首页 > 代码库 > ARMv8 Linux内核异常处理过程分析
ARMv8 Linux内核异常处理过程分析
NOTE：为了方便大家阅读，制作了PDF版文档，下载请猛戳这里
老样子，为了赚点积分下载其他人的文件，下载以上资料需要资源分2分， 如果没有积分请留言所有文档，留下邮箱即可。
看了Linaro提供的开源ARMv8 Linux内核源码，发现ARMv8异常处理与ARMv7及之前的架构有所不同，简单分析。
LinaroARMv8工程：http://www.linaro.org/engineering/engineering-projects/armv8
1.1 Linux内核异常处理相关文件
Linux内核中，异常处理主要由两个文件完成，entry.S和traps.c，当然还有一些其它异常处理函数分布于fault.c, memory.c等等。entry.S包含异常的入口、进入异常处理C函数前的压栈、退出C函数前的出栈、一些fork函数相关的处理代码（暂不分析）、任务切换汇编处理过程（cpu_switch_to函数，暂不分析）。traps.c主要包含异常处理C函数。
本文主要分析entry.S，对于traps.c作简要介绍。
1.2 执行kernel_entry之前的栈
1.3 执行kernel_entry时的栈
1.4 执行kernel_exit 时的栈
1.5 entry.s代码分析
/*
* Low-level exception handling code
*
* Copyright (C) 2012 ARM Ltd.
* Authors: CatalinMarinas <catalin.marinas@arm.com>
* WillDeacon <will.deacon@arm.com>
*
* This program is free software; you canredistribute it and/or modify
* it under the terms of the GNU General PublicLicense version 2 as
* published by the Free Software Foundation.
*
* This program is distributed in the hope thatit will be useful,
* but WITHOUT ANY WARRANTY; without even theimplied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULARPURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNUGeneral Public License
* along with this program. If not, see<http://www.gnu.org/licenses/>.
*/
#include<linux/init.h>
#include<linux/linkage.h>
#include<asm/assembler.h>
#include<asm/asm-offsets.h>
#include<asm/errno.h>
#include<asm/thread_info.h>
#include<asm/unistd.h>
#include<asm/unistd32.h>
/*
* Bad Abort numbers
*-----------------
*/
#defineBAD_SYNC 0
#defineBAD_IRQ 1
#defineBAD_FIQ 2
#defineBAD_ERROR 3
//根据该结构体内容
/*
structpt_regs {
union {
struct user_pt_regs user_regs;//结构体user_pt_regs和结构体pt_regs内容一样
struct { //共用体存储31个通用寄存器,外加sp,pc,pstate三个特殊寄存器
//该结构体用于异常处理的压栈弹栈操作
u64 regs[31];
u64 sp;
u64 pc;
u64 pstate;
};
};
u64 orig_x0;
u64 syscallno;
};
*/
//S_FRAME_SIZE定义在asm-offsets.c中，DEFINE(S_FRAME_SIZE,sizeof(structpt_regs));
//即结构体pt_regs的大小，结构体pt_regs的定义见上面
//S_LR定义：DEFINE(S_LR,offsetof(structpt_regs, regs[30]));
//即31号寄存器在结构体pt_regs中的偏移量
//阅读以下内容请参考图1 和图2
.macro kernel_entry,el, regsize = 64
sub sp,sp, #S_FRAME_SIZE - S_LR // room for LR,SP, SPSR, ELR，见图2中sp‘指向的位置
.if \regsize== 32
mov w0,w0 // zero upper 32bits of x0
.endif
/*
*.macro push,xreg1, xreg2 //压栈两个寄存器
*stp \xreg1,\xreg2, [sp, #-16]! //注意！！！push指令也改变sp的值！！！
*.endm
*/
push x28,x29 //进行压栈操作，push也是一个宏定义，因为ARMv8没有push指令，用stp代替
push x26,x27
push x24,x25
push x22,x23
push x20,x21
push x18,x19
push x16,x17
push x14,x15
push x12,x13
push x10,x11
push x8,x9
push x6,x7
push x4,x5
push x2,x3
push x0,x1 //此时sp指向位置见图2中sp‘‘
.if \el== 0 //如果异常级是el0，把el0的sp栈指针给x21寄存器
mrs x21,sp_el0
.else
add x21,sp, #S_FRAME_SIZE //如果异常级不是el0,把sp指针指向的地方加上pt_regs大小后的地址放入x21，
//即指向没进入kernel_entry函数钱的sp指向的位置，见图2中x21指向的地址
.endif
mrs x22,elr_el1 //把el1的lr寄存器给x22
mrs x23,spsr_el1 //把spsr给x23
stp lr,x21, [sp, #S_LR] //把lr，x21寄存器存入sp+S_LR指向的地方
stp x22,x23, [sp, #S_PC] //把lr，存入sp+s_PC指向的位置，用于异常返回
/*
*Set syscallno to -1 by default (overridden later if real syscall).
