Linux启动过程的内核代码分析

参考上文：

http://www.cnblogs.com/long123king/p/3543872.html

http://www.cnblogs.com/long123king/p/3545688.html

补充：linker script documentation

http://www.nacad.ufrj.br/online/sgi/860-0247-001/sgi_html/ldLinker_scripts.html

参考：http://blog.chinaunix.net/uid-20499746-id-1663135.html

http://blog.csdn.net/redredbird/article/details/5986035

同类文章参考：

http://blog.chinaunix.net/uid-1701789-id-148056.html

http://www.cnblogs.com/cybertitan/archive/2012/09/29/2708184.html

1. 内核代码的布局

我们知道，内核代码被加载到物理内存1MB处，然后in_pm32跳转到1MB物理内存处执行。

那么1MB物理内存处存放的是什么代码呢？

我们先看一个链接器的脚本文件arch/x86/boot/compressed/vmlinux.lds.S

#include <asm-generic/vmlinux.lds.h>

OUTPUT_FORMAT(CONFIG_OUTPUT_FORMAT, CONFIG_OUTPUT_FORMAT, CONFIG_OUTPUT_FORMAT)

#undef i386

#include <asm/cache.h>
#include <asm/page_types.h>

#ifdef CONFIG_X86_64
OUTPUT_ARCH(i386:x86-64)
ENTRY(startup_64)
#else
OUTPUT_ARCH(i386)
ENTRY(startup_32)
#endif

SECTIONS
{
    /* Be careful parts of head_64.S assume startup_32 is at
     * address 0.
     */
    . = 0;
    .head.text : {
        _head = . ;
        HEAD_TEXT
        _ehead = . ;
    }
    .rodata..compressed : {
        *(.rodata..compressed)
    }
    .text :    {
        _text = .;     /* Text */
        *(.text)
        *(.text.*)
        _etext = . ;
    }
    .rodata : {
        _rodata = . ;
        *(.rodata)     /* read-only data */
        *(.rodata.*)
        _erodata = . ;
    }
    .got : {
        _got = .;
        KEEP(*(.got.plt))
        KEEP(*(.got))
        _egot = .;
    }
    .data :    {
        _data = . ;
        *(.data)
        *(.data.*)
        _edata = . ;
    }
    . = ALIGN(L1_CACHE_BYTES);
    .bss : {
        _bss = . ;
        *(.bss)
        *(.bss.*)
        *(COMMON)
        . = ALIGN(8);    /* For convenience during zeroing */
        _ebss = .;
    }
#ifdef CONFIG_X86_64
       . = ALIGN(PAGE_SIZE);
       .pgtable : {
        _pgtable = . ;
        *(.pgtable)
        _epgtable = . ;
    }
#endif
    _end = .;
}

可见，在vmlinux即内核映像的0地址处存放的是.head.text段。

#define __HEAD        .section    ".head.text","ax"

因此，我们找到下面的代码：arch/x86/boot/compressed/head_32.S

    __HEAD
ENTRY(startup_32)
    cld
    /*
     * Test KEEP_SEGMENTS flag to see if the bootloader is asking
     * us to not reload segments
     */
    testb    $(1<<6), BP_loadflags(%esi)
    jnz    1f

    cli
    movl    $__BOOT_DS, %eax
    movl    %eax, %ds
    movl    %eax, %es
    movl    %eax, %fs
    movl    %eax, %gs
    movl    %eax, %ss
1:

以及arch/x86/kernel/head_32.S

/*
 * 32-bit kernel entrypoint; only used by the boot CPU.  On entry,
 * %esi points to the real-mode code as a 32-bit pointer.
 * CS and DS must be 4 GB flat segments, but we don't depend on
 * any particular GDT layout, because we load our own as soon as we
 * can.
 */
__HEAD
ENTRY(startup_32)
    movl pa(stack_start),%ecx

    /* test KEEP_SEGMENTS flag to see if the bootloader is asking
        us to not reload segments */
    testb $(1<<6), BP_loadflags(%esi)
    jnz 2f

