STM32F103 ucLinux开发之二（内核启动汇编代码分析)

start_kernel之前的汇编代码分析

Boot中执行下面两句话之后，进入uclinux内核。

theKernel = (void (*)(int, int, unsigned int))((uint32_t)0x08003001);

theKernel(0, 2189, ((uint32_t)0x20000100));

首先来到0x0800 3000处，此时携带有三个参数，R0、R1、R2，分别是0,2189,0x2000 0100.

0x0800 3000对应着下面stext的汇编代码。

代码阅读说明：

① @后面的内容标示是注释语句

② ARM或者THUMB指令的选取，在\include\asm-arm\unified.h中，定义了使用ARM，THUMB为空

③ 偏移量#PROC_INFO_SZ等，在\include\asm\asm-offset.h中宏定义

1.1   head-mommu.S

文件在arch\arm\kernel\head-nommu.S，text.head段，有stext、__after_proc_init两段组成，内核从这里开始启动，然后通过各种调用，最终进入C语言的start_kernel函数，这段代码执行流程如下：

（1）       调用__lookup_processor_type，传入R9（CPU基址寄存器的值），成功后获得当前的proc_info结构体信息，地址放入R10；

（2）       调用__lookup_machine_type，BootLoader传给内核的R1值，成功后获得当前的machine_desc结构体信息，地址放入R8；

（3）       执行__v7m_setup，进行必要的初始化；

（4）       执行__switch_data，并最终跳转到C语言的start_kernel函数。

.section ".text.head", "ax"

ENTRY(stext)

cpsid       i                           @ disable interrupts       //cortex-M3特殊指令，关闭所有中断

ldr   r9, =0xe000ed00                  @ CPUID register address

ldr   r9, [r9]                         //CPUID基址寄存器，参考手册（周立功）-P80

bl    __lookup_processor_type             @ r5=procinfo r9=cupid              //head-common.S

movs       r10, r5                         @ invalid processor (r5=0)?

beq  __error_p                            @ yes, error 'p'

bl    __lookup_machine_type        @ r5=machinfo

movs       r8, r5                           @ invalid machine (r5=0)?

beq  __error_a                     @ yes, error 'a'

badr lr, __after_proc_init              @ return (PIC) address         //提前暂存lr的值

ARM(   add  pc, r10, #PROCINFO_INITFUNC       )      //R10处偏移16个字节，然后赋给PC

//相当于跳转到下面的__v7m_setup

ENDPROC(stext)

__after_proc_init:

ldr   pc,__switch_data           //将PC 指针赋值到__switch_data标号地址处，实际执行的

ENDPROC(__after_proc_init)      //是在__mmap_switched这个标号处

.ltorg

#include "head-common.S"          //末尾包含下面的文件

1.2   head-common.S

文件在arch\arm\kernel\head-common.S，有__switch_data、__mmap_switched、__error_p、__error_a、__error、__lookup_processor_type、C语言的lookup_processor_type、__lookup_machine_type  、C语言的lookup_machine_type、__vet_atags等组成，这里只列出上面调用要使用的查找处理器类型和查找机器类型。

_lookup_processor_type:                     //r9是刚从CPU基址寄存器中取出的值

ARM(   adr   r3, 3f             )      //执行此句后，r3的地址是后面标号3处的地址

ARM(   ldmda     r3, {r5 - r7}   )//r5,r6,r7依次变为，__proc_info_begin，end，以及

//标号3处的末尾链接地址

sub  r3, r3, r7               @ get offset between virt&phys    //这三行执行虚实地址转换

add  r5, r5, r3               @ convert virt addresses to//r5是proc_info_list结构体地址

add  r6, r6, r3               @ physical address space       //__proc_info_end的自己

1:    ldmia      r5, {r3, r4}                   @ value, mask              //r3是结构体的val变量

and  r4, r4, r9               @ mask wanted bits              //r4是结构体的mask变量

teq   r3, r4

beq  2f                                                                   //相等转到后面的2标号处

add  r5, r5, #PROC_INFO_SZ             @ sizeof(proc_info_list)       //宏定义在asm-offset.h

cmp r5, r6             //结构体可能是个数组，需要全部查找，若r5的地址没有超出end

blo   1b                  //的地址，则继续转到1处理，若最后没找到，r5变为空

mov r5, #0                           @ unknown processor

2:    mov pc, lr

ENDPROC(__lookup_processor_type)

