Re: Guest memory backed by PCI BAR (x86)

[Nate Case <ncase@xes-inc.com>]

----- Original Message -----
> 
> 
> On 26/03/2015 17:34, Nate Case wrote:
> >    0x52:        add    al,dh
> >    0x54:        pop    cx
> >    0x55:        clc
> >    0x56:        add    al,dh
> > => 0x58:        cs
> >    0x59:        call   0xf05c
> >    0x5c:        shr    bh,cl
> >    0x5e:        add    al,dh
> >    0x60:        add    ax,0xcf
> >    0x63:        lock repnz out 0x0,al
> 
> This code makes no sense, it looks like the processor has gone into the
> weeds. :(
> 
> Based on this:
> 
> cs             0x9020   36896
> 
> I could guess, based on your use of resource2_wc, that the host is
> bypassing the processor cache but the guest is not.  This use is not
> supported on x86 KVM, sorry.

I don't think the "x/70i 0" output reflected where the CPU was actually
executing?  Based on the CS:IP of 9020:0058 (0x90258), shouldn't I be
dumping from around 0x90200 instead?  gdb gets easily confused here

real-mode-gdb$ x/70i 0x90200
   0x90200:     cli    
   0x90201:     mov    al,0x80
   0x90203:     out    0x70,al
   0x90205:     mov    ax,0x9000
   0x90208:     mov    ds,ax
   0x9020a:     mov    es,ax
   0x9020c:     mov    fs,ax
   0x9020e:     mov    ss,ax
   0x90210:     mov    sp,dx
   0x90212:     push   cs
   0x90213:     pop    ds
   0x90214:     lidtw  ds:0xa2
   0x90219:     lgdtw  ds:0xa8
   0x9021e:     mov    dx,0x92
   0x90221:     in     al,dx
   0x90222:     cmp    al,0xff
   0x90224:     je     0x90238
   0x90226:     mov    ah,BYTE PTR [esp+0x4]
   0x9022b:     test   ah,ah
   0x9022d:     je     0x90233
   0x9022f:     or     al,0x2
   0x90231:     jmp    0x90235
   0x90233:     and    al,0xfd
   0x90235:     and    al,0xfe
   0x90237:     out    dx,al
   0x90238:     call   0x90266
   0x9023b:     mov    al,0xd1
   0x9023d:     out    0x64,al
   0x9023f:     call   0x90266
   0x90242:     mov    al,0xdf
   0x90244:     out    0x60,al
   0x90246:     call   0x90266
   0x90249:     mov    ax,0x1
   0x9024c:     lmsw   ax
   0x9024f:     jmp    0x90251
   0x90251:     mov    ax,0x18
   0x90254:     mov    ds,ax
   0x90256:     mov    es,ax
   0x90258:     mov    ss,ax      <-- the "real" IP
   0x9025a:     mov    fs,ax
   0x9025c:     mov    gs,ax
   0x9025e:     jmp    0x10:0x10000
   0x90266:     call   0x9027f
   0x90269:     in     al,0x64
   0x9026b:     cmp    al,0xff
   0x9026d:     je     0x9027e
   0x9026f:     test   al,0x1
   0x90271:     je     0x9027a
   0x90273:     call   0x9027f
   0x90276:     in     al,0x60
   0x90278:     jmp    0x90266
   0x9027a:     test   al,0x2
   0x9027c:     jne    0x90266
   0x9027e:     ret    
   0x9027f:     jmp    0x90281
   0x90281:     ret    
   0x90282:     add    BYTE PTR [bx+si],al
   0x90284:     add    BYTE PTR [bx+si],al
   0x90286:     add    BYTE PTR [bx+si],al
   0x90288:     add    BYTE PTR [bx+si],al
   0x9028a:     add    BYTE PTR [bx+si],al
   0x9028c:     add    BYTE PTR [bx+si],al
   0x9028e:     add    BYTE PTR [bx+si],al
   0x90290:     add    BYTE PTR [bx+si],al
   0x90292:     (bad)  
   0x90293:     jg     0x90295
   0x90295:     add    BYTE PTR [bx+si],al
   0x90297:     call   0xffff:0xc0
   0x9029c:     (bad)  
   0x9029d:     (bad)  

Thanks,

Nate