x86 reset entry, Cache-As-RAM과 gd

QUESTION

cache와 DRAM을 믿을 수 없는 x86 CPU가 어떤 memory를 stack과 gd로 사용해 첫 C 초기화에 도달하는가?

STRUCTURE

객체와 주소가 놓이는 구조

CALL PATH

실행 흐름

STATE LEDGER

단계별 입력과 출력

각 단계의 입력과 처리 후 바뀌는 상태를 정리한 표다. 사용 중인 소스 버전에서 다른 필드를 변경한다면 그에 맞춰 표도 수정한다.

분석 범위의 전제와 비교해, 다음 단계에 잘못된 입력을 넘긴 부분부터 조사한다.

VISUAL WALKTHROUGH

주소와 객체의 이동을 그림으로 읽기

아래 그림은 주소, 객체를 사용하는 기간, 제어권을 넘기는 시점을 중심으로 정리했다. 실제 주소와 크기는 사용 중인 보드의 bdinfo, 맵 파일과 링커 심벌로 확인한다.

UPSTREAM SOURCE

원본 코드

아래 코드는 U-Boot v2026.07의 arch/x86/cpu/start.S에서 29-174줄을 그대로 가져온 것이다. 설명을 위해 실제 코드를 가짜 의사 코드로 바꾸지 않았다.

29#include <generated/asm-offsets.h>
30#include <linux/linkage.h>
31
32.section .text.start
33.code32
34.globl _start
35.type _start, @function
36.globl _x86boot_start
37_x86boot_start:
38	/*
39	 * This is the fail-safe 32-bit bootstrap entry point.
40	 *
41	 * This code is used when booting from another boot loader like
42	 * coreboot or EFI. So we repeat some of the same init found in
43	 * start16.
44	 */
45	cli
46	cld
47
48	/* Turn off cache (this might require a 486-class CPU) */
49	movl	%cr0, %eax
50	orl	$(X86_CR0_NW | X86_CR0_CD), %eax
51	movl	%eax, %cr0
52	wbinvd
53
54	/*
55	 * Zero the BIST (Built-In Self Test) value since we don't have it.
56	 * It must be 0 or the previous loader would have reported an error.
57	 */
58	movl	$0, %ebp
59
60	jmp	1f
61
62	/* Add a way for tools to discover the _start entry point */
63	.align	4
64	.long	0x12345678
65_start:
66	/* This is the 32-bit cold-reset entry point, coming from start16 */
67
68	/* Save BIST */
69	movl	%eax, %ebp
701:
71
72	/* Save table pointer */
73	movl	%ecx, %esi
74
75#ifdef CONFIG_X86_LOAD_FROM_32_BIT
76	lgdt	gdt_ptr2
77#endif
78
79	/* Load the segment registers to match the GDT loaded in start16.S */
80	movl	$(X86_GDT_ENTRY_32BIT_DS * X86_GDT_ENTRY_SIZE), %eax
81	movw	%ax, %fs
82	movw	%ax, %ds
83	movw	%ax, %gs
84	movw	%ax, %es
85	movw	%ax, %ss
86
87	/* Clear the interrupt vectors */
88	lidt	blank_idt_ptr
89
90#ifdef CONFIG_USE_EARLY_BOARD_INIT
91	/*
92	 * Critical early platform init - generally not used, we prefer init
93	 * to happen later when we have a console, in case something goes
94	 * wrong.
95	 */
96	jmp	early_board_init
97.globl early_board_init_ret
98early_board_init_ret:
99#endif
100