ENTRY(lookup_processor_type)

stmfd      sp!, {r4 - r7, r9, lr}

mov r9, r0             //提供C语言的API结构，r0是传入的参数

bl    __lookup_processor_type

mov r0, r5             //此处的R0是函数的返回值，即传出的参数

ldmfd      sp!, {r4 - r7, r9, pc}

ENDPROC(lookup_processor_type)

.long       __proc_info_begin        //arch/arm/kernel/vmlinux.lds.s中定义

.long       __proc_info_end

3:    .long       .

.long       __arch_info_begin

.long       __arch_info_end

/*

* Lookup machine architecture in the linker-build list of architectures.

* Note that we can't use the absolute addresses for the __arch_info

* lists since we aren't running with the MMU on (and therefore, we are

* not in the correct address space).  We have to calculate the offset.

*

*  r1 = machine architecture number

* Returns:

*  r3, r4, r6 corrupted

*  r5 = mach_info pointer in physical address space

*/

__lookup_machine_type:

adr   r3, 3b

ldmia      r3, {r4, r5, r6}       //r5是__arch_info_begin，r6是end

sub  r3, r3, r4               @ get offset between virt&phys    //虚实地址转换

add  r5, r5, r3               @ convert virt addresses to

add  r6, r6, r3               @ physical address space

1:    ldr   r3, [r5, #MACHINFO_TYPE]      @ get machine type //结构体偏移字节数，见上面的注释

teq   r3, r1                           @ matches loader number?    //与传递给内核的r1相同

beq  2f                         @ found                                     //r3就是结构体中第一个变量nr

add  r5, r5, #SIZEOF_MACHINE_DESC    @ next machine_desc

cmp r5, r6

blo   1b

mov r5, #0                           @ unknown machine

2:    mov pc, lr

ENDPROC(__lookup_machine_type)

/*

* This provides a C-API version of the above function.

*/

ENTRY(lookup_machine_type)

stmfd      sp!, {r4 - r6, lr}

mov r1, r0             //提供C语言的API结构，r0是传入的参数

bl    __lookup_machine_type

mov r0, r5             //此处的R0是函数的返回值，即传出的参数

ldmfd      sp!, {r4 - r6, pc}

ENDPROC(lookup_machine_type)

1.2.1    lookup_processor_type

（1）vmlinux.lds.s

文件在arch\arm\kernel\ vmlinux.lds.s

__proc_info_begin = .;                 //include/asm-arm/procinfo.h中定义

*(.proc.info.init)

__proc_info_end = .;

__arch_info_begin = .;                 //include/asm-arm/mach/arch.h 中定义

*(.arch.info.init)

__arch_info_end = .;

（2）procinfo.h

文件在include/asm-arm/procinfo.h

struct proc_info_list {                   // pro-v7m.S对其实例化

unsigned int           cpu_val;

unsigned int           cpu_mask;

unsigned long        __cpu_mm_mmu_flags; /* used by head.S */

unsigned long        __cpu_io_mmu_flags;    /* used by head.S */

unsigned long        __cpu_flush;          /* used by head.S */

const char              *arch_name;

const char              *elf_name;

unsigned int           elf_hwcap;

const char              *cpu_name;

struct processor      *proc;

struct cpu_tlb_fns   *tlb;

struct cpu_user_fns *user;

struct cpu_cache_fns      *cache;

};

（3）pro-v7m.S

文件在arch\arm\mm\ pro-v7m.S，内容很多，核心就是.section ".proc.info.init"，其它的都是它这个结构体中得成员，如__v7m_setup、cpu_arch_name、cpu_elf_name、cpu_v7m_name、v7m_processor_functions等。

cpu_v7m_name:

.ascii       "ARMv7-M Processor"

.align

.section ".text.init", #alloc, #execinstr

.type v7m_processor_functions, #object

ENTRY(v7m_processor_functions)

.word      v7m_early_abort

.word      cpu_v7m_proc_init

.word      cpu_v7m_proc_fin

.word      cpu_v7m_reset

.word      cpu_v7m_do_idle

.word      cpu_v7m_dcache_clean_area

.word      cpu_v7m_switch_mm

.word      cpu_v7m_set_pte_ext

.word      pabort_noifar

.size v7m_processor_functions, . - v7m_processor_functions

.type cpu_arch_name, #object

cpu_arch_name:

.asciz      "armv7m"

.size cpu_arch_name, . - cpu_arch_name

.type       cpu_elf_name, #object

cpu_elf_name:

.asciz      "v7m"

.size cpu_elf_name, . - cpu_elf_name

.align

.section ".proc.info.init", #alloc, #execinstr

/*

* Match any ARMv7-M processor core.