*/
.if \el== 0
mvn x21,xzr
str x21,[sp, #S_SYSCALLNO]
.endif
/*
*Registers that may be useful after this macro is invoked:
*
*x21 - aborted SP
*x22 - aborted PC
*x23 - aborted PSTATE
*/
.endm
.macro kernel_exit,el, ret = 0
//把此时sp（即图2中sp‘‘）+S_PC位置处开始的16字节内容分别给x21,x22
//即把栈中存的x21和x22内容取出来
ldp x21,x22, [sp, #S_PC] // load ELR,SPSR
.if \el== 0
ldr x23,[sp, #S_SP] // load return stackpointer，取出
.endif
.if \ret
ldr x1,[sp, #S_X1] // preserve x0(syscall return)，如果ret=1，则保存x0，用于系统调用，暂不分析
add sp,sp, S_X2
.else
pop x0,x1 //如果ret=0，弹出x0,x1
.endif
pop x2,x3 // load therest of the registers
pop x4,x5
pop x6,x7
pop x8,x9
msr elr_el1,x21 // set up the returndata，把前面弹出的x21,x22分别赋值给elr_el1,spsr_el1
msr spsr_el1,x22
.if \el== 0
msr sp_el0,x23
.endif
pop x10,x11
pop x12,x13
pop x14,x15
pop x16,x17
pop x18,x19
pop x20,x21
pop x22,x23
pop x24,x25
pop x26,x27
pop x28,x29
ldr lr,[sp], #S_FRAME_SIZE - S_LR // load LR andrestore SP，把lr弹出
eret //return to kernel，异常返回，该指令会把lr给pc，完成跳转
.endm
.macro get_thread_info,rd
mov \rd,sp
and \rd,\rd, #~((1 << 13) - 1) // top of 8Kstack
.endm
/*
* These are the registers used in the syscallhandler, and allow us to
* have in theory up to 7 arguments to afunction - x0 to x6.
*
* x7 is reserved for the system call number in32-bit mode.
*/
sc_nr .req x25 // number of system calls
scno .req x26 // syscall number
stbl .req x27 // syscall table pointer
tsk .req x28 // current thread_info
/*
* Interrupt handling.
*/
.macro irq_handler
ldr x1,handle_arch_irq
mov x0,sp
blr x1
.endm
.text
/*
* Exception vectors.
