Tek-life

配置wsgi运行环境

tek-life — Wed, 23 Nov 2011 07:32:21 +0000

我想用python写web.
之前最拿手的应该是用asp写，后来，学了php。总感觉，用这些脚本写网站，不太geek。所以，就摸索着用python写。

昨天，申请了支持python的SAE，其安装手册上的例子是用wsgi跑一个helloworld. 我对这些东西还不懂，纯菜鸟。SAE用的版本系统是svn，蛋疼的很。每次svn ci的时候，总感觉很不习惯，不如git那样舒服。

so.想在local上学习python web开发。python写web方式有很多，因为SAE上支持WSGI，所以，就先玩玩WSGI吧。可是在配置WSGI方面，网上有很多垃圾文章，明明很简单的东西，非要再加个Django，而我只是想运行个hello world而已，用不上这么厚重的东西。

下面是配置总结，整个过程比较简单：

依次安装apache2和libapache2-mod-wsgi后，我还安装了libapache2-mod-wsgi-py3.

然后，在/etc/apache2/mods-enabled/下面应该能够看到俩个文件：
wsgi.conf wsgi.load

然后在/etc/apache2/apache2.conf结尾加上：

231 
232     order deny,allow
233     Allow from all
234 
235 WSGIScriptAlias / /var/www/index.wsgi

于是，就OK了。这个时候，怎么测试是OK的呢？我们先重启apache2，然后写个简单的hello world程序。
重启apache2:

	$sudo /etc/init.d/apache2 restart

Hello world程序：在/var/www/下

$touch index.wsgi
$vim index.wsgi

def application(environ, start_response):
    start_response('200 OK', [('Content-Type', 'text/plain')])
    yield 'Hello World\n'

ps:该helloworld测试程序来自：http://en.wikipedia.org/wiki/Web_Server_Gateway_Interface
然后在浏览器中http://127.0.0.1就可以看到Hello world了。

SD卡读写操作浅析

tek-life — Sat, 08 Oct 2011 03:22:52 +0000

一个读写请求何时被读写，怎样读写，全看请求队列。以Goldfish平台上的MMC卡，我们来看看其请求队列都怎样设置的：

mmc_blk_probe()

597 struct mmc_blk_data *md;

598 int err;

599

600 char cap_str[10];

601

602 /*

603 * Check that the card supports the command class(es) we need.

604 */

605 if (!(card->csd.cmdclass & CCC_BLOCK_READ))

606 return -ENODEV;

607

608 md = mmc_blk_alloc(card);

mmc_blk_probe->mmc_blk_alloc()

510 struct mmc_blk_data *md;

511 int devidx, ret;

512

513 devidx = find_first_zero_bit(dev_use, MMC_NUM_MINORS);//在dev_use中查找一个没有被用到的

514 if (devidx >= MMC_NUM_MINORS)

515 return ERR_PTR(-ENOSPC);

516 __set_bit(devidx, dev_use);

517

518 md = kzalloc(sizeof(struct mmc_blk_data), GFP_KERNEL);

519 if (!md) {

520 ret = -ENOMEM;

521 goto out;

522 }

523

524

525 /*

526 * Set the read-only status based on the supported commands

527 * and the write protect switch.

528 */

529 md->read_only = mmc_blk_readonly(card);

530

531 md->disk = alloc_disk(1 << MMC_SHIFT);//这个结构非常非常重要

532 if (md->disk == NULL) {

533 ret = -ENOMEM;

534 goto err_kfree;

535 }

536

537 spin_lock_init(&md->lock);

538 md->usage = 1;//每get一次，会++

539

540 ret = mmc_init_queue(&md->queue, card, &md->lock);

541 if (ret)

542 goto err_putdisk;

543

544 md->queue.issue_fn = mmc_blk_issue_rq;

545 md->queue.data = md;

546

547 md->disk->major = MMC_BLOCK_MAJOR;//发送的request将根据它来寻找disk，然后挂载在disk->queue上

548 md->disk->first_minor = devidx << MMC_SHIFT;

549 md->disk->fops = &mmc_bdops;

550 md->disk->private_data = md;

551 md->disk->queue = md->queue.queue;//哦，原来如此哇~

552 md->disk->driverfs_dev = &card->dev;

第531行通过alloc_disk分配一个disk，这个结构就是通用块设备结构。所有的request，将查询其/dev/目录下的对应设备，通过major和minor找到对应的disk，然后挂载在disk->queue上。这个request被执行的时机，全部由这个请求队列决定。哪些方面呢？我们接着看，等所有流程跟踪结束后，会做一个总结。

mmc_blk_probe->mmc_blk_alloc()->mmc_init_queue()

125 mq->card = card;

126 mq->queue = blk_init_queue(mmc_request, lock);

127 if (!mq->queue)

128 return -ENOMEM;

129

130 mq->queue->queuedata = mq;

131 mq->req = NULL;

132

133 blk_queue_prep_rq(mq->queue, mmc_prep_request);

134 blk_queue_ordered(mq->queue, QUEUE_ORDERED_DRAIN, NULL);

135 queue_flag_set_unlocked(QUEUE_FLAG_NONROT, mq->queue);

这个mmc_init_queue，由调用通用的blk_init_queue创建一个请求队列,在mmc_init_queue中，单独设定了其特定的参数。

其特定的参数由：

queue->request_fn=mmc_request

queue->prep_rq_fn=mmc_prep_request

queue->odered=QUEUE_ORDERED_DRAIN

queue->next_ordered=QUEUE_ORDERED_DRAIN

queue->prepare_flush_fn=NULL

除了这些特定的参数外，还有一些参数是通用的，也是必不可少的。继续往下看：

mmc_blk_probe->mmc_blk_alloc()->mmc_init_queue()->blk_init_queue

540 /**

541 * blk_init_queue - prepare a request queue for use with a block device

542 * @rfn: The function to be called to process requests that have been

543 * placed on the queue.

544 * @lock: Request queue spin lock

545 *

546 * Description:

547 * If a block device wishes to use the standard request handling procedures,

548 * which sorts requests and coalesces adjacent requests, then it must

549 * call blk_init_queue(). The function @rfn will be called when there

550 * are requests on the queue that need to be processed. If the device

551 * supports plugging, then @rfn may not be called immediately when requests

552 * are available on the queue, but may be called at some time later instead.

553 * Plugged queues are generally unplugged when a buffer belonging to one

554 * of the requests on the queue is needed, or due to memory pressure.

555 *

556 * @rfn is not required, or even expected, to remove all requests off the

557 * queue, but only as many as it can handle at a time. If it does leave

558 * requests on the queue, it is responsible for arranging that the requests

559 * get dealt with eventually.

560 *

561 * The queue spin lock must be held while manipulating the requests on the

562 * request queue; this lock will be taken also from interrupt context, so irq

563 * disabling is needed for it.

564 *

565 * Function returns a pointer to the initialized request queue, or %NULL if

566 * it didn't succeed.

567 *

568 * Note:

569 * blk_init_queue() must be paired with a blk_cleanup_queue() call

570 * when the block device is deactivated (such as at module unload).

571 **/

572

573 struct request_queue *blk_init_queue(request_fn_proc *rfn, spinlock_t *lock)

574 {

575 return blk_init_queue_node(rfn, lock, -1);

576 }

mmc_blk_probe->mmc_blk_alloc()->mmc_init_queue()->blk_init_queue->blk_init_queue_node

579 struct request_queue *

580 blk_init_queue_node(request_fn_proc *rfn, spinlock_t *lock, int node_id)

581 {

582 struct request_queue *q = blk_alloc_queue_node(GFP_KERNEL, node_id);

583

584 if (!q)

585 return NULL;

586

587 q->node = node_id;

588 if (blk_init_free_list(q)) {

589 kmem_cache_free(blk_requestq_cachep, q);

590 return NULL;

591 }

592

593 /*

594 * if caller didn't supply a lock, they get per-queue locking with

595 * our embedded lock

596 */

597 if (!lock)

598 lock = &q->__queue_lock;

599

600 q->request_fn = rfn;

601 q->prep_rq_fn = NULL;

602 q->unplug_fn = generic_unplug_device;

603 q->queue_flags = QUEUE_FLAG_DEFAULT;

604 q->queue_lock = lock;

605

606 blk_queue_segment_boundary(q, BLK_SEG_BOUNDARY_MASK);

607

608 blk_queue_make_request(q, __make_request);

609 blk_queue_max_segment_size(q, MAX_SEGMENT_SIZE);

610

611 blk_queue_max_hw_segments(q, MAX_HW_SEGMENTS);

612 blk_queue_max_phys_segments(q, MAX_PHYS_SEGMENTS);

613

614 q->sg_reserved_size = INT_MAX;

615

616 blk_set_cmd_filter_defaults(&q->cmd_filter);

617

618 /*

619 * all done

620 */

621 if (!elevator_init(q, NULL)) {

622 blk_queue_congestion_threshold(q);

623 return q;

624 }

在这里，又定义了几个通用的参数:

queue->unplug_fn=generic_unplug_device

queue->make_request_fn=__make_request,这个函数太通用了

queue->seg_boundary_mask,这个是合并的规则，默认是0xFFFFFFFF

queue->max_segment_size,最大的segment是2^16B(64KB)

queue->max_hw_segments，最多的segment数目(128)

queue->max_phys_segments，最多物理段数目(128)

第608行，通过调用blk_queue_make_request，设置了一个关键的数据结构，queue->unplug_timer，它决定了request执行的时机。

第616行，设置一些标志位，这些标志位起到filter的作用。在request的执行中起作用。

621行设置了I/O调度算法，默认采用“anticipatory”,不过将之改为none也可以。各个块设备的request与电梯调度中的queue是什么关系呢？

mmc_blk_probe->mmc_blk_alloc()->mmc_init_queue()->blk_init_queue->blk_init_queue_node->blk_queue_make_request

98 /**

99 * blk_queue_make_request – define an alternate make_request function for a device

100 * @q: the request queue for the device to be affected

101 * @mfn: the alternate make_request function

102 *

103 * Description:

104 * The normal way for &struct bios to be passed to a device

105 * driver is for them to be collected into requests on a request

106 * queue, and then to allow the device driver to select requests

107 * off that queue when it is ready. This works well for many block

108 * devices. However some block devices (typically virtual devices

109 * such as md or lvm) do not benefit from the processing on the

110 * request queue, and are served best by having the requests passed

111 * directly to them. This can be achieved by providing a function

112 * to blk_queue_make_request().

113 *

114 * Caveat:

115 * The driver that does this *must* be able to deal appropriately

116 * with buffers in "highmemory". This can be accomplished by either calling

117 * __bio_kmap_atomic() to get a temporary kernel mapping, or by calling

118 * blk_queue_bounce() to create a buffer in normal memory.

119 **/

120 void blk_queue_make_request(struct request_queue *q, make_request_fn *mfn)

121 {

122 /*

123 * set defaults

124 */

125 q->nr_requests = BLKDEV_MAX_RQ;

126 blk_queue_max_phys_segments(q, MAX_PHYS_SEGMENTS);

127 blk_queue_max_hw_segments(q, MAX_HW_SEGMENTS);

128 blk_queue_segment_boundary(q, BLK_SEG_BOUNDARY_MASK);

129 blk_queue_max_segment_size(q, MAX_SEGMENT_SIZE);

130

131 q->make_request_fn = mfn;

132 q->backing_dev_info.ra_pages =

133 (VM_MAX_READAHEAD * 1024) / PAGE_CACHE_SIZE;

134 q->backing_dev_info.state = 0;

135 q->backing_dev_info.capabilities = BDI_CAP_MAP_COPY;

136 blk_queue_max_sectors(q, SAFE_MAX_SECTORS);

137 blk_queue_hardsect_size(q, 512);

138 blk_queue_dma_alignment(q, 511);

139 blk_queue_congestion_threshold(q);

140 q->nr_batching = BLK_BATCH_REQ;

141

142 q->unplug_thresh = 4; /* hmm */

143 q->unplug_delay = (3 * HZ) / 1000; /* 3 milliseconds */

144 if (q->unplug_delay == 0)

145 q->unplug_delay = 1;

146

147 q->unplug_timer.function = blk_unplug_timeout;

148 q->unplug_timer.data = (unsigned long)q;

149

150 /*

151 * by default assume old behaviour and bounce for any highmem page

152 */

153 blk_queue_bounce_limit(q, BLK_BOUNCE_HIGH);

154 }

每当插入一个request的时候，若请求队列为空，则会 blk_plug_device

__make_request

1248 if (!blk_queue_nonrot(q) && elv_queue_empty(q))

1249 blk_plug_device(q);

1250 add_request(q, req);

__make_request->blk_plug_device

205 /*

206 * "plug" the device if there are no outstanding requests: this will

207 * force the transfer to start only after we have put all the requests

208 * on the list.

209 *

210 * This is called with interrupts off and no requests on the queue and

211 * with the queue lock held.

212 */

213 void blk_plug_device(struct request_queue *q)

214 {

215 WARN_ON(!irqs_disabled());

216

217 /*

218 * don't plug a stopped queue, it must be paired with blk_start_queue()

219 * which will restart the queueing

220 */

221 if (blk_queue_stopped(q))

222 return;

223

224 if (!queue_flag_test_and_set(QUEUE_FLAG_PLUGGED, q)) {

225 mod_timer(&q->unplug_timer, jiffies + q->unplug_delay);

226 trace_block_plug(q);

227 }

228 }

通过225行的mod_timer来插入一个定时器。当定时器到期后，会执行timer.function，即blk_unplug_timeout。

316 void blk_unplug_timeout(unsigned long data)

317 {

318 struct request_queue *q = (struct request_queue *)data;

319

320 trace_block_unplug_timer(q);

321 kblockd_schedule_work(q, &q->unplug_work);

322 }

321行，定时器又调度了q->unplug_work。而q->unplug_work是什么时候定义的呢？

在前面的blk_init_queue_node就定义了的。

mmc_blk_probe->mmc_blk_alloc()->mmc_init_queue()->blk_init_queue->blk_init_queue_node

579 struct request_queue *

580 blk_init_queue_node(request_fn_proc *rfn, spinlock_t *lock, int node_id)

581 {

582 struct request_queue *q = blk_alloc_queue_node(GFP_KERNEL, node_id);

mmc_blk_probe->mmc_blk_alloc()->mmc_init_queue()->blk_init_queue->blk_init_queue_node->blk_alloc_queue_node

508 struct request_queue *blk_alloc_queue_node(gfp_t gfp_mask, int node_id)

509 {

510 struct request_queue *q;

511 int err;

512

513 q = kmem_cache_alloc_node(blk_requestq_cachep,

514 gfp_mask | __GFP_ZERO, node_id);

515 if (!q)

516 return NULL;

517

518 q->backing_dev_info.unplug_io_fn = blk_backing_dev_unplug;

519 q->backing_dev_info.unplug_io_data = q;

520 err = bdi_init(&q->backing_dev_info);

521 if (err) {

522 kmem_cache_free(blk_requestq_cachep, q);

523 return NULL;

524 }

525

526 init_timer(&q->unplug_timer);

527 setup_timer(&q->timeout, blk_rq_timed_out_timer, (unsigned long) q);

528 INIT_LIST_HEAD(&q->timeout_list);

529 INIT_WORK(&q->unplug_work, blk_unplug_work);

530

531 kobject_init(&q->kobj, &blk_queue_ktype);

532

533 mutex_init(&q->sysfs_lock);

534 spin_lock_init(&q->__queue_lock);

535

536 return q;

537 }

在529行，定义了queue->unplug_work。(在第527行，竟然还有一个timer，这个q->timeout的timer什么时候用呢？)

queue->unplug_work的function是blk_unplug_work

blk_unplug_timeout->blk_unplug_work

307 void blk_unplug_work(struct work_struct *work)

308 {

309 struct request_queue *q =

310 container_of(work, struct request_queue, unplug_work);

311

312 trace_block_unplug_io(q);

313 q->unplug_fn(q);

314 }

第313行又调用了q->unplug_fn,即generic_unplug_device（在blk_init_queue_node中定义了）。

blk_unplug_timeout->blk_unplug_work->generic_unplug_device

278 /**

279 * generic_unplug_device – fire a request queue

280 * @q: The &struct request_queue in question

281 *

282 * Description:

283 * Linux uses plugging to build bigger requests queues before letting

284 * the device have at them. If a queue is plugged, the I/O scheduler

285 * is still adding and merging requests on the queue. Once the queue

286 * gets unplugged, the request_fn defined for the queue is invoked and

287 * transfers started.

288 **/

289 void generic_unplug_device(struct request_queue *q)

290 {

291 if (blk_queue_plugged(q)) {

292 spin_lock_irq(q->queue_lock);

293 __generic_unplug_device(q);

294 spin_unlock_irq(q->queue_lock);

295 }

296 }

blk_unplug_timeout->blk_unplug_work->generic_unplug_device->__generic_unplug_device

268 void __generic_unplug_device(struct request_queue *q)

269 {

270 if (unlikely(blk_queue_stopped(q)))

271 return;

272 if (!blk_remove_plug(q) && !blk_queue_nonrot(q))

273 return;

274

275 q->request_fn(q);

276 }

275行的request_fn对于mmc是mmc_request

blk_unplug_timeout->blk_unplug_work->generic_unplug_device->__generic_unplug_device->mmc_request

81 /*

82 * Generic MMC request handler. This is called for any queue on a

83 * particular host. When the host is not busy, we look for a request

84 * on any queue on this host, and attempt to issue it. This may

85 * not be the queue we were asked to process.

86 */

87 static void mmc_request(struct request_queue *q)

88 {

89 struct mmc_queue *mq = q->queuedata;

90 struct request *req;

91 int ret;

93 if (!mq) {

94 printk(KERN_ERR "MMC: killing requests for dead queue\n");

95 while ((req = elv_next_request(q)) != NULL) {

96 do {

97 ret = __blk_end_request(req, -EIO,

98 blk_rq_cur_bytes(req));

99 } while (ret);

100 }

101 return;

102 }

103

104 if (!mq->req)

105 wake_up_process(mq->thread);//用线程来写

106 }

在105行,mmc又唤醒了mq->thread.即

mmc_init_queue

202 init_MUTEX(&mq->thread_sem);

203

204 mq->thread = kthread_run(mmc_queue_thread, mq, "mmcqd");

205 if (IS_ERR(mq->thread)) {

206 ret = PTR_ERR(mq->thread);

207 goto free_bounce_sg;

208 }

blk_unplug_timeout->blk_unplug_work->generic_unplug_device->__generic_unplug_device->mmc_request->mmc_queue_thread

44 static int mmc_queue_thread(void *d)

45 {

46 struct mmc_queue *mq = d;

47 struct request_queue *q = mq->queue;

49 current->flags |= PF_MEMALLOC;

51 down(&mq->thread_sem);

52 do {

53 struct request *req = NULL;

55 spin_lock_irq(q->queue_lock);

56 set_current_state(TASK_INTERRUPTIBLE);

57 if (!blk_queue_plugged(q))

58 req = elv_next_request(q);

59 mq->req = req;

60 spin_unlock_irq(q->queue_lock);

62 if (!req) {

63 if (kthread_should_stop()) {

64 set_current_state(TASK_RUNNING);

65 break;

66 }

67 up(&mq->thread_sem);

68 schedule();

69 down(&mq->thread_sem);

70 continue;

71 }

72 set_current_state(TASK_RUNNING);

74 mq->issue_fn(mq, req);

75 } while (1);

76 up(&mq->thread_sem);

78 return 0;

79 }

而，该线程所做的事情是，从请求队列上取下一个request，然后用mq->issue_fn去执行。mq->issue_fn是在mmc_blk_probe->mmc_blk_alloc中定义的：mmc_blk_issue_rq

mmc_queue_thread->mmc_blk_issue_rq:

264 static int mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req)

265 {

266 struct mmc_blk_data *md = mq->data;

267 struct mmc_card *card = md->queue.card;

268 struct mmc_blk_request brq;

269 int ret = 1, disable_multi = 0;

270

271 #ifdef CONFIG_MMC_BLOCK_DEFERRED_RESUME

272 if (mmc_bus_needs_resume(card->host)) {

273 mmc_resume_bus(card->host);

274 mmc_blk_set_blksize(md, card);

275 }

276 #endif

277

278 mmc_claim_host(card->host);

279

280 do {

281 struct mmc_command cmd;

282 u32 readcmd, writecmd, status = 0;

283

284 memset(&brq, 0, sizeof(struct mmc_blk_request));

285 brq.mrq.cmd = &brq.cmd;

286 brq.mrq.data = &brq.data;

287

288 brq.cmd.arg = req->sector;

289 if (!mmc_card_blockaddr(card))

290 brq.cmd.arg <<= 9;

291 brq.cmd.flags = MMC_RSP_SPI_R1 | MMC_RSP_R1 | MMC_CMD_ADTC;

292 brq.data.blksz = 512;

293 brq.stop.opcode = MMC_STOP_TRANSMISSION;

294 brq.stop.arg = 0;

295 brq.stop.flags = MMC_RSP_SPI_R1B | MMC_RSP_R1B | MMC_CMD_AC;

296 brq.data.blocks = req->nr_sectors;

297

298 /*

299 * The block layer doesn't support all sector count

300 * restrictions, so we need to be prepared for too big

301 * requests.

302 */

303 if (brq.data.blocks > card->host->max_blk_count)

304 brq.data.blocks = card->host->max_blk_count;

305

306 /*

307 * After a read error, we redo the request one sector at a time

308 * in order to accurately determine which sectors can be read

309 * successfully.

310 */

311 if (disable_multi && brq.data.blocks > 1)

312 brq.data.blocks = 1;

313

314 if (brq.data.blocks > 1) {

315 /* SPI multiblock writes terminate using a special

316 * token, not a STOP_TRANSMISSION request.

317 */

318 if (!mmc_host_is_spi(card->host)

319 || rq_data_dir(req) == READ)

320 brq.mrq.stop = &brq.stop;

321 readcmd = MMC_READ_MULTIPLE_BLOCK;

322 writecmd = MMC_WRITE_MULTIPLE_BLOCK;

323 } else {

324 brq.mrq.stop = NULL;

325 readcmd = MMC_READ_SINGLE_BLOCK;

326 writecmd = MMC_WRITE_BLOCK;

327 }

328

329 if (rq_data_dir(req) == READ) {

330 brq.cmd.opcode = readcmd;

331 brq.data.flags |= MMC_DATA_READ;

332 } else {

333 brq.cmd.opcode = writecmd;

334 brq.data.flags |= MMC_DATA_WRITE;

335 }

336

337 mmc_set_data_timeout(&brq.data, card);

338

339 brq.data.sg = mq->sg;

340 brq.data.sg_len = mmc_queue_map_sg(mq);

341

342 /*

343 * Adjust the sg list so it is the same size as the

344 * request.

345 */

346 if (brq.data.blocks != req->nr_sectors) {

347 int i, data_size = brq.data.blocks << 9;

348 struct scatterlist *sg;

349

350 for_each_sg(brq.data.sg, sg, brq.data.sg_len, i) {

351 data_size -= sg->length;

352 if (data_size <= 0) {

353 sg->length += data_size;

354 i++;

355 break;

356 }

357 }

358 brq.data.sg_len = i;

359 }

360

361 mmc_queue_bounce_pre(mq);

362

363 mmc_wait_for_req(card->host, &brq.mrq);

364

365 mmc_queue_bounce_post(mq);

366

367 /*

368 * Check for errors here, but don't jump to cmd_err

369 * until later as we need to wait for the card to leave

370 * programming mode even when things go wrong.

371 */

372 if (brq.cmd.error || brq.data.error || brq.stop.error) {

373 if (brq.data.blocks > 1 && rq_data_dir(req) == READ) {

374 /* Redo read one sector at a time */

375 printk(KERN_WARNING "%s: retrying using single "

376 "block read\n", req->rq_disk->disk_name);

377 disable_multi = 1;

378 continue;

379 }

380 status = get_card_status(card, req);

381 } else if (disable_multi == 1) {

382 disable_multi = 0;

383 }

384

385 if (brq.cmd.error) {

386 printk(KERN_ERR "%s: error %d sending read/write "

387 "command, response %#x, card status %#x\n",

388 req->rq_disk->disk_name, brq.cmd.error,

389 brq.cmd.resp[0], status);

390 }

391

392 if (brq.data.error) {

393 if (brq.data.error == -ETIMEDOUT && brq.mrq.stop)

394 /* 'Stop' response contains card status */

395 status = brq.mrq.stop->resp[0];

396 printk(KERN_ERR "%s: error %d transferring data,"

397 " sector %u, nr %u, card status %#x\n",

398 req->rq_disk->disk_name, brq.data.error,

399 (unsigned)req->sector,

400 (unsigned)req->nr_sectors, status);

401 }

402

403 if (brq.stop.error) {

404 printk(KERN_ERR "%s: error %d sending stop command, "

405 "response %#x, card status %#x\n",

406 req->rq_disk->disk_name, brq.stop.error,

407 brq.stop.resp[0], status);

408 }

409

410 if (!mmc_host_is_spi(card->host) && rq_data_dir(req) != READ) {

411 do {

412 int err;

413

414 cmd.opcode = MMC_SEND_STATUS;

415 cmd.arg = card->rca << 16;

416 cmd.flags = MMC_RSP_R1 | MMC_CMD_AC;

417 err = mmc_wait_for_cmd(card->host, &cmd, 5);

418 if (err) {

419 printk(KERN_ERR "%s: error %d requesting status\n",

420 req->rq_disk->disk_name, err);

421 goto cmd_err;

422 }

423 /*

424 * Some cards mishandle the status bits,

425 * so make sure to check both the busy

426 * indication and the card state.

427 */

428 } while (!(cmd.resp[0] & R1_READY_FOR_DATA) ||

429 (R1_CURRENT_STATE(cmd.resp[0]) == 7));

430

431 #if 0

432 if (cmd.resp[0] & ~0×00000900)

433 printk(KERN_ERR "%s: status = %08x\n",

434 req->rq_disk->disk_name, cmd.resp[0]);

435 if (mmc_decode_status(cmd.resp))

436 goto cmd_err;

437 #endif

438 }

439

440 if (brq.cmd.error || brq.stop.error || brq.data.error) {

441 if (rq_data_dir(req) == READ) {

442 /*

443 * After an error, we redo I/O one sector at a

444 * time, so we only reach here after trying to

445 * read a single sector.

446 */

447 spin_lock_irq(&md->lock);

448 ret = __blk_end_request(req, -EIO, brq.data.blksz);

449 spin_unlock_irq(&md->lock);

450 continue;

451 }

452 goto cmd_err;

453 }

454

455 /*

456 * A block was successfully transferred.

457 */

458 spin_lock_irq(&md->lock);

459 ret = __blk_end_request(req, 0, brq.data.bytes_xfered);

460 spin_unlock_irq(&md->lock);

461 } while (ret);

462

463 mmc_release_host(card->host);

464

465 return 1;

466

467 cmd_err:

468 /*

469 * If this is an SD card and we're writing, we can first

470 * mark the known good sectors as ok.

471 *

472 * If the card is not SD, we can still ok written sectors

473 * as reported by the controller (which might be less than

474 * the real number of written sectors, but never more).

475 */

476 if (mmc_card_sd(card)) {

477 u32 blocks;

478

479 blocks = mmc_sd_num_wr_blocks(card);

480 if (blocks != (u32)-1) {

481 spin_lock_irq(&md->lock);

482 ret = __blk_end_request(req, 0, blocks << 9);

483 spin_unlock_irq(&md->lock);

484 }

485 } else {

486 spin_lock_irq(&md->lock);

487 ret = __blk_end_request(req, 0, brq.data.bytes_xfered);

488 spin_unlock_irq(&md->lock);

489 }

490

491 mmc_release_host(card->host);

492

493 spin_lock_irq(&md->lock);

494 while (ret)

495 ret = __blk_end_request(req, -EIO, blk_rq_cur_bytes(req));

496 spin_unlock_irq(&md->lock);

497

498 return 0;

499 }

500

该函数所做的事情就是将mmc->host锁住，然后让host进行操作。操作最重要的是363行：mmc_wait_for_req(card->host, &brq.mrq)

mmc_queue_thread->mmc_blk_issue_rq->mmc_wait_for_req

186 /**

187 * mmc_wait_for_req – start a request and wait for completion

188 * @host: MMC host to start command

189 * @mrq: MMC request to start

190 *

191 * Start a new MMC custom command request for a host, and wait

192 * for the command to complete. Does not attempt to parse the

193 * response.

194 */

195 void mmc_wait_for_req(struct mmc_host *host, struct mmc_request *mrq)

196 {

197 DECLARE_COMPLETION_ONSTACK(complete);

198

199 mrq->done_data = &complete;

200 mrq->done = mmc_wait_done;

201

202 mmc_start_request(host, mrq);//maybe have a long time.

203

204 wait_for_completion(&complete);//wait until the data completed.the sem also anipulated by interrupt.

205 }

206

207 EXPORT_SYMBOL(mmc_wait_for_req);

mmc_start_request，就开始操作了。什么时候操作结束呢？要看complete了。complete中的done变量，在数据读取结束时，有中断来将其+1。然后本线程检测到后，就可以结束了。

从Nand驱动到文件读写

tek-life — Fri, 07 Oct 2011 07:44:04 +0000

Nand属于块设备。那么nand块设备是否像其他块设备那样，每次读写都经历一个“C/S”的过程呢？
我们在Goldfish Platform上，从nand的驱动注册开始，看看nand之上的yaffs2文件读写到底是怎样的一个过程。

本文主要是对自己在学习过程中遇到疑问做一个记录，同以前的文章一样，基本上只有流程，那些原理之类的东西，请同学们google吧。在下文中，有些代码可能会有重复，主要目的是不想让各位看官看的太累，跳来跳去，眼镜受不了啊。

代码是Android Kernel 2.6.29.整个记录过程比较仓促，难免会由认识上的错误，欢迎大家指正。

下面是Android在Goldfish Platform上的执行流程：
<1>
377 static int __init init_mtdblock(void)
378 {
379 return register_mtd_blktrans(&mtdblock_tr);
380 }
在代码片段<1>中注册了一个struct mtd_blktrans_ops结构的mtdblock_tr,这个模块是系统在启动过程中加载的，从模块的init名字，可以看出，是针对mtd块设备的。由于在Linux中，Nand被归为MTD设备，MTD设备就是将nand设备封装了一下，让上层没有直接看到nand，而是看到的MTD。实际上，通过MTD来操作Nand，还是通过nand内部的驱动函数。不要把MTD看的太过神秘。如果还需要了解，请Google吧，我之前就是太较真了，一直没有弄明白，read the fucking code之后才算明白过来了。

这个mtd_blktrans_ops结构如下：
<2>
32 struct mtd_blktrans_ops {
33     char *name;
34     int major;
35     int part_bits;
36     int blksize;
37     int blkshift;
38
39     /* Access functions */
40     int (*readsect)(struct mtd_blktrans_dev *dev,
41             unsigned long block, char *buffer);
42     int (*writesect)(struct mtd_blktrans_dev *dev,
43              unsigned long block, char *buffer);
44     int (*discard)(struct mtd_blktrans_dev *dev,
45                unsigned long block, unsigned nr_blocks);
46
47     /* Block layer ioctls */
48     int (*getgeo)(struct mtd_blktrans_dev *dev, struct hd_geometry *geo);
49     int (*flush)(struct mtd_blktrans_dev *dev);
50
51     /* Called with mtd_table_mutex held; no race with add/remove */
52     int (*open)(struct mtd_blktrans_dev *dev);
53     int (*release)(struct mtd_blktrans_dev *dev);
54
55     /* Called on {de,}registration and on subsequent addition/removal
56        of devices, with mtd_table_mutex held. */
57     void (*add_mtd)(struct mtd_blktrans_ops *tr, struct mtd_info *mtd);
58     void (*remove_dev)(struct mtd_blktrans_dev *dev);
59
60     struct list_head devs;
61     struct list_head list;
62     struct module *owner;
63
64     struct mtd_blkcore_priv *blkcore_priv;
65 };
其中第64行的 struct mtd_blkcore_priv，它包含了一个读写请求队列。所有的mtd设备的读写请求共用了一个请求队列。
init_mtdblock->register_mtd_blktrans
340 int register_mtd_blktrans(struct mtd_blktrans_ops *tr)
341 {
342     int ret, i;
343
344     /* Register the notifier if/when the first device type is
345        registered, to prevent the link/init ordering from fucking
346        us over. */
347     if (!blktrans_notifier.list.next)
348         register_mtd_user(&blktrans_notifier);
349
350     tr->blkcore_priv = kzalloc(sizeof(*tr->blkcore_priv), GFP_KERNEL);//几乎算是一个队列了
351     if (!tr->blkcore_priv)
352         return -ENOMEM;
353
354     mutex_lock(&mtd_table_mutex);
355
356     ret = register_blkdev(tr->major, tr->name);//"mtdblk"注册一个通用块设备
357     if (ret) {
358         printk(KERN_WARNING "Unable to register %s block device on major %d: %d\n",
359                tr->name, tr->major, ret);
360         kfree(tr->blkcore_priv);
361         mutex_unlock(&mtd_table_mutex);
362         return ret;
363     }
364     spin_lock_init(&tr->blkcore_priv->queue_lock);
365
366     tr->blkcore_priv->rq = blk_init_queue(mtd_blktrans_request, &tr->blkcore_priv->queue_lock);
367     if (!tr->blkcore_priv->rq) {
368         unregister_blkdev(tr->major, tr->name);
369         kfree(tr->blkcore_priv);
370         mutex_unlock(&mtd_table_mutex);
371         return -ENOMEM;
372     }
373
374     tr->blkcore_priv->rq->queuedata = tr;
375     blk_queue_hardsect_size(tr->blkcore_priv->rq, tr->blksize);
376     if (tr->discard)
377         blk_queue_set_discard(tr->blkcore_priv->rq,
378                       blktrans_discard_request);
379
380     tr->blkshift = ffs(tr->blksize) – 1;
381
382     tr->blkcore_priv->thread = kthread_run(mtd_blktrans_thread, tr,
383             "%sd", tr->name);
384     if (IS_ERR(tr->blkcore_priv->thread)) {
385         blk_cleanup_queue(tr->blkcore_priv->rq);
386         unregister_blkdev(tr->major, tr->name);
387         kfree(tr->blkcore_priv);
388         mutex_unlock(&mtd_table_mutex);
389         return PTR_ERR(tr->blkcore_priv->thread);
390     }
391
392     INIT_LIST_HEAD(&tr->devs);
393     list_add(&tr->list, &blktrans_majors);
394
395     for (i=0; i 396         if (mtd_table[i] && mtd_table[i]->type != MTD_ABSENT)
397             tr->add_mtd(tr, mtd_table[i]);//对于每一个mtd设备，都alloc_disk
398     }
399
400     mutex_unlock(&mtd_table_mutex);
401
402     return 0;
403 }
356行，比较重要在/dev/目录下，将多一个mtdblk节点。为啥叫mtdblk呢，第二个参数决定的。^_^
366行，正如上述所言，声明了一个读写请求队列。
382行，声明了一个内核线程。当每一次请求发送的时候，会让这个线程run一次。(引入一个问题：线程自动终结后，如何释放所拥有的资源？)
在第395~398行，其实所有的nand并没有在这里添加，貌似是因为这个时候goldfish_nand设备驱动还没有被加进来出来。所以register_mtd_blktrans的工作至此已经结束了。它的贡献，仅仅是注册了一个mtd_blktrans_ops。
当执行到module_init(goldfish_nand_init)的时候，才开始添加mtd设备。
405 static int __init goldfish_nand_init(void)
406 {
407     return platform_driver_register(&goldfish_nand_driver);
408 }
在这之后，会遍历bus上的所有设备，直到和goldfish_nand相匹配。有同学可能会有疑问，为啥在设备注册的时候不主动去匹配驱动呢？确实，设备会主动去匹配驱动，但是当前驱动的代码还没有被加载进来的时候，去神马地方找驱动捏？
58 static void goldfish_pdev_worker(struct work_struct *work)
59 {
60     int ret;
61     struct pdev_bus_dev *pos, *n;
62
63     list_for_each_entry_safe(pos, n, &pdev_bus_removed_devices, list) {
64         list_del(&pos->list);
65         platform_device_unregister(&pos->pdev);
66         kfree(pos);
67     }
68     list_for_each_entry_safe(pos, n, &pdev_bus_new_devices, list) {
69         list_del(&pos->list);
70         ret = platform_device_register(&pos->pdev);
71         if(ret) {
72             printk("goldfish_pdev_worker failed to register device, %s\n", pos->pdev.name);
73         }
74         else {
75             printk("goldfish_pdev_worker registered %s\n", pos->pdev.name);
76         }
77         list_add_tail(&pos->list, &pdev_bus_registered_devices);
78     }
79 }
看第70行，可以看到，确实注册了设备，并且在platform_device_register中，也确实去匹配驱动了，只不过没有找到驱动而饮恨“铩羽而归”。然后，当每一次注册一个驱动的时候，会去找对应的设备。当找到对应的设备后，就会调用对应驱动的probe函数了。对于goldfish_nand_driver，其probe函数是：
goldfish_nand_probe
315 static int goldfish_nand_probe(struct platform_device *pdev)
316 {
317     uint32_t num_dev;
318     int i;
319     int err;
320     uint32_t num_dev_working;
321     uint32_t version;
322     struct resource *r;
323     struct goldfish_nand *nand;
324     unsigned char __iomem *base;
325
326     r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
327     if(r == NULL) {
328         err = -ENODEV;
329         goto err_no_io_base;
330     }
331
332     base = ioremap(r->start, PAGE_SIZE);
333     if(base == NULL) {
334         err = -ENOMEM;
335         goto err_ioremap;
336     }
337     version = readl(base + NAND_VERSION);
338     if(version != NAND_VERSION_CURRENT) {
339         printk("goldfish_nand_init: version mismatch, got %d, expected %d\n",
340                version, NAND_VERSION_CURRENT);
341         err = -ENODEV;
342         goto err_no_dev;
343     }
344     num_dev = readl(base + NAND_NUM_DEV);
345     if(num_dev == 0) {
346         err = -ENODEV;
347         goto err_no_dev;
348     }
349
350     nand = kzalloc(sizeof(*nand) + sizeof(struct mtd_info) * num_dev, GFP_KERNEL);
351     if(nand == NULL) {
352         err = -ENOMEM;
353         goto err_nand_alloc_failed;
354     }
355     spin_lock_init(&nand->lock);
356     nand->base = base;
357     nand->mtd_count = num_dev;
358     platform_set_drvdata(pdev, nand);
359
360     num_dev_working = 0;
361     for(i = 0; i < num_dev; i++) {
362         err = goldfish_nand_init_device(nand, i);
363         if(err == 0)
364             num_dev_working++;
365     }
366     if(num_dev_working == 0) {
367         err = -ENODEV;
368         goto err_no_working_dev;
369     }
370     return 0;
371
372 err_no_working_dev:
373     kfree(nand);
374 err_nand_alloc_failed:
375 err_no_dev:
376     iounmap(base);
377 err_ioremap:
378 err_no_io_base:
379     return err;
380 }
362行，根据枚举出来的nand，调用goldfish_nand_init_device去初始化。
goldfish_nand_probe->goldfish_nand_init_device
248 static int goldfish_nand_init_device(struct goldfish_nand *nand, int id)
249 {
250     uint32_t name_len;
251     uint32_t result;
252     uint32_t flags;
253     unsigned long irq_flags;
254     unsigned char __iomem *base = nand->base;
255     struct mtd_info *mtd = &nand->mtd[id];
256     char *name;
257
258     spin_lock_irqsave(&nand->lock, irq_flags);
259     writel(id, base + NAND_DEV);
260     flags = readl(base + NAND_DEV_FLAGS);
261     name_len = readl(base + NAND_DEV_NAME_LEN);
262     mtd->writesize = readl(base + NAND_DEV_PAGE_SIZE);
263     mtd->size = readl(base + NAND_DEV_SIZE_LOW);
264     mtd->size |= (uint64_t)readl(base + NAND_DEV_SIZE_HIGH) << 32;
265     mtd->oobsize = readl(base + NAND_DEV_EXTRA_SIZE);
266     mtd->oobavail = mtd->oobsize;
267     mtd->erasesize = readl(base + NAND_DEV_ERASE_SIZE) /
268                      (mtd->writesize + mtd->oobsize) * mtd->writesize;
269     do_div(mtd->size, mtd->writesize + mtd->oobsize);
270     mtd->size *= mtd->writesize;
271     printk("goldfish nand dev%d: size %llx, page %d, extra %d, erase %d\n",
272            id, mtd->size, mtd->writesize, mtd->oobsize, mtd->erasesize);
273     spin_unlock_irqrestore(&nand->lock, irq_flags);
274
275     mtd->priv = nand;
276
277     mtd->name = name = kmalloc(name_len + 1, GFP_KERNEL);
278     if(name == NULL)
279         return -ENOMEM;
280
281     result = goldfish_nand_cmd(mtd, NAND_CMD_GET_DEV_NAME, 0, name_len, name);
282     if(result != name_len) {
283         kfree(mtd->name);
284         mtd->name = NULL;
285         printk("goldfish_nand_init_device failed to get dev name %d != %d\n",
286                result, name_len);
287         return -ENODEV;
288     }
289     ((char *) mtd->name)[name_len] = '\0';
290
291     /* Setup the MTD structure */
292     mtd->type = MTD_NANDFLASH;
293     mtd->flags = MTD_CAP_NANDFLASH;
294     if(flags & NAND_DEV_FLAG_READ_ONLY)
295         mtd->flags &= ~MTD_WRITEABLE;
296
297     mtd->owner = THIS_MODULE;
298     mtd->erase = goldfish_nand_erase;
299     mtd->read = goldfish_nand_read;
300     mtd->write = goldfish_nand_write;
301     mtd->read_oob = goldfish_nand_read_oob;
302     mtd->write_oob = goldfish_nand_write_oob;
303     mtd->block_isbad = goldfish_nand_block_isbad;
304     mtd->block_markbad = goldfish_nand_block_markbad;
305
306     if (add_mtd_device(mtd)) {
307         kfree(mtd->name);
308         mtd->name = NULL;
309         return -EIO;
310     }
311
312     return 0;
313 }
306行，调用add_mtd_device
goldfish_nand_probe->goldfish_nand_init_device->add_mtd_device
35 /**
36 * add_mtd_device – register an MTD device
37 * @mtd: pointer to new MTD device info structure
38 *
39 * Add a device to the list of MTD devices present in the system, and
40 * notify each currently active MTD 'user' of its arrival. Returns
41 * zero on success or 1 on failure, which currently will only happen
42 * if the number of present devices exceeds MAX_MTD_DEVICES (i.e. 16)
43 */
44
45 int add_mtd_device(struct mtd_info *mtd)
46 {
47     int i;
48
49     BUG_ON(mtd->writesize == 0);
50     mutex_lock(&mtd_table_mutex);
51
52     for (i=0; i < MAX_MTD_DEVICES; i++)
53         if (!mtd_table[i]) {
54             struct mtd_notifier *not;
55
56             mtd_table[i] = mtd;
57             mtd->index = i;
58             mtd->usecount = 0;
59
60             if (is_power_of_2(mtd->erasesize))
61                 mtd->erasesize_shift = ffs(mtd->erasesize) – 1;
62             else
63                 mtd->erasesize_shift = 0;
64
65             if (is_power_of_2(mtd->writesize))
66                 mtd->writesize_shift = ffs(mtd->writesize) – 1;
67             else
68                 mtd->writesize_shift = 0;
69
70             mtd->erasesize_mask = (1 << mtd->erasesize_shift) – 1;
71             mtd->writesize_mask = (1 << mtd->writesize_shift) – 1;
72
73             /* Some chips always power up locked. Unlock them now */
74             if ((mtd->flags & MTD_WRITEABLE)
75                 && (mtd->flags & MTD_POWERUP_LOCK) && mtd->unlock) {
76                 if (mtd->unlock(mtd, 0, mtd->size))
77                     printk(KERN_WARNING
78                            "%s: unlock failed, "
79                            "writes may not work\n",
80                            mtd->name);
81             }
82
83             DEBUG(0, "mtd: Giving out device %d to %s\n",i, mtd->name);
84             /* No need to get a refcount on the module containing
85                the notifier, since we hold the mtd_table_mutex */
86             list_for_each_entry(not, &mtd_notifiers, list)
87             {
88                 not->add(mtd);
89             }
90
91             mutex_unlock(&mtd_table_mutex);
92             /* We _know_ we aren't being removed, because
93                our caller is still holding us here. So none
94                of this try_ nonsense, and no bitching about it
95                either. */
96             __module_get(THIS_MODULE);
97             return 0;
98         }
99
100     mutex_unlock(&mtd_table_mutex);
101     return 1;
102 }
103
注意第88行，它调用的是：blktrans_notify_add.为啥是这个呢？在初始化的时候，有个模块是init_mtdblock，其调用了register_mtd_blktrans(&mtdblock_tr),结构mtdblock_tr中定义了一些操作mtdblock的一些操作，比如add_mtd。
362 static struct mtd_blktrans_ops mtdblock_tr = {
363     .name       = "mtdblock",
364     .major      = 31,
365     .part_bits = 0,
366     .blksize    = 512,
367     .open       = mtdblock_open,
368     .flush      = mtdblock_flush,
369     .release    = mtdblock_release,
370     .readsect   = mtdblock_readsect,
371     .writesect = mtdblock_writesect,
372     .add_mtd    = mtdblock_add_mtd,
373     .remove_dev = mtdblock_remove_dev,
374     .owner      = THIS_MODULE,
375 };

那么它在初始化的时候，又定义了一个mtd_notifier结构的blktrans_notifier。具体，为什么要搞的这么复杂，Linux主要是为了可扩展性的考虑。
335 static struct mtd_notifier blktrans_notifier = {
336     .add = blktrans_notify_add,
337     .remove = blktrans_notify_remove,
338 };
324 static void blktrans_notify_add(struct mtd_info *mtd)
325 {
326     struct mtd_blktrans_ops *tr;
327
328     if (mtd->type == MTD_ABSENT)
329         return;
330
331     list_for_each_entry(tr, &blktrans_majors, list)
332         tr->add_mtd(tr, mtd);
333 }
回到上文，通过not->add(mtd)添加mtd设备，not->add又调用了tr->add_mtd,这个函数是上面mtdblock_tr定义的mtdblock_add_mtd。
blktrans_notify_add->mtdblock_add_mtd
337 static void mtdblock_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd)
338 {
339     struct mtd_blktrans_dev *dev = kzalloc(sizeof(*dev), GFP_KERNEL);
340
341     if (!dev)
342         return;
343
344     dev->mtd = mtd;
345     dev->devnum = mtd->index;
346
347     dev->size = mtd->size >> 9;
348     dev->tr = tr;
349
350     if (!(mtd->flags & MTD_WRITEABLE))
351         dev->readonly = 1;
352
353     add_mtd_blktrans_dev(dev);
354 }

blktrans_notify_add->mtdblock_add_mtd->add_mtd_blktrans_dev

216 int add_mtd_blktrans_dev(struct mtd_blktrans_dev *new)
217 {
218     struct mtd_blktrans_ops *tr = new->tr;
219     struct mtd_blktrans_dev *d;
220     int last_devnum = -1;
221     struct gendisk *gd;
222
223     if (mutex_trylock(&mtd_table_mutex)) {
224         mutex_unlock(&mtd_table_mutex);
225         BUG();
226     }
227
228     list_for_each_entry(d, &tr->devs, list) {
229         if (new->devnum == -1) {
230             /* Use first free number */
231             if (d->devnum != last_devnum+1) {
232                 /* Found a free devnum. Plug it in here */
233                 new->devnum = last_devnum+1;
234                 list_add_tail(&new->list, &d->list);
235                 goto added;
236             }
237         } else if (d->devnum == new->devnum) {
238             /* Required number taken */
239             return -EBUSY;
240         } else if (d->devnum > new->devnum) {
241             /* Required number was free */
242             list_add_tail(&new->list, &d->list);
243             goto added;
244         }
245         last_devnum = d->devnum;
246     }
247     if (new->devnum == -1)
248         new->devnum = last_devnum+1;
249
250     if ((new->devnum << tr->part_bits) > 256) {
251         return -EBUSY;
252     }
253
254     list_add_tail(&new->list, &tr->devs);
255 added:
256     mutex_init(&new->lock);
257     if (!tr->writesect)
258         new->readonly = 1;
259
260     gd = alloc_disk(1 << tr->part_bits);//哦，在这里分配alloc_disk
261     if (!gd) {
262         list_del(&new->list);
263         return -ENOMEM;
264     }
265     gd->major = tr->major;
266     gd->first_minor = (new->devnum) << tr->part_bits;
267     gd->fops = &mtd_blktrans_ops;
268
269     if (tr->part_bits)
270         if (new->devnum < 26)
271             snprintf(gd->disk_name, sizeof(gd->disk_name),
272                  "%s%c", tr->name, 'a' + new->devnum);
273         else
274             snprintf(gd->disk_name, sizeof(gd->disk_name),
275                  "%s%c%c", tr->name,
276                  'a' – 1 + new->devnum / 26,
277                  'a' + new->devnum % 26);
278     else
279         snprintf(gd->disk_name, sizeof(gd->disk_name),
280              "%s%d", tr->name, new->devnum);
281
282     /* 2.5 has capacity in units of 512 bytes while still
283        having BLOCK_SIZE_BITS set to 10. Just to keep us amused. */
284     set_capacity(gd, (new->size * tr->blksize) >> 9);
285
286     gd->private_data = new;
287     new->blkcore_priv = gd;
288     gd->queue = tr->blkcore_priv->rq;//使用的队列是tr的队列
289
290     if (new->readonly)
291         set_disk_ro(gd, 1);
292
293     add_disk(gd);//加入
294
295     return 0;
296 }
288行，使用了tr的队列，这个tr队列是在register_mtd_blktrans(&mtdblock_tr)初始化时定义的。
340 int register_mtd_blktrans(struct mtd_blktrans_ops *tr)
341 {
342     int ret, i;
343
344     /* Register the notifier if/when the first device type is
345        registered, to prevent the link/init ordering from fucking
346        us over. */
347     if (!blktrans_notifier.list.next)
348         register_mtd_user(&blktrans_notifier);
349
350     tr->blkcore_priv = kzalloc(sizeof(*tr->blkcore_priv), GFP_KERNEL);//几乎算是一个队列了
351     if (!tr->blkcore_priv)
352         return -ENOMEM;
353
354     mutex_lock(&mtd_table_mutex);
355
356     ret = register_blkdev(tr->major, tr->name);//"mtdblk"注册一个通用块设备
357     if (ret) {
358         printk(KERN_WARNING "Unable to register %s block device on major %d: %d\n",
359                tr->name, tr->major, ret);
360         kfree(tr->blkcore_priv);
361         mutex_unlock(&mtd_table_mutex);
362         return ret;
363     }
364     spin_lock_init(&tr->blkcore_priv->queue_lock);
365     tr->blkcore_priv->rq = blk_init_queue(mtd_blktrans_request, &tr->blkcore_priv->queue_lock);

tr队列比较通用，只有request_fn不同。设置的这么简单，让人始料不及啊。不过令人以外的是，mtd的读写并不经过request等策略。它们是通过什么策略呢？
我们直到在Linux中，文件的读写是经过几个层次，最上面是VFS，然后是具体的文件系统。具体的文件系统决定了，是否经过request策略。我们不妨直接去看看Yaffs2的file_operations对象，从那里入手，看看具体是否经过了request吧。
由于在Linux中的VFS是具有页缓存的，而页缓存相关联的数据结构是address_space，其host是inode。所以，对于文件的读写，基本上最终是通过调用address_space的operations结构。
这个是yaffs2的address_operations结构。它们是否最终request，看看其readpage即可
270 static struct address_space_operations yaffs_file_address_operations = {
271     .readpage = yaffs_readpage,
272     .writepage = yaffs_writepage,
273 #if (YAFFS_USE_WRITE_BEGIN_END > 0)
274     .write_begin = yaffs_write_begin,
275     .write_end = yaffs_write_end,
276 #else
277     .prepare_write = yaffs_prepare_write,
278     .commit_write = yaffs_commit_write,
279 #endif
280 };
由于yaffs_read主要涉及yaffs2文件系统内部的流程，因此不再详述。比较有特点的是，对于yaffs2文件系统，它并没有使用传统的页缓存的概念。在yaffs_device数据结构里面有“yaffs_ChunkCache *srCache;”一个成员变量，其数据类型：
111 /* Special sequence number for bad block that failed to be marked bad */
112 #define YAFFS_SEQUENCE_BAD_BLOCK    0xFFFF0000
113
114 /* ChunkCache is used for short read/write operations.*/
115 typedef struct {
116     struct yaffs_ObjectStruct *object;
117     int chunkId;
118     int lastUse;
119     int dirty;
120     int nBytes;     /* Only valid if the cache is dirty */
121     int locked;     /* Can't push out or flush while locked. */
122 #ifdef CONFIG_YAFFS_YAFFS2
123     __u8 *data;
124 #else
125     __u8 data[YAFFS_BYTES_PER_CHUNK];
126 #endif
127 } yaffs_ChunkCache;
每一次，在cache中，查找是否存在对应的cache的时候，它的查找函数是这样的：
4015 /* Find a cached chunk */
4016 static yaffs_ChunkCache *yaffs_FindChunkCache(const yaffs_Object *obj,
4017                           int chunkId)
4018 {
4019     yaffs_Device *dev = obj->myDev;
4020     int i;
4021     if (dev->nShortOpCaches > 0) {
4022         for (i = 0; i < dev->nShortOpCaches; i++) {
4023             if (dev->srCache[i].object == obj &&
4024                 dev->srCache[i].chunkId == chunkId) {
4025                 dev->cacheHits++;
4026
4027                 return &dev->srCache[i];
4028             }
4029         }
4030     }
4031     return NULL;
4032 }
从上面的查找中，可以发现，它并不像ext2那样，用hash或者radix_tree那样将页缓存组织起来。它的组织方式，和nand设备是一样的。哈，这也许是yaffs2移植性强的一个体现吧。它不局限于在Linux中，不局限于是否支持MTD，只要是一个OS，任意类型的，都可以被移植进去。

所以，回归上文，其实之前申请的alloc_disk，request_queue之类的玩意，都是坑爹的啊。所以，对于Nand设备的读写并没有其他块设备那么复杂啊。之前的那个request_fn竟然都木有用上。

SD卡读写流程

tek-life — Thu, 06 Oct 2011 03:46:45 +0000

本流程分析针对2.6.29Kernel on Goldfish Platform.
SD卡的读写操作同其他块设备一样，都是异步的过程。当进程把request发到块设备请求队列后，在真正读写时，mq->thread进程会被激活。这个进程准确说属于内核线程，其函数执行主体如下：
44 static int mmc_queue_thread(void *d)
45 {
46     struct mmc_queue *mq = d;
47     struct request_queue *q = mq->queue;
48
49     current->flags |= PF_MEMALLOC;
50
51     down(&mq->thread_sem);
52     do {
53         struct request *req = NULL;
54
55         spin_lock_irq(q->queue_lock);
56         set_current_state(TASK_INTERRUPTIBLE);
57         if (!blk_queue_plugged(q))
58             req = elv_next_request(q);
59         mq->req = req;
60         spin_unlock_irq(q->queue_lock);
61
62         if (!req) {
63             if (kthread_should_stop()) {
64                 set_current_state(TASK_RUNNING);
65                 break;
66             }
67             up(&mq->thread_sem);
68             schedule();
69             down(&mq->thread_sem);
70             continue;
71         }
72         set_current_state(TASK_RUNNING);
73
74         mq->issue_fn(mq, req);
75     } while (1);
76     up(&mq->thread_sem);
77
78     return 0;
79 }
通过51行和76行，保证只有一个线程操作mq。
接下来，第74行调用mq->issue_fn，即： mmc_blk_issue_rq。
264 static int mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req)
265 {
266     struct mmc_blk_data *md = mq->data;
267     struct mmc_card *card = md->queue.card;
268     struct mmc_blk_request brq;
269     int ret = 1, disable_multi = 0;
270
271 #ifdef CONFIG_MMC_BLOCK_DEFERRED_RESUME
272     if (mmc_bus_needs_resume(card->host)) {
273         mmc_resume_bus(card->host);
274         mmc_blk_set_blksize(md, card);
275     }
276 #endif
277
278     mmc_claim_host(card->host);
279
280     do {
281         struct mmc_command cmd;
282         u32 readcmd, writecmd, status = 0;
283
284         memset(&brq, 0, sizeof(struct mmc_blk_request));
285         brq.mrq.cmd = &brq.cmd;
286         brq.mrq.data = &brq.data;
287
288         brq.cmd.arg = req->sector;
289         if (!mmc_card_blockaddr(card))
290             brq.cmd.arg <<= 9;
291         brq.cmd.flags = MMC_RSP_SPI_R1 | MMC_RSP_R1 | MMC_CMD_ADTC;
292         brq.data.blksz = 512;
293         brq.stop.opcode = MMC_STOP_TRANSMISSION;
294         brq.stop.arg = 0;
295         brq.stop.flags = MMC_RSP_SPI_R1B | MMC_RSP_R1B | MMC_CMD_AC;
296         brq.data.blocks = req->nr_sectors;
297
298         /*
299          * The block layer doesn't support all sector count
300          * restrictions, so we need to be prepared for too big
301          * requests.
302          */
303         if (brq.data.blocks > card->host->max_blk_count)
304             brq.data.blocks = card->host->max_blk_count;
305
306         /*
307          * After a read error, we redo the request one sector at a time
308          * in order to accurately determine which sectors can be read
309          * successfully.
310          */
311         if (disable_multi && brq.data.blocks > 1)
312             brq.data.blocks = 1;
313
314         if (brq.data.blocks > 1) {
315             /* SPI multiblock writes terminate using a special
316              * token, not a STOP_TRANSMISSION request.
317              */
318             if (!mmc_host_is_spi(card->host)
319                     || rq_data_dir(req) == READ)
320                 brq.mrq.stop = &brq.stop;
321             readcmd = MMC_READ_MULTIPLE_BLOCK;
322             writecmd = MMC_WRITE_MULTIPLE_BLOCK;
323         } else {
324             brq.mrq.stop = NULL;
325             readcmd = MMC_READ_SINGLE_BLOCK;
326             writecmd = MMC_WRITE_BLOCK;
327         }
328
329         if (rq_data_dir(req) == READ) {
330             brq.cmd.opcode = readcmd;
331             brq.data.flags |= MMC_DATA_READ;
332         } else {
333             brq.cmd.opcode = writecmd;
334             brq.data.flags |= MMC_DATA_WRITE;
335         }
336
337         mmc_set_data_timeout(&brq.data, card);
338
339         brq.data.sg = mq->sg;
340         brq.data.sg_len = mmc_queue_map_sg(mq);
341
342         /*
343          * Adjust the sg list so it is the same size as the
344          * request.
345          */
346         if (brq.data.blocks != req->nr_sectors) {
347             int i, data_size = brq.data.blocks << 9;
348             struct scatterlist *sg;
349
350             for_each_sg(brq.data.sg, sg, brq.data.sg_len, i) {
351                 data_size -= sg->length;
352                 if (data_size <= 0) {
353                     sg->length += data_size;
354                     i++;
355                     break;
356                 }
357             }
358             brq.data.sg_len = i;
359         }
360
361         mmc_queue_bounce_pre(mq);
362
363         mmc_wait_for_req(card->host, &brq.mrq);
364
365         mmc_queue_bounce_post(mq);
366
367         /*
368          * Check for errors here, but don't jump to cmd_err
369          * until later as we need to wait for the card to leave
370          * programming mode even when things go wrong.
371          */
372         if (brq.cmd.error || brq.data.error || brq.stop.error) {
373             if (brq.data.blocks > 1 && rq_data_dir(req) == READ) {
374                 /* Redo read one sector at a time */
375                 printk(KERN_WARNING "%s: retrying using single "
376                        "block read\n", req->rq_disk->disk_name);
377                 disable_multi = 1;
378                 continue;
379             }
380             status = get_card_status(card, req);
381         } else if (disable_multi == 1) {
382             disable_multi = 0;
383         }
384
385         if (brq.cmd.error) {
386             printk(KERN_ERR "%s: error %d sending read/write "
387                    "command, response %#x, card status %#x\n",
388                    req->rq_disk->disk_name, brq.cmd.error,
389                    brq.cmd.resp[0], status);
390         }
391
392         if (brq.data.error) {
393             if (brq.data.error == -ETIMEDOUT && brq.mrq.stop)
394                 /* 'Stop' response contains card status */
395                 status = brq.mrq.stop->resp[0];
396             printk(KERN_ERR "%s: error %d transferring data,"
397                    " sector %u, nr %u, card status %#x\n",
398                    req->rq_disk->disk_name, brq.data.error,
399                    (unsigned)req->sector,
400                    (unsigned)req->nr_sectors, status);
401         }
402
403         if (brq.stop.error) {
404             printk(KERN_ERR "%s: error %d sending stop command, "
405                    "response %#x, card status %#x\n",
406                    req->rq_disk->disk_name, brq.stop.error,
407                    brq.stop.resp[0], status);
408         }
409
410         if (!mmc_host_is_spi(card->host) && rq_data_dir(req) != READ) {
411             do {
412                 int err;
413
414                 cmd.opcode = MMC_SEND_STATUS;
415                 cmd.arg = card->rca << 16;
416                 cmd.flags = MMC_RSP_R1 | MMC_CMD_AC;
417                 err = mmc_wait_for_cmd(card->host, &cmd, 5);
418                 if (err) {
419                     printk(KERN_ERR "%s: error %d requesting status\n",
420                            req->rq_disk->disk_name, err);
421                     goto cmd_err;
422                 }
423                 /*
424                  * Some cards mishandle the status bits,
425                  * so make sure to check both the busy
426                  * indication and the card state.
427                  */
428             } while (!(cmd.resp[0] & R1_READY_FOR_DATA) ||
429                 (R1_CURRENT_STATE(cmd.resp[0]) == 7));
430
431 #if 0
432             if (cmd.resp[0] & ~0×00000900)
433                 printk(KERN_ERR "%s: status = %08x\n",
434                        req->rq_disk->disk_name, cmd.resp[0]);
435             if (mmc_decode_status(cmd.resp))
436                 goto cmd_err;
437 #endif
438         }
439
440         if (brq.cmd.error || brq.stop.error || brq.data.error) {
441             if (rq_data_dir(req) == READ) {
442                 /*
443                  * After an error, we redo I/O one sector at a
444                  * time, so we only reach here after trying to
445                  * read a single sector.
446                  */
447                 spin_lock_irq(&md->lock);
448                 ret = __blk_end_request(req, -EIO, brq.data.blksz);
449                 spin_unlock_irq(&md->lock);
450                 continue;
451             }
452             goto cmd_err;
453         }
454
455         /*
456          * A block was successfully transferred.
457          */
458         spin_lock_irq(&md->lock);
459         ret = __blk_end_request(req, 0, brq.data.bytes_xfered);
460         spin_unlock_irq(&md->lock);
461     } while (ret);
462
463     mmc_release_host(card->host);
464
465     return 1;
466
467 cmd_err:
468     /*
469      * If this is an SD card and we're writing, we can first
470      * mark the known good sectors as ok.
471      *
472      * If the card is not SD, we can still ok written sectors
473      * as reported by the controller (which might be less than
474      * the real number of written sectors, but never more).
475      */
476     if (mmc_card_sd(card)) {
477         u32 blocks;
478
479         blocks = mmc_sd_num_wr_blocks(card);
480         if (blocks != (u32)-1) {
481             spin_lock_irq(&md->lock);
482             ret = __blk_end_request(req, 0, blocks << 9);
483             spin_unlock_irq(&md->lock);
484         }
485     } else {
486         spin_lock_irq(&md->lock);
487         ret = __blk_end_request(req, 0, brq.data.bytes_xfered);
488         spin_unlock_irq(&md->lock);
489     }
490
491     mmc_release_host(card->host);
492
493     spin_lock_irq(&md->lock);
494     while (ret)
495         ret = __blk_end_request(req, -EIO, blk_rq_cur_bytes(req));
496     spin_unlock_irq(&md->lock);
497
498     return 0;
499 }
278行和491行保证了，当前握有card->host的唯一性。
280行~360行，根据当前的request，再次组织一个新的block request,通过363行，进行读写。
186 /**
187 * mmc_wait_for_req – start a request and wait for completion
188 * @host: MMC host to start command
189 * @mrq: MMC request to start
190 *
191 * Start a new MMC custom command request for a host, and wait
192 * for the command to complete. Does not attempt to parse the
193 * response.
194 */
195 void mmc_wait_for_req(struct mmc_host *host, struct mmc_request *mrq)
196 {
197     DECLARE_COMPLETION_ONSTACK(complete);
198
199     mrq->done_data = &complete;
200     mrq->done = mmc_wait_done;
201
202     mmc_start_request(host, mrq);//maybe have a long time.
203
204     wait_for_completion(&complete);//wait until the data completed.the sem also anipulated by interrupt.
205 }
186行~205行，是个真正的读写过程。通过complete保证了：只有数据读写完毕，这个函数才返回。否则，将一直等待（等待的过程在204行）。
123 static void
124 mmc_start_request(struct mmc_host *host, struct mmc_request *mrq)
125 {
126 #ifdef CONFIG_MMC_DEBUG
127     unsigned int i, sz;
128     struct scatterlist *sg;
129 #endif
130
131     pr_debug("%s: starting CMD%u arg %08x flags %08x\n",
132          mmc_hostname(host), mrq->cmd->opcode,
133          mrq->cmd->arg, mrq->cmd->flags);
134
135     if (mrq->data) {
136         pr_debug("%s:     blksz %d blocks %d flags %08x "
137             "tsac %d ms nsac %d\n",
138             mmc_hostname(host), mrq->data->blksz,
139             mrq->data->blocks, mrq->data->flags,
140             mrq->data->timeout_ns / 1000000,
141             mrq->data->timeout_clks);
142     }
143
144     if (mrq->stop) {
145         pr_debug("%s:     CMD%u arg %08x flags %08x\n",
146              mmc_hostname(host), mrq->stop->opcode,
147              mrq->stop->arg, mrq->stop->flags);
148     }
149
150     WARN_ON(!host->claimed);
151
152     led_trigger_event(host->led, LED_FULL);
153
154     mrq->cmd->error = 0;
155     mrq->cmd->mrq = mrq;
156     if (mrq->data) {
157         BUG_ON(mrq->data->blksz > host->max_blk_size);
158         BUG_ON(mrq->data->blocks > host->max_blk_count);
159         BUG_ON(mrq->data->blocks * mrq->data->blksz >
160             host->max_req_size);
161
162 #ifdef CONFIG_MMC_DEBUG
163         sz = 0;
164         for_each_sg(mrq->data->sg, sg, mrq->data->sg_len, i)
165             sz += sg->length;
166         BUG_ON(sz != mrq->data->blocks * mrq->data->blksz);
167 #endif
168
169         mrq->cmd->data = mrq->data;
170         mrq->data->error = 0;
171         mrq->data->mrq = mrq;
172         if (mrq->stop) {
173             mrq->data->stop = mrq->stop;
174             mrq->stop->error = 0;
175             mrq->stop->mrq = mrq;
176         }
177     }
178     host->ops->request(host, mrq);//对于goldish会调用goldfish_mmc_request
179 }
178行注释，调用goldfish_mmc_request进行真正的读写。
400 static void goldfish_mmc_request(struct mmc_host *mmc, struct mmc_request *req)
401 {
402     struct goldfish_mmc_host *host = mmc_priv(mmc);
403
404     WARN_ON(host->mrq != NULL);
405
406     host->mrq = req;
407     goldfish_mmc_prepare_data(host, req);//parameters be written and ready
408     goldfish_mmc_start_command(host, req->cmd);//data been transported
409
410     /* this is to avoid accidentally being detected as an SDIO card in mmc_attach_sdio() */
411     if (req->cmd->opcode == SD_IO_SEND_OP_COND &&
412         req->cmd->flags == (MMC_RSP_SPI_R4 | MMC_RSP_R4 | MMC_CMD_BCR)) {
413         req->cmd->error = -EINVAL;
414     }
415 }
第408行，调用goldfish_mmc_request
156 static void
157 goldfish_mmc_start_command(struct goldfish_mmc_host *host, struct mmc_command *cmd)
158 {
159     u32 cmdreg;
160     u32 resptype;
161     u32 cmdtype;
162
163     host->cmd = cmd;
164
165     resptype = 0;
166     cmdtype = 0;
167
168     /* Our hardware needs to know exact type */
169     switch (mmc_resp_type(cmd)) {
170     case MMC_RSP_NONE:
171         break;
172     case MMC_RSP_R1:
173     case MMC_RSP_R1B:
174         /* resp 1, 1b, 6, 7 */
175         resptype = 1;
176         break;
177     case MMC_RSP_R2:
178         resptype = 2;
179         break;
180     case MMC_RSP_R3:
181         resptype = 3;
182         break;
183     default:
184         dev_err(mmc_dev(host->mmc), "Invalid response type: %04x\n", mmc_resp_type(cmd));
185         break;
186     }
187
188     if (mmc_cmd_type(cmd) == MMC_CMD_ADTC) {
189         cmdtype = OMAP_MMC_CMDTYPE_ADTC;
190     } else if (mmc_cmd_type(cmd) == MMC_CMD_BC) {
191         cmdtype = OMAP_MMC_CMDTYPE_BC;
192     } else if (mmc_cmd_type(cmd) == MMC_CMD_BCR) {
193         cmdtype = OMAP_MMC_CMDTYPE_BCR;
194     } else {
195         cmdtype = OMAP_MMC_CMDTYPE_AC;
196     }
197
198     cmdreg = cmd->opcode | (resptype << | (cmdtype << 12);
199
200     if (host->bus_mode == MMC_BUSMODE_OPENDRAIN)
201         cmdreg |= 1 << 6;
202
203     if (cmd->flags & MMC_RSP_BUSY)
204         cmdreg |= 1 << 11;
205
206     if (host->data && !(host->data->flags & MMC_DATA_WRITE))
207         cmdreg |= 1 << 15;
208
209     GOLDFISH_MMC_WRITE(host, MMC_ARG, cmd->arg);
210     GOLDFISH_MMC_WRITE(host, MMC_CMD, cmdreg);
211 }
这个过程可能会等一段时间。
什么时候，才知道数据读写完毕呢？通过中断。当数据读写完毕后，host会向系统发起一个中断。在中断中，将调用第200行的mmc_wait_done。其中断函数的代码如下：
291 static irqreturn_t goldfish_mmc_irq(int irq, void *dev_id)
292 {
293     struct goldfish_mmc_host * host = (struct goldfish_mmc_host *)dev_id;
294     u16 status;
295     int end_command = 0;
296     int end_transfer = 0;
297     int transfer_error = 0;
298     int state_changed = 0;
299     int cmd_timeout = 0;
300
301     while ((status = GOLDFISH_MMC_READ(host, MMC_INT_STATUS)) != 0) {
302         GOLDFISH_MMC_WRITE(host, MMC_INT_STATUS, status);
303
304         if (status & MMC_STAT_END_OF_CMD) {
305             end_command = 1;
306         }
307
308         if (status & MMC_STAT_END_OF_DATA) {
309             end_transfer = 1;
310         }
311         if (status & MMC_STAT_STATE_CHANGE) {
312             state_changed = 1;
313         }
314
315         if (status & MMC_STAT_CMD_TIMEOUT) {
316             end_command = 0;
317             cmd_timeout = 1;
318         }
319     }
320
321     if (cmd_timeout) {
322         struct mmc_request *mrq = host->mrq;
323         mrq->cmd->error = -ETIMEDOUT;
324         host->mrq = NULL;
325         mmc_request_done(host->mmc, mrq);
326     }
327
328     if (end_command) {
329         goldfish_mmc_cmd_done(host, host->cmd);
330     }
331     if (transfer_error)
332         goldfish_mmc_xfer_done(host, host->data);
333     else if (end_transfer) {
334         host->dma_done = 1;
335         goldfish_mmc_end_of_data(host, host->data);
336     }
337     if (state_changed) {
338         u32 state = GOLDFISH_MMC_READ(host, MMC_STATE);
339         pr_info("%s: Card detect now %d\n", __func__,
340             (state & MMC_STATE_INSERTED));
341         mmc_detect_change(host->mmc, 0);
342     }
343
344     if (!end_command && !end_transfer &&
345         !transfer_error && !state_changed && !cmd_timeout) {
346         status = GOLDFISH_MMC_READ(host, MMC_INT_STATUS);
347         dev_info(mmc_dev(host->mmc),"spurious irq 0x%04x\n", status);
348         if (status != 0) {
349             GOLDFISH_MMC_WRITE(host, MMC_INT_STATUS, status);
350             GOLDFISH_MMC_WRITE(host, MMC_INT_ENABLE, 0);
351         }
352     }
353
354     return IRQ_HANDLED;
355 }
在第333~336行，如果数据传输完毕后，会执行335行的goldfish_mmc_end_of_data()，注意host->dma_done设置为1，下面的程序会调用到。
252 static void
253 goldfish_mmc_end_of_data(struct goldfish_mmc_host *host, struct mmc_data *data)
254 {
255     if (!host->dma_in_use) {
256         goldfish_mmc_xfer_done(host, data);
257         return;
258     }
259     if (host->dma_done)
260         goldfish_mmc_xfer_done(host, data);
261 }
由于之前host->dma_done设置为1，那么执行259~260行。即调用goldfish_mmc_xfer_done
213 static void
214 goldfish_mmc_xfer_done(struct goldfish_mmc_host *host, struct mmc_data *data)
215 {
216     if (host->dma_in_use) {
217         enum dma_data_direction dma_data_dir;
218
219         if (data->flags & MMC_DATA_WRITE)
220             dma_data_dir = DMA_TO_DEVICE;
221         else
222             dma_data_dir = DMA_FROM_DEVICE;
223
224         if (dma_data_dir == DMA_FROM_DEVICE) {
225             // we don't really have DMA, so we need to copy from our platform driver buffer
226             uint8_t* dest = (uint8_t *)sg_virt(data->sg);
227             memcpy(dest, host->virt_base, data->sg->length);
228         }
229
230         host->data->bytes_xfered += data->sg->length;
231
232         dma_unmap_sg(mmc_dev(host->mmc), data->sg, host->sg_len, dma_data_dir);
233     }
234
235     host->data = NULL;
236     host->sg_len = 0;
237
238     /* NOTE: MMC layer will sometimes poll-wait CMD13 next, issuing
239      * dozens of requests until the card finishes writing data.
240      * It'd be cheaper to just wait till an EOFB interrupt arrives…
241      */
242
243     if (!data->stop) {
244         host->mrq = NULL;
245         mmc_request_done(host->mmc, data->mrq);
246         return;
247     }
248
249     goldfish_mmc_start_command(host, data->stop);
250 }
第245行，调用了mmc_request_done
69 /**
70 * mmc_request_done – finish processing an MMC request
71 * @host: MMC host which completed request
72 * @mrq: MMC request which request
73 *
74 * MMC drivers should call this function when they have completed
75 * their processing of a request.
76 */
77 void mmc_request_done(struct mmc_host *host, struct mmc_request *mrq)
78 {
79     struct mmc_command *cmd = mrq->cmd;
80     int err = cmd->error;
81
82     if (err && cmd->retries && mmc_host_is_spi(host)) {
83         if (cmd->resp[0] & R1_SPI_ILLEGAL_COMMAND)
84             cmd->retries = 0;
85     }
86
87     if (err && cmd->retries) {
88         pr_debug("%s: req failed (CMD%u): %d, retrying…\n",
89             mmc_hostname(host), cmd->opcode, err);
90
91         cmd->retries–;
92         cmd->error = 0;
93         host->ops->request(host, mrq);
94     } else {
95         led_trigger_event(host->led, LED_OFF);
96
97         pr_debug("%s: req done (CMD%u): %d: %08x %08x %08x %08x\n",
98             mmc_hostname(host), cmd->opcode, err,
99             cmd->resp[0], cmd->resp[1],
100             cmd->resp[2], cmd->resp[3]);
101
102         if (mrq->data) {
103             pr_debug("%s:     %d bytes transferred: %d\n",
104                 mmc_hostname(host),
105                 mrq->data->bytes_xfered, mrq->data->error);
106         }
107
108         if (mrq->stop) {
109             pr_debug("%s:     (CMD%u): %d: %08x %08x %08x %08x\n",
110                 mmc_hostname(host), mrq->stop->opcode,
111                 mrq->stop->error,
112                 mrq->stop->resp[0], mrq->stop->resp[1],
113                 mrq->stop->resp[2], mrq->stop->resp[3]);
114         }
115
116         if (mrq->done)
117             mrq->done(mrq);
118     }
119 }
最终会调用117行的mrq->done，即mmc_wait_done
181 static void mmc_wait_done(struct mmc_request *mrq)
182 {
183     complete(mrq->done_data);
184 }
183行中的mrq->done_data被设置为了&complete(看mmc_wait_for_req)。
4824 /**
4825 * complete: – signals a single thread waiting on this completion
4826 * @x: holds the state of this particular completion
4827 *
4828 * This will wake up a single thread waiting on this completion. Threads will be
4829 * awakened in the same order in which they were queued.
4830 *
4831 * See also complete_all(), wait_for_completion() and related routines.
4832 */
4833 void complete(struct completion *x)
4834 {
4835     unsigned long flags;
4836
4837     spin_lock_irqsave(&x->wait.lock, flags);
4838     x->done++;
4839     __wake_up_common(&x->wait, TASK_NORMAL, 1, 0, NULL);
4840     spin_unlock_irqrestore(&x->wait.lock, flags);
4841 }
4842 EXPORT_SYMBOL(complete);
看4838行，done++后，再调用complete上的进程，这时候，进程就可以结束 wait_for_completion(&complete)了。wait_for_completion代码如下：
4898 /**
4899 * wait_for_completion: – waits for completion of a task
4900 * @x: holds the state of this particular completion
4901 *
4902 * This waits to be signaled for completion of a specific task. It is NOT
4903 * interruptible and there is no timeout.
4904 *
4905 * See also similar routines (i.e. wait_for_completion_timeout()) with timeout
4906 * and interrupt capability. Also see complete().
4907 */
4908 void __sched wait_for_completion(struct completion *x)
4909 {
4910     wait_for_common(x, MAX_SCHEDULE_TIMEOUT, TASK_UNINTERRUPTIBLE);
4911 }
4912 EXPORT_SYMBOL(wait_for_completion);
4887 static long __sched
4888 wait_for_common(struct completion *x, long timeout, int state)
4889 {
4890     might_sleep();
4891
4892     spin_lock_irq(&x->wait.lock);
4893     timeout = do_wait_for_common(x, timeout, state);
4894     spin_unlock_irq(&x->wait.lock);
4895     return timeout;
4896 }
4861 static inline long __sched
4862 do_wait_for_common(struct completion *x, long timeout, int state)
4863 {
4864     if (!x->done) {
4865         DECLARE_WAITQUEUE(wait, current);
4866
4867         wait.flags |= WQ_FLAG_EXCLUSIVE;
4868         __add_wait_queue_tail(&x->wait, &wait);
4869         do {
4870             if (signal_pending_state(state, current)) {
4871                 timeout = -ERESTARTSYS;
4872                 break;
4873             }
4874             __set_current_state(state);
4875             spin_unlock_irq(&x->wait.lock);
4876             timeout = schedule_timeout(timeout);
4877             spin_lock_irq(&x->wait.lock);
4878         } while (!x->done && timeout);
4879         __remove_wait_queue(&x->wait, &wait);
4880         if (!x->done)
4881             return timeout;
4882     }
4883     x->done–;
4884     return timeout ?: 1;
4885 }
着重看4878行。
至此，基本上，mmc读写请求的整个过程就分析结束了。

