ARM Linux源代码分析(1)

1. 分析环境

    kernel: 2.6.10
    board: SMDK2410 1.32, 64M SDRAM, 128M SM卡

2. head.S
*/

/*
 * linux/arch/arm/kernel/head.S
 *
 *  Copyright (C) 1994-2002 Russell King
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 *
 *  Kernel startup code for all 32-bit CPUs
 */
#include
#include
#include

#include
#include
#include
#include
#include

#ifndef CONFIG_XIP_KERNEL /* 我在的平台, 这个宏没有定义 */
/*
 * We place the page tables 16K below TEXTADDR.  Therefore, we must make sure
 * that TEXTADDR is correctly set.  Currently, we expect the least significant
 * 16 bits to be 0x8000, but we could probably relax this restriction to
 * TEXTADDR >= PAGE_OFFSET + 0x4000
 *
 * 页表放在比TEXTADDR低16K的地方, 所以我们必须要确认TEXTADDR被正确设定. 目前,
 * 我们希望低16位为0x8000, 不过我们可以放松这个限制为
 * TEXTADDR >= PAGE_OFFSET + 0x4000
 *
 * Note that swapper_pg_dir is the virtual address of the page tables, and
 * pgtbl gives us a position-independent reference to these tables.  We can
 * do this because stext == TEXTADDR
 *
 * 注意swapper_pg_dir是页表的虚拟地址, pgtbl给我们一个位置无关的页表地址, 这是
 * 因为stext == TEXTADDR.
 */
#if (TEXTADDR & 0xffff) != 0x8000
    #error TEXTADDR must start at 0xXXXX8000
#endif

    /* swapper_pg_dir = 0x30008000 - 0x4000 */
    .globl swapper_pg_dir
    .equ    swapper_pg_dir, TEXTADDR - 0x4000

    /* rd = stext - 0x4000, 这里stext == TEXTADDR */
    /* adr指令是在pc值上+/-一个标号的偏移得到的, 所以得到的地址只跟pc和标号到
     * pc的偏移相关, 跟编译地址无关. 在MMU打开前, 代码要是地址无关的, 会经常
     * 用到adr.
     */
    .macro pgtbl, rd, phys
    adr     \rd, stext
    sub     \rd, \rd, #0x4000
    .endm
#else
/*
* XIP Kernel:
*
* We place the page tables 16K below DATAADDR.  Therefore, we must make sure
* that DATAADDR is correctly set.  Currently, we expect the least significant
* 16 bits to be 0x8000, but we could probably relax this restriction to
* DATAADDR >= PAGE_OFFSET + 0x4000
*
* Note that pgtbl is meant to return the physical address of swapper_pg_dir.
* We can't make it relative to the kernel position in this case since
* the kernel can physically be anywhere.
*/
#if (DATAADDR & 0xffff) != 0x8000
#error DATAADDR must start at 0xXXXX8000
#endif

.globl swapper_pg_dir
.equ swapper_pg_dir, DATAADDR - 0x4000

.macro pgtbl, rd, phys
ldr \rd, =((DATAADDR - 0x4000) - VIRT_OFFSET)
add \rd, \rd, \phys
.endm
#endif

