完全理解ARM启动流程：Uboot-Kernel

mtd0     mtd1     mtd2     mtd3     mtd4     mtd5
mtd0ro  mtd1ro  mtd2ro  mtd3ro  mtd4ro  mtd5ro

cat mtd0/name    U-Boot
cat mtd1/name    U-Boot Env
cat mtd2/name    U-Boot Logo
cat mtd3/name    Kernel
cat mtd4/name    File System

OUTPUT_FORMAT("elf32-littlearm", "elf32-littlearm", "elf32-littlearm")
OUTPUT_ARCH(arm)
ENTRY(_start)
SECTIONS
{
　　. = 0x00000000;//起始地址
　　. = ALIGN(4);//4字节对齐
　　.text   : //test指代码段，上面3行标识是不占用任何空间的
　　{
　　　　arch/arm/cpu/arm_cortexa8/start.o     (.text) //这里把start.o放在第一位就表示把start.s编译时放到最开始，这就是为什么把uboot烧到起始地址上它肯定运行的是start.s
　　　　arch/arm/cpu/arm_cortexa8/ti81xx/lowlevel_init.o      (.text)
　　　　*(.text)
　　}
　　. = ALIGN(4);//前面的 “.” 代表当前值，是计算一个当前的值，是计算上面占用的整个空间，再加一个单元就表示它现在的位置
　　.rodata : { *(.rodata) }
　　. = ALIGN(4);
　　.data : { *(.data) }
　　. = ALIGN(4);
　　.got : { *(.got) }
　　. = .;
　　__u_boot_cmd_start = .;
　　.u_boot_cmd : { *(.u_boot_cmd) }
　　__u_boot_cmd_end = .;
　　. = ALIGN(4);
　　__bss_start = .;
　　.bss (NOLOAD) : { *(.bss) . = ALIGN(4); }
　　_end = .;
}
OUTPUT_FORMAT("elf32-littlearm", "elf32-littlearm", "elf32-littlearm")
/*OUTPUT_FORMAT("elf32-arm", "elf32-arm", "elf32-arm")*/
OUTPUT_ARCH(arm)
ENTRY(_start)

.globl _start                                   /*声明一个符号可被其它文件引用，相当于声明了一个全局变量，.globl与.global相同*/
_start:    b     reset                          /* 复位，b是不带返回的跳转(bl是带返回的跳转)，意思是无条件直接跳转到reset标号出执行程序*/
    ldr   pc, _undefined_instruction            /* 未定义指令向量 l---dr相当于mov操作*/
    ldr   pc, _software_interrupt               /*  软件中断向量 */
    ldr   pc, _prefetch_abort                   /*  预取指令异常向量 */
    ldr   pc, _data_abort                       /*  数据操作异常向量 */
    ldr   pc, _not_used                         /*  未使用   */
    ldr   pc, _irq                              /*  irq中断向量  */
    ldr   pc, _fiq                              /*  fiq中断向量  */
/*  中断向量表入口地址 */
_undefined_instruction:    .word undefined_instruction  /*就是在当前地址，即_undefined_instruction 处存放 undefined_instruction*/
_software_interrupt:     .word software_interrupt
_prefetch_abort:      .word prefetch_abort
_data_abort:        .word data_abort
_not_used:         .word not_used
_irq:             .word irq
_fiq:            .word fiq    //word伪操作用于分配一段字内存单元(分配的单元都是字对齐的)，并用伪操作中的expr初始化
_pad: 　　　　　　.word 0x12345678 /* now 16*4=64 */
.global _end_vect
_end_vect:
    .balignl 16,0xdeadbeef

_TEXT_BASE:
    .word TEXT_BASE //0x07080000,在board/ti/ti8168_dvr/config.mk中,这段话表示，用户告诉编译器编译地址的起始地址  
.globl _armboot_start
_armboot_start:
 .word _start /*_start 是uboot的第一行代码的标号,代表的是第一行代码的地址*/
 
.globl _bss_start
_bss_start:
 .word __bss_start //在cpu/arm_cortexa8/u-boot.lds中定义
.globl _bss_end
_bss_end:
 .word _end //在cpu/arm_cortexa8/u-boot.lds中定义
#ifdef CONFIG_USE_IRQ  // 这个宏没有定义,预编译不执行
/* IRQ stack memory (calculated at run-time) */
.globl IRQ_STACK_START
IRQ_STACK_START:
 .word 0x0badc0de
/* IRQ stack memory (calculated at run-time) */
.globl FIQ_STACK_START
FIQ_STACK_START:
 .word 0x0badc0de
#endif

reset:
    /*
     * set the cpu to SVC32 mode
    */
    mrs r0, cpsr
    bic  r0, r0, #0x1f        /*工作模式位清零 */
    orr   r0, r0, #0xd3       /*工作模式位设置为“10011”（管理模式），并将中断禁止位和快中断禁止位置1 */
    msr cpsr, r0

#if (CONFIG_OMAP34XX) // 这个宏没有定义,下面的代码不会预编译
    /* Copy vectors to mask ROM indirect addr */
    adr r0, _start  @ r0 <- current position of code
    add r0, r0, #4  @ skip reset vector
    mov r2, #64   @ r2 <- size to copy
    add r2, r0, r2  @ r2 <- source end address
    mov r1, #SRAM_OFFSET0 @ build vect addr
    mov r3, #SRAM_OFFSET1
    add r1, r1, r3
    mov r3, #SRAM_OFFSET2
    add r1, r1, r3
next:
    ldmia r0!, {r3 - r10}  @ copy from source address [r0]
    stmia r1!, {r3 - r10}  @ copy to   target address [r1]
    cmp r0, r2   @ until source end address [r2]
    bne next   @ loop until equal */
#if !defined(CONFIG_SYS_NAND_BOOT) && !defined(CONFIG_SYS_ONENAND_BOOT)
    /* No need to copy/exec the clock code - DPLL adjust already done
     * in NAND/oneNAND Boot.
     */
    bl cpy_clk_code  @ put dpll adjust code behind vectors
#endif /* NAND Boot */
#endif

/* the mask ROM code should have PLL and others stable */
#ifndef CONFIG_SKIP_LOWLEVEL_INIT
    bl cpu_init_crit
#endif