文件读写，从请求到IO启动

tek-life — Mon, 26 Sep 2011 09:28:26 +0000

在Linux中，块设备的读写是一个比较复杂的过程。如果再加上VFS的话，层次就更多了。实际上VFS和块设备驱动联系的不是非常密切。在VFS中，我们会看到当发生读写请求的时候，会调用ll_rw_block函数或者submit_bh函数，其中ll_rw_block是对submit_bh的封装。这个函数，实际上就是从VFS到实际设备读写的必经之路。关于这一点，有很多用systemtap来观测io的脚本就是在submit_bh函数安装一个stub（有关io检测的相关的文章，可以参看淘宝的大牛诸霸的博客）。

在这里，我们不再谈论VFS的东西，而是从submit_bh开始看起，然后到数据被读出，进程又继续执行的流程。
submit_bh的功能正如其函数的名字那样–“提交buffer head”。那么，具体提交给谁呢？由谁来提交呢？其实块设备的读写似乎是一个C/S架构的服务器。客户端是各个进行io操作的进程，服务器端就是设备的请求队列。进程把请求的信息包装成一个request的数据结构，然后，挂载在服务端，即块设备的请求队列中。我前面说的那句话“似乎是一个C/S架构的”，而不是真正C/S架构的。因为，C/S架构来源于网络程序，客户端进程把数据发往正在监听的服务端，然后服务端的进程从网络缓冲区中经过网络协议的层层解压“剥皮”，拿到数据。而我们谈论这个文件数据的读写并不真正是C/S架构的，原因就是，客户端的发送和服务端的接收请求全由一个进程，即用户进程来完成的。这一点应该很好理解，因为在OS中，除了中断以及异常处理没有上下文外，其他的都有进程上下文，因此，从submit读写请求到接收读写请求，当然就是进程自己的事情了，当然，如果你要是抬杠“在内核中完全可以由一个专门的线程用来处理服务端的事情”，我也无话可说。原理上，你这个抬杠当然是行得通的。说到这里，我想起了微内核的MINIX，就此打住，继续回到他们的处理过程中。
当用户进程提交请求，并挂载到块设备队列的过程中，还涉及一个IO调度的问题，即是，用户进程在提交一个请求时，遇到了调度算法，这个调度算法做的事情很简单，它检查这个请求和正在排队的请求能否合二为一。如果不能合二为一，那就直接挂上去。至此，一个进程所要做的工作基本上就结束了。可是，请求被相应的时机呢？什么时候，它的请求才能满足？
我们清楚，一个硬件设备，特别是块设备，让它来读取数据然后内核再从端口里面把数据提出来，或者说，通过DMA的方式，直接从磁盘中拿到数据，这个数据读出来的过程是很漫长的，这个漫长是相对于CPU来说的，绝对时间其实是很短暂的。一般情况下，用户进程在往块设备的请求队列上挂请求的时候，发现队列为空的话，会将该队列插入到一个全局的队列中(tq_disk，从名字中，我们也能够看出来是task queue for disk的缩写)。如果队列不为空，那么说明该队列已经加入到tq_disk的全局队列中了，既然该块设备的读写请求队列不为空，那么要利用调度策略，看时候能够和正在该块设备上排队的读写请求和二为一了。这里有一个很恰当的比方：当我们去饭店吃饭的时候，如果你要点的菜如果和师傅正在炒或者准备炒的菜一样的话，炒菜师傅会把两个人点的菜一块炒，特别是学校的食堂，每到吃饭高峰期，人很多，因此，学生们一般都会问服务员，下面要做的是什么菜，如果要节省时间的话，就要师傅下面要炒的菜了。在这里，磁盘的调度原理就是这个样子，貌似很简单哇。其实，有些时候，我们可能并不需要一个请求队列，比如，将来计算机的磁盘全部是SSD了，不再用机械磁盘了，都是电读写的，那么这个IO调度说不定就要被废除了。然后，也就不再需要请求队列了。一个请求到了，然后马上就发送到驱动程序，驱动程序想设备发送命令，读取数据。而在Linux的内核中，已经考虑到这一点了，如果进程进行同步IO的话，就直接启动驱动程序进行IO读写了（请参考代码段一）。
前面说到，将读写请求挂载在块设备的请求队列时，如果不为空的话，会看能否进行IO调度，不能调度的话，会向块设备请求队列插入一个请求。然后进程的任务就完成了。如果插入请求的时候，发现这个队列上的请求非常多，那么怎么办呢？进程就会主动的启动磁盘IO让这些请求队列赶紧执行(请参考代码片段二)。
上面设计到的进程启动磁盘IO，都算是主动的。除了主动的时候，还有被动的情况。当进程将请求挂载在块设备请求队列的时候，它是要用其中的数据的。什么时候用呢？该用的时候就用呀，不过用的时候，会检测相关的数据是否被读出了，如果没有读出，那么进程就被阻塞，然后启动磁盘IO(请参考代码片段三)。这一点在Linux2.6的内核中稍微进行了改进，设置了一个request数量阈值，如果大于这个阈值，那么就启动磁盘IO。
在Linux2.6的内核中，还增加了一个启动IO磁盘的时机，即，读写请求被插入到某个块设备的请求队列时，设置了一个定时器，保证在某个时间点之内，一定要启动磁盘IO。
启动磁盘IO后，数据怎么读出就跟进程没什么关系了。进程在使用的时候，就会查看它要用的buffer缓冲区是否locked，如果否，就说明已经读好了，如果是，那么就继续启动磁盘然后等待(代码片段三)。
以上基本上就分析完了。在2.6的内核中，在request和buffer head中又加了一个bio，不过仅仅加了个bio并不影响理解。另外，单单看块设备驱动，并不能够解决读写请求发送到块设备请求队列，然后块设备又怎样的把读写的数据读入到buffer中。当然了，在这一个南大富士通的赵磊大牛写过一个系列的文章“写一个块设备驱动”，一共120页。对我的帮助还是蛮大，当初凌晨看到2点半，然后又加上一个上午，基本上算是一口气看完了。写得不错，希望对块设备驱动有兴趣的同学，可以google一下，看看。

注：本文还非常naive，错误难免，如果发现，请批评指正。

附件：参考2.4.31内核
代码片段一:
         submit_bh->__make_request
1000 static int __make_request(request_queue_t * q, int rw,
1001                   struct buffer_head * bh)
1002 {
1003     unsigned int sector, count, sync;
1004     int max_segments = MAX_SEGMENTS;
1005     struct request * req, *freereq = NULL;
1006     int rw_ahead, max_sectors, el_ret;
1007     struct list_head *head, *insert_here;
1008     int latency;
1009     elevator_t *elevator = &q->elevator;
1010     int should_wake = 0;
1011
1012     count = bh->b_size >> 9;
1013     sector = bh->b_rsector;
1014     sync = test_and_clear_bit(BH_Sync, &bh->b_state);
1015
.。。。。。。。。。。。。。。。。。。。。。。。。。
1176 out:
1177     if (freereq)
1178         blkdev_release_request(freereq);
1179     if (should_wake)
1180         get_request_wait_wakeup(q, rw);
1181     if (sync)
1182         __generic_unplug_device(q);//进程发起启动磁盘IO
1183     spin_unlock_irq(&io_request_lock);
1184     return 0;
1185 end_io:
1186     bh->b_end_io(bh, test_bit(BH_Uptodate, &bh->b_state));
1187     return 0;
1188 }
代码片段二：
__make_request->__get_request_wait
643 static struct request *__get_request_wait(request_queue_t *q, int rw)
644 {
645     register struct request *rq;
646     DECLARE_WAITQUEUE(wait, current);
647
648     add_wait_queue_exclusive(&q->wait_for_requests, &wait);
649
650     do {
651         set_current_state(TASK_UNINTERRUPTIBLE);
652         spin_lock_irq(&io_request_lock);
653         if (blk_oversized_queue(q) || q->rq.count == 0) {
654             __generic_unplug_device(q);//进程发起启动磁盘IO
655             spin_unlock_irq(&io_request_lock);
656             schedule();
657             spin_lock_irq(&io_request_lock);
658         }
659         rq = get_request(q, rw);
660         spin_unlock_irq(&io_request_lock);
661     } while (rq == NULL);
662     remove_wait_queue(&q->wait_for_requests, &wait);
663     current->state = TASK_RUNNING;
664
665     return rq;
666 }
667
代码片段三：
180 /*
181 * Note that the real wait_on_buffer() is an inline function that checks
182 * that the buffer is locked before calling this, so that unnecessary disk
183 * unplugging does not occur.
184 */
185 void __wait_on_buffer(struct buffer_head * bh)
186 {
187     struct task_struct *tsk = current;
188     DECLARE_WAITQUEUE(wait, tsk);
189
190     get_bh(bh);
191     add_wait_queue(&bh->b_wait, &wait);
192     do {
193         set_task_state(tsk, TASK_UNINTERRUPTIBLE);
194         if (!buffer_locked(bh))
195             break;
196         /*
197          * We must read tq_disk in TQ_ACTIVE after the
198          * add_wait_queue effect is visible to other cpus.
199          * We could unplug some line above it wouldn't matter
200          * but we can't do that right after add_wait_queue
201          * without an smp_mb() in between because spin_unlock
202          * has inclusive semantics.
203          * Doing it here is the most efficient place so we
204          * don't do a suprious unplug if we get a racy
205          * wakeup that make buffer_locked to return 0, and
206          * doing it here avoids an explicit smp_mb() we
207          * rely on the implicit one in set_task_state.
208          */
209         run_task_queue(&tq_disk);
210         schedule();
211     } while (buffer_locked(bh));
212     tsk->state = TASK_RUNNING;
213     remove_wait_queue(&bh->b_wait, &wait);
214     put_bh(bh);
215 }
__wait_on_buffer->run_task_queue
119 static inline void run_task_queue(task_queue *list)
120 {
121     if (TQ_ACTIVE(*list))
122         __run_task_queue(list);
123 }
__wait_on_buffer->run_task_queue->__run_task_queue
334 void __run_task_queue(task_queue *list)
335 {
336     struct list_head head, *next;
337     unsigned long flags;
338
339     spin_lock_irqsave(&tqueue_lock, flags);
340     list_add(&head, list);
341     list_del_init(list);
342     spin_unlock_irqrestore(&tqueue_lock, flags);
343
344     next = head.next;
345     while (next != &head) {
346         void (*f) (void *);
347         struct tq_struct *p;
348         void *data;
349
350         p = list_entry(next, struct tq_struct, list);
351         next = next->next;
352         f = p->routine;
353         data = p->data;
354         wmb();
355         p->sync = 0;
356         if (f)
357             f(data);//这里对于普通的磁盘，就是generic_unplug_device，和代码片段一以及二是一个启动IO操作，
358         //其实这个函数还是包装了一下，最直接的是q->request_fn
359     }
360 }

参考：
1.《Linux内核源码情景分析(下册)》,第八章，设备驱动
2.《深入Linux内核架构》，第六章，设备驱动程序
3.《写一个块设备驱动》，赵磊

如何挂载一个文件系统

tek-life — Thu, 18 Aug 2011 13:35:02 +0000

挂载一个文件系统中最重要的数据结构有以下3个：
1.          file_system_type 要挂载的文件系统类型。
2.          super_block其中有怎样获取该文件系统相关数据的方法。
3.          vfsmount 这个数据结构起到被挂载文件系统和挂载点文件系统的枢纽所用
这几个数据结构的关系，请着重看下图的红色椭圆形区域：

对照上图，我们可以得出结论，如果要挂载一个文件系统需要做的工作：
1.查找相应的文件系统类型，such as ext2 ext3 or ntfs or yaffs2 or rootfs etc.
2.查找相应的挂载点，方法：一路摸索，顺藤摸瓜。找到其dentry和inode.
3.生成一个vfsmount，这个数据结构是挂载点目录以及正在挂载的这个文件系统的根目录（依据的数据结构是：mnt_mountpoing和mnt_root）的枢纽（非常重要）,并将这个vfsmount放在到hashtable中。这个hashtable的hash值运算依据的是挂载点目录以及挂载点inode.除了挂载到hashtable中外，还要链到父挂载点的子链表中。
放在hashtable的原因是，将来在lookup其内的目录或者文件时，需要根据挂载点的目录和挂载点的inode取hash值快速得到vfsmount。
4.主要的工作完成后，还需要把正在挂载的这个文件系统的根目录的inode和dentry取出来放在内存中，其中dentry的值还要赋给vfsmount的mnt_root.
当然这个第4步骤和第3步骤可能会有混合，主要是为了给vfsmount->mnt_root赋值，所以，需要取该文件系统的根目录。

按照以上的分析，我们对照review一下内核的源码的流程（为了方便，将与分析无关的语句去掉了）：
2393 SYSCALL_DEFINE5(mount, char __user *, dev_name, char __user *, dir_name,
2394                 char __user *, type, unsigned long, flags, void __user *, data)
2395 {
…….//做些参数检测，然后将用户空间的相关变量拷贝到内核区间
2419
2420         ret = do_mount(kernel_dev, kernel_dir, kernel_type, flags,
2421                 (void *) data_page);
————————————————————————————-
2191 long do_mount(char *dev_name, char *dir_name, char *type_page,
2192                   unsigned long flags, void *data_page)
2193 {
…做些参数检测工作，然后寻找挂载点。
2211         retval = kern_path(dir_name, LOOKUP_FOLLOW, &path);
2212         if (retval)
2213                 return retval;
….
//下面根据参数，选择相应的函数，我们假定最一般的情况，选择do_new_mount
2244         if (flags & MS_REMOUNT)
2245                 retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
2246                                     data_page);
2247         else if (flags & MS_BIND)
2248                 retval = do_loopback(&path, dev_name, flags & MS_REC);
2249        else if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE))
2250                 retval = do_change_type(&path, flags);
2251         else if (flags & MS_MOVE)
2252                 retval = do_move_mount(&path, dev_name);
2253         else
2254                retval = do_new_mount(&path, type_page, flags, mnt_flags,
2255                                       dev_name, data_page);
——————————————————————————————-
1877 /*
1878 * create a new mount for userspace and request it to be added into the
1879 * namespace's tree
1880 */
1881 static int do_new_mount(struct path *path, char *type, int flags,
1882                         int mnt_flags, char *name, void *data)
1883 {
…做一些其他工作后，开始调用do_kenn_mount,从传参的情况，可以推测，要做的工作是：
1.       找到相关的文件系统
2.       从即将挂载的设备中，取出节点，然后初始化vfsmount
3.       将返回值赋给mnt.
那么最重要的vfsmount已经得到
1894         mnt = do_kern_mount(type, flags, name, data);
1895         if (IS_ERR(mnt))
1896                 return PTR_ERR(mnt);
1897
1898         err = do_add_mount(mnt, path, mnt_flags);
1899         if (err)
1900                 mntput(mnt);
1901         return err;
1902 }
——————————————————————————————-

do_new_mount->do_kern_mount-> vfs_kern_mount
964 vfs_kern_mount(struct file_system_type *type, int flags, const char *name, void *data)
965 {
下面分配一个vfsmount
975         mnt = alloc_vfsmnt(name);
976         if (!mnt)
977                 goto out;
…
根据情况，调用不同的函数，将vfsmount数据结构填好。以及分配superblock，以及相关的dentry和inode.
992         if (type->mount) {
993                 root = type->mount(type, flags, name, data);
994                 if (IS_ERR(root)) {
995                         error = PTR_ERR(root);
996                         goto out_free_secdata;
997                 }
998                 mnt->mnt_root = root;
999                 mnt->mnt_sb = root->d_sb;
1000         } else {
1001                 error = type->get_sb(type, flags, name, data, mnt);
1002                 if (error < 0)
1003                         goto out_free_secdata;
—————————————————————————————————————-
do_new_mount->do_add_mount
1938 static int do_add_mount(struct vfsmount *newmnt, struct path *path, int mnt_flags)
1939 {
….
为了防止前面在获取文件系统内部根目录时其他进程已经挂载到该挂载点（可能是其他文件系统，也可能是正在挂载的文件系统）因此要检测一下
1956         if (path->mnt->mnt_sb == newmnt->mnt_sb &&
1957             path->mnt->mnt_root == path->dentry)
1958                 goto unlock;
1959
1960         err = -EINVAL;
1961         if (S_ISLNK(newmnt->mnt_root->d_inode->i_mode))
1962                 goto unlock;
1963
1964         newmnt->mnt_flags = mnt_flags;
//把vfsmount插入到合适的链表中,注意，在这里面还将vfsmount中的成员mnt_mountpoint重新赋值为path->dentry.而不是在vfs_kern_mount时赋的mnt_root
1965         err = graft_tree(newmnt, path);
1966
1967 unlock:
1968         up_write(&namespace_sem);
1969         return err;
1970 }

从这个代码跟踪，可以发现，基本上挂载一个文件系统依据了我们前面分析的步骤。
欢迎批评指正。
<完>

通过简单的例子,学习systemtap

tek-life — Fri, 29 Jul 2011 09:09:55 +0000

看例子先!

怎样遍历数组：

1. #

2. # Print the system call count by process name in descending order.

3. #

5. global syscalls

7. probe begin {

8. print ("Collecting data… Type Ctrl-C to exit and display results\n")

9. }

10.

11. probe syscall.* {

12. syscalls[execname()]++

13. }

14.

15. probe end {

16. printf ("%-10s %-s\n", "#SysCalls", "Process Name")

17. foreach (proc in syscalls-)

18. printf("%-10d %-s\n", syscalls[proc], proc)

19. }

这中间,比较难理解的是第17行,那么它的解释如下：

The variable proc is an index variable that iterates over the range of values possible for the array index of syscalls. Also note the en dash (-) after syscalls that denotes that the iteration runs in reverse order. This character ensures that the number of system calls made print in descending order. To print in ascending order, change the script tosyscalls+.

——————————————————————–

例子二：怎样探测内核变量或者局部变量

通过stap的L参数可以查看支持的内核变量.在stap的man手册中,有下面一句:

stap the -L option should be the used to get possible variables

例如：

$stap -L 'kernel.function("sys_read")'

kernel.function("sys_read@/build/buildd/linux-2.6.38/fs/read_write.c:402") $fd:unsigned int $buf:char* $count:size_t $fput_needed:int

从这个例子中,可以看到,对于内核中的变量,通过$加上变量的名字就可以访问了,但是并不是内核里面所有的变量都可以访问,使用前,请先用stap -L 检测一下!

不过在使用的过程中,可能会碰到一些问题,比如对于char * name的变量,用printf("%s\n",$name)输出的时候,会报错,错误的类型是"type mismatch".为什么呢?因为name本身是一个指针,需要转换一下才可以.转换函数可以查看man stapfuncs,不过,有些机器上安装的man手册不太完整,完整的可以看这个网站:http://linux.die.net/man/5/stapfuncs

在下面列举一些:

kernel_string:string (addr:long)

Copy a 0-terminated string from kernel space at given address.

kernel_long:long (addr:long)

Copy a long from kernel space at given address.

kernel_int:long (addr:long)

Copy an int from kernel space at given address.

kernel_short:long (addr:long)

Copy a short from kernel space at given address.

kernel_char:long (addr:long)

Copy a char from kernel space at given address.

user_string:string (addr:long)

Copy a string from user space at given address. If the access would fault, return "" and signal no errors.

user_string2:string (addr:long, err_msg:string)

Copy a string from user space at given address. If the access would fault, return instead the err_msg value.

user_string_warn:string (addr:long)

Copy a string from user space at given address. If the access would fault, signal a warning and return "".

使用其中kernel_string() 就可以把char *name的值取出来:kernel_string($name).

除了可以检测到内核里面的变量之外,还可以检测到系统中具有全局意义的变量,比如进程的名字,进程的ID,以及UID等,这些变量被stap包装为一个函数,列表如下:

tid() The id of the current thread.

pid() The process (task group) id of the current thread.

uid() The id of the current user.

execname() The name of the current process.

cpu() The current cpu number.

gettimeofday_s() Number of seconds since epoch.可以有us ms等

get_cycles() Snapshot of hardware cycle counter.

pp() A string describing the probe point being currently handled.

probefunc() If known, the name of the function in which this probe was placed.

例如下面这个例子,这个例子在运行stap后有哪些进程调用do_fork,以及调用时候的标志是什么:

1. #!/usr/bin/stap

3. global proc_counter

5. probe begin {

6. print ("Started monitoring creation of new processes….Press ^C to terminate\n")

7. printf ("%-25s %-10s %-s\n", "Process Name", "#Process ID", "#Clone Flags")

8. }

10. probe kernel.function("do_fork") {

11. proc_counter++

12. printf("%-25s %-10d 0x%-x\n", execname(), pid(), $clone_flags)

13. }

14.

15. probe end {

16. printf ("\n%d processes forked during the observed period\n", proc_counter)

17.}

在上面这个例子中,调用了execname()来访问进程的名字,pid()来访问进程号,$clone_flags来说明其中使用的标志.

除此之外,对于syscall还有一些特殊的探测变量：argstr :参数列表，只对syscall有。

name: syscall的名字

retstr.对syscall.return才有

使用这些变量的时候,不用加前面的$符号.

另外，systemtap还内置了一些函数：比如我想只跟踪某个程序调用sys_read的情况.怎么判断程序的名字是否与execname()相等呢? 使用systemtap内置的isinstr函数就可以了.例如:

probe syscall.open{

{

if(isinstr(execname(),"ls")

printf("%s \n",execname())}

}

如果是ls程序的话,那么就把该程序的名字打印出来

———————

好了,最后在贴一个调试程序的例子:

例子3，

1 probe syscall.* {

2 en = execname();

3 ui = uid();

4 eui = euid();

5 if (en == "")

6 {

7 printf("%s(%d): %s(%s)", en, pid(), name, argstr);

9 if (ui != eui) {

10 printf(" as %d/%d ", ui, eui);

11 } else {

12 printf(" as %d ", ui);

13 }

14 }

15 }

17 probe syscall.*.return {

18 en = execname();

19 if (en == "") {

20 printf("= %s\n", retstr);

21 }

This produces output with system call arguments and return values helpfully decoded for you; it looks like:

(14087): open("/etc/passwd", O_RDONLY) as 2315/0 = 3 [...] (14087): close(1) as 2315/0 = -9 (EBADF)

<全文完>

注:ubuntu下安装systemtap请参考以前的blog.其他发行版请直接看tutorial. 欢迎批评指正!

外网主机ssh和vnc访问内网主机

tek-life — Tue, 26 Jul 2011 02:35:15 +0000

之前，孤陋寡闻，以为外网访问内网纯属扯淡！早上开shlug的邮件列表，看到这个thread。实验了一下，夷~，竟然可以。太棒了！

外网通过ssh访问内网的方法：
$ ssh -f -N -R 7070:127.0.0.1:22 外网主机用户名@外网主机ip
$ ssh 内网主机用户名@127.0.0.1 -p 7070
原理：将外网7070的端口映射到内网主机的22端口

外网通过VNC访问内网的方法：
同ssh访问的方法一样，我们还可以使用VNC服务：
在内网主机上安装好VNC，然后，开启一个session(默认的端口是从5900开始的)
在内网主机操作：
$vnc4server :1
$vnc4passwd //设定VNC连接密码
$ssh -f -N -R 1234:127.0.0.1:5901 外网主机用户名@外网主机ip
好，已经将5901绑定到外网主机的1234端口了。
然后，操作外网主机：
在外网主机菜单Applications->Internet->Remote Desktop Viewer
选择VNC协议，填入127.0.0.1:1234
然后，会要求输入密码，就是内网主机通过vnc4passwd设定的密码了。

OK啦~

Linux系统调用宏展开笔记

tek-life — Tue, 28 Jun 2011 08:56:51 +0000

不知道从哪个版本的内核开始，系统调用变成宏了。在2.6.38的内核里面追踪了一下，以SYSCALL_DEFINE1为例：

SYSCALL_DEFINE1（name,…）展开sys_name,后面的数字，若为1则是一个参数，若为2则为2个参数

具体的宏，展开跟踪流程如下：

#define SYSCALL_DEFINE1(name, …) SYSCALL_DEFINEx(1, _##name, __VA_ARGS__)

#define SYSCALL_DEFINEx(x, sname, …) \

__SYSCALL_DEFINEx(x, sname, __VA_ARGS__)

#define __SYSCALL_DEFINEx(x, name, …) \

asmlinkage long sys##name(__SC_DECL##x(__VA_ARGS__))

#define __SC_DECL1(t1, a1) t1 a1

拿一个例子来对照一下:

SYSCALL_DEFINE1(brk, unsigned long, brk)

SYSCALL_DEFINE1(1, _brk, unsigned long, brk)

__SYSCALL_DEFINE1(1, _brk, unsigned long ,brk)

asmlinkage long sys_brk(unsigned long brk)

SYSCALL_DEFINE1(brk, unsigned long, brk)—> long sys_brk(unsigned long brk)

{

unsigned long rlim, retval;

unsigned long newbrk, oldbrk;

struct mm_struct *mm = current->mm;

unsigned long min_brk;

……

retval = mm->brk;

up_write(&mm->mmap_sem);

return retval;

}

Xen-ARM Guest DOM启动以及VCPU切换

tek-life — Wed, 15 Jun 2011 03:18:48 +0000

/*
从hypervisor到DOM的转换比较复杂，简单的步骤有两个阶段:
1.将guest的contest的寄存器信息赋值，其中还包括一些DOM设置信息
2.调用scheduler通过__switch_to调度到设置的VCPU上
*/
————hypervisor————-
construct_guest_dom()
{
…..
new_thread(v, dsi.v_kernentry, vstack_end, vstartinfo_start);
…..
}

void new_thread(struct vcpu *d, unsigned long start_pc, unsigned long start_stack, unsigned long start_info)
{
unsigned long *domain_stack;
struct cpu_info *ci;
struct cpu_user_regs *domain_context;
struct cpu_user_regs *regs = &d->arch.guest_context.user_regs;

domain_stack = alloc_xenheap_pages(STACK_ORDER);
if(domain_stack == NULL) {
return;
}

ci = (struct cpu_info *)domain_stack;
ci->cur_vcpu = d;

domain_stack += (STACK_SIZE – sizeof(struct cpu_user_regs))/sizeof(unsigned long);

domain_context = (struct cpu_user_regs *)domain_stack;
domain_context->r0 = 0;
domain_context->r12 = start_info;//参数传过来
domain_context->r13 = start_stack;
domain_context->r15 = start_pc;//DOM的启始地址

domain_context->psr = 0×13;

regs->r13 = (unsigned long)domain_stack;
regs->r14 = (unsigned long)ret_to_user;
}

调度VCPU代码：
open_softirq(SCHEDULE_SOFTIRQ, __enter_scheduler);

__enter_scheduler调用__switch_to,传给__switch_to的有三个参数：

#define switch_to(prev,next,last)                                       \
do {                                                                    \
__switch_to(prev,&prev->arch.guest_context, &next->arch.guest_context);   \
} while (0)

ENTRY(__switch_to)
disable_irq   ip           @ ensure IRQs are disabled
add     ip, r1, #(OFFSET_USER_REGS + OFFSET_R4)
save_ctx:
stmia   ip, {r4 – sl, fp, ip, sp, lr}      @ Store most regs on stack

mrc   p15, 0, r4, c3, c0, 0
str   r4, [r1, #(OFFSET_SYS_REGS + OFFSET_VDACR)]
load_ctx:
ldr   r4, [r2, #(OFFSET_SYS_REGS + OFFSET_VDACR)]
mcr   p15, 0, r4, c3, c0, 0

add   ip, r2, #(OFFSET_USER_REGS + OFFSET_R4)
enable_irq   r4
ldmia   ip, {r4 – sl, fp, ip, sp, pc}       @ Load all regs saved previously

@ mov pc, lr
nop
nop
b .

————-dom——————–
ENTRY(stext)
ldr r10, start_info //start_info的地址 -> r10
str r12, [r10] //r12的值 -> xen_start_info变量(start_info标记处)

ldr sp, __init_sp //sp->13

b start_kernel //进入Guest KERNEL

start_info:
.long xen_start_info

怎样向Android社区提交代码

tek-life — Fri, 27 May 2011 09:19:59 +0000

向开源社区贡献代码的方式很多，Android采用repo的方式。

由于在提交patch的时候，必须使用repo upload命令，所以，首先要安装repo在自己的项目中。安装repo在自己项目的步骤分两步：
1-1.
$ curl http://android.git.kernel.org/repo > ~/bin/repo
$ chmod a+x ~/bin/repo

1-2.然后把~/bin加入到PATH环境变量中，如果不加的话，用repo就需要全路径，比较麻烦，不管怎样，下面这一步是可选的：

$ export PATH=~/bin:$PATH

2.安装repo到自己的项目中，只有安装到自己项目中后，才可以使用repo，即使是repo help也不例外。

$ repo init -u git://android.git.kernel.org/platform/manifest.git

题外话：使用repo比使用git更麻烦，在教育网中，repo platform几乎是不能完成的任务，当然，可以使用git proxy，不过这种方法并不好使，一个简单且方便的方法是搞一个VPS 。

如果自己要提交的project没有在manifest管辖的范围内，那就需要自己去修改.repo/manifest.xml文件了。
比如，我要修改的Project项目名称是kernel/common，路径是kernel/common，而这个Project并没有在manifest.xml，所以在.repo/mainfest.xml文件中添加这么一行：

然后运行repo sync去下载整个platform，整个platform的容量基本上2GB左右，如果没有必要下载那么多的项目，修改.repo/manifest.xml，只保留自己的项目就可以了。
比如，我只需要其中的platform/build项目，那么在.repo/manifest.xml中只保留的条目就可以了，更改.repo/manifest.xml修改为：

fetch="git://android.git.kernel.org/"
review="review.source.android.com" />
remote="korg" />

root.mk" dest="Makefile" />

在repo sync的时候，可能会弹出如下的错误：

error: revision master in kernel/common not found

这是因为，在manifest.xml中，默认的revision为master。因此，需要在相关的项目中设置revision。例如：我需要kernel/common项目中的android-2.6.27分支,那么，应该在manifest.xml中写为：

repo sync完成后，进入相关的项目,建立一个分支，修改后，并提交.

例如，
$cd kernel/common #进入项目目录中
$repo start goldfish . #建立一个新的goldfish分支
$git checkout goldfish #切换到goldfish分支上
完成修改任务
$git add .
$git commit

Android社区要求提交的commit：

Start with a one-line summary (60 characters max), followed by a blank line.
The description should focus on what issue it solves, and how it solves it. The second part is somewhat optional when implementing new features, though desirable.
Include a brief note of any assumptions or background information that may be important when another contributor works on this feature next year.

然后就可以repo upload了，不过在upload的时候，需要在https://review.source.android.com/中注册并提交自己的ssh public keys.
提交完成ssh public keys后，就OK啦，成功后，会自动返回一个review。然后等待人工review，这一切，都可以在https://review.source.android.com 中看到。

友情提示：欢迎转载，转载请说明出处。如果有任何问题，欢迎批评,交流，指正。

<全文完>

关于Makefile

tek-life — Sat, 07 May 2011 02:59:20 +0000

几乎所有的Linux项目都是使用make来进行项目管理的.make是依据Makefile来进行工作的.因此书写和阅读Makefile就是Linux程序员必备的一项基本功.

对于像我这样的newbie，写一个稍微复杂的Makefile必定会错误百出，原因是Makefile的命令语法与bash有相似之处,但是还有许多细节上的差别,比如

赋值bash要求"="两边是不能有空格的,但是Makefile就允许.
在bash中用if条件判断,就像VB一样,但是如果要在Makefile中使用的话,需要写到一行中,如果写不下,需要用"\"来告诉make,下面的一行和上面的这一行属于一个逻辑行.
Makefile还对TAB,空格有严格的要求,这个仿佛就像是Python.如果你不TAB就写一个命令,make不认为是一个命令,而如果写个ifdef而用了TAB的话,make会把ifdef当作一个命令来执行,而不是一个条件判断.
exit在Makefile中貌似起不到Bash中的效果,你要在Makefile中控制其执行情况必须用error才可以.

读Makefile就是执果索因(这是别人总结的),根据结果顺瓜摸藤,就比较容易了.而对于Makefile的语法如果单单能够要求读懂的话，也是比较简单。

一般情况，在一个项目中，用Makefile就完全能够进行项目管理了。但一些项目会由像Rules.mk,Post.mk之类的东西让我们感到望而生畏，仿佛Make是一项深不可测的东西。其实Rules.mk和Post.mk同1.mk 2.mk没有什么区别。在一个论坛里面有下面一句话：

IIRC, traditionally, when people set up Makefiles and used files named rules.mk and make.mk, they put all the platform-independent stuff in make.mk, and all the platform-specific stuff in rules.mk. And then their Makefiles just included those, and each Makefile contained the things specific to each thing that was being built (like source filenames and such).

http://www.linuxquestions.org/questions/programming-9/rule-mk-and-make-mk-for-makefile-365498/

关于Makefile的学习，有一本介绍Makefile的电子书,写得非常好,它是由陈皓撰写,内容与文笔一样的优秀的–《跟我一起写Makefile》。需要下载的朋友，可以google之。BTW，能够表达能力极强的程序员着实太少，倘若都能够像陈皓这样，我们国家的计算机事业应该比印度高不少了吧。他的主页：http://coolshell.cn。

附录：

关于项目上的东西，以后时间久了，看它就可以了。

xenarm中的Makefile

Makefile生成的目标文件有4个: xen-bin xen xen.gz xen-syms

xen-bin

arch/arm/Makefile

17 $(TARGET): $(TARGET)-bin $(TARGET)-syms

18 @cp $(TARGET)-syms $@

fuck，xen-syms和xen原来是一个东西！

…

29 $(TARGET)-bin: $(TARGET)-syms

30 $(OBJCOPY) $(OBJCOPYFLAGS) $< $@

xen-syms

20 $(TARGET)-syms: arch-$(TARGET_MACHINE)/start.o $(ALL_OBJS) xen.lds

21 $(OBJCOPY) -I binary -O elf32-littlearm -B arm 24.bmp image.o

22 $(OBJCOPY) -I binary -O elf32-littlearm -B arm 8×16 en.o

23 #$(OBJCOPY) -I binary -O elf32-littlearm -B arm shut.wav sound.o

24 #$(OBJCOPY) -I binary -O elf32-littlearm -B arm mini mini.o

25 $(LD) $(LDFLAGS) -N -T xen.lds arch-$(TARGET_MACHINE)/start.o $(ALL_OBJS ) en.o image.o -o $@

xen

./Rules.mk

30 TARGET := $(BASEDIR)/xen

xen.gz

./Makefile

18 $(TARGET).gz: $(TARGET)

19 gzip -f -9 < $< > $@.new

20 mv $@.new $@

关于setjmp和longjmp

tek-life — Tue, 29 Mar 2011 02:00:29 +0000

前段时间看C专家编程遇到setjmp和longjmp,没有特别在意.这两天看深入理解计算机系统,再次提到setjmp和longjmp.觉得很巧妙,写个小程序测试一下其特性:

1 //longjmp每一次都跳到setjmp的地方,正所谓是保存了当时的堆栈情况
2 //如此看来,setjmp和longjmp的配对,和fork()函数有可比性:
3 //fork()一个函数执行两次,返回两个不同的值,一个是0,一个是subprocess id.
4 //而,longjmp则跳转到setjmp的位置,setjmp返回的值第一次是0,以后就由longjmp的参数决定
5
6 #include
7 #include
8 #include
9
10 sigjmp_buf buf;
11
12 void fun()
13 {
14 printf(“%s……….”,__func__);
15 longjmp(buf, 2);
16 exit(0);
17 }
18 void bar()
19 {
20 printf(“%s\n”,__func__);
21 exit(0);
22 }
23
24 void main()
25 {
26
27 int n;
28 printf(“Starting………”);
29 n=setjmp(buf);//第一次返回为0,下一次调用的情景是遇到longjmp,返回值为longjmp的第二个参数
30 printf(“Restarting………”);
31 if(n ==1)
32 fun();
33 if(n ==2 )
34 bar();
35
36 while(1)
37 {
38 longjmp(buf,1);
39 printf(“I cannot appear.\n”);
40 }
41 exit(0);
42 }
~
输出:
haifeng@Tek-life:~/tmp$ ./a.out
Starting………Restarting………Restarting………fun……….Restarting………bar

在Android Console中添加Busybox和Bash

tek-life — Tue, 22 Mar 2011 09:21:49 +0000

整个过程分两部分：
第一部分：将busybox 和 bash 通过adb push 推到/data目录下
第二部分：更改init.rc，将PATH环境写入ramdisk.img中
第一部分：
下载bash和busybox,然后按照下面的步骤，step by
step:（由于bash和busybox的链接大部分已经失效，我手动编译了两个，作为附件放在页面底部）
#adb shell mkdir /data/busybox
#adb push busybox /data/busyobx
#adb push bash /data/busybox
//adb shell，进入android
#cd /data/busyobx
#chmod +x busybox bash
#./busybox –install //将程序安装在当前目录下
#export PATH=/data/busybox:$PATH
至此，已经可以使用busybox和bash了。但是很麻烦，每次都需要在前面加上busybox。
因此，最好是将环境变量直接在初始化的时候就指定，因此需要更改ramdisk.img中的init.rc
第二部分
更改init.rc
1）将ramdisk.img复制其他目录，名称改为ramdisk.img.gz，解压
#gunzip ramdisk.img.gz
//新建一个文件夹ramdisk，进入
#cpio -i -F ../ramdisk.img
这时，可到ramdisk中看看去~
2）修改init.rc，在PATH中加上busybox 路径
3）重新打包成镜像，并使用新镜像启动emulator
#cpio -i -t -F ../ramdisk.img > list
#cpio -o -H newc -O rd_busybox.img < list

//使用 -ramdisk 参数，指定所使用的镜像文件
–over—
bash:https://docs.google.com/uc?id=0ByKC30p2j_DDMmM3Zjk5YzItM2U2NC00NGZkLTk4MGYtMmU3ZDgyNTY0MWUz&export=download&hl=zh_CN
busybox:
这里面有一堆 http://www.busybox.net/downloads/binaries
也可以使用：https://docs.google.com/uc?id=0ByKC30p2j_DDM2RhMWEyNjEtZDVlZC00MDcyLTk3MjktZDczMzc5YTc4NDI5&export=download&hl=zh_CN

在ubuntu中通过ndiswrapper使用无线网卡

tek-life — Sun, 20 Mar 2011 04:06:01 +0000

首先，科普一下ndiswrapper:

NDISwrapper is a free software driver wrapper that enables the use of Windows XP drivers for network devices (PCI cards, USB modems, and routers), on Unix-like operating systems. NDISwrapper works by implementing the Windows kernel and NDIS APIs, and dynamically linking the Windows drivers to this implementation. It therefore works only on systems based on the architectures supported by Windows, namely IA-32 or x86-64.

对于那些厂商提供Linux驱动的网络硬件，就不许要这个ndiswrapper啦。我使用的是NETGEAR，是老美生产的无线网卡，但不提共LINUX的驱动。具体型号是NETGEAR WNA3100，之前在Ubuntu10.10上，使用自编译的ndswripper,老连不上。但是使用debian可以。

今天，由于Debian老出问题，而且ubuntu10.10也推出了中国定制版，于是，便安装了Ubuntu。在图书馆，都使用无线的网络。因此，要安装包，必须先到xp下面下载后，在重启进入Ubuntu安装，相当麻烦。

由于NETWEAR官方没有出LINUX的驱动，因此需采用ndiswrapper这个工具来加载windows驱动。在ubuntu中，已经自带了ndiswrapper程序，位于/usr/sbin/ndiswrapper-1.9.

具体使用的方法，可以查看Help.

先ndiswrapper-1.9 -i bcmwlhigh5.inf.inf #安装windows driver.
然后ndiswrapper-1.9 -m #将配置信息写到modprobe中。
然后sudo modprobe ndiswrapper #将模块插入到KERNEL中。
这个时候，基本上就OK了。
可以使用nm-tool查看网络信息：

haifeng@haifeng-Alviso:~$ nm-tool

NetworkManager Tool

State: connected

- Device: eth0 —————————————————————–
Type: Wired
Driver: 8139too
State: unavailable
Default: no
HW Address: 00:E0:4C:4F:03:BB

Capabilities:
Carrier Detect: yes
Speed: 10 Mb/s

Wired Properties
Carrier: off

- Device: wlan0 [Auto Hust-wireless] ——————————————
Type: 802.11 WiFi
Driver: ndiswrapper
State: connected
Default: yes
HW Address: 00:26:F2:4F:AF:A0

Capabilities:
Speed: 52 Mb/s

Wireless Properties
WEP Encryption: yes
WPA Encryption: yes
WPA2 Encryption: yes

Wireless Access Points (* = current AP)
Hust-wireless: Infra, 3C:E5:A6:93:F5:70, Freq 2437 MHz, Rate 54 Mb/s, Strength 35
*Hust-wireless: Infra, 3C:E5:A6:93:40:F0, Freq 2462 MHz, Rate 54 Mb/s, Strength 79
Hust-wireless: Infra, 3C:E5:A6:93:7A:90, Freq 2437 MHz, Rate 54 Mb/s, Strength 26
Hust-wireless: Infra, 3C:E5:A6:93:F6:F0, Freq 2437 MHz, Rate 54 Mb/s, Strength 45
Connectify-me: Infra, 00:1F:3A:42:94:9D, Freq 2437 MHz, Rate 54 Mb/s, Strength 31 WPA2

IPv4 Settings:
Address: 115.156.228.246
Prefix: 24 (255.255.255.0)
Gateway: 115.156.228.254

DNS: 202.114.0.242

采用系统自带的ndiswrapper可能会有问题，我认证不成功，说是，用户名密码错误。sign!

在ubuntu的仓库中下载相应的安装包，我下载的地址：
http://ubuntu.uestc.edu.cn/ubuntu/pool/main/n/ndiswrapper/
下载ndiswrapper-common_1.56-3_all.deb ndiswrapper-utils-1.9_1.56-3_i386.deb
两个最新版本的deb即可。
然后dpkg -i 安装之。

然后 ndiswrapper -i ;ndiswrapper -m 就OK了。
采用1.56版本的这个ndiswrapper木有出现问题。

Enjoy!

ubuntu 10.10 安装systemtap 补充

tek-life — Fri, 18 Mar 2011 03:10:47 +0000

前几天，看到yufeng的日志(http://blog.yufeng.info/archives/1098)有介绍ubuntu10.10安装systemtap的方法，尝试并安装成功(http://haifeng-hust.blogspot.com/2011/03/ubuntu1010systemtap.html)。但是这种方法安装出来的stap在pass3编译ko的时候经常出问题。因此利用deb包半手工安装。

在http://ftp.debian.org/debian/pool/main/s/systemtap/的页面中有两个版本1.4.1和1.2.5.就目前10.10版本的ubuntu，安装1.4.1时依赖包libdw1需要1.4.9版本，但是对于deb包，最高的就是1.4.7版本。因此只要降低systemtap的版本。

由于在安装1.4.7的时候，没有安装成功，这时候，无论安装什么包都会提示sudo apt-get install
-f，非常烦人。除去提示的方法就是用sudo dpkg -r 卸载刚才没有安装成功的包。

到http://ftp.debian.org/debian/pool/main/s/systemtap/上面下载1.2.5版本的三个包systemtap-runtime
systemtap-common
systemtap.然后在安装systemtap1.2.5的时候，会发生libsqlite依赖包版本过低的问题。因此需要升级libsqlite，升级包地址请猛击：http://packages.debian.org/squeeze/i386/libsqlite3-0/download

然后安装之。这时候，就可以安装systemtap了。

然后测试：
sudo tap -ve ‘probe begin{printf(“Hello world\n”);exit();}’
sudo tap -ve ‘probe
kernel.function(“sys_open”).return{printf(“%s\n”,execname());exit();}’

另外一个比较纠结的问题是，有时候会莫名其妙重启系统。另外，这个stap的版本较老，一些参数比如 -l 不能识别。

使用VNCServer

tek-life — Thu, 17 Mar 2011 02:51:55 +0000

通过VNCServer，可以远程使用桌面，而不用老是对着黑漆漆的tty。安装步骤如下：

安装vnc4server
haifeng@Tek-life:~$ sudo apt-get install vnc4server

然后配置vncserver
haifeng@Tek-life:~$ vim .vnc/xstartup
1 #!/bin/sh
2
3 # Uncomment the following two lines for normal desktop:
4 unset SESSION_MANAGER
5 # exec /etc/X11/xinit/xinitrc
6
7 #[ -x /etc/vnc/xstartup ] && exec /etc/vnc/xstartup
8 #[ -r $HOME/.Xresources ] && xrdb $HOME/.Xresources
9 xsetroot -solid grey
10 #vncconfig -iconic &
11 x-terminal-emulator -geometry 80×24+10+10 -ls -title “$VNCDESKTOP Desktop” &
12 exec /etc/X11/xinit/xinitrc
13 #x-window-manager &
14 #gnome-session &

好了，配置结束
创建密码
haifeng@Tek-life:~$ vncpasswd
Password:
Verify:
然后，开个VNC服务
haifeng@Tek-life:~$ vncserver :20
xauth: /var/run/gdm/auth-for-haifeng-OFLDyx/database not writable, changes will be ignored

New ‘Tek-life:20 (haifeng)’ desktop is Tek-life:20

Starting applications specified in /home/haifeng/.vnc/xstartup
Log file is /home/haifeng/.vnc/Tek-life:20.log
这样，其他用户登录的时候，就用:
vncserver ip :20
比如，我的IP是192.168.205.110,那么用vncview登录时候，就填入：
192.168.205.110:20
然后密码就填刚才vncpasswd时设定的密码。
如果要想关闭，很简单：
haifeng@Tek-life:~$ vncserver -kill :20
就OK了。
截个屏：

Enjoy it!

在ubuntu10.10中安装Systemtap

tek-life — Wed, 16 Mar 2011 07:42:10 +0000

SystemTAP是个好东西。属于居家必备的工具之一。这两天安装了一下，其中还蛮折腾的。

安装步骤：
sudo apt-get install systemtap
Ubuntu Desktop默认没有安装kernel debug info的包，systemtap无法追踪内核信息。查看内核版本
haifeng@Tek-life:~$ uname -a Linux Tek-life 2.6.35-27-generic #48-Ubuntu SMP Tue Feb 22 20:25:29 UTC 2011 i686 GNU/Linux
从这里下载对应的kernel debug info包，安装
sudo dpkg -i linux-image-2.6.35-27-generic-dbgsym_2.6.35-27.48_i386.ddeb
至此内核追踪已经可以执行，但module的信息还需要多做些工作
sudo apt-get install elfutils
将以下内容保存为script.sh,并改变为可执行
1 #!/bin/bash
2 for file in `find /usr/lib/debug -name ‘*.ko’ -print`
3 do
4 buildid=`eu-readelf -n $file| grep Build.ID: | awk ‘{print $3}’`
5 dir=`echo $buildid | cut -c1-2`
6 fn=`echo $buildid | cut -c3-`
7 rm -rf /usr/lib/debug/.build-id
8 mkdir -p /usr/lib/debug/.build-id/$dir
9 ln -s $file /usr/lib/debug/.build-id/$dir/$fn
10 ln -s $file /usr/lib/debug/.build-id/$dir/${fn}.debug
11 done
基本上就OK了。
测试：
haifeng@Tek-life:~$ stap -l ‘module(“*”).function(“*”)’
不输出错误信息。
如果输出错误信息的话，核实安装的linux-image-debug那个ddeb包。如果确实不是包的问题，升级KERNEL。我就是升级了KERNEL，才OK的。搞了2天，他妈的，教育网网速太慢了。

再测试Hello World

haifeng@Tek-life:~$ sudo stap -ve ‘probe begin{printf(“hello”); exit();}’
Pass 1: parsed user script and 72 library script(s) using 18892virt/12732res/1880shr kb, in 140usr/10sys/149real ms.
Pass 2: analyzed script: 1 probe(s), 1 function(s), 0 embed(s), 0 global(s) using 19156virt/13260res/2008shr kb, in 10usr/0sys/5real ms.
Pass 3: using cached /home/haifeng/.systemtap/cache/60/stap_606e63ba024e3858ea3a7591bcec7a4c_670.c
Pass 4: using cached /home/haifeng/.systemtap/cache/60/stap_606e63ba024e3858ea3a7591bcec7a4c_670.ko
Pass 5: starting run.
helloPass 5: run completed in 0usr/10sys/300real ms.

如果其中哪一个pass出错，同样核实安装的ddeb包是否和内核版本对应。确实对应，那么就升级自己的KERNEL，照此再做一遍。

这两天再对照一些Tutorial,学习一下。
参考：
1.http://sourceware.org/systemtap/wiki/SystemtapOnUbuntu
2.http://www.ningoo.net/html/2010/use_systemtap_on_ubuntu.html
3.http://blog.yufeng.info/archives/1098

让oklinux跑起来

tek-life — Wed, 02 Mar 2011 12:39:18 +0000

oklinux是让修改过的linux跑在okl4虚拟机上。网上缺乏针对于oklinux的运行总结。在下不才，折腾好久，才编译运行成功，遂记录之，以方便后来者。
下载地址：
okl4:http://wiki.ok-labs.com/downloads/release-3.0/okl4_3.0.tar.gz
linux:http://wiki.ok-labs.com/downloads/release-3.0/oklinux_2.6.24.9-patch.4.tar.gz
分别解压okl4和linux.在okl4的目录中建一个指向Linux目录的软连接：
$cd okl4_3.0
$ln -s ../linux-2.6.24.9-patch.4 linux

编译源码还需要交叉编译器。交叉编译器的下载地址
EABI:http://wiki.ok-labs.com/downloads/release-3.0/arm-linux-gnueabi-4.2.4.tar.gz
OABI：http://www.ertos.nicta.com.au/downloads/tools/arm-linux-3.4.4.tar.gz
将这两个交叉交叉编译器解压后，更改okl4_3.0/tools/toolchains.py中的：
gnu_arm_eabi_toolchain . gnu_arm_nptl_toolchain . arm_linux_toolchain，使之指向自己本机中编译器的正确位置。

然后，进入okl4_3.0，运行：
./tools/build.py machine=versatile project=linux wombat=true TOOLCHAIN=gnu_arm_eabi_toolchain pistachio.TOOLCHAIN=gnu_arm_toolchain PYFREEZE=False kdb_serial=True KDB_BREAKIN=False
可能出现的错误以及解决方法：
1.提示arm-linux-g++找不到。
在PATH中加上相应的arm-linux-g++的bin目录就可以了。
export PATH=$PATH:/path/to/bin/
2.提示phthon版本不正确。
okl4采用python2.4版本。因此,安装python2.4。在ubuntu下sudo apt-get install python2.4 .
然后改变/usr/bin/python连接的位置指向python2.4即可
3.在生成ext2ramdisk的时候出现错误。这个时候，可以按照如下的办法进行操作：
先安装genext2fs.
然后更改 tools/kenge.py
改1438行开始的
def Ext2FS(self, size, dev):
genext2fs = SConscript(os.path.join(self.oklinux_dir, “tools”,
“genext2fs”, “SConstruct”),
build_dir=os.path.join(self.builddir,
“native”, “tools”, “genext2fs”),
duplicate=0)
ramdisk = self.builddir + os.sep + “ext2ramdisk”
cmd = self.Command(ramdisk, Dir(os.path.join(self.builddir,
“install”)),
genext2fs[0].abspath +
” -b $EXT2FS_SIZE -d $SOURCE -f $EXT2FS_DEV
$TARGET”,
EXT2FS_SIZE=size, EXT2FS_DEV=dev)

Depends(cmd, genext2fs)

# always regenerate the ramdisk file
AlwaysBuild(cmd)
return cmd
为

def Ext2FS(self, size, dev):
#genext2fs = SConscript(os.path.join(self.oklinux_dir, “tools”, “genext2fs”, “SConstruct”),
# build_dir=os.path.join(self.builddir, “native”, “tools”, “genext2fs”),
# duplicate=0)
ramdisk = self.builddir + os.sep + “ext2ramdisk”
cmd = self.Command(ramdisk, Dir(os.path.join(self.builddir,
“install”)),
# genext2fs[0].abspath +
“genext2fs -b $EXT2FS_SIZE -d $SOURCE -D $EXT2FS_DEV $TARGET”,
EXT2FS_SIZE=size, EXT2FS_DEV=dev)

# Depends(cmd, genext2fs)

# always regenerate the ramdisk file
AlwaysBuild(cmd)
return cmd
至此，便可以生成img文件
－－－－－－－－－－－－－－－－－－任务完成一大半——–
然后安装qemu-system-arm
下载
http://wiki.ok-labs.com/downloads/release-3.0/qemu-okl.0.9.1.tar.gz
编译
# ./configure –target-list=arm-softmmu –disable-sdl –static –disable-gfx-check
# make
运行
# qemu-system-arm -M versatileab -start-addr 0×04100000 -nographic -kernel path/to/images/image.elf

汇编代码杂记

tek-life — Tue, 01 Mar 2011 08:08:35 +0000

一直没有在汇编中写过代码。而且读一些复杂的代码，还有一些吃力。并且自己在ARM体系结构方面的基本功非常薄弱，仅仅是看过杜春雷同学写的那本《ARM体系结构与编程》的教材，偶尔看一下网上同学总结的一些ARM指令的野史笔记。

由于要追踪一下项目中页表的建立流程，由于枝叶比较繁茂，并且深入汇编代码之中，因此，不能充分利用野蛮并且笨拙的Printk，于是便需要在汇编中调用自己写的C函数，然后让流程重新回到汇编中，继续徜徉。

让汇编调用C中的函数，在网上的文章一抓一大把，可是让C中的函数重新返回到汇编中，不着痕迹得继续运行，却没有这样的总结性文章。无奈之下，重新从download.csdn.net中下载到ARM指令集（以前看过，但由于一次误操作，将之永久驱逐出俺的硬盘中），By the way，这个ARM指令集确实不错，有需要的同学到csdn资源中心去自己寻找吧。下面把俺的情况说一下：

ENTRY(cpu_arm926_set_pte_ext)

mov r3, r1

eor r3, r3, #L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_WRITE | L_PTE_DIRTY

bic r2, r3, #PTE_SMALL_AP_MASK

bic r2, r2, #PTE_TYPE_MASK

orr r2, r2, #PTE_TYPE_SMALL

tst r3, #L_PTE_USER @ User?

orrne r2, r2, #PTE_SMALL_AP_URO_SRW

tst r3, #L_PTE_WRITE | L_PTE_DIRTY @ Write and Dirty?

orreq r2, r2, #PTE_SMALL_AP_UNO_SRW

tst r3, #L_PTE_PRESENT | L_PTE_YOUNG @ Present and Young?

movne r2, #0

b hypervisor_set_pte

我要做的事情是，在hypervisor_set_pte之前调用一个自写的C函数。由于后面还有b hypervisor_set_pte.而hypervisor_set_pte这个函数返回后，返回到lr所指定的地址中去，因此在调用自写的C函数时，必须要保存lr的值。
至此，在b hypervisor_set_pte之前加上：

stmfd sp!, {lr}

bl test

ldmfd sp!, {lr}

这样似乎很完美了。可是编译执行后，虽然是完成了test函数的功能，但却出现了取值异常。根据分析，不应该出现得啊。后来，经过同学的分析，是不是有可能破坏了其他的寄存器？我测试了一下，把r0清0后，然后b hypervisor_set_pte，编译运行的结果也出现错误，显然，确实是其他寄存器需要被hypervisor_set_pte使用。于是，

stmfd sp!,{r0,lr}

bl test

ldmfd sp!,{r0,lr}

编译运行的结果仍然不正确。索性，

stmfd sp!, {r0-r12, lr}

bl test

ldmfd sp!, {r0-r12, lr}

编译运行后，哦，世界一片宁静。太棒了。
由此，写汇编一定要仔细，谨慎。尽量做到万无一失，就好似做POJ上的题目，每一种条件都要想到，否则一直WA。通过这个错误，马上连想到，第一次写驱动时，malloc后忘记free的窘状，明明一切逻辑都正确，为什么运行不起来？哦，原来是内存耗完了。

写此篇，以纪念在ARM汇编中写上第一行代码。

关于asm-offsets的一些说明

tek-life — Wed, 23 Feb 2011 04:07:53 +0000

对Kbuild里面的asm-offsets一直不太清楚，找到了一个RFC,并简单翻译了一下。详见http://marc.info/?l=linux-kernel&m=100219616028442&w=2

Almost every architecture generates Assembler values to map the offsets of fields in C structures, about the only exception is i386 and that is because its offsets are hard coded into entry.S. Every arch has done it differently, none of them have got it exactly right.
几乎所有的体系结构都会产生汇编的值去和C语言中的数据结构各个域的偏移相对应。但x86是一个例外，因为它的偏移是硬编码的，具体可以参考entry.S.没一种体系结构都是不一样的，但几乎没有一个能够对应的十分准确。

As part of kbuild 2.5 I am standardizing on one method for generating Assembler offsets. This change is required for kbuild 2.5 but it can be added to 2.4 without disturbing the current kbuild, I want to do this gradually now instead of a single massive change in kernel 2.5. I will be issuing per architecture changes for generating Assembler offsets against 2.4.
从kbuild2.5开始，我就开始做了一个标准化的方法去生成汇编的相对偏移。如果你的kbuild是2.4版本的，也可以是用kbuild2.5的这个标准化方法。我想逐步的把这个方法加入到2.5的Linux Kernel中，重点是针对各个架构的不同点。

The kbuild 2.5 method for generating Assembler offsets satisfies these requirements:
在Kbuild 2.5中，要使用这个标准化的方法，需要满足的一下几点：
* No manual intervention required. Many architectures rely on users running make dep after changing config options that affect the Assembler offsets. If the user forgets to run make dep then the C and Assembler code is out of sync – totally unacceptable. This is completely fixed in kbuild 2.5; I cannot do a complete fix in kbuild 2.4 but it is still better than the existing manual system.
不需要人工干预。你只要配置好config，然后make dep就可以啦。如果忘记了make dep，那么后果很严重，C和汇编代码就不会对应，会产生错误。不过，如果你采用2.5,这个问题已经被修复了。虽然我没有在kbuild2.4里面这样做，但是，如果你是用kbuild2.4这样的版本，总比完全手动要好的多吧。
* Standard name for the related files. There are 6+ different names for the files used to generate Assembler offsets, kbuild 2.5 uses asm-offsets.[csh] on all architectures.
相关文件都采用了标准名字。有6个不同名字的文件用来产生汇编的偏移,从kbuild2.5开始，在所有的体系结构中，只采用了asm-offsets.c .h 和.s
* Allows for multiple parallel compiles from the same source tree. Writing the generated asm-offsets.h to include/asm is not an option, it prevents concurrent compiles.
在同一个工作目录下，允许并行编译。通过向include/asm下面写声称的asm-offsets.h，会阻止并发编译。
* The method must work in native and cross compile mode and give exactly the same results. Some 2.4 code only works in native mode, some architectures have different methods for native and cross compile with different output formats. Yeuch!
使用这种方法必须能够保证采用编译器和交叉编译器都能得到同样的计算结果。在2.4版本中就不太好。
* Standard scripts for generating the output. Every arch does it differently in 2.4, standards are good!
采用标准化的脚本来产生输出，这一点在2.4版本中已经做得比较好了。
* Correct dependency trees. Because 2.4 make dep does not scan .S files, there is little or no dependency information. Even if the offsets are regenerated, the affected Assembler code does not always get rebuilt. kbuild 2.5 handles dependencies for Assembler as well as C; I cannot get kbuild 2.4 perfect but I can improve on the existing (or non-existent) 2.4 dependencies.
还是依赖问题。在2.4版本中make dep 不会扫描.S文件。即使重新编译声称asmoffsets，那些汇编代码也不会重新编译。在2.5版本中已经解决了这个问题。我不能让2.4版本完美，但我会想办法提高2.4版本所存在的依赖问题
All architectures will define arch/$(ARCH)/asm-offsets.c. This has a standard prologue for the macros that convert offsets to Assembler, followed by arch specific field references.
所有的架构会定义asm-offsets.c文件，这是一个标准的宏文件将会根据体系结构的信息产生相应汇编代码中的偏移位置。
arch/$(ARCH)/asm-offsets.s is generated from arch/$(ARCH)/asm-offsets.c using standard rules, although kbuild 2.4 needs some tweaking.
asm-offsets.s由asm-offsets.c产生。
arch/$(ARCH)/asm-offsets.h is generated from arch/$(ARCH)/asm-offsets.s by a semi-standard script. Most of the script is common to all architectures but the precise format of the Assembler output is arch specific.
asm-offsets.h由asm-offsets.s产生。各个平台产生代码所是用的脚本大部分都是一样的，但在细微的格式上可能会产生平台差别。
The final result is included in *only* the Assembler programs that need it, as #include asm-offsets.h” with -I arch/$(ARCH) in the relevant Makefiles. Hard coding relative paths in source files is a pet hate, use #include “localname.h” and -I instead. Including the generated
file in C code is not allowed, it severly pollutes the dependency chain, to the extent that any config change can force a complete recompile, unacceptable.
通过在makefile中采用－I arch/$(ARCH)参数，使最后的结果包含在了要使用的汇编程序中。如果要是用硬编码的话就在汇编源文件中用#include来包含,C文件就不需要了，切记！否则，会产生不必要的麻烦。

XEN-ARM定时器管理算法简要总结

tek-life — Thu, 20 Jan 2011 09:29:01 +0000

XEN-ARM的定时器优先队列管理算法采用的是最小堆。关于最小堆的知识，请参考

《算法导论》第二版第6章堆。

下面是简要流程。欢迎讨论

/*初始化定时器*/

void __init timer_init(void)

{

static struct timer *dummy_heap;

int i;

open_softirq(TIMER_SOFTIRQ, timer_softirq_action);

* All CPUs initially share an empty dummy heap. Only those CPUs that

* are brought online will be dynamically allocated their own heap.

