Linux系统中u-boot启动流程分析（详解）

u-boot:启动详细的代码调用流程
u-boot.lds:(arch/arm/cpu/u-boot.lds)
    |-->_start:(arch/arm/lib/vectors.S)
        |-->reset(arch/arm/cpu/armv7/start.S)    
            |-->save_boot_params(arch/arm/cpu/armv7/start.S)/*将引导参数保存到内存中*/
                |-->save_boot_params_ret(arch/arm/cpu/armv7/start.S)
                    |-->cpu_init_cp15(arch/arm/cpu/armv7/start.S)/*初始化*/
                    |-->cpu_init_crit(arch/arm/cpu/armv7/start.S)
                        |-->lowlevel_init(arch/arm/cpu/armv7/lowlevel_init.S)
                    |-->_main(arch/arm/lib/crt0.S)
                        |-->board_init_f_alloc_reserve(common/init/board_init.c)/*为u-boot的gd结构体分配空间*/
                        |-->board_init_f_init_reserve(common/init/board_init.c)    /*将gd结构体清零*/
                        |-->board_init_f(common/board_f.c)
                            |-->initcall_run_list(include/initcall.h)    /*初始化序列函数*/
                                |-->init_sequence_f[](common/board_f.c)    /* 初始化序列函数数组 */
                                    |-->board_early_init_f(board/freescale/mx6ull_toto/mx6ull_toto.c)/*初始化串口的IO配置*/
                                    |-->timer_init(arch/arm/imx-common/timer.c)    /*初始化内核定时器，为uboot提供时钟节拍*/
                                    |-->init_baud_rate(common/board_f.c)        /*初始化波特率*/
                                    |-->serial_init(drivers/serial/serial.c)    /*初始化串口通信设置*/
                                    |-->console_init_f(common/console.c)        /*初始化控制台*/
                                    |-->...
                        |-->relocate_code(arch/arm/lib/relocate.S)    /*主要完成镜像拷贝和重定位*/
                        |-->relocate_vectors(arch/arm/lib/relocate.S)/*重定位向量表*/
                        |-->board_init_r(common/board_r.c)/*板级初始化*/
                            |-->initcall_run_list(include/initcall.h)/*初始化序列函数*/
                                |-->init_sequence_r[](common/board_f.c)/*序列函数*/
                                    |-->initr_reloc(common/board_r.c)    /*设置 gd->flags,标记重定位完成*/
                                    |-->serial_initialize(drivers/serial/serial-uclass.c)/*初始化串口*/
                                        |-->serial_init(drivers/serial/serial-uclass.c)     /*初始化串口*/
                                    |-->initr_mmc(common/board_r.c)                         /*初始化emmc*/
                                        |-->mmc_initialize(drivers/mmc/mmc.c)
                                            |-->mmc_do_preinit(drivers/mmc/mmc.c)
                                                |-->mmc_start_init(drivers/mmc/mmc.c)
                                    |-->console_init_r(common/console.c)                /*初始化控制台*/
                                    |-->interrupt_init(arch/arm/lib/interrupts.c)        /*初始化中断*/
                                    |-->initr_net(common/board_r.c)                        /*初始化网络设备*/
                                        |-->eth_initialize(net/eth-uclass.c)
                                            |-->eth_common_init(net/eth_common.c)
                                                |-->phy_init(drivers/net/phy/phy.c)
                                            |-->uclass_first_device_check(drivers/core/uclass.c)
                                                |-->uclass_find_first_device(drivers/core/uclass.c)
                                                |-->device_probe(drivers/core/device.c)
                                                    |-->device_of_to_plat(drivers/core/device.c)
                                                        |-->drv->of_to_plat
                                                            |-->fecmxc_of_to_plat(drivers/net/fec_mxc.c)/*解析设备树信息*/
                                                    |-->device_get_uclass_id(drivers/core/device.c)
                                                    |-->uclass_pre_probe_device(drivers/core/uclass.c)
                                                    |-->drv->probe(dev)
                                                        /*drivers/net/fec_mxc.c*/
                                                        U_BOOT_DRIVER(fecmxc_gem) = {
                                                            .name    = "fecmxc",
                                                            .id    = UCLASS_ETH,
                                                            .of_match = fecmxc_ids,
                                                            .of_to_plat = fecmxc_of_to_plat,
                                                            .probe    = fecmxc_probe,
                                                            .remove    = fecmxc_remove,
                                                            .ops    = &fecmxc_ops,
                                                            .priv_auto    = sizeof(struct fec_priv),
                                                            .plat_auto    = sizeof(struct eth_pdata),
                                                        };
                                                        |-->fecmxc_probe(drivers/net/fec_mxc.c)/*探测和初始化*/
                                                            |-->fec_get_miibus(drivers/net/fec_mxc.c)
                                                                |-->mdio_alloc(drivers/net/fec_mxc.c)
                                                                |-->bus->read = fec_phy_read;
                                                                |-->bus->write = fec_phy_write;
                                                                |-->mdio_register(common/miiphyutil.c)
