ARM64 体系结构与内核实现

mrs x0, daif          // 读取中断屏蔽位
mrs x1, CurrentEL     // 读取当前异常级别（位于 bits[3:2]）
lsr x1, x1, #2        // 右移得到 0/1/2/3
msr daifset, #2       // 关闭 IRQ
msr daifclr, #2       // 打开 IRQ

mrs x0, tcr_el1
bic x1, x0, #0x7          // 清除 TG0 位
orr x1, x1, #0x0          // TG0 = 0b000 (4KB)
msr tcr_el1, x1
isb                       // 系统寄存器写入后需要 ISB 同步

at s1e1r, x0              // 以 EL1 权限翻译 x0 中的地址，不产生访存
mrs x1, par_el1           // 读取结果，bit0=1 表示翻译失败
tlbi vmalle1              // 失效 EL1 全部 TLB 项
tlbi vae1, x0             // 失效指定 VA 的 TLB 项
dsb ish                   // 等待失效操作完成
isb                       // 同步指令流水

/dts-v1/;
/ {
    compatible = "linux,dummy-virt";
    #address-cells = <2>;
    #size-cells = <2>;

    cpus {
        #address-cells = <1>;
        #size-cells = <0>;
        cpu@0 {
            device_type = "cpu";
            compatible = "arm,cortex-a57";
            reg = <0x0>;
            enable-method = "psci";
        };
    };

    memory@40000000 {
        device_type = "memory";
        reg = <0x0 0x40000000 0x0 0x80000000>;
    };

    uart@9000000 {
        compatible = "arm,pl011", "arm,primecell";
        reg = <0x0 0x09000000 0x0 0x1000>;
        interrupts = <0x0 0x21 0x4>;
        clocks = <&clk_uart>;
    };
};

dtc -I dts -O dtb -o board.dtb board.dts    # 编译 DTS 为二进制 DTB
dtc -I dtb -O dts -o board.dts board.dtb    # 反编译 DTB 回 DTS
fdtdump board.dtb | head -20                # 查看 DTB 头部信息

ls /proc/device-tree/                                   # 查看根节点
cat /proc/device-tree/compatible | tr '\0' '\n'         # 读取 compatible
hexdump -C /proc/device-tree/uart@9000000/reg           # 查看寄存器范围

#include <linux/of.h>
#include <linux/of_irq.h>

static int my_probe(struct platform_device *pdev)
{
    struct device *dev = &pdev->dev;
    struct resource *res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
    int irq = platform_get_irq(pdev, 0);
    u32 freq;

    if (!res)
        return -ENODEV;
    if (irq < 0)
        return irq;
    if (of_property_read_u32(dev->of_node, "clock-frequency", &freq))
        freq = 24000000;

    dev_info(dev, "mmio=%pR irq=%d freq=%u\n", res, irq, freq);
    return 0;
}

static const struct of_device_id my_match[] = {
    { .compatible = "vendor,my-uart" },
    { }
};
MODULE_DEVICE_TABLE(of, my_match);

mkdir /sys/kernel/config/device-tree/overlays/mydev
cat mydev.dtbo > /sys/kernel/config/device-tree/overlays/mydev/dtbo
rmdir /sys/kernel/config/device-tree/overlays/mydev   # 移除 overlay

void __init setup_arch(char **cmdline_p)
{
    setup_machine_fdt(__fdt_pointer);   // 解析 FDT
    parse_early_param();
    bootmem_init();
    paging_init();
}

echo 0 > /sys/devices/system/cpu/cpu1/online   # 下线一个 CPU
echo 1 > /sys/devices/system/cpu/cpu1/online   # 重新上线

mrs x0, ICC_PMR_EL1       // 读取当前中断优先级阈值
mrs x0, ICC_IAR1_EL1      // 确认中断（读取 IAR）
and x1, x0, #0xffffff     // 提取中断号
msr ICC_EOIR1_EL1, x0     // 结束中断（写入 EOIR）
mov x0, #1
msr ICC_IGRPEN1_EL1, x0   // 使能组 1 中断

intc: interrupt-controller@8000000 {
    compatible = "arm,gic-v3";
    reg = <0x0 0x08000000 0x0 0x10000>,    // GICD
          <0x0 0x080a0000 0x0 0xf60000>;   // GICR
    interrupt-controller;
    #interrupt-cells = <3>;
    interrupts = <0x1 0x9 0x4>;            // 维护中断
};

cat /proc/interrupts
#  11:       1234          0     GICv3  27 Level     arch_timer
#  13:          0       2048     GICv3  33 Level     eth0
# IPI0:       512        640     Rescheduling interrupts

dma_sync_single_for_device(dev, dma_handle, size, DMA_TO_DEVICE);   // 写回供设备读
dma_sync_single_for_cpu(dev, dma_handle, size, DMA_FROM_DEVICE);    // 失效供 CPU 读

dc civac, x0              // 按 VA 清理并失效数据 cache
dc cvac, x0               // 按 VA 清理数据 cache（写回）
ic ivau, x0               // 按 VA 失效指令 cache

