First entry to the Linux kernel 2.4
- After minimum hardware setup, the bootstrap code (described in head.S) calls "start_kernel".
| arch/i386/kernel/head.S |
...
call SYMBOL_NAME(start_kernel)
...
| |
- start_kernel executes many initialize routines and activate a thread of init().
- init calls do_basic_setup() and start the first process, /sbin/init.
- In do_basic_setup(), sockets are initialized (sock_init) and kernel-embedded initialize routines are sequentially called (do_initcalls).
| init/main.c |
asmlinkage void __init start_kernel(void)
{
...
printk(linux_banner); // "linux_banner" is defined in init/version.c (W.N.).
...
... // Dozens of initialize routines
...
kernel_thread(init, NULL, CLONE_FS | CLONE_FILES | CLONE_SIGNAL);
...
cpu_idle();
}
static int init(void * unused)
{
...
do_basic_setup();
...
execve("/sbin/init",argv_init,envp_init);
...
}
static void __init do_basic_setup(void)
{
...
sock_init(); // net/socket.c (SEE BELOW)
...
do_initcalls();
...
}
static void __init do_initcalls(void)
{
initcall_t *call;
call = &__initcall_start;
do {
(*call)();
call++;
} while (call < &__initcall_end);
...
}
| |
- Let's confirm the contents of sock_init().
- There is a familiar welcome message, and sock_init() clears net_families[] with null pointers. At this moment, no protocols are registered in the kernel.
| net/socket.c |
...
/*
* The protocol list. Each protocol is registered in here.
*/
static struct net_proto_family *net_families[NPROTO]; // Current NPROTO is defined as 32
// in (W.N.).
...
void __init sock_init(void)
{
int i;
printk(KERN_INFO "Linux NET4.0 for Linux 2.4\n");
printk(KERN_INFO "Based upon Swansea University Computer Society NET3.039\n");
/*
* Initialize all address (protocol) families.
*/
for (i = 0; i < NPROTO; i++)
net_families[i] = NULL;
...
/*
* Initialize the protocols module.
*/
register_filesystem(&sock_fs_type);
sock_mnt = kern_mount(&sock_fs_type);
/* The real protocol initialization is performed when
* do_initcalls is run.
*/
...
}
| |
![]() initcall array in .initcall.init section
- To trace the process of do_initcalls(), introduce a short printk() statement in it as follows. The code means that there is an array holding each entry address of initializer. The array starts at __initcall_start and ends before __initcall_end. In addition, I inserted the same notifier in drivers/net/loopback.c. Loopback device is the most simple network interface and every kernel includes it.
| modified do_initcalls() in init/main.c |
static void __init do_initcalls(void)
{
initcall_t *call;
call = &__initcall_start;
do {
printk(KERN_INFO "+++ do_initcall: %08X\n", call); // Dump the entry address of initializer (W.N.).
(*call)();
call++;
} while (call < &__initcall_end);
/* Make sure there is no pending stuff from the initcall sequence */
flush_scheduled_tasks();
}
| |
| modified loopback_init() in drivers/net/loopback.c |
int __init loopback_init(struct net_device *dev)
{
printk(KERN_INFO "=== Executing loopback_init ===\n");
dev->mtu = PAGE_SIZE - LOOPBACK_OVERHEAD;
dev->hard_start_xmit = loopback_xmit;
dev->hard_header = eth_header;
dev->hard_header_cache = eth_header_cache;
dev->header_cache_update= eth_header_cache_update;
dev->hard_header_len = ETH_HLEN; /* 14 */
dev->addr_len = ETH_ALEN; /* 6 */
...
};
| |
- Then recompile the kernel, install, reboot it, and confirm the startup message. Note that printk tells calling address starts at C029F4E8 and reaches at C029F574 (the stepwidth is 4 bytes). I imposed comments at important locations.
- At first, you can see the banner message from sock_init().
- You can also find the important fact that loopback_init() is lastly called in partition_setup().
- dummy_init_module() and network interface initializer (RTL-8139 in my case) succeed.
