kernel源码（八）head.s
这一篇我们来讲解head.s源码，不同于bootsect.s和setup.s，head.s使用at&t汇编格式。存放在磁盘的第6个扇区处(bootsect.s存放在第一个扇区，setup.s存放在第2345个扇区)。
1 源码
/* * linux/boot/head.s * * (C) 1991 Linus Torvalds */ /* * head.s contains the 32-bit startup code. * * NOTE!!! Startup happens at absolute address 0x00000000, which is also where * the page directory will exist. The startup code will be overwritten by * the page directory. */ .text .globl _idt,_gdt,_pg_dir,_tmp_floppy_area _pg_dir: startup_32: movl $0x10,%eax mov %ax,%ds mov %ax,%es mov %ax,%fs mov %ax,%gs lss _stack_start,%esp call setup_idt call setup_gdt movl $0x10,%eax # reload all the segment registers mov %ax,%ds # after changing gdt. CS was already mov %ax,%es # reloaded in 'setup_gdt' mov %ax,%fs mov %ax,%gs lss _stack_start,%esp xorl %eax,%eax 1: incl %eax # check that A20 really IS enabled movl %eax,0x000000 # loop forever if it isn't cmpl %eax,0x100000 je 1b /* * NOTE! 486 should set bit 16, to check for write-protect in supervisor * mode. Then it would be unnecessary with the "verify_area()"-calls. * 486 users probably want to set the NE (#5) bit also, so as to use * int 16 for math errors. */ movl %cr0,%eax # check math chip andl $0x80000011,%eax # Save PG,PE,ET /* "orl $0x10020,%eax" here for 486 might be good */ orl $2,%eax # set MP movl %eax,%cr0 call check_x87 jmp after_page_tables /* * We depend on ET to be correct. This checks for 287/387. */ check_x87: fninit fstsw %ax cmpb $0,%al je 1f /* no coprocessor: have to set bits */ movl %cr0,%eax xorl $6,%eax /* reset MP, set EM */ movl %eax,%cr0 ret .align 2 1: .byte 0xDB,0xE4 /* fsetpm for 287, ignored by 387 */ ret /* * setup_idt * * sets up a idt with 256 entries pointing to * ignore_int, interrupt gates. It then loads * idt. Everything that wants to install itself * in the idt-table may do so themselves. Interrupts * are enabled elsewhere, when we can be relatively * sure everything is ok. This routine will be over- * written by the page tables. */ setup_idt: lea ignore_int,%edx movl $0x00080000,%eax movw %dx,%ax /* selector = 0x0008 = cs */ movw $0x8E00,%dx /* interrupt gate - dpl=0, present */ lea _idt,%edi mov $256,%ecx rp_sidt: movl %eax,(%edi) movl %edx,4(%edi) addl $8,%edi dec %ecx jne rp_sidt lidt idt_descr ret /* * setup_gdt * * This routines sets up a new gdt and loads it. * Only two entries are currently built, the same * ones that were built in init.s. The routine * is VERY complicated at two whole lines, so this * rather long comment is certainly needed :-). * This routine will beoverwritten by the page tables. */ setup_gdt: lgdt gdt_descr ret /* * I put the kernel page tables right after the page directory, * using 4 of them to span 16 Mb of physical memory. People with * more than 16MB will have to expand this. */ .org 0x1000 pg0: .org 0x2000 pg1: .org 0x3000 pg2: .org 0x4000 pg3: .org 0x5000 /* * tmp_floppy_area is used by the floppy-driver when DMA cannot * reach to a buffer-block. It needs to be aligned, so that it isn't * on a 64kB border. */ _tmp_floppy_area: .fill 1024,1,0 