/*
 * Kernel startup entry point.
 * ---------------------------
 * Kernel的启动入口.
 *
 * This is normally called from the decompressor code.  The requirements
 * are: MMU = off, D-cache = off, I-cache = dont care, r0 = 0,
 * r1 = machine nr.
 *
 * 这里一般由解压缩代码调用. 它需要: MMU = off, D-cache = off,
 * I-cache = 不关心, r0 = 0, r1 = 机器号.
 *
 * This code is mostly position independent, so if you link the kernel at
 * 0xc0008000, you call this at __pa(0xc0008000).
 *
 * 这里的代码通常是位置无关的, 所以如果你在0xc0008000链接kernel, 直接调用
 * __pa(0xc0008000).
 *
 * See linux/arch/arm/tools/mach-types for the complete list of machine
 * numbers for r1.
 *
 * 在linux/arch/arm/tools/mach-types里查看机器号r1的完整列表.
 *
 * We're trying to keep crap to a minimum; DO NOT add any machine specific
 * crap here - that's what the boot loader (or in extreme, well justified
 * circumstances, zImage) is for.
 *
 */
    __INIT
    .type   stext, #function
ENTRY(stext)
    mov     r12, r0
    mov     r0, #PSR_F_BIT | PSR_I_BIT | MODE_SVC   @ make sure svc mode
                                                /* 确认是SVC模式 */
    msr     cpsr_c, r0          @ and all irqs disabled
                            /* 关闭所有irq */
    bl      __lookup_processor_type     /* 查看处理器类型 */
    teq     r10, #0             @ invalid processor?
                            /* 无效的处理器? */
    moveq r0, #'p'        @ yes, error 'p'
                            /* 如果是, 错误码'p' */
    beq     __error
    bl      __lookup_architecture_type /* 查看体系类型 */
    teq     r7, #0              @ invalid architecture?
                            /* 无效体系? */
    moveq r0, #'a'        @ yes, error 'a'
                            /* 如果是, 错误码'a' */
    beq     __error
    bl      __create_page_tables    /* 建立页表 */

    /*
     * The following calls CPU specific code in a position independent
     * manner.  See arch/arm/mm/proc-*.S for details.  r10 = base of
     * xxx_proc_info structure selected by __lookup_architecture_type
     * above.  On return, the CPU will be ready for the MMU to be
     * turned on, and r0 will hold the CPU control register value.
     *
     * 下面的代码按位置无关的方式调用特定的CPU代码, 详细信息查看
     * arch/arm/mm/proc-*.S. r0 = xxx_proc_info结构起始地址, 该结构由上面
     * 的__lookup_architecture_type选择. 在返回时, CPU已经准备好打开MMU,
     * r0将保存CPU控制寄存器的值.
     */
    adr     lr, __turn_mmu_on       @ return (PIC) address
                                    /* 调用完下面的__arm920_setup后返回到
                                       __turn_mmu_on */
    add     pc, r10, #12            /* 调用__arm920_setup , 详见
                                       arch/arm/mm/proc-arm920.S */

    .type   __switch_data, %object
__switch_data:
    .long   __mmap_switched
    .long   __data_loc              @ r2
    .long   __data_start            @ r3
    .long   __bss_start             @ r4
    .long   _end                    @ r5
    .long   processor_id            @ r6
    .long   __machine_arch_type     @ r7
    .long   cr_alignment            @ r8
    .long   init_thread_union+8192  @ sp

    /*
     * Enable the MMU.  This completely changes the structure of the visible
     * memory space.  You will not be able to trace execution through this.
     * If you have an enquiry about this, *please* check the linux-arm-kernel
     * mailing list archives BEFORE sending another post to the list.
     *
     * 打开MMU. 这将完全改变可见存储空间的结构, 你不能跟踪运行情况.
     * 如果你有疑问, 请先查看linux-arm-kernel邮件列表, 在你发邮件到这个列表前.
     */
    .align 5
    .type   __turn_mmu_on, %function
__turn_mmu_on:
    ldr     lr, __switch_data                   /* 完成后跳到__switch_data偏移0存放的地址,
                                                   即__mmap_switched */
    #ifdef CONFIG_ALIGNMENT_TRAP
    orr     r0, r0, #2                          @ ...........A.
                                                /* 访问非对齐地址产生一个TRAP */
    #endif
    mcr     p15, 0, r0, c1, c0, 0               @ write control reg
    mrc     p15, 0, r3, c0, c0, 0               @ read id reg
    mov     r3, r3
    mov     r3, r3
    mov     pc, lr