*/
.macro ventry label //这里是2^7对齐，即对齐到内存地址的0x80
.align 7
b \label
.endm
.align 11
/*ENTRY也是一个宏，定义在include/linkage.h中
*#ifndef ENTRY
*#define ENTRY(name) \
*.globl name; \
*ALIGN; \
*name:
*#endif
*/
ENTRY(vectors)
ventry el1_sync_invalid // Synchronous EL1t,ventry 是一个宏，见上面定义
ventry el1_irq_invalid // IRQ EL1t，这个版本的内核，对于XXX_invalid类异常都是不真正处理的。这里以el1_irq_invalid进行分析
ventry el1_fiq_invalid // FIQ EL1t
ventry el1_error_invalid // Error EL1t
ventry el1_sync // Synchronous EL1h，以el1级发生同步异常为例，详细分析内核异常处理过程
ventry el1_irq // IRQ EL1h
ventry el1_fiq_invalid // FIQ EL1h
ventry el1_error_invalid // Error EL1h
ventry el0_sync // Synchronous 64-bit EL0
ventry el0_irq // IRQ 64-bit EL0
ventry el0_fiq_invalid // FIQ 64-bit EL0
ventry el0_error_invalid // Error 64-bit EL0
#ifdefCONFIG_COMPAT
ventry el0_sync_compat // Synchronous 32-bit EL0
ventry el0_irq_compat // IRQ 32-bit EL0
ventry el0_fiq_invalid_compat // FIQ 32-bit EL0
ventry el0_error_invalid_compat // Error 32-bit EL0
#else
ventry el0_sync_invalid // Synchronous 32-bit EL0
ventry el0_irq_invalid // IRQ 32-bit EL0
ventry el0_fiq_invalid // FIQ 32-bit EL0
ventry el0_error_invalid // Error 32-bit EL0
#endif
END(vectors)
/*
* Invalid mode handlers
*/
.macro inv_entry,el, reason, regsize = 64
kernel_entry el, \regsize //kernel_entry是宏，主要完成寄存器压栈操作。
mov x0,sp //x0,x1,x2是传给函数bad_mode函数的参数。sp是当前栈指针。
mov x1,#\reason //x1是发生异常的原因，用于读取一个结构体，在函数bad_mode中会介绍
mrs x2,esr_el1 //通过分析bad_mode及其他函数，确定esr_el1是el1级异常分类寄存器，
//用于在一个大类异常（例如syc异常）中细分异常类型
b bad_mode
.endm
el0_sync_invalid:
inv_entry 0, BAD_SYNC
ENDPROC(el0_sync_invalid)
el0_irq_invalid:
inv_entry 0, BAD_IRQ
ENDPROC(el0_irq_invalid)
el0_fiq_invalid:
inv_entry 0, BAD_FIQ
ENDPROC(el0_fiq_invalid)
el0_error_invalid:
inv_entry 0, BAD_ERROR
ENDPROC(el0_error_invalid)
#ifdefCONFIG_COMPAT
el0_fiq_invalid_compat:
inv_entry 0, BAD_FIQ, 32
ENDPROC(el0_fiq_invalid_compat)
el0_error_invalid_compat:
inv_entry 0, BAD_ERROR, 32
ENDPROC(el0_error_invalid_compat)
#endif
el1_sync_invalid:
inv_entry 1, BAD_SYNC
ENDPROC(el1_sync_invalid)
el1_irq_invalid:
inv_entry 1, BAD_IRQ //inv_entry是一个宏定义，主要工作就是将寄存器压栈后跳到bad_mode函数运行。
//后面紧跟的1代表异常级是el1，即内核态。
//BAD_IRQ定义在前面，值为1，代表发生异常的原因
ENDPROC(el1_irq_invalid)
el1_fiq_invalid:
inv_entry 1, BAD_FIQ
ENDPROC(el1_fiq_invalid)
el1_error_invalid:
inv_entry 1, BAD_ERROR
ENDPROC(el1_error_invalid)
/*
* EL1 mode handlers.
