Final - Report Jayanth
Final - Report Jayanth
On
Next Generation Xeon Processors
Thesis submitted in partial fulfillment of the
Requirements for the degree of
Embedded Systems
by
Assistant Professor
Bangalore
MCIS
CERTIFICATE
This is to certify that this thesis work titled
Assistant Professor
MCIS
Bangalore
ACKNOWLEDGMENT
SUCCESS means achievement and behind every success there
is a need of unfathomable set of gratitude to those who supported
and without whom this entire project task would not have taken the
shape as it meant for.
D Jayanth Reddy
CONTENTS
ABSTRACT
1. VALIDATION METHODOLOGIES
10
10
11
2. RESET DESCRIPTION
12
2.1. INTRODUCTION
12
13
13
13
14
14
15
2.3. INITIATORS
15
2.4. TARGETS
15
16
16
17
18
21
21
22
25
28
4.5AP INITIALIZATION
32
33
34
3
34
4.6.3. Timers
37
37
38
38
38
39
39
39
40
41
42
43
43
44
45
46
47
47
48
49
50
50
51
51
52
52
54
55
56
58
58
58
59
60
60
62
6. SPECIFIC REQUIREMENTS
64
6.1. HARDWARE
64
6.1.1. PLATFORM
64
6.1.2. HOST PC
69
69
6.2. SOFTWARE
70
7. RESET VALIDATION
71
71
7.2. TESTS
73
73
73
75
77
77
79
BIBLIOGRAPHY
80
Appendix A
81
Appendix B
85
12
16
17
18
22
24
30
35
45
46
64
FLOW CHARTS:
Fig7.1. Basic Flow chart of Reset
72
74
76
78
TABLES:
Table4.1 Platform Controller Hub PIRQ routing table
36
48
73
ABSTRACT
Reset validation is used to verify and validate the platform and components
correctly handle and recover from various platform-level resets. Reset validation is a
part of Post Silicon validation which mainly concentrates on validating the Memory,
PCI-Express, processor interconnections and some components feature correctness.
Reset is issuing a restart (rebooting) .In computing, Restart is the process by which a
running computer system is restarted, either intentionally or unintentionally. There are
different types of resets, such as Cold, Warm, Reset cycling, Random and BIOS
initiated reset. The automation of Reset reduces the manual effort in issuing the reset
and validating the different components and platform features.
1. VALIDATION METHODOLOGIES
BACKGROUND
One of the challenging tasks in server validation is to check correctness of the
product both before and after the product is released to maintain quality of product
shipped. Validation remains an integral and crucial phase of todays microprocessor
design and manufacturing process.
1.1.
SILICON VALIDATION:
Validation is the process of checking that a product, service or system meets
specifications and made available in market in time and that it fulfills its intended
purpose. Validation is needed to prevent the data corruption, unexpected machine
breakdowns, and incomplete or corrupt data transmissions over cell phones and
PDAs. It also ensures that the processor is compatible with previous generation
softwares (SW), hardwares (HW), operating systems (OS), reliable and durable for
many years.
1.2.
are either presilicon or postsilicon validation. Each technique has a unique advantage
in capturing a specific type of bug more quickly than others. Although there is some
duplication in the functionality tested, bugs missed by one technique can potentially
be captured by another technique thus ensuring the quality of the silicon. This fig 1.1
shows the whole cycle of product
Processor Validation techniques are broadly classified as follows
Presilicon Validation.
Postsilicon Validation.
in presilicon Validation. Typical reasons for this are the slow simulation speed that
prevents running a large number of tests, tests requiring long execution times, tests
not run in a particular mode, innovations in circuit technology and so forth.
Postsilicon validation has usually found fewer bugs than presilicon, as would be
expected.
But, with the complexity of the processor growing, the bugs found in
postsilicon have increased. The complexity of creating the conditions to cause the
bugs to appear and the complexity of debugging them have increased as well. Such
bugs are hard to detect in presilicon because they involve many complex interactions
between units that are hard to detect with the limited number of presilicon simulation
cycles and will continue to exist in silicon. Due to short postsilicon validation cycles,
it is important that these bugs be detected rapidly.
One difficulty with postsilicon validation is that visibility inside the chip is
limited, internal signals cannot be probed. Test and debug is a challenge at this stage.
Manipal Center for Information Sciences
10
The work is done at the device's register interfaces using software and at its external
signals using tools such as logic analyzers and oscilloscopes.
1.4.
POSTSILICON METHODOLOGIES:
Postsilicon validation effort is done along two major directions as
follows
Electrical validation(EV)
11
2. RESET DESCRIPTION
2.1. INTRODUCTION:
In computing, Reset is the process by which a running computer system is
restarted, either intentionally or unintentionally. Reset can be any one from the
different types, there should be initiator and a target.
Reset Types: Cold, Warm, BIOS initiated, and Random etc.
Initiators: User can reset the platform, through a script via a Host, or BIOS
can also act as initiator.
Targets: CPU is the main concentration in reset, even the platform
components can be our targets
The basic idea of this validation is to check the platform and some
components are recovered correctly from the different types of resets and validating
the sticky register behavior after reset. Reset can be any one from the different types,
there should be initiator and a target. The following is the block diagram which
explains how reset happens in a platform/PC.
12
13
maintained. This reset preserves the error log state and machine check bank states for
use by platform debug.
2.2.3. BIOS INITIATED RESET:
The BIOS initiated Reset is where the BIOS will trigger the Cold or Warm
reset, after the platform is success fully booted instead of handing over to OS the
BIOS issues a restart.
2.2.4. BIOS FLOW BREAK RESET:
The BIOS Flow Break Reset, the user has the freedom to break at particular
POST code and check the platform at desired break point.
"POST" stands for Power on Self-Test. When the BIOS start to run, it does a
Self-Test of the components on the motherboard, and in some cases, boards that are
plugged into the various slots. It goes through several steps of checking, testing and
initializing the hardware components. Before entering each step, the BIOS writes a 2
digit identifying code to an external address. This code is commonly referred to as a
POST code. The meaning of the codes varies widely. Most computer manufacturers
use a BIOS supplied by a third party, the most common are Phoenix and AMI, but
there are many others. The codes also vary depending on the motherboard and the
manufacturer's requirements. These codes are useful during the manufacturing process
to help identify problems. To the consumer, they are useful in cases where the system
won't boot up and the video screen does not work, or if you are attempting to make
modifications. If the BIOS detect a problem, it will stop on the problem, and the last
code that was output will indicate what the failure is.
In order to see the codes being generated by your BIOS, you will need a Post
Code Master Display card, which plugs into your PC and displays these codes as the
BIOS perform its tests. There are versions available for both ISA and PCI
motherboard slots. The card displays HEX digits which consist of the numbers 0-9
and the letters A-F. The POST code values can be found in the Appendices A
14
15
16
17
18
After the POST the BIOS wants to boot up an operating system, which must
be found somewhere: hard drives, CD-ROM drives, floppy disks, etc. The actual
order in which the BIOS seek a boot device is user configurable. If there is no suitable
boot device the BIOS halts with a complaint like Non-System Disk or Disk Error. A
dead hard drive might present with this symptom. Hopefully this doesnt happen and
the BIOS find a working disk allowing the boot to proceed.
3.3. MASTER BOOT RECORDER:
The BIOS now reads the first 512-byte sector (sector zero) of the hard disk.
This is called the Master Boot Record and it normally contains two vital components:
a tiny OS-specific bootstrapping program at the start of the MBR followed by a
partition table for the disk. The BIOS however does not care about any of this it
simply loads the contents of the MBR into memory location 0x7c00 and jumps to that
location to start executing whatever code is in the MBR.
19
Operating System. This message does not come from the BIOS but rather from the
MBR code loaded from disk. Thus the specific message depends on the MBR flavor.
Boot loading has gotten more sophisticated and flexible over time. The Linux boot
loaders LILO and GRUB can handle a wide variety of operating systems, file
systems, and boot configurations. Their MBR code does not necessarily follow the
boot the active partition approach described above. But functionally the process
goes like this:
The MBR itself contains the first stage of the boot loader. GRUB calls this
stage 1.
Due to its tiny size, the code in the MBR does just enough to load another
sector from disk that contains additional bootstrap code. This sector might be
the boot sector for a partition, but could also be a sector that was hard-coded
into the MBR code when the MBR was installed.
The MBR code plus code loaded in step 2 then read a file containing the
second stage of the boot loader. In GRUB this is GRUB Stage 2, and in
Windows Server this is c:\NTLDR. If step 2 fails in Windows youd get a
message like NTLDR is missing. The stage 2 code then reads a boot
configuration file (e.g., grub.conf in GRUB, boot.ini in Windows). It then
presents boot choices to the user or simply goes ahead in a single-boot system.