*/

.type       __v7m_proc_info, #object

__v7m_proc_info:          //E000ED00是CPUID基址寄存器，其中[19:16]读作常量F

.long       0x000f0000           @ Required ID value

.long       0x000f0000           @ Mask for ID

.long   0                     @ proc_info_list.__cpu_mm_mmu_flags

.long   0                     @ proc_info_list.__cpu_io_mmu_flags

b     __v7m_setup         @ proc_info_list.__cpu_flush

.long       cpu_arch_name

.long       cpu_elf_name

.long    HWCAP_SWP|HWCAP_HALF|HWCAP_THUMB|HWCAP_FAST_MULT|HWCAP_EDSP

.long       cpu_v7m_name

.long       v7m_processor_functions      @ proc_info_list.proc

.long       0                   @ proc_info_list.tlb

.long       0                   @ proc_info_list.user

.long       0                   @ proc_info_list.cache

.size __v7m_proc_info, . - __v7m_proc_info

1.2.2    lookup_machine_type

（1）arch.h

文件在include/asm-arm/mach/arch.h

struct machine_desc {                  //在stm3210e_eval.c中实例化

/*

* Note! The first four elements are used

* by assembler code in head.S, head-common.S

*/

unsigned int           nr;          /* architecture number   */

unsigned int           phys_io;  /* start of physical io     */

unsigned int           io_pg_offst;    /* byte offset for io

* page tabe entry  */

const char              *name;           /* architecture name      */

unsigned long        boot_params;  /* tagged list          */

unsigned int           video_start;     /* start of video RAM    */

unsigned int           video_end;      /* end of video RAM     */

unsigned int           reserve_lp0 :1;       /* never has lp0      */

unsigned int           reserve_lp1 :1;       /* never has lp1      */

unsigned int           reserve_lp2 :1;       /* never has lp2      */

unsigned int           soft_reboot :1;       /* soft reboot         */

void               (*fixup)(struct machine_desc *,

struct tag *, char **,

struct meminfo *);

void               (*map_io)(void);/* IO mapping function     */

void               (*init_irq)(void);

struct sys_timer      *timer;           /* system tick timer       */

void               (*init_machine)(void);

};

/*

* Set of macros to define architecture features.  This is built into

* a table by the linker.

*/

#define MACHINE_START(_type,_name)                 \

static const struct machine_desc __mach_desc_##_type       \

__used                                             \

__attribute__((__section__(".arch.info.init"))) = {    \

.nr          = MACH_TYPE_##_type,          \

.name             = _name,

#define MACHINE_END                          \

};

（2）stm3210e_eval.c

文件在arch\arm\mach-stm3210e_eval\ stm3210e_eval.c

MACHINE_START(STM3210E_EVAL, "STM3210E-EVAL")

/* Maintainer: MCD Application TEAM */                               /* Status */

.fixup             = stm3210e_eval_fixup,                             //OK

.boot_params  = CONFIG_EXTERNAL_RAM_BASE + 0x100,                     //OK

.init_irq   = nvic_init_irq,                                  //OK

.timer             = &stm3210e_eval_timer,                                 //OK

.init_machine  = stm3210e_eval_init,                                //OK

MACHINE_END

（3）match-type.h

文件在include/asm-arm/mach-type.h

#define MACH_TYPE_STM3210E_EVAL        2189

1.3   __v7m_setup

文件在arch\arm\mm\ pro-v7m.S

/*

* __v7m_setup

*

* Initialise TLB, Caches, and MMU state ready to switch the MMU

* on.  Return in r0 the new CP15 C1 control register setting.

