封面图加载中

[linux内存管理] 第005篇 启动代码分析之汇编部分

copyright_author: 科学边界 copyright_author_href: https://www.daodaodao123.com/ copyright_info: 此文章版权归科学边界所有，如有转载，请注明来自原作者 copyright_url: https://www.daod
  • 本文作者
  • 文章发布日期 2024-11-26 05:59
  • 热度 7
  • 本文共计
  • 预计阅读

copyright_author: 科学边界
copyright_author_href: https://www.daodaodao123.com/
copyright_info: 此文章版权归科学边界所有，如有转载，请注明来自原作者
copyright_url: https://www.daodaodao123.com/?p=715

首先是引导程序，即 bootloader，简单说即 bootloader 会做如下事情：
(1)初始化物理内存；
(2)设置设备树；
(3)解压缩内核映像，将其加载到内核运行地址(可选);
(4)跳转到内核入口地址; 下面进入 Linux 范畴：

一、内核的起始地址

第一个要看的文件，“arch/arm64/kernel/vmlinux.lds.S”，Linux内核的链接脚本。

OUTPUT_ARCH(aarch64)  /// 编译目标文件格式为 aarch64
ENTRY(_text)          /// 内核入口地址

Linux 内核的内存布局定义

 /***************************************************************************
 * 内核的内存布局：*
 * 包括代码段(.text)，只读数据段(.rodata)，初始化数据段(.init.), .bss 段等
 * 几个常见的地址在 arch/arm64/mm/init.c 加了打印
 *
 **************************************************************************/
SECTIONS
{
    . = KIMAGE_VADDR;  /// 内核的起始链接地址，...

	.head.text : {
		_text = .;     ///内核入口地址
		HEAD_TEXT
	}
	.text : ALIGN(SEGMENT_ALIGN) {	/* Real text segment		*/
		_stext = .;		/* Text and read-only data	*/
			IRQENTRY_TEXT
			SOFTIRQENTRY_TEXT
			ENTRY_TEXT
			TEXT_TEXT
			SCHED_TEXT
			CPUIDLE_TEXT
			LOCK_TEXT
			KPROBES_TEXT
			HYPERVISOR_TEXT
			IDMAP_TEXT
			HIBERNATE_TEXT
			TRAMP_TEXT
			*(.fixup)
			*(.gnu.warning)
		. = ALIGN(16);
		*(.got)			/* Global offset table		*/
	}
}

这里我们追寻一下我司的一个高通的项目sm4450平台的，使用readelf读取vmlinux可知
从vmlinux.lds.S中的section可知，KIMAGE_VADDR地址对应的就是readelf输出结果中的[ 1] .head.text，所以KIMAGE_VADDR为0xffffffc008000000

llvm-readelf.exe -S D:\dump\vmlinux\vmlinux
There are 53 section headers, starting at offset 0x1c8612f0:

Section Headers:
  [Nr] Name              Type            Address          Off    Size   ES Flg Lk Inf Al
  [ 0]                   NULL            0000000000000000 000000 000000 00      0   0  0
  [ 1] .head.text        PROGBITS        ffffffc008000000 010000 010000 00  AX  0   0 65536
  [ 2] .text             PROGBITS        ffffffc008010000 020000 14131d8 00 WAX  0   0 4096
  [ 3] .rodata           PROGBITS        ffffffc009430000 1440000 aa45b3 00 WAMS  0   0 4096
  [ 4] .rodata1          PROGBITS        ffffffc009ed45b3 1ee45b3 000000 00  WA  0   0  1
  [ 5] .pci_fixup        PROGBITS        ffffffc009ed45c0 1ee45c0 0024c0 00   A  0   0 16
  [ 6] .builtin_fw       PROGBITS        ffffffc009ed6a80 1ee6a80 000000 00   A  0   0  8
  [ 7] __ksymtab         PROGBITS        ffffffc009ed6a80 1ee6a80 0084fc 00   A  0   0  4
  [ 8] __ksymtab_gpl     PROGBITS        ffffffc009edef7c 1eeef7c 00c660 00   A  0   0  4
  [ 9] __ksymtab_unused  PROGBITS        ffffffc009eeb5dc 1efb5dc 000000 00   A  0   0  1
  [10] __ksymtab_unused_gpl PROGBITS     ffffffc009eeb5dc 1efb5dc 000000 00   A  0   0  1
  [11] __ksymtab_gpl_future PROGBITS     ffffffc009eeb5dc 1efb5dc 000000 00   A  0   0  1
  [12] __kcrctab         PROGBITS        ffffffc009eeb5dc 1efb5dc 002c54 00   A  0   0  4
  [13] __kcrctab_gpl     PROGBITS        ffffffc009eee230 1efe230 004220 00   A  0   0  1
  [14] __kcrctab_unused  PROGBITS        ffffffc009ef2450 1f02450 000000 00   A  0   0  1
  [15] __kcrctab_unused_gpl PROGBITS     ffffffc009ef2450 1f02450 000000 00   A  0   0  1
  [16] __kcrctab_gpl_future PROGBITS     ffffffc009ef2450 1f02450 000000 00   A  0   0  1
  [17] __ksymtab_strings PROGBITS        ffffffc009ef2450 1f02450 02816c 01 AMS  0   0  1
  [18] __init_rodata     PROGBITS        ffffffc009f1a5bc 1f2a5bc 000000 00   A  0   0  1
  [19] __param           PROGBITS        ffffffc009f1a5c0 1f2a5c0 003778 00   A  0   0  8
  [20] __modver          PROGBITS        ffffffc009f1dd38 1f2dd38 0000d8 00   A  0   0  8
  [21] __ex_table        PROGBITS        ffffffc009f1de10 1f2de10 002d68 00   A  0   0  8
  [22] .notes            NOTE            ffffffc009f20b78 1f30b78 00003c 00   A  0   0  4
  [23] .hyp.rodata       PROGBITS        ffffffc009f21000 1f31000 001000 00 WAMS  0   0  8
  [24] .init.text        PROGBITS        ffffffc009f30000 1f40000 05ec8c 00  AX  0   0  4
  [25] .exit.text        PROGBITS        ffffffc009f8ec8c 1f9ec8c 0082dc 00  AX  0   0  4
  [26] .altinstructions  PROGBITS        ffffffc009f96f68 1fa6f68 0cb5bc 00   A  0   0  1
  [27] .init.data        PROGBITS        ffffffc00a070000 2080000 015f35 00 WAMS  0   0 256
  [28] .data..percpu     PROGBITS        ffffffc00a086000 2096000 017898 00  WA  0   0 64
  [29] .hyp.data..percpu PROGBITS        ffffffc00a09e000 20ae000 000e88 00  WA  0   0 16
  [30] .hyp.reloc        PROGBITS        ffffffc00a09ee88 20aee88 000064 00   A  0   0  4
  [31] .rela.dyn         RELA            ffffffc00a09eef0 20aeef0 000078 18   A  0   0  8
  [32] .relr.dyn         ANDROID_RELR    ffffffc00a09ef68 20aef68 008f20 08   A  0   0  8
  [33] .data             PROGBITS        ffffffc00a0b0000 20c0000 1c0aa0 00  WA  0   0 4096
  [34] __bug_table       PROGBITS        ffffffc00a270aa0 2280aa0 0205b0 00  WA  0   0  4
  [35] .mmuoff.data.write PROGBITS       ffffffc00a291800 22a1800 000018 00  WA  0   0 2048
  [36] .mmuoff.data.read PROGBITS        ffffffc00a292000 22a2000 000008 00  WA  0   0  8
  [37] .pecoff_edata_padding PROGBITS    ffffffc00a292008 22a2008 0001f8 00  WA  0   0  1
  [38] .sbss             PROGBITS        ffffffc00a293000 22a2200 000000 00  WA  0   0  1
  [39] .bss              NOBITS          ffffffc00a293000 22a3000 0f7c94 00  WA  0   0 4096
  [40] .eh_frame         PROGBITS        ffffffc00a390000 22b0000 02ba94 00   A  0   0  8
  [41] .debug_aranges    PROGBITS        0000000000000000 22dba94 000a20 00      0   0  1
  [42] .debug_info       PROGBITS        0000000000000000 22dc4b4 1261748f 00      0   0  1
  [43] .debug_abbrev     PROGBITS        0000000000000000 148f3943 3ab68a 00      0   0  1
  [44] .debug_line       PROGBITS        0000000000000000 14c9efcd 15eff48 00      0   0  1
  [45] .debug_frame      PROGBITS        0000000000000000 1628ef18 25c2d0 00      0   0  8
  [46] .debug_str        PROGBITS        0000000000000000 164eb1e8 498de6 01  MS  0   0  1
  [47] .debug_loc        PROGBITS        0000000000000000 16983fce 4187c98 00      0   0  1
  [48] .debug_ranges     PROGBITS        0000000000000000 1ab0bc66 b21e80 00      0   0  1
  [49] .comment          PROGBITS        0000000000000000 1b62dae6 000116 01  MS  0   0  1
  [50] .symtab           SYMTAB          0000000000000000 1b62dc00 cb2320 18     51 510804  8
  [51] .strtab           STRTAB          0000000000000000 1c2dff20 581142 00      0   0  1
  [52] .shstrtab         STRTAB          0000000000000000 1c861062 00028b 00      0   0  1
Key to Flags:
  W (write), A (alloc), X (execute), M (merge), S (strings), I (info),
  L (link order), O (extra OS processing required), G (group), T (TLS),
  C (compressed), x (unknown), o (OS specific), E (exclude),
  R (retain), p (processor specific)

现在我们通过代码来计算这个值：

///arch/arm64/include/asm/memory.h
#define KIMAGE_VADDR		(MODULES_END)
#define MODULES_END		(MODULES_VADDR + MODULES_VSIZE)

//MODULES_VSIZE的大小
#define MODULES_VSIZE		(SZ_128M)
#define SZ_128M				0x08000000

