GdbArmulator 源代碼分析

1、Gdb/Armulator 源代碼分析 摘要 說明 A.和GDB間的通迅 Armulator一般和Gdb通訊有兩種方式,其一是在Gdb內(nèi)部直接調(diào)用模擬器的相關(guān)函數(shù),另一方法則是用pipe或socket傳遞RDP協(xié)議來連接Gdb和Amulator.而第一種方法是現(xiàn)在Gdb/Armulator所真正使用的(第二種是早期使用的方法),下面就分析了函數(shù)直接調(diào)用法. 函數(shù)直接調(diào)用這個方法是由Steve (sac) 修改原RDP方法而來的,Steve本人的描述如下:/*This directory contains the standard release of the ARMulator fromAdv

2、anced RISC Machines, and was ftpd from.It likes to use TCP/IP between the simulator and the host, which isnice, but is a pain to use under anything non-unix.Ive added created a new Makefile.in (the original in Makefile.orig)to build a version of the simulator without the TCP/IP stuff, and awrapper.c

3、 to link directly into gdb and the run command.It should be possible (barring major changes in the layout ofthe armulator) to upgrade the simulator by copying all the filesout of a release into this directory and renaming the Makefile.以下是RDP 通訊和直接函數(shù)調(diào)用的圖示:要清楚Armulator的執(zhí)行過程就要從它的啟動說起,當(dāng)你在Gdb中鍵入target si

4、m 去激活A(yù)mulator后Gdb首先進行命令行解釋,并將current_target指針指向sim變量,即將Armulator的調(diào)試函數(shù)集賦予Gdb,隨后的函數(shù)調(diào)用堆棧如下:-gdbsim_open () in remote-sim.c.-sim_open() in /sim/arm/wrapper.c/*這里Amulator對調(diào)用參數(shù)進行分析處理*/-*current_target-to_fetch_registers(-1) /*此函數(shù)指針實指向sim_fetch_register() in /sim/arm/wrapper.c*/-sim_fetch_register(-1)/*此函數(shù)

5、指針是在將current_target指向sim時,通過注冊target_ops 結(jié)構(gòu)完成掛接的*/sim_fetch_register (sd, rn, memory, length) ARMword regval; init ();file:/就在這,Amulator進行了初始化 至此Armulator被裝載完畢,其后Gdb就是通過target_ops(定義在target.h)結(jié)構(gòu)中的各個函數(shù)指針來完成對它的調(diào)試工. B.Armulator 內(nèi)部機制 a.初始化 從上述可知整個模擬器的初始化入口是在wrapper.c中的init( )函數(shù),那么它到底又做了些什么呢? (原始的Gdb5.0中

6、的Armulator是模擬ARM7DTMI 的,而補丁代碼修改了memory map 并添加了timer 和uart 的IO能力使其能夠模擬AT91.因為后者是對前者的增強,所以我們的分析以后者為準(zhǔn)) Once the armulator to reset ,the ARMul_NewState will be called.And its task is to malloc a ARMul_state stuct which saves the armulators states and initialize it .And the ARMul_MemoryInit() will mallo

7、c 4m ram for you.#1static void#2init ()#3#4static int done;#5if (!done)#6#7ARMul_EmulateInit ();file:/Call this routine once to set up the emulators tables.#8state = ARMul_NewState ();#9state-bigendSig = (big_endian ? HIGH : LOW);#10RMul_MemoryInit (state, mem_size);file:/原始代碼中的內(nèi)存初始,但現(xiàn)在無用#11ARMul_OS

8、Init (state);file:/預(yù)裝系統(tǒng)初始化#12ARMul_CoProInit (state);file:/協(xié)處理器初始#13state-verbose = verbosity;#14done = 1;#15file:/the below is added for AT91#16ARMul_SelectProcessor(state, ARM600);#17ARMul_SetCPSR(state, USER32MODE);#18ARMul_Reset(state);#19#20 因為這是補丁代碼,難免又冗余出現(xiàn),實際10-11行的兩處掉用是沒有實際意義的,而12行是協(xié)處理器的初始化,

9、因為并沒又模擬協(xié)處理器所以此處只是以備擴展. 重點的初始化過程是在ARMul_NewState()中的.首先它給模擬器的核心狀態(tài)結(jié)構(gòu)ARMul_State分配了空間,這個結(jié)構(gòu)里保存了Armulator的所有方面的狀態(tài),包括arm寄存器,流水線狀態(tài)等等. 并賦予初值,我們以后就用state表示之.然后調(diào)用ARMul_Reset()進行更近一步的設(shè)置.而后者又主要完成模擬器內(nèi)存結(jié)構(gòu)的分配和rom映象的加載-/sim/arm/armmem.c/mem_reset(),IO設(shè)備的狀態(tài)初始/sim/arm/armio.c/io_reset(),你也可在這添加你的初始代碼.到這就完成了Armulator的

10、裝載. (大家注意到18行也調(diào)用了ARMul_Reset(),這是一個BUG,使得模擬器進行了兩次內(nèi)存分配,而浪費了系統(tǒng)內(nèi)存.此處可刪去.) Memory map 是所有模擬器的關(guān)鍵.Armulator由AT91向其他MCU移植時Memory map又是首先要處理的.Armulator的各個內(nèi)存區(qū)是由mem_bank_t結(jié)構(gòu)來描述的:typedef struct mem_bank_t ARMword(*read_word)(ARMul_State *state, ARMword addr);void(*write_word)(ARMul_State *state, ARMword addr,

