Linux内核的启动分为压缩内核和非压缩内核两种，这里我们以压缩内核为例。压缩内核运行时，将运行一段解压缩程序，得到真正的内核镜像，然后跳转到内核镜像运行。此时，Linux进入非压缩内核入口，在非压缩内核入口中，完成各种初始化操作后跳转到C语言入口处运行。主要流程如下所示。

1.解压缩内核镜像

解压缩程序通常在arch/arm/boot/compressed/目录中

├── atags_to_fdt.c
├── big-endian.S
├── decompress.c
├── head.S
├── head-sa1100.S
├── head-shark.S
├── head-sharpsl.S
├── head-shmobile.S
├── head-vt8500.S
├── head-xscale.S
├── libfdt_env.h
├── ll_char_wr.S
├── Makefile
├── misc.c
├── mmcif-sh7372.c
├── ofw-shark.c
├── piggy.gzip.S
├── piggy.lzma.S
├── piggy.lzo.S
├── piggy.xzkern.S
├── sdhi-sh7372.c
├── sdhi-shmobile.c
├── sdhi-shmobile.h
├── string.c
└── vmlinux.lds.in

它们经过编译后，生成的内容独立于真正的Linux内核，这部分内容的功能就是初始化环境，解压缩和运行真正的Linux内核。在压缩内核启动时，首先进入arch/arm/boot/compressed目录中的compressed目录中的head.S文件。

start:
                .type   start,#function
                .rept   7
                mov     r0, r0
                .endr
   ARM(         mov     r0, r0          )
   ARM(         b       1f              )
 THUMB(         adr     r12, BSYM(1f)   )
 THUMB(         bx      r12             )
                .word   0x016f2818              @ Magic numbers to help the loader
                .word   start                   @ absolute load/run zImage address
                .word   _edata                  @ zImage end address
 THUMB(         .thumb                  )
1:              mov     r7, r1                  @ save architecture ID
                mov     r8, r2                  @ save atags pointer  

start是head.S的程序的开始，在此之前都是一些宏定义。在1标号处保存由bootloader传递过来的参数

#ifndef __ARM_ARCH_2__
                /*
                 * Booting from Angel - need to enter SVC mode and disable
                 * FIQs/IRQs (numeric definitions from angel arm.h source).
                 * We only do this if we were in user mode on entry.
                 */
               @获取当前运行模式
                mrs     r2, cpsr                @ get current mode
               @测试是否为usr模式
                tst     r2, #3                  @ not user?
                bne     not_angel
                mov     r0, #0x17               @ angel_SWIreason_EnterSVC
 ARM(           swi     0x123456        )       @ angel_SWI_ARM
 THUMB(         svc     0xab            )       @ angel_SWI_THUMB
not_angel:
                mrs     r2, cpsr                @ turn off interrupts to
                orr     r2, r2, #0xc0           @ prevent angel from running
                msr     cpsr_c, r2
#else
                teqp    pc, #0x0c000003         @ turn off interrupts
#endif

如果内核从angel运行进入的运行模式将是usr mode，这时需要进入svc mode ，并禁止所有FIQ和IRQ中断。这些只有在进入时处于用户模式的时候才会执行。正常情况下，将运行not_angel标号处关闭中断的代码。然后对内核代码进行重定向(telocate)--（这部分代码还没看懂-_-！！！）,重定向完成之后会跳转到not_relocated标号处运行。

not_relocated:  mov     r0, #0
1:              str     r0, [r2], #4            @ clear bss
                str     r0, [r2], #4
                str     r0, [r2], #4
                str     r0, [r2], #4
                cmp     r2, r3
                blo     1b
/*
 * The C runtime environment should now be setup sufficiently.
 * Set up some pointers, and start decompressing.
 *   r4  = kernel execution address
 *   r7  = architecture ID
 *   r8  = atags pointer
 */
                mov     r0, r4
                mov     r1, sp                  @ malloc space above stack
                add     r2, sp, #0x10000        @ 64k max
                mov     r3, r7
                bl      decompress_kernel
                bl      cache_clean_flush
                bl      cache_off
                mov     r0, #0                  @ must be zero
                mov     r1, r7                  @ restore architecture number
                mov     r2, r8                  @ restore atags pointer
 ARM(           mov     pc, r4  )               @ call kernel

重定向完成之后，首先清bss段，这时所有初始化C语言运行环境都要做的，然后调用decompress_kernel解压内核，之后跳转到非压缩内核启动阶段。

2.汇编阶段启动流程

对于tiny4412而言，内核的链接脚本为arch/arm/kernel/vmlinux.lds，它是由arch/arm/kernel/vmlinux.lds.S生成的。在链接脚本中，我们可以找到内核的入口