                                                                |-->fec_mii_setspeed(drivers/net/fec_mxc.c)
                                                            |-->fec_phy_init(drivers/net/fec_mxc.c)
                                                                |-->device_get_phy_addr(drivers/net/fec_mxc.c)
                                                                |-->phy_connect(drivers/net/phy/phy.c)
                                                                    |-->phy_find_by_mask(drivers/net/phy/phy.c)
                                                                        |-->bus->reset(bus)
                                                                        |-->get_phy_device_by_mask(drivers/net/phy/phy.c)
                                                                            |-->create_phy_by_mask(drivers/net/phy/phy.c)
                                                                                |-->phy_device_create(drivers/net/phy/phy.c)
                                                                                    |-->phy_probe(drivers/net/phy/phy.c)
                                                                    |-->phy_connect_dev(drivers/net/phy/phy.c)
                                                                        |-->phy_reset(drivers/net/phy/phy.c)
                                                                |-->phy_config(drivers/net/phy/phy.c)
                                                                    |-->board_phy_config(drivers/net/phy/phy.c)
                                                                        |-->phydev->drv->config(phydev)
                                                                            /*drivers/net/phy/smsc.c*/
                                                                            static struct phy_driver lan8710_driver = {
                                                                                .name = "SMSC LAN8710/LAN8720",
                                                                                .uid = 0x0007c0f0,
                                                                                .mask = 0xffff0,
                                                                                .features = PHY_BASIC_FEATURES,
                                                                                .config = &genphy_config_aneg,
                                                                                .startup = &genphy_startup,
                                                                                .shutdown = &genphy_shutdown,
                                                                            };
                                                                            |-->genphy_config_aneg(drivers/net/phy/phy.c)
                                                                                |-->phy_reset(需要手动调用)(drivers/net/phy/phy.c)
                                                                                |-->genphy_setup_forced(drivers/net/phy/phy.c)
                                                                                |-->genphy_config_advert(drivers/net/phy/phy.c)
                                                                                |-->genphy_restart_aneg(drivers/net/phy/phy.c)
                                                    |-->uclass_post_probe_device(drivers/core/uclass.c)
                                                        |-->uc_drv->post_probe(drivers/core/uclass.c)
                                                            /*net/eth-uclass.c*/
                                                            UCLASS_DRIVER(ethernet) = {
                                                                .name        = "ethernet",
                                                                .id        = UCLASS_ETH,
                                                                .post_bind    = eth_post_bind,
                                                                .pre_unbind    = eth_pre_unbind,
                                                                .post_probe    = eth_post_probe,
                                                                .pre_remove    = eth_pre_remove,
                                                                .priv_auto    = sizeof(struct eth_uclass_priv),
                                                                .per_device_auto    = sizeof(struct eth_device_priv),
                                                                .flags        = DM_UC_FLAG_SEQ_ALIAS,
                                                            };
                                                            |-->eth_post_probe(net/eth-uclass.c)
                                                                |-->eth_write_hwaddr(drivers/core/uclass.c)
                                    |-->...
                                    |-->run_main_loop(common/board_r.c)/*主循环，处理命令*/
                                        |-->main_loop(common/main.c)
                                            |-->bootdelay_process(common/autoboot.c)    /*读取环境变量bootdelay和bootcmd的内容*/
                                            |-->autoboot_command(common/autoboot.c)        /*倒计时按下执行，没有操作执行bootcmd的参数*/
                                                |-->abortboot(common/autoboot.c)
                                                    |-->printf("Hit any key to stop autoboot: %2d ", bootdelay);
                                                    /*到这里就是我们看到uboot延时3s启动内核的地方*/
                                            |-->cli_loop(common/cli.c)    /*倒计时按下space键,执行用户输入命令*/

