From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from [140.186.70.92] (port=37319 helo=eggs.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1Q7tnJ-0003Qi-HO
	for qemu-devel@nongnu.org; Thu, 07 Apr 2011 14:19:04 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <jljusten@gmail.com>) id 1Q7tnE-0002t1-Rq
	for qemu-devel@nongnu.org; Thu, 07 Apr 2011 14:18:57 -0400
Received: from mail-pv0-f173.google.com ([74.125.83.173]:36166)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <jljusten@gmail.com>) id 1Q7tnE-0002sd-NN
	for qemu-devel@nongnu.org; Thu, 07 Apr 2011 14:18:56 -0400
Received: by pvg3 with SMTP id 3so1192913pvg.4
	for <qemu-devel@nongnu.org>; Thu, 07 Apr 2011 11:18:55 -0700 (PDT)
MIME-Version: 1.0
In-Reply-To: <4D9DE166.9080001@codemonkey.ws>
References: <BANLkTiniHnWOAhhs4kz60dWOnVPO1x0GBw@mail.gmail.com>
	<4D9DBC05.8010400@codemonkey.ws> <20110407153106.GA7100@redhat.com>
	<4D9DDB80.8090905@codemonkey.ws> <20110407155142.GB7100@redhat.com>
	<4D9DE166.9080001@codemonkey.ws>
Date: Thu, 7 Apr 2011 11:18:54 -0700
Message-ID: <BANLkTi=vWeaF2-3-AbxX4NFR5mpJrO4aUw@mail.gmail.com>
Subject: Re: [Qemu-devel] How does the QEMU load the binary files bios.bin and
	vgabios-cirrus.bin?
From: Jordan Justen <jljusten@gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Anthony Liguori <anthony@codemonkey.ws>
Cc: Bei Guan <gbtju85@gmail.com>, Gleb Natapov <gleb@redhat.com>, QEMU Developers <qemu-devel@nongnu.org>

On Thu, Apr 7, 2011 at 09:08, Anthony Liguori <anthony@codemonkey.ws> wrote=
:
> On 04/07/2011 10:51 AM, Gleb Natapov wrote:
>> That may seams to be impossible but it is how HW works. And this is how
>> QEMU emulates it. Look at target-i386/helper.c:cpu_reset()
>>
>> =A0 =A0 cpu_x86_load_seg_cache(env, R_CS, 0xf000, 0xffff0000, 0xffff,
>> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0DESC_P_MASK | DES=
C_S_MASK | DESC_CS_MASK |
>> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0DESC_R_MASK | DES=
C_A_MASK);
>>
>> =A0 =A0 env->eip =3D 0xfff0;
>>
>> Don't know how a20 gate is handled btw.
>
> I see that we use 0xf0000 in the kernel but this is because of a limitati=
on
> of VMX.

I recently noticed that kvm does this.  It does not seem to be a big
deal as firmware can easily deal with it, but I did find it odd that
kvm had the csbase of 0xf0000 as processors generally use a csbase of
0xffff0000 initially.  (At least, this is what I've seen with Intel
processors for the past 12 years.)

How can this limitation exist with VMX if mode transitions are
supported, in which case this type of csbase vs. real-mode segment
mismatch can easily occur?

> I guess when 32-bit was introduced, this behavior was added.
>
>>> The CS base starts out at 0xf0000 and IP is 0xfff0. =A0That gives a
>>> real address of 0xffff0. =A0This is usually a trampoline to somewhere
>>> else in the space.
>>
>> CS descriptor and CS selector don't have to be in sync (big real mode).
>
> Indeed.

Another place this will often be seen is SMM, as the SMBASE can easily
be > 1MB, but the SMM entry is in 16 bit mode.

-Jordan