[Qemu-devel] Where is vga-rom mapped in guest system memory?

[Qemu-devel] Where is vga-rom mapped in guest system memory?

[Jaeyong Yoo]

[-- Attachment #1: Type: text/html, Size: 1426 bytes --]

Re: [Qemu-devel] Where is vga-rom mapped in guest system memory?

[Laszlo Ersek]

On 05/13/14 14:58, Jaeyong Yoo wrote:
> Hello qemu!
> 
>  
> 
> I am currently writing a vga device emulator and need to debug vga-bios.
> 
> What I want is to set break-point on the entry of vga-bios and for this,
> 
> I'm reading qemu source around pci device and rom-related memory regions
> 
> to find out where should I set break point. And, sadly, got stuck.
> 
>  
> 
> Could you give me any advice about the memory-mapped address of vga-rom or
> 
> any pointers?

Some.

The vgabios binary is loaded from the file identified by the "romfile"
property of the VGA card that you select. For example,

  -device qxl-vga,romfile=...

or

  -vga qxl \
  -global qxl-vga.romfile=...

Of course the property has a default value for each VGA card. See the

  k->romfile = ...

assignments in:
- cirrus_vga_class_init() -- vgabios-cirrus.bin
- qxl_primary_class_init() -- vgabios-qxl.bin
- vga_class_init() -- vgabios-stdvga.bin

I think the oprom is loaded in

pci_qdev_init() [hw/pci/pci.c]
  pci_add_option_rom()

The vgabios oprom is shadowed from ROM (pci address space) to RAM by the
SeaBIOS initialization code, and then POSTed:

handle_post() [src/post.c]
  make_bios_writable() [src/fw/shadow.c]
    make_bios_writable_intel()
      __make_bios_writable_intel() -- shadows vgabios in C segment too
  dopost() [src/post.c]
    maininit()
      vgarom_setup() [src/optionroms.c]
        init_pcirom()
          init_optionrom()
            callrom()
              __callrom()
                _rom_header_entry [vgasrc/vgaentry.S]
                  vga_post() [vgasrc/vgainit.c]

You can instrument vga_post() in the SeaBIOS source [vgasrc/vgainit.c],
rebuild the vgabios binary, and load this binary with the video card's
romfile=... property on the qemu command line.

Laszlo

Laszlo

Re: [Qemu-devel] Where is vga-rom mapped in guest system memory?

[Jaeyong Yoo]

> -----Original Message-----
> From: qemu-devel-bounces+jaeyong.yoo=samsung.com@nongnu.org [mailto:qemu-
> devel-bounces+jaeyong.yoo=samsung.com@nongnu.org] On Behalf Of Laszlo
> Ersek
> Sent: Tuesday, May 13, 2014 10:55 PM
> To: jaeyong.yoo@samsung.com; qemu-devel@nongnu.org
> Subject: Re: [Qemu-devel] Where is vga-rom mapped in guest system memory?
> 
> On 05/13/14 14:58, Jaeyong Yoo wrote:
> > Hello qemu!
> >
> >
> >
> > I am currently writing a vga device emulator and need to debug vga-bios.
> >
> > What I want is to set break-point on the entry of vga-bios and for
> > this,
> >
> > I'm reading qemu source around pci device and rom-related memory
> > regions
> >
> > to find out where should I set break point. And, sadly, got stuck.
> >
> >
> >
> > Could you give me any advice about the memory-mapped address of
> > vga-rom or
> >
> > any pointers?
> 
> Some.
> 
> The vgabios binary is loaded from the file identified by the "romfile"
> property of the VGA card that you select. For example,
> 
>   -device qxl-vga,romfile=...
> 
> or
> 
>   -vga qxl \
>   -global qxl-vga.romfile=...
> 
> Of course the property has a default value for each VGA card. See the
> 
>   k->romfile = ...
> 
> assignments in:
> - cirrus_vga_class_init() -- vgabios-cirrus.bin
> - qxl_primary_class_init() -- vgabios-qxl.bin
> - vga_class_init() -- vgabios-stdvga.bin
> 
> I think the oprom is loaded in
> 
> pci_qdev_init() [hw/pci/pci.c]
>   pci_add_option_rom()
> 
> The vgabios oprom is shadowed from ROM (pci address space) to RAM by the
> SeaBIOS initialization code, and then POSTed:
> 
> handle_post() [src/post.c]
>   make_bios_writable() [src/fw/shadow.c]
>     make_bios_writable_intel()
>       __make_bios_writable_intel() -- shadows vgabios in C segment too
>   dopost() [src/post.c]
>     maininit()
>       vgarom_setup() [src/optionroms.c]
>         init_pcirom()
>           init_optionrom()
>             callrom()
>               __callrom()
>                 _rom_header_entry [vgasrc/vgaentry.S]
>                   vga_post() [vgasrc/vgainit.c]
> 
> You can instrument vga_post() in the SeaBIOS source [vgasrc/vgainit.c],
> rebuild the vgabios binary, and load this binary with the video card's
> romfile=... property on the qemu command line.

