转自：http://www.cnblogs.com/armlinux/archive/2011/11/06/2396787.html
1. 内核启动地址
1.1. 名词解释
ZTEXTADDR
解压代码运行的开始地址。没有物理地址和虚拟地址之分，因为此时MMU处于关闭状态。这个地址不一定时RAM的地址，可以是支持读写寻址的flash等存储中介。
Start address of decompressor. here's no point in talking about virtual or physical addresses here, since the MMU will be off at the time when you call the decompressor code. You normally call the kernel at this address to start it booting. This doesn't have to be located in RAM, it can be in flash or other read-only or read-write addressable medium.
ZRELADDR
内核启动在RAM中的地址。压缩的内核映像被解压到这个地址，然后执行。
This is the address where the decompressed kernel will be written, and eventually executed. The following constraint must be valid:
__virt_to_phys(TEXTADDR) == ZRELADDR
The initial part of the kernel is carefully coded to be position independent.
TEXTADDR
内核启动的虚拟地址，与ZRELADDR相对应。一般内核启动的虚拟地址为RAM的第一个bank地址加上0x8000。
TEXTADDR = PAGE_OFFSET + TEXTOFFST
Virtual start address of kernel, normally PAGE_OFFSET + 0x8000.This is where the kernel image ends up. With the latest kernels, it must be located at 32768 bytes into a 128MB region. Previous kernels placed a restriction of 256MB here.
TEXTOFFSET
内核偏移地址。在arch/arm/makefile中设定。
PHYS_OFFSET
RAM第一个bank的物理起始地址。
Physical start address of the first bank of RAM.
PAGE_OFFSET
RAM第一个bank的虚拟起始地址。
Virtual start address of the first bank of RAM. During the kernel
boot phase, virtual address PAGE_OFFSET will be mapped to physical
address PHYS_OFFSET, along with any other mappings you supply.
This should be the same value as TASK_SIZE.
1.2. 内核启动地址确定
内核启动引导地址由bootp.lds决定。 Bootp.lds : arch/arm/bootp
OUTPUT_ARCH(arm)
ENTRY(_start)
SECTIONS
{
. = 0;
.text : {
_stext = .;
*(.start)
*(.text)
initrd_size = initrd_end - initrd_start;
_etext = .;
}
}
由上 .= 0可以确定解压代码运行的开始地址在0x0的位置。ZTEXTADDR的值决定了这个值得选取。
Makefile : arch/arm/boot/compressed
如果设定内核从ROM中启动的话，可以在make menuconfig 的配置界面中设置解压代码的起始地址，否则解压代码的起始地址为0x0。实际上，默认从ROM启动时，解压代码的起始地址也是0x0。
feq ($(CONFIG_ZBOOT_ROM),y)
ZTEXTADDR := $(CONFIG_ZBOOT_ROM_TEXT)
ZBSSADDR := $(CONFIG_ZBOOT_ROM_BSS)
else
ZTEXTADDR :=0 ZBSSADDR := ALIGN(4)
endif
SEDFLAGS = s/TEXT_START/$(ZTEXTADDR)/;s/BSS_START/$(ZBSSADDR)/
……
$(obj)/vmlinux.lds: $(obj)/vmlinux.lds.in arch/arm/mach-s3c2410/Makefile .config
@sed "$(SEDFLAGS)" < $< > $@
@sed "$(SEDFLAGS)" < $< > $@ 规则将TEXT_START设定为ZTEXTADDR。TEXT_START在arch/arm/boot/compressed/vmlinux.lds.in 中被用来设定解压代码的起始地址。
OUTPUT_ARCH(arm)
ENTRY(_start)
SECTIONS
{
. = TEXT_START;
_text = .;
.text : {
_start = .;
*(.start)
*(.text)
*(.text.*)
……
}
}
内核的编译依靠vmlinux.lds，vmlinux.lds由vmlinux.lds.s 生成。从下面代码可以看出内核启动的虚拟地址被设置为PAGE_OFFSET + TEXT_OFFSET，而内核启动的物理地址ZRELADDR在arch/arm/boot/Makefile中设定。
OUTPUT_ARCH(arm)
ENTRY(stext)
SECTIONS
{
#ifdef CONFIG_XIP_KERNEL
. = XIP_VIRT_ADDR(CONFIG_XIP_PHYS_ADDR);
#else
. = PAGE_OFFSET + TEXT_OFFSET;
#endif
.init : { /* Init code and data */
_stext = .;
_sinittext = .;
*(.init.text)