/*
 * Set segments to known values.
 */
    lgdt pa(boot_gdt_descr)
    movl $(__BOOT_DS),%eax
    movl %eax,%ds
    movl %eax,%es
    movl %eax,%fs
    movl %eax,%gs
    movl %eax,%ss
2:
    leal -__PAGE_OFFSET(%ecx),%esp

那么这二者有什么先后顺序吗？

---

原来，思路到了这里是走进了一个误区，/compressed目录下面存放的是压缩后的代码，主要功能是解压缩内核；而/kernel目录下的才是真正的内核文件。

在/kernel目录下也有一个链接器的脚本文件arch/x86/kernel/vmlinux.lds.S

/*
 * ld script for the x86 kernel
 *
 * Historic 32-bit version written by Martin Mares <mj@atrey.karlin.mff.cuni.cz>
 *
 * Modernisation, unification and other changes and fixes:
 *   Copyright (C) 2007-2009  Sam Ravnborg <sam@ravnborg.org>
 *
 *
 * Don't define absolute symbols until and unless you know that symbol
 * value is should remain constant even if kernel image is relocated
 * at run time. Absolute symbols are not relocated. If symbol value should
 * change if kernel is relocated, make the symbol section relative and
 * put it inside the section definition.
 */

#ifdef CONFIG_X86_32
#define LOAD_OFFSET __PAGE_OFFSET
#else
#define LOAD_OFFSET __START_KERNEL_map
#endif

#include <asm-generic/vmlinux.lds.h>
#include <asm/asm-offsets.h>
#include <asm/thread_info.h>
#include <asm/page_types.h>
#include <asm/cache.h>
#include <asm/boot.h>

#undef i386     /* in case the preprocessor is a 32bit one */

OUTPUT_FORMAT(CONFIG_OUTPUT_FORMAT, CONFIG_OUTPUT_FORMAT, CONFIG_OUTPUT_FORMAT)

#ifdef CONFIG_X86_32
OUTPUT_ARCH(i386)
ENTRY(phys_startup_32)
jiffies = jiffies_64;
#else
OUTPUT_ARCH(i386:x86-64)
ENTRY(phys_startup_64)
jiffies_64 = jiffies;
#endif

#if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
/*
 * On 64-bit, align RODATA to 2MB so that even with CONFIG_DEBUG_RODATA
 * we retain large page mappings for boundaries spanning kernel text, rodata
 * and data sections.
 *
 * However, kernel identity mappings will have different RWX permissions
 * to the pages mapping to text and to the pages padding (which are freed) the
 * text section. Hence kernel identity mappings will be broken to smaller
 * pages. For 64-bit, kernel text and kernel identity mappings are different,
 * so we can enable protection checks that come with CONFIG_DEBUG_RODATA,
 * as well as retain 2MB large page mappings for kernel text.
 */
#define X64_ALIGN_DEBUG_RODATA_BEGIN    . = ALIGN(HPAGE_SIZE);

#define X64_ALIGN_DEBUG_RODATA_END
        . = ALIGN(HPAGE_SIZE);
        __end_rodata_hpage_align = .;

#else

#define X64_ALIGN_DEBUG_RODATA_BEGIN
#define X64_ALIGN_DEBUG_RODATA_END

#endif

PHDRS {
    text PT_LOAD FLAGS(5);          /* R_E */
    data PT_LOAD FLAGS(6);          /* RW_ */
#ifdef CONFIG_X86_64
    user PT_LOAD FLAGS(5);          /* R_E */
#ifdef CONFIG_SMP
    percpu PT_LOAD FLAGS(6);        /* RW_ */
#endif
    init PT_LOAD FLAGS(7);          /* RWE */
#endif
    note PT_NOTE FLAGS(0);          /* ___ */
}

SECTIONS
{
#ifdef CONFIG_X86_32
        . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
        phys_startup_32 = startup_32 - LOAD_OFFSET;
#else
        . = __START_KERNEL;
        phys_startup_64 = startup_64 - LOAD_OFFSET;
#endif