- Then, inet_init() and af_unix_init().
| dmesg on my laptop |
Linux version 2.4.3 (root@mebius) (gcc version 2.95.3 20010315 (Debian release)) #9 Tue Apr 3 17:37:
44 JST 2001
BIOS-provided physical RAM map:
BIOS-e820: 0000000000000000 - 000000000009f800 (usable)
BIOS-e820: 000000000009f800 - 00000000000a0000 (reserved)
BIOS-e820: 00000000000ebc00 - 0000000000100000 (reserved)
BIOS-e820: 0000000000100000 - 0000000007ff0000 (usable)
BIOS-e820: 0000000007ff0000 - 0000000007fffc00 (ACPI data)
BIOS-e820: 0000000007fffc00 - 0000000008000000 (ACPI NVS)
BIOS-e820: 00000000fff80000 - 0000000100000000 (reserved)
On node 0 totalpages: 32752
zone(0): 4096 pages.
zone(1): 28656 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/hda1 mem=131008K
Initializing CPU#0
Detected 333.350 MHz processor.
Console: colour VGA+ 80x25
Calibrating delay loop... 665.19 BogoMIPS
Memory: 126564k/131008k available (1076k kernel code, 4056k reserved, 387k data, 184k init, 0k highm
em)
Dentry-cache hash table entries: 16384 (order: 5, 131072 bytes)
Buffer-cache hash table entries: 4096 (order: 2, 16384 bytes)
Page-cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 8192 (order: 4, 65536 bytes)
CPU: Before vendor init, caps: 0183f9ff 00000000 00000000, vendor = 0
CPU: L1 I cache: 16K, L1 D cache: 16K
CPU: L2 cache: 256K
Intel machine check architecture supported.
Intel machine check reporting enabled on CPU#0.
CPU: After vendor init, caps: 0183f9ff 00000000 00000000 00000000
CPU: After generic, caps: 0183f9ff 00000000 00000000 00000000
CPU: Common caps: 0183f9ff 00000000 00000000 00000000
CPU: Intel Mobile Pentium II stepping 0a
Enabling fast FPU save and restore... done.
Checking 'hlt' instruction... OK.
POSIX conformance testing by UNIFIX
PCI: PCI BIOS revision 2.10 entry at 0xfd9be, last bus=0
PCI: Using configuration type 1
PCI: Probing PCI hardware
PCI: Using IRQ router PIIX [8086/7110] at 00:07.0
got res[10000000:10000fff] for resource 0 of Ricoh Co Ltd RL5c475
Limiting direct PCI/PCI transfers.
Linux NET4.0 for Linux 2.4 // Message from sock_init()
Based upon Swansea University Computer Society NET3.039
+++ do_initcall: C029F4E8 // do_initcalls() START
+++ do_initcall: C029F4EC
+++ do_initcall: C029F4F0 // apm_init() in arch/i386/kernel/kernel.o
apm: BIOS version 1.2 Flags 0x03 (Driver version 1.14)
+++ do_initcall: C029F4F4
+++ do_initcall: C029F4F8
+++ do_initcall: C029F4FC // kswapd_init() in mm/mm.o
Starting kswapd v1.8
+++ do_initcall: C029F500
+++ do_initcall: C029F504
+++ do_initcall: C029F508
+++ do_initcall: C029F50C
+++ do_initcall: C029F510
+++ do_initcall: C029F514
+++ do_initcall: C029F518
+++ do_initcall: C029F51C
+++ do_initcall: C029F520
+++ do_initcall: C029F524
+++ do_initcall: C029F528 // partition_setup() in fs/fs.o
pty: 256 Unix98 ptys configured
block: queued sectors max/low 84058kB/28019kB, 256 slots per queue
RAMDISK driver initialized: 16 RAM disks of 8000K size 1024 blocksize
Uniform Multi-Platform E-IDE driver Revision: 6.31
ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx
PIIX4: IDE controller on PCI bus 00 dev 39
PIIX4: chipset revision 1
PIIX4: not 100% native mode: will probe irqs later
ide0: BM-DMA at 0xfc90-0xfc97, BIOS settings: hda:DMA, hdb:pio
ide1: BM-DMA at 0xfc98-0xfc9f, BIOS settings: hdc:pio, hdd:pio
hda: TOSHIBA MK8113MAT, ATA DISK drive
ide0 at 0x1f0-0x1f7,0x3f6 on irq 14
hda: 16006410 sectors (8195 MB), CHS=996/255/63, UDMA(33)
Partition check:
hda: hda1 hda2 hda3 hda4 < hda5 hda6 hda7 hda8 hda9 hda10 >
Floppy drive(s): fd0 is 1.44M
FDC 0 is a National Semiconductor PC87306
=== Executing loopback_init === // loopback initialization is here!