*/
.align 6
el1_sync:
kernel_entry 1 //把寄存器信息压栈
//读异常类型寄存器
mrs x1,esr_el1 // read thesyndrome register
//逻辑右移26位，取31-27位
lsr x24,x1, #26 // exception class
//判断异常类型
cmp x24,#0x25 // data abort in EL1
//如果是el1的数据中止（data_abort）异常，跳转到el1_da标号处
b.eq el1_da
cmp x24,#0x18 // configurable trap
b.eq el1_undef
cmp x24,#0x26 // stack alignmentexception
b.eq el1_sp_pc
cmp x24,#0x22 // pc alignmentexception
b.eq el1_sp_pc
cmp x24,#0x00 // unknown exceptionin EL1
b.eq el1_undef
cmp x24,#0x30 // debug exceptionin EL1
b.ge el1_dbg
b el1_inv
el1_da:
/*
*Data abort handling，数据中止异常处理函数
*/
mrs x0,far_el1 //看过函数do_mem_abort内容后确定，far_el1寄存器是异常地址寄存器
/* 该宏定义在arm64/include/asm/assembler.h中：
*.macro enable_dbg_if_not_stepping, tmp
*mrs \tmp, mdscr_el1 //通过该宏名称确定，mdscr_el1寄存器是关于硬件debug的，不影响异常处理不分析
*tbnz \tmp, #1, 9990f
*enable_dbg
*9990:
*.endm
*/
//通过以上内容及该宏名称可以猜测，其作用只是根据条件决定是否开启dbg模式，不影响异常执行，不做分析
enable_dbg_if_not_stepping x2
// re-enable interrupts if they wereenabled in the aborted context
//根据x23(在kernel_entry中定义，存储spsr的值)判断是否开启中断
tbnz x23,#7, 1f // PSR_I_BIT
enable_irq
1:
mov x2,sp // structpt_regs，sp中存储的是执行完kernel_entry后的值，其指向压栈后的栈顶，作为参数传给函数do_mem_abort
//do_mem_abort函数在arm64/mm/fault.c中，分析见代码最后面
bl do_mem_abort //传给该函数的x0发生异常的地址信息，x1是异常类型，x2就是压入栈中的寄存器堆首地址。
// disable interrupts before pulling preserveddata off the stack
disable_irq
kernel_exit 1 //异常返回，把所有压入栈中的寄存器弹出。对应于kernel_entry。
el1_sp_pc:
/*
*Stack or PC alignment exception handling
*/
mrs x0,far_el1
mov x1,x25
mov x2,sp
b do_sp_pc_abort
el1_undef:
/*
*Undefined instruction
*/
mov x0,sp
b do_undefinstr
el1_dbg:
/*
*Debug exception handling
*/
tbz x24,#0, el1_inv // EL1 only
mrs x0,far_el1
mov x2,sp // structpt_regs
bl do_debug_exception
kernel_exit 1
el1_inv:
// TODO: add support for undefined instructionsin kernel mode
mov x0,sp
mov x1,#BAD_SYNC
mrs x2,esr_el1
b bad_mode
ENDPROC(el1_sync)
.align 6
el1_irq:
kernel_entry 1
enable_dbg_if_not_stepping x0
#ifdefCONFIG_TRACE_IRQFLAGS
bl trace_hardirqs_off
#endif
#ifdefCONFIG_PREEMPT
get_thread_info tsk
ldr x24,[tsk, #TI_PREEMPT] // getpreempt count
add x0,x24, #1 // increment it
str x0,[tsk, #TI_PREEMPT]
#endif
irq_handler
#ifdefCONFIG_PREEMPT
str x24,[tsk, #TI_PREEMPT] // restorepreempt count
cbnz x24,1f // preempt count!= 0
ldr x0,[tsk, #TI_FLAGS] // get flags
tbz x0,#TIF_NEED_RESCHED, 1f // needsrescheduling?
bl el1_preempt
1:
#endif
#ifdefCONFIG_TRACE_IRQFLAGS
bl trace_hardirqs_on
#endif
kernel_exit 1
ENDPROC(el1_irq)
#ifdefCONFIG_PREEMPT
el1_preempt:
mov x24,lr
1: enable_dbg
bl preempt_schedule_irq // irq en/disable is done inside
ldr x0,[tsk, #TI_FLAGS] // get newtasks TI_FLAGS
tbnz x0,#TIF_NEED_RESCHED, 1b // needsrescheduling?
ret x24
#endif
/*
* EL0 mode handlers.