after_page_tables: pushl $0 # These are the parameters to main :-) pushl $0 pushl $0 pushl $L6 # return address for main, if it decides to. pushl $_main jmp setup_paging L6: jmp L6 # main should never return here, but # just in case, we know what happens. /* This is the default interrupt "handler" :-) */ int_msg: .asciz "Unknown interrupt\n\r" .align 2 ignore_int: pushl %eax pushl %ecx pushl %edx push %ds push %es push %fs movl $0x10,%eax mov %ax,%ds mov %ax,%es mov %ax,%fs pushl $int_msg call _printk popl %eax pop %fs pop %es pop %ds popl %edx popl %ecx popl %eax iret /* * Setup_paging * * This routine sets up paging by setting the page bit * in cr0. The page tables are set up, identity-mapping * the first 16MB. The pager assumes that no illegal * addresses are produced (ie >4Mb on a 4Mb machine). * * NOTE! Although all physical memory should be identity * mapped by this routine, only the kernel page functions * use the >1Mb addresses directly. All "normal" functions * use just the lower 1Mb, or the local data space, which * will be mapped to some other place - mm keeps track of * that. * * For those with more memory than 16 Mb - tough luck. I've * not got it, why should you :-) The source is here. Change * it. (Seriously - it shouldn't be too difficult. Mostly * change some constants etc. I left it at 16Mb, as my machine * even cannot be extended past that (ok, but it was cheap :-) * I've tried to show which constants to change by having * some kind of marker at them (search for "16Mb"), but I * won't guarantee that's all :-( ) */ .align 2 setup_paging: movl $1024*5,%ecx /* 5 pages - pg_dir+4 page tables */ xorl %eax,%eax xorl %edi,%edi /* pg_dir is at 0x000 */ cld;rep;stosl movl $pg0+7,_pg_dir /* set present bit/user r/w */ movl $pg1+7,_pg_dir+4 /* --------- " " --------- */ movl $pg2+7,_pg_dir+8 /* --------- " " --------- */ movl $pg3+7,_pg_dir+12 /* --------- " " --------- */ movl $pg3+4092,%edi movl $0xfff007,%eax /* 16Mb - 4096 + 7 (r/w user,p) */ std 1: stosl /* fill pages backwards - more efficient :-) */ subl $0x1000,%eax jge 1b xorl %eax,%eax /* pg_dir is at 0x0000 */ movl %eax,%cr3 /* cr3 - page directory start */ movl %cr0,%eax orl $0x80000000,%eax movl %eax,%cr0 /* set paging (PG) bit */ ret /* this also flushes prefetch-queue */ .align 2 .word 0 idt_descr: .word 256*8-1 # idt contains 256 entries .long _idt .align 2 .word 0 gdt_descr: .word 256*8-1 # so does gdt (not that that's any .long _gdt # magic number, but it works for me :^) .align 3 _idt: .fill 256,8,0 # idt is uninitialized _gdt: .quad 0x0000000000000000 /* NULL descriptor */ .quad 0x00c09a0000000fff /* 16Mb */ .quad 0x00c0920000000fff /* 16Mb */ .quad 0x0000000000000000 /* TEMPORARY - don't use */ .fill 252,8,0 /* space for LDT's and TSS's etc */
首先，伪指令指定代码段，以及全局可访问标签
.text
.globl _idt,_gdt,_pg_dir,_tmp_floppy_area
程序入口startup_32。我们知道，在保护模式下，段寄存器的唯一作用是存放段选择子(参考https://www.cnblogs.com/zhenjingcool/p/15929907.html)，在下面这段代码中设置段寄存器ds，es，fs，gs为0x10
_pg_dir: startup_32: movl $0x10,%eax mov %ax,%ds mov %ax,%es mov %ax,%fs mov %ax,%gs lss _stack_start,%esp