At this point the boot loader code needs to fire up a kernel. It must know
enough about file systems to read the kernel from the boot partition. In Linux
this means reading a file like vmlinuz-2.6.22-14-server containing the
kernel, loading the file into memory and jumping to the kernel bootstrap code.
In Windows Server 2003 some of the kernel start-up code is separate from the
kernel image itself and is actually embedded into NTLDR. After performing
several
initializations,
NTDLR
loads
the
kernel
image
from
file
20
the disk, since the kernel is clearly not available at that point. The solution is the
venerable unreal mode. This is not a true processor mode, but rather a technique
where a program switches back and forth between real mode and protected mode in
order to access memory above 1MB while still using the BIOS. At the end of this
sticky process the loader has stuffed the kernel in memory, by hook or by crook, but it
leaves the processor in real mode when its done.Were now at the jump from Boot
Loader to Early Kernel Initialization as shown in the first diagram. Thats when
things heat up as the kernel starts to unfold and set things in motion.
21
The first task is for the power supply to be allowed to settle down to its
nominal state. Once the primary power supply settles, there is usually a number of
derived voltage levels needed on the platform. For example, on the Intel Architecture
reference platform the main input supply is a 12-volt source, but the platform and
processor require voltage rails of 1.5, 3.3, 5, and 12 volts. Voltages must be provided
in a particular order, a process known as power sequencing. The power is sequenced
by controlling analog switches, typically field-effect transistors. The sequence is often
driven by a Complex Program Logic Device (CPLD).
Platform clocks are derived from a small number of input clock and oscillator
sources. The devices use phase-locked loop circuitry to generate the derived clocks
used for the platform. These clocks take time to converge.
It is only after all these steps have occurred that the power-sequencing CPLD
can de-assert the reset line to the processor, as illustrated in Fig 4.1. Depending on
integration of silicon features, some of this logic may be on chip and controlled by
microcontroller firmware that starts prior to the main processor.
22
The reset vector may contain instructions or a pointer to the starting instructions in
flash memory. The location of the vector is architecture-specific and usually in a fixed
location, depending on the processor. The first fetching instructions start at 0xFFF,
FFF0. Only 16 bytes are left to the top of memory, so these 16 bytes must contain a
far jump to the remainder of the initialization code. This code is always written in
assembly at this point as there is no software stack or cache RAM available at this
time.
4.2. MODES SELECTION:
IA-32 supports three operating modes and one quasi-operating mode:
Protected mode is the native operating mode of the processor. It provides a
rich set of architectural features, flexibility, high performance, and backward
compatibility.
Real-address mode or "real mode" provides the programming environment of
the Intel 8086 processor, with a few extensions, such as the ability to switch to
protected or system management mode. Whenever a reset or a power-on
happens, the system transitions back to real-address mode.
System management mode (SMM) is a standard architectural feature in all IA32 processors, beginning with the 386 SL. This mode provides an operating
system or executive with a transparent mechanism for implementing power
management and OEM differentiation features. SMM is entered through
activation of an external system interrupt pin, which generates a System
Management Interrupt (SMI). In SMM, the processor switches to a separate
address space while saving the context of the currently running program or
task. SMM-specific code may then be executed transparently. Upon returning
from SMM, the processor is placed back into its state prior to the system
management interrupt.
o The system firmware is usually responsible for creating an system
management interrupt handler, which may periodically take over the
system from the host OS. Legitimate workarounds are executed in the
SMI handler, and handling and logging-off errors may happen at the
23
24
code
to
be
accessed
directly
from
nonvolatile
RAM
(physical
address 0xFFFxxxxx).
Upon execution of the first long jump, these 12 address lines will be driven
according to instructions by firmware. If one of the protected modes is not entered
before the first long jump, the processor will enter real mode, with only 1 MB of
addressability. In order for real mode to work without memory, the chipset needs to be
able to alias a range of memory below 1 MB to an equivalent range just below 4 GB.
Certain chipsets do not have this aliasing and may require a switch to another
operating mode before performing the first long jump. The processor also invalidates
the internal caches and translation look-aside buffers.
The processor continues to boot in real mode. There is no particular technical
reason for the boot sequence to occur in real mode. Some speculate that this feature is
maintained in order to ensure that the platform can boot legacy code such as MSDOS. While this is a valid issue, there are other factors that complicate a move to
protected-mode booting. The change would need to be introduced and validated
among a broad ecosystem of manufacturers and developers, for example.
Compatibility issues would arise in test and manufacturing environments. These and
other natural hurdles keep boot mode "real."
The first power-on mode is actually a special subset of real mode. The top 12
address lines are held high, thus allowing aliasing, in which the processor can execute
code from nonvolatile storage (such as flash memory) located within the lowest one
megabyte as if it were located at the top of memory.
Normal operation of firmware (including the BIOS) is to switch to flat
protected mode as early in the boot sequence as possible. It is usually not necessary to
switch back to real mode unless executing an option ROM that makes legacy software
interrupt calls. Flat protected mode runs 32-bit code and physical addresses are
25
mapped one-to-one with logical addresses (that is, paging is off). The interrupt
descriptor table is used for interrupt handling. This is the recommended mode for all
BIOS/boot loaders.
4.3. EARLY INITIALIZATION:
The early phase of the BIOS/bootloader initializes the memory and processor
cores. In a BIOS constructed in accord with the Unified EFI Forum's UEFI 2.0
framework, the security and Pre-EFI Initialization (PEI) phases are normally
synonymous with "early initialization." It doesn't matter if legacy or UEFI BIOS is
used. From a hardware point of view, the early initialization sequence is the same.
In a multicore system, the bootstrap processor is the CPU core (or thread) that
is chosen to boot the system firmware, which is normally single-threaded. At RESET,
all of the processors race for a semaphore flag bit in the chipset The first finds
it clear and in the process of reading it sets the flag; the other processors find the
flag set and enter a wait-for-SIPI (Start-up Inter-Processor Interrupt) or halt state. The
first processor initializes main memory and the Application Processors (APs), then
continues with the rest of the boot process.
A multiprocessor system does not truly enter multiprocessing operation until
the OS takes over. While it is possible to do a limited amount of parallel processing
during the UEFI boot phase, such as during memory initialization with multiple
socket designs, any true multithreading activity would require changes to be made to
the Driver Execution Environment (DXE) phase of the UEFI. Without obvious
benefits, such changes are unlikely to be broadly adopted.
The early initialization phase next readies the bootstrap processor (BSP) and
I/O peripherals base address registers, which are needed to configure the memory
controller. The device-specific portion of an Intel architecture memory map is highly
configurable. Most devices are seen and accessed via a logical Peripheral Component
Interconnect (PCI) bus hierarchy. Device control registers are mapped to a predefined
I/O or memory-mapped I/O space, and they can be set up before the memory map is
configured. This allows the early initialization firmware to configure the memory map
26
of the device as needed to set up DRAM. Before DRAM can be configured, the
firmware must establish the exact configuration of DRAM that is on the board.
System-on-a-chip (SOC) devices based on other processor architectures
typically provide a static address map for all internal peripherals, with external
devices connected via a bus interface. Bus-based devices are mapped to a memory
range within the SOC address space. These SOC devices usually provide a
configurable chip-select register set to specify the base address and size of the
memory range enabled by the chip select. SOCs based on Intel Architecture primarily
use the logical PCI infrastructure for internal and external devices.
The location of the device in the host's memory address space is defined by
the PCI Base Address Register (BAR) for each of the devices. The device
initialization typically enables all the BAR registers for the devices required for
system boot. The BIOS will assign all devices in the system a PCI base address by
writing the appropriate BAR registers during PCI enumeration. Long before full PCI
enumeration, the BIOS must enable the PCI Express (PCIe) BAR as well as the
Platform Controller Hub (PCH) Root Complex Base Address Register (RCBA) BAR
for memory, I/O, and memory-mapped I/O (MMIO) interactions during the early
phase of boot. Depending on the chipset, there are prefetchers that can be enabled at
this point to speed up data transfer from the flash device. There may also be Direct
Media Interface (DMI) link settings that must be tuned for optimal performance.
The next step, initialization of the CPU, requires simple configuration of
processor and machine registers, loading a microcode update, and enabling the Local
APIC (LAPIC).
Microcode is a hardware layer of instructions involved in the implementation
of the machine-defined architecture. It is most prevalent in CISC-based processors.
Microcode is developed by the CPU vendor and incorporated into an internal CPU
ROM during manufacture. Since the infamous "Pentium flaw," Intel processor
architecture allows that microcode to be updated in the field either through a BIOS
update or via an OS update.