*/
.align 6
el0_sync:
kernel_entry 0
mrs x25,esr_el1 // read the syndromeregister
lsr x24,x25, #26 // exceptionclass
cmp x24,#0x15 // SVC in 64-bitstate
b.eq el0_svc
adr lr,ret_from_exception
cmp x24,#0x24 // data abort in EL0
b.eq el0_da
cmp x24,#0x20 // instruction abortin EL0
b.eq el0_ia
cmp x24,#0x07 // FP/ASIMD access
b.eq el0_fpsimd_acc
cmp x24,#0x2c // FP/ASIMDexception
b.eq el0_fpsimd_exc
cmp x24,#0x18 // configurable trap
b.eq el0_undef
cmp x24,#0x26 // stack alignmentexception
b.eq el0_sp_pc
cmp x24,#0x22 // pc alignmentexception
b.eq el0_sp_pc
cmp x24,#0x00 // unknown exceptionin EL0
b.eq el0_undef
cmp x24,#0x30 // debug exceptionin EL0
b.ge el0_dbg
b el0_inv
#ifdefCONFIG_COMPAT
.align 6
el0_sync_compat:
kernel_entry 0, 32
mrs x25,esr_el1 // read the syndromeregister
lsr x24,x25, #26 // exceptionclass
cmp x24,#0x11 // SVC in 32-bitstate
b.eq el0_svc_compat
adr lr,ret_from_exception
cmp x24,#0x24 // data abort in EL0
b.eq el0_da
cmp x24,#0x20 // instruction abortin EL0
b.eq el0_ia
cmp x24,#0x07 // FP/ASIMD access
b.eq el0_fpsimd_acc
cmp x24,#0x28 // FP/ASIMDexception
b.eq el0_fpsimd_exc
cmp x24,#0x00 // unknown exceptionin EL0
b.eq el0_undef
cmp x24,#0x30 // debug exceptionin EL0
b.ge el0_dbg
b el0_inv
el0_svc_compat:
/*
*AArch32 syscall handling
*/
adr stbl,compat_sys_call_table // load compatsyscall table pointer
uxtw scno,w7 // syscall numberin w7 (r7)
mov sc_nr, #__NR_compat_syscalls
b el0_svc_naked
.align 6
el0_irq_compat:
kernel_entry 0, 32
b el0_irq_naked
#endif
el0_da:
/*
*Data abort handling
*/
mrs x0,far_el1
disable_step x1
isb
enable_dbg
// enable interrupts before calling themain handler
enable_irq
mov x1,x25
mov x2,sp
b do_mem_abort
el0_ia:
/*
*Instruction abort handling
*/
mrs x0,far_el1
disable_step x1
isb
enable_dbg
// enable interrupts before calling themain handler
enable_irq
orr x1,x25, #1 << 24 // usereserved ISS bit for instruction aborts
mov x2,sp
b do_mem_abort
el0_fpsimd_acc:
/*
*Floating Point or Advanced SIMD access
*/
mov x0,x25
mov x1,sp
b do_fpsimd_acc
el0_fpsimd_exc:
/*
*Floating Point or Advanced SIMD exception
*/
mov x0,x25
mov x1,sp
b do_fpsimd_exc
el0_sp_pc:
/*
*Stack or PC alignment exception handling
*/
mrs x0,far_el1
disable_step x1
isb
enable_dbg
// enable interrupts before calling themain handler
enable_irq
mov x1,x25
mov x2,sp
b do_sp_pc_abort
el0_undef:
/*
*Undefined instruction
*/
mov x0,sp
b do_undefinstr
el0_dbg:
/*
*Debug exception handling
*/
tbnz x24,#0, el0_inv // EL0 only
mrs x0,far_el1
disable_step x1
mov x1,x25
mov x2,sp
b do_debug_exception
el0_inv:
mov x0,sp
mov x1,#BAD_SYNC
mrs x2,esr_el1
b bad_mode
ENDPROC(el0_sync)
.align 6
el0_irq:
kernel_entry 0
el0_irq_naked:
disable_step x1
isb
enable_dbg
#ifdefCONFIG_TRACE_IRQFLAGS
bl trace_hardirqs_off
#endif
get_thread_info tsk
#ifdefCONFIG_PREEMPT
ldr x24,[tsk, #TI_PREEMPT] // getpreempt count
add x23,x24, #1 // increment it
str x23,[tsk, #TI_PREEMPT]
#endif
irq_handler
#ifdefCONFIG_PREEMPT
ldr x0,[tsk, #TI_PREEMPT]
str x24,[tsk, #TI_PREEMPT]
cmp x0,x23
b.eq 1f
mov x1,#0
str x1,[x1] // BUG
1:
#endif
#ifdefCONFIG_TRACE_IRQFLAGS
bl trace_hardirqs_on
#endif
b ret_to_user
ENDPROC(el0_irq)
/*
* This is the return code to user mode forabort handlers
*/
ret_from_exception:
get_thread_info tsk
b ret_to_user
ENDPROC(ret_from_exception)
/*
* Register switch for AArch64. Thecallee-saved registers need to be saved
* and restored. On entry:
* x0 =previous task_struct (must be preserved across the switch)
* x1 =next task_struct
* Previous and next are guaranteed not to bethe same.
