[Qemu-devel] [BUG] QEMU BIOS - El Torito no emulation boot address incorrect seg:off

[Qemu-devel] [BUG] QEMU BIOS - El Torito no emulation boot address incorrect seg:off

[Jarno Rajala]

Hello

I believe I've located a minor bug in QEMU BIOS. According to the El 
Torito specification the no emulation mode should load the boot code to 
the real mode address seg:0 and start executing from there. However, 
QEMU jumps to 0:seg*16, which is the same absolute address, but wrong 
segment:offset.

The QEMU BIOS version I have is

QEMU BIOS - build: 02/13/08
$Revision: 1.194 $ $Date: 2007/12/23 19:46:27 $
Options: apmbios pcibios eltorito rombios32

The following boot code illustrates the problem. It prints JJ to the top 
of the screen on a real PC, but prints JA instead on QEMU. (The boot 
image is set to load into the segment 0x7c8)

test_code:
    call .call
.call:
    pop bx
    mov ax,cs
    shl ax,4
    add ax,bx
   
.l1
    cmp ax,0x7c83
    jne .l1
   
    mov ax,0xb800
    mov es,ax
    mov [es:0],word 0x074a
   
    mov ax,cs
    cmp ax,0x7c8
    jne .l2
    mov [es:2],word 0x074a
    jmp .loopy
.l2
    cmp ax,0
    jne .loopy
    mov [es:2],word 0x0741
   
   
.loopy:
    jmp .loopy

Jarno Rajala

Re: [Qemu-devel] [BUG] QEMU BIOS - El Torito no emulation boot address incorrect seg:off

[Anthony Liguori]

Jarno Rajala wrote:
> Hello
>
> I believe I've located a minor bug in QEMU BIOS. According to the El 
> Torito specification the no emulation mode should load the boot code 
> to the real mode address seg:0 and start executing from there. 
> However, QEMU jumps to 0:seg*16, which is the same absolute address, 
> but wrong segment:offset.

It could be a bug, but then again, specifications aren't always 
correct.  At any rate, the BIOS code is part of the Bochs project so I 
would suggest bringing it up there.

Regards,

Anthony Liguori

> The QEMU BIOS version I have is
>
> QEMU BIOS - build: 02/13/08
> $Revision: 1.194 $ $Date: 2007/12/23 19:46:27 $
> Options: apmbios pcibios eltorito rombios32
>
> The following boot code illustrates the problem. It prints JJ to the 
> top of the screen on a real PC, but prints JA instead on QEMU. (The 
> boot image is set to load into the segment 0x7c8)
>
> test_code:
>    call .call
> .call:
>    pop bx
>    mov ax,cs
>    shl ax,4
>    add ax,bx
>   .l1
>    cmp ax,0x7c83
>    jne .l1
>      mov ax,0xb800
>    mov es,ax
>    mov [es:0],word 0x074a
>      mov ax,cs
>    cmp ax,0x7c8
>    jne .l2
>    mov [es:2],word 0x074a
>    jmp .loopy
> .l2
>    cmp ax,0
>    jne .loopy
>    mov [es:2],word 0x0741
>     .loopy:
>    jmp .loopy
>
> Jarno Rajala
>
>
>