start_kernel之前的汇编代码分析
Boot中执行下面两句话之后，进入uclinux内核。
theKernel = (void (*)(int, int, unsigned int))((uint32_t)0x08003001);
theKernel(0, 2189, ((uint32_t)0x20000100));
首先来到0x0800 3000处，此时携带有三个参数，R0、R1、R2，分别是0,2189,0x2000 0100.
0x0800 3000对应着下面stext的汇编代码。
代码阅读说明：
① @后面的内容标示是注释语句
② ARM或者THUMB指令的选取，在\include\asm-arm\unified.h中，定义了使用ARM，THUMB为空
③ 偏移量#PROC_INFO_SZ等，在\include\asm\asm-offset.h中宏定义
1.1 head-mommu.S
文件在arch\arm\kernel\head-nommu.S，text.head段，有stext、__after_proc_init两段组成，内核从这里开始启动，然后通过各种调用，最终进入C语言的start_kernel函数，这段代码执行流程如下：
（1） 调用__lookup_processor_type，传入R9（CPU基址寄存器的值），成功后获得当前的proc_info结构体信息，地址放入R10；
（2） 调用__lookup_machine_type，BootLoader传给内核的R1值，成功后获得当前的machine_desc结构体信息，地址放入R8；
（3） 执行__v7m_setup，进行必要的初始化；
（4） 执行__switch_data，并最终跳转到C语言的start_kernel函数。
.section ".text.head", "ax"
ENTRY(stext)
cpsid i @ disable interrupts //cortex-M3特殊指令，关闭所有中断
ldr r9, =0xe000ed00 @ CPUID register address
ldr r9, [r9] //CPUID基址寄存器，参考手册（周立功）-P80
bl __lookup_processor_type @ r5=procinfo r9=cupid //head-common.S
movs r10, r5 @ invalid processor (r5=0)?
beq __error_p @ yes, error ‘p‘
bl __lookup_machine_type @ r5=machinfo
movs r8, r5 @ invalid machine (r5=0)?
beq __error_a @ yes, error ‘a‘
badr lr, __after_proc_init @ return (PIC) address //提前暂存lr的值
ARM( add pc, r10, #PROCINFO_INITFUNC ) //R10处偏移16个字节，然后赋给PC
//相当于跳转到下面的__v7m_setup
ENDPROC(stext)
__after_proc_init:
ldr pc,__switch_data //将PC 指针赋值到__switch_data标号地址处，实际执行的
ENDPROC(__after_proc_init) //是在__mmap_switched这个标号处
.ltorg
#include "head-common.S" //末尾包含下面的文件
1.2 head-common.S
文件在arch\arm\kernel\head-common.S，有__switch_data、__mmap_switched、__error_p、__error_a、__error、__lookup_processor_type、C语言的lookup_processor_type、__lookup_machine_type 、C语言的lookup_machine_type、__vet_atags等组成，这里只列出上面调用要使用的查找处理器类型和查找机器类型。
_lookup_processor_type: //r9是刚从CPU基址寄存器中取出的值
ARM( adr r3, 3f ) //执行此句后，r3的地址是后面标号3处的地址
ARM( ldmda r3, {r5 - r7} )//r5,r6,r7依次变为，__proc_info_begin，end，以及
//标号3处的末尾链接地址
sub r3, r3, r7 @ get offset between virt&phys //这三行执行虚实地址转换
add r5, r5, r3 @ convert virt addresses to//r5是proc_info_list结构体地址
add r6, r6, r3 @ physical address space //__proc_info_end的自己
1: ldmia r5, {r3, r4} @ value, mask //r3是结构体的val变量
and r4, r4, r9 @ mask wanted bits //r4是结构体的mask变量
teq r3, r4
beq 2f //相等转到后面的2标号处
add r5, r5, #PROC_INFO_SZ @ sizeof(proc_info_list) //宏定义在asm-offset.h
cmp r5, r6 //结构体可能是个数组，需要全部查找，若r5的地址没有超出end
blo 1b //的地址，则继续转到1处理，若最后没找到，r5变为空
mov r5, #0 @ unknown processor
2: mov pc, lr
ENDPROC(__lookup_processor_type)
ENTRY(lookup_processor_type)
stmfd sp!, {r4 - r7, r9, lr}
mov r9, r0 //提供C语言的API结构，r0是传入的参数
bl __lookup_processor_type
mov r0, r5 //此处的R0是函数的返回值，即传出的参数
ldmfd sp!, {r4 - r7, r9, pc}
ENDPROC(lookup_processor_type)
.long __proc_info_begin //arch/arm/kernel/vmlinux.lds.s中定义
.long __proc_info_end
3: .long .