/*
 * The following fragment of code is executed with the MMU on, and uses
 * absolute addresses; this is not position independent.
 *
 * 下面的代码在MMU打开的情况下运行, 是绝对地址, 不是位置无关的.
 *  r0  = processor control register
 *  r1  = machine ID
 *  r9  = processor ID
 *  r12 = value of r0 when kernel was called (currently always zero)
 *
 * 这里主要是为调用C函数start_kernel做准备. 在调用这部分代码前, 我们必须
 * 打开MMU, 因为kernel的位置相关代码是要以0xc0008000为起始地址的, 所以在这
 * 之前, 我们建立了页表, 并打开MMU.
 */
    .align 5
__mmap_switched:
    adr         r2, __switch_data + 4
    ldmia       r2, {r2, r3, r4, r5, r6, r7, r8, sp}

    cmp         r2, r3              @ Copy data segment if needed
1:  cmpne       r3, r4
    ldrne       fp, [r2], #4
    strne       fp, [r3], #4
    bne         1b

    mov         fp, #0              @ Clear BSS (and zero fp)
1:  cmp         r4, r5
    strcc       fp, [r4],#4
    bcc         1b

    str         r9, [r6]   @ Save processor ID
    str         r1, [r7]   @ Save machine type
    bic         r2, r0, #2   @ Clear 'A' bit
    stmia       r8, {r0, r2}   @ Save control register values
    b           start_kernel

 

/*
 * Setup the initial page tables.  We only setup the barest
 * amount which are required to get the kernel running, which
 * generally means mapping in the kernel code.
 *
 * 设置初始化页表, 我们只设置kernel运行所需少量内存, 通常就是
 * 映射kernel的代码.
 *
 * r5 = physical address of start of RAM
 * r6 = physical IO address
 * r7 = byte offset into page tables for IO
 * r8 = page table flags
 */
__create_page_tables:
        /* 取页表地址到r4, 这里r4 = 0x30004000 */
        pgtbl r4, r5                          @ page table address

        /*
         * Clear the 16K level 1 swapper page table
         *
         * 清空页表
         */
        mov     r0, r4
        mov r3, #0
        add r2, r0, #0x4000
1: str r3, [r0], #4
        str r3, [r0], #4
        str r3, [r0], #4
        str r3, [r0], #4
        teq r0, r2
        bne 1b

        /*
         * Create identity mapping for first MB of kernel to
         * cater for the MMU enable.  This identity mapping
         * will be removed by paging_init().  We use our current program
         * counter to determine corresponding section base address.\
         *
         * kernel的第1M建立等价映射, 为打开MMU做准备. 这个等价映射将在
         * paging_init()中移除. 我们用pc来确定对应的段地址.
         */
        mov r2, pc, lsr #20   @ start of kernel section
        add r3, r8, r2, lsl #20  @ flags + kernel base (flags = 0x00000c1e)
        str r3, [r4, r2, lsl #2]  @ identity mapping
        /*
         *           r4           +  (pc >> 20) << 2
         * 31                   14 13           2 1 0
         * -------------------------------------------
         * |   Translatioin base  | Table index  |0|0|
         * -------------------------------------------
         * 这一个表项把kernel section的虚地址和实地址等同起来.
         * r3 = 0x00000c1e + 0x30000000 = 0x30000c1e
         * r4 = 0x30004000
         * r2 >> 18 = 0x30000000 >> 18 = 0xc00
         * [0x30004000 + 0xc00] = 0x30000c1e
         */

        /*
         * Now setup the pagetables for our kernel direct
         * mapped region.  We round TEXTADDR down to the
         * nearest megabyte boundary.  It is assumed that
         * the kernel fits within 4 contigous 1MB sections.
         *
         * 现在为kernel设置页表, 把TEXTADDR完整成MB, 这里假设
         * kernel在4个连续的1MB段内.
         */
        /* TEXTADDR = 0xc0000000 */
        add r0, r4,  #(TEXTADDR & 0xff000000) >> 18 @ start of kernel
        /* r0 = 0x30004000 + 0x3000 */
        str r3, [r0, #(TEXTADDR & 0x00f00000) >> 18]!
        /* [0x30004000 + 0x3000] = 0x30000c1e */
        /*
         * add r0, r4, #(TEXTADDR & 0xfff00000) >> 18
         * str r3, [r0]
         * 上2行的意思同这2行相同, 为什么不这样做?
         */
        add r3, r3, #1 << 20
        str r3, [r0, #4]!   @ KERNEL + 1MB
        /* [0x30004000 + 0x3004] = 0x30100c1e */
        add r3, r3, #1 << 20
        str r3, [r0, #4]!   @ KERNEL + 2MB
        /* [0x30004000 + 0x3008] = 0x30200c1e */
        add r3, r3, #1 << 20
        str r3, [r0, #4]   @ KERNEL + 3MB
        /* [0x30004000 + 0x300c] = 0x30300c1e */

