【coreboot】基础流程

墨蓝 2023-10-17 08:18 10阅读 0赞

## coreboot执行流程 ##

以上内容参考自[wiki][]中的《coreboot Overview》章节以及coreboot源代码。

在wiki中执行流程是按照intel平台来的，但是中间有部分并不是很清楚。

这里根据代码有增加部分内容，但是并不是一定按照intel平台来的。

coreboot执行流程大致分为四个阶段：

**bootblock->romstage->ramstage->payload**

**1. At 0xFFFFFFF0, start execution at reset\_vector from src/cpu/x86/16bit/reset16.inc,which simply jumps to \_start.**

对应代码：

.section ".reset", "ax", %progbits
    	.code16
    .globl	_start
    _start:
    	.byte  0xe9
    	.int   _start16bit - ( . + 2 )
    	/* Note: The above jump is hand coded to work around bugs in binutils.
    	 * 5 byte are used for a 3 byte instruction.  This works because x86
    	 * is little endian and allows us to use supported 32bit relocations
    	 * instead of the weird 16 bit relocations that binutils does not
    	 * handle consistenly between versions because they are used so rarely.
    	 */
    	.previous

如果不关注具体的细节，这里的代码就是一个跳转语句，跳转到\_start16bit的位置。

**2. \_start from src/cpu/x86/16bit/entry16.inc, invalidates the TLBs, sets up a GDT for selector 0x08 (code) and 0x10 (data), switches to protected mode, and jumps to\_\_protected\_start (setting the CS to the new selector 0x08). The selectors provide full flat access to the entire physical memory map.**

entry16.inc中有\_start16bit，它就是第一步的跳转位置。在entry16.inc中的主要操作就是进入保护模式，然后跳转的32位的代码中：

/* Now that we are in protected mode jump to a 32 bit code segment. */
    	ljmpl	$ROM_CODE_SEG, $__protected_start

**3. \_\_protected\_start fromsrc/cpu/x86/32bit/entry32.inc, sets all other segment registers to the 0x10 selector.**

__protected_start:
    	/* Save the BIST value */
    	movl	%eax, %ebp
    
    #if !IS_ENABLED(CONFIG_NO_EARLY_BOOTBLOCK_POSTCODES)
    	post_code(POST_ENTER_PROTECTED_MODE)
    #endif
    
    	movw	$ROM_DATA_SEG, %ax
    	movw	%ax, %ds
    	movw	%ax, %es
    	movw	%ax, %ss
    	movw	%ax, %fs
    	movw	%ax, %gs
    
    	/* Restore the BIST value to %eax */
    	movl	%ebp, %eax

ROM\_DATA\_SEG的值就是0x10。

以上涉及的到的文件都包含在bootblock\_romcc.S或者bootblock\_crt0.S文件中，这属于coreboot的第一个阶段，称为**bootblock阶段**。

bootblock\_romcc.S或者bootblock\_crt0.S对应着两种不同的bootblock，参看说明：

bootblock\_romcc.S对应的是：

/*
     * This is the original bootblock used by coreboot on x86 systems. It contains
     * a monolithic code flow, assembled from the following stages:
     *     - reset16.inc: the reset vector
     *     - entry16.inc: protected mode setup
     *     - entry32.inc: segment descriptor setup
     *     - CONFIG_CHIPSET_BOOTBLOCK_INCLUDE: chipset-specific initialization
     *     - generated/bootblock.inc: ROMCC part of the bootblock
     *
     * This is used on platforms which do not select C_ENVIRONMENT_BOOTBLOCK, and it
     * tries to do the absolute minimum before walking CBFS and jumping to romstage.
     *
     * This file assembles the bootblock program by the order of the includes. Thus,
     * it's extremely important that one pays very careful attention to the order
     * of the includes.
    */

bootblock\_romcc.S的代码：

#include <arch/x86/prologue.inc>
    #include <cpu/x86/16bit/entry16.inc>
    #include <cpu/x86/16bit/reset16.inc>
    #include <cpu/x86/32bit/entry32.inc>
    
    #ifdef CONFIG_CHIPSET_BOOTBLOCK_INCLUDE
    #include CONFIG_CHIPSET_BOOTBLOCK_INCLUDE
    #endif
    
    #if IS_ENABLED(CONFIG_SSE)
    #include <cpu/x86/sse_enable.inc>
    #endif
    
    /*
     * This bootblock.inc file is generated by ROMCC. The above program flow
     * falls through to this point. ROMCC assumes the last function it parsed
     * is the main function and it places its instructions at the beginning of
     * the generated file. Moreover, any library/common code needed in bootblock
     * needs to come after bootblock.inc.
     */
    #include <generated/bootblock.inc>

