pixhawk PX4FMU和PX4IO最底层启动过程分析

首先，大体了解PX4IO 与PX4FMU各自的任务

PX4IO(STM32F100)为PIXHAWK 中专用于处理输入输出的部分,输入为支持的各类遥控器(PPM,SPKT/DSM,SBUS), 输出为电调的PWM 驱动信号, 它与PX4FMU(STM32F427)通过串口进行通信

PX4FMU ：各种传感器数据读取、姿态解算、PWM控制量的计算、与PX4IO通信

进入主题

PX4IO 与PX4FMU 一样,在大的软件架构上分为Bootloader,OS 和APP 三个部分,OS 为Nuttx,如下图

根据自己理解画的流程图：（2016.05.19加）

1.Bootloader

       在嵌入式操作系统中，BootLoader是在操作系统内核运行之前运行。可以初始化硬件设备、建立内存空间映射图，从而将系统的软硬件环境带到一个合适状态，以便为最终调用操作系统内核准备好正确的环境。在嵌入式系统中，通常并没有像BIOS那样的固件程序（注，有的嵌入式CPU也会内嵌一段短小的启动程序），因此整个系统的加载启动任务就完全由BootLoader来完成。Bootloader是嵌入式系统在加电后执行的第一段代码，在它完成CPU和相关硬件的初始化之后，再将操作系统映像或固化的嵌入式应用程序装在到内存中然后跳转到操作系统所在的空间，启动操作系统运行。

因此进入px4/Bootloader可以看到main_f1、main_f4，分别对应着PX4IO、PX4FMU

主要是负责是否升级芯片,不升级则进入OS（具体的内容还没仔细看，读者结合注释应该能够看懂）

2.Nuttx

此部分摘自于pixhawk自学笔记之px4程序启动顺序

代码位置：Firmware/build_px4fmu-v2_default/px4fmu-v2/Nuttx/nuttx/arch/arm/src/stm32/stm32_start.c

__start--                                #处理器执行的第一条指令（px4使用的是stm32，入口在stm32_start.c中）

        |

        v

   stm32_clockconfig()------             #初始化时钟

                          |

                          v

                 rcc_reset()                            #复位rcc

                 stm32_stdclockconfig()       #初始化标准时钟

                rcc_enableperipherals()       #使能外设时钟

------------------------------------------------------------------

 

   stm32_fpuconfig()                         #配置fpu

                              |

                              v

               stm32_lowsetup()                    #基本初始化串口，之后可以使用up_lowputc()

               stm32_gpioinit()                      #初始化gpio，只是调用stm32_gpioremap()设置重映射

               up_earlyserialinit()                   #初始化串口，之后可以使用up_putc()

               stm32_boardinitialize()--          #板级初始化

                          |

                          v

                stm32_spiinitialize()        #初始化spi，只是调用stm32_configgpio()设置gpio

                stm32_usbinitialize()        #初始化usb，只是调用stm32_configgpio()设置gpio

                  up_ledinit();                  #初始化led，只是调用stm32_configgpio()设置gpio

                          |

   ----------------------------------------------------------------------------------------------