+++ do_initcall: C029F52C // ext2_fs() in fs/fs.o
+++ do_initcall: C029F530
+++ do_initcall: C029F534
+++ do_initcall: C029F538
+++ do_initcall: C029F53C
+++ do_initcall: C029F540
loop: loaded (max 8 devices)
+++ do_initcall: C029F544
Serial driver version 5.05 (2000-12-13) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0x03f8 (irq = 4) is a 16550A
+++ do_initcall: C029F548 // dummy_init_module() in drivers/net/net.o
+++ do_initcall: C029F54C // rtl8139_init_module() in drivers/net/net.o
8139too Fast Ethernet driver 0.9.15c loaded
PCI: Found IRQ 9 for device 00:03.0
PCI: The same IRQ used for device 00:07.2
eth0: RealTek RTL8139 Fast Ethernet at 0xc8800c00, 08:00:1f:06:79:20, IRQ 9
eth0: Identified 8139 chip type 'RTL-8139B'
+++ do_initcall: C029F550
+++ do_initcall: C029F554
+++ do_initcall: C029F558
+++ do_initcall: C029F55C
+++ do_initcall: C029F560
+++ do_initcall: C029F564 // inet_init() in net/network.o
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 8192 bind 8192)
+++ do_initcall: C029F568 // af_unix_init() in net/network.o
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
+++ do_initcall: C029F56C
+++ do_initcall: C029F570
+++ do_initcall: C029F574 // atalk_init() in net/network.o
NET4: AppleTalk 0.18a for Linux NET4.0 // do_initcalls() END
fatfs: bogus cluster size
reiserfs: checking transaction log (device 03:01) ...
Using r5 hash to sort names
ReiserFS version 3.6.25
VFS: Mounted root (reiserfs filesystem) readonly.
Freeing unused kernel memory: 184k freed
Adding Swap: 128516k swap-space (priority -1)
eth0: Setting half-duplex based on auto-negotiated partner ability 0000.
| |
![]() initcalls mechanism
- Now it is time to understand the mechanism of initcalls definitions.
- Let's focus into the inet_init() in net/network.o.
- "cd net" and "grep -r inet_init *" tells us that inet_init() is defined in net/ipv4/af_inet.c.
| net/ipv4/af_inet.c |
static int __init inet_init(void)
{
...
printk(KERN_INFO "NET4: Linux TCP/IP 1.0 for NET4.0\n");
...
}
module_init(inet_init);
| |
- We can confirm the startup message.
- See __init and module_init(), these macros are defined in include/linux/init.h.
| include/linux/init.h |
#ifndef MODULE
#ifndef __ASSEMBLY__
...
typedef int (*initcall_t)(void);
...
extern initcall_t __initcall_start, __initcall_end;
#define __initcall(fn) \
static initcall_t __initcall_##fn __init_call = fn
...
#endif /* __ASSEMBLY__ */
/*
* Mark functions and data as being only used at initialization
* or exit time.
*/
#define __init __attribute__ ((__section__ (".text.init")))
...
#define __init_call __attribute__ ((unused,__section__ (".initcall.init")))
...
/**
* module_init() - driver initialization entry point
* @x: function to be run at kernel boot time or module insertion
*
* module_init() will add the driver initialization routine in
* the "__initcall.int" code segment if the driver is checked as
* "y" or static, or else it will wrap the driver initialization
* routine with init_module() which is used by insmod and
* modprobe when the driver is used as a module.
*/
#define module_init(x) __initcall(x);
...
#else // MODULE
...
#define __init
...
#define __initcall(fn)
...
#define module_init(x) \
int init_module(void) __attribute__((alias(#x))); \
extern inline __init_module_func_t __init_module_inline(void) \
{ return x; }
...
#endif // MODULE
| |
- init.h is controlled by the global macro MODULE. Makefile turns on this macro (-DMODULE) in case of module.
- Currently, CONFIG_INET option can not be defined as module ("M") and it is compiled into the kernel ("y").
