From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.33) id 1BcX1A-000307-Dq for qemu-devel@nongnu.org; Mon, 21 Jun 2004 18:11:56 -0400 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.33) id 1BcX18-0002zv-Ef for qemu-devel@nongnu.org; Mon, 21 Jun 2004 18:11:56 -0400 Received: from [199.232.76.173] (helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.33) id 1BcX18-0002zs-9p for qemu-devel@nongnu.org; Mon, 21 Jun 2004 18:11:54 -0400 Received: from [216.109.118.96] (helo=web60201.mail.yahoo.com) by monty-python.gnu.org with smtp (Exim 4.34) id 1BcWzN-0005MB-Ko for qemu-devel@nongnu.org; Mon, 21 Jun 2004 18:10:05 -0400 Message-ID: <20040621221005.40221.qmail@web60201.mail.yahoo.com> Date: Mon, 21 Jun 2004 15:10:05 -0700 (PDT) From: Piotr Krysik Subject: Re: [Qemu-devel] BIOS checksums? In-Reply-To: <1087828431.9477.347.camel@sherbert> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Reply-To: qemu-devel@nongnu.org List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Hi, A few words about the architecture. As I mentioned, I'm trying to use QEMU to monitor interactions between guest OS and real hardware. To avoid interactions between guest and host OS, I decided to run QEMU _without_ OS. It's started by boot loader. The QEMU log is send to another machine. The other machine can also be used to run remote gdb. 1. IO QEMU uses serial port to communicate with the other machine. There are also some other ports that should be protected from access by code executed in the emulator, as they may interact with QEMU (e.g. CPU reset, DRAM Controller reprogramming). All the other emulated IO ports are hooked to real machine. I'm emulating some of the protected IO ports. 2. Memory I have to reserve some memory for QEMU. I'm allocating some MB of top of RAM. The rest is visible to guest OS with it's real address (addresses used by emulated CPU is identical to addresses used by hardware), so it should be possible to use DMA without translating addresses. Also I don't have to treat memory mapped hardware in any special way. The QEMU area is not visible to emulated CPU, so it's protected from direct access by guest OS. It could be accessed by DMA (e.g. broken drivers). If such (unlikely) case is discovered, it can be handled by intercepting and modifying IO or memory access used to setup that DMA. To run BIOS, I had to intercept some IO that tried to reprogram RAM Controller. 3. CPU QEMU runs in real mode with 32-bit addressing. All the interrupts are redirected from host hardware to QEMU by IRQ handler calling cpu_interrupt. Guest OS uses emulated CPU provided by QEMU:-) I'm protecting real CPU from switching A20 and reset, and redirect them to emulated CPU. To run BIOS, I had to disable SMM (System Management Mode) by reprogramming ACPI, emulate self-test of Keyboard Controller and intercept IO access to ACPI and an unknown device at 0x03fX. After QEMU is started it's possible to: * reset some hardware and restart BIOS or * reload boot sector and start guest OS. It's not possible to build generic emulator capable of restating BIOS. My prototype runs 440BX-based PC with Award-based BIOS. The BIOS successfully reprograms emulated DRAM Controller, test interrupts, initializes PCI, etc. It's stating to test RAM and then goes into BIOS setup (I didn't discover the reason yet, but suspect timing). Emulating BIOS restart can be used to monitor interactions between BIOS and hardware during system start-up. And the mechanism is not limited to PC. Reloading boot sector and starting guest OS without restarting BIOS should remove most of chipset and BIOS dependencies. My prototype is capable to run Linux up to the point of login prompt, but keyboard is not functioning (my interrupt handler is not 100% correct). This mode was tested only with QEMU emulated hardware -- I run Linux inside my prototype inside QEMU inside Linux. BTW. What is "PMC config space"? Did you mean DIMM Serial Presence Detect? Regards, Piotrek --- Gianni Tedesco wrote: > On Mon, 2004-06-21 at 07:29 -0700, Piotr Krysik > wrote: > > Are you talking about using proprietary > closed-source BIOS-es of real > > PC? They are usually very hardware-depended. > > > > In fact I started a project to use QEMU to monitor > interactions > > between guest OS and real hardware (similar to > "PCI Host/Proxy" by > > Gianni Tedesco, but not limited to PCI hardware). > At this point I have > > prof of concept prototype that successfully boots > proprietary BIOS of > > my PC up to the point of testing the RAM. > > Sounds very interesting, are you doing this just > generically by just > hooking up virtual i/o ports to real ones? I guess > to get a BIOS running > it takes more than that? > > Doesn't the BIOS use the PMC config space to query > DRAM bank layout? If > so that shouldn't be too difficult to modify > hw/pci.c to do the right > thing(tm).... > > -- > // Gianni Tedesco (gianni at scaramanga dot co dot > uk) > lynx --source www.scaramanga.co.uk/scaramanga.asc | > gpg --import > 8646BE7D: 6D9F 2287 870E A2C9 8F60 3A3C 91B5 7669 > 8646 BE7D > > ATTACHMENT part 1.2 application/pgp-signature name=signature.asc > _______________________________________________ > Qemu-devel mailing list > Qemu-devel@nongnu.org > http://lists.nongnu.org/mailman/listinfo/qemu-devel > __________________________________ Do you Yahoo!? New and Improved Yahoo! Mail - 100MB free storage! http://promotions.yahoo.com/new_mail