1# 2# Copyright (C) 2014, Simon Glass <sjg@chromium.org> 3# Copyright (C) 2014, Bin Meng <bmeng.cn@gmail.com> 4# 5# SPDX-License-Identifier: GPL-2.0+ 6# 7 8U-Boot on x86 9============= 10 11This document describes the information about U-Boot running on x86 targets, 12including supported boards, build instructions, todo list, etc. 13 14Status 15------ 16U-Boot supports running as a coreboot [1] payload on x86. So far only Link 17(Chromebook Pixel) and QEMU [2] x86 targets have been tested, but it should 18work with minimal adjustments on other x86 boards since coreboot deals with 19most of the low-level details. 20 21U-Boot also supports booting directly from x86 reset vector without coreboot, 22aka raw support or bare support. Currently Link, QEMU x86 targets and all 23Intel boards support running U-Boot 'bare metal'. 24 25As for loading an OS, U-Boot supports directly booting a 32-bit or 64-bit 26Linux kernel as part of a FIT image. It also supports a compressed zImage. 27 28Build Instructions 29------------------ 30Building U-Boot as a coreboot payload is just like building U-Boot for targets 31on other architectures, like below: 32 33$ make coreboot-x86_defconfig 34$ make all 35 36Note this default configuration will build a U-Boot payload for the QEMU board. 37To build a coreboot payload against another board, you can change the build 38configuration during the 'make menuconfig' process. 39 40x86 architecture ---> 41 ... 42 (qemu-x86) Board configuration file 43 (qemu-x86_i440fx) Board Device Tree Source (dts) file 44 (0x01920000) Board specific Cache-As-RAM (CAR) address 45 (0x4000) Board specific Cache-As-RAM (CAR) size 46 47Change the 'Board configuration file' and 'Board Device Tree Source (dts) file' 48to point to a new board. You can also change the Cache-As-RAM (CAR) related 49settings here if the default values do not fit your new board. 50 51Building a ROM version of U-Boot (hereafter referred to as u-boot.rom) is a 52little bit tricky, as generally it requires several binary blobs which are not 53shipped in the U-Boot source tree. Due to this reason, the u-boot.rom build is 54not turned on by default in the U-Boot source tree. Firstly, you need turn it 55on by enabling the ROM build: 56 57$ export BUILD_ROM=y 58 59This tells the Makefile to build u-boot.rom as a target. 60 61Link-specific instructions: 62 63First, you need the following binary blobs: 64 65* descriptor.bin - Intel flash descriptor 66* me.bin - Intel Management Engine 67* mrc.bin - Memory Reference Code, which sets up SDRAM 68* video ROM - sets up the display 69 70You can get these binary blobs by: 71 72$ git clone http://review.coreboot.org/p/blobs.git 73$ cd blobs 74 75Find the following files: 76 77* ./mainboard/google/link/descriptor.bin 78* ./mainboard/google/link/me.bin 79* ./northbridge/intel/sandybridge/systemagent-r6.bin 80 81The 3rd one should be renamed to mrc.bin. 82As for the video ROM, you can get it here [3] and rename it to vga.bin. 83Make sure all these binary blobs are put in the board directory. 84 85Now you can build U-Boot and obtain u-boot.rom: 86 87$ make chromebook_link_defconfig 88$ make all 89 90Intel Crown Bay specific instructions: 91 92U-Boot support of Intel Crown Bay board [4] relies on a binary blob called 93Firmware Support Package [5] to perform all the necessary initialization steps 94as documented in the BIOS Writer Guide, including initialization of the CPU, 95memory controller, chipset and certain bus interfaces. 96 97Download the Intel FSP for Atom E6xx series and Platform Controller Hub EG20T, 98install it on your host and locate the FSP binary blob. Note this platform 99also requires a Chipset Micro Code (CMC) state machine binary to be present in 100the SPI flash where u-boot.rom resides, and this CMC binary blob can be found 101in this FSP package too. 102 103* ./FSP/QUEENSBAY_FSP_GOLD_001_20-DECEMBER-2013.fd 104* ./Microcode/C0_22211.BIN 105 106Rename the first one to fsp.bin and second one to cmc.bin and put them in the 107board directory. 