[Qemu-discuss] HDD emulation in QEMU

Good day

Our team research real BIOS actions during system boot. We use QEMU as a platform for our work. We set BIOS binary file as a QEMU bios and run emulator. After some work (we hope send our changes into upstream after work) we can see the BIOS logo, RAM test result and invitation to BIOS setup. And now we faced with a trouble: BIOS doesn't see a bootable drive.

Of course we set drive in run script:

...

-cdrom ./OS_IMG.iso \

-hda ./qemu_vm.img

...

.img image created by QEMU, and .iso image has been tested and can be used as bootable CD in VirtualBox and QEMU.

We tried to switch HDD type in BIOS setupL ahci sata / native ide /legacy ide, but it had no effect.

At each run BIOS show

IDE drive 0 master not found

IDE drive 0 slave not found

.....

We make additional log output for understand the situation.

We sew multiple read and write requests in PCI AHCI areas (D31:F2 and D31:F5). Adresses during read: 0x92, 0xf, 0x0, 0x1, 0x43, 0x92

BIOS try to write into this areas. It is like that:

AHCI PCI config write: addr=0x90, val=0, len=1

AHCI PCI config write: addr=0x94, val=0x800193, len=4

AHCI PCI config write: addr=0xa0, val=0x40, len=1

AHCI PCI config write: addr=0xa4, val=0x220000, len=4

AHCI PCI config write: addr=0xa0, val=0x78, len=1

AHCI PCI config write: addr=0xa4, val=0x220000, len=4

AHCI PCI config write: addr=0xa0, val=0x94, len=1

AHCI PCI config write: addr=0xa4, val=0x220022, len=4

AHCI PCI config write: addr=0xa0, val=0x88, len=1

AHCI PCI config write: addr=0xa4, val=0, len=4

AHCI PCI config write: addr=0xa0, val=0x8c, len=1

AHCI PCI config write: addr=0xa4, val=0x90900aa, len=4

AHCI PCI config write: addr=0xa0, val=0xa8, len=1

AHCI PCI config write: addr=0xa4, val=0x9240082, len=4

AHCI PCI config write: addr=0xa0, val=0xac, len=1

AHCI PCI config write: addr=0xa4, val=0x909008a, len=4

AHCI PCI config write: addr=0xa0, val=0x18, len=1

AHCI PCI config write: addr=0xa4, val=0x909001b, len=4

AHCI PCI config write: addr=0xa0, val=0x28, len=1

AHCI PCI config write: addr=0xa4, val=0x90d001b, len=4

AHCI PCI config write: addr=0xa0, val=0x84, len=1

AHCI PCI config write: addr=0xa4, val=0x90d001b, len=4

AHCI PCI config write: addr=0xa0, val=0xa0, len=1

AHCI PCI config write: addr=0xa4, val=0x90d001b, len=4

AHCI PCI config write: addr=0xa0, val=0, len=1

AHCI PCI config write: addr=0xa4, val=0x90d001b, len=4

AHCI PCI config write: addr=0x92, val=0, len=2

AHCI PCI config write: addr=0x92, val=0xf, len=2

AHCI PCI config write: addr=0x92, val=0xf, len=1

AHCI PCI config write: addr=0x90, val=0, len=1

AHCI PCI config write: addr=0x41, val=0x80, len=1

AHCI PCI config write: addr=0x43, val=0x80, len=1

AHCI PCI config write: addr=0x9, val=0xf, len=1

AHCI PCI config write: addr=0x2c, val=0xb0021458, len=4

AHCI PCI config write: addr=0, val=0xffff, len=2

AHCI PCI config write: addr=0xc, val=0x8008, len=2

AHCI PCI config write: addr=0x4, val=0x7, len=1

AHCI PCI config write: addr=0x20, val=0xf001, len=4

AHCI PCI config write: addr=0x92, val=0xf0e, len=2

AHCI PCI config write: addr=0x92, val=0xe0f, len=2

AHCI PCI config write: addr=0x92, val=0xf0d, len=2

AHCI PCI config write: addr=0x92, val=0xd0f, len=2

AHCI PCI config write: addr=0x92, val=0xf0b, len=2

AHCI PCI config write: addr=0x92, val=0xb0f, len=2

AHCI PCI config write: addr=0x92, val=0xf07, len=2

AHCI PCI config write: addr=0x92, val=0x70f, len=2

AHCI PCI config write: addr=0x92, val=0x8f0f, len=2

AHCI PCI config write: addr=0x44, val=0, len=1

AHCI PCI config write: addr=0x55, val=0, len=1

AHCI PCI config write: addr=0x54, val=0, len=1

AHCI PCI config write: addr=0x44, val=0, len=1

AHCI PCI config write: addr=0x55, val=0, len=1

AHCI PCI config write: addr=0x54, val=0, len=1

AHCI PCI config write: addr=0x30, val=0, len=4

AHCI PCI config write: addr=0x4, val=0x7, len=2

AHCI PCI config write: addr=0x30, val=0xf1000001, len=4

AHCI PCI config write: addr=0x30, val=0, len=4