.long __arch_info_begin
.long __arch_info_end
/*
* Lookup machine architecture in the linker-build list of architectures.
* Note that we can‘t use the absolute addresses for the __arch_info
* lists since we aren‘t running with the MMU on (and therefore, we are
* not in the correct address space). We have to calculate the offset.
*
* r1 = machine architecture number
* Returns:
* r3, r4, r6 corrupted
* r5 = mach_info pointer in physical address space
*/
__lookup_machine_type:
adr r3, 3b
ldmia r3, {r4, r5, r6} //r5是__arch_info_begin，r6是end
sub r3, r3, r4 @ get offset between virt&phys //虚实地址转换
add r5, r5, r3 @ convert virt addresses to
add r6, r6, r3 @ physical address space
1: ldr r3, [r5, #MACHINFO_TYPE] @ get machine type //结构体偏移字节数，见上面的注释
teq r3, r1 @ matches loader number? //与传递给内核的r1相同
beq 2f @ found //r3就是结构体中第一个变量nr
add r5, r5, #SIZEOF_MACHINE_DESC @ next machine_desc
cmp r5, r6
blo 1b
mov r5, #0 @ unknown machine
2: mov pc, lr
ENDPROC(__lookup_machine_type)
/*
* This provides a C-API version of the above function.
*/
ENTRY(lookup_machine_type)
stmfd sp!, {r4 - r6, lr}
mov r1, r0 //提供C语言的API结构，r0是传入的参数
bl __lookup_machine_type
mov r0, r5 //此处的R0是函数的返回值，即传出的参数
ldmfd sp!, {r4 - r6, pc}
ENDPROC(lookup_machine_type)
1.2.1 lookup_processor_type
（1）vmlinux.lds.s
文件在arch\arm\kernel\ vmlinux.lds.s
__proc_info_begin = .; //include/asm-arm/procinfo.h中定义
*(.proc.info.init)
__proc_info_end = .;
__arch_info_begin = .; //include/asm-arm/mach/arch.h 中定义
*(.arch.info.init)
__arch_info_end = .;
（2）procinfo.h
文件在include/asm-arm/procinfo.h
struct proc_info_list { // pro-v7m.S对其实例化
unsigned int cpu_val;
unsigned int cpu_mask;
unsigned long __cpu_mm_mmu_flags; /* used by head.S */
unsigned long __cpu_io_mmu_flags; /* used by head.S */
unsigned long __cpu_flush; /* used by head.S */
const char *arch_name;
const char *elf_name;
unsigned int elf_hwcap;
const char *cpu_name;
struct processor *proc;
struct cpu_tlb_fns *tlb;
struct cpu_user_fns *user;
struct cpu_cache_fns *cache;
};
（3）pro-v7m.S
文件在arch\arm\mm\ pro-v7m.S，内容很多，核心就是.section ".proc.info.init"，其它的都是它这个结构体中得成员，如__v7m_setup、cpu_arch_name、cpu_elf_name、cpu_v7m_name、v7m_processor_functions等。
cpu_v7m_name:
.ascii "ARMv7-M Processor"
.align
.section ".text.init", #alloc, #execinstr
.type v7m_processor_functions, #object
ENTRY(v7m_processor_functions)
.word v7m_early_abort
.word cpu_v7m_proc_init
.word cpu_v7m_proc_fin
.word cpu_v7m_reset
.word cpu_v7m_do_idle
.word cpu_v7m_dcache_clean_area
.word cpu_v7m_switch_mm
.word cpu_v7m_set_pte_ext
.word pabort_noifar
.size v7m_processor_functions, . - v7m_processor_functions
.type cpu_arch_name, #object
cpu_arch_name:
.asciz "armv7m"
.size cpu_arch_name, . - cpu_arch_name
.type cpu_elf_name, #object
cpu_elf_name:
.asciz "v7m"
.size cpu_elf_name, . - cpu_elf_name
.align
.section ".proc.info.init", #alloc, #execinstr
/*
* Match any ARMv7-M processor core.
