最近項目原因，要在uboot中增加內核驗校和內核損壞修復功能，所以需要回頭看看uboot。這次選擇了uboot2015來進行分析

uboot是明遠睿智提供的。

下載地址 鏈接：https://pan.baidu.com/s/13SuRii3WTqvFTNIsSS9GAg 密碼：65zz

環境：ubuntu16

主控：imx6q

1、start.s arch\arm\cpu\armv7\start.S

因為我們這款cpu指令集是armv7的所以選擇這個目錄下的start.s，如果不知道自己該看那個目錄下的start.s，可以用如下方法

先編譯uboot，編譯成功后，執行 find -name start.0 即可看見start文件所在目錄

然后我們來看看代碼，我對代碼進行了刪減，我們目的在于流程分析，就不分析具體每句話了

reset:/* Allow the board to save important registers */b save_boot_params save_boot_params_ret:/** disable interrupts (FIQ and IRQ), also set the cpu to SVC32 mode,* except if in HYP mode already*/。。。。。。。。/** Setup vector:* (OMAP4 spl TEXT_BASE is not 32 byte aligned.* Continue to use ROM code vector only in OMAP4 spl)*/ #if !(defined(CONFIG_OMAP44XX) && defined(CONFIG_SPL_BUILD))/* Set V=0 in CP15 SCTLR register - for VBAR to point to vector */。。。。。。。。。/* Set vector address in CP15 VBAR register */。。。。。。。。。 #endif/* the mask ROM code should have PLL and others stable */ #ifndef CONFIG_SKIP_LOWLEVEL_INITbl cpu_init_cp15bl cpu_init_crit #endifbl _main //進入_main

arch\arm\lib\crt0.S _main在這個文件里

ENTRY(_main)/** Set up initial C runtime environment and call board_init_f(0).*/#if defined(CONFIG_SPL_BUILD) && defined(CONFIG_SPL_STACK)ldr sp, =(CONFIG_SPL_STACK) #elseldr sp, =(CONFIG_SYS_INIT_SP_ADDR) #endif。。。。。。。 clr_gd:。。。。。。。 #if defined(CONFIG_SYS_MALLOC_F_LEN)sub sp, sp, #CONFIG_SYS_MALLOC_F_LENstr sp, [r9, #GD_MALLOC_BASE] #endif/* mov r0, #0 not needed due to above code */bl board_init_f /*這個函數把uboot拷貝到ram*/#if ! defined(CONFIG_SPL_BUILD)/** Set up intermediate environment (new sp and gd) and call* relocate_code(addr_moni). Trick here is that we'll return* 'here' but relocated.*/。。。。。。b relocate_code here: /** now relocate vectors*/bl relocate_vectors/* Set up final (full) environment */bl c_runtime_cpu_setup /* we still call old routine here */ #endif #if !defined(CONFIG_SPL_BUILD) || defined(CONFIG_SPL_FRAMEWORK) # ifdef CONFIG_SPL_BUILD/* Use a DRAM stack for the rest of SPL, if requested */bl spl_relocate_stack_gdcmp r0, #0movne sp, r0 # endifldr r0, =__bss_start /* this is auto-relocated! */#ifdef CONFIG_USE_ARCH_MEMSETldr r3, =__bss_end /* this is auto-relocated! */mov r1, #0x00000000 /* prepare zero to clear BSS */subs r2, r3, r0 /* r2 = memset len */bl memset #elseldr r1, =__bss_end /* this is auto-relocated! */mov r2, #0x00000000 /* prepare zero to clear BSS */clbss_l:cmp r0, r1 /* while not at end of BSS */strlo r2, [r0] /* clear 32-bit BSS word */addlo r0, r0, #4 /* move to next */blo clbss_l #endif#if ! defined(CONFIG_SPL_BUILD)bl coloured_LED_initbl red_led_on #endif/* call board_init_r(gd_t *id, ulong dest_addr) */mov r0, r9 /* gd_t */ldr r1, [r9, #GD_RELOCADDR] /* dest_addr *//* call board_init_r */ldr pc, =board_init_r /* this is auto-relocated! *//* we should not return here. */ #endifENDPROC(_main)