AHCI PCI config write: addr=0x90, val=0, len=1

AHCI PCI config write: addr=0x94, val=0x800193, len=4

AHCI PCI config write: addr=0xa0, val=0x40, len=1

AHCI PCI config write: addr=0xa4, val=0x922001b, len=4

AHCI PCI config write: addr=0xa0, val=0x78, len=1

AHCI PCI config write: addr=0xa4, val=0x922001b, len=4

AHCI PCI config write: addr=0xa0, val=0x94, len=1

AHCI PCI config write: addr=0xa4, val=0x9220022, len=4

AHCI PCI config write: addr=0xa0, val=0x88, len=1

AHCI PCI config write: addr=0xa4, val=0, len=4

AHCI PCI config write: addr=0xa0, val=0x8c, len=1

AHCI PCI config write: addr=0xa4, val=0x90900aa, len=4

AHCI PCI config write: addr=0xa0, val=0xa8, len=1

AHCI PCI config write: addr=0xa4, val=0x9240082, len=4

AHCI PCI config write: addr=0xa0, val=0xac, len=1

AHCI PCI config write: addr=0xa4, val=0x909008a, len=4

AHCI PCI config write: addr=0xa0, val=0x18, len=1

AHCI PCI config write: addr=0xa4, val=0x909001b, len=4

AHCI PCI config write: addr=0xa0, val=0x28, len=1

AHCI PCI config write: addr=0xa4, val=0x90d001b, len=4

AHCI PCI config write: addr=0xa0, val=0x84, len=1

AHCI PCI config write: addr=0xa4, val=0x90d001b, len=4

AHCI PCI config write: addr=0xa0, val=0xa0, len=1

AHCI PCI config write: addr=0xa4, val=0x90d001b, len=4

AHCI PCI config write: addr=0xa0, val=0, len=1

AHCI PCI config write: addr=0xa4, val=0x90d001b, len=4

AHCI PCI config write: addr=0x92, val=0x8f0f, len=2

AHCI PCI config write: addr=0x92, val=0xf, len=1

AHCI PCI config write: addr=0x90, val=0, len=1

AHCI PCI config write: addr=0x41, val=0x80, len=1

AHCI PCI config write: addr=0x43, val=0x80, len=1

AHCI PCI config write: addr=0x2c, val=0xb0021458, len=4

AHCI PCI config write: addr=0, val=0xffff, len=2

AHCI PCI config write: addr=0xc, val=0x8008, len=2

AHCI PCI config write: addr=0x4, val=0x7, len=1

AHCI PCI config write: addr=0x20, val=0xf001, len=4

AHCI PCI config write: addr=0x92, val=0x8f0e, len=2

AHCI PCI config write: addr=0x92, val=0x8e0f, len=2

AHCI PCI config write: addr=0x92, val=0x8f0d, len=2

AHCI PCI config write: addr=0x92, val=0x8d0f, len=2

AHCI PCI config write: addr=0x92, val=0x8f0b, len=2

AHCI PCI config write: addr=0x92, val=0x8b0f, len=2

AHCI PCI config write: addr=0x92, val=0x8f07, len=2

AHCI PCI config write: addr=0x92, val=0x870f, len=2

AHCI PCI config write: addr=0x92, val=0x8f0f, len=2

Also BIOS try to use HDC IO ports:

Write:

AHCI: HDC 0 write addr 0x2 val 0xa size 1

AHCI: HDC 0 write addr 0x2 val 0x5 size 1

AHCI: HDC 0 write addr 0x4 val 0xaa size 1

AHCI: HDC 0 write addr 0x6 val 0xa0 size 1

AHCI: HDC 0 write addr CTRL REG val 0xc size 1

AHCI: HDC 0 write addr CTRL REG val 0x8 size 1

AHCI: HDC 0 write addr 0x6 val 0xa0 size 1

AHCI: HDC 0 write addr 0x6 val 0xb0 size 1

AHCI: HDC 0 write addr 0x6 val 0xa0 size 1

AHCI: HDC 0 write addr 0x6 val 0xb0 size 1

AHCI: HDC 0 write addr 0x6 val 0xa0 size 1

AHCI: HDC 0 write addr 0x6 val 0xb0 size 1

AHCI: HDC 0 write addr 0x6 val 0xa0 size 1

AHCI: HDC 0 write addr 0x6 val 0xb0 size 1

AHCI: HDC 0 write addr 0x2 val 0xa size 1

AHCI: HDC 0 write addr 0x2 val 0x5 size 1

AHCI: HDC 0 write addr 0x6 val 0xa0 size 1

AHCI: HDC 0 write addr 0x4 val 0xaa size 1

AHCI: HDC 0 write addr 0x6 val 0xa0 size 1

AHCI: HDC 0 write addr CTRL REG val 0xc size 1

AHCI: HDC 0 write addr CTRL REG val 0x8 size 1

AHCI: HDC 0 write addr 0x6 val 0xa0 size 1

AHCI: HDC 0 write addr 0x6 val 0xb0 size 1

And multiple read with offset 1f7 (CONTROL/STATUS):

AHCI: HDC 0 read addr 0x7 size 1 val = 0x40

As you can see we add 1<<6 bit during our serch. We try set "Ready" bit, but it led to hang up.

We noticed that it was not transmit any command to the hard disk (spin up, read data/ write data or anything else)

Can anyone tell what is missing in QEMU to get started with hdd? Or: what is the bios sign of willingness to HDD?

From:	Maksim Ratnikov
Subject:	[Qemu-discuss] HDD emulation in QEMU
Date:	Thu, 29 Sep 2016 02:48:26 +0300