/* SPDX-License-Identifier: GPL-2.0+ */
/*
 * Copyright (c) 2004-2008 Texas Instruments
 *
 * (C) Copyright 2002
 * Gary Jennejohn, DENX Software Engineering, <garyj@denx.de>
 */
#include <config.h>
#include <asm/psci.h>
/* 指定输出可执行文件: "elf 32位 小端格式 arm指令" */
OUTPUT_FORMAT("elf32-littlearm", "elf32-littlearm", "elf32-littlearm")
/* 指定输出可执行文件的目标架构:"arm" */
OUTPUT_ARCH(arm)
/* 指定输出可执行文件的起始地址为:"_start" */
ENTRY(_start)
SECTIONS
{
#ifndef CONFIG_CMDLINE
    /DISCARD/ : { *(__u_boot_list_2_cmd_*) }
#endif
#if defined(CONFIG_ARMV7_SECURE_BASE) && defined(CONFIG_ARMV7_NONSEC)
    /*
     * If CONFIG_ARMV7_SECURE_BASE is true, secure code will not
     * bundle with u-boot, and code offsets are fixed. Secure zone
     * only needs to be copied from the loading address to
     * CONFIG_ARMV7_SECURE_BASE, which is the linking and running
     * address for secure code.
     *
     * If CONFIG_ARMV7_SECURE_BASE is undefined, the secure zone will
     * be included in u-boot address space, and some absolute address
     * were used in secure code. The absolute addresses of the secure
     * code also needs to be relocated along with the accompanying u-boot
     * code.
     *
     * So DISCARD is only for CONFIG_ARMV7_SECURE_BASE.
     */
    /DISCARD/ : { *(.rel._secure*) }
#endif
    /* 
     * 指定可执行文件(image)的全局入口地址，通常都放在ROM(flash)0x0位置
     * 设置 0 的原因是 arm 内核的处理器,上电后默认是从 0x00000000 处启动
     */
    . = 0x00000000;
    . = ALIGN(4);                     ``````````/* 中断向量表 */
    .text :
    {
        *(.__image_copy_start)         /* u-boot 的设计中需要将 u-boot 的镜像拷贝到 ram(sdram,ddr....)中执行，这里表示复制的开始地址 */
        *(.vectors)                    /* 中断向量表 */
        CPUDIR/start.o (.text*)        /* CPUDIR/start.o 中的所有.text 段 */
    }
    /* This needs to come before *(.text*) */
    .__efi_runtime_start : {
        *(.__efi_runtime_start)
    }
    .efi_runtime : {
        *(.text.efi_runtime*)
        *(.rodata.efi_runtime*)
        *(.data.efi_runtime*)
    }
    .__efi_runtime_stop : {
        *(.__efi_runtime_stop)
    }
    .text_rest :
    {
        *(.text*)
    }
#ifdef CONFIG_ARMV7_NONSEC
    /* Align the secure section only if we're going to use it in situ */
    .__secure_start
#ifndef CONFIG_ARMV7_SECURE_BASE
        ALIGN(CONSTANT(COMMONPAGESIZE))
#endif
    : {
        KEEP(*(.__secure_start))
    }
#ifndef CONFIG_ARMV7_SECURE_BASE
#define CONFIG_ARMV7_SECURE_BASE
#define __ARMV7_PSCI_STACK_IN_RAM
#endif
    .secure_text CONFIG_ARMV7_SECURE_BASE :
        AT(ADDR(.__secure_start) + SIZEOF(.__secure_start))
    {
        *(._secure.text)
    }
    .secure_data : AT(LOADADDR(.secure_text) + SIZEOF(.secure_text))
    {
        *(._secure.data)
    }
#ifdef CONFIG_ARMV7_PSCI
    .secure_stack ALIGN(ADDR(.secure_data) + SIZEOF(.secure_data),
                CONSTANT(COMMONPAGESIZE)) (NOLOAD) :
#ifdef __ARMV7_PSCI_STACK_IN_RAM
        AT(ADDR(.secure_stack))
#else
        AT(LOADADDR(.secure_data) + SIZEOF(.secure_data))
#endif
    {
        KEEP(*(.__secure_stack_start))
        /* Skip addreses for stack */
        . = . + CONFIG_ARMV7_PSCI_NR_CPUS * ARM_PSCI_STACK_SIZE;
        /* Align end of stack section to page boundary */
        . = ALIGN(CONSTANT(COMMONPAGESIZE));
        KEEP(*(.__secure_stack_end))
#ifdef CONFIG_ARMV7_SECURE_MAX_SIZE
        /*
         * We are not checking (__secure_end - __secure_start) here,
         * as these are the load addresses, and do not include the
         * stack section. Instead, use the end of the stack section
         * and the start of the text section.
         */
        ASSERT((. - ADDR(.secure_text)) <= CONFIG_ARMV7_SECURE_MAX_SIZE,
               "Error: secure section exceeds secure memory size");
#endif
    }
#ifndef __ARMV7_PSCI_STACK_IN_RAM
    /* Reset VMA but don't allocate space if we have secure SRAM */
    . = LOADADDR(.secure_stack);
#endif
#endif
    .__secure_end : AT(ADDR(.__secure_end)) {
        *(.__secure_end)
        LONG(0x1d1071c);    /* Must output something to reset LMA */
    }
#endif
    /* 
     * .rodata 段,确保是以4字节对齐 
     */
    . = ALIGN(4);
    .rodata : { *(SORT_BY_ALIGNMENT(SORT_BY_NAME(.rodata*))) }
    /* 
     * data段,确保是以4字节对齐
     */
    . = ALIGN(4);
    .data : {
        *(.data*)
    }
    . = ALIGN(4);
    . = .;
    /* 
     * u_boot_list 段,确保是以 4 字节对齐 
     * 这里存放的都是 u_boot_list 中的函数
     */
    . = ALIGN(4);
    __u_boot_list : {
        KEEP(*(SORT(__u_boot_list*)));
    }
    . = ALIGN(4);
    .efi_runtime_rel_start :
    {
        *(.__efi_runtime_rel_start)
    }
    .efi_runtime_rel : {
        *(.rel*.efi_runtime)
        *(.rel*.efi_runtime.*)
    }
    .efi_runtime_rel_stop :
    {
        *(.__efi_runtime_rel_stop)
    }
    /* 
     * __image_copy_end 也是个符号表示一个结束地址,确保是以4字节对齐 
     */
    . = ALIGN(4);
    .image_copy_end :        /* u-boot 的设计中需要将 u-boot 的镜像拷贝到ram(sdram,ddr....)中执行，这里表示复制的结束地址 */
    {
        *(.__image_copy_end)
    }
    .rel_dyn_start :        /*  .rel.dyn 段起始地址 */
    {
        *(.__rel_dyn_start)
    }
    .rel.dyn : {
        *(.rel*)
    }
    .rel_dyn_end :            /*  .rel.dyn 段结束地址 */
    {
        *(.__rel_dyn_end)
    }
    .end :
    {
        *(.__end)
    }
    _image_binary_end = .;    /* bin文件结束地址 */
    /*
     * Deprecated: this MMU section is used by pxa at present but
     * should not be used by new boards/CPUs.
     */
    . = ALIGN(4096);
    .mmutable : {
        *(.mmutable)
    }
/*
 * Compiler-generated __bss_start and __bss_end, see arch/arm/lib/bss.c
 * __bss_base and __bss_limit are for linker only (overlay ordering)
 */
    .bss_start __rel_dyn_start (OVERLAY) : {    /* .bss段起始地址 */
        KEEP(*(.__bss_start));
        __bss_base = .;
    }
    .bss __bss_base (OVERLAY) : {
        *(.bss*)
         . = ALIGN(4);
         __bss_limit = .;
    }
    .bss_end __bss_limit (OVERLAY) : {            /* .bss段结束地址 */
        KEEP(*(.__bss_end));
    }
    .dynsym _image_binary_end : { *(.dynsym) }
    .dynbss : { *(.dynbss) }
    .dynstr : { *(.dynstr*) }
    .dynamic : { *(.dynamic*) }
    .plt : { *(.plt*) }
    .interp : { *(.interp*) }
    .gnu.hash : { *(.gnu.hash) }
    .gnu : { *(.gnu*) }
    .ARM.exidx : { *(.ARM.exidx*) }
    .gnu.linkonce.armexidx : { *(.gnu.linkonce.armexidx.*) }
}