SET_HEAP_SIZE(&dummy_heap, 0);

SET_HEAP_LIMIT(&dummy_heap, 0);

for ( i = 0; i < NR_CPUS; i++ )

{

spin_lock_init(&timers[i].lock);

timers[i].heap = &dummy_heap;

}

当软中断发生时，函数执行

在定时器优先队列中查找满足expires的定时器，从队列中摘除，然后执行之

static void timer_softirq_action(void)

{

int cpu = smp_processor_id();

struct timer *t, **heap;

s_time_t now;

void (*fn)(void *);

void *data;

DPRINTK(5, “%s:%d\n”, __FUNCTION__, __LINE__);

spin_lock_irq(&timers[cpu].lock);

do {

heap = timers[cpu].heap;

now = NOW();

//以此取定时器优先队列中最优先定时器

//然后执行其过程

while ( (GET_HEAP_SIZE(heap) != 0) && ( (t = heap[1])->expires < (now + (s_time_t)TIMER_SLOP) ) )

{

remove_entry(heap, t);

timers[cpu].running = t;

fn = t->function;

data = t->data;

//printk(“fn:%x”, fn);

spin_unlock_irq(&timers[cpu].lock);

//执行定时器操作

(*fn)(data);

DPRINTK(5, “%s:%d\n”, __FUNCTION__, __LINE__);

spin_lock_irq(&timers[cpu].lock);

/* Heap may have grown while the lock was released. */

heap = timers[cpu].heap;

}

timers[cpu].running = NULL;

}while ( !reprogram_timer(GET_HEAP_SIZE(heap) ? heap[1]->expires : 0) );//如果有定时器，小于now()，那么就继续loop

DPRINTK(5, “%s:%d\n”, __FUNCTION__, __LINE__);

spin_unlock_irq(&timers[cpu].lock);

}

Delete @t from @heap. Return TRUE if new top of heap.

摘除定时器会用到down_heap 和 up_heap来调整最小堆。

static int remove_entry(struct timer **heap, struct timer *t)

{

int sz = GET_HEAP_SIZE(heap);

int pos = t->heap_offset;

//t->heap_offset

t->heap_offset = 0;

//–如果删除的元素是最后的，那么就不需要做调整啦~~,仅仅是heap-size减一就可以咯

if ( unlikely(pos == sz) )

{

SET_HEAP_SIZE(heap, sz-1);

goto out;

}

//–把最后一个元素填上来，这是最小堆的精髓！

heap[pos] = heap[sz];

heap[pos]->heap_offset = pos;

SET_HEAP_SIZE(heap, –sz);

//如果是中间节点，并且小于父母的，那么就需要up_heap

//如果是根结点，或者暂时不小于父母的，那么就是down_heap

if ( (pos > 1) && (heap[pos]->expires < heap[pos>>1]->expires) )

up_heap(heap, pos);

else

down_heap(heap, pos);

out:

return (pos == 1);

}

/* Float element @pos up @heap. */

static void up_heap(struct timer **heap, int pos)

{

struct timer *t = heap[pos];

//根节点的expires最小-－

//具体算法是，自底向上，循环保证最小堆的性质

while ( (pos > 1) && (t->expires < heap[pos>>1]->expires) )

{

heap[pos] = heap[pos>>1];

heap[pos]->heap_offset = pos;

pos >>= 1;

}

heap[pos] = t;

t->heap_offset = pos;

}

/* Sink down element @pos of @heap. */

static void down_heap(struct timer **heap, int pos)

{

//自顶向下插入一个元素时的方法

int sz = GET_HEAP_SIZE(heap), nxt;

struct timer *t = heap[pos];

while ( (nxt = (pos << 1)) <= sz )

{

//nxt是left-subtree nxt+1是right-subtree

if ( ((nxt+1) <= sz) && (heap[nxt+1]->expires < heap[nxt]->expires) )

nxt++;//–better than the book of < the introduction of algorithm >

if ( heap[nxt]->expires > t->expires )//如果保证了最小堆，就是找到了～～

break;

heap[pos] = heap[nxt];

heap[pos]->heap_offset = pos;

pos = nxt;

}

heap[pos] = t;

t->heap_offset = pos;

}

/*下面附上相关的一些函数*/

/****************************************************************************

* HEAP OPERATIONS.

#define GET_HEAP_SIZE(_h) ((int)(((u16 *)(_h))[0]))

#define SET_HEAP_SIZE(_h,_v) (((u16 *)(_h))[0] = (u16)(_v))

#define GET_HEAP_LIMIT(_h) ((int)(((u16 *)(_h))[1]))

#define SET_HEAP_LIMIT(_h,_v) (((u16 *)(_h))[1] = (u16)(_v))

/****************************************************************************

* TIMER OPERATIONS.

static inline void __add_timer(struct timer *timer)

{

static int tmp_count;

printk(“__add_timer:%d\n”,tmp_count++);

int cpu = timer->cpu;

if ( add_entry(&timers[cpu].heap, timer) ){//如果是在最高优先级，那么就需要调用一下softirq

cpu_raise_softirq(cpu, TIMER_SOFTIRQ);

}

static inline void __stop_timer(struct timer *timer)

{

int cpu = timer->cpu;

if ( remove_entry(timers[cpu].heap, timer) )//如果删除了最优先的timer,才需要

cpu_raise_softirq(cpu, TIMER_SOFTIRQ);

}

static inline void timer_lock(struct timer *timer)

void set_timer(struct timer *timer, s_time_t expires)

{

unsigned long flags;

timer_lock_irqsave(timer, flags);

//现检测timer是否在队列中

if ( active_timer(timer) )

__stop_timer(timer);//从队列中除去先

timer->expires = expires;//更新expires

if ( likely(!timer->killed) )

__add_timer(timer);

timer_unlock_irqrestore(timer, flags);

}

void stop_timer(struct timer *timer)

{

unsigned long flags;

timer_lock_irqsave(timer, flags);

if ( active_timer(timer) )

__stop_timer(timer);

timer_unlock_irqrestore(timer, flags);

}

int reprogram_timer(s_time_t timeout)

{

s_time_t now;

s_time_t expire;

if ( timeout == 0 )

return 1;

now = NOW();

expire = timeout – now; /* value from now */

if ( expire <= 0 )

return 0;

return 1;

}

gcc装载具体库的的方法总结

tek-life — Thu, 20 Jan 2011 03:24:22 +0000

注：该总结主要来自:bugfly z的buzz.感谢bugfly z，以及回帖的盆友，如果有不完善的地方，欢迎拍砖。

1.环境变量LD_PRELOAD

LD_PRELOAD 后面接的是具体的库文件全路径，可以接多个

参考：http://blog.csdn.net/haoel/archive/2007/05/09/1602108.aspx

2.是方案1的变体。直接把库名加到列表加到/etc/ld.so.preload. 该方法会影响到系统里所有应用。

程序加载时，LD_PRELOAD加载路径优先级高于/etc/ld.so.preload

3. 环境变量LD_LIBRARY_PATH

LD_LIBRARY_PATH指定查找路径，这个路径优先级别高于系统预设的路径

假如现在需要在已有的环境变量上添加新的路径名，则采用如下方式：

LD_LIBRARY_PATH=NEWDIRS:$LD_LIBRARY_PATH.（newdirs是新的路径串）

4. gcc 中的 -L 和－l参数－Wl参数

放在/lib和/usr/lib和/usr/local/lib里的库直接用-l参数就能链接了，但如果库文件没放在这三个目录里，而是放在其他目录里，这时另外一个参数-L就派上用场了，比如常用的X11的库，它在/usr/X11R6/lib目录下，我们编译时就要用-L/usr/X11R6/lib -lX11参数，-L参数跟着的是库文件所在的目录名。

-Wl,表示后面的参数将传给link程序ld

5.LD程序硬编码了一些库搜索路径

查看方法：

00653000-0066e000 r-xp 00000000 08:07 1320479 /lib/ld-2.11.1.so

0066e000-0066f000 r–p 0001a000 08:07 1320479 /lib/ld-2.11.1.so

0066f000-00670000 rw-p 0001b000 08:07 1320479 /lib/ld-2.11.1.so

$ strings /lib/ld-2.11.1.so | grep lib

…

display library search paths

/lib/

/usr/lib/

/lib/i486-linux-gnu/

/usr/lib/i486-linux-gnu/

…

上面就是默认的装载路径, 直接在装载器里hardcode,

5.ldconfig也可以起到作用

ldconfig命令的用途,主要是在默认搜寻目录(/lib和/usr/lib)以及动态库配置文件/etc/ld.so.conf内所列的目录下,搜索出可共享的动态链接库(格式如前介绍,lib*.so*),进而创建出动态装入程序(ld.so)所需的连接和缓存文件.缓存文件默认为/etc /ld.so.cache,此文件保存已排好序的动态链接库名字列表.

运行ldconfig -v 可以看到所有的系统加载库

－－－－－－－－－－－－－－－

xenarm irq routine

tek-life — Thu, 06 Jan 2011 05:08:56 +0000

/*
当一个异常出现以后，ARM微处理器会执行以下几步操作：（这些是中断发生时，自动处理的）

1、将下一条指令的地址存入相应连接寄存器LR，以便程序在处理异常返回时能从正确的位置重新开始执行。若异常是从ARM状态进入，LR寄存器中保存的是下一条指令的地址（当前PC＋4或PC＋8，与异常的类型有关）；若异常是从Thumb状态进入，则在LR寄存器中保存当前 PC的偏移量，这样，异常处理程序就不需要确定异常是从何种状态进入的。例如：在软件中断异常SWI，指令MOV PC，R14_svc总是返回到下一条指令，不管SWI是在ARM状态执行，还是在Thumb状态执行。

2、将CPSR复制到相应的SPSR中。

3、根据异常类型，强制设置CPSR的运行模式位。

4、强制PC从相关的异常向量地址取下一条指令执行，从而跳转到相应的异常处理程序处。还可以设置中断禁止位，以禁止中断发生.当有异常发生时，处理器会跳转到对应的0xffff0000起始的向量处取指令，然后，通过b指令散转到异常处理代码．因为ARM中b指令是相对跳转，而且只有+/-32MB的寻址范围，所以把__stubs_start~__stubs_end之间的异常处理代码复制到了0xffff0200起始处．这里可直接用b指令跳转过去，这样比使用绝对跳转（ldr)效率高。
*/

        b       vector_undefined_instruction + stubs_offset
        ldr     pc, .LCvswi + stubs_offset
        b       vector_prefetch_abort + stubs_offset
        b       vector_data_abort + stubs_offset
        b       vector_addrexcptn + stubs_offset
        b       vector_irq + stubs_offset
        b       vector_FIQ + stubs_offset

#define INSTALL_VECTOR_STUB(name, offset, mode, correction, branch_table)
        vector_##name:
                vector_stub     offset, mode, correction, branch_table
        .macro vector_stub      offset, mode, correction, branch_table
        sub     sp, sp, #16
        sub     lr, lr, #correction @修正返回地址
        stmia   sp!, {r0, lr}

        mrs     r0, spsr @spsr保存的是cpsr的值
        mov     lr, #offset
        stmia   sp!, {r0, lr}

        mrs     lr, cpsr
        eor     lr, lr, #(mode ^ PSR_MODE_SVC)
        msr     spsr_cxsf, lr   @改变spsr以重启irq       @ switch to SVC_32 mode

        and     r0, r0, #15
        adr     lr, branch_table
        ldr     lr, [lr, r0, lsl #2]    @根据spsr内容来决定进入哪一个irq_
        sub     r0, sp, #16
        movs    pc, lr                          @ Changes mode and branches
        .endm

__irq_svc:
        save_svc_context
#ifdef CONFIG_MACHINE_VERSATILE
        get_irqnr_preamble r5, lr @ minsung
#endif
1:      get_irqnr_and_base r0, r6, r5, lr
        movne   r1, sp

        @
        @ routine called with r0 = irq number, r1 = struct pt_regs *
        @
        adrne   lr, 1b
        bne     asm_do_IRQ

        /* restore svc mode register */
        ldr     r0, [sp, #S_PSR]                @ irqs are already disabled
        msr     spsr_cxsf, r0
        ldmia   sp, {r0 – pc}^                  @ load r0 – pc, cpsr

        .macro save_svc_context
        sub     sp, sp, #S_FRAME_SIZE
SPFIX( tst     sp, #4                 )
SPFIX( bicne   sp, sp, #4             )
        stmib   sp, {r1 – r12}

        ldmia   r0, {r1 – r4}
        add     r5, sp, #S_SP
        add     r0, sp, #S_FRAME_SIZE
SPFIX( addne   r0, r0, #4  )
        str     r1, [sp]                @ Save real R0

mov r1, lr

        stmia   r5, {r0 – r4}
        .endm
/*
从下面这段程序可以看出来，
        如何获得goldfish中断号，
        如何获得goldfish状态

        如果没有中断号，还可以设置条件描述符
*/
        .macro get_irqnr_and_base, irqnr, irqstat, base, tmp
        ldr     base, =IO_ADDRESS(GOLDFISH_INTERRUPT_BASE)
        ldr     irqnr, [base, #GOLDFISH_INTERRUPT_NUMBER]
        ldr     irqstat, [base, #GOLDFISH_INTERRUPT_STATUS]
        teq     irqstat, #0
        /* EQ will be set if no irqs pending */
        .endm

/*
时间中断来了，仅仅是打开了一个软中断而已。
*/
irqreturn_t goldfish_timer_interrupt(int irq, void *dev_id, struct cpu_user_regs *regs)
{
uint32_t timer_base = IO_ADDRESS(GOLDFISH_TIMER_BASE);

timer_tick(regs);

raise_softirq(TIMER_SOFTIRQ);

__raw_writel(1, timer_base + TIMER_CLEAR_INTERRUPT);

goldfish_timer_set_next_event(LATCH);

    return IRQ_HANDLED;
}
//软中断，跟定时器又联系上了。
static void timer_softirq_action(void)
{
                int           cpu = smp_processor_id();
                struct timer *t, **heap;
                s_time_t      now;
                void        (*fn)(void *);
                void         *data;

DPRINTK(5, “%s:%dn“, __FUNCTION__, __LINE__);
spin_lock_irq(&timers[cpu].lock);

                do {
                        heap = timers[cpu].heap;
                        now = NOW();

                        while ( (GET_HEAP_SIZE(heap) != 0) && ( (t = heap[1])->expires < (now + (s_time_t)TIMER_SLOP) ) )
                        {
                                remove_entry(heap, t);
                                timers[cpu].running = t;
                                fn   = t->function;
                                data = t->data;
//      printk(“fn:%x”, fn);
                                spin_unlock_irq(&timers[cpu].lock);
                                (*fn)(data);//执行定时器routine

DPRINTK(5, “%s:%dn“, __FUNCTION__, __LINE__);
spin_lock_irq(&timers[cpu].lock);

                                /* Heap may have grown while the lock was released. */
                                heap = timers[cpu].heap;
                        }

                        timers[cpu].running = NULL;
                }
                while ( !reprogram_timer(GET_HEAP_SIZE(heap) ? heap[1]->expires : 0) );

DPRINTK(5, “%s:%dn“, __FUNCTION__, __LINE__);

spin_unlock_irq(&timers[cpu].lock);
}
/*
从异常返回

异常处理完毕之后，ARM微处理器会执行以下几步操作从异常返回：

1、将连接寄存器LR的值减去相应的偏移量后送到PC中。

2、将SPSR复制回CPSR中。

3、若在进入异常处理时设置了中断禁止位，要在此清除。
*/

回顾2010

tek-life — Fri, 31 Dec 2010 07:49:51 +0000

这一年就要过完了，照例要总结一下，这一年都做了一些什么。明年的这个时候应该都拿到offer了。等待毕业和入职了。每想到此，既兴奋又紧张。明年的一年又是紧张的一年，不知道系统能否顺利做完。

这一年最大的收获，应该是入了Linux的门，并且看了不少关于编译链接，计算机系统结构和操作系统方面的书。感觉羽翼一点点丰满，不过，当然距离大牛还有很长的路要走。
上半年的时候，基本上把精力都放在了Linux驱动方面了。看过了宋宝华的Linux驱动开发的书和Linux Device Driver，除此之外，还看了unstanding linux kenrel.和Linux kernel development.
下半年把精力都放在了项目上，移植了yaffs到xenarm上，并且将原来支持的128MB支持到了768MB，当然最大能够达到950MB。将xenheap的大小扩大到了64MB。这一块，我感觉，还是蛮有成就感。内存太小，肯定干不成事情。跑一个android，最少需要70MB以上的，原来的128MB一定是不够用的。特别是，当yaffs在xenarm里面跑成功以后，那种感觉是难以形容的。每看到自己写的代码，就像看到自己的孩子似的。现在的xenarm已经能够跑起来两个android了。不过缺点是，相关的设备虚拟化程度仍然不够。调度算法仍然不完整，调度两个android，明显bug太多，另外，由于设备虚拟化的问题，现在只能跑两个一模一样的系统。因为要公用nand嘛，nand里放的是root fs.在下半年，也看了一些书，这些书，增加了我的一些自信。《自己动手写OS－第二版》《程序员自我修养－－链接装载与库》《代码揭秘》《CODE》其中前两本，给我的感觉很棒。除此之外，还看了PHP和SHELL方面的两本书，同时还看了正则表达式方面的书。当然，看过之后，没有怎么用，都忘记了，不过重新拾起来应该比较快。

去年的这个时候，我按照月份，把每个月所做的事情都列了一下。今年，想到此，便想到了在实验室每个月7号写的QA，我想也许是因为，我对QA已经恐惧了，所以，不写的那么具体了。总结一下，以告慰自己，又过了一年，没有虚度年华。

xenarm代码片段注释

tek-life — Fri, 31 Dec 2010 02:00:22 +0000

ENTRY(ret_to_user)
test_all_events:
disable_irq r1 @ ensure IRQs are disabled

bl get_irq_stat @ get softirq pending status
ldr r1, [r0, #OFFSET_SOFTIRQ_PENDING]@指针操作,返回值放到r0中

ldr r0, =0xffff
tst r1, r0 @ bit mask check is needed!!!

beq test_guest_events
enable_irq r1 @ sti @ r1.. ok??????

bl do_softirq
b test_all_events

/*
disable_irq r1
        .macro disable_irq, temp
        msr     cpsr_c, #PSR_STATUS_I | PSR_MODE_SVC //只更改控制位0~8,禁止中断标志位
        .endm
*/
ENTRY(test_guest_events)
        vcpu    r10                           @从在xenheap中堆栈页的最下部分得到vcpu结构
        ldr     r11, [r10, #OFFSET_VCPU_INFO] @获得vcpu_info
        ldrb    r9, [r11, #OFFSET_EVTCHN_UPCALL_MASK]     @r9为evtchn_upcall_mask
        tst     r9, #0xFF                                 ＠如果r9为非零则，bne,否则，要处理upcall信息
        bne     restore @如果不为0,那么就b restore

        ldrb    r12, [r11, #OFFSET_EVTCHN_UPCALL_PENDING] @r12为evtchn_upcall_pending
        tst     r12, #0xFF
        beq     restore @如果为0,那么也 b restore 没有evtchn @如果r12仍然为0,那么说明没有guest events事件要处理

        /*
        .macro vcpu    rd                   @通过这种方式得到vcpuinfo.STACK上面是context，下面是cpuinfo
                ldr     rd, =(~(STACK_SIZE – 1))
                and     rd, r13, rd
                ldr     rd, [rd]
        .endm
        */
/*
* Send event to guest domain
* 操作的都是vcpu->arch.guest_context.内容
* 但是把domain_guest的信息全部保存在了vcpu->arch.guest_context.sysusrregs的vksp中
*/
ENTRY(do_upcall)
        vcpu    r10
        ldr     r11, [r10, #OFFSET_VCPU_INFO]                           @r11指向的是vcpu_info
        add     r10, r10, #(OFFSET_ARCH_VCPU + OFFSET_GUEST_CONTEXT)    @r10指向了guest_context

        @——–lr指向event_callback
        ldr     lr, [r10, #OFFSET_HYPERVISOR_CALLBACK]                  @ lr event_callback–
        cmp     lr, #0                                                  @ 如果没有设置call back,那么就restore
        beq     restore

        @–upcall_mask，                                                屏蔽掉evtchn
        mov     r9, #0×01
        strb    r9, [r11, #OFFSET_EVTCHN_UPCALL_MASK]   @r11指向的是vcpu_info
        @———————————-

mov r4, #PSR_MODE_SVC
str r4, [r10, #(OFFSET_SYS_REGS + OFFSET_VPSR)] @r10指向的是guest_context svc

        @–将domain_context保存在vksp的下面
        @ Load virtual kernel stack pointer
        ldr     r11, [r10, #(OFFSET_SYS_REGS + OFFSET_VKSP)]    @r11指向guest_context指定的stack pointer–domain_stack ?

        @ Align VKSP in 8-byte boundary
        sub     r12, r11, #S_FRAME_SIZE @ r12指向domain_context
        tst     r12, #4
        bicne   r12, r12, #4
        tst     r12, #4
1:
        bne     1b

@ Update effective virtual kernel stack pointer.更新的vksp r12指向了新的stack top–这样便于保存信息
str r12, [r10, #(OFFSET_SYS_REGS + OFFSET_VKSP)]@改变stack了,stack top 距离原来的stack 有1个user regs

        @ Create bounce frame in guest stack
        @ 将domain_context的信息都保存在vksp下面的一个S_FRAME_SIZE区间中
        ldmia   sp!, {r0-r8}
        stmia   r12!, {r0-r8}

        ldmia   sp!, {r0-r8}
        stmia   r12!, {r0-r8}
        @———————————————

        sub     r12, r12, #S_FRAME_SIZE @ r12重新指向vksp下面的位置，因为上面的4条指令，已经更改了它的位置
        ldr     r0, =.LCupcall
        stmia   r0, {r12,lr}

        ldmia   r0, {sp, lr}^ //lr = event_upcall 和sp＝vksp

        ldr     r0, [r12, #S_CONTEXT] @ r0 context
        ldr     r1, [r12, #S_PSR]     @ r1 psr
        ldr     r2, [r10, #(OFFSET_SYS_REGS + OFFSET_VFAR)] @r2 far
        ldr     r3, [r10, #(OFFSET_SYS_REGS + OFFSET_VFSR)] @r3 fsr
        mov     r7, #PSR_MODE_USR                           @user_mod -> r7
        msr     spsr, r7                                    @r7->spsr

ldr r5, =DOMAIN_KERNEL_VALUE
mcr p15, 0, r5, c3, c0, 0 @ Load DAC

movs pc, lr

ENTRY(restore)
@与swi放在一起看，会更清楚一些
        @进入到guest的环境中
        @将sp内容保存在数据结构vcpu context中，设置进入guest的一些寄存器c3 cpsr r0~r15.(原来的
                        guest信息全部保存在此？莫非是)
        @将sp内容全部弹出

vcpu r4
add r5, r4, #(OFFSET_ARCH_VCPU + OFFSET_GUEST_CONTEXT)//r5保存了guest_context

        ldr     r1, [sp, #S_PSR] //r1 保存了psr 是 13 svc
        and     r3, r1, #PSR_MODE_MASK
        str     r3, [r5, #(OFFSET_SYS_REGS + OFFSET_VPS)]//保存spr到guest_context.sys_regs中

bic r1, r1, #PSR_MODE_MASK //位清除指令
orr r1, r1, #PSR_MODE_USR //0×10

        cmp     r3, #PSR_MODE_USR
        ldreq   r7, =DOMAIN_HYPERVISOR_VALUE
        ldrne   r7, =DOMAIN_KERNEL_VALUE
        mcr     p15, 0, r7, c3, c0, 0   @改变域控制

        mrc     p15, 0, r3, c2, c0, 0           @ arbitrary read of cp15
        mov    r3, r3                           @ wait for completion
        sub     pc, pc, #4                      @ flush instruction pipeline

        @下面的操作sp指向的栈地址把原来存储的寄存器全部弹出了
        ldr     lr, [sp, #S_PC]!                @ Get PC                          ?1
        msr     spsr, r1                        @ save in spsr_svc user模式       ?2

        ldmdb   sp, {r0 – lr}^                  @ Get calling r0 – lr        LDM DB 传送前地址-4  ^的作用是用户模式寄存器
        mov     r0, r0
        add     sp, sp, #S_FRAME_SIZE – S_PC    @这里sp指针指向framesize后部

        movs    pc, lr                          @ return & move spsr_svc into cpsr ?4

like-linux系统链表原理简单分析

tek-life — Tue, 14 Dec 2010 07:51:53 +0000

  1 /*
  2 like-linux系统下链表结构分析
  3 *在like-linux系统中，链表的可移植性比较好，并不像在大学学到的链表结构那样的死板。其原理在很多linux的讲解中都有描述。
  4 *原理部分可以看一下李先静老师写的《系统程序员成长之路》一书。
  5 *本文根据xenarm中的链表来具体得理一下在like-linux系统中的链表原理。
  6
  7 *因为时间有限，只是把相关宏定义简单扩展，并把代码做了注释和筛捡。没有成文，望各位看官见谅
  8 */
  9
10
11 /*
12 *定义了一个相关结构和spinlock
13 */
14 spinlock_t consistent_lock;
15 struct arm_vm_region {
16         struct list_head        vm_list;
17         unsigned long           vm_start;
18         unsigned long           vm_end;
19         struct page             *vm_pages;
20         int                     vm_active;
21 };
22
23 /*
24 *初始化一个链表头
25 *链表头不同于链表节点，在实际分配中，链表头存放的是边界范围等一些概括信息
26 *
27 */
28 static struct arm_vm_region consistent_head = {//初始化一个链表头
29         .vm_list        = LIST_HEAD_INIT(consistent_head.vm_list),
30         .vm_start       = CONSISTENT_BASE,
31         .vm_end         = CONSISTENT_END,
32 };
33
34 static struct arm_vm_region * arm_vm_region_alloc(struct arm_vm_region *head, size_t size, gfp_t gfp)
35 {
36         //head头放的是区间总体范围
37         unsigned long addr = head->vm_start, end = head->vm_end – size;
38         unsigned long flags;
39         struct arm_vm_region *c, *new;
40
41         new = xmalloc(struct arm_vm_region);
42         if (!new)
43                 goto out;
44
45         spin_lock_irqsave(&consistent_lock, flags);
46
47         /*
48            *遍历一下链表的各个节点，寻找合适的区间范围
49            *list_for_each_entry宏是一个关键，其实是一个for循环，只不过设计的比较巧妙，依靠了链表的结构
50            ＊其具体定义在下面
51          */
52         list_for_each_entry(c, &head->vm_list, vm_list) {
53                 if ((addr + size) < addr)//越界
54                         goto nospc;
55                 if ((addr + size) <= c->vm_start)//可以夹到vm_region块之间
56                         goto found;
57                 addr = c->vm_end;//addr 为下一个的结束地址
58                 if (addr > end)
59                         goto nospc;
60         }
61         /*
62          *注意，若上面的链表仅仅有一个头的话，没有问题，直接到下面这个found就ok了。
63          */
64 found:
65         /*
66          * Insert this entry _before_ the one we found.
67          */
68         list_add_tail(&new->vm_list, &c->vm_list);
69         new->vm_start = addr;
70         new->vm_end = addr + size;
71         new->vm_active = 1;
72
73         spin_unlock_irqrestore(&consistent_lock, flags);
74         return new;
75
76 nospc:
77         spin_unlock_irqrestore(&consistent_lock, flags);
78         xfree(new);
79 out:
80         return NULL;
81 }
82
83 /**
84 * list_for_each_entry  -       iterate over list of given type
85 * @pos:        the type * to use as a loop counter.
86 * @head:       the head for your list.
87 * @member:     the name of the list_struct within the struct.
88 */
89 #define list_for_each_entry(pos, head, member)                          \
90         for (pos = list_entry((head)->next, typeof(*pos), member);      \
91              &pos->member != (head);                                    \
92              pos = list_entry(pos->member.next, typeof(*pos), member))
93
94 /**
95 * list_entry – get the struct for this entry
96 * @ptr:        the &struct list_head pointer.
97 * @type:       the type of the struct this is embedded in.
98 * @member:     the name of the list_struct within the struct.
99 */
100 #define list_entry(ptr, type, member) \
101         ((type *)((char *)(ptr)-(unsigned long)(&((type *)0)->member)))
102
103 /*
104    **********************************************************************************************
105 */
106 static void * __dma_alloc(/*struct device *dev,*/size_t size, dma_addr_t *handle/*, gfp_t gfp*/,pgprot_t prot)
107 {
108         struct page_info *page;
109         struct arm_vm_region *c;
110         unsigned long order;
111         unsigned long flags;
112
113         //若没有初始化，就…
114         if (!consistent_pte[0]) {
115                 printk(KERN_ERR "%s: not initialised\n", __func__);
116                 return NULL;
117         }
118         size = round_pgup(size);
119
120         //若分配的空间太大了，超过了，那么就…
121         if (
122             size >= (CONSISTENT_END – CONSISTENT_BASE)) {
123                 printk(KERN_WARNING "coherent allocation too big "
124                        "(requested %#x)\n", size);
125                 goto no_page;
126         }
127
128         //转换为伙伴算法的尺寸
129         order = get_order_from_bytes(size);
130
131         local_irq_save(flags);
132         page = alloc_heap_pages(0, order);//分配的是实际的页
133         local_irq_restore(flags);
134         if (!page)
135                 goto no_page;
136
137         c = arm_vm_region_alloc(&consistent_head, size,
138                            /* gfp &*/ ~(__GFP_DMA | __GFP_HIGHMEM));//分配的是页框
139         if (c) {
140                 pte_t *pte;
141                 struct page_info *end = page + (1 << order);
142                 int idx = CONSISTENT_PTE_INDEX(c->vm_start);
143                 u32 off = CONSISTENT_OFFSET(c->vm_start) & (PTRS_PER_PTE-1);
144
145                 pte = consistent_pte[idx] + off;
146                 c->vm_pages = page;
147
148                 *handle = page_to_phys(page);//page_to_dma(/*dev,*/ page);
149
150                 do {
151                         *pte = l1e_from_paddr(page_to_phys(page), prot);//mk_pte(page, prot);
152
153                         page++;
154                         pte++;
155                         off++;
156                         if (off >= PTRS_PER_PTE) {
157                                 off = 0;
158                                 cpu_flush_cache_page((unsigned long)consistent_pte[idx]);
159                                 pte = consistent_pte[++idx];
160                         }
161                 } while (size -= PAGE_SIZE);
162                 cpu_flush_cache_page((unsigned long)consistent_pte[idx]);
163                 /*
164                  * Free the otherwise unused pages.
165                  */
166                 while (page < end) {//若分配的页数没有全部被映射，于是释放掉没有被映射的页数
167                         free_heap_pages(0/*MEMZONE_DMADOM*/,page,order);
168                         page++;
169                 }
170                 return (void *)c->vm_start;
171         }
172         //如果没有分配vm成功的话，那么就free
173         if (page)
174                 free_heap_pages(0/*MEMZONE_DMADOM*/,page,order);
175 no_page:
176         printk("No enough memory for DMA\n");
177         *handle = ~0;
178         return NULL;
179 }
180
181 pgprot_t pgprot_kernel;
182 /*
183 * Allocate a writecombining region, in much the same way as
184 * dma_alloc_coherent above.
185 */
186 void *
187 dma_alloc_writecombine(/*struct device *dev, */size_t size, dma_addr_t *handle/*, gfp_t gfp*/)
188 {
189         return __dma_alloc(/*dev, */size, handle, /*gfp,*/
190                            pgprot_writecombine(pgprot_kernel));
191 }
192
193 /*
194 * Initialise the consistent memory allocation.
195 * 先把pgd给初始化了
196 */
197 int consistent_init(void)
198 {
199         pde_t *pgd;
200         pte_t *pte;
201         void *pt;
202         int ret = 0, i = 0;
203         u32 base = CONSISTENT_BASE;
204         pgprot_kernel = PTE_TYPE_SMALL/* | PTE_BUFFERABLE | PTE_CACHEABLE*/ | PTE_SMALL_AP_UNO_SRW;//L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY | L_PTE_WRITE | L_PTE_EXEC;
205
206         do {
207                 pt = alloc_xenheap_page();//pte_alloc_kernel(pgd, base);
208                 clear_page(pt);
209                 idle_pg_table[pgd_index(base)] =l2e_from_page(virt_to_page(pt), PMD_TYPE_TABLE | PMD_DOMAIN(DOMAIN_IO));
210                 cpu_flush_cache_page((unsigned long) &idle_pg_table[pgd_index(base)]);
211                 if (!pt) {
212                         printk(KERN_ERR "%s: no pte tables\n", __func__);
213                         ret = -ENOMEM;
214                         break;
215                 }
216                 //这个数组，是为了方便以后分配dma页的时候，建立页表
217                 consistent_pte[i++] = pt;
218                 base += (1 << PGDIR_SHIFT);
219         } while (base < CONSISTENT_END);
220         printk("consistent init ok\n");
221
222         return ret;
223 }

ARM Domain中的域管理简述

tek-life — Mon, 06 Dec 2010 02:45:25 +0000

1 /*
2 *ARM Domain中的域管理简述
3 *在ARM中，没有像x86那样的ring0,ring1,ring2,ring3的机制,那么它的安全管理是通过CP15协处理器的c3寄存器以及页目录表项来联合进行安全管理的。
4 *本文试图去简要分析一下在ARM体系结构中CP15协处理器中C3寄存器是如何进行安全管理的。另外关于页目录表项中的AP位也附带介绍。
5 *由于鄙人水平有限，分析不当的地方，望各位达人拍砖。
6 *
7 */
8 /*
9 先看一下一级页目录表项中的描述符
10 31                20            12 1110  9  8        5  4  3 2 1 0
11 |——段基址—–|—–SBZ——|-AP-|SBZ|–Domain–|IMP|C|B|—|
12
13 段基址  :下一级描述符的基地址.
14 SBZ     :是should be zero.
15 AP      :Access Permissions.
16 Domain  :即是本文所述的重点了。
17 IMP     :Implementation defined.
18 C       :cachable
19 B       :bufferable
20 */
21 /*
22 在ARM体系结构中，硬件安全检查的优先顺序是，先检查domain,在检查AP和cp15中的c1，确定访问权限
23
24 大致的思路是：现在来了一个虚拟地址　VA,根据va,mmu工作，查到了一级页描述符，然后查一下DOM,这里domain占４位，对于２进制来说，即是可以表示１６个数，假若目前描述符中的domain是12,也就是1100，那么MMU就去看一下CP15中的c3寄存器的第12*2-1和12*2两位（c3一共是３２位，每一个domain是用２位）,如果是01呢？如果是01的话，接着要继续去看AP和C1了。
25 这就是c3的工作思路了。其实很简单。就是我现把第０～１５个域对应的权限安排好，然后就按照程序的需求，由程序员将０～１５个域的序号按照需要填入描述符表中。MMU在工作的时候，查到域序号后，再到C3中按照查到的域序号去看权限位是00,还是01,还是10,还是11。根据不同的权限位，决定是否去看AP位。
26 这个道理就像生活中的事情：小弟有个事情需要跟老板请假，先跟大老板说，大老板如果心情好，就说恩，可以，这样小弟的请假就通过了。倘若，大老板心情不高兴，但碍于面子，就说，你这个事情看看组里面同意不，于是小弟就需要跟组里面和小老板去商量，看他们是否同意请假。大老板就是Manger，小老板和组里面的就算是Client了。其实在ARM的c3机制中也只定义了这两个有效的权限级别:01和11,倘若出现00和10，则会抛出异常来。01对应的是Client，11对应的是Manger.
27
28 下面拿一个例子来说明
29 */
30 /*
31 *定义了４个DOMAIN,和对应的c3
32 */
33         mov     r5, #(DOMAIN_VALUE(DOMAIN_SUPERVISOR, DOMAIN_MANAGER)   | \
34                       DOMAIN_VALUE(DOMAIN_HYPERVISOR, DOMAIN_MANAGER)   | \
35                       DOMAIN_VALUE(DOMAIN_USER, DOMAIN_MANAGER)         | \
36                       DOMAIN_VALUE(DOMAIN_IO, DOMAIN_CLIENT))
37
38         mcr     p15, 0, r5, c3, c0, 0   @ Load DAC
39
40
41 /*
42 *将具体的域描述符安装到PDE中
43 */
44
45 mem_map_table:
46         MAP_ENTRY(0xC0000000, 0xC0000000, 64, PDE_TYPE_HYPERVISOR)
47         MAP_ENTRY(0xFF000000, 0xC0000000, 2, PDE_TYPE_HYPERVISOR)
48         MAP_ENTRY(0xE0000000, 0×10000000, 1, PDE_TYPE_IO)
49         MAP_ENTRY(0,0,0,0)
50 /*
51 *具体的宏定义
52 */
53 #define PDE_AP_SRW_UNO          (0×01 << 10)
54 #define PDE_AP_SRW_URO          (0×02 << 10)
55 #define PDE_AP_SRW_URW          (0×03 << 10)
56
57 #define PDE_BUFFERABLE                  (0×04)
58 #define PDE_CACHEABLE                   (0×08)
59
60 #define PDE_WRITEBACK                   (PDE_CACHEABLE | PDE_BUFFERABLE)
61 #define PDE_WRITETHROUGH                (PDE_CACHEABLE)
62 #define PDE_SHARED                              (0)
63
64 #define PDE_DOMAIN_HYPERVISOR   (DOMAIN_HYPERVISOR << 5)//00b–0
65 #define PDE_DOMAIN_SUPERVISOR   (DOMAIN_SUPERVISOR << 5)//01b–1
66 #define PDE_DOMAIN_USER         (DOMAIN_USER << 5)      //11b–3
67 #define PDE_DOMAIN_IO           (DOMAIN_IO << 5)        //10b–2
68
69 #define PDE_TYPE_HYPERVISOR             (PDE_TYPE_SECTION | PDE_DOMAIN_HYPERVISOR | PDE_AP_SRW_UNO | PDE_WRITEBACK)
70 #define PDE_TYPE_IO                             (PDE_TYPE_SECTION | PDE_DOMAIN_IO | PDE_AP_SRW_URW)

71 /*
72 至此，我可能仍然没有把问题说清楚，如果仍有不明白的地方，欢迎讨论。
73 如果说的有错误，希望得到纠正。
74 */

Android on OKL4 Tutorials

tek-life — Sun, 14 Nov 2010 04:16:14 +0000

可能在博客里面xml内容显示不正常，移步docs.google，查看 http://docs.google.com/View?id=df6sncnm_899k8tqgng5

Android on OKL4

OKL4 3.0 was originally ported to run on the HTC Dream (found here). A student, Michael Hills, developed a rudimentary Android port that removes Linux and runs natively on OKL4 3.0 for his undergraduate thesis. The supplied code demonstrates the Lunar Lander application found in the Android SDK running on the Dalvik VM on OKL4.

Getting the source

1. First create a base directory to contain all of the source of this project.

2.Then download the Android repo tool and place it into a directory that is in your environment’s PATH.

3.Then inside the project base directory, create a directory for the Android source and initialize the repo.

You may need to prepare your build environment to compile Android as specified at http://source.android.com/source/index.html.
curl http://android.git.kernel.org/repo >~/bin/repo
chmod a+x ~/bin/repo
mkdir android-1.5r2
cd android-1.5r2
repo init -u git://android.git.kernel.org/platform/manifest.git -b android-1.5r2

4.Before downloading the Android source, we need to add the project for the HTC Dream hardware

Create a local_manifest.xml file inside android-1.5r2/.repo with the contents:

5.Then download the Android source by running the command:

repo sync

6.create a file named buildspec.mk in the android-1.5r2 directory.

All development targets the Android Developer Phone 1 (HTC Dream) and not the simulator. Therefore it is handy to tell the Android build system to default to building for the phone. To do this create a file named buildspec.mk in the android-1.5r2 directory.

The content of buildspec.mk is:

TARGET_PRODUCT:=htc_dream

7.Following this, download okl4-android.tar.bz2 which contains everything else that is not Android.(在下载的这个包中，已经包含了所有的内容了，不用再单独下载okl-android了)

Place the tarball into the base project directory and then extract it.
tar xf okl4-android.tar.bz2
Part of this tarball is a directory with diffs that will be used to patch the Android tree with the changes made during porting. A script has been provided to patch the tree with these diffs in the base directory.
./patch.py android-1.5r2 diffs
… where android-1.5r2 is the android source tree directory, and diffs is the directory containing the diffs.

8.下载Android1.5r2 SDK

Next the Android 1.5r2 SDK is required for the Android simulator which is used to optimise Java libraries (explained later). However it appears to no longer be available for download on the Android site. Instead, I have tested that using the 1.5r3 SDK works correctly. Download the SDK from http://developer.android.com/sdk/index.html and follow the instructions listed there on how to add the 1.5r3 platform to the SDK.(PS:其实是1.5R2 SDK可以下载的http://developer.android.com/sdk/older_releases.html)

After extracting the tarball and patching the Android tree, the code base is now ready for building.

号外：

The gcc toolchain that is used to compile both the Android and OKL4 trees is supplied with Android. If you are using Linux add the following directory to your path:

./android-1.5r2/prebuilt/linux-x86/toolchain/arm-eabi-4.2.1/bin

If you are using Mac, then use:

./android-1.5r2/prebuilt/darwin-x86/toolchain/arm-eabi-4.2.1/bin

However all development was done using Ubuntu 9.04 64-bit, and this has not been tested on a Mac.

In addition to this, the OKL4 kernel uses a different toolchain to the userland components. The kernel does not compile with the Android toolchain. Instead, use the arm-3.4.4 toolchain listed on http://ertos.nicta.com.au/software/prebuilt/binaries.pml and add the toolchain’s bin/ directory to your PATH.

Building the source

Both Android and OKL4 have their own build system, and so building the source is a little more complicated than just running a single make command. Libraries and binaries that are compiled in the Android source tree must be linked to OKL4 libraries and then placed into the in-memory file system which is done using the Elfweaver tool in the OKL4 tree.

The directory layout of the source should look like the following:

./android-1.5r2/
./okl4-android-3.0/
./fs/

The first two directories are self-explanatory. The third directory contains files that will be placed into the in-memory file system.

The base directory contains several scripts to ease compilation.

Getting Started

One script will build all necessary parts of the Android tree (Java libraries, Bionic libc, Dalvik, and other misc libs), and do a full build of the OKL4 tree.

./makeall.sh

However, Dalvik uses optimised Java libraries at runtime. The optimising tool was not ported and isn’t executed at runtime, so these optimised dex libraries must be produced beforehand and inserted into the in-memory file system.

The optimisation process uploads the built Java library jars to the simulator and invokes the optimisation tool on them. The optimised dex files are then downloaded back and placed into the fs/data/dalvik-cache directory where Dalvik can find them at runtime.

To start the simulator:

export ANDROID_PRODUCT_OUT=path/to/android-sdk-linux/platforms/android-1.5/images
path/to/android-sdk-linux/tools/emulator

Once the simulator has finished loading, it is time to optimise the Java libraries. This is done by attempting to run a Java program with the jars you want optimised specified in the classpath.

In the project base directory run:

./optimise.sh LunarLander

The argument to optimise.sh specifies the application jar that you wished to be optimised, currently only LunarLander is available. The jar file for LunarLander is located in fs/data/java, and the script automatically looks for specified jars in that location.

Now the boot image is ready to be built, this is done in the OKL4 tree.

cd okl4-android-3.0
./make.sh dream

Calling make.sh will compile the OKL4 tree, and then build a boot image containing the files in the fs directory. Files to be placed in memory are specified in okl4-android-3.0/projects/sos/SConstruct. Make sure the latest dalvikvm binary and Java libraries are present in the file-system when compiling and booting the image onto the phone.

Once the boot image is ready, it can be loaded onto the phone using:

./run.sh dream

This script simply calls a fastboot modified for OKL4. More information about this can be found at http://ertos.nicta.com.au/software/okl4htcdream/ under “Running the code on the HTC Dream”.

The LunarLander application should load, and you can use the S key to start and restart the game, Q to rotate left, W to rotate right, and Spacebar for thrust.

A Development Cycle

A standard development cycle might involve changes to code in either the Android or OKL4 trees. Rebuilding the OKL4 tree is as simple as ./make.sh dream, however the Android tree is a bit more complicated since we’re using only a subset, and a complete build takes a long time.

Generally, you will need to rebuild Java or C/C++ libraries. A script has been provided to build individual libraries. For C/C++ libraries, in the base directory:

./phonelibs.sh c dvm cutils

This will build libc, libdvm, and libcutils.

For Java libraries, in the android-1.5r2/ directory:

make core framework

This will rebuild the Java core library and runtime framework library, which are both jars.

If you modify Dalvik main (dalvik/dalvikvm/Main.c), it needs to be rebuilt using:

make dalvikvm

The object file will be made, and ignore the following error messages which are a result of modifying makefiles to build static libraries.

The dalvikvm binary is statically linked with libraries from both Android and OKL4, and therefore if C/C++ libraries in either tree are modified, dalvikvm must be recompiled.

In the base directory:

make dalvik TARGET=dream

This will place a dalvikvm binary into fs/bin/.

If Java libraries are modified, they need to be re-optimised. In the base directory with the Android simulator running in the background:

./optimise.sh

… where app.jar is the Dalvik application you wish to run that has been extracted from an apk file.

Once everything is ready to go, simply build and load the boot image from the okl4-android-3.0 directory.

./make.sh dream
./run.sh dream

Bugs and Limitations

A bug exists with the in-memory file system, and I do not know the exact cause. In the process of inserting files into the boot image, some files are occasionally corrupted and results in strange runtime behaviour. If the boot image fails to load the LunarLander application, then adding extra files to fs/data/java can make the bug go away (temporarily). The bug revealed itself early on during my thesis, but disappeared for the most of the year, only to reappear again towards the very end.
Static linking is used because I never implemented shared libraries in my OS personality. Any library that you wish to use from the Android tree mustbe compiled statically, and some of the time Android libraries are configured to produce shared libraries only. The Android.mk file in the library’s directory must be modified to build a static library, and this can be done by replacing “include $(BUILD_SHARED_LIBRARY)” with “include $(BUILD_STATIC_LIBRARY).
C++ static initialisers are not called. This is a process which is meant to be done before calling main. Constructors of objects declared as static are meant to be executed, but they are not and this can cause strange behaviour with uninitialised objects.
Only the LunarLander application was tested to run unmodified. It is highly likely that most programs will not work as I re-implemented the application-side libraries. This was done to get something running in the thesis to be able to benchmark the system. This is not a complete port of Android on OKL4.

Contact

If you have any questions about this project, please email Michael Hills (mikeh@cse.unsw.edu.au).

xen-arm 算法技巧赏析（0）

tek-life — Fri, 12 Nov 2010 00:58:04 +0000

1 /*
2 原以为，在平时的工程实现中，算法几乎是用不上的。但在看内核的过程中，发现算法还是比较重要的。
3 尤其是一些细微而又精巧的程序设计技巧。这些技巧是需要掌握的。
4
5 下面的这段程序摘自：xen-arm中，的内存初始化部分。
6 功能：从first_page页开始的nr_pages页在页位图中，表示为空闲页。
7 页位图，位于_end之后。_end标识xen-arm kernel的结束地址。
8
9 */
10 static void map_free(unsigned long first_page, unsigned long nr_pages)
11 {
12 unsigned long start_off, end_off, curr_idx, end_idx;
13
14 #ifndef NDEBUG
15 unsigned long i;
16 /* Check that the block isn’t already freed. */
17 for ( i = 0; i < nr_pages; i++ )
18 ASSERT(allocated_in_map(first_page + i));//ASSERT:如果条件不成立，就报错
19 #endif
20
21 curr_idx  = (first_page-min_page) / PAGES_PER_MAPWORD;
22 start_off = (first_page-min_page) & (PAGES_PER_MAPWORD-1);
23 end_idx   = (first_page-min_page + nr_pages) / PAGES_PER_MAPWORD;
24 end_off   = (first_page-min_page + nr_pages) & (PAGES_PER_MAPWORD-1);
25
26 if ( curr_idx == end_idx )
27 {
28 //这个算法还是比较巧妙的
29 //1<
30 /*
31 -(1<
32 通过这种方式，把0~end_off之间全部变为0 ，而end_off ~31之间为1
33 */
34 //两者之或，就是从start_off ~ end_off 之间全部为0了
35 alloc_bitmap[curr_idx] &= -(1UL<1UL<1);
36 }
37 else
38 {
39 alloc_bitmap[curr_idx] &= (1UL<1;//start_off~31之间的为0,妙哉！
40 while ( ++curr_idx != end_idx ) alloc_bitmap[curr_idx] = 0;
41 alloc_bitmap[curr_idx] &= -(1UL< 42 }
43 }
44

printf和标准输出［z］

tek-life — Tue, 12 Oct 2010 09:53:45 +0000

原文：http://blog.21ic.com/user1/3783/archives/2007/42870.html

printf和标准输出

上次写到main函数的参数传递.现在继续往下进行.最近忙实验室的事情,看了一周
的文章,也没啥进展,周末写点技术贴,放松一下:-)

进入main函数后,就要调用printf(“Hello World!”);了.顺便将C语言参数传递提
一下.字符串”Hello World!”编译器是当作字符串常量来处理的,虽然printf是在main
内部调用,但”Hello World!”可不是放在main的栈中,字符串常量至少是放到.data段的
,准确说是放在只读数据段.rodata,这个我在工作站上验证了一把.假如编辑的文件名是
hello.c,首先编译生成elf格式二进制文件gcc hello.c -o hello然后用命令objdump -s hello -s参数会将所有段信息dump出来.你会看到”Hello World!”位于.rodata段.

printf()是个标准C库函数.虽然功能简单,但实现起来却不容易.这是个和平台相关的
函数.在pc上,printf输出是输出到终端屏幕,在嵌入式设备上,一般printf()是输出到串口.
同是调用printf(),最终输出的设备却不同,从直觉的肯定是感觉printf()底层和平台是相
关的.那么printf()是怎样实现的呢?

可以看一下C库程序的代码,这里以uClibc为例.
int printf(const char * __restrict format, …)
{
va_list arg;
int rv;

va_start(arg, format);
rv = vfprintf(stdout, format, arg);
va_end(arg);

return rv;
}
printf支持字符串格式化输出,具体参数处理这里不提.可以看到printf()调用了
vfprintf(),vfprintf()第一个参数是stdout是标准输出设备.标准输出设备是个结构体,
最重要的成员就是他的描述符,其值为1.

跟进vfprintf()函数看,里面是复杂的参数处理,因为printf()的参数形式很灵活,
所以在vfprintf()里面要对传进来的参数进行解析处理,形成最终的输出格式.有兴趣的
可以看一下,借助这个可以让你在一个没有操作系统的平台上实现你自己的printf()
函数.这样你在裸机上调程序时输出调试信息就更方便些(实际上uClinux的printk就是
这么干的).

vfprintf()在参数处理之后，就是输出了，输出调用的是putc()，进入putc()然后
再跟进几层函数，发现调用了linux系统调用write()。呵呵，是的，输出就是借助操作
系统代码完成的。在write之前所有的代码都是C库的代码，可以说是和平台无关的。
而涉及到具体输出，就要调用操作系统提供给你的接口。系统调用的原理就是通过一定
手段（一般是trap陷阱）进入操作系统的内核空间，调用操作系统代码来完成某些任务。

Linux系统调用针对不同平台有不同的实现方式。这个以后再讲。调用write()后，
进入内核空间，首先来到的就是sys_write()，这个函数代码位于fs/read_write.c中。
一进入sys_write()，就要根据传进来的fd描述符找到相应的file结构。对于标准输出，
fd=1，每个进程的进程控制块都有一个打开文件的数组。file结构就是根据fd在这个
数组中查找到相应的结构。找到结构后，就会调用file->write()来向外输出。具体输出
到哪里，就要看file结构对应的设备驱动是什么。一般嵌入式系统可以从串口将信息输
出，那么file->write()最底层就是调用的串口驱动的类似transmit_char的函数。

有关linux的设备驱动有很多书介绍,整个驱动的结构很复杂,我这里也没必要提了.
至于终端设备怎样挂在驱动队列里面,怎么根据标准输出的描述符找到相应的驱动结构
有兴趣的莊printf()函数看,里面是复杂的参数处理,因为printf()的参数形式很灵活,
所以在vfprintf()里面要对传进来的参数进行解析处理,形成最终的输出格式.有兴趣的
可以看一下,借助这个可以让你在一个没有操作系统的平台上实现你自己的printf()
函数.这样你在裸机上调程序时输出调试信息就更方便些(实际上uClinux的printk就是
这么干的).

有关linux的设备驱动有很多书介绍,整个驱动的结构很复杂,我这里也没必要提了.
至于终端设备怎样挂在驱动队列里面,怎么根据标准输出的描述符找到相应的驱动结构
有兴趣的请查阅相关资料.
–
手段（一般是trap陷阱）进入操作系统的内核空间，调用操作系统代码来完成某些任务。

有关linux的设备驱动有很多书介绍,整个驱动的结构很复杂,我这里也没必要提了.
至于终端设备怎样挂在驱动队列里面,怎么根据标准输出的描述符找到相应的驱动结构
有兴趣的请查阅相关资料.

