I am working on Minix, and we detected a problem which might be related
In short, Minix' boot monitor (first written in 1992, and which supports
80286 architectures), while in 16-bit real mode, uses BIOS service 15/87
to move blocks into high memory.
It stopped working recently with kvm on Intel.
On 03/10/2010 12:26 PM, Erik van der Kouwe wrote on kvm mailing list:
To which Avi Kivity wrote on 2010-03-10 13:03:25 +0200:
MINIX is using big real mode which is currently not
well supported by
kvm on Intel hardware:
(qemu) info registers
EIP=0000f4a7 EFL=00023002 [-------] CPL=3 II=0 A20=1 SMM=0 HLT=0
ES =0000 00000000 0000ffff 0000f300
CS =f000 000f0000 0000ffff 0000f300
SS =9492 00094920 0000ffff 0000f300
DS =97ce 00097cec 0000ffff 0000f300
A ds.base of 0x97cec cannot be translated to a real mode segment.
I searched the issue; if you are interested in the details, please read
I notice it might be related to the switch from Bochs to SeaBIOS.
3555 case 0x87:
3640 mov eax, cr0
3641 or al, #0x01
3642 mov cr0, eax
3643 ;; far jump to flush CPU queue after transition to prot. mode
3644 JMP_AP(0x0020, protected_mode)
3647 ;; GDT points to valid descriptor table, now load SS, DS, ES
3658 movsw ;; move CX words from DS:SI to ES:DI
3660 ;; make sure DS and ES limits are 64KB
3661 mov ax, #0x28
3662 mov ds, ax
3663 mov es, ax
3665 ;; reset PG bit in CR0 ???
3666 mov eax, cr0
3667 and al, #0xFE
3668 mov cr0, eax
In SeaBIOS, the applicable code is in src/system.c, and looks like
(now this is AT&T assembly):
83 static void
84 handle_1587(struct bregs *regs)
127 // Enable protected mode
128 " movl %%cr0, %%eax\n"
129 " orl $" __stringify(CR0_PE) ", %%eax\n"
130 " movl %%eax, %%cr0\n"
132 // far jump to flush CPU queue after transition to prot. mode
133 " ljmpw $(4<<3), $1f\n"
135 // GDT points to valid descriptor table, now load DS, ES
144 " rep movsw\n"
146 // Disable protected mode
147 " movl %%cr0, %%eax\n"
148 " andl $~" __stringify(CR0_PE) ", %%eax\n"
149 " movl %%eax, %%cr0\n"
Note that while the basic scheme is the same, the "cleaning up" of lines
3660-3663 "make sure DS and ES limits are 64KB" is not present.
IIUC, the virtualized CPU goes back to real mode with those segments
sets as they are in protected mode, and yes with Minix boot monitor they
happenned to NOT be paragraph-aligned. And aligning it kills the bug...
Avi Kivity seems to think this is a possible explanation; and he does
not see any harm in adding that cleaning up, while it could have the
benefical property to avoid possible faults while virtualizing the CPU
(which is a bit tricky with Intel hardware in real mode.)
Is it possible to add such "cleaning up" to SeaBIOS too?