内存配置
名称           来源             长度             属性
*default*        0x00000000         0xffffffff
链结器命令稿和内存映射
段 .text 的地址设置为 0x87800000
                0x00000000                . = 0x0
                0x00000000                . = ALIGN (0x4)
.text           0x87800000      0x3a8
 *(.__image_copy_start)
 .__image_copy_start
                0x87800000        0x0 arch/arm/lib/sections.o
                0x87800000                __image_copy_start
 *(.vectors)
 .vectors       0x87800000      0x2e8 arch/arm/lib/vectors.o
                0x87800000                _start
                0x87800020                _undefined_instruction
                0x87800024                _software_interrupt
                0x87800028                _prefetch_abort
                0x8780002c                _data_abort
                0x87800030                _not_used
                0x87800034                _irq
                0x87800038                _fiq
                0x87800040                IRQ_STACK_START_IN
 arch/arm/cpu/armv7/start.o(.text*)
 .text          0x878002e8       0xc0 arch/arm/cpu/armv7/start.o
                0x878002e8                reset
                0x878002ec                save_boot_params_ret
                0x87800328                c_runtime_cpu_setup
                0x87800338                save_boot_params
                0x8780033c                cpu_init_cp15
                0x8780039c                cpu_init_crit
...

/*
 *************************************************************************
 *
 * Symbol _start is referenced elsewhere, so make it global
 *
 *************************************************************************
 */
.globl _start
/*
 *************************************************************************
 *
 * Vectors have their own section so linker script can map them easily
 *
 *************************************************************************
 */
    .section ".vectors", "ax"
#if defined(CONFIG_ENABLE_ARM_SOC_BOOT0_HOOK)
/*
 * Various SoCs need something special and SoC-specific up front in
 * order to boot, allow them to set that in their boot0.h file and then
 * use it here.
 *
 * To allow a boot0 hook to insert a 'special' sequence after the vector
 * table (e.g. for the socfpga), the presence of a boot0 hook supresses
 * the below vector table and assumes that the vector table is filled in
 * by the boot0 hook.  The requirements for a boot0 hook thus are:
 *   (1) defines '_start:' as appropriate
 *   (2) inserts the vector table using ARM_VECTORS as appropriate
 */
#include <asm/arch/boot0.h>
#else
/*
 *************************************************************************
 *
 * Exception vectors as described in ARM reference manuals
 *
 * Uses indirect branch to allow reaching handlers anywhere in memory.
 *
 *************************************************************************
 */
_start:
#ifdef CONFIG_SYS_DV_NOR_BOOT_CFG
    .word   CONFIG_SYS_DV_NOR_BOOT_CFG
#endif
    ARM_VECTORS
#endif /* !defined(CONFIG_ENABLE_ARM_SOC_BOOT0_HOOK) */
#if !CONFIG_IS_ENABLED(SYS_NO_VECTOR_TABLE)
/*
 *************************************************************************
 *
 * Indirect vectors table
 *
 * Symbols referenced here must be defined somewhere else
 *
 *************************************************************************
 */
    .globl  _reset
    .globl  _undefined_instruction     /* 未定义指令异常 */
    .globl  _software_interrupt        /* 软中断异常 */
    .globl  _prefetch_abort            /* 预取异常 */
    .globl  _data_abort                /* 数据异常 */
    .globl  _not_used                  /* 未使用 */
    .globl  _irq                       /* 外部中断请求IRQ */
    .globl  _fiq                       /* 快束中断请求FIQ */
    ...

/*************************************************************************
 *
 * Startup Code (reset vector)
 *
 * Do important init only if we don't start from memory!
 * Setup memory and board specific bits prior to relocation.
 * Relocate armboot to ram. Setup stack.
 *
 *************************************************************************/
    .globl  reset
    .globl  save_boot_params_ret
    .type   save_boot_params_ret,%function
#ifdef CONFIG_ARMV7_LPAE
    .global switch_to_hypervisor_ret
#endif
reset:
    /* Allow the board to save important registers */
    b   save_boot_params
save_boot_params_ret:
    ...