Linux系统调用［z］

tek-life — Tue, 12 Oct 2010 09:50:59 +0000

在网上，这篇文章已经很少见完整版了，就连内核之旅也不例外。因此，转过来，备份一下。原文，请猛击：http://blog.csdn.net/kanghua/archive/2007/10/22/1836840.aspx
摘要：本期重点和大家讨论系统调用机制。其中涉及到了一些及系统调用的性能、上下文深层问题，同时也穿插着讲述了一些内核调试方法。并且最后试验部分我们利用系统调用与相关内核服务完成了一个搜集系统调用序列的特定任务，该试验具有较强的实用和教学价值。

什么是系统调用

顾名思意，系统调用说的是操作系统提供给用户程序调用的一组“特殊”接口。用户程序可以通过这组“特殊”接口来获得操作系统内核提供的服务，比如用户可以通过文件系统相关的调用请求系统打开文件、关闭文件或读写文件，可以通过时钟相关的系统调用获得系统时间或设置系统时间等。

从逻辑上来说，系统调用可被看成是一个内核与用户空间程序交互的接口——它好比一个中间人，把用户进程的请求传达给内核，待内核把请求处理完毕后再将处理结果送回给用户空间。

系统服务之所以需要通过系统调用提供给用户空间的根本原因是为了对系统“保护”，因为我们知道Linux的运行空间分为内核空间与用户空间，它们各自运行在不同的级别中，逻辑上相互隔离。所以用户进程在通常情况下不允许访问内核数据，也无法使用内核函数，它们只能在用户空间操作用户数据，调用户用空间函数。比如我们熟悉的“hello world”程序（执行时）就是标准的户空间进程，它使用的打印函数printf就属于用户空间函数，打印的字符“hello word”字符串也属于用户空间数据。

但是很多情况下，用户进程需要获得系统服务（调用系统程序），这时就必须利用系统提供给用户的“特殊”接口——系统调用了，它的特殊性主要在于规定了用户进程进入内核的具体位置；换句话说用户访问内核的路径是事先规定好的，只能从规定位置进入内核，而不准许肆意跳入内核。有了这样的陷入内核的统一访问路径限制才能保证内核安全无虞。我们可以形象地描述这种机制：作为一个游客，你可以买票要求进入野生动物园，但你必须老老实实的坐在观光车上，按照规定的路线观光游览。当然，不准下车，因为那样太危险，不是让你丢掉小命，就是让你吓坏了野生动物。

Linux的系统调用

对于现代操作系统，系统调用是一种内核与用户空间通讯的普遍手段，Linux系统也不例外。但是Linux系统的系统调用相比很多Unix和windows等系统具有一些独特之处，无处不体现出Linux的设计精髓——简洁和高效。

Linux系统调用很多地方继承了Unix的系统调用（但不是全部），但Linux相比传统Unix的系统调用做了很多扬弃，它省去了许多Unix系统冗余的系统调用，仅仅保留了最基本和最有用的系统调用，所以Linux全部系统调用只有250个左右（而有些操作系统系统调用多达1000个以上）。

这些系统调用按照功能逻辑大致可分为“进程控制”、“文件系统控制”、“系统控制”、“存管管理”、“网络管理”、“socket控制”、“用户管理”、“进程间通信”几类，详细情况可参阅文章系统调用列表

如果你想详细看看系统调用的说明，可以使用man 2 syscalls 命令查看，或干脆到 <内核源码目录>/include/asm-i386/unistd.h源文件种找到它们的原本。

熟练了解和掌握上面这些系统调用是对系统程序员的必备要求，但对于一个开发内核者或内核开发者来[1]说死记硬背下这些调用还远远不够。如果你仅仅知道存在的调用而不知道为什么它们会存在，或只知道如何使用调用而不知道这些调用在系统中的主要用途，那么你离驾驭系统还有不小距离。

要弥补这个鸿沟，第一，你必须明白系统调用在内核里的主要用途。虽然上面给出了数种分类，不过总的概括来讲系统调用主要在系统中的用途无非以下几类：

l 控制硬件——系统调用往往作为硬件资源和用户空间的抽象接口，比如读写文件时用到的write/read调用。

l 设置系统状态或读取内核数据——因为系统调用是用户空间和内核的唯一通讯手段[2]，所以用户设置系统状态，比如开/关某项内核服务（设置某个内核变量），或读取内核数据都必须通过系统调用。比如getpgid、getpriority、setpriority、sethostname

l 进程管理——一系列调用接口是用来保证系统中进程能以多任务，在虚拟内存环境下得以运行。比如 fork、clone、execve、exit等

第二，什么服务应该存在于内核；或者说什么功能应该实现在内核而不是在用户空间。这个问题并不没有明确的答案，有些服务你可以选择在内核完成，也可以在用户空间完成。选择在内核完成通常基于以下考虑：

l 服务必须获得内核数据，比如一些服务必须获得中断或系统时间等内核数据。

l 从安全角度考虑，在内核中提供的服务相比用户空间提供的毫无疑问更安全，很难被非法访问到。

l 从效率考虑，在内核实现服务避免了和用户空间来回传递数据以及保护现场等步骤，因此效率往往要比实现在用户空间高许多。比如,httpd等服务。

l 如果内核和用户空间都需要使用该服务，那么最好实现在内核空间，比如随机数产生。

理解上述道理对掌握系统调用本质意义很大，希望网友们能从使用中多总结，多思考。

系统调用、用户编程接口（API）、系统命令、和内核函数的关系

系统调用并非直接和程序员或系统管理员打交道，它仅仅是一个通过软中断机制（我们后面讲述）向内核提交请求，获取内核服务的接口。而在实际使用中程序员调用的多是用户编程接口——API，而管理员使用的则多是系统命令。

用户编程接口其实是一个函数定义，说明了如何获得一个给定的服务，比如read()、malloc()、free（）、abs()等。它有可能和系统调用形式上一致，比如read()接口就和read系统调用对应，但这种对应并非一一对应，往往会出现几种不同的API内部用到统一个系统调用，比如malloc()、free（）内部利用brk( )系统调用来扩大或缩小进程的堆；或一个API利用了好几个系统调用组合完成服务。更有些API甚至不需要任何系统调用——因为它不必需要内核服务，如计算整数绝对值的abs（）接口。

另外要补充的是Linux的用户编程接口遵循了在Unix世界中最流行的应用编程界面标准——POSIX标准，这套标准定义了一系列API。在Linux中（Unix也如此）这些API主要是通过C库（libc）实现的，它除了定义的一些标准的C函数外，一个很重要的任务就是提供了一套封装例程（wrapper routine）将系统调用在用户空间包装后供用户编程使用。

不过封装并非必须的，如果你愿意直接调用，Linux内核也提供了一个syscall()函数来实现调用，我们看个例子来对比一下通过C库调用和直接调用的区别。

#include

int main(void) {

long ID1, ID2;

/*—————————–*/

/* 直接系统调用*/

/* SYS_getpid (func no. is 20) */

/*—————————–*/

ID1 = syscall(SYS_getpid);

printf (“syscall(SYS_getpid)=%ld\n”, ID1);

/*—————————–*/

/* 使用”libc”封装的系统调用 */

/* SYS_getpid (Func No. is 20) */

/*—————————–*/

ID2 = getpid();

printf (“getpid()=%ld\n”, ID2);

return(0);

}

系统命令相对编程接口更高了一层，它是内部引用API的可执行程序，比如我们常用的系统命令ls、hostname等。Linux的系统命令格式遵循系统V的传统，多数放在/bin和/sbin下（相关内容可看看shell等章节）。

有兴趣的话可以通过strace ls或strace hostname 命令查看一下它们用到的系统调用，你会发现诸如open、brk、fstat、ioctl 等系统调用被用在系统命令中。

下一个需要解释一下的问题是内核函数和系统调用的关系，内核函数大家不要想像的过于复杂，其实它们和普通函数很像，只不过在内核实现，因此要满足一些内核编程的要求[3]。系统调用是一层用户进入内核的接口，它本身并非内核函数，进入内核后，不同的系统调用会找到对应到各自的内核函数——换个专业说法就叫：系统调用服务服务例程。实际对请求服务的是内核函数而非调用接口。

比如系统调用 getpid实际就是调用内核函数sys_getpid。

asmlinkage long sys_getpid(void)

{

return current->tpid;

}

Linux系统种存在许多的内核函数，有些是内核文件种自己使用的，有些则是可以export出来供内核其他部分共同使用的，具体情况自己决定。

内核公开的内核函数——export出来的——可以使用命令ksyms 或 cat /proc/ksyms来查看。另外网上还有一本归纳分类内核函数的书叫作《The Linux Kernel API Book》，有兴趣的读者可以去看看。

总而言之，从用户角度向内核看，依次是系统命令、编程接口、系统调用和内核函数。再讲述了系统调用实现后，我们会回过头来看看整个执行路径。

系统调用实现

Linux中实现系统调用利用了0×86体系结构中的软件中断[4]。软件中断和我们常说的中断(硬件中断)不同之处在于——它是通过软件指令触发而并非外设，也就是说又编程人员出发的一种异常，具体的讲就是调用int $0×80汇编指令，这条汇编指令将产生向量为128的编程异常。

之所以系统调用需要借助异常实现，是因为当用户态的进程调用一个系统调用时，CPU便被切换到内核态执行内核函数[5]，而我们在i386体系结构部分已经讲述过了进入内核——进入高特权级别——必须经过系统的门机制，这里异常实际上就是通过系统门陷入内核（除了int 0×80外用户空间还可以通过int3——向量3、into——向量4 、bound——向量5等异常指令进入内核，而其他异常用户空间程序无法利用，都是由系统使用的）。

我们更详细的解释一下这个过程。int $0×80指令目的是产生一个编号为128的编程异常，这个编程异常对应的中断描述符表IDT中的第128项——也就是对应的系统门描述符。门描述符中含有一个预设的内核空间地址，它指向了系统调用处理程序：system_call()（别和系统调用服务程序混淆,这个程序在entry.S文件中用汇编语言编写）。

很显然所有的系统调用都会统一的转到这个地址，但Linux一共有2、3百个系统调用都从这里进入内核后又该如何派发它们到各自的服务程序去呢？别发昏，解决这个问题的方法非常简单：首先Linux为每个系统调用都进行了编号（0—NR_syscall），同时在内核中保存了一张系统调用表，该表中保存了系统调用编号和其对应的服务例程，因此在系统调入通过系统门陷入内核前，需要把系统调用号一并传入内核，在x86上，这个传递动作是通过在执行int0x80前把调用号装入eax寄存器实现的。这样系统调用处理程序一旦运行，就可以从eax中得到数据，然后再去系统调用表中寻找相应服务例程了。

除了需要传递系统调用号以外，许多系统调用还需要传递一些参数到内核，比如sys_write(unsigned int fd, const char * buf, size_t count)调用就需要传递文件描述符号fd和要写入的内容buf和写入字节数count等几个内容到内核。碰到这种情况，Linux会有6个寄存器使用来传递这些参数：eax (存放系统调用号)、 ebx、ecx、edx、esi及edi来存放这些额外的参数（以字母递增的顺序）。具体做法是在system_call( )中使用SAVE_ALL宏把这些寄存器的值保存在内核态堆栈中。

有始便有终，当服务例程结束时，system_call( ) 从eax获得系统调用的返回值，并把这个返回值存放在曾保存用户态 eax寄存器栈单元的那个位置上。然后跳转到ret_from_sys_call( )，终止系统调用处理程序的执行。

当进程恢复它在用户态的执行前，RESTORE_ALL宏会恢复用户进入内核前被保留到堆栈中的寄存器值。其中eax返回时会带回系统调用的返回码。（负数说明调用错误，0或正数说明正常完成）

我们可以通过分析一下getpid系统调用的真是过程来将上述概念具体化，分析getpid系统调用一个办法是查看entry.s中的代码细节，逐步跟踪源码来分析运行过程，另外就是可借助一些内核调试工具，动态跟踪运行路径。

假设我们的程序源文件名为getpid.c，内容是：

#include

int main(void) {

long ID;

ID = getpid();

printf (“getpid()=%ld\n”, ID);

return(0);

}

将其编译成名为getpid的执行文件”gcc –o getpid <路径>/getpid.c”, 我们使用KDB来产看它进入内核后的执行路径。

l 激活KDB (按下pause键，当然你必须已经给内核打了KDB补丁);设置内核断点 “bp sys_getpid” ;退出kdb “go”;然后执行./getpid 。瞬间，进入内核调试状态,执行路径停止在断点sys_getpid处。

l 在KDB>提示符下，执行bt命令观察堆栈，发现调用的嵌套路径，可以看到在sys_getpid是在内核函数system_call中被嵌套调用的。

l 在KDB>提示符下，执行rd命令查看寄存器中的数值，可以看到eax中存放的getpid调用号——0×00000014(=20).

l 在KDB>提示符下，执行ssb（或ss）命令跟踪内核代码执行路径,可以发现sys_getpid执行后，会返回system_call函数，然后接者转入ret_from_sys_call例程。（再往后还有些和调度有关其他例程，我们这里不说了它们了。）

结合用户空间的执行路径，大致该程序可归结为一下几个步骤：

1 该程序调用libc库的封装函数getpid。该封装函数中将系统调用号_NR_getpid（第20个）压入EAX寄存器，

2 调用软中断 int 0×80 进入内核。

（以下进入内核态）

3 在内核中首先执行system_call，接着执行根据系统调用号在调用表中查找到对应的系统调用服务例程sys_getpid。

4．执行sys_getpid服务例程。

5．执行完毕后，转入ret_from_sys_call例程，系统调用中返回。

内核调试是一个很有趣的话题，方法多种多样，我个人认为比较好用的是UML（user mode linux+gdb）和 KDB 这两个工具。尤其KDB对于调试小规模内核模块或查看内核运行路径很有效，对于它的使用方法可以看看Linux 内核调试器内幕这片文章。

系统调用思考

系统调用的内在过程并不复杂，我们不再多说了，下面这节我们主要就系统调用所涉及的一些重要问题作一些讨论和分析，希望这样能更有助了解系统调用的精髓。

调用上下文分析

系统调用虽说是要进入内核执行，但它并非一个纯粹意义上的内核例程。首先它是代表用户进程的，这点决定了虽然它会陷入内核执行，但是上下文仍然是处于进程上下文中，因此可以访问进程的许多信息（比如current结构——当前进程的控制结构），而且可以被其他进程抢占（在从系统调用返回时，由system_call函数判断是否该再调度），可以休眠，还可接收信号[6]等等。

所有这些特点都涉及到了进程调度的问题，我们这里不做深究，只要大家明白系统调用完成后，再回到或者说把控制权交回到发起调用的用户进程前，内核会有一次调度。如果发现有优先级别更高的进程或当前进程的时间片用完，那么就会选择高优先级的进程或重新选择进程运行。除了再调度需要考虑外，再就是内核需要检查是否有挂起的信号，如果发现当前进程有挂起的信号，那么还需要先返回用户空间处理信号处理例程（处于用户空间），然后再回到内核，重新返回用户空间，有些麻烦但这个反复过程是必须的。

调用性能问题

系统调用需要从用户空间陷入内核空间，处理完后，又需要返回用户空间。其中除了系统调用服务例程的实际耗时外，陷入/返回过程和系统调用处理程序（查系统调用表、存储\恢复用户现场）也需要花销一些时间，这些时间加起来就是一个系统调用的响应速度。系统调用不比别的用户程序，它对性能要求很苛刻，因为它需要陷入内核执行，所以和其他内核程序一样要求代码简洁、执行迅速。幸好Linux具有令人难以置信的上下文切换速度，使得其进出内核都被优化得简洁高效；同时所有Linux系统调用处理程序和每个系统调用本身也都非常简洁。

绝大多数情况下，Linux系统调用性能是可以接受的，但是对于一些对性能要求非常高的应用来说，它们虽然希望利用系统调用的服务，但却希望加快相应速度，避免陷入/返回和系统调用处理程序带来的花销，因此采用由内核直接调用系统调用服务例程，最好的例子就HTTPD——它为了避免上述开销，从内核调用socket等系统调用服务例程。

什么时候添加系统调用

系统调用是用户空间和内核空间交互的唯一手段，但是这并非时说要完成交互功能非要添加新系统调用不可。添加系统调用需要修改内核源代码、重新编译内核，因此如果想灵活的和内核交互信息，最好使用一下几种方法。

l 编写字符驱动程序

利用字符驱动程序可以完成和内核交互数据的功能。它最大的好处在于可以模块式加载，这样以来就避免了编译内核等手续，而且调用接口固定，容易操作。

l 使用proc 文件系统

利用proc文件系统修订系统状态是一种很常见的手段，比如通过修改proc文件系统下的系统参数配置文件（/proc/sys），我们可以直接在运行时动态更改内核参数；再如，通过下面这条指令：echo 1 > /proc/sys/net/ip_v4/ip_forward开启内核中控制IP转发的开关。类似的，还有许多内核选项可以直接通过proc文件系统进行查询和调整。

l 使用虚拟文件系统

有些内核开发者认为利用ioctl（）系统调用（字符设备驱动接口）往往会似的系统调用意义不明确，而且难控制。而将信息放入到proc文件系统中会使信息组织混乱，因此也不赞成过多使用。他们建议实现一种孤立的虚拟文件系统来代替ioctl()和/proc，因为文件系统接口清楚，而且便于用户空间访问，同时利用虚拟文件系统使得利用脚本执行系统管理任务更家方便、有效。

实验部分

代码功能介绍

我们希望收集Linux系统运行时系统调用被执行的信息，既实时获取系统调用日志。这些日志信息将能以可读形式实时的返回给用户空间，以便用户观察或做近一步的日志分析（如入侵检测等）。

所以简单的讲实验代码集需要完成以下几个基本功能：

第一：记录系统调用日志，将其写入缓冲区（内核中），以便用户读取；

第二：建立新的系统调用，以便将内核缓冲中的系统调用日志返回到用户空间。

第三：循环利用系统调用，以便能动态实时返回系统调用日志。

代码结构体系介绍

基本函数

代码功能一节介绍中的基本功能对应程序代码集中的三个子程序。它们分别是syscall_auydit、Sys_audit和auditd。接下来我们介绍代码具体结构。

日志记录例程Syscall_audit

syscall_audit该程序是一个内核态的服务例程，该例程负责记录系统调用的运行日志。

记录系统调用日志的具体做法是在内核中修改系统调用处理程序system_call[7]，在其中需要监控的每个调用（在我们例子钟222个系统调用都监控了，当然你也可以根据自己需求有选择的监控）执行完毕后都插入一个日志记录指令，该指令会转去调用内核服务函数syscall_audit来记录该次调用的信息[8]。

Syscall_audit内核服务例程会建立了一个内核缓冲区来存放被记录的函数。当搜集的数据量到达一定阀值时（比如设定为到达缓冲区总大小的%80，这样作可避免在丢失新调用），唤醒系统调用进程取回数据。否则继续搜集，这时系统调用程序会堵塞在一个等待队列上，直到被唤醒，也就是说如果缓冲区还没接近满时，系统调用会等待（被挂起）它被填充。

系统调用Sys_audit

由于系统调用是在内核中被执行，因此记录其执行日志也应该在内核态收集，所以我们需要利用一个新的系统调用来完成将内核信息带回到用户空间——sys_audit就是我们新填加的系统调用，它功能非常简单，就是从缓冲区中取数据返回用户空间。

为了保证数据连续性，防止丢失。我们会建立一个内核缓冲区存放每刻搜集到的日志数据，并且当搜集的数据量到达一定阀值时（比如设定为到达缓冲区总大小的%80），系统调用进程就会被唤醒[9]，以取回数据。否则在日志搜集时，系统调用程序会堵塞在等待队列上，直到被唤醒，也就是说如果缓冲区还没接近满时，系统调用会等待它被填充。

用户空间服务程序auditd

不用多说，我们需要一个用户空间服务进程来不断的调用audit系统调用，取回系统中搜集到的的调用日志信息。要知道，长时间的调用日志序列对于分析入侵或系统行为等才有价值。

把代码集成到内核中

除了上面介绍的内容外，我们还需要一些辅助性，但却很必要的工作，这些工作将帮助我们将上述代码灵活地机结成一体，完成需要的功能。

n 其一是修改entry.S汇编代码，该代码中含有系统调用表和系统调用入口代码system_call。我们首先需要在系统调用表中加入新的系统调用（名为sys_audit,223号。.long SYMBOL_NAME(sys_audit)）；下来在系统调用入口中加入跳转到日志记录服务例程中（跳转 “je auditsys”，而auditsys代码段会真正调用系统调用记录例程syscall_audit）；

n 其二是填加代码文件audit.c，该文件中包含syscall_audit与系统调用sys_audit两个函数体，我们这里只说包含函数体，而并非函数，是因为这里我们并不想把函数的实现在内核中写死，而是希望利用了函数指针，即做了两个钩子函数，来完成把具体函数实现放在模块中完成，以便能动态加载，方便调试（请见下一节介绍）。

u 其三是修改i386_ksyms.c文件，再最后加入

extern void (*my_audit)(int,int);

EXPORT_SYMBOL(my_audit);

extern int(*my_sysaudit)(unsigned char,unsigned char*,unsigned short,unsigned char);

EXPORT_SYMBOL(my_sysaudit);

，这样做是为了导出内核符号表，以便能模块代码中能挂接上以上函数指针。

n 其四是修改内核原代码目录下/kernel自目录下的Makefile文件，很简单，只需要在obj-y := 。。。。。最后加上audit.o，告诉编译内核是把audit.o编进去。

关键代码解释

我们的日志收集例程与取日志系统调用这两个关键函数的实现是放在内核模块中实现。其中有些需要解释的地方：

1. 模块编程的必要原则，如初始化、注销等都应该实现，所不同的是我们在初始化与注销时会分别挂上或卸下[10]了两个钩子函数的实现。

2. 我们系统调用日志记录采用了一个结构体：syscall_buf，它含有诸如系统调用号——syscall、进程ID——pid、调用程序名——comm[COMM_SIZE]等字段，共52字节；我们的内核缓冲区为audit_buf，它是一个可容纳100个syscall_buf的数组。

3. 系统调用实现极简单，要做的仅仅是利用__copy_to_user[11]将内核缓冲中的日志数据取到用户空间。为了提高效率，在缓冲区未满时（未到%80的阀值时），系统调用会挂起等待wait_event_interruptible(buffer_wait, current_pos >= AUDIT_BUF_SIZE*8/10)；相应地当缓冲区收集快满时，则唤醒系统调用继续收集日志wake_up_interruptible(&buffer_wait)。

4. 最后要补充说明一下，在auditd用户服务程序中调用我们新加的系统调用前必须利用宏_syscall4(int, audit, u8, type, u8 *, buf, u16, len, u8, reset)来“声明”该调用——展开成audit函数原形，以便进行格式转换和参数传递，否则系统不能识别。

取回数据

Audit系统调用

用户程序auditd

系统调用服务例程sys_audit

系统调用日志缓冲

Audit.o模块

my_sysaudit钩子函数

my_audit钩子函数

用户空间

内核空间

日志记录例程syscall_audit

描述日志数据流向

描述系统调用关系

程序体系图

STEP BY STEP

下面具体讲述一下如何添加这个调用。

1 修改entry.S ——在其中的添加audit调用，并且在system_call中加入搜集例程。（该函数位于<内核源代码>/arch/i386/kernel/下）

2 添加audit.c文件到<内核源代码>/arch/i386/kernel/下——该文件中定义了

sys_audit和syscall_audit 两个函数需要的钩子函数（my_audit和my_sysaudit），它们会在entry.S中被使用。

3 修改<内核源代码>/arch/i386/kernel/i386-kysms.c文件，在其中导出my_audit与my_sysaudit两个钩子函数。因为只有在内核符号表里导出，才可被其他内核函数使用，也就是说才能在模块中被挂上。

4 修改<内核源代码>/arch/i386/kernel/Makefile文件，将audit.c编译入内核。

到这可以重新编译内核了，新内核已经加入了检测点了。下一步是编写模块来实现系统调用与内核搜集服务例程的功能了。

1 编写名为audit的模块，其中除了加载、卸载模块函数以外主要实现了mod_sys_audit与mod_syscall_audit两个函数。它们会分别挂载到my_sysaudit和my_audit两个钩子上。

2 编译后将模块加载 insmod audit.o。（你可通过dmesg查看是加载信息）

3 修改/usr/include/asm/unistd.h ——在其中加入audit的系统调用号。这样用户空间才可找到audit系统调用了。

4 最后，我们写一个用户deamon程序，来循环调用audit系统调用，并把搜集到的信息打印到屏幕上。

完了。系统调用还有许多细节，请大家查看有关书记吧。不罗索了。再见。

相关代码请下载 auditexample.tar （实现于2.4.18内核）。

感谢SAL的开发者，例子程序基本框架来自于它们的灵感。

[1]我们说的开发内核者指开发系统内核，比如开发驱动模块机制、开发系统调用机制；而内核开发者则是指在内核基础之上进行的开发，比如驱动开发、系统调用开发、文件系统开发、网络通讯协议开发等。我们杂志所关注的问题主要在内核开发层次，即利用内核提供的机制进行开发。

[2]对Linux而言，系统调用是用户程序访问内核的唯一手段，无论是/proc方式或设备文件方式归根到底都是利用系统调用完成的。

[3]内核编程相比用户程序编程有一些特点，简单的讲内核程序一般不能引用C库函数（除非你自己实现了，比如内核实现了不少C库种的String操作函数）；缺少内存保护措施；堆栈有限（因此调用嵌套不能过多）；而且由于调度关系，必须考虑内核执行路径的连续性，不能有长睡眠等行为。

[4]软件中断虽然叫中断，但实际上属于异常（更准确说是陷阱）——CPU发出的中断——而且是由编程者触发的一种特殊异常。

[5]系统调用过程可被理解成——由内核在核心态代表应用程序执行任务。

[6]除了进程上下文外，Linux系统中还有另一种上下文——它被成为中断上下文。中断上下文不同于进程上下文，它代表中断执行，所以和进程是异步进行而且可以说毫不相干的。这种上下文中的程序，要避免睡眠因为无法被抢占。

[7]System_call是个通用的系统调用服务程序，或说系统调用入口程序，因为任何一个系统调用都要经过system_call统一处理（查找系统调用表，跳转到相应调用的服务例程），所以任何一次系统调用的信息都可被syscall_audit记录下来。

[8] 这里我们主要记录诸如调用时刻、调用者PID、程序名等信息，这些信息可从xtime或current这些全局变量处取得。

[9] 这里需要利用等待队列，具体声明见DECLARE_WAIT_QUEUE_HEAD(buffer_wait)。

[10] 所谓挂上或卸下其实就是将函数指针指向模块中实现的函数或指向空函数，但要知道这些函数指针一定是要导出到内核符号表中的，否则找不到。

[11] 这是一个系统提供的内核函数，目的就是从内核向用户空间传递数据。

Printf从函数库到OS跟踪流程

tek-life — Tue, 12 Oct 2010 09:43:57 +0000

首先需要弄清楚：API－用户编程借口与系统调用的区别，这里有一篇非常好的文章:

http://www.tek-life.org/2010/10/12/linux%E7%B3%BB%E7%BB%9F%E8%B0%83%E7%94%A8%EF%BC%BBz%EF%BC%BD/

另外，printf具体内部原理请见：

http://www.tek-life.org/2010/10/12/printf%E5%92%8C%E6%A0%87%E5%87%86%E8%BE%93%E5%87%BA%EF%BC%BBz%EF%BC%BD/

我仅仅是进行了code review

arch/x86/boot/printf.c

int printf(const char *fmt, …)

{

char printf_buf[1024];

va_list args;

int printed;

va_start(args, fmt);

printed = vsprintf(printf_buf, fmt, args);

va_end(args);

puts(printf_buf);

return printed;

}

void __attribute__((section(“.inittext”))) puts(const char *str)

{

int n = 0;

while (*str) {

putchar(*str++);

n++;

}

* These functions are in .inittext so they can be used to signal

* error during initialization.

void __attribute__((section(“.inittext”))) putchar(int ch)

{

unsigned char c = ch;

if (c == ‘\n’)

putchar(‘\r’); /* \n -> \r\n */

/* int $0×10 is known to have bugs involving touching registers

it shouldn’t. Be extra conservative… */

asm volatile(“pushal; pushw %%ds; int $0×10; popw %%ds; popal”

: : “b” (0×0007), “c” (0×0001), “a” (0x0e00|ch));

}

我擦，跟踪错了！这是在实模式！调用10号中断显示。注释上写的很清楚，他们被安排在inittext段，当且进当在初始化的时候会调用。Inittext会被擦除的。

10号调用的具体参数：

BIOS 呼叫 INT 10H，AH=0EH
在文字模式或绘图模式下显示一字元，游标则右移一格
(AL) <= 字元 ascii
(BH) <= 页码
(BL) <= 前景颜色码 (绘图模式时)
注:所谓 TTY 就是类似打字机输出方式，每显示一字元，游标则右移一格，
当移到最后一行时，游标则至跳下一列的最左边开始，当移到最后一列
时，萤幕则上卷一列

看一下C库函数中的具体实现：

采用ulibc

libc/stdio/printf.c:

int printf(const char * __restrict format, …){

va_list arg;

int rv;

va_start(arg, format);

rv = vfprintf(stdout, format, arg);

va_end(arg);

return rv;

}

libc/stdio/old_vfprintf.c

int vfprintf(FILE * __restrict op, register const char * __restrict fmt,

va_list ap)

{

union {

#ifdef LLONG_MAX

long long ll;

#endif

#if LONG_MAX != INT_MAX

long l;

#endif

int i;

} intarg;

int i, cnt, dataargtype, len;

const void *argptr = argptr; /* ok to be initialized. */

const char *fmt0;

int preci, width;

#define upcase i

int radix, dpoint /*, upcase*/;

char tmp[65]; /* TODO – determine needed size from headers */

char flag[sizeof(spec)];

__STDIO_AUTO_THREADLOCK_VAR;

__STDIO_AUTO_THREADLOCK(op);

__STDIO_STREAM_VALIDATE(op);

cnt = 0;

if (__STDIO_STREAM_IS_NARROW_WRITING(op)

|| !__STDIO_STREAM_TRANS_TO_WRITE(op, __FLAG_NARROW)

) {

while (*fmt) {

if (*fmt == ‘%’) {

fmt0 = fmt; /* save our position in case of bad format */

++fmt;

width = -1; /* min field width */

preci = -5; /* max string width or mininum digits */

radix = 10; /* number base */

dpoint = 0; /* found decimal point */

/* init flags */

for (p =(char *) spec ; *p ; p++) {

flag[p-spec] = ‘\0′;

}

flag[FLAG_0_PAD] = ‘ ‘;

/* process optional flags */

for (p = (char *)spec ; *p ; ) {

if (*fmt == *p) {

flag[p-spec] = *fmt++;

p = (char *)spec; /* restart scan */

} else {

p++;

}

if (!flag[FLAG_PLUS]) {

flag[FLAG_PLUS] = flag[FLAG_SPACE];

}

/* process optional width and precision */

do {

if (*fmt == ‘.’) {

++fmt;

dpoint = 1;

}

if (*fmt == ‘*’) { /* parameter width value */

++fmt;

i = va_arg(ap, int);

} else {

for ( i = 0 ; (*fmt >= ’0′) && (*fmt <= ’9′) ; ++fmt ) {

i = (i * 10) + (*fmt – ’0′);

}

if (dpoint) { preci = i;

if (i<0) {

preci = -5;

}

} else {

width = i;

if (i<0) {

width = -i;

flag[FLAG_MINUS_LJUSTIFY] = 1;

}

} while ((*fmt == ‘.’) && !dpoint );

/* process optional qualifier */

p = (char *) qual_chars;

do {

if (*fmt == *p) {

++fmt;

break;

}

} while (*++p);

if ((p – qual_chars < 2) && (*fmt == *p)) {

p += ((sizeof(qual_chars)-2) / 2);

++fmt;

}

dataargtype = ((int)(p[(sizeof(qual_chars)-2) / 2])) << 8;

#if WANT_GNU_ERRNO

if (*fmt == ‘m’) {

flag[FLAG_PLUS] = ‘\0′;

flag[FLAG_0_PAD] = ‘ ‘;

p = __glibc_strerror_r(errno, tmp, sizeof(tmp));

goto print;

}

#endif

/* process format specifier */

for (p = (char *) u_spec ; *p ; p++) {

if (*fmt != *p) continue;

if (p-u_spec < 1) { /* print a % */

goto charout;

}

if (p-u_spec < 2) { /* store output count in int ptr */

_store_inttype(va_arg(ap, void *),

dataargtype,

(intmax_t) (cnt));

goto nextfmt;

}

if (p-u_spec < 10) {

if (*p == ‘p’) {

#if INTPTR_MAX == INT_MAX

dataargtype = 0;

#else

#error Fix dataargtype for pointers!

#endif

}

switch(dataargtype) {

case (PA_INT|PA_FLAG_LONG_LONG):

#ifdef LLONG_MAX

intarg.ll = va_arg(ap, long long);

argptr = &intarg.ll;

break;

#endif

case (PA_INT|PA_FLAG_LONG):

#if LONG_MAX != INT_MAX

intarg.l = va_arg(ap, long);

argptr = &intarg.l;

break;

#endif

default:

intarg.i = va_arg(ap, int);

argptr = &intarg.i;

break;

}

if (p-u_spec < { /* unsigned conversion */

radix = u_radix[p-u_spec-2];

upcase = ((*p == ‘x’) ? __UIM_LOWER : __UIM_UPPER);

if (*p == ‘p’) {

upcase = __UIM_LOWER;

flag[FLAG_HASH] = ‘p’;

}

p = _uintmaxtostr(tmp + sizeof(tmp) – 1,

(uintmax_t)

_load_inttype(dataargtype, argptr, radix),

radix, upcase);

flag[FLAG_PLUS] = ‘\0′; /* meaningless for unsigned */

if (*p != ’0′) { /* non-zero */

if (flag[FLAG_HASH]) {

if (radix == {

*–p = ’0′; /* add leadding zero */

} else if (radix != 10) { /* either 2 or 16 */

flag[FLAG_PLUS] = ’0′;

*–p = ‘b’;

if (radix == 16) {

*p = ‘x’;

if (*fmt == ‘X’) {

*p = ‘X’;

}

} else if (flag[FLAG_HASH] == ‘p’) { /* null pointer */

p = “(nil)”;

}

} else if (p-u_spec < 10) { /* signed conversion */

p = _uintmaxtostr(tmp + sizeof(tmp) – 1,

(uintmax_t)

_load_inttype(dataargtype, argptr, -radix),

-radix, upcase);

} else if (p-u_spec < 12) { /* character or string */

flag[FLAG_PLUS] = ‘\0′;

flag[FLAG_0_PAD] = ‘ ‘;

if (*p == ‘c’) { /* character */

p = tmp;

*p = va_arg(ap, int);

/* This takes care of the “%c”,0 case */

len = 1;

goto print_len_set;

} else { /* string */

p = va_arg(ap, char *);

if (!p) {

p = “(null)”;

preci = 6;

} else {

if (preci < 0) {

preci = INT_MAX;

}

len = strnlen(p, preci);

goto print_len_set;

}

#if defined(__UCLIBC_HAS_FLOATS__) || WANT_FLOAT_ERROR

} else if (p-u_spec < 27) { /* floating point */

#endif /* defined(__UCLIBC_HAS_FLOATS__) || WANT_FLOAT_ERROR */

#if defined(__UCLIBC_HAS_FLOATS__)

struct printf_info info;

if (preci < 0) {

preci = 6;

}

info.width = width;

info.prec = preci;

info.spec = *fmt;

info.pad = flag[FLAG_0_PAD];

info._flags = 0;

if (flag[FLAG_PLUS] == ‘+’) {

PRINT_INFO_SET_FLAG(&info,showsign);

} else if (flag[FLAG_PLUS] == ‘ ‘) {

PRINT_INFO_SET_FLAG(&info,space);

}

if (flag[FLAG_HASH]) {

PRINT_INFO_SET_FLAG(&info,alt);

}

if (flag[FLAG_MINUS_LJUSTIFY]) {

PRINT_INFO_SET_FLAG(&info,left);

}

#if 1

cnt += _fpmaxtostr(op,

(__fpmax_t)

((dataargtype == (8 << 8))

? va_arg(ap, long double)

: (long double) va_arg(ap, double)),

&info, _fp_out_narrow);

#else

cnt += _fpmaxtostr(op,

(__fpmax_t)

((lval > 1)

? va_arg(ap, long double)

: (long double) va_arg(ap, double)),

&info, _fp_out_narrow);

#endif

goto nextfmt;

#elif WANT_FLOAT_ERROR

(void) ((lval > 1) ? va_arg(ap, long double)

: va_arg(ap, double)); /* carry on */

p = (char *) dbl_err;

#endif /* defined(__UCLIBC_HAS_FLOATS__) */

}

#if WANT_GNU_ERRNO

print:

#endif

{ /* this used to be printfield */

/* cheaper than strlen call */

/* for ( len = 0 ; p[len] ; len++ ) { } */

len = strnlen(p, SIZE_MAX);

print_len_set:

if ((*p == ‘-’)

#if WANT_GNU_ERRNO

&& (*fmt != ‘m’)

#endif

&& (*fmt != ‘s’)) {

flag[FLAG_PLUS] = *p++;

–len;

}

if (flag[FLAG_PLUS]) {

++len;

++preci;

if (flag[FLAG_PLUS] == ’0′) { /* base 16 */

++preci; /* account for x or X */

}

if (preci >= 0) {

if ((*fmt == ‘s’)

#if WANT_GNU_ERRNO

|| (*fmt == ‘m’)

#endif

) {

if (len > preci) {

len = preci;

} else {

preci = len;

}

preci -= len;

if (preci < 0) {

preci = 0;

}

width -= preci;

}

width -= len;

if (width < 0) {

width = 0;

}

if (preci < 0) {

preci = 0;

if (!flag[FLAG_MINUS_LJUSTIFY]

/* && flag[FLAG_PLUS] */

&& (flag[FLAG_0_PAD] == ’0′)) {

preci = width;

width = 0;

}

while (width + len + preci) {

unsigned char ch;

/* right padding || left padding */

if ((!len && !preci)

|| (width && !flag[FLAG_MINUS_LJUSTIFY])) {

ch = ‘ ‘;

–width;

} else if (flag[FLAG_PLUS]) {

ch = flag[FLAG_PLUS]; /* sign */

if (flag[FLAG_PLUS]==’0′) { /* base 16 case */

flag[FLAG_PLUS] = *p++; /* get the x|X */

} else {

flag[FLAG_PLUS] = ‘\0′;

}

–len;

} else if (preci) {

ch = ’0′;

–preci;

} else {

ch = *p++; /* main field */

–len;

}

++cnt;

PUTC(ch, op);

}

goto nextfmt;

}

fmt = fmt0; /* this was an illegal format */

}

charout:

++cnt;

PUTC(*fmt, op); /* normal char out */

nextfmt:

++fmt;

}

i = (__FERROR_UNLOCKED(op)) ? -1 : cnt;

__STDIO_STREAM_VALIDATE(op);

__STDIO_AUTO_THREADUNLOCK(op);

return i;

}

libc/stdio/old_vfprintf.c

#define PUTC(C,F) putc_unlocked((C),(F))

include/stdio.h

define putc_unlocked(_ch, _fp) __PUTC_UNLOCKED(_ch, _fp)

libc/sysdeps/linux/common/bits/uClibc_stdio.h

#define __PUTC_UNLOCKED(__c, __stream) (__fputc_unlocked)((__c),(__stream))

libc/stdio/fputc.c

int __fputc_unlocked(int c, register FILE *stream)

{

__STDIO_STREAM_VALIDATE(stream);

/* First the fast path. We’re good to go if putc macro enabled. */

if (__STDIO_STREAM_CAN_USE_BUFFER_ADD(stream)) {

__STDIO_STREAM_BUFFER_ADD(stream, ((unsigned char) c));

return (unsigned char) c;

}

/* Next quickest… writing and narrow oriented, but macro

* disabled and/or buffer is full. */

if (__STDIO_STREAM_IS_NARROW_WRITING(stream)

|| !__STDIO_STREAM_TRANS_TO_WRITE(stream, __FLAG_NARROW)

) {

if (__STDIO_STREAM_IS_FAKE_VSNPRINTF(stream)) {

return (unsigned char) c;

}

if (__STDIO_STREAM_BUFFER_SIZE(stream)) { /* Do we have a buffer? */

/* The buffer is full and/or the stream is line buffered. */

if (!__STDIO_STREAM_BUFFER_WAVAIL(stream) /* Buffer full? */

&& __STDIO_COMMIT_WRITE_BUFFER(stream) /* Commit failed! */

) {

goto BAD;

}

#ifdef __UCLIBC_MJN3_ONLY__

#warning CONSIDER: Should we fail if the commit fails but we now have room?

#endif

__STDIO_STREAM_BUFFER_ADD(stream, ((unsigned char) c));

if (__STDIO_STREAM_IS_LBF(stream)) {

if ((((unsigned char) c) == ‘\n’)

&& __STDIO_COMMIT_WRITE_BUFFER(stream)) {

/* Commit failed! */

__STDIO_STREAM_BUFFER_UNADD(stream); /* Undo the write! */

goto BAD;

}

} else {

/* NOTE: Do not try to save space by moving uc to the top of

* the file, as that dramaticly increases runtime. */

unsigned char uc = (unsigned char) c;

if (! __stdio_WRITE(stream, &uc, 1)) { //如果没有缓冲区，那么就输出到标准输出中

goto BAD;

}

return (unsigned char) c;

}

BAD:

return EOF;

}

libc/stdio/_WRITE.c

size_t attribute_hidden __stdio_WRITE(register FILE *stream,

{

size_t todo;

ssize_t rv, stodo;

__STDIO_STREAM_VALIDATE(stream);

assert(stream->__filedes >= -1);

assert(__STDIO_STREAM_IS_WRITING(stream));

assert(!__STDIO_STREAM_BUFFER_WUSED(stream)); /* Buffer must be empty. */

todo = bufsize;

do {

if (todo == 0) { /* Done? */

__STDIO_STREAM_VALIDATE(stream);

return bufsize;

}

stodo = (todo <= SSIZE_MAX) ? todo : SSIZE_MAX;

if ((rv = __WRITE(stream, (char *) buf, stodo)) >= 0) { //写到标准输出中

#ifdef __UCLIBC_MJN3_ONLY__

#warning TODO: Make custom stream write return check optional.

#endif

#ifdef __UCLIBC_HAS_GLIBC_CUSTOM_STREAMS__

assert(rv <= stodo);

if (rv > stodo) { /* Wrote more than stodo! */

/* abort(); */

}

#endif

todo -= rv;

buf += rv;

} else

#ifdef __UCLIBC_MJN3_ONLY__

#warning EINTR?

#endif

/* if (errno != EINTR) */

{

__STDIO_STREAM_SET_ERROR(stream);

#ifdef __STDIO_BUFFERS

if ((stodo = __STDIO_STREAM_BUFFER_SIZE(stream)) != 0) {

unsigned char *s;

if (stodo > todo) {

stodo = todo;

}

s = stream->__bufstart;

do {

if (((*s = *buf) == ‘\n’)

&& __STDIO_STREAM_IS_LBF(stream)

) {

break;

}

++s;

++buf;

} while (–stodo);

stream->__bufpos = s;

todo -= (s – stream->__bufstart);

}

#endif /* __STDIO_BUFFERS */

__STDIO_STREAM_VALIDATE(stream);

return bufsize – todo;

}

} while (1);

}

libc/stdio/_stdio.h

#define __WRITE(STREAMPTR,BUF,SIZE) \

((((STREAMPTR)->__gcs.write) == NULL) ? -1 : \

(((STREAMPTR)->__gcs.write)((STREAMPTR)->__cookie,(BUF),(SIZE))))

这个write到底怎么实现呢？

看：

libc/stdio/_fopen.c：

__STDIO_STREAM_RESET_GCS(stream);

libc/stdio/_stdio.h：

#define __STDIO_STREAM_RESET_GCS(S) \

(S)->__cookie = &((S)->__filedes); \

(S)->__gcs.read = _cs_read; \

(S)->__gcs.write = _cs_write; \

(S)->__gcs.seek = _cs_seek; \

(S)->__gcs.close = _cs_close

libc/stdio/_cs_funcs.c：

ssize_t attribute_hidden _cs_write(void *cookie, const char *buf, size_t bufsize)

{

return write(*((int *) cookie), (char *) buf, bufsize);

}

这个write是怎么实现呢？通过系统调用，不过，这个write的API在哪里实现呢？

在内核中，我还没有找到，不过，从Linux的API列表中，看到了。具体方法是：

#:man 2 syscalls

系统调用服务例程：

asmlinkage ssize_t sys_write(unsigned int fd, const char __user * buf, size_t count)

{

struct file *file;

ssize_t ret = -EBADF;

int fput_needed;

file = fget_light(fd, &fput_needed);

if (file) {

loff_t pos = file_pos_read(file);

ret = vfs_write(file, buf, count, &pos);

file_pos_write(file, pos);

fput_light(file, fput_needed);

}

return ret;

}

struct file *fget_light(unsigned int fd, int *fput_needed)

{

struct file *file;

struct files_struct *files = current->files;

*fput_needed = 0;

if (likely((atomic_read(&files->count) == 1))) {

file = fcheck_files(files, fd);

} else {

rcu_read_lock();

file = fcheck_files(files, fd);

if (file) {

if (atomic_inc_not_zero(&file->f_count))

*fput_needed = 1;

else

/* Didn’t get the reference, someone’s freed */

file = NULL;

}

rcu_read_unlock();

}

return file;

}

fs/read_write.c

ssize_t vfs_write(struct file *file, const char __user *buf, size_t count, loff_t *pos)

{

ssize_t ret;

if (!(file->f_mode & FMODE_WRITE))

return -EBADF;

if (!file->f_op || (!file->f_op->write && !file->f_op->aio_write))

return -EINVAL;

if (unlikely(!access_ok(VERIFY_READ, buf, count)))

return -EFAULT;

ret = rw_verify_area(WRITE, file, pos, count);

if (ret >= 0) {

count = ret;

if (file->f_op->write)

ret = file->f_op->write(file, buf, count, pos);

else

ret = do_sync_write(file, buf, count, pos);

if (ret > 0) {

fsnotify_modify(file->f_path.dentry);

add_wchar(current, ret);

}

inc_syscw(current);

}

return ret;

}

A Skills List for Developing Embedded Software

tek-life — Sat, 09 Oct 2010 03:00:38 +0000

A Skills List for Developing Embedded Software

Dale Word
Dept. of Electrical and Computer Engineering
California State University, Chico

1. What’s Unique About Embedded Development

The very nature of embedded systems dictates that the development of software for them is different than software for general purpose computers.

a. Background

The key factors that separate embedded computer systems from other type of computer based systems are as follows:

· Dedicated Function – Embedded systems are designed to perform one specific set of functions, typically as part of a larger device or system. This is in contrast with a typical desktop system that is a general purpose computing platform, designed to support a variety of applications, each performing a different set of functions.

· Limited Resources – Due to the fact that embedded systems are typically a component of a larger system, rather than a standalone computing device, they commonly are designed with limited computing resources. This can be the result a desire to reduce production costs, or as a result of the operating environment of the end system. These limitations include the lack of graphical user interfaces, limited storage devices, limited processing power, etc.

· Hardware Interaction – In general purpose computing systems, the details of the operating environment a typically abstracted by different operating system layers, to enhance portability and interoperability. The limited resources and specific nature of embedded systems prevent the use of those same layers, requiring the embedded software to interface to the operating environment much more directly.

· Real-Time Processing – The high level of integration with additional devices and equipment in embedded systems frequently dictate that they perform their processing in a fixed time interval. The “realtime” aspect of the application adds additional complexity to all phases of the development process, from design to testing.

Defining the characteristics of embedded systems is very inexact, because embedded systems vary widely in their configurations and capabilities. There is a full spectrum of systems that are considered embedded systems, from the smallest 8 bit microcontroller system, to the highest end, high performance multiprocessor based multitasking system.

b. Differentiating Factors – Development

The unique set of characteristics that define embedded systems result in an equally unique set of development considerations.

· Resource Limitations – Developing code in a resource limited environment requires developers to consider not only the functional aspects of their code, but also its resource usage. This includes memory usage, processor loading, data representation, etc.

· Hardware Interaction – The low level, hardware intensive code that is required in many embedded systems requires an intimate knowledge of the hardware components being used, and the techniques required to access them directly.

· Real-Time – The addition of temporal requirements to any set of software can multiply the complexity of the implementation. The need to consider execution time and behavior patterns significantly changes every aspect of the implementation process.

· Development Cycle – In software development efforts for general purpose computers, the target hardware platform is well-known, fixed, and well defined. In embedded systems this is frequently not the case. The target hardware can vary from a sophisticated, well defined, off-the-shelf platform to a completely untested prototype design. In the cases where hardware development is parallel to the software development, the potential for hardware problems requires that embedded developers consider a much more complex set of possibilities when problem solving. If the software development cycle precedes the hardware development, the software set may need to be developed on a prototype platform, and ported to the actual target when it becomes available.

2. Historical Perspective on Software Development

Software development, in years past, required many of the skills that embedded development continues to require today. Historically, operating systems and development environments were not sophisticated enough to eliminate the need for the low level skills of an embedded developer. As the technologies have improved, there has been a movement toward more and more abstraction of the underlying hardware and operating system. This increasing abstraction of the target hardware, combined with increasingly sophisticated development tools, has given rise to a growing number of software developers that do not possess the skills required by embedded development. Graphically based, integrated development toolsets have only exacerbated the problem, allowing “point and click” development cycles, that require little or no understanding of what is going on below the application level. In fairness, it should be stated that this trend toward abstraction and tool sophistication has yielded great gains in productivity for general software development. Unfortunately, these gains have come at the cost of losing the skill base that applies directly to embedded development.

3. Detailed Skills List

The development of embedded software applications requires a skill set that
focuses on these unique characteristics of embedded systems.

a. Architecture Concepts

One of the key areas of knowledge that is required for embedded development is an understanding and awareness of the underlying computer architecture of the target system.

· Memory Map View – Embedded developers need to have a very “physical” view of their applications. This includes an understanding of the overall memory layout of the target system, and where each component of their application resides in that memory. This view can be obtained by a quick study of the memory map (generated during the link process). It should include an understanding of where code and data segments exist, where stack, heap and constant storage is allocated. This “physical” view, like many of the other skills described in this section, is more critical in systems that have limited memory resources, and less critical in systems with more memory and more sophisticated operating systems.

· Stack Operations – One of the best ways to gather information about the current state of execution in a multitasking embedded system is to take a snapshot of the stack, and use it to determine the sequence of calls that have led to the current state. In order to do this, a developer must have a good understanding of the way exception processing and context switching affect the contents of the stack, and the structure of the stack frames and context sets that are pushed onto the stack.

· Instruction Set Architecture – An understanding of the target processor details is another important part of an embedded developer’s skill set. This should include things like: Register Sets, Processor Modes, Addressing Modes, Processor Status Registers, etc. This set of skills may not be required in most development cycles, but can be crucial in resolving subtle problems during debugging, or when implementing advanced features that directly rely on some unique aspect of the processor.

· Exception Handling – A basic understanding of exception and interrupt handling is important in dealing with external events or data sources, and error conditions that result in a processor exception. This level of processing is typically handled for, and hidden from the developer in more sophisticated operating system and toolset systems.

b. Programming Skills:

The range of programming skills and the different areas of focus can be viewed as a spectrum, from the most abstract, high level programming environments to the lowest level, most hardware specific environment. While development for general purpose machines typically focuses on more abstract, high level programming concepts, embedded developers must also focus on low level, more hardware specific details. Figure 1 depicts this relationship graphically.

· Assembly Language Programming – Assembly language code historically has been an important part of many embedded systems, providing better performance and a smaller footprint for critical sections of code. With the advances in processor speed and memory size relative to cost, this is becoming less and less necessary. A basic knowledge of the assembly language of your target processor is important, but more of a background topic than a central development skill as it was in the past.

· Low Level C Programming – One of the key characteristics of embedded software is its low level, direct interaction with hardware. To implement these functions in C, there are a few specific aspects of the language that need to be understood:
     o Direct memory access using type casting of constant values
          *(int *)0xFFF0000 = some_value;
          status = *(int *)0xFFF00000;
     o Bit level operations, including masking and shifting
         *(int *)UART_STAT_REG = uart_status & TX_EN_BIT & RX_EN_BIT;

While these are not new concepts to experienced C programmers, they are commonly misunderstood or overlooked by developers coming from a higher level, more abstract programming background.

c. Tools/Environment

The environment used to develop embedded software is sometimes the thing that is most different from other types of software development.

· Headless Targets – The very nature of an embedded device that doesn’t have any kind of external display or interfaces can make getting debugging information difficult. If you have sophisticated tools, this is usually not a problem. For the rare case where you don’t have support form tools, some cleverness and creativity may be required to gain visibility into the embedded application. This may involve using hardware that was not intended to communicate data to provide rudimentary information access.

· Cross Development – One of the key aspects that helps define embedded development is the pattern of cross development – creating code on a machine of one type, to run on a machine of a different type. Once this “foreign” executable has been created, it must be loaded onto the target hardware. This involves several concepts that are important for a developer to understand. First, a developer needs to understand what the boot sequence of the target device really is. Typically the device will boot to a monitor program in ROM, initialize some communications interface, and then wait to receive an executable code image from the development machine. Understanding this sequence, and where each of these components resides in the overall memory map is essential for a developer to have a clear picture of the target board’s behavior.

· Hardware Knowledge – The close interaction with hardware in embedded systems requires that developers understand the characteristics and capabilities of each external (to the CPU) hardware component being accessed. This usually means studying databooks and reference manuals for the specific chips involved, and developing an understanding of the configuration and operation of each of them. This is an area in which example code sets can be of great value in helping speed up the learning process. Looking at an existing driver for the chip you’re using can often yield great insights into its use.

d. Problem Solving

One of the things that separates embedded development most from general purpose systems development is the unique set of problem solving skills it requires.

· Real-Time Debugging – The addition of real time constraints to an application not only complicates the design and development process, but can make the debugging process extremely complex. The key difference is the need to maintain an intuitive model of the temporal aspects of the application. This includes recognizing the different behaviors that result from timing dependencies, resource conflicts, interrupt processing, etc.

· Understand Your Toolset – Starting out with any new embedded development tool set can be a trying process. Most modern tools sets provide a wealth of information and features, but they require an investment of time to learn the details of how to make use of these capabilities. The time spent learning a toolset almost always pays off later in time saved during debugging. Besides learning what a toolset CAN do, it is also crucial to understand its limitations. Examples of this include understanding the effects of remote debug tasks running on your target systems, or pipeline behavior and its affect on emulator performance.

· Holistic Problem Solving – The term holsitic is defined as “ views in which the individual elements of a system are determined by their relations to all other elements of that system”. A holistic approach to problem solving involves looking at all the system components, and objectively analyzing the data to determine the root causes of a problem. The holistic nature of this approach means that the interactions of all components (hardware, RTOS, application software, etc. ) are considered together to identify the causes of unwanted behaviors.

· Vertical vs Horizontal Problem Space – When considering the components that make up any computer system, one way to view the overall picture is to look at it as a hierarchy, layered from the most concrete (hardware) to the most abstract (user interface). Given this view as a backdrop, it is useful to look at the number of layers that are incorporated into a typical training or problem solving exercise. For most formal academic programs, the focus is on doing very detailed work on one or two layers, taking a “horizontal slice” of the overall problem space. This approach, while giving a great deal of exposure to one specific layer of the problem space, fails to model the way difficult problems are solved in real commercial environments.

· Given a difficult or subtle problem, it is often required to take a top to bottom view of the problem, or a “vertical slice” of the problem space. This ability to seek solutions across functional boundaries, and “drill down” through the layers of a system is characteristic of embedded systems development.

· Problem Solving Methodology – Arthur Clarke, the famous science fiction author and futurist, once said: “Any sufficiently advanced technology is indistinguishable from magic.” I would propose that there is an embedded corollary that says: “advanced technology produces problems that ARE indistinguishable from magic (at first)”. The following is a list of problem solving steps:

1. Find Clues – Like NTSB sifting through the wreckage of a plane crash – examine each small piece may have some significance. Look at stack traces, buffer contents, etc., identifying anything that indicates unexpected behavior.

2. Gather as much information as possible – The solution often lies not in some complex implementation detail, but rather in taking a simple (and somehow different) view of what is occurring.

3. Pursue Theories –Like walking a maze, pursue each path until you’re sure it has been exhausted. When that path has been exhausted, backtrack and start pursuing another one.

4. Find the answer – Don’t assume that making some fairly arbitrary change that makes the problem go away is an adequate solution. Find the root cause, so you can be sure it is completely eradicated from the system.

5. Logic is your main tool – No matter how much pressure you’re under, hang on to a logical, methodical approach. Be careful to distinguish between what you know (and have proven), versus what you’re assuming.

4. Transitioning to Embedded Development

For any organization transitioning to embedded development for the first time, the first, most critical resource is the development staff. Creating an embedded development team means either hiring the necessary talent or providing specific training for current developers who may lack the specific skills required for embedded development.

a. Hiring – Degree programs

Obviously, if the situation permits, hiring experienced embedded developers is preferable. While evaluating the industry experience of a candidate and its applicability to any development effort is too specific to discuss in general terms, the applicability of different engineering degree types and their applicability to embedded development can be briefly summarized.

· Computer Science – In the past 20 years or so, the focus of Computer Science degree programs has changed. In the early days of the computer industry, Computer Science programs tended to teach the fundamental concepts associated with software theory, development and design – without addressing specific application areas as major topics. As the industry and technologies have matured, these application areas have become recognized sub-disciplines of Computer Science. This has led to more concentration on these more abstract areas of study, with a reduction in the amount of time spent addressing low level, concrete details. For embedded development, this means that some Computer Science graduates may lack adequate exposure to things like assembly language programming, interrupt and driver level code, etc. The positive aspect of this trend toward abstraction is that many of these same graduates may be more highly skilled in design approaches, leading to higher quality code once they overcome any low level shortcomings they may have.

· Electrical Engineering – On the opposite end of the spectrum is the hardware-focused discipline of Electrical Engineering. Just as in Computer Science, the evolution of the industry has led to more diversity and specialization in this discipline also. This trend requires an increased focus on these Electrical Engineering specific topics, and less on software related concepts. One development that may help prepare Electrical Engineering students for a transition to more software oriented tasks is the growth in the use of high level logic design languages. Experience with these tools, even in the context of circuit design, provides some fundamental knowledge that can ease the transition into code development later.

· Computer Engineering – Given the constant growth in the amount of information that must be included in Computer Science and Electrical Engineering programs, it follows that these programs would need to spend more time addressing those topics firmly within their disciplines, leaving less time to address topics in the other discipline. As these programs migrate toward their ends of the spectrum, the growing void is filled by the somewhat younger discipline of Computer Engineering. Focusing on both hardware and software concepts, it clearly addresses the issues associated with embedded development.

· Finding the Right Fit – Figure 3 shows a graphical view of this degree program spectrum.

The key to finding the best candidates for a given organization is to identify where in this spectrum of knowledge skills are needed, and finding candidates whose backgrounds match up.

b. Professional Training

For existing employees without a background in embedded development, or for those needing a refresher course, some professional training may be required.

· Extension/Remote Classroom Programs – With the growth in remote classes being offered via the internet, many options exist for acquiring embedded development education in this manner. The following is a brief list of some of these programs:
     Embedded development certificate programs:
          University of California, San Diego
          University of Colorado at Boulder
          University of Washington
    Embedded development courses offered:
          University of California, Berkeley
          University of California, Irvine
          Iowa State University
     (See the references at the end of this document for web links to each of these programs)

· Mentoring – A more informal means of providing training is to establish a mentoring program, using more experienced developers to train their less experienced peers. One way to accomplish this is to have the trainee “shadow” the mentor through a full development cycle. If there are no experienced mentors available in-house, it may be beneficial to hire outside consultants to lead an early development cycle, while acting as mentors to the permanent development staff.

· Self Teaching – A final option, if no other resources are available, is to explore selfteaching exercises. The most common way to do this is with the aid of a reference text. This text should address general embedded development concepts, and provide a set of examples to work through, on some form of target hardware. This kind of exercise can provide a good initial hands-on learning experience. The problems with this approach are 1) help can be difficult to get when you get stuck, and 2) they’re usually based on fairly simplistic, low cost target hardware, restricting the complexity of the exercises. (See the book references at the end of this document for some title suggestions)

5. Tips/Hints

The following is a list of informal tips for getting started with, and getting through your first embedded development effort:

· Start with reliable target hardware – The last thing you need during your first embedded project is to have more problems and variables introduced by the hardware. If your final target is a custom board, start with a similar evaluation board until you get past the early stages of the software development process.

· Do not overestimate the value of demo code – Getting someone else’s code to run, no matter how great of a demo it is, is not the same as generating your own working code from scratch. There may be several issues to be resolved in the process of getting your code to actually run on the board.

· Start simple – Get it to do something simple first. Take small steps early, to verify your basic assumptions, before you start adding complexity.

· DO NOT expect vendors to design your product – Most vendors of embedded development products provide great support, often with very experienced embedded developers. Be careful not to ask them to design your product for you, 1) it’s not their job – they support their product, not everything that can be produced with it, and 2) you’ll probably get a design that looks more like their latest application note, rather than a good solution for your product.

· DO expect vendors to solve their own problems – When you encounter problems with a tool, and the answer is not obvious in the documentation, use the vendor’s support services. You may be struggling with a problem they’ve seen before. Be prepared to isolate the problem section of your code by generating a “cut-down” version of the code – this will greatly simplify the process of identifying the true cause of the problem.

· Keep a test/development log – Embedded systems, particularly real-time embedded systems, can exhibit complex and subtle behavior patterns. Over the span of a lengthy development cycle, it is difficult to track the cause-effect relationship between changes to the code and the resulting effect on behavior. A simple way to maintain a persistent record of this is to keep a log, with entries for every set of code changes, the date, and the test results generated. This does not have to be anything rigid or formal, but rather a set of notes, tailored to each developer’s personal style. Using some form of version control software to manage the code base is also very helpful, yielding a precise record of every change to the software, in chronological order.

· No matter how mysterious a problem seems, be methodical – Resist the temptation to make arbitrary changes to see if you can make an illusive problem go away. This will probably just cover up a problem that will come back to haunt you later. [Also: No matter how mysterious or bizarre the problem seems, don’t start sacrificing chickens or making offerings to the digital gods – it won’t help, and it looks vaguely unprofessional.]

6. Conclusion – Defining Your Needs

There is no single definition of the skill set required to begin embedded software development. The answer varies with each different development configuration. Factors like the complexity of the target system, the time and budget constraints involved, and the background of the existing development staff all contribute to the unique character of each development effort. The skills needed to develop embedded code for a simple, 8-bit microcontroller based product are distinctly different than those required for a high-end real-time system with multiple 32-bit processors. The key is to identify what your specific needs are for your development, and ensure that you satisfy those needs with the appropriate staff and equipment.

7. References

a. Books

“Programming Embedded Systems in C and C++”, Michael Barr, O’Reilly

“Fundamentals of Embedded Software: Where C and Assembly Meet”,
Daniel Lewis, Prentice Hall

“MicroC/OS-II, the Real Time Kernel”, Jean Labrosse, CMP

b. Websites

Embedded development certificate programs:

University of California, San Diego
http://www.extension.ucsd.edu/Programs/certificate_directory_su00.html
University of Colorado at Boulder
http://ece-www.colorado.edu/embedded.html
University of Washington
http://www.outreach.washington.edu/extinfo/certprog/emb/emb_main.asp

Embedded development courses:

University of California, Berkeley
http://www.unex.berkeley.edu/eng/#8
University of California, Irvine
http://www.unex.uci.edu/cgi-bin/order/scan/sf=catno/se=214
Iowa State University
http://www.lifelearner.iastate.edu/courses/disciplinesp03.htm

[转] platform设备驱动全透析

tek-life — Sun, 26 Sep 2010 07:34:09 +0000

转自：宋宝华博客http://blog.donews.com/21cnbao/archive/2010/07/14/1581997.aspx

宋宝华，其人：畅销书《linux设备驱动开发详解》作者。不多介绍。赶紧转入正题。

1.1 platform总线、设备与驱动

在Linux2.6的设备驱动模型中，关心总线、设备和驱动这3个实体，总线将设备和驱动绑定。在系统每注册一个设备的时候，会寻找与之匹配的驱动；相反的，在系统每注册一个驱动的时候，会寻找与之匹配的设备，而匹配由总线完成。

一个现实的Linux设备和驱动通常都需要挂接在一种总线上，对于本身依附于PCI、USB、I²C、SPI等的设备而言，这自然不是问题，但是在嵌入式系统里面，SoC系统中集成的独立的外设控制器、挂接在SoC内存空间的外设等确不依附于此类总线。基于这一背景，Linux发明了一种虚拟的总线，称为platform总线，相应的设备称为platform_device，而驱动成为platform_driver。

注意，所谓的platform_device并不是与字符设备、块设备和网络设备并列的概念，而是Linux系统提供的一种附加手段，例如，在S3C6410处理器中，把内部集成的I²C、RTC、SPI、LCD、看门狗等控制器都归纳为platform_device，而它们本身就是字符设备。platform_device结构体的
定义如代码清单1所示。

代码清单1

platform_device结构体

1struct platform_device {

2const char * name;/* 设备名 */

3 u32 id;

4 struct device dev;

5 u32 num_resources;/* 设备所使用各类资源数量 */

6 struct resource * resource;/* 资源 */

7 };

platform_driver这个结构体中包含probe()、remove()、shutdown()、suspend()、
resume()函数，通常也需要由驱动实现，如代码清单2。

代码清单2

platform_driver结构体

1 struct platform_driver {

2 int (*probe)(struct platform_device *);

3 int (*remove)(struct platform_device *);

4 void (*shutdown)(struct platform_device *);

5 int (*suspend)(struct platform_device *, pm_message_t state);

6 int (*suspend_late)(struct platform_device *, pm_message_t state);

7 int (*resume_early)(struct platform_device *);

8 int (*resume)(struct platform_device *);

9 struct pm_ext_ops *pm;

10 struct device_driver driver;

11};

系统中为platform总线定义了一个bus_type的实例platform_bus_type，其定义如代码清单.3。

代码清单.3
platform总线的bus_type
实例platform_bus_type

1 struct bus_type platform_bus_type = {

2 .name = “platform”,

3 .dev_attrs = platform_dev_attrs,

4.match = platform_match,

5.uevent = platform_uevent,

6 .pm= PLATFORM_PM_OPS_PTR,

7 };

8
EXPORT_SYMBOL_GPL(platform_bus_type);

这里要重点关注其match()成员函数，正是此成员表明了platform_device和platform_driver之间如何匹配，如代码清单4所示。

代码清单4
platform_bus_type的match()成员函数

1 static int platform_match(struct device *dev, struct device_driver *drv)

2 {

3 struct platform_device *pdev;

5 pdev = container_of(dev, struct platform_device, dev);

6 return (strncmp(pdev->name, drv->name, BUS_ID_SIZE) == 0);

7 }

从代码清单4的第6行可以看出，匹配platform_device和platform_driver主要看二者的name字段是否相同。

对platform_device的定义通常在BSP的板文件中实现，在板文件中，将platform_device归纳为一个数组，最终通过platform_add_devices()函数统一注册。platform_add_devices()函数可以将平台设备添加到系统中，这个函数的原型为：

int platform_add_devices(struct platform_device **devs, int num);

该函数的第一个参数为平台设备数组的指针，第二个参数为平台设备的数量，它内部调用了platform_device_register()函数用于注册单个的平台设备。

1.2 将globalfifo作为platform设备

现在我们将前面章节的globalfifo驱动挂接到platform总线上，要完成2个工作:

1. 将globalfifo移植为platform驱动。

2.在板文件中添加globalfifo这个platform设备。

为完成将globalfifo移植到platform驱动的工作，需要在原始的globalfifo字符设备驱动中套一层platform_driver的外壳，如代码清单5。注意进行这一工作后，并没有改变globalfifo是字符设备的本质，只是将其挂接到了platform总线。

代码清单5 为globalfifo添加platform_driver

1 static int __devinit globalfifo_probe(struct platform_device *pdev)

2 {

3 int ret;

4 dev_t devno = MKDEV(globalfifo_major, 0);

6 /*申请设备号*/

7 if (globalfifo_major)

8 ret = register_chrdev_region(devno, 1, “globalfifo”);

9 else
{ /* 动态申请设备号 */

10 ret = alloc_chrdev_region(&devno, 0, 1, “globalfifo”);

11 globalfifo_major = MAJOR(devno);

12 }

13 if (ret < 0)

14 return ret;

15 /*动态申请设备结构体的内存*/

16 globalfifo_devp = kmalloc(sizeof(struct globalfifo_dev), GFP_KERNEL);

17 if(!globalfifo_devp) { /*申请失败*/

18 ret = – ENOMEM;

19 goto fail_malloc;

20 }

22 memset(globalfifo_devp, 0, sizeof(struct globalfifo_dev));

24 globalfifo_setup_cdev(globalfifo_devp, 0);

26 init_MUTEX(&globalfifo_devp->sem); /*初始化信号量*/

27 init_waitqueue_head(&globalfifo_devp->r_wait); /*初始化读等待队列头*/

28 init_waitqueue_head(&globalfifo_devp->w_wait); /*初始化写等待队列头*/

30 return 0;

32 fail_malloc: unregister_chrdev_region(devno, 1);

33 return ret;

34 }

36 static int __devexit globalfifo_remove(struct platform_device *pdev)

37 {

38 cdev_del(&globalfifo_devp->cdev); /*注销cdev*/

39 kfree(globalfifo_devp); /*释放设备结构体内存*/

40 unregister_chrdev_region(MKDEV(globalfifo_major, 0), 1); /*释放设备号*/

41 return 0;

42 }

44 static struct platform_driver globalfifo_device_driver = {

45 .probe = globalfifo_probe,

46 .remove = __devexit_p(globalfifo_remove),

47 .driver = {

48 .name = “globalfifo”,

49 .owner = THIS_MODULE,

50 }

51 };

53 static int __init globalfifo_init(void)

54 {

55 return platform_driver_register(&globalfifo_device_driver);

56 }

58 static void __exit globalfifo_exit(void)

59 {

60 platform_driver_unregister(&globalfifo_device_driver);

61 }

63 module_init(globalfifo_init);

64 module_exit(globalfifo_exit);

在代码清单5中，模块加载和卸载函数仅仅通过platform_driver_register()、platform_driver_unregister()函数进行platform_driver的注册与注销，而原先注册和注销字符设备的工作已经被移交到platform_driver的probe()和remove()成员函数中。

代码清单5未列出的部分与原始的globalfifo驱动相同，都是实现作为字符设备驱动核心的file_operations的成员函数。

为了完成在板文件中添加globalfifo这个platform设备的工作，需要在板文件（对于LDD6410而言，为arch/arm/mach-s3c6410/ mach-ldd6410.c）中添加相应的代码，如代码清单6。

代码清单6
globalfifo对应的platform_device

1 static struct platform_device globalfifo_device = {

2 .name = “globalfifo”,

3 .id = -1,

4 };

对于LDD6410开发板而言，为了完成上述globalfifo_device这一platform_device的注册，只需要将其地址放
入 arch/arm/mach-s3c6410/mach-ldd6410.c中定义的ldd6410_devices数组，如：

static struct platform_device *ldd6410_devices[] __initdata = {

+ &globalfifo_device,

#ifdef
CONFIG_FB_S3C_V2

&s3c_device_fb,

#endif

&s3c_device_hsmmc0,

…

}

在加载LDD6410驱动后，在sysfs中会发现如下结点：

/sys/bus/platform/devices/globalfifo/

/sys/devices/platform/globalfifo/

留意一下代码清单5的第48行和代码清单6的第2行，platform_device和platform_driver的name一致，这是二者得以匹配的前提。

1.3 platform设备资源和数据

留意一下代码清单1中platform_device结构体定义的第5~6行，描述了platform_device的资源，资源本身由resource结构体描述，其定义如代码清单7。

代码清单7
resouce结构体定义

1 struct resource {

2 resource_size_t start;

3 resource_size_t end;

4 const char *name;

5 unsigned long flags;

6 struct resource *parent, *sibling, *child;

7 };

我们通常关心start、end和flags这3个字段，分别标明资源的开始值、结束值和类型，flags可以为IORESOURCE_IO、IORESOURCE_MEM、IORESOURCE_IRQ、IORESOURCE_DMA等。start、end的含义会随着flags而变更，如当flags为IORESOURCE_MEM时，start、end分别表示该platform_device占据的内存的开始地址和结束地址；当flags为IORESOURCE_IRQ时，start、end分别表示该platform_device使用的中断号的开始值和结束值，如果只使用了
1个中断号，开始和结束值相同。对于同种类型的资源而言，可以有多份，譬如说某设备占据了2个内存区域，则可以定义2个IORESOURCE_MEM资源。

对resource的定义也通常在BSP的板文件中进行，而在具体的设备驱动中透过platform_get_resource()这样的API来获取，此API的原型为：

struct resource *platform_get_resource(struct platform_device *, unsigned int, unsigned int);

譬如在LDD6410开发板的板文件中为DM9000网卡定义了如下resouce：

static struct resource ldd6410_dm9000_resource[] = {

[0] = {

.start = 0×18000000,

.end = 0×18000000 + 3,

.flags = IORESOURCE_MEM

[1] = {

.start = 0×18000000 + 0×4,

.end = 0×18000000 + 0×7,

.flags = IORESOURCE_MEM

[2] ={

.start = IRQ_EINT(7),

.end = IRQ_EINT(7),

.flags = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHLEVEL,

}

};

在DM9000网卡的驱动中则是通过如下办法拿到这3份资源：

db->addr_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);

db->data_res = platform_get_resource(pdev, IORESOURCE_MEM, 1);

db->irq_res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);

对于IRQ而言，platform_get_resource()还有一个进行了封装的变体platform_get_irq()，其原型为：

int platform_get_irq(struct platform_device *dev, unsigned int num);

它实际上调用了“platform_get_resource(dev,IORESOURCE_IRQ, num);”。

设备除了可以在BSP中定义资源以外，还可以附加一些数据信息，因为对设备的硬件描述除了中断、内存、DMA通道以外，可能还会有一些配置信息，而这些配置信息也依赖于板，不适宜直接放置在设备驱动本身，因此，platform也提供了platform_data的支持。platform_data的形式是自定义的，如对于DM9000网卡而言，platform_data为一个dm9000_plat_data结构体，我们就可以将MAC地址、总线宽度、有无EEPROM信息放入platform_data：

static struct dm9000_plat_data ldd6410_dm9000_platdata = {

.flags = DM9000_PLATF_16BITONLY | DM9000_PLATF_NO_EEPROM,

.dev_addr = { 0×0, 0×16, 0xd4, 0×9f, 0xed, 0xa4 },

};

static struct platform_device ldd6410_dm9000 = {

.name = “dm9000″,

.id =0,

.num_resources= ARRAY_SIZE(ldd6410_dm9000_resource),

.resource= ldd6410_dm9000_resource,

.dev ={

.platform_data= &ldd6410_dm9000_platdata,

}

};

而在DM9000网卡的驱动中，通过如下方式就拿到了platform_data：

struct dm9000_plat_data *pdata = pdev->dev.platform_data;其中，pdev为platform_device的指针。

由以上分析可知，设备驱动中引入platform的概念至少有如下2大好处：

1. 使得设备被挂接在一个总线上，因此，符合Linux2.6的设备模型。其结果是，配套的sysfs结点、设备电源管理都成为可能。

2.隔离BSP和驱动。在BSP中定义platform设备和设备使用的资源、设备的具体配置信息，而在驱动中，只需要通过通用API去获取资源和数据，做到了板相关代码和驱动代码的分离，使得驱动具有更好的可扩展性和跨平台性。

ubuntu10.04安装java1.5

tek-life — Thu, 23 Sep 2010 08:17:08 +0000

因为要运行android emulator要求必须要是1.5版本的java sdk.