27
Next, the LAPICs must be enabled to handle interrupts that occur before
enabling protected mode.
Software initialization code must load a minimum number of protected-mode
data structures and code modules into memory to support reliable operation of the
processor in protected mode. These data structures include an Interrupt Descriptor
Table (IDT), a Global Descriptor Table (GDT), a Task-State Segment (TSS), and,
optionally, a Local Descriptor Table (LDT). If paging is to be used, at least one page
directory and one page table must be loaded. A code segment containing the code to
be executed when the processor switches to protected mode must also be loaded, as
well as one or more code modules that contain necessary interrupt and exception
handlers.
Initialization code must also initialize certain system registers. The global
descriptor table register must be initialized, along with control registers CRxx through
CRxy. The IDT register may be initialized immediately after switching to protected
mode, prior to enabling interrupts. Memory Type Range Registers (MTRRs) are also
initialized.
With these data structures, code modules, and system registers initialized, the
processor can be switched to protected mode. This is accomplished by loading control
register CRa0 with a value that sets the PE (protected mode enable) flag. From this
point onward, it is likely that the system will not enter real mode again, legacy option
ROMs and legacy OS/BIOS interface notwithstanding, until the next hardware reset is
experienced.
4.4. MEMORY CONFIGURATION AND INITIALIZATION:
The initialization of the memory controller varies slightly depending on the
DRAM technology and the capabilities of the memory controller itself. The
information on the DRAM controller is proprietary for processor, and in such cases
the initialization Memory Reference Code (MRC) is typically supplied by the vendor.
It is likely that memory configuration will be performed by single-point-ofentry and single-point-of-exit code that has multiple boot paths contained within it.
Manipal Center for Information Sciences
28
Settings for buffer strengths and loading for a given number of banks of memory are
chipset specific.
Once the memory controller has been initialized, a number of subsequent
cleanup events take place, including tests to ensure that memory is operational.
Memory testing is now part of the MRC, but it is possible to add more tests should the
design require it. BIOS vendors typically provide some kind of memory test on a cold
boot. Memory testing can take considerable time.
If testing is warranted, right after initialization is the time to do it. The system
is idle, the subsystems are not actively accessing memory, and the OS has not taken
over the host side of the platform. Several hardware features can assist in this testing
both during boot and at run-time. One of the most common technologies is errorcorrection codes. After power-up, the state of the correction codes may not reflect the
contents, and all memory must be written to. Writing to memory ensures that the ECC
bits are valid and set to the appropriate contents. For security purposes, the memory
may need to be zeroed out manually by the BIOS or, in some cases; a memory
controller may incorporate the feature into hardware to save time. Depending on the
source of the reset and security requirements, the system may or may not execute a
memory wipe or ECC initialization. On a warm reset sequence, memory context can
be maintained.
If there are memory timing changes or other configuration alterations that
require a reset to take effect, this is normally the time to execute a warm reset. That
warm reset would start the early initialization phase over again. Affected registers
would need to be restored.
From the reset vector, execution starts directly from nonvolatile flash storage.
This operating mode is known as execute-in-place. The read performance of
nonvolatile storage is much slower than the read performance of DRAM. The
performance of code running from flash is therefore much lower than code executed
in RAM. Most firmware is therefore copied from slower nonvolatile storage into
RAM. The firmware is then executed in RAM in a process known as shadowing.
29
30
Before memory is initialized, the data and code stacks are held in the
processor cache. Once memory is initialized, the system must exit that special caching
mode and flush the cache. The stack will be transferred to a new location in main
memory and cache reconfigured as part of AP initialization.
The stack must be set up before jumping into the shadowed portion of the
BIOS that is now in memory. A memory location must be chosen for stack space. The
stack will count down so the top of the stack must be entered and enough memory
must be allocated for the maximum stack.
If the system is in real mode, then SS:SP must be set with the appropriate
values. If protected mode is used, which is likely the case following MRC execution,
then SS:ESP must be set to the correct memory location.
This is where the code makes the jump into memory. If a memory test has not
been performed before this point, the jump could very well be to garbage. System
failures indicated by a Power-On Self-Test (POST) code between "end of memory
initialization" and the first following POST code almost always indicate a catastrophic
memory initialization problem. If this is a new design, then chances are this is in the
hardware and requires step-by-step debug.
For legacy option ROMs and BIOS memory ranges, Intel chipsets usually
come with memory aliasing capabilities that allow access to memory below 1 MB to
be routed to or from DRAM or nonvolatile storage located just under 4 GB. The
registers that control this aliasing are typically referred to as Programmable Attribute
Maps (PAMs). Manipulation of these registers may be required before, during, and
after firmware shadowing. The control over the redirection of memory access varies
from chipset to chipset For example; some chipsets allow control over reads and
writes, while others allow control over reads only.
For shadowing, if PAM registers remain at default values (all 0s), all Firmware
Hub (FWH) accesses to the E and F segments (E_0000F_FFFFh) will be directed
downstream toward the flash component. This will function to boot the system, but is
very slow. Shadowing can be used to improve boot speed. One method of shadowing
31
the E and F segments of BIOS is to utilize the PAM registers. This can be done by
changing the enables (HIENABLE[ ] and LOENABLE[ ]) to 10 (write only). This
will direct reads to the flash device and writes to memory. Data can then be shadowed
into memory by reading and writing the same address. Once BIOS code has been
shadowed into memory, the enables can be changed to read-only mode so memory
reads are directed to memory. This also prevents accidental overwriting of the image
in memory.
4.5. AP INITIALIZATION:
The BSP starts and initializes the system. The APs must be initialized with
identical features. Before memory is activated, the APs are uninitialized. After
memory is started, the remaining processors are initialized and left in a wait-for-SIPI
state. To accomplish this, the system firmware must:
Find microcode and copy it to memory.
Find the CPU code in the Serial Peripherals Interface (SPI) and copy it to
memory an important step to avoid execution-in-place for the remainder of
the sequence.
Send start-up inter processor interrupts to all processors.
Disable all NEM settings, if this has not already been done.
Load microcode updates on all processors.
Enable cache-on mode for all processors.
From a UEFI perspective, AP initialization may either be part of the PEI or
DXE phase of the boot flow, or in the early or advanced initialization. There is some
debate as to the final location.
Since Intel processors are packaged in various configurations, there are
different terms that must be understood when considering processor initialization. In
Manipal Center for Information Sciences
32
this context, a thread is a logical processor that shares resources with another logical
processor in the same physical package. A core is a processor that coexists with
another processor in the same physical package and does not share any resources with
other processors. A package is a chip that contains any number of cores and threads.
Threads and cores on the same package are detectable by executing the
CPUID instruction. Detection of additional packages must be done blindly. If a design
must accommodate more than one physical package, the BSP needs to wait a certain
amount of time for all potential APs in the system to "log in." Once a timeout occurs
or the maximum expected number of processors "log in," it can be assumed that there
are no more processors in the system.
In order to wake up secondary threads or cores, the BSP sends a SIPI to each
thread and core. This SIPI is sent by using the BSP's LAPIC, indicating the physical
address from which the AP should start executing. This address must be below 1 MB
of memory and must be aligned on a 4-KB boundary. Upon receipt of the SIPI, the AP
starts executing the code pointed to by the SIPI message. Unlike the BSP, the AP
starts code execution in real mode. This requires that the code that the AP starts
executing is located below 1 MB.
Because of the different processor combinations and the various attributes of
shared processing registers between threads, care must be taken to ensure that there
are no caching conflicts in the memory used throughout the system.AP behavior
during firmware initialization is dependent on the firmware implementation, but is
most commonly restricted to short periods of initialization followed by a HLT
instruction, during which the system awaits direction from the BSP before
undertaking another operation.
Once the firmware is ready to attempt to boot an OS, all AP processors must
be placed back in their power-on state. The BSP accomplishes this by sending an Init
Assert IPI followed by an Init De-assert IPI to all APs in the system (except itself).
4.6 ADVANCED INITIALIZATION:
33
initialization)
Serial ports, console in/out
Clocking and overclocking
PCI bus initialization
Graphics (optional)
Universal Serial Bus (USB)
Serial Advanced Technology Attachment (SATA)
4.6.1. General-Purpose I/O: GPIOs are key to platform extensibility. GPIOs can be
configured for either input or output, but can also be configured to enable native
functionality. Depending on weak or strong pull-up or pull-down resistors, some
GPIOs can function as strapping pins that are sampled at reset by the chip-set, and
then have a second function during boot-up and at run-time. GPIOs may also act like
sideband signals to allow for system wakes.