/*************************************************************************
 *
 * void save_boot_params(u32 r0, u32 r1, u32 r2, u32 r3)
 *  __attribute__((weak));
 *
 * Stack pointer is not yet initialized at this moment
 * Don't save anything to stack even if compiled with -O0
 *
 *************************************************************************/
ENTRY(save_boot_params)
    b   save_boot_params_ret        @ back to my caller
####2.save_boot_params_ret函数讲解
同样save_boot_params函数也是只有一句跳转语句，跳转到save_boot_params_ret函数save_boot_params_ret 函数代码如下：
save_boot_params_ret:
#ifdef CONFIG_POSITION_INDEPENDENT
    /*
     * Fix .rela.dyn relocations. This allows U-Boot to loaded to and
     * executed at a different address than it was linked at.
     */
pie_fixup:
    /* 获取标号reset的运行地址到r0 */
    adr r0, reset   /* r0 <- Runtime value of reset label */
    /* 获取标号reset的链接地址到r0 */
    ldr r1, =reset  /* r1 <- Linked value of reset label */
    /* 计算运行地址和link地址的偏移 */
    subs    r4, r0, r1  /* r4 <- Runtime-vs-link offset */
    /* 如果为0，说明link地址和运行地址一致，不需要重定位直接退出 */
    beq pie_fixup_done
    /* 
     * 下面几行代码的作用是计算运行时rel.dyn段在内存中实际地址，只有获取这个段的
     * 真实的起使地址才能依据其中的信息进行重定位。
     */
    //获取pie_fixup标号的运行地址
    adr r0, pie_fixup
    //_rel_dyn_start_ofs链接时rel.dyn段相对pie_fixup标号的偏移
    ldr r1, _rel_dyn_start_ofs
    add r2, r0, r1  /* r2 <- Runtime &__rel_dyn_start */
    //计算rel.dyn运行时起始地址
    ldr r1, _rel_dyn_end_ofs
    //计算rel.dyn运行结束地址
    add r3, r0, r1  /* r3 <- Runtime &__rel_dyn_end */
pie_fix_loop:
    //获取rel.dyn段地址中的内容
    ldr r0, [r2]    /* r0 <- Link location */
    //获取rel.dyn段地址接下来4个字节中的内容
    ldr r1, [r2, #4]    /* r1 <- fixup */
    //如果r1等于23则执行重定位
    cmp r1, #23     /* relative fixup? */
    bne pie_skip_reloc
    /* relative fix: increase location by offset */
    add r0, r4
    ldr r1, [r0]
    add r1, r4
    str r1, [r0]
    str r0, [r2]
    add r2, #8
pie_skip_reloc:
    //判断是否所有表项都修改完成，没完成则循环操作
    cmp r2, r3
    blo pie_fix_loop
pie_fixup_done:
#endif
#ifdef CONFIG_ARMV7_LPAE
/*
 * check for Hypervisor support
 */
    mrc p15, 0, r0, c0, c1, 1       @ read ID_PFR1
    and r0, r0, #CPUID_ARM_VIRT_MASK    @ mask virtualization bits
    cmp r0, #(1 << CPUID_ARM_VIRT_SHIFT)
    beq switch_to_hypervisor
switch_to_hypervisor_ret:
#endif
    /*
     * disable interrupts (FIQ and IRQ), also set the cpu to SVC32 mode,
     * except if in HYP mode already
     */
    /* 将程序状态寄存器读取到通用寄存器R0 */
    mrs r0, cpsr
    and r1, r0, #0x1f       @ mask mode bits
    teq r1, #0x1a       @ test for HYP mode
    /* 清除当前的工作模式 */
    bicne   r0, r0, #0x1f       @ clear all mode bits
    /* 设置SVC模式,即超级管理员权限 */
    orrne   r0, r0, #0x13       @ set SVC mode
    /* 失能中断FIQ和IRQ */
    orr r0, r0, #0xc0       @ disable FIQ and IRQ
    msr cpsr,r0
#if !CONFIG_IS_ENABLED(SYS_NO_VECTOR_TABLE)
/*
 * Setup vector:
 */
    /* Set V=0 in CP15 SCTLR register - for VBAR to point to vector */
    mrc p15, 0, r0, c1, c0, 0   @ Read CP15 SCTLR Register
    bic r0, #CR_V       @ V = 0
    mcr p15, 0, r0, c1, c0, 0   @ Write CP15 SCTLR Register
#ifdef CONFIG_HAS_VBAR
    /* Set vector address in CP15 VBAR register */
    ldr r0, =_start
    mcr p15, 0, r0, c12, c0, 0  @Set VBAR
#endif
#endif
    /* the mask ROM code should have PLL and others stable */
#if !CONFIG_IS_ENABLED(SKIP_LOWLEVEL_INIT)
#ifdef CONFIG_CPU_V7A
    bl  cpu_init_cp15
#endif
#if !CONFIG_IS_ENABLED(SKIP_LOWLEVEL_INIT_ONLY)
    bl  cpu_init_crit
#endif
#endif
    bl  _main

/*************************************************************************
 *
 * cpu_init_cp15
 *
 * Setup CP15 registers (cache, MMU, TLBs). The I-cache is turned on unless
 * CONFIG_SYS_ICACHE_OFF is defined.
 *
 *************************************************************************/
ENTRY(cpu_init_cp15)
#if CONFIG_IS_ENABLED(ARMV7_SET_CORTEX_SMPEN)
    /*
     * The Arm Cortex-A7 TRM says this bit must be enabled before
     * "any cache or TLB maintenance operations are performed".
     */
    mrc p15, 0, r0, c1, c0, 1   @ read auxilary control register
    orr r0, r0, #1 << 6     @ set SMP bit to enable coherency
    mcr p15, 0, r0, c1, c0, 1   @ write auxilary control register
#endif
    /*
     * Invalidate L1 I/D
     */
    mov r0, #0          @ set up for MCR
    mcr p15, 0, r0, c8, c7, 0   @ invalidate TLBs
    mcr p15, 0, r0, c7, c5, 0   @ invalidate icache
    mcr p15, 0, r0, c7, c5, 6   @ invalidate BP array
    mcr     p15, 0, r0, c7, c10, 4  @ DSB
    mcr     p15, 0, r0, c7, c5, 4   @ ISB
    /*
     * disable MMU stuff and caches
     */
    mrc p15, 0, r0, c1, c0, 0
    bic r0, r0, #0x00002000 @ clear bits 13 (--V-)
    bic r0, r0, #0x00000007 @ clear bits 2:0 (-CAM)
    orr r0, r0, #0x00000002 @ set bit 1 (--A-) Align
    orr r0, r0, #0x00000800 @ set bit 11 (Z---) BTB
    ...

/*************************************************************************
 *
 * CPU_init_critical registers
 *
 * setup important registers
 * setup memory timing
 *
 *************************************************************************/
ENTRY(cpu_init_crit)
    /*
     * Jump to board specific initialization...
     * The Mask ROM will have already initialized
     * basic memory. Go here to bump up clock rate and handle
     * wake up conditions.
     */
    b   lowlevel_init       @ go setup pll,mux,memory
ENDPROC(cpu_init_crit)
#endif

WEAK(lowlevel_init)
    /*
     * Setup a temporary stack. Global data is not available yet.
     */
#if defined(CONFIG_SPL_BUILD) && defined(CONFIG_SPL_STACK)
    ldr sp, =CONFIG_SPL_STACK
#else
    ldr sp, =SYS_INIT_SP_ADDR
#endif
    bic sp, sp, #7 /* 8-byte alignment for ABI compliance */
#ifdef CONFIG_SPL_DM
    mov r9, #0
#else
    /*
     * Set up global data for boards that still need it. This will be
     * removed soon.
     */
#ifdef CONFIG_SPL_BUILD
    ldr r9, =gdata
#else
    sub sp, sp, #GD_SIZE
    bic sp, sp, #7
    mov r9, sp
#endif
#endif
    /*
     * Save the old lr(passed in ip) and the current lr to stack
     */
    push    {ip, lr}
    /*
     * Call the very early init function. This should do only the
     * absolute bare minimum to get started. It should not:
     *
     * - set up DRAM
     * - use global_data
     * - clear BSS
     * - try to start a console
     *
     * For boards with SPL this should be empty since SPL can do all of
     * this init in the SPL board_init_f() function which is called
     * immediately after this.
     */
    bl  s_init
    pop {ip, pc}
ENDPROC(lowlevel_init)