- After preprocessing, af_inet.c will be rewritten to as follows.
| net/ipv4/af_inet.c |
static int __attribute__ ((__section__ (".text.init"))) inet_init(void)
{
...
printk(KERN_INFO "NET4: Linux TCP/IP 1.0 for NET4.0\n");
...
}
initcall_t __initcall_inet_init __attribute__ ((unused,__section__ (".initcall.init"))) = inet_init;
| |
- These expansions mean that
- The text code of inet_init() will be stored into .text.init section. This mechanism is aided for freeing memory space of initializers after kernel startup.
- A new variable __initcall_inet_init which holds the entry address of inet_init will be stored into .initcall.init section. Note that the macro definition in init.h says this variable is declared as static, so we can not confirm it in the kernel symbol table (only global scope addresses are registered in the table).
- For hacking purpose, remove the static keyword and delcare __initcall_*** variables as global. CAUTION: This change may bring link errors in case of name collisions (netfilter is one of the case).
- OK, let's hack the kernel!
| modified include/linux/init.h |
...
#define __initcall(fn) \
initcall_t __initcall_##fn __init_call = fn
...
| |
![]() How to inspect the kernel?
- Linux kernel is not a special one. It is nothing more than an ELF object file like as /bin/ls.
- So, you can examine the kernel (vmlinux) using nm, objdump, readelf, and so on.
- By default, top level Makefile creates a System.map file for debugging, but it is nothing but a list of labels. So, I modified the Makefile to create an informative link map using "--cref -Map linux.map" options.
- Now, "make vmlinux" creates vmlinux and outputs a linux.map.
| /usr/src/linux/Makefile |
vmlinux: $(CONFIGURATION) init/main.o init/version.o linuxsubdirs
$(LD) $(LINKFLAGS) $(HEAD) init/main.o init/version.o \
--start-group \
$(CORE_FILES) \
$(DRIVERS) \
$(NETWORKS) \
$(LIBS) \
--end-group \
--cref -Map linux.map \
-o vmlinux
$(NM) vmlinux | grep -v '\(compiled\)\|\(\.o$$\)\|\( [aUw] \)\|\(\.\.ng$$\)\|\(LASH[RL]DI\)'
| sort > System.map
| |
- Then, confirm the sections in vmlinux by objdump command. "-h" option outputs information from the section headers.
- Yes, there are ".text.init" and ".initcall.init" sections described above.
- Let's examine the contents of .initcall.init section.
| objdump -h vmlinux |
vmlinux: file format elf32-i386
Sections:
Idx Name Size VMA LMA File off Algn
0 .text 0010bf68 c0100000 c0100000 00001000 2**4
CONTENTS, ALLOC, LOAD, READONLY, CODE
1 .text.lock 00001130 c020bf68 c020bf68 0010cf68 2**2
CONTENTS, ALLOC, LOAD, READONLY, CODE
2 .rodata 0004407c c020d0a0 c020d0a0 0010e0a0 2**5
CONTENTS, ALLOC, LOAD, READONLY, DATA
3 .kstrtab 000062fe c0251120 c0251120 00152120 2**5
CONTENTS, ALLOC, LOAD, READONLY, DATA
4 __ex_table 00001418 c0257420 c0257420 00158420 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
5 __ksymtab 00001d68 c0258838 c0258838 00159838 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
6 .data 00013abc c025a5a0 c025a5a0 0015b5a0 2**5
CONTENTS, ALLOC, LOAD, DATA
7 .data.init_task 00002000 c0270000 c0270000 00170000 2**5
CONTENTS, ALLOC, LOAD, DATA
8 .text.init 0000f56c c0272000 c0272000 00172000 2**4
CONTENTS, ALLOC, LOAD, READONLY, CODE
9 .data.init 0001de60 c0281580 c0281580 00181580 2**5
CONTENTS, ALLOC, LOAD, DATA
10 .setup.init 00000108 c029f3e0 c029f3e0 0019f3e0 2**2
CONTENTS, ALLOC, LOAD, DATA
11 .initcall.init 00000090 c029f4e8 c029f4e8 0019f4e8 2**2
CONTENTS, ALLOC, LOAD, DATA
12 .data.page_aligned 00000800 c02a0000 c02a0000 001a0000 2**5
CONTENTS, ALLOC, LOAD, DATA
13 .data.cacheline_aligned 00001fe0 c02a0800 c02a0800 001a0800 2**5
CONTENTS, ALLOC, LOAD, DATA
14 .bss 0002b3d8 c02a27e0 c02a27e0 001a27e0 2**5
ALLOC
15 .comment 00003bc9 00000000 00000000 001a27e0 2**0
CONTENTS, READONLY
16 .note 00001a90 00000000 00000000 001a63a9 2**0
CONTENTS, READONLY
| |
- The following is a part of linux.map.