11、ARMword data);unsigned longaddr, len;char*filename; mem_bank_t;file:/定義在armmem.h中Armulator的整個內(nèi)存則是又此結(jié)構(gòu)的數(shù)組static mem_bank_t mem_banks管理的.AT91的memory map如下:static mem_bank_t mem_banks = /* the yuks below are to work around a uClinux/mount options problem */ real_read_word,real_write_word,0x01000000, 0x

12、00400000, , /* 2.4 */ real_read_word,_write_word,0x01400000, 0x00400000, boot.rom, real_read_word,real_write_word,0x02000000, 0x00400000, , /* 2.0 */ real_read_word,real_write_word,0x02400000, 0x00001000, , /* yuk!*/ real_read_word,_write_word,0x04000000, 0x00400000, boot.rom, real_read_word,real_wr

13、ite_word,0x00000000, 0x00004000, , io_read_word,io_write_word,0xf0000000, 0x10000000, , fail_read_word,fail_write_word, 0, 0 ; 根據(jù)mem_banks,mem_reset( )將分配空間,加載boot.rom文件. (原來的內(nèi)存是由ARMul_MemoryExit( )釋放的,但補丁后的代碼就沒了釋放功能,這也是需要糾正的地方) a.指令流 Armulator 加載完成后,就開始等待Gdb的運行命令了.最終/sim/wrapper.c/sim_resume( )是啟動a

14、rm指令執(zhí)行的地方. Sim_resume( )根據(jù)Gdb的要求選擇用/sim/arm/arminit.c/ARMul_DoInstr()還是用/sim/arm/arminit.c/ARMul_DoProg()來調(diào)用 流水線模擬函數(shù)/sim/arm/armemu.c/ARMul_Emulate32().ARMul_DoInstr()和ARMul_DoProg()的區(qū)別就是一個單步執(zhí)行,一個連續(xù)執(zhí)行指令. ARMul_DoProg()又不停的判斷state-Emulate是否為STOP,如果是,模擬器又將停下等待Gdb的調(diào)試. 而在arm/armemu.c, /arm/armvirt.c 和 /

15、arm/armsupp.c中的函數(shù)則模擬指令預(yù)取,指令譯碼,指令執(zhí)行以及數(shù)據(jù)回寫的功能.這三個文件時可以說時Armulator的核心! b.中斷 Armulator 的中斷機制主要靠以下兩個例程實現(xiàn): 1.IntPending(): 用來檢測state中的各個中斷標(biāo)志是否置位,從而判斷是否又需要中斷. 2.ARMul_Abort():當(dāng)需要中斷時,用來改變處理器模式,并將pc指向相應(yīng)的中斷向量. 在流水線函數(shù)ARMul_Emulate32()執(zhí)行當(dāng)中,有多處調(diào)用IntPending() 去檢測中斷.而Ispending() 也十分簡單,它僅僅判斷state中的四個變量:State-Except

16、ion : 中斷使能標(biāo)志.State-NresetSig : reset 中斷信號.State-NirqSig : irq 中斷信號.State-NfiqSig : fiq 中斷信號.所以當(dāng)你的虛擬外設(shè)產(chǎn)生中斷時,你只要調(diào)用/sim/arm/armio.c/ update_int()即可:static void update_int(ARMul_State *state)ARMwordrequests = sr & mr;state-NfiqSig = (requests & 0x000f) ? LOW : HIGH;state-NirqSig

17、= (requests & 0xfff0) ? LOW : HIGH; b.讀寫操作 無論是CPU指令還是Gdb調(diào)試時讀寫內(nèi)存或IO空間,最后都將要落到/armvirt.c/getword(), /armvirt.c/putword()這兩個函數(shù)身上. 在原始代碼中這兩個函數(shù)馬上就進行內(nèi)存數(shù)組的讀寫了.而補丁代碼的流程如下:-getword()/putword()-mmu_read_data()/mmu_write_data() in armmmu.c /*進行mmu的地址轉(zhuǎn)換和cache 查詢*/-real_read_data()/real_write_data() :讀寫ram,romio

18、_read_data()/io_write_data() :讀寫IO空間_write_data()/fail_read_data()/fail_write_data() :非法讀寫,如地址錯誤,rom讀操作等. 可以看出最后幾個函數(shù)的選擇是由讀寫地址在相應(yīng)的mem_bank_t結(jié)構(gòu)中的讀寫函數(shù)指針決定的. c.設(shè)備同步 Armulator 中有個很好的接口: ARMul_ScheduleEvent (ARMul_State * state, unsigned long delay, unsigned (*what) () in armvirt.c 它的目的就是注冊你的同步例程,并且每個時鐘周期即ARMul_Emulate32()將調(diào)用ARMul_ScheduleEvent()查看是否需要同步你的設(shè)備. 也許你在ARMul_Emulate32()中還發(fā)現(xiàn)了/sim/arm/armio.c/io_do_cycle(),沒錯它是AT91的timer和uart用來和指令流