Grub 原理/代码分析

Grub 原理分析————给对Linux启动流程感兴趣的同僚们。

Grub的启动流程：BIOS将MBR拷贝到0000:7c00处，将控制权交给mbr中的代码——stage1.s
stage1.s 将start.s从硬盘拷贝到内存中，并跳转执行。然后start.s需要加载stage1.5,只有加载了
stage1.5才能识别文件系统，这个stage1.5和boot目录下的众多stage1.5是一样的。然而它
的位置并不在boot目录下，而是在第三个山区开始到差不多10k的位置上。加载了stage1.5后可以识别boot目录
所在的文件系统，找到stage2加载，此时一个mini os已经起来。

grub在硬盘上的分布：
第一个扇区：stage1.s   任务：加载start.s到内存中运行
第二个扇区：start.s   任务：加载stage1.5到内存中运行
第三个山区往后10k左右的空间：stage1.s  任务：加载/识别文件系统，加载boot目录下的stage2
/boot目录：stage2    任务：实现一个minios，提供一个shell，加载Linux kernel

下面找个事例来证明一下上面的分布。以xgl的ubuntu为例,将其硬盘的头20K内容dd出来
dd of=/dev/sda of=/boot.img bs=1k count=20

vi打开查看16进制代码：

第一个山区的内容如下：
      1 0000000: eb48 90d0 bc00 7cfb 5007 501f fcbe 1b7c  .H....|.P.P....|
      2 0000010: bf1b 0650 57b9 e501 f3a4 cbbd be07 b104  ...PW...........
      3 0000020: 386e 007c 0975 1383 c510 e2f4 cd18 8bf5  8n.|.u..........
      4 0000030: 83c6 1049 7419 382c 74f6 a0b5 07b4 0302  ...It.8,t.......
      5 0000040: ff00 0020 0100 0000 0002 fa90 90f6 c280  ... ............
      6 0000050: 7502 b280 ea59 7c00 0031 c08e d88e d0bc  u....Y|..1......
      7 0000060: 0020 fba0 407c 3cff 7402 88c2 52be 7f7d  . ..@|<.t...R..}
      8 0000070: e834 01f6 c280 7454 b441 bbaa 55cd 135a  .4....tT.A..U..Z
      9 0000080: 5272 4981 fb55 aa75 43a0 417c 84c0 7505  RrI..U.uC.A|..u.
     10 0000090: 83e1 0174 3766 8b4c 10be 057c c644 ff01  ...t7f.L...|.D..
     11 00000a0: 668b 1e44 7cc7 0410 00c7 4402 0100 6689  f..D|.....D...f.
     12 00000b0: 5c08 c744 0600 7066 31c0 8944 0466 8944  /..D..pf1..D.f.D
     13 00000c0: 0cb4 42cd 1372 05bb 0070 eb7d b408 cd13  ..B..r...p.}....
     14 00000d0: 730a f6c2 800f 84ea 00e9 8d00 be05 7cc6  s.............|.
     15 00000e0: 44ff 0066 31c0 88f0 4066 8944 0431 d288  [email protected]..
     16 00000f0: cac1 e202 88e8 88f4 4089 4408 31c0 88d0  [email protected]...
     17 0000100: c0e8 0266 8904 66a1 447c 6631 d266 f734  ...f..f.D|f1.f.4
     18 0000110: 8854 0a66 31d2 66f7 7404 8854 0b89 440c  .T.f1.f.t..T..D.
     19 0000120: 3b44 087d 3c8a 540d c0e2 068a 4c0a fec1  ;D.}<.T.....L...
     20 0000130: 08d1 8a6c 0c5a 8a74 0bbb 0070 8ec3 31db  ...l.Z.t...p..1.
     21 0000140: b801 02cd 1372 2a8c c38e 0648 7c60 1eb9  .....r*....H|`..
     22 0000150: 0001 8edb 31f6 31ff fcf3 a51f 61ff 2642  ....1.1.....a.&B
     23 0000160: 7cbe 857d e840 00eb 0ebe 8a7d e838 00eb  |..}.@.....}.8..
     24 0000170: 06be 947d e830 00be 997d e82a 00eb fe47  ...}.0...}.*...G
     25 0000180: 5255 4220 0047 656f 6d00 4861 7264 2044  RUB .Geom.Hard D
     26 0000190: 6973 6b00 5265 6164 0020 4572 726f 7200  isk.Read. Error.
     27 00001a0: bb01 00b4 0ecd 10ac 3c00 75f4 c300 0000  ........<.u.....
     28 00001b0: 0000 0000 0000 0000 10cc 10cc 0000 0001  ................
     29 00001c0: 0100 82fe 3f7b 3f00 0000 3d65 1e00 8000  ....?{?...=e....
     30 00001d0: 017c 83fe 3f93 7c65 1e00 18e2 0500 0000  .|..?.|e........
     31 00001e0: 0194 83fe ffff 9447 2400 6809 7c12 0000  .......G$.h.|...
     32 00001f0: 0000 0000 0000 0000 0000 0000 0000 55aa  ..............U.
可以参考其中的打印信息，如"GRUB .Geom.Hard Disk.Read.Error."。这一段字符信息可以在stage1.s代码中找到：
notification_string: .string "GRUB "
geometry_error_string: .string "Geom"
hd_probe_error_string: .string "Hard Disk"
read_error_string: .string "Read"
general_error_string: .string " Error"
这个扇区放的代码就是stage1.s代码！
最后两个字节“55aa”，说明启动扇区有效。