/*************************************************************************
 *
 * CPU_init_critical registers
 *
 * setup important registers
 * setup memory timing
 *
 *************************************************************************/
cpu_init_crit:
    /*
     * Invalidate L1 I/D
     */
    mov    r0, #0            @ set up for MCR
    mcr    p15, 0, r0, c8, c7, 0    @ invalidate TLBs  //将0写入c8，使TLB内容无效
    mcr    p15, 0, r0, c7, c5, 0    @ invalidate icache //将0写入c7，使Cache内容无效
    /*
     * disable MMU stuff and caches
     */
    mrc    p15, 0, r0, c1, c0, 0
    bic    r0, r0, #0x00002000    @ clear bits 13 (--V-)
    bic    r0, r0, #0x00000007    @ clear bits 2:0 (-CAM)
    orr    r0, r0, #0x00000002    @ set bit 1 (--A-) Align
    orr    r0, r0, #0x00000800    @ set bit 12 (Z---) BTB
    mcr    p15, 0, r0, c1, c0, 0 //修改CP15的c1寄存器来实现关闭MMU
    /*
     * Jump to board specific initialization...
     * The Mask ROM will have already initialized
     * basic memory. Go here to bump up clock rate and handle
     * wake up conditions.
     */
    mov    ip, lr            @ persevere link reg across call
    bl    lowlevel_init      @ go setup pll,mux,memory
    mov    lr, ip            @ restore link
    mov    pc, lr            @ back to my caller

/*****************************************************************************
 * lowlevel_init: - Platform low level init.
 * Corrupted Register : r0, r1, r2, r3, r4, r5, r6
 ****************************************************************************/
.globl lowlevel_init
lowlevel_init:
    /* The link register is saved in ip by start.S */
    mov r6, ip
    /* check if we are already running from RAM */ //判断程序是否已经在 RAM 中运行
    ldr r2, _lowlevel_init
    ldr r3, _TEXT_BASE
    sub r4, r2, r3
    sub r0, pc, r4
    /* require dummy instr or subtract pc by 4 instead i'm doing stack init */
    ldr sp, SRAM_STACK
mark1:
    ldr r5, _mark1
    sub r5, r5, r2 /* bytes between mark1 and lowlevel_init */
    sub r0, r0, r5 /* r0 <- _start w.r.t current place of execution */
    mov r10, #0x0 /* r10 has in_ddr used by s_init() */
#ifdef CONFIG_NOR_BOOT
    cmp r0, #0x08000000 /* check for running from NOR */
    beq ocmc_init_start /* if == then running from NOR */
    ands r0, r0, #0xC0000000 /* MSB 2 bits <> 0 then we are in ocmc or DDR */
    cmp r0, #0x40000000 /* if running from ocmc */
    beq nor_init_start /* if == skip ocmc init and jump to nor init */
    mov r10, #0x01 /* if <> we are running from DDR hence skip ddr init */
       /* by setting in_ddr to 1 */
    b s_init_start /* and jump to s_init */
#else
    ands r0, r0, #0xC0000000 /* MSB 2 bits <> 0 then we are in ocmc or DDR */
    cmp r0, #0x80000000
    bne s_init_start
    mov r10, #0x01
    b s_init_start
#endif
#ifdef CONFIG_NOR_BOOT
ocmc_init_start:
    /**** enable ocmc 0 ****/
    /* CLKSTCTRL */
    ldr r5, cm_alwon_ocmc_0_clkstctrl_addr
    mov r2, #0x2
    str r2, [r5]
    /* wait for gpmc enable to settle */
ocmc0_wait0:
    ldr r2, [r5]
    ands r2, r2, #0x00000100
    cmp r2, #0x00000100
    bne ocmc0_wait0
    /* CLKCTRL */
    ldr r5, cm_alwon_ocmc_0_clkctrl_addr
    mov r2, #0x2
    str r2, [r5]
    /* wait for gpmc enable to settle */
ocmc0_wait1:
    ldr r2, [r5]
    ands r2, r2, #0x00030000
    cmp r2, #0
    bne ocmc0_wait1
#ifdef CONFIG_TI816X
    /**** enable ocmc 1 ****/
    /* CLKSTCTRL */
    ldr r5, cm_alwon_ocmc_1_clkstctrl_addr
    mov r2, #0x2
    str r2, [r5]
    /* wait for gpmc enable to settle */
ocmc1_wait0:
    ldr r2, [r5]
    ands r2, r2, #0x00000100
    cmp r2, #0x00000100
    bne ocmc1_wait0
    /* CLKCTRL */
    ldr r5, cm_alwon_ocmc_1_clkctrl_addr
    mov r2, #0x2
    str r2, [r5]
    /* wait for gpmc enable to settle */
ocmc1_wait1:
    ldr r2, [r5]
    ands r2, r2, #0x00030000
    cmp r2, #0
    bne ocmc1_wait1
#endif
nor_init_start:
    /* gpmc init */
    bl  cpy_nor_gpmc_code /* copy nor gpmc init code to sram */
    mov r0, pc
    add r0, r0, #12  /* 12 is for next three instructions */
    mov lr, r0  /* gpmc init code in sram should return to s_init_start */
    ldr r0, sram_pc_start
    mov pc, r0 /* transfer ctrl to nor_gpmc_init() in sram */
#endif
s_init_start:
    mov r0, r10 /* passing in_ddr in r0 */
    bl s_init // 调用C语言初始化系统时钟和MUX
    /* back to arch calling code */
    mov pc, r6

#ifndef CONFIG_SKIP_RELOCATE_UBOOT 
relocate:        @ relocate U-Boot to RAM 
     adr r0, _start    @ r0 <- current position of code 
     ldr  r1, _TEXT_BASE    @ test if we run from flash or RAM 
     cmp  r0, r1      @ don't reloc during debug 
     beq stack_setup

/* Set up the stack */ 
stack_setup: 
    ldr  r0, _TEXT_BASE    @ upper 128 KiB: relocated uboot 
    sub r0, r0, #CONFIG_SYS_MALLOC_LEN @ malloc area 
    sub r0, r0, #CONFIG_SYS_GBL_DATA_SIZE @ bdinfo  //跳过全局数据区

/* 
  * Size of malloc() pool 
 */ 
#define CONFIG_SYS_MALLOC_LEN    (CONFIG_ENV_SIZE + 32 * 1024) 
/* size in bytes reserved for initial data */ 
#define CONFIG_SYS _GBL_DATA_SIZE 128 
#define CONFIG_ENV_SIZE         0x2000

#ifdef CONFIG_USE_IRQ 
    sub r0, r0, #(CONFIG_STACKSIZE_IRQ + CONFIG_STACKSIZE_FIQ) 
#endif 
    sub  sp, r0, #12    @ leav e 3 words for abort-stack 
    and  sp, sp, #~7    @ 8 byte alinged for (ldr/str)d

ldr r2, _armboot_start 
     ldr r3, _bss_start 
     sub r2, r3, r2    @ r2 <- size of armboot 
     add r2, r0, r2   @ r2  <- source end address

copy_loop:     @ copy 32 bytes at a time 
    ldmia  r0!, {r3 - r10}    @ copy from source address [r0] 
    stmia  r1!, {r3 - r10}    @ copy to      target address [r1] 
    cmp r0, r2   @ until  source end addreee [r2] 
    ble copy_loop 
#endif  /* CONFIG_SKIP_RELOCATE_UBOOT */