但是默认的sources.list里面都是1.6的。寻找安装方法，网上通用的方法是：

Add the following to /etc/apt/sources.list:

deb http://us.archive.ubuntu.com/ubuntu/ jaunty multiverse

deb http://us.archive.ubuntu.com/ubuntu/ jaunty-updates multiverse

这样sudo apt-get update 速度太慢了。等了好久，还没有更新好数据库。

鄙人性急，受不了这样的速度。直接把ubuntu 9.04的源拿过来。

sudo apt-get update后，然后apt-cache search java5.竟然能找到了。挺好！

立马install.速度200+k/s,刚刚的。

安装结束后，再将原来的sources.list还原。

附一个哈工大的9.04源：

deb http://run.hit.edu.cn/ubuntu/ jaunty main restricted universe multiverse

deb-src http://run.hit.edu.cn/ubuntu/ jaunty main restricted universe multiverse

deb http://run.hit.edu.cn/ubuntu/ jaunty-updates main restricted universe multiverse

deb-src http://run.hit.edu.cn/ubuntu/ jaunty-updates main restricted universe multiverse

deb http://run.hit.edu.cn/ubuntu/ jaunty-backports main restricted universe multiverse

deb-src http://run.hit.edu.cn/ubuntu/ jaunty-backports main restricted universe multiverse

deb http://run.hit.edu.cn/ubuntu/ jaunty-security main restricted universe multiverse

deb-src http://run.hit.edu.cn/ubuntu/ jaunty-security main restricted universe multiverse

认识FAT32

tek-life — Tue, 21 Sep 2010 04:05:56 +0000

FAT32文件系统是一个比较重要的文件系统，并且，设计思路比较简单。在windows操作系统，以及嵌入式平台上有广泛的用途。对于一个没有安装操作系统的普通FAT32分区的磁盘，主要的结构有：DBR，FAT表，备份FAT表，以及数据区。注意与FAT16和FAT12区分，FAT32是没有单独的根目录区的，因为单独的根目录区，对根目录下面的文件数量是有限制的。对于一个划分了FAT32分区的磁盘来说，在DBR里面包含有重要的磁盘分区信息。操作系统读取磁盘的时候，按照DBR和FAT表来读取和寻找文件的。

在DBR中，最重要的数据结构是BPB块，BPB表里面包含了很多有用的信息。

Q：BPB表保存在哪里？

A：保存在DBR区中，而DBR区，在FAT32格式的磁盘分区中一般位于0磁头1柱面1扇区的位置。0磁头0柱面留给MBR以及保留扇区。如果没有安装操作系统，那么就在0磁头0柱面上第1个扇区。本文的实验没有安装操作系统的SDCARD。

知道了BPB保存在哪里后，要掌握FAT32分区情况，就需要知道一些关键的信息：

1。DBR后面有多少的保留扇区？

2。FAT表保存在哪里？

3。一个FAT占多少扇区？

4。在FAT32里面已经没有了根目录区的概念了，那么根目录在哪个扇区？

了解了这些以后，我们就能够大概跟踪到各个文件了。

DBR截图

对照以上截图，以及FAT手册，我们就可以回答上面的这几个问题。

Q：DBR后面有多少保留扇区？

A：0X0E
2个字节。0020个扇区，也就是加上DBR一共32个扇区

Q：FAT表保存在哪里？

A：第一个柱面DBR＋保留扇区之后。第32个扇区之后，保存着FAT表

Q：1个FAT表占用多少扇区？

A：0X24
4个字节。01fc个扇区

Q：根目录在哪个扇区？

A：位于的簇号记录于DBR
0X2C 4个字节。不过，一般是在FAT表之后DBR＋2＊FAT表扇区之后。0X0002扇区

Q：FAT表是以簇为单位来管理的，一个簇有多少扇区？

A：DBR里面偏移0x0D一个字节。01个扇区（32MB）

Q：根目录数据在哪个扇区？

A：保留扇区＋FAT＊2扇区看一下
32＋0x01fc*2=32+1016=1048扇区数.1048*512=536576B

由于在FAT32分区格式中，根目录区的特殊性已经取消了。因此保留扇区（保留扇区包括DBR）＋FAT1＋FAT2后，便是根目录数据区的位置。根目录本身的目录项是没有的，在数据区开始位置放置的就是根目录的内容（也就是根目录的数据）。所以，如果我们去查找根目录下的某个文件，或者目录，直接异步到数据区的开始处，就可以查找了。我们可能会有疑问，那如果根目录区内的文件名很多，于是根目录的数据大小超过了一个簇的大小，咋办哩？当然有办法了，想想FAT表的作用吧，呵呵。FAT表便是一个数据区的链表，按照FAT表来索冀，我们就能够得到一个大小超过一个簇的文件了。

用一个例子来说明吧。

首先，用android下面的工具：mksdcard来制作一个FAT32的img镜像。

看到了，已经生成了一个32MB的MY_SD的fat32镜像。

接着，我们把MY_SD挂在到/mnt/t分区，并且往上面放两个文件：

然后，经过前面我们对FAT32的分析，第一个分区是DBR分区，然后是31个保留分区，接下来是FAT分区。根据DBR分区中BPB相关字段，FAT分区一共占0x01FC(508)个扇区，再加上备份FAT表，一共是1016个FAT分区。这样子，数据区就在1016+31个分区之后的分区。我们先查找river.txt的文件分布吧：

根目录的数据区域包含了根目录下的文件及目录的相关信息。因此我们要在1048个扇区将根目录的数据读出来，从中，识别river.txt的目录名
和数据所在的簇号：

从中我们可以看到river.txt数据区所在的位置是00000004簇，文件大小是8个字节(“huanghe”一共是7个字节，再加上\0，一共是8个字节)。另外，我们也可以看到mountain.txt所在簇号00000005，文件大小是9个字节(“ximalaya”，在加上\0)。

由于river.txt数据是在第4簇号放着，而FAT规定簇号的起始记号是从2开始，因此，实际上，要找的话，就从数据区的第2个簇号里面放着，在32MB的fat32中，每一个簇占1个扇区，因此river.txt所在的数据扇区的位置：1048＋2＝1050个扇区，1050＊512B＝537600B。我们找一下：

看到了吧。强化一下，我们继续找mountain.txt.
1048+3=1051扇区，1051＊512B＝538112B。我们来找一下：

呵呵，找到了。以上就是对FAT32的文件系统的认识。

讨论地址:http://linux.chinaunix.net/bbs/viewthread.php?tid=1171438&page=1&extra=#pid7301790

用git管理源码

tek-life — Fri, 17 Sep 2010 02:54:13 +0000

git管理源码，好处自不必说。学习git参考的是《pro git》。
该书的豆瓣链接：http://book.douban.com/subject/3420144/

关于文件的修改：

如果，自己想添加新的文件。最好是，自己建立一个分支：
git branch new-branch //建立新的分支
git checkout new-branch //切换到新的分支下工作
这时候，可以添加或者修改文件。

注意，这个时候，该分支下新添加的文件与master分支是没有一点关系的。

另外，说一下git revert ，git reset –hard和 –soft的区别

git reset –mixed id ，是将git的HEAD变了（也就是提交记录变了），但文件并没有改变，（也就是working tree并没有改变）。
git reset –soft id. 实际上，是git reset –mixed id 后，又做了一次git add
git reset –herd id.是将git的HEAD变了，文件也变了。

git revert与git reset最大的不同是，git revert 仅仅是撤销某次提交。
比如git revert HEAD~1 ,那么会撤销倒数第二次的提交结果。而倒数第一次的提交记录，仍然在。
如果git reset –hard HEAD~1,那么，commit退回到倒数第三次的状态中。
总体来讲，还是git revert 好啊，雁过留声嘛。

其实，通过git reset –soft id的方法，可以将原来多次的git提交记录合并为一个。

两个分支的合并：（分支也就是版本的意思）
git pull . 分支1, 将分支1的变化提交到分支2。
在分支合并部分，不要用git merge 和 git push。容易出错。
另外，还有一种分支合并的方法是rebase。这种方法，更符合思维。
git checkout A1
git rebase master
过程是，找到将A1和master的共同commit点。A1 把自分叉以来的所有补丁都达到master上。相当于：

git checkout master
git pull . A1
—-or—-
git checkout master
git merge A1

关于查看git 记录。

git whatchanged 可以查看最近两次提交记录，以及文件的变更。
git log 可以查看所有的git提交记录。另外，一些参数，也是很有用，比如 -p -N -stat
git diff 版本1 版本2 可以查看两个分支的差异。

主要，就是这些了。以后再有什么新的需求，一并写过来。
—
git add -i 竟然还有交互模式。很方便，不过自己仅仅使用了其中的一条。

本地－服务器查看：
omycle@omycle-desktop:/home/sda4/work/neo$ git remote show origin
* remote origin
Fetch URL: git://211.69.198.249/neo.git
Push URL: git://211.69.198.249/neo.git
HEAD branch: master
Remote branch:
master tracked
Local branch configured for ‘git pull’: //如果git pull 缺省状态是用master分支
master merges with remote master
Local ref configured for ‘git push’: //如果git push 缺省状态是到master分支
master pushes to master (up to date)
如果距离上一次clone 有一定时间了，那么服务器一定是做过了不少更新工作，怎样将新的更新同时同步到本地呢？
git fetch origin
为啥用origin呢，因为，我们在clone的时候，建立默认的远程仓库名的别名 origin/master，就表示远程仓库上的master分支。因此，就用git fetch origin.意思就是，让存放在本地的origin/master分支与服务器同步。

关于diff:

git diff 要查看尚未暂存的文件（还没有git add 之前）更新了哪些部分,不加参数直接输入。
git diff -cached 已经暂存文件更新了那些部分，也就是git add 之后，git commit之前。

其实，要是看文件具体更改详情的话，用git log，也可以。
git log -p -n，n是看最近的n次记录。

建立git服务器：

建立git服务器，其实很简单，特别是对于项目成员比较少的情况下。
比如，在本地有一个test目录，里面是要共享的项目。那么：
git clone –bare test.git test
这样，就建立了test.git了。其他成员就可以共享了。
例如：
对于我来说，用omycle@192.168.227.101就可以通过SSH的方式远程git clone 项目了。
git clone omycle@192.168.227.101:~/test.git

步骤真是简单啊。

当然，麻烦的步骤是，在一个新的目录里面git初始化后，运行：
git remote add origit omycle@192.168.227.101:~/test.git
git fetch origin
git pull origin master
这样，就可以了。

last.fm客户端编译错误解决过程

tek-life — Wed, 15 Sep 2010 08:19:17 +0000

last.fm网站做的挺不错，并且提供了一个c++写的客户端。在ubuntu10.04下编译，竟然缺少了几个头文件。

在网上看到一个碰到的错误和我的一样，因此把他写的贴出来：

From:http://wildebeestplain.blogspot.com/2010/05/lastfm-on-ubuntu-lucid-lynx-1004.html

Having recently got a nice shiny new netbook (an HP/Compaq 311c) I was trying to get last.fm to compile on it. My netbook was running a reasonably fresh install of Ubuntu Lucid Lynx (10.04).

So I downloaded the source for last.fm-1.4.2.58240 and unzipped it into my source directory. Knowing that it needed qt4 I then ran:
sudo apt-get install libqt4-dev

With that all installed I tried running ./configure in the source directory and it said everything was fine, so I went ahead and typed make.

After waiting while it compiled I was then greeted by the following error:
make[1]: Entering directory `/home/marvin/src/last.fm-1.4.2.58240/src/libFingerprint/fplib/pro_qmake' g++ -c -pipe -O2 -w -fPIC -DNBREAKPAD -DLINUX -DNDEBUG -I/usr/share/qt4/mkspecs/linux-g++ -I. -I../../../../src -I../../../../build -I../../../libMoose -I../../../libUnicorn -I../include -I../src -I../../libs/fftw/src/api -I../../../../res/libsamplerate -o ../../../../build/fplib/release/FingerprintExtractor.o ../src/FingerprintExtractor.cpp ../src/FingerprintExtractor.cpp: In member function ‘bool fingerprint::FingerprintExtractor::process(const short int*, size_t, bool)’: ../src/FingerprintExtractor.cpp:445: error: ‘memcpy’ was not declared in this scope make[1]: *** [../../../../build/fplib/release/FingerprintExtractor.o] Error 1 make[1]: Leaving directory `/home/marvin/src/last.fm-1.4.2.58240/src/libFingerprint/fplib/pro_qmake' make: *** [sub-src-libFingerprint-fplib-pro_qmake-fplib-pro-make_default-ordered] Error 2 marvin@Anjie:~/src/last.fm-1.4.2.58240$

Knowing that memcpy is part of the standard C library I thought this seemed a little strange. So I opened up last.fm-1.4.2.58240/src/libFingerprint/fplib/src/FingerprintExtractor.cpp and added the following line in bold:
#include #include
Then recompiled.

The next error was the following:
g++ -c -pipe -O2 -w -fPIC -DNBREAKPAD -DLINUX -DNDEBUG -I/usr/share/qt4/mkspecs/linux-g++ -I. -I../../../../src -I../../../../build -I../../../libMoose -I../../../libUnicorn -I../include -I../src -I../../libs/fftw/src/api -I../../../../res/libsamplerate -o ../../../../build/fplib/release/OptFFT.o ../src/OptFFT.cpp ../src/OptFFT.cpp: In constructor ‘fingerprint::OptFFT::OptFFT(size_t)’: ../src/OptFFT.cpp:262: error: ‘exit’ was not declared in this scope make[1]: *** [../../../../build/fplib/release/OptFFT.o] Error 1 make[1]: Leaving directory `/home/marvin/src/last.fm-1.4.2.58240/src/libFingerprint/fplib/pro_qmake' make: *** [sub-src-libFingerprint-fplib-pro_qmake-fplib-pro-make_default-ordered] Error 2 marvin@Anjie:~/src/last.fm-1.4.2.58240$

Which I fixed by editing last.fm-1.4.2.58240/src/libFingerprint/fplib/src/OptFFT.cpp to include the line in bold:
#include #include // for memcopy #include
And then once again ran make.

The next error was:
g++ -c -pipe -O2 -w -D_REENTRANT -fPIC -DNBREAKPAD -DLINUX -DQT_NO_DEBUG -DQT_SQL_LIB -DQT_XML_LIB -DQT_GUI_LIB -DQT_NETWORK_LIB -DQT_CORE_LIB -DQT_SHARED -I/usr/share/qt4/mkspecs/linux-g++ -I. -I/usr/include/qt4/QtCore -I/usr/include/qt4/QtNetwork -I/usr/include/qt4/QtGui -I/usr/include/qt4/QtXml -I/usr/include/qt4/QtSql -I/usr/include/qt4 -I../../src -I../../build -I../libMoose -I../libUnicorn -Ifplib/include -I../src/ -I../../res/mad -I../../build/LastFmFingerprint/release -o ../../build/LastFmFingerprint/release/MP3_Source_Qt.o MP3_Source_Qt.cpp MP3_Source_Qt.cpp: In function ‘short int f2s(mad_fixed_t)’: MP3_Source_Qt.cpp:70: error: ‘SHRT_MAX’ was not declared in this scope MP3_Source_Qt.cpp:72: error: ‘SHRT_MAX’ was not declared in this scope MP3_Source_Qt.cpp: In member function ‘virtual void MP3_Source::skipSilence(double)’: MP3_Source_Qt.cpp:379: error: ‘abs’ was not declared in this scope MP3_Source_Qt.cpp:385: error: ‘abs’ was not declared in this scope make[1]: *** [../../build/LastFmFingerprint/release/MP3_Source_Qt.o] Error 1 make[1]: Leaving directory `/home/marvin/src/last.fm-1.4.2.58240/src/libFingerprint' make: *** [sub-src-libFingerprint-make_default-ordered] Error 2

So I opened last.fm-1.4.2.58240/src/libFingerprint/MP3_Source_Qt.cpp and added the lines in bold:
#include #include #include #include

And ran make once more.

This time it was a linking error:
g++ -Wl,-O1 -shared -Wl,-soname,libLastFmFingerprint.so.1 -o libLastFmFingerprint.so.1.0.0 ../../build/LastFmFingerprint/release/Sha256File.o ../../build/LastFmFingerprint/release/Sha256.o ../../build/LastFmFingerprint/release/MP3_Source_Qt.o ../../build/LastFmFingerprint/release/Fingerprinter2.o ../../build/LastFmFingerprint/release/FingerprintCollector.o ../../build/LastFmFingerprint/release/FingerprintQueryer.o ../../build/LastFmFingerprint/release/moc_Fingerprinter2.o ../../build/LastFmFingerprint/release/moc_FingerprintCollector.o ../../build/LastFmFingerprint/release/moc_FingerprintQueryer.o -L/home/marvin/src/last.fm-1.4.2.58240/bin -L/home/marvin/src/last.fm-1.4.2.58240/build/LastFmFingerprint/../fplib -L/usr/lib -lMoose -L/home/marvin/src/last.fm-1.4.2.58240/bin -lLastFmTools /home/marvin/src/last.fm-1.4.2.58240/build/fplib/libfplib.a -lsamplerate -lfftw3f -lQtSql -lQtXml -lQtGui -lQtNetwork -lQtCore -lpthread /usr/bin/ld: cannot find -lsamplerate collect2: ld returned 1 exit status make[1]: *** [../../bin/libLastFmFingerprint.so.1.0.0] Error 1 make[1]: Leaving directory `/home/marvin/src/last.fm-1.4.2.58240/src/libFingerprint' make: *** [sub-src-libFingerprint-make_default-ordered] Error 2 marvin@Anjie:~/src/last.fm-1.4.2.58240$

So I ran sudo apt-get install libsamplerate0 libsamplerate0-dev libfftw3-dev libfftw3-3 libmad0-dev libmad0 libgpod-dev libgpod4 libasound2-dev and then ran make again.

If you’re wondering how I came up with all the libraries above, it was just from running make several times and then using apt-cache search to search for the missing libraries. I didn’t include these steps as they’re a bit tedious.

Having done all that it’s possible to run last.fm with bin/last.fm.sh.

通过内核获取config文件

tek-life — Wed, 28 Jul 2010 03:52:27 +0000

有两种方法，但前提是需要配置了，才能在编译好的内核中再获取config文件。貌似是一个蛋生鸡，鸡生蛋的纠结问题。

但，有时候，我们需要配置内核运行。因此，一般是需要获得一个既有的能跑的config文件。下面介绍的这两种获取config的方法就是用于此目的的。

首先，说一下方法：
法1.在运行的内核中的/proc/config.gz 保存的便是配置文件了
法2.通过/usr/src/linux/scripts/extract-ikconfig 脚本获得一个已经编译好的内核。
这两种方法的前提是，获取内核config的内核在编译的时候，下面的两项被选中了。

CONFIG_IKCONFIG
This option enables the complete Linux kernel “.config” file
contents to be saved in the kernel. It provides documentation
of which kernel options are used in a running kernel or in an
on-disk kernel. This information can be extracted from the kernel
image file with the script scripts/extract-ikconfig and used as
input to rebuild the current kernel or to build another kernel.
It can also be extracted from a running kernel by reading
/proc/config.gz if enabled (below).
如果这一项配置了，那么通过脚本extract-ikconfig获得config文件

CONFIG_IKCONFIG_PROC

This option enables access to the kernel configuration file
through /proc/config.gz.
如果这一项配置了，那么通过运行内核获得 /proc/config.gz

shell脚本后台执行的若干总结

tek-life — Sat, 24 Jul 2010 04:35:53 +0000

命令后面直接加上&的幼儿园方法不讨论，因为解决不了问题。

shell关闭了,但仍然让脚本执行的方法：
1. nohup 就是忽略掉了父进程hungup信号，继续执行。默认是将脚本所有的输出，输出到了/dev/null或者 nohup.out.
2.用setsid的方法，让脚本的父进程设置为init，这样，关闭shell，脚本照样执行。但对于有输出的脚本程序就不行了，那么用什么方法捏？可以指定其标准输出和错误输出都到/dev/null中。
setsid python /opt/proxy/localproxy/proxy.py > /dev/null 2>&1

另外，搞清楚：
command >/devnull 2>&1 与 command > /dev/null 2>/dev/null
其区别不解释.

对于xterm远程登录，可能掉线的情况，推荐方法是用screen.这样可以续上原来的session.
screen的具体用法不解释。

Linux设备注册

tek-life — Thu, 22 Jul 2010 08:57:16 +0000

在加载驱动之前，设备最先被加载。其中最主要的就是资源的注册了。本文简要介绍一些注册的一些过程。
最初，是要准备设备的资源，然后被初始化。
拿imx的MMC为例，其他的与之相同。
arch/arm/mach-imx/gener.c
static struct resource imx_mmc_resources[] = {
[0] = {
.start = 0×00214000,
.end = 0x002140FF,
.flags = IORESOURCE_MEM,
},
[1] = {
.start = (SDHC_INT),
.end = (SDHC_INT),
.flags = IORESOURCE_IRQ,
},
};
Coment:设备的资源定义一般都位于arch/arm/mach-机器类型目录下面的文件中。

static struct platform_device imx_mmc_device = {
.name = “imx-mmc”,
.id = 0,
.num_resources = ARRAY_SIZE(imx_mmc_resources),
.resource = imx_mmc_resources,
};

最初的设备定义仅此而已。

然后，看一下注册是经过怎样的流程：

void __init imx_map_io(void)
{
iotable_init(imx_io_desc, ARRAY_SIZE(imx_io_desc));
}

static struct platform_device *devices[] __initdata = {
&imx_mmc_device,
&imxfb_device,
&imx_uart1_device,
&imx_uart2_device,
};

static int __init imx_init(void)
{
return platform_add_devices(devices, ARRAY_SIZE(devices));
}

subsys_initcall(imx_init);

—————————————————————————–
以上调用imx_init，通过platform_add_devices来注册设备。我们继续跟进：

drivers/base/platform.c

int platform_add_devices(struct platform_device **devs, int num)
{
int i, ret = 0;

for (i = 0; i < num; i++) {
ret = platform_device_register(devs[i]);
if (ret) {
while (--i >= 0)
platform_device_unregister(devs[i]);
break;
}
}

return ret;
}
EXPORT_SYMBOL_GPL(platform_add_devices);

int platform_device_register(struct platform_device * pdev)
{
device_initialize(&pdev->dev);
return platform_device_add(pdev);
}
EXPORT_SYMBOL_GPL(platform_device_register);

————————————————————————-
添加设备实际上也是注册设备，从其名字即可以看出来。
我们看看，platform_device_register里面调用了初始化和add两个函数。
初始化什么呢？因为在最初定义设备的时候，我们仅仅只定义了资源，设备成员变量dev没有被舒适化，那么这里 device_initialize(&pdev->dev);便是初始化这个设备了。
然后我们跟进 platform_device_add()
drivers/base/platform.c
int platform_device_add(struct platform_device *pdev)
{
int i, ret = 0;

if (!pdev)
return -EINVAL;

if (!pdev->dev.parent)
pdev->dev.parent = &platform_bus;

pdev->dev.bus = &platform_bus_type;

if (pdev->id != -1)
snprintf(pdev->dev.bus_id, BUS_ID_SIZE, “%s.%u”, pdev->name, pdev->id);
else
strlcpy(pdev->dev.bus_id, pdev->name, BUS_ID_SIZE);

for (i = 0; i < pdev->num_resources; i++) {
struct resource *p, *r = &pdev->resource[i];

if (r->name == NULL)
r->name = pdev->dev.bus_id;

p = r->parent;//如果资源还没有插入到树中的话，那么就到下面这个if语句块中
if (!p) {
if (r->flags & IORESOURCE_MEM)
p = &iomem_resource;
else if (r->flags & IORESOURCE_IO)
p = &ioport_resource;
}

if (p && insert_resource(p, r)) {
printk(KERN_ERR
“%s: failed to claim resource %d\n”,
pdev->dev.bus_id, i);
ret = -EBUSY;
goto failed;
}
}

pr_debug(“Registering platform device ‘%s’. Parent at %s\n”,
pdev->dev.bus_id, pdev->dev.parent->bus_id);

ret = device_add(&pdev->dev);
if (ret == 0)
return ret;

failed:
while (–i >= 0)
if (pdev->resource[i].flags & (IORESOURCE_MEM|IORESOURCE_IO))
release_resource(&pdev->resource[i]);
return ret;
}
EXPORT_SYMBOL_GPL(platform_device_add);

这里最主要是两个函数，一个是insert_resource,一个是device_add.前一个把资源插入父设备的资源树中，关于Linux资源管理，网上有一篇很好的文章：“Linux对I/O端口资源的管理–詹荣开”。我摘录了其中对于insert_resource的描述：

　　Linux是以一种倒置的树形结构来管理每一类I/O资源（如：I/O端口、外设内存、DMA和IRQ）的。每一类I/O资源都对应有一颗倒置的资源树，树中的每一个节点都是一个resource结构，而树的根结点root则描述了该类资源的整个资源空间。

insert_resource调用__request_resource()来注册相应的资源：
/* Return the conflict entry if you can’t request it */
static struct resource * __request_resource(struct resource *root, struct resource *new)
{
resource_size_t start = new->start;
resource_size_t end = new->end;
struct resource *tmp, **p;

if (end < start)
return root;
if (start < root->start)
return root;
if (end > root->end)
return root;
p = &root->child;
for (;;) {
tmp = *p;
if (!tmp || tmp->start > end) {
new->sibling = tmp;
*p = new;
new->parent = root;
return NULL;
}
p = &tmp->sibling;
if (tmp->end < start)
continue;
return tmp;
}
}
算法描述：

　　①前三个if语句判断new所描述的资源范围是否被包含在root内，以及是否是一段有效的资源（因为end必须大于start）。否则就返回root指针，表示与根结点相冲突。
　　②接下来用一个for循环遍历根节点root的child链表，以便检查是否有资源冲突，并将new插入到child链表中的合适位置（child链表是以I/O资源物理地址从低到高的顺序排列的）。为此，它用tmp指针指向当前正被扫描的resource结构，用指针p指向前一个resource结构的sibling指针成员变量，p的初始值为指向root－>sibling。For循环体的执行步骤如下：
　　l 让tmp指向当前正被扫描的resource结构（tmp＝*p）。
　　l 判断tmp指针是否为空（tmp指针为空说明已经遍历完整个child链表），或者当前被扫描节点的起始位置start是否比new的结束位置end还要大。只要这两个条件之一成立的话，就说明没有资源冲突，于是就可以把new链入child链表中：①设置new的sibling指针指向当前正被扫描的节点tmp（new->sibling=tmp）；②当前节点tmp的前一个兄弟节点的sibling指针被修改为指向new这个节点（*p=new）；③将new的parent指针设置为指向root。然后函数就可以返回了（返回值NULL表示没有资源冲突）。
　　l 如果上述两个条件都不成立，这说明当前被扫描节点的资源域有可能与new相冲突（实际上就是两个闭区间有交集），因此需要进一步判断。为此它首先修改指针p，让它指向tmp->sibling，以便于继续扫描child链表。然后，判断tmp->end是否小于new->start，如果小于，则说明当前节点tmp和new没有资源冲突，因此执行continue语句，继续向下扫描child链表。否则，如果tmp->end大于或等于new->start，则说明tmp->[start,end]和new->[start,end]之间有交集。所以返回当前节点的指针tmp，表示发生资源冲突。

另外，看一下device_add()
drivers/base/core.c

/**
* device_add – add device to device hierarchy.
* @dev: device.
*
* This is part 2 of device_register(), though may be called
* separately _iff_ device_initialize() has been called separately.
*
* This adds it to the kobject hierarchy via kobject_add(), adds it
* to the global and sibling lists for the device, then
* adds it to the other relevant subsystems of the driver model.
*/
int device_add(struct device *dev)
{
struct device *parent = NULL;
char *class_name = NULL;
struct class_interface *class_intf;
int error = -EINVAL;

dev = get_device(dev);
if (!dev || !strlen(dev->bus_id))
goto Error;

pr_debug(“DEV: registering device: ID = ‘%s’\n”, dev->bus_id);

parent = get_device(dev->parent);

error = setup_parent(dev, parent);
if (error)
goto Error;

/* first, register with generic layer. */
kobject_set_name(&dev->kobj, “%s”, dev->bus_id);
error = kobject_add(&dev->kobj);
if (error)
goto Error;

/* notify platform of device entry */
if (platform_notify)
platform_notify(dev);

/* notify clients of device entry (new way) */
if (dev->bus)
blocking_notifier_call_chain(&dev->bus->bus_notifier,
BUS_NOTIFY_ADD_DEVICE, dev);

dev->uevent_attr.attr.name = “uevent”;
dev->uevent_attr.attr.mode = S_IWUSR;
if (dev->driver)
dev->uevent_attr.attr.owner = dev->driver->owner;
dev->uevent_attr.store = store_uevent;
error = device_create_file(dev, &dev->uevent_attr);
if (error)
goto attrError;

if (MAJOR(dev->devt)) {
struct device_attribute *attr;
attr = kzalloc(sizeof(*attr), GFP_KERNEL);
if (!attr) {
error = -ENOMEM;
goto ueventattrError;
}
attr->attr.name = “dev”;
attr->attr.mode = S_IRUGO;
if (dev->driver)
attr->attr.owner = dev->driver->owner;
attr->show = show_dev;
error = device_create_file(dev, attr);
if (error) {
kfree(attr);
goto ueventattrError;
}

dev->devt_attr = attr;
}

if (dev->class) {
sysfs_create_link(&dev->kobj, &dev->class->subsys.kset.kobj,
“subsystem”);
/* If this is not a “fake” compatible device, then create the
* symlink from the class to the device. */
if (dev->kobj.parent != &dev->class->subsys.kset.kobj)
sysfs_create_link(&dev->class->subsys.kset.kobj,
&dev->kobj, dev->bus_id);
if (parent) {
sysfs_create_link(&dev->kobj, &dev->parent->kobj,
“device”);
#ifdef CONFIG_SYSFS_DEPRECATED
class_name = make_class_name(dev->class->name,
&dev->kobj);
if (class_name)
sysfs_create_link(&dev->parent->kobj,
&dev->kobj, class_name);
#endif
}
}

if ((error = device_add_attrs(dev)))
goto AttrsError;
if ((error = device_add_groups(dev)))
goto GroupError;
if ((error = device_pm_add(dev)))
goto PMError;
if ((error = bus_add_device(dev)))
goto BusError;
if (!dev->uevent_suppress)
kobject_uevent(&dev->kobj, KOBJ_ADD);
if ((error = bus_attach_device(dev)))
goto AttachError;
if (parent)
klist_add_tail(&dev->knode_parent, &parent->klist_children);

if (dev->class) {
down(&dev->class->sem);
/* tie the class to the device */
list_add_tail(&dev->node, &dev->class->devices);

/* notify any interfaces that the device is here */
list_for_each_entry(class_intf, &dev->class->interfaces, node)
if (class_intf->add_dev)
class_intf->add_dev(dev, class_intf);
up(&dev->class->sem);
}
Done:
kfree(class_name);
put_device(dev);
return error;
……

}

上面的这个语句块主要的工作是在设备模型的工作。从注释中，我们可以看到其主要思路。

ubuntu 10.04 编译低版本gcc3.4.6出错

tek-life — Wed, 21 Jul 2010 13:12:57 +0000

./configure –disable-checking
make
出错：
error: call to ‘__open_missing_mode’ declared with attribute error: open with O_CREAT in second argument needs 3 arguments
更改
gcc/collect2.c 1537行，添加地三个参数
edir_handle = open (redir, O_WRONLY | O_TRUNC | O_CREAT, 0777);

关于位域

tek-life — Tue, 13 Jul 2010 09:24:10 +0000

位域，就是在某些结构的成员变量后面加了冒号后跟一个十进制的数子，比如：
struct str
{
int a:1;
}类似的定义在kernel中经常碰到。先看一个例子：

#include 
typedef struct test
{
unsigned int a:1;
int b;
}Test;
Test tt;
void main()
{
tt.a=1,tt.b=100;
printf("tt.a:%d,tt.b:%d\n",tt.a,tt.b);
tt.a=0,tt.b=100;
printf("tt.a:%d,tt.b:%d\n",tt.a,tt.b);
tt.a=2,tt.b=100;
printf("tt.a:%d,tt.b:%d\n",tt.a,tt.b);
tt.a=3,tt.b=100;
printf("tt.a:%d,tt.b:%d\n",tt.a,tt.b);
}

运行结果：
omycle@omycle-desktop:~$ ./a
tt.a:1,tt.b:100
tt.a:0,tt.b:100
tt.a:0,tt.b:100
tt.a:1,tt.b:100
可以看到，结构体Test成员变量a被定义为unsigned int 中的最低位–LSB，这就决定了非0即1.我们在实验中也验证了确实是这样子的。
那么位域有什么好处呢？

有些信息在存储时，并不需要占用一个完整的字节，而只需占几个或一个二进制位。例如在存放一个开关量时，只有0和1 两种状态，用一位二进位即可。为了节省存储空间，并使处理简便，C语言又提供了一种数据结构，称为“位域”或“位段”。所谓“位域”是把一个字节中的二进位划分为几个不同的区域，并说明每个区域的位数。每个域有一个域名，允许在程序中按域名进行操作。这样就可以把几个不同的对象用一个字节的二进制位域来表示。

说明：
1. 一个位域必须存储在同一个字节中，不能跨两个字节。如一个字节所剩空间不够存放另一位域时，应从下一单元起存放该位域。也可以有意使某位域从下一单元开始。例如：
struct bs
{
unsigned a:4
unsigned :0 /*空域*/
unsigned b:4 /*从下一单元开始存放*/
unsigned c:4
}
这个位域定义中，a占第一字节的4位，后4位填0表示不使用，b从第二字节开始，占用4位，c占用4位。
2. 位域可以无位域名，这时它只用来作填充或调整位置。无名的位域是不能使用的。例如：
struct k
{
int a:1
int :2 /*该2位不能使用*/
int b:3
int c:2
};

函数指针与typedef

tek-life — Tue, 13 Jul 2010 01:20:13 +0000

在阅读内核的时候，会遇到不少函数指针的情况。整理了一下，另外，也有c++函数指针的情况。不过清楚了c的函数指针，读c++的函数指针就不困难了。

另外，也要注意弱类型与强类型。

（一）简单的函数指针的应用。
//形式1：返回类型(*函数名)(参数表)
char (*pFun) (int); //声明

char glFun(int a)
{ return;}
       第一行定义了一个指针变量pFun。首先我们根据前面提到的“形式1”认识到它是一个指向某种函数的指针，这种函数参数是一个int型，返回值是 char类型。只有第一句我们还无法使用这个指针，因为我们还未对它进行赋值。
      第二行定义了一个函数glFun()。该函数正好是一个以int为参数返回char的函数。我们要从指针的层次上理解函数——函数的函数名实际上就是一个指针，函数名指向该函数的代码在内存中的首地址。
        然后就是可爱的main()函数了，它的第一句您应该看得懂了——它将函数glFun的地址赋值给变量pFun。main()函数的第二句中 “*pFun”显然是取pFun所指向地址的内容，当然也就是取出了函数glFun()的内容，然后给定参数为2。这里，我们可能会稍微疑惑一下，对于变量赋值给指针的话是这样子的
int i;
int * ptr;
ptr=&i
而这里对函数的赋值，直接是ptr=fun().实际上，函数名就是一个地址。在内核的代码中，我们经常能见到在汇编中调用c函数，是直接call fun，来进行的。因此，疑惑终结。

void main()
{
pFun = glFun;//赋值
(*pFun)(2);
}

（二）使用typedef更直观更方便。
//形式2：typedef 返回类型(*新类型)(参数表)
typedef char (*PTRFUN)(int);
typedef的功能是定义新的类型。第一句就是定义了一种PTRFUN的类型，并定义这种类型为指向某种函数的指针，这种函数以一个int为参数并返回 char类型。后面就可以像使用int,char一样使用PTRFUN了。
第二行的代码便使用这个新类型定义了变量pFun，此时就可以像使用形式1一样使用这个变量了。

PTRFUN pFun; //声明

char glFun(int a)
{ return;}

void main()
{
pFun = glFun; //赋值
(*pFun)(2);
}

EmbeddedXENVIRQ发送流程

tek-life — Fri, 02 Jul 2010 01:41:22 +0000

Hypervisor发送virq的函数有两个：

一个是send_geust_vcpu_virq,另一个是send_guest_global_virq

void send_guest_vcpu_virq(struct vcpu *v, int virq)

{

int port;

ASSERT(!virq_is_global(virq));

port = v->virq_to_evtchn[virq];

if ( unlikely(port == 0) ) {

return;

}

evtchn_set_pending(v, port);

}

void send_guest_global_virq(struct domain *d, int virq)

{

int port;

struct vcpu *v;

struct evtchn *chn;

ASSERT(virq_is_global(virq));

if ( unlikely(d == NULL) )

return;

v = d->vcpu[0];

if ( unlikely(v == NULL) )

return;

port = v->virq_to_evtchn[virq];

if ( unlikely(port == 0) )

return;

chn = evtchn_from_port(d, port);

evtchn_set_pending(d->vcpu[chn->notify_vcpu_id], port);

}

send_guest_vcpu_virq的调用关系是这样的：

图中的两个定时器是在分配vcpu的时候安装的。

send_guest_global_virq的调用关系比较复杂，都是发给DOM0的

EmbeddedXEN VIRQ申请

tek-life — Thu, 01 Jul 2010 13:48:57 +0000

为了说明VIRQ，拿时间中断的注册为例来说明Virq的申请过程，明白了VIRQ申请过程后，我们简单的看一下DOMU console的注册过程。

arch/arm/mach-pxa/time-xen.c

MACHINE_START(MAINSTONE, “Intel HCDDBBVA0 Development Platform (aka Mainstone) / EmbeddedXEN (xen-pxa270-qemu)”)

/* Maintainer: MontaVista Software Inc. */

.phys_io = 0×40000000,

.boot_params = 0xa0000100, /* BLOB boot parameter setting */

.io_pg_offst = (io_p2v(0×40000000) >> 18) & 0xfffc,

.timer = &pxa_timer,

.init_machine = mainstone_init

MACHINE_END

struct sys_timer pxa_timer = {

.init = pxa_timer_init,

.suspend = pxa_timer_suspend,

.resume = pxa_timer_resume,

.offset = pxa_gettimeoffset,

};

—————–好了，上面是数据结构，以及定义，现在看一下怎么用这些数据的—–

init/main-xen.c

asmlinkage void __init start_kernel_lx0(void)

{

……

time_init(); /* (DRE) xen guest */

……

}

arch/arm/kernel/time.c

void __init time_init(void)

{

if (system_timer->offset == NULL)

system_timer->offset = dummy_gettimeoffset;

system_timer->init();

#ifdef CONFIG_NO_IDLE_HZ

if (system_timer->dyn_tick)

system_timer->dyn_tick->lock = SPIN_LOCK_UNLOCKED;

#endif

}

———就这样pxa_timer_init登上舞台了———

arch/arm/mach-pxa/time-xen.c

static void __init pxa_timer_init(void)

{

bind_virq_to_irqhandler(

VIRQ_TIMER, //VIRQ_TIMER:0

xen_virtual_timer_interrupt,

SA_INTERRUPT,

”timer0″,

/* ”ost0″,*/

NULL);

}

xen_guest/core/evtchn.c

int bind_virq_to_irqhandler(unsigned int virq,unsigned int cpu,irq_handler_t handler,unsigned long irqflags,const char *devname,void *dev_id)

{

unsigned int irq;

int retval;

irq = bind_virq_to_irq(virq, cpu);

retval = request_irq(irq, handler, irqflags, devname, dev_id);

if (retval != 0) {

unbind_from_irq(irq);

return retval;

}

return irq;

}

——–看一下如何将virq绑定到irq上的@！———–

文件路径同上
static int bind_virq_to_irq(unsigned int virq, unsigned int cpu)
{
//evtchn_op_t op = { .cmd = EVTCHNOP_bind_virq };
evtchn_bind_virq_t op;
int evtchn, irq;

spin_lock(&irq_mapping_update_lock);

if ((irq = per_cpu(virq_to_irq, cpu)[virq]) == -1) {//说明，这个virq对应的irq还没有被分配，可以使用
op.virq = virq;
op.vcpu = cpu;

BUG_ON(HYPERVISOR_event_channel_op(EVTCHNOP_bind_virq, &op) != 0);//virq与evtchn相联系了。下面要让evtchn和irq相联系,这样，才能在DOMU这一层处理
evtchn = op.port;
irq = find_unbound_irq();
evtchn_to_irq[evtchn] = irq;
irq_info[irq] = mk_irq_info(IRQT_VIRQ, virq, evtchn);

per_cpu(virq_to_irq, cpu)[virq] = irq;

bind_evtchn_to_cpu(evtchn, cpu);//在DOM中将其绑定的！@
}

irq_bindcount[irq]++;//找到一个被绑定的Irq以后，要将数组中的该元素加一的，这样以后再找Unbound_irq的时候，就不用找它了。

return irq;
}

文件路径同上，在这里，也可以看出，DOMU里面同样也有Irq的概念。只不过描述符不同
//找到一个没有被绑定的的irq
static int find_unbound_irq(void)
{
int irq;

for (irq = 0; irq < NR_IRQS; irq++)
if (irq_bindcount[irq] == 0)//找到了
break;

if (irq == NR_IRQS)
panic(“No available IRQ to bind to: increase NR_IRQS!\n”);

return irq;
}

HYPERVISOR_event_channel_op(EVTCHNOP_bind_virq, &op)会根据CMD去调用evtchn_bind_virq
xen/common/event_channel.c
static long evtchn_bind_virq(evtchn_bind_virq_t *bind)
{
   struct evtchn *chn;
   struct vcpu *v;
   struct domain *d = current->domain;
   int port, virq = bind->virq, vcpu = bind->vcpu;
   long rc = 0;

   if ( (virq < 0) || (virq >= ARRAY_SIZE(v->virq_to_evtchn)) )
   return -EINVAL;

   if ( virq_is_global(virq) && (vcpu != 0) )
   return -EINVAL;

   if ( (vcpu < 0) || (vcpu >= ARRAY_SIZE(d->vcpu)) ||
   ((v = d->vcpu[vcpu]) == NULL) )
   return -ENOENT;

   spin_lock(&d->evtchn_lock);

   if ( v->virq_to_evtchn[virq] != 0 )
   ERROR_EXIT(-EEXIST);

   if ( (port = get_free_port(d)) < 0 )
   ERROR_EXIT(port);
//分配evtchn号
   chn = evtchn_from_port(d, port);
   chn->state = ECS_VIRQ;
   chn->notify_vcpu_id = vcpu;
   chn->u.virq = virq;

   v->virq_to_evtchn[virq] = bind->port = port;

out:
   spin_unlock(&d->evtchn_lock);

   return rc;
}

———-

将xen_virtual_timer_interrupt送到irq线上

arch/arm/mach-pxa/time-xen.c

/* (GCD) From Samsung. Added regs argument */

static irqreturn_t xen_virtual_timer_interrupt(int irq, void *dev_id, struct pt_regs *regs)//简单的就是更新墙上时间

{

write_seqlock(&xtime_lock);

//if (displayme)

// printk(“### timer_tick\n”);

timer_tick(regs);

write_sequnlock(&xtime_lock);

return IRQ_HANDLED;

}

对比一下，看看hypervisor层的时间中断处理函数：
static irqreturn_t pxa_ost0_interrupt(int irq, void *dev_id, struct pt_regs *regs)
{
//struct clock_event_device *c = dev_id;
//static int cnt = 0;

/* Disarm the compare/match, signal the event. */
OIER &= ~OIER_E0;
OSSR = OSSR_M0;

timer_interrupt(irq, dev_id, regs);

return IRQ_HANDLED;
}
void timer_interrupt(int irq, void *dev_id, struct xen_cpu_user_regs *regs) {
ASSERT(local_irq_is_enabled());

/* Update jiffies counter. */
(*(volatile unsigned long *) &jiffies_64)++;
raise_softirq(TIMER_SOFTIRQ);

if (–plt_overflow_jiffies == 0)
plt_overflow();
}

arch/arm/kernel/time.c

/*
* Kernel system timer support.
*/
void timer_tick(struct pt_regs *regs)
{
profile_tick(CPU_PROFILING, regs);
do_leds();
do_set_rtc();
do_timer(regs);
#ifndef CONFIG_SMP
update_process_times(user_mode(regs));
#endif
}
以后，当virq中断来了以后，就直接执行xen_virtual_timer_interrupt了。

除了timer的virq申请之外，还有console的申请。

在console模块注册的时候，申请了virq中断。我们可以在xen_guest/core/console.c里面找到

static int __init xencons_init(void)

{

int rc;

if (xen_init() < 0)

return -ENODEV;

if (xc_mode == XC_OFF)

return 0;

if (!(xen_start_info->flags & SIF_INITDOMAIN)) {

rc=xencons_ring_init();

if(rc)

return rc;

}

xencons_driver = alloc_tty_driver((xc_mode == XC_SERIAL) ?

1 : MAX_NR_CONSOLES);

if (xencons_driver == NULL)

return -ENOMEM;

DRV(xencons_driver)->name = “xencons”;

DRV(xencons_driver)->major = TTY_MAJOR;

DRV(xencons_driver)->type = TTY_DRIVER_TYPE_SERIAL;

DRV(xencons_driver)->subtype = SERIAL_TYPE_NORMAL;

DRV(xencons_driver)->init_termios = tty_std_termios;

DRV(xencons_driver)->flags =

TTY_DRIVER_REAL_RAW |

TTY_DRIVER_RESET_TERMIOS;

DRV(xencons_driver)->termios = xencons_termios;

DRV(xencons_driver)->termios_locked = xencons_termios_locked;

if (xc_mode == XC_SERIAL) {

DRV(xencons_driver)->name = “ttyS”;

DRV(xencons_driver)->minor_start = 64 + xc_num;

DRV(xencons_driver)->name_base = 0 + xc_num;

} else {

DRV(xencons_driver)->name = “tty”;

DRV(xencons_driver)->minor_start = xc_num;

DRV(xencons_driver)->name_base = xc_num;

}

tty_set_operations(xencons_driver, &xencons_ops);

if ((rc = tty_register_driver(DRV(xencons_driver))) != 0) {

printk(“WARNING: Failed to register Xen virtual “

“console driver as ‘%s%d’\n”,

DRV(xencons_driver)->name,

DRV(xencons_driver)->name_base);

put_tty_driver(xencons_driver);

xencons_driver = NULL;

return rc;

}

// tty_register_device(xencons_driver, 0, NULL);

if (xen_start_info->flags & SIF_INITDOMAIN) {

xencons_priv_irq = bind_virq_to_irqhandler(

VIRQ_CONSOLE,

xencons_priv_interrupt,

“console”,

NULL);

BUG_ON(xencons_priv_irq < 0);

}

printk(“Xen virtual console successfully installed as %s%d\n”,

DRV(xencons_driver)->name,

DRV(xencons_driver)->name_base );

return 0;

}

module_init(xencons_init);

好了到此为止。

超级调用swi 82的最初流程

tek-life — Wed, 30 Jun 2010 07:32:23 +0000

xen/arch/arm/kernel/entry-armv.S

__vectors_start:

swi SYS_ERROR0 /* Reset */

b vector_undefined_instruction + stubs_offset

ldr pc, .LCvswi + stubs_offset

b vector_prefetch_abort + stubs_offset

b vector_data_abort + stubs_offset

b vector_addrexcptn + stubs_offset

b vector_irq + stubs_offset

b vector_fiq + stubs_offset

.globl __vectors_end

__vectors_end:

* We group all the following data together to optimise

* for CPUs with separate I & D caches.

.align 5

.LCvswi:

.word vector_swi

————–
xen/arch/arm/hypervisor/hypervisor.S

ENTRY(vector_swi)

sub sp, sp, #S_FRAME_SIZE

stmia sp, {r0 – r12}

add r8, sp, #S_PC

stmdb r8, {sp, lr}^

mrs r8, spsr

str lr, [sp, #S_PC]

str r8, [sp, #S_PSR]

vcpu r8

add r8, r8, #(OFFSET_ARCH_VCPU + OFFSET_GUEST_CONTEXT)

ldr r9, [r8, #(OFFSET_SYS_REGS+OFFSET_VPSR)]

ldr r10, [sp, #S_SP]

cmp r9, #PSR_MODE_USR

streq r10, [r8, #(OFFSET_SYS_REGS+OFFSET_VUSP)]

strne r10, [r8, #(OFFSET_SYS_REGS+OFFSET_VKSP)]

ldr r8, [sp, #S_PSR]

bic r8, r8, #PSR_MODE_MASK

orr r8, r8, r9

str r8, [sp, #S_PSR]

ldr r10, [lr, #-4]

bic r10, r10, #0xff000000

cmp r10, #HYPERCALL_VECTOR_NO

moveq r12, #0×18

movne r12, #0×08

str r12, [sp, #S_CONTEXT]

beq process_hypercalls //BEQ 也就是条件跳转当r10与 82比较，相等的时候，就跳转到process_hypercalls标号处

b do_upcall //这个do_upcall和evtchn_do_upcall好相似，实际上也是的。

process_hypercalls:

enable_irq

adr lr, ret_from_hypercall

adr tbl, hypercall_table

add tbl, tbl, scno, lsl #2

ldr pc, [tbl]

ENTRY(hypercall_table)

__hypercall_start:

.long do_set_trap_table /* 0 */

.long do_mmu_update

.long do_ni_hypercall

.long do_stack_switch

.long do_set_callbacks

.long do_fpu_taskswitch /* 5 */

.long do_sched_op_compat

.long do_domctl

.long do_set_debugreg

.long do_get_debugreg

.long do_update_descriptor /* 10 */

.long do_ni_hypercall

.long do_memory_op

.long do_multicall

.long do_update_va_mapping

.long do_set_timer_op /* 15 */

.long do_event_channel_op

。。。。。。
————-

看一下do_upcall的定义：

xen/arch/arm/kernel/entry-common.S

* Send event to guest domain

ENTRY(do_upcall)

vcpu r10

ldr r11, [r10, #OFFSET_VCPU_INFO]

add r10, r10, #(OFFSET_ARCH_VCPU + OFFSET_GUEST_CONTEXT)

ldr lr, [r10, #OFFSET_HYPERVISOR_CALLBACK]

cmp lr, #0

beq restore

@DRE_start

@ldrb r9, [r11, #OFFSET_EVTCHN_UPCALL_MASK]

@cmp r9, #1

@beq restore

@DRE_end

mov r9, #0×01

strb r9, [r11, #OFFSET_EVTCHN_UPCALL_MASK]

mov r4, #PSR_MODE_SVC

str r4, [r10, #(OFFSET_SYS_REGS + OFFSET_VPSR)]

@ Load virtual kernel stack pointer

ldr r11, [r10, #(OFFSET_SYS_REGS + OFFSET_VKSP)]

@ Align VKSP in 8-byte boundary

sub r12, r11, #S_FRAME_SIZE

tst r12, #4

bicne r12, r12, #4

tst r12, #4

bne 1b

@ Update effective virtual kernel stack pointer.

str r12, [r10, #(OFFSET_SYS_REGS + OFFSET_VKSP)]

@ Create bounce frame in guest stack

ldmia sp!, {r0-r8}

stmia r12!, {r0-r8}

ldmia sp!, {r0-r8}

stmia r12!, {r0-r8}

sub r12, r12, #S_FRAME_SIZE

ldr r0, =.LCupcall

stmia r0, {r12,lr}

ldmia r0, {sp, lr}^

ldr r0, [r12, #S_CONTEXT]

ldr r1, [r12, #S_PSR]

ldr r2, [r10, #(OFFSET_SYS_REGS + OFFSET_VFAR)]

ldr r3, [r10, #(OFFSET_SYS_REGS + OFFSET_VFSR)]

mov r7, #PSR_MODE_USR

msr spsr, r7

ldr r5, =DOMAIN_KERNEL_VALUE

mcr p15, 0, r5, c3, c0, 0 @ Load DAC

movs pc, lr

.LCupcall:

.long 0

An example of second rank pointer struct data

tek-life — Tue, 29 Jun 2010 01:04:51 +0000

1 #include
2
3 void main()
4 {
5     struct cc{
6     int a;
7     char *ap;
8     };
9     struct cc c;
10     c.a=100;
11     c.ap=”abcdefg\n”;
12
13     printf(“%d;%s”,c.a,c.ap);
14
15     struct cc * cp=&c;
16     printf(“%d;%s”,cp->a,cp->ap);
17
18     struct cc ** cpp=&cp;
19     printf(“%d,%s”,(**cpp).a,(**cpp).ap);
20     printf(“%d,%s”,(*cpp)->a,(*cpp)->ap);
21 }

结果：
omycle@omycle-desktop:~/network$ ./test
100;abcdefg
100;abcdefg
100,abcdefg
100,abcdefg

Embeddedxen中断初始化

tek-life — Mon, 28 Jun 2010 03:40:39 +0000

xen中的中断初始化–和Linux的差不太多

typedef struct irqdesc {

char   *type;

irq_handler_t handle;

struct irqchip *chip;

struct irqaction *action;

unsigned int flags;

unsigned int status;

spinlock_t lock;

void   *chipdata;

void   *data;

unsigned int disable_depth;

/* Is this one of HID interrupts? */

unsigned int isHIDirq;

}irqdesc_t __cacheline_aligned;

xen/arch/arm/hypervisor/irq.c

struct irqdesc irq_desc[NR_IRQS]; //128

void __init xen_init_IRQ(void)

{

int irq;

for (irq = 0; irq < NR_IRQS; irq++)

irq_desc[irq].status |= IRQ_NO_REQUEST | IRQ_NO_PROBE;

#ifdef CONFIG_SMP

bad_irq_desc.affinity = CPU_MASK_ALL;

bad_irq_desc.cpu = smp_processor_id();

#endif

xen_init_arch_irq();

}

xen/arch/arm/mach-pxa/mainstone.c

void __init xen_init_arch_irq(void)

{

int irq;

printk(“Initing arch-IRQ…\n”);

pxa_init_irq();

/* setup extra Mainstone irqs */

for(irq = MAINSTONE_IRQ(0); irq <= MAINSTONE_IRQ(15); irq++) {/*160–175*/

  set_irq_chip(irq, &mainstone_irq_chip);

  set_irq_handler(irq, level_irq_handler);

  if (irq == MAINSTONE_IRQ(10) || irq == MAINSTONE_IRQ(14))

   set_irq_flags(irq, IRQF_VALID | IRQF_TRIGGER_PROBE ); //| IRQF_TRIGGER_NO_AUTO_ENABLE);

  else

   set_irq_flags(irq, IRQF_VALID | IRQF_TRIGGER_PROBE);

}

set_irq_flags(MAINSTONE_IRQ(8), 0);

set_irq_flags(MAINSTONE_IRQ(12), 0);

MST_INTMSKENA = 0;

MST_INTSETCLR = 0;

set_irq_chained_handler(IRQ_GPIO(0), mainstone_irq_handler);

set_irq_type(IRQ_GPIO(0), IRQT_RISING);

}

xen/arch/arm/mach-pxa/irq.c

void __init pxa_init_irq(void)

{

int irq;

/* disable all IRQs */

ICMR = 0;

/* all IRQs are IRQ, not FIQ */

ICLR = 0;

/* clear all GPIO edge detects */

GFER0 = 0;

GFER1 = 0;

GFER2 = 0;

GRER0 = 0;

GRER1 = 0;

GRER2 = 0;

GEDR0 = GEDR0;

GEDR1 = GEDR1;

GEDR2 = GEDR2;

#ifdef CONFIG_PXA27x

/* And similarly for the extra regs on the PXA27x */

ICMR2 = 0;

ICLR2 = 0;

GFER3 = 0;

GRER3 = 0;

GEDR3 = GEDR3;

#endif

/* only unmasked interrupts kick us out of idle */

ICCR = 1;

/* GPIO 0 and 1 must have their mask bit always set */

GPIO_IRQ_mask[0] = 3;

//NR_IRQS=512

//PXA_IRQ_SKIP=0

for (irq = PXA_IRQ(PXA_IRQ_SKIP); irq <= PXA_IRQ(31); irq++) {

  set_irq_chip(irq, &pxa_internal_chip_low);

  set_irq_handler(irq, level_irq_handler);

  set_irq_flags(irq, IRQF_VALID);

}

#if PXA_INTERNAL_IRQS > 32

for (irq = PXA_IRQ(32); irq < PXA_IRQ(PXA_INTERNAL_IRQS); irq++) {

  set_irq_chip(irq, &pxa_internal_chip_high);

  set_irq_handler(irq, level_irq_handler);

  set_irq_flags(irq, IRQF_VALID);

}

#endif

for (irq = IRQ_GPIO0; irq <= IRQ_GPIO1; irq++) {

  set_irq_chip(irq, &pxa_low_gpio_chip);

  set_irq_handler(irq, edge_irq_handler);

  set_irq_flags(irq, IRQF_VALID | IRQF_TRIGGER_PROBE);

}

for (irq = IRQ_GPIO(2); irq <= IRQ_GPIO(PXA_LAST_GPIO); irq++) {

  set_irq_chip(irq, &pxa_muxed_gpio_chip);

  set_irq_handler(irq, edge_irq_handler);

  set_irq_flags(irq, IRQF_VALID | IRQF_TRIGGER_PROBE);

}

/* Install handler for GPIO>=2 edge detect interrupts */

set_irq_chip(IRQ_GPIO_2_x, &pxa_internal_chip_low);

set_irq_chained_handler(IRQ_GPIO_2_x, pxa_gpio_demux_handler);

}

以上是xen中的中断初始化分析。下面看一下DOM的中断初始化。在DOM中，实际上没有了中断的概念，全部被evtchn_desc_t所替代了。

DOM

arch/arm/kernel/traps-xen.c

void __init trap_init(void)

{

//unsigned long vectors = CONFIG_VECTORS_BASE;

unsigned long vectors = (unsigned long) __guestvectors;//.extern __guestvectors arch/arm/kernel/entry-armv-xen.S

extern char __stubs_start[], __stubs_end[];

extern char __vectors_start[], __vectors_end[];

extern char __kuser_helper_start[], __kuser_helper_end[];

int kuser_sz = __kuser_helper_end – __kuser_helper_start;

/*

* Copy the vectors, stubs and kuser helpers (in entry-armv.S)

* into the vector page, mapped at 0xffff0000, and ensure these

* are visible to the instruction stream.

*/

memcpy((void *)vectors, __vectors_start, __vectors_end – __vectors_start);

memcpy((void *)vectors + 0×200, __stubs_start, __stubs_end – __stubs_start);

memcpy((void *)vectors + 0×1000 – kuser_sz, __kuser_helper_start, kuser_sz);

/*

* Copy signal return handlers into the vector page, and

* set sigreturn to be a pointer to these.

*/

memcpy((void *)KERN_SIGRETURN_CODE, sigreturn_codes,

sizeof(sigreturn_codes));

/* (GCD) From Samsung */

#if 0

flush_icache_range(vectors, vectors + PAGE_SIZE);

modify_domain(DOMAIN_USER, DOMAIN_CLIENT);

#endif /* 0 */

}

static evtchn_desc_t evtchn_desc[NR_IRQS];//512

void __init init_IRQ(void)

{

int i;

int cpu;

spin_lock_init(&irq_mapping_update_lock);

init_evtchn_cpu_bindings();

/* No VIRQ or IPI bindings. */

for (cpu = 0; cpu < NR_CPUS; cpu++) {

  for (i = 0; i < NR_VIRQS; i++)

   per_cpu(virq_to_irq, cpu)[i] = -1;

  for (i = 0; i < NR_IPIS; i++)

   per_cpu(ipi_to_irq, cpu)[i] = -1;

}

/* No event-channel -> IRQ mappings. */

for (i = 0; i < NR_EVENT_CHANNELS; i++) {

  evtchn_to_irq[i] = -1;

  mask_evtchn(i); /* No event channels are ‘live’ right now. */

}

/* No IRQ -> event-channel mappings. */

for (i = 0; i < NR_IRQS; i++)

  irq_info[i] = IRQ_UNBOUND;

/* Dynamic IRQ space is currently unbound. Zero the refcnts. */

for (i = 0; i < NR_DYNIRQS; i++) {

  irq_bindcount[dynirq_to_irq(i)] = 0;

  evtchn_desc[dynirq_to_irq(i)].status = IRQ_DISABLED;

  evtchn_desc[dynirq_to_irq(i)].action = NULL;

  evtchn_desc[dynirq_to_irq(i)].depth   = 1;

  evtchn_desc[dynirq_to_irq(i)].handler = &dynirq_type;

  evtchn_desc[dynirq_to_irq(i)].lock = __SPIN_LOCK_UNLOCKED(evtchn_desc->lock);

}

/* Phys IRQ space is statically bound (1:1 mapping). Nail refcnts. */

for (i = 0; i < NR_PIRQS; i++) {

  irq_bindcount[pirq_to_irq(i)] = 1;

  evtchn_desc[pirq_to_irq(i)].status = IRQ_DISABLED;

  evtchn_desc[pirq_to_irq(i)].action = NULL;

  evtchn_desc[pirq_to_irq(i)].depth   = 1;

  evtchn_desc[pirq_to_irq(i)].handler = &pirq_type;

  evtchn_desc[pirq_to_irq(i)].lock = __SPIN_LOCK_UNLOCKED(evtchn_desc->lock);

}

}

typedef struct hw_interrupt_type hw_irq_controller;

struct hw_interrupt_type {

const char *typename;

unsigned int (*startup)(unsigned int irq);

void (*shutdown)(unsigned int irq);

void (*enable)(unsigned int irq);

void (*disable)(unsigned int irq);

void (*ack)(unsigned int irq);

void (*end)(unsigned int irq);

void (*set_affinity)(unsigned int irq, cpumask_t dest);

int (*set_type)(unsigned int irq, unsigned int type);

void (*release)(unsigned int irq, void *dev_id);

};

typedef struct evtchn_desc {

hw_irq_controller *handler;

void *handler_data;

struct irqaction *action; /* IRQ action list */

unsigned int status; /* IRQ status */

unsigned int depth; /* nested irq disables */

unsigned int irq_count; /* For detecting broken interrupts */

unsigned int irqs_unhandled;

spinlock_t lock;

#if defined (CONFIG_GENERIC_PENDING_IRQ) || defined (CONFIG_IRQBALANCE)

unsigned int move_irq; /* Flag need to re-target intr dest*/

#endif

} evtchn_desc_t;

xenarm中断原理

tek-life — Mon, 28 Jun 2010 03:29:41 +0000

xenarm中断原理：

xenarm项目有两部分构成，一部分是xen,一部分是xenolinux

本文有三部分构成

1.中断初始化

2.中断申请

3.中断响应

————————————–

中断初始化

xen的irq初始化:

arch/arm/arch-imx21/start.S

.b start_xen

start_xen() //arch/arm/xen/xensetup.c

platform_setup()—-DECLARE_PLATFORM_OP(platform_setup, imx21ads_platform_setup);//arch/arm/arch-imx21/platform.c

imx21ads_platform_setup()

imx21_irq_init()

void imx21_irq_init(void)

{

unsigned int irq;

/* Mask all interrupts initially */

IMR(0) = 0;

IMR(1) = 0;

IMR(2) = 0;

IMR(3) = 0;

IMR(4) = 0;

IMR(5) = 0;

for (irq = 0; irq < IMX_IRQS; irq++) {

set_irq_chip(irq, &imx21_internal_chip);

set_irq_handler(irq, level_irq_handler);

set_irq_flags(irq, IRQF_VALID);

}

for (irq = IRQ_GPIOA(0); irq < IRQ_GPIOF(32); irq++) {

set_irq_chip(irq, &imx21_gpio_chip);

set_irq_handler(irq, edge_irq_handler);

set_irq_flags(irq, IRQF_VALID | IRQF_TRIGGER_PROBE);

}

set_irq_chained_handler(INT_GPIO, imx21_gpio_handler);

/* Disable all interrupts initially. */

/* In IMX21 this is done in the bootloader. */

}

DOMU的初始化

b start_kernel arch/arm/kernel/head-xen.S

|
start_kernel()

init_IRQ() //drivers/xen/core/evtchn.c

void __init init_IRQ(void)
{
int i;
int cpu;
spin_lock_init(&irq_mapping_update_lock);
init_evtchn_cpu_bindings();
/* No VIRQ or IPI bindings. */
for (cpu = 0; cpu < NR_CPUS; cpu++) {
for (i = 0; i < NR_VIRQS; i++)
per_cpu(virq_to_irq, cpu)[i] = -1;
for (i = 0; i < NR_IPIS; i++)
per_cpu(ipi_to_irq, cpu)[i] = -1;
}
/* No event-channel -> IRQ mappings. */
for (i = 0; i < NR_EVENT_CHANNELS; i++) {
evtchn_to_irq[i] = -1;
mask_evtchn(i); /* No event channels are ‘live’ right now. */
}
/* No IRQ -> event-channel mappings. */
for (i = 0; i < NR_IRQS; i++)
irq_info[i] = IRQ_UNBOUND;
/* Dynamic IRQ space is currently unbound. Zero the refcnts. */
for (i = 0; i < NR_DYNIRQS; i++) {
irq_bindcount[dynirq_to_irq(i)] = 0;
evtchn_desc[dynirq_to_irq(i)].status = IRQ_DISABLED;
evtchn_desc[dynirq_to_irq(i)].action = NULL;
evtchn_desc[dynirq_to_irq(i)].depth = 1;
evtchn_desc[dynirq_to_irq(i)].handler = &dynirq_type;
evtchn_desc[dynirq_to_irq(i)].lock = __SPIN_LOCK_UNLOCKED(evtchn_desc->lock);
}
/* Phys IRQ space is statically bound (1:1 mapping). Nail refcnts. */
for (i = 0; i < NR_PIRQS; i++) {
irq_bindcount[pirq_to_irq(i)] = 1;
evtchn_desc[pirq_to_irq(i)].status = IRQ_DISABLED;
evtchn_desc[pirq_to_irq(i)].action = NULL;
evtchn_desc[pirq_to_irq(i)].depth = 1;
evtchn_desc[pirq_to_irq(i)].handler = &pirq_type;
evtchn_desc[pirq_to_irq(i)].lock = __SPIN_LOCK_UNLOCKED(evtchn_desc->lock);
}
}

———————————————
DOMU的中断申请：

drivers/xen/core/evtchn.c

int request_irq(unsigned int irq,

irq_handler_t handler,

unsigned long irqflags, const char * devname, void *dev_id)

{

struct irqaction * action;

int retval;

* Sanity-check: shared interrupts must pass in a real dev-ID,

* otherwise we’ll have trouble later trying to figure out

* which interrupt is which (messes up the interrupt freeing

* logic etc).

if ((irqflags & SA_SHIRQ) && !dev_id)

return -EINVAL;

if (irq >= NR_IRQS)

return -EINVAL;

if (!handler)

return -EINVAL;

action = (struct irqaction *)kmalloc(sizeof(struct irqaction), GFP_KERNEL);

if (!action)

return -ENOMEM;

action->handler = handler;

action->flags = irqflags;

cpus_clear(action->mask);

action->name = devname;

action->next = NULL;

action->dev_id = dev_id;

retval = setup_irq(irq, action);

if (retval)

kfree(action);

return retval;

}

int setup_irq(unsigned int irq, struct irqaction * new)

{

struct evtchn_desc *desc = evtchn_desc + irq;

struct irqaction *old, **p;

unsigned long flags;

int shared = 0;

// the following should be commented: jyhwang 2007 July 15

// printk("irq=%d, NR_IRQS=%d\n", irq, NR_IRQS);

if (irq >= NR_IRQS)

return -EINVAL;

if (desc->handler == NULL)

return -ENOSYS;

* Some drivers like serial.c use request_irq() heavily,

* so we have to be careful not to interfere with a

* running system.

if (new->flags & SA_SAMPLE_RANDOM) {

* This function might sleep, we want to call it first,

* outside of the atomic block.