// 方案一：分配一致性内存，CPU 与设备共享同一份数据
void *buf = dma_alloc_coherent(dev, size, &dma_handle, GFP_KERNEL);
dma_free_coherent(dev, size, buf, dma_handle);

// 方案二：流式 DMA 映射，显式同步
dma_addr_t h = dma_map_single(dev, buf, size, DMA_TO_DEVICE);
dma_unmap_single(dev, h, size, DMA_TO_DEVICE);

sudo apt install gcc-aarch64-linux-gnu binutils-aarch64-linux-gnu \
                 qemu-system-arm device-tree-compiler
aarch64-linux-gnu-gcc --version     # 验证工具链

export ARCH=arm64
export CROSS_COMPILE=aarch64-linux-gnu-
make defconfig                      # 生成默认配置
make -j$(nproc) Image.gz            # 多核并行编译
make -j$(nproc) dtbs

qemu-system-aarch64 \
  -machine virt \
  -cpu cortex-a57 \
  -smp 4 -m 2G \
  -kernel arch/arm64/boot/Image.gz \
  -append "console=ttyAMA0 root=/dev/vda rw" \
  -nographic

# 终端一：启动 QEMU 并暂停，等待 gdb 连接
qemu-system-aarch64 -machine virt -cpu cortex-a57 -smp 1 -m 1G \
  -kernel arch/arm64/boot/Image.gz \
  -append "console=ttyAMA0 nokaslr" \
  -nographic -s -S

# 终端二：启动 gdb 连接
gdb-multiarch vmlinux
(gdb) target remote :1234
(gdb) break start_kernel
(gdb) continue
(gdb) info registers x0 x1

ldaxr x1, [x0]            // Load-Acquire Exclusive
add x1, x1, #1            // 修改 x1
stlxr w2, x1, [x0]        // Store-Release Exclusive，w2 返回 0 表示成功
cbnz w2, retry            // 失败则重试

# ============================================================
# 完整可运行示例：交叉编译 ARM64 内核并在 QEMU virt 上启动
# 适用：Debian/Ubuntu x86_64 主机
# ============================================================
set -e

WORK=$HOME/arm64-lab
KERNEL_SRC=$WORK/linux
mkdir -p "$WORK"

echo "=== 步骤 1: 安装工具链 ==="
sudo apt update
sudo apt install -y gcc-aarch64-linux-gnu binutils-aarch64-linux-gnu \
                    qemu-system-arm device-tree-compiler bc flex bison \
                    libssl-dev libelf-dev
aarch64-linux-gnu-gcc --version | head -1

echo "=== 步骤 2: 获取内核源码 ==="
[ -d "$KERNEL_SRC" ] || git clone --depth 1 \
    https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git "$KERNEL_SRC"
cd "$KERNEL_SRC"

echo "=== 步骤 3: 配置并编译 ==="
export ARCH=arm64
export CROSS_COMPILE=aarch64-linux-gnu-
make defconfig
scripts/config --enable CONFIG_SERIAL_AMBA_PL011
scripts/config --enable CONFIG_SERIAL_AMBA_PL011_CONSOLE
scripts/config --enable CONFIG_ARM_ARCH_TIMER
make -j"$(nproc)" Image.gz

echo "=== 步骤 4: 制作最小 initramfs ==="
cd "$WORK"
mkdir -p initramfs/{bin,dev,proc,sys}
cp /bin/busybox initramfs/bin/ 2>/dev/null || true
cat > initramfs/init <<'EOF'
#!/bin/sh
mount -t proc none /proc
mount -t sysfs none /sys
echo "--- /proc/interrupts ---"
cat /proc/interrupts
echo "--- compatible ---"
tr '\0' '\n' < /proc/device-tree/compatible
echo "ARM64 QEMU 启动成功"
exec sh
EOF
chmod +x initramfs/init
cd initramfs && find . | cpio -o -H newc 2>/dev/null | gzip > ../initramfs.cpio.gz && cd ..

echo "=== 步骤 5: 在 QEMU 中启动内核 ==="
qemu-system-aarch64 \
    -machine virt -cpu cortex-a57 -smp 4 -m 2G \
    -kernel "$KERNEL_SRC/arch/arm64/boot/Image.gz" \
    -initrd "$WORK/initramfs.cpio.gz" \
    -append "console=ttyAMA0 rdinit=/init nokaslr" \
    -nographic

echo "=== 步骤 6: 调试模式（另开终端）==="
echo "  qemu-system-aarch64 -machine virt -cpu cortex-a57 -m 1G \\"
echo "    -kernel $KERNEL_SRC/arch/arm64/boot/Image.gz \\"
echo "    -append 'console=ttyAMA0 nokaslr' -nographic -s -S"
echo "  gdb-multiarch $KERNEL_SRC/vmlinux -ex 'target remote :1234'"