Check whenever pnp roms attempt to redirect int19, and in case it does
log a message and undo the redirect.
A pnp rom should not need this, we have BEVs and BCVs for that.
Nevertheless there are roms in the wild which are redirecting int19.
At least some BIOS implementations for physical hardware have a config
option in the setup to allow/disallow int19 redirections, so just not
allowing this seems to be the way to deal with this situation.
Buglink: https://bugzilla.redhat.com//show_bug.cgi?id=1642135
Signed-off-by: Gerd Hoffmann <kraxel(a)redhat.com>
---
src/optionroms.c | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
diff --git a/src/optionroms.c b/src/optionroms.c
index fc992f649f..4ec5504ca9 100644
--- a/src/optionroms.c
+++ b/src/optionroms.c
@@ -8,6 +8,7 @@
#include "bregs.h" // struct bregs
#include "config.h" // CONFIG_*
#include "farptr.h" // FLATPTR_TO_SEG
+#include "biosvar.h" // GET_IVT
#include "hw/pci.h" // pci_config_readl
#include "hw/pcidevice.h" // foreachpci
#include "hw/pci_ids.h" // PCI_CLASS_DISPLAY_VGA
@@ -136,9 +137,24 @@ init_optionrom(struct rom_header *rom, u16 bdf, int isvga)
tpm_option_rom(newrom, rom->size * 512);
- if (isvga || get_pnp_rom(newrom))
+ struct pnp_data *pnp = get_pnp_rom(newrom);
+ if (isvga || pnp) {
+ struct segoff_s old19, new19;
// Only init vga and PnP roms here.
+ old19 = GET_IVT(0x19);
callrom(newrom, bdf);
+ new19 = GET_IVT(0x19);
+ if (old19.seg != new19.seg ||
+ old19.offset != new19.offset) {
+ dprintf(1, "WARNING! rom tried to hijack int19 "
+ "(vec %04x:%04x, pnp %s, bev %s, bvc %s)\n",
+ new19.seg, new19.offset,
+ pnp ? "yes" : "no",
+ pnp && pnp->bev ? "yes" : "no",
+ pnp && pnp->bcv ? "yes" : "no");
+ SET_IVT(0x19, old19);
+ }
+ }
return rom_confirm(newrom->size * 512);
}
--
2.9.3
According to SMBIOS Specification, section 6.1.3 Text Strings:
"Text strings associated with a given SMBIOS structure are returned in
the dmiStructBuffer, appended directly after the formatted portion of the
structure. This method of returning string information eliminates the
need for application software to deal with pointers embedded in the
SMBIOS structure. Each string is terminated with a null (00h) BYTE and
the set of strings is terminated with an additional null (00h) BYTE”
Furthermore:
"If the formatted portion of the structure contains string-reference
fields and all the string fields are set to 0 (no string references),
the formatted section of the structure is followed by two null (00h)
BYTES"
From the above it can be seen that any SMBIOS type which contains string
references should end with an additional zero byte.
This is currently handled in all SMBIOS types which use
load_str_field_with_default() besides type0.
Therefore, add the missing zero byte to SMBIOS Type 0.
Running QEMU with:
-machine pc-i440fx-2.0 (for legacy smbios)
-smbios type=0,vendor=,version=,date= (for zero str_index)
Will cause SMBIOS type0 entry to overrun type1 entry.
Reviewed-by: Ross Philipson <ross.philipson(a)oracle.com>
Reviewed-By: Liran Alon <liran.alon(a)oracle.com>
Signed-off-by: Sam Eiderman <shmuel.eiderman(a)oracle.com>
---
src/fw/smbios.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/fw/smbios.c b/src/fw/smbios.c
index f3b5ad9d..62a563b2 100644
--- a/src/fw/smbios.c
+++ b/src/fw/smbios.c
@@ -205,6 +205,10 @@ smbios_init_type_0(void *start)
*end = 0;
end++;
+ if (!str_index) {
+ *end = 0;
+ end++;
+ }
return end;
}
--
2.13.3
When I kexec either Xen or Linux in real mode, from either Xen or
Linux, it fails.
The last thing I see looks like SeaBIOS trying to use SMM for call32:
----------------
IN:
0x00000000000f70ec: mov %eax,%esi
0x00000000000f70ef: mov $0xb5,%eax
0x00000000000f70f5: mov $0x1234,%ecx
0x00000000000f70fb: mov $0xef3dc,%ebx
0x00000000000f7101: out %al,$0xb2
0x00000000000f7103: pause
----------------
IN:
0x00000000000ef3db: hlt
This happens when the real mode boot code calls INT 13h to read from
the disk. It seems to happen with virtio and SATA disks.
This is with the Ubuntu-packaged 1.10.2-1ubuntu1 SeaBIOS. Switching to
an IDE disk, or booting with 'edd=skipmbr', makes Xen work and Linux
get a little further before it dies anyway.