然后調用了 board_init_r 函數

common\board_r.c

void board_init_r(gd_t *new_gd, ulong dest_addr) { #ifdef CONFIG_NEEDS_MANUAL_RELOCint i; #endif#ifdef CONFIG_AVR32mmu_init_r(dest_addr); #endif#if !defined(CONFIG_X86) && !defined(CONFIG_ARM) && !defined(CONFIG_ARM64)gd = new_gd; #endif#ifdef CONFIG_NEEDS_MANUAL_RELOCfor (i = 0; i < ARRAY_SIZE(init_sequence_r); i++)init_sequence_r[i] += gd->reloc_off; #endifif (initcall_run_list(init_sequence_r)) //只是一個函數指針的數組，里面包含了一系列初始化函數hang();/* NOTREACHED - run_main_loop() does not return */hang(); }

我們來看看這個init_sequence_r 為了更加清晰的看到他的流程，我刪減了一部分代碼

init_fnc_t init_sequence_r[] = {initr_trace,initr_reloc,/* TODO: could x86/PPC have this also perhaps? */ #ifdef CONFIG_ARMinitr_caches, #endifinitr_reloc_global_data,。。。。。。。board_init, /* Setup chipselects */ #endif/** TODO: printing of the clock inforamtion of the board is now* implemented as part of bdinfo command. Currently only support for* davinci SOC's is added. Remove this check once all the board* implement this.*/。。。。。。。。INIT_FUNC_WATCHDOG_RESET #ifdef CONFIG_SYS_DELAYED_ICACHEinitr_icache_enable, #endif #if defined(CONFIG_PCI) && defined(CONFIG_SYS_EARLY_PCI_INIT)/** Do early PCI configuration _before_ the flash gets initialised,* because PCU ressources are crucial for flash access on some boards.*/initr_pci, #endif。。。。。。。 #ifdef CONFIG_ARCH_MISC_INITarch_misc_init, /* miscellaneous arch-dependent init */ #endif #ifdef CONFIG_MISC_INIT_Rmisc_init_r, /* miscellaneous platform-dependent init */ #endifINIT_FUNC_WATCHDOG_RESET。。。。。。。 #if defined(CONFIG_X86) || defined(CONFIG_MICROBLAZE) || defined(CONFIG_AVR32) \|| defined(CONFIG_M68K)timer_init, /* initialize timer */ #endifINIT_FUNC_WATCHDOG_RESET/** Some parts can be only initialized if all others (like* Interrupts) are up and running (i.e. the PC-style ISA* keyboard).*/last_stage_init, #endif #ifdef CONFIG_CMD_BEDBUGINIT_FUNC_WATCHDOG_RESETinitr_bedbug, #endif #if defined(CONFIG_PRAM) || defined(CONFIG_LOGBUFFER)initr_mem, #endif #ifdef CONFIG_PS2KBDinitr_kbd, #endif #ifdef CONFIG_FSL_FASTBOOTinitr_check_fastboot, #endifrun_main_loop, };

這里滿足宏條件的函數都會被執行，最后一個執行的函數是run_main_loop，我繼續追蹤下去，這個函數 還是在這個文件中board_r.c

static int run_main_loop(void) { #ifdef CONFIG_SANDBOXsandbox_main_loop_init(); #endif/* main_loop() can return to retry autoboot, if so just run it again */for (;;) //死循環main_loop();return 0; }

可以看見，這里是單向的，調用了run_main_loop就不會返回了，我們繼續看看main_loop();

common\main.c

/* We come here after U-Boot is initialised and ready to process commands */ void main_loop(void) {const char *s;。。。。。。。。。puts("#test!!!!!!!!!!!!!!!!!!!!!!!\n");modem_init(); #ifdef CONFIG_VERSION_VARIABLEsetenv("ver", version_string); /* set version variable */ #endif /* CONFIG_VERSION_VARIABLE */cli_init();run_preboot_environment_command();#if defined(CONFIG_UPDATE_TFTP)update_tftp(0UL); #endif /* CONFIG_UPDATE_TFTP */s = bootdelay_process(); //uboot讀秒，等待用戶按鍵if (cli_process_fdt(&s))cli_secure_boot_cmd(s);printf("flag2");autoboot_command(s); //用戶沒有按鍵，執行環境參數命令cli_loop(); }