    /* Text and read-only data */
    .text :  AT(ADDR(.text) - LOAD_OFFSET) {
        _text = .;
        /* bootstrapping code */
        HEAD_TEXT
#ifdef CONFIG_X86_32
        . = ALIGN(PAGE_SIZE);
        *(.text..page_aligned)
#endif
        . = ALIGN(8);
        _stext = .;
        TEXT_TEXT
        SCHED_TEXT
        LOCK_TEXT
        KPROBES_TEXT
        ENTRY_TEXT
        IRQENTRY_TEXT
        *(.fixup)
        *(.gnu.warning)
        /* End of text section */
        _etext = .;
    } :text = 0x9090

    NOTES :text :note

    EXCEPTION_TABLE(16) :text = 0x9090

#if defined(CONFIG_DEBUG_RODATA)
    /* .text should occupy whole number of pages */
    . = ALIGN(PAGE_SIZE);
#endif
    X64_ALIGN_DEBUG_RODATA_BEGIN
    RO_DATA(PAGE_SIZE)
    X64_ALIGN_DEBUG_RODATA_END

    /* Data */
    .data : AT(ADDR(.data) - LOAD_OFFSET) {
        /* Start of data section */
        _sdata = .;

        /* init_task */
        INIT_TASK_DATA(THREAD_SIZE)

#ifdef CONFIG_X86_32
        /* 32 bit has nosave before _edata */
        NOSAVE_DATA
#endif

        PAGE_ALIGNED_DATA(PAGE_SIZE)

        CACHELINE_ALIGNED_DATA(L1_CACHE_BYTES)

        DATA_DATA
        CONSTRUCTORS

        /* rarely changed data like cpu maps */
        READ_MOSTLY_DATA(INTERNODE_CACHE_BYTES)

        /* End of data section */
        _edata = .;
    } :data

#ifdef CONFIG_X86_64

#define VSYSCALL_ADDR (-10*1024*1024)

#define VLOAD_OFFSET (VSYSCALL_ADDR - __vsyscall_0 + LOAD_OFFSET)
#define VLOAD(x) (ADDR(x) - VLOAD_OFFSET)

#define VVIRT_OFFSET (VSYSCALL_ADDR - __vsyscall_0)
#define VVIRT(x) (ADDR(x) - VVIRT_OFFSET)
#define EMIT_VVAR(x, offset) .vsyscall_var_ ## x
    ADDR(.vsyscall_0) + offset
    : AT(VLOAD(.vsyscall_var_ ## x)) {
        *(.vsyscall_var_ ## x)
    }
    x = VVIRT(.vsyscall_var_ ## x);

    . = ALIGN(4096);
    __vsyscall_0 = .;

    . = VSYSCALL_ADDR;
    .vsyscall_0 : AT(VLOAD(.vsyscall_0)) {
        *(.vsyscall_0)
    } :user

    . = ALIGN(L1_CACHE_BYTES);
    .vsyscall_fn : AT(VLOAD(.vsyscall_fn)) {
        *(.vsyscall_fn)
    }

    .vsyscall_1 ADDR(.vsyscall_0) + 1024: AT(VLOAD(.vsyscall_1)) {
        *(.vsyscall_1)
    }
    .vsyscall_2 ADDR(.vsyscall_0) + 2048: AT(VLOAD(.vsyscall_2)) {
        *(.vsyscall_2)
    }

    .vsyscall_3 ADDR(.vsyscall_0) + 3072: AT(VLOAD(.vsyscall_3)) {
        *(.vsyscall_3)
    }

#define __VVAR_KERNEL_LDS
#include <asm/vvar.h>
#undef __VVAR_KERNEL_LDS

    . = __vsyscall_0 + PAGE_SIZE;

#undef VSYSCALL_ADDR
#undef VLOAD_OFFSET
#undef VLOAD
#undef VVIRT_OFFSET
#undef VVIRT
#undef EMIT_VVAR

