| Filename | Latest commit message | Latest commit date |
|---|---|---|
35ea398334
The first piece of real-hardware work, and it is three bugs that QEMU cannot show you. The report was an ASUS laptop -- Ryzen 7000-series APU, Radeon integrated, RTX discrete -- booting to a white underscore on a black screen, and unable to be offered 1920x1080. **The framebuffer address was truncated.** The loader handed over `(UINT32)gop->Mode->FrameBufferBase` and the kernel read a 32-bit field out of a VBE mode-info block -- a *BIOS* structure the UEFI path had been filling in because the kernel already knew how to read one. A machine that puts its aperture above 4 GB, which is ordinary on a laptop with a discrete GPU, got a plausible-looking address pointing at nothing. The splash went into it, the kernel was handed it, and the firmware's own cursor kept blinking on an otherwise black screen. Every step in that sequence succeeded on a number that was wrong, which is why there is no error message anywhere in it. SCHBOOT_FB_BASE is the loader's own display block: 64-bit address, 64-bit size, 32-bit width, height and stride, and the pixel format. The VBE block is still written for the BIOS loader, but anything that does not fit is left at zero rather than wrapped -- a truncated address is this bug, and a zero is at least honest. The kernel then has a problem the loader does not: its direct map covers the low 4 GB, so a framebuffer above it needs ioremap(), which needs kpdpt, which kvmalloc() has not allocated when the early console starts. A low framebuffer is attached exactly as before; a high one is attached immediately after kvmalloc(), still thousands of lines before anything else. **There was more than one adapter, and the first one was taken.** LocateProtocol answers with *a* GOP and the specification says nothing about which. QEMU with a stdvga and a virtio-gpu has **three** handles and two of them are Blt-only with a framebuffer address of zero -- so this is not a hardware-only hazard, it was a one-in-three chance of drawing into address 0 that happened to keep coming up heads. Every handle is scored now: no aperture, no candidacy; a readable current mode beats one that needs changing; size breaks the tie. **mode_usable() rejected modes real machines have.** A padded scanline (every GPU that aligns its rows -- and very likely the reason 1920x1080 could not be offered), a width not divisible by eight (1366x768, which is half the laptops in the world), and anything below 800x600 (the only mode some firmware gives over a KVM). All three passed on QEMU, which is why they survived. The mode list now offers 1366x768 and 640x480 where it did not. The loader also prints what it found, to the firmware's text console, which is cleared before the splash: invisible on a boot that works, and the only thing on the screen on a boot that dies before the splash. One process note, recorded because it cost a wrong test: `make UEFI_KEEP=1` ships the loader that is already built. Its own comment says "a build that quietly ships a stale bootloader is how you spend an evening debugging code that is not running", and that is exactly what happened -- a regression run that looked clean had tested the old loader. Loader work gets a full build. Both supported configurations verified after a clean build: one boot each, no traps, no panics, socktest and memfdtest green, and the adapter report shows the right one being chosen out of three. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
| .. | ||
| common | ||
| uefi | ||
| README.md | ||
Booting SchOS
One firmware path:
boot/
uefi/ the loader: a 64-bit PE application
common/ the user interface, shared with nothing else now
There were two. boot/bios/ held an MBR, an El Torito CD stub and a real-mode
stage 2, and it was a separate directory rather than #ifdefs because the two
shared almost nothing: a BIOS loader lives in 16-bit real mode and talks to the
firmware through software interrupts, while UEFI hands a loader long mode with
paging already on and a table of function pointers to call.
That asymmetry is what removed it. Everything since roughly 2012 boots UEFI,
CSM — the firmware-side BIOS emulation that let legacy loaders run at all — has
been going away since Intel dropped support for it in 2020, and the cost of the
second path was not the code but the tax on everything that touched it: stage 2
had a 65-sector ceiling that it silently overflowed, and the resolution menu
could not be shared because VBE mode setting is INT 10h and needs real mode.
The contract below survives it. It was written to let a second loader exist, and it is worth keeping in that shape: it is what the kernel expects, stated once, rather than a description of whoever happens to be calling.
What the loader must hand the kernel
Whichever path runs, the kernel expects the same things. This is the contract; a second loader is correct exactly when it satisfies it.
| Where | Notes | |
|---|---|---|
| Kernel image | loaded per its ELF program headers | entry at entry64 |
| CPU state | see below -- the two paths differ here | |
| Memory map | E820_MAP_ADDR, 24-byte entries, count at E820_COUNT_ADDR |
kernel/arch/x86_64/e820.c reads it |
| Framebuffer | VBE_INFO_ADDR |
address, pitch, width, height, depth |
| Verbose flag | BOOT_VERBOSE_FLAG_ADDR |
set by the F8 menu |
The addresses are defined once, in include/memlayout.h and include/schboot.h.
The kernel does not care which firmware produced them.
The entry point
UEFI hands a loader long mode with paging already on. Dropping back to
protected mode only to climb out again is a mode switch whose failure mode is a
triple fault with no console, so the kernel publishes an entry that takes the
machine as it already is.
kernel/arch/x86_64/entry.S carries a sch64_header — magic SCH64BOO,
8-byte aligned within the first 16 KB, followed by a 64-bit physical address —
found by scanning. include/schboot.h holds the magic so loader and kernel
cannot disagree.
The 32-bit multiboot entry is still in entry.S and now has no caller: the
BIOS loader was the only thing that used it. It is left in place rather than
removed in the same change that removed the loader, because deleting kernel
entry code is its own piece of work with its own way of failing silently.
What that entry expects:
- long mode, interrupts off
- CR3 pointing at tables that identity-map the low 4 GB and map the same
4 GB at
0xffff800000000000.entry64low's first instruction is amovabsto a high address, so identity alone triple faults immediately. - RBX = the framebuffer physical address, and never 1 — that value marks an
application processor in
entry64high.
The kernel loads its own GDT at that entry (entry64uefi), rather than the
loader doing it. A loader arriving in long mode is still on the firmware's
descriptors, and the first thing the kernel does that depends on its own
selectors takes a #GP against a GDT the firmware no longer owns — it
surfaced as unexpected trap 13 ... cs=38, a long way from the cause.
e820.c reads a BIOS memory map. UEFI hands out a different structure
(EFI_MEMORY_DESCRIPTOR, from GetMemoryMap), so the UEFI loader has to
translate it into the same 24-byte entries rather than inventing a second
format for the kernel to learn.
What booting looks like now
make esp stages EFI/BOOT/BOOTX64.EFI and schos/kernel, and QEMU is
pointed at OVMF with that directory as a virtual FAT volume — make qemu.
make iso builds a disc with a single El Torito entry pointing at a FAT image
holding the same two files.
Neither is an installable disk. A real GPT image with a real FAT partition is the installer's job, and until it exists there is nothing here that writes to a disk a machine could boot from unaided.
Secure Boot is not addressed either: the loader is unsigned, so a machine enforcing it will refuse to run this.