- __initcall_start and __initcall_end appeared in do_initcalls() are defined in the top and bottom of this section.
- Their addresses are C029F4E8 and C029F578, respectively.
- As I removed static keyword in __initcall() macro, __initcall_*** variables are visible to us. From this link table, we can completely trace the boot process.
- TIPS: Every kernel hacker does grep, grep, and grep..., but this is quite time-consuming work. linux.map contains all of function entry points (its name and address) and tells us which object file contains it. Why not "less linux.map"?
| linux.map |
0xc029f4e8 __initcall_start=.
.initcall.init 0xc029f4e8 0x90
*(.initcall.init)
.initcall.init
0xc029f4e8 0xc arch/i386/kernel/kernel.o
0xc029f4e8 __initcall_dmi_scan_machine
0xc029f4ec __initcall_cpuid_init
0xc029f4f0 __initcall_apm_init
.initcall.init
0xc029f4f4 0x4 kernel/kernel.o
0xc029f4f4 __initcall_uid_cache_init
.initcall.init
0xc029f4f8 0xc mm/mm.o
0xc029f4f8 __initcall_kmem_cpucache_init
0xc029f4fc __initcall_kswapd_init
0xc029f500 __initcall_init_shmem_fs
.initcall.init
0xc029f504 0x3c fs/fs.o
0xc029f504 __initcall_bdflush_init
0xc029f508 __initcall_init_pipe_fs
0xc029f50c __initcall_fasync_init
0xc029f510 __initcall_filelock_init
0xc029f514 __initcall_dnotify_init
0xc029f518 __initcall_init_misc_binfmt
0xc029f51c __initcall_init_script_binfmt
0xc029f520 __initcall_init_elf_binfmt
0xc029f524 __initcall_init_proc_fs
0xc029f528 __initcall_partition_setup
0xc029f52c __initcall_init_ext2_fs
0xc029f530 __initcall_init_fat_fs
0xc029f534 __initcall_init_msdos_fs
0xc029f538 __initcall_init_iso9660_fs
0xc029f53c __initcall_init_reiserfs_fs
.initcall.init
0xc029f540 0x4 drivers/block/block.o
0xc029f540 __initcall_loop_init
.initcall.init
0xc029f544 0x4 drivers/char/char.o
0xc029f544 __initcall_rs_init
.initcall.init
0xc029f548 0x8 drivers/net/net.o
0xc029f548 __initcall_dummy_init_module
0xc029f54c __initcall_rtl8139_init_module
.initcall.init
0xc029f550 0x4 drivers/ide/idedriver.o
0xc029f550 __initcall_ide_cdrom_init
.initcall.init
0xc029f554 0x4 drivers/cdrom/driver.o
0xc029f554 __initcall_cdrom_init
.initcall.init
0xc029f558 0x4 drivers/pci/driver.o
0xc029f558 __initcall_pci_proc_init
.initcall.init
0xc029f55c 0x1c net/network.o
0xc029f55c __initcall_p8022_init
0xc029f560 __initcall_snap_init
0xc029f564 __initcall_inet_init
0xc029f568 __initcall_af_unix_init
0xc029f56c __initcall_netlink_proto_init
0xc029f570 __initcall_packet_init
0xc029f574 __initcall_atalk_init
0xc029f578 __initcall_end=.
0xc02a0000 .=ALIGN(0x1000)
0xc029f578 __init_end=.
0xc02a0000 .=ALIGN(0x1000)
| |
- Now, we noticed important things.
- The first code relating the network is sock_init().
- loopback device is initialized in partition_setup().
- dummy and Ethernet devices are initialized.
- TCP/IP is initialized in inet_init().
- UNIX domain sockets are initialized in af_unix_init().
- I will discuss each subjects later on (please be patient).
|
|
