Linux0.11内核源码解析-head.s

学习资料：

1. Linux内核完全注释

2. 操作系统真像还原

3. 极客时间-Linux内核源码趣读

4. Linux0.11内核源码

->设置ds,es,fs,gs,寄存器为0x10,都指向GDT的第2个描述0000 0000 0001 0000

/*
*  head.s contains the 32-bit startup code.
*
* NOTE!!! Startup happens at absolute address 0x00000000, which is also where
* the page directory will exist. The startup code will be overwritten by
* the page directory.
*/
.text
.globl idt,gdt,pg_dir,tmp_floppy_area
pg_dir:
.globl startup_32
startup_32:movl $0x10,%eax  mov %ax,%dsmov %ax,%esmov %ax,%fsmov %ax,%gslss stack_start,%esp  #_stack_start->ss:esp,设置系统堆栈，stack_start定义在kernel/sched.ccall setup_idtcall setup_gdtmovl $0x10,%eax        # reload all the segment registersmov %ax,%ds        # after changing gdt. CS was alreadymov %ax,%es        # reloaded in 'setup_gdt'mov %ax,%fsmov %ax,%gslss stack_start,%espxorl %eax,%eax
1:    incl %eax        # check that A20 really IS enabledmovl %eax,0x000000    # loop forever if it isn'tcmpl %eax,0x100000je 1b

检查数学协处理器芯片是否存在，修改cr0寄存器，假设存在协处理器的情况下执行一个协处理器指令，如果出错的话则说明协处理器芯片不存在，需要设置cr0中协处理器仿真位EM（bit 2），并复位协处理器存在标志MP（bit 1）

finit 向协处理器发出初始化命令，它会把协处理器置于一个未受以前操作影响的已知状态，设置其控制字为默认值、清除状态字和所有浮点栈式寄存器。非等待形式的这条指令（fninit）还会让协处理器终止执行当前正在执行的任何先前的算术操作。fstsw 指令取协处理器的状态字。如果系统中存在协处理器的话，那么在执行了fninit指令后其状态字低字节肯定为0。

/*
* NOTE! 486 should set bit 16, to check for write-protect in supervisor
* mode. Then it would be unnecessary with the "verify_area()"-calls.
* 486 users probably want to set the NE (#5) bit also, so as to use
* int 16 for math errors.
*/movl %cr0,%eax        # check math chipandl $0x80000011,%eax    # Save PG,PE,ET
/* "orl $0x10020,%eax" here for 486 might be good */orl $2,%eax        # set MPmovl %eax,%cr0call check_x87jmp after_page_tables/*
* We depend on ET to be correct. This checks for 287/387.
*/
check_x87:fninitfstsw %axcmpb $0,%alje 1f            /* no coprocessor: have to set bits */movl %cr0,%eaxxorl $6,%eax        /* reset MP, set EM */movl %eax,%cr0ret
.align 2
1:    .byte 0xDB,0xE4        /* fsetpm for 287, ignored by 387 */ret

设置了 256 个中断描述符，并且让每一个中断描述符中的中断程序例程都指向一个 ignore_int 的函数地址，这个是个默认的中断处理程序，之后会逐渐被各个具体的中断程序所覆盖。举个例子，比如之后键盘模块会将自己的键盘中断处理程序，覆盖过去

*
*  setup_idt
*
*  sets up a idt with 256 entries pointing to
*  ignore_int, interrupt gates. It then loads
*  idt. Everything that wants to install itself
*  in the idt-table may do so themselves. Interrupts
*  are enabled elsewhere, when we can be relatively
*  sure everything is ok. This routine will be over-
*  written by the page tables.
*/
setup_idt:lea ignore_int,%edx # 将ignore_int的有效地址放到edx寄存器movl $0x00080000,%eax # 将选择符0x0008置入eax的高16位中movw %dx,%ax        /* selector = 0x0008 = cs */ # 低16位置入eax的低16位中，movw $0x8E00,%dx    /* interrupt gate - dpl=0, present */lea idt,%edi # idt是中断描述符表的地址mov $256,%ecx
rp_sidt:movl %eax,(%edi) # 将哑中断门描述符存入表中movl %edx,4(%edi)addl $8,%edidec %ecxjne rp_sidtlidt idt_descrret.align 2
.word 0
idt_descr:.word 256*8-1        # idt contains 256 entries.long idt
.align 2idt:    .fill 256,8,0        # idt is uninitialized

其实和我们原先设置好的 gdt 一模一样。也是有代码段描述符和数据段描述符，然后第四项系统段描述符并没有用到，不用管。最后还留了 252 项的空间，这些空间后面会用来放置任务状态段描述符 TSS 和局部描述符表 LDT，这些都是为多任务准备的

/*
*  setup_gdt
*
*  This routines sets up a new gdt and loads it.
*  Only two entries are currently built, the same
*  ones that were built in init.s. The routine
*  is VERY complicated at two whole lines, so this
*  rather long comment is certainly needed :-).
*  This routine will beoverwritten by the page tables.
*/
setup_gdt:lgdt gdt_descrretgdt_descr:.word 256*8-1        # so does gdt (not that that's any.long gdt        # magic number, but it works for me :^).align 8gdt:    .quad 0x0000000000000000    /* NULL descriptor */.quad 0x00c09a0000000fff    /* 16Mb */.quad 0x00c0920000000fff    /* 16Mb */.quad 0x0000000000000000    /* TEMPORARY - don't use */.fill 252,8,0            /* space for LDT's and TSS's etc */