// MODULES_VADDR大小
#define MODULES_VADDR		(KASAN_SHADOW_END)
// 此处判断是否设置了这两个defconfig确定，我从手机导出/proc/config.gz中的config文件确认这两个配置config均为not set
#if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
#define KASAN_SHADOW_OFFSET	_AC(CONFIG_KASAN_SHADOW_OFFSET, UL)
#define KASAN_SHADOW_END	((UL(1) << (64 - KASAN_SHADOW_SCALE_SHIFT)) \
					+ KASAN_SHADOW_OFFSET)
#define KASAN_THREAD_SHIFT	1
#else
#define KASAN_THREAD_SHIFT	0
#define KASAN_SHADOW_END	(_PAGE_END(VA_BITS_MIN))
#endif /* CONFIG_KASAN */

// VA_BITS_MIN的确定
#if VA_BITS > 48
#define VA_BITS_MIN		(48)
#else
#define VA_BITS_MIN		(VA_BITS)   //走到了这里，因为设置了CONFIG_ARM64_VA_BITS_39=y，所以VA_BITS_MIN=39
#endif

//_PAGE_END函数
// 这个函数的意思是根据传入的 va 值生成一个掩码，此掩码的特点是从最高位到va-1位都是1，其余位都是0
#define _PAGE_END(va)		(-(UL(1) << ((va) - 1)))

经过如上的分析此时内核的起始地址即为：
-(1)<<(39-1) + 0x0800 0000
= -(0x4000000000)+0x0800 0000 //此处的符号为补码，其结果在64位系统中为0xFFFFFFC0 0000 0000
= 0xFFFFFFC0 0000 0000 + 0x0800 0000
= 0xFFFFFFC008000000
这就和从vmlinux中读出来的一致了

llvm-readelf.exe -h D:\dump\vmlinux\vmlinux
ELF Header:
  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
  Class:                             ELF64
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              DYN (Shared object file)
  Machine:                           AArch64
  Version:                           0x1
  Entry point address:               0xFFFFFFC008000000   //开始点至
  Start of program headers:          64 (bytes into file)
  Start of section headers:          478548720 (bytes into file)
  Flags:                             0x0
  Size of this header:               64 (bytes)
  Size of program headers:           56 (bytes)
  Number of program headers:         25
  Size of section headers:           64 (bytes)
  Number of section headers:         53
  Section header string table index: 52

二、head.S

/*
 * Kernel startup entry point.
 * ---------------------------
 *
 * The requirements are:
 *   MMU = off, D-cache = off, I-cache = on or off,
 *   x0 = physical address to the FDT blob.
 *
 * This code is mostly position independent so you call this at
 * __pa(PAGE_OFFSET).
 *
 * Note that the callee-saved registers are used for storing variables
 * that are useful before the MMU is enabled. The allocations are described
 * in the entry routines.
 */
 /*********************************************************************************
  *
  * ARMV8支持EL2和EL3，这些异常等级都可以引导Linux内核的运行；
  * Linux内核运行在EL1,
  * kernel启动条件的要求：
  * CPU：
  * 屏蔽CPU上所有的中断，比如清除PSTATE寄存器的DAIF域；
  * CPU必须处在EL2或非安全模式的EL1
  *
  * MMU和高速缓存:
  * 关闭MMU;
  * 关闭数据高速缓存；//清除内核镜像加载的地址范围的高速缓存，最简单办法，关闭缓存
  * 指令高速缓存可关闭或打开；//因为u-boot和内核指令代码不会重叠，缓存不会出错
  *
  * 其他：
  * X0寄存器指向设备树的物理地址；
  * 设置时钟，CNTFRQ和CNTVOFF寄存器；
  * 内存一致性；
  *
  * U-boot的作用是加载内核镜像到内存，跳转到kernel入口地址，即这里！
  ********************************************************************************/
	__HEAD
	/*
	 * DO NOT MODIFY. Image header expected by Linux boot-loaders.
	 */
	efi_signature_nop			// special NOP to identity as PE/COFF executable
	b	primary_entry			// branch to kernel start, magic     ///跳转到内核启动汇编代码入口
	.quad	0				// Image load offset from start of RAM, little-endian
	le64sym	_kernel_size_le			// Effective size of kernel image, little-endian
	le64sym	_kernel_flags_le		// Informative flags, little-endian
	.quad	0				// reserved
	.quad	0				// reserved
	.quad	0				// reserved
	.ascii	ARM64_IMAGE_MAGIC		// Magic number
	.long	.Lpe_header_offset		// Offset to the PE header.

	__EFI_PE_HEADER

	__INIT  ///以下代码处于".init.text"段

2.1 primary_entry

进入 Linux 内核，汇编部分主要完成以下工作：

SYM_CODE_START(primary_entry)
	bl	preserve_boot_args      ///保持启动参数到boot_args[]数组
	bl	init_kernel_el			// w0=cpu_boot_mode ///切换到EL1模式，以运行kernel
	adrp	x23, __PHYS_OFFSET
	and	x23, x23, MIN_KIMG_ALIGN - 1	// KASLR offset, defaults to 0
	bl	set_cpu_boot_mode_flag    ///设置set_cpu_boot_mode_flag全局变量
	bl	__create_page_tables      ///创建恒等映射页表，以及内核映像映射页表
	/*
	 * The following calls CPU setup code, see arch/arm64/mm/proc.S for
	 * details.
	 * On return, the CPU will be ready for the MMU to be turned on and
	 * the TCR will have been set.
	 */
	bl	__cpu_setup			// initialise processor  ///为打开MMU做一些处理器相关的初始化
	b	__primary_switch    ///启动MMU，并跳转到start_kernel()函数(进入内核的C语言部分)
SYM_CODE_END(primary_entry)