/* Clear BSS (if any). Is below tx (watch load addr - need space) */
clear_bss:
    ldr    r0, _bss_start        @ find start of bss segment /* BSS段开始地址，在u-boot.lds中指定*/
    ldr    r1, _bss_end        @ stop here /* BSS段结束地址，在u-boot.lds中指定*/
    mov    r2, #0x00000000        @ clear value /* 将bss段清零*/
clbss_l:
    str    r2, [r0]        @ clear BSS location 
    cmp    r0, r1            @ are we at the end yet
    add    r0, r0, #4        @ increment clear index pointer
    bne    clbss_l            @ keep clearing till at end

ldr pc, _start_armboot @ jump to C code
_start_armboot: .word start_armboot

typedef    struct    global_data {
    bd_t        *bd;
    unsigned long    flags;
    unsigned long    baudrate;
    unsigned long    have_console;    /* serial_init() was called */
    unsigned long    env_addr;    /* Address  of Environment struct */
    unsigned long    env_valid;    /* Checksum of Environment valid? */
    unsigned long    fb_base;    /* base address of frame buffer */
#ifdef CONFIG_VFD
    unsigned char    vfd_type;    /* display type */
#endif
#ifdef CONFIG_FSL_ESDHC
    unsigned long    sdhc_clk;
#endif
#if 0
    unsigned long    cpu_clk;    /* CPU clock in Hz!        */
    unsigned long    bus_clk;
    phys_size_t    ram_size;    /* RAM size */
    unsigned long    reset_status;    /* reset status register at boot */
#endif
    void        **jt;        /* jump table */
} gd_t;

#define DECLARE_GLOBAL_DATA_PTR     register volatile gd_t *gd asm ("r8")

bd_t在include/asm/u-boot.h中定义如下：

typedef struct bd_info {
    int                bi_baudrate;               /* 串口通讯波特率 */
    unsigned long     bi_ip_addr;          /* IP 地址*/
    struct environment_s        *bi_env;              /* 环境变量开始地址 */
    ulong            bi_arch_number;      /* 开发板的机器码 */
    ulong            bi_boot_params;       /* 内核参数的开始地址 */
    struct                         /* RAM配置信息 */
    {
              ulong start;
              ulong size;
    }bi_dram[CONFIG_NR_DRAM_BANKS]; 
} bd_t;

U-Boot使用一个数组init_sequence来存储对于大多数开发板都要执行的初始化函数的函数指针。

typedef int (init_fnc_t) (void);
int print_cpuinfo (void);
init_fnc_t *init_sequence[] = {
#if defined(CONFIG_ARCH_CPU_INIT)
    arch_cpu_init,        /* basic arch cpu dependent setup */
#endif
    board_init,         /*开发板相关的配置--board/samsung/mini2440/mini2440.c */
#if defined(CONFIG_USE_IRQ)
    interrupt_init,        /* set up exceptions */
#endif
    timer_init,         /*开发板相关的配置--board/samsung/mini2440/mini2440.c */
#ifdef CONFIG_FSL_ESDHC
    get_clocks,
#endif
    env_init,        /*初始化环境变量--common/env_flash.c 或common/env_nand.c*/
    init_baudrate,         /*初始化波特率-- lib_arm/board.c */
    serial_init,         /* 串口初始化-- drivers/serial/serial_s3c24x0.c */
    console_init_f,        /* 控制通讯台初始化阶段1-- common/console.c */
    display_banner,        /*打印U-Boot版本、编译的时间-- gedit lib_arm/board.c */
#if defined(CONFIG_DISPLAY_CPUINFO)
    print_cpuinfo,        /* display cpu info (and speed) */
#endif
#if defined(CONFIG_DISPLAY_BOARDINFO)
    checkboard,        /* display board info */
#endif
#if defined(CONFIG_HARD_I2C) || defined(CONFIG_SOFT_I2C)
    init_func_i2c,
#endif
    dram_init,         /*配置可用的RAM-- board/samsung/mini2440/mini2440.c */
#if defined(CONFIG_CMD_PCI) || defined (CONFIG_PCI)
    arm_pci_init,
#endif
    display_dram_config,  /* 显示RAM大小-- lib_arm/board.c */
    NULL,
};

/*
 * Basic board specific setup
 */
int board_init(void)
{
    u32 regVal;
    /* Get Timer and UART out of reset */
    /* UART 软复位 */
    regVal = __raw_readl(UART_SYSCFG);
    regVal |= 0x2;
    __raw_writel(regVal, UART_SYSCFG);
    while( (__raw_readl(UART_SYSSTS) & 0x1) != 0x1);
    /* 关闭smart idle */
    regVal = __raw_readl(UART_SYSCFG);
    regVal |= (1<<3);
    __raw_writel(regVal, UART_SYSCFG);
    /* 8168 dvr 开发板的机器码 */
    gd->bd->bi_arch_number = MACH_TYPE_TI8168EVM;
    /* 内核启动参数地址 */
    gd->bd->bi_boot_params = PHYS_DRAM_1 + 0x100;
    /*通用存储控制模块 初始化*/
    gpmc_init();
    /*gpio 初始化*/
    gpio_clkctrl_enable();
    gpio_dvr_init();
　　 /*初始化模拟spi的IO*/
    #if defined(CONFIG_3WIRE_EEPROM)
    dvr_netra_eeprom_init();
    #endif
    //# RDK 支持8bit NAND
    gpmc_set_cs_buswidth(0, 0);
    return 0;
}

/*
 * Configure DRAM banks
 *
 * Description: sets uboots idea of sdram size
 */
int dram_init(void)
{
    /* Fill up board info */
    gd->bd->bi_dram[0].start = PHYS_DRAM_1;
    gd->bd->bi_dram[0].size = PHYS_DRAM_1_SIZE;
    gd->bd->bi_dram[1].start = PHYS_DRAM_2;
    gd->bd->bi_dram[1].size = PHYS_DRAM_2_SIZE;
    return 0;
}

void start_armboot (void)
{
       init_fnc_t **init_fnc_ptr;
       char *s;
       … …
       /* 计算全局数据结构的地址gd */
       gd = (gd_t*)(_armboot_start - CONFIG_SYS_MALLOC_LEN - sizeof(gd_t));
       … …
       memset ((void*)gd, 0, sizeof (gd_t));
       gd->bd = (bd_t*)((char*)gd - sizeof(bd_t));
       memset (gd->bd, 0, sizeof (bd_t));
       gd->flags |= GD_FLG_RELOC;
 
       monitor_flash_len = _bss_start - _armboot_start;
 