SOC devices are designed to be used in a large number of configurations. The
devices often have more capabilities than the device is capable of exposing on the I/O
pins concurrently. That is because multiple functions may be multiplexed to an
individual I/O pin. Before the pins are used they must be configured to implement a
specific function or serve as general-purpose I/O pins. The system firmware developer
must work through 64 to 256 GPIOs and their individual options with the board
designer of each platform to ensure that this feature is properly enabled.
34
and
add-in
PCI
devices.
35
Platfrom
Control
PIRQ# Pin
PIRQA#
PIRQB#
PIRQC#
PIRQD#
PIRQE#
PIRQF#
PIRQG#
PIRQH#
36
The redirection table selects the IDT vector for the associated IRQ. This mode is
available only when running in protected mode.
The boot loader typically does not use Message Signaled Interrupts (MSIs) for
interrupt handling.
The Interrupt Vector Table (IVT) is located at memory location 0p. It contains
256 interrupt vectors. The IVT is used in real mode. Each 32-bit vector address
consists of the CS:IP for the interrupt vector.
The Interrupt Descriptor Table (IDT) contains the exceptions and interrupts in
protected mode. There are 256 interrupt vectors, and the exceptions and interrupts are
defined in the same locations as in the IVT. Exceptions are routines that handle error
conditions such as page faults and general protection Real-mode Interrupt Service
Routines (ISRs) communicate information between the boot loader and the OS. For
example, INT10h is used for video services such as changing video mode and
resolution. Some legacy programs and drivers, assuming these real-mode ISRs are
available, call INT routines directly.
4.6.3. Timers: A variety of timers can be employed in an Intel Architecture system:
The Programmable Interrupt Timer (PIT) resides in the IOH or ICH and
4.6.4. Memory Caching Control: Memory regions that must have different caching
behaviors will vary from design to design. In the absence of detailed caching
Manipal Center for Information Sciences
37
While MTRRs are programmed by the BIOS, Page Attribute Tables (PATs) are used
primarily with the OS to control caching down to the page level.
4.6.5. Serial Ports: An RS-232 serial port or UART 16550 is initialized for either
run-time or debug solutions. Unlike USB ports, which require considerable
initialization and a large software stack, serial ports have a minimal register-level
interface requirements. A serial port can be enabled very early in POST to provide
serial output support.
Console In/Console Out: During the DXE portion of the UEFI phase, the boot
services include console in and console out protocols.
4.6.6. Clock and Overclock Programming: Depending on the clocking solution of
the platform, the BIOS may have to enable the clocking of the system. It is possible
that a subsystem such as the ME or a server platform's Baseboard Management
Controller (BMC) has this responsibility. It is also possible that beyond the basic
clock programming, there are expanded configuration options for overclocking, such
as:
usages.
Under-clock CPU for adaptive clocking support.
Lock out clock registers prior to transitioning to host OS.
38
4.6.7. PCI Device Enumeration: PCI device enumeration is a generic term that
refers to detecting and assigning resources to PCI-compliant devices in the system.
The discovery process assigns the resources needed by each device, including the
following:
PCI device discovery applies to all newer interfaces such as PCIe root ports,
USB controllers, SATA controllers, audio controllers, LAN controllers, and various
add-in devices. These newer interfaces all comply with the PCI specification.
It is interesting to note that in UEFI-compliant systems, it is not during the
DXE phase but during BDS that most required drivers are loaded.
4.6.8. Graphics Initialization: The video BIOS or Graphics Output Protocol (GOP)
UEFI driver is normally the first option ROM to be executed. Once the main consoleout is up and running, the console-in line can be configured.
4.6.9. Input Devices: Refer to schematics to determine which I/O devices are in the
system. Typically, a system will contain one or more of the following devices:
Embedded Controller (EC): An EC is typically used in mobile or lowpower systems. The EC contains separate firmware that controls power-
4.6.10. USB Initialization: The USB controller supports both Enhanced Host
Controller Interface (EHCI) and Extensible Host Controller Interface (xHCI)
39
hardware. Enabling the host controller for standard PCI resources is relatively easy. It
is possible to delay USB support until the OS drivers take over. If pre-OS support for
EHCI or xHCI is required, then the tasks associated with the USB subsystem become
substantially more complex. Legacy USB requires an SMI handler be used to trap port
60 and 64 accesses to I/O space, converting these to the proper keyboard or mouse
commands. This pre-OS USB support is required if booting to USB is preferred.
4.6.11. SATA Initialization: A SATA controller supports the ATA/IDE programming
interface as well as the Advanced Host Controller Interface (AHCI). In the following
discussion, the term "ATA-IDE Mode" refers to the ATA/IDE programming interface
that uses standard task file I/O registers or PCI IDE Bus Master I/O block registers.
The term "AHCI Mode" refers to the AHCI programming interface that uses memorymapped register and buffer space and a command-list-based model.
The general guidelines for initializing the SATA controller during POST and
S3 resume are described in the following sections. Upon resuming from S3, system
BIOS is responsible for restoring all the registers that it initialized during POST.
The system BIOS must program the SATA controller mode prior to beginning
other initialization steps. The SATA controller mode is set by programming the SATA
Mode Select (SMS) field of the port mapping register (D31:F2:Reg 90h[7:6]). The
system BIOS may never change the SATA controller mode during run-time. Please
note that the availability of the following modes is dependent on which PCH is in use.
If system BIOS is enabling AHCI Mode or RAID Mode, system BIOS must
disable D31:F5 by setting the SAD2 bit, RCBA + 3418h[25]. The BIOS must ensure
that it has not enabled memory space, I/O space, or interrupts for this device prior to
disabling the device.
IDE mode is selected by programming the SMS field, D31:F2:Reg
90h[7:6] to 00. In this mode, the SATA controller is set up to use the ATA/IDE
programming interface. The 6/4 SATA ports are controlled by two SATA functions.
One function routes up to four SATA ports,D31:F2, and the other routes up to two
SATA
ports, D31:F5.
In
IDE
mode,
the
40
Sub
Class
Code, D31:F2:Reg
0Ah and D31:F5:Reg 0Ah are set to 01h. This mode may also be referred to as
"compatibility mode," as it does not have any special OS driver requirements.
AHCI mode is selected by programming the SMS field, D31:F2:Reg 90h[7:6],
to 01h. In this mode, the SATA controller is set up to use the AHCI programming
interface. The six SATA ports are controlled by a single SATA function, D31:F2. In
AHCI mode the Sub Class Code,D31:F2:Reg 0Ah, is set to 06h. This mode does
require specific OS driver support.
RAID mode is selected by programming the SMS field, D31:F2:Reg
90h[7:6] to 10b. In this mode, the SATA controller is set up to use the AHCI
programming interface. The 6/4 SATA ports are controlled by a single SATA
function, D31:F2. In RAID mode, the Sub Class Code,D31:F2:Reg 0Ah, is set to 04h.
This mode does require specific OS driver support.
To allow the RAID option ROM to access all 6/4 SATA ports, the RAID
option ROM enables and uses the AHCI programming interface by setting the AE
bit, ABAR + 04h[31]. One consequence is that all register settings applicable to AHCI
mode set by the BIOS have to be set in RAID as well. The other consequence is that
the BIOS is required to provide AHCI support to ATAPI SATA devices, which the
RAID option ROM does not handle.
PCH supports stable image-compatible ID. When the alternative ID
enable, D31:F2:Reg 9Ch [7] is not set, the PCH SATA controller will report the
Device ID as 2822h.
It has been observed that some SATA drives will not start spin-up until the
SATA port is enabled by the controller. In order to reduce drive detection time, and
hence the total boot time, system BIOS should enable the SATA port early during
POST (for example, immediately after memory initialization) by setting the Port x
Enable (PxE) bits of the Port Control and Status register, D31:F2:Reg
92h and D31:F5:Reg 92h, to initiate spin-up.
4.6.12. Defining the Memory Map:
41
requires run-time access. See the applicable ACPI specification for details.
ROM (5): Memory that decodes to nonvolatile storage (for example,
flash).
IOAPIC (6): Memory that is decoded by IOAPICs in the system (must also
be uncached).
LAPIC (7): Memory that is decoded by local APICs in the system (must
also be uncached).
Region Locations: The following regions are typically reserved in a system memory
map:
00000000-0009FFFF: Memory
000A0000-000FFFFF: Reserved
00100000-xxxxxxxx: Memory (The xxxxxxxx indicates that the top of
memory changes based on "reserved" items listed below and any other
42
43
offset in the EIP register. The secondary processor (if there is one) goes into
a halt state.
Intel486 processor The primary processor (or single processor in a
uniprocessor system) immediately starts executing software-initialization
code in the current code segment beginning at the offset in the EIP register.
