1.內核啟動地址
1.1.名詞解釋
ZTEXTADDR

解壓代碼運行的開始地址。沒有物理地址和虛擬地址之分，因為此時MMU處于關閉狀態。這個地址不一定時RAM的地址，可以是支持讀寫尋址的flash等存儲中介。

Start address of decompressor. here's no point in talking about virtual or physical addresses here, since the MMU will be off at the time when you call the decompressor code. You normally call   the kernel at this address to start it booting. This doesn't have to be located in RAM, it can be in flash or other read-only or      read-write addressable medium.

ZRELADDR

       內核啟動在RAM中的地址。壓縮的內核映像被解壓到這個地址，然后執行。

This is the address where the decompressed kernel will be written, and eventually executed. The following constraint must be valid:

              __virt_to_phys(TEXTADDR) == ZRELADDR

       The initial part of the kernel is carefully coded to be position independent.

TEXTADDR

       內核啟動的虛擬地址，與ZRELADDR相對應。一般內核啟動的虛擬地址為RAM的第一個bank地址加上0x8000。

       TEXTADDR = PAGE_OFFSET + TEXTOFFST

       Virtual start address of kernel, normally PAGE_OFFSET + 0x8000.This is where the kernel image ends up. With the latest kernels, it must be located at 32768 bytes into a 128MB region. Previous kernels placed a restriction of 256MB here.

TEXTOFFSET

       內核偏移地址。在arch/arm/makefile中設定。

PHYS_OFFSET

       RAM第一個bank的物理起始地址。

Physical start address of the first bank of RAM.

PAGE_OFFSET

RAM第一個bank的虛擬起始地址。

       Virtual start address of the first bank of RAM. During the kernel

       boot phase, virtual address PAGE_OFFSET will be mapped to physical

       address PHYS_OFFSET, along with any other mappings you supply.

       This should be the same value as TASK_SIZE.

1.2.內核啟動地址確定
內核啟動引導地址由bootp.lds決定。 Bootp.lds : arch/arm/bootp

OUTPUT_ARCH(arm)

ENTRY(_start)

SECTIONS

{

. = 0;

.text : {

   _stext = .;

   *(.start)

   *(.text)

   initrd_size = initrd_end - initrd_start;

   _etext = .;

}

}

由上 .= 0可以確定解壓代碼運行的開始地址在0x0的位置。ZTEXTADDR的值決定了這個值得選取。

Makefile : arch/arm/boot/compressed

如果設定內核從ROM中啟動的話，可以在make menuconfig 的配置界面中設置解壓代碼的起始地址，否則解壓代碼的起始地址為0x0。實際上，默認從ROM啟動時，解壓代碼的起始地址也是0x0。

feq ($(CONFIG_ZBOOT_ROM),y)

ZTEXTADDR := $(CONFIG_ZBOOT_ROM_TEXT)

ZBSSADDR    := $(CONFIG_ZBOOT_ROM_BSS)

else

ZTEXTADDR :=0                                                       ZBSSADDR := ALIGN(4)

endif

SEDFLAGS    = s/TEXT_START/$(ZTEXTADDR)/;s/BSS_START/$(ZBSSADDR)/                                                                                                                                             

……

$(obj)/vmlinux.lds: $(obj)/vmlinux.lds.in arch/arm/mach-s3c2410/Makefile .config

       @sed "$(SEDFLAGS)" < $< > $@

@sed "$(SEDFLAGS)" < $< > $@ 規則將TEXT_START設定為ZTEXTADDR。TEXT_START在arch/arm/boot/compressed/vmlinux.lds.in 中被用來設定解壓代碼的起始地址。

OUTPUT_ARCH(arm)

ENTRY(_start)

SECTIONS

{

. = TEXT_START;  

_text = .;

.text : {

    _start = .;

    *(.start)

    *(.text)

*(.text.*)

……

}

}

內核的編譯依靠vmlinux.lds，vmlinux.lds由vmlinux.lds.s 生成。從下面代碼可以看出內核啟動的虛擬地址被設置為PAGE_OFFSET + TEXT_OFFSET，而內核啟動的物理地址ZRELADDR在arch/arm/boot/Makefile中設定。