   在stm32_start.c文件中我们会看到这么一句话：

  os_start()---------------                         #初始化操作系统

                          |

                          v

                 dq_init()                                #初始化各种状态的任务列表（置为null）

                g_pidhash[i]=                        #初始化唯一可以确定的元素--进程ID

                g_pidhash[PIDHASH(0)]=      #分配空闲任务的进程ID为0

                 g_idletcb=                            #初始化空闲任务的任务控制块

                sem_initialize()--                   #初始化信号量

                                 |

                                 v

                      dq_init()                           #将信号量队列置为null

                      sem_initholders()             #初始化持有者结构以支持优先级继承

                                 |

                          --------

                          |

                          v

                up_allocate_heap()         #分配用户模式的堆（设置堆的起点和大小）

                kumm_initialize()            #初始化用户模式的堆

                up_allocate_kheap()        #分配内核模式的堆

                kmm_initialize()               #初始化内核模式的堆

                task_initialize()                #初始化任务数据结构

                irq_initialize()                  #将所有中断向量都指向同一个异常中断处理程序

                wd_initialize()                  #初始化看门狗数据结构

                clock_initialize()               #初始化rtc

                timer_initialize()               #配置POSIX定时器

                sig_initialize()                  #初始化信号

                mq_initialize()                  #初始化命名消息队列

                pthread_initialize()           #初始化线程特定的数据，空函数

                 fs_initialize()---                #初始化文件系统

                                 |

                                 v

                      sem_init()         #初始化节点信号量为1

                      files_initialize() #初始化文件数组，空函数

                                 |

                          --------

                          |

                          v

                net_initialize()--       #初始化网络

                                 |

                                 v

                      uip_initialize()       #初始化uIP层

                      net_initroute()        #初始化路由表

                      netdev_seminit()   #初始化网络设备信号量

                      arptimer_init()        #初始化ARP定时器

                                 |

                          --------

                          |

                          v

                up_initialize()---       #处理器特定的初始化

                                 |

                                 v

                      up_calibratedelay()           #校准定时器

                      up_addregion()                 #增加额外的内存段

                      up_irqinitialize()                #设置中断优先级，关联硬件异常处理函数

                      up_pminitialize()               #初始化电源管理

                      up_dmainitialize()              #初始化DMA

                      up_timerinit()                     #初始化定时器中断

                      devnull_register()               #注册/dev/null

                      devzero_register()              #注册/dev/zero

                      up_serialinit()                      #注册串口控制台/dev/console和串口/dev/ttyS0

                      up_rnginitialize()                #初始化并注册随机数生成器

                      up_netinitialize()                 #初始化网络，是arch/arm/src/chip/stm32_eth.c中的

                      up_usbinitialize()                 #初始化usb驱动

                      board_led_on()                     #打开中断使能led，但很快会被其它地方的led操作改变状态

                                 |

                          --------

                          |

                          v

                lib_initialize()                     #初始化c库，空函数

                group_allocate()                #分配空闲组

                group_setupidlefiles()        #在空闲任务上创建stdout、stderr、stdin

                group_initialize()               #完全初始化空闲组

                os_bringup()------              #创建初始任务

                                 |

                                 v

                      KEKERNEL_THREAD()    #启动内核工作者线程

                      board_initialize()           #最后一刻的板级初始化

                      TASK_CREATE()             #启动默认应用程序

                                 |

                          --------

                          |

                          v

                 forup_idle()                         #空闲任务循环

                          |

        --------------------

        |

        v

   for(;;)                               #不应该到达这里

__start 负责STM32 芯片的底层初始化,包括时钟,FPU,GPIO 等单元的初始化

os_start 负责OS 的底层初始化,包括各种队列和进程结构的初始化

os_bringup 负责OS 基本进程的启动以及用户进程的启动,用户启动入口由(CONFIG_USER_ENTRYPOINT)宏进行指定

3.APP

PX4FMU中   #define CONFIG_USER_ENTRYPOINT nsh_main

进入nsh_main

int nsh_main(int argc, char *argv[]){  int exitval = 0;  int ret;  /* Call all C++ static constructors */#if defined(CONFIG_HAVE_CXX) && defined(CONFIG_HAVE_CXXINITIALIZE)  up_cxxinitialize();#endif  /* Make sure that we are using our symbol take */#if defined(CONFIG_LIBC_EXECFUNCS) && defined(CONFIG_EXECFUNCS_SYMTAB)  exec_setsymtab(CONFIG_EXECFUNCS_SYMTAB, 0);#endif  /* Register the BINFS file system */#if defined(CONFIG_FS_BINFS) && (CONFIG_BUILTIN)  ret = builtin_initialize();  if (ret < 0)    {     fprintf(stderr, "ERROR: builtin_initialize failed: %d\n", ret);     exitval = 1;   }#endif  /* Initialize the NSH library */  nsh_initialize();  /* If the Telnet console is selected as a front-end, then start the   * Telnet daemon.   */#ifdef CONFIG_NSH_TELNET  ret = nsh_telnetstart();  if (ret < 0)    {     /* The daemon is NOT running.  Report the the error then fail...      * either with the serial console up or just exiting.      */     fprintf(stderr, "ERROR: Failed to start TELNET daemon: %d\n", ret);     exitval = 1;   }#endif  /* If the serial console front end is selected, then run it on this thread */#ifdef CONFIG_NSH_CONSOLE  ret = nsh_consolemain(0, NULL);  /* nsh_consolemain() should not return.  So if we get here, something   * is wrong.   */  fprintf(stderr, "ERROR: nsh_consolemain() returned: %d\n", ret);  exitval = 1;#endif  return exitval;}