(The Intel486 does not automatically execute a DP or MP initialization
protocol to determine which processor is the primary processor.)
The software-initialization code performs all system-specific initialization of
the BSP or primary processor and the system logic.
At this point, for MP (or DP) systems, the BSP (or primary) processor wakes
up each AP (or secondary) processor to enable those processors to execute selfconfiguration code.
When all processors are initialized, configured, and synchronized, the BSP or
primary processor begins executing an initial operating-system or executive task. The
x87 CPU is also initialized to a known state during hardware reset. x87 FPU software
initialization code can then be executed to perform operations such as setting the
precision of the x87 FPU and the exception masks. No special initialization of the x87
FPU is required to switch operating modes.
Asserting the INIT# pin on the processor invokes a similar response to a
hardware reset. The major difference is that during an INIT, the internal caches,
MSRs, MTRRs, and x87 FPU state are left unchanged (although, the TLBs and BTB
are invalidated as with a hardware reset). An INIT provides a method for switching
from protected to real-address mode while maintaining the contents of the internal
caches.
5.1.1. PROCESSOR STATE AFTER RESET:
Appendixes B shows the state of the flags and other registers following powerup for the Pentium 4, Intel Xeon, P6 family, and Pentium processors. The state of
control register CR0 is 60000010H (see Fig5.1). This place the processor is in realaddress mode with paging disabled.
Manipal Center for Information Sciences
44
45
46
initialization code is completed, the code must not contain a far jump or far call or
allow an interrupt to occur (which would cause the CS selector value to be changed).
5.2. X87 FPU INITIALIZATION:
Software-initialization code can determine the whether the processor contains
an x87 FPU by using the CPUID instruction. The code must then initialize the x87
FPU and set flags in control register CR0 to reflect the state of the x87 FPU
environment.
A hardware reset places the x87 FPU in the state shown in Appendix B. This
state is different from the state the x87 FPU is placed in following the execution of an
FINIT or FNINIT instruction . If the x87 FPU is to be used, the software-initialization
code should execute an FINIT/FNINIT instruction following a hardware reset. These
instructions, tag all data registers as empty, clear all the exception masks, set the TOPof-stack value to 0, and select the default rounding and precision controls setting
(round to nearest and 64-bit precision). If the processor is reset by asserting the INIT#
pin, the x87 FPU state is not changed.
5.2.1. CONFIGURING THE X87 FPU ENVIRONMENT:
Initialization code must load the appropriate values into the MP, EM, and NE
flags of control register CR0. These bits are cleared on hardware reset of the
processor. Table5.1 shows the suggested settings for these flags, depending on the IA32 processor being initialized. Initialization code can test for the type of processor
present before setting or clearing these flags. The EM flag determines whether
floating-point instructions are executed by the x87 FPU (EM is cleared) or a devicenot-available exception (#NM) is generated for all floating-point instructions so that
an exception handler can emulate the floating point operation (EM = 1). Ordinarily,
the EM flag is cleared when an x87 FPU or math coprocessor is present and set if they
are not present. If the EM flag is set and no x87 FPU, math coprocessor, or floatingpoint emulator is present, the processor will hang when a floating-point instruction is
executed.
47
EM
1
MP
0
NE
1
IA-32 Processor
Intel486 SX, Intel386 DX, and Intel386 SX
processors only, without the presence of a math
1 or 0*
coprocessor.
Pentium 4, Intel Xeon, P6 family, Pentium, Intel486
DX, and Intel 487 SX processors, and Intel386 DX and
Intel386 SX processors when a companion math
1 or 0*
coprocessor is present.
More recent Intel 64 or IA-32 processors
48
support
IA32_FEATURE_CONTROL).
49
(for
example:
IA32_EFER,
The MSRs can be read and written to using the RDMSR and WRMSR
instructions, respectively. When performing software initialization of an IA-32 or
Intel 64 processor, many of the MSRs will need to be initialized to set up things like
performance-monitoring events, run-time machine checks, and memory types for
physical memory. Lists of available performance-monitoring events, Performance
Monitoring Events, Model-Specific Registers (MSRs) The references earlier in
this section show where the functions of the various groups of MSRs are described in
this manual.
5.5. MEMORY TYPE RANGE REGISTERS (MTRRS):
Memory type range registers (MTRRs) were introduced into the IA-32
architecture with the Pentium Pro processor. They allow the type of caching (or no
caching) to be specified in system memory for selected physical address ranges. They
allow memory accesses to be optimized for various types of memory such as RAM,
ROM, frame buffer memory, and memory-mapped I/O devices. In general, initializing
the MTRRs is normally handled by the software initialization code or BIOS and is not
an operating system or executive function. At the very least all the MTRRs must be
cleared to 0, which selects the uncached (UC) memory type.
5.6. INITIALIZING SSE/SSE2/SSE3/SSSE3 EXTENSIONS:
For processors that contain SSE/SSE2/SSE3/SSSE3 extensions, steps must be
taken when initializing the processor to allow execution of these instructions.
1. Check
the
CPUID
feature
flags
for
the
presence
of
the
system
supports
saving
and
restoring
the
50
SOFTWARE
INITIALIZATION
FOR
REAL-ADDRESS
MODE
OPERATION:
Following a hardware reset (either through a power-up or the assertion of the
RESET# pin) the processor is placed in real-address mode and begins executing
software initialization code from physical address FFFFFFF0H. Software
initialization code must first set up the necessary data structures for handling basic
system functions, such as a real-mode IDT for handling interrupts and exceptions. If
the processor is to remain in real-address mode, software must then load additional
operating-system or executive code modules and data structures to allow reliable
execution of application programs in real-address mode.
If the processor is going to operate in protected mode, software must load the
necessary data structures to operate in protected mode and then switch to protected
mode. The protected-mode data structures that must be loaded are described in
Software Initialization for Protected-Mode Operation.
5.7.1. REAL-ADDRESS MODE IDT:
In real-address mode, the only system data structure that must be loaded into
memory is the IDT (also called the interrupt vector table). By default, the address of
the base of the IDT is physical address 0H. This address can be changed by using the
LIDT instruction to change the base address value in the IDTR. Software initialization
code needs to load interrupt- and exception-handler pointers into the IDT before
interrupts can be enabled.
The actual interrupt- and exception-handler code can be contained either in
EPROM or RAM; however, the code must be located within the 1-MByte addressable
51
SOFTWARE
INITIALIZATION
FOR
PROTECTED-MODE
OPERATION:
The processor is placed in real-address mode following a hardware reset. At
this point in the initialization process, some basic data structures and code modules
must be loaded into physical memory to support further initialization of the processor,
as described in Software Initialization for Real-Address Mode Operation. Before the
processor can be switched to protected mode, the software initialization code must
load a minimum number of protected mode data structures and code modules into
memory to support reliable operation of the processor in protected mode. These data
structures include the following:
o A IDT.
Manipal Center for Information Sciences
52
o
o
o
o
o
A GDT.
A TSS.
(Optional) An LDT.
If paging is to be used, at least one page directory and one page table.
A code segment that contains the code to be executed when the
53
Before the GDT can be used, the base address and limit for the GDT must be
loaded into the GDTR register using an LGDT instruction.
A multi-segmented model may require additional segments for the operating
system, as well as segments and LDTs for each application program. LDTs require
segment descriptors in the GDT. Some operating systems allocate new segments and
LDTs as they are needed. This provides maximum flexibility for handling a dynamic
programming environment. However, many operating systems use a single LDT for
all tasks, allocating GDT entries in advance. An embedded system, such as a process
controller, might pre-allocate a fixed number of segments and LDTs for a fixed
number of application programs. This would be a simple and efficient way to
structure the software environment of a real-time system.
5.8.2. INITIALIZING PROTECTED-MODE EXCEPTIONS AND INTERRUPTS:
Software initialization code must at a minimum load a protected-mode IDT
with gate descriptor for each exception vector that the processor can generate. If
interrupt or trap gates are used, the gate descriptors can all point to the same code
segment, which contains the necessary exception handlers. If task gates are used, one
TSS and accompanying code, data, and task segments are required for each exception
handler called with a task gate.
If hardware allows interrupts to be generated, gate descriptors must be
provided in the IDT for one or more interrupt handlers.
Before the IDT can be used, the base address and limit for the IDT must be
loaded into the IDTR register using an LIDT instruction. This operation is typically
carried out immediately after switching to protected mode.