       /* 逐个调用init_sequence数组中的初始化函数  */
       for (init_fnc_ptr = init_sequence; *init_fnc_ptr; ++init_fnc_ptr) {
              if ((*init_fnc_ptr)() != 0) {
                     hang ();
              }
       }
 
       /* armboot_start 在cpu/arm920t/start.S 中被初始化为u-boot.lds连接脚本中的_start */
       mem_malloc_init (_armboot_start - CONFIG_SYS_MALLOC_LEN,
                     CONFIG_SYS_MALLOC_LEN);
 
       /* NOR Flash初始化 */
#ifndef CONFIG_SYS_NO_FLASH
       /* configure available FLASH banks */
       display_flash_config (flash_init ());
#endif /* CONFIG_SYS_NO_FLASH */
 
       … … 
       /* NAND Flash 初始化*/
#if defined(CONFIG_CMD_NAND)
       puts ("NAND:  ");
       nand_init();         /* go init the NAND */
#endif
       … …
       /*配置环境变量，重新定位 */
       env_relocate ();
       … …
       /* 从环境变量中获取IP地址 */
       gd->bd->bi_ip_addr = getenv_IPaddr ("ipaddr");
       stdio_init (); /* get the devices list going. */
       jumptable_init ();
       … …
       console_init_r (); /* fully init console as a device */
       … …
       /* enable exceptions */
       enable_interrupts ();
 
#ifdef CONFIG_USB_DEVICE
       usb_init_slave();
#endif
 
       /* Initialize from environment */
       if ((s = getenv ("loadaddr")) != NULL) {
              load_addr = simple_strtoul (s, NULL, 16);
       }
#if defined(CONFIG_CMD_NET)
       if ((s = getenv ("bootfile")) != NULL) {
              copy_filename (BootFile, s, sizeof (BootFile));
       }
#endif
       … …
       /* 网卡初始化 */
#if defined(CONFIG_CMD_NET)
#if defined(CONFIG_NET_MULTI)
       puts ("Net:   ");
#endif
       eth_initialize(gd->bd);
… …
#endif
 
       /* main_loop() can return to retry autoboot, if so just run it again. */
       for (;;) {
              main_loop ();
       }
       /* NOTREACHED - no way out of command loop except booting */
}

void main_loop (void)
{
#ifndef CONFIG_SYS_HUSH_PARSER
    static char lastcommand[CONFIG_SYS_CBSIZE] = { 0, };
    int len;
    int rc = 1;
    int flag;
#endif
#if defined(CONFIG_BOOTDELAY) && (CONFIG_BOOTDELAY >= 0)
    char *s;
    int bootdelay;
#endif
#ifdef CONFIG_PREBOOT
    char *p;
#endif
#ifdef CONFIG_BOOTCOUNT_LIMIT
    unsigned long bootcount = 0;
    unsigned long bootlimit = 0;
    char *bcs;
    char bcs_set[16];
#endif /* CONFIG_BOOTCOUNT_LIMIT */
#if defined(CONFIG_VFD) && defined(VFD_TEST_LOGO)
    ulong bmp = 0;        /* default bitmap */
    extern int trab_vfd (ulong bitmap);
#ifdef CONFIG_MODEM_SUPPORT
    if (do_mdm_init)
        bmp = 1;    /* alternate bitmap */
#endif
    trab_vfd (bmp);
#endif    /* CONFIG_VFD && VFD_TEST_LOGO */
#ifdef CONFIG_BOOTCOUNT_LIMIT
    bootcount = bootcount_load();
    bootcount++;
    bootcount_store (bootcount);
    sprintf (bcs_set, "%lu", bootcount);
    setenv ("bootcount", bcs_set);
    bcs = getenv ("bootlimit");
    bootlimit = bcs ? simple_strtoul (bcs, NULL, 10) : 0;
#endif /* CONFIG_BOOTCOUNT_LIMIT */
#ifdef CONFIG_MODEM_SUPPORT
    debug ("DEBUG: main_loop:   do_mdm_init=%d\n", do_mdm_init);
    if (do_mdm_init) {
        char *str = strdup(getenv("mdm_cmd"));
        setenv ("preboot", str);  /* set or delete definition */
        if (str != NULL)
            free (str);
        mdm_init(); /* wait for modem connection */
    }
#endif  /* CONFIG_MODEM_SUPPORT */
#ifdef CONFIG_VERSION_VARIABLE
    {
        extern char version_string[];
        setenv ("ver", version_string);  /* set version variable */
    }
#endif /* CONFIG_VERSION_VARIABLE */
#ifdef CONFIG_SYS_HUSH_PARSER
    u_boot_hush_start ();
#endif
#if defined(CONFIG_HUSH_INIT_VAR)
    hush_init_var ();
#endif
#ifdef CONFIG_AUTO_COMPLETE
    install_auto_complete(); //安装自动补全的函数，分析如下
#endif
#ifdef CONFIG_PREBOOT
    if ((p = getenv ("preboot")) != NULL) {
# ifdef CONFIG_AUTOBOOT_KEYED
        int prev = disable_ctrlc(1);    /* disable Control C checking */
# endif
# ifndef CONFIG_SYS_HUSH_PARSER
        run_command (p, 0);
# else
        parse_string_outer(p, FLAG_PARSE_SEMICOLON |
                    FLAG_EXIT_FROM_LOOP);
# endif
# ifdef CONFIG_AUTOBOOT_KEYED
        disable_ctrlc(prev);    /* restore Control C checking */
# endif
    }
#endif /* CONFIG_PREBOOT */
#if defined(CONFIG_UPDATE_TFTP)
    update_tftp ();
#endif /* CONFIG_UPDATE_TFTP */
#if defined(CONFIG_BOOTDELAY) && (CONFIG_BOOTDELAY >= 0)
    s = getenv ("bootdelay");
    bootdelay = s ? (int)simple_strtol(s, NULL, 10) : CONFIG_BOOTDELAY;
    debug ("### main_loop entered: bootdelay=%d\n\n", bootdelay);
# ifdef CONFIG_BOOT_RETRY_TIME
    init_cmd_timeout ();
# endif    /* CONFIG_BOOT_RETRY_TIME */
#ifdef CONFIG_POST
    if (gd->flags & GD_FLG_POSTFAIL) {
        s = getenv("failbootcmd");
    }
    else
#endif /* CONFIG_POST */
#ifdef CONFIG_BOOTCOUNT_LIMIT
    if (bootlimit && (bootcount > bootlimit)) {
        printf ("Warning: Bootlimit (%u) exceeded. Using altbootcmd.\n",
                (unsigned)bootlimit);
        s = getenv ("altbootcmd");
    }
    else
#endif /* CONFIG_BOOTCOUNT_LIMIT */
        s = getenv ("bootcmd"); //获取引导命令。分析见下面。
    printf ("### main_loop: bootcmd=\"%s\"\n", s ? s : "<UNDEFINED>");
    if (bootdelay >= 0 && s && !abortboot (bootdelay)) {
                //如果延时大于等于零，并且没有在延时过程中接收到按键，则引导内核。abortboot函数的分析见下面。 
# ifdef CONFIG_AUTOBOOT_KEYED
        int prev = disable_ctrlc(1);    /* disable Control C checking */
# endif
# ifndef CONFIG_SYS_HUSH_PARSER
        run_command (s, 0);//运行引导内核的命令。这个命令是在配置头文件中定义的。run_command的分析在下面。
# else
        parse_string_outer(s, FLAG_PARSE_SEMICOLON |
                    FLAG_EXIT_FROM_LOOP);
# endif
# ifdef CONFIG_AUTOBOOT_KEYED
        disable_ctrlc(prev);    /* restore Control C checking */
# endif
    }
# ifdef CONFIG_MENUKEY
    if (menukey == CONFIG_MENUKEY) {
        s = getenv("menucmd");
        if (s) {
# ifndef CONFIG_SYS_HUSH_PARSER
        run_command (s, 0);
# else
        parse_string_outer(s, FLAG_PARSE_SEMICOLON |
                    FLAG_EXIT_FROM_LOOP);
# endif
        }
    }
#endif /* CONFIG_MENUKEY */
#endif    /* CONFIG_BOOTDELAY */
#ifdef CONFIG_AMIGAONEG3SE
    {
        extern void video_banner(void);
        video_banner();
    }
#endif
    /*
     * Main Loop for Monitor Command Processing
     */
#ifdef CONFIG_SYS_HUSH_PARSER
    parse_file_outer();
    /* This point is never reached */
    for (;;);
#else
    for (;;) { 
#ifdef CONFIG_BOOT_RETRY_TIME
        if (rc >= 0) {
            /* Saw enough of a valid command to
             * restart the timeout.
             */
            reset_cmd_timeout();
        }
#endif
        len = readline (CONFIG_SYS_PROMPT); //CONFIG_SYS_PROMPT的意思是回显字符，一般是“>”。这是由配置头文件定义的
        flag = 0;    /* assume no special flags for now */
        if (len > 0)
            strcpy (lastcommand, console_buffer); //保存输入的数据。
        else if (len == 0)
            flag |= CMD_FLAG_REPEAT; ;//如果输入数据为零，则重复执行上次的命令，如果上次输入的是一个命令的话 
#ifdef CONFIG_BOOT_RETRY_TIME
        else if (len == -2) {
            /* -2 means timed out, retry autoboot
             */
            puts ("\nTimed out waiting for command\n");
# ifdef CONFIG_RESET_TO_RETRY
            /* Reinit board to run initialization code again */
            do_reset (NULL, 0, 0, NULL);
# else
            return;        /* retry autoboot */
# endif
        }
#endif
        if (len == -1)
            puts ("<INTERRUPT>\n");
        else
            rc = run_command (lastcommand, flag); //执行命令 
        if (rc <= 0) {//执行失败，则清空记录 
            /* invalid command or not repeatable, forget it */
            lastcommand[0] = 0;
        }
    }
#endif /*CONFIG_SYS_HUSH_PARSER*/
}