/*
 * entry point of crt0 sequence
 */
ENTRY(_main)
/* Call arch_very_early_init before initializing C runtime environment. */
#if CONFIG_IS_ENABLED(ARCH_VERY_EARLY_INIT)
    bl  arch_very_early_init
#endif
/*
 * Set up initial C runtime environment and call board_init_f(0).
 */
#if defined(CONFIG_TPL_BUILD) && defined(CONFIG_TPL_NEEDS_SEPARATE_STACK)
    ldr r0, =(CONFIG_TPL_STACK)
#elif defined(CONFIG_SPL_BUILD) && defined(CONFIG_SPL_STACK)
    ldr r0, =(CONFIG_SPL_STACK)
#else
    ldr r0, =(SYS_INIT_SP_ADDR)
#endif
    bic r0, r0, #7  /* 8-byte alignment for ABI compliance */
    mov sp, r0
    bl  board_init_f_alloc_reserve
    mov sp, r0
    /* set up gd here, outside any C code */
    mov r9, r0
    bl  board_init_f_init_reserve
#if defined(CONFIG_DEBUG_UART) && CONFIG_IS_ENABLED(SERIAL)
    bl  debug_uart_init
#endif
#if defined(CONFIG_SPL_BUILD) && defined(CONFIG_SPL_EARLY_BSS)
    CLEAR_BSS
#endif
    mov r0, #0
    bl  board_init_f

ulong board_init_f_alloc_reserve(ulong top)
{
    /* Reserve early malloc arena */
#ifndef CONFIG_MALLOC_F_ADDR
#if CONFIG_VAL(SYS_MALLOC_F_LEN)
    top -= CONFIG_VAL(SYS_MALLOC_F_LEN);
#endif
#endif
    /* LAST : reserve GD (rounded up to a multiple of 16 bytes) */
    top = rounddown(top-sizeof(struct global_data), 16);
    return top;
}

void board_init_f_init_reserve(ulong base)
{
    struct global_data *gd_ptr;
    /*
     * clear GD entirely and set it up.
     * Use gd_ptr, as gd may not be properly set yet.
     */
    gd_ptr = (struct global_data *)base;
    /* zero the area */
    memset(gd_ptr, '\0', sizeof(*gd));
    /* set GD unless architecture did it already */
#if !defined(CONFIG_ARM)
    arch_setup_gd(gd_ptr);
#endif
    if (CONFIG_IS_ENABLED(SYS_REPORT_STACK_F_USAGE))
        board_init_f_init_stack_protection_addr(base);
    /* next alloc will be higher by one GD plus 16-byte alignment */
    base += roundup(sizeof(struct global_data), 16);
    /*
     * record early malloc arena start.
     * Use gd as it is now properly set for all architectures.
     */
#if CONFIG_VAL(SYS_MALLOC_F_LEN)
    /* go down one 'early malloc arena' */
    gd->malloc_base = base;
#endif
    if (CONFIG_IS_ENABLED(SYS_REPORT_STACK_F_USAGE))
        board_init_f_init_stack_protection();
}

#if ! defined(CONFIG_SPL_BUILD)
/*
 * Set up intermediate environment (new sp and gd) and call
 * relocate_code(addr_moni). Trick here is that we'll return
 * 'here' but relocated.
 */
    ldr r0, [r9, #GD_START_ADDR_SP] /* sp = gd->start_addr_sp */
    bic r0, r0, #7  /* 8-byte alignment for ABI compliance */
    mov sp, r0
    ldr r9, [r9, #GD_NEW_GD]        /* r9 <- gd->new_gd */
    adr lr, here
#if defined(CONFIG_POSITION_INDEPENDENT)
    adr r0, _main
    ldr r1, _start_ofs
    add r0, r1
    ldr r1, =CONFIG_SYS_TEXT_BASE
    sub r1, r0
    add lr, r1
#endif
    ldr r0, [r9, #GD_RELOC_OFF]     /* r0 = gd->reloc_off */
    add lr, lr, r0
#if defined(CONFIG_CPU_V7M)
    orr lr, #1              /* As required by Thumb-only */
#endif
    ldr r0, [r9, #GD_RELOCADDR]     /* r0 = gd->relocaddr */
    b   relocate_code

here:
/*
 * now relocate vectors
 */
    bl  relocate_vectors

/* Set up final (full) environment */
    bl  c_runtime_cpu_setup /* we still call old routine here */
#endif
#if !defined(CONFIG_SPL_BUILD) || CONFIG_IS_ENABLED(FRAMEWORK)
#if !defined(CONFIG_SPL_BUILD) || !defined(CONFIG_SPL_EARLY_BSS)
    CLEAR_BSS
#endif
# ifdef CONFIG_SPL_BUILD
    /* Use a DRAM stack for the rest of SPL, if requested */
    bl  spl_relocate_stack_gd
    cmp r0, #0
    movne   sp, r0
    movne   r9, r0
# endif
#if ! defined(CONFIG_SPL_BUILD)
    bl coloured_LED_init
    bl red_led_on
#endif
    /* call board_init_r(gd_t *id, ulong dest_addr) */
    mov     r0, r9                  /* gd_t */
    ldr r1, [r9, #GD_RELOCADDR] /* dest_addr */
    /* call board_init_r */
#if CONFIG_IS_ENABLED(SYS_THUMB_BUILD)
    ldr lr, =board_init_r   /* this is auto-relocated! */
    bx  lr
#else
    ldr pc, =board_init_r   /* this is auto-relocated! */
#endif
    /* we should not return here. */
#endif
ENDPROC(_main)

void board_init_f(ulong boot_flags)
{
    gd->flags = boot_flags;
    gd->have_console = 0;
    if (initcall_run_list(init_sequence_f))
        hang();
#if !defined(CONFIG_ARM) && !defined(CONFIG_SANDBOX) && \
        !defined(CONFIG_EFI_APP) && !CONFIG_IS_ENABLED(X86_64) && \
        !defined(CONFIG_ARC)
    /* NOTREACHED - jump_to_copy() does not return */
    hang();
#endif
}