#endif /* CONFIG_X86_64 */

    /* Init code and data - will be freed after init */
    . = ALIGN(PAGE_SIZE);
    .init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
        __init_begin = .; /* paired with __init_end */
    }

#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
    /*
     * percpu offsets are zero-based on SMP.  PERCPU_VADDR() changes the
     * output PHDR, so the next output section - .init.text - should
     * start another segment - init.
     */
    PERCPU_VADDR(INTERNODE_CACHE_BYTES, 0, :percpu)
#endif

    INIT_TEXT_SECTION(PAGE_SIZE)
#ifdef CONFIG_X86_64
    :init
#endif

    INIT_DATA_SECTION(16)

    /*
     * Code and data for a variety of lowlevel trampolines, to be
     * copied into base memory (< 1 MiB) during initialization.
     * Since it is copied early, the main copy can be discarded
     * afterwards.
     */
     .x86_trampoline : AT(ADDR(.x86_trampoline) - LOAD_OFFSET) {
        x86_trampoline_start = .;
        *(.x86_trampoline)
        x86_trampoline_end = .;
    }

    .x86_cpu_dev.init : AT(ADDR(.x86_cpu_dev.init) - LOAD_OFFSET) {
        __x86_cpu_dev_start = .;
        *(.x86_cpu_dev.init)
        __x86_cpu_dev_end = .;
    }

    /*
     * start address and size of operations which during runtime
     * can be patched with virtualization friendly instructions or
     * baremetal native ones. Think page table operations.
     * Details in paravirt_types.h
     */
    . = ALIGN(8);
    .parainstructions : AT(ADDR(.parainstructions) - LOAD_OFFSET) {
        __parainstructions = .;
        *(.parainstructions)
        __parainstructions_end = .;
    }

    /*
     * struct alt_inst entries. From the header (alternative.h):
     * "Alternative instructions for different CPU types or capabilities"
     * Think locking instructions on spinlocks.
     */
    . = ALIGN(8);
    .altinstructions : AT(ADDR(.altinstructions) - LOAD_OFFSET) {
        __alt_instructions = .;
        *(.altinstructions)
        __alt_instructions_end = .;
    }

    /*
     * And here are the replacement instructions. The linker sticks
     * them as binary blobs. The .altinstructions has enough data to
     * get the address and the length of them to patch the kernel safely.
     */
    .altinstr_replacement : AT(ADDR(.altinstr_replacement) - LOAD_OFFSET) {
        *(.altinstr_replacement)
    }

    /*
     * struct iommu_table_entry entries are injected in this section.
     * It is an array of IOMMUs which during run time gets sorted depending
     * on its dependency order. After rootfs_initcall is complete
     * this section can be safely removed.
     */
    .iommu_table : AT(ADDR(.iommu_table) - LOAD_OFFSET) {
        __iommu_table = .;
        *(.iommu_table)
        __iommu_table_end = .;
    }

    . = ALIGN(8);
    .apicdrivers : AT(ADDR(.apicdrivers) - LOAD_OFFSET) {
        __apicdrivers = .;
        *(.apicdrivers);
        __apicdrivers_end = .;
    }

    . = ALIGN(8);
    /*
     * .exit.text is discard at runtime, not link time, to deal with
     *  references from .altinstructions and .eh_frame
     */
    .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
        EXIT_TEXT
    }

    .exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
        EXIT_DATA
    }

#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
    PERCPU_SECTION(INTERNODE_CACHE_BYTES)
#endif

    . = ALIGN(PAGE_SIZE);

    /* freed after init ends here */
    .init.end : AT(ADDR(.init.end) - LOAD_OFFSET) {
        __init_end = .;
    }

    /*
     * smp_locks might be freed after init
     * start/end must be page aligned
     */
    . = ALIGN(PAGE_SIZE);
    .smp_locks : AT(ADDR(.smp_locks) - LOAD_OFFSET) {
        __smp_locks = .;
        *(.smp_locks)
        . = ALIGN(PAGE_SIZE);
        __smp_locks_end = .;
    }