看第二个扇区的内容：
     33 0000200: 5256 be03 21e8 2a01 5ebf f821 668b 2d83  RV..!.*.^..!f.-.
     34 0000210: 7d04 000f 84ca 0080 7cff 0074 3e66 8b1d  }.......|..t>f..
     35 0000220: 6631 c0b0 7f39 4504 7f03 8b45 0429 4504  f1...9E....E.)E.
     36 0000230: 6601 05c7 0410 0089 4402 6689 5c08 c744  f.......D.f./..D
     37 0000240: 0600 7050 6631 c089 4404 6689 440c b442  ..pPf1..D.f.D..B
     38 0000250: cd13 0f82 9f00 bb00 70eb 5666 8b05 6631  ........p.Vf..f1
     39 0000260: d266 f734 8854 0a66 31d2 66f7 7404 8854  .f.4.T.f1.f.t..T
     40 0000270: 0b89 440c 3b44 087d 748b 042a 440a 3945  ..D.;D.}t..*D.9E
     41 0000280: 047f 038b 4504 2945 0466 0105 8a54 0dc0  ....E.)E.f...T..
     42 0000290: e206 8a4c 0afe c108 d18a 6c0c 5a52 8a74  ...L......l.ZR.t
     43 00002a0: 0b50 bb00 708e c331 dbb4 02cd 1372 468c  .P..p..1.....rF.
     44 00002b0: c38e 4506 58c1 e005 0145 0660 1ec1 e004  ..E.X....E.`....
     45 00002c0: 89c1 31ff 31f6 8edb fcf3 a41f be14 21e8  ..1.1.........!.
     46 00002d0: 6000 6183 7d04 000f 853c ff83 ef08 e92e  `.a.}....<......
     47 00002e0: ffbe 1621 e84b 005a ea00 2200 00be 1921  ...!.K.Z.."....!
     48 00002f0: e83f 00eb 06be 1e21 e837 00be 2321 e831  .?.....!.7..#!.1
     49 0000300: 00eb fe4c 6f61 6469 6e67 2073 7461 6765  ...Loading stage
     50 0000310: 312e 3500 2e00 0d0a 0047 656f 6d00 5265  1.5......Geom.Re
     51 0000320: 6164 0020 4572 726f 7200 bb01 00b4 0ecd  ad. Error.......
     52 0000330: 1046 8a04 3c00 75f2 c300 0000 0000 0000  .F..<.u.........
     53 0000340: 0000 0000 0000 0000 0000 0000 0000 0000  ................
     54 0000350: 0000 0000 0000 0000 0000 0000 0000 0000  ................
     55 0000360: 0000 0000 0000 0000 0000 0000 0000 0000  ................
     56 0000370: 0000 0000 0000 0000 0000 0000 0000 0000  ................
     57 0000380: 0000 0000 0000 0000 0000 0000 0000 0000  ................
     58 0000390: 0000 0000 0000 0000 0000 0000 0000 0000  ................
     59 00003a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
     60 00003b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
     61 00003c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
     62 00003d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
     63 00003e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
     64 00003f0: 0000 0000 0000 0000 0200 0000 1200 2002  .............. .
    