static const init_fnc_t init_sequence_f[] = {
    setup_mon_len,
    fdtdec_setup,
    trace_early_init,
    initf_malloc,
    log_init,
    initf_bootstage,    /* uses its own timer, so does not need DM */
    event_init,
    bloblist_init,
    setup_spl_handoff,
    console_record_init,
    arch_fsp_init,
    arch_cpu_init,      /* basic arch cpu dependent setup */
    mach_cpu_init,      /* SoC/machine dependent CPU setup */
    initf_dm,
    board_early_init_f,
    get_clocks,     /* get CPU and bus clocks (etc.) */
    timer_init,     /* initialize timer */
    board_postclk_init,
    env_init,       /* initialize environment */
    init_baud_rate,     /* initialze baudrate settings */
    serial_init,        /* serial communications setup */
    console_init_f,     /* stage 1 init of console */
    display_options,    /* say that we are here */
    display_text_info,  /* show debugging info if required */
    checkcpu,
    print_resetinfo,
    print_cpuinfo,      /* display cpu info (and speed) */
    embedded_dtb_select,
    show_board_info,
    INIT_FUNC_WATCHDOG_INIT
    misc_init_f,
    INIT_FUNC_WATCHDOG_RESET
    init_func_i2c,
    init_func_vid,
    announce_dram_init,
    dram_init,      /* configure available RAM banks */
    post_init_f,
    INIT_FUNC_WATCHDOG_RESET
    testdram,
    INIT_FUNC_WATCHDOG_RESET
    init_post,
    INIT_FUNC_WATCHDOG_RESET
    setup_dest_addr,
    fix_fdt,
    reserve_pram,
    ...
#if !defined(CONFIG_ARM) && !defined(CONFIG_SANDBOX) && \
        !CONFIG_IS_ENABLED(X86_64)
    jump_to_copy,
#endif
    NULL,
};

/*
 * void relocate_code(addr_moni)
 *
 * This function relocates the monitor code.
 *
 * NOTE:
 * To prevent the code below from containing references with an R_ARM_ABS32
 * relocation record type, we never refer to linker-defined symbols directly.
 * Instead, we declare literals which contain their relative location with
 * respect to relocate_code, and at run time, add relocate_code back to them.
 */
ENTRY(relocate_code)
relocate_base:
    adr r3, relocate_base
    ldr r1, _image_copy_start_ofs
    add r1, r3          /* r1 <- Run &__image_copy_start */
    subs    r4, r0, r1      /* r4 <- Run to copy offset      */
    beq relocate_done       /* skip relocation               */
    ldr r1, _image_copy_start_ofs
    add r1, r3          /* r1 <- Run &__image_copy_start */
    ldr r2, _image_copy_end_ofs
    add r2, r3          /* r2 <- Run &__image_copy_end   */
copy_loop:
    ldmia   r1!, {r10-r11}      /* copy from source address [r1] */
    stmia   r0!, {r10-r11}      /* copy to   target address [r0] */
    cmp r1, r2          /* until source end address [r2] */
    blo copy_loop
    /*
     * fix .rel.dyn relocations
     */
    ldr r1, _rel_dyn_start_ofs
    add r2, r1, r3      /* r2 <- Run &__rel_dyn_start */
    ldr r1, _rel_dyn_end_ofs
    add r3, r1, r3      /* r3 <- Run &__rel_dyn_end */
fixloop:
    ldmia   r2!, {r0-r1}        /* (r0,r1) <- (SRC location,fixup) */
    and r1, r1, #0xff
    cmp r1, #R_ARM_RELATIVE
    bne fixnext
    /* relative fix: increase location by offset */
    add r0, r0, r4
    ldr r1, [r0]
    add r1, r1, r4
    str r1, [r0]
fixnext:
    cmp r2, r3
    blo fixloop
relocate_done:
#ifdef __XSCALE__
    /*
     * On xscale, icache must be invalidated and write buffers drained,
     * even with cache disabled - 4.2.7 of xscale core developer's manual
     */
    mcr p15, 0, r0, c7, c7, 0   /* invalidate icache */
    mcr p15, 0, r0, c7, c10, 4  /* drain write buffer */
#endif
    /* ARMv4- don't know bx lr but the assembler fails to see that */
#ifdef __ARM_ARCH_4__
    mov pc, lr
#else
    bx  lr
#endif
ENDPROC(relocate_code)

ENTRY(relocate_vectors)
#ifdef CONFIG_CPU_V7M
    /*
     * On ARMv7-M we only have to write the new vector address
     * to VTOR register.
     */
    ldr r0, [r9, #GD_RELOCADDR] /* r0 = gd->relocaddr */
    ldr r1, =V7M_SCB_BASE
    str r0, [r1, V7M_SCB_VTOR]
#else
#ifdef CONFIG_HAS_VBAR
    /*
     * If the ARM processor has the security extensions,
     * use VBAR to relocate the exception vectors.
     */
    ldr r0, [r9, #GD_RELOCADDR] /* r0 = gd->relocaddr */
    mcr     p15, 0, r0, c12, c0, 0  /* Set VBAR */
#else
    /*
     * Copy the relocated exception vectors to the
     * correct address
     * CP15 c1 V bit gives us the location of the vectors:
     * 0x00000000 or 0xFFFF0000.
     */
    ldr r0, [r9, #GD_RELOCADDR] /* r0 = gd->relocaddr */
    mrc p15, 0, r2, c1, c0, 0   /* V bit (bit[13]) in CP15 c1 */
    ands    r2, r2, #(1 << 13)
    ldreq   r1, =0x00000000     /* If V=0 */
    ldrne   r1, =0xFFFF0000     /* If V=1 */
    ldmia   r0!, {r2-r8,r10}
    stmia   r1!, {r2-r8,r10}
    ldmia   r0!, {r2-r8,r10}
    stmia   r1!, {r2-r8,r10}
#endif
#endif
    bx  lr
ENDPROC(relocate_vectors)