其中包含

#ifdef CONFIG_NSH_CONSOLE  ret = nsh_consolemain(0, NULL);

进入nsh_consolemain

int nsh_consolemain(int argc, char *argv[]){  FAR struct console_stdio_s *pstate = nsh_newconsole();  int ret;  DEBUGASSERT(pstate);  /* Execute the start-up script */#ifdef CONFIG_NSH_ROMFSETC  (void)nsh_initscript(&pstate->cn_vtbl);#endif  /* Initialize any USB tracing options that were requested */#ifdef CONFIG_NSH_USBDEV_TRACE  usbtrace_enable(TRACE_BITSET);#endif  /* Execute the session */  ret = nsh_session(pstate);  /* Exit upon return */  nsh_exit(&pstate->cn_vtbl, ret);  return ret;}

其中包含

  /* Execute the start-up script */#ifdef CONFIG_NSH_ROMFSETC  (void)nsh_initscript(&pstate->cn_vtbl);#endif

执行启动脚本也就是rcS，接下来根据自己版本分别看ardupilot和PX4原生码

  /* Execute the session */  ret = nsh_session(pstate);

执行用户程序
跟踪pstate

FAR struct console_stdio_s *pstate = nsh_newconsole();

进入nsh_newconsole

FAR struct console_stdio_s *nsh_newconsole(void){  struct console_stdio_s *pstate = (struct console_stdio_s *)zalloc(sizeof(struct console_stdio_s));  if (pstate)    {      /* Initialize the call table */#ifndef CONFIG_NSH_DISABLEBG      pstate->cn_vtbl.clone      = nsh_consoleclone;      pstate->cn_vtbl.release    = nsh_consolerelease;#endif      pstate->cn_vtbl.write      = nsh_consolewrite;      pstate->cn_vtbl.output     = nsh_consoleoutput;      pstate->cn_vtbl.linebuffer = nsh_consolelinebuffer;      pstate->cn_vtbl.redirect   = nsh_consoleredirect;      pstate->cn_vtbl.undirect   = nsh_consoleundirect;      pstate->cn_vtbl.exit       = nsh_consoleexit;      /* (Re-) open the console input device */#ifdef CONFIG_NSH_CONDEV      pstate->cn_confd           = open(CONFIG_NSH_CONDEV, O_RDWR);      if (pstate->cn_confd < 0)        {          free(pstate);          return NULL;        }      /* Create a standard C stream on the console device */      pstate->cn_constream = fdopen(pstate->cn_confd, "r+");      if (!pstate->cn_constream)        {          close(pstate->cn_confd);          free(pstate);          return NULL;        }#endif      /* Initialize the output stream */      pstate->cn_outfd           = OUTFD(pstate);      pstate->cn_outstream       = OUTSTREAM(pstate);    }  return pstate;}