这里有个问题就是bootblock.inc并不是现成的代码，而是ROMCC生成的文件，而ROMCC是coreboot的一个工具，具体作用还不明。

bootblock\_crt0.S对应的是：

/*
     * This is the modern bootblock. It is used by platforms which select
     * C_ENVIRONMENT_BOOTBLOCK, and it prepares the system for C environment runtime
     * setup. The actual setup is done by hardware-specific code.
     *
     * It provides a bootflow similar to other architectures, and thus is considered
     * to be the modern approach.
    */

对应的代码：

#include <cpu/x86/cr.h>
    
    /*
     * Include the old code for reset vector and protected mode entry. That code has
     * withstood the test of time.
     */
    #include <arch/x86/prologue.inc>
    #include <cpu/x86/16bit/entry16.inc>
    #include <cpu/x86/16bit/reset16.inc>
    #include <cpu/x86/32bit/entry32.inc>
    
    #if IS_ENABLED(CONFIG_BOOTBLOCK_DEBUG_SPINLOOP)
    
    	/* Wait for a JTAG debugger to break in and set EBX non-zero */
    	xor	%ebx, %ebx
    
    debug_spinloop:
    	cmp	$0, %ebx
    	jz	debug_spinloop
    #endif
    
    bootblock_protected_mode_entry:
    
    	/* BIST result in eax */
    	movl	%eax, %ebx
    
    	/* Get an early timestamp */
    	rdtsc
    
    #if IS_ENABLED(CONFIG_BOOTBLOCK_SAVE_BIST_AND_TIMESTAMP)
    	lea	1f, %ebp
    
    	/* eax: Low 32-bits of timestamp
    	 * ebx: BIST result
    	 * ebp: return address
    	 * edx: High 32-bits of timestamp
    	 */
    	jmp	bootblock_save_bist_and_timestamp
    1:
    #else
    	movd	%ebx, %mm0
    	movd	%eax, %mm1
    	movd	%edx, %mm2
    #endif
    
    #if IS_ENABLED(CONFIG_SSE)
    enable_sse:
    	mov	%cr4, %eax
    	or	$CR4_OSFXSR, %ax
    	mov	%eax, %cr4
    #endif /* IS_ENABLED(CONFIG_SSE) */
    
    	/* We're done. Now it's up to platform-specific code */
    	jmp	bootblock_pre_c_entry

两种类型的bootblock前面的resetvector和进入保护模式的方式都是一样的，之后modern bootblock跳转到了bootblock\_pre\_c\_entry：

/*
     * C code entry point for the boot block.
     */
    void asmlinkage bootblock_c_entry(uint64_t base_timestamp);

bootblock\_c\_entry()最终会调用：

/*
     * This is a the same as the bootblock main(), with the difference that it does
     * not collect a timestamp. Instead it accepts the first timestamp as an
     * argument. This can be used in cases where an earlier stamp is available
     * Note that this function is designed to be entered from C code.
     * This function assumes that the timer has already been initialized, so it
     * does not call init_timer().
     */
    void asmlinkage bootblock_main_with_timestamp(uint64_t base_timestamp);

这个函数是bootblock阶段的c语言入口。

它的一个代码实现：

void asmlinkage bootblock_main_with_timestamp(uint64_t base_timestamp)
    {
    	/* Initialize timestamps if we have TIMESTAMP region in memlayout.ld. */
    	if (IS_ENABLED(CONFIG_COLLECT_TIMESTAMPS) && _timestamp_size > 0)
    		timestamp_init(base_timestamp);
    
    	bootblock_soc_early_init();
    	bootblock_mainboard_early_init();
    
    	if (IS_ENABLED(CONFIG_BOOTBLOCK_CONSOLE)) {
    		console_init();
    		exception_init();
    	}
    
    	bootblock_soc_init();
    	bootblock_mainboard_init();
    
    	run_romstage();
    }

最终它跳转到了romstage阶段，这是coreboot的第二个阶段。

**4. Execution continues with various mainboard init fragments:**

**a) \_\_fpu\_start fromcpu/x86/fpu\_enable.inc.**

**b) (unlabeled) fromcpu/x86/sse\_enable.inc**

**c) Some CPUs enable their on-chipcache to be used temporarily as a scratch RAM (stack), e.g.cpu/amd/model\_lx/cache\_as\_ram.inc.**

