pmon启动分析(汇编部分)

1、精品好资料学习推荐/*$Id: start.S,v 2006/09/14 01:59:08 root Exp $ */* * Copyright (c) 2001 Opsycon AB (www.opsycon.se) * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source

2、code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the d

3、istribution. * 3. All advertising materials mentioning features or use of this software * must display the following acknowledgement: *This product includes software developed by Opsycon AB, Sweden. * 4. The name of the author may not be used to endorse or promote products * derived from this softwa

4、re without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AS IS AND ANY EXPRESS * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE L

5、IABLE FOR ANY * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, S

6、TRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * */#ifndef _KERNEL#define _KERNEL#endif#include #include #include #include #include pmon/dev/ns16550.h#include target/prid.h#incl

7、ude target/sbd.h#include target/fcr.h#include target/via686b.h#include target/i8254.h#include target/isapnpreg.h#define DEBUG_LOCORE#ifndef BOOT_FROM_EJTAG #define BOOT_FROM_EJTAG#endif#undef BOOT_FROM_EJTAG#ifdef DEBUG_LOCORE#defineTTYDBG(x) .rdata;98: .asciz x; .text; la a0, 98b; bal stringserial;

8、 nop#else#define TTYDBG(x)#endif#definePRINTSTR(x) .rdata;98: .asciz x; .text; la a0, 98b; bal stringserial; nop/* Delay macro */#defineDELAY(count)li v0, count;99:bnezv0, 99b;addiuv0, -1#define tmpsizes1#define msizes2#define bonitos4#define dbgs5#define sdCfgs6#define CP0_CONFIG $16#define CP0_TAG

9、LO $28#define CP0_TAGHI $29/* * Register usage: * *s0link versus load offset, used to relocate absolute adresses. *s1free *s2memory size. *s3free. *s4Bonito base address. *s5dbg. *s6sdCfg. *s7rasave. *s8L3 Cache size. */.setnoreorder.globl_start.globlstart.globl_main_start:start:.globlstack/*栈的大小是16

10、K，从反汇编的地址可以看出，在下面la sp,stack中堆栈指针SP指向的地址是0x8000C000，可以看出sp的指向的位置，并不是指向flash，因此开始的堆栈用的就是sdram，而ld生成代码的text段的起始地址为0x80010000，这是吻合的。*/stack = start - 0x4000/* Place PMON stack below PMON start in RAM */* NOTE! Not more that 16 instructions here! Right now its FULL! */mtc0zero, COP_0_STATUS_REG /*禁止中断*/

11、mtc0zero, COP_0_CAUSE_REG /*禁止异常处理*/lit0, SR_BOOT_EXC_VEC/* Exception to Boostrap Location */mtc0t0, COP_0_STATUS_REG/*以上两句中SR_BOOT_EXC_VEC的值是0x00400000，其目的就是设置协处理器0的状态寄存器status的BEV位为1，使得CPU使用ROM(kseg1空间的异常入口)，可见此时的这些代码都是在ROM中运行的。*/lasp, stacklagp, _gp/baluncached/* Switch to uncached address space

12、*/nopballocate/* Get current execute address */nopuncached:orra, UNCACHED_MEMORY_ADDRjranop/*bal locate是一条跳转指令。先说说bal这条指令。通常bal指令会算出相对于PC寄存器的偏移量，然后把PC+8指令的地址放到ra寄存器里，也就是把uncached:即把or ra,UNCACHED_MEMORY_ADDR这条指令的地址放到ra寄存器中。由于龙芯加电启动时是从0xBFC00000地址开始的，那么此时ra寄存器中的值就是0xBFC0002C，此后程序就跳转到locate这里开始执行。*/*由

13、于龙芯的地址空间决定，当BEV=1时，异常入口地址从0xBFC00200出开始，所以这里的代码不能太长，指令条数是有限的，但并不是上面说的16条(这是我的理解)，因为后面紧跟着是其它中断向量的地址。*/* * Reboot vector usable from outside pmon. */*以下是各种异常*/.align9ext_map_and_reboot:lia0,0x10000000 /*test from 0xbfcxxxxx or 0xff20xxxx */anda0,rabneza0,1flaa0,_startlis0,0xbfc00000subus0,a01:laa0, v2