#ifdef CONFIG_X86_64
    .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
        NOSAVE_DATA
    }
#endif

    /* BSS */
    . = ALIGN(PAGE_SIZE);
    .bss : AT(ADDR(.bss) - LOAD_OFFSET) {
        __bss_start = .;
        *(.bss..page_aligned)
        *(.bss)
        . = ALIGN(PAGE_SIZE);
        __bss_stop = .;
    }

    . = ALIGN(PAGE_SIZE);
    .brk : AT(ADDR(.brk) - LOAD_OFFSET) {
        __brk_base = .;
        . += 64 * 1024;        /* 64k alignment slop space */
        *(.brk_reservation)    /* areas brk users have reserved */
        __brk_limit = .;
    }

    _end = .;

        STABS_DEBUG
        DWARF_DEBUG

    /* Sections to be discarded */
    DISCARDS
    /DISCARD/ : { *(.eh_frame) }
}


#ifdef CONFIG_X86_32
/*
 * The ASSERT() sink to . is intentional, for binutils 2.14 compatibility:
 */
. = ASSERT((_end - LOAD_OFFSET <= KERNEL_IMAGE_SIZE),
       "kernel image bigger than KERNEL_IMAGE_SIZE");
#else
/*
 * Per-cpu symbols which need to be offset from __per_cpu_load
 * for the boot processor.
 */
#define INIT_PER_CPU(x) init_per_cpu__##x = x + __per_cpu_load
INIT_PER_CPU(gdt_page);
INIT_PER_CPU(irq_stack_union);

/*
 * Build-time check on the image size:
 */
. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
       "kernel image bigger than KERNEL_IMAGE_SIZE");

#ifdef CONFIG_SMP
. = ASSERT((irq_stack_union == 0),
           "irq_stack_union is not at start of per-cpu area");
#endif

#endif /* CONFIG_X86_32 */

#ifdef CONFIG_KEXEC
#include <asm/kexec.h>

. = ASSERT(kexec_control_code_size <= KEXEC_CONTROL_CODE_MAX_SIZE,
           "kexec control code size is too big");
#endif

SECTIONS
{
#ifdef CONFIG_X86_32
       . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
        phys_startup_32 = startup_32 - LOAD_OFFSET;
#else
        . = __START_KERNEL;
        phys_startup_64 = startup_64 - LOAD_OFFSET;
#endif

    /* Text and read-only data */
    .text :  AT(ADDR(.text) - LOAD_OFFSET) {
        _text = .;
        /* bootstrapping code */
        HEAD_TEXT
#ifdef CONFIG_X86_32
        . = ALIGN(PAGE_SIZE);
        *(.text..page_aligned)
#endif
        . = ALIGN(8);
        _stext = .;
        TEXT_TEXT
        SCHED_TEXT
        LOCK_TEXT
        KPROBES_TEXT
        ENTRY_TEXT
        IRQENTRY_TEXT
        *(.fixup)
        *(.gnu.warning)
        /* End of text section */
        _etext = .;
    } :text = 0x9090

其中

#ifdef CONFIG_X86_32
#define LOAD_OFFSET __PAGE_OFFSET
#else
#define LOAD_OFFSET __START_KERNEL_map
#endif

/* Physical address where kernel should be loaded. */
#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START
                + (CONFIG_PHYSICAL_ALIGN - 1))
                & ~(CONFIG_PHYSICAL_ALIGN - 1))

config PHYSICAL_START
    hex "Physical address where the kernel is loaded" if (EXPERT || CRASH_DUMP)
    default "0x1000000"
    ---help---
      This gives the physical address where the kernel is loaded.

      If kernel is a not relocatable (CONFIG_RELOCATABLE=n) then
      bzImage will decompress itself to above physical address and
      run from there. Otherwise, bzImage will run from the address where
      it has been loaded by the boot loader and will ignore above physical
      address.

