[SeaBIOS] qemu-kvm: SeaBIOS 1.9.0 and above cannot boot Windows 10 from harddisk

[Paolo Bonzini]

On 26/04/2016 23:41, Kevin O'Connor wrote:
> It appears the fault is occurring in the OS bootloader, not in the
> SeaBIOS code.
> 
> [...]
>>>> > >> QEMU output with SeaBIOS 1.9.0 and above:
>>> > > 
>>> > > Did it work with some prior version of SeaBIOS?
>> > 
>> > Yes. Tested it with the default version (1.7.2.2) of my distribution,
>> > 1.8.0, 1.8.1 and version 1.8.2.
> It's odd that it works with a different SeaBIOS version.  You could
> try bisecting between 1.8.0 and 1.9.2 to see what change the crash
> starts at - but be aware that random differences in the SeaBIOS binary
> might be tickling the underlying issue.

I second this, but the root cause is that you need a new kernel or a new
processor.  Your processor doesn't know how to run code running in "big
real mode" (you can see that you are in big real mode from the
"ffffffff" in the dump on the lines between "ES" and "GS").  Your kernel
has to emulate that code instruction by instruction, but it doesn't know
how to emulate one particular instruction used by Windows, sahf.  This
instruction was added to kernel 3.13 in the following commit:

    commit 98f73630f96f1a6d8c845b8b3e5f9ae532cf82d1
    Author: Paolo Bonzini <pbonzini at redhat.com>
    Date:   Thu Oct 31 11:19:42 2013 +0100

    KVM: x86: emulate SAHF instruction

    Yet another instruction that we fail to emulate, this time found
    in Windows 2008R2 32-bit.

    Reviewed-by: Gleb Natapov <gleb at redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

> You could also try reporting to the kvm list - they'll know how to
> interpret the cpu dump.

FWIW, the code dump disassembles to the following:

...
00000007  681A00            push word 0x1a
0000000A  B448              mov ah,0x48
0000000C  8A160E00          mov dl,[0xe]
00000010  8BF4              mov si,sp
00000012  16                push ss
00000013  1F                pop ds
00000014  CD13              int 0x13
00000016  9F                lahf
00000017  83C418            add sp,byte +0x18
0000001A  9E                sahf
0000001B  58                pop ax
0000001C  1F                pop ds
0000001D  72E1              jc 0
0000001F  3B060B00          cmp ax,[0xb]
00000023  75DB              jnz 0
00000025  A30F00            mov [0xf],ax
00000028  C12E0F0004        shr word [0xf],byte 0x4
0000002D  1E                push ds
0000002E  5A                pop dx
...

Thanks,

Paolo