Flash芯片
之前Desktop的案子,BIOS 由一块32M的Nor Flash存储,还有一块Flash做PDR Region
生成的BIOS Bin
BIOS编译过程中会根据不同的xml file生成对应的BIOS bin文件,xml file可以用Intel提供的Fit.exe工具解析
Intel闪存映像布局
英特尔在相应芯片组的数据表页面上讨论了BIOS的结构。对于所有从第六系列开始的芯片组,此格式通常保持不变,该文件分为3-5个区域,可选的是GbE区域和PDR。
UEFI Tool解析
用开源EFITool工具加载了编译生成的bin文件,AMI有自己的MMtool
可以发现Reset Vector位于BIOS Rom Image的最底部,探索形成这样的Image结构相关的各种文件(.fdf/.fd/.fv等文件)
组成结构:16M BIOS + 16M ME ,PDR Regin存在备用的PDR Flash上
BIOS Rom部分,由GenFv工具根据fdf文件生成,根据代码的定义的Flash Layout相关的Token Veb会自动生成fdf,前面的部分描述了Flahs Layout的布局,详细列出各个FV的起始地址和Size,edk2的话fdf则需要自己写
#FD Section
[FD.AMIROM]
BaseAddress = 0xff000000
Size = 0x1000000
ErasePolarity = 1
BlockSize = 0x1000
NumBlocks = 0x1000
DEFINE UNCOMPRESSED_PEI_EXECUTABLES_ALIGNMENT =
DEFINE SEC_CORE_EXECUTABLE_ALIGNMENT = Align = 8
......
0x0|0x20000
FV = LNV_OEM_DATA_REGION
0x20000|0x50000
FV = NVRAM
0x70000|0x50000
#RAW - NVRAM_BACKUP
0xc0000|0x20000
FV = LEM_FV_DATA
0xe0000|0x870000
FV = FV_MAIN_WRAPPER
0x950000|0x20000
FV = FV_CMP
0x970000|0x10000
FV = FV_BCP
0x980000|0x110000
FV = FV_DATA_BACKUP
0xa90000|0x110000
FV = FV_DATA
0xba0000|0xa0000
FV = FV_BB_AFTER_MEMORY_BACKUP
0xc40000|0x90000
FV = FV_FSP_S_BACKUP
0xcd0000|0xa0000
FV = FV_BB_AFTER_MEMORY
0xd70000|0x90000
FV = FV_FSP_S
0xe00000|0x70000
#FV_FSP_BACKUP
FILE = Build/Fsp_Rebased_M_T.fd
0xe70000|0x90000
FV = FV_BB_BACKUP
0xf00000|0x70000
#FV_FSP
FILE = Build/Fsp_Rebased_M_T.fd
0xf70000|0x90000
FV = FV_BB
#FV Section
[FV.FV_MAIN]
BlockSize = 0x1000
NumBlocks = 0x0
FvAlignment = 16
MEMORY_MAPPED = TRUE
FvNameGuid = 5C60F367-A505-419A-859E-2A4FF6CA6FE5
APRIORI DXE {
INF AmiModulePkg/AmiStatusCode/StatusCodeDxe.inf
INF AmiModulePkg/AmiStatusCode/StatusCodeSmm.inf
INF MdeModulePkg/Universal/PCD/Dxe/Pcd.inf
......
!include AmiPkg/Configuration/FontFileStatement.txt
!include AmiModulePkg/NVRAM/FvMainDefaultsFdfFileStatement.txt
!include AmiChipsetModulePkg/LegacyRom/Vbios/VbiosFdfFileStatements.txt
......
#FV Section
[FV.FV_LOGOROMHOLE]
BlockSize = 0x1000
NumBlocks = 0x20
FvAlignment = 1
......
FvNameGuid = E54D9684-2735-43ef-A379-30F2F592BA10
!include AmiTsePkg/Core/em/AMITSE/Logoffs.txt
#FV Section
[FV.FV_MEFW_CAPSULE]
BlockSize = 0x1000
NumBlocks = 0x600
FvAlignment = 16
......