应该是用户在console输入新的nsh命令吧

PX4IO中       #define CONFIG_USER_ENTRYPOINT user_start

进入user_start

intuser_start(int argc, char *argv[]){/* configure the first 8 PWM outputs (i.e. all of them) */up_pwm_servo_init(0xff);/* run C++ ctors before we go any further */up_cxxinitialize();/* reset all to zero */memset(&system_state, 0, sizeof(system_state));/* configure the high-resolution time/callout interface */hrt_init();/* calculate our fw CRC so FMU can decide if we need to update */calculate_fw_crc();/* * Poll at 1ms intervals for received bytes that have not triggered * a DMA event. */#ifdef CONFIG_ARCH_DMAhrt_call_every(&serial_dma_call, 1000, 1000, (hrt_callout)stm32_serial_dma_poll, NULL);#endif/* print some startup info */lowsyslog("\nPX4IO: starting\n");/* default all the LEDs to off while we start */LED_AMBER(false);LED_BLUE(false);LED_SAFETY(false);#ifdef GPIO_LED4LED_RING(false);#endif/* turn on servo power (if supported) */#ifdef POWER_SERVOPOWER_SERVO(true);#endif/* turn off S.Bus out (if supported) */#ifdef ENABLE_SBUS_OUTENABLE_SBUS_OUT(false);#endif/* start the safety switch handler */safety_init();/* initialise the control inputs */controls_init();/* set up the ADC */adc_init();/* start the FMU interface */interface_init();/* add a performance counter for mixing */perf_counter_t mixer_perf = perf_alloc(PC_ELAPSED, "mix");/* add a performance counter for controls */perf_counter_t controls_perf = perf_alloc(PC_ELAPSED, "controls");/* and one for measuring the loop rate */perf_counter_t loop_perf = perf_alloc(PC_INTERVAL, "loop");struct mallinfo minfo = mallinfo();lowsyslog("MEM: free %u, largest %u\n", minfo.mxordblk, minfo.fordblks);/* initialize PWM limit lib */pwm_limit_init(&pwm_limit);/* *    P O L I C E    L I G H T S * * Not enough memory, lock down. * * We might need to allocate mixers later, and this will * ensure that a developer doing a change will notice * that he just burned the remaining RAM with static * allocations. We don't want him to be able to * get past that point. This needs to be clearly * documented in the dev guide. * */if (minfo.mxordblk < 600) {lowsyslog("ERR: not enough MEM");bool phase = false;while (true) {if (phase) {LED_AMBER(true);LED_BLUE(false);} else {LED_AMBER(false);LED_BLUE(true);}up_udelay(250000);phase = !phase;}}/* Start the failsafe led init */failsafe_led_init();/* * Run everything in a tight loop. */uint64_t last_debug_time = 0;uint64_t last_heartbeat_time = 0;for (;;) {/* track the rate at which the loop is running */perf_count(loop_perf);/* kick the mixer */perf_begin(mixer_perf);mixer_tick();perf_end(mixer_perf);/* kick the control inputs */perf_begin(controls_perf);controls_tick();perf_end(controls_perf);if ((hrt_absolute_time() - last_heartbeat_time) > 250 * 1000) {last_heartbeat_time = hrt_absolute_time();heartbeat_blink();}ring_blink();check_reboot();/* check for debug activity (default: none) */show_debug_messages();/* post debug state at ~1Hz - this is via an auxiliary serial port * DEFAULTS TO OFF! */if (hrt_absolute_time() - last_debug_time > (1000 * 1000)) {isr_debug(1, "d:%u s=0x%x a=0x%x f=0x%x m=%u",  (unsigned)r_page_setup[PX4IO_P_SETUP_SET_DEBUG],  (unsigned)r_status_flags,  (unsigned)r_setup_arming,  (unsigned)r_setup_features,  (unsigned)mallinfo().mxordblk);last_debug_time = hrt_absolute_time();}}}

user_start 负责px4io 基础环境的初始化,包括PWM,串口,ADC 等资源的初始化,最后运行一个死循环,用于处理遥控器输入,与PX4FMU 通信的内容

controls_tick 负责处理遥控器的输入内容,包括SBUS 的处理sbus_input、 SPKT/DSM 的处理dsm_port_input、 PPM 的处理ppm_input

PX4IO 底层中断处理的内容如下图

（1）紫色为PX4IO 的底层串口IO 操作,流程为当PX4IO 收到PX4FMU 的串口数据后会运行serial_interrupt, serial_interrupt 负责收发DMA 的操作,如果收到一个完整的包,则调用rx_dma_callback 进行处理, rx_dma_callback 首先调用rx_handle_packet 解析包中的内容,判断为写寄存器还是读寄存器,处理完成后由rx_dma_callback 发送回包给PX4FMU