我們 繼續進入到 autoboot_command(s);

void autoboot_command(const char *s) {debug("### main_loop: bootcmd=\"%s\"\n", s ? s : "<UNDEFINED>");if (stored_bootdelay != -1 && s && !abortboot(stored_bootdelay)) { #if defined(CONFIG_AUTOBOOT_KEYED) && !defined(CONFIG_AUTOBOOT_KEYED_CTRLC)int prev = disable_ctrlc(1); /* disable Control C checking */ #endifrun_command_list(s, -1, 0); //傳遞過來的命令流s會在這里被解析執行#if defined(CONFIG_AUTOBOOT_KEYED) && !defined(CONFIG_AUTOBOOT_KEYED_CTRLC)disable_ctrlc(prev); /* restore Control C checking */ #endif}#ifdef CONFIG_MENUKEYif (menukey == CONFIG_MENUKEY) {s = getenv("menucmd");if (s)run_command_list(s, -1, 0);} #endif /* CONFIG_MENUKEY */ }

對于命令的解析執行，我們追蹤 run_command_list(s, -1, 0);來分析分析

int run_command_list(const char *cmd, int len, int flag) {int need_buff = 1;char *buff = (char *)cmd; /* cast away const */int rcode = 0;if (len == -1) {len = strlen(cmd); #ifdef CONFIG_SYS_HUSH_PARSER/* hush will never change our string */need_buff = 0; #else/* the built-in parser will change our string if it sees \n */need_buff = strchr(cmd, '\n') != NULL; #endif}if (need_buff) {buff = malloc(len + 1);if (!buff)return 1;memcpy(buff, cmd, len);buff[len] = '\0';} #ifdef CONFIG_SYS_HUSH_PARSERrcode = parse_string_outer(buff, FLAG_PARSE_SEMICOLON); #else。。。。。。。。。 #endifreturn rcode; }

繼續追蹤parse_string_outer(buff, FLAG_PARSE_SEMICOLON);

#ifndef __U_BOOT__ static int parse_string_outer(const char *s, int flag) #else int parse_string_outer(const char *s, int flag) #endif /* __U_BOOT__ */ {struct in_str input; #ifdef __U_BOOT__char *p = NULL;int rcode;if (!s)return 1;if (!*s)return 0;if (!(p = strchr(s, '\n')) || *++p) {p = xmalloc(strlen(s) + 2);strcpy(p, s);strcat(p, "\n");setup_string_in_str(&input, p);rcode = parse_stream_outer(&input, flag);free(p);return rcode;} else { #endifsetup_string_in_str(&input, s);return parse_stream_outer(&input, flag); #ifdef __U_BOOT__} #endif }

這里主要是對命令流進行了分割、執行。我們再繼續追蹤 parse_stream_outer(&input, flag);

/* most recursion does not come through here, the exeception is* from builtin_source() */ static int parse_stream_outer(struct in_str *inp, int flag) {struct p_context ctx;o_string temp=NULL_O_STRING;int rcode; #ifdef __U_BOOT__int code = 1; #endifdo {ctx.type = flag;initialize_context(&ctx);update_ifs_map();if (!(flag & FLAG_PARSE_SEMICOLON) || (flag & FLAG_REPARSING)) mapset((uchar *)";$&|", 0);inp->promptmode=1;rcode = parse_stream(&temp, &ctx, inp,flag & FLAG_CONT_ON_NEWLINE ? -1 : '\n'); #ifdef __U_BOOT__if (rcode == 1) flag_repeat = 0; #endifif (rcode != 1 && ctx.old_flag != 0) {syntax(); #ifdef __U_BOOT__flag_repeat = 0; #endif}if (rcode != 1 && ctx.old_flag == 0) {done_word(&temp, &ctx);done_pipe(&ctx,PIPE_SEQ); #ifndef __U_BOOT__run_list(ctx.list_head); //執行命令 #else。。。。。。。。 #endif} else {if (ctx.old_flag != 0) {free(ctx.stack);b_reset(&temp);} #ifdef __U_BOOT__if (inp->__promptme == 0) printf("<INTERRUPT>\n");inp->__promptme = 1; #endiftemp.nonnull = 0;temp.quote = 0;inp->p = NULL;free_pipe_list(ctx.list_head,0);}b_free(&temp);/* loop on syntax errors, return on EOF */} while (rcode != -1 && !(flag & FLAG_EXIT_FROM_LOOP) &&(inp->peek != static_peek || b_peek(inp))); #ifndef __U_BOOT__return 0; #elsereturn (code != 0) ? 1 : 0; #endif /* __U_BOOT__ */ }

追蹤run_list(ctx.list_head);