下面细看每个函数内容

2.1.1 preserve_boot_args

 ///把引导程序传递过来的参数x0~x3保存到boot_args[]数组中
SYM_CODE_START_LOCAL(preserve_boot_args)
	mov	x21, x0				// x21=FDT，x0设备树地址，暂存在x21

	adr_l	x0, boot_args			// record the contents of
	stp	x21, x1, [x0]			// x0 .. x3 at kernel entry
	stp	x2, x3, [x0, #16]       ///4个参数存入boot_args

	dmb	sy				// needed before dc ivac with
						// MMU off
						///保证后面__inval_dcache_area清除缓存前，执行完stp指令，保证参数保存完整性

	add	x1, x0, #0x20			// 4 x 8 bytes
	///x0为设备树地址，x1=32为长度，__inval_dcache_area使boot_args[]数组对应的高速缓存失效，并清除缓存
	b	dcache_inval_poc		// tail call
SYM_CODE_END(preserve_boot_args)

2.1.2 init_kernel_el

SYM_FUNC_START(init_kernel_el)
    mrs x0, CurrentEL
    cmp x0, #CurrentEL_EL2
    b.eq    init_el2

SYM_INNER_LABEL(init_el1, SYM_L_LOCAL)
    mov_q   x0, INIT_SCTLR_EL1_MMU_OFF /// 设置大小端
    msr sctlr_el1, x0
    isb                                /// 刷新流水线
    mov_q   x0, INIT_PSTATE_EL1        /// 屏蔽外部中断信号
    msr spsr_el1, x0
    msr elr_el1, lr                    /// 设置 el1 返回地址
    mov w0, #BOOT_CPU_MODE_EL1         /// 返回值，ARM64 当前运行等级 el1 
    eret

SYM_INNER_LABEL(init_el2, SYM_L_LOCAL)

2.1.3 set_cpu_boot_mode_flag

/*
 * Sets the __boot_cpu_mode flag depending on the CPU boot mode passed
 * in w0. See arch/arm64/include/asm/virt.h for more info.
 */
SYM_FUNC_START_LOCAL(set_cpu_boot_mode_flag)
    adr_l   x1, __boot_cpu_mode   /// 全局变量，存放本地 CPU 执行等级
    cmp w0, #BOOT_CPU_MODE_EL2
    b.ne    1f
    add x1, x1, #4              ///EL2, 存放在__boot_cpu_mode[1]
1:  str w0, [x1]            // This CPU has booted in EL1  ///w0 为 init_kernel_el 函数返回的当前 CPU 异常等级
    dmb sy                  /// 确保__boot_cpu_mode 数据完整刷回内存；dc  ivac, x1            // Invalidate potentially stale cache line
    ret
SYM_FUNC_END(set_cpu_boot_mode_flag)

2.1.4 __create_page_tables

创建恒等映射页表，以及内核映像映射页表，这部分再下一个大章节中详细描述

三、内核启动开始阶段的内存映射

  1. CPU启动时，MMU是关闭的，CPU访问的是物理地址，而MMU开启后，访问的是虚拟地址；
  2. 现代处理器大多支持多级流水线，处理器会提前预取多条指令到流水线中, 当打开MMU时，CPU已经预取多条指令到流水线中，并且这些指令都是用物理地址预取的；MMU开启后，将以虚拟地址访问，这样继续访问流水线中预取的指令 (按物理地址预取)，就很容易出错；{% u 为解决这个问题，引入“ 恒等映射”，即将虚拟地址映射到相等的物理地址 %}，可以巧妙的解决上述问题；这里建立的恒等映射是小范围的，一般内核镜像占用的空间就几M；恒等映射完毕，开启MMU，CPU进入虚拟地址访问阶段；

3.1内存恒等映射

3.1.1 __create_page_tables

SYM_FUNC_START_LOCAL(__create_page_tables)
	mov	x28, lr  ///汇编函数由多级跳转，保存返回地址

	/*
	 * Invalidate the init page tables to avoid potential dirty cache lines
	 * being evicted. Other page tables are allocated in rodata as part of
	 * the kernel image, and thus are clean to the PoC per the boot
	 * protocol.
	 */

	/*
	 * 页表地址在vmlinux.lds.S定义，大小为INIT_DIR_SIZE
	 * init_pg_dir = .;
	 * . += INIT_DIR_SIZE;
	 * init_pg_end = .;
	 */

	adrp	x0, init_pg_dir
	adrp	x1, init_pg_end
	bl	dcache_inval_poc	///init_pg_dir页表高速缓存，失效