_einittext = .;
……
}
}
# arch/arm/boot/Makefile
# Note: the following conditions must always be true:
# ZRELADDR == virt_to_phys(PAGE_OFFSET + TEXT_OFFSET)
# PARAMS_PHYS must be within 4MB of ZRELADDR
# INITRD_PHYS must be in RAM
ZRELADDR := $(zreladdr-y)
#---> zrealaddr-y is specified with 0x30008000 in arch/arm/boot/makefile.boot
PARAMS_PHYS := $(params_phys-y)
INITRD_PHYS := $(initrd_phys-y)
export ZRELADDR INITRD_PHYS PARAMS_PHYS
通过下面的命令编译内核映像，由参数-a, -e设置其入口地址为ZRELADDR，此值在上面ZRELADDR := $(zreladdr-y)指定。
quiet_cmd_uimage= UIMAGE $@
cmd_uimage = $(CONFIG_SHELL) $(MKIMAGE) -A arm -O linux -T kernel
-C none -a $(ZRELADDR) -e $(ZRELADDR)
-n 'Linux-$(KERNELRELEASE)' -d $< $@
1.3. 小结
从上面分析可知道，linux内核被bootloader拷贝到RAM后，解压代码从ZTEXTADDR开始运行（这段代码是与位置无关的PIC）。内核被解压缩到ZREALADDR处，也就是内核启动的物理地址处。相应地，内核启动的虚拟地址被设定为TEXTADDR，满足如下条件：
TEXTADDR = PAGE_OFFSET + TEXT_OFFSET
内核启动的物理地址和虚拟地址满足入下条件：
ZRELADDR == virt_to_phys(PAGE_OFFSET + TEXT_OFFSET)= virt_to_phys(TEXTADDR)
假定开发板为smdk2410，则有：
内核启动的虚拟地址
TEXTADDR = 0xC0008000
内核启动的物理地址
ZRELADDR = 0x30008000
如果直接从flash中启动还需要设置ZTEXTADDR地址。
2. 内核启动过程分析
内核启动过程经过大体可以分为两个阶段：内核映像的自引导；linux内核子模块的初始化。
start
Decompress_kernel()
Call_kernel
Stext:
Prepare_namespace
Do_basic_setup
init
Rest_init
Setup_arch ……
Start_kernel
_enable_mmu
Execve(“/sbin/init”))
内核启动流程图
2.1. 内核映像的自引导
这阶段的主要工作是实现压缩内核的解压和进入内核代码的入口。
Bootloader完成系统引导后，内核映像被调入内存指定的物理地址ZTEXTADDR。典型的内核映像由自引导程序和压缩的VMlinux组成。因此在启动内核之前需要先把内核解压缩。内核映像的入口的第一条代码就是自引导程序。它在arch/arm/boot/compressed/head.S文件中。
Head.S文件主要功能是实现压缩内核的解压和跳转到内核vmlinux内核的入口。Decompress_kernel(): arch/arm/boot/compressed/misc.c 和call_kernel这两个函数实现了上述功能。在调用decompress_kernel()解压内核之前，需要确保解压后的内核代码不会覆盖掉原来的内核映像。以及设定内核代码的入口地址ZREALADDR。
.text
adr r0, LC0
ldmia r0, {r1, r2, r3, r4, r5, r6, ip, sp}
.type LC0, #object
LC0: .word LC0 @ r1
.word __bss_start @ r2
.word _end @ r3
.word zreladdr @ r4
.word _start @ r5
.word _got_start @ r6
.word _got_end @ ip
.word user_stack+4096 @ sp
上面这段代码得到内核代码的入口地址，保存在r4中。
/*
* Check to see if we will overwrite ourselves.
* r4 = final kernel address
* r5 = start of this image
* r2 = end of malloc space (and therefore this image)
* We basically want:
* r4 >= r2 -> OK
* r4 + image length <= r5 -> OK
*/
cmp r4, r2
bhs wont_overwrite
add r0, r4, #4096*1024 @ 4MB largest kernel size
cmp r0, r5
bls wont_overwrite
mov r5, r2 @ decompress after malloc space
mov r0, r5
mov r3, r7
bl decompress_kernel
b call_kernel
上面代码判断解压后的内核代码会不会覆盖原来的内核映像，然后调用内核解压缩函数decompress_kernel()。
ulg
decompress_kernel(ulg output_start, ulg free_mem_ptr_p, ulg free_mem_ptr_end_p,
int arch_id)
{
output_data = (uch *)output_start; /* 指定内核执行地址，保存在r4中*/
free_mem_ptr = free_mem_ptr_p;
free_mem_ptr_end = free_mem_ptr_end_p;
__machine_arch_type = arch_id;
arch_decomp_setup(); /*解压缩前的初始化和设置，包括串口波特率设置等*/
makecrc(); /*CRC校验*/
putstr("Uncompressing Linux...");
gunzip(); /*调用解压缩函数*/
putstr(" done, booting the kernel. ");
return output_ptr;
}