14、00_msgbalstringserialnopbexc_common.align7/* bfc00280 */laa0, v280_msgbalstringserialnopbexc_common/* Cache error */.align8/* bfc00300 */PRINTSTR(rnPANIC! Unexpected Cache Error exception! )mfc0a0, COP_0_CACHE_ERRbalhexserialnopbexc_common/* General exception */.align7/* bfc00380 */lia0,0x10000000 /

15、*test from 0xbfcxxxxx or 0xff20xxxx */anda0,rabneza0,1flaa0,_startlis0,0xbfc00000subus0,a01:laa0, v380_msgbalstringserialnopbexc_common.align9/* bfc00400 */laa0, v400_msgbalstringserialnopbexc_common.align7/* bfc00480 */#laa0, v480_msg#balstringserial#nop#bexc_common#if 0li s0,(0xbfc00000-0x81000000

16、)PRINTSTR(ACPI_MEM_CEHCK=)lia1, 0lit0, 0xa0000000lit2, 0xa01000001:lwt1,(t0)addua1, a1, t1addiu t0, t0, 4bnet0,t2,1bnopaddu a0,a1,zerobalhexserialnopPRINTSTR(rn)#endif/*acpi: set ddr autorefresh and suspend */lit0, 0xaffffe30lwt1, 0x4(t0)lit2, 0x1ort1, t1, t2swt1, 0x4(t0)lit0, 0xbfe7c008lwt1, 0x0(t0

17、)ori t1, t1, 0x2000swt1, 0x0(t0).align8/* bfc00500 */exc_common:PRINTSTR(rnCAUSE=)mfc0a0, COP_0_CAUSE_REGbalhexserialnopPRINTSTR(rnSTATUS=)mfc0a0, COP_0_STATUS_REGbalhexserialnopPRINTSTR(rnERRORPC=)mfc0a0, COP_0_ERROR_PCbalhexserialnopPRINTSTR(rnEPC=)mfc0a0, COP_0_EXC_PCbalhexserialnopPRINTSTR(rnBAD

18、ADDR=)mfc0a0, COP_0_BAD_VADDRbalhexserialnopbal mydebug_mainnop1:b 1bnop.align 9nop.align 8.word read.word write.word open.word close.word nullfunction.word printf.word vsprintf.word nullfunction.word nullfunction.word getenv.word nullfunction.word nullfunction.word nullfunction.word nullfunction/*这

19、里是例外向量，其实什么都没做，就是输出一些相关的信息，然后统一跳转到ex_common处来处理，这是靠对齐来保证位于MIPS体系结构相应的中断向量处，如.align 9，则以29为间隔对齐，换成16进制就是以0x200为间隔*/* * We get here from executing a bal to get the PC value of the current execute * location into ra. Check to see if we run from ROM or if this is ramloaded. */locate:las0,uncachedsubus0,

20、ra,s0/*根据调试的过程可以看出，uncached的地址是0x8100002c，而ra寄存器中的值是0xbfc0002c，所以s0中的偏移地址值是0x3ec00000。(注意以上的地址是针对LS1B的启动pmon的调试结果得到的，只具有参考意义)上述地址的作用：到目前为止，内存、cache等都没有初始化，所以程序还是在rom中运行，但是程序自身却认为其是在ram中运行的。要理解这两种运行方式的区别就必须说明一下LS232的地址分配问题。其地址分配见下表：虚拟地址范围从不同模式访问用户模式管理模式核心模式调试模式0xff40_0000-0xffff_ffff12Mbkseg3kseg30xf

21、f20_0000-0xff3f_ffff2 Mbkseg3kseg30xe000_0000-0xff1f_ffff498 Mbkseg3kseg30xc000_0000-0xdfff_ffff512 Mbssegksseg/kseg2ksseg/kseg20xa000_0000-0xbfff_ffff512 Mbkseg1kseg10x8000_0000-0x9fff_ffff512 Mbkseg0kseg00x0000_0000-0x7fff_ffff2Gbusegsusegkusegkusegkuseg：用户模式可用的地址kseg0：只需要把最高位清零，这些地址就转换成物理地址，连续地映射