	/*
	 * Clear the init page tables. 初始化页表清零
	 */
	adrp	x0, init_pg_dir
	adrp	x1, init_pg_end
	sub	x1, x1, x0
1:	stp	xzr, xzr, [x0], #16
	stp	xzr, xzr, [x0], #16
	stp	xzr, xzr, [x0], #16
	stp	xzr, xzr, [x0], #16
	subs	x1, x1, #64
	b.ne	1b

	mov	x7, SWAPPER_MM_MMUFLAGS  ///描述段内存属性，普通内存，块映射，访问权限，共享属性

	/*
	 * Create the identity mapping.
	 */

	/*
	 * 在vmlinux.lds.S定义，大小为IDMAP_DIR_SIZE，通常为3个连续4KB页面,分别对应PGD,PUD和PMD页表
	 * 这里要建立一个2MB大小的块映射
	 * idmap_pg_dir = .;
	 * . += IDMAP_DIR_SIZE;
	 * idmap_pg_end = .;
	 */
     // 查询我司flame项目代码IDMAP_DIR_SIZE为 ((48-4)/(12-3)-1 )*4kb= 3*4kb

	adrp	x0, idmap_pg_dir

	///.idmap.text段的起始地址，除了开机启动时打开MMU外，内核还有许多场景需要恒等映射，如唤醒处理器的函数cpu_do_resume
	adrp	x3, __idmap_text_start		// __pa(__idmap_text_start)

#ifdef CONFIG_ARM64_VA_BITS_52
	mrs_s	x6, SYS_ID_AA64MMFR2_EL1
	and	x6, x6, #(0xf << ID_AA64MMFR2_LVA_SHIFT)
	mov	x5, #52
	cbnz	x6, 1f
#endif
	mov	x5, #VA_BITS_MIN  ///我司flame项目VA_BITS_MIN=39
1:
	adr_l	x6, vabits_actual
	str	x5, [x6]        ///VA_BITS_MIN的值保存在全局变量vabits_actual中
	dmb	sy              //保证str指令数据刷新到内存
	dc	ivac, x6		// Invalidate potentially stale cache line

	/*
	 * VA_BITS may be too small to allow for an ID mapping to be created
	 * that covers system RAM if that is located sufficiently high in the
	 * physical address space. So for the ID map, use an extended virtual
	 * range in that case, and configure an additional translation level
	 * if needed.
	 *
	 * Calculate the maximum allowed value for TCR_EL1.T0SZ so that the
	 * entire ID map region can be mapped. As T0SZ == (64 - #bits used),
	 * this number conveniently equals the number of leading zeroes in
	 * the physical address of __idmap_text_end.
	 */
	adrp	x5, __idmap_text_end
	clz	x5, x5 ///统计x5第一个1前由多少个0
	cmp	x5, TCR_T0SZ(VA_BITS_MIN) // default T0SZ small enough?
	b.ge	1f			// .. then skip VA range extension ///__idmap_text_end没超过VA_BITS_MIN表达的范围，跳转1f

	adr_l	x6, idmap_t0sz
	str	x5, [x6]
	dmb	sy
	dc	ivac, x6		// Invalidate potentially stale cache line

#if (VA_BITS < 48)
#define EXTRA_SHIFT	(PGDIR_SHIFT + PAGE_SHIFT - 3)
#define EXTRA_PTRS	(1 << (PHYS_MASK_SHIFT - EXTRA_SHIFT))

	/*
	 * If VA_BITS < 48, we have to configure an additional table level.
	 * First, we have to verify our assumption that the current value of
	 * VA_BITS was chosen such that all translation levels are fully
	 * utilised, and that lowering T0SZ will always result in an additional
	 * translation level to be configured.
	 */
#if VA_BITS != EXTRA_SHIFT
#error "Mismatch between VA_BITS and page size/number of translation levels"
#endif

	mov	x4, EXTRA_PTRS
	create_table_entry x0, x3, EXTRA_SHIFT, x4, x5, x6
#else
	/*
	 * If VA_BITS == 48, we don't have to configure an additional
	 * translation level, but the top-level table has more entries.
	 */
	mov	x4, #1 << (PHYS_MASK_SHIFT - PGDIR_SHIFT)
	str_l	x4, idmap_ptrs_per_pgd, x5
#endif
1:
	ldr_l	x4, idmap_ptrs_per_pgd   //idmap_ptrs_per_pgd等于PTRS_PER_PGD,表示PGD页表由多少个页表项
	adr_l	x6, __idmap_text_end		// __pa(__idmap_text_end)

	///调用map_memory宏建立__idmap_text代码段的映射页表；
/*
 * x0：idmap_pg_dir
 * x1：
 * x3：__idmap_text_start
 * x6： __idmap_text_end
 * x7： SWAPPER_MM_MMUFLAGS
 * x3： __idmap_text_start
 * x4： PTRS_PER_PGD
*/
	map_memory x0, x1, x3, x6, x7, x3, x4, x10, x11, x12, x13, x14

SYM_FUNC_END(__create_page_tables)

3.2 粗粒度内核镜像映射

3.2.1 map_memory

/* tbl：页表起始地址，页表基地址
 * rtbl：下一级页表起始地址，通常是tbl+PAGE_SIZE
 * vstart：要映射的虚拟地址的起始地址
 * vend：要映射的虚拟地址的结束地址
 * flags：最后一级页表的属性
 * phys：映射的物理地址
 * pgds：PGD页表项的个数
 */
	.macro map_memory, tbl, rtbl, vstart, vend, flags, phys, pgds, istart, iend, tmp, count, sv
	sub \vend, \vend, #1
	add \rtbl, \tbl, #PAGE_SIZE
	mov \sv, \rtbl
	mov \count, #0

