SeaBIOS February 2024

seabios@seabios.org

9 participants
8 discussions

[PATCH] fix smbios blob length overflow
by Igor Mammedov 03 Mar '24

03 Mar '24

When tables are more than 64K, size of copied tables will be truncated due to cast from u32 to u16, and as result only a small portion of the tables will be copied in the end. That leads to corrupted tables (a part from QEMU and remainder is whatever was in memory block allocated for the tables). Fix it by making qtables_len 32bit int. Signed-off-by: Igor Mammedov <imammedo(a)redhat.com> --- src/fw/biostables.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/fw/biostables.c b/src/fw/biostables.c index 1c09a785..90712d4b 100644 --- a/src/fw/biostables.c +++ b/src/fw/biostables.c @@ -499,7 +499,7 @@ smbios_build_tables(struct romfile_s *f_tables, u16 *number_of_structures) { struct smbios_type_0 *t0; - u16 qtables_len, need_t0 = 1; + u32 qtables_len, need_t0 = 1; u8 *qtables, *tables; if (f_tables->size != *length) -- 2.39.3

2 2

[PATCH v2 2/2] Add basic MXM 3.0 interrupt support
by Riku Viitanen 27 Feb '24

27 Feb '24

VGAROMs on MXM graphics cards need certain int15h functions present, to function properly. On HP EliteBook 8560w with coreboot and Quadro 2000M, this warning is displayed for 30 seconds, making every boot extremely slow: ERROR: Valid MXM Structure not found POST halted for 30 seconds, P-state limited to P10... This patch implements the minimum functionality to get rid of it: the functions 0 and 1, version 3.0 of the specification [1]. Older version 2.1 is not implemented. Functions are enabled only if romfile "mxm-30-sis" exists. These functios are specific to the MXM revision, but not the board or GPU. Some boards might require more of the optional functions to be implemented, however. - Function 0 returns information about supported functions and revision. - Function 1 returns a pointer to a MXM configuration structure in low memory. This is copied from romfile "mxm-30-sis". TEST: HP EliteBook 8560w boots without error and delay, graphics work. [1]: MXM Graphics Module Software Specification Version 3.0, Revision 1.1 [2]: https://codeberg.org/Riku_V/mxmdump/ Signed-off-by: Riku Viitanen <riku.viitanen(a)protonmail.com> --- src/optionroms.c | 8 ++++++ src/vgahooks.c | 70 ++++++++++++++++++++++++++++++++++++++++++++++++ src/vgahooks.h | 8 ++++++ 3 files changed, 86 insertions(+) create mode 100644 src/vgahooks.h diff --git a/src/optionroms.c b/src/optionroms.c index e906ab97..4e6a1ad1 100644 --- a/src/optionroms.c +++ b/src/optionroms.c @@ -22,6 +22,7 @@ #include "string.h" // memset #include "util.h" // get_pnp_offset #include "tcgbios.h" // tpm_* +#include "vgahooks.h" // MXM30SIS static int EnforceChecksum, S3ResumeVga, RunPCIroms; @@ -463,6 +464,13 @@ vgarom_setup(void) RunPCIroms = romfile_loadint("etc/pci-optionrom-exec", 2); ScreenAndDebug = romfile_loadint("etc/screen-and-debug", 1); + // Load MXM 3.0 System Information Structure, if it exists + void *mxm_sis = romfile_loadfile_low("mxm-30-sis", NULL); + if (mxm_sis) + MXM30SIS = (u32)mxm_sis; + else + MXM30SIS = 0; + // Clear option rom memory memset((void*)BUILD_ROM_START, 0, rom_get_max() - BUILD_ROM_START); diff --git a/src/vgahooks.c b/src/vgahooks.c index 1f149532..25e91f20 100644 --- a/src/vgahooks.c +++ b/src/vgahooks.c @@ -18,8 +18,10 @@ #define VH_VIA 1 #define VH_INTEL 2 #define VH_SMI 3 +#define VH_MXM 4 int VGAHookHandlerType VARFSEG; +u32 MXM30SIS VARFSEG; static void handle_155fXX(struct bregs *regs) @@ -296,6 +298,71 @@ winent_mb6047_setup(struct pci_device *pci) SmiBootDisplay = 0x02; } +/**************************************************************** + * MXM VGA hooks + ****************************************************************/ + +// Function 0: Return Specification Support Level +static void +mxm_V30_F00(struct bregs *regs) +{ + regs->ax = 0x005f; // Success + regs->bl = 0x30; // MXM 3.0 + regs->cx = 0x0003; // Supported Functions + set_success(regs); +} + +// Function 1: Return a Pointer to the MXM Structure +static void +mxm_V30_F01(struct bregs *regs) +{ + switch (regs->cx) { + case 0x0030: + regs->ax = 0x005f; // Success + regs->es = GET_GLOBAL(MXM30SIS)/16; + regs->di = GET_GLOBAL(MXM30SIS)%16; + set_success(regs); + break; + default: + handle_155fXX(regs); + break; + } +} + +static void +mxm_V30(struct bregs *regs) +{ + switch (regs->bx) { + case 0xff00: mxm_V30_F00(regs); break; + case 0xff01: mxm_V30_F01(regs); break; + default: handle_155fXX(regs); break; + } +} + +static void +mxm_155f80(struct bregs *regs) +{ + // TODO: implement other versions, like 2.1 + mxm_V30(regs); +} + +static void +mxm_155f(struct bregs *regs) +{ + switch (regs->al) { + case 0x80: mxm_155f80(regs); break; + default: handle_155fXX(regs); break; + } +} + +void +mxm_setup(void) +{ + VGAHookHandlerType = VH_MXM; +} + + + /**************************************************************** * Entry and setup ****************************************************************/ @@ -313,6 +380,7 @@ handle_155f(struct bregs *regs) switch (htype) { case VH_VIA: via_155f(regs); break; case VH_INTEL: intel_155f(regs); break; + case VH_MXM: mxm_155f(regs); break; default: handle_155fXX(regs); break; } } @@ -352,4 +420,6 @@ vgahook_setup(struct pci_device *pci) via_setup(pci); else if (pci->vendor == PCI_VENDOR_ID_INTEL) intel_setup(pci); + else if (GET_GLOBAL(MXM30SIS)) + mxm_setup(); } diff --git a/src/vgahooks.h b/src/vgahooks.h new file mode 100644 index 00000000..c9113714 --- /dev/null +++ b/src/vgahooks.h @@ -0,0 +1,8 @@ +#ifndef __VGAHOOKS_H +#define __VGAHOOKS_H + +#include "types.h" // u32 + +extern u32 MXM30SIS; + +#endif // vgahooks.h -- 2.43.2