108 109Note the FSP release version 001 has a bug which could cause random endless 110loop during the FspInit call. This bug was published by Intel although Intel 111did not describe any details. We need manually apply the patch to the FSP 112binary using any hex editor (eg: bvi). Go to the offset 0x1fcd8 of the FSP 113binary, change the following five bytes values from orginally E8 42 FF FF FF 114to B8 00 80 0B 00. 115 116As for the video ROM, you need manually extract it from the Intel provided 117BIOS for Crown Bay here [6], using the AMI MMTool [7]. Check PCI option ROM 118ID 8086:4108, extract and save it as vga.bin in the board directory. 119 120Now you can build U-Boot and obtain u-boot.rom 121 122$ make crownbay_defconfig 123$ make all 124 125Intel Minnowboard Max instructions: 126 127This uses as FSP as with Crown Bay, except it is for the Atom E3800 series. 128Download this and get the .fd file (BAYTRAIL_FSP_GOLD_003_16-SEP-2014.fd at 129the time of writing). Put it in the board directory: 130board/intel/minnowmax/fsp.bin 131 132Obtain the VGA RAM (Vga.dat at the time of writing) and put it into the same 133directory: board/intel/minnowmax/vga.bin 134 135You still need two more binary blobs. The first comes from the original 136firmware image available from: 137 138http://firmware.intel.com/sites/default/files/2014-WW42.4-MinnowBoardMax.73-64-bit.bin_Release.zip 139 140Unzip it: 141 142 $ unzip 2014-WW42.4-MinnowBoardMax.73-64-bit.bin_Release.zip 143 144Use ifdtool in the U-Boot tools directory to extract the images from that 145file, for example: 146 147 $ ./tools/ifdtool -x MNW2MAX1.X64.0073.R02.1409160934.bin 148 149This will provide the descriptor file - copy this into the correct place: 150 151 $ cp flashregion_0_flashdescriptor.bin board/intel/minnowmax/descriptor.bin 152 153Then do the same with the sample SPI image provided in the FSP (SPI.bin at 154the time of writing) to obtain the last image. Note that this will also 155produce a flash descriptor file, but it does not seem to work, probably 156because it is not designed for the Minnowmax. That is why you need to get 157the flash descriptor from the original firmware as above. 158 159 $ ./tools/ifdtool -x BayleyBay/SPI.bin 160 $ cp flashregion_2_intel_me.bin board/intel/minnowmax/me.bin 161 162Now you can build U-Boot and obtain u-boot.rom 163 164$ make minnowmax_defconfig 165$ make all 166 167The ROM image is broken up into these parts: 168 169Offset Description Controlling config 170------------------------------------------------------------ 171000000 descriptor.bin Hard-coded to 0 in ifdtool 172001000 me.bin Set by the descriptor 173500000 <spare> 174700000 u-boot-dtb.bin CONFIG_SYS_TEXT_BASE 175790000 vga.bin CONFIG_X86_OPTION_ROM_ADDR 1767c0000 fsp.bin CONFIG_FSP_ADDR 1777f8000 <spare> (depends on size of fsp.bin) 1787fe000 Environment CONFIG_ENV_OFFSET 1797ff800 U-Boot 16-bit boot CONFIG_SYS_X86_START16 180 181Overall ROM image size is controlled by CONFIG_ROM_SIZE. 182 183 184Intel Galileo instructions: 185 186Only one binary blob is needed for Remote Management Unit (RMU) within Intel 187Quark SoC. Not like FSP, U-Boot does not call into the binary. The binary is 188needed by the Quark SoC itself. 189 190You can get the binary blob from Quark Board Support Package from Intel website: 191 192* ./QuarkSocPkg/QuarkNorthCluster/Binary/QuarkMicrocode/RMU.bin 193 194Rename the file and put it to the board directory by: 195 196 $ cp RMU.bin board/intel/galileo/rmu.bin 197 198Now you can build U-Boot and obtain u-boot.rom 199 200$ make galileo_defconfig 201$ make all 202 203QEMU x86 target instructions: 204 205To build u-boot.rom for QEMU x86 targets, just simply run 206 207$ make qemu-x86_defconfig 208$ make all 209 210Note this default configuration will build a U-Boot for the QEMU x86 i440FX 211board. To build a U-Boot against QEMU x86 Q35 board, you can change the build 212configuration during the 'make menuconfig' process like below: 213 214Device Tree Control ---> 215 ... 