[arch/x86/Kconfig]

因此红色语句将.[当前标号]定位到3GB+1MB(0xC0100000)虚拟地址处

1MB物理内存处

#define HEAD_TEXT  *(.head.text)

因此，可以确认，1MB物理内存处是arch/x86/kernel/head_32.S中的startup_32函数

2. startup_32函数

该函数也是通过汇编定义

#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)

/* Number of possible pages in the lowmem region */
LOWMEM_PAGES = (((1<<32) - __PAGE_OFFSET) >> PAGE_SHIFT)
   
/* Enough space to fit pagetables for the low memory linear map */
MAPPING_BEYOND_END = PAGE_TABLE_SIZE(LOWMEM_PAGES) << PAGE_SHIFT

/*
* Worst-case size of the kernel mapping we need to make:
* a relocatable kernel can live anywhere in lowmem, so we need to be able
* to map all of lowmem.
*/
KERNEL_PAGES = LOWMEM_PAGES

INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_PAGES) * PAGE_SIZE

LOWMEM_PAGES为1GB大小，即内核态的内存空间范围。

long(((long long)1 << 32 ) / 4) >> 12 = 0x00040000

即需要0x40000个页表项来表示内核可能用到的地址空间。

PAGE_TABLE_SIZE(0x40000) = 0x40000 / 1024 = 0x100

需要页目录能包含0x100（256）个项目，每个项目用于指定对应的页表的物理地址，每个页目录项为32位。因此需要

0x100 * 4 = 1024bytes = 1KB

来保存内核需要的页目录项目。

接下来，分配存放内核页表的内存空间：

RESERVE_BRK(pagetables, INIT_MAP_SIZE)

/*
 * Reserve space in the brk section.  The name must be unique within
 * the file, and somewhat descriptive.  The size is in bytes.  Must be
 * used at file scope.
 *
 * (This uses a temp function to wrap the asm so we can pass it the
 * size parameter; otherwise we wouldn't be able to.  We can't use a
 * "section" attribute on a normal variable because it always ends up
 * being @progbits, which ends up allocating space in the vmlinux
 * executable.)
 */
#define RESERVE_BRK(name,sz)
    static void __section(.discard.text) __used notrace
    __brk_reservation_fn_##name##__(void) {
        asm volatile (
            ".pushsection .brk_reservation,"aw",@nobits;"
            ".brk." #name ":"
            " 1:.skip %c0;"
            " .size .brk." #name ", . - 1b;"
            " .popsection"
            : : "i" (sz));
    }

相当于分配一个.brk.pagetables的section，大小为1KB。

下面这段代码，检查bootloader有没有明确地指示不要重新设置各个段选择子的内容，如果可以，就将各个数据段选择子都重置为BOOT_DS段选择子。

/* test KEEP_SEGMENTS flag to see if the bootloader is asking
    us to not reload segments */
testb $(1<<6), BP_loadflags(%esi)
jnz 2f

/*
et segments to known values.

lgdt pa(boot_gdt_descr)
movl $(__BOOT_DS),%eax
movl %eax,%ds
movl %eax,%es
movl %eax,%fs
movl %eax,%gs
movl %eax,%ss

在上面.data section中有设置标号stack_start

.data
.balign 4
ENTRY(stack_start)
    .long init_thread_union+THREAD_SIZE

early_recursion_flag:
    .long 0

ready:    .byte 0

int_msg:
    .asciz "Unknown interrupt or fault at: %p %p %p
"

fault_msg:
/* fault info: */
    .ascii "BUG: Int %d: CR2 %p
"
/* pusha regs: */
    .ascii "     EDI %p  ESI %p  EBP %p  ESP %p
"
    .ascii "     EBX %p  EDX %p  ECX %p  EAX %p
"
/* fault frame: */
    .ascii "     err %p  EIP %p   CS %p  flg %p
"
    .ascii "Stack: %p %p %p %p %p %p %p %p
"
    .ascii "       %p %p %p %p %p %p %p %p
"
    .asciz "       %p %p %p %p %p %p %p %p
"

#include "../../x86/xen/xen-head.S"