相关的代码都能够找到，但是并不是在所有平台上都会使用，即使使用，也会有不同的实现，所以会对应不同的代码。

这一部分仍属于bootblock阶段，并且根据不同的平台代码分布位置可能不同。

**5. The final mainboard init fragment is mainboard-specific, in C, called romstage.c. For non-cache-as-RAM targets, it is compiled with romcc. It includes and uses other C-code fragments for:**

**a) Initializing MSRs, MTRRs, APIC.**

**b) Setting up the southbridge minimally ("early setup").**

**c) Setting up Super I/O serial.**

**d) Initializing the console.**

**e) Initializing RAM controller and RAM itself.**

这一部分属于romstage阶段。

void run_romstage(void)
    {
    	struct prog romstage =
    		PROG_INIT(PROG_ROMSTAGE, CONFIG_CBFS_PREFIX "/romstage");
    
    	if (prog_locate(&romstage))
    		goto fail;
    
    	timestamp_add_now(TS_START_COPYROM);
    
    	if (cbfs_prog_stage_load(&romstage))
    		goto fail;
    
    	timestamp_add_now(TS_END_COPYROM);
    
    	prog_run(&romstage);
    
    fail:
    	if (IS_ENABLED(CONFIG_BOOTBLOCK_CONSOLE))
    		die("Couldn't load romstage.\n");
    	halt();
    }

从代码上看，应该是获取到二进制的romstage文件并执行。

romstage文件通过romstage.c文件编译得到，它有很多个，因为要对应不同的平台。

**6. Execution continues at \_\_main from src/arch/x86/init/crt0\_romcc\_epilogue.inc, where the non-romcc C coreboot code is copied (possibly decompressed) to RAM, then the RAM entry point is jumped to.**

romstage阶段最后的步骤就是初始化内存并拷贝相关代码到内存中，而后再跳转到内存中去执行剩余的代码。

下面就进入ramstage阶段：

**7. The RAM entry point is \_startin src/arch/x86/lib/c\_start.S, where new descriptor tables are set up, the stack and BSS are cleared, the IDT is initialized, and hardwaremain() is called(operation is now full 32-bit protected mode C program with stack).**

c\_start.S中有如下的代码：

/*
    	 *	Now we are finished. Memory is up, data is copied and
    	 *	bss is cleared.   Now we call the main routine and
    	 *	let it do the rest.
    	 */
    	post_code(POST_PRE_HARDWAREMAIN)	/* post fe */
    
    #if CONFIG_GDB_WAIT
    	call gdb_hw_init
    	call gdb_stub_breakpoint
    #endif
    	call main
    	/* NOTREACHED */

这里的main就是hardwaremain.c中的main()函数。

**8. hardwaremain() is from src/boot/hardwaremain.c, the console is initialized, devices are enumerated and initialized, configured and enabled.**

在hardwaremain.c中，会按照如下的过程执行：

static struct boot_state boot_states[] = {
    	BS_INIT_ENTRY(BS_PRE_DEVICE, bs_pre_device),
    	BS_INIT_ENTRY(BS_DEV_INIT_CHIPS, bs_dev_init_chips),
    	BS_INIT_ENTRY(BS_DEV_ENUMERATE, bs_dev_enumerate),
    	BS_INIT_ENTRY(BS_DEV_RESOURCES, bs_dev_resources),
    	BS_INIT_ENTRY(BS_DEV_ENABLE, bs_dev_enable),
    	BS_INIT_ENTRY(BS_DEV_INIT, bs_dev_init),
    	BS_INIT_ENTRY(BS_POST_DEVICE, bs_post_device),
    	BS_INIT_ENTRY(BS_OS_RESUME_CHECK, bs_os_resume_check),
    	BS_INIT_ENTRY(BS_OS_RESUME, bs_os_resume),
    	BS_INIT_ENTRY(BS_WRITE_TABLES, bs_write_tables),
    	BS_INIT_ENTRY(BS_PAYLOAD_LOAD, bs_payload_load),
    	BS_INIT_ENTRY(BS_PAYLOAD_BOOT, bs_payload_boot),
    };

最终到达加载payload那一步：

**9. The payload is called, either via elfboot() from boot/elfboot.c, or filo() from boot/filo.c**

PS：以上属于根据wiki和coreboot得到的个人理解，不保证100%正确，如有错误请见谅。

[wiki]: https://www.coreboot.org/Developer_Manual#Recommended_hardware_and_software_tools