FvNameGuid = 9F8B1DEF-B62B-45F3-8282-BFD7EA19801B
INF RuleOverride = SubtypeGuidUncompressedNoChecksum Build/MeFwFid.inf
......
!include AmiModulePkg/Ofbd/Meud/AutoMeud/MeRegionFdfFileStatement.txt
#FV Section
[FV.LNV_OEM_DATA_REGION]
BlockSize = 0x1000
NumBlocks = 0x20
FvAlignment = 1
......
#FV Section
[FV.NVRAM]
BlockSize = 0x1000
NumBlocks = 0x50
FvAlignment = 16
......
FvNameGuid = FA4974FC-AF1D-4E5D-BDC5-DACD6D27BAEC
!include AmiModulePkg/NVRAM/NvramFdfFileStatement.txt
#FV Section
[FV.LEM_FV_DATA]
BlockSize = 0x1000
NumBlocks = 0x20
FvAlignment = 16
......
FvNameGuid = 4f1c52d3-d824-4d2a-a2f0-ec40c23c5916
INF RuleOverride = SubtypeGuidUncompressedNoChecksum
......
!include AmiTsePkg/Core/em/AMITSE/Romhole.txt
#FV Section
[FV.FV_CMP]
BlockSize = 0x1000
NumBlocks = 0x20
FvAlignment = 16
......
FvNameGuid = aea406cf-4fc8-4dc3-9796-1ee03b64c715
!include LenovoModulePkg/Universal/ExtendedComputrace/AbsolutePkg/OEMSpecifiedAgentX64ProductionInstaller.txt
#FV Section
[FV.FV_BCP]
BlockSize = 0x1000
NumBlocks = 0x10
FvAlignment = 16
......
FvNameGuid = 8649FC2D-C0E6-4262-AD51-0CEABAB6429E
INF RuleOverride = Uncompressed PldmPkg/BiosConfigPreserve/BiosConfigPreserveBin/BCPFlashData/BCPFlashData.inf
#FV Section
[FV.FV_DATA_BACKUP]
BlockSize = 0x1000
NumBlocks = 0x110
FvAlignment = 16
......
FvNameGuid = E4A068F1-5EF1-4ACE-857C-7935F8A0C708
!include CrbPkg/AmiCrbIntelTopSwap/FvDataBackupFdfFileStatement.txt
#FV Section
[FV.FV_DATA]
BlockSize = 0x1000
NumBlocks = 0x110
FvAlignment = 16
......
FvNameGuid = AFDD39F1-19D7-4501-A730-CE5A27E1154B
INF RuleOverride = UncompressedBinaryNoChecksum AmiChipsetModulePkg/FIT/ReserveBinary/ReserveBootGuardSaveResigndata.inf
!include AmiChipsetModulePkg/FIT/FitTable/FitMicrocodeFdfFileStatement.txt
#FV Section
[FV.FV_BB_AFTER_MEMORY_BACKUP]
BlockSize = 0x1000
NumBlocks = 0xa0
FvAlignment = 16
......
FvNameGuid = 5b08a058-784f-4938-9a49-1588aa05f4b9
......
#FV Section
[FV.FV_FSP_S_BACKUP]
BlockSize = 0x1000
NumBlocks = 0x90
FvAlignment = 16
!include Intel/CometLakeFspBinPkg/FvFspSFdfFileStatement.txt
#FV Section
[FV.FV_BB_AFTER_MEMORY]
BlockSize = 0x1000
NumBlocks = 0xa0
FvAlignment = 16
......
#FV Section
[FV.FV_FSP_S]
BlockSize = 0x1000
NumBlocks = 0x90
FvAlignment = 16
!include Intel/CometLakeFspBinPkg/FvFspSFdfFileStatement.txt
......
#FV Section
[FV.FV_BB_BACKUP]
BlockSize = 0x1000
NumBlocks = 0x90
FvBaseAddress = 0xfff70000
......
FvNameGuid = 61C0F511-A691-4F54-974F-B9A42172CE53
APRIORI PEI {
INF AmiModulePkg/AmiStatusCode/StatusCodePei.inf
INF AmiModulePkg/IO/NCT6686D/NCT6686DPeiInit.inf
......