	///compute_indices宏计算vstart,vend在页表中的索引值
	compute_indices \vstart, \vend, #PGDIR_SHIFT, \pgds, \istart, \iend, \count
	///设置页表内容，分别填充一级页表PGD，二级页表PMD, 最后一级页表PT
	populate_entries \tbl, \rtbl, \istart, \iend, #PMD_TYPE_TABLE, #PAGE_SIZE, \tmp
	mov \tbl, \sv
	mov \sv, \rtbl

#if SWAPPER_PGTABLE_LEVELS > 3
	compute_indices \vstart, \vend, #PUD_SHIFT, #PTRS_PER_PUD, \istart, \iend, \count
	populate_entries \tbl, \rtbl, \istart, \iend, #PMD_TYPE_TABLE, #PAGE_SIZE, \tmp
	mov \tbl, \sv
	mov \sv, \rtbl
#endif

#if SWAPPER_PGTABLE_LEVELS > 2
	compute_indices \vstart, \vend, #SWAPPER_TABLE_SHIFT, #PTRS_PER_PMD, \istart, \iend, \count
	populate_entries \tbl, \rtbl, \istart, \iend, #PMD_TYPE_TABLE, #PAGE_SIZE, \tmp
	mov \tbl, \sv
#endif

	compute_indices \vstart, \vend, #SWAPPER_BLOCK_SHIFT, #PTRS_PER_PTE, \istart, \iend, \count
	bic \count, \phys, #SWAPPER_BLOCK_SIZE - 1
	populate_entries \tbl, \count, \istart, \iend, \flags, #SWAPPER_BLOCK_SIZE, \tmp
	.endm

3.2.2 compute_indices

/**************************************************************
 * func:计算vstart,vend在页表的索引值，返回值填在istart,iend
 *
 * vstart:虚拟地址的起始地址
 * vend:虚拟地址结束地址；
 * shift各级页表在虚拟地址中的偏移；
 * ptrs：页表项的个数；
 * istart：vstart索引值；
 * iend:vend索引值；
 * count:页表项个数
 **************************************************************/

	.macro compute_indices, vstart, vend, shift, ptrs, istart, iend, count
	lsr	\iend, \vend, \shift
	mov	\istart, \ptrs
	sub	\istart, \istart, #1
	and	\iend, \iend, \istart	// iend = (vend >> shift) & (ptrs - 1) iend索引值
	mov	\istart, \ptrs
	mul	\istart, \istart, \count
	add	\iend, \iend, \istart	// iend += count * ptrs
					// our entries span multiple tables
					//跨多个表

	lsr	\istart, \vstart, \shift
	mov	\count, \ptrs
	sub	\count, \count, #1
	and	\istart, \istart, \count ///istart索引值istart = (vstart >> shift) & (ptrs - 1)

	sub	\count, \iend, \istart  ///页表项个数
	.endm

3.2.3 populate_entries

/*******************************************************************
     * 填写页表
     *
     *  tbl:    页表基地址
     *  rtbl:   下级页表基地址
     *  index:  写入页表的起始索引
     *  eindex: 页表结束索引
     *  flags:  页表属性
     *  inc:  
     *  tmp1:   temporary variable
     *********************************************************************/

    .macro populate_entries, tbl, rtbl, index, eindex, flags, inc, tmp1
.Lpe\@: phys_to_pte \tmp1, \rtbl
    orr \tmp1, \tmp1, \flags    // tmp1 = table entry
    str \tmp1, [\tbl, \index, lsl #3] ///
    add \rtbl, \rtbl, \inc  // rtbl = pa next level /// 这里我理解为 rtbl 的下一个页(简单理解为相邻下个物理页)，而不是下一级，跟注释有点不同？add \index, \index, #1
    cmp \index, \eindex     /// 判断是否填充完，未完则继续填写下一个
    b.ls    .Lpe\@
    .endm

综上，.idmap.text 段的虚拟地址映射到了相同的物理地址上，这个映射表在 idmap_pg_dir 中；
{% tip success %}
问题：那些函数在这个映射的 2MB 内存中?
由 head.s 中的定义知
.section .idmap.text,awx

__enable_mmu, __primary_switch, __cput_setup 等汇编函数都在.idmap.text 段中；可以从 System.map 文件中得到验证；这些函数在 Linux“自举”过程中会用到；
{% endtip %}

{% tip success %}
问题：为什么要使用map_memory创建第二个页表？
CPU 刚启动时，物理内存一般都在低地址(不会超过 256T 大小)，恒等映射的地址实际在用户空间了，即 MMU 启用后 idmap_pg_dir 会填入 TTBR0; 而内核空间的链接地址都是在高地址(内核空间在高地址)，需要填入 TTBR1；因此，这里再建一张表，映射整个内核镜像，且虚拟地址空间是在高地址区 0xffffxxxx xxxx xxxx
{% endtip %}