101	post_code(POST_START)
102
103	/* Initialise Cache-As-RAM */
104	jmp	car_init
105.globl car_init_ret
106car_init_ret:
107#ifdef CONFIG_USE_CAR
108	/*
109	 * We now have CONFIG_SYS_CAR_SIZE bytes of Cache-As-RAM (or SRAM,
110	 * or fully initialised SDRAM - we really don't care which)
111	 * starting at CONFIG_SYS_CAR_ADDR to be used as a temporary stack
112	 * and early malloc() area. The MRC requires some space at the top.
113	 *
114	 * Stack grows down from top of CAR. We have:
115	 *
116	 * top-> CONFIG_SYS_CAR_ADDR + CONFIG_SYS_CAR_SIZE
117	 *	MRC area
118	 *	global_data with x86 global descriptor table
119	 *	early malloc area
120	 *	stack
121	 * bottom-> CONFIG_SYS_CAR_ADDR
122	 */
123	movl	$(CONFIG_SYS_CAR_ADDR + CONFIG_SYS_CAR_SIZE - 4), %esp
124#ifdef CONFIG_DCACHE_RAM_MRC_VAR_SIZE
125	subl	$CONFIG_DCACHE_RAM_MRC_VAR_SIZE, %esp
126#endif
127#else
128	/*
129	 * Instructions for FSP1, but not FSP2:
130	 * U-Boot enters here twice. For the first time it comes from
131	 * car_init_done() with esp points to a temporary stack and esi
132	 * set to zero. For the second time it comes from fsp_init_done()
133	 * with esi holding the HOB list address returned by the FSP.
134	 */
135#endif
136	/* Set up global data */
137	mov	%esp, %eax
138	call	board_init_f_alloc_reserve
139	mov	%eax, %esp
140	call	board_init_f_init_reserve
141
142#ifdef CONFIG_DEBUG_UART
143	call	debug_uart_init
144#endif
145
146	/* Get address of global_data */
147	mov	%fs:0, %edx
148#if defined(CONFIG_USE_HOB) && !defined(CONFIG_USE_CAR)
149	/* Store the HOB list if we have one */
150	test	%esi, %esi
151	jz	skip_hob
152	movl	%esi, GD_HOB_LIST(%edx)
153
154#ifdef CONFIG_HAVE_FSP
155	/*
156	 * After fsp_init() returns, the stack has already been switched to a
157	 * place within system memory as defined by CONFIG_FSP_TEMP_RAM_ADDR.
158	 * Enlarge the size of malloc() pool before relocation since we have
159	 * plenty of memory now.
160	 */
161	subl	$CONFIG_FSP_SYS_MALLOC_F_LEN, %esp
162	movl	%esp, GD_MALLOC_BASE(%edx)
163#endif
164skip_hob:
165#else
166	/* Store table pointer */
167	movl	%esi, GD_TABLE(%edx)
168#endif
169	/* Store BIST */
170	movl	%ebp, GD_BIST(%edx)
171
172	/* Set parameter to board_init_f() to boot flags */
173	post_code(POST_START_DONE)
174	xorl	%eax, %eax

