1

I know that there are differently methods to do a reboot.

I'm working on a simple hyper-visor and I have a little problem when I want to reboot a multi-processor aware x86 Windows 7 Guest. The main steps the OS does seem to be: Task Switch - Task Switch - Triple Fault. This happens on all CPUs except one which does not initiate a Task Switch at all and hangs somewhere. The last exit I get from it is a CPUID with EAX = 1 so I really don't know (yet) where or why it does not get to do a Task Switch like all the others. I'm a bit stuck on understanding this - maybe some details about what should normally happen will help me.

What is the actual method that is used for a reboot by a x86 Windows 7?

EDIT I figured this out a few days ago, but I haven't got time to update the post. I'm not going to answer my own question because I don't think this is a full and definitive answer, but for someone who might have the same problem this will make things a bit easier.

Turns out, that the missing CPU was halted. The flow is, more ore less, this: Task Switch, Triple Fault (for n-1 CPUs) and halt (for the n-th CPU). After this there should be an init on each one and then everything is reset.

2

See my findings below based on some quick analysis in IDA, but take it all with a grain of salt. There may be other scenarios that would cause Windows 7 to reboot through other mechanisms when performing a planned reboot. Perhaps others on this site can contribute with their expertise...

At the lowest level, Windows calls hal!HalReturnToFirmware(), which calls hal!HalpReboot(), which is pretty well documented in ReactOS.

In both Windows 7 and ReactOS, the final instructions that actually cause the reboot are effectively:

mov al, 0xFE
out 0x64, al

This writes the system reset command to the keyboard controller's IO port.

  • From what I've seen there's a difference even between single processor and multi processor version (no task switch on the single CPU version). I'm not getting to the part with the keyboard controller. – user3002428 Mar 6 '15 at 6:04
  • I found it from following your links from the answer. From the source code alone it seems that only the BSP should execute that function. Is this right? – user3002428 Mar 6 '15 at 14:33
  • To confirm or disconfirm that would likely take more time than I want to invest in this ;) – Jason Geffner Mar 6 '15 at 14:35
  • The question is open if somebody knows the answer. I'll update it if I find it in the meantime. – user3002428 Mar 6 '15 at 14:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.