同样，打印信息“Loading stage1.5”可以在start.s中找到
#ifdef STAGE1_5
notification_string: .string "Loading stage1.5"
#else

所以这个扇区加载的是start.s代码

[源码分析]
stage1.s 和 start.s 全部汇编编写，重点分析
stage1.s

source code：

/* -*-Asm-*- */
/*
 *  GRUB  --  GRand Unified Bootloader
 *  Copyright (C) 1999,2000,2001   Free Software Foundation, Inc.
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software
 *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */

#include

/*
 *  defines for the code go here
 */

  /* Absolute addresses
     This makes the assembler generate the address without support
     from the linker. (ELF can't relocate 16-bit addresses!) */
#define ABS(x) (x-_start+0x7c00)

  /* Print message string */
#define MSG(x)  movw $ABS(x), %si; call message

  /* XXX: binutils-2.9.1.0.x doesn't produce a short opcode for this. */
  //这个我一直不能理解，这样操作就能把x的值赋给al？分号的作用很奇怪！
#define MOV_MEM_TO_AL(x)  .byte 0xa0;  .word x

  .file "stage1.S"

  .text

  /* Tell GAS to generate 16-bit instructions so that this code works
     in real mode. */
  .code16
/*文件的起点*/
.globl _start; _start:
  /*
   * _start is loaded at 0x7c00 and is jumped to with CS:IP 0:0x7c00
   */

  /*
   * Beginning of the sector is compatible with the FAT/HPFS BIOS
   * parameter block.
   */
/*直接跳转到after_BPB，为了给BIOS参数空出一块区域？*/
  jmp after_BPB
  nop /* do I care about this ??? *///这个毫无意义，显然不会被执行

  /*
   * This space is for the BIOS parameter block!!!!  Don't change
   * the first jump, nor start the code anywhere but right after
   * this area.
   */
//前面两条语句3个字节搞定,这里再空出一个字节。
  . = _start + 4

  /* scratch space */
  /*初始化定义，使用lba硬盘的话这些宏都不会被使用，他们是chs硬盘规则*/
mode:
  .byte 0
disk_address_packet:
sectors:
  .long 0
heads:
  .long 0
cylinders:
  .word 0
sector_start:
  .byte 0
head_start:
  .byte 0
cylinder_start:
  .word 0
  /* more space... */

  . = _start + STAGE1_BPBEND

  /*
   * End of BIOS parameter block.
   */

stage1_version:
  .byte COMPAT_VERSION_MAJOR, COMPAT_VERSION_MINOR
boot_drive:
  .byte 0xff  /* the disk to load stage2 from */
      /* 0xff means use the boot drive */
force_lba:
  .byte 0
stage2_address:
  .word 0x8000
stage2_sector:
  .long 1
stage2_segment:
  .word 0x800

after_BPB:

/* general setup */
/*进行基本设置，需要关掉所有中断*/
  cli   /* we're not safe here! */

  /*
   * ljmp to the next instruction because some bogus BIOSes
   * jump to 07C0:0000 instead of 0000:7C00.
   */
   /*这个似乎是对bogus BIOS做兼容的*/
  ljmp  $0, $ABS(real_start)

real_start:
/*这里真正开始了*/
  /* set up %ds and %ss as offset from 0 */
  xorw  %ax, %ax    /*ax=0*/
  movw  %ax, %ds    /*ds清零*/
  movw  %ax, %ss    //ss也清零

