Linux-Android启动之Init进程前传
原文地址：http://blog.csdn.net/guopeixin/article/details/5694749
一. 内核自引导程序
1. 内核zimage自解压
这部分代码在arch/${arch}/boot/compressed/head.S中，该文件的代码在zimage的生成过程中，将会被打包到zimage中。
head.S会首先初始化自解压相关的如内存等环境，接下来就去调用decompress_kernel去解压，并调用call_kernel函数去启动vmlinux。
去下面仅仅列举一下head.S文件中最重要的部分：
----------------------------------------------------------------
/*
* We're not in danger of overwriting ourselves. Do this the simple way.
*
* r4 = kernel execution address
* r7 = architecture ID
*/
wont_overwrite: mov r0, r4
mov r3, r7
bl decompress_kernel
b call_kernel
...
call_kernel: bl cache_clean_flush
bl cache_off
mov r0, #0 @ must be zero
mov r1, r7 @ restore architecture number
mov r2, r8 @ restore atags pointer
mov pc, r4 @ call kernel
----------------------------------------------------------------
其中函数decompress_kernel在arch/${arch}/boot/compressed/misc.c中实现，功能就是完成zimage镜像的自解压，显然该自解压的过程需
要配置相应的解压地址等，这部分代码如下：
----------------------------------------------------------------
ulg
decompress_kernel(ulg output_start, ulg free_mem_ptr_p, ulg free_mem_ptr_end_p,
int arch_id)
{
output_data = (uch *)output_start; /* Points to kernel start */
free_mem_ptr = free_mem_ptr_p; /* 显然，这个地址是从通过寄存器传进来的 */
free_mem_end_ptr = free_mem_ptr_end_p;
__machine_arch_type = arch_id;
arch_decomp_setup();
makecrc();
putstr("Uncompressing Linux...");
gunzip();
putstr(" done, booting the kernel./n");
return output_ptr;
}
----------------------------------------------------------------
调用call_kernel后首先关闭cache，然后就跳转到vmlinux入口去执行并将系统的控制权交给了vmlinux。
2. 内核vmlinux入口
>> vmlinux的编译简单描述
因为这里会牵扯到两个文件head.S和head-nommu.S,所以下面简单的描述一下vmlinux的生成过程。来看一下/arch/${arch}/kernel/makefile
，在该文件的最后脚本如下：
----------------------------------------------------------------
#
# Makefile for the linux kernel.
#
AFLAGS_head.o := -DTEXT_OFFSET=$(TEXT_OFFSET)
ifdef CONFIG_DYNAMIC_FTRACE
CFLAGS_REMOVE_ftrace.o = -pg
endif
# Object file lists.
obj-y := compat.o elf.o entry-armv.o entry-common.o irq.o /
process.o ptrace.o setup.o signal.o /
sys_arm.o stacktrace.o time.o traps.o
obj-$(CONFIG_ISA_DMA_API) += dma.o
obj-$(CONFIG_ARCH_ACORN) += ecard.o
obj-$(CONFIG_FIQ) += fiq.o
obj-$(CONFIG_MODULES) += armksyms.o module.o
obj-$(CONFIG_ARTHUR) += arthur.o
obj-$(CONFIG_ISA_DMA) += dma-isa.o
obj-$(CONFIG_PCI) += bios32.o isa.o
obj-$(CONFIG_SMP) += smp.o
obj-$(CONFIG_DYNAMIC_FTRACE) += ftrace.o
obj-$(CONFIG_KEXEC) += machine_kexec.o relocate_kernel.o
obj-$(CONFIG_KPROBES) += kprobes.o kprobes-decode.o
obj-$(CONFIG_ATAGS_PROC) += atags.o
obj-$(CONFIG_OABI_COMPAT) += sys_oabi-compat.o
obj-$(CONFIG_ARM_THUMBEE) += thumbee.o
obj-$(CONFIG_KGDB) += kgdb.o
obj-$(CONFIG_CRUNCH) += crunch.o crunch-bits.o
AFLAGS_crunch-bits.o := -Wa,-mcpu=ep9312
obj-$(CONFIG_CPU_XSCALE) += xscale-cp0.o
obj-$(CONFIG_CPU_XSC3) += xscale-cp0.o
obj-$(CONFIG_IWMMXT) += iwmmxt.o
AFLAGS_iwmmxt.o := -Wa,-mcpu=iwmmxt
ifneq ($(CONFIG_ARCH_EBSA110),y)
obj-y += io.o
endif
head-y := head$(MMUEXT).o
obj-$(CONFIG_DEBUG_LL) += debug.o
extra-y := $(head-y) init_task.o vmlinux.lds
----------------------------------------------------------------
可以看到，文件的结束位置有一行代码“head-y := head$(MMUEXT).o”，其中MMUEXT在/arch/${arch}/makefile中
定义，实际上对于没有mmu的处理器，MMUEXT就是nommu，而对于包含mmu的处理器，它的值是空，参照MMUEXT在/arch/${arch}/makefile中的相关代码