* Yes, this might clear the entropy pool if the wrong

* driver is attempted to be loaded, without actually

* installing a new handler, but is this really a problem,

* only the sysadmin is able to do this.

rand_initialize_irq(irq);

}

* The following block of code has to be executed atomically

spin_lock_irqsave(&desc->lock,flags);

p = &desc->action;

if ((old = *p) != NULL) {

/* Can’t share interrupts unless both agree to */

if (!(old->flags & new->flags & SA_SHIRQ)) {

spin_unlock_irqrestore(&desc->lock,flags);

return -EBUSY;

}

/* add new interrupt at end of irq queue */

do {

p = &old->next;

old = *p;

} while (old);

shared = 1;

}

*p = new;//action赋值

if (!shared) {

desc->depth = 0;

desc->status &= ~(IRQ_DISABLED | IRQ_AUTODETECT |

IRQ_WAITING | IRQ_INPROGRESS);

if (desc->handler->startup)

desc->handler->startup(irq);//priq_startup()

else

desc->handler->enable(irq);

}

spin_unlock_irqrestore(&desc->lock,flags);

new->irq = irq;

new->dir = NULL;

return 0;

}

static unsigned int startup_pirq(unsigned int irq)

{

evtchn_op_t op = { .cmd = EVTCHNOP_bind_pirq };

int evtchn = evtchn_from_irq(irq);

if (VALID_EVTCHN(evtchn)) {

goto out;

}

op.u.bind_pirq.pirq = irq;

/* NB. We are happy to share unless we are probing. */

op.u.bind_pirq.flags = probing_irq(irq) ? 0 : BIND_PIRQ__WILL_SHARE;

if (HYPERVISOR_event_channel_op(&op) != 0) {

if (!probing_irq(irq))

printk(KERN_INFO "Failed to obtain physical IRQ %d\n",

irq);

return 0;

}

evtchn = op.u.bind_pirq.port;

pirq_query_unmask(irq_to_pirq(irq));

bind_evtchn_to_cpu(evtchn, 0);

evtchn_to_irq[evtchn] = irq;

irq_info[irq] = mk_irq_info(IRQT_PIRQ, irq, evtchn);

out:

unmask_evtchn(evtchn);

pirq_unmask_notify(irq_to_pirq(irq));

return 0;

}

在xenarm中：common/event_channel.c

long do_event_channel_op(int cmd, XEN_GUEST_HANDLE(void) arg)

{

long rc;

switch ( cmd )

{

case EVTCHNOP_alloc_unbound: {

struct evtchn_alloc_unbound alloc_unbound;

if ( copy_from_guest(&alloc_unbound, arg, 1) != 0 )

return -EFAULT;

rc = evtchn_alloc_unbound(&alloc_unbound);

if ( (rc == 0) && (copy_to_guest(arg, &alloc_unbound, 1) != 0) )

rc = -EFAULT; /* Cleaning up here would be a mess! */

break;

}

case EVTCHNOP_bind_interdomain: {

struct evtchn_bind_interdomain bind_interdomain;

if ( copy_from_guest(&bind_interdomain, arg, 1) != 0 )

return -EFAULT;

rc = evtchn_bind_interdomain(&bind_interdomain);

if ( (rc == 0) && (copy_to_guest(arg, &bind_interdomain, 1) != 0) )

rc = -EFAULT; /* Cleaning up here would be a mess! */

break;

}

case EVTCHNOP_bind_virq: {

struct evtchn_bind_virq bind_virq;

if ( copy_from_guest(&bind_virq, arg, 1) != 0 )

return -EFAULT;

rc = evtchn_bind_virq(&bind_virq);

if ( (rc == 0) && (copy_to_guest(arg, &bind_virq, 1) != 0) )

rc = -EFAULT; /* Cleaning up here would be a mess! */

break;

}

case EVTCHNOP_bind_ipi: {

struct evtchn_bind_ipi bind_ipi;

if ( copy_from_guest(&bind_ipi, arg, 1) != 0 )

return -EFAULT;

rc = evtchn_bind_ipi(&bind_ipi);

if ( (rc == 0) && (copy_to_guest(arg, &bind_ipi, 1) != 0) )

rc = -EFAULT; /* Cleaning up here would be a mess! */

break;

}

case EVTCHNOP_bind_pirq: {

struct evtchn_bind_pirq bind_pirq;

if ( copy_from_guest(&bind_pirq, arg, 1) != 0 )

return -EFAULT;

rc = evtchn_bind_pirq(&bind_pirq);

if ( (rc == 0) && (copy_to_guest(arg, &bind_pirq, 1) != 0) )

rc = -EFAULT; /* Cleaning up here would be a mess! */

break;

}

case EVTCHNOP_close: {

struct evtchn_close close;

if ( copy_from_guest(&close, arg, 1) != 0 )

return -EFAULT;

rc = evtchn_close(&close);

break;

}

case EVTCHNOP_send: {

struct evtchn_send send;

if ( copy_from_guest(&send, arg, 1) != 0 )

return -EFAULT;

rc = evtchn_send(send.port);

break;

}

case EVTCHNOP_status: {

struct evtchn_status status;

if ( copy_from_guest(&status, arg, 1) != 0 )

return -EFAULT;

rc = evtchn_status(&status);

if ( (rc == 0) && (copy_to_guest(arg, &status, 1) != 0) )

rc = -EFAULT;

break;

}

case EVTCHNOP_bind_vcpu: {

struct evtchn_bind_vcpu bind_vcpu;

if ( copy_from_guest(&bind_vcpu, arg, 1) != 0 )

return -EFAULT;

rc = evtchn_bind_vcpu(bind_vcpu.port, bind_vcpu.vcpu);

break;

}

case EVTCHNOP_unmask: {

struct evtchn_unmask unmask;

if ( copy_from_guest(&unmask, arg, 1) != 0 )

return -EFAULT;

rc = evtchn_unmask(&unmask);

break;

}

case EVTCHNOP_reset: {

struct evtchn_reset reset;

if ( copy_from_guest(&reset, arg, 1) != 0 )

return -EFAULT;

rc = evtchn_reset(&reset);

break;

}

default:

rc = -ENOSYS;

break;

}

return rc;

}

static long evtchn_bind_pirq(evtchn_bind_pirq_t *bind) //common/event_channel.c

{

struct evtchn *chn;

struct domain *d = current->domain;

int port, pirq = bind->pirq;

long rc;

if ( (pirq < 0) || (pirq >= ARRAY_SIZE(d->pirq_to_evtchn)) )

return -EINVAL;

if ( !irq_access_permitted(d, pirq) )

return -EPERM;

spin_lock(&d->evtchn_lock);

if ( d->pirq_to_evtchn[pirq] != 0 )

ERROR_EXIT(-EEXIST);

if ( (port = get_free_port(d)) < 0 )

ERROR_EXIT(port);

chn = evtchn_from_port(d, port);

d->pirq_to_evtchn[pirq] = port;

rc = pirq_guest_bind(d->vcpu[0], pirq, !!(bind->flags & BIND_PIRQ__WILL_SHARE));

if ( rc != 0 )

{

d->pirq_to_evtchn[pirq] = 0;

goto out;

}

chn->state = ECS_PIRQ;

chn->u.pirq = pirq;

bind->port = port;

out:

spin_unlock(&d->evtchn_lock);

return rc;

}

int pirq_guest_bind(struct vcpu *v, int irq, int will_share) //arch/arm/xen/irq.c

{

struct irqdesc *desc;

irq_guest_action_t *action;

unsigned long flags;

int rc = 0;

if ( (irq < 0) || (irq >= NR_IRQS) )

return -EINVAL;

desc = get_irq_descriptor(irq);

spin_lock_irqsave(&desc->lock, flags);

action = (irq_guest_action_t *)desc->action;

if (!(desc->flags & IRQF_GUEST_BOUND)) {

if (desc->action != NULL ) {

DPRINTK(3,"Cannot bind IRQ %d to guest. In use by %s.\n",(int)irq, desc->action->name);

rc = -EBUSY;

goto out;

}

action = xmalloc(irq_guest_action_t);

if ((desc->action = (struct irqaction *)action) == NULL ) {

DPRINTK(3,"Cannot bind IRQ %d to guest. Out of memory.\n", irq);

rc = -ENOMEM;

goto out;

}

action->shareable = 1;

action->nr_guests = 0;

action->in_flight = 0;

action->ack_type = pirq_ack_type(irq);

desc->disable_depth = 0;

desc->flags |= IRQF_GUEST_BOUND;

if(will_share) {

desc->flags |= IRQF_SHARABLE;

}

desc->chip->unmask(irq);

} else if ( !will_share || !action->shareable ) {

DPRINTK(3,"Cannot bind IRQ %d to guest. Will not share with others.\n", irq);

rc = -EBUSY;

goto out;

}

if ( action->nr_guests == IRQ_MAX_GUESTS ) {

DPRINTK(3,"Cannot bind IRQ %d to guest. Already at max share.\n", irq);

rc = -EBUSY;

goto out;

}

action->guest[action->nr_guests++] = v->domain;

out:

spin_unlock_irqrestore(&desc->lock, flags);

return rc;

}

至此，中断申请结束！

——————————————————

中断响应：

Hypervisor中断响应：

arch/arm/xen/entry.S

.align 5
__irq_svc:
save_svc_context
#ifdef CONFIG_MACHINE_VERSATILE
        get_irqnr_preamble r5, lr @ minsung
#endif
1: get_irqnr_and_base r0, r6, r5, lr
movne r1, sp
@
@ routine called with r0 = irq number, r1 = struct pt_regs *
@
adrne lr, 1b
bne asm_do_IRQ—在DOMU中是irq_handler
————————————————————————
__irq_usr:
save_usr_context
vcpu r0
add r0, r0, #(OFFSET_ARCH_VCPU + OFFSET_GUEST_CONTEXT)
ldr r1, [r0, #(OFFSET_SYS_REGS + OFFSET_VPSR)]
ldr r2, [sp, #S_SP]
cmp r1, #PSR_MODE_USR
streq r2, [r0, #(OFFSET_SYS_REGS + OFFSET_VUSP)]
strne r2, [r0, #(OFFSET_SYS_REGS + OFFSET_VKSP)]
ldr     r3, [sp, #S_PSR]
bic     r3, r3, #PSR_MODE_MASK
orr     r3, r3, r1
str     r3, [sp, #S_PSR]
#ifdef CONFIG_MACHINE_VERSATILE
get_irqnr_preamble r5, lr @ minsung
#endif
1: get_irqnr_and_base r0, r6, r5, lr
movne   r1, sp
adrne lr, 1b
bne     asm_do_IRQ

asm_do_IRQ

asmlinkage void asm_do_IRQ(unsigned int irq, struct cpu_user_regs *regs)

{

struct irqdesc *desc;

if (irq >= NR_IRQS) {

printk("Bad IRQ = %d\n", irq);

}

desc = get_irq_descriptor(irq);

desc->handle(irq, desc, regs);

}

void level_irq_handler(unsigned int irq, struct irqdesc *desc, struct cpu_user_regs *regs)

{

irqreturn_t ret;

irqaction_t *action;

spin_lock(&desc->lock);

desc->chip->ack(irq);

if(desc->flags & IRQF_GUEST_BOUND) {

handle_guest_bound_irq(irq);

goto out_unlock;

}

if (unlikely(desc->status & IRQ_IN_PROGRESS))

goto out_unlock;

desc->status &= ~(IRQ_REPLAY | IRQ_WAITING);

action = desc->action;

if (unlikely(!action || (desc->status & IRQ_DISABLED))) {

desc->status |= IRQ_PENDING;

goto out_unlock;

}

desc->status |= IRQ_IN_PROGRESS;

desc->status &= ~IRQ_PENDING;

spin_unlock(&desc->lock);

ret = handle_event(irq, action, regs);

if(!ret) {

printk("Action return = %d\n", ret);

}

spin_lock(&desc->lock);

desc->status &= ~IRQ_IN_PROGRESS;

if (!(desc->status & IRQ_DISABLED) && desc->chip->unmask)

desc->chip->unmask(irq);

out_unlock:

spin_unlock(&desc->lock);

}

static void handle_guest_bound_irq(unsigned int irq)

{

int i;

struct domain *d;

struct irqdesc *desc;

irq_guest_action_t *action;

desc = get_irq_descriptor(irq);

action = (irq_guest_action_t *)desc->action;

for ( i = 0; i < action->nr_guests; i++ ) {

d = action->guest[i];

// send HID irqs to only the foreground domain.

if (desc->isHIDirq && d->domain_id != (domid_t)foreground_domain) {

continue;

}

if(action->ack_type == ACK_TYPE_UNMASK) {

if(!test_and_set_bit(irq, (volatile unsigned long *)&d->pirq_mask)) {//测试，是否被mask了。

action->in_flight++;

}

send_guest_pirq(d, irq);

}

void send_guest_pirq(struct domain *d, int pirq)

{

int port = d->pirq_to_evtchn[pirq];

struct evtchn *chn;

ASSERT(port != 0);

if(!acm_send_guest_pirq(d, pirq))

return;

chn = evtchn_from_port(d, port);

evtchn_set_pending(d->vcpu[chn->notify_vcpu_id], port);

}

DOMU的中断响应：
arch/arm/kernel/entry-armv-xen.S

__irq_svc:

    svc_entry

#ifndef CONFIG_XENOLINUX

#ifdef CONFIG_TRACE_IRQFLAGS

    bl trace_hardirqs_off

#endif

#ifdef CONFIG_PREEMPT

    get_thread_info tsk

    ldr r8, [tsk, #TI_PREEMPT]      @ get preempt count

    add r7, r8, #1          @ increment it

    str r7, [tsk, #TI_PREEMPT]

#endif

    irq_handler

   .macro irq_handler
    mov r0, sp
    bl evtchn_do_upcall
    .endm

* NB. Interrupts are disabled on entry. */
asmlinkage void evtchn_do_upcall(struct pt_regs *regs)
{
unsigned long l1, l2;
unsigned int   l1i, l2i, port;
int            irq, cpu = smp_processor_id();
shared_info_t *s = HYPERVISOR_shared_info;
vcpu_info_t   *vcpu_info = &s->vcpu_info[cpu];
retry:
xchg(&vcpu_info->evtchn_upcall_pending,0);
l1 = xchg(&vcpu_info->evtchn_pending_sel, 0);
while (l1 != 0) {
l1i = __ffs(l1);
l1 &= ~(1UL << l1i);
while ((l2 = active_evtchns(cpu, s, l1i)) != 0) {
l2i = __ffs(l2);
port = (l1i * BITS_PER_LONG) + l2i;
if ((irq = evtchn_to_irq[port]) != -1) {
irq_enter();
do_IRQ(irq, regs);
irq_exit();
} else {
evtchn_device_upcall(port);
}
}
}
if(vcpu_info->evtchn_upcall_pending) {
goto retry;
}
}
fastcall unsigned int do_IRQ(unsigned int irq, struct pt_regs *regs)

{

struct pt_regs *old_regs = set_irq_regs(regs);

evtchn_desc_t *desc = evtchn_desc + irq;

struct irqaction * action;

unsigned int status = 0;

kstat_this_cpu.irqs[irq]++;

spin_lock(&desc->lock);

if (desc->handler->ack)

desc->handler->ack(irq);

status = desc->status & ~(IRQ_REPLAY | IRQ_WAITING);

status |= IRQ_PENDING; /* we _want_ to handle it */

action = NULL;

if (likely(!(status & (IRQ_DISABLED | IRQ_INPROGRESS)))) {

action = desc->action;

status &= ~IRQ_PENDING; /* we commit to handling */

status |= IRQ_INPROGRESS; /* we are handling it */

}

desc->status = status;

if (unlikely(!action))

goto out;

/*

* Edge triggered interrupts need to remember

* pending events.

* This applies to any hw interrupts that allow a second

* instance of the same irq to arrive while we are in do_IRQ

* or in the handler. But the code here only handles the _second_

* instance of the irq, not the third or fourth. So it is mostly

* useful for irq hardware that does not mask cleanly in an

* SMP environment.

*/

for (;;) {

irqreturn_t ret;

spin_unlock(&desc->lock);

         if (!(action->flags & SA_INTERRUPT))

                 local_irq_enable();

do {

                 ret = action->handler(irq, action->dev_id);

                 if (ret == IRQ_HANDLED)

                         status |= action->flags;

                 action = action->next;

         } while (action);

if (status & SA_SAMPLE_RANDOM)

add_interrupt_randomness(irq);

local_irq_disable();

spin_lock(&desc->lock);

if (likely(!(desc->status & IRQ_PENDING)))

break;

desc->status &= ~IRQ_PENDING;

}

desc->status &= ~IRQ_INPROGRESS;

out:

/*

* The ->end() handler has to deal with interrupts which got

* disabled while the handler was running.

*/

desc->handler->end(irq);

spin_unlock(&desc->lock);

set_irq_regs(old_regs);

return 1;

}

Embeddedxen中断申请

tek-life — Fri, 25 Jun 2010 05:53:11 +0000

先看xen的中断申请

申请中断离不开request_irq和setup_irq

xen只申请了两个irq一个是timer的,另一个是console.

xen/arch/arm/mach-pxa/time.c

void __init xen_pxa_timer_init(void)
{
unsigned long clock_tick_rate;

OIER = 0;
OSSR = OSSR_M0 | OSSR_M1 | OSSR_M2 | OSSR_M3;

if (cpu_is_pxa25x())
clock_tick_rate = 3686400;
else if (machine_is_mainstone())
clock_tick_rate = 3249600;
else
clock_tick_rate = 3250000;

set_oscr2ns_scale(clock_tick_rate);

ckevt_pxa_osmr0.mult =
div_sc(clock_tick_rate, NSEC_PER_SEC, ckevt_pxa_osmr0.shift);

ckevt_pxa_osmr0.max_delta_ns =
clockevent_delta2ns(0x7fffffff, &ckevt_pxa_osmr0);
ckevt_pxa_osmr0.min_delta_ns =
clockevent_delta2ns(MIN_OSCR_DELTA * 2, &ckevt_pxa_osmr0) + 1;

cksrc_pxa_oscr0.mult =
clocksource_hz2mult(clock_tick_rate, cksrc_pxa_oscr0.shift);

setup_irq(IRQ_OST0, &pxa_ost0_irq);

/* timebase_freq = CLOCK_TICK_RATE: source clock rate in Hz */
//timebase_freq = 1000000LL;
timebase_freq = CLOCK_TICK_RATE;
system_timer_clocksource = &cksrc_pxa_oscr0;
system_timer_clockevent = &ckevt_pxa_osmr0;

ckevt_pxa_osmr0.set_mode(CLOCK_EVT_MODE_PERIODIC, &ckevt_pxa_osmr0);

}

所安装的irqaction是pxa_ost0_irq,xen/arch/arm/mach-pxa/time.c

static struct irqaction pxa_ost0_irq = {
.name = “ost0″,
.flags = IRQF_DISABLED | IRQF_TIMER | IRQF_IRQPOLL,
.handler = pxa_ost0_interrupt,
.dev_id = &ckevt_pxa_osmr0,
};

xen/arch/arm/hypervisor/irq.c
int setup_irq(unsigned int irq, struct irqaction *new)
{
int rc = 0;
   int shared = 0;
   struct irqaction *old, **p;
   unsigned long flags;
   struct irqdesc *desc;

if(irq >= NR_IRQS) {
printk(“BAD IRQ = %d\n”, irq);
while(1);
}

   desc = get_irq_descriptor(irq);

   spin_lock_irqsave(&desc->lock, flags);

   p = &desc->action;

   if ((old = *p) != NULL) {
   /* Can’t share interrupts unless both agree to */
   if (!(old->flags & new->flags & IRQF_SHARABLE) ||
   ((old->flags ^ new->flags) & IRQF_TRIGGER_MASK)) {
   printk(“IRQ sharing failed.\n”);

rc = -EBUSY;
goto out;
   }

   /* add new interrupt at end of irq queue */
   do {
   p = &old->next;
   old = *p;
   } while (old);
   shared = 1;
   }

   *p = new;

   if (!shared) {
if(new->flags & IRQF_TRIGGER_MASK) {
if(desc->chip->set_type) {
desc->chip->set_type(irq, new->flags & IRQF_TRIGGER_MASK);
} else {
printk(“No set_irq_type function for irq %d\n”, irq);
rc = -1;
goto out;
}
}

desc->status &= ~(IRQ_AUTO_DETECT | IRQ_WAITING | IRQ_IN_PROGRESS);

if(!(desc->status & IRQ_NO_AUTO_ENABLE)) {
desc->disable_depth = 0;
desc->status &= ~IRQ_DISABLED;
desc->chip->unmask(irq);
} else {
desc->disable_depth = 1;
}

   }

desc->flags &= ~IRQF_GUEST_BOUND;

out:
   spin_unlock_irqrestore(&desc->lock, flags);

   return rc;
}

setup_irq timer后，就开始setup_irq console了。

console的设置稍微复杂了一些：

在__start_xen中：xen/arch/arm/hypersivor/setup.c

pxaserial.baud = 115200;
pxaserial.data_bits = 8;
pxaserial.parity = ‘n’;
pxaserial.stop_bits = 1;
pxaserial.io_base = 1;
pxaserial.irq = IRQ_FFUART;

//pxaserial.io_base = 0x3f8;
pxaserial_init(0, &pxaserial);

pxaserial的结构体：xen/drivers/char/pxa.c
static struct pxaserial {

int baud, data_bits, parity, stop_bits, irq;

unsigned long io_base; /* I/O port or memory-mapped I/O address. */

char *remapped_io_base; /* Remapped virtual address of mmap I/O. */

/* UART with IRQ line: interrupt-driven I/O. */

struct irqaction irqaction;

/* UART with no IRQ line: periodically-polled I/O. */

struct timer timer;

unsigned int timeout_ms;

} pxaserial_com[2] = { { 0 }, { 0 } };

pxaserial_init xen/drivers/char/pxa.c

void __init pxaserial_init(int index, struct pxaserial_defaults *defaults)

{

struct pxaserial *uart = &pxaserial_com[index];

if ( (index < 0) || (index> 1) )

return;

if ( defaults != NULL )

{

uart->baud = defaults->baud;

uart->data_bits = defaults->data_bits;

uart->parity = parse_parity_char(defaults->parity);

uart->stop_bits = defaults->stop_bits;

uart->irq = defaults->irq;

uart->io_base = defaults->io_base;

}

pxaserial_parse_port_config(uart, index);

}

—

pxaserial_parse_port_config xen/drivers/char/pxa.c

static void __init pxaserial_parse_port_config(struct pxaserial *uart, int index)

{

int baud;

const char *conf = ((index == 0) ? opt_com1 : opt_com2);

/* (LSU) Defined in xen/lib/vsprintf.c */

extern unsigned long simple_strtoul(const char *cp, char **endp, unsigned int base);

/* No user-specified configuration? */

if ( (conf == NULL) || (*conf == ‘\0′) )

{

/* Some platforms may automatically probe the UART configuartion. */

if ( uart->baud != 0 )

goto config_parsed;

return;

}

if ( strncmp(conf, “auto”, 4) == 0 )

{

uart->baud = BAUD_AUTO;

conf += 4;

}

else if ( (baud = simple_strtoul(conf, (char **) &conf, 10)) != 0 )

uart->baud = baud;

if ( *conf != ‘,’ )

goto config_parsed;

conf++;

uart->data_bits = simple_strtoul(conf, (char **) &conf, 10);

uart->parity = parse_parity_char(*conf);

conf++;

uart->stop_bits = simple_strtoul(conf,(char **) &conf, 10);

if ( *conf == ‘,’ )

{

conf++;

uart->io_base = simple_strtoul(conf, (char **) &conf, 0);

if ( *conf == ‘,’ )

{

conf++;

uart->irq = simple_strtoul(conf, (char **) &conf, 10);

}

}

config_parsed:

/* Sanity checks. */

if ( (uart->baud != BAUD_AUTO) && ((uart->baud < 1200) || (uart->baud> 115200)) )

PARSE_ERR(“Baud rate %d outside supported range.”, uart->baud);

if ( (uart->data_bits < 5) || (uart->data_bits> )

PARSE_ERR(“%d data bits are unsupported.”, uart->data_bits);

if ( (uart->stop_bits < 1) || (uart->stop_bits> 2) )

PARSE_ERR(“%d stop bits are unsupported.”, uart->stop_bits);

if ( uart->io_base == 0 )

PARSE_ERR(“I/O base address must be specified.”);

/* Register with generic serial driver. */

serial_register_uart(0, &pxaserial_driver, uart);

}

上面的这个pxaserial_parse_port_config函数有点长，不过，除了最后一句有用外，其他的都在扯淡。特别是中间那一大段完全没有被执行，所以不要有压力哈。

serial_register_uart xen/drivers/char/serial.c

void __init serial_register_uart(int idx, struct uart_driver *driver, void *uart)

{

   /* Store UART-specific info. */

   com[idx].driver = driver;

   com[idx].uart = uart;

   /* Default is no transmit FIFO. */

   com[idx].tx_fifo_size = 1;

}

其实这个函数不再是重点了，重点的是其中的值：
我们看一下，com[0]的类型是：

struct serial_port {

   /* Uart-driver parameters. */

   struct uart_driver *driver;

   void *uart;

   /* Number of characters the port can hold for transmit. */

   int   tx_fifo_size;

   /* Transmit data buffer (interrupt-driven uart). */

   char *txbuf;

   unsigned int txbufp, txbufc;

   /* Force synchronous transmit. */

   int sync;

   /* Receiver callback functions (asynchronous receivers). */

   serial_rx_fn rx_lo, rx_hi, rx;

   /* Receive data buffer (polling receivers). */

   char rxbuf[SERIAL_RXBUFSZ];

   unsigned int rxbufp, rxbufc;

   /* Serial I/O is concurrency-safe. */

   spinlock_t rx_lock, tx_lock;

};

也就是说，设置了com[0]的两个成员变量，一个是driver,另一个是uart.我们在回头看一下pxaserial_parse_port_config(struct pxaserial *uart, int index),其实这个函数调用serial_register_uart(0, &pxaserial_driver, uart)的并不优雅，它将原本是index确定为了0.不过对于本项目显然是没有问题的。可以看看linux是怎样实现的。
在函数serial_register_uart里面讲3个成员变量定以后，就剩下其他的小东西了。这些东西紧接着就定义了，不要急。我们先来看一下struct uart_driver *driver=&pxaserial_driver.

改变定义在xen/drivers/char/pxa.c文件中

static struct uart_driver pxaserial_driver = {

.init_preirq = pxa_initpreirq,

.putc = pxaserial_putc,

.getc = pxaserial_getc,

.irq = pxaserial_irq,

.init_postirq = pxaserial_init_postirq,

.endboot = NULL,

.tx_empty = serial_pxa_tx_empty,

};

以上分别定义了struct pxaserial类型的pxaserial，定义了struct uart_driver类型的pxaserial_driver.然后将它们赋值给了struct serial_port类型的com[0].

我们回过头来看看，实际上，并没有定义struct pxaserial pxaserial的全部成员，比如irqaction，比如timer.也许是以后还会有。我们需要耐心。
好，这里已经定义好了serial_port的3个重要的成员变量了，革命尚未成功，同志仍需努力！

返回到__start_xen的主程序，接下来开始执行

serial_init_preirq(void);

void __init serial_init_preirq(void)

{

   int i;

   for ( i = 0; i < ARRAY_SIZE(com); i++ )

   if ( com[i].driver && com[i].driver->init_preirq )

   com[i].driver->init_preirq(&com[i]);

}

可以看到，实际上执行的是pxa_initpreirq(&com[0]),com[1]没有初始化，因此com[1]并没有被执行。

/* from startup…*/

/* (LSU) Applied awaited signature */

//static int pxa_initpreirq(struct serial_port *port) {

static void pxa_initpreirq(struct serial_port *port) {

struct uart_pxa_port *up = &serial_pxa_port;

unsigned long flags;

// int retval;

if (up->line == 3) /* HWUART */

up->mcr |= UART_MCR_AFE;

else

up->mcr = 0;

/*

* Clear the FIFO buffers and disable them.

* (they will be reenabled in set_termios())

*/

serial_out(up, UART_FCR, UART_FCR_ENABLE_FIFO);

serial_out(up, UART_FCR, UART_FCR_ENABLE_FIFO | UART_FCR_CLEAR_RCVR

| UART_FCR_CLEAR_XMIT);

serial_out(up, UART_FCR, 0);

/*

* Clear the interrupt registers.

*/

(void) serial_in(up, UART_LSR);

(void) serial_in(up, UART_RX);

(void) serial_in(up, UART_IIR);

(void) serial_in(up, UART_MSR);

/*

* Now, initialize the UART

*/

serial_out(up, UART_LCR, UART_LCR_WLEN8);

spin_lock_irqsave(&up->lock, flags);

up->mctrl |= TIOCM_OUT2;

serial_pxa_set_mctrl(port, up->mctrl);

spin_unlock_irqrestore(&up->lock, flags);

//return 0;

}

只里面又包含了已经被定义好的东东   xen/drivers/char/pxa.c

static struct uart_pxa_port serial_pxa_port = {

.name = “FFUART”,

.cken = CKEN6_FFUART,

.membase = (void *)&FFUART,

.mapbase = __PREG(FFUART),

.irq = IRQ_FFUART,

.uartclk = 921600 * 16,

.line = 0,

};

struct uart_pxa_port {

spinlock_t lock;

unsigned char ier;

unsigned char lcr;

unsigned char mcr;

unsigned int mctrl;

unsigned int lsr_break_flag;

unsigned int cken;

int line;

char *name;

unsigned long iobase; /* io base address */

void __iomem *membase; /* ioremap cookie or NULL */

unsigned long mapbase; /* resource base */

unsigned int irq; /* interrupt number */

unsigned int uartclk; /* UART clock rate */

unsigned char regshift; /* register shift */

unsigned char iotype; /* UPIO_* */

unsigned char hub6;

upf_t flags; /* UPF_* flags */

};

从上面看来，应该是一些硬件参数信息了。不过和pxaserial那个结构体似乎有某种联系。

还是看那个函数，有用的只有这么一行：serial_pxa_set_mctrl(port, up->mctrl);
我们进去看看：

static void serial_pxa_set_mctrl(struct serial_port *port, unsigned int mctrl) {

struct uart_pxa_port *up = &serial_pxa_port;

unsigned char mcr = 0;

if (mctrl & TIOCM_RTS)

mcr |= UART_MCR_RTS;

if (mctrl & TIOCM_DTR)

mcr |= UART_MCR_DTR;

if (mctrl & TIOCM_OUT1)

mcr |= UART_MCR_OUT1;

if (mctrl & TIOCM_OUT2)

mcr |= UART_MCR_OUT2;

if (mctrl & TIOCM_LOOP)

mcr |= UART_MCR_LOOP;

mcr |= up->mcr;

serial_out(up, UART_MCR, mcr);

}

晕倒啊，将port传进来有意义么？根本就没有用到port,还是用的原来的serial_pxa_port
然后就是serial_out(up,UART_MCR,mcr).

static inline void serial_out(struct uart_pxa_port *up, int offset, int value)

{

offset <<= 2;

writel(value, up->port.membase + offset);

}

drivers/serial/pxa.c

struct uart_pxa_port {

struct uart_port port;

unsigned char ier;

unsigned char lcr;

unsigned char mcr;

unsigned int lsr_break_flag;

unsigned int cken;

char *name;

};

这里的uart_port

struct uart_port {

spinlock_t lock; /* port lock */

unsigned int iobase; /* in/out[bwl] */

unsigned char __iomem *membase; /* read/write[bwl] */

unsigned int irq; /* irq number */

unsigned int uartclk; /* base uart clock */

unsigned int fifosize; /* tx fifo size */

unsigned char x_char; /* xon/xoff char */

unsigned char regshift; /* reg offset shift */

unsigned char iotype; /* io access style */

unsigned char unused1;

#define UPIO_PORT (0)

#define UPIO_HUB6 (1)

#define UPIO_MEM (2)

#define UPIO_MEM32 (3)

#define UPIO_AU (4) /* Au1x00 type IO */

#define UPIO_TSI (5) /* Tsi108/109 type IO */

unsigned int read_status_mask; /* driver specific */

unsigned int ignore_status_mask; /* driver specific */

struct uart_info *info; /* pointer to parent info */

struct uart_icount icount; /* statistics */

struct console *cons; /* struct console, if any */

#ifdef CONFIG_SERIAL_CORE_CONSOLE

unsigned long sysrq; /* sysrq timeout */

#endif

upf_t flags;

#define UPF_FOURPORT ((__force upf_t) (1 << 1))

#define UPF_SAK ((__force upf_t) (1 << 2))

#define UPF_SPD_MASK ((__force upf_t) (0×1030))

#define UPF_SPD_HI ((__force upf_t) (0×0010))

#define UPF_SPD_VHI ((__force upf_t) (0×0020))

#define UPF_SPD_CUST ((__force upf_t) (0×0030))

#define UPF_SPD_SHI ((__force upf_t) (0×1000))

#define UPF_SPD_WARP ((__force upf_t) (0×1010))

#define UPF_SKIP_TEST ((__force upf_t) (1 << 6))

#define UPF_AUTO_IRQ ((__force upf_t) (1 << 7))

#define UPF_HARDPPS_CD ((__force upf_t) (1 << 11))

#define UPF_LOW_LATENCY ((__force upf_t) (1 << 13))

#define UPF_BUGGY_UART ((__force upf_t) (1 << 14))

#define UPF_MAGIC_MULTIPLIER ((__force upf_t) (1 << 16))

#define UPF_CONS_FLOW ((__force upf_t) (1 << 23))

#define UPF_SHARE_IRQ ((__force upf_t) (1 << 24))

#define UPF_BOOT_AUTOCONF ((__force upf_t) (1 << 28))

#define UPF_DEAD ((__force upf_t) (1 << 30))

#define UPF_IOREMAP ((__force upf_t) (1 << 31))

#define UPF_CHANGE_MASK ((__force upf_t) (0x17fff))

#define UPF_USR_MASK ((__force upf_t) (UPF_SPD_MASK|UPF_LOW_LATENCY))

unsigned int mctrl; /* current modem ctrl settings */

unsigned int timeout; /* character-based timeout */

unsigned int type; /* port type */

const struct uart_ops *ops;

unsigned int custom_divisor;

unsigned int line; /* port index */

unsigned long mapbase; /* for ioremap */

struct device *dev; /* parent device */

unsigned char hub6; /* this should be in the 8250 driver */

unsigned char unused[3];

};

有这么长。。。
好了，搞这这么久，实际上根本与Port屁事不关。我擦～～～

回到__start_xen的主程序，继续我们未完成的千秋大业。
init_console();

void __init init_console(void)

{

extern void add_taint(unsigned flag);

   char *p;

   /* Where should console output go? */

   for ( p = opt_console; p != NULL; p = strchr(p, ‘,’) )

   {

   if ( *p == ‘,’ )

   p++;

   if ( strncmp(p, “com”, 3) == 0 )

   sercon_handle = serial_parse_handle(p);

   else if ( strncmp(p, “vga”, 3) == 0 )

   vga_init();

   }

   serial_set_rx_handler(sercon_handle, serial_rx);

   /* HELLO WORLD — start-of-day banner text. */

   printk(xen_banner());

   printk(” http://www.cl.cam.ac.uk/netos/xen\n”);

   printk(” University of Cambridge Computer Laboratory\n\n”);

   printk(” Xen version %d.%d%s (%s@%s) (%s) %s\n”,

   xen_major_version(), xen_minor_version(), xen_extra_version(),

   xen_compile_by(), xen_compile_domain(),

   xen_compiler(), xen_compile_date());

   printk(” EmbeddedXEN/PENAR Project – Reconfigurable Embedded Digital System (REDS) Institute from HEIG-VD/Switzerland\n”);

   printk(” http://reds.heig-vd.ch\n\n”);

   printk(” Latest ChangeSet: %s\n\n”, xen_changeset());

   set_printk_prefix(“(XEN) “);

   if ( opt_sync_console )

   {

   serial_start_sync(sercon_handle);

   add_taint(TAINT_SYNC_CONSOLE);

   printk(“Console output is synchronous.\n”);

   }

}

这里面有一句挺重要：
serial_set_rx_handler(sercon_handle, serial_rx);

void __init serial_set_rx_handler(int handle, serial_rx_fn fn)

{

   struct serial_port *port = &com[handle & SERHND_IDX];

   unsigned long flags;

   if ( handle == -1 )

   return;

   spin_lock_irqsave(&port->rx_lock, flags);

   if ( port->rx != NULL )

   goto fail;

   if ( handle & SERHND_LO )

   {

   if ( port->rx_lo != NULL )

   goto fail;

   port->rx_lo = fn;

   }

   else if ( handle & SERHND_HI )

   {

   if ( port->rx_hi != NULL )

   goto fail;

   port->rx_hi = fn;

   }

   else

   {

   if ( (port->rx_hi != NULL) || (port->rx_lo != NULL) )

   goto fail;

   port->rx = fn;

   }

   spin_unlock_irqrestore(&port->rx_lock, flags);

   return;

fail:

   spin_unlock_irqrestore(&port->rx_lock, flags);

   printk(“ERROR: Conflicting receive handlers for COM%d\n”,

   handle & SERHND_IDX);

}

这里将port的成员变量rx_lo,rx_hi,rx_rx全部定位了fn，也就是serial_rx

然后在start_of_day()中，com实际上才开始注册了。在start_of_day中
serial_init_postirq();

void __init serial_init_postirq(void)

{

   int i;

   for ( i = 0; i < ARRAY_SIZE(com); i++ )

   if ( com[i].driver && com[i].driver->init_postirq )

   com[i].driver->init_postirq(&com[i]);

}

实际上是pxaserial_init_postirq.–这在前面赋值的时候，已经被赋值了。xen/drivers/char/pxa.c

static void __init pxaserial_init_postirq(struct serial_port *port)

{

struct pxaserial *uart = port->uart;

struct uart_pxa_port *up = &serial_pxa_port;

int rc;

//int bits;

if ( uart->irq < 0 )

return;

serial_async_transmit(port);

/* We do not consider polling mode (DRE) */

uart->irqaction.handler = pxaserial_interrupt;

uart->irqaction.name = “pxaserial”;

uart->irqaction.dev_id = port;

if ( (rc = setup_irq(uart->irq, &uart->irqaction)) != 0 )

printk(“ERROR: Failed to allocate ns16550 IRQ %d\n”, uart->irq);

/*

* Finally, enable interrupts. Note: Modem status interrupts

* are set via set_termios(), which will be occurring imminently

* anyway, so we don’t enable them here.

*/

up->ier = UART_IER_RLSI | UART_IER_RDI | UART_IER_RTOIE | UART_IER_UUE;

serial_out(up, UART_IER, up->ier);

/*

* And clear the interrupt registers again for luck.

*/

(void) serial_in(up, UART_LSR);

(void) serial_in(up, UART_RX);

(void) serial_in(up, UART_IIR);

(void) serial_in(up, UART_MSR);

}

看到uart->irqaction了吧，被赋值了，呵呵，终于被赋值了，不过timer还没有被赋值，没关系，我们以后再看，至此，本文基本上也就完成一半了。

现在我们来看一下DOM方面的中断申请，不例外，肯定是用reqeust_irq和setup_irq.我们先来看一下request_irq:

xen_guest/core/evtchn.c

int request_irq(unsigned int irq, irq_handler_t handler, unsigned long irqflags, const char * devname, void *dev_id)

{

struct irqaction * action;

int retval;

/*

* Sanity-check: shared interrupts must pass in a real dev-ID,

* otherwise we’ll have trouble later trying to figure out

* which interrupt is which (messes up the interrupt freeing

* logic etc).

*/

if ((irqflags & SA_SHIRQ) && !dev_id)

  return -EINVAL;

if (irq >= NR_IRQS)

  return -EINVAL;

if (!handler)

  return -EINVAL;

action = (struct irqaction *)kmalloc(sizeof(struct irqaction), GFP_KERNEL);

if (!action)

  return -ENOMEM;

action->handler = handler;

action->flags = irqflags;

cpus_clear(action->mask);

action->name = devname;

action->next = NULL;

action->dev_id = dev_id;

retval = setup_irq(irq, action);

if (retval)

  kfree(action);

return retval;

}

setup_irq()

xen_guest/core/evtchn.c

int setup_irq(unsigned int irq, struct irqaction * new)

{

struct evtchn_desc *desc = evtchn_desc + irq;

struct irqaction *old, **p;

unsigned long flags;

int shared = 0;

// the following should be commented: jyhwang 2007 July 15

// printk(“irq=%d, NR_IRQS=%d\n”, irq, NR_IRQS);

if (irq >= NR_IRQS)

  return -EINVAL;

if (desc->handler == NULL)

  return -ENOSYS;

/*

* Some drivers like serial.c use request_irq() heavily,

* so we have to be careful not to interfere with a

* running system.

*/

if (new->flags & SA_SAMPLE_RANDOM) {

  /*

   * This function might sleep, we want to call it first,

   * outside of the atomic block.

   * Yes, this might clear the entropy pool if the wrong

   * driver is attempted to be loaded, without actually

   * installing a new handler, but is this really a problem,

   * only the sysadmin is able to do this.

   */

  rand_initialize_irq(irq);

}

/*

* The following block of code has to be executed atomically

*/

spin_lock_irqsave(&desc->lock,flags);

p = &desc->action;

if ((old = *p) != NULL) {

  /* Can’t share interrupts unless both agree to */

  if (!(old->flags & new->flags & SA_SHIRQ)) {

   spin_unlock_irqrestore(&desc->lock,flags);

   return -EBUSY;

  }

  /* add new interrupt at end of irq queue */

  do {

   p = &old->next;

   old = *p;

  } while (old);

  shared = 1;

}

*p = new;//action赋值给evtchn_desc

if (!shared) {

  desc->depth = 0;

  desc->status &= ~(IRQ_DISABLED | IRQ_AUTODETECT |

      IRQ_WAITING | IRQ_INPROGRESS);

  if (desc->handler->startup)

   desc->handler->startup(irq);

  else

   desc->handler->enable(irq);

}

spin_unlock_irqrestore(&desc->lock,flags);

new->irq = irq;

new->dir = NULL;

return 0;

}

看到setup_irq，似乎与Linux没有什么太大的不同，可是这也正是移植的妙处，总是要尽量的和原来的系统兼容，对吧。

我们来看看desc->handler->startup(irq);这句吧，这才是核心。我们知道在DOM进行初始化的时候，是怎么初始化呢？如果是pirq的话，分配的handler是pirq_type,这个handler的startup是被startup_pirq()实例化的。那么我们就来看看startup_pirq吧：

#define probing_irq(_irq) (evtchn_desc[(_irq)].action == NULL)

static unsigned int startup_pirq(unsigned int irq)

{

// evtchn_op_t op = { .cmd = EVTCHNOP_bind_pirq };

evtchn_bind_pirq_t op;

int evtchn = evtchn_from_irq(irq), ret = 0;

if (VALID_EVTCHN(evtchn)) {

  goto out;

}

op.pirq = irq;

/* NB. We are happy to share unless we are probing. */

op.flags = probing_irq(irq) ? 0 : BIND_PIRQ__WILL_SHARE;

ret = HYPERVISOR_event_channel_op(EVTCHNOP_bind_pirq, &op);

if (ret != 0) {

  if (!probing_irq(irq))

   printk(KERN_INFO “Failed to obtain physical IRQ %d\n”, irq);

  return 0;

}

evtchn = op.port;

pirq_query_unmask(irq_to_pirq(irq));

bind_evtchn_to_cpu(evtchn, 0);

evtchn_to_irq[evtchn] = irq;

irq_info[irq] = mk_irq_info(IRQT_PIRQ, irq, evtchn);

out:

unmask_evtchn(evtchn);

pirq_unmask_notify(irq_to_pirq(irq));

return 0;

}

由于我们现在工作于DOMU的内核中，如果在x86架构中的话，是在ring1态，但这是在arm架构中，因此仍然是在ring3。不过,如果要申请进入ring0,也要进行HYPERVISOR_event_channel_op

xen/common/event_channel.c

long do_event_channel_op(int cmd, XEN_GUEST_HANDLE(void) arg)

{

…

case EVTCHNOP_bind_pirq: {

        struct evtchn_bind_pirq bind_pirq;

        if ( copy_from_guest(&bind_pirq, arg, 1) != 0 )

            return -EFAULT;

        rc = evtchn_bind_pirq(&bind_pirq);

        if ( (rc == 0) && (copy_to_guest(arg, &bind_pirq, 1) != 0) )

            rc = -EFAULT; /* Cleaning up here would be a mess! */

        break;

    }

…

}

evtchn_bind_pirq(&bind_pirq);

xen/common/event_channel.c

static long evtchn_bind_pirq(evtchn_bind_pirq_t *bind)

{

    struct evtchn *chn;

    struct domain *d = current->domain;

    int            port, pirq = bind->pirq;

    long           rc;

    if ( (pirq < 0) || (pirq >= ARRAY_SIZE(d->pirq_to_evtchn)) )

        return -EINVAL;

    if ( !irq_access_permitted(d, pirq) )

        return -EPERM;

    spin_lock(&d->evtchn_lock);

    if ( d->pirq_to_evtchn[pirq] != 0 )

        ERROR_EXIT(-EEXIST);

    if ( (port = get_free_port(d)) < 0 )//得到evtchn号

        ERROR_EXIT(port);

    chn = evtchn_from_port(d, port);//从evtchn号得到chn数据结构

    d->pirq_to_evtchn[pirq] = port;

    rc = pirq_guest_bind(d->vcpu[0], pirq, !!(bind->flags & BIND_PIRQ__WILL_SHARE));

    if ( rc != 0 )

    {

        d->pirq_to_evtchn[pirq] = 0;

        goto out;

    }

    chn->state = ECS_PIRQ;//充实这个数据结构

    chn->u.pirq = pirq;//充实

    bind->port = port;//充实bind，要带回去的

out:

    spin_unlock(&d->evtchn_lock);

    return rc;

}

port与pirq

port属于DOM的，pirq属于系统的。

当irq来了以后，实际上就是pirq，找到port,然后找到chn，然后就设定vcpu响应的Port了.(这些在中断响应文章中都有叙述)

也就是说xen->dom的interface是通过port来进行的,而在申请的时候，是通过结构体evtchn_bind_pirq

void send_guest_pirq(struct domain *d, int pirq)

{

   int port = d->pirq_to_evtchn[pirq];

   struct evtchn *chn;

   ASSERT(port != 0);

   chn = evtchn_from_port(d, port);

   evtchn_set_pending(d->vcpu[chn->notify_vcpu_id], port);

}

  然后当DOM执行时，

evtchn_do_upcall

asmlinkage void evtchn_do_upcall(struct pt_regs *regs)

{

unsigned long l1, l2;

unsigned int l1i, l2i, port;

int irq, cpu = smp_processor_id();

shared_info_t *s = HYPERVISOR_shared_info;

vcpu_info_t *vcpu_info = &s->vcpu_info[cpu];

retry:

xchg(&vcpu_info->evtchn_upcall_pending,0);

l1 = xchg(&vcpu_info->evtchn_pending_sel, 0);

while (l1 != 0) {

l1i = __ffs(l1);

l1 &= ~(1UL << l1i);

while ((l2 = active_evtchns(cpu, s, l1i)) != 0) {

l2i = __ffs(l2);

port = (l1i * BITS_PER_LONG) + l2i;

if ((irq = evtchn_to_irq[port]) != -1) { //evtchn号转化为irq号

irq_enter();

do_IRQ(irq, regs); //guest分发中断函数

irq_exit();

} else {

evtchn_device_upcall(port);

}

}

}

if(vcpu_info->evtchn_upcall_pending) {//当有多个中断的时候

goto retry;

}

}

好了，这部分的回顾，就到此打住。

int pirq_guest_bind(struct vcpu *v, int irq, int will_share)

{

struct irqdesc      *desc;

irq_guest_action_t *action;

unsigned long       flags;

int                 rc = 0;

if ( (irq < 0) || (irq >= NR_IRQS) )

  return -EINVAL;

desc = get_irq_descriptor(irq);

spin_lock_irqsave(&desc->lock, flags);

action = (irq_guest_action_t *)desc->action;//

if (!(desc->flags & IRQF_GUEST_BOUND)) {

  if (desc->action != NULL ) {

   printk(“Cannot bind IRQ %d to guest. In use by %s.\n”,(int)irq, desc->action->name);

   rc = -EBUSY;

   goto out;

  }//:

  action = xmalloc(irq_guest_action_t);

  if ((desc->action = (struct irqaction *)action) == NULL ) {

   printk(“Cannot bind IRQ %d to guest. Out of memory.\n”, irq);

   rc = -ENOMEM;

   goto out;

  }

  action->shareable = 1;

  action->nr_guests = 0;

  action->in_flight = 0;

  action->ack_type = pirq_ack_type(irq);

  desc->disable_depth = 0;

  desc->flags |= IRQF_GUEST_BOUND;

  if(will_share) {

   desc->flags |= IRQF_SHARABLE;

  }

  desc->chip->unmask(irq);

} else if ( !will_share || !action->shareable ) {

  printk(“Cannot bind IRQ %d to guest. Will not share with others.\n”, irq);

  rc = -EBUSY;

  goto out;

}

if ( action->nr_guests == IRQ_MAX_GUESTS ) {

  printk(“Cannot bind IRQ %d to guest. Already at max share.\n”, irq);

  rc = -EBUSY;

  goto out;

}

action->guest[action->nr_guests++] = v->domain;

out:

spin_unlock_irqrestore(&desc->lock, flags);

return rc;

}

在上面的这个pirq_guest_bind需要注意的是action的初始化。这里的action和domu的action是两个概念。不是同一回事，一个是irqdesc,一个是evtchn_desc_t。也就是说，一个是中断描述符，另一个是事件通道描述符。当中断由下往上传输的时候，先有irqdesc工作，然后，交给DOMU的时候，evtchn_desc_t开始工作。

我们看到，在request_irq中已经将action实例化了因此，在 pirq_guest_bind(struct vcpu *v, int irq, int will_share)中，直接更改action->guest[acton->nr_guests++]=v->domain,然后返回。

好了，接下来，我们会分析一个实例，来看一下，具体是怎样利用接口request_irq()申请中断.

中断响应，从Embeddedxen到DOM

tek-life — Thu, 24 Jun 2010 14:04:12 +0000

最初的跳转：
arch/arm/kernel/entry-armv.S

__irq_svc:
svc_entry

#ifdef CONFIG_PREEMPT
get_thread_info tsk
ldr r8, [tsk, #TI_PREEMPT] @ get preempt count
add r7, r8, #1 @ increment it
str r7, [tsk, #TI_PREEMPT]
#endif

irq_handler

…

__irq_usr:
usr_entry

get_thread_info tsk
#ifdef CONFIG_PREEMPT
ldr r8, [tsk, #TI_PREEMPT] @ get preempt count
add r7, r8, #1 @ increment it
str r7, [tsk, #TI_PREEMPT]
#endif

irq_handler

.macro irq_handler
1: get_irqnr_and_base r0, r6, r5, lr
movne r1, sp
@
@ routine called with r0 = irq number, r1 = struct pt_regs *
@
adrne lr, 1b
bne asm_do_IRQ

看asm_do_IRQ:

xen/arch/arm/hypervisor/irq.c

asmlinkage void asm_do_IRQ(unsigned int irq, struct xen_cpu_user_regs *regs)
{
struct irqdesc *desc;

if (irq >= NR_IRQS) {
printk(“Bad IRQ = %d\n”, irq);
}

  /* (GCD) CONFIG_XEN_BENCHMARK
   * GPIO37 irq#69 is decode from interrupt #10 in pxa_gpio_demux_handler() function
   * See file xen/arch/arm/mach-pxa/irq.c
   */

desc = get_irq_descriptor(irq);
desc->handle(irq, desc, regs);
}

这里初始化被赋值为: level_irq_handler–<-xen_init_IRQ(void)

void level_irq_handler(unsigned int irq, struct irqdesc *desc, struct xen_cpu_user_regs *regs)

{

irqreturn_t ret;

irqaction_t *action;

spin_lock(&desc->lock);

desc->chip->ack(irq);

if(desc->flags & IRQF_GUEST_BOUND) {

handle_guest_bound_irq(irq);

goto out_unlock;

}

if (unlikely(desc->status & IRQ_IN_PROGRESS))

goto out_unlock;

desc->status &= ~(IRQ_REPLAY | IRQ_WAITING);

action = desc->action;

if (unlikely(!action || (desc->status & IRQ_DISABLED))) {

desc->status |= IRQ_PENDING;

goto out_unlock;

}

desc->status |= IRQ_IN_PROGRESS;

desc->status &= ~IRQ_PENDING;

spin_unlock(&desc->lock);

ret = handle_event(irq, action, regs);

if(!ret) {

printk(“Action return = %d\n”, ret);

}

spin_lock(&desc->lock);

desc->status &= ~IRQ_IN_PROGRESS;

if (!(desc->status & IRQ_DISABLED) && desc->chip->unmask)

desc->chip->unmask(irq);

out_unlock:

spin_unlock(&desc->lock);

}

当xen执行到这里的时候,出现了分叉,如果desc的flags标志位是IRQF_GUEST_BOUND,那么就发往DOM否则，自己处理。

其实在xen中，自己处理的中断只有两处，一个是timer，另一个是console.

由于handle_event的执行流程跟linux中的差不多，就不再多叙。我们就假设，中断具有IRQF_GUEST_BOUND,那么就会执行Handle_guest_bound_irq(irq).

static void handle_guest_bound_irq(unsigned int irq)
{
int i;
struct domain *d;
struct irqdesc *desc;
irq_guest_action_t *action;

desc = get_irq_descriptor(irq);

action = (irq_guest_action_t *)desc->action;

for ( i = 0; i < action->nr_guests; i++ ) {//每一个申请中断的DOM都发。也就是多个DOM可以申请同一个中断
                                                                       //从中我们看到，XEN是向DOM发送的，而不是VCPU

d = action->guest[i];

// send HID irqs to only the foreground domain.
if (desc->isHIDirq && d->domain_id != (domid_t)foreground_domain) {
continue;
}

if(action->ack_type == ACK_TYPE_UNMASK) {
if(!test_and_set_bit(irq, (volatile unsigned long *)&d->pirq_mask)) {
action->in_flight++;
}
}

send_guest_pirq(d, irq);
}
}

在xen/common/event_channel.c中

void send_guest_pirq(struct domain *d, int pirq)

{

   int port = d->pirq_to_evtchn[pirq];

   struct evtchn *chn;

   ASSERT(port != 0);

   chn = evtchn_from_port(d, port);

   evtchn_set_pending(d->vcpu[chn->notify_vcpu_id], port);

}

在上面的这个send_guest_pirq中，设置Pending是向dom中的该chn的notify_vcpu_id,而不是随便制定的一个vcpu.

void evtchn_set_pending(struct vcpu *v, int port)

{

   struct domain *d = v->domain;

   shared_info_t *s = d->shared_info;

   /*

   * The following bit operations must happen in strict order.

   * NB. On x86, the atomic bit operations also act as memory barriers.

   * There is therefore sufficiently strict ordering for this architecture –

   * others may require explicit memory barriers.

   */

if ( test_and_set_bit(port, __shared_info_addr(d, s, evtchn_pending)) )

   return;

   if ( !test_bit (port, __shared_info_addr(d, s, evtchn_mask)) &&

   !test_and_set_bit(port / BITS_PER_GUEST_LONG(d),

   vcpu_info_addr(v, evtchn_pending_sel)) )

   {

   vcpu_mark_events_pending(v);

   }

   /* Check if some VCPU might be polling for this event. */

   if ( unlikely(d->is_polling) )

   {

   d->is_polling = 0;

   smp_mb(); /* check vcpu poll-flags /after/ clearing domain poll-flag */

   for_each_vcpu ( d, v )

   {

   if ( !v->is_polling )

   continue;

   v->is_polling = 0;

   vcpu_unblock(v);

   }

   }

}

对上面这个函数的认识还有一些问题。

接下来，如果函数被执行了，那么相关的vcpu位被设置，然后什么时候被执行呢？

当一个时间中断来了以后，会触发SCHEDULE_SOFTIRQ.因此schedule()会被执行.这样，相关的vcpu就执行了。

当VCPU被调度后，我们看一下DOM的中断执行顺序：

arch/arm/kernel/entry-armv-xen.S

__irq_usr:

usr_entry

get_thread_info tsk

#ifdef CONFIG_PREEMPT

ldr r8, [tsk, #TI_PREEMPT] @ get preempt count

add r7, r8, #1 @ increment it

str r7, [tsk, #TI_PREEMPT]

#endif

irq_handler

…

.align 5

__irq_svc:

svc_entry

#ifdef CONFIG_PREEMPT

get_thread_info tsk

ldr r8, [tsk, #TI_PREEMPT] @ get preempt count

add r7, r8, #1 @ increment it

str r7, [tsk, #TI_PREEMPT]

#endif

irq_handler

.macro irq_handler

mov r0, sp

bl evtchn_do_upcall

.endm

看一下evtchn_do_upcall

xen_guest/core/evtchn.c

asmlinkage void evtchn_do_upcall(struct pt_regs *regs)

{

unsigned long l1, l2;

unsigned int l1i, l2i, port;

int irq, cpu = smp_processor_id();

shared_info_t *s = HYPERVISOR_shared_info;

vcpu_info_t *vcpu_info = &s->vcpu_info[cpu];

retry:

xchg(&vcpu_info->evtchn_upcall_pending,0);

l1 = xchg(&vcpu_info->evtchn_pending_sel, 0);

while (l1 != 0) {

l1i = __ffs(l1);

l1 &= ~(1UL << l1i);

while ((l2 = active_evtchns(cpu, s, l1i)) != 0) {

l2i = __ffs(l2);

port = (l1i * BITS_PER_LONG) + l2i;

if ((irq = evtchn_to_irq[port]) != -1) { //evtchn号转化为irq号

irq_enter();

do_IRQ(irq, regs); //guest分发中断函数

irq_exit();

} else {

evtchn_device_upcall(port);

}

}

}

if(vcpu_info->evtchn_upcall_pending) {//当有多个中断的时候

goto retry;

}

}

到这里实际上已经和Linux接上轨了

fastcall unsigned int do_IRQ(unsigned int irq, struct pt_regs *regs)

{

struct pt_regs *old_regs = set_irq_regs(regs);

evtchn_desc_t *desc = evtchn_desc + irq;

struct irqaction * action;

unsigned int status = 0;

kstat_this_cpu.irqs[irq]++;

spin_lock(&desc->lock);

if (desc->handler->ack)

desc->handler->ack(irq);//调用pirq_ack函数—xen_guest/core/evtchn.c

status = desc->status & ~(IRQ_REPLAY | IRQ_WAITING);

status |= IRQ_PENDING; /* we _want_ to handle it */

action = NULL;

if (likely(!(status & (IRQ_DISABLED | IRQ_INPROGRESS)))) {

action = desc->action;

status &= ~IRQ_PENDING; /* we commit to handling */

status |= IRQ_INPROGRESS; /* we are handling it */

}

desc->status = status;

if (unlikely(!action))

goto out;

/*

* Edge triggered interrupts need to remember

* pending events.

* This applies to any hw interrupts that allow a second

* instance of the same irq to arrive while we are in do_IRQ

* or in the handler. But the code here only handles the _second_

* instance of the irq, not the third or fourth. So it is mostly

* useful for irq hardware that does not mask cleanly in an

* SMP environment.

*/

for (;;) {

irqreturn_t ret;

spin_unlock(&desc->lock);

   if (!(action->flags & SA_INTERRUPT))

   local_irq_enable();

do {

   ret = action->handler(irq, action->dev_id, regs);

   if (ret == IRQ_HANDLED)

   status |= action->flags;

   action = action->next;

   } while (action);

if (status & SA_SAMPLE_RANDOM)

add_interrupt_randomness(irq);

local_irq_disable();

spin_lock(&desc->lock);

if (likely(!(desc->status & IRQ_PENDING)))

break;

desc->status &= ~IRQ_PENDING;

}

desc->status &= ~IRQ_INPROGRESS;

out:

/*

* The ->end() handler has to deal with interrupts which got

* disabled while the handler was running.

*/

desc->handler->end(irq);

spin_unlock(&desc->lock);

set_irq_regs(old_regs);

return 1;

}

贴图一张

embeddedxen中xen的时间中断分析

tek-life — Tue, 22 Jun 2010 09:35:39 +0000

需要注意的一点是，这里的timer_softirq和DOMU里面的并不一样。本文仅浅析xen里面的timer

执行顺序：

irq来了以后->time_irq_handler->调用其他函数->raise_softirq(TIMER_SOFTIRQ)->timer_softirq_action->(定时器timer->fn())->raise_softirq(SCHEDULE_SOFTIRQ)->schedule()

timer_init();——open_softirq(TIMER_SOFTIRQ, timer_softirq_action);

init_xen_time()//这个函数里面有很多故事

init_platform_timer();

xen_pxa_timer_init();

setup_irq(IRQ_OST0, &pxa_ost0_irq);//IRQ_OST0 是26

也就是安装了IRQ，那么，看一下pxa_ost0_irq

static struct irqaction pxa_ost0_irq = {

.name = “ost0″,

.flags = IRQF_DISABLED | IRQF_TIMER | IRQF_IRQPOLL,

.handler = pxa_ost0_interrupt,

.dev_id = &ckevt_pxa_osmr0,

};

看到它的handler是pxa_ost0_interrupt

static irqreturn_t

pxa_ost0_interrupt(int irq, void *dev_id, struct pt_regs *regs)

{

//struct clock_event_device *c = dev_id;

//static int cnt = 0;

/* Disarm the compare/match, signal the event. */

OIER &= ~OIER_E0;

OSSR = OSSR_M0;

timer_interrupt(irq, dev_id, regs);

return IRQ_HANDLED;

}

当发生时间中断的时候，会调用timer_interrupt();

void timer_interrupt(int irq, void *dev_id, struct xen_cpu_user_regs *regs) {

ASSERT(local_irq_is_enabled());

/* Update jiffies counter. */

(*(volatile unsigned long *) &jiffies_64)++;

raise_softirq(TIMER_SOFTIRQ);

if (–plt_overflow_jiffies == 0)

plt_overflow();

}

可以看到，每来一次中断，就raise_softirq();也就是响应 timer_softirq_action

我看来看一下timer_softirq_action都在做什么事情：

static void timer_softirq_action(void)

{

struct timer *t, **heap;

struct timers *ts;

s_time_t now;

void (*fn)(void *);

void *data;

ts = &this_cpu(timers);

spin_lock_irq(&ts->lock);

do {

heap = ts->heap;

now = NOW();

while ( (GET_HEAP_SIZE(heap) != 0) &&

((t = heap[1])->expires < (now + TIMER_SLOP)) )

{

remove_entry(heap, t);

ts->running = t;

fn = t->function;

data = t->data;

spin_unlock_irq(&ts->lock);

(*fn)(data);

spin_lock_irq(&ts->lock);

/* Heap may have grown while the lock was released. */

heap = ts->heap;

}

ts->running = NULL;

}

while ( !reprogram_timer(GET_HEAP_SIZE(heap) ? heap[1]->expires : 0) );

spin_unlock_irq(&ts->lock);

}

在一个时间中断来了以后那个ISR做的事情是(* fn)(data),即是t->function.这个function到底是哪个函数呢？—s_time_fn().为什么捏？让我们从长计议：

在启动xen的时候，调用了scheduler_init();在scheduler_init()里面做的事情是init_timer
for_each_cpu ( i )
{
   spin_lock_init(&per_cpu(schedule_data, i).schedule_lock);
   init_timer(&per_cpu(schedule_data, i).s_timer, s_timer_fn, NULL, i);
}
也就是将定时器发生是的函数给确定了，是s_timer_fn.有问题么？我们看一下init_timer的定义就可以啦：
static inline void init_timer(
   struct timer *timer,
   void (*function)(void *),
   void *data,
   unsigned int cpu)
{
   memset(timer, 0, sizeof(*timer));
   timer->function = function;
   timer->data = data;
   timer->cpu = cpu;
}
那么s_timer_fn做什么事情了？
/* The scheduler timer: force a run through the scheduler */
static void s_timer_fn(void *unused)
{
    raise_softirq(SCHEDULE_SOFTIRQ);
   perfc_incr(sched_irq);
}
晕啊，又将SCHEDULE_SOFTIRQ给raise了

又一个软中断，让我们继续追踪一下SCHEDULE_SOFTIRQ吧：
记得我们上面说过在xen启动的时候，调用了scheduler_init吧，在scheduler_init中，我们做的工作是初始化了定时器，其实在初始化定时器之前，这个函数还做了另外一件事情：

open_softirq(SCHEDULE_SOFTIRQ, schedule);

是不是有点小晕，好吧，我们把scheduler_init()全部拿出来晒一晒

/* Initialise the data structures. */

void __init scheduler_init(void)

{

int i;

open_softirq(SCHEDULE_SOFTIRQ, schedule);

for_each_cpu ( i )

{

spin_lock_init(&per_cpu(schedule_data, i).schedule_lock);

init_timer(&per_cpu(schedule_data, i).s_timer, s_timer_fn, NULL, i);

}

for ( i = 0; schedulers[i] != NULL; i++ )

{

ops = *schedulers[i];

if ( strcmp(ops.opt_name, opt_sched) == 0 )

break;

}

if ( schedulers[i] == NULL )

printk(“Could not find scheduler: %s\n”, opt_sched);

printk(“Using scheduler: %s (%s)\n”, ops.name, ops.opt_name);

SCHED_OP(init);

}

好，现在看一下schedule都做的是啥事情：

* The main function

* – deschedule the current domain (scheduler independent).

* – pick a new domain (scheduler dependent).

static void schedule(void)

{

struct vcpu *prev = current, *next = NULL;

s_time_t now = NOW();

struct schedule_data *sd;

struct task_slice next_slice;

s32 r_time; /* time for new dom to run */

ASSERT(!in_irq());

ASSERT(this_cpu(mc_state).flags == 0);

perfc_incr(sched_run);

sd = &this_cpu(schedule_data);

spin_lock_irq(&sd->schedule_lock);

stop_timer(&sd->s_timer);

/* get policy-specific decision on scheduling… */

next_slice = ops.do_schedule(now);

r_time = next_slice.time;

next = next_slice.task;

sd->curr = next;

set_timer(&sd->s_timer, now + r_time);

if ( unlikely(prev == next) )

{

spin_unlock_irq(&sd->schedule_lock);

return continue_running(prev);

}

TRACE_2D(TRC_SCHED_SWITCH_INFPREV,

prev->domain->domain_id,

now – prev->runstate.state_entry_time);

TRACE_3D(TRC_SCHED_SWITCH_INFNEXT,

next->domain->domain_id,

(next->runstate.state == RUNSTATE_runnable) ?

(now – next->runstate.state_entry_time) : 0,

r_time);

ASSERT(prev->runstate.state == RUNSTATE_running);

vcpu_runstate_change(

prev,

(test_bit(_VPF_blocked, &prev->pause_flags) ? RUNSTATE_blocked :

(vcpu_runnable(prev) ? RUNSTATE_runnable : RUNSTATE_offline)),

now);

ASSERT(next->runstate.state != RUNSTATE_running);

vcpu_runstate_change(next, RUNSTATE_running, now);

ASSERT(!next->is_running);

next->is_running = 1;

spin_unlock_irq(&sd->schedule_lock);

perfc_incr(sched_ctx);

stop_timer(&prev->periodic_timer);

/* Ensure that the domain has an up-to-date time base. */

update_vcpu_system_time(next);

vcpu_periodic_timer_work(next);

TRACE_4D(TRC_SCHED_SWITCH,

prev->domain->domain_id, prev->vcpu_id,

next->domain->domain_id, next->vcpu_id);

context_switch(prev, next);

}

唉，这么多东西，哥也晕了。这个调度是在调度domain还是调度vcpu还是调度一个进程呢？

step by step 设备驱动程序学习笔记

tek-life — Sat, 12 Jun 2010 08:45:40 +0000

有个参照很好

tekkman.cublog.cn

内联汇编笔记

tek-life — Sat, 12 Jun 2010 04:35:11 +0000

重要的一条：其实内联汇编输入部分输出部分相当于函数的参数而已。

__asm__ __volatile__("Instruction List":output:input:Modify);
在output 部分
"=register"(a) : a=register
在input部分
“=register”(a) : register=a
我觉得这是在output部分和input部分的很大的一个区别了。强调这个是因为很容易被混淆。
另外，无论是Output,还是input是没有执行顺序的。我觉得这就完全相当于一条指令，并且没有优先级的指令，不像函数入栈那样有个先后顺序。我为什么这样觉得呢？因为从output开始从0被编号，第一个变量被定为0，就想enum那样。然后在Instruction List中就可以%0，这样引用了。
在output部分，还有一点需要注意，就是“+register”(a)的情况，那么这样子的话，在Instruction List操作之前，先会有一个赋值的操作，就像Input部分那样 register=a.
另外，在gcc汇编c文件的时候，Instruction List 部分会被
APP
….
NO APP
标识.我觉得，这个也很好，并且可以帮助我们看到__asm__ ()里面的执行顺序。虽然我老是说，他们是没有执行顺序的，但是这是两码事。其中的细节，需要细细探究。

还有一些东西，不想再整理了，一起放到google docs了。

http://docs.google.com/Doc?docid=0ASKC30p2j_DDZGY2c25jbm1fODI1aHI0N3ZyZGc&hl=zh_CN

设备控制器，设备驱动程序,文件系统

tek-life — Tue, 01 Jun 2010 03:39:43 +0000

首先当用户进程发出输入输出时，系统把请求处理的权限放在文件系统，文件系统通过驱动程序提供的接口将任务下放到驱动程序，驱动程序根据需要对设备控制器进行操作，设备控制器再去控制设备本身。

设备控制器对设备本身的控制是电器工程师所关心的事情.

设备驱动程序是一组相关函数的集合。它包含设备服务子程序和中断处理程序。设备服务子程序包含了所有与设备相关的代码，每个设备服务子程序只处理一种设备或者紧密相关的设备。其功能就是从与设备无关的软件中接受抽象的命令并执行之。当执行一条请求时，具体操作是根据控制器对驱动程序提供的接口（指的是控制器中的各种寄存器），并利用中断机制去调用中断服务子程序配合设备来完成这个请求。

设备驱动程序利用结构 file_operations 与文件系统联系起来，即设备的各种操作的入口函数存在file_operation中。对于特定的设备来说有一些操作是不必要的,其入口置为NULL。

About my Grub.cfg

tek-life — Tue, 01 Jun 2010 02:32:06 +0000

装了双系统。直接默认进入Linux。没有显示Grub启动菜单。
检查了以下/boot/grub目录下，是有grub.cfg的.
在grub.cfg文件中，添加了
menuentry “win7″ {
set root=(hd0,1)
chainloader +1
}

并且，改了set default=”5″

可是仍然进入的是LINUX。

重启后，一直按ESC，看到GRUB的启动界面。

按C，手工输入

set root=(hd0,1)

chainloader +1

boot

能够进入WIN 7.