READING CONTRACT

발췌 범위와 읽기 기준

원문 29-174줄에는 앞뒤 문맥이 포함됩니다. 기준 구문 _start:은 L37에 있습니다. 발췌 첫 줄을 함수 정의의 시작으로 해석하지 않습니다.

x86는 DRAM 전 stack을 Cache-As-RAM 또는 platform temporary RAM에 둔다. _x86boot_start와 _start, TPL/SPL/U-Boot proper의 실제 선택을 먼저 고정하고 CAR top에서 stack, gd와 malloc_f가 차지하는 주소를 계산한다.

RELATED SOURCE

함께 읽어야 하는 원본 코드

첫 코드 조각만으로 동작이 완성되지 않는 경우 호출 매크로, 객체 정의와 실제 실행 목록을 같은 페이지에 묶었다. 각 조각은 같은 기준 commit에서 가져왔다.

7 */
8
9#include <config.h>
10
11.section .text.start
12.code64
13.globl _start
14.type _start, @function
15_start:
16	/* Set up memory using the existing stack */
17	mov	%rsp, %rdi
18	call	board_init_f_alloc_reserve
19
20	mov	%rax, %rsp
21	mov	%rsp, %rdi
22
23	call	board_init_f_init_reserve
24
25	xor	%rdi, %rdi
26	call	board_init_f
27	call	board_init_f_r
28
29	/* Should not return here */
30	jmp	.
31
32.globl board_init_f_r_trampoline64
33.type board_init_f_r_trampoline64, @function
34board_init_f_r_trampoline64:
35	/*
36	 * SDRAM has been initialised, U-Boot code has been copied into
37	 * RAM, BSS has been cleared and relocation adjustments have been
38	 * made. It is now time to jump into the in-RAM copy of U-Boot
39	 *
40	 * %eax = Address of top of new stack
41	 */
42
43	/* Stack grows down from top of SDRAM */
44	movq	%rsi, %rsp
45
46	/* New gd is in rdi */
47
48	/* Re-enter U-Boot by calling board_init_f_r() */
49	call	board_init_f_r

74 *   alignment constraint of the architecture for which we are bulding.
75 *
76 *  - GD is allocated last, so that the return value of this functions is
77 *   both the bottom of the reserved area and the address of GD, should
78 *   the calling context need it.
79 */
80
81ulong board_init_f_alloc_reserve(ulong top)
82{
83	/* Reserve early malloc arena */
84#ifndef CFG_MALLOC_F_ADDR
85#if CONFIG_IS_ENABLED(SYS_MALLOC_F)
86	top -= CONFIG_VAL(SYS_MALLOC_F_LEN);
87#endif
88#endif
89	/* LAST : reserve GD (rounded up to a multiple of 16 bytes) */
90	top = rounddown(top-sizeof(struct global_data), 16);
91
92	return top;
93}
94
95/*
96 * Initialize reserved space (which has been safely allocated on the C
97 * stack from the C runtime environment handling code).
98 *
99 * Notes:
100 *
101 * Actual reservation was done by the caller; the locations from base
102 * to base+size-1 (where 'size' is the value returned by the allocation
103 * function above) can be accessed freely without risk of corrupting the
104 * C runtime environment.
105 *
106 * IMPORTANT:
107 *
108 * Upon return from the allocation function above, on some architectures
109 * the caller will set gd to the lowest reserved location. Therefore, in
110 * this initialization function, the global data MUST be placed at base.
111 *
112 * ALSO IMPORTANT:
113 *
114 * On some architectures, gd will already be good when entering this
115 * function. On others, it will only be good once arch_setup_gd() returns.
116 * Therefore, global data accesses must be done:
117 *
118 * - through gd_ptr if before the call to arch_setup_gd();
119 *
120 * - through gd once arch_setup_gd() has been called.
121 *
122 * Do not use 'gd->' until arch_setup_gd() has been called!
123 *
124 * IMPORTANT TOO:
125 *
126 * Initialization for each "chunk" (GD, early malloc arena...) ends with
127 * an incrementation line of the form 'base += <some size>'. The last of
128 * these incrementations seems useless, as base will not be used any
129 * more after this incrementation; but if/when a new "chunk" is appended,
130 * this increment will be essential as it will give base right value for
131 * this new chunk (which will have to end with its own incrementation
132 * statement). Besides, the compiler's optimizer will silently detect
133 * and remove the last base incrementation, therefore leaving that last
134 * (seemingly useless) incrementation causes no code increase.
135 */