Thanks for the answer. It is the exact code-path that I was looking for :-)

I have one follow-up question.
It looks like seabios (bios.bin) includes the vgabios (such as vga_post
functions). And this bios.bin is not loaded as vgabios-stdvga.bin (the
one that you mentioned in vga_class_init). I'm not clearly understanding
the difference between vgabios inside bios.bin and vgabios-stdvga.bin.
Could you tell me the difference?

Additionally, currently, what I'm trying to do is to port the VirtualBox's
graphics stack to qemu and I'm expecting to use VirtualBox's vgabios. In this
case, do I have to modify something in seabios? I thought all I need to do is
to set romfile as the path to the VirtualBox vgabios, and now I'm not sure...


Best regards,
Jaeyong

Re: [Qemu-devel] Where is vga-rom mapped in guest system memory?

[Laszlo Ersek]

On 05/14/14 06:01, Jaeyong Yoo wrote:
>> -----Original Message-----
>> From: qemu-devel-bounces+jaeyong.yoo=samsung.com@nongnu.org [mailto:qemu-
>> devel-bounces+jaeyong.yoo=samsung.com@nongnu.org] On Behalf Of Laszlo
>> Ersek
>> Sent: Tuesday, May 13, 2014 10:55 PM
>> To: jaeyong.yoo@samsung.com; qemu-devel@nongnu.org
>> Subject: Re: [Qemu-devel] Where is vga-rom mapped in guest system memory?
>>
>> On 05/13/14 14:58, Jaeyong Yoo wrote:
>>> Hello qemu!
>>>
>>>
>>>
>>> I am currently writing a vga device emulator and need to debug vga-bios.
>>>
>>> What I want is to set break-point on the entry of vga-bios and for
>>> this,
>>>
>>> I'm reading qemu source around pci device and rom-related memory
>>> regions
>>>
>>> to find out where should I set break point. And, sadly, got stuck.
>>>
>>>
>>>
>>> Could you give me any advice about the memory-mapped address of
>>> vga-rom or
>>>
>>> any pointers?
>>
>> Some.
>>
>> The vgabios binary is loaded from the file identified by the "romfile"
>> property of the VGA card that you select. For example,
>>
>>   -device qxl-vga,romfile=...
>>
>> or
>>
>>   -vga qxl \
>>   -global qxl-vga.romfile=...
>>
>> Of course the property has a default value for each VGA card. See the
>>
>>   k->romfile = ...
>>
>> assignments in:
>> - cirrus_vga_class_init() -- vgabios-cirrus.bin
>> - qxl_primary_class_init() -- vgabios-qxl.bin
>> - vga_class_init() -- vgabios-stdvga.bin
>>
>> I think the oprom is loaded in
>>
>> pci_qdev_init() [hw/pci/pci.c]
>>   pci_add_option_rom()
>>
>> The vgabios oprom is shadowed from ROM (pci address space) to RAM by the
>> SeaBIOS initialization code, and then POSTed:
>>
>> handle_post() [src/post.c]
>>   make_bios_writable() [src/fw/shadow.c]
>>     make_bios_writable_intel()
>>       __make_bios_writable_intel() -- shadows vgabios in C segment too
>>   dopost() [src/post.c]
>>     maininit()
>>       vgarom_setup() [src/optionroms.c]
>>         init_pcirom()
>>           init_optionrom()
>>             callrom()
>>               __callrom()
>>                 _rom_header_entry [vgasrc/vgaentry.S]
>>                   vga_post() [vgasrc/vgainit.c]
>>
>> You can instrument vga_post() in the SeaBIOS source [vgasrc/vgainit.c],
>> rebuild the vgabios binary, and load this binary with the video card's
>> romfile=... property on the qemu command line.
> 
> Thanks for the answer. It is the exact code-path that I was looking for :-)
> 
> I have one follow-up question.
> It looks like seabios (bios.bin) includes the vgabios (such as vga_post
> functions). And this bios.bin is not loaded as vgabios-stdvga.bin (the
> one that you mentioned in vga_class_init). I'm not clearly understanding
> the difference between vgabios inside bios.bin and vgabios-stdvga.bin.
> Could you tell me the difference?