重新启动进入linux。

输入 grub-mkconfig.

看到grub.cfg自动加载了win7 .

终于OK了。

原来有一个grub-update。现在变成了grub-mkconfig.

shell-find备忘

tek-life — Mon, 31 May 2010 09:41:12 +0000

find:

在find中用正则表达式：

find –name “[A-Z]*” ;寻找大写字母开头的文件

过滤掉特殊路径

find / –path “/proc” –prune -o –name “abc” –print ;/proc下面的不读
find / $–path /proc –o -path /dev $ -prune –o –name “abc” – print; /proc和/dev下面的目录都无视

在这里 –o 是or的意思，-a是and的意思。

另外，还用到的有 –perm –mtime –type –user -newer在各个参数前面加个！就是去反的意思。

find . ！-type d -print ;输出当前目录下非目录类型文件

从外到内，看中断处理

tek-life — Sun, 30 May 2010 14:33:14 +0000

仍旧以s3c2410来看。中断来了以后,找到一个表项，假如找到了vector_irq。
/home/sda3/linux-2.6.21.1/arch/arm/kernel/entry-armv.S

    .globl  __vectors_start
__vectors_start:
    swi SYS_ERROR0
    b   vector_und + stubs_offset
    ldr pc, .LCvswi + stubs_offset
    b   vector_pabt + stubs_offset
    b   vector_dabt + stubs_offset
    b   vector_addrexcptn + stubs_offset
    b   vector_irq + stubs_offset
    b   vector_fiq + stubs_offset

    .globl  __vectors_end
__vectors_end:

即，执行了b vector_irq + sbus_offset
vector_irq是什么东东呢？
我们在该文件中，可以看到一个宏：

    .macro  vector_stub, name, mode, correction=0
    .align  5

vector_\name:
    .if \correction
    sub lr, lr, #\correction
    .endif

    @
    @ Save r0, lr_ (parent PC) and spsr_
    @ (parent CPSR)
    @
    stmia   sp, {r0, lr}        @ save r0, lr
    mrs lr, spsr
    str lr, [sp, #8]        @ save spsr

    @
    @ Prepare for SVC32 mode.  IRQs remain disabled.
    @
    mrs r0, cpsr
    eor r0, r0, #(\mode ^ SVC_MODE)
    msr spsr_cxsf, r0

    @
    @ the branch table must immediately follow this code
    @
    and lr, lr, #0x0f
    mov r0, sp
    ldr lr, [pc, lr, lsl #2]
    movs    pc, lr          @ branch to handler in SVC mode
    .endm

即，程序会跳转到这里玩一会儿，然后去哪里呢？我们看到movs pc,lr 也就是通过改变pc的值来进行跳转，那么依据是什么捏？该句上面为ldr lr,[pc,lr,lsl #2]也即是根据lr的值然后逻辑左移2位。lr是什么，lr在上面的语句 and lr,lr,#0x0f与了一下，其实是取其mode.假如，我们得到的值是0，则：

    .globl  __stubs_start
__stubs_start:
/*
 * Interrupt dispatcher
 */
    vector_stub irq, IRQ_MODE, 4

    .long   __irq_usr           @  0  (USR_26 / USR_32)
    .long   __irq_invalid           @  1  (FIQ_26 / FIQ_32)
    .long   __irq_invalid           @  2  (IRQ_26 / IRQ_32)
    .long   __irq_svc           @  3  (SVC_26 / SVC_32)
    .long   __irq_invalid           @  4
    .long   __irq_invalid           @  5
    .long   __irq_invalid           @  6
    .long   __irq_invalid           @  7
    .long   __irq_invalid           @  8
    .long   __irq_invalid           @  9
    .long   __irq_invalid           @  a
    .long   __irq_invalid           @  b
    .long   __irq_invalid           @  c
    .long   __irq_invalid           @  d
    .long   __irq_invalid           @  e
    .long   __irq_invalid           @  f

我们会到__irq_usr里面去处理。__irq_usr在哪里捏，我们就用cscope的神功去ctrl + ]去寻找。
/home/sda3/linux-2.6.21.1/arch/arm/kernel/entry-armv.S

__irq_usr:
    usr_entry

#ifdef CONFIG_TRACE_IRQFLAGS
    bl  trace_hardirqs_off
#endif
    get_thread_info tsk
#ifdef CONFIG_PREEMPT
    ldr r8, [tsk, #TI_PREEMPT]      @ get preempt count
    add r7, r8, #1          @ increment it
    str r7, [tsk, #TI_PREEMPT]
#endif

    irq_handler
#ifdef CONFIG_PREEMPT
    ldr r0, [tsk, #TI_PREEMPT]
    str r8, [tsk, #TI_PREEMPT]
    teq r0, r7
    strne   r0, [r0, -r0]
#endif
#ifdef CONFIG_TRACE_IRQFLAGS
    bl  trace_hardirqs_on
#endif

    mov why, #0
    b   ret_to_user

    .ltorg

在__irq_usr里面进行一番云雨之后，跳转到了__irq_handler.我们继续追踪：
在同一文件中：

    .macro  irq_handler
    get_irqnr_preamble r5, lr
1:  get_irqnr_and_base r0, r6, r5, lr
    movne   r1, sp
    @
    @ routine called with r0 = irq number, r1 = struct pt_regs *
    @
    adrne   lr, 1b
    bne asm_do_IRQ

#ifdef CONFIG_SMP
    /*
     * XXX
     *
     * this macro assumes that irqstat (r6) and base (r5) are
     * preserved from get_irqnr_and_base above
     */
    test_for_ipi r0, r6, r5, lr
    movne   r0, sp
    adrne   lr, 1b
    bne do_IPI

#ifdef CONFIG_LOCAL_TIMERS
    test_for_ltirq r0, r6, r5, lr
    movne   r0, sp
    adrne   lr, 1b
    bne do_local_timer
#endif
#endif

    .endm

看到了木有，调用了asm_do_irq.到这里，基本上，我们就可以出一口气了，毕竟arm_do_irq的语义已经很明显了嘛。可是，且慢。让我们看看arm_do_irq到底干了什么事情：
/home/sda3/linux-2.6.21.1/arch/arm/kernel/irq.c

asmlinkage void asm_do_IRQ(unsigned int irq, struct pt_regs *regs)
{
    struct pt_regs *old_regs = set_irq_regs(regs);
    struct irq_desc *desc = irq_desc + irq;                                                                   

    /*
     * Some hardware gives randomly wrong interrupts.  Rather
     * than crashing, do something sensible.
     */
    if (irq >= NR_IRQS)
        desc = &bad_irq_desc;                                                                                    

    irq_enter();                                                                                                

    desc_handle_irq(irq, desc);                                                                                 

    /* AT91 specific workaround */
    irq_finish(irq);                                                                                              

    irq_exit();
    set_irq_regs(old_regs);
}

在上面的这个函数中，我们要注意两个东西:其一,desc_handle_irq(irq,desc).其二，set_irq_regs(old_regs).即处理完成后，要将regs复原。
让我们看看desc_handle_irq吧。

static inline void desc_handle_irq(unsigned int irq, struct irq_desc *desc)
{
    desc->handle_irq(irq, desc);
}

这里，我们就不能随便追踪啦。因为要和desc有关系啦，也就是中断描述符有关系。我们先看一下struct irq_desc的结构吧：

struct irq_desc {
    irq_flow_handler_t  handle_irq;
    struct irq_chip     *chip;
    struct msi_desc     *msi_desc;
    void            *handler_data;
    void            *chip_data;
    struct irqaction    *action;    /* IRQ action list */
    unsigned int        status;     /* IRQ status */                                                     

    unsigned int        depth;      /* nested irq disables */
    unsigned int        wake_depth; /* nested wake enables */
    unsigned int        irq_count;  /* For detecting broken IRQs */
    unsigned int        irqs_unhandled;
    spinlock_t      lock;
#ifdef CONFIG_SMP
    cpumask_t       affinity;
    unsigned int        cpu;
#endif
#if defined(CONFIG_GENERIC_PENDING_IRQ) || defined(CONFIG_IRQBALANCE)
    cpumask_t       pending_mask;
#endif
#ifdef CONFIG_PROC_FS
    struct proc_dir_entry   *dir;
#endif
    const char      *name;
} ____cacheline_aligned;

从结构体来看，handler是irq的处理函数。还记得初始化irq的时候么？init_IRQ->init_arch_irq 而init_arch_irq因平台不同而不同。在setup_arch()中，
/home/sda3/linux-2.6.21.1/arch/arm/kernel/setup.c

    /*
     * Set up various architecture-specific pointers
     */
    init_arch_irq = mdesc->init_irq;
    system_timer = mdesc->timer;
    init_machine = mdesc->init_machine;

s3c2410平台下，我们姑且看一种init_arch_irq吧：

MACHINE_START(SMDK2410, "SMDK2410") /* @TODO: request a new identifier and switch
                    * to SMDK2410 */
    /* Maintainer: Jonas Dietsche */
    .phys_io    = S3C2410_PA_UART,
    .io_pg_offst    = (((u32)S3C24XX_VA_UART) >> 18) & 0xfffc,
    .boot_params    = S3C2410_SDRAM_PA + 0x100,
    .map_io     = smdk2410_map_io,
    .init_irq   = s3c24xx_init_irq,
    .init_machine   = smdk_machine_init,
    .timer      = &s3c24xx_timer,
MACHINE_END

也就是其init_irq为s3c24xx_init_irq。我们就去找一下：cs f s s3c24xx_init_irq

void __init s3c24xx_init_irq(void)
{
    unsigned long pend;
    unsigned long last;
    int irqno;
    int i;

    irqdbf("s3c2410_init_irq: clearing interrupt status flags\n");

    /* first, clear all interrupts pending... */

    last = 0;
    for (i = 0; i < 4; i++) {
        pend = __raw_readl(S3C24XX_EINTPEND);

        if (pend == 0 || pend == last)
            break;

        __raw_writel(pend, S3C24XX_EINTPEND);
        printk("irq: clearing pending ext status %08x\n", (int)pend);
        last = pend;
    }

    last = 0;
    for (i = 0; i < 4; i++) {
        pend = __raw_readl(S3C2410_INTPND);

        if (pend == 0 || pend == last)
            break;

        __raw_writel(pend, S3C2410_SRCPND);
        __raw_writel(pend, S3C2410_INTPND);
        printk("irq: clearing pending status %08x\n", (int)pend);
        last = pend;
    }

    last = 0;
    for (i = 0; i < 4; i++) {
        pend = __raw_readl(S3C2410_SUBSRCPND);

        if (pend == 0 || pend == last)
            break;
}
    last = 0;
    for (i = 0; i < 4; i++) {
        pend = __raw_readl(S3C2410_SUBSRCPND);

        if (pend == 0 || pend == last)
            break;

        printk("irq: clearing subpending status %08x\n", (int)pend);
        __raw_writel(pend, S3C2410_SUBSRCPND);
        last = pend;
    }

    /* register the main interrupts */

    irqdbf("s3c2410_init_irq: registering s3c2410 interrupt handlers\n");

    for (irqno = IRQ_EINT4t7; irqno <= IRQ_ADCPARENT; irqno++) {
        /* set all the s3c2410 internal irqs */

        switch (irqno) {
            /* deal with the special IRQs (cascaded) */

        case IRQ_EINT4t7:
        case IRQ_EINT8t23:
        case IRQ_UART0:
        case IRQ_UART1:
        case IRQ_UART2:
        case IRQ_ADCPARENT:
            set_irq_chip(irqno, &s3c_irq_level_chip);
            set_irq_handler(irqno, handle_level_irq);
            break;

        case IRQ_RESERVED6:
        case IRQ_RESERVED24:
            /* no IRQ here */
            break;

        default:
            //irqdbf("registering irq %d (s3c irq)\n", irqno);
            set_irq_chip(irqno, &s3c_irq_chip);
            set_irq_handler(irqno, handle_edge_irq);
            set_irq_flags(irqno, IRQF_VALID);
        }
    }

    /* setup the cascade irq handlers */

    set_irq_chained_handler(IRQ_EINT4t7, s3c_irq_demux_extint4t7);
    set_irq_chained_handler(IRQ_EINT8t23, s3c_irq_demux_extint8);

    set_irq_chained_handler(IRQ_UART0, s3c_irq_demux_uart0);
    set_irq_chained_handler(IRQ_UART1, s3c_irq_demux_uart1);
    set_irq_chained_handler(IRQ_UART2, s3c_irq_demux_uart2);
    set_irq_chained_handler(IRQ_ADCPARENT, s3c_irq_demux_adc);

    /* external interrupts */

    for (irqno = IRQ_EINT0; irqno <= IRQ_EINT3; irqno++) {
        irqdbf("registering irq %d (ext int)\n", irqno);
        set_irq_chip(irqno, &s3c_irq_eint0t4);
        set_irq_handler(irqno, handle_edge_irq);
        set_irq_flags(irqno, IRQF_VALID);
    }

    for (irqno = IRQ_EINT4; irqno <= IRQ_EINT23; irqno++) {
        irqdbf("registering irq %d (extended s3c irq)\n", irqno);
        set_irq_chip(irqno, &s3c_irqext_chip);
        set_irq_handler(irqno, handle_edge_irq);
        set_irq_flags(irqno, IRQF_VALID);
    }

    /* register the uart interrupts */

    irqdbf("s3c2410: registering external interrupts\n");

    irqdbf("s3c2410: registering external interrupts\n");

    for (irqno = IRQ_S3CUART_RX0; irqno <= IRQ_S3CUART_ERR0; irqno++) {
        irqdbf("registering irq %d (s3c uart0 irq)\n", irqno);
        set_irq_chip(irqno, &s3c_irq_uart0);
        set_irq_handler(irqno, handle_level_irq);
        set_irq_flags(irqno, IRQF_VALID);
    }

    for (irqno = IRQ_S3CUART_RX1; irqno <= IRQ_S3CUART_ERR1; irqno++) {
        irqdbf("registering irq %d (s3c uart1 irq)\n", irqno);
        set_irq_chip(irqno, &s3c_irq_uart1);
        set_irq_handler(irqno, handle_level_irq);
        set_irq_flags(irqno, IRQF_VALID);
    }

    for (irqno = IRQ_S3CUART_RX2; irqno <= IRQ_S3CUART_ERR2; irqno++) {
        irqdbf("registering irq %d (s3c uart2 irq)\n", irqno);
        set_irq_chip(irqno, &s3c_irq_uart2);
        set_irq_handler(irqno, handle_level_irq);
        set_irq_flags(irqno, IRQF_VALID);
    }

    for (irqno = IRQ_TC; irqno <= IRQ_ADC; irqno++) {
        irqdbf("registering irq %d (s3c adc irq)\n", irqno);
        set_irq_chip(irqno, &s3c_irq_adc);
        set_irq_handler(irqno, handle_edge_irq);
        set_irq_flags(irqno, IRQF_VALID);
    }

    irqdbf("s3c2410: registered interrupt handlers\n");
}

在这里我们的默认irq_handler为handler_edge_irq\handle_level_irq.我们姑且看一下handler_edge_irq吧：

void fastcall
handle_level_irq(unsigned int irq, struct irq_desc *desc)
{
    unsigned int cpu = smp_processor_id();
    struct irqaction *action;
    irqreturn_t action_ret;

    spin_lock(&desc->lock);
    mask_ack_irq(desc, irq);

    if (unlikely(desc->status & IRQ_INPROGRESS))
        goto out_unlock;
    desc->status &= ~(IRQ_REPLAY | IRQ_WAITING);
    kstat_cpu(cpu).irqs[irq]++;

    /*
     * If its disabled or no action available
     * keep it masked and get out of here
     */
    action = desc->action;
    if (unlikely(!action || (desc->status & IRQ_DISABLED))) {
        desc->status |= IRQ_PENDING;
        goto out_unlock;
    }

    desc->status |= IRQ_INPROGRESS;
    desc->status &= ~IRQ_PENDING;
    spin_unlock(&desc->lock);

    action_ret = handle_IRQ_event(irq, action);
    if (!noirqdebug)
        note_interrupt(irq, desc, action_ret);

    spin_lock(&desc->lock);
    desc->status &= ~IRQ_INPROGRESS;
    if (!(desc->status & IRQ_DISABLED) && desc->chip->unmask)
        desc->chip->unmask(irq);
out_unlock:
    spin_unlock(&desc->lock);
}

我们看到，会调用handle_IRQ_event(irq, action);继续追踪之

irqreturn_t handle_IRQ_event(unsigned int irq, struct irqaction *action)
{
    irqreturn_t ret, retval = IRQ_NONE;
    unsigned int status = 0;

    handle_dynamic_tick(action);

    if (!(action->flags & IRQF_DISABLED))
        local_irq_enable_in_hardirq();

    do {
        ret = action->handler(irq, action->dev_id);
        if (ret == IRQ_HANDLED)
            status |= action->flags;
        retval |= ret;
        action = action->next;
    } while (action);

    if (status & IRQF_SAMPLE_RANDOM)
        add_interrupt_randomness(irq);
    local_irq_disable();

    return retval;
}

我们看到 handle_IRQ_event会有一个do{}while()循环，依次处理该irq线上的action。好，就是这样啦。

从下到上分析中断处理

tek-life — Sun, 30 May 2010 03:34:51 +0000

S3C2410中断的定义的中断向量是从16～47.然后外部中断从48~69.70~80.一共有66(80-16)个中断其中70～78 UART是用来与PC进行通信的。

 25 #define S3C2410_CPUIRQ_OFFSET    (16)
 26
 27 #define S3C2410_IRQ(x) ((x) + S3C2410_CPUIRQ_OFFSET)
 28
 29 /* main cpu interrupts */
 30 #define IRQ_EINT0      S3C2410_IRQ(0)       /* 16 */
 31 #define IRQ_EINT1      S3C2410_IRQ(1)
 32 #define IRQ_EINT2      S3C2410_IRQ(2)
 33 #define IRQ_EINT3      S3C2410_IRQ(3)
 34 #define IRQ_EINT4t7    S3C2410_IRQ(4)       /* 20 */
 35 #define IRQ_EINT8t23   S3C2410_IRQ(5)
 36 #define IRQ_RESERVED6  S3C2410_IRQ(6)       /* for s3c2410 */
 37 #define IRQ_CAM        S3C2410_IRQ(6)       /* for s3c2440,s3c2443 */
 38 #define IRQ_BATT_FLT   S3C2410_IRQ(7)
 39 #define IRQ_TICK       S3C2410_IRQ(8)       /* 24 */
 40 #define IRQ_WDT        S3C2410_IRQ(9)       /* WDT/AC97 for s3c2443 */
 41 #define IRQ_TIMER0     S3C2410_IRQ(10)
 42 #define IRQ_TIMER1     S3C2410_IRQ(11)
 43 #define IRQ_TIMER2     S3C2410_IRQ(12)
 44 #define IRQ_TIMER3     S3C2410_IRQ(13)
 45 #define IRQ_TIMER4     S3C2410_IRQ(14)
 46 #define IRQ_UART2      S3C2410_IRQ(15)
 47 #define IRQ_LCD        S3C2410_IRQ(16)      /* 32 */
 48 #define IRQ_DMA0       S3C2410_IRQ(17)      /* IRQ_DMA for s3c2443 */
 49 #define IRQ_DMA1       S3C2410_IRQ(18)
 50 #define IRQ_DMA2       S3C2410_IRQ(19)
 51 #define IRQ_DMA3       S3C2410_IRQ(20)
 52 #define IRQ_SDI        S3C2410_IRQ(21)
 53 #define IRQ_SPI0       S3C2410_IRQ(22)
 54 #define IRQ_UART1      S3C2410_IRQ(23)
 55 #define IRQ_RESERVED24 S3C2410_IRQ(24)      /* 40 */
 56 #define IRQ_NFCON      S3C2410_IRQ(24)      /* for s3c2440 */
 57 #define IRQ_USBD       S3C2410_IRQ(25)
 58 #define IRQ_USBH       S3C2410_IRQ(26)
 59 #define IRQ_IIC        S3C2410_IRQ(27)
 60 #define IRQ_UART0      S3C2410_IRQ(28)      /* 44 */
 61 #define IRQ_SPI1       S3C2410_IRQ(29)
 62 #define IRQ_RTC        S3C2410_IRQ(30)
 63 #define IRQ_ADCPARENT  S3C2410_IRQ(31)

 65 /* interrupts generated from the external interrupts sources */
 66 #define IRQ_EINT4      S3C2410_IRQ(32)     /* 48 */
 67 #define IRQ_EINT5      S3C2410_IRQ(33)
 68 #define IRQ_EINT6      S3C2410_IRQ(34)
 69 #define IRQ_EINT7      S3C2410_IRQ(35)
 70 #define IRQ_EINT8      S3C2410_IRQ(36)
 71 #define IRQ_EINT9      S3C2410_IRQ(37)
 72 #define IRQ_EINT10     S3C2410_IRQ(38)
 73 #define IRQ_EINT11     S3C2410_IRQ(39)
 74 #define IRQ_EINT12     S3C2410_IRQ(40)
 75 #define IRQ_EINT13     S3C2410_IRQ(41)
 76 #define IRQ_EINT14     S3C2410_IRQ(42)
 77 #define IRQ_EINT15     S3C2410_IRQ(43)
 78 #define IRQ_EINT16     S3C2410_IRQ(44)
 79 #define IRQ_EINT17     S3C2410_IRQ(45)
 80 #define IRQ_EINT18     S3C2410_IRQ(46)
 81 #define IRQ_EINT19     S3C2410_IRQ(47)
 82 #define IRQ_EINT20     S3C2410_IRQ(48)     /* 64 */
 83 #define IRQ_EINT21     S3C2410_IRQ(49)
 84 #define IRQ_EINT22     S3C2410_IRQ(50)
 85 #define IRQ_EINT23     S3C2410_IRQ(51)
 86
 87
 88 #define IRQ_EINT(x)    S3C2410_IRQ((x >= 4) ? (IRQ_EINT4 + (x) - 4) : (S3C2410_IRQ(0) + (x)))
 89
 90 #define IRQ_LCD_FIFO   S3C2410_IRQ(52)
 91 #define IRQ_LCD_FRAME  S3C2410_IRQ(53)
 98 #define S3C2410_IRQSUB(x)   S3C2410_IRQ((x)+54)
 99
100 #define IRQ_S3CUART_RX0     S3C2410_IRQSUB(0)   /* 70 */
101 #define IRQ_S3CUART_TX0     S3C2410_IRQSUB(1)
102 #define IRQ_S3CUART_ERR0    S3C2410_IRQSUB(2)
103
104 #define IRQ_S3CUART_RX1     S3C2410_IRQSUB(3)   /* 73 */
105 #define IRQ_S3CUART_TX1     S3C2410_IRQSUB(4)
106 #define IRQ_S3CUART_ERR1    S3C2410_IRQSUB(5)
107
108 #define IRQ_S3CUART_RX2     S3C2410_IRQSUB(6)   /* 76 */
109 #define IRQ_S3CUART_TX2     S3C2410_IRQSUB(7)
110 #define IRQ_S3CUART_ERR2    S3C2410_IRQSUB(8)
111
112 #define IRQ_TC          S3C2410_IRQSUB(9)
113 #define IRQ_ADC         S3C2410_IRQSUB(10)
114
115 /* extra irqs for s3c2440 */
...

那么前16就是trap了。
这些中断向量的初始化是由

661 void __init s3c24xx_init_irq(void)
662 {
663     unsigned long pend;
664     unsigned long last;
665     int irqno;
666     int i;
667
668     irqdbf("s3c2410_init_irq: clearing interrupt status flags\n");
669
670     /* first, clear all interrupts pending... */
671
672     last = 0;
673     for (i = 0; i < 4; i++) {
674         pend = __raw_readl(S3C24XX_EINTPEND);
675
676         if (pend == 0 || pend == last)
677             break;
678
679         __raw_writel(pend, S3C24XX_EINTPEND);
680         printk("irq: clearing pending ext status %08x\n", (int)pend);
681         last = pend;
682     }
683
684     last = 0;
685     for (i = 0; i < 4; i++) {
686         pend = __raw_readl(S3C2410_INTPND);
687
688         if (pend == 0 || pend == last)
689             break;
690
691         __raw_writel(pend, S3C2410_SRCPND);
692         __raw_writel(pend, S3C2410_INTPND);
693         printk("irq: clearing pending status %08x\n", (int)pend);
694         last = pend;
695     }
696
697     last = 0;
698     for (i = 0; i < 4; i++) {
699         pend = __raw_readl(S3C2410_SUBSRCPND);
700
701         if (pend == 0 || pend == last)
702             break;
703
704         printk("irq: clearing subpending status %08x\n", (int)pend);
705         __raw_writel(pend, S3C2410_SUBSRCPND);
706         last = pend;
707     }
708
709     /* register the main interrupts */
710
711     irqdbf("s3c2410_init_irq: registering s3c2410 interrupt handlers\n");
712
713     for (irqno = IRQ_EINT4t7; irqno <= IRQ_ADCPARENT; irqno++) {
714         /* set all the s3c2410 internal irqs */
715
716         switch (irqno) {
717             /* deal with the special IRQs (cascaded) */
718
719         case IRQ_EINT4t7:
720         case IRQ_EINT8t23:
721         case IRQ_UART0:
722         case IRQ_UART1:
723         case IRQ_UART2:
724         case IRQ_ADCPARENT:
725             set_irq_chip(irqno, &s3c_irq_level_chip);
726             set_irq_handler(irqno, handle_level_irq);
727             break;
728
729         case IRQ_RESERVED6:
730         case IRQ_RESERVED24:
731             /* no IRQ here */
732             break;
733
734         default:
735             //irqdbf("registering irq %d (s3c irq)\n", irqno);
736             set_irq_chip(irqno, &s3c_irq_chip);
737             set_irq_handler(irqno, handle_edge_irq);
738             set_irq_flags(irqno, IRQF_VALID);
739         }
740     }
741
742     /* setup the cascade irq handlers */
743
744     set_irq_chained_handler(IRQ_EINT4t7, s3c_irq_demux_extint4t7);
745     set_irq_chained_handler(IRQ_EINT8t23, s3c_irq_demux_extint8);
746
747     set_irq_chained_handler(IRQ_UART0, s3c_irq_demux_uart0);
748     set_irq_chained_handler(IRQ_UART1, s3c_irq_demux_uart1);
749     set_irq_chained_handler(IRQ_UART2, s3c_irq_demux_uart2);
750     set_irq_chained_handler(IRQ_ADCPARENT, s3c_irq_demux_adc);
751
752     /* external interrupts */
753
754     for (irqno = IRQ_EINT0; irqno <= IRQ_EINT3; irqno++) {
755         irqdbf("registering irq %d (ext int)\n", irqno);
756         set_irq_chip(irqno, &s3c_irq_eint0t4);
757         set_irq_handler(irqno, handle_edge_irq);
758         set_irq_flags(irqno, IRQF_VALID);
759     }
760
761     for (irqno = IRQ_EINT4; irqno <= IRQ_EINT23; irqno++) {
762         irqdbf("registering irq %d (extended s3c irq)\n", irqno);
763         set_irq_chip(irqno, &s3c_irqext_chip);
764         set_irq_handler(irqno, handle_edge_irq);
765         set_irq_flags(irqno, IRQF_VALID);
766     }
767
768     /* register the uart interrupts */
769
770     irqdbf("s3c2410: registering external interrupts\n");
771
772     for (irqno = IRQ_S3CUART_RX0; irqno <= IRQ_S3CUART_ERR0; irqno++) {
773         irqdbf("registering irq %d (s3c uart0 irq)\n", irqno);
774         set_irq_chip(irqno, &s3c_irq_uart0);
775         set_irq_handler(irqno, handle_level_irq);
776         set_irq_flags(irqno, IRQF_VALID);
777     }
778
779     for (irqno = IRQ_S3CUART_RX1; irqno <= IRQ_S3CUART_ERR1; irqno++) {
780         irqdbf("registering irq %d (s3c uart1 irq)\n", irqno);
781         set_irq_chip(irqno, &s3c_irq_uart1);
782         set_irq_handler(irqno, handle_level_irq);
783         set_irq_flags(irqno, IRQF_VALID);
784     }
785
786     for (irqno = IRQ_S3CUART_RX2; irqno <= IRQ_S3CUART_ERR2; irqno++) {
787         irqdbf("registering irq %d (s3c uart2 irq)\n", irqno);
788         set_irq_chip(irqno, &s3c_irq_uart2);
789         set_irq_handler(irqno, handle_level_irq);
790         set_irq_flags(irqno, IRQF_VALID);
791     }
792
793     for (irqno = IRQ_TC; irqno <= IRQ_ADC; irqno++) {
794         irqdbf("registering irq %d (s3c adc irq)\n", irqno);
795         set_irq_chip(irqno, &s3c_irq_adc);
796         set_irq_handler(irqno, handle_edge_irq);
797         set_irq_flags(irqno, IRQF_VALID);
798     }
799
800     irqdbf("s3c2410: registered interrupt handlers\n");
801 }

上面便是对中断向量进行赋值了。其中set_irq_chip是设置irq上的中断控制器。set_irq_handle便是设置该中断线上的处理函数了，比如ack mark之类的。set_irq_flags是设置该中断线的标志位，有哪些呢？

 49 #define IRQ_INPROGRESS      0x00000100  /* IRQ handler active - do not enter! */
 50 #define IRQ_DISABLED        0x00000200  /* IRQ disabled - do not enter! */
 51 #define IRQ_PENDING     0x00000400  /* IRQ pending - replay on enable */
 52 #define IRQ_REPLAY      0x00000800  /* IRQ has been replayed but not acked yet */
 53 #define IRQ_AUTODETECT      0x00001000  /* IRQ is being autodetected */
 54 #define IRQ_WAITING     0x00002000  /* IRQ not yet seen - for autodetection */
 55 #define IRQ_LEVEL       0x00004000  /* IRQ level triggered */
 56 #define IRQ_MASKED      0x00008000  /* IRQ masked - shouldn't be seen again */
 57 #define IRQ_PER_CPU     0x00010000  /* IRQ is per CPU */
 58 #define IRQ_NOPROBE     0x00020000  /* IRQ is not valid for probing */
 59 #define IRQ_NOREQUEST       0x00040000  /* IRQ cannot be requested */
 60 #define IRQ_NOAUTOEN        0x00080000  /* IRQ will not be enabled on request irq */
 61 #define IRQ_WAKEUP      0x00100000  /* IRQ triggers system wakeup */
 62 #define IRQ_MOVE_PENDING    0x00200000  /* need to re-target IRQ destination */
 63 #define IRQ_NO_BALANCING    0x00400000  /* IRQ is excluded from balancing */

另外set_irq_handler我们来看一下：

534 void
535 __set_irq_handler(unsigned int irq, irq_flow_handler_t handle, int is_chained,
536           const char *name)
537 {
538     struct irq_desc *desc;
539     unsigned long flags;
540
541     if (irq >= NR_IRQS) {
542         printk(KERN_ERR
543                "Trying to install type control for IRQ%d\n", irq);
544         return;
545     }
546
547     desc = irq_desc + irq;
548
549     if (!handle)              //如果形参handle没有被赋值，那么先将之赋值为handle_bad_irq.在后面567行我们会看到，实际上是会执行卸载操作
550         handle = handle_bad_irq;
551     else if (desc->chip == &no_irq_chip) {
552         printk(KERN_WARNING "Trying to install %sinterrupt handler "
553                "for IRQ%d\n", is_chained ? "chained " : "", irq);
554         /*
555          * Some ARM implementations install a handler for really dumb
556          * interrupt hardware without setting an irq_chip. This worked
557          * with the ARM no_irq_chip but the check in setup_irq would
558          * prevent us to setup the interrupt at all. Switch it to
559          * dummy_irq_chip for easy transition.
560          */
561         desc->chip = &dummy_irq_chip;
562     }
563
564     spin_lock_irqsave(&desc->lock, flags);
565
566     /* Uninstall? */
567     if (handle == handle_bad_irq) {
568         if (desc->chip != &no_irq_chip)
569             mask_ack_irq(desc, irq);
570         desc->status |= IRQ_DISABLED;
571         desc->depth = 1;
572     }
573     desc->handle_irq = handle;
574     desc->name = name;

另外，现在已经设置好中断向量了，那么这些中断向量在哪里放着呢？因为如果要响应中断的话，必须找到入口啊。
看一下trap_init函数：

678 void __init trap_init(void)
679 {
680     unsigned long vectors = CONFIG_VECTORS_BASE;
681     extern char __stubs_start[], __stubs_end[];
682     extern char __vectors_start[], __vectors_end[];
683     extern char __kuser_helper_start[], __kuser_helper_end[];
684     int kuser_sz = __kuser_helper_end - __kuser_helper_start;
685
686     /*
687      * Copy the vectors, stubs and kuser helpers (in entry-armv.S)
688      * into the vector page, mapped at 0xffff0000, and ensure these
689      * are visible to the instruction stream.
690      */
691     memcpy((void *)vectors, __vectors_start, __vectors_end - __vectors_start);
692     memcpy((void *)vectors + 0x200, __stubs_start, __stubs_end - __stubs_start);
693     memcpy((void *)vectors + 0x1000 - kuser_sz, __kuser_helper_start, kuser_sz);
694
695     /*
696      * Copy signal return handlers into the vector page, and
697      * set sigreturn to be a pointer to these.
698      */
699     memcpy((void *)KERN_SIGRETURN_CODE, sigreturn_codes,
700            sizeof(sigreturn_codes));
701
702     flush_icache_range(vectors, vectors + PAGE_SIZE);
703     modify_domain(DOMAIN_USER, DOMAIN_CLIENT);
704 }

看到了吧，将__vectors_start~__vectors_end还有stub都移到了vector的位置，而vector的位置既是 CONFIG_VECTORS_BASE，

147 #define CONFIG_VECTORS_BASE 0xffff0000

那么__vector_start在哪里捏？
~/linux-2.6.21.1/arch/arm/kernel/entry-armv.S

1062 __vectors_start:
1063     swi SYS_ERROR0
1064     b   vector_und + stubs_offset
1065     ldr pc, .LCvswi + stubs_offset
1066     b   vector_pabt + stubs_offset
1067     b   vector_dabt + stubs_offset
1068     b   vector_addrexcptn + stubs_offset
1069     b   vector_irq + stubs_offset
1070     b   vector_fiq + stubs_offset
1071
1072     .globl  __vectors_end
1073 __vectors_end:

在该文件，我们也可以找到__stub_start的变量地址。

S3C2410中断处理器模块寄存器详解

tek-life — Sun, 30 May 2010 03:03:59 +0000

S3C2410的中断异常处理模块有以下寄存器构成：

SRCPND，
INTMODE，
INTMSK，
PRIORITY，
INTPND，
INTOFFSET，
SUBSRCPND，
INTSUBMSK。

下面具体介绍各个寄存器的功能：

SRCPND（Source Pending Register）寄存器有效位32位，可读写，每一位涉及到一个中断源，SRCPND是主中断源引脚寄存器，某个位被置1表示相应的中断被触发，但我们知道在同一时刻内系统可以触发若干个中断，只要中断被触发了，SRCPND的相应位便被置1，也就是说SRCPND 在同一时刻可以有若干位同时被置1，另外，此寄存器不受中断控制器的优先权逻辑的影响。如果此中断没有被INTMSK寄存器屏蔽或者是快中断(FIQ) 的话，它将被进一步处理。通过写数据到这个寄存器能清除SPCPND相应的位。

INTMODE（Interrupt Mode Register）寄存器有效位为32位，可读写，每一位与SRCPND中各位相对应，它的作用是指定该位相应的中断源处理模式（IRQ还是FIQ）。若某位为0，则该位相对应的中断按IRQ模式处理，为1则以FIQ模式进行处理，该寄存器初始化值为0×00000000,即所有中断皆以IRQ模式进行处理。此中断控制器中只有一个中断源能用FIQ mode（在紧急中断下使用FIQ mode），因此INTMODE仅有一位能置1。

INTMSK（Interrupt Mask Register）寄存器有效位为32位，可读写，INTMSK为主中断屏蔽寄存器与SRCPND寄存器对应，它的作用是决定该位相应的中断请求是否被处理。若某位被设置为1，则该位相对应的中断产生后将被忽略（CPU不处理该中断请求），设置为0则CPU对其进行处理。该寄存器初始化值为 0xFFFFFFFF，既默认情况下所有的中断都是被屏蔽的。

PRIORITY（IRQ PRIORITY Control Register）寄存器有32位，有效位[20：0]，可读写，此寄存器的作用是如果有几个中断源同时触发，按照下图的流向，假如这几个中断源都没被屏蔽，并且都是IRQ模式，因此就要判定哪个中断源的优先级最高，使其在INTPND寄存器中对应位置1，CPU转向相应的中断服务程序，让中断服务程序来处理相应的中断请求。

INTPND（Interrupt Pending Register）寄存器有效位为32位，可读写，看起来和SRCPND寄存器一样，其实他们在功能上有着重大的区别。他在某一时刻只能有1个位被置 1，INTPND 某个位被置1（该位对应的中断在所有已触发的中断里具有最高优先级且该中断没有被屏蔽），则表示CPU即将或已经在对该位相应的中断进行处理。因此 SRCPND寄存器说明有什么中断被触发了，而INTPND寄存器说明CPU即将或已经在对某一个中断进行处理。

INTOFFSET（Interrupt Offset Register）寄存器有效位为32位，只读，此寄存器的值显示IRQ mode的哪个中断请求在INTPND寄存器中，通过清SRCPND和INTPND这位能自动清除，FIQ mode中断不会影响INTOFFSET寄存器，因此此寄存器仅对IRQ mode中断有效。

SUBSRCPND（Sub Source Pending Register）寄存器有32位，有效位[10：0]，可读写，它们中的每一位分别代表一个中断源，SRCPND是主中断源引脚寄存器，它是副中断源引脚寄存器，情况类似SRCPND。

INTSUBMSK（Interrupt Sub Mask Register）寄存器有32位但有效位为11位，可读写，如果mask bit位是0，此中断请求被服务，情况类似INTMSK。

更全的资料：http://www.cnblogs.com/dubingsky/archive/2010/04/11/1709378.html

vim + cscope

tek-life — Sat, 29 May 2010 05:03:52 +0000

配置vim

利用网上现成的vim配置文件

$ mkdir ~/.vim_runtime
$ svn co svn://orangoo.com/vim ~/.vim_runtime
$ cat ~/.vim_runtime/install.sh
$ sh ~/.vim_runtime/install.sh 
   can be `mac`, `linux` or `windows`

参考：http://amix.dk/blog/post/19486#The-ultimate-vim-configuration-vimrc

配置cscope:

if has("cscope")

    set csprg=/usr/bin/cscope

    set csto=0

    set cst

    set nocsverb

    " add any database in current directory

    if filereadable("cscope.out")

    cs add cscope.out

    " else add database pointed to by environment

    elseif $CSCOPE_DB != ""

    cs add $CSCOPE_DB

endif

一些容易忽略的快捷键：

$

当前行的末尾

0

当前行的开头

“

这是两个 back quote，在键盘上是ESC下边那个键。

回到光标跳转前的位置.其实引号也可以。

k是向上走一行

j是向下走一行

h是向左走一列

l是向右走一列

ctrl + e 逐行上翻

ctrl + y 逐行下翻

ctrl + f 往下翻一屏 front

ctrl + b 往上翻一屏 back

*

查找光标所在的单词

一个简单的模块编译例子

tek-life — Fri, 28 May 2010 08:45:32 +0000

1.测试源码test.c

 test.c
#include

#include

static __init int test_init(void)
{
    printk("Test module is ready--omycle ...\n");
    return 0;
}
static __exit void test_exit(void)
{
    printk("Test module is exit--omycle ...\n");
    return ;
}
module_init(test_init);
module_exit(test_exit);
MODULE_LICENSE("Dual BSD/GPL");
MODULE_AUTHOR("omycle");
MODULE_DESCRIPTION("This is a simple module!");
MODULE_VERSION("Ver 0.0001");

2.
模块的编译，需要Makefile文件。当然，如果没有的话，命令写的比较麻烦。

Makefile
KERNELDIR ?=/usr/src/linux-headers-2.6.31-21-generic/
PWD :=$(shell pwd)
    obj-m :=test.o
default:
    $(MAKE) -C $(KERNELDIR) M=$(PWD) modules

注意Makefile的写法，行首的间隔符要用TAB键
3.编译
在测试根目录下输入：make
我的结果是：
omycle@omycle-desktop:/home/sda3/LKD/B$ make make -C /usr/src/linux-headers-2.6.31-21-generic/ M=/home/sda3/LKD/B modules make[1]: Entering directory `/usr/src/linux-headers-2.6.31-21-generic' /usr/src/linux-headers-2.6.31-21-generic/arch/x86/Makefile:80: stack protector enabled but no compiler support Building modules, stage 2. MODPOST 1 modules make[1]: Leaving directory `/usr/src/linux-headers-2.6.31-21-generic'
4.
插入模块
sudo insmod test.ko
删除模块
sudo rmmod test
5.验证：
dmseg | tail -10 [27844.553239] Test module is ready--omycle ...

rmmod test后：
[27888.625461] Test module is exit--omycle ...
6.扩展
omycle@omycle-desktop:/home/sda3/LKD/B$ modinfo test.ko filename: test.ko license: Dual BSD/GPL author: omycle description: This is a simple module! version: Ver 0.0001 vermagic: 2.6.31-21-generic SMP mod_unload modversions 586 depends: srcversion: 8E9BAD26686753AA92DC8D6
7.普通应用程序和模块编程的区别：
C语言应用程序内核模块程序
使用函数 Libc库内核函数
运行空间用户空间内核空间
运行权限普通用户超级用户
入口函数 main() module_init()
出口函数 exit() module_exit()
编译 Gcc –c Makefile
连接 Gcc insmod
运行直接运行 insmod
调试 Gdb kdbug, kdb,kgdb等

arm-linux注册中断

tek-life — Thu, 27 May 2010 08:31:03 +0000

二注册中断
这部分我们仍以3sc2410下的watchdog的中断为例来讲解中断的注册及调用过程。
drivers/char/watchdog/s3c2410_wdt.c:

static int s3c2410wdt_probe(struct platform_device *pdev)
{
        struct resource *res;
        int started = 0;
        int ret;
        int size;

        DBG("%s: probe=%p\n", __FUNCTION__, pdev);

        /* get the memory region for the watchdog timer */

        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        if (res == NULL) {
                printk(KERN_INFO PFX "failed to get memory region resouce\n");
                return -ENOENT;
        }

        size = (res->end-res->start)+1;
        wdt_mem = request_mem_region(res->start, size, pdev->name);
        if (wdt_mem == NULL) {
                printk(KERN_INFO PFX "failed to get memory region\n");
                ret = -ENOENT;
                goto err_req;
        }

        wdt_base = ioremap(res->start, size);
        if (wdt_base == 0) {
                printk(KERN_INFO PFX "failed to ioremap() region\n");
                ret = -EINVAL;
                goto err_req;
        }

        DBG("probe: mapped wdt_base=%p\n", wdt_base);

        res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
        if (res == NULL) {
                printk(KERN_INFO PFX "failed to get irq resource\n");
                ret = -ENOENT;
                goto err_map;
        }

        ret = request_irq(res->start, s3c2410wdt_irq, 0, pdev->name, pdev);
        if (ret != 0) {
                printk(KERN_INFO PFX "failed to install irq (%d)\n", ret);
                goto err_map;
        }

        wdt_clock = clk_get(&pdev->dev, "watchdog");
        if (IS_ERR(wdt_clock)) {
                printk(KERN_INFO PFX "failed to find watchdog clock source\n");
                ret = PTR_ERR(wdt_clock);
                goto err_irq;
        }

        clk_enable(wdt_clock);

        /* see if we can actually set the requested timer margin, and if
         * not, try the default value */

        if (s3c2410wdt_set_heartbeat(tmr_margin)) {
                started = s3c2410wdt_set_heartbeat(CONFIG_S3C2410_WATCHDOG_DEFAULT_TIME);

                if (started == 0) {
                        printk(KERN_INFO PFX "tmr_margin value out of range, default %d used\n",
                               CONFIG_S3C2410_WATCHDOG_DEFAULT_TIME);
                } else {
                        printk(KERN_INFO PFX "default timer value is out of range, cannot start\n");
                }
        }

        ret = misc_register(&s3c2410wdt_miscdev);
        if (ret) {
                printk (KERN_ERR PFX "cannot register miscdev on minor=%d (%d)\n",
                        WATCHDOG_MINOR, ret);
                goto err_clk;
        }

        if (tmr_atboot && started == 0) {
                printk(KERN_INFO PFX "Starting Watchdog Timer\n");
                s3c2410wdt_start();
        } else if (!tmr_atboot) {
                /* if we're not enabling the watchdog, then ensure it is
                 * disabled if it has been left running from the bootloader
                 * or other source */

                s3c2410wdt_stop();
        }

        return 0;

 err_clk:
        clk_disable(wdt_clock);
        clk_put(wdt_clock);

 err_irq:
        free_irq(wdt_irq->start, pdev);

 err_map:
        iounmap(wdt_base);

 err_req:
        release_resource(wdt_mem);
        kfree(wdt_mem);

        return ret;
}

在s3c2410wdt_probe函数中为watchdog注册了一个中断，中断号为IRQ_WDT，
#define IRQ_WDT S3C2410_IRQ(9)
中断处理函数是s3c2410wdt_irq。我们来看request_irq是如何实现的：
kernel/irq/Manage.c:

/**
 *  request_irq - allocate an interrupt line
 *  @irq: Interrupt line to allocate
 *  @handler: Function to be called when the IRQ occurs
 *  @irqflags: Interrupt type flags
 *  @devname: An ascii name for the claiming device
 *  @dev_id: A cookie passed back to the handler function
 *
 *  This call allocates interrupt resources and enables the
 *  interrupt line and IRQ handling. From the point this
 *  call is made your handler function may be invoked. Since
 *  your handler function must clear any interrupt the board
 *  raises, you must take care both to initialise your hardware
 *  and to set up the interrupt handler in the right order.
 *
 *  Dev_id must be globally unique. Normally the address of the
 *  device data structure is used as the cookie. Since the handler
 *  receives this value it makes sense to use it.
 *
 *  If your interrupt is shared you must pass a non NULL dev_id
 *  as this is required when freeing the interrupt.
 *
 *  Flags:
 *
 *  IRQF_SHARED     Interrupt is shared
 *  IRQF_DISABLED   Disable local interrupts while processing
 *  IRQF_SAMPLE_RANDOM The interrupt can be used for entropy
  */
int request_irq(unsigned int irq, irqreturn_t (*handler)(int, void *, struct pt_regs *),  unsigned long irqflags, const char *devname, void *dev_id)
{
    struct irqaction *action;
    int retval;
 #ifdef CONFIG_LOCKDEP
    /*
     * Lockdep wants atomic interrupt handlers:
     */
  irqflags |= IRQF_DISABLED;
#endif
    /*
     * Sanity-check: shared interrupts must pass in a real dev-ID,
     * otherwise we'll have trouble later trying to figure out
     * which interrupt is which (messes up the interrupt freeing
     * logic etc).
     */
    /*允许共享的中断必须要有一个独一无二的dev_id, 看上面函数的解释
    if ((irqflags & IRQF_SHARED) && !dev_id)
        return -EINVAL;
    if (irq >= NR_IRQS) /*中断号是否合法*/
        return -EINVAL;
    /*这个标记对s3c2410来 说在s3c24xx_init_irq里通过调用set_irq_flags()被 去掉了*/
    if (irq_desc[irq].status & IRQ_NOREQUEST)
        return -EINVAL;
    if (!handler)  /*中断例程*/
        return -EINVAL;

    /*分配一个irqaction对 象，来保存这个中断信息*/
    action = kmalloc(sizeof(struct irqaction), GFP_ATOMIC);
    if (!action)
        return -ENOMEM;

   /*保存中断例程等信息*/
    action->handler = handler;
    action->flags = irqflags;
    cpus_clear(action->mask);   /*清除相应位*/
    action->name = devname;
    action->next = NULL;
    action->dev_id = dev_id;

    select_smp_affinity(irq);

    retval = setup_irq(irq, action);/*安装中断*/
    if (retval)
        kfree(action);

    return retval;
}

该函数的功能及参数含义在函数头有详细的说明，这里就不多介绍了，值得注意的是我们在申请中断之前，必须要去掉该中断的IRQ_NOREQUEST标记(系统初始化的时候赋了这个标记)，具体方法是调用set_irq_flags()函数。
接着看setup_irq
kernel/irq/Manage.c:

/*
 * Internal function to register an irqaction - typically used to
 * allocate special interrupts that are part of the architecture.
 */
int setup_irq(unsigned int irq, struct irqaction *new)
{
    struct irq_desc *desc = irq_desc + irq; /*获取保存该中断的 中断描述符地址*/
    struct irqaction *old, **p;
    unsigned long flags;
    int shared = 0;

    if (irq >= NR_IRQS)
        return -EINVAL;

    /*对于s3c2410的 中断在s3c24xx_init_irq里已经初始化过了*/
    if (desc->chip == &no_irq_chip)
        return -ENOSYS;
    /*
     * Some drivers like serial.c use request_irq() heavily,
     * so we have to be careful not to interfere with a
     * running system.
     */
    if (new->flags & IRQF_SAMPLE_RANDOM) {
        /*
         * This function might sleep, we want to call it first,
         * outside of the atomic block.
         * Yes, this might clear the entropy pool if the wrong
         * driver is attempted to be loaded, without actually
         * installing a new handler, but is this really a problem,
         * only the sysadmin is able to do this.
         */
        rand_initialize_irq(irq);
    }

    /*
     * The following block of code has to be executed atomically
     */
     /*
* 下面if代码段主要是查看该中断是否可以共享，如可以，则把中断例程链入中断例程list中, 至于中断共享的条件有： 1 触发方式相同， 2 都允许中断共享*/
    spin_lock_irqsave(&desc->lock, flags);
    p = &desc->action;
    old = *p;
    if (old) { /*对于IRQ_WDT，这个if不成立，但它已经设置了handle_irq 喔*/
        /*
         * Can't share interrupts unless both agree to and are
         * the same type (level, edge, polarity). So both flag
         * fields must have IRQF_SHARED set and the bits which
         * set the trigger type must match.
         */
        /*判断能否共享中断*/
        if (!((old->flags & new->flags) & IRQF_SHARED) ||
            ((old->flags ^ new->flags) & IRQF_TRIGGER_MASK))
            goto mismatch;

#if defined(CONFIG_IRQ_PER_CPU)
        /* All handlers must agree on per-cpuness */
        if ((old->flags & IRQF_PERCPU) !=
            (new->flags & IRQF_PERCPU))
            goto mismatch;
#endif
         /* add new interrupt at end of irq queue */
        /*把中断例程加入list中*/
        do {
            p = &old->next;
            old = *p;
        } while (old);
        shared = 1;
    }

    *p = new;  /*该行很关键， 它把中断的处理函数添加到该中断描述符的中断例程list里*/
#if defined(CONFIG_IRQ_PER_CPU)
    if (new->flags & IRQF_PERCPU)
        desc->status |= IRQ_PER_CPU;
#endif
    if (!shared) {
/*对于IRQ_WDT来说这步是多余的，初始化 的时候已做过*/
        irq_chip_set_defaults(desc->chip); 

        /* Setup the type (level, edge polarity) if configured: */
/*对于IRQ_WDT来说，没有定义触发方式， 即默认触发方式*/
        if (new->flags & IRQF_TRIGGER_MASK) {
            /*如果要设触发方式，则调用平台特定的函数，因此如果我们的平台要实现该功能则必*须要在irq_chip对象里加入对set_type 函数的支持*/
            if (desc->chip && desc->chip->set_type)
               desc->chip->set_type(irq, new->flags & IRQF_TRIGGER_MASK);
            else
               /*
                * IRQF_TRIGGER_* but the PIC does not support
                * multiple flow-types?
                 */
               printk(KERN_WARNING "No IRQF_TRIGGER set_type "
                      "function for IRQ %d (%s)\n", irq,
                      desc->chip ? desc->chip->name :
                      "unknown");
        } else
            /*这函数只是简单的检查是否有handle_irq*/
            compat_irq_chip_set_default_handler(desc);
         /*去掉中断的相关状态，让它就绪*/
        desc->status &= ~(IRQ_AUTODETECT | IRQ_WAITING |
                 IRQ_INPROGRESS);
         if (!(desc->status & IRQ_NOAUTOEN)) {
            /*使能该中断*/
            desc->depth = 0;
            desc->status &= ~IRQ_DISABLED;
            if (desc->chip->startup)
               desc->chip->startup(irq); /*平台相关函数*/
            else
               desc->chip->enable(irq);  /*平台相关函数*/
        } else
            /* Undo nested disables: */
            desc->depth = 1;
    }
    spin_unlock_irqrestore(&desc->lock, flags);
     new->irq = irq;
    register_irq_proc(irq);  /*在/proc/irq/下创建该中断的一个文件*/
    new->dir = NULL;
    register_handler_proc(irq, new); /*为/proc/irq/下 创建的文件设置处理函数*/

    return 0;

mismatch:
    spin_unlock_irqrestore(&desc->lock, flags);
    if (!(new->flags & IRQF_PROBE_SHARED)) {
        printk(KERN_ERR "IRQ handler type mismatch for IRQ %d\n", irq);
        dump_stack();
    }
    return -EBUSY;
}

该函数主要是安装了一个中断，并使能它。我们先看使能函数，它是平台相关的，对于s3c2410的IRQ_WDT来说使用的是默认的使能函数(default_startup(),初始化赋值)，如果我们要使用自己的使能函数，只要在chip对象里添加就行了。
kernel/irq/Chip.c:

static unsigned int default_startup(unsigned int irq)
{
    irq_desc[irq].chip->enable(irq);
     return 0;
}

对于IRQ_WDT来说调用的irq_desc[irq].chip->enable(irq)仍是默认函数：default_enable（）
kernel/irq/chip.c:

static void default_enable(unsigned int irq)
{
    struct irq_desc *desc = irq_desc + irq;
     desc->chip->unmask(irq);   /*unmask该中断*/
    desc->status &= ~IRQ_MASKED;
}

呵呵，对于IRQ_WDT来说这次的调用desc->chip->unmask(irq)，实际上是s3c_irq_unmask, 具体可查看前面分析的chip对象。
arch/arm/mach-s3c2410/Irq.c:

static void s3c_irq_unmask(unsigned int irqno)
{
    unsigned long mask;
     if (irqno != IRQ_TIMER4 && irqno != IRQ_EINT8t23)
        irqdbf2("s3c_irq_unmask %d\n", irqno);
     irqno = IRQ_EINT0;
     mask = __raw_readl(S3C2410_INTMSK);
    mask &= ~(1UL << irqno);
    __raw_writel(mask, S3C2410_INTMSK);
}

对着s3c2410的data sheet一看就知道了，就是打开相应中断。至此中断处理函数安装好了，中断也打开了，系统就可以正确的响应中断了。Ok，到此为止IRQ_WDT的中断注册过程已完成，此时的中断描述符如下所示：

arm-linux中断初始化分析

tek-life — Wed, 26 May 2010 13:21:07 +0000

这篇文档准备简要的分析下arm平台上linux下的中断是如何运行的，本文将先分析初始化时的中断是如何建立的，然后以一个例子来注册一个中断，并详细分析中断触发到调用我们自己的中断例程的整个流程。
本文linux2.6.18的源码和s3c2410的CPU及smdk2410的板子为例来分析代码。
一中断初始化：
大家都知道arm下规定，在0×00000000或0xffff0000的地址处必须存放一张跳转表, 其格式如下：

上面的这个表我们称之为”异常中断向量表”,表中的IRQ和FIQ位置就是用来存放处理中断函数的地址。至于具体选择在哪一个地址处存放该表，可由CPU的协处理器完成。如s3c2410下由CP15中寄存器1的位13来决定，我们可以通过设置该位来告诉系统我们的向量表在哪。
include/arch/asm-arm/proc-armv/system.h

#if __LINUX_ARM_ARCH__ >= 4    //at91rm9200是ARMV4结构
#define vectors_base()    ((cr_alignment & CR_V) ? 0xffff0000 : 0)
#else
#define vectors_base()    (0)
#endif

可以看到ARMv4以下的版本,该地址固定为0;ARMv4及以上版本，ARM中断向量表的地址由CP15协处理器c1寄存器中V位 (bit[13])控制,V和中断向量表的对应关系如下:

V=0 ～ 0×00000000~0x0000001C
V=1 ～ 0xffff0000~0xffff001C

因此，在中断初始化的时候我们要做的就是在IRQ和FIQ的位置处放置我们的中断处理函数地址或跳转语句跳转到我们的中断处理函数。这个过程是在trap_init中完成的，而它由start_kernel()调用。
arch/arm/kernel/traps.c

void __init trap_init(void)
{
    unsigned long vectors = CONFIG_VECTORS_BASE;/*跳转表的存放位置（即上面那表的存放位置）*/
     /*这些都在entry-armv.S下定义
*stub vector kuser_helper具体指什么？
*/
    extern char __stubs_start[], __stubs_end[];
    extern char __vectors_start[], __vectors_end[];
    extern char __kuser_helper_start[], __kuser_helper_end[];
    int kuser_sz = __kuser_helper_end - __kuser_helper_start;
     /*
     * Copy the vectors, stubs and kuser helpers (in entry-armv.S)
     * into the vector page, mapped at 0xffff0000, and ensure these
     * are visible to the instruction stream.
     */
/*复制跳转表内容到指定的位置
* memcpy(dst,src,count)
*/
    memcpy((void *)vectors, __vectors_start, __vectors_end - __vectors_start);
    memcpy((void *)vectors + 0x200, __stubs_start, __stubs_end - __stubs_start);
    memcpy((void *)vectors + 0x1000 - kuser_sz, __kuser_helper_start, kuser_sz);
     /*
     * Copy signal return handlers into the vector page, and
     * set sigreturn to be a pointer to these.
     */
    memcpy((void *)KERN_SIGRETURN_CODE, sigreturn_codes,   sizeof(sigreturn_codes));
     flush_icache_range(vectors, vectors + PAGE_SIZE);
    modify_domain(DOMAIN_USER, DOMAIN_CLIENT);
}

上面这个函数主要就是在CONFIG_VECTORS_BASE处设置好那张跳转表， CONFIG_VECTORS_BASE在autoconf.h中定义(该文件自动成生)，值为0xffff0000, 而CP15下的r1[13]在系统启动的时候在汇编部分就已经设置好了。
接下来我们就看下__vectors_start，__vectors_end，__stubs_start，__stubs_end之间的内容。
arch/arm/kernel/entry-armv.S

 .globl __vectors_start
__vectors_start:
    swi SYS_ERROR0
    b   vector_und + stubs_offset
    ldr pc, .LCvswi + stubs_offset
    b   vector_pabt + stubs_offset
    b   vector_dabt + stubs_offset
    b   vector_addrexcptn + stubs_offset
    b   vector_irq + stubs_offset
    b   vector_fiq + stubs_offset
 .globl  __vectors_end
__vectors_end:
     .data

这就是那张跳转表. vector_irq, vector_fiq等函数我们后面在分析，他们就定义在__stubs_start，__stubs_end中.至此经过traps_init后,在0xffff0000处的跳转表就形成了.当产生IRQ时，将调用b vector_irq + stubs_offset.

在系统初始化的时候除了会调用trap_init外,还会调用init_IRQ函数(也由start_kernel调用)，它初始化了一个全局中断描述符表(该表保存了每个中断的所有属性信息),并调用特定平台的中断初始化函数。
arm/arm/kernel/irq.c

void __init init_IRQ(void)
{
    int irq;
    /*初始化中断描述符表*/
for (irq = 0; irq < NR_IRQS; irq++)
      irq_desc[irq].status |= IRQ_NOREQUEST | IRQ_DELAYED_DISABLE | IRQ_NOPROBE;
 #ifdef CONFIG_SMP
    bad_irq_desc.affinity = CPU_MASK_ALL;
    bad_irq_desc.cpu = smp_processor_id();
#endif
    init_arch_irq();  /*特定平台的中断初始化*/
}

系统中总共有NR_IRQS个中断，并且每个中断都有一个中断描述符，保存在irq_desc中，该描述符保存了该中断的所有属性信息。对于平台smdk2410来说init_arch_irq()就是s3c24xx_init_irq()函数, 这是在setup_arch()里面赋值的--setup_arch也是在start_kernel里面被调用的。后面的内容我们都以中断号IRQ_WDT为例来讲解：
arch/arm/mach-s3c2410/irq.c:

/* s3c24xx_init_irq
 * Initialise S3C2410 IRQ system
*/
void __init s3c24xx_init_irq(void)
{
    unsigned long pend;
    unsigned long last;
    int irqno;
    int i;

    irqdbf("s3c2410_init_irq: clearing interrupt status flags\n");
     /* first, clear all interrupts pending... */
    /*先清掉所有的pending标志位，该位代表是否系统中触发了一个中断*/
    last = 0;
    for (i = 0; i < 4; i++) {
        pend = __raw_readl(S3C24XX_EINTPEND);
   if (pend == 0 || pend == last)
            break;
         __raw_writel(pend, S3C24XX_EINTPEND);
        printk("irq: clearing pending ext status %08x\n", (int)pend);
        last = pend;
    }
     last = 0;
    for (i = 0; i < 4; i++) {
        pend = __raw_readl(S3C2410_INTPND);
         if (pend == 0 || pend == last)
            break;
         __raw_writel(pend, S3C2410_SRCPND);
        __raw_writel(pend, S3C2410_INTPND);
        printk("irq: clearing pending status %08x\n", (int)pend);
        last = pend;
    }
     last = 0;
    for (i = 0; i < 4; i++) {
        pend = __raw_readl(S3C2410_SUBSRCPND);
         if (pend == 0 || pend == last)
            break;
         printk("irq: clearing subpending status %08x\n", (int)pend);
        __raw_writel(pend, S3C2410_SUBSRCPND);
        last = pend;
    }
     /* register the main interrupts */
    /* 注册主要的中断*/
    irqdbf("s3c2410_init_irq: registering s3c2410 interrupt handlers\n");
     for (irqno = IRQ_EINT4t7; irqno <= IRQ_ADCPARENT; irqno++) {
        /* set all the s3c2410 internal irqs */
         switch (irqno) {
            /* deal with the special IRQs (cascaded) */
         case IRQ_EINT4t7:
        case IRQ_EINT8t23:
        case IRQ_UART0:
        case IRQ_UART1:
        case IRQ_UART2:
        case IRQ_ADCPARENT:
            set_irq_chip(irqno, &s3c_irq_level_chip);
            set_irq_handler(irqno, do_level_IRQ);
            break;

        case IRQ_RESERVED6:
        case IRQ_RESERVED24:
            /* no IRQ here */
            break;

        default:  /*IRQ_WDT 就是这条通路*/
            //irqdbf("registering irq %d (s3c irq)\n", irqno);
            set_irq_chip(irqno, &s3c_irq_chip); /*为中断号设置chip*/
            set_irq_handler(irqno, do_edge_IRQ); /*设 置中断例程*/
            set_irq_flags(irqno, IRQF_VALID);    /*设置中断ready的标记*/
        }
    }

    /* setup the cascade irq handlers */
     set_irq_chained_handler(IRQ_EINT4t7, s3c_irq_demux_extint);
    set_irq_chained_handler(IRQ_EINT8t23, s3c_irq_demux_extint);
     set_irq_chained_handler(IRQ_UART0, s3c_irq_demux_uart0);
    set_irq_chained_handler(IRQ_UART1, s3c_irq_demux_uart1);
    set_irq_chained_handler(IRQ_UART2, s3c_irq_demux_uart2);
    set_irq_chained_handler(IRQ_ADCPARENT, s3c_irq_demux_adc);
     /* external interrupts */
     for (irqno = IRQ_EINT0; irqno <= IRQ_EINT3; irqno++) {
        irqdbf("registering irq %d (ext int)\n", irqno);
        set_irq_chip(irqno, &s3c_irq_eint0t4);
        set_irq_handler(irqno, do_edge_IRQ);
        set_irq_flags(irqno, IRQF_VALID);
    }

    for (irqno = IRQ_EINT4; irqno <= IRQ_EINT23; irqno++) {
        irqdbf("registering irq %d (extended s3c irq)\n", irqno);
        set_irq_chip(irqno, &s3c_irqext_chip);
        set_irq_handler(irqno, do_edge_IRQ);
        set_irq_flags(irqno, IRQF_VALID);
    }
     /* register the uart interrupts */
     irqdbf("s3c2410: registering external interrupts\n");
     for (irqno = IRQ_S3CUART_RX0; irqno <= IRQ_S3CUART_ERR0; irqno++) {
        irqdbf("registering irq %d (s3c uart0 irq)\n", irqno);
        set_irq_chip(irqno, &s3c_irq_uart0);
        set_irq_handler(irqno, do_level_IRQ);
        set_irq_flags(irqno, IRQF_VALID);
    }
     for (irqno = IRQ_S3CUART_RX1; irqno <= IRQ_S3CUART_ERR1; irqno++) {
        irqdbf("registering irq %d (s3c uart1 irq)\n", irqno);
        set_irq_chip(irqno, &s3c_irq_uart1);
        set_irq_handler(irqno, do_level_IRQ);
        set_irq_flags(irqno, IRQF_VALID);
    }
     for (irqno = IRQ_S3CUART_RX2; irqno <= IRQ_S3CUART_ERR2; irqno++) {
        irqdbf("registering irq %d (s3c uart2 irq)\n", irqno);
        set_irq_chip(irqno, &s3c_irq_uart2);
        set_irq_handler(irqno, do_level_IRQ);
        set_irq_flags(irqno, IRQF_VALID);
    }
     for (irqno = IRQ_TC; irqno <= IRQ_ADC; irqno++) {
        irqdbf("registering irq %d (s3c adc irq)\n", irqno);
        set_irq_chip(irqno, &s3c_irq_adc);
        set_irq_handler(irqno, do_edge_IRQ);
        set_irq_flags(irqno, IRQF_VALID);
    }
     irqdbf("s3c2410: registered interrupt handlers\n");
}

上面这个函数结合s3c2410的data sheet很好理解，就是注册各个必要的中断，注意这里为每个中断号注册的中断例程只是个整体的函数，该函数只是处理一些共性的操作如清中断标记位等，他会进一步调用我们注册的中断例程来处理特定的中断。如何注册中断会在后面分析。这个初始化函数调用了很多与中断相关的函数，我们逐个分析：
kernel/irq/chip.c:

/*
 *  set_irq_chip - set the irq chip for an irq
 *  @irq:   irq number
 *  @chip:  pointer to irq chip description structure
 */
/*为某个中断号设置一个chip*/
int set_irq_chip(unsigned int irq, struct irq_chip *chip)
{
    struct irq_desc *desc;
    unsigned long flags;
     if (irq >= NR_IRQS) {
        printk(KERN_ERR "Trying to install chip for IRQ%d\n", irq);
        WARN_ON(1);
        return -EINVAL;
    }
     if (!chip)
        chip = &no_irq_chip;

    desc = irq_desc + irq;  /*获取保存该中断的中断描述符*/
    spin_lock_irqsave(&desc->lock, flags);
    irq_chip_set_defaults(chip); /*为chip设置一些默认的公共的操作函数*/
    desc->chip = chip;  /*为中断保存chip对象*/
    /*
     * For compatibility only:
     */
    desc->chip = chip;
    spin_unlock_irqrestore(&desc->lock, flags);

    return 0;
}

为特定中断号初始化好chip对象，表示该中断号由这个chip控制，后面会调用到该中断号所属chip的相关函数，各个中断的chip是不同的,以IRQ_WDT为例，它的chip是s3c_irq_chip,请看：
arch/arm/mach-s3c2410/irq.c:

static struct irqchip s3c_irq_chip = {
    .ack       = s3c_irq_ack,
    .mask      = s3c_irq_mask,
    .unmask    = s3c_irq_unmask,
    .set_wake  = s3c_irq_wake
};

在set_irq_chip()中,还调用了irq_chip_set_defaults，目的是设置一些公共的开关操作。
kernel/irq/Chip.c:

/*
 * Fixup enable/disable function pointers
 */
void irq_chip_set_defaults(struct irq_chip *chip)
{
    if (!chip->enable)
        chip->enable = default_enable;
    if (!chip->disable)
        chip->disable = default_disable;
    if (!chip->startup)
        chip->startup = default_startup;
    if (!chip->shutdown)
        chip->shutdown = chip->disable;
    if (!chip->name)
        chip->name = chip->typename;
}

从代码中看，很显然，如果chip没有相应的操作函数，则就给chip赋默认的操作函数。
我们仍然回到s3c24xx_init_irq中. 接着看set_irq_handler()
include/linux/Irq.h:

static inline void set_irq_handler(unsigned int irq, void fastcall (*handle)(unsigned int, struct irq_desc *, struct pt_regs *))
{
    __set_irq_handler(irq, handle, 0);
}

kernel/irq/chip.c:

void __set_irq_handler(unsigned int irq, void fastcall (*handle)(unsigned int, irq_desc_t *, struct pt_regs *),int is_chained)
{
    struct irq_desc *desc;
    unsigned long flags;

    if (irq >= NR_IRQS) { /*参数检查*/
        printk(KERN_ERR
               "Trying to install type control for IRQ%d\n", irq);
        return;
    }

    desc = irq_desc + irq; /*获取中断描述符的存储地址*/

    if (!handle)
        handle = handle_bad_irq;  /*赋默认的中断handle*/

    if (desc->chip == &no_irq_chip) {
        printk(KERN_WARNING "Trying to install %sinterrupt handler "
               "for IRQ%d\n", is_chained ? "chained " : " ", irq);
        /*
         * Some ARM implementations install a handler for really dumb
         * interrupt hardware without setting an irq_chip. This worked
         * with the ARM no_irq_chip but the check in setup_irq would
         * prevent us to setup the interrupt at all. Switch it to
         * dummy_irq_chip for easy transition.
         */
        desc->chip = &dummy_irq_chip;  /*赋默认的chip*/
    }

    spin_lock_irqsave(&desc->lock, flags);
     /* Uninstall? */
    if (handle == handle_bad_irq) {/*没有设置中断例程，这里先将该中断设置为disable，防止在这时以及在这时之前来了此中断，就进行了错误的处理，这样就悲剧了。*/
        if (desc->chip != &no_irq_chip) {
            desc->chip->mask(irq);
            desc->chip->ack(irq);
        }
        desc->status |= IRQ_DISABLED;  /*没有中断例程则disable掉该中断*/
        desc->depth = 1;
    }
    desc->handle_irq = handle;  /*保存中断例程，对于IRQ_WDT来说则是do_edge_IRQ */

    /*由上面的调用可知，is_chained 始终等于0*/
    if (handle != handle_bad_irq && is_chained) {
        desc->status &= ~IRQ_DISABLED;//这个时候，就将IRQ_ENABLE了
        desc->status |= IRQ_NOREQUEST | IRQ_NOPROBE;
        desc->depth = 0;
        desc->chip->unmask(irq);
    }
    spin_unlock_irqrestore(&desc->lock, flags);
}

上面这个函数就是为特定的中断设置好一个中断处理例程.
Comment:这里的例程可不是我们request_irq注册的例程.
继续回到那个s3c24xx_init_irq函数，看set_irq_flags
arch/arm/kernel/irq.c:

void set_irq_flags(unsigned int irq, unsigned int iflags)
{
    struct irqdesc *desc;
    unsigned long flags;

    if (irq >= NR_IRQS) {
        printk(KERN_ERR "Trying to set irq flags for IRQ%d\n", irq);
        return;
    }

    desc = irq_desc + irq;
    spin_lock_irqsave(&desc->lock, flags);
    desc->status |= IRQ_NOREQUEST | IRQ_NOPROBE | IRQ_NOAUTOEN;
    if (iflags & IRQF_VALID)
        desc->status &= ~IRQ_NOREQUEST;  /*清掉IRQ_NOREQUEST 标记*/
    if (iflags & IRQF_PROBE)
        desc->status &= ~IRQ_NOPROBE;
    if (!(iflags & IRQF_NOAUTOEN))
        desc->status &= ~IRQ_NOAUTOEN;
    spin_unlock_irqrestore(&desc->lock, flags);
}

该函数主要是为特定的中断设置相应的状态标记, 而这里我们调用它的目的就是清掉IRQ_NOREQUEST标记，告诉系统该中断已经可以被申请使用了，中断在申请的时候会查看是否有IRQ_NOREQUEST标记，如有则表面该中断还不能使用。而初始化的时候所有的中断都有这个标记.
好，告一段落，基本上中断已经初始化差不多了.
参考：http://blog.csdn.net/aaronychen/archive/2008/09/03/2874643.aspx

ARM中断原理—ARM9 2410

tek-life — Tue, 25 May 2010 03:24:12 +0000

几天前一个学生问我ARM中断嵌套的问题，我才发现原在我心中理所当然的事对学生来说理解实属不易。

     ARM有七种模式，我们这里只讨论SVC、IRQ和FIQ模式。

     我们可以假设ARM核心有两根中断引脚（实际上是看不见的），一根叫 irq pin, 一根叫fiq pin.