5.8.3. INITIALIZING PAGING:
Paging is controlled by the PG flag in control register CR0. When this flag is
clear (its state following a hardware reset), the paging mechanism is turned off; when
it is set, paging is enabled. Before setting the PG flag, the following data structures
and registers must be initialized:
54
o Software must load at least one page directory and one page table into
physical memory. The page table can be eliminated if the page
directory contains a directory entry pointing to itself (here, the page
directory and page table reside in the same page), or if only 4-MByte
pages are used.
o Control register CR3 (also called the PDBR register) is loaded with the
physical base address of the page directory.
o (Optional) Software may provide one set of code and data descriptors
in the GDT or in an LDT for supervisor mode and another set for user
mode.
With this paging initialization complete, paging is enabled and the processor is
switched to protected mode at the same time by loading control register CR0 with an
image in which the PG and PE flags are set. (Paging cannot be enabled before the
processor is switched to protected mode.)
5.8.4. INITIALIZING MULTITASKING:
If the multitasking mechanism is not going to be used and changes between
privilege levels are not allowed, it is not necessary load a TSS into memory or to
initialize the task register.
If the multitasking mechanism is going to be used and/or changes between
privilege levels are allowed, software initialization code must load at least one TSS
and an accompanying TSS descriptor. (A TSS is required to change privilege levels
because pointers to the privileged-level 0, 1, and 2 stack segments and the stack
pointers for these stacks are obtained from the TSS.) TSS descriptors must not be
marked as busy when they are created; they should be marked busy by the processor
only as a side-effect of performing a task switch. As with descriptors for LDTs, TSS
descriptors reside in the GDT.
After the processor has switched to protected mode, the LTR instruction can
be used to load a segment selector for a TSS descriptor into the task register. This
instruction marks the TSS descriptor as busy, but does not perform a task switch. The
processor can, however, use the TSS to locate pointers to privilege-level 0, 1, and 2
Manipal Center for Information Sciences
55
stacks. The segment selector for the TSS must be loaded before software performs its
first task switch in protected mode, because a task switch copies the current task state
into the TSS.
After the LTR instruction has been executed, further operations on the task
register are performed by task switching. As with other segments and LDTs, TSSs and
TSS descriptors can be either pre-allocated or allocated as needed.
5.8.5. INITIALIZING IA-32E MODE:
On Intel 64 processors, the IA32_EFER MSR is cleared on system reset. The
operating system must be in protected mode with paging enabled before attempting to
initialize IA-32e mode. IA-32e mode operation also requires physical-address
extensions with four levels of enhanced paging structures.
Operating systems should follow this sequence to initialize IA-32e mode:
1. Starting from protected mode, disable paging by setting CR0.PG = 0. Use
the MOV CR0 instruction to disable paging (the instruction must be
located in an identity-mapped page).
2. Enable physical-address extensions (PAE) by setting CR4.PAE = 1. Failure
to enable PAE will result in a #GP fault when an attempt is made to
initialize IA-32e mode.
3. Load CR3 with the physical base address of the Level 4 page map table
(PML4).
4. Enable IA-32e mode by setting IA32_EFER.LME = 1.
5. Enable paging by setting CR0.PG = 1. This causes the processor to set the
IA32_EFER.LMA bit to 1. The MOV CR0 instruction that enables paging
and the following instructions must be located in an identity-mapped page
(until such time that a branch to non-identity mapped pages can be
effected).
64-bit mode paging tables must be located in the first 4 GBytes of physicaladdress space prior to activating IA-32e mode. This is necessary because the MOV
CR3 instruction used to initialize the page-directory base must be executed in legacy
mode prior to activating IA-32e mode (setting CR0.PG = 1 to enable paging).
Manipal Center for Information Sciences
56
Because MOV CR3 is executed in protected mode, only the lower 32 bits of the
register are written, limiting the table location to the low 4 GBytes of memory.
Software can relocate the page tables anywhere in physical memory after IA-32e
mode is activated.
The processor performs 64-bit mode consistency checks whenever software
attempts to modify any of the enable bits directly involved in activating IA-32e mode
(IA32_EFER.LME, CR0.PG, and CR4.PAE). It will generate a general protection
fault (#GP) if consistency checks fail. 64-bit mode consistency checks ensure that the
processor does not enter an undefined mode or state with unpredictable behavior.
64-bit mode consistency checks fail in the following circumstances:
o An attempt is made to enable or disable IA-32e mode while paging is
enabled.
o IA-32e mode is enabled and an attempt is made to enable paging prior
to enabling physical-address extensions (PAE).
o IA-32e mode is active and an attempt is made to disable physicaladdress extensions (PAE).
o If the current CS has the L-bit set on an attempt to activate IA-32e
mode.
o If the TR contains a 16-bit TSS.
5.8.5.1 IA-32E MODE SYSTEM DATA STRUCTURES:
After activating IA-32e mode, the system-descriptor-table registers (GDTR,
LDTR, IDTR, TR) continue to reference legacy protected-mode descriptor tables.
Tables referenced by the descriptors all reside in the lower 4 GBytes of linear-address
space. After activating IA-32e mode, 64-bit operating-systems should use the LGDT,
LLDT, LIDT, and LTR instructions to load the system-descriptor-table registers with
references to 64-bit descriptor tables.
5.8.5.2. IA-32E MODE INTERRUPTS AND EXCEPTIONS:
Software must not allow exceptions or interrupts to occur between the time
IA-32e mode is activated and the update of the interrupt-descriptor-table register
57
58
59
Before switching to protected mode from real mode, a minimum set of system
data structures and code modules must be loaded into memory, as described in
Software Initialization for Protected-Mode Operation. Once these tables are created,
software initialization code can switch into protected mode.
Protected mode is entered by executing a MOV CR0 instruction that sets the
PE flag in the CR0 register. (In the same instruction, the PG flag in register CR0 can
be set to enable paging.) Execution in protected mode begins with a CPL of 0.
Intel 64 and IA-32 processors have slightly different requirements for
switching to protected mode. To insure upwards and downwards code compatibility
with Intel 64 and IA-32 processors, we recommend that you follow these steps:
1. Disable interrupts. A CLI instruction disables maskable hardware
interrupts. NMI interrupts can be disabled with external circuitry.
(Software must guarantee that no exceptions or interrupts are generated
during the mode switching operation.)
2. Execute the LGDT instruction to load the GDTR register with the base
address of the GDT.
3. Execute a MOV CR0 instruction that sets the PE flag (and optionally the
PG flag) in control register CR0.
4. Immediately following the MOV CR0 instruction, execute a far JMP or far
CALL instruction. (This operation is typically a far jump or call to the next
instruction in the instruction stream.)
5. The JMP or CALL instruction immediately after the MOV CR0 instruction
changes the flow of execution and serializes the processor.
6. If paging is enabled, the code for the MOV CR0 instruction and the JMP
or CALL instruction must come from a page that is identity mapped (that
is, the linear address before the jump is the same as the physical address
after paging and protected mode is enabled). The target instruction for the
JMP or CALL instruction does not need to be identity mapped.
7. If a local descriptor table is going to be used, execute the LLDT instruction
to load the segment selector for the LDT in the LDTR register.
8. Execute the LTR instruction to load the task register with a segment
selector to the initial protected-mode task or to a writable area of memory
that can be used to store TSS information on a task switch.
Manipal Center for Information Sciences
60
9. After entering protected mode, the segment registers continue to hold the
contents they had in real-address mode. The JMP or CALL instruction in
step 4 resets the CS register. Perform one of the following operations to
update the contents of the remaining segment registers.
o Reload segment registers DS, SS, ES, FS, and GS. If the ES,
FS, and/or GS registers are not going to be used, load them
o
Random failures can occur if other instructions exist between steps 3 and 4 above.
Failures will be readily seen in some situations, such as when instructions that
reference memory are inserted between steps 3 and 4 while in system management
mode.
5.9.2. SWITCHING BACK TO REAL-ADDRESS MODE:
The processor switches from protected mode back to real-address mode if
software clears the PE bit in the CR0 register with a MOV CR0 instruction. A
procedure that reenters real-address mode should perform the following steps:
1. Disable interrupts. A CLI instruction disables maskable hardware
interrupts. NMI interrupts can be disabled with external circuitry.
2. If paging is enabled, perform the following operations:
a. Transfer program control to linear addresses that are identity
mapped to physical addresses (that is, linear addresses equal
physical addresses).
b. Insure that the GDT and IDT are in identity mapped pages.
c. Clear the PG bit in the CR0 register.
d. Move 0H into the CR3 register to flush the TLB.
3. Transfer program control to a readable segment that has a limit of 64
Kbytes (FFFFH). This operation loads the CS register with the segment
limit required in real-address mode.