*

* We automatically detect if we have a Harvard cache, and use the

* Harvard cache control instructions insead of the unified cache

* control instructions.

*

* This should be able to cover all ARMv7-M cores.

*

* It is assumed that:

* - cache type register is implemented

*/

__v7m_setup:

@ Configure the vector table base address    //配置中断向量偏移

ldr   r0, =0xe000ed08           @ vector table base address

ldr   r12, =vector_table

str    r12, [r0]

@ Lower the priority of the SVC and PendSV exceptions

ldr   r0, =0xe000ed1c    //设置SVC、PendSV的中断优先级都为128

mov r5, #0x80000000

str    r5, [r0]           @ set SVC priority

ldr   r0, =0xe000ed20

mov r5, #0x00800000

str    r5, [r0]           @ set PendSV priority

@ SVC to run the kernel in this mode

badr r0, 1f

ldr   r5, [r12, #11 * 4]   @ read the SVC vector entry

str    r0, [r12, #11 * 4]   @ write the temporary SVC vector entry

mov r6, lr                     @ save LR

mov r7, sp                    @ save SP

#if !defined(CONFIG_XIP_KERNEL)

ldr   sp, =__v7m_setup_stack_top

#endif

cpsie       i

svc   #0                  //呼叫系统服务，权威指南-P182，暂时没找到？

1: cpsid       i

str    r5, [r12, #11 * 4]   @ restore the original SVC vector entry

mov lr, r6                     @ restore LR

mov sp, r7                    @ restore SP

@ Special-purpose control register

mov r0, #1                           //还是进入特权级的线程模式，主堆栈？

msr  control, r0             @ Thread mode has unpriviledged access

@ Configure the System Control Register

ldr   r0, =0xe000ed10           @ system control register

ldr   r12, [r0]                       //不知道是干啥，不确定是否在E000 ED10上

orr   r12, #1 << 9          @ STKALIGN

str    r12, [r0]                //E000 ED14的这个位倒是为了对齐双字节，指南-306

mov pc, lr                     //之前的lr值赋给PC，即PC转到那里执行

ENDPROC(__v7m_setup)

1.4   __switch_data

文件在arch\arm\kernel\head-common.S

.type       __switch_data, %object

__switch_data:

.long       __mmap_switched

.long       __data_loc                    @ r4

.long       __data_start                  @ r5

.long       _edata_loc                    @ r6 //added to determine the size of data segment to be copied.

.long       __bss_start                    @ r6

.long       _end                            @ r7

.long       processor_id                 @ r4

.long       __machine_arch_type           @ r5

.long       __atags_pointer                    @ r6

#ifdef CONFIG_CPU_CP15

.long       cr_alignment                 @ r7

#else

.long       0                          @ r7

#endif

.long       init_thread_union + THREAD_START_SP @ sp

/*

* The following fragment of code is executed with the MMU on in MMU mode,

* and uses absolute addresses; this is not position independent.

*

*  r0  = cp#15 control register

*  r1  = machine ID

*  r2  = atags pointer

*  r9  = processor ID

*/

__mmap_switched:        //从__v7m_setup出来以后，转到这里

adr   r3, __switch_data + 4

ldmia      r3!, {r4, r5, r6}

cmp r4, r5                           @ Copy data segment if needed

beq  2f

1:    ldr   fp, [r4], #4            //fp是r11

str    fp, [r5], #4

cmp r4, r6

bne  1b

2:    ldmia      r3!,{r6,r7}                   @load __bss_start to r6 and _end to r7

mov fp, #0                           @ Clear BSS (and zero fp)

1:    cmp r6, r7

itt    cc                  //itt相当于if-then

strcc fp, [r6],#4

bcc  1b

ARM(   ldmia      r3, {r4, r5, r6, r7, sp})

str    r9, [r4]                  @ Save processor ID被赋值

str    r1, [r5]                  @ Save machine type被赋值

str    r2, [r6]                  @ Save atags pointer被赋值

bic   r4, r0, #CR_A               @ Clear 'A' bit              这句貌似没用？

#if !defined (CONFIG_CPU_V7M)

stmia       r7, {r0, r4}                   @ Save control register values

#endif

@2: b     2b

b     start_kernel            //跳入C语言的函数

ENDPROC(__mmap_switched)