        /*
         * Then map first 1MB of ram in case it contains our boot params.
         *
         * 因为RAM的第1MB存放有boot参数, 所以也需要映射. (当前boot参数所在
         * 的段与前面pc值所在段相等, 但这不是一定的.
         */
        add r0, r4, #VIRT_OFFSET >> 18
        add r2, r5, r8
        str r2, [r0]

/* 下面代码略过 */
#ifdef CONFIG_XIP_KERNEL
/*
* Map some ram to cover our .data and .bss areas.
* Mapping 3MB should be plenty.
*/
sub r3, r4, r5
mov r3, r3, lsr #20
add r0, r0, r3, lsl #2
add r2, r2, r3, lsl #20
str r2, [r0], #4
add r2, r2, #(1 << 20)
str r2, [r0], #4
add r2, r2, #(1 << 20)
str r2, [r0]
#endif

bic r8, r8, #0x0c   @ turn off cacheable
@ and bufferable bits
#ifdef CONFIG_DEBUG_LL
/*
* Map in IO space for serial debugging.
* This allows debug messages to be output
* via a serial console before paging_init.
*/
add r0, r4, r7
rsb r3, r7, #0x4000   @ PTRS_PER_PGD*sizeof(long)
cmp r3, #0x0800
addge r2, r0, #0x0800
addlt r2, r0, r3
orr r3, r6, r8
1: str r3, [r0], #4
add r3, r3, #1 << 20
teq r0, r2
bne 1b
#if defined(CONFIG_ARCH_NETWINDER) || defined(CONFIG_ARCH_CATS)
/*
* If we're using the NetWinder, we need to map in
* the 16550-type serial port for the debug messages
*/
teq r1, #MACH_TYPE_NETWINDER
teqne r1, #MACH_TYPE_CATS
bne 1f
add r0, r4, #0x3fc0   @ ff000000
mov r3, #0x7c000000
orr r3, r3, r8
str r3, [r0], #4
add r3, r3, #1 << 20
str r3, [r0], #4
1:
#endif
#endif
#ifdef CONFIG_ARCH_RPC
/*
* Map in screen at 0x02000000 & SCREEN2_BASE
* Similar reasons here - for debug.  This is
* only for Acorn RiscPC architectures.
*/
add r0, r4, #0x80   @ 02000000
mov r3, #0x02000000
orr r3, r3, r8
str r3, [r0]
add r0, r4, #0x3600   @ d8000000
str r3, [r0]
#endif
        /* 返回 */
        mov pc, lr
        .ltorg

 

/*
 * Exception handling.  Something went wrong and we can't proceed.  We
 * ought to tell the user, but since we don't have any guarantee that
 * we're even running on the right architecture, we do virtually nothing.
 *
 * 异常处理. 一些东西错了就不能继续, 我们应该告诉用户, 但因为我们甚至不能
 * 保证运行在正确的体系上, 我们实际在做无用功.
 *
 * r0 = ascii error character:
 * a = invalid architecture
 * p = invalid processor
 * i = invalid calling convention
 *
 * Generally, only serious errors cause this.
 */
__error:
        #ifdef CONFIG_DEBUG_LL
        mov r8, r0    @ preserve r0
        adr r0, err_str
        bl printascii
        mov r0, r8
        bl printch
        #endif