     在ARM的cpsr中，有一个I位和一个F位，分别用来禁止IRQ和FIQ的。

     先不说中断控制器，只说ARM核心。正常情况下，ARM核都只是机械地随着pc的指示去做事情，当CPSR中的I和F位为1的时候，IRQ和FIQ全部处于禁止状态。无论你在irq pin和fiq pin上面发什么样的中断信号，ARM是不会理你的，你根本不能打断他，因为他耳聋了，眼也瞎了。

     在I位和F位为0的时候，当irq pin上有中断信号过来的时候，就会打断arm的当前工作，并且切换到IRQ模式下，并且跳到相应的异常向量表（vector)位置去执行代码。这个过程是自动的，但是返回到被中断打断的地方就得您亲自动手了。当你跳到异常向量表，处于IRQ的模式的时候，这个时候如果irq pin上面又来中断信号了，这个时候ARM不会理你的，irq pin就跟秘书一样，ARM核心就像老板，老板本来在做事，结果来了一个客户，秘书打断它，让客户进去了。而这个时候再来一个客户，要么秘书不断去敲门问，要么客户走人。老板第一个客户没有会见完，是不会理你的。

     但是有一种情况例外，当ARM处在IRQ模式，这个时候fiq pin来了一个中断信号，fiq pin是什么？是快速中断呀，比如是公安局的来查刑事案件，那才不管你老板是不是在会见客户，直接打断，进入到fiq模式下，并且跳到相应的fiq的异常向量表处去执行代码。那如果当ARM处理FIQ模式，fiq pin又来中断信号，又就是又一批公安来了，那没戏，都是执法人员，你打不断我。那如果这个时候irq pin来了呢？来了也不理呀，正在办案，还敢来妨碍公务。

    所以得出一个结论： IRQ模式只能被FIQ模式打断，FIQ模式下谁也打不断。

   在打不断的情况下，irq pin 或 fiq pin随便你怎么发中断信号，都是白发。

   所以除了fiq能打断irq以外，根本没有所谓中断嵌套的情况。

   但是再怎么说irq pin 和fiq pin加起来也就2根引脚，那这么多中断源，怎么办呢？不可能谁来了都直接来敲门吧。

    那么接下来该说谁来给irq pin或者 fiq pin发信号呢？上文中可以看到，是老板的客户，也可能是公安。这个事情就是由中断控制器来管理。

    拿最简单的2410/2440的中断控制器举例，这个中断控制器加一个子中断控制器，还有一个外部中断控制器管理了50多个中断资源，说穿了有50多个脚。这些脚除了外部中断都是规定了功能的，比如WDT、LCD、DMA等，这个功能不能改，因为2410/2440内部硬件连线决定了。

当你WDT和DMA的中断都到来的时候，就会被送到SRCPND寄存器中，两个中断都在里面，那到底把哪一个送给ARM呢？这个时候先看INTMOD,也就是模式，哪个是设置成为了快速中断，哪个就被送上去；那如果两个都是设置的快速中断呢？不可能，因为同一时间只能有一个中断可以被设成快速中断。所以，如果有快速中断，这个时候直接就给fiq pin发中断信号，打断ARM。

   那要是没有快速中断呢，这个时候就看INTMSK，看WDT和ＤＭＡ有没有被屏蔽的，如果DMA在INTMSK被屏蔽了，那就只有ＷＤＴ继续向上送了，如果都没有屏蔽，那么他们两个同进来到了PRIORITY优先级寄存器，在这里，根据优先级的设置，一定会分出一个高，一个低的优先级出来，高的那个就被送上去，送到了INTPND寄存器，所以ＩＮＴＰＮＤ随时随地有且只有一个一个中断在里面。只要ＩＮＴＰＮＤ里面有中断，irq pin就不会一直不断给ＡＲＭ中断信号，当第一次发的时候，中断了ＡＲＭ，这个时候ＡＲＭ进入相应的异常向量，并处于ＩＲＱ模式，正在这个时候，ＩＮＴＰＮＤ仍然在不断的通过irq pin向ＡＲＭ发中断信号，但是ＡＲＭ这个时候已经处于ＩＲＱ模式，是不会理睬你的。当你中断处理完了，要退出ＩＲＱ模式了，这个时候小心了，如果你在退出ＩＲＱ模式之前不清除INTPND里面的中断位，当你刚退出IRQ模式，又被中断了，因为INTPND一直在发中断信号。所以在退出IRQ模式之前要清除INTPND里面的中断位。但是光清除INTPND里面的位还不行，因为SRCPND里面WDT和DMA的中断还在，当你刚清除完INTPND，结果 SRCPND里面又选了一个出来又送到了INTPND里面。所以正确的处理方法是退出IRQ模式之前，一定要先清除SRCPND里相应的中断位，再清除 INTPND里相应的位。那么请注意，SRCPND里面可能有多位，所以清除你已处理过的中断就行了，而INTPND里面只可能有一位，直接清掉就可以了。

附上一张我用＋－号画的简图:

http://www.upemb.com/uploads/allimg/091019/16394K234-0.png”/>

     再来说说Linux的情况。Linux不用FIQ,只用到了IRQ。但是我们有时候一个中断需要处理很长时间，那我们就需要占用IRQ模式那么长的时间吗？没有，linux在IRQ模式下只是简单的记录是什么中断，马上就切换回了ＳＶＣ模式，换句话说，Ｌinux的中断处理都是在ＳＶＣ模式下处理的。那么中断号是怎么来的呢？在ＡＲＭ上固死了，相应的中断号只有一个办法得到：查询irqs.h 。那我先用一个中断号注册一个中断处理程序，当中断发生的时候，Linux怎么知道是我这个中断号发生的中断呢？在处理中断的时候，先读取INTPND，根据需要再读取EINTPEND或SUBSRCPND计算出一个中断号，相应的处理算法在 get_irq_nr_base这个宏中。而且irqs.h中的中断号就是根据这个算法把每个中断算一下得来的。

      还有子中断、外部中断，电平触发、边沿触发等，以后再谈。

作者介绍：本文由尚观科技老师和同学生（刘勇，孙贺，聂强，聂大鹏，牛须乐，孙磊）共同创作

ARM是RISC架构，不像X86那样的复杂。在X86中，外部中断一共只有15根线由8259A做中断控制器，这样，就会存在设备共享终端线的情况。

ARM没有这样做，因为它的中断控制器就比较复杂。除了中断控制器，还有子中断控制器，外部中断控制器，能控制50多个中断。除此之外，还有INTPND、SRCPND用于中断处理的寄存器。总而言之，ARM在硬件方面做了很多工作，来简化程序设计。

Linux源码点滴–asmlinkage

tek-life — Mon, 24 May 2010 01:23:01 +0000

asmlinkage是个宏，使用它是为了保持参数在stack中。因为从汇编语言到C语言代码参数的传递是通过stack的，它也可能从 stack中得到一些不需要的参数。Asmlinkage将要解析那些参数。

“asmlinkage” is defined, for example, in the header file
“include/asm-i386/linkage.h” as
__attribute__((regparm(0)))
that tells compiler put all function parameters in the stack (i.e.
disables call optimization).

Definition of “__init” is placed in the header “include/linux/init.h”.
(Paths to headers are valid for version 2.6.9)

看一下/usr/include/asm /linkage.h里面的定义：
#define asmlinkage CPP_ASMLINKAGE __attribute__((regparm(0)))
__attribute__是关键字，是gcc的C语言扩展，regparm(0)表示不从寄存器传递参数

asmlinkage存在的必要性：

这个asmlinkage大都用在系统调用中，系统调用需要在entry.s文件中用汇编语言调用，所以必须要保证它符合C语言的参数传递规则，才能用汇编语言正确调用它。

补充一：

__attribute__机制是GNU C的一大特色，它可以设置函数属性、变量属性和类型属性等。可以通过它们向编译器提供更多数据，帮助编译器执行优化等。
__attribute__((regparm(0)))：告诉gcc编译器该函数不需要通过任何寄存器来传递参数，参数只是通过堆栈来传递。
__attribute__((regparm(3)))：告诉gcc编译器这个函数可以通过寄存器传递多达3个的参数，这3个寄存器依次为EAX、 EDX 和 ECX。更多的参数才通过堆栈传递。这样可以减少一些入栈出栈操作，因此调用比较快。

补充二：

关于CPP_ASMLINKAGE:

6 #ifdef __cplusplus
7 #define CPP_ASMLINKAGE extern “C”
8 #else
9 #define CPP_ASMLINKAGE
10 #endif
11
12 #ifndef asmlinkage
13 #define asmlinkage CPP_ASMLINKAGE
14 #endif

Linux入门进阶方法谈

tek-life — Sun, 23 May 2010 03:07:04 +0000

一，入门阶段

target：

知道什么是kernel，大致了解kernel，解除对kernel的恐惧心理

1> Makefile

- target：
Makefile要熟悉，至少对应用程序的Makefile裁减要比较了解，总之对Makefile比较熟悉，这是了解kernel的架构组织的基础。

-建议练习：
交叉编译应用程序，裁减Makefile。

- Status:已经都练习过了。

- Enhance:建议平时学习，多多学习Makefile，可以重点关注kernel代码里面的Makefile的写法，以及如何修改Kconfig文件，如何在kernel源代码中，加入新功能代码，如何添加修改Makefile

2>在普通的PC上升级Linux kernel

- target:
熟悉如何编译kernel的源代码，升级kernel后，要配置哪些文件，才能正确的运行kernel

- Status:

- Enhance:
无

3>掌握如何用KGDB调试kernel的源代码

- Target:
掌握KGDB和kgdb调试器的用法和常用的命令，图形界面可选，但是命令行界面一定要掌握。

二，进阶阶段：

Target：
进入到具体的编程阶段，加一些练习代码。熟悉kernel的函数用法

4>熟悉module的写法，这是进入kernel的捷径

- Target：
掌握module的的写法，具体的Makefile怎么样写？怎么编译？掌握和module有关的常用的函数，比如export_symbol() ,MODULE_LICIENCE()等等，总之，ldd3头两章要看的比较熟悉才行。

可以熟练的写一些module，其实这些module都可以看成是一个driver或者一个内核模块的缩写或者简化版本。比如一个helloworld的module。虽然简单，也能反应很多问题。driver就是在上面的基础上控制硬件而已。

-练习：

看ldd3上面的22页上面的helloworld小module程序。
参照http://dirac.org/linux/writing/lkmpg/2.6/chinese/lkmpg_chs/来练习module的写法，和实现一些简单的功能，这些和arm和x86都是无关的，是通用的。

5>在x86机器上练习如何给kernel加上一些系统调用。

- target :

了解什么是“系统调用”，系统调用的原理，和glibc里面的c函数有什么区别，如何在kernel代码里面加系统调用，用户程序如何调用这个系统调用。

知道如何在kernel现有的基础上加上一些系统调用。

-参考资料：
http://www.kerneltravel.net/journal/iv/index.htm 陈莉君老师的网站

-练习：
我这里有个例子，比如实现一个系统调用：查找某个进程的pid（当然用ps ax|grep很容易搞定，我们这里只是练习而已）
可以参考我的例子：
(See attached file: module_syscall.c) (See attached file:chardev_test.c) ,供参考，这是我原来自己练习的例子。

6>熟悉kernel一些常用的机制，一些基本函数的用法，

Target：
了解kernel api的用法，
例子：自旋锁，信号量，同步，互斥。
推荐书籍：ldd3（linux device driver 3rd），非常好
必看章节：
第一章设备驱动程序简介，入门。
第二章构造和运行模块，了解什么是模块，怎么编译，大致怎么写？
第三障字符设备，写一个简单的模块，可以实现read write（）函数，和硬件无关，因为我们不关心driver
第四章debug，掌握printk的用法
选看章节，或者提高章节
第五章并发和竟态一定要掌握

参考资料：

ldd3
下面是我在www.linuxforum.net上的一个讨论关于自旋锁和信号量分析的讨
论：对于了解信号量和spinlock的用法，比较有好处。
(See attached file: spinlock讨论帖子.pdf)
大家也可以充分利用www.linuxforum.net边讨论边学习。这种方式进步很快。

练习：
-一个module，实现read/write/ioctl()函数。
– enhance上面的module，要实现互斥同步的功能。比如实现一个module
，当一个进程read的时候，另一个进程再去读的时候，要阻塞调用，当第一个进程
释放这个资源的时候，第二个进程要被唤醒。
这是我的例子：参考：(See attached file: chardev_test_waitqueue.c)

关于，更多的互斥的例子，可以参考下面我的自己以前练习的例子：
(See attached file: chardev_test_atomic.c)(See attached file:chardev_test_sema.c)(See attached file: chardev_test_waitqueue.c)(See attached file: chardev_test_wait_kmalloc.c)
下面是kernel里面timer的用法，可以参考。

(See attached file: chrdev_timer.c)

编译module的时候，需要Makefile，
下面的Makefile可以作为例子：
针对2.4 kernel的例子（仅仅是例子，不要照抄）
(See attached file: Makefile)
针对2.6 kernel的例子：
(See attached file: Makefile)

6>进阶资料

可以看看www.kerneltravel.net上面的文章，相当不错，
推荐：内核中的调度与同步
http://www.kerneltravel.net/journal/vi/syn.htm

中断解析
http://www.kerneltravel.net/journal/viii/index.htm

7>根据工作需要去看相应的代码，比如要看jffs2，就要看jffs2的代码，如果看实时，就要看RT的实现代码。

本文摘自：kernelchina.cublog.cn

ubuntu 9.10 network-server configure

tek-life — Sat, 22 May 2010 04:21:01 +0000

删除网桥：

ip link set br0 down
brctl delbr br0

tftp服务器

sudo vi /etc/inetd.conf
tftp dgram udp wait nobody /usr/sbin/tcpd /usr/sbin/in.tftpd /tftpboot

重新启动服务：
sudo /etc/init.d/openbsd-inetd restart

测试：

在/tftpboot 文件夹下新建立一个文件
cd /tftpboot
touch test
进入另外一个文件夹
tftp 192.168.227.101
tftp> get test

NFS服务器：

1、进行NFS服务器端与客户端的安装：

sudo apt-get install nfs-kernel-server nfs-common portmap

安装客户端的作用是可以在本机进行NFS服务的测试。

2、配置portmap

两种方法任选一种就可以：

(1):sudo emacs /etc/default/portmap

去掉 -i 127.0.0.1

(2)sudo dpkg-reconfigure portmap

运行后选择“否”

3、配置挂载目录和权限

vim /etc/exports

配置如下：

/home/nfsboot *(rw,sync)
解释一下：

/home/nfsboot是NFS的共享目录，*表示任何IP都可以共享这个目录，你可以改为受限的IP，rw表示的是权限，sync是默认的。

4、更新exports文件

只要你更改了/etc/exports, 你不可以通过sudo exportfs -r 来更新这个文件

5、重启NFS服务

sudo /etc/init.d/nfs-kernel-server restart 重启nfs服务

6、进行测试

尝试一下挂载本地磁盘(我的linux系统IP为202.198.137.18，将/home/nfsboot挂载到/mnt)
$ sudo mount 202.198.137.18:/home/nfsboot /mnt
运行 $ df 看看结果
$ sudo umount /mnt

DHCP服务器：

启动服务器
root@ubuntu:/# /etc/init.d/dhcp3-server start
* Starting DHCP server dhcpd3 [ OK ]
root@ubuntu:/#
查看服务是否已经正常监听
root@ubuntu:/# netstat -aunp|grep dhcp
udp 0 0 0.0.0.0:67 0.0.0.0:* 23011/dhcpd3

CentOS5.4安装xen

tek-life — Thu, 20 May 2010 09:12:43 +0000

终于把xen编译好了，只有DOM0,安装的时候，出了很多错误，说实话都没有解决。于是，采用了最简单的方法：

下载:

xen3.4.2:http://bits.xensource.com/oss-xen/release/3.4.2/xen-3.4.2.tar.gz

linux 2.6.18.8打过xen补丁的：http://bits.xensource.com/oss-xen/release/3.4.2/linux-2.6.18-xen-3.4.2.tar.gz

安装方法：

step 1:
分别解压后，将linux-2.6.18.8解压后的内核拷入xen-3.4.2目录内，并重命名为 xen-2.6.18-xen.hg。
为了不再进行同步linux，修改xen-3.4.2/buildconfigs/src.hg-clone文件，将其中的某些行删除，删除后的内容为：

# Mercurial
HG ?= hg
LINUX_SRCDIR ?= linux-$(LINUX_VER)-xen.hg
# Repository to clone.
XEN_LINUX_HGREPO ?= $$(sh buildconfigs/select-repository $(LINUX_SRCDIR) $(LINUX_SRC_PATH))
# Set XEN_LINUX_HGREV to update to a particlar revision.
XEN_LINUX_HGREV ?= tip
$(LINUX_SRCDIR)/.valid-src: $(__XEN_LINUX_UPDATE)
set -e ; \
touch $@

step 2:

安装xen的时候，需要依赖一些库文件，因此，要预先检查一下

进入xen-3.4.2/tools/check目录

分别运行 ./chk build 和 ./chk install

都提示OK，则可，否则，安装之。

step3:

准备xen-3.4.2/studom目录内的相关文件：

grub-0.97.tar.gz newlib-1.16.0.tar.gz pciutils-2.2.9.tar.gz
lwip-1.3.0.tar.gz pciutils-2.2.9.tar.bz2 zlib-1.2.3.tar.gz

注意：pciutils有两个，一个是.tar.bz2,一个是.tar.gz。

将以上的文件下载好后，拷贝到studom目录下

step4:

开始安装了。这里，会发生很多警告，或者错误，如果想将错误输出到文件中，以便分别到网上寻找错误的解决方法，可以在每一条命令后面加上 2> error.txt 这样，就将错误和警告信息输出到文本文件error.txt了。

运行 make dist –j 8 ;这里 –j 的参数是多线程，这里用8线程进行make

然后，运行 make install –j 8;

通过这两条命令，已经在/boot目录下生成了kernel文件和xen.gz了。

注意，不可运行make world，因为这条命令是几条命令的集合，首先会运行 make clean，这条命令一运行，我们在linux-2.6.18-xen.hg下的目录都被清空了，功夫白费了。

我们还少initrd文件，因此，Continue.

step5:

运行：mkinitrd –without-dmraid -v -f /boot/initrd-2.6.18.8-xen.img 2.6.18.8-xen

这个—without-dmraid可加可不加，不过，我没有实验过不加的情况，如果你时间充足，都测试一下，完了，留言告诉偶一声，谢谢。

step6:

上面的工作都已经做完了，那么就很轻松了，改一下grub.conf就可以啦。我的grub为：

title CentOS (2.6.18-164.15.1.el5)
        root (hd0,0)
        kernel /vmlinuz-2.6.18-164.15.1.el5 ro root=/dev/VolGroup00/LogVol00 rhgb quiet
        initrd /initrd-2.6.18-164.15.1.el5.img
title Red Hat Enterprise Linux Server (2.6.18-128.el5)
        root (hd0,0)
        kernel /vmlinuz-2.6.18-128.el5 ro root=/dev/VolGroup00/LogVol00 rhgb quiet
        initrd /initrd-2.6.18-128.el5.img
title xen-3
        root (hd0,0)
        kernel /xen-3.4.2.gz
        module /vmlinuz-2.6.18.8-xen ro root=/dev/VolGroup00/LogVol00 rhgb quiet
        module /initrd-2.6.18.8-xen.img

到这里，就可以重启了，如果启动后，出现cann’t find filesystem的错误，检查一下grub.conf里面的root参数，是否赋值正确了。我就在这里摔了好几跤。

OK。

接下来，我会进行DOMU的实验。

centos 5.4 安装mercurial

tek-life — Wed, 19 May 2010 14:16:40 +0000

Mercurial和其他软件的源码编译安装不太一样。

除了最基本的./configure ;make ;make install;外，还需要一个hg debuginstall.

安装步骤如下：

1. 下载源码

http://mercurial.selenic.com/release/mercurial-1.4.1.tar.gz

2. 编译安装

a) # make all

b) # make install

c) # hg debuginstall
会出现abort: couldn’t find mercurial libraries in…

方法

可以在命令行中export，但范围和时间都很有限，不如找到hg和mercurial的位置，进行如下修改：

# mv /usr/local/bin/hg /usr/local/bin/hg.py
# cat > /usr/local/bin/hg <<\EOF
#!/bin/sh
PYTHONPATH=/usr/local/lib64/python2.4/site-packages:${PYTHONPATH}
export PYTHONPATH
exec /usr/local/bin/hg.py “$@”
EOF

别忘了chmod 755 /usr/local/bin/hg

然后，运行 hg debuginstall
仍然会出现错误：

Checking username…
no username supplied (see “hg help config”)
(specify a username in your .hgrc file)
1 problems detected, please check your install!

通过man hgrc会看到一些说明。默认是去一些位置找配置文件的。如果没有，就创建。源码中contrib文件夹下提供了一个sample.hgrc，可以拷贝过来修改

# cp contrib/sample.hgrc /root/.hgrc

# vim /root/.hgrc

改变如下：

### show changed files and be a bit more verbose if True

# verbose = True

### username data to appear in comits

### it usually takes the form: Joe User

username = Joe Who

verbose = True

### — Extensions

再运行hg debuginstall ，出现这个提示就可以了

Checking encoding (UTF-8)…

Checking extensions…

Checking templates…

Checking patch…

patching file hg-debuginstall-wCOuEs

Checking commit editor…

Checking username…

No problems detected

d) # hg

运行hg，出现

分布式软件配置管理工具 – 水银 (版本 1.4.1)

这是自由软件，具体参见版权条款。这里没有任何担保，甚至没有适合

特定目的的隐含的担保。

ok!

参考：http://hi.baidu.com/shuxiaotu/blog/item/4fe50c195a03e40c35fa4192.html

"/usr/openwin/bin/xauth: timeout in locking authority file $HOME/.Xauthority"

tek-life — Wed, 19 May 2010 03:07:05 +0000

1. The user’s $HOME is not writable by the user; $HOME may be owned by an entirely different user.
2. The lock file $HOME/.Xauthority-l already exists; remove this file.

Expert these two points:

3.please check the permission.The general method is run this command

chmod 777 .

——other problem—-

Unluckily,we may come across this problem:

we couldn’t modify the $HOME ‘s file or add some things.The problem is that the $HOME is not ours,we should change the owner by root .

switch to root,and run this command:

chown user:user *.*//the user is our id name

and then change the permission:

chmod 555 *.*

Then that is ok.

ubuntu 更改默认桌面路径

tek-life — Wed, 19 May 2010 01:36:50 +0000

mv 桌面 desktop
gedit ~/.config/user-dirs.dirs
找到

XDG_DESKTOP_DIR="$HOME/ 桌面"
改成

XDG_DESKTOP_DIR="$HOME/desktop"
改完重启gnome

sudo /etc/init.d/gdb restart

libstdc++.so.6: no version information available

tek-life — Wed, 19 May 2010 00:54:06 +0000

用apt-get install ，总是出现：/usr/local/lib /libstdc++.so.6: no version information available之类的错误。然后用ldconfig检查 ldconfig -p | grep libstd ，结果如下：
    libstdc++.so.6 (libc6) => /usr/local/lib/libstdc++.so.6
    libstdc++.so.6 (libc6) => /usr/lib/libstdc++.so.6
    libstdc++.so (libc6) => /usr/local/lib/libstdc++.so
后来发现问题是：/etc/ld.so.conf.d/libc.conf的问题，将其中的/usr/local/lib去掉，然后运行ldconfig,问题就解决了。

必须运行sudo ldconfig，这样才会改变/etc/ld.so.cache的内容，让配置生效。

apt-get 两种安装软件方法

tek-life — Tue, 18 May 2010 07:39:39 +0000

方法一(直接用二进制包安装）：
apt-get install mozilla-firefox
方法二（源码编译安装）
apt-get build-dep mozilla-firefox (先安装编译firefox需要依赖的包）
apt-get -b source mozilla-firefox (下载firefox的源码包并自动编译生成deb包，但并没有对源码作任何修改）
dpkg -i “生成的firefox软件的deb包的名称”(安装firefox软件的deb包）

ubuntu 9.10 编译qemu-0.9.1错误—dirent.h

tek-life — Tue, 18 May 2010 07:38:31 +0000

原因是在usr/include/linux/目录下，缺少dirent.h文件。

从2.6.18内核中拷贝即可。

linux-2.6.21.1编译出错–“sumversion.c”

tek-life — Mon, 17 May 2010 03:31:15 +0000

scripts/mod/sumversion.c: 在函数‘get_src_version’中:
scripts/mod/sumversion.c:384: 错误：‘PATH_MAX’未声明(在此函数内第一次使用)
scripts/mod/sumversion.c:384: 错误：(即使在一个函数内多次出现，每个未声明的标识符在其
scripts/mod/sumversion.c:384: 错误：所在的函数内也只报告一次。)
scripts/mod/sumversion.c:384: 警告：未使用的变量‘filelist’
make[2]: *** [scripts/mod/sumversion.o] 错误 1
make[1]: *** [scripts/mod] 错误 2
make: *** [scripts] 错误 2

解决办法:
#vim /linux-2.6.21.1/scripts/mod/sumversion.c
添加

#include

pts与tty

tek-life — Fri, 14 May 2010 09:17:43 +0000

在使用ubuntu的时候，如果输入ps –e ，会出现：

2358 pts/0    00:00:00 su
2368 pts/0    00:00:00 bash
2789 tty1     00:00:00 bash
2837 ?        00:00:00 gnome-terminal
2838 ?        00:00:00 gnome-pty-helpe
2839 pts/1    00:00:00 bash
2873 pts/2    00:00:00 bash
2905 pts/0    00:00:00 ps

之类的信息，其中tty1和pts/0是何东东？

在计算机的发展史上，关于人机接口，有2个主要概念，一个是终端；另一个是控制台

终端分为字符哑终端和图形终端

控制台是另外一个人机接口，不通过终端与主机相连, 而是通过显示卡-显示器和键盘接口分别与主机相连。

在PC机上，没有终端的概念，仅有控制台，而且是1个。
我们所看到的这些tty1-7和pts/0实际上都是虚拟的终端，由getty来虚拟的。而tty7是由Xorg来管理的，如下：

892 tty7     00:00:10 Xorg
894 ?        00:00:00 hald-addon-acpi
895 ?        00:00:00 hald-addon-inpu
944 tty4     00:00:00 getty
946 tty5     00:00:00 getty
956 tty2     00:00:00 getty
957 tty3     00:00:00 getty
961 tty6     00:00:00 getty

另外，扩展一下：

在UNIX系统中，计算机显示器通常被称为控制台终端（Console），关于/dev/console 应该来说更像一个缓冲结果。实现对内核的打印，比如说内核把要打印的内容装入缓冲区，然后由console来决定打印到哪里吧（比如是tty0还是串口等）。

在kernel中，console这个结构中有个device。如果，我们来个专门打印内核的设备（比如通过串口），我们把那个串口register_console，那么/dev/console就到这个串口设备了。这时，内核打印就到这个串口设备了，而用户的打印还是和上面的/dev/tty相关，如果/dev/tty对应/dev/tty0,那么用户打印还在窗口中出现。所以说/dev/console是用来外接控制台的。

好，比较明白了吧，在打印时候的路径为：console->tty->tty?

参考资料：
http://blog.csdn.net/liaoxinmeng/archive/2009/12/14/5004743.aspx

git备忘

tek-life — Tue, 11 May 2010 13:00:37 +0000

git diff :比较索引和本地之间的区别，当本地提交到索引（使用了add命令），则输出为空
而 git diff -cached 应该是比较仓库和索引之间的区别，当索引提交到仓库（使用了commit命令），则输出为空

git-merge后，是会产生双父母的，这种情况如果要查看父母信息，：
$git show HEAD^1 //查看HEAD的第一个父母,合并之前的主分支
$git show HEAD^2 //查看HEAD的第二个父母，合并之前的被合并分支

git cat-file –t … 查看文件类型
git cat-file 类型 id 查看文件内容
git ls-tree id 查看树

Changes to be committed表示在index和commit的区别状况。
而Changed but not updated表示当前目录和index的区别状况。

git commit之后要输入commit信息，加个 –s 不用输入信息

android 日记(1)

tek-life — Fri, 07 May 2010 08:35:15 +0000

查看目标平台:
omycle@omycle-desktop:~/ftk_emu/tools$ android list target
Available Android targets:
id: 1 or "android-7"
     Name: Android 2.1-update1
     Type: Platform
     API level: 7
     Revision: 1
Skins: WVGA800, WQVGA432, WVGA854, WQVGA400, HVGA (default), QVGA

查看avd:
omycle@omycle-desktop:~/ftk_emu/tools$ android list avd
Available Android Virtual Devices:
    Name: ftk
    Path: /home/omycle/.android/avd/ftk.avd
Target: Android 2.1-update1 (API level 7)
    Skin: HVGA

查看现有的皮肤：
omycle@omycle-desktop:~/ftk_emu/platforms/android-2.1-update1/skins$ ls
HVGA NOTICE.txt QVGA WQVGA400 WQVGA432 WVGA800 WVGA854

查看内核版本

tek-life — Thu, 06 May 2010 12:55:23 +0000

查看内核的有

uname –a

omycle@omycle-desktop:~$ uname -a
Linux omycle-desktop 2.6.31-21-generic #59-Ubuntu SMP Wed Mar 24 07:28:56 UTC 2010 i686 GNU/Linux

cat /etc/issue

[root@cintel lhf]# cat /etc/issue
Red Hat Enterprise Linux Server release 5 (Tikanga)
Kernel \r on an \m

omycle@omycle-desktop:~$ cat /etc/issue
Ubuntu 9.10 \n \l

cat /etc/redhat_release

[root@cintel lhf]# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 5 (Tikanga)

查看发行版的有：

lsb_release –a

omycle@omycle-desktop:~$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 9.10
Release:        9.10
Codename:       karmic

[root@cintel lhf]# lsb_release -a
LSB Version:    :core-3.1-ia32:core-3.1-noarch:graphics-3.1-ia32:graphics-3.1-noarch
Distributor ID: RedHatEnterpriseServer
Description:    Red Hat Enterprise Linux Server release 5 (Tikanga)
Release:        5
Codename:       Tikanga

Linux 虚拟内存规划

tek-life — Thu, 06 May 2010 08:06:36 +0000

从先静的csdn上看到的大内高手系列文章，其中有设计Linux虚拟内存模型的，这是他总结的要点，觉得挺好。

Linux的内存模型，一般为：

地址	作用	说明
>=0xc000 0000	内核虚拟存储器	用户代码不可见区域
<0xc000 0000	Stack（用户栈）	ESP指向栈顶
	↓ ↑	空闲内存
>=0×4000 0000	文件映射区
<0×4000 0000	↑	空闲内存
	Heap(运行时堆)	通过brk/sbrk系统调用扩大堆，向上增长。
	.data、.bss(读写段)	从可执行文件中加载
>=0×0804 8000	.init、.text、.rodata(只读段)	从可执行文件中加载
<0×0804 8000	保留区域

用十进制的观点:（这样更便于接受）

文件映射区是在1G以上的地方

栈是在3G以下的地方

内核空间是在3G以上的地方

在先静的文章中，还举出了单线程和多线程的例子。对于多线程，我还没有做过多的了解，对单线程，要区分如果一次从堆中划分较多的空间，那么会从文件映射去来划分，也就是从1G以上的地方去划分，而不是在1G一下(表格中brk/sbrk的地方)

先静文章地址：http://blog.csdn.net/absurd/archive/2006/06/19/814268.aspx

RHEL /CentOS yum源的安装

tek-life — Wed, 05 May 2010 14:37:18 +0000

方法一：

中科大的源：

cd /etc/yum.repos.d
mv CentOS-Base.repo  CentOS-Base.repo.save
wget http://centos.ustc.edu.cn/CentOS-Base.repo.5
mv CentOS-Base.repo.5 CentOS-Base.repo

参考网址：http://centos.ustc.edu.cn/
————————————————————————————————————————————————————————————————

方法二：

首先察看一下本RHEL的发行版本：

cat /proc/redhat-release

1。确保RHEL5中已经安装了yum。

2。修改源配置文件＃gedit /etc/yum.repos.d/CentOS-Base.repo

在其中加入以下内容

[base]
name=CentOS-5-Base
#mirrorlist=http://mirrorlist.centos.org/?release=$releasever5&arch=$basearch&repo=os
#baseurl=http://mirror.centos.org/centos/$releasever/os/$basearch/
baseurl=http://ftp.sjtu.edu.cn/centos/5/os/$basearch/
gpgcheck=1
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-centos5
#released updates
[update]
name=CentOS-5-Updates
#mirrorlist=http://mirrorlist.centos.org/?release=4&arch=$basearch&repo=updates
baseurl=http://ftp.sjtu.edu.cn/centos/5/updates/$basearch/
gpgcheck=1
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-centos5
#packages used/produced in the build but not released
[addons]
name=CentOS-5-Addons
#mirrorlist=http://mirrorlist.centos.org/?release=4&arch=$basearch&repo=addons
baseurl=http://ftp.sjtu.edu.cn/centos/5/addons/$basearch/
gpgcheck=1
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-centos5
#additional packages that may be useful
[extras]
name=CentOS-5-Extras
#mirrorlist=http://mirrorlist.centos.org/?release=4&arch=$basearch&repo=extras
baseurl=http://ftp.sjtu.edu.cn/centos/5/extras/$basearch/
gpgcheck=1
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-centos5
#additional packages that extend functionality of existing packages
[centosplus]
name=CentOS-5-Plus
#mirrorlist=http://mirrorlist.centos.org/?release=4&arch=$basearch&repo=centosplus
baseurl=http://ftp.sjtu.edu.cn/centos/5/centosplus/$basearch/
gpgcheck=1
enabled=0
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-centos5
#contrib – packages by Centos Users
[contrib]
name=CentOS-5-Contrib
#mirrorlist=http://mirrorlist.centos.org/?release=4&arch=$basearch&repo=contrib
baseurl=http://ftp.sjtu.edu.cn/centos/5/contrib/$basearch/
gpgcheck=1
enabled=0
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-centos5
# vi dag.repo
[dag]
name=Dag RPM Repository for RHEL5
baseurl=http://ftp.riken.jp/Linux/dag/redhat/el5/en/$basearch/dag/
enabled=1
gpgcheck=1
gpgkey=http://ftp.riken.jp/Linux/dag/packages/RPM-GPG-KEY.dag.txt

3. 导入key
＃rpm –import http://ftp.sjtu.edu.cn/centos/5/os/i386/RPM-GPG-KEY-CentOS-5

4. 运行，测试
＃yum update

在安装软件的时候，会出现key失效，或者key太老的警告。

解决方法：

1、关闭验证，也就是把gpgcheck=0

2、将这两个导入，就可以了。
rpm –import http://dag.wieers.com/rpm/packages/RPM-GPG-KEY.dag.txt
rpm –import http://quattor.web.lal.in2p3.fr/packages/os/sl520-x86_64/base/RPM-GPG-KEYs/RPM-GPG-KEY-CentOS-5

android模拟器

tek-life — Wed, 05 May 2010 08:02:05 +0000

通过adb bugreport可以获取android的bug信息

adb bugreport > bugreport.txt

然后通过winscp传到宿主机上：

emulator所模拟的信息：

<6>Initializing cgroup subsys cpu
<5>Linux version 2.6.29-00261-g0097074 (digit@digit.mtv.corp.google.com) (gcc version 4.4.0 (GCC) ) #14 Tue Feb 2 15:49:02 PST 2010
<4>CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00093177
<4>CPU: VIVT data cache, VIVT instruction cache
<4>Machine: Goldfish
<4>Memory policy: ECC disabled, Data cache writeback

ftk效果图

tek-life — Tue, 04 May 2010 14:13:31 +0000

ftk不错的小玩意儿

具体编译方法，参见：

http://www.limodev.cn/blog/archives/1392

运行桌面：

binutils的升级方式

tek-life — Tue, 04 May 2010 03:29:55 +0000

binutils即为二进制工具，提供了as ld之类的工具。要查看本机的binutils版本，可以

as –vison

因为在安装交叉编译工具链的时候，我安装了2.19的低版本的binutils，因此，要想升级为2.20或者更高的版本，通过apt-get install 的方式是不行的。

在网上看到，有的童鞋说必须通过编译的方式才能升级。貌似有道理。

git获取android源码，稍微有点眉目

tek-life — Sat, 01 May 2010 01:08:19 +0000

tek-life@tek-life-desktop:~$ repo init -u git://android.git.kernel.org/platform/manifest.git
Getting repo …
from git://android.git.kernel.org/tools/repo.git
fatal: cannot make /home/tek-life/.repo/repo directory: File exists
tek-life@tek-life-desktop:~$ repo init -u git://android.git.kernel.org/platform/manifest.git
Getting repo …
from git://android.git.kernel.org/tools/repo.git
remote: Counting objects: 1008, done.
remote: Compressing objects: 100% (417/417), done.
remote: Total 1008 (delta 633), reused 918 (delta 570)
Receiving objects: 100% (1008/1008), 294.73 KiB | 54 KiB/s, done.
Resolving deltas: 100% (633/633), done.
From git://android.git.kernel.org/tools/repo
* [new branch] maint -> origin/maint
* [new branch] master -> origin/master
* [new branch] stable -> origin/stable
* [new tag] v1.6.9.4 -> v1.6.9.4
From git://android.git.kernel.org/tools/repo
* [new tag] v1.0 -> v1.0
* [new tag] v1.0.1 -> v1.0.1
* [new tag] v1.0.2 -> v1.0.2
* [new tag] v1.0.3 -> v1.0.3
* [new tag] v1.0.4 -> v1.0.4
* [new tag] v1.0.5 -> v1.0.5
* [new tag] v1.0.6 -> v1.0.6
* [new tag] v1.0.7 -> v1.0.7
* [new tag] v1.0.8 -> v1.0.8
* [new tag] v1.0.9 -> v1.0.9
* [new tag] v1.1 -> v1.1
* [new tag] v1.2 -> v1.2
* [new tag] v1.3 -> v1.3
* [new tag] v1.3.1 -> v1.3.1
* [new tag] v1.3.2 -> v1.3.2
* [new tag] v1.4 -> v1.4
* [new tag] v1.4.1 -> v1.4.1
* [new tag] v1.4.2 -> v1.4.2
* [new tag] v1.4.3 -> v1.4.3
* [new tag] v1.4.4 -> v1.4.4
* [new tag] v1.5 -> v1.5
* [new tag] v1.5.1 -> v1.5.1
* [new tag] v1.6 -> v1.6
* [new tag] v1.6.1 -> v1.6.1
* [new tag] v1.6.2 -> v1.6.2
* [new tag] v1.6.3 -> v1.6.3
* [new tag] v1.6.4 -> v1.6.4
* [new tag] v1.6.5 -> v1.6.5
* [new tag] v1.6.6 -> v1.6.6
* [new tag] v1.6.7 -> v1.6.7
* [new tag] v1.6.7.1 -> v1.6.7.1
* [new tag] v1.6.7.2 -> v1.6.7.2
* [new tag] v1.6.7.3 -> v1.6.7.3
* [new tag] v1.6.7.4 -> v1.6.7.4
* [new tag] v1.6.7.5 -> v1.6.7.5
* [new tag] v1.6.8 -> v1.6.8
* [new tag] v1.6.8.1 -> v1.6.8.1
* [new tag] v1.6.8.10 -> v1.6.8.10
* [new tag] v1.6.8.11 -> v1.6.8.11
* [new tag] v1.6.8.2 -> v1.6.8.2
* [new tag] v1.6.8.3 -> v1.6.8.3
* [new tag] v1.6.8.4 -> v1.6.8.4
* [new tag] v1.6.8.5 -> v1.6.8.5
* [new tag] v1.6.8.6 -> v1.6.8.6
* [new tag] v1.6.8.7 -> v1.6.8.7
* [new tag] v1.6.8.8 -> v1.6.8.8
* [new tag] v1.6.8.9 -> v1.6.8.9
* [new tag] v1.6.9 -> v1.6.9
* [new tag] v1.6.9.1 -> v1.6.9.1
* [new tag] v1.6.9.2 -> v1.6.9.2
* [new tag] v1.6.9.3 -> v1.6.9.3
Getting manifest …
from git://android.git.kernel.org/platform/manifest.git

ubuntu运行zhcon后死机

tek-life — Fri, 30 Apr 2010 03:23:20 +0000

解决方法：zhcon –utf8 –drv=vga

These critical programs are missing or too old: as ld

tek-life — Thu, 29 Apr 2010 12:57:04 +0000

在安装交叉编译工具的时候，提示这个错误，因为binutils版本为2.20，因此会出现ld,as 版本不搭配的错误，其实这一点在glibc 的configure里面可以看到。

在google里面看到大多数人都是pathch的方法。我的办法是在我用的ubuntu 9.10系统里面重新安装binuntils 2.19版本，等安装完交叉编译链后，再重新将binuntils 升级为2.20即可。

制作initrd

tek-life — Thu, 22 Apr 2010 00:51:29 +0000

首先，制作Initrd，需要了解，inidrd是什么，它由什么构成的。
然后，我们会发现，在嵌入式的Initrd中 busybox是一个非常常用的工具，可是，到底busybox在制作initrd中扮演什么样的角色呢？
其实，initrd只是引入了一些应用程序而已，只是，这些应用程序做的很好，体积很小。当然，因为它是缩水版的，于是，一些功能就没有啦，比如 ls -al ,就只相当于ls.
因此，不要指望busybox能够做所有的事情。
我们还需要做一些必要的目录，比如 etc lib 等。
下面是我做Initrd的一些步骤。其中，参考了cublog上的一篇日志。

http://blog.chinaunix.net/u2/70445/showart_1163143.html

转载，请注明。
首先下载busybox1.9.1版本，然后解压缩，相信大家都会。然后step by step
1、更改busybox1.9.1的Makefile
ARCH ?=arm
CROSS_COMPILE?= 自己的交叉编译环境的位置我的是：/opt/crosstool/gcc-4.1.0-glibc-2.3.2/arm-linux/bin/arm-linux-
2、make menuconfig
Busybox Setting—–>
build option–>
[ ] Build BusyBox as a static binary (no shared libs)

Build shared libbusybox

Produce a binary for each applet, linked against libbusybox

Produce additional busybox binary linked against libbusybox
[ ] Build with Large File Support (for accessing files > 2 GB)

installation option–>

Don’t use /usr
Applets links (as soft-links) —>
(./_install) BusyBox installation prefix

Busybox Library Tuning —>

MD5: Trade Bytes for Speed

Faster /proc scanning code (+100 bytes)

Support for /etc/networks

Additional editing keys

vi-style line editing commands

History saving

Tab completion

Username completion

Fancy shell prompts

Linux Module Utilities —>

Support version 2.6.x Linux kernels

insmod

Enable load map (-m) option

Symbols in load map

rmmod

lsmod

lsmod pretty output for 2.6.x Linux kernels

modprobe
[ ] Multiple options parsing
[ ] Fancy alias parsing
— Options common to multiple modutils
[ ] Support tainted module checking with new kernels
[ ] Support version 2.2.x to 2.4.x Linux kernels

Support version 2.6.x Linux kernels

其他的用默认值

3、make install 开始安装
在busybox的根目录下生成_install文件夹，里面的东西有3项：bin sbin linuxrc

4、修改安装Busybox后的busybox文件属性，具体原因，随后再续。
chmod 4755 ./_install/bin/busybox
5、在自己的home目录中，建立rootfs目录
将_install的内容拷贝到rootfs目录中

6、在rootfs目录下，建立空目录：
dev home proc tmp var
boot etc lib mnt root sys usr
7、此时 rootfs目录下有如下内容：
bin dev home linuxrc proc sbin tmp var
boot etc lib mnt root sys usr
8、
以root身份建立节点文件/dev/console, /dev/null
mknod -m 600 dev/console c 5 1
mknod -m 666 dev/null c 1 3

9、进入etc目录，建立profile文件，内容如下：
#!/bin/sh
#/etc/profile:system-wide .profile file for the Bourne shells

echo
echo -n “Processing /etc/profile……”

# Set search library path
export LD_LIBRARY_PATH=/lib:/usr/lib

# set user path
export PATH=/bin:/sbin:/usr/bin:/usr/sbin

#Set PS1
USER = “`id -un`”
LOGNAME=$USER
PS1=’[\u@\h\W]\$’
PATH=$PATH

echo “Done!”
10、
在etc目录下建立init.d目录，然后在init.d目录下建立rcS文件
init.d/rcS内容：
#!/bin/sh

# set hostname, needed host file in /etc directory
#./etc/host
hostname `cat /etc/host`

# mount all filesystem defined in “fstab”
echo “#mount all…….”
/bin/mount -a

#+/bin/chmod 0666 /dev/null

echo “# starting mdev….”
/bin/echo /sbin/mdev > /proc/sys/kernel/hotplug
mdev -s

/usr/etc/init

echo “******************************************”
echo ” ”
echo ” ”
echo ” ”
echo “******************************************”

11、在etc目录下建立fstab文件
proc /proc proc defaults 0 0
none /tmp ramfs defaults 0 0
none /var ramfs defaults 0 0
mdev /dev ramfs defaults 0 0
sysfs /sys sysfs defaults 0 0
12、在etc目录下建立inittab文件
::sysinit:/etc/init.d/rcS
::respawn:-/bin/sh

tty2::askfirst:-/bin/sh

::ctrlaltdel:/bin/umount -a -r

::shutdown:/bin umount -a -r
::shutdown:/sbin/swapoff -a
13、在etc目录下建立空文件
mdev.conf
14、
复制主机/etc/下面的文件passwd, group, shadow文件到/etc
[root@centos etc]# cp /etc/group .
[root@centos etc]# cp /etc/passwd .
[root@centos etc]# cp /etc/shadow .
15、
因为是编译的时候使用的是动态链接。所以先看看~/busybox/_install/bin/busybox使用了哪些 lib，然后从glibc复制相应的lib到~/fsroot/lib中。
[root@centos bin]# /usr/local/arm/3.4.1/arm-linux-gnu-readelf -d busybox
Dynamic section at offset 0xb8014 contains 22 entries:
Tag Type Name/Value
0×00000001 (NEEDED) Shared library:[libcrypt.so.1]
0×00000001 (NEEDED) Shared library: [libm.so.6]
0×00000001 (NEEDED) Shared library: [libc.so.6]
0x0000000c (INIT) 0xc04c
0x0000000d (FINI) 0xa26f0
0×00000004 (HASH) 0x80e8
0×00000005 (STRTAB) 0xa384
0×00000006 (SYMTAB) 0x8b24
……
……
……
复制lib 文件到lib目录下：
[root@centos lib]cp /usr/local/arm/3.4.1/arm-linux/lib/ld* .
[root@centos lib]cp /usr/local/arm/3.4.1/arm-linux/lib/libc-2.3.2.so .
[root@centos lib]cp /usr/local/arm/3.4.1/arm-linux/lib/libc.so.6 .
[root@centos lib]cp /usr/local/arm/3.4.1/arm-linux/lib/libm * .
[root@centos lib]cp /usr/local/arm/3.4.1/arm-linux/lib/libcrypt* .
16、进入busybox根目录下，进入usr目录下，建立etc目录
在该etc目录下建立init文件
#!/bin/sh
ifconfig eth0 192.168.1.111 up
ifconfig lo 127.0.0.1

17、 mkcramfs fsroot fs_2.6.26_busybox.cramfs
18、利用之前编译好的zImage引导操作系统

讨论贴：

http://linux.chinaunix.net/bbs/thread-1162326-1-1.html

[转]研究生如何拥有并保持自信

tek-life — Wed, 21 Apr 2010 08:55:41 +0000

虽然年龄不小了，但刚进实验室的研究生，仍然是个“孩子”，刚离开按部就班的课堂，手上就捧一个啥都要探索的课题，不要说动手，即使思想转变也需要时日，因此， “不知道”、“不懂”、“不会”常挂嘴边、常上心头。

其实这“三不”倒没什么，什么都可以慢慢学、慢慢做嘛，导师再怎么催、甚至骂，也不至于要命吧？但是，对学生自己，倒有一点致命：自信心慢慢磨没了。没有自信心，轻者消沉、重者浮躁、再重就要出人命了。

网上的很多学生抱怨自己的导师打击自己的自信心，说连导师自己都不知道怎么做，还急于向学生要结果！这其实是个“借口”，而不是导致学生失去自信心的理由。

自信心是谁给的呢？有的人可能觉得是老板给的，老板一味迁就、手把手的教导、热心鼓励、不吝表扬等等，的确能让人感觉浑身来劲，精神备足。很可惜的是，这不是“自信”，而是“他信”，他人（老板）加在你身上的 “信”！拿他信当自信，这是很多研究生容易犯的一个想当然的美丽错误。

“他信”是别人给的，说没有就没有，一收走就立刻完蛋。“自信”是自己挣来的，谁也拿不走，自己想不要都不行。前者是施舍，施舍的东西最靠不住；后者是本领，有本领这个本钱才算是有“奔”的头。

因此，对研究生来说，最重要的就是要靠自己的本领“挣”得自信，而不是靠别人施舍，只有这样的自信才能长久保持。实验室是个“雷区”，无论导师还是学生，都要亲自去趟雷，老是踩到雷，炸的魂飞魄散，肯定会害怕，越害怕越不敢走，如此恶性循环，最后就会吓出神经病，毫无自信可言。那么如何才能避免踩雷而挣得属于自己的自信呢？很简单：

一不能“不懂装懂”：古人云：知之为知之，不知为不知；俗话又说：不知者不怪。你不知道的事情，不要装作精通；不懂的事情，不要装作内行。科学研究都是实打实的真刀实枪，不是水中月镜中花的文字游戏。不知道就是不知道，这不丢人；明明不知道，还硬着头皮说知道，点头如捣蒜，殊不知一句话就能漏马脚，那才丢人呢！

与导师或同行讨论问题，千万不能“装”，不懂的一定要明说。多数导师都有个毛病：学生越是不知道，他教的就越来劲，呵呵！老师问“懂了吗？”学生要是随口回答“懂了”，老师会很失落的：）要是发现你不懂装懂，那就会失望的！因此，老师派你趟雷，不要轻易说“没问题”，其实问题一大堆，“懂”就是“咚”的一声谁头皮硬谁先玩完呀：）

二不能“一错再错”：说实话，做研究就是个“试错”的过程，错误无处不在、无时不在。如果说一个科学家的成就与他的犯错率成正比，恐怕还是很合适的。在一定程度上说，错误不可怕，没有错误那才可怕呢！因此，科学研究中出错是常态，不出错才是异常！这个“错”是好事，越错自信心会越强。

但是，话说回来，“一错再错”就成了打击自信心的狙击枪！同一个错误，今天犯了，明天还犯，后天还犯，这就是错上加错，不可原谅了。在趟雷的路上，哪儿跌倒了哪儿再爬起来继续前进；如果明明知道那里是个雷，还是一脚踏上去，这就是傻了。长此以往，自己就会怀疑自己是不是做科研的料？不要说“自信”，连“他信”估计都不会有了！

三不能“得过且过”：人都说科学研究靠兴趣，但限于目前的体制，不是每个研究生都能对自己的课题具有浓厚的兴趣。调剂来调剂去的，够累不说，还要硬撑着过下去，就当下的行情，换导师也不是一幅良药。即使有兴趣，但苦于学业的压力、老板的催促，得过且过的事常有发生。明明没做的实验点，偏偏说做过了；明明没看的文献，偏偏说读过了，只求今天能躲过老板的检查就好，明天再说吧！这些都是科研之大忌，即使是急功近利的老板，他也不愿意看到学生如此！科学研究也要按部就班，不能超近道。做不出来就是做不出来，另谋出路就是了，没必要做假。明明没把雷挖出来就说没事，结果后来人一脚踩上，你说谁负这个责任呢？实在没有路可走了，那就趁早退一步，海阔天空，总比害人又害己好千万倍呀！

如果说“不懂装懂”是摧毁自信心的定时炸弹，“一错再错”是瞄准自信心的狙击步枪，那么“得过且过”就是杀死自信心的慢性毒药。要想拥有长久的自信，请远离这三样东西吧！

交叉编译linux内核 for arm 出现错误

tek-life — Tue, 20 Apr 2010 07:44:26 +0000

1、下载内核源码后，更改Makefile文件，更改
ARCH ?=arm
CROSS_COMPILE?=交叉编译工具的目录

2、然后拷贝arch/arm/configs/versatile_defconfig到源文件根目录下面命名为.config
cp arch/arm/configs/versatile_defconfig .config

3、然后make menuconfig ，这一步不用管，退出保存即可

4、然后make,这一步会产生vmlinux文件。

5、然后make zImage,会在arch/arm/boot/目录下产生 zImage，kernel就这样产生了。

6、编译出内核以后，开始编译initrd.img文件

7、在/lib/modules/目录下产生相应的模块文件
sudo modules_install

8、产生initrd.img-2.6.26的引导文件
mkinitramfs -o /boot/initrd.img-2.6.26 2.6.26

在/boot目录下，看了一下initrd.img-2.6.26，好大快5M了。

引导后，出现错误：

request_module: runaway loop modprobe

循环4次，就开始打印错误信息。

一张美图–vim快捷键

tek-life — Sun, 18 Apr 2010 05:43:08 +0000

qemu 模拟Linux 2.6.30

tek-life — Tue, 13 Apr 2010 03:52:32 +0000

1、获取引导安装的initrd.gz 和引导的内核 vmlinuz
URL:http://ftp.nl.debian.org/debian/dists/testing/main/installer-armel/current/images/versatile/netboot/

我把这两个文件上传到google code了.–因为,这个文件经常会更新,所以,为了保证童鞋们能够用下面的step by step ,so …. ,save it for myself and ourselves.

http://code.google.com/p/emulate-linux-on-qemu-for-arm/downloads/list

2、制作模拟的磁盘

qemu-img create –f hda.img 10G

3、开始安装啦，很振奋人心滴

qemu-system-arm -M versatilepb -kernel vmlinuz-2.6.30-2-versatile -initrd initrd.gz -hda hda.img -append “root=/dev/ram”

抓一个图，以示之。

4、当安装结束以后，我们会发现，没有引导系统用的initrd.怎么办？用2.6.26.1的initrd。

然后就启动起来啦。启动起来后，通过其他的方法，把vmlinuz和Initrd拷贝出来，启动用。

Grub对多硬盘的处理

tek-life — Mon, 12 Apr 2010 13:10:15 +0000

1、若多个硬盘，那么从hd0,开始往后排，hd0,hd1,hd2,hd3… Grub不管是SCSI还是IDE，一律是hd打头。

2、Grub对硬盘的编号和Linux的不一样。MBR在那个磁盘，哪个磁盘就是hd0,而Linux是按照IDE或者SCSI顺序hda,hdb,hdc。较新版本的Linux把IDE硬盘和SCSI硬盘都当作sd来处理了。于是，便是sda,sdb,sdc…了。

技巧：在GRUB里面，不知道有几个磁盘，那么输入 boot (hd 后按TAB键，便会有提示啦～。

启动Qemu,VNC server running on `::1:5901′

tek-life — Sun, 11 Apr 2010 14:06:27 +0000

The Qestion & Answer:

>>when I type the commandline  "qemu -hda hda.img -boot d"
>> Error happens.
>> The scene is :
>>  >> omycle@ubuntu:~$ sudo qemu -hda hda.img  -boot d
>> VNC server running on `::1:5901'    -------just show this line.And
>> then nothing happens .
>
>You should use VNC to connect to localhost :1
>
>> who can tell me why?
>
>You probably haven't compiled QEMU with libsdl, so it defaults to VNC
>mode.

安装 libsdl

sudo apt-get install libsdl1.2-dev

重新编译qemu

即可

远程查看ubuntu 9.10 桌面

tek-life — Fri, 09 Apr 2010 01:40:24 +0000

通常情况下，我们用Putty查看的是字符界面。如何查看远程桌面呢？
通过VNC

对于服务器，要安装VNCSERVER

对于客户端，要安装VNCVIEWER

具体步骤：

对于服务器：

1.安装VNC服务端组件：

$ sudo apt-get install vnc4-common vnc4server

2、设置VNC登录密码

$ vncpasswd

3、修改vnc的默认设置，使启动时运行gnome作为X的桌面

$ vncserver :1

$ vncserver -kill :1

注意：里面的":1"代表display号，客户登录的时候得写相同的display号才能登录（见后面客户端部分）。
4、修改~/.vnc/xstartup文件，建议拷贝系统中Xsession的配置文件：

$ cp /etc/X11/Xsession ~/.vnc/xstartup

5、再次启动VNC SERVER：//因为我们要测试一下哈

$ vncserver :1

对于客户端：

1、安装客户端组件

$ sudo apt-get install vnc4-common xvnc4viewer

2、登录吧

$ vncviewer 192.168.227.110:1

要输入密码

记得，如果你在windows桌面的话，要在windows环境下安装XMING，然后再putty.

Qemu支持的ARM系列

tek-life — Tue, 06 Apr 2010 09:37:23 +0000

对于ARM来说，目前的SVN的版本中(2008-10-07)支持的SOC/machine包括:
(1)    integratorcp: ARM Integrator/CP (ARM926EJ-S)
(2)    versatilepb: ARM Versatile/PB (ARM926EJ-S)
(3)    versatileab: ARM Versatile/AB (ARM926EJ-S)
(4)    realview: ARM RealView Emulation Baseboard (ARM926EJ-S)
(5)    akita: Akita PDA (PXA270)
(6)    spitz: Spitz PDA (PXA270)
(7)    borzoi: Borzoi PDA (PXA270)
(8)    terrier: Terrier PDA (PXA270)
(9)    cheetah: Palm Tungsten|E aka. Cheetah PDA (OMAP310)
(10)    n800: Nokia N800 tablet aka. RX-34 (OMAP2420)
(11)    n810: Nokia N810 tablet aka. RX-44 (OMAP2420)
(12)    lm3s811evb: Stellaris LM3S811EVB
(13)    lm3s6965evb: Stellaris LM3S6965EVB
(14)    connex: Gumstix Connex (PXA255)
(15)    verdex: Gumstix Verdex (PXA270)
(16)    mainstone: Mainstone II (PXA27x)
(17)    musicpal: Marvell 88w8618 / MusicPal (ARM926EJ-S)
(18)    tosa: Tosa PDA (PXA255)

Why cann’t we remove the ZONE_DMA from Linux

tek-life — Mon, 05 Apr 2010 09:47:34 +0000

ZONE_DMA设置的原因是因为，当年主板上的ISA总线中的DMA控制器只能寻址24位物理地址，因此最多能够寻址到16MB的地方。现在，随着硬件的发展，ISA早已经成为历史。可是，为什么现在还要保留着ZONE_DMA区呢？

这是在linux-kernel mail list上的答案：

http://lkml.org/lkml/2010/4/4/2

While ISA is gone as a true peripheral interconnect for new systems it does,
actually, still live on in a lot of systems that Linux still supports. While
those systems, generally, are running the same kernel and userspace they were
a decade ago I have no doubt that somebody might find an old machine and put
Linux on it - just because they could.

And that also discounts the non-IBM PC machines that are out there that Linux
also supports. While I don't know enough about them to say for sure, I am
quite certain that at least some of them are still using the ISA bus.

DRH

> Thanks for your reply.And do you means that , If I use a modern PC,such as
> my pc (CPU:Intel dual-core 2.6GHZ; Memory 2GB; And no pci ).I can remove
> the ZONE_DMA .And make sure this system also run smoothly as before?

*MAYBE* - if you don't use parallel ports, floppy drives or similar. There
actually are still a lot of devices that use the ISA bus in a modern PC - even
the keyboard (well, not USB ones) is an ISA device.

Simple fact is that if it was possible to configure it out and not cause
massive problems somebody would have already spun out a patch to allow just
that. 

DRH

Incorrect about that. The i810 chipset doesn’t support the ISA bus as an
*EXPANSION* *BUS* – it does, however, have an internal ISA bus that happens to
be hardwired for certain chips. Among those chips is the keyboard controller
that is a part of the PS/2 keyboard and mouse system. But for those components
that do DMA… Look at the parallel port and the floppy drive – both
(technically) live on the ISA bus.
But I’m not a hardware expert by any stretch – most of what I know is gleaned
from reading code and manual. However… the bits I’m talking about have
interfaces that are, for the most part, carved in stone. Changing them would
require adding circuitry to allow the existing interface continued function -
so I doubt anyone has changed them. (I mean… it’d be almost stupid – have
you ever really looked at the amount of real-estate on a modern MB devoted to
nothing but making sure traces are properly routed? There is a reason they
talk about boards being “4 layer” and such…)
DRH

---------------------

Last I heard this discussed it was mentioned that there were some
fairly common integrated sound devices using ISA DMA.

As for the i810 chipset not supporting ISA that isn't really true.  No
one implements ISA plug-in slots, but at least in the for of LPC
hardware that is effectively ISA continues to be supported for various
legacy devices.

Ultimately I don't see much point in disabling ZONE_DMA.  It is a lot of
work to track down if it is really needed, and it only costs 16MB.  So
unless someone shows me that ZONE_DMA triggers the OOM killer unnecessarily
or otherwise impacts the system what does legacy code hurt?

Eric

---------------------

Some onboard motherboard devices may also be ISA devices.

Thomas Fjellstrom

———————————-

Floppy disks & paralell ports still use DMA

	Regards
		Oliver

————————————

There are a couple of reasons to keep ZONE_DMA. It is not used by ISA
device drivers exclusivly. Old style PCI devices may have small DMA
masks (so they could address between 16 MB and 4GB depending on the
device) too. Drivers for these devices often use ZONE_DMA as a fallback
if they can't allocate memory addressable by the device using
ZONE_NORMAL. So there is a use for ZONE_DMA with 32bit PCI too.
(And I also remember I have seen an AM2 board with an ISA slot for
 embedded purposes too, so ISA is not completly dead)

	Joerg

————————————–

I think Joerg is right. In short wods, ZONE_DMA is not only an relative thing to ISA devices. ISA devices need it in the ancient board because they could not refer to all the memory addresses which are usually 32-bit, on the contrary, ISA devices just use 24-bit address. ZONE_DMA serves those kmalloc call with GFP_DMA and __GFP_DMA flags, and that is the true meaning of it.
It is not reasonable to truncate ZONE_DMA, because although it could be defined as a size of 16MB, the actual size of DMA transferring region is decided by the watermark of ZONE_NORMAL. It is saying that a part of ZONE_DMA could be used as ZONE_NORMAL memory when lowmem_reserved_ratio is set to a certain value. Refer to Documentation/sysctl/vm.txt for more information.
Best regards,
–
Adam Jiang

总结以上大牛的观点，我分析如下：

1、现在的一些机器必须使用ISA插槽的主板，比如税务部门，他们需要使用税控卡，税控卡有很多是ISA插槽的，另外，对于部分主板集成的声卡，内部也在使用ISA总线。我听说还有工程控制卡，用于工程监控，也是ISA接口的。

2、虽然在有些机器中，没有使用ISA扩展总线，但是ZONE_DMA仍然有它的作用：
若ZONE_NORMAL区中的内存量不足的话，ZONE_DMA就会被当作ZONE_NORMAL区来使用。