Debugging coreboot in qemu environment - part 2

In previous post coreboot was configured and installed. Here we try to establish good debugging environment for it. To create a good emulated environment to debug, research and learn coreboot few tricks are required. First of all we need to know how to run our emulated enviroment (qemu). What I mean by that ?

• load coreboot image (-bios option),
• freeze CPU at startup (-S),
• get appropriate feedback about virtual machine state (-d in_asm,cpu),
• set up remote gdb server to run qemu step by step (-s).

So finally we get:

qemu -bios src/coreboot/build/coreboot.rom -s -S -d in_asm,cpu -nographic

We don't need graphics so it also could be disable (-nographic). Run above command and prepare debugging environment as described below.

1. Set up gdb:
   1. load bootblock file in gdb:

      file path/to/coreboot/build/bootblock.elf

   2. use objdump to find out at what address .text, .bss and .data sections are:

      objdump -h src/coreboot/build/coreboot_ram|grep -E "text|bss|\.data"

      my output looks like that:

      0 .text         00010810  00100000  00100000  00001000  2**2
      3 .data         000004d8  001174e8  001174e8  000184e8  2**2
      4 .bss          0000080c  001179c0  001179c0  000189c0  2**3

   3. use above addresses to load symbols from coreboot_ram file in gdb:

      add-symbol-file src/coreboot/build/coreboot_ram 0x00100000 -s .data \
      0x001174e8 -s .bss 0x001179c0

2. In another terminal or screen window

   vim /tmp/qemu.log

   (use :e to reload qemu.log file after every instruction), in this file we will get information about all registers of virtual machine
target remote :1234
3. Run next instruction (ni command in gdb) and refresh qemu.log, if you get something like:

   EAX=00000000 EBX=00000000 ECX=00000000 EDX=00000633 
   ESI=00000000 EDI=00000000 EBP=00000000 ESP=00000000
   EIP=0000fff0 EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
   ES =0000 00000000 0000ffff 00009300
   CS =f000 ffff0000 0000ffff 00009b00
   SS =0000 00000000 0000ffff 00009300 
   DS =0000 00000000 0000ffff 00009300
   FS =0000 00000000 0000ffff 00009300
   GS =0000 00000000 0000ffff 00009300
   LDT=0000 00000000 0000ffff 00008200
   TR =0000 00000000 0000ffff 00008b00
   GDT=     00000000 0000ffff
   IDT=     00000000 0000ffff
   CR0=60000010 CR2=00000000 CR3=00000000 CR4=00000000
   DR0=00000000 DR1=00000000 DR2=00000000 DR3=00000000
   DR6=ffff0ff0 DR7=00000400
   

it means that your debugging enviroment was set correctly.

Debugging coreboot in qemu environment - part 1

First of all I use testing version of Debian - wheezy. Clone coreboot repository:

git clone http://review.coreboot.org/p/coreboot

Conifigure:

cd coreboot; make menuconfig

Set:

Payload  ---> Add a payload ---> FILO
Payload  ---> FILO version ---> HEAD
Debugging  ---> Check PIRQ table consistency
Debugging  ---> Output verbose malloc debug messages
Debugging  ---> Output verbose ACPI debug messages
Debugging  ---> Enable debug messages for option ROM execution
Debugging  ---> Built-in low-level shell
Debugging  ---> Trace function calls

Try to build:

make

If everything builds correctly you can process. Sometimes there is need to use cross compiler. To build one:

cd util/crossgcc

./buildgcc

To explore coreboot code effectively I suggest to create tags and cscope database for coreboot. In my personal workspace I've got process that I go through before I start work (if you use my workspace configuration which is available @github you can follow below steps directly, if not adjust to your enviroment):

1. run vim ;)
2. :cd /path/to/code
3. s<Tab> (fuzzyfinder -> bookmark dir)
4. si (fuzzyfinder -> change dir)
5. sr (run ctags to generate tags and cscope to build symbol database - ctags -R;cscope -R -q -b -v)

After steps above we can start work with code. Run vim in coreboot dirctory. Type:
:e src/cpu/x86/16bit/reset16.inc
Put cursor over protected_start and press Ctrl-]. If everything goes ok you should jump to build/mainboard/emulation/qemu-x86/bootblock.s line 537.


In second article we dive into first phase of coreboot execution in emulated environment.  

flashrom and Shuttle AV18E2

During Christmas break I found an old unused motherboard in my home, right away I thought that it maybe useful as learning environment for coreboot. First you need to do with this kind of board is to check if it is possible to flash its BIOS with user space tool called flashrom list of supported hardware can be found here.


All you need to do is go through this HOWTO. Be aware that these operations can cause you will not be able to run your motherboard if something goes wrong. Therefore, I suggest protect yourself by supplying checked programmer or other memory chip for your board containing a working BIOS.


For my Shuttle board I checked if the Winbond W49F002U chip on it is supported by flashrom. Fortunately it was. After that I read my BIOS by:

flashrom -Vr bios_bckp.bin

And write it by:

flashrom -Vw bios_bckp.bin

At the end I've got VERIFIED message but when I look carefully inside the log there was something like this:

Erasing and writing flash chip... Trying erase function 0... 0x000000-0x01ffff:S,
 0x020000-0x037fff:S, 0x038000-0x039fff:S, 0x03a000-0x03bfff:S, 0x03c000-0x03ffff:S
Erase/write done.
Verifying flash... VERIFIED.

This means that these addresses have not been overwritten but skipped, becuse the fact that the data which were to be overridden were identical with what we wanted to write. So if we found such output to properly verify flashrom we need to clear our memory and write it again with BIOS backup. Correct output should look like this:

Erasing and writing flash chip... Trying erase function 0... 0x000000-0x01ffff:W,
0x020000-0x037fff:W, 0x038000-0x039fff:W, 0x03a000-0x03bfff:W, 0x03c000-0x03ffff:W
Erase/write done.
Verifying flash... VERIFIED. 

Next post I will try to familiarize you with the process of debugging coreboot using QEMU.

How to begin with coreboot

About a month ago I started my adventure with coreboot. As coreboot home page says "coreboot is a Free Software project aimed at replacing the proprietary BIOS (firmware) found in most computers". Although I read the majority of materials from mentioned page I still suffered from a lack of basic information that would help me to arrange everything in my head. Therefore, I decided to write a series of posts described my actions associated with this interesting project.


At the beginning I would recommend some interesting sources of information on coreboot:

• http://www.coreboot.org/QEMU - If you're impatient and want to start as soon as possible
• Coreboot videos - One of the easiest ways to obtain general information about the project
• Start to understand - I found this page by accident while googling materials, thanks to its author I understood basics and found out what's next
• Documentation - Many different types of documents, a large proportion of them are not applying to the latest version of coreboot v4, however, still has a educational value.

After reviewing the above materials, you should understand the basics of coreboot. In the next post I will describe flashrom application and my experience with one of the old motherboard.