/*
     * Map the kernel image (starting with PHYS_OFFSET).
     */

    /// 调用 map_memory 宏建立整个内核镜像代码段  的映射页表；/**************************************************************************
     * 为什么要建第二张表？* CPU 刚启动时，物理内存一般都在低地址(不会超过 256T 大小)，恒等映射的地址实际在用户空间了，* 即 MMU 启用后 idmap_pg_dir 会填入 TTBR0;
     * 而内核空间的链接地址都是在高地址(内核空间在高地址)，需要填入 TTBR1；* 因此，这里再建一张表，映射整个内核镜像，且虚拟地址空间是在高地址区 0xffffxxxx xxxx xxxx

     * 注：init_pg_dir 和 idmap_pg_dir 两个页表映射区别：* (1)init_pg_dir 映射的虚拟地址在高位 0xffff xxxx xxxx xxxx;
     *   idmap_pg_dir 映射的虚拟地址在低位 0x0000 xxxx xxxx xxxx;
     *   MMU 启用后，init_pg_dir 填入 TTBR1,idmap_pg_dir 填入 TTBR0；* (2)init_pg_dir 映射大小是整个内核镜像，idmap_pg_dir 映射 2M, 只是内存访问过渡，成功开启 MMU 即可；***************************************************************************/
    adrp    x0, init_pg_dir
    mov_q   x5, KIMAGE_VADDR        // compile time __va(_text)
    add x5, x5, x23         // add KASLR displacement
    mov x4, PTRS_PER_PGD
    adrp    x6, _end            // runtime __pa(_end)
    adrp    x3, _text           // runtime __pa(_text)
    sub x6, x6, x3          // _end - _text
    add x6, x6, x5          // runtime __va(_end)

    map_memory x0, x1, x5, x6, x7, x3, x4, x10, x11, x12, x13, x14

四、__cpu_setup 函数

为打开MMU做一些处理器相关的初始化

/*
 *  __cpu_setup
 *
 *  Initialise the processor for turning the MMU on.
 *
 * Output:
 *  Return in x0 the value of the SCTLR_EL1 register.
 */
    .pushsection .idmap.text, awx  /// 把__cpu_setup 连接到.idmap.text 段
SYM_FUNC_START(__cpu_setup)
    tlbi    vmalle1             // Invalidate local TLB  /// 本地 TLB 无效
    dsb nsh                                              /// 确保 tlbi 执行完

    mov x1, #3 << 20
    msr cpacr_el1, x1           // Enable FP/ASIMD       /// 设定 EL0,EL1 可以访问浮点单元，SIMD 单元
    mov x1, #1 << 12            // Reset mdscr_el1 and disable
    msr mdscr_el1, x1           // access to the DCC from EL0
    isb                 // Unmask debug exceptions now,
    enable_dbg              // since this is per-cpu   /// 打开 PSATE 调试功能
    reset_pmuserenr_el0 x1          // Disable PMU access from EL0
    reset_amuserenr_el0 x1          // Disable AMU access from EL0

    /*
     * Default values for VMSA control registers. These will be adjusted
     * below depending on detected CPU features.
     */
    mair    .req    x17
    tcr .req    x16
    mov_q   mair, MAIR_EL1_SET

    /// 设置 TCR 寄存器，TCR 用于管理页表映射
    mov_q   tcr, TCR_TxSZ(VA_BITS) | TCR_CACHE_FLAGS | TCR_SMP_FLAGS | \
            TCR_TG_FLAGS | TCR_KASLR_FLAGS | TCR_ASID16 | \
            TCR_TBI0 | TCR_A1 | TCR_KASAN_SW_FLAGS

...
    tcr_clear_errata_bits tcr, x9, x5

#ifdef CONFIG_ARM64_VA_BITS_52
    ldr_l       x9, vabits_actual
    sub     x9, xzr, x9
    add     x9, x9, #64
    tcr_set_t1sz    tcr, x9
#else
    ldr_l       x9, idmap_t0sz  
#endif
    tcr_set_t0sz    tcr, x9

    /*
     * Set the IPS bits in TCR_EL1.
     */
    tcr_compute_pa_size tcr, #TCR_IPS_SHIFT, x5, x6  ///IPS 域，设置位宽
#ifdef CONFIG_ARM64_HW_AFDBM
    /*
     * Enable hardware update of the Access Flags bit.
     * Hardware dirty bit management is enabled later,
     * via capabilities.
     */
    mrs x9, ID_AA64MMFR1_EL1
    and x9, x9, #0xf
    cbz x9, 1f
    orr tcr, tcr, #TCR_HA       // hardware Access flag update
1:
#endif /* CONFIG_ARM64_HW_AFDBM */
    msr mair_el1, mair
    msr tcr_el1, tcr
    /*
     * Prepare SCTLR
     */
    mov_q   x0, INIT_SCTLR_EL1_MMU_ON /// 返回值，下个函数__enable_mmu 的参数
    ret                 // return to head.S

    .unreq  mair
    .unreq  tcr
SYM_FUNC_END(__cpu_setup)

五、__primary_switch函数

启动MMU，并跳转到start_kernel()函数(进入内核的C语言部分)