*
*/
ENTRY(cpu_switch_to)
add x8,x0, #THREAD_CPU_CONTEXT
mov x9,sp
stp x19,x20, [x8], #16 // storecallee-saved registers
stp x21,x22, [x8], #16
stp x23,x24, [x8], #16
stp x25,x26, [x8], #16
stp x27,x28, [x8], #16
stp x29,x9, [x8], #16
str lr,[x8]
add x8,x1, #THREAD_CPU_CONTEXT
ldp x19,x20, [x8], #16 // restorecallee-saved registers
ldp x21,x22, [x8], #16
ldp x23,x24, [x8], #16
ldp x25,x26, [x8], #16
ldp x27,x28, [x8], #16
ldp x29,x9, [x8], #16
ldr lr,[x8]
mov sp,x9
ret
ENDPROC(cpu_switch_to)
/*
* This is the fast syscall return path. We do as little as possible here,
* and this includes saving x0 back into thekernel stack.
*/
ret_fast_syscall:
disable_irq // disable interrupts
ldr x1,[tsk, #TI_FLAGS]
and x2,x1, #_TIF_WORK_MASK
cbnz x2,fast_work_pending
tbz x1,#TIF_SINGLESTEP, fast_exit
disable_dbg
enable_step x2
fast_exit:
kernel_exit 0, ret = 1
/*
* Ok, we need to do extra processing, enterthe slow path.
*/
fast_work_pending:
str x0,[sp, #S_X0] // returned x0
work_pending:
tbnz x1,#TIF_NEED_RESCHED, work_resched
/* TIF_SIGPENDING or TIF_NOTIFY_RESUMEcase */
ldr x2,[sp, #S_PSTATE]
mov x0,sp // ‘regs‘
tst x2,#PSR_MODE_MASK // user moderegs?
b.ne no_work_pending // returning to kernel
enable_irq //enable interrupts for do_notify_resume()
bl do_notify_resume
b ret_to_user
work_resched:
enable_dbg
bl schedule
/*
* "slow" syscall return path.
*/
ENTRY(ret_to_user)
disable_irq // disable interrupts
ldr x1,[tsk, #TI_FLAGS]
and x2,x1, #_TIF_WORK_MASK
cbnz x2,work_pending
tbz x1,#TIF_SINGLESTEP, no_work_pending
disable_dbg
enable_step x2
no_work_pending:
kernel_exit 0, ret = 0
ENDPROC(ret_to_user)
/*
* This is how we return from a fork.
*/
ENTRY(ret_from_fork)
bl schedule_tail
get_thread_info tsk
b ret_to_user
ENDPROC(ret_from_fork)
/*
* SVC handler.
*/
.align 6
el0_svc:
adrp stbl,sys_call_table // load syscalltable pointer
uxtw scno,w8 //syscall number in w8
mov sc_nr,#__NR_syscalls
el0_svc_naked: // compat entrypoint
stp x0,scno, [sp, #S_ORIG_X0] // save theoriginal x0 and syscall number
disable_step x16
isb
enable_dbg
enable_irq
get_thread_info tsk
ldr x16,[tsk, #TI_FLAGS] // check forsyscall tracing
tbnz x16,#TIF_SYSCALL_TRACE, __sys_trace // are we tracing syscalls?
adr lr,ret_fast_syscall // returnaddress
cmp scno, sc_nr //check upper syscall limit
b.hs ni_sys
ldr x16,[stbl, scno, lsl #3] // address in thesyscall table
br x16 // call sys_* routine
ni_sys:
mov x0,sp
b do_ni_syscall
ENDPROC(el0_svc)
/*
*This is the really slow path. We‘regoing to be doing context
*switches, and waiting for our parent to respond.