118
119	gdt.len = (num_entries * X86_GDT_ENTRY_SIZE) - 1;
120	gdt.ptr = (ulong)boot_gdt;
121
122	asm volatile("lgdtl %0\n" : : "m" (gdt));
123}
124
125void arch_setup_gd(gd_t *new_gd)
126{
127	u64 *gdt_addr;
128
129	gdt_addr = new_gd->arch.gdt;
130
131	/*
132	 * CS: code, read/execute, 4 GB, base 0
133	 *
134	 * Some OS (like VxWorks) requires GDT entry 1 to be the 32-bit CS
135	 */
136	gdt_addr[X86_GDT_ENTRY_UNUSED] = GDT_ENTRY(0xc09b, 0, 0xfffff);
137	gdt_addr[X86_GDT_ENTRY_32BIT_CS] = GDT_ENTRY(0xc09b, 0, 0xfffff);
138
139	/* DS: data, read/write, 4 GB, base 0 */
140	gdt_addr[X86_GDT_ENTRY_32BIT_DS] = GDT_ENTRY(0xc093, 0, 0xfffff);
141
142	/*
143	 * FS: data, read/write, sizeof (Global Data Pointer),
144	 * base (Global Data Pointer)
145	 */
146	new_gd->arch.gd_addr = new_gd;
147	gdt_addr[X86_GDT_ENTRY_32BIT_FS] = GDT_ENTRY(0x8093,
148					(ulong)&new_gd->arch.gd_addr,
149					sizeof(new_gd->arch.gd_addr) - 1);
150
151	/* 16-bit CS: code, read/execute, 64 kB, base 0 */
152	gdt_addr[X86_GDT_ENTRY_16BIT_CS] = GDT_ENTRY(0x009b, 0, 0x0ffff);
153
154	/* 16-bit DS: data, read/write, 64 kB, base 0 */
155	gdt_addr[X86_GDT_ENTRY_16BIT_DS] = GDT_ENTRY(0x0093, 0, 0x0ffff);
156
157	gdt_addr[X86_GDT_ENTRY_16BIT_FLAT_CS] = GDT_ENTRY(0x809b, 0, 0xfffff);
158	gdt_addr[X86_GDT_ENTRY_16BIT_FLAT_DS] = GDT_ENTRY(0x8093, 0, 0xfffff);
159	gdt_addr[X86_GDT_ENTRY_64BIT_CS] = GDT_ENTRY(0xaf9b, 0, 0xfffff);
160	gdt_addr[X86_GDT_ENTRY_64BIT_TS1] = GDT_ENTRY(0x8980, 0, 0xfffff);
161	gdt_addr[X86_GDT_ENTRY_64BIT_TS2] = 0;
162
163	load_gdt(gdt_addr, X86_GDT_NUM_ENTRIES);
164	load_ds(X86_GDT_ENTRY_32BIT_DS);
165	load_es(X86_GDT_ENTRY_32BIT_DS);
166	load_gs(X86_GDT_ENTRY_32BIT_DS);
167	load_ss(X86_GDT_ENTRY_32BIT_DS);

DETAILS

내부 동작을 더 깊게 읽기

IMPLEMENTATION NOTES

구현을 읽을 때 놓치기 쉬운 부분

OBJECT LIFETIME

객체와 수명

FAILURE PATH

실패 지점과 증상

로그가 끊긴 함수뿐 아니라 그 함수에 주소, 크기, 플래그를 전달한 앞 단계도 조사한다. 오류 처리 후 등록된 객체나 하드웨어 설정이 그대로 남아 있는지도 확인한다.

EVIDENCE

소스 밖에서 확인할 증거

소스에서 파악한 동작을 실제 빌드 결과와 대상 보드의 로그로 확인한다. 아래 명령의 보드 이름과 툴체인 접두사는 사용 중인 빌드 환경에 맞게 바꾼다.

LAB

직접 확인할 실험

1. 01
   QEMU에서 _start, car_init_ret, board_init_f에 breakpoint

   32-bit protected entry 진입 전후에 BIST and table pointer의 주소·크기·반환값과 timestamp를 함께 남긴다.

2. 02
   CAR 전체를 pattern으로 채워 stack high-water 측정

   GDT and blank IDT 진입 전후에 segment registers의 주소·크기·반환값과 timestamp를 함께 남긴다.

3. 03
   GD 주소와 FS base/GDT descriptor 대조

   car_init 진입 전후에 Cache-As-RAM range의 주소·크기·반환값과 timestamp를 함께 남긴다.

4. 04
   POST code에 TSC를 붙여 CAR와 DRAM training 시간 분리

   CAR stack 진입 전후에 temporary stack의 주소·크기·반환값과 timestamp를 함께 남긴다.

PRIMARY REFERENCES

원문과 다음 글