SYM_FUNC_START_LOCAL(__primary_switch)
#ifdef CONFIG_RANDOMIZE_BASE   /// 内核启动时对内核映像的虚拟地址重新映射，防止黑客攻击
    mov x19, x0             // preserve new SCTLR_EL1 value
    mrs x20, sctlr_el1          // preserve old SCTLR_EL1 value
#endif

    adrp    x1, init_pg_dir
    bl  __enable_mmu           /// 参数 x0->SCTLR_EL1,x1->init_pg_dir 页表基地址，开启 MMU
#ifdef CONFIG_RELOCATABLE      /// 配置重新映射内核镜像
#ifdef CONFIG_RELR
    mov x24, #0             // no RELR displacement yet
#endif
    bl  __relocate_kernel
#ifdef CONFIG_RANDOMIZE_BASE
    ldr x8, =__primary_switched
    adrp    x0, __PHYS_OFFSET
    blr x8

    /*
     * If we return here, we have a KASLR displacement in x23 which we need
     * to take into account by discarding the current kernel mapping and
     * creating a new one.
     */
    pre_disable_mmu_workaround
    msr sctlr_el1, x20          // disable the MMU
    isb
    bl  __create_page_tables        // recreate kernel mapping

    tlbi    vmalle1             // Remove any stale TLB entries
    dsb nsh
    isb

    set_sctlr_el1   x19         // re-enable the MMU

    bl  __relocate_kernel
#endif
#endif
    ldr x8, =__primary_switched
    adrp    x0, __PHYS_OFFSET
    br  x8                      /// 实现重映射
SYM_FUNC_END(__primary_switch)

5.1 __enable_mmu函数

/*
 * Enable the MMU.
 *
 *  x0  = SCTLR_EL1 value for turning on the MMU.
 *  x1  = TTBR1_EL1 value
 *
 * Returns to the caller via x30/lr. This requires the caller to be covered
 * by the .idmap.text section.
 *
 * Checks if the selected granule size is supported by the CPU.
 * If it isn't, park the CPU
 */
SYM_FUNC_START(__enable_mmu)
	mrs	x2, ID_AA64MMFR0_EL1
	ubfx	x2, x2, #ID_AA64MMFR0_TGRAN_SHIFT, 4
	cmp     x2, #ID_AA64MMFR0_TGRAN_SUPPORTED_MIN
	b.lt    __no_granule_support
	cmp     x2, #ID_AA64MMFR0_TGRAN_SUPPORTED_MAX
	b.gt    __no_granule_support
	update_early_cpu_boot_status 0, x2, x3
	adrp	x2, idmap_pg_dir
	phys_to_ttbr x1, x1
	phys_to_ttbr x2, x2
	msr	ttbr0_el1, x2			// load TTBR0
	offset_ttbr1 x1, x3
	msr	ttbr1_el1, x1			// load TTBR1   //填充两个页表基地址到TTBR0,TTBR1
	isb

	set_sctlr_el1	x0          //填充M域，使能MMU

	ret
SYM_FUNC_END(__enable_mmu)

5.2 __primary_switched函数

SYM_FUNC_START_LOCAL(__primary_switched)
	///已开启mmu，这里开始访问的都是虚拟地址,
	///比如init_task静态定义的虚拟地址，已经映射到对应物理内存地址
	adr_l	x4, init_task           ///init_thread_union指向thread_union数据结构，其中包含系统第一个进程(init进程)的内核栈

	init_cpu_task x4, x5, x6

	adr_l	x8, vectors			// load VBAR_EL1 with virtual	//将异常向量表的地址传入X8寄存器
	msr	vbar_el1, x8			// vector table address			//将x8寄存器内的异常向量表地址写入vbar_el1
	isb

	stp	x29, x30, [sp, #-16]!
	mov	x29, sp

    ///保存设备树的地址
	str_l	x21, __fdt_pointer, x5		// Save FDT pointer

	ldr_l	x4, kimage_vaddr		// Save the offset between
	sub	x4, x4, x0			// the kernel virtual and
	str_l	x4, kimage_voffset, x5		// physical mappings

	// Clear BSS
	///清除未初始化的数据段
	adr_l	x0, __bss_start
	mov	x1, xzr
	adr_l	x2, __bss_stop
	sub	x2, x2, x0
	bl	__pi_memset
	dsb	ishst				// Make zero page visible to PTW

#if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
	bl	kasan_early_init
#endif
	mov	x0, x21				// pass FDT address in x0
	bl	early_fdt_map			// Try mapping the FDT early
	bl	init_feature_override		// Parse cpu feature overrides
#ifdef CONFIG_RANDOMIZE_BASE
	tst	x23, ~(MIN_KIMG_ALIGN - 1)	// already running randomized?
	b.ne	0f
	bl	kaslr_early_init		// parse FDT for KASLR options
	cbz	x0, 0f				// KASLR disabled? just proceed
	orr	x23, x23, x0			// record KASLR offset
	ldp	x29, x30, [sp], #16		// we must enable KASLR, return
	ret					// to __primary_switch()
0:
#endif
	bl	switch_to_vhe			// Prefer VHE if possible
	ldp	x29, x30, [sp], #16    //sp指向内核栈顶?
	bl	start_kernel           //跳转到C语言入口
	ASM_BUG()
SYM_FUNC_END(__primary_switched)

从此刻开始，汇编结束了，内核开启了C语言的世界。。。