*/
__sys_trace:
mov x1,sp
mov w0,#0 // trace entry
bl syscall_trace
adr lr,__sys_trace_return // returnaddress
uxtw scno,w0 // syscall number(possibly new)
mov x1,sp // pointer toregs
cmp scno,sc_nr // check uppersyscall limit
b.hs ni_sys
ldp x0,x1, [sp] // restore thesyscall args
ldp x2,x3, [sp, #S_X2]
ldp x4,x5, [sp, #S_X4]
ldp x6,x7, [sp, #S_X6]
ldr x16,[stbl, scno, lsl #3] // address in thesyscall table
br x16 // call sys_* routine
__sys_trace_return:
str x0,[sp] // save returned x0
mov x1,sp
mov w0,#1 // trace exit
bl syscall_trace
b ret_to_user
/*
* Special system call wrappers.
*/
ENTRY(sys_execve_wrapper)
mov x3,sp
b sys_execve
ENDPROC(sys_execve_wrapper)
ENTRY(sys_clone_wrapper)
mov x5,sp
b sys_clone
ENDPROC(sys_clone_wrapper)
ENTRY(sys_rt_sigreturn_wrapper)
mov x0,sp
b sys_rt_sigreturn
ENDPROC(sys_rt_sigreturn_wrapper)
ENTRY(sys_sigaltstack_wrapper)
ldr x2,[sp, #S_SP]
b sys_sigaltstack
ENDPROC(sys_sigaltstack_wrapper)
ENTRY(handle_arch_irq)
.quad 0
/*
* Dispatch a data abort to the relevanthandler.
*/
/*
asmlinkagevoid __exception do_mem_abort(unsigned long addr, unsigned int esr,
struct pt_regs *regs)
{
const struct fault_info *inf = fault_info+ (esr & 63);//取esr所有有效位，用于选择fault_info数组中的相应处理函数，该数组定义在后面
struct siginfo info;
if (!inf->fn(addr, esr, regs)) //如果处理成功（返回0），则直接返回，否则继续执行。
return;
//异常处理不成功，打印出错信息，进一步处理，不做分析。这里假设异常处理正常返回。
pr_alert("Unhandled fault: %s(0x%08x) at 0x%016lx\n",
inf->name, esr, addr);
info.si_signo = inf->sig;
info.si_errno = 0;
info.si_code = inf->code;
info.si_addr = (void __user *)addr;
arm64_notify_die("", regs,&info, esr);
}
*/
/*
staticstruct fault_info {
int (*fn)(unsignedlong addr, unsigned int esr, struct pt_regs *regs);//相应的异常处理函数
int sig;
int code;
const char *name;
}fault_info[] = {
{ do_bad, SIGBUS, 0, "ttbraddress size fault" },
{ do_bad, SIGBUS, 0, "level1 address size fault" },
{ do_bad, SIGBUS, 0, "level2 address size fault" },
{ do_bad, SIGBUS, 0, "level3 address size fault" },
{ do_translation_fault, SIGSEGV, SEGV_MAPERR, "input address range fault" },
{ do_translation_fault, SIGSEGV, SEGV_MAPERR, "level 1 translation fault" },
{ do_translation_fault, SIGSEGV, SEGV_MAPERR, "level 2 translation fault" },
{ do_page_fault, SIGSEGV, SEGV_MAPERR, "level3 translation fault" },
{ do_bad, SIGBUS, 0, "reservedaccess flag fault" },
{ do_bad, SIGSEGV,SEGV_ACCERR, "level 1 access flagfault" },
{ do_bad, SIGSEGV,SEGV_ACCERR, "level 2 access flagfault" },
{ do_page_fault, SIGSEGV, SEGV_ACCERR, "level3 access flag fault" },
{ do_bad, SIGBUS, 0, "reservedpermission fault" },
{ do_bad, SIGSEGV,SEGV_ACCERR, "level 1 permissionfault" },
{ do_sect_fault, SIGSEGV, SEGV_ACCERR, "level2 permission fault" },