/* Select which version we will use */ static int run_list(struct pipe *pi) {int rcode=0; #ifndef __U_BOOT__if (fake_mode==0) { #endifrcode = run_list_real(pi); #ifndef __U_BOOT__} #endif/* free_pipe_list has the side effect of clearing memory* In the long run that function can be merged with run_list_real,* but doing that now would hobble the debugging effort. */free_pipe_list(pi,0); return rcode; }

追蹤 run_list_real(pi);

static int run_list_real(struct pipe *pi) {char *save_name = NULL;char **list = NULL;char **save_list = NULL;struct pipe *rpipe;int flag_rep = 0; #ifndef __U_BOOT__int save_num_progs; #endifint rcode=0, flag_skip=1;int flag_restore = 0;int if_code=0, next_if_code=0; /* need double-buffer to handle elif */reserved_style rmode, skip_more_in_this_rmode=RES_XXXX;/* check syntax for "for" */for (rpipe = pi; rpipe; rpipe = rpipe->next) {if ((rpipe->r_mode == RES_IN ||rpipe->r_mode == RES_FOR) &&(rpipe->next == NULL)) {syntax(); #ifdef __U_BOOT__flag_repeat = 0; #endifreturn 1;}if ((rpipe->r_mode == RES_IN &&(rpipe->next->r_mode == RES_IN &&rpipe->next->progs->argv != NULL))||(rpipe->r_mode == RES_FOR &&rpipe->next->r_mode != RES_IN)) {syntax(); #ifdef __U_BOOT__flag_repeat = 0; #endifreturn 1;}}for (; pi; pi = (flag_restore != 0) ? rpipe : pi->next) {if (pi->r_mode == RES_WHILE || pi->r_mode == RES_UNTIL ||pi->r_mode == RES_FOR) { #ifdef __U_BOOT__。。。。。。。。。。 #endif。。。。。。。。。。 #ifndef __U_BOOT__pi->progs->glob_result.gl_pathv[0] =pi->progs->argv[0]; #endifcontinue;} else {/* insert new value from list for variable */if (pi->progs->argv[0])free(pi->progs->argv[0]);pi->progs->argv[0] = *list++; #ifndef __U_BOOT__pi->progs->glob_result.gl_pathv[0] =pi->progs->argv[0]; #endif}}if (rmode == RES_IN) continue;if (rmode == RES_DO) {if (!flag_rep) continue;}if (rmode == RES_DONE) {if (flag_rep) {flag_restore = 1;} else {rpipe = NULL;}}if (pi->num_progs == 0) continue; #ifndef __U_BOOT__save_num_progs = pi->num_progs; /* save number of programs */ #endifrcode = run_pipe_real(pi); //執行debug_printf("run_pipe_real returned %d\n",rcode); #ifndef __U_BOOT__if (rcode!=-1) {/* We only ran a builtin: rcode was set by the return value* of run_pipe_real(), and we don't need to wait for anything. */} else if (pi->followup==PIPE_BG) {/* XXX check bash's behavior with nontrivial pipes *//* XXX compute jobid *//* XXX what does bash do with attempts to background builtins? */insert_bg_job(pi);rcode = EXIT_SUCCESS;} else {。。。。。。。} else {rcode = checkjobs(pi);}debug_printf("checkjobs returned %d\n",rcode);}last_return_code=rcode; #elseif (rcode < -1) {last_return_code = -rcode - 2;return -2; /* exit */}last_return_code=(rcode == 0) ? 0 : 1; #endif #ifndef __U_BOOT__pi->num_progs = save_num_progs; /* restore number of programs */ #endifif ( rmode == RES_IF || rmode == RES_ELIF )next_if_code=rcode; /* can be overwritten a number of times */if (rmode == RES_WHILE)flag_rep = !last_return_code;if (rmode == RES_UNTIL)flag_rep = last_return_code;if ( (rcode==EXIT_SUCCESS && pi->followup==PIPE_OR) ||(rcode!=EXIT_SUCCESS && pi->followup==PIPE_AND) )skip_more_in_this_rmode=rmode; #ifndef __U_BOOT__checkjobs(NULL); #endif}return rcode; }

追蹤 rcode = run_pipe_real(pi);

