OpenBSD内核之引导PBR

Posted 2020-08-20 logicbaby陈龙的blog

　　OpenBSD引导的第二部PBR，也是活动分区的一个扇区的代码，由第一步的MBR加载到0x7C00处，manpage里详细的讲解了过程和大致实现 biosboot(8) （http://man.openbsd.org/OpenBSD-6.0/man8/i386/biosboot.8），代码在sys/arch/i386/stand/biosboot/目录下，主要就是其中的biosboot.S；和mbr.S一样，在代码的开头清晰的介绍了该代码要做的事情：

 

/*
 * Memory layout:
 *
 * 0x00000 -> 0x07BFF    our stack        (to  31k)
 * 0x07A00 -> 0x07BFF    typical MBR loc        (at  30k5)
 * 0x07C00 -> 0x07DFF    our code        (at  31k)
 * 0x07E00 -> ...        /boot inode block    (at  31k5)
 * 0x07E00 -> ...        (indirect block if nec)
 * 0x40000 -> ...    /boot            (at 256k)
 *
 * The BIOS loads the MBR at physical address 0x07C00.  It then relocates
 * itself to (typically) 0x07A00.
 *
 * The MBR then loads us at physical address 0x07C00.
 *
 * We use a long jmp to normalise our address to seg:offset 07C0:0000.
 * (In real mode on x86, segment registers contain a base address in
 * paragraphs (16 bytes).  0000:00010 is the same as 0001:0000.)
 *
 * We set the stack to start at 0000:7BFC (grows down on i386)
 *
 * We then read the inode for /boot into memory just above us at
 * 07E0:0000, and run through the direct block table (and the first
 * indirect block table, if necessary).
 *
 * We load /boot at seg:offset 4000:0000.
 *
 * Previous versions limited the size of /boot to 64k (loaded in a single
 * segment).  This version does not have this limitation.
 */

 

　　注释内容包含了mbr.S开头的内容，还是讲解了大致引导过程：BIOS 读MBR到0x7C00处，然后MBR将自身重定位到0x7A00，MBR加载PBR也就是biosboot.S到0x7C00，然后jmp到0x7C00处的biosboot.S执行。

　　biosboot.S的特殊之处在于不像mbr.S里那样直接从磁盘扇区的第1扇区这种“物理”定位信息加载后续代码，也就是说biosboot需要能直接操作文件系统了，因为它后续加载的是/boot，要直接从根分区加载boot！对比其他的bootloader，比如GRUB，GRUB能直接读各种各样的文件系统，其代码复杂度可想而知，OpenBSD的biosboot实际上并不能读文件系统，因为它只有512字节啊，这点空间不可能能放下文件系统驱动！biosboot采取的方法是在最终的二进制内容里直接保存/boot所在的磁盘扇区位置信息，当然不可能直接写死在biosboot.S代码里，采取的办法是打二进制patch，也就是直接修改编译后的二进制文件里的，通过用户态程序/usr/sbin/installboot将/boot的物理位置信息写到编译后的biosboot中，然后将修改后的biosboot写到分区第一个扇区；这里涉及到ELF文件相关知识，在biosboot.S中有几个导出的符号，installboot将/boot物理位置信息写到这几个符号所指的位置处，代码的注释里清晰的讲解了这几个导出符号：

 

/*
 * The data passed by installboot is:
 *
 * inodeblk    uint32    the filesystem block that holds /boot‘s inode
 * inodedbl    uint32    the memory offset to the beginning of the
 *            direct block list (di_db[]).  (This is the
 *            offset within the block + $INODEOFF, which is
 *            where we load the block to.)
 * fs_bsize_p    uint16    the filesystem block size _in paragraphs_
 *            (i.e. fs_bsize / 16)
 * fs_bsize_s    uint16    the number of disk sectors in a filesystem
 *            block (i.e. fs_bsize / d_secsize). Directly written
 *            into the LBA command block, at lba_count.
 *            XXX LIMITED TO 127 BY PHOENIX EDD SPEC.
 * fsbtodb    uint8    shift count to convert filesystem blocks to
 *            disk blocks (sectors).  Note that this is NOT
 *            log2 fs_bsize, since fragmentation allows
 *            the trailing part of a file to use part of a
 *            filesystem block.  In other words, filesystem
 *            block numbers can point into the middle of
 *            filesystem blocks.
 * p_offset    uint32    the starting disk block (sector) of the
 *            filesystem
 * nblocks    uint16    the number of filesystem blocks to read.
 *            While this can be calculated as
 *            howmany(di_size, fs_bsize) it takes us too
 *            many code bytes to do it.
 *
 * All of these are patched directly into the code where they are used
 * (once only, each), to save space.
 *
 * One more symbol is exported, in anticipation of a "-c" flag in
 * installboot to force CHS reads:
 *
 * force_chs    uint8    set to the value 1 to force biosboot to use CHS
 *            reads (this will of course cause the boot sequence
 *            to fail if /boot is above 8 GB).
 */

 

　　这几个值使biosboot能直接定位到磁盘上的boot。biosboot中和mbr一样也有CHS、LBA相关的代码，按住shift键强制使用CHS模式。加载boot到0x40000，也就是256KB处，然后jmp到其中继续执行/boot。

　　OK，终于看完这些实模式的鬼东西了……后面空了再继续写boot后面的东西吧。