3 6

Regression 32bit Kernel + Virtio-scsi
by Max Tottenham 26 Feb '24

26 Feb '24

Hi Folks The commits between be848676..a6ed6b701 appear to break QEMU guests using a 32bit kernel when booting from virtio_scsi devices. I end up seeing the following in dmesg: [ 2.016642] virtio_scsi: probe of virtio0 failed with error -2 Notably - I've tried modifying the amount of RAM the geust boots with, based on the comments in the commit messages, PAE *is* also enabled in the guest kernel (the kernel v6.1.76). qemu-system-x86_64 .... -m 2048M - Guest boots fine qemu-system-x86_64 .... -m 4095M - Guest does not boot. In the latter case I still see the 64 bit address space being used in the BIOS debug log in the latter case: 00.006: === PCI bus & bridge init === 00.006: PCI: pci_bios_init_bus_rec bus = 0x0 00.007: === PCI device probing === 00.007: Found 8 PCI devices (max PCI bus is 00) 00.008: PCIe: using q35 mmconfig at 0xb0000000 00.008: === PCI new allocation pass #1 === 00.008: PCI: check devices 00.009: === PCI new allocation pass #2 === 00.009: PCI: IO: c000 - c11f 00.009: PCI: 32: 00000000c0000000 - 00000000fec00000 00.009: PCI: 64: 0000380000000000 - 0000380040000000 00.009: PCI: map device bdf=00:02.0 bar 4, addr 380000000000, size 00004000 [prefmem] 00.010: PCI: map device bdf=00:03.0 bar 4, addr 380000004000, size 00004000 [prefmem] 00.010: PCI: map device bdf=00:04.0 bar 4, addr 380000008000, size 00004000 [prefmem] 00.010: PCI: map device bdf=00:02.0 bar 0, addr 0000c000, size 00000040 [io] 00.011: PCI: map device bdf=00:03.0 bar 0, addr 0000c040, size 00000040 [io] 00.011: PCI: map device bdf=00:04.0 bar 0, addr 0000c080, size 00000040 [io] 00.011: PCI: map device bdf=00:1f.3 bar 4, addr 0000c0c0, size 00000040 [io] 00.011: PCI: map device bdf=00:1f.2 bar 4, addr 0000c100, size 00000020 [io] 00.012: PCI: map device bdf=00:04.0 bar 6, addr feb80000, size 00040000 [mem] 00.012: PCI: map device bdf=00:01.0 bar 6, addr febc0000, size 00010000 [mem] 00.012: PCI: map device bdf=00:01.0 bar 2, addr febd0000, size 00001000 [mem] 00.012: PCI: map device bdf=00:02.0 bar 1, addr febd1000, size 00001000 [mem] 00.013: PCI: map device bdf=00:03.0 bar 1, addr febd2000, size 00001000 [mem] 00.013: PCI: map device bdf=00:04.0 bar 1, addr febd3000, size 00001000 [mem] 00.013: PCI: map device bdf=00:1f.2 bar 5, addr febd4000, size 00001000 [mem] 00.013: PCI: map device bdf=00:01.0 bar 0, addr fd000000, size 01000000 [prefmem] 00.014: PCI: init bdf=00:00.0 id=8086:29c0 00.014: PCI: init bdf=00:01.0 id=1234:1111 00.014: PCI: init bdf=00:02.0 id=1af4:1004 00.015: PCI: init bdf=00:03.0 id=1af4:1004 00.016: PCI: init bdf=00:04.0 id=1af4:1000 I'm happy to help test/provide more logs if they are useful. -- Max Tottenham | Senior Software Engineer /(* Akamai Technologies

2 3

[PATCH v2 1/2] Add romfile_loadfile_low
by Riku Viitanen 23 Feb '24

23 Feb '24

Useful for MXM structures for example: it needs to be in low memory, since the VGA BIOS needs to access it in real mode. Signed-off-by: Riku Viitanen <riku.viitanen(a)protonmail.com> --- src/romfile.c | 30 ++++++++++++++++++++++++++++++ src/romfile.h | 1 + 2 files changed, 31 insertions(+) diff --git a/src/romfile.c b/src/romfile.c index b598274e..5d80d809 100644 --- a/src/romfile.c +++ b/src/romfile.c @@ -78,6 +78,36 @@ romfile_loadfile(const char *name, int *psize) return data; } +// Helper function to find, malloc_low, and copy a romfile. +void * +romfile_loadfile_low(const char *name, int *psize) +{ + struct romfile_s *file = romfile_find(name); + if (!file) + return NULL; + + int filesize = file->size; + if (!filesize) + return NULL; + + char *data = malloc_low(filesize); + if (!data) { + warn_noalloc(); + return NULL; + } + + dprintf(5, "Copying romfile '%s' (len %d) to low memory\n", + name, filesize); + int ret = file->copy(file, data, filesize); + if (ret < 0) { + free(data); + return NULL; + } + if (psize) + *psize = filesize; + return data; +} + // Attempt to load an integer from the given file - return 'defval' // if unsuccessful. u64 diff --git a/src/romfile.h b/src/romfile.h index 3e0f8200..70111ac2 100644 --- a/src/romfile.h +++ b/src/romfile.h @@ -14,6 +14,7 @@ void romfile_add(struct romfile_s *file); struct romfile_s *romfile_findprefix(const char *prefix, struct romfile_s *prev); struct romfile_s *romfile_find(const char *name); void *romfile_loadfile(const char *name, int *psize); +void *romfile_loadfile_low(const char *name, int *psize); u64 romfile_loadint(const char *name, u64 defval); void const_romfile_add_int(char *name, u32 value); -- 2.43.2

1 0

an issue with win10 boot and different compiler versions
by Michael Tokarev 21 Feb '24

21 Feb '24

Hi! I come across an old qemu issue today, https://gitlab.com/qemu-project/qemu/-/issues/1115 . It seemed interesting, and since I do have several test win10 guests handy, I tested it with qemu built from tag v7.1.0. And observed the described behavior. After digging deeper, it turns out the same bios, compiled using different gcc, produces either good or broken binaries. It is not the seabios itself, the diff is the gcc version. In particular, on debian bookworm, gcc-12 produces seabios which breaks win10 boot. While on debian sid, gcc-13 produces working seabios from the same source. Everything else can be anything - any qemu version, any seabios version, - any combination. Giving any combination, compile bios with gcc from bookworm - win10 does not boot; compile this same bios using gcc from sid - it works. The binary in question is vgabios-stdvga.bin. I tried compiling vgabios-stdvga.bin with gcc-11, - this one produces broken binary too. This goes up to qemu version 8.1.0, and from where, version of compiler used to build seabios does not matter anymore. This is a past already, yet it's a quite interesting (to me anyway) observation. Something was (or maybe still is?) quite fragile here. Maybe it's a good idea to do some bisections, at least to find out when qemu started working again with "broken" bios, to understand the issue better. FWIW. Thanks, /mjt

6 12

Re: [PATCH 1/2] romfile: implement a generic loader
by Riku Viitanen 14 Feb '24

14 Feb '24

> I'd suggest to add a romfile_loadfile_low() I can definitely do that. > or add a 'struct zone_s' > parameter instead of passing in a function pointer. Sounds sensible. I see there's a malloc that takes zone as argument. > Also: What the trailing bytes are used for? Only for re-implementing the existing loadfile function, to reduce copy-pasted code.

1 0

[PATCH 1/2] romfile: implement a generic loader
by Riku Viitanen 14 Feb '24

14 Feb '24

romfile_loadfile_g: Based on romfile_loadfile but more flexible. User has to supply pointer to a malloc function and the