OUTPUT_ARCH(arm)

ENTRY(stext)

SECTIONS

{

#ifdef CONFIG_XIP_KERNEL

       . = XIP_VIRT_ADDR(CONFIG_XIP_PHYS_ADDR);

#else

       . = PAGE_OFFSET + TEXT_OFFSET;   

#endif

       .init : {                  /* Init code and data             */

              _stext = .;

                     _sinittext = .;

                     *(.init.text)

                     _einittext = .;

……

       }

}

# arch/arm/boot/Makefile

# Note: the following conditions must always be true:

#   ZRELADDR == virt_to_phys(PAGE_OFFSET + TEXT_OFFSET)

#   PARAMS_PHYS must be within 4MB of ZRELADDR

#   INITRD_PHYS must be in RAM

ZRELADDR    := $(zreladdr-y)                                      

#---> zrealaddr-y is specified with 0x30008000 in arch/arm/boot/makefile.boot

PARAMS_PHYS := $(params_phys-y)

INITRD_PHYS := $(initrd_phys-y)

export ZRELADDR INITRD_PHYS PARAMS_PHYS

通過下面的命令編譯內核映像，由參數-a, -e設置其入口地址為ZRELADDR，此值在上面ZRELADDR    := $(zreladdr-y)指定。

quiet_cmd_uimage= UIMAGE $@                                                                     

      cmd_uimage = $(CONFIG_SHELL) $(MKIMAGE) -A arm -O linux -T kernel

                 -C none -a $(ZRELADDR) -e $(ZRELADDR)

                 -n 'Linux-$(KERNELRELEASE)' -d $< $@

1.3.小結
從上面分析可知道，linux內核被bootloader拷貝到RAM后，解壓代碼從ZTEXTADDR開始運行（這段代碼是與位置無關的PIC）。內核被解壓縮到ZREALADDR處，也就是內核啟動的物理地址處。相應地，內核啟動的虛擬地址被設定為TEXTADDR，滿足如下條件：

TEXTADDR = PAGE_OFFSET + TEXT_OFFSET

內核啟動的物理地址和虛擬地址滿足入下條件：

ZRELADDR == virt_to_phys(PAGE_OFFSET + TEXT_OFFSET)= virt_to_phys(TEXTADDR)

假定開發板為smdk2410，則有：

內核啟動的虛擬地址

TEXTADDR     = 0xC0008000

內核啟動的物理地址  

ZRELADDR     = 0x30008000

如果直接從flash中啟動還需要設置ZTEXTADDR地址。

2.內核啟動過程分析
內核啟動過程經過大體可以分為兩個階段：內核映像的自引導；linux內核子模塊的初始化。

start

Decompress_kernel()

Call_kernel

Stext:

Prepare_namespace

Do_basic_setup

init

Rest_init

Setup_arch ……

Start_kernel

_enable_mmu

Execve(“/sbin/init”))

內核啟動流程圖

2.1.內核映像的自引導
這階段的主要工作是實現壓縮內核的解壓和進入內核代碼的入口。

Bootloader完成系統引導后，內核映像被調入內存指定的物理地址ZTEXTADDR。典型的內核映像由自引導程序和壓縮的VMlinux組成。因此在啟動內核之前需要先把內核解壓縮。內核映像的入口的第一條代碼就是自引導程序。它在arch/arm/boot/compressed/head.S文件中。

Head.S文件主要功能是實現壓縮內核的解壓和跳轉到內核vmlinux內核的入口。Decompress_kernel(): arch/arm/boot/compressed/misc.c 和call_kernel這兩個函數實現了上述功能。在調用decompress_kernel()解壓內核之前，需要確保解壓后的內核代碼不會覆蓋掉原來的內核映像。以及設定內核代碼的入口地址ZREALADDR。

              .text

              adr   r0, LC0

              ldmia       r0, {r1, r2, r3, r4, r5, r6, ip, sp}

              .type       LC0, #object

LC0:              .word      LC0               @ r1

              .word      __bss_start            @ r2

              .word      _end                     @ r3

              .word      zreladdr          @ r4

              .word      _start                    @ r5

              .word      _got_start              @ r6

              .word      _got_end        @ ip