-arm/mach/arch.h 中定义

               *(.arch.info.init)

        __arch_info_end = .;

（2）procinfo.h

文件在include/asm-arm/procinfo.h

struct proc_info_list {                   // pro-v7m.S对其实例化

unsigned int           cpu_val;

unsigned int           cpu_mask;

unsigned long        __cpu_mm_mmu_flags; /* used by head.S */

unsigned long        __cpu_io_mmu_flags;    /* used by head.S */

unsigned long        __cpu_flush;          /* used by head.S */

const char              *arch_name;

const char              *elf_name;

unsigned int           elf_hwcap;

const char              *cpu_name;

struct processor      *proc;

struct cpu_tlb_fns   *tlb;

struct cpu_user_fns *user;

struct cpu_cache_fns      *cache;

};

（3）pro-v7m.S

文件在arch\arm\mm\ pro-v7m.S，内容很多，核心就是.section ".proc.info.init"，其它的都是它这个结构体中得成员，如__v7m_setup、cpu_arch_name、cpu_elf_name、cpu_v7m_name、v7m_processor_functions等。

cpu_v7m_name:

.ascii       "ARMv7-M Processor"

.align

.section ".text.init", #alloc, #execinstr

.type v7m_processor_functions, #object

ENTRY(v7m_processor_functions)

.word      v7m_early_abort

.word      cpu_v7m_proc_init

.word      cpu_v7m_proc_fin

.word      cpu_v7m_reset

.word      cpu_v7m_do_idle

.word      cpu_v7m_dcache_clean_area

.word      cpu_v7m_switch_mm

.word      cpu_v7m_set_pte_ext

.word      pabort_noifar

.size v7m_processor_functions, . - v7m_processor_functions

.type cpu_arch_name, #object

cpu_arch_name:

.asciz      "armv7m"

.size cpu_arch_name, . - cpu_arch_name

.type       cpu_elf_name, #object

cpu_elf_name:

.asciz      "v7m"

.size cpu_elf_name, . - cpu_elf_name

.align

.section ".proc.info.init", #alloc, #execinstr

/*

 * Match any ARMv7-M processor core.

 */

.type       __v7m_proc_info, #object

__v7m_proc_info:          //E000ED00是CPUID基址寄存器，其中[19:16]读作常量F

.long       0x000f0000           @ Required ID value

.long       0x000f0000           @ Mask for ID

.long   0                     @ proc_info_list.__cpu_mm_mmu_flags

.long   0                     @ proc_info_list.__cpu_io_mmu_flags

b     __v7m_setup         @ proc_info_list.__cpu_flush

.long       cpu_arch_name

.long       cpu_elf_name

.long    HWCAP_SWP|HWCAP_HALF|HWCAP_THUMB|HWCAP_FAST_MULT|HWCAP_EDSP

.long       cpu_v7m_name

.long       v7m_processor_functions      @ proc_info_list.proc

.long       0                   @ proc_info_list.tlb

.long       0                   @ proc_info_list.user

.long       0                   @ proc_info_list.cache

.size __v7m_proc_info, . - __v7m_proc_info

1.2.2    lookup_machine_type

（1）arch.h

文件在include/asm-arm/mach/arch.h 

struct machine_desc {                  //在stm3210e_eval.c中实例化

       /*

        * Note! The first four elements are used

        * by assembler code in head.S, head-common.S

        */

       unsigned int           nr;          /* architecture number   */

       unsigned int           phys_io;  /* start of physical io     */

       unsigned int           io_pg_offst;    /* byte offset for io

                                           * page tabe entry  */

       const char              *name;           /* architecture name      */

       unsigned long        boot_params;  /* tagged list          */

       unsigned int           video_start;     /* start of video RAM    */

       unsigned int           video_end;      /* end of video RAM     */

       unsigned int           reserve_lp0 :1;       /* never has lp0      */

       unsigned int           reserve_lp1 :1;       /* never has lp1      */

       unsigned int           reserve_lp2 :1;       /* never has lp2      */

       unsigned int           soft_reboot :1;       /* soft reboot         */

       void               (*fixup)(struct machine_desc *,

                                    struct tag *, char **,

                                    struct meminfo *);

       void               (*map_io)(void);/* IO mapping function     */

       void               (*init_irq)(void);

       struct sys_timer      *timer;           /* system tick timer       */

       void               (*init_machine)(void);

};

/*

 * Set of macros to define architecture features.  This is built into

 * a table by the linker.

 */

#define MACHINE_START(_type,_name)                 \

static const struct machine_desc __mach_desc_##_type       \

 __used                                             \

 __attribute__((__section__(".arch.info.init"))) = {    \

       .nr          = MACH_TYPE_##_type,          \

       .name             = _name,

#define MACHINE_END                          \

};

（2）stm3210e_eval.c

文件在arch\arm\mach-stm3210e_eval\ stm3210e_eval.c

MACHINE_START(STM3210E_EVAL, "STM3210E-EVAL")

       /* Maintainer: MCD Application TEAM */                               /* Status */

       .fixup             = stm3210e_eval_fixup,                             //OK

       .boot_params  = CONFIG_EXTERNAL_RAM_BASE + 0x100,                     //OK

       .init_irq   = nvic_init_irq,                                  //OK

       .timer             = &stm3210e_eval_timer,                                 //OK

       .init_machine  = stm3210e_eval_init,                                //OK

MACHINE_END

（3）match-type.h

文件在include/asm-arm/mach-type.h

#define MACH_TYPE_STM3210E_EVAL        2189

1.3   __v7m_setup

文件在arch\arm\mm\ pro-v7m.S

/*

 * __v7m_setup

 *

 * Initialise TLB, Caches, and MMU state ready to switch the MMU

 * on.  Return in r0 the new CP15 C1 control register setting.