bios.bin and vgabios.bin are separate build outputs of SeaBIOS. If you
run "make menuconfig" in the seabios directory and browse the options,
it should become clearer. (The build system should be discussed on the
seabios list, the maintainers can help you more than I can.)

I recommend to study the following SRPM:

https://www.kraxel.org/repos/jenkins/seabios/seabios.git-1.7.4-93.b113.g6ad7b5b.src.rpm

the SPEC file should help (see the do_build() function and the various
build config files).

> Additionally, currently, what I'm trying to do is to port the VirtualBox's
> graphics stack to qemu and I'm expecting to use VirtualBox's vgabios. In this
> case, do I have to modify something in seabios?

I wouldn't think so.

> I thought all I need to do is
> to set romfile as the path to the VirtualBox vgabios

I agree. If the virtualbox vgabios is a "well formed" PCI oprom,
matching the PCI IDs of the display device you are porting etc, then it
should "just work". SeaBIOS runs on physical hardware too, and (I
gather) it posts the oproms of the various (unknown in andvance)
physical cards too that it finds in the machine.

Laszlo

Re: [Qemu-devel] Where is vga-rom mapped in guest system memory?

[Jaeyong Yoo]

> -----Original Message-----
> From: qemu-devel-bounces+jaeyong.yoo=samsung.com@nongnu.org [mailto:qemu-
> devel-bounces+jaeyong.yoo=samsung.com@nongnu.org] On Behalf Of Laszlo
> Ersek
> Sent: Wednesday, May 14, 2014 7:56 PM
> To: Jaeyong Yoo; qemu-devel@nongnu.org
> Subject: Re: [Qemu-devel] Where is vga-rom mapped in guest system memory?
> 
> On 05/14/14 06:01, Jaeyong Yoo wrote:
> >> -----Original Message-----
> >> From: qemu-devel-bounces+jaeyong.yoo=samsung.com@nongnu.org
> >> [mailto:qemu-
> >> devel-bounces+jaeyong.yoo=samsung.com@nongnu.org] On Behalf Of Laszlo
> >> Ersek
> >> Sent: Tuesday, May 13, 2014 10:55 PM
> >> To: jaeyong.yoo@samsung.com; qemu-devel@nongnu.org
> >> Subject: Re: [Qemu-devel] Where is vga-rom mapped in guest system
> memory?
> >>
> >> On 05/13/14 14:58, Jaeyong Yoo wrote:
> >>> Hello qemu!
> >>>
> >>>
> >>>
> >>> I am currently writing a vga device emulator and need to debug vga-
> bios.
> >>>
> >>> What I want is to set break-point on the entry of vga-bios and for
> >>> this,
> >>>
> >>> I'm reading qemu source around pci device and rom-related memory
> >>> regions
> >>>
> >>> to find out where should I set break point. And, sadly, got stuck.
> >>>
> >>>
> >>>
> >>> Could you give me any advice about the memory-mapped address of
> >>> vga-rom or
> >>>
> >>> any pointers?
> >>
> >> Some.
> >>
> >> The vgabios binary is loaded from the file identified by the "romfile"
> >> property of the VGA card that you select. For example,
> >>
> >>   -device qxl-vga,romfile=...
> >>
> >> or
> >>
> >>   -vga qxl \
> >>   -global qxl-vga.romfile=...
> >>
> >> Of course the property has a default value for each VGA card. See the
> >>
> >>   k->romfile = ...
> >>
> >> assignments in:
> >> - cirrus_vga_class_init() -- vgabios-cirrus.bin
> >> - qxl_primary_class_init() -- vgabios-qxl.bin
> >> - vga_class_init() -- vgabios-stdvga.bin
> >>
> >> I think the oprom is loaded in
> >>
> >> pci_qdev_init() [hw/pci/pci.c]
> >>   pci_add_option_rom()
> >>
> >> The vgabios oprom is shadowed from ROM (pci address space) to RAM by