如下：
----------------------------------------------------------------
# defines filename extension depending memory manement type.
ifeq ($(CONFIG_MMU),)
MMUEXT := -nommu
endif
----------------------------------------------------------------
所以对于诸如S3C6410之类的包含MMU的处理器，实际上最终vmlinux开始位置的代码就是/arch/${arch}/kernel/head.S.
>> head.S文件的分析
需要注意的是，对于该文件的描述，一般的书籍上可能是仅仅对老版本的linux系统进行了分析，就是说该文件结束位置直接调用了
start_kernel 函数，至此开始执行c代码。其实，并不是这样的。
下面简单的列写一下head.S的内容：
----------------------------------------------------------------/*
* Kernel startup entry point.
* ---------------------------
*
* This is normally called from the decompressor code. The requirements
* are: MMU = off, D-cache = off, I-cache = dont care, r0 = 0,
* r1 = machine nr, r2 = atags pointer.
*
* This code is mostly position independent, so if you link the kernel at
* 0xc0008000, you call this at __pa(0xc0008000).
*
* See linux/arch/arm/tools/mach-types for the complete list of machine
* numbers for r1.
*
* We're trying to keep crap to a minimum; DO NOT add any machine specific
* crap here - that's what the boot loader (or in extreme, well justified
* circumstances, zImage) is for.
*/
.section ".text.head", "ax"
ENTRY(stext)
msr cpsr_c, #PSR_F_BIT | PSR_I_BIT | SVC_MODE @ ensure svc mode
@ and irqs disabled
mrc p15, 0, r9, c0, c0 @ get processor id
bl __lookup_processor_type @ r5=procinfo r9=cpuid
movs r10, r5 @ invalid processor (r5=0)?
beq __error_p @ yes, error 'p'
bl __lookup_machine_type @ r5=machinfo
movs r8, r5 @ invalid machine (r5=0)?
beq __error_a @ yes, error 'a'
bl __vet_atags
bl __create_page_tables
/*
* The following calls CPU specific code in a position independent
* manner. See arch/arm/mm/proc-*.S for details. r10 = base of
* xxx_proc_info structure selected by __lookup_machine_type
* above. On return, the CPU will be ready for the MMU to be
* turned on, and r0 will hold the CPU control register value.
*/
ldr r13, __switch_data @ address to jump to after
@ mmu has been enabled
adr lr, __enable_mmu @ return (PIC) address
add pc, r10, #PROCINFO_INITFUNC
ENDPROC(stext)
#if defined(CONFIG_SMP)
ENTRY(secondary_startup)
/*
* Common entry point for secondary CPUs.
*
* Ensure that we're in SVC mode, and IRQs are disabled. Lookup
* the processor type - there is no need to check the machine type
* as it has already been validated by the primary processor.
*/
msr cpsr_c, #PSR_F_BIT | PSR_I_BIT | SVC_MODE
mrc p15, 0, r9, c0, c0 @ get processor id
bl __lookup_processor_type
movs r10, r5 @ invalid processor?
moveq r0, #'p' @ yes, error 'p'
beq __error
/*
* Use the page tables supplied from __cpu_up.
*/
adr r4, __secondary_data
ldmia r4, {r5, r7, r13} @ address to jump to after
sub r4, r4, r5 @ mmu has been enabled
ldr r4, [r7, r4] @ get secondary_data.pgdir
adr lr, __enable_mmu @ return address
add pc, r10, #PROCINFO_INITFUNC @ initialise processor
@ (return control reg)
ENDPROC(secondary_startup)
/*
* r6 = &secondary_data
*/
ENTRY(__secondary_switched)
ldr sp, [r7, #4] @ get secondary_data.stack
mov fp, #0
b secondary_start_kernel
ENDPROC(__secondary_switched)
.type __secondary_data, %object
__secondary_data:
.long .
.long secondary_data
.long __secondary_switched
#endif /* defined(CONFIG_SMP) */
/*
* Setup common bits before finally enabling the MMU. Essentially
* this is just loading the page table pointer and domain access
* registers.