  /* set up the REAL stack */
  movw  $STAGE1_STACKSEG, %sp   /*头文件中定义堆栈0x2000*/

  /*开中断，其实就是设置了堆栈。把代码段和数据段清零*/
  sti   /* we're safe again */

  /*
   *  Check if we have a forced disk reference here
   */
  MOV_MEM_TO_AL(ABS(boot_drive))  /* movb ABS(boot_drive), %al */
  cmpb  $0xff, %al  /*显然al=0xff，前面有定义，使用boot driver*/
  je  1f
  movb  %al, %dl
1:
  /* save drive reference first thing! */
  pushw %dx   //dl中保存了驱动器参数，这个是bios传递进来的？

  /* print a notification message on the screen */
  MSG(notification_string)

  /* do not probe LBA if the drive is a floppy */
  testb $STAGE1_BIOS_HD_FLAG, %dl
//STAGE1_BIOS_HD_FLAG=0x80。dl如果也是0x80就说明启动介质为floppy
  jz  chs_mode    //test结果为0，即STAGE1_BIOS_HD_FLAG=dl ，则跳转
   
  /* check if LBA is supported */
  //到这里说明是硬盘引导
  //
  // LBA 扩展功能分两个子集 , 如下 :
 //  第一个子集提供了访问大硬盘所必须的功能 , 包括
 // 1.检查扩展是否存在 : ah = 41h , bx = 0x55aa , dl = drive( 0x80 ~ 0xff )
 // 2.扩展读  : ah = 42h
 // 3.扩展写  : ah = 43h
 // 4.校验扇区  : ah = 44h
 // 5.扩展定位  : ah = 47h
 // 6.取得驱动器参数 : ah = 48h
 //  第二个子集提供了对软件控制驱动器锁定和弹出的支持 ,包括
 // 1.检查扩展  : ah = 41h
 // 2.锁定/解锁驱动器 : ah = 45h
 // 3.弹出驱动器  : ah = 46h
 // 4.取得驱动器参数 : ah = 48h
 // 5.取得扩展驱动器改变状态: ah = 49h

 //下面开始具体检测 , 首先检测扩展是否存在
 // 此时寄存器的值和 BIOS 调用分别是 :
 // AH = 0x41
 // BX = 0x55AA
 // DL = driver( 0x80 ~ 0xFF )
 // INT  13H
 // 返回结果 : 如果支持 CF = 0 ; 否则 CF = 1
 // CF = 0 (支持LBA) 时的寄存器值 :
 // ah : 扩展功能的主版本号( major version of extensions )
 // al : 内部使用( internal use )
 // bx : AA55h ( magic number )
 // cx :
 //  Bits  Description
 //  0  extended disk access functions
 //  1  removable drive controller functions supported
 //  2  enhanced disk drive (EDD) functions (AH=48h,AH=4Eh) supported.
 //    Extended drive parameter table is valid
 //  3~15  reserved (0)
 // CF = 1 (不支持LBA) 时的寄存器值 :
 // ah = 0x01 ( invalid function )
  movb  $0x41, %ah
  movw  $0x55aa, %bx
  int $0x13   //读取硬盘信息

  /*
   *  %dl may have been clobbered by INT 13, AH=41H.
   *  This happens, for example, with AST BIOS 1.04.
   */
  // int $0x13可能修改dx的值，现在恢复
  popw  %dx
  pushw %dx

  /* use CHS if fails */
  //假设使用LBA硬盘，则不会发生跳转
  jc  chs_mode
  cmpw  $0xaa55, %bx
  jne chs_mode

  /* check if AH=0x42 is supported if FORCE_LBA is zero */
  MOV_MEM_TO_AL(ABS(force_lba)) /* movb ABS(force_lba), %al */
  testb %al, %al
  jnz lba_mode
  andw  $1, %cx
  jz  chs_mode
  //终于，排除艰难，进入LBA模式（大硬盘模式）
lba_mode:
  /* save the total number of sectors */
  movl  0x10(%si), %ecx   //啥意思？没看明白？哪里的值？可能是BIOS传进来的值吧

  /* set %si to the disk address packet */
  //si定位到disk_address_packet
  movw  $ABS(disk_address_packet), %si

  /* set the mode to non-zero */
  movb  $1, -1(%si)
  //1=〉LBA ； 0=〉chs
  movl  ABS(stage2_sector), %ebx
//bx=stage2 segment
  /* the size and the reserved byte */
  movw  $0x0010, (%si)