> >> the SeaBIOS initialization code, and then POSTed:
> >>
> >> handle_post() [src/post.c]
> >>   make_bios_writable() [src/fw/shadow.c]
> >>     make_bios_writable_intel()
> >>       __make_bios_writable_intel() -- shadows vgabios in C segment too
> >>   dopost() [src/post.c]
> >>     maininit()
> >>       vgarom_setup() [src/optionroms.c]
> >>         init_pcirom()
> >>           init_optionrom()
> >>             callrom()
> >>               __callrom()
> >>                 _rom_header_entry [vgasrc/vgaentry.S]
> >>                   vga_post() [vgasrc/vgainit.c]
> >>
> >> You can instrument vga_post() in the SeaBIOS source
> >> [vgasrc/vgainit.c], rebuild the vgabios binary, and load this binary
> >> with the video card's romfile=... property on the qemu command line.
> >
> > Thanks for the answer. It is the exact code-path that I was looking
> > for :-)
> >
> > I have one follow-up question.
> > It looks like seabios (bios.bin) includes the vgabios (such as
> > vga_post functions). And this bios.bin is not loaded as
> > vgabios-stdvga.bin (the one that you mentioned in vga_class_init). I'm
> > not clearly understanding the difference between vgabios inside bios.bin
> and vgabios-stdvga.bin.
> > Could you tell me the difference?
> 
> bios.bin and vgabios.bin are separate build outputs of SeaBIOS. If you run
> "make menuconfig" in the seabios directory and browse the options, it
> should become clearer. (The build system should be discussed on the
> seabios list, the maintainers can help you more than I can.)
> 
> I recommend to study the following SRPM:
> 
> https://www.kraxel.org/repos/jenkins/seabios/seabios.git-1.7.4-
> 93.b113.g6ad7b5b.src.rpm
> 
> the SPEC file should help (see the do_build() function and the various
> build config files).

Thanks for the answer, Laszlo.

I built the seabios in qemu and try to see the debug message of seabios.
So, I checked the "Serial port debugging" option in Debugging section with the 
serial port base address 0x3f8. (Is this the correct value?)
And, launch qemu with option "-serial stdio" but I don’t see any messages from
seabios. If I want to see the debug message of seabios to the output console,
what am I missing?

My full command for launching qemu is the following:
$ sudo x86_64-softmmu/qemu-system-x86_64 -enable-kvm -m 1024 -vga vmware -serial stdio ~/data/qemu-images/ubuntu-13.04-desktop.img


Thanks,
Jaeyong

Re: [Qemu-devel] Where is vga-rom mapped in guest system memory?

[Laszlo Ersek]

On 05/14/14 13:41, Jaeyong Yoo wrote:

> I built the seabios in qemu and try to see the debug message of seabios.
> So, I checked the "Serial port debugging" option in Debugging section with the 
> serial port base address 0x3f8. (Is this the correct value?)
> And, launch qemu with option "-serial stdio" but I don’t see any messages from
> seabios. If I want to see the debug message of seabios to the output console,
> what am I missing?
> 
> My full command for launching qemu is the following:
> $ sudo x86_64-softmmu/qemu-system-x86_64 -enable-kvm -m 1024 -vga vmware -serial stdio ~/data/qemu-images/ubuntu-13.04-desktop.img

I rely on the qemu debug port rather than on serial:

  -debugcon file:debug.log -global isa-debugcon.iobase=0x402

Check the DEBUG_IO and DEBUG_LEVEL settings in the SeaBIOS config as well.

