一： Linux kernel内存存布局
在ARM平台中zImage.bin是一个压缩镜像，它用于将被压缩的kernel解压缩到KERNEL_RAM_PADDR开始的一段内存中，接着跳进真正的kernel去执行。该kernel的执行起点是stext函数，定义于arch/arm/kernel/head.S。在分析ENTRY(stext)前，先介绍此时内存的布局如下图所示：
图一：内存布局［此处借用下网络上已有的图片，自己不想弄图片了］
在我的YL-E2410的平台上，SDRAM的开始内存地址是0x30000000，大小为64M，即0x20000000。 Linux2.6.38.8 ARM kernel将SDRAM的开始地址定义为PHYS_OFFSET。经bootloader加载kernel并由自解压部分代码运行后，最终kernel被放置到KERNEL_RAM_PADDR（=PHYS_OFFSET + TEXT_OFFSET，即0x30008000）地址上的一段内存，经此放置后，kernel代码以后均不会被移动。在arch\arm\mach-s3c2410\Makefile.boot文件，其内容如下：
zreladdr-y := 0x30008000
params_phys-y := 0x30000100
这也验证了为什么内核会被放置在0x30008000的地方了，这个地址必须由Makefile.boot指定。而params_phys-y则是linux Kernel的taglist等参数的起始地址。在进入kernel代码前，即自解压缩阶段，ARM未开启MMU功能。因此启动代码一个重要功能是设置好相应的页表，并开启MMU功能。为了支持MMU功能，kernel镜像中的所有符号，包括代码段和数据段的符号，在链接时都生成了它在开启MMU时，所在物理内存地址映射到的虚拟内存地址。Kernel第一个符号stext为例，在编译链接，它生成的虚拟地址是0xc0008000，而放置它的物理地址为0x30008000。实际上这个变换可以利用简单的公式进行表示：va = pa – PHYS_OFFSET + PAGE_OFFSET。Arm linux最终的kernel空间的页表，就是按照这个关系来建立。之所提及linux的内存映射，原因是在进入kernel代码，里面所有符号地址值为0xCxxxxxxx地址，而此时ARM未开启MMU功能，故在执行stext函数第一条执行时，它的PC值就是stext所在的内存地址（即物理地址，0x30008000）。
二：stext函数详解
stext函数定义在arch/arm/kernel/head.S，它的功能是获取处理器类型和机器类型信息，并创建临时的页表，然后开启MMU功能，并跳进第一个C语言函数start_kernel。stext函数的在前置条件是：MMU, D-cache, 关闭; r0 = 0, r1 = machine nr, r2 = atags prointer.
[cpp]- /* * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as * published by the Free Software Foundation.
- * * Kernel startup code for all 32-bit CPUs
- */ #include <linux/linkage.h>
- #include <linux/init.h>
- #include <asm/assembler.h> #include <asm/domain.h>
- #include <asm/ptrace.h> #include <asm/asm-offsets.h>
- #include <asm/memory.h> #include <asm/thread_info.h>
- #include <asm/system.h>
- #ifdef CONFIG_DEBUG_LL #include <mach/debug-macro.S>
- #endif
- #if (PHYS_OFFSET & 0x001fffff) #error "PHYS_OFFSET must be at an even 2MiB boundary!"
- #endif
- #define KERNEL_RAM_VADDR (PAGE_OFFSET + TEXT_OFFSET) #define KERNEL_RAM_PADDR (PHYS_OFFSET + TEXT_OFFSET)
- /* * swapper_pg_dir is the virtual address of the initial page table.
- * We place the page tables 16K below KERNEL_RAM_VADDR. Therefore, we must * make sure that KERNEL_RAM_VADDR is correctly set. Currently, we expect
- * the least significant 16 bits to be 0x8000, but we could probably * relax this restriction to KERNEL_RAM_VADDR >= PAGE_OFFSET + 0x4000.
- */ #if (KERNEL_RAM_VADDR & 0xffff) != 0x8000
- #error KERNEL_RAM_VADDR must start at 0xXXXX8000 #endif
- .globl swapper_pg_dir
- .equ swapper_pg_dir, KERNEL_RAM_VADDR - 0x4000
- .macro pgtbl, rd ldr \rd, =(KERNEL_RAM_PADDR - 0x4000)
- .endm
- #ifdef CONFIG_XIP_KERNEL #define KERNEL_START XIP_VIRT_ADDR(CONFIG_XIP_PHYS_ADDR)
- #define KERNEL_END _edata_loc #else
- #define KERNEL_START KERNEL_RAM_VADDR #define KERNEL_END _end
- #endif
- /* * Kernel startup entry point.
- * --------------------------- *
- * This is normally called from the decompressor code. The requirements * are: MMU = off, D-cache = off, I-cache = dont care, r0 = 0,
- * r1 = machine nr, r2 = atags pointer. *
- * This code is mostly position independent, so if you link the kernel at * 0xc0008000, you call this at __pa(0xc0008000).
- * * See linux/arch/arm/tools/mach-types for the complete list of machine
- * numbers for r1. *
- * We're trying to keep crap to a minimum; DO NOT add any machine specific * crap here - that's what the boot loader (or in extreme, well justified
- * circumstances, zImage) is for. */
- __HEAD ENTRY(stext)
- /* 设置CPU运行模式为SVC，并关中断 */ setmode PSR_F_BIT | PSR_I_BIT | SVC_MODE, r9 @ ensure svc mode
- @ and irqs disabled mrc p15, 0, r9, c0, c0 @ get processor id
- bl __lookup_processor_type @ r5=procinfo r9=cpuid * r10指向cpu对应的proc_info记录 */
- movs r10, r5 @ invalid processor (r5=0)? THUMB( it eq ) @ force fixup-able long branch encoding
- beq __error_p @ yes, error 'p' bl __lookup_machine_type @ r5=machinfo
- /* r8 指向开发板对应的arch_info记录 */ movs r8, r5 @ invalid machine (r5=0)?
- THUMB( it eq ) @ force fixup-able long branch encoding beq __error_a @ yes, error 'a'
- /* __vet_atags函数涉及bootloader造知kernel物理内存的情况 */ /*
- * r1 = machine no, r2 = atags, * r8 = machinfo, r9 = cpuid, r10 = procinfo
- */ bl __vet_atags
- #ifdef CONFIG_SMP_ON_UP bl __fixup_smp
- #endif /* 创建临时页表 */
- bl __create_page_tables
- /* * The following calls CPU specific code in a position independent
- * manner. See arch/arm/mm/proc-*.S for details. r10 = base of * xxx_proc_info structure selected by __lookup_machine_type
- * above. On return, the CPU will be ready for the MMU to be * turned on, and r0 will hold the CPU control register value.
- * 这里的逻辑关系相当复杂，先是从proc_info结构中的中跳进__arm920_setup函数， * 然后执__enable_mmu 函数。最后在__enable_mmu函数通过mov pc, r13来执行__mmap_switched，
- * __mmap_switched函数在最后一条语句，鱼跃龙门，跳进第一个C语言函数start_kernel */
- ldr r13, =__mmap_switched @ address to jump to after @ mmu has been enabled
- adr lr, BSYM(1f) @ return (PIC) address ARM( add pc, r10, #PROCINFO_INITFUNC )
- THUMB( add r12, r10, #PROCINFO_INITFUNC ) THUMB( mov pc, r12 )
- 1: b __enable_mmu ENDPROC(stext)
- .ltorg