__create_page_tables
/*
* Setup the initial page tables. We only setup the barest
* amount which are required to get the kernel running, which
* generally means mapping in the kernel code.
*
* r8 = phys_offset, r9 = cpuid, r10 = procinfo
*
* Returns:
* r0, r3, r5-r7 corrupted
* r4 = page table (see ARCH_PGD_SHIFT in asm/memory.h)
*/
@ __create_page_tables函数初始化了一个非常简单页表，仅映射了使内核能够正常启动的代码空间，
@ 更加细致的工作将会在后续阶段完善。
__create_page_tables:
pgtbl r4, r8 @ page table address,[r4] = 0x20000000([r8])+0x8000-0x4000
@ 该地址是页表的起始地址，在kernel的入口地址（0x20008000）之前16KB。
@ 第一步、将这16KB空间清零
/*
* Clear the swapper page table
*/
mov r0, r4 @ [r0] = 0x20004000
mov r3, #0 @ [r3] = 0
add r6, r0, #PG_DIR_SIZE @ [r6] = 0x20008000
1: str r3, [r0], #4 @ loop clear from 0x20004000 to 0x20008000
str r3, [r0], #4
str r3, [r0], #4
str r3, [r0], #4
teq r0, r6
bne 1b
#ifdef CONFIG_ARM_LPAE
/*
* Build the PGD(Page Global Directory) table (first level) to point to the PMD(Page Middle Directory) table. A PGD
* entry is 64-bit wide.
*/
mov r0, r4
add r3, r4, #0x1000 @ first PMD table address
orr r3, r3, #3 @ PGD block type
mov r6, #4 @ PTRS_PER_PGD
mov r7, #1 << (55 - 32) @ L_PGD_SWAPPER
1:
#ifdef CONFIG_CPU_ENDIAN_BE8
str r7, [r0], #4 @ set top PGD entry bits
str r3, [r0], #4 @ set bottom PGD entry bits
#else
str r3, [r0], #4 @ set bottom PGD entry bits
str r7, [r0], #4 @ set top PGD entry bits
#endif
add r3, r3, #0x1000 @ next PMD table
subs r6, r6, #1
bne 1b
add r4, r4, #0x1000 @ point to the PMD tables
#ifdef CONFIG_CPU_ENDIAN_BE8
add r4, r4, #4 @ we only write the bottom word
#endif
#endif
第二步、 __enable_mmu页表的建立
/*__enable_mmu函数使能mmu后，CPU发出的地址是虚拟地址，程序正常运行需要映射得到物理地址，
为了保障正常地配置mmu，这里需要对这段代码1:1的绝对映射，映射范围__turn_mmu_on至__turn_mmu_on_end。
正常使能mmu后，不需要这段特定的映射了，在后续C代码启动阶段时被paging_init()函数删除。
*/
ldr r7, [r10, #PROCINFO_MM_MMUFLAGS] @ mm_mmuflags,[r7] = 10001110000001110b=0x11c0e
/*
* Create identity mapping to cater for __enable_mmu.
* This identity mapping will be removed by paging_init().
*/
adr r0, __turn_mmu_on_loc
ldmia r0, {r3, r5, r6}
sub r0, r0, r3 @ virt->phys offset
add r5, r5, r0 @ phys __turn_mmu_on
add r6, r6, r0 @ phys __turn_mmu_on_end
mov r5, r5, lsr #SECTION_SHIFT @ >>20 1M
mov r6, r6, lsr #SECTION_SHIFT @ >>20
1: orr r3, r7, r5, lsl #SECTION_SHIFT @ flags + kernel base
str r3, [r4, r5, lsl #PMD_ORDER] @ identity mapping
@ [r4 + r5 << 2] = [r3],将描述符写到转换表中，4bytes对齐，每个符占4bytes
cmp r5, r6
addlo r5, r5, #1 @ next section
blo 1b
@ 第三步、根据当前内核所划分的虚拟地址空间，建立内核页表项，Linux默认内核在最高1G，因此内核起始虚拟地址一般为0xc0000000
/*
* Map our RAM from the start to the end of the kernel .bss section.
*/
add r0, r4, #PAGE_OFFSET >> (SECTION_SHIFT - PMD_ORDER) @>>20 + <<2 = >>18,内核空间起始地址的描述符
@ 截取PAGE_OFFSET的高14位与表头地址相加，作为基址送入寄存器r0；
@ 这里之所以截取高14位，是由于section页表，可记录4K个表项，正好取虚拟地址的高12位作为页表的索引，
@ 每个表项占用4字节，则索引号需乘4，为14位。[r0]对应转换表的起始一项
ldr r6, =(_end - 1) @ bss section结束地址-1
orr r3, r8, r7 @ [r7] = mm_mmuflags,[r8] = phys_offset = 0x20000000
add r6, r4, r6, lsr #(SECTION_SHIFT - PMD_ORDER) @ 需要map的bss end address,[r6]对应转换表的最后一项
@ 由此可以算得一级描述符的条目为([r6]-[r0])>>2个
1: str r3, [r0], #1 << PMD_ORDER @ 将一个描述符（4bytes）写到对应转换表项后，转换表项后移4bytes，这是个1:1映射
add r3, r3, #1 << SECTION_SHIFT @ 下1M
cmp r0, r6
bls 1b
#ifdef CONFIG_XIP_KERNEL
/*
* Map the kernel image separately as it is not located in RAM.