  /* the blocks */
  //修改block值=1
  movw  $1, 2(%si)
  //修改absolute address=stage2_segment
  /* the absolute address (low 32 bits) */
  movl  %ebx, 8(%si)

  /* the segment of buffer address */
  movw  $STAGE1_BUFFERSEG, 6(%si)

  xorl  %eax, %eax    //eax=0
  movw  %ax, 4(%si)   //[si + 4]=0  head=0
  movl  %eax, 12(%si) //[si + 12] =0  cylinder_start=0   0道0面

/*
 * BIOS call "INT 0x13 Function 0x42" to read sectors from disk into memory
 *  Call with %ah = 0x42
 *      %dl = drive number
 *      %ds:%si = segment:offset of disk address packet
 *  Return:
 *      %al = 0x0 on success; err code on failure
 */
//将si处的一个扇区的内容读到ds处。si由disk_address_packet处的8字节大小指定，应该
是第0x10个扇区。
  movb  $0x42, %ah
  int $0x13

  /* LBA read is not supported, so fallback to CHS.  */
  jc  chs_mode
//然后将这个扇区copy到指定的buff中
  movw  $STAGE1_BUFFERSEG, %bx
  jmp copy_buffer
 
chs_mode:
  /*
   *  Determine the hard disk geometry from the BIOS!
   *  We do this first, so that LS-120 IDE floppies work correctly.
   */
  movb  $8, %ah
  int $0x13
  jnc final_init

  /*
   *  The call failed, so maybe use the floppy probe instead.
   */
  testb $STAGE1_BIOS_HD_FLAG, %dl
  jz  floppy_probe

  /* Nope, we definitely have a hard disk, and we're screwed. */
  jmp hd_probe_error

final_init:

  movw  $ABS(sectors), %si

  /* set the mode to zero */
  movb  $0, -1(%si)

  /* save number of heads */
  xorl  %eax, %eax
  movb  %dh, %al
  incw  %ax
  movl  %eax, 4(%si)

  xorw  %dx, %dx
  movb  %cl, %dl
  shlw  $2, %dx
  movb  %ch, %al
  movb  %dh, %ah

  /* save number of cylinders */
  incw  %ax
  movw  %ax, 8(%si)

  xorw  %ax, %ax
  movb  %dl, %al
  shrb  $2, %al

  /* save number of sectors */
  movl  %eax, (%si)

setup_sectors:
  /* load logical sector start (bottom half) */
  movl  ABS(stage2_sector), %eax

  /* zero %edx */
  xorl  %edx, %edx

  /* divide by number of sectors */
  divl  (%si)

  /* save sector start */
  movb  %dl, 10(%si)

  xorl  %edx, %edx  /* zero %edx */
  divl  4(%si)    /* divide by number of heads */

  /* save head start */
  movb  %dl, 11(%si)

  /* save cylinder start */
  movw  %ax, 12(%si)

  /* do we need too many cylinders? */
  cmpw  8(%si), %ax
  jge geometry_error

/*
 *  This is the loop for taking care of BIOS geometry translation (ugh!)
 */

  /* get high bits of cylinder */
  movb  13(%si), %dl

  shlb  $6, %dl   /* shift left by 6 bits */
  movb  10(%si), %cl  /* get sector */

  incb  %cl   /* normalize sector (sectors go
          from 1-N, not 0-(N-1) ) */
  orb %dl, %cl  /* composite together */
  movb  12(%si), %ch  /* sector+hcyl in cl, cylinder in ch */