struct tag_header {
       u32 size;       /* 表示tag数据结构的联合u实质存放的数据的大小*/
       u32 tag;        /* 表示标记的类型 */
};
 
struct tag {
       struct tag_header hdr;
       union {
              struct tag_core           core;
              struct tag_mem32      mem;
              struct tag_videotext   videotext;
              struct tag_ramdisk     ramdisk;
              struct tag_initrd  initrd;
              struct tag_serialnr       serialnr;
              struct tag_revision      revision;
              struct tag_videolfb     videolfb;
              struct tag_cmdline     cmdline;
 
              /*
               * Acorn specific
               */
              struct tag_acorn  acorn;
              /*
               * DC21285 specific
               */
              struct tag_memclk      memclk;
       } u;
};

int do_bootm_linux(int flag, int argc, char *argv[], bootm_headers_t *images)
{
       bd_t       *bd = gd->bd;
       char       *s;
       int   machid = bd->bi_arch_number;
       void       (*theKernel)(int zero, int arch, uint params);
  
#ifdef CONFIG_CMDLINE_TAG
       char *commandline = getenv ("bootargs");   /* U-Boot环境变量bootargs */
#endif
       … …
       theKernel = (void (*)(int, int, uint))images->ep; /* 获取内核入口地址 */
       … …
#if   defined (CONFIG_SETUP_MEMORY_TAGS) || \
       defined (CONFIG_CMDLINE_TAG) || \
       defined (CONFIG_INITRD_TAG) || \
       defined (CONFIG_SERIAL_TAG) || \
       defined (CONFIG_REVISION_TAG) || \
       defined (CONFIG_LCD) || \
       defined (CONFIG_VFD)
       setup_start_tag (bd);                                     /* 设置ATAG_CORE标志 */
       … …
#ifdef CONFIG_SETUP_MEMORY_TAGS
      setup_memory_tags (bd);                             /* 设置内存标记 */
#endif
 #ifdef CONFIG_CMDLINE_TAG
      setup_commandline_tag (bd, commandline);      /* 设置命令行标记 */
#endif
       … …
      setup_end_tag (bd);                               /* 设置ATAG_NONE标志 */          
#endif
      /* we assume that the kernel is in place */
      printf ("\nStarting kernel ...\n\n");
       … …
      cleanup_before_linux ();          /* 启动内核前对CPU作最后的设置 */
 
      theKernel (0, machid, bd->bi_boot_params);      /* 调用内核 */
 
      /* does not return */
      return 1;
}

static void setup_start_tag (bd_t *bd)
{
       params = (struct tag *) bd->bi_boot_params;  /* 内核的参数的开始地址 */
 
       params->hdr.tag = ATAG_CORE;
       params->hdr.size = tag_size (tag_core);
 
       params->u.core.flags = 0;
       params->u.core.pagesize = 0;
       params->u.core.rootdev = 0;
 
       params = tag_next (params);
}

static void setup_memory_tags (bd_t *bd)
{
       int i;
       /*设置一个内存标记 */
       for (i = 0; i < CONFIG_NR_DRAM_BANKS; i++) {   
              params->hdr.tag = ATAG_MEM;
              params->hdr.size = tag_size (tag_mem32);
 
              params->u.mem.start = bd->bi_dram[i].start;
              params->u.mem.size = bd->bi_dram[i].size;
 
              params = tag_next (params);
       }
}

static void setup_end_tag (bd_t *bd)
{
       params->hdr.tag = ATAG_NONE;
       params->hdr.size = 0;
}

int cleanup_before_linux (void)
{
       /*
        * this function is called just before we call linux
        * it prepares the processor for linux
        *
        * we turn off caches etc ...
        */
       disable_interrupts ();         /* 禁止FIQ/IRQ中断 */
 
