vhaudiquet
64e19c213a
Minimal freestanding arm64 binary that depthcharge boots as a kernel: parses depthcharge's /firmware/coreboot DTB node, walks the coreboot table, finds LB_TAG_FRAMEBUFFER, and paints red/yellow/green/blue checkpoints (~2s each) into the live boot-splash framebuffer. Verified against coreboot tables header, Linux arm64 booting.rst, and depthcharge's fit.c/boot64.c. Host parser tests pass against the live /sys/firmware/fdt; full red->yellow->green->blue sequence verified end-to-end under qemu-system-aarch64; packed image verifies with the ChromeOS devkeys.
272 lines
8.0 KiB
C
272 lines
8.0 KiB
C
/*
|
|
* krane-fb-stub — freestanding, position-independent payload main.
|
|
*
|
|
* Checkpoint sequence (from the task spec):
|
|
* 1. RED — stub entered and running (depthcharge jumped here)
|
|
* 2. YELLOW — DTB parsed, /firmware/coreboot node found
|
|
* 3. GREEN — "LBIO" signature verified, LB_TAG_FRAMEBUFFER record found
|
|
* 4. BLUE — previous fills visibly succeeded; hold blue forever
|
|
* On any failure: spin forever on the LAST SUCCESSFUL color.
|
|
*
|
|
* Deviation from the prompt (documented in README): the framebuffer
|
|
* address is only knowable after parsing the DTB and the coreboot table,
|
|
* so "red on entry" is physically impossible. Parsing happens first
|
|
* (fast, <1ms); if any parse stage fails the screen keeps showing
|
|
* depthcharge's own output (the dev-mode menu), which is an even
|
|
* stronger "stuck at stage N" signal than a stuck color.
|
|
*/
|
|
|
|
typedef unsigned char u8;
|
|
typedef unsigned short u16;
|
|
typedef unsigned int u32;
|
|
typedef unsigned long long u64;
|
|
|
|
/* ---- platform helpers --------------------------------------------------- */
|
|
|
|
static void halt(void)
|
|
{
|
|
for (;;)
|
|
__asm__ volatile("wfe");
|
|
}
|
|
|
|
#ifdef __aarch64__
|
|
/* Generic timer read — not a timer driver, just two system registers. */
|
|
static void delay_ms(unsigned ms)
|
|
{
|
|
u64 frq, t;
|
|
__asm__ volatile("mrs %0, cntfrq_el0" : "=r"(frq));
|
|
if (!frq) { /* paranoia: fallback spin */
|
|
volatile u64 n = (u64)ms * 200000;
|
|
while (n--)
|
|
;
|
|
return;
|
|
}
|
|
__asm__ volatile("mrs %0, cntpct_el0" : "=r"(t));
|
|
u64 end = t + (frq / 1000) * (u64)ms;
|
|
do {
|
|
__asm__ volatile("mrs %0, cntpct_el0" : "=r"(t));
|
|
} while (t < end);
|
|
}
|
|
#else
|
|
/* host test build */
|
|
static void delay_ms(unsigned ms) { (void)ms; }
|
|
#endif
|
|
|
|
static u32 rd32le(const void *p) { return *(volatile const u32 *)p; }
|
|
static u32 rd32be(const void *p) { return __builtin_bswap32(*(volatile const u32 *)p); }
|
|
|
|
static int streq(const char *a, const char *b)
|
|
{
|
|
while (*a && *a == *b) { a++; b++; }
|
|
return *a == *b;
|
|
}
|
|
|
|
/* ---- FDT parsing -------------------------------------------------------- */
|
|
|
|
#define FDT_MAGIC 0xd00dfeedu
|
|
#define FDT_BEGIN_NODE 1
|
|
#define FDT_END_NODE 2
|
|
#define FDT_PROP 3
|
|
#define FDT_NOP 4
|
|
#define FDT_END 9
|
|
|
|
struct fbinfo {
|
|
u64 pa;
|
|
u32 xres, yres, bpl;
|
|
u8 bpp, rpos, rsize, gpos, gsize, bpos, bsize;
|
|
};
|
|
|
|
/*
|
|
* Walk the FDT at `dt`, find /firmware/coreboot, return reg pair #1
|
|
* (coreboot table address + size). Cell counts tracked from
|
|
* #address-cells/#size-cells properties; krane root is 2/2 and
|
|
* depthcharge's fixup adds them on /firmware as well.
