Re: [Qemu-devel] How does the QEMU load the binary files bios.bin and vgabios-cirrus.bin?

[Jordan Justen]

On Thu, Apr 7, 2011 at 09:08, Anthony Liguori <address@hidden> wrote:
> On 04/07/2011 10:51 AM, Gleb Natapov wrote:
>> That may seams to be impossible but it is how HW works. And this is how
>> QEMU emulates it. Look at target-i386/helper.c:cpu_reset()
>>
>>     cpu_x86_load_seg_cache(env, R_CS, 0xf000, 0xffff0000, 0xffff,
>>                            DESC_P_MASK | DESC_S_MASK | DESC_CS_MASK |
>>                            DESC_R_MASK | DESC_A_MASK);
>>
>>     env->eip = 0xfff0;
>>
>> Don't know how a20 gate is handled btw.
>
> I see that we use 0xf0000 in the kernel but this is because of a limitation
> of VMX.

I recently noticed that kvm does this.  It does not seem to be a big
deal as firmware can easily deal with it, but I did find it odd that
kvm had the csbase of 0xf0000 as processors generally use a csbase of
0xffff0000 initially.  (At least, this is what I've seen with Intel
processors for the past 12 years.)

How can this limitation exist with VMX if mode transitions are
supported, in which case this type of csbase vs. real-mode segment
mismatch can easily occur?

> I guess when 32-bit was introduced, this behavior was added.
>
>>> The CS base starts out at 0xf0000 and IP is 0xfff0.  That gives a
>>> real address of 0xffff0.  This is usually a trampoline to somewhere
>>> else in the space.
>>
>> CS descriptor and CS selector don't have to be in sync (big real mode).
>
> Indeed.

Another place this will often be seen is SMM, as the SMBASE can easily
be > 1MB, but the SMM entry is in 16 bit mode.

-Jordan