Manipal Center for Information Sciences
61
4. Load segment registers SS, DS, ES, FS, and GS with a selector for a
descriptor containing the following values, which are appropriate for realaddress mode:
a. Limit = 64 KBytes (0FFFFH)
b. Byte granular (G = 0)
c. Expand up (E = 0)
d. Writable (W = 1)
e. Present (P = 1)
f. Base = any value
The segment registers must be loaded with non-null segment selectors or
the segment registers will be unusable in real-address mode. Note that if
the segment registers are not reloaded, execution continues using the
descriptor attributes loaded during protected mode.
5. Execute an LIDT instruction to point to a real-address mode interrupt table
that is within the 1-MByte real-address mode address range.
6. Clear the PE flag in the CR0 register to switch to real-address mode.
7. Execute a far JMP instruction to jump to a real-address mode program.
This operation flushes the instruction queue and loads the appropriate
base-address value in the CS register.
8. Load the SS, DS, ES, FS, and GS registers as needed by the real-address
mode code. If any of the registers are not going to be used in real-address
mode, write 0s to them.
9. Execute the STI instruction to enable maskable hardware interrupts and
perform the necessary hardware operation to enable NMI interrupts.
62
6. SPECIFIC REQUIREMENTS
6.1. HARDWARE:
As the Reset is mainly targeted for the validation of the CPU and some
platform components, the following are the details
6.1.1. PLATFORM:
The Platform is the just like an ordinary mother board which can be used to
connect multiple CPU (IA 32 architecture). The given is the general description of the
Motherboard
63
64
65
Given the high thermal design power of high-speed computer CPUs and
components, modern motherboards nearly always include heat sinks and mounting
points for fans to dissipate excess heat.
CPU SOCKETS:
A CPU socket or slot is an electrical component that attaches to a printed
circuit board (PCB) and is designed to house a CPU (also called a microprocessor). It
is a special type of integrated circuit socket designed for very high pin counts. A CPU
socket provides many functions, including a physical structure to support the CPU,
support for a heat sink, facilitating replacement (as well as reducing cost), and most
importantly, forming an electrical interface both with the CPU and the PCB. CPU
sockets on the motherboard can most often be found in most desktop and server
computers (laptops typically use surface mount CPUs), particularly those based on
the Intel x86 architecture. A CPU socket type and motherboard chipset must support
the CPU series and speed.
INTEGRATED PERIPHERALS:
With the steadily declining costs and size of integrated circuits, it is now
possible to include support for many peripherals on the motherboard. By combining
many functions on one PCB, the physical size and total cost of the system may be
reduced; highly integrated motherboards are thus especially popular in small form
factor and budget computers.
For example, the ECS RS485M-M, a typical modern budget motherboard for
computers based on AMD processors, has on-board support for a very large range of
peripherals:
Disk controllers for a floppy disk drive, up to 2 PATA drives, and up to
SATA drives (including RAID 0/1 support)
integrated graphics
controller
supporting 2D and 3D graphics,
with VGA and TV output
integrated sound card supporting 8-channel (7.1) audio and S/PDIF output
Fast Ethernet network controller for 10/100 Mbit networking
USB 2.0 controller supporting up to 12 USB ports
Manipal Center for Information Sciences
66
IrDA controller for infrared data communication (e.g. with an IrDAenabled cellular phone or printer)
Temperature, voltage, and fan-speed sensors that allow software to
monitor the health of computer components
Expansion cards to support all of these functions would have cost hundreds of dollars
even a decade ago; however, such highly integrated motherboards are available for as
little as $30 in the US.
PERIPHERAL CARD SLOTS:
A typical motherboard of 2012 will have a different number of connections
depending on its standard.
A standard ATX motherboard will typically have two or three PCI-E 16x
connection for a graphics card, one or two legacy PCI slots for various expansion
cards,
and
one
or
two
PCI-E
1x
(which
has
superseded PCI).
standard EATX motherboard will have two to four PCI-Express 16x connection for
graphics cards, and a varying number of PCI and PCI-E 1x slots. It can sometimes
also have a PCI-E 4x slot. (This varies between brands and models.)
Some motherboards have two or more PCI-E 16x slots, to allow more than 2
monitors without special hardware, or use a special graphics technology
called SLI (for NVidia) and Crossfire (for ATI). These allow 2 to 4 graphics cards to
be linked together, to allow better performance in intensive graphical computing
tasks, such as gaming, video editing, et cetera.
NORTH BRIDGE:
The northbridge is part of a family of Intel microchips, used to manage data
communications between
a CPU and
a motherboard within
67
these functions have migrated to the CPU chip itself, beginning with memory and
graphics controllers.
The northbridge typically handles communications among the CPU, in some
cases RAM, and PCI Express (or AGP) video cards, and the Southbridge. Some
Northbridges also contain integrated video controllers, also known as a Graphics and
Memory Controller Hub (GMCH) in Intel systems. Because different processors and
RAM require different signaling, a given northbridge will typically work with only
one or two classes of CPUs and generally only one type of RAM.
There are a few chipsets that support two types of RAM (generally these are
available when there is a shift to a new standard). For example, the northbridge from
the NVidia nForce2 chipset will only work with Socket A processors combined
with DDR SDRAM; the Intel i875 chipset will only work with systems using Pentium
4processors or Celeron processors that have a clock speed greater than 1.3 GHz and
utilize DDR SDRAM, and the Intel i915g chipset only works with the Intel Pentium 4
and the Celeron, but it can use DDR or DDR2 memory.
SOUTHBRIDGE:
The Southbridge is one of the two chips in the core logic chipset on a personal
computer (PC) motherboard, the other being the northbridge. The southbridge
typically
implements
the
slower
capabilities
of
the
motherboard
in
68
the CPU. Through the use of controller integrated channel circuitry, the northbridge
can directly link signals from the I/O units to the CPU for data control and access.
A southbridge chipset handles all of a computer's I/O functions, such as USB,
audio, serial, the system BIOS, the ISA bus, the interrupt controller and the IDE
channels. Different combinations of Southbridge and Northbridge chips are possible,
but these two kinds of chip must be designed to work together; there is no industrywide standard for interoperability between different core logic chipset designs.
Traditionally, the interface between a northbridge and southbridge was the PCI bus.
The main bridging interfaces used now are DMI (Intel) and UMI (AMD).
6.1.2. HOST PC:
The platform which I am validating doesnt have an operating system so we
will be using a Host PC to interact with the platform
6.1.3. IN TARGET PROBE:
In-target probe, or ITP is a device used in computer hardware and microprocessor
design, to control a target microprocessor or similar ASIC at the register level. It
generally allows full control of the target device and allows the computer engineer
access to individual processor registers, program counter, and instructions within the
device. It allows the processor to be single-stepped or for breakpoints to be set.
6.2. SOFTWARE:
The following are the software which I have used
PYTHON:
The Python is scripting language which I will be using in the reset validation.
Python is a general-purpose, interpreted high-level programming language whose
design philosophy emphasizes code readability
69
70
7. RESET VALIDATION
7.1. RESET STEPS:
The Next Generation Xeon Processors have distributed cache and significant
amount of IO integration on chip. In addition it supports advanced power
management technologies. These Processors are intended to be used in the various
platform configurations ranging from single socket to up to 4 or 8 sockets.
The validation of both warm and cold reset will be done in 5 steps.
The following steps give a brief idea how reset happens
In Step0 the start condition is power off and end condition is assertion of the
xxPWRGOOD. Here in this step the platform will be provided with the minimum
voltage levels.
In the second step the controller unit begins the execution of the microcode,
here all the basic fuses will be de-asserted, and the configuration registers will be
loaded.
Third step will take care of assigning the logical ids to the processors(multiprocessor configuration) and initialization of the message channels and loads the
patch which comes with the processor.
Fourth and Fifth steps will run the BIOS patch codes and BIOS will enable all
the features on the platform and signals the controller unit by setting the reset done
bit. The flow chart for the test phases is show
71
72
7.2. TESTS:
The following are test involved in the validation of different reset types.
S.no
1
2
3
4
Test
Manual Cold Reset
Manual Warm Reset
BIOS initiated Reset
BIOS flow break reset
Table7.1. Test cases
Start
Platform is in Stable state
Configuration details are collected
Cold reset is issued by cmd (writing into the port)
If platform booted = True go to step vi else report failure and stop
If BIOS completion = True go to step vii else report failure and stop
If Collected details == Ideal config data report Reset successful else
viii.
73
74
Start
Platform is in Stable state
Configuration details are collected
Write value xyz in to Sticky register
Warm reset is issued by cmd (writing into the port)
If platform booted = True go to step vii else go to step x
If BIOS completion = True go to step viii else go to step x
If sticky registers == xyz then go to step ix else go to step x
If Collected details == Ideal config data go to step xi else step x
Reset failure, dump the failure condition step xii
Reset Successful
Stop
Here the platform components are verified by doing warm reset cycling with checks
in place to verify the CPU and chipset errors, proper detection of all system memory
and devices during each cycle.