下图是段选择子的格式，我们设置其为0x10，也就是0000 0000 0001 0000，TI=0表示该段指向GDT，index=2
index=2，也就是段描述符表GDT中的第2项(从0开始)，我们回过头来查看setup.s中的gdt定义
gdt: .word 0,0,0,0 ! dummy .word 0x07FF ! 8Mb - limit=2047 (2048*4096=8Mb) .word 0x0000 ! base address=0 .word 0x9A00 ! code read/exec .word 0x00C0 ! granularity=4096, 386 .word 0x07FF ! 8Mb - limit=2047 (2048*4096=8Mb) .word 0x0000 ! base address=0 .word 0x9200 ! data read/write .word 0x00C0 ! granularity=4096, 386
其第二项为
.word 0x07FF ! 8Mb - limit=2047 (2048*4096=8Mb) .word 0x0000 ! base address=0 .word 0x9200 ! data read/write .word 0x00C0 ! granularity=4096, 386
我们对照代码段描述符格式，注意，这里0x07FF对应段描述符中的低16位。由此可知，limit=0000 0111 1111 1111，即2^12-1
G被置1，当G置位时，段大小以4096字节为单位计。所以段大小为2^12*4096字节=8MB。
base=0
综上，也就是说，如下代码执行后，段寄存器ds,es,fs,gs段基址为0，段大小为8MB，且这几个段是重合的。
_pg_dir: startup_32: movl $0x10,%eax mov %ax,%ds mov %ax,%es mov %ax,%fs mov %ax,%gs lss _stack_start,%esp
最后一句 lss _stack_start,%esp 表示将_stack_start地址的低16位存入堆栈指针sp中，高16位存入堆栈寄存器ss中。stack_start(不带前面下划线)是在其他文件中定义的标签，后面将介绍。
接下来，重新设置中断描述符表idt和全局描述符表gdt
call setup_idt
我们看一下初始化中断描述符表的代码：
setup_idt: lea ignore_int,%edx //ignore_int地址放入edx中 movl $0x00080000,%eax //0x00080000放入eax中 movw %dx,%ax /* ignore_int低两字节放入eax低两字节 */ movw $0x8E00,%dx /* 0x8E00放入edx低两字节 */ lea _idt,%edi //中断描述符表基地址放入edi中 mov $256,%ecx //计数寄存器ecx存储256，后面会循环256次 rp_sidt: movl %eax,(%edi) //eax放入中断描述符表_idt中 movl %edx,4(%edi) //edx放入中断描述符表_idt偏移量4字节处 addl $8,%edi dec %ecx jne rp_sidt lidt idt_descr ret
我们定义了中断描述符表 _idt: .fill 256,8,0 表示该描述符表可容纳256个中断描述符，每个中断描述符占8字节
下面这两行
movl %eax,(%edi) //eax放入中断描述符表_idt中
movl %edx,4(%edi) //edx放入中断描述符表_idt偏移量4字节处
作用是在中断描述符表_idt中创建一个中断描述符(一个中断描述符占8个字节)。
下图展示了由代码生成的edx和eax和中断门描述符的对应关系。我们会循环256次，把edx和eax放入_idt中。
程序执行完毕，我们将获得一个_idt，里面有256个中断描述符，这些中断描述符都有相同的结构，段选择子都是0x0008，偏移量都指向ignore_int。我们初始化的这些中断描述符都有相同的功能，当一个中断发生时，都使用ignore_int中断处理程序处理
循环256次结束，执行 lidt idt_descr 加载中断描述符表到idtr寄存器中。
上图中段选择符是0x0008，也就是0000 0000 0000 1000。中断门描述符中的16-31表示一个段选择符，指向GDT中的指定项。这里的段选择符指向gdt的第二项，由下面对setup_gdt的代码讲解我们可以知道，第二项是指向代码段。
我们再看一下ignore_int，这个是默认的中断处理程序，在这个程序中，我们先把ax，cx，dx，ds，es等压入堆栈，然后打印一条信息“Unknown Interrupt”。
/* This is the default interrupt "handler" :-) */ int_msg: .asciz "Unknown interrupt\n\r" .align 2 ignore_int: pushl %eax pushl %ecx pushl %edx push %ds push %es push %fs movl $0x10,%eax mov %ax,%ds mov %ax,%es mov %ax,%fs pushl $int_msg call _printk popl %eax pop %fs pop %es pop %ds popl %edx popl %ecx popl %eax iret
我么再看一下call setup_gdt
setup_gdt: lgdt gdt_descr ret
.align 2 .word 0 gdt_descr: .word 256*8-1 # so does gdt (not that that's any .long _gdt # magic number, but it works for me :^)
_gdt: .quad 0x0000000000000000 /* NULL descriptor */ .quad 0x00c09a0000000fff /* 16Mb */ .quad 0x00c0920000000fff /* 16Mb */ .quad 0x0000000000000000 /* TEMPORARY - don't use */ .fill 252,8,0 /* space for LDT's and TSS's etc */
在_gdt中我们预设了4个全局描述符，第一个是NULL无用，第二个是代码段描述符，第三个是数据段描述符，第四个是临时无用，然后我们预留了252个8字节空间供以后使用。
接着我们回到startup_32，继续往下走
1: incl %eax # check that A20 really IS enabled movl %eax,0x000000 # loop forever if it isn't cmpl %eax,0x100000 je 1b