22、到物理内存中512Mb的低位。通过高速缓存对这段区域内的地址进行访问，cache段kseg1：把最高3位清零，这些地址就映射到物理地址，并连续地映射到物理内存中512Mb的低位，kseg1段不用缓存，uncache段kseg1段是唯一在系统重启时能正常工作的内存映射空间kseg2：只能在核心状态下使用，并且要经过MMU转换，在MMU设置好之前不要对其进行访问(注意在有些版本中将这里的kseg2和kseg3统称为kseg2)书接前述，当前程序是在kseg1中运行，但是程序自身却认为其在kseg0中运行，而这两个段都同时映射到相同的物理地址，只是kseg1段是uncache段，kseg0段是cac

23、he段，在内存、cache等资源没有初始化好的情况下要保证程序在rom中运行，所以需要一个偏移地址来修正程序的运行地址，这个偏移地址就是上面计算的s0。*/#balCPU_TLBClear#noplit0,SR_BOOT_EXC_VECmtc0t0,COP_0_STATUS_REGmtc0 zero,COP_0_CAUSE_REG/*这里再一次设置BEV=1，但是这个在程序的开始处已经初始化过了，没看懂？*/.set noreorder/*spi speed*/ li t0, 0xbfe80000 li t1, 0x17 / div 4, fast_read + burst_en + memo

24、ry_ensb t1, 0x4(t0) / sfc_param/*上述代码设置的SPI0的寄存器sfc_param，设置SPI时钟分频系数为4分频，同时使能了SPI_flash的读使能以及SPI的快速读和读连续地址模式*/*下述代码是设置时钟，配置信息在Targets/ls1f/conf中，因为我们这里用的是ls1g配置，所以这里没有配置LS1FSOC选项*/#ifdef LS1FSOC/* to adjust the DDR frequency */li v0,0xbfc00000+(NVRAM_POS+PLL_OFFS)lw a1,(v0)li v0,0xffff0000and v0,a1

25、bnez v0,1fnopandi v0,a1,0x8888beqz v0,1fnopb 2fnop1:#define DDRCFG_DATA (0x8888|(CPU_MULT-1)|(DDR_MULT-3)8) li a1, DDRCFG_DATA / 1fboard 25MHz2: li a0, 0xbfe78030 sw a1, 0x0(a0) noplwa2, 0x0(a0)xor a2,a1andi a2,0xf0fbnez a2,2bnop#else li a0, 0xbfe78030/*31:dc_div_en,30-26:dc_div,25:cpu_div_en,24-20:

26、cpu_div,19:ddr_div_en,18-14:ddr_div*/*0xbfe78030这个地址在LS1B上是PLL_FREQ的基地址，这个寄存器是用来精确配置LS1B的时钟，具体配置方法请参考LS1B的用户手册。在下面要用到PLL_DIV_PARAM这个寄存器，其地址是0xbfe78034。*/#if 0 li v1,0x92298000 li a1, 0x39f0a#elseli v0,0xbfc00000+(NVRAM_POS+PLL_OFFS)lw v1,4(v0)lw a1,(v0)/*寄存器v0中的值是0xbfc701f0，地址0xbfc701f0中的值是0xfffffff

27、f，调试结果显示0xbfc701f4地址中的值0xffffffff，但是在数据手册上并没有对这个地址有说明，这个地址有什么用？*/li v0,0xfffc0000and v0,a1bnez v0,1fnop/*分析得v0的值为0xfffc0000，不为零，所以跳转到下面标号为1的地方继续执行。*/andi v0,v1,0x3fbnez v0,1fnopli v0,(131)|(125)|(119)and a2,v0,v1bne a2,v0,1fnopbeqz v1,1fnopnop/beqz a1,1fnopb 2fnop1: /li v1, (131)|(426)|(125)|(220)|(

28、119)|(514)|0x2a00 /li a1,20/li v1, 0x86188000 /(131)|(426)|(125)|(220)|(119)|(514)|0x2a00/li a1,0x21402 /li v1,0x86188000 /(131)|(426)|(125)|(220)|(119)|(514)|0x2a00 li v1,0x8618aa00 /(131)|(426)|(125)|(120)|(119)|(214)|0x2a00 li a1, 4 /li v1,0xa22a0000 /(131)|(426)|(125)|(220)|(119)|(5 enable/ mmap