!include Build/BiosGuardPubKeyhash_FdfFileStatement.txt
!include AmiChipsetModulePkg/FIT/FitTable/FitTableFdfFileStatement.txt
!include LenovoModulePkg/Universal/BuildNaming/BuildNaming.txt
#FV Section
[FV.FV_BB]
BlockSize = 0x1000
NumBlocks = 0x90
FvAlignment = 16
......
FvNameGuid = 61C0F511-A691-4F54-974F-B9A42172CE53
APRIORI PEI {
INF AmiModulePkg/AmiStatusCode/StatusCodePei.inf
INF AmiModulePkg/IO/NCT6686D/NCT6686DPeiInit.inf
INF LenovoModulePkg/Universal/AssetID/AssetIDOnRecoveryMode/AssetIDOnRecoveryModePei.inf
......
!include AmiChipsetModulePkg/BiosGuard/Binary/BiosGuardBinary_FdfFileStatement.txt
!include Intel/CometLakePlatSamplePkg/Binaries/Pct/PctGpioFdfFileStatements.txt
!include
......
fdf文件的开头部份是关键字[fd],它表示完整的BIOS Rom Image。还指定了BIOS的加载地址BaseAddress = 0xff00000,大小Size = 0x1000000(16M),这与UEFITool给出的数据不谋而合:
根据BIOS Rom Image位于4G空间的顶部(0xFFFFFFFF),减去Rom Image Size推算下可以推出Bios Rom加载地址(就是Fdf文件中的BaseAddress=0xff000000)
接下来形如下列内容,则是在FD中开辟了一段连续空间,用来存放FV/FILE等内容。
Offset|Size
[RegionType]
其中Offset和Size是这段空间的相对于整个FD的偏移和大小;前面UEFITool图中”BIOS Region”中列出的每一个FFS项都可以对应到Fdf文件[FD]节中RegionType为FV的项(毕竟只有FV才会用到文件系统FFS)。如果仔细比对,可能会发现UEFITool中倒数第二和倒数第三个FFS的Size和Padding相加正好对应[FD]节中的FV_FSP:
0xf00000|0x70000
#FV_FSP
FILE = Build/Fsp_Rebased_M_T.fd\
FV_FSP项的RegionType是FILE,可以包含任意内容,自然也可以包含其他的fd文件,就如NCB_LOGO项中包含了开机Logo文件;其次,fd文件又由fv组成,UEFITool又能解析fd文件,因此造成了这种FDF和BIOS Rom image不一致。其实,我们可以用UEFITool加载Fsp_Rebuild_M_T.fd,发现其中包含两个FFS:
如果FV_FSP包含的fd文件是经过压缩操作的,那么FDF文件中RegionType为FV的项应该和UEFITool实际得到的相一致。
FDF文件[FD]节之后就是大量的[FV]节,FV的主要作用就是包含组件和模块。他们来填充[FD]节中开辟的空间。先来看一个相对简单的FV节:FV.NVRAM,它只包含一个include语句,指向NvramFdfFileStatement.txt文件:
!include AmiModulePkg/NVRAM/NvramFdfFileStatement.txt
NvramFdfFileStatement.txt文件通过FILE指令,包含binary file:
FILE RAW = CEF5B9A3-476D-497f-9FDC-E98143E0422C {
$(OUTPUT_DIRECTORY)/Nvram.bin
}
FV的主要作用就是填充[FD]节中开辟的空间,用这个FV节验证一下:
FDF中,FV.Nvram位于Bios Rom image的开头,Fv guid:FA4974FC-AF1D-4E5D-BDC5-DACD6D27BAEC,NvramFdfFileStatement.txt中指定的File Guid:CEF5B9A3-476D-497f-9FDC-E98143E0422C;用UEFITool加载Bios Rom image,第一个FFS(就是FV.Nvram)的Volume GUID: FA4974FC-AF1D-4E5D-BDC5-DACD6D27BAEC;再展开FFS,其中包含的唯一的文件的File Guid: CEF5B9A3-476D-497F-9FDC-E98143E0422C,这些值和FDF中的Fv Guid以及File Guid是一致的。
除了File Guid是一致的,用UEFITool解压后得到的Nvram.bin和原始的Nvram.bin的内容也是一致的:
以上是简单的FV的情况,有些复杂的FV中可以嵌套其它的FV的操作,如FDF中的FV.FV_MAIN_WRAPPER,
#FV Section
[FV.FV_MAIN_WRAPPER]
BlockSize = 0x1000
NumBlocks = 0x870
......