|
|
*/
|
|
static int find_coreboot_reg(const void *dt, u64 *addr, u32 *size)
|
|
{
|
|
const u8 *base = (const u8 *)dt;
|
|
const u8 *sbase = base + rd32be(base + 12); /* off_dt_strings */
|
|
const u32 *p = (const u32 *)(base + rd32be(base + 8)); /* off_dt_struct */
|
|
|
|
if (rd32be(base) != FDT_MAGIC)
|
|
return -1;
|
|
|
|
int depth = 0;
|
|
const char *path[8];
|
|
u32 ac = 2, sc = 2; /* krane root: #address/size-cells = 2/2 */
|
|
|
|
for (;;) {
|
|
u32 tok = rd32be(p); p++;
|
|
|
|
if (tok == FDT_BEGIN_NODE) {
|
|
const char *name = (const char *)p;
|
|
while (*(volatile const u8 *)p) /* skip name + NUL */
|
|
p = (const u32 *)((const u8 *)p + 1);
|
|
p = (const u32 *)(((u64)p + 4) & ~3ull); /* + pad */
|
|
if (depth < 8)
|
|
path[depth] = name;
|
|
depth++;
|
|
} else if (tok == FDT_END_NODE) {
|
|
depth--;
|
|
} else if (tok == FDT_PROP) {
|
|
u32 len = rd32be(p); p++;
|
|
u32 nameoff = rd32be(p); p++;
|
|
const char *pname = (const char *)(sbase + nameoff);
|
|
|
|
if (len == 4 && streq(pname, "#address-cells"))
|
|
ac = rd32be(p);
|
|
else if (len == 4 && streq(pname, "#size-cells"))
|
|
sc = rd32be(p);
|
|
else if (depth == 3 && streq(path[1], "firmware") &&
|
|
streq(path[2], "coreboot") && streq(pname, "reg") &&
|
|
len >= 16 && ac == 2 && sc == 2) {
|
|
/* first (address, size) pair, big-endian cells */
|
|
*addr = (u64)rd32be(p) << 32 | rd32be(p + 1);
|
|
*size = (u64)rd32be(p + 2) << 32 | rd32be(p + 3);
|
|
return 0;
|
|
}
|
|
p = (const u32 *)((const u8 *)p + ((len + 3) & ~3ull));
|
|
} else if (tok == FDT_NOP) {
|
|
continue;
|
|
} else { /* FDT_END or garbage */
|
|
return -1;
|
|
}
|
|
}
|
|
}
|
|
|
|
/* ---- coreboot table walk ------------------------------------------------ */
|
|
|
|
#define LB_TAG_FRAMEBUFFER 0x12
|
|
|
|
/*
|
|
* Layout verified against coreboot
|
|
* src/commonlib/include/commonlib/coreboot_tables.h (see README):
|
|
* struct lb_header: sig[4] "LBIO", header_bytes, header_checksum,
|
|
* table_bytes, table_checksum, table_entries (LE u32)
|
|
* struct lb_record: tag, size
|
|
* struct lb_framebuffer, offsets from record start (record = tag, size, ...):
|
|
* physical_address @8 (lb_uint64_t = 4-byte-aligned u64, little-endian)
|
|
* x_resolution @16, y_resolution @20, bytes_per_line @24,
|
|
* bits_per_pixel @28, red_pos/size @29/30, green @31/32,
|
|
* blue @33/34, reserved @35/36, orientation @37, flags @38, pad @39
|
|
* sizeof(struct lb_framebuffer) == 40 (host-verified with real header).