*/
.type __v7m_proc_info, #object
__v7m_proc_info: //E000ED00是CPUID基址寄存器，其中[19:16]读作常量F
.long 0x000f0000 @ Required ID value
.long 0x000f0000 @ Mask for ID
.long 0 @ proc_info_list.__cpu_mm_mmu_flags
.long 0 @ proc_info_list.__cpu_io_mmu_flags
b __v7m_setup @ proc_info_list.__cpu_flush
.long cpu_arch_name
.long cpu_elf_name
.long HWCAP_SWP|HWCAP_HALF|HWCAP_THUMB|HWCAP_FAST_MULT|HWCAP_EDSP
.long cpu_v7m_name
.long v7m_processor_functions @ proc_info_list.proc
.long 0 @ proc_info_list.tlb
.long 0 @ proc_info_list.user
.long 0 @ proc_info_list.cache
.size __v7m_proc_info, . - __v7m_proc_info
1.2.2 lookup_machine_type
（1）arch.h
文件在include/asm-arm/mach/arch.h
struct machine_desc { //在stm3210e_eval.c中实例化
/*
* Note! The first four elements are used
* by assembler code in head.S, head-common.S
*/
unsigned int nr; /* architecture number */
unsigned int phys_io; /* start of physical io */
unsigned int io_pg_offst; /* byte offset for io
* page tabe entry */
const char *name; /* architecture name */
unsigned long boot_params; /* tagged list */
unsigned int video_start; /* start of video RAM */
unsigned int video_end; /* end of video RAM */
unsigned int reserve_lp0 :1; /* never has lp0 */
unsigned int reserve_lp1 :1; /* never has lp1 */
unsigned int reserve_lp2 :1; /* never has lp2 */
unsigned int soft_reboot :1; /* soft reboot */
void (*fixup)(struct machine_desc *,
struct tag *, char **,
struct meminfo *);
void (*map_io)(void);/* IO mapping function */
void (*init_irq)(void);
struct sys_timer *timer; /* system tick timer */
void (*init_machine)(void);
};
/*
* Set of macros to define architecture features. This is built into
* a table by the linker.
*/
#define MACHINE_START(_type,_name) \
static const struct machine_desc __mach_desc_##_type \
__used \
__attribute__((__section__(".arch.info.init"))) = { \
.nr = MACH_TYPE_##_type, \
.name = _name,
#define MACHINE_END \
};
（2）stm3210e_eval.c
文件在arch\arm\mach-stm3210e_eval\ stm3210e_eval.c
MACHINE_START(STM3210E_EVAL, "STM3210E-EVAL")
/* Maintainer: MCD Application TEAM */ /* Status */
.fixup = stm3210e_eval_fixup, //OK
.boot_params = CONFIG_EXTERNAL_RAM_BASE + 0x100, //OK
.init_irq = nvic_init_irq, //OK
.timer = &stm3210e_eval_timer, //OK
.init_machine = stm3210e_eval_init, //OK
MACHINE_END
（3）match-type.h
文件在include/asm-arm/mach-type.h
#define MACH_TYPE_STM3210E_EVAL 2189
1.3 __v7m_setup
文件在arch\arm\mm\ pro-v7m.S
/*
* __v7m_setup
*
* Initialise TLB, Caches, and MMU state ready to switch the MMU
* on. Return in r0 the new CP15 C1 control register setting.