{ do_page_fault, SIGSEGV, SEGV_ACCERR, "level3 permission fault" },
{ do_bad, SIGBUS, 0, "synchronousexternal abort" },
{ do_bad, SIGBUS, 0, "asynchronousexternal abort" },
{ do_bad, SIGBUS, 0, "unknown18" },
{ do_bad, SIGBUS, 0, "unknown19" },
{ do_bad, SIGBUS, 0, "synchronousabort (translation table walk)" },
{ do_bad, SIGBUS, 0, "synchronousabort (translation table walk)" },
{ do_bad, SIGBUS, 0, "synchronousabort (translation table walk)" },
{ do_bad, SIGBUS, 0, "synchronousabort (translation table walk)" },
{ do_bad, SIGBUS, 0, "synchronousparity error" },
{ do_bad, SIGBUS, 0, "asynchronousparity error" },
{ do_bad, SIGBUS, 0, "unknown26" },
{ do_bad, SIGBUS, 0, "unknown27" },
{ do_bad, SIGBUS, 0, "synchronousparity error (translation table walk" },
{ do_bad, SIGBUS, 0, "synchronousparity error (translation table walk" },
{ do_bad, SIGBUS, 0, "synchronousparity error (translation table walk" },
{ do_bad, SIGBUS, 0, "synchronousparity error (translation table walk" },
{ do_bad, SIGBUS, 0, "unknown32" },
{ do_bad, SIGBUS, BUS_ADRALN, "alignmentfault" },
{ do_bad, SIGBUS, 0, "debugevent" },
{ do_bad, SIGBUS, 0, "unknown35" },
{ do_bad, SIGBUS, 0, "unknown36" },
{ do_bad, SIGBUS, 0, "unknown37" },
{ do_bad, SIGBUS, 0, "unknown38" },
{ do_bad, SIGBUS, 0, "unknown39" },
{ do_bad, SIGBUS, 0, "unknown40" },
{ do_bad, SIGBUS, 0, "unknown41" },
{ do_bad, SIGBUS, 0, "unknown42" },
{ do_bad, SIGBUS, 0, "unknown43" },
{ do_bad, SIGBUS, 0, "unknown44" },
{ do_bad, SIGBUS, 0, "unknown45" },
{ do_bad, SIGBUS, 0, "unknown46" },
{ do_bad, SIGBUS, 0, "unknown47" },
{ do_bad, SIGBUS, 0, "unknown48" },
{ do_bad, SIGBUS, 0, "unknown49" },
{ do_bad, SIGBUS, 0, "unknown50" },
{ do_bad, SIGBUS, 0, "unknown51" },
{ do_bad, SIGBUS, 0, "implementationfault (lockdown abort)" },
{ do_bad, SIGBUS, 0, "unknown53" },
{ do_bad, SIGBUS, 0, "unknown54" },
{ do_bad, SIGBUS, 0, "unknown55" },
{ do_bad, SIGBUS, 0, "unknown56" },
{ do_bad, SIGBUS, 0, "unknown57" },
{ do_bad, SIGBUS, 0, "implementationfault (coprocessor abort)" },
{ do_bad, SIGBUS, 0, "unknown59" },
{ do_bad, SIGBUS, 0, "unknown60" },
{ do_bad, SIGBUS, 0, "unknown61" },
{ do_bad, SIGBUS, 0, "unknown62" },
{ do_bad, SIGBUS, 0, "unknown63" },
};
*/
1.6 traps.c代码分析
//该文件中代码原理很简单，目前暂不分析，若需要，后续再添上。
/*
* bad_mode handles the impossible case in theexception vector.
*/
//三个参数从左到右分别对应x0~x3,该函数的作用就是打印出错原因，跳转到panic()函数
asmlinkagevoid bad_mode(struct pt_regs *regs, int reason, unsigned int esr)
{
console_verbose();
pr_crit("Bad mode in %s handlerdetected, code 0x%08x\n",
handler[reason], esr);
die("Oops - bad mode", regs, 0);
local_irq_disable();
panic("bad mode");
}