216 (qemu-x86_q35) Default Device Tree for DT control 217 218Test with coreboot 219------------------ 220For testing U-Boot as the coreboot payload, there are things that need be paid 221attention to. coreboot supports loading an ELF executable and a 32-bit plain 222binary, as well as other supported payloads. With the default configuration, 223U-Boot is set up to use a separate Device Tree Blob (dtb). As of today, the 224generated u-boot-dtb.bin needs to be packaged by the cbfstool utility (a tool 225provided by coreboot) manually as coreboot's 'make menuconfig' does not provide 226this capability yet. The command is as follows: 227 228# in the coreboot root directory 229$ ./build/util/cbfstool/cbfstool build/coreboot.rom add-flat-binary \ 230 -f u-boot-dtb.bin -n fallback/payload -c lzma -l 0x1110000 -e 0x1110015 231 232Make sure 0x1110000 matches CONFIG_SYS_TEXT_BASE and 0x1110015 matches the 233symbol address of _start (in arch/x86/cpu/start.S). 234 235If you want to use ELF as the coreboot payload, change U-Boot configuration to 236use CONFIG_OF_EMBED instead of CONFIG_OF_SEPARATE. 237 238To enable video you must enable these options in coreboot: 239 240 - Set framebuffer graphics resolution (1280x1024 32k-color (1:5:5)) 241 - Keep VESA framebuffer 242 243At present it seems that for Minnowboard Max, coreboot does not pass through 244the video information correctly (it always says the resolution is 0x0). This 245works correctly for link though. 246 247Test with QEMU 248-------------- 249QEMU is a fancy emulator that can enable us to test U-Boot without access to 250a real x86 board. Please make sure your QEMU version is 2.3.0 or above test 251U-Boot. To launch QEMU with u-boot.rom, call QEMU as follows: 252 253$ qemu-system-i386 -nographic -bios path/to/u-boot.rom 254 255This will instantiate an emulated x86 board with i440FX and PIIX chipset. QEMU 256also supports emulating an x86 board with Q35 and ICH9 based chipset, which is 257also supported by U-Boot. To instantiate such a machine, call QEMU with: 258 259$ qemu-system-i386 -nographic -bios path/to/u-boot.rom -M q35 260 261Note by default QEMU instantiated boards only have 128 MiB system memory. But 262it is enough to have U-Boot boot and function correctly. You can increase the 263system memory by pass '-m' parameter to QEMU if you want more memory: 264 265$ qemu-system-i386 -nographic -bios path/to/u-boot.rom -m 1024 266 267This creates a board with 1 GiB system memory. Currently U-Boot for QEMU only 268supports 3 GiB maximum system memory and reserves the last 1 GiB address space 269for PCI device memory-mapped I/O and other stuff, so the maximum value of '-m' 270would be 3072. 271 272QEMU emulates a graphic card which U-Boot supports. Removing '-nographic' will 273show QEMU's VGA console window. Note this will disable QEMU's serial output. 274If you want to check both consoles, use '-serial stdio'. 275 276CPU Microcode 277------------- 278Modern CPUs usually require a special bit stream called microcode [8] to be 279loaded on the processor after power up in order to function properly. U-Boot 280has already integrated these as hex dumps in the source tree. 281 282SMP Support 283----------- 284On a multicore system, U-Boot is executed on the bootstrap processor (BSP). 285Additional application processors (AP) can be brought up by U-Boot. In order to 286have an SMP kernel to discover all of the available processors, U-Boot needs to 287prepare configuration tables which contain the multi-CPUs information before 288loading the OS kernel. Currently U-Boot supports generating two types of tables 289for SMP, called Simple Firmware Interface (SFI) [9] and Multi-Processor (MP) 290[10] tables. The writing of these two tables are controlled by two Kconfig 291options GENERATE_SFI_TABLE and GENERATE_MP_TABLE. 292 293Driver Model 294------------ 295x86 has been converted to use driver model for serial and GPIO. 296 297Device Tree 298----------- 299x86 uses device tree to configure the board thus requires CONFIG_OF_CONTROL to 300be turned on. Not every device on the board is configured via device tree, but 301more and more devices will be added as time goes by. Check out the directory 302arch/x86/dts/ for these device tree source files. 