29、5 - block trans enable,cache / mmap4 - fetch ins / mmap1:0 - destination / / NOTE: the address windows has priority, win0 win1 . win7 set_cpu_window(0, 0x1fc00000, 0xfff00000, 0x1fc000f3) / boot rom set_cpu_window(1, 0x10000000, 0xf8000000, 0x10000001) / PCI mem0, mem1, disabled set_cpu_window(2, 0x

30、18000000, 0xfc000000, 0x18000001) / PCI mem2 disabled set_cpu_window(3, 0x1c000000, 0xffe00000, 0x1c000001) / PCI cfg/IO/header disabled set_cpu_window(4, 0x1c200000, 0xffe00000, 0x1c2000d2) / gpu 1c2 /dc 1c3 set_cpu_window(5, 0x1f000000, 0xff000000, 0x1f0000d3) / AXIMUX set_cpu_window(6, 0x40000000

31、, 0xc0000000, 0x000000f0) / DDR 1GB set_cpu_window(7, 0x00000000, 0x00000000, 0x000000f0) / everything else / after this fixup, the kernel code should be compiled with / uncached instruction fetch patch#endif /*上述的代码是在确定CPU配置窗口地址，没看懂？*/* * Now determine DRAM configuration and size by * reading the I

32、2C EEROM on the DIMMS */* * set gpio 66 to make ddr #CKE low */lit0,0xbfd010c8lit1,0x4swt1,(t0)lit0,0xbfd010f8lit1,0x0swt1,(t0)/*LS1B没有GPIO66，这段代码似乎没用？*/*下面就是DDR2的配置过程*/#ddr2config by cww 20090901 li msize,0x0f000000 /*240Mb*/ PRINTSTR(DDR2 config begin_2rn) bal ddr2_config /*ddr2_config这个文件在同目录下，是个

33、单独的文件，我将其代码贴到结尾处，并分析之*/ nop PRINTSTR(DDR2 config endrn)#ifdef CONFIG_DDR16BIT/*16bit ddr*/ li a0,0xbfd00000li a1,0x110000lw a2,0x424(a0);or a2,a1sw a2,0x424(a0);#endif/*在ls1g的配置文件中，CONFIG_DDR16BIT没有设置，这段pass，(*_*) */*disable DDR-config*/ li a0,0xbfd00000 lw a2,0x424(a0) li a1,0x100000 or a2,a1 sw a2

34、,0x424(a0)/*在LS1B用户手册上找到这个寄存器，一看便知。*/*disable DDR-config*/*100M phy*/li a0,0xbfd00000lw a2,0x424(a0);ori a2,0xf#ifndef CONFIG_PHY100M/*在ls1g的配置文件中，配置了CONFIG_PHY100M，所以这段不编译*/xor a2,0xf#endifsw a2,0x424(a0);/*上述代码功能是配置百兆，复用PAD配置成GMAC0功能*/*GMAC1 enable use UART0 UART1 */ lw a2,0x420(a0)#ifdef CONFIG_G

35、MAC1 li a1,0x1c30c307 or a2,a1 xor a2,a1/*查看LS1B的用户手册，阅读0xbfd00420这个寄存器，此处是屏蔽其他外设，比如NAND，对相关PAD的复用*/#endif ori a2,0x18#ifndef CONFIG_GMAC1 /*not configure CONFIG_GAMC1,here is ignore*/ xor a2,0x18#endif sw a2,0x420(a0) /*将复用PAD配置成GAMC1功能*/#define CF_7_SE (1 3) /* Secondary cache enable */#define CF_7_SC (1 31) /* Secondary cache not present */#define CF_7_TE (1 12) /* Tertiary cache enable */#define CF_7_TC (1 17) /* Tertiary cache not present */#define CF_7_TS (3 20) /* Tertiary cache size */#define CF_7_TS_AL 20 /* Shift to align */#define NOP8 nop;nop;nop;nop;nop