The Flow chart for the Warm reset is given in diagram.
75
76
iii.
iv.
v.
break at
Issue a warm Reset / Cold reset
BIOS break at Postcode value go to step v else step vii
Checking the signals. If signals are correct step vi else wrong step
vi.
vii.
viii.
ix.
viii
BIOS Break pass
Next BIOS break Value repeat from step ii
BIOS break fail step
Stop
The Following Flow chart will give a brief flow of the BIOS flow break reset
77
78
Reset Validation of Different Reset types that are Warm reset, Cold reset,
BIOS initiated Reset and BIOS Flow break reset was successful tested. The Memory,
PCI Express, Processor interconnections and component features were collected as
per the reset flows and were compared with the original data for the correctness and
various component register were checked for correct values. The test scripts are fully
automated for different reset types. The automation of the tests has improved the
validation process in the following ways:
o The automation of the test for issuing multiple resets and check the
platform correctness reduced the manual effort of issuing the reset and
checking.
o The scripts were fully automated in logging the platform details if the
reset doesnt go fine for debugging purpose.
Reset scripts need to developed to issues resets from the OS and make sure
that the platform comes and OS boots fine.
The further tests can be automated to run some basic memory transaction
using OS and trigger the reset (cold/warm) when memory transaction is happening
and check the OS boots fine without any hang.
79
BIBLIOGRAPHY
80
Appendix A
Intel STL2 Server Motherboard BIOS Post Codes
The following are the Post codes which give the description of about the each POST
code value and its description.
POST
Code
0204 06 08 09 0A 0B 0C 0E 0F 10 11 12 14 16 18 1A 1C 20 22 24 28 2A 2C 32 34 35 36 37 38 39 3A -
Description
Verify Real Mode
Get Processor type
Initialize system hardware
Initialize chipset registers with initial POST values
Set in POST flag
Initialize Processor registers
Enable Processor cache
Initialize caches to initial POST values
Initialize I/O
Initialize the local bus IDE
Initialize Power Management
Load alternate registers with initial POST values
Restore Processor control word during warm boot
Initialize keyboard controller
BIOS ROM checksum
8254 timer initialization
8237 DMA controller initialization
Reset Programmable Interrupt Controller
Test DRAM refresh
Test 8742 Keyboard Controller
Set ES segment register to 4 GB
Autosize DRAM, system BIOS stops execution here if the
BIOS does not detect any usable memory DIMMs
Clear 8 MB base RAM
Base RAM failure, BIOS stops execution here if entire
memory is bad
Test Processor bus-clock frequency
Test CMOS
RAM Initialize alternate chipset registers
Warm start shut down
Reinitialize the chipset
Shadow system BIOS ROM
Reinitialize the cache
Autosize cache
81
3C 3D 40 42 44 46 47 48 49 4A 4B 4C 4E 50 52 54 55 56 58 5A 5C 60 62 64 66 68 6A 6B 6C 6E 70 72 74 76 7A 7C 7D 7E 82 85 86 88 8A 8C -
82
90 91 92 93 94 95 96 98 9A 9C 9E A0 A2 A4 A8 AA AC AE B0 B2 B4 B5 B6 B7 B8 BC BE BF C0 C8 C9 DO D2 D4 D6 D8 DA DC E0 E1 E2 E3 -
83
E4 E5 E6 E7 E8 E9 EA EB EC ED EE EF F0 F1 F2 F3 F4 F5 F6 F7 -
84
Appendix B
IA-32 Processor States Following Power-up, Reset, or INIT
Register
Pentium 4 and
Intel Xeon
Processor
EFLAGS1
EIP
CRO
CR2,CR3,Cr4
CS
00000002H
0000FFF0H
600000010H
00000000H
Selector =
F000H;
Base =
FFFF0000H;
Limit = FFFFH;
AR = Present,
R/W,Accessed
SS, DS, ES, FS, GS
Selector =
0000H;
Base =
00000000H;
Limit = FFFFH;
AR = Present,
R/W,Accessed
EDX
00000FxxH
EAX
0
EBX,ECX,ESI,EDI,E
00000000H
BP,ESP
ST0 through ST7Pwr up or Reset:
+0.0FINIT/FNINI
T: Unchanged
x87 FPU Control Pwr up or Reset:
Word
0040HFINIT/FNI
NIT: 037FH
x87 FPU Status Pwr up or Reset:
Word
0000HFINIT/FNI
NIT: 0000H
x87 FPU Tag
Pwr up or Reset:
Word
5555HFINIT/FNI
NIT: FFFFH
x87 FPU
Pwr up or Reset:
DataOperand and
0000HFINIT/FNI
CSSeg. SelectorsNIT: 0000H
Pwr up or
x87 FPU
Reset:00000000
DataOperand and
HFINIT/FNINIT:
Inst.Pointers
00000000H
Manipal Center for Information Sciences
P6 Family
Processor
Pentium
Processor
00000002H
0000FFF0H
600000010H
00000000H
Selector =
F000H;
Base =
FFF0000H;
Limit = FFFFH;
AR = Present,
R/W,Accessed
Selector =
0000H;
Base
=00000000H;
Limit = FFFFH;
AR = Present,
R/W,Accessed
000n06xxH
0
00000000H
00000002H
0000FFF0H
600000010H
00000000H
Selector =
F000H;
Base
=FFFF0000H;
Limit = FFFFH;
AR = Present,
R/W,Accessed
Selector =
0000H;
Base =
0000000H;
Limit = FFFFH;
AR = Present,
R/W,Accessed
000005xxH
0
00000000H
Pwr up or
Reset:
+0.0FINIT/FNI
NIT:
Unchanged
Pwr up or
Reset: 0040H
FINIT/FNINIT:0
37FH
Pwr up or
Reset:
0000HFINIT/FN
INIT: 0000H
Pwr up or
Reset:
5555HFINIT/FN
INIT: FFFFH
Pwr up or
Reset:
Pwr up or
Reset:
+0.0FINIT/FNI
NIT:
Unchanged
Pwr up or
Reset:
0040HFINIT/FN
INIT: 037FH
Pwr up or
Reset:
0000HFINIT/FN
INIT: 0000H
Pwr up or
Reset:
5555HFINIT/FN
INIT: FFFFH
Pwr up or
Reset:
85
MM0 through
MM75
Pwr up or
Reset:00000000
00000000HINIT
orFINIT/FNINIT:u
nchanged
MXCSR
Pwr up or Reset:
1F80H INIT:
Unchanged
GDTR, IDTR
Base =
00000000H
Limit = FFFFH
AR = Present,
R/W
Selector =
0000H Base =
00000000H
Limit = FFFFH
AR = Present,
R/W
000000000H
LDTR, Task
Register
DR0, DR1,
DR2,DR3
DR6
DR7
Time-Stamp
Counter
FFFF0FF0H
00000400H
Power up or
Reset:0H
INIT: Unchanged
0000HFINIT/FN
INIT: 0000H
Pwr up or
Reset:0000000
0HFINIT/FNINIT
: 00000000H
Pentium II and
Pentium III
processors
only
Pwr up or
Reset:0000000
000000000HIN
IT
orFINIT/FNINIT:
unchanged
Pentium II and
Pentium III
processors
only
Pwr up
or
Reset:0000000
000000000H
INIT:nchanged
Pentium III
processor
onlyPwr up or
Reset:1F80H
INIT:
Unchanged
Base =
00000000H
Limit = FFFFH
AR = Present,
R/W
Selector =
0000H Base =
00000000H
Limit = FFFFH
AR = Present,
R/W
000000000H
FFFF0FF0H
00000400H
Power up or
Reset:0H
INIT:
Unchanged
86
0000HFINIT/FN
INIT: 0000H
Pwr up or
Reset:0000000
0HFINIT/FNINIT
: 00000000H
Pentium with
MMX
Pwr up or
Reset:0000000
000000000HIN
IT
orFINIT/FNINIT:
unchanged
NA
NA
Base =
00000000H
Limit = FFFFH
AR = Present,
R/W
Selector =
0000H Base =
00000000H
Limit = FFFFH
AR = Present,
R/W
000000000H
FFFF0FF0H
00000400H
Power up or
Reset:0H
INIT:
Unchanged
Machine-Check Power up or
Architecture
Reset:undefined
INIT: Unchanged
APIC
Power up or
Reset:Enabled
INIT: Unchanged
Power up or
Reset:Undefin
ed INIT:
Unchanged
Power up or
Reset:Enabled
INIT:
Unchanged
87
Not
Implemented
Power up or
Reset:Enabled
INIT:
Unchanged