这一段代码作用是，检测A20地址线是否真的开启，如果未开启则执行 je 1b 意思是跳转到标号1处，b表示向后执行，f表示向前执行，这里是从标号1处向后执行，也就是进入死循环。如果开启了则继续往下执行。
接着往下看
movl %cr0,%eax # check math chip andl $0x80000011,%eax # Save PG,PE,ET /* "orl $0x10020,%eax" here for 486 might be good */ orl $2,%eax # set MP movl %eax,%cr0 call check_x87 jmp after_page_tables
CR0寄存器结构图
这一句 andl $0x80000011,%eax
0x80000011=1000 0000 0000 0000 0000 0000 0001 0001，对照cr0寄存器各位功能可知，这一句作用是保存cr0的PG,PE,ET位到eax中。
orl $2,%eax # set MP 这里把eax的第2位置1，对应cr0寄存器的MP位。
movl %eax,%cr0 重新设置cr0.此时的cr0的mp位置1了。
call check_x87 这里是检查适配80x87类型，这里不做解释
下面我们看一下 jmp after_page_tables
after_page_tables: pushl $0 # These are the parameters to main :-)这4个值是main函数的参数，其中L6是main函数返回地址 pushl $0 pushl $0 pushl $L6 # return address for main, if it decides to. L6是main函数的返回地址。正常情况下main函数是不会返回的，也就是这里理论上不会执行。 pushl $_main jmp setup_paging
这里把_main入口地址压入堆栈，是c程序的入口。这样当执行完 jmp setup_paging ，_main出栈，开始执行c程序。这里是模拟了一个函数调用栈，以此来调用c程序。
我们来看一下 jmp setup_paging ，这段代码比较难懂，暂时还不清楚，后面书写的理解可能有偏差，后续改正。
.align 2 setup_paging: movl $1024*5,%ecx /* 5 pages - pg_dir+4 page tables */ xorl %eax,%eax xorl %edi,%edi /* pg_dir is at 0x000 */ cld;rep;stosl movl $pg0+7,_pg_dir /* set present bit/user r/w */ movl $pg1+7,_pg_dir+4 /* --------- " " --------- */ movl $pg2+7,_pg_dir+8 /* --------- " " --------- */ movl $pg3+7,_pg_dir+12 /* --------- " " --------- */ movl $pg3+4092,%edi movl $0xfff007,%eax /* 16Mb - 4096 + 7 (r/w user,p) */ std 1: stosl /* fill pages backwards - more efficient :-) */ subl $0x1000,%eax jge 1b xorl %eax,%eax /* pg_dir is at 0x0000 */ movl %eax,%cr3 /* cr3 - page directory start */ movl %cr0,%eax orl $0x80000000,%eax movl %eax,%cr0 /* set paging (PG) bit */ ret /* this also flushes prefetch-queue */
在head.s最开始，我们定义了页目录_pg_dir,也就是页目录基址为0
.text .globl _idt,_gdt,_pg_dir,_tmp_floppy_area _pg_dir: startup_32:
然后，我们还定义了4个页表，基址分别为0x1000,0x2000,0x3000,0x4000
.org 0x1000 //.org指令用于指定下面程序或数据的起始地址 pg0: .org 0x2000 pg1: .org 0x3000 pg2: .org 0x4000 pg3: .org 0x5000
我么再回过头来看
.align 2 setup_paging: movl $1024*5,%ecx /* 5 pages - pg_dir+4 page tables */ xorl %eax,%eax xorl %edi,%edi /* pg_dir is at 0x000 */ cld;rep;stosl //cld和std用于设置EFLAG寄存器的DF标志位，DF置位表示esi和edi递减,DF清零表示esi和edi递增。rep表示后面一条指令重复执行,一直到cx=0；stosl指令表示edi每次增加4。这样就实现了从0开始前5个页表项清零。
我们把1024*5放入ecx中，也就是1个页目录和4个页表大小。每个页目录或页表为2^10字节， cld;rep;stosl 这个代码作用是清空从0开始的前面5*1024字节空间。
下面的代码把页表地址放入页目录中。每一项占4个字节。
movl $pg0+7,_pg_dir /* set present bit/user r/w */ //pg_dir指向内存地址0x0处，这里放置页目录项到0x0处 movl $pg1+7,_pg_dir+4 /* --------- " " --------- */ //放置第一个页表项到0x4处 movl $pg2+7,_pg_dir+8 /* --------- " " --------- */ //放置第二个页表项到0x8处 movl $pg3+7,_pg_dir+12 /* --------- " " --------- */ //放置第三个页表项到0x12处 movl $pg3+4092,%edi movl $0xfff007,%eax /* 16Mb - 4096 + 7 (r/w user,p) */ std
movl $pg3+4092,%edi pg3页表的最后一个页表项地址放入edi中。(一个页表有1024个页表项，每个页表项4字节，所以一个页表大小为4KB)
注： movl $pg0+7,_pg_dir 为什么加7，参考https://www.cnblogs.com/zhenjingcool/p/15929907.html4.2小节关于页目录项和页表项结构的说明，这里7=111b，即设置P位、R/W位、U/S位。
下图展示了页目录表和页表位置关系
movl $0xfff007,%eax 表示最大内存地址16M最后4KB的地址赋给eax。
下面的代码还未理解，暂时先写到这里。。。。