       /* turn off I/D-cache */
       icache_disable();               /* 使指令Cache失效 */
       dcache_disable();              /* 使数据Cache失效 */
       /* flush I/D-cache */
       cache_flush();                    /* 刷新Cache */
 
       return 0;
}

void       (*theKernel)(int zero, int arch, uint params);
    … …
    theKernel = (void (*)(int, int, uint))images->ep;
    … …
    theKernel (0, machid, bd->bi_boot_params);    
int do_bootm_linux(int flag, int argc, char * const argv[],
           bootm_headers_t *images)
{
    /* No need for those on ARM */
    if (flag & BOOTM_STATE_OS_BD_T || flag & BOOTM_STATE_OS_CMDLINE)
        return -1;
        // 当flag为BOOTM_STATE_OS_PREP，则说明只需要做准备动作boot_prep_linux
    if (flag & BOOTM_STATE_OS_PREP) {
        boot_prep_linux(images);
        return 0;
    }
        // 当flag为BOOTM_STATE_OS_GO ，则说明只需要做跳转动作 
        if (flag & (BOOTM_STATE_OS_GO | BOOTM_STATE_OS_FAKE_GO)) {
        boot_jump_linux(images, flag);
        return 0;
    }
    boot_prep_linux(images); // 以全局变量bootm_headers_t images为参数传递给boot_prep_linux
    boot_jump_linux(images, flag);// 以全局变量bootm_headers_t images为参数传递给boot_jump_linux
    return 0;
}

static void boot_prep_linux(bootm_headers_t *images)
{
    char *commandline = getenv("bootargs");
    if (IMAGE_ENABLE_OF_LIBFDT && images->ft_len) {
#ifdef CONFIG_OF_LIBFDT
        debug("using: FDT\n");
        if (image_setup_linux(images)) {
            printf("FDT creation failed! hanging...");
            hang();
        }
#endif
    }

static void boot_jump_linux(bootm_headers_t *images, int flag)
{
    unsigned long machid = gd->bd->bi_arch_number; // 从bd中获取machine-id，machine-id在uboot启动流程的文章中有说明过了
    char *s;
    void (*kernel_entry)(int zero, int arch, uint params); // kernel入口函数，也就是kernel的入口地址，对应kernel的_start地址。
    unsigned long r2;
    int fake = (flag & BOOTM_STATE_OS_FAKE_GO); // 伪跳转，并不真正地跳转到kernel中
    kernel_entry = (void (*)(int, int, uint))images->ep; 
         // 将kernel_entry设置为images中的ep（kernel的入口地址），后面直接执行kernel_entry也就跳转到了kernel中了
        // 这里要注意这种跳转的方法
    debug("## Transferring control to Linux (at address %08lx)" \
        "...\n", (ulong) kernel_entry);
    bootstage_mark(BOOTSTAGE_ID_RUN_OS);
    announce_and_cleanup(fake);
        // 把images->ft_addr（fdt的地址）放在r2寄存器中
    if (IMAGE_ENABLE_OF_LIBFDT && images->ft_len)
        r2 = (unsigned long)images->ft_addr;
    else
        r2 = gd->bd->bi_boot_params;
    if (!fake) {
            kernel_entry(0, machid, r2);
        // 这里通过调用kernel_entry，就跳转到了images->ep中了，也就是跳转到kernel中了，具体则是kernel的_start符号的地址。
        // 参数0则传入到r0寄存器中，参数machid传入到r1寄存器中，把images->ft_addr（fdt的地址）放在r2寄存器中
        // 满足了kernel启动的硬件要求
    }
}

ENTRY(stext)
jiffies = jiffies_64;
SECTIONS
{
......
. = 0xC0000000 + 0x00008000;
.head.text : {
_text = .;
*(.head.text)
}
.text : { /* Real text segment */
_stext = .; /* Text and read-only data */

textofs-y := 0x00008000
......
# The byte offset of the kernel image in RAM from the start of RAM.
TEXT_OFFSET := $(textofs-y)

#ifdef CONFIG_MMU
 
/*
* PAGE_OFFSET - the virtual address of the start of the kernel image
* TASK_SIZE - the maximum size of a user space task.
* TASK_UNMAPPED_BASE - the lower boundary of the mmap VM area
*/
#define PAGE_OFFSET UL(CONFIG_PAGE_OFFSET)

config PAGE_OFFSET
hex
default 0x40000000 if VMSPLIT_1G
default 0x80000000 if VMSPLIT_2G
default 0xC0000000

/*
* swapper_pg_dir is the virtual address of the initial page table.
* We place the page tables 16K below KERNEL_RAM_VADDR. Therefore, we must
* make sure that KERNEL_RAM_VADDR is correctly set. Currently, we expect
* the least significant 16 bits to be 0x8000, but we could probably
* relax this restriction to KERNEL_RAM_VADDR >= PAGE_OFFSET + 0x4000.
*/
#define KERNEL_RAM_VADDR (PAGE_OFFSET + TEXT_OFFSET)
#if (KERNEL_RAM_VADDR & 0xffff) != 0x8000
#error KERNEL_RAM_VADDR must start at 0xXXXX8000
#endif
 
#ifdef CONFIG_ARM_LPAE
/* LPAE requires an additional page for the PGD */
#define PG_DIR_SIZE 0x5000
#define PMD_ORDER 3
#else
#define PG_DIR_SIZE 0x4000
#define PMD_ORDER 2
#endif
 
.globl swapper_pg_dir
.equ swapper_pg_dir, KERNEL_RAM_VADDR - PG_DIR_SIZE
 
.macro pgtbl, rd, phys
add \rd, \phys, #TEXT_OFFSET - PG_DIR_SIZE
.endm

/*
* Kernel startup entry point.
* ---------------------------
*
* This is normally called from the decompressor code. The requirements
* are: MMU = off, D-cache = off, I-cache = dont care, r0 = 0,
* r1 = machine nr, r2 = atags or dtb pointer.
*
* This code is mostly position independent, so if you link the kernel at
* 0xc0008000, you call this at __pa(0xc0008000).
*
* See linux/arch/arm/tools/mach-types for the complete list of machine
* numbers for r1.
*
* We're trying to keep crap to a minimum; DO NOT add any machine specific
* crap here - that's what the boot loader (or in extreme, well justified
* circumstances, zImage) is for.
*/
.arm
 