为啥要重新设置一遍，因为原来设置的gdt是在setup程序中，之后这个地方的缓冲区又被覆盖掉，所以在head.s中重新设置

剩下最后的代码就是分页机制开启

采用10 10 12分页机制

15M转换，二进制：0000 0000 1101 0000 0000 0000 0000 0000

高10位 中10位 低12位

10：0000 0000 11 10： 01 0000 0000 12： 0000 0000 0000

高10位负责页目录表中找到页目录项，页目录项的值加上中间10位拼接后的地址去页表中寻找一个页表项，这个页表项的值再加上低12位的偏移地址，就是最终的物理地址

step1.高10位：0000 0000 11代表的是页目录项3（PDE3），找到页表3

step2.中10位：0100 0000 00代表的是第256表项（PTE256）

step3.低12位：0000 0000 0000代表的是页内偏移地址0

step4.页偏移地址+页起始地址15M

CR0分页寄存器开关

在linux0.11的版本里最大内存为16M，所以这里只需要1个页目录表和4个页表

4个页表*1024（10位）页表项数*4kb（12位） = 16MB

/*
* I put the kernel page tables right after the page directory,
* using 4 of them to span 16 Mb of physical memory. People with
* more than 16MB will have to expand this.
*/
.org 0x1000
pg0:.org 0x2000
pg1:.org 0x3000
pg2:.org 0x4000
pg3:.org 0x5000 # 0x5000定义的是数据块

保留1k字节

/*
* tmp_floppy_area is used by the floppy-driver when DMA cannot
* reach to a buffer-block. It needs to be aligned, so that it isn't
* on a 64kB border.
*/
tmp_floppy_area:.fill 1024,1,0

为调用main做准备，，压入三个参数envp,argv,argc但是main没有用到，在设置分页后调用ret指令会将main的地址弹出堆栈，执行main

after_page_tables:pushl $0        # These are the parameters to main :-)pushl $0pushl $0pushl $L6        # return address for main, if it decides to.pushl $mainjmp setup_paging/*
* Setup_paging
*
* This routine sets up paging by setting the page bit
* in cr0. The page tables are set up, identity-mapping
* the first 16MB. The pager assumes that no illegal
* addresses are produced (ie >4Mb on a 4Mb machine).
*
* NOTE! Although all physical memory should be identity
* mapped by this routine, only the kernel page functions
* use the >1Mb addresses directly. All "normal" functions
* use just the lower 1Mb, or the local data space, which
* will be mapped to some other place - mm keeps track of
* that.
*
* For those with more memory than 16 Mb - tough luck. I've
* not got it, why should you  The source is here. Change
* it. (Seriously - it shouldn't be too difficult. Mostly
* change some constants etc. I left it at 16Mb, as my machine
* even cannot be extended past that (ok, but it was cheap 
* I've tried to show which constants to change by having
* some kind of marker at them (search for "16Mb"), but I
* won't guarantee that's all  )
*/
.align 2
setup_paging:# 对5页内存进行清0，一个页目录+4页页表movl $1024*5,%ecx        /* 5 pages - pg_dir+4 page tables */xorl %eax,%eaxxorl %edi,%edi            /* pg_dir is at 0x000 */cld;rep;stosl #递增方向# pg0+7 0x00001007 表示第一页 表示用户页存在，用户可读写# 第一页表所在地址 0x00001007 & 0xffff f000 = 0x1000# 第二页表的属性 0x00001007 & 0x0000 0fff = 0x07movl $pg0+7,pg_dir        /* set present bit/user r/w */movl $pg1+7,pg_dir+4        /*  --------- " " --------- */movl $pg2+7,pg_dir+8        /*  --------- " " --------- */movl $pg3+7,pg_dir+12        /*  --------- " " --------- */movl $pg3+4092,%edi # 最后一页的最后一项movl $0xfff007,%eax        /*  16Mb - 4096 + 7 (r/w user,p) */ # 最后一页物理内存页面地址是0xfff000,加上7属性标志std # 递减方向
1:    stosl            /* fill pages backwards - more efficient  */subl $0x1000,%eax # 每填好一项，物理地址减去0x1000jge 1b# 启动分页xorl %eax,%eax        /* pg_dir is at 0x0000 */movl %eax,%cr3        /* cr3 - page directory start */movl %cr0,%eaxorl $0x80000000,%eaxmovl %eax,%cr0        /* set paging (PG) bit */ret            /* this also flushes prefetch-queue */ # ret  to main function

逻辑地址：我们程序员写代码时给出的地址叫逻辑地址，其中包含段选择子和偏移地址两部分。

线性地址：通过分段机制，将逻辑地址转换后的地址，叫做线性地址。而这个线性地址是有个范围的，这个范围就叫做线性地址空间，32 位模式下，线性地址空间就是 4G。

物理地址：就是真正在内存中的地址，它也是有范围的，叫做物理地址空间。那这个范围的大小，就取决于你的内存有多大了。

虚拟地址：如果没有开启分页机制，那么线性地址就和物理地址是一一对应的，可以理解为两者相等。如果开启了分页机制，那么线性地址将被视为虚拟地址，这个虚拟地址将会通过分页机制的转换，最终转换成物理地址。

小结：

1.在引导加载程序bootsect将setup和system加载后，分别把自己和setup代码移动到0x90000和0x90200处，然后权限交给setup。

2.setup程序利用bios中断保存获取机器的基本参数在0x90000,同时把system模块往下移动到0x00000处开始，所以system中的head就从0x00000开始；

然后加载描述表基地址到描述符表寄存器中，为进行32位保护模式下运行做好准备，设置中断，CR0跳转head。

3.head初始化中断描述表256项们描述符，检查A20，测试数学协处理器，初始化内存页表目录，为内存的分页管理做准备工作。

4.跳转main