OUTPUT_ARCH(arm)
ENTRY(stext)
jiffies = jiffies_64;
SECTIONS
{

可以看出内核的入口为stext，它在 linux/arch/arm/kernel/head.S 中被定义。

    .arm
    __HEAD
ENTRY(stext)
 THUMB(    adr    r9, BSYM(1f)    )    @ Kernel is always entered in ARM.
 THUMB(    bx    r9        )    @ If this is a Thumb-2 kernel,
 THUMB(    .thumb            )    @ switch to Thumb now.
 THUMB(1:            )
  @设定为SVC模式，关闭IRQ、FIQ
    setmode    PSR_F_BIT | PSR_I_BIT | SVC_MODE, r9 @ ensure svc mode
                        @ and irqs disabled
    @检查CPU ID 是否匹配
    mrc    p15, 0, r9, c0, c0        @ get processor id
    bl    __lookup_processor_type        @ r5=procinfo r9=cpuid
    movs    r10, r5                @ invalid processor (r5=0)?
 THUMB( it    eq )        @ force fixup-able long branch encoding
    beq    __error_p            @ yes, error ‘p‘
#ifdef CONFIG_ARM_LPAE
    mrc    p15, 0, r3, c0, c1, 4        @ read ID_MMFR0
    and    r3, r3, #0xf            @ extract VMSA support
    cmp    r3, #5                @ long-descriptor translation table format?
 THUMB( it    lo )                @ force fixup-able long branch encoding
    blo    __error_p            @ only classic page table format
#endif
#ifndef CONFIG_XIP_KERNEL
    adr    r3, 2f
    ldmia    r3, {r4, r8}
    sub    r4, r3, r4            @ (PHYS_OFFSET - PAGE_OFFSET)
    add    r8, r8, r4            @ PHYS_OFFSET
#else
    ldr    r8, =PHYS_OFFSET        @ always constant in this case
#endif
    /*
     * r1 = machine no, r2 = atags or dtb,
     * r8 = phys_offset, r9 = cpuid, r10 = procinfo
     */
    @检查bootloader传入的参数列表atags的合法性
    bl    __vet_atags
#ifdef CONFIG_SMP_ON_UP
    bl    __fixup_smp
#endif
#ifdef CONFIG_ARM_PATCH_PHYS_VIRT
    bl    __fixup_pv_table
#endif
  @创建初始页表
    bl    __create_page_tables
    /*
     * The following calls CPU specific code in a position independent
     * manner.  See arch/arm/mm/proc-*.S for details.  r10 = base of
     * xxx_proc_info structure selected by __lookup_processor_type
     * above.  On return, the CPU will be ready for the MMU to be
     * turned on, and r0 will hold the CPU control register value.
     */
    @建立C语言环境（代码重定位、清bss段）
    ldr    r13, =__mmap_switched        @ address to jump to after
                        @ mmu has been enabled
    adr    lr, BSYM(1f)            @ return (PIC) address
    mov    r8, r4                @ set TTBR1 to swapper_pg_dir
 ARM(    add    pc, r10, #PROCINFO_INITFUNC    )
 THUMB(    add    r12, r10, #PROCINFO_INITFUNC    )
 THUMB(    mov    pc, r12                )
 @开启MMU
1:    b    __enable_mmu
ENDPROC(stext)

__mmap_switched定义在arch/arm/kernel/head-common.S中

__mmap_switched:
        adr     r3, __mmap_switched_data
        ldmia   r3!, {r4, r5, r6, r7}
        cmp     r4, r5                          @ Copy data segment if needed
1:      cmpne   r5, r6
        ldrne   fp, [r4], #4
        strne   fp, [r5], #4
        bne     1b
        mov     fp, #0                          @ Clear BSS (and zero fp)
1:      cmp     r6, r7
        strcc   fp, [r6],#4
        bcc     1b
 ARM(   ldmia   r3, {r4, r5, r6, r7, sp})
 THUMB( ldmia   r3, {r4, r5, r6, r7}    )
 THUMB( ldr     sp, [r3, #16]           )
        str     r9, [r4]                        @ Save processor ID
        str     r1, [r5]                        @ Save machine type
        str     r2, [r6]                        @ Save atags pointer
        bic     r4, r0, #CR_A                   @ Clear ‘A‘ bit
        stmia   r7, {r0, r4}                    @ Save control register values
        b       start_kernel

汇编阶段代码主要完成了以下工作

①设置处理器为SVC模式并关闭中断

②调用__lookup_processor_type查找处理器信息结构体proc_info

③调用__enable_mmu打开MMU

④调用__create_page_tables创建初始页表

⑤调用__mmap_switched初始化C语言运行环境，最红跳转到C语言阶段入口函数start_kernel

3.C语言阶段启动流程

内核启动流程，知识储备还不完善，以后更新 -_- ......

参考文章：

http://blog.csdn.net/zqixiao_09/article/details/50821995