__HEAD
ENTRY(stext)

_BOOT_CMD(
       menu,    3,    0,    do_menu,
       "menu - display a menu, to select the items to do something\n",
       " - display a menu, to select the items to do something"
);

U_BOOT_CMD(name,maxargs,rep,cmd,usage,help)

在内存中保存命令的help字段会占用一定的内存，通过配置U-Boot可以选择是否保存help字段。

U_BOOT_CMD宏在include/command.h中定义：

#define U_BOOT_CMD(name,maxargs,rep,cmd,usage,help) \
　　　　cmd_tbl_t __u_boot_cmd_##name Struct_Section = {#name, maxargs, rep, cmd, usage, help}

struct cmd_tbl_s {
       char       *name;          /* 命令名 */
       int          maxargs;       /* 最大参数个数 */
       int          repeatable;    /* 是否自动重复 */
       int          (*cmd)(struct cmd_tbl_s *, int, int, char *[]);  /*  响应函数 */
       char       *usage;         /* 简短的帮助信息 */
#ifdef    CONFIG_SYS_LONGHELP
       char              *help;           /*  较详细的帮助信息 */
#endif
#ifdef CONFIG_AUTO_COMPLETE
       /* 自动补全参数 */
       int          (*complete)(int argc, char *argv[], char last_char, int maxv, char *cmdv[]);
#endif
};
typedef struct cmd_tbl_s  cmd_tbl_t;

#define Struct_Section  __attribute__ ((unused,section (".u_boot_cmd")))

. = .;
__u_boot_cmd_start = .;          /*将 __u_boot_cmd_start指定为当前地址 */
.u_boot_cmd : { *(.u_boot_cmd) }
__u_boot_cmd_end = .;           /*  将__u_boot_cmd_end指定为当前地址  */

因此“menu”命令的定义经过宏展开后如下：

int do_menu (cmd_tbl_t *cmdtp, int flag, int argc, char *argv[])
{
       /* 实现代码略 */
}

COBJS-$(CONFIG_BOOT_MENU) += cmd_menu.o

#define CONFIG_BOOT_MENU 1

#include <common.h>
#include <command.h>
extern char console_buffer[];
extern int readline (const char *const prompt);
extern char awaitkey(unsigned long delay, int* error_p);
extern void download_nkbin_to_flash(void);
 /**
 * Parses a string into a number.  The number stored at ptr is
 * potentially suffixed with K (for kilobytes, or 1024 bytes),
 * M (for megabytes, or 1048576 bytes), or G (for gigabytes, or
 * 1073741824).  If the number is suffixed with K, M, or G, then
 * the return value is the number multiplied by one kilobyte, one
 * megabyte, or one gigabyte, respectively.
 *
 * @param ptr where parse begins
 * @param retptr output pointer to next char after parse completes (output)
 * @return resulting unsigned int
 */
static unsigned long memsize_parse2 (const char *const ptr, const char **retptr)
{
      unsigned long ret = simple_strtoul(ptr, (char **)retptr, 0);
      int sixteen = 1;
      switch (**retptr) {
      case 'G':
      case 'g':
          ret <<= 10;
      case 'M':
      case 'm':
          ret <<= 10;
      case 'K':
      case 'k':
          ret <<= 10;
          (*retptr)++;
          sixteen = 0;
      default:
          break;
      }
      if (sixteen)
          return simple_strtoul(ptr, NULL, 16);
     
      return ret;
}
 
void param_menu_usage()
{
     printf("\r\n##### Parameter Menu #####\r\n");
     printf("[v] View the parameters\r\n");
     printf("[s] Set parameter \r\n");
     printf("[d] Delete parameter \r\n");
     printf("[w] Write the parameters to flash memeory \r\n");
     printf("[q] Quit \r\n");
     printf("Enter your selection: ");
}
 
void param_menu_shell(void)
{
     char c;
     char cmd_buf[256];
     char name_buf[20];
     char val_buf[256];
    
      while (1)
     {
          param_menu_usage();
         c = awaitkey(-1, NULL);
         printf("%c\n", c);
         switch (c)
         {
             case 'v':
             {
                 strcpy(cmd_buf, "printenv ");
                 printf("Name(enter to view all paramters): ");
                 readline(NULL);
                 strcat(cmd_buf, console_buffer);
                 run_command(cmd_buf, 0);
                 break;
             }
            
              case 's':
             {
                 sprintf(cmd_buf, "setenv ");
                 printf("Name: ");
                 readline(NULL);
                 strcat(cmd_buf, console_buffer);
                 printf("Value: ");
                 readline(NULL);
                 strcat(cmd_buf, " ");
                 strcat(cmd_buf, console_buffer);
                 run_command(cmd_buf, 0);
                 break;
             }
            
              case 'd':
             {
                 sprintf(cmd_buf, "setenv ");
                 printf("Name: ");
                 readline(NULL);
                 strcat(cmd_buf, console_buffer);
                 run_command(cmd_buf, 0);
                 break;
             }
            
              case 'w':
             {
                 sprintf(cmd_buf, "saveenv");
                 run_command(cmd_buf, 0);
                 break;
             }
            
              case 'q':
             {
                 return;
                 break;
             }
         }
     }
}
 
void main_menu_usage(void)
{
     printf("\r\n##### 100ask Bootloader for OpenJTAG #####\r\n");
     printf("[n] Download u-boot to Nand Flash\r\n");
     if (bBootFrmNORFlash())
          printf("[o] Download u-boot to Nor Flash\r\n");
     printf("[k] Download Linux kernel uImage\r\n");
     printf("[j] Download root_jffs2 image\r\n");
    //    printf("[c] Download root_cramfs image\r\n");
     printf("[y] Download root_yaffs image\r\n");
     printf("[d] Download to SDRAM & Run\r\n");
     printf("[z] Download zImage into RAM\r\n");
     printf("[g] Boot linux from RAM\r\n");
     printf("[f] Format the Nand Flash\r\n");
     printf("[s] Set the boot parameters\r\n");
     printf("[b] Boot the system\r\n");
     printf("[r] Reboot u-boot\r\n");
     printf("[q] Quit from menu\r\n");
     printf("Enter your selection: ");
}
 