Laszlo

Re: [Qemu-devel] Where is vga-rom mapped in guest system memory?

[Jaeyong Yoo]

> I rely on the qemu debug port rather than on serial:
> 
>   -debugcon file:debug.log -global isa-debugcon.iobase=0x402
> 
> Check the DEBUG_IO and DEBUG_LEVEL settings in the SeaBIOS config as well.

Thanks Laszlo! Now I can see the log message in VirtualBox vgabios with qemu
debug port.

By the way, I've got one more question, which is very strange for me.

I tried to print a string and the values read by the string address do not look
correct. More specifically, I wrote the following code in VirtualBox vga-bios:

char *msg = "Start Vgabios\n";

for (i = msg; ++i; *i != 0)
{
    outb(0x402, *i);
}

And, I expect to see the message "Start Vgabios" in the debug port, but it doesn't
work. If I object-dump the related parts in VirtualBox vga-bios, I can see that the
msg (msg = 0x7eea) properly contains "Start Vgabios". And, if I print the value of i
in vga-bios, it gives 0x7eea (which is correct address). Then I expect that *i should
be 'S' but *I gives zero. I checked the vga-rom size field and it properly covers the
actual size of vgarom. Then, I think qemu properly map the entire vgarom in the proper,
so it won't be an issue.

Is there some issues with memory addressing that I'm missing?


Best regards,
Jaeyong

Re: [Qemu-devel] Where is vga-rom mapped in guest system memory?

[Laszlo Ersek]

On 05/15/14 15:25, Jaeyong Yoo wrote:
>> I rely on the qemu debug port rather than on serial:
>>
>>   -debugcon file:debug.log -global isa-debugcon.iobase=0x402
>>
>> Check the DEBUG_IO and DEBUG_LEVEL settings in the SeaBIOS config as well.
> 
> Thanks Laszlo! Now I can see the log message in VirtualBox vgabios with qemu
> debug port.
> 
> By the way, I've got one more question, which is very strange for me.
> 
> I tried to print a string and the values read by the string address do not look
> correct. More specifically, I wrote the following code in VirtualBox vga-bios:
> 
> char *msg = "Start Vgabios\n";
> 
> for (i = msg; ++i; *i != 0)
> {
>     outb(0x402, *i);
> }
> 
> And, I expect to see the message "Start Vgabios" in the debug port, but it doesn't
> work. If I object-dump the related parts in VirtualBox vga-bios, I can see that the
> msg (msg = 0x7eea) properly contains "Start Vgabios". And, if I print the value of i
> in vga-bios, it gives 0x7eea (which is correct address). Then I expect that *i should
> be 'S' but *I gives zero. I checked the vga-rom size field and it properly covers the
> actual size of vgarom. Then, I think qemu properly map the entire vgarom in the proper,
> so it won't be an issue.
> 
> Is there some issues with memory addressing that I'm missing?

You are probably in real mode. The above outb() loop probably translates
to something like this:

00000000  3E8A04            mov al,[ds:si]
00000003  BA0204            mov dx,0x402
00000006  EE                out dx,al
00000007  46                inc si

(objdump -S will allow you to see it exactly.)

My take is that ds is not set correctly. You might have to set ds
manually, or at least decorate the definition of the string with some
gcc section attribute so that the compiler places the string in a
section that will be "automatically" matched by ds.

Or, you might be able to test it like this:
- first, change the type of "msg" from "pointer to character" to "array
of characters":

  char msg[] = "Start Vgabios\n"

- second, give it automatic storage duration, rather than static storage
duration. In English, make it local to the function containing the loop.
Hopefully the compiler will generate code that places the string on the
stack then, and then your loop body will (hopefully) look something like

00000000  368A02            mov al,[ss:bp+si]
00000003  BA0204            mov dx,0x402
00000006  EE                out dx,al
00000007  46                inc si

(Ie. work off your stack, where ss and bp should be "just right".)