static intserial_interrupt(int irq, void *context){static bool abort_on_idle = false;uint32_t sr = rSR;/* get UART status register */(void)rDR;/* required to clear any of the interrupt status that brought us here */if (sr & (USART_SR_ORE |/* overrun error - packet was too big for DMA or DMA was too slow */  USART_SR_NE |/* noise error - we have lost a byte due to noise */  USART_SR_FE)) {/* framing error - start/stop bit lost or line break */perf_count(pc_errors);if (sr & USART_SR_ORE) {perf_count(pc_ore);}if (sr & USART_SR_NE) {perf_count(pc_ne);}if (sr & USART_SR_FE) {perf_count(pc_fe);}/* send a line break - this will abort transmission/reception on the other end */rCR1 |= USART_CR1_SBK;/* when the line goes idle, abort rather than look at the packet */abort_on_idle = true;}if (sr & USART_SR_IDLE) {/* * If we saw an error, don't bother looking at the packet - it should have * been aborted by the sender and will definitely be bad. Get the DMA reconfigured * ready for their retry. */if (abort_on_idle) {abort_on_idle = false;dma_reset();return 0;}/* * The sender has stopped sending - this is probably the end of a packet. * Check the received length against the length in the header to see if * we have something that looks like a packet. */unsigned length = sizeof(dma_packet) - stm32_dmaresidual(rx_dma);if ((length < 1) || (length < PKT_SIZE(dma_packet))) {/* it was too short - possibly truncated */perf_count(pc_badidle);dma_reset();return 0;}/* * Looks like we received a packet. Stop the DMA and go process the * packet. */perf_count(pc_idle);stm32_dmastop(rx_dma);rx_dma_callback(rx_dma, DMA_STATUS_TCIF, NULL);}return 0;}

static voidrx_dma_callback(DMA_HANDLE handle, uint8_t status, void *arg){/* * We are here because DMA completed, or UART reception stopped and * we think we have a packet in the buffer. */perf_begin(pc_txns);/* disable UART DMA */rCR3 &= ~(USART_CR3_DMAT | USART_CR3_DMAR);/* handle the received packet */rx_handle_packet();/* re-set DMA for reception first, so we are ready to receive before we start sending */dma_reset();/* send the reply to the just-processed request */dma_packet.crc = 0;dma_packet.crc = crc_packet(&dma_packet);stm32_dmasetup(tx_dma,(uint32_t)&rDR,(uint32_t)&dma_packet,PKT_SIZE(dma_packet),DMA_CCR_DIR|DMA_CCR_MINC|DMA_CCR_PSIZE_8BITS|DMA_CCR_MSIZE_8BITS);stm32_dmastart(tx_dma, NULL, NULL, false);rCR3 |= USART_CR3_DMAT;perf_end(pc_txns);}

static voidrx_handle_packet(void){/* check packet CRC */uint8_t crc = dma_packet.crc;dma_packet.crc = 0;if (crc != crc_packet(&dma_packet)) {perf_count(pc_crcerr);/* send a CRC error reply */dma_packet.count_code = PKT_CODE_CORRUPT;dma_packet.page = 0xff;dma_packet.offset = 0xff;return;}if (PKT_CODE(dma_packet) == PKT_CODE_WRITE) {/* it's a blind write - pass it on */if (registers_set(dma_packet.page, dma_packet.offset, &dma_packet.regs[0], PKT_COUNT(dma_packet))) {perf_count(pc_regerr);dma_packet.count_code = PKT_CODE_ERROR;} else {dma_packet.count_code = PKT_CODE_SUCCESS;}return;}if (PKT_CODE(dma_packet) == PKT_CODE_READ) {/* it's a read - get register pointer for reply */unsigned count;uint16_t *registers;if (registers_get(dma_packet.page, dma_packet.offset, &registers, &count) < 0) {perf_count(pc_regerr);dma_packet.count_code = PKT_CODE_ERROR;} else {/* constrain reply to requested size */if (count > PKT_MAX_REGS) {count = PKT_MAX_REGS;}if (count > PKT_COUNT(dma_packet)) {count = PKT_COUNT(dma_packet);}/* copy reply registers into DMA buffer */memcpy((void *)&dma_packet.regs[0], registers, count * 2);dma_packet.count_code = count | PKT_CODE_SUCCESS;}return;}/* send a bad-packet error reply */dma_packet.count_code = PKT_CODE_CORRUPT;dma_packet.page = 0xff;dma_packet.offset = 0xfe;}

（2） 蓝色为包操作,只提供registers_set 写操作和registers_get 读操作

（3）IOPacket 为协议包,包括以下几部分
    count_code 标记包的读写,错误,长度等信息
    crc 为包的效验码
    page 为数据页
    offset 为数据偏移量
    regs 为数据内容