*/
__enable_mmu:
#ifdef CONFIG_ALIGNMENT_TRAP
orr r0, r0, #CR_A
#else
bic r0, r0, #CR_A
#endif
#ifdef CONFIG_CPU_DCACHE_DISABLE
bic r0, r0, #CR_C
#endif
#ifdef CONFIG_CPU_BPREDICT_DISABLE
bic r0, r0, #CR_Z
#endif
#ifdef CONFIG_CPU_ICACHE_DISABLE
bic r0, r0, #CR_I
#endif
mov r5, #(domain_val(DOMAIN_USER, DOMAIN_MANAGER) | /
domain_val(DOMAIN_KERNEL, DOMAIN_MANAGER) | /
domain_val(DOMAIN_TABLE, DOMAIN_MANAGER) | /
domain_val(DOMAIN_IO, DOMAIN_CLIENT))
mcr p15, 0, r5, c3, c0, 0 @ load domain access register
mcr p15, 0, r4, c2, c0, 0 @ load page table pointer
b __turn_mmu_on
ENDPROC(__enable_mmu)
/*
* Enable the MMU. This completely changes the structure of the visible
* memory space. You will not be able to trace execution through this.
* If you have an enquiry about this, *please* check the linux-arm-kernel
* mailing list archives BEFORE sending another post to the list.
*
* r0 = cp#15 control register
* r13 = *virtual* address to jump to upon completion
*
* other registers depend on the function called upon completion
*/
.align 5
__turn_mmu_on:
mov r0, r0
mcr p15, 0, r0, c1, c0, 0 @ write control reg
mrc p15, 0, r3, c0, c0, 0 @ read id reg
mov r3, r3
mov r3, r3
mov pc, r13
ENDPROC(__turn_mmu_on)
#include "head-common.S"
----------------------------------------------------------------
可能大家注意到，上面有大段的文字是secondary_startup以及CONFIG_SMP等，其实这个是对于SMP系统才会采用的代码。众所周知，SMP是对
称多处理的简称，是指系统中使用了一组处理器，各CPU之间共享内存子系统和总线结构，对应的有非对称多处理，嵌入式设备上我们并不会使用到
SMP的功能。
乍一看，无论如何也调用不到网上所谓的start_kernel函数中，大家注意看“ldr r13, __switch_data”，这里就是将函数__switch_data的
地址保存到r13，并在函数__enable_mmu-->__turn_mmu_on结束位置的“mov pc, r13”中将__switch_data调用起来。而函数__switch_data是实
现在/arch/${arch}/kernel/head-common.S中的一个函数，而函数start_kernel就是由__switch_data调用起来的。
你一定在奇怪，那么函数__enable_mmu是怎么调用起来的呢，呵呵，你简直是太聪明、太细心了。那赶紧听我跟你说吧，代码“add pc,
r10, #PROCINFO_INITFUNC”将会跳转到/arch/${arch}/mm/proc-arn-926.S中的初始化函数__arm926_setup中，并在该函数结束的位置以“mov pc,
lr”的方式调用__enable_mmu，千万别告诉我你忘记了前面提到的__enable_mmu的值保存在lr中哦。
至于为什么代码“add pc, r10, #PROCINFO_INITFUNC”将会跳转到/arch/${arch}/mm/proc-arn-926.S中的初始化函数__arm926_setup
中，我这里就不列举了。可以参照后面我转载的一篇文章。
----------------------------------------------------------------
.type __arm926_setup, #function
__arm926_setup:
mov r0, #0
mcr p15, 0, r0, c7, c7 @ invalidate I,D caches on v4
mcr p15, 0, r0, c7, c10, 4 @ drain write buffer on v4
#ifdef CONFIG_MMU
mcr p15, 0, r0, c8, c7 @ invalidate I,D TLBs on v4
#endif
#ifdef CONFIG_CPU_DCACHE_WRITETHROUGH
mov r0, #4 @ disable write-back on caches explicitly
mcr p15, 7, r0, c15, c0, 0
#endif
adr r5, arm926_crval
ldmia r5, {r5, r6}
mrc p15, 0, r0, c1, c0 @ get control register v4
bic r0, r0, r5
orr r0, r0, r6
#ifdef CONFIG_CPU_CACHE_ROUND_ROBIN
orr r0, r0, #0x4000 @ .1.. .... .... ....