|
|
*/
|
|
static int find_framebuffer(u64 table, struct fbinfo *fb)
|
|
{
|
|
const u8 *h = (const u8 *)table;
|
|
|
|
if (rd32le(h) != 0x4F49424Cu) /* "LBIO", 'L' = lowest byte */
|
|
return -1;
|
|
|
|
u32 header_bytes = rd32le(h + 4);
|
|
u32 entries = rd32le(h + 20);
|
|
if (header_bytes < 24 || header_bytes > 4096 ||
|
|
entries == 0 || entries > 4096)
|
|
return -1;
|
|
|
|
const u8 *rec = h + header_bytes;
|
|
for (u32 i = 0; i < entries; i++) {
|
|
u32 tag = rd32le(rec);
|
|
u32 rsize = rd32le(rec + 4);
|
|
if (rsize < 8)
|
|
return -1;
|
|
if (tag == LB_TAG_FRAMEBUFFER) {
|
|
if (rsize < 40)
|
|
return -1;
|
|
fb->pa = (u64)rd32le(rec + 8) |
|
|
(u64)rd32le(rec + 12) << 32;
|
|
fb->xres = rd32le(rec + 16);
|
|
fb->yres = rd32le(rec + 20);
|
|
fb->bpl = rd32le(rec + 24);
|
|
fb->bpp = rec[28];
|
|
fb->rpos = rec[29]; fb->rsize = rec[30];
|
|
fb->gpos = rec[31]; fb->gsize = rec[32];
|
|
fb->bpos = rec[33]; fb->bsize = rec[34];
|
|
if (!fb->pa || !fb->xres || !fb->yres || !fb->bpl)
|
|
return -1;
|
|
if (fb->bpp % 8 || fb->bpp < 8 || fb->bpp > 32)
|
|
return -1;
|
|
if (fb->bpl < (u32)fb->xres * (fb->bpp / 8))
|
|
return -1;
|
|
if (fb->xres > 16384 || fb->yres > 16384)
|
|
return -1;
|
|
return 0;
|
|
}
|
|
rec += rsize;
|
|
}
|
|
return -1;
|
|
}
|
|
|
|
/* ---- framebuffer fill --------------------------------------------------- */
|
|
|
|
static u64 mkcolor(const struct fbinfo *f, int r, int g, int b)
|
|
{
|
|
u64 v = 0;
|
|
if (r && f->rsize && f->rsize < 32)
|
|
v |= (u64)((1u << f->rsize) - 1) << f->rpos;
|
|
if (g && f->gsize && f->gsize < 32)
|
|
v |= (u64)((1u << f->gsize) - 1) << f->gpos;
|
|
if (b && f->bsize && f->bsize < 32)
|
|
v |= (u64)((1u << f->bsize) - 1) << f->bpos;
|
|
return v;
|
|
}
|
|
|
|
static void fill_screen(const struct fbinfo *f, u64 val)
|
|
{
|
|
u32 bppb = f->bpp / 8;
|
|
|
|
for (u32 y = 0; y < f->yres; y++) {
|
|
volatile u8 *row = (volatile u8 *)f->pa + (u64)y * f->bpl;
|
|
for (u32 x = 0; x < f->xres; x++) {
|
|
volatile u8 *px = row + (u64)x * bppb;
|
|
switch (bppb) {
|
|
case 4: *(volatile u32 *)px = (u32)val; break;
|
|
case 2: *(volatile u16 *)px = (u16)val; break;
|
|
case 1: *px = (u8)val; break;
|
|
case 3:
|
|
px[0] = (u8)val;
|
|
px[1] = (u8)(val >> 8);
|
|
px[2] = (u8)(val >> 16);
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
/* ---- main checkpoint sequence ------------------------------------------- */
|
|
|
|
static void checkpoint(const struct fbinfo *f, int r, int g, int b)
|
|
{
|
|
fill_screen(f, mkcolor(f, r, g, b));
|
|
delay_ms(2000);
|
|
}
|
|
|
|
void cmain(u64 dtb)
|
|
{
|
|
struct fbinfo fb;
|
|
u64 lbio_addr;
|
|
u32 lbio_size;
|
|
|
|
/*
|
|
* Parse everything first (instantaneous); see deviation note above.
|
|
* If either stage fails we halt having painted nothing — the screen
|
|
* keeps depthcharge's output, which identifies the failure stage.
|
|
*/
|
|
if (find_coreboot_reg((const void *)dtb, &lbio_addr, &lbio_size))
|
|
halt(); /* stuck on depthcharge output */
|
|
|
|
if (find_framebuffer(lbio_addr, &fb))
|
|
halt(); /* stuck on depthcharge output */
|
|
|
|
/* Checkpoint 1: red — we entered, parsed, and can draw. */
|
|
checkpoint(&fb, 1, 0, 0); /* red */
|
|
/* Checkpoint 2: yellow — DTB stage. */
|
|
checkpoint(&fb, 1, 1, 0); /* yellow */
|
|
/* Checkpoint 3: green — LBIO + framebuffer record found. */
|
|
checkpoint(&fb, 0, 1, 0); /* green */
|
|
/* Checkpoint 4: blue — all earlier fills visibly succeeded. */
|
|
checkpoint(&fb, 0, 0, 1); /* blue */
|
|
|
|
halt(); /* hold blue forever */
|
|
}
|