*
* We automatically detect if we have a Harvard cache, and use the
* Harvard cache control instructions insead of the unified cache
* control instructions.
*
* This should be able to cover all ARMv7-M cores.
*
* It is assumed that:
* - cache type register is implemented
*/
__v7m_setup:
@ Configure the vector table base address //配置中断向量偏移
ldr r0, =0xe000ed08 @ vector table base address
ldr r12, =vector_table
str r12, [r0]
@ Lower the priority of the SVC and PendSV exceptions
ldr r0, =0xe000ed1c //设置SVC、PendSV的中断优先级都为128
mov r5, #0x80000000
str r5, [r0] @ set SVC priority
ldr r0, =0xe000ed20
mov r5, #0x00800000
str r5, [r0] @ set PendSV priority
@ SVC to run the kernel in this mode
badr r0, 1f
ldr r5, [r12, #11 * 4] @ read the SVC vector entry
str r0, [r12, #11 * 4] @ write the temporary SVC vector entry
mov r6, lr @ save LR
mov r7, sp @ save SP
#if !defined(CONFIG_XIP_KERNEL)
ldr sp, =__v7m_setup_stack_top
#endif
cpsie i
svc #0 //呼叫系统服务，权威指南-P182，暂时没找到？
1: cpsid i
str r5, [r12, #11 * 4] @ restore the original SVC vector entry
mov lr, r6 @ restore LR
mov sp, r7 @ restore SP
@ Special-purpose control register
mov r0, #1 //还是进入特权级的线程模式，主堆栈？
msr control, r0 @ Thread mode has unpriviledged access
@ Configure the System Control Register
ldr r0, =0xe000ed10 @ system control register
ldr r12, [r0] //不知道是干啥，不确定是否在E000 ED10上
orr r12, #1 << 9 @ STKALIGN
str r12, [r0] //E000 ED14的这个位倒是为了对齐双字节，指南-306
mov pc, lr //之前的lr值赋给PC，即PC转到那里执行
ENDPROC(__v7m_setup)
1.4 __switch_data
文件在arch\arm\kernel\head-common.S
.type __switch_data, %object
__switch_data:
.long __mmap_switched
.long __data_loc @ r4
.long __data_start @ r5
.long _edata_loc @ r6 //added to determine the size of data segment to be copied.
.long __bss_start @ r6
.long _end @ r7
.long processor_id @ r4
.long __machine_arch_type @ r5
.long __atags_pointer @ r6
#ifdef CONFIG_CPU_CP15
.long cr_alignment @ r7
#else
.long 0 @ r7
#endif
.long init_thread_union + THREAD_START_SP @ sp
/*
* The following fragment of code is executed with the MMU on in MMU mode,
* and uses absolute addresses; this is not position independent.
*
* r0 = cp#15 control register
* r1 = machine ID
* r2 = atags pointer
* r9 = processor ID
*/
__mmap_switched: //从__v7m_setup出来以后，转到这里
adr r3, __switch_data + 4
ldmia r3!, {r4, r5, r6}
cmp r4, r5 @ Copy data segment if needed
beq 2f
1: ldr fp, [r4], #4 //fp是r11
str fp, [r5], #4
cmp r4, r6
bne 1b
2: ldmia r3!,{r6,r7} @load __bss_start to r6 and _end to r7
mov fp, #0 @ Clear BSS (and zero fp)
1: cmp r6, r7
itt cc //itt相当于if-then
strcc fp, [r6],#4
bcc 1b
ARM( ldmia r3, {r4, r5, r6, r7, sp})
str r9, [r4] @ Save processor ID被赋值
str r1, [r5] @ Save machine type被赋值
str r2, [r6] @ Save atags pointer被赋值
bic r4, r0, #CR_A @ Clear ‘A‘ bit 这句貌似没用？
#if !defined (CONFIG_CPU_V7M)
stmia r7, {r0, r4} @ Save control register values
#endif
@2: b 2b
b start_kernel //跳入C语言的函数
ENDPROC(__mmap_switched)