I'm just guessing of course.

Laszlo

Re: [Qemu-devel] Where is vga-rom mapped in guest system memory?

[Jaeyong Yoo]

> -----Original Message-----
> From: qemu-devel-bounces+jaeyong.yoo=samsung.com@nongnu.org [mailto:qemu-
> devel-bounces+jaeyong.yoo=samsung.com@nongnu.org] On Behalf Of Laszlo
> Ersek
> Sent: Thursday, May 15, 2014 11:05 PM
> To: Jaeyong Yoo; qemu-devel@nongnu.org
> Subject: Re: [Qemu-devel] Where is vga-rom mapped in guest system memory?
> 
> On 05/15/14 15:25, Jaeyong Yoo wrote:
> >> I rely on the qemu debug port rather than on serial:
> >>
> >>   -debugcon file:debug.log -global isa-debugcon.iobase=0x402
> >>
> >> Check the DEBUG_IO and DEBUG_LEVEL settings in the SeaBIOS config as
> well.
> >
> > Thanks Laszlo! Now I can see the log message in VirtualBox vgabios
> > with qemu debug port.
> >
> > By the way, I've got one more question, which is very strange for me.
> >
> > I tried to print a string and the values read by the string address do
> > not look correct. More specifically, I wrote the following code in
> VirtualBox vga-bios:
> >
> > char *msg = "Start Vgabios\n";
> >
> > for (i = msg; ++i; *i != 0)
> > {
> >     outb(0x402, *i);
> > }
> >
> > And, I expect to see the message "Start Vgabios" in the debug port,
> > but it doesn't work. If I object-dump the related parts in VirtualBox
> > vga-bios, I can see that the msg (msg = 0x7eea) properly contains
> > "Start Vgabios". And, if I print the value of i in vga-bios, it gives
> > 0x7eea (which is correct address). Then I expect that *i should be 'S'
> > but *I gives zero. I checked the vga-rom size field and it properly
> > covers the actual size of vgarom. Then, I think qemu properly map the
> entire vgarom in the proper, so it won't be an issue.
> >
> > Is there some issues with memory addressing that I'm missing?
> 
> You are probably in real mode. The above outb() loop probably translates
> to something like this:
> 
> 00000000  3E8A04            mov al,[ds:si]
> 00000003  BA0204            mov dx,0x402
> 00000006  EE                out dx,al
> 00000007  46                inc si
> 
> (objdump -S will allow you to see it exactly.)
> 
> My take is that ds is not set correctly. You might have to set ds manually,
> or at least decorate the definition of the string with some gcc section
> attribute so that the compiler places the string in a section that will be
> "automatically" matched by ds.
> 
> Or, you might be able to test it like this:
> - first, change the type of "msg" from "pointer to character" to "array of
> characters":
> 
>   char msg[] = "Start Vgabios\n"
> 
> - second, give it automatic storage duration, rather than static storage
> duration. In English, make it local to the function containing the loop.
> Hopefully the compiler will generate code that places the string on the
> stack then, and then your loop body will (hopefully) look something like
> 
> 00000000  368A02            mov al,[ss:bp+si]
> 00000003  BA0204            mov dx,0x402
> 00000006  EE                out dx,al
> 00000007  46                inc si
> 
> (Ie. work off your stack, where ss and bp should be "just right".)
> 
> I'm just guessing of course.

Thanks a lot Laszlo,
The problem was ds as you guessed! After I set ds the same as cs, I can
see log messages correctly! And, I can start porting VirtualBox vgabios
to work on qemu.

By the way, would there be no-issue of VBox vgabios (16-bit code) working
with seaBIOS? I'm guessing not, but I want to double check.


Thanks,
Jaeyong

Re: [Qemu-devel] Where is vga-rom mapped in guest system memory?

[Laszlo Ersek]

On 05/16/14 06:19, Jaeyong Yoo wrote:

> By the way, would there be no-issue of VBox vgabios (16-bit code) working
> with seaBIOS? I'm guessing not, but I want to double check.

I presume it should "just work" (TM).

Laszlo