*/
@ 这里只是将内核存储空间重新映射
#define XIP_START XIP_VIRT_ADDR(CONFIG_XIP_PHYS_ADDR)
mov r3, pc
mov r3, r3, lsr #SECTION_SHIFT
orr r3, r7, r3, lsl #SECTION_SHIFT
add r0, r4, #(XIP_START & 0xff000000) >> (SECTION_SHIFT - PMD_ORDER)
str r3, [r0, #((XIP_START & 0x00f00000) >> SECTION_SHIFT) << PMD_ORDER]! @ [r0] = [r0] + #((XIP_START & 0x00f00000) >> SECTION_SHIFT) << PMD_ORDER
ldr r6, =(_edata_loc - 1)
add r0, r0, #1 << PMD_ORDER
add r6, r4, r6, lsr #(SECTION_SHIFT - PMD_ORDER)
1: cmp r0, r6
add r3, r3, #1 << SECTION_SHIFT
strls r3, [r0], #1 << PMD_ORDER
bls 1b
#endif
/*
* Then map boot params address in r2 if specified.
* We map 2 sections in case the ATAGs/DTB crosses a section boundary.
*/
@ 第四步、填写boot传来的内核启动参数所在段的映射，一般为内存开始时的1MB段，这个段一般已经映射过了
@ 对boot 参数的映射,boot参数存在r2中，需要map 2个sections以防该参数处于一个段的边界
mov r0, r2, lsr #SECTION_SHIFT @ [r0] = [r2] >> 20
movs r0, r0, lsl #SECTION_SHIFT @ [r0]就是[r2]的高12bit，1M对齐
subne r3, r0, r8 @ [r3] = [r0] - phys_addr
addne r3, r3, #PAGE_OFFSET @ 对应的虚拟地址
addne r3, r4, r3, lsr #(SECTION_SHIFT - PMD_ORDER) @ 转换表项
orrne r6, r7, r0 @ 描述符项
strne r6, [r3], #1 << PMD_ORDER @ 下一个setion的描述符也更新
addne r6, r6, #1 << SECTION_SHIFT
strne r6, [r3]
@ 如果哪一步等于0就说明已经map过了
#if defined(CONFIG_ARM_LPAE) && defined(CONFIG_CPU_ENDIAN_BE8)
sub r4, r4, #4 @ Fixup page table pointer
@ for 64-bit descriptors
#endif
#ifdef CONFIG_DEBUG_LL
#if !defined(CONFIG_DEBUG_ICEDCC) && !defined(CONFIG_DEBUG_SEMIHOSTING)
/*
* Map in IO space for serial debugging.
* This allows debug messages to be output
* via a serial console before paging_init.
*/
addruart r7, r3, r0
mov r3, r3, lsr #SECTION_SHIFT
mov r3, r3, lsl #PMD_ORDER
add r0, r4, r3
mov r3, r7, lsr #SECTION_SHIFT
ldr r7, [r10, #PROCINFO_IO_MMUFLAGS] @ io_mmuflags
orr r3, r7, r3, lsl #SECTION_SHIFT
#ifdef CONFIG_ARM_LPAE
mov r7, #1 << (54 - 32) @ XN
#ifdef CONFIG_CPU_ENDIAN_BE8
str r7, [r0], #4
str r3, [r0], #4
#else
str r3, [r0], #4
str r7, [r0], #4
#endif
#else
orr r3, r3, #PMD_SECT_XN
str r3, [r0], #4
#endif
#else /* CONFIG_DEBUG_ICEDCC || CONFIG_DEBUG_SEMIHOSTING */
/* we don't need any serial debugging mappings */
ldr r7, [r10, #PROCINFO_IO_MMUFLAGS] @ io_mmuflags
#endif
#if defined(CONFIG_ARCH_NETWINDER) || defined(CONFIG_ARCH_CATS)
/*
* If we're using the NetWinder or CATS, we also need to map
* in the 16550-type serial port for the debug messages
*/
add r0, r4, #0xff000000 >> (SECTION_SHIFT - PMD_ORDER)
orr r3, r7, #0x7c000000
str r3, [r0]
#endif
#ifdef CONFIG_ARCH_RPC
/*
* Map in screen at 0x02000000 & SCREEN2_BASE
* Similar reasons here - for debug. This is
* only for Acorn RiscPC architectures.
*/
add r0, r4, #0x02000000 >> (SECTION_SHIFT - PMD_ORDER)
orr r3, r7, #0x02000000
str r3, [r0]
add r0, r4, #0xd8000000 >> (SECTION_SHIFT - PMD_ORDER)
str r3, [r0]
#endif
#endif
#ifdef CONFIG_ARM_LPAE
sub r4, r4, #0x1000 @ point to the PGD table
mov r4, r4, lsr #ARCH_PGD_SHIFT
#endif
mov pc, lr
ENDPROC(__create_page_tables)
.ltorg
.align
__turn_mmu_on_loc:
.long .
.long __turn_mmu_on
.long __turn_mmu_on_end