/* run_pipe_real() starts all the jobs, but doesn't wait for anything* to finish. See checkjobs().** return code is normally -1, when the caller has to wait for children* to finish to determine the exit status of the pipe. If the pipe* is a simple builtin command, however, the action is done by the* time run_pipe_real returns, and the exit code is provided as the* return value.** The input of the pipe is always stdin, the output is always* stdout. The outpipe[] mechanism in BusyBox-0.48 lash is bogus,* because it tries to avoid running the command substitution in* subshell, when that is in fact necessary. The subshell process* now has its stdout directed to the input of the appropriate pipe,* so this routine is noticeably simpler.*/ static int run_pipe_real(struct pipe *pi) {int i; #ifndef __U_BOOT__int nextin, nextout;int pipefds[2]; /* pipefds[0] is for reading */struct child_prog *child;struct built_in_command *x;char *p; # if __GNUC__/* Avoid longjmp clobbering */(void) &i;(void) &nextin;(void) &nextout;(void) &child; # endif #elseint nextin;int flag = do_repeat ? CMD_FLAG_REPEAT : 0;struct child_prog *child;char *p; # if __GNUC__/* Avoid longjmp clobbering */(void) &i;(void) &nextin;(void) &child; # endif #endif /* __U_BOOT__ */nextin = 0; #ifndef __U_BOOT__pi->pgrp = -1; #endif/* Check if this is a simple builtin (not part of a pipe).* Builtins within pipes have to fork anyway, and are handled in* pseudo_exec. "echo foo | read bar" doesn't work on bash, either.*/if (pi->num_progs == 1) child = & (pi->progs[0]); #ifndef __U_BOOT__。。。。。。。 #elseif (pi->num_progs == 1 && child->group) {int rcode;debug_printf("non-subshell grouping\n");rcode = run_list_real(child->group); #endif return rcode;} else if (pi->num_progs == 1 && pi->progs[0].argv != NULL) {for (i=0; is_assignment(child->argv[i]); i++) { /* nothing */ }if (i!=0 && child->argv[i]==NULL) {/* assignments, but no command: set the local environment */for (i=0; child->argv[i]!=NULL; i++) {/* Ok, this case is tricky. We have to decide if this is a* local variable, or an already exported variable. If it is* already exported, we have to export the new value. If it is* not exported, we need only set this as a local variable.* This junk is all to decide whether or not to export this* variable. */int export_me=0;char *name, *value;name = xstrdup(child->argv[i]);debug_printf("Local environment set: %s\n", name);value = strchr(name, '=');if (value)*value=0; #ifndef __U_BOOT__if ( get_local_var(name)) {export_me=1;} #endiffree(name);p = insert_var_value(child->argv[i]);set_local_var(p, export_me);if (p != child->argv[i]) free(p);} return EXIT_SUCCESS; /* don't worry about errors in set_local_var() yet */}for (i = 0; is_assignment(child->argv[i]); i++) {p = insert_var_value(child->argv[i]); #ifndef __U_BOOT__putenv(strdup(p)); #elseset_local_var(p, 0); #endifif (p != child->argv[i]) {child->sp--;free(p);}}if (child->sp) {char * str = NULL;str = make_string(child->argv + i,child->argv_nonnull + i);parse_string_outer(str, FLAG_EXIT_FROM_LOOP | FLAG_REPARSING);free(str); return last_return_code;} #ifndef __U_BOOT__。。。。。。。。 #else/* check ";", because ,example , argv consist from* "help;flinfo" must not execute*/if (strchr(child->argv[i], ';')) {printf("Unknown command '%s' - try 'help' or use ""'run' command\n", child->argv[i]); return -1;}/* Process the command */ return cmd_process(flag, child->argc, child->argv,&flag_repeat, NULL); #endif}

追蹤 cmd_process(flag, child->argc, child->argv, &flag_repeat, NULL);

enum command_ret_t cmd_process(int flag, int argc, char * const argv[],int *repeatable, ulong *ticks) {enum command_ret_t rc = CMD_RET_SUCCESS;cmd_tbl_t *cmdtp;/* Look up command in command table */cmdtp = find_cmd(argv[0]);if (cmdtp == NULL) {printf("Unknown command '%s' - try 'help'\n", argv[0]);return 1;}/* found - check max args */if (argc > cmdtp->maxargs)rc = CMD_RET_USAGE;#if defined(CONFIG_CMD_BOOTD)/* avoid "bootd" recursion */else if (cmdtp->cmd == do_bootd) {if (flag & CMD_FLAG_BOOTD) {puts("'bootd' recursion detected\n");rc = CMD_RET_FAILURE;} else {flag |= CMD_FLAG_BOOTD;}} #endif/* If OK so far, then do the command */if (!rc) {if (ticks)*ticks = get_timer(0);rc = cmd_call(cmdtp, flag, argc, argv);if (ticks)*ticks = get_timer(*ticks);*repeatable &= cmdtp->repeatable;}if (rc == CMD_RET_USAGE)rc = cmd_usage(cmdtp);return rc; }