void menu_shell(void)
{
     char c;
     char cmd_buf[200];
     char *p = NULL;
     unsigned long size;
     unsigned long offset;
     struct mtd_info *mtd = &nand_info[nand_curr_device];
     while (1)
     {
         main_menu_usage();
         c = awaitkey(-1, NULL);
         printf("%c\n", c);
         switch (c)
         {
            case 'n':
            {
                 strcpy(cmd_buf, "usbslave 1 0x30000000; nand erase bootloader; nand write.jffs2 0x30000000 bootloader $(filesize)");
                 run_command(cmd_buf, 0);
                 break;
            }
            case 'o':
            {
                if (bBootFrmNORFlash())
                {
                     strcpy(cmd_buf, "usbslave 1 0x30000000; protect off all; erase 0 +$(filesize); cp.b 0x30000000 0 $(filesize)");
                     run_command(cmd_buf, 0);
                 }
                 break;
             }
            
            case 'k':
             {
                 strcpy(cmd_buf, "usbslave 1 0x30000000; nand erase kernel; nand write.jffs2 0x30000000 kernel $(filesize)");
                 run_command(cmd_buf, 0);
                 break;
             }
             case 'j':
             {
                 strcpy(cmd_buf, "usbslave 1 0x30000000; nand erase root; nand write.jffs2 0x30000000 root $(filesize)");
                 run_command(cmd_buf, 0);
                 break;
             }
#if 0
             case 'c':
             {
                 strcpy(cmd_buf, "usbslave 1 0x30000000; nand erase root; nand write.jffs2 0x30000000 root $(filesize)");
                 run_command(cmd_buf, 0);
                 break;
             }
#endif
             case 'y':
             {
                 strcpy(cmd_buf, "usbslave 1 0x30000000; nand erase root; nand write.yaffs 0x30000000 root $(filesize)");
                 run_command(cmd_buf, 0);
                 break;
             }
             case 'd':
             {
                 extern volatile U32 downloadAddress;
                 extern int download_run;
                
                 download_run = 1;
                 strcpy(cmd_buf, "usbslave 1");
                 run_command(cmd_buf, 0);
                 download_run = 0;
                 sprintf(cmd_buf, "go %x", downloadAddress);
                 run_command(cmd_buf, 0);
                 break;
             }
             case 'z':
             {
                 strcpy(cmd_buf, "usbslave 1 0x30008000");
                 run_command(cmd_buf, 0);
                 break;
             }
             case 'g':
             {
                 extern void do_bootm_rawLinux (ulong addr);
                 do_bootm_rawLinux(0x30008000);
             }
             case 'b':
             {
                 printf("Booting Linux ...\n");
                 strcpy(cmd_buf, "nand read.jffs2 0x30007FC0 kernel; bootm 0x30007FC0");
                 run_command(cmd_buf, 0);
                 break;
             }
             case 'f':
             {
                 strcpy(cmd_buf, "nand erase ");
                 printf("Start address: ");
                 readline(NULL);
                 strcat(cmd_buf, console_buffer);
                 printf("Size(eg. 4000000, 0x4000000, 64m and so on): ");
                 readline(NULL);
                 p = console_buffer;
                 size = memsize_parse2(p, &p);
                 sprintf(console_buffer, " %x", size);
                 strcat(cmd_buf, console_buffer);
                 run_command(cmd_buf, 0);
                 break;
             }
             case 's':
             {
                 param_menu_shell();
                 break;
             }
             case 'r':
             {
                 strcpy(cmd_buf, "reset");
                 run_command(cmd_buf, 0);
                 break;
             }
            
              case 'q':
             {
                 return;   
                  break;
             }
         }
                
      }
}
int do_menu (cmd_tbl_t *cmdtp, int flag, int argc, char *argv[])
{
     menu_shell();
     return 0;
}
U_BOOT_CMD(
　　 　menu, 3, 0, do_menu,
　　　 "menu - display a menu, to select the items to do something\n",
      " - display a menu, to select the items to do something"
);

#include <common.h>
#include <command.h>
/**功能：等待键盘输入***/
static char awaitkey(unsigned long delay, int* error_p)
{
     int i;
     char c;
     if (delay == -1) {
         while (1) {
             if (tstc()) /* we got a key press */
                 return getc();
         }
     }
     else {       
          for (i = 0; i < delay; i++) {
       　　　　if (tstc()) /* we got a key press */
        　　　　　　return getc();
             udelay (10*1000);
         }
     }
     if (error_p)
        *error_p = -1;
     return 0;
}     
 
/*****提示符，功能说明****/ 
void main_menu_usage(void)
{
   printf("\r\n######## Hotips TFTP DownLoad for SMDK2440 ########\r\n");
   printf("\r\n");
   printf("[1] 下载 u-boot.bin       写入 Nand Flash\r\n");
   printf("[2] 下载 Linux(uImage)    内核镜像写入 Nand Flash\r\n");
   printf("[3] 下载 yaffs2(fs.yaffs) 文件系统镜像写入 Nand Flash\r\n");
   printf("[4] 下载 Linux(uImage)    内核镜像到内存并运行\r\n");
   printf("[5] 重启设备\r\n");
   printf("[q] 退出菜单\r\n");
   printf("\r\n");
   printf("输入选择: ");
}
/***do_menu()的调用函数，命令的具体实现***/
void menu_shell(void)
{
     char c;
     char cmd_buf[200];
     while (1)
     {
       main_menu_usage();
       c = awaitkey(-1, NULL);
       printf("%c\n", c);
       switch (c)
       {
         case '1':
         {
           strcpy(cmd_buf, "tftp 0x32000000 u-boot.bin; nand erase 0x0 0x60000; nand write 0x32000000 0x0 0x60000");
           run_command(cmd_buf, 0);
           break;
         }
         case '2':
         {
           strcpy(cmd_buf, "tftp 0x32000000 uImage; nand erase 0x80000 0x200000; nand write 0x32000000 0x80000 0x200000");
           run_command(cmd_buf, 0);
           break;
         }
         case '3':
         {
           strcpy(cmd_buf, "tftp 0x32000000 fs.yaffs; nand erase 0x280000; nand write.yaffs2 0x32000000 0x280000 $(filesize)");
           run_command(cmd_buf, 0);
           break;
         }
         case '4':
         {
           strcpy(cmd_buf, "tftp 0x32000000 uImage; bootm 0x32000000");
           run_command(cmd_buf, 0);
           break;
         }
         case '5':
         {
           strcpy(cmd_buf, "reset");
           run_command(cmd_buf, 0);
           break;
         }
         case 'q':
         {
           return;   
            break;
         }
       }
     }
}
int do_menu (cmd_tbl_t *cmdtp, int flag, int argc, char *argv[])
{
     menu_shell();
     return 0;
}
U_BOOT_CMD(
   menu, 1, 0, do_menu,
   "Download Menu",
   "U-boot Download Menu by Hotips\n"
);