!include AmiPkg/Configuration/NestedFvMainFdfFileStatement.txt
FV.FV_MAIN_WRAPPER节中内容不多,仅仅含有若干条!include语句,但是FV.FV_MAIN_WRAPPER节占据BIOS Rom Image很大一块空间:BlockSizeNumBlocks=0x10000x870=0x870000。它占用如此多空间的原因是NestedFvMainFdfFileStatement.txt通过FILE指令包含了一块压缩的FV文件,而该FV文件是Dxe阶段的代码
NestedFvMainFdfFileStatement.txt的内容如下:
#Includes FVMAIN FV image
FILE FV_IMAGE = 9E21FD93-9C72-4c15-8C4B-E77F1DB2D792 $(FFS_FILE_CHECKSUM_KEYWORD) {
SECTION $(PEI_COMPRESSION_SECTION) {
SECTION FV_IMAGE = FV_MAIN
}
}
FV_MAIN节内容如下:
#FV Section
[FV.FV_MAIN]
BlockSize = 0x1000
NumBlocks = 0x0
FvAlignment = 16
......
INF AmiModulePkg/RomLayout/RomLayoutDxe.inf
INF MdeModulePkg/Core/Dxe/DxeMain.inf
INF AmiModulePkg/Bds/Bds.inf
前面找到Dxe阶段的代码,那Sec和Pei阶段的代码在哪?platform.fdf文件[fd]节中设定FV_BB节位于Bios Rom image的尾部,因此,我们可以猜测并验证Sec模块和Pei模块也位于FV_BB中:
[FV.FV_BB]
BlockSize = 0x1000
NumBlocks = 0xa0
...
APRIORI PEI { ;PEI阶段的APRIORI文件
INF AmiModulePkg/AmiStatusCode/StatusCodePei.inf
...
}
...
INF MdeModulePkg/Core/Pei/PeiMain.inf ;Pei阶段入口
...
INF UefiCpuPkg/SecCore/SecCore.inf ;Sec阶段入口
...
INF UefiCpuPkg/CpuIoPei/CpuIoPei.inf
INF MdeModulePkg/Universal/PcatSingleSegmentPciCfg2Pei/PcatSingleSegmentPciCfg2Pei.inf
虽然,我们已经确定Sec模块和Pei模块位于FV_BB块中,但是有个问题随之出现:SecCore.inf并不是FV_BB中最后一个模块(夹在其他模块之间),所以一眼看去感觉开机时执行的第一条指令并不在SecCore模块中,这明显与EFI Spec相悖。更何况SecCore.inf含有ResetVector:
另外,UEFITool也明显显示SecCore位于Bios Rom image尾部
fdf的设定和实际现象有差异,那一定是GenFv在生成Bios Rom image时有特殊处理。和GenFv Build Bios相关的只能查看Build.log,它记录了从源码到制成Rom Image的全过程,在Build.log的结尾,记录了各个模块在Bios Rom Image的排列位置,有个特殊的Firmware Volumon:08 No.049 类型是SECC—-SecCore,属性被标记为VTF,Bios Rom Image中其他FV中任何模块都不具有该属性:
在PI spec Vol3中提到:
VTF是Volume Top File的缩写,PI spec规定VTF的File Guid为EFI_FFS_VOLUME_TOP_FILE_GUID(1BA0062E-C779-4582-8566-336AE8F78F09),必须位于firmware volume的最后一个字节。而SecCore.inf的FILE_GUID = 1BA0062E-C779-4582-8566-336AE8F78F09。猜测只要某个inf指定自己FILE_GUID为EFI_FFS_VOLUME_TOP_FILE_GUID就有机会被安排在最开始执行。