  /* restore %dx */
  popw  %dx

  /* head number */
  movb  11(%si), %dh

/*
 * BIOS call "INT 0x13 Function 0x2" to read sectors from disk into memory
 *  Call with %ah = 0x2
 *      %al = number of sectors
 *      %ch = cylinder
 *      %cl = sector (bits 6-7 are high bits of "cylinder")
 *      %dh = head
 *      %dl = drive (0x80 for hard disk, 0x0 for floppy disk)
 *      %es:%bx = segment:offset of buffer
 *  Return:
 *      %al = 0x0 on success; err code on failure
 */

  movw  $STAGE1_BUFFERSEG, %bx
  movw  %bx, %es  /* load %es segment with disk buffer */

  xorw  %bx, %bx  /* %bx = 0, put it at 0 in the segment */
  movw  $0x0201, %ax  /* function 2 */
  int $0x13

  jc  read_error

  movw  %es, %bx

copy_buffer:
  movw  ABS(stage2_segment), %es
//es=0x8000 目的addr。es:si=0x8000:0000
//源：DS：SI = 0x0000:0000？代码段似乎被清零了啊。疑惑

  /*
   * We need to save %cx and %si because the startup code in
   * stage2 uses them without initializing them.
   */
  pusha
  pushw %ds

  movw  $0x100, %cx   //256次循环
  movw  %bx, %ds      //bx=硬盘参数？
  xorw  %si, %si      //=0
  xorw  %di, %di      //=0
  //确定copy方向
  cld
  //循环使用movsw每次拷贝2个byte。
  rep
  movsw
  //恢复现场
  popw  %ds
  popa

  /* boot stage2 *///跳转到stage2，stage1的工作完成。
  jmp *(stage2_address)

/* END OF MAIN LOOP */

/*
 * BIOS Geometry translation error (past the end of the disk geometry!).
 */
geometry_error:
  MSG(geometry_error_string)
  jmp general_error

/*
 * Disk probe failure.
 */
hd_probe_error:
  MSG(hd_probe_error_string)
  jmp general_error

/*
 * Read error on the disk.
 */
read_error:
  MSG(read_error_string)

general_error:
  MSG(general_error_string)

/* go here when you need to stop the machine hard after an error condition */
stop: jmp stop

notification_string:  .string "GRUB "
geometry_error_string:  .string "Geom"
hd_probe_error_string:  .string "Hard Disk"
read_error_string:  .string "Read"
general_error_string: .string " Error"

/*
 * message: write the string pointed to by %si
 *
 *   WARNING: trashes %si, %ax, and %bx
 */

  /*
   * Use BIOS "int 10H Function 0Eh" to write character in teletype mode
   *  %ah = 0xe %al = character
   *  %bh = page  %bl = foreground color (graphics modes)
   */
1:
  movw  $0x0001, %bx
  movb  $0xe, %ah
  int $0x10   /* display a byte */
message:
  lodsb
  cmpb  $0, %al
  jne 1b  /* if not end of string, jmp to display */
  ret

  /*
   *  Windows NT breaks compatibility by embedding a magic
   *  number here.
   */

  . = _start + STAGE1_WINDOWS_NT_MAGIC
nt_magic:
  .long 0
  .word 0

  /*
   *  This is where an MBR would go if on a hard disk.  The code
   *  here isn't even referenced unless we're on a floppy.  Kinda
   *  sneaky, huh?
   */

part_start:
  . = _start + STAGE1_PARTSTART

probe_values:
  .byte 36, 18, 15, 9, 0

floppy_probe:
/*
 *  Perform floppy probe.
 */

  movw  $ABS(probe_values-1), %si

probe_loop:
  /* reset floppy controller INT 13h AH=0 */
  xorw  %ax, %ax
  int $0x13

  incw  %si
  movb  (%si), %cl

  /* if number of sectors is 0, display error and die */
  cmpb  $0, %cl
  jne 1f

/*
 * Floppy disk probe failure.
 */
  MSG(fd_probe_error_string)
  jmp general_error

fd_probe_error_string:  .string "Floppy"

1:
  /* perform read */
  movw  $STAGE1_BUFFERSEG, %bx
  movw  $0x201, %ax
  movb  $0, %ch
  movb  $0, %dh
  int $0x13

  /* if error, jump to "probe_loop" */
  jc  probe_loop

  /* %cl is already the correct value! */
  movb  $1, %dh
  movb  $79, %ch

  jmp final_init

  . = _start + STAGE1_PARTEND

/* the last 2 bytes in the sector 0 contain the signature */
  .word STAGE1_SIGNATURE

 

待续……