1. main函数
参见上方http://www.cnblogs.com/long123king/p/3543872.html，代码跳转到main函数。
arch/x86/boot/main.c
1: void main(void)
2: {
3: /* First, copy the boot header into the "zeropage" */
4: copy_boot_params();
5:
6: /* Initialize the early-boot console */
7: console_init();
8: if (cmdline_find_option_bool("debug"))
9: puts("early console in setup code\n");
10:
11: /* End of heap check */
12: init_heap();
13:
14: /* Make sure we have all the proper CPU support */
15: if (validate_cpu()) {
16: puts("Unable to boot - please use a kernel appropriate "
17: "for your CPU.\n");
18: die();
19: }
20:
21: /* Tell the BIOS what CPU mode we intend to run in. */
22: set_bios_mode();
23:
24: /* Detect memory layout */
25: detect_memory();
26:
27: /* Set keyboard repeat rate (why?) */
28: keyboard_set_repeat();
29:
30: /* Query MCA information */
31: query_mca();
32:
33: /* Query Intel SpeedStep (IST) information */
34: query_ist();
35:
36: /* Query APM information */
37: #if defined(CONFIG_APM) || defined(CONFIG_APM_MODULE)
38: query_apm_bios();
39: #endif
40:
41: /* Query EDD information */
42: #if defined(CONFIG_EDD) || defined(CONFIG_EDD_MODULE)
43: query_edd();
44: #endif
45:
46: /* Set the video mode */
47: set_video();
48:
49: /* Do the last things and invoke protected mode */
50: go_to_protected_mode();
51: }
2. 进入保护模式
1: /*
2: * Actual invocation sequence
3: */
4: void go_to_protected_mode(void)
5: {
6: /* Hook before leaving real mode, also disables interrupts */
7: realmode_switch_hook();
8:
9: /* Enable the A20 gate */
10: if (enable_a20()) {
11: puts("A20 gate not responding, unable to boot...\n");
12: die();
13: }
14:
15: /* Reset coprocessor (IGNNE#) */
16: reset_coprocessor();
17:
18: /* Mask all interrupts in the PIC */
19: mask_all_interrupts();
20:
21: /* Actual transition to protected mode... */
22: setup_idt();
23: setup_gdt();
24: protected_mode_jump(boot_params.hdr.code32_start,
25: (u32)&boot_params + (ds() << 4));
26: }
enable_a20，打开20位以上的地址线，因为在实模式下，最高寻址1MB，20位以上的地址线没有用到，处于关闭状态。当我们把内核映射准备好，并且加载到了1MB物理内存时，要想跳转到内核代码中进行执行，必须开启20位以上的地址线。
设置GDT，这个GDT是临时的，实际上只设置了CS/DS段，而且是简单的0~4GB范围。
1: struct gdt_ptr {
2: u16 len;
3: u32 ptr;
4: } __attribute__((packed));
5:
6: static void setup_gdt(void)
7: {
8: /* There are machines which are known to not boot with the GDT
9: being 8-byte unaligned. Intel recommends 16 byte alignment. */
10: static const u64 boot_gdt[] __attribute__((aligned(16))) = {
11: /* CS: code, read/execute, 4 GB, base 0 */
12: [GDT_ENTRY_BOOT_CS] = GDT_ENTRY(0xc09b, 0, 0xfffff),
13: /* DS: data, read/write, 4 GB, base 0 */
14: [GDT_ENTRY_BOOT_DS] = GDT_ENTRY(0xc093, 0, 0xfffff),
15: /* TSS: 32-bit tss, 104 bytes, base 4096 */
16: /* We only have a TSS here to keep Intel VT happy;
17: we don't actually use it for anything. */
18: [GDT_ENTRY_BOOT_TSS] = GDT_ENTRY(0x0089, 4096, 103),
19: };
20: /* Xen HVM incorrectly stores a pointer to the gdt_ptr, instead
21: of the gdt_ptr contents. Thus, make it static so it will
22: stay in memory, at least long enough that we switch to the
23: proper kernel GDT. */
24: static struct gdt_ptr gdt;
25:
26: gdt.len = sizeof(boot_gdt)-1;
27: gdt.ptr = (u32)&boot_gdt + (ds() << 4);
28:
29: asm volatile("lgdtl %0" : : "m" (gdt));
30: }
protected_mode_jump又跳转到了汇编语言。
3. protected_mode_jump
1:
2:
3: .code16
4:
5: /*
6: * void protected_mode_jump(u32 entrypoint, u32 bootparams);
7: */
8: GLOBAL(protected_mode_jump)
9: movl %edx, %esi # Pointer to boot_params table
10:
11: xorl %ebx, %ebx
12: movw %cs, %bx
13: shll $4, %ebx
14: addl %ebx, 2f
15: jmp 1f # Short jump to serialize on 386/486
16: 1:
17:
18: movw $__BOOT_DS, %cx
19: movw $__BOOT_TSS, %di
20:
21: movl %cr0, %edx
22: orb $X86_CR0_PE, %dl # Protected mode
23: movl %edx, %cr0
24:
25: # Transition to 32-bit mode
26: .byte 0x66, 0xea # ljmpl opcode
27: 2: .long in_pm32 # offset
28: .word __BOOT_CS # segment
29: ENDPROC(protected_mode_jump)
该段开始的.code16指令，表示这段代码依然是16位的实模式代码。
使能CR0寄存器中的PE(Protection Enable)位，进入保护模式。
movl %cr0, %edx
orb $X86_CR0_PE, %dl # Protected mode
movl %edx, %cr0
# Transition to 32-bit mode
.byte 0x66, 0xea # ljmpl opcode
2: .long in_pm32 # offset
.word __BOOT_CS # segment
ljmpl跳转到GDT中设置好的BOOT_CS段的in_pm32地址处执行，这时就已经是32位的保护模式了。
4. in_pm32
in_pm32标号代表的意思就是“在32位保护模式下运行”
1: .code32
2: .section ".text32","ax"
3: AL(in_pm32)
4: # Set up data segments for flat 32-bit mode
5: movl %ecx, %ds
6: movl %ecx, %es
7: movl %ecx, %fs
8: movl %ecx, %gs
9: movl %ecx, %ss
10: # The 32-bit code sets up its own stack, but this way we do have
11: # a valid stack if some debugging hack wants to use it.
12: addl %ebx, %esp
13:
14: # Set up TR to make Intel VT happy
15: ltr %di
16:
17: # Clear registers to allow for future extensions to the
18: # 32-bit boot protocol
19: xorl %ecx, %ecx
20: xorl %edx, %edx
21: xorl %ebx, %ebx
22: xorl %ebp, %ebp
23: xorl %edi, %edi
24:
25: # Set up LDTR to make Intel VT happy
26: lldt %cx
27:
28: jmpl *%eax # Jump to the 32-bit entrypoint
29: ROC(in_pm32)
各个数据段的段选择子的设置：
# Set up data segments for flat 32-bit mode
movl %ecx, %ds
movl %ecx, %es
movl %ecx, %fs
movl %ecx, %gs
movl %ecx, %ss
回想protected_mode_jump中对于ecx的设置：
1:
movw $__BOOT_DS, %cx
movw $__BOOT_TSS, %di
将各个数据段，包括栈段都设置成BOOT_DS段选择子。
设置栈指针：
# The 32-bit code sets up its own stack, but this way we do have
# a valid stack if some debugging hack wants to use it.
addl %ebx, %esp
回想上方ebx的设置：
xorl %ebx, %ebx 【清0】
movw %cs, %bx 【当前的CS代码段基地】
shll $4, %ebx 【左移4位，取到当前CS代码段的起始地址】
addl %ebx, 2f 【将标号2处设置成esp的位置】……
# Transition to 32-bit mode
.byte 0x66, 0xea # ljmpl opcode
2: .long in_pm32 # offset
.word __BOOT_CS # segment
那么标号2在什么位置呢？
回想Setup.ld链接脚本【该脚本用于指导链接器生成setup可执行程序】，以及protected_mode_jump开头的段定义
.text
.code16/*
* void protected_mode_jump(u32 entrypoint, u32 bootparams);
*/
GLOBAL(protected_mode_jump)
. = 0;
.bstext : { *(.bstext) }
.bsdata : { *(.bsdata) }. = 497;
.header : { *(.header) }
.entrytext : { *(.entrytext) }
.inittext : { *(.inittext) }
.initdata : { *(.initdata) }
__end_init = .;.text : { *(.text) }
.text32 : { *(.text32) }. = ALIGN(16);
.rodata : { *(.rodata*) }
因此，32位的栈的栈指针被设置在了32位代码段的下部。
然后是跳转到下一阶段的程序执行
jmpl *%eax # Jump to the 32-bit entrypoint
ENDPROC(in_pm32)
那么eax寄存器的值是多少呢？
回想调用protected_mode_jump时的参数
/* Actual transition to protected mode... */
setup_idt();
setup_gdt();
protected_mode_jump(boot_params.hdr.code32_start,
(u32)&boot_params + (ds() << 4));
因此跳转到了code32_start地址处的函数执行(因为%eax前面有*，代表解引用，因此是跳转到该指针指向的函数执行)。
code32_start: # here loaders can put a different
# start address for 32-bit code.
.long 0x100000 # 0x100000 = default for big kernel
也就是跳转到1MB物理内存处执行，这次是真的将控制权交给内核了。