#ifdef CONFIG_ARCH_RPC
/*
* Turn the screen red on a error - RiscPC only.
*/
mov r0, #0x02000000
mov r3, #0x11
orr r3, r3, r3, lsl #8
orr r3, r3, r3, lsl #16
str r3, [r0], #4
str r3, [r0], #4
str r3, [r0], #4
str r3, [r0], #4
#endif

1: mov r0, r0
        b 1b

#ifdef CONFIG_DEBUG_LL
err_str:
        .asciz "\nError: "
        .align
#endif

/*
 * Read processor ID register (CP#15, CR0), and look up in the linker-built
 * supported processor list.  Note that we can't use the absolute addresses
 * for the __proc_info lists since we aren't running with the MMU on
 * (and therefore, we are not in the correct address space).  We have to
 * calculate the offset.
 *
 * 读取处理器ID寄存器(CP#15, CR0), 在链接时建立的已支持处理器列表中查找.
 * 注意, 我们不能使用__proc_info的绝对地址, 因为我们还没有运行MMU,
 * (因此, 我们不在正确的地址空间). 我们必须计算偏移.
 *
 * Returns:
 * r5, r6, r7 corrupted
 * r8  = page table flags
 * r9  = processor ID
 * r10 = pointer to processor structure
 */
__lookup_processor_type:
        adr r5, 2f                          /* 取2f的相对地址 */
        ldmia r5, {r7, r9, r10}               /* r7 = __proc_info_end,
                                                   r9 = __proc_info_begin,
                                                   r10 = 2 */
        sub r5, r5, r10   @ convert addresses
                                                /* r5 = 2的相对地址 - 2的绝对地址 */
        add r7, r7, r5   @ to our address space
                                                /* r7 += r5, 把r7从绝对地址转化为
                                                   相对地址 */
        add r10, r9, r5                     /* 绝对转相对 */
        mrc p15, 0, r9, c0, c0  @ get processor id
1: ldmia r10, {r5, r6, r8}  @ value, mask, mmuflags
        and r6, r6, r9   @ mask wanted bits
        teq r5, r6
        moveq pc, lr
        add r10, r10, #PROC_INFO_SZ  @ sizeof(proc_info_list)
        cmp r10, r7
        blt 1b
        mov r10, #0    @ unknown processor
        mov pc, lr

        /*
         * Look in include/asm-arm/procinfo.h and arch/arm/kernel/arch.[ch] for
         * more information about the __proc_info and __arch_info structures.
         */
2: .long __proc_info_end
        .long __proc_info_begin
        .long 2b
        .long __arch_info_begin
        .long __arch_info_end

/*
 * Lookup machine architecture in the linker-build list of architectures.
 * Note that we can't use the absolute addresses for the __arch_info
 * lists since we aren't running with the MMU on (and therefore, we are
 * not in the correct address space).  We have to calculate the offset.
 *
 * 在链接时建立的机器列表中查找机器结构. 注意我们不能使用__arch_info的绝对地址,
 * 因为我们没有打开MMU(因此, 我们不在正确的地址空间). 我们必须计算偏移.
 *
 *  r1 = machine architecture number
 * Returns:
 *  r2, r3, r4 corrupted
 *  r5 = physical start address of RAM
 *  r6 = physical address of IO
 *  r7 = byte offset into page tables for IO
 */
__lookup_architecture_type:
        adr r4, 2b                          /* 这里的做法同__lookup_processor_type */
        ldmia r4, {r2, r3, r5, r6, r7} @ throw away r2, r3
        sub r5, r4, r5   @ convert addresses
        add r4, r6, r5   @ to our address space
        add r7, r7, r5
1: ldr r5, [r4]   @ get machine type
        teq r5, r1    @ matches loader number?
        beq 2f    @ found
        add r4, r4, #SIZEOF_MACHINE_DESC @ next machine_desc
        cmp r4, r7
        blt 1b
        mov r7, #0    @ unknown architecture
        mov pc, lr
2: ldmib r4, {r5, r6, r7}  @ found, get results
        mov pc, lr