void board_init_r(gd_t *new_gd, ulong dest_addr)
{
    /*
     * Set up the new global data pointer. So far only x86 does this
     * here.
     * TODO(sjg@chromium.org): Consider doing this for all archs, or
     * dropping the new_gd parameter.
     */
    if (CONFIG_IS_ENABLED(X86_64) && !IS_ENABLED(CONFIG_EFI_APP))
        arch_setup_gd(new_gd);
#if !defined(CONFIG_X86) && !defined(CONFIG_ARM) && !defined(CONFIG_ARM64)
    gd = new_gd;
#endif
    gd->flags &= ~GD_FLG_LOG_READY;
    if (IS_ENABLED(CONFIG_NEEDS_MANUAL_RELOC)) {
        for (int i = 0; i < ARRAY_SIZE(init_sequence_r); i++)
            MANUAL_RELOC(init_sequence_r[i]);
    }
    if (initcall_run_list(init_sequence_r))
        hang();
    /* NOTREACHED - run_main_loop() does not return */
    hang();
}

static init_fnc_t init_sequence_r[] = {
    initr_trace,
    initr_reloc,
    event_init,
    initr_caches,
    initr_reloc_global_data,
    initr_barrier,
    initr_malloc,
    log_init,
    initr_bootstage,
    console_record_init,
    initr_of_live,
    board_init, /* Setup chipselects */
    stdio_init_tables,
    serial_initialize,
    initr_announce,
    INIT_FUNC_WATCHDOG_RESET
    INIT_FUNC_WATCHDOG_RESET
    power_init_board,
    initr_flash,
    initr_nand,
    initr_mmc,
    initr_env,
    INIT_FUNC_WATCHDOG_RESET
    cpu_secondary_init_r,
    INIT_FUNC_WATCHDOG_RESET
    stdio_add_devices,
    jumptable_init,
    console_init_r,     /* fully init console as a device */
    interrupt_init,
    board_late_init,
    INIT_FUNC_WATCHDOG_RESET
    initr_net,
    run_main_loop,
};

static int run_main_loop(void)
{
#ifdef CONFIG_SANDBOX
    sandbox_main_loop_init();
#endif
    /* main_loop() can return to retry autoboot, if so just run it again */
    for (;;)
        main_loop();
    return 0;
}

/* We come here after U-Boot is initialised and ready to process commands */
void main_loop(void)
{
    const char *s;
    bootstage_mark_name(BOOTSTAGE_ID_MAIN_LOOP, "main_loop");
    if (IS_ENABLED(CONFIG_VERSION_VARIABLE))
        env_set("ver", version_string);  /* set version variable */
    cli_init();
    if (IS_ENABLED(CONFIG_USE_PREBOOT))
        run_preboot_environment_command();
    if (IS_ENABLED(CONFIG_UPDATE_TFTP))
        update_tftp(0UL, NULL, NULL);
    if (IS_ENABLED(CONFIG_EFI_CAPSULE_ON_DISK_EARLY)) {
        /* efi_init_early() already called */
        if (efi_init_obj_list() == EFI_SUCCESS)
            efi_launch_capsules();
    }
    s = bootdelay_process();
    if (cli_process_fdt(&s))
        cli_secure_boot_cmd(s);
    autoboot_command(s);
    cli_loop();
    panic("No CLI available");
}

void autoboot_command(const char *s)
{
    debug("### main_loop: bootcmd=\"%s\"\n", s ? s : "<UNDEFINED>");
    if (s && (stored_bootdelay == -2 ||
         (stored_bootdelay != -1 && !abortboot(stored_bootdelay)))) {
        bool lock;
        int prev;
        lock = autoboot_keyed() &&
            !IS_ENABLED(CONFIG_AUTOBOOT_KEYED_CTRLC);
        if (lock)
            prev = disable_ctrlc(1); /* disable Ctrl-C checking */
        run_command_list(s, -1, 0);
        if (lock)
            disable_ctrlc(prev);    /* restore Ctrl-C checking */
    }
    if (IS_ENABLED(CONFIG_AUTOBOOT_USE_MENUKEY) &&
        menukey == AUTOBOOT_MENUKEY) {
        s = env_get("menucmd");
        if (s)
            run_command_list(s, -1, 0);
    }
}

static int abortboot(int bootdelay)
{
    int abort = 0;
    if (bootdelay >= 0) {
        if (autoboot_keyed())
            abort = abortboot_key_sequence(bootdelay);
        else
            abort = abortboot_single_key(bootdelay);
    }
    if (IS_ENABLED(CONFIG_SILENT_CONSOLE) && abort)
        gd->flags &= ~GD_FLG_SILENT;
    return abort;
}

static int abortboot_single_key(int bootdelay)
{
    int abort = 0;
    unsigned long ts;
    printf("Hit any key to stop autoboot: %2d ", bootdelay);
    /*
     * Check if key already pressed
     */
    if (tstc()) {   /* we got a key press   */
        getchar();  /* consume input    */
        puts("\b\b\b 0");
        abort = 1;  /* don't auto boot  */
    }
    while ((bootdelay > 0) && (!abort)) {
        --bootdelay;
        /* delay 1000 ms */
        ts = get_timer(0);
        do {
            if (tstc()) {   /* we got a key press   */
                int key;
                abort  = 1; /* don't auto boot  */
                bootdelay = 0;  /* no more delay    */
                key = getchar();/* consume input    */
                if (IS_ENABLED(CONFIG_AUTOBOOT_USE_MENUKEY))
                    menukey = key;
                break;
            }
            udelay(10000);
        } while (!abort && get_timer(ts) < 1000);
        printf("\b\b\b%2d ", bootdelay);
    }
    putc('\n');
    return abort;
}