Bug 622350

Summary: KVM crashes inside SeaBIOS when attempting to boot MS-DOS
Product: Red Hat Enterprise Linux 6 Reporter: Cao, Chen <kcao>
Component: seabiosAssignee: Gleb Natapov <gleb>
Status: CLOSED ERRATA QA Contact: Virtualization Bugs <virt-bugs>
Severity: medium Docs Contact:
Priority: low    
Version: 6.0CC: berrange, clalance, ehabkost, extras-orphan, hpa, jasowang, jforbes, khong, knoel, llim, markmc, notting, quintela, tburke, virt-maint
Target Milestone: rcKeywords: RHELNAK
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: seabios-0.6.1-1.el6 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 616272
: 665970 (view as bug list) Environment:
Last Closed: 2011-05-19 13:04:32 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 580953, 665970    

Description Cao, Chen 2010-08-09 03:22:47 UTC 
+++ This bug was initially created as a clone of Bug #616272 +++

Description of problem:

KVM crashes when booting an MS-DOS 6.22 guest on an Intel host.  This happens inside SeaBIOS; apparently SeaBIOS puts the hardware in a state KVM can't handle.

Version-Release number of selected component (if applicable):

qemu-system-x86-0.12.3-8.fc13.x86_64

How reproducible:

Every time

Steps to Reproduce:
1. Create an MS-DOS 6.22 boot disk
2. Boot it.
  
Actual results:
kvm: unhandled exit 80000021
kvm_run returned -22

"info registers" in the Qemu console shows that the error happens inside SeaBIOS, immediately after a return to real mode.

Expected results:
MS-DOS booting.

Additional info:
Happens with both hard disk and floppy disk images.  No config.sys or autoexec.bat needed in the guest.

CPU information (x4 cores x2 threads):
vendor_id       : GenuineIntel
cpu family      : 6
model           : 26
model name      : Intel(R) Core(TM) i7 CPU         940  @ 2.93GHz
stepping        : 4
cpu MHz         : 1600.000
cache size      : 8192 KB
physical id     : 0
siblings        : 8
core id         : 0
cpu cores       : 4
apicid          : 0
initial apicid  : 0
fpu             : yes
fpu_exception   : yes
cpuid level     : 11
wp              : yes
flags           : fpu vme de pse tsc msr pae mce cx8 apic mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good xtopology nonstop_tsc aperfmperf pni dtes64 monitor ds_cpl vmx est tm2 ssse3 cx16 xtpr pdcm sse4_1 sse4_2 popcnt lahf_lm ida tpr_shadow vnmi flexpriority ept vpid       
bogomips        : 5853.09                                                                   
clflush size    : 64                                                                        
cache_alignment : 64                                                                        
address sizes   : 36 bits physical, 48 bits virtual                                         
power management:

--- Additional comment from hpa on 2010-07-26 19:08:27 EDT ---

Note: "Plain" Qemu handles the same thing fine.

--- Additional comment from hpa on 2010-07-30 21:21:18 EDT ---

(qemu) info registers
EAX=00000010 EBX=00000008 ECX=e0100000 EDX=00000508
ESI=00000020 EDI=e0100020 EBP=00000008 ESP=000004d4
EIP=0000f4a7 EFL=00000002 [-------] CPL=3 II=0 A20=1 SMM=0 HLT=0
ES =0000 00000000 0000ffff 0000f300
CS =f000 000f0000 0000ffff 0000f300
SS =8e01 0008e010 0000ffff 0000f300
DS =8ec9 0008ec96 0000ffff 0000f300
FS =0000 00000000 0000ffff 0000f300                   
GS =0000 00000000 0000ffff 0000f300
LDT=0000 00000000 0000ffff 00008200
TR =0000 feffd000 00002088 00008b00
GDT=     0008ec66 0000002f
IDT=     000f8560 00000000                            
CR0=00000010 CR2=00000000 CR3=00000000 CR4=00000000
DR0=00000000 DR1=00000000 DR2=00000000 DR3=00000000       
DR6=ffff0ff0 DR7=00000400                                 
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00000000
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000                        
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000                        
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000             
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000 XMM01=00000000000000000000000000000000
XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000
XMM04=00000000000000000000000000000000 XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
Comment 1 Cao, Chen 2010-08-09 03:24:33 UTC 
# rpm -q qemu-kvm
qemu-kvm-0.12.1.2-2.108.el6.x86_64

# uname -r
2.6.32-59.el6.x86_64

# rpm -q seabios
seabios-0.5.1-2.el6.x86_64

(qemu) info registers
EAX=00000010 EBX=00000008 ECX=42400000 EDX=00001798
ESI=00000020 EDI=42400020 EBP=00000008 ESP=00001764
EIP=0000f4a7 EFL=00000002 [-------] CPL=3 II=0 A20=1 SMM=0 HLT=0
ES =0000 00000000 0000ffff 0000f300
CS =f000 000f0000 0000ffff 0000f300
SS =8424 00084240 0000ffff 0000f300
DS =8646 00086464 0000ffff 0000f300
FS =0000 00000000 0000ffff 0000f300
GS =0000 00000000 0000ffff 0000f300
LDT=0000 00000000 0000ffff 00008200
TR =0000 feffd000 00002088 00008b00
GDT=     00086434 0000002f
IDT=     000f8370 00000000
CR0=00000010 CR2=00000000 CR3=00000000 CR4=00000000
DR0=00000000 DR1=00000000 DR2=00000000 DR3=00000000
DR6=ffff0ff0 DR7=00000400
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00000000
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000 XMM01=00000000000000000000000000000000
XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000
XMM04=00000000000000000000000000000000 XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
Comment 2 RHEL Program Management 2010-08-09 03:27:59 UTC 
This issue has been proposed when we are only considering blocker
issues in the current Red Hat Enterprise Linux release.

** If you would still like this issue considered for the current
release, ask your support representative to file as a blocker on
your behalf. Otherwise ask that it be considered for the next
Red Hat Enterprise Linux release. **
Comment 3 jason wang 2010-08-09 09:05:08 UTC 
Hello ken:
  Could you please show the output of x /i $pc after the crash?
  Thanks
Comment 4 Cao, Chen 2010-08-09 09:27:17 UTC 
(In reply to comment #3)
> Hello ken:
>   Could you please show the output of x /i $pc after the crash?
>   Thanks    

(qemu) x /i $pc
0x00000000000ff4a7:  ljmp   $0xf000,$0xf4ac
Comment 8 Eduardo Habkost 2011-01-10 21:03:03 UTC 
The patch is present on upstream 0.6.1 release, so it was automatically included when we rebased to seabios 0.6.1.
Comment 9 Keqin Hong 2011-02-23 05:22:49 UTC 
Checked on seabios-0.6.1.2-3.el6 that this patch was applied.
Since this was verified in upstream (Bug 616272#c7) and we couldn't find a valid MS-DOS 6.22 now (which is also not a RHEL officially supported OS), we only checked the patch was applied and made sure there's no regression with this patch.
Comment 11 errata-xmlrpc 2011-05-19 13:04:32 UTC 
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-0564.html