303 304Useful Commands 305--------------- 306In keeping with the U-Boot philosophy of providing functions to check and 307adjust internal settings, there are several x86-specific commands that may be 308useful: 309 310hob - Display information about Firmware Support Package (FSP) Hand-off 311 Block. This is only available on platforms which use FSP, mostly 312 Atom. 313iod - Display I/O memory 314iow - Write I/O memory 315mtrr - List and set the Memory Type Range Registers (MTRR). These are used to 316 tell the CPU whether memory is cacheable and if so the cache write 317 mode to use. U-Boot sets up some reasonable values but you can 318 adjust then with this command. 319 320Development Flow 321---------------- 322These notes are for those who want to port U-Boot to a new x86 platform. 323 324Since x86 CPUs boot from SPI flash, a SPI flash emulator is a good investment. 325The Dediprog em100 can be used on Linux. The em100 tool is available here: 326 327 http://review.coreboot.org/p/em100.git 328 329On Minnowboard Max the following command line can be used: 330 331 sudo em100 -s -p LOW -d u-boot.rom -c W25Q64DW -r 332 333A suitable clip for connecting over the SPI flash chip is here: 334 335 http://www.dediprog.com/pd/programmer-accessories/EM-TC-8 336 337This allows you to override the SPI flash contents for development purposes. 338Typically you can write to the em100 in around 1200ms, considerably faster 339than programming the real flash device each time. The only important 340limitation of the em100 is that it only supports SPI bus speeds up to 20MHz. 341This means that images must be set to boot with that speed. This is an 342Intel-specific feature - e.g. tools/ifttool has an option to set the SPI 343speed in the SPI descriptor region. 344 345If your chip/board uses an Intel Firmware Support Package (FSP) it is fairly 346easy to fit it in. You can follow the Minnowboard Max implementation, for 347example. Hopefully you will just need to create new files similar to those 348in arch/x86/cpu/baytrail which provide Bay Trail support. 349 350If you are not using an FSP you have more freedom and more responsibility. 351The ivybridge support works this way, although it still uses a ROM for 352graphics and still has binary blobs containing Intel code. You should aim to 353support all important peripherals on your platform including video and storage. 354Use the device tree for configuration where possible. 355 356For the microcode you can create a suitable device tree file using the 357microcode tool: 358 359 ./tools/microcode-tool -d microcode.dat create <model> 360 361or if you only have header files and not the full Intel microcode.dat database: 362 363 ./tools/microcode-tool -H BAY_TRAIL_FSP_KIT/Microcode/M0130673322.h \ 364 -H BAY_TRAIL_FSP_KIT/Microcode/M0130679901.h \ 365 create all 366 367These are written to arch/x86/dts/microcode/ by default. 368 369Note that it is possible to just add the micrcode for your CPU if you know its 370model. U-Boot prints this information when it starts 371 372 CPU: x86_64, vendor Intel, device 30673h 373 374so here we can use the M0130673322 file. 375 376If you platform can display POST codes on two little 7-segment displays on 377the board, then you can use post_code() calls from C or assembler to monitor 378boot progress. This can be good for debugging. 379 380If not, you can try to get serial working as early as possible. The early 381debug serial port may be useful here. See setup_early_uart() for an example. 382 383TODO List 384--------- 385- Audio 386- Chrome OS verified boot 387- SMI and ACPI support, to provide platform info and facilities to Linux 388 389References 390---------- 391[1] http://www.coreboot.org 392[2] http://www.qemu.org 393[3] http://www.coreboot.org/~stepan/pci8086,0166.rom 394[4] http://www.intel.com/content/www/us/en/embedded/design-tools/evaluation-platforms/atom-e660-eg20t-development-kit.html 395[5] http://www.intel.com/fsp 396[6] http://www.intel.com/content/www/us/en/secure/intelligent-systems/privileged/e6xx-35-b1-cmc22211.html 397[7] http://www.ami.com/products/bios-uefi-tools-and-utilities/bios-uefi-utilities/ 398[8] http://en.wikipedia.org/wiki/Microcode 399[9] http://simplefirmware.org 400[10] http://www.intel.com/design/archives/processors/pro/docs/242016.htm 401