#endif
mov pc, lr
----------------------------------------------------------------
好了，终于调用到start_kernel了,这是任何版本的linux内核通用的初始化函数。
3. Linux系统初始化
前面已经提到，函数start_kernel是任何版本的linux内核通用的初始化函数，也是汇编代码执行结束后的第一个c函数，它实现在
init/main.c中。
有关start_kernel的代码很长，初始化了很多东西，比如调用了setup_arch()、timer_init()、init_IRQ、console_init()、
pgtable_cache_init()、security_init()、signals_init()和rest_init()等，这里只对rest_init()做简单的分析。
下面首先列写一下rest_init()的代码：
----------------------------------------------------------------
/*
* We need to finalize in a non-__init function or else race conditions
* between the root thread and the init thread may cause start_kernel to
* be reaped by free_initmem before the root thread has proceeded to
* cpu_idle.
*
* gcc-3.4 accidentally inlines this function, so use noinline.
*/
static noinline void __init_refok rest_init(void)
__releases(kernel_lock)
{
int pid;
kernel_thread(kernel_init, NULL, CLONE_FS | CLONE_SIGHAND);
numa_default_policy();
pid = kernel_thread(kthreadd, NULL, CLONE_FS | CLONE_FILES);
kthreadd_task = find_task_by_pid_ns(pid, &init_pid_ns);
unlock_kernel();
/*
* The boot idle thread must execute schedule()
* at least once to get things moving:
*/
init_idle_bootup_task(current);
rcu_scheduler_starting();
preempt_enable_no_resched();
schedule();
preempt_disable();
/* Call into cpu_idle with preempt disabled */
cpu_idle();
}
----------------------------------------------------------------
可以看到，函数rest_init()首先会去创建线程kernel_init（注意：这里和网上或者相关书籍中描述的也不一样，可能是Linux版本的问题）
，有些文档中描述这里创建的是Init线程，虽然名字不一致，但是具体的实现是基本一致的，基本上都是完成根文件系统的挂载、初始化所有Linux的
设备驱动（就是调用驱动的初始化函数，类似于CE/Mobile中的Device Manager对设备驱动的初始化）以及启动用户空间Init进程。
由于手中的rest_init进程和网上描述的都是不一致的，所以这里也进行了简要的列举，代码如下：
----------------------------------------------------------------
static int __init kernel_init(void * unused)
{
lock_kernel();
/*
* init can run on any cpu.
*/
set_cpus_allowed_ptr(current, CPU_MASK_ALL_PTR);
/*
* Tell the world that we're going to be the grim
* reaper of innocent orphaned children.
*
* We don't want people to have to make incorrect
* assumptions about where in the task array this
* can be found.
*/
init_pid_ns.child_reaper = current;
cad_pid = task_pid(current);
smp_prepare_cpus(setup_max_cpus);
do_pre_smp_initcalls();
start_boot_trace();
smp_init();
sched_init_smp();
cpuset_init_smp();
do_basic_setup();
/*
* check if there is an early userspace init. If yes, let it do all
* the work
*/
if (!ramdisk_execute_command)
ramdisk_execute_command = "/init";
if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
ramdisk_execute_command = NULL;
prepare_namespace();
}
/*
* Ok, we have completed the initial bootup, and
* we're essentially up and running. Get rid of the
* initmem segments and start the user-mode stuff..
*/
init_post();
return 0;
}
static noinline int init_post(void)
{
/* need to finish all async __init code before freeing the memory */
async_synchronize_full();
free_initmem();
unlock_kernel();
mark_rodata_ro();
system_state = SYSTEM_RUNNING;
numa_default_policy();
if (sys_open((const char __user *) "/dev/console", O_RDWR, 0) < 0)
printk(KERN_WARNING "Warning: unable to open an initial console./n");
(void) sys_dup(0);
(void) sys_dup(0);
current->signal->flags |= SIGNAL_UNKILLABLE;
if (ramdisk_execute_command) {
run_init_process(ramdisk_execute_command);
printk(KERN_WARNING "Failed to execute %s/n",
ramdisk_execute_command);
}
/*
* We try each of these until one succeeds.
*
* The Bourne shell can be used instead of init if we are
* trying to recover a really broken machine.
*/
if (execute_command) {
run_init_process(execute_command);
printk(KERN_WARNING "Failed to execute %s. Attempting "
"defaults.../n", execute_command);
}
run_init_process("/sbin/init");
run_init_process("/etc/init");
run_init_process("/bin/init");
run_init_process("/bin/sh");
panic("No init found. Try passing init= option to kernel.");
}
----------------------------------------------------------------
可以看到，和网络上相关的描述不一样的是，这里首先会去初始化设备驱动，而不是像网上或者数据上所描述的一样，首先去加载跟文件系
统，难道不存在初始化的时候需要访问文件的驱动了？或者以前的做法纯属一种安全的考虑？
这些问题就留到以后对Linux&Android有深入地了解之后再去考虑吧!
好了,搞定!!!