命令最終在這里被執行，以上一系列過程 將收到的指令通過一系列字符處理然后加入一個執行列表，然后執行這個列表。這些命令的的具體實現大家可以 執行 find -name ./common/cmd*.c

這些文件里定義了命令的具體實現。

比如我們mmc read xx xx命令，在common\cmd_mmc.c :842中，大家可以具體去看看,其實讀秒過后的，系統自動執行了一系列環境變量（）中保存的命令，執行命令這一套的通用的，只是命令的來源不一樣，一個是用戶輸入的，一個是從環境命令中讀取的。我們可以做個實驗，在parse_string_outer函數中添加如下代碼

#ifndef __U_BOOT__ static int parse_string_outer(const char *s, int flag) #else int parse_string_outer(const char *s, int flag) #endif /* __U_BOOT__ */ {struct in_str input; #ifdef __U_BOOT__char *p = NULL;int rcode;if (!s)return 1;if (!*s)return 0;if (!(p = strchr(s, '\n')) || *++p) {p = xmalloc(strlen(s) + 2)printf("#stream =%s \n", s); //yinstrcpy(p, s);strcat(p, "\n");printf("#hush\n"); //yinsetup_string_in_str(&input, p);rcode = parse_stream_outer(&input, flag);free(p);return rcode;} else { #endifsetup_string_in_str(&input, s);return parse_stream_outer(&input, flag); #ifdef __U_BOOT__} #endif }

然后編譯，燒寫，啟動，觀察輸出信息

U-Boot 2015.04 (Mar 16 2018 - 18:45:12)CPU: Freescale i.MX6Q rev1.5 at 792 MHz CPU: Temperature 35 C Reset cause: POR Board: MYZR i.MX6 Evaluation Kit Model: MY-IMX6-EK314-6Q-1G I2C: ready DRAM: 1 GiB MMC: FSL_SDHC: 0, FSL_SDHC: 1 SF: Detected SST25VF016B with page size 256 Bytes, erase size 4 KiB, total 2 MiB *** Warning - bad CRC, using default environmentNo panel detected: default to Hannstar-XGA Display: Hannstar-XGA (1024x600) In: serial Out: serial Err: serial Net: using phy at 5 FEC [PRIME] #test!!!!!!!!!!!!!!!!!!!! Normal Boot flag1 flag2Hit any key to stop autoboot: 0 #run start stream = mmc dev ${mmcdev}; if run loadimage; then run mmcboot; else run netboot; fi; #hush switch to partitions #0, OK mmc1(part 0) is current device stream = fatload mmc ${mmcdev}:${mmcpart} ${loadaddr} ${image_file} #hush reading zImage-myimx6 5602432 bytes read in 157 ms (34 MiB/s) stream = echo Booting from mmc ...; run mmcargs; if run loadfdt; then bootz ${loadaddr} - ${fdt_addr}; else echo WARN: Cannot boot from mmc; fi; #hush Booting from mmc ... stream = run set_disp; setenv bootargs console=${console},${baudrate} ${smp} cma=320M root=${mmcroot} ${disp_args} #hush stream = setenv disp_args ${display} #hush stream = fatload mmc ${mmcdev}:${mmcpart} ${fdt_addr} ${fdt_file} #hush reading myimx6ek314-6q.dtb 42887 bytes read in 18 ms (2.3 MiB/s) Kernel image @ 0x12000000 [ 0x000000 - 0x557c80 ] ## Flattened Device Tree blob at 18000000Booting using the fdt blob at 0x18000000Using Device Tree in place at 18000000, end 1800d786Starting kernel ...

分析到這里想必大家都有了自己想法，剩下的就交給你們去探索了，這里僅僅是個拋磚引玉，做個粗淺的分析，感謝您耐著性子讀到這里，哈哈哈~~

lornyin 2018/3/17

總結

以上是生活随笔為你收集整理的uboot2015–启动流程分析 imx6q的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。