 *

 * We automatically detect if we have a Harvard cache, and use the

 * Harvard cache control instructions insead of the unified cache

 * control instructions.

 *

 * This should be able to cover all ARMv7-M cores.

 *

 * It is assumed that:

 * - cache type register is implemented

 */

__v7m_setup:

    @ Configure the vector table base address    //配置中断向量偏移

    ldr   r0, =0xe000ed08           @ vector table base address

    ldr   r12, =vector_table

    str    r12, [r0]

    @ Lower the priority of the SVC and PendSV exceptions

    ldr   r0, =0xe000ed1c    //设置SVC、PendSV的中断优先级都为128

    mov r5, #0x80000000

    str    r5, [r0]           @ set SVC priority

    ldr   r0, =0xe000ed20

    mov r5, #0x00800000

    str    r5, [r0]           @ set PendSV priority

    @ SVC to run the kernel in this mode

    badr r0, 1f

    ldr   r5, [r12, #11 * 4]   @ read the SVC vector entry

    str    r0, [r12, #11 * 4]   @ write the temporary SVC vector entry

    mov r6, lr                     @ save LR

    mov r7, sp                    @ save SP

#if !defined(CONFIG_XIP_KERNEL)

    ldr   sp, =__v7m_setup_stack_top

#endif

    cpsie       i

    svc   #0                  //呼叫系统服务，权威指南-P182，暂时没找到？

1: cpsid       i

    str    r5, [r12, #11 * 4]   @ restore the original SVC vector entry

    mov lr, r6                     @ restore LR

    mov sp, r7                    @ restore SP

    @ Special-purpose control register

    mov r0, #1                           //还是进入特权级的线程模式，主堆栈？

    msr  control, r0             @ Thread mode has unpriviledged access

    @ Configure the System Control Register

    ldr   r0, =0xe000ed10           @ system control register

    ldr   r12, [r0]                       //不知道是干啥，不确定是否在E000 ED10上

    orr   r12, #1 << 9          @ STKALIGN      

    str    r12, [r0]                //E000 ED14的这个位倒是为了对齐双字节，指南-306

    mov pc, lr                     //之前的lr值赋给PC，即PC转到那里执行

ENDPROC(__v7m_setup)

1.4   __switch_data

文件在arch\arm\kernel\head-common.S

.type       __switch_data, %object

__switch_data:

       .long       __mmap_switched

       .long       __data_loc                    @ r4

       .long       __data_start                  @ r5

       .long       _edata_loc                    @ r6 //added to determine the size of data segment to be copied.

       .long       __bss_start                    @ r6

       .long       _end                            @ r7

       .long       processor_id                 @ r4

       .long       __machine_arch_type           @ r5

       .long       __atags_pointer                    @ r6

#ifdef CONFIG_CPU_CP15

       .long       cr_alignment                 @ r7

#else

       .long       0                          @ r7

#endif

       .long       init_thread_union + THREAD_START_SP @ sp

/*

 * The following fragment of code is executed with the MMU on in MMU mode,

 * and uses absolute addresses; this is not position independent.

 *

 *  r0  = cp#15 control register

 *  r1  = machine ID

 *  r2  = atags pointer

 *  r9  = processor ID

 */

__mmap_switched:        //从__v7m_setup出来以后，转到这里

       adr   r3, __switch_data + 4   

       ldmia      r3!, {r4, r5, r6}

       cmp r4, r5                           @ Copy data segment if needed

       beq  2f

1:    ldr   fp, [r4], #4            //fp是r11

       str    fp, [r5], #4

       cmp r4, r6

       bne  1b

2:    ldmia      r3!,{r6,r7}                   @load __bss_start to r6 and _end to r7

       mov fp, #0                           @ Clear BSS (and zero fp)

1:    cmp r6, r7

       itt    cc                  //itt相当于if-then

       strcc fp, [r6],#4

       bcc  1b

 ARM(   ldmia      r3, {r4, r5, r6, r7, sp})

       str    r9, [r4]                  @ Save processor ID被赋值

       str    r1, [r5]                  @ Save machine type被赋值

       str    r2, [r6]                  @ Save atags pointer被赋值

       bic   r4, r0, #CR_A               @ Clear ‘A‘ bit              这句貌似没用？

#if !defined (CONFIG_CPU_V7M)

       stmia       r7, {r0, r4}                   @ Save control register values

#endif

                                          @2: b     2b

       b     start_kernel            //跳入C语言的函数

ENDPROC(__mmap_switched)

STM32F103 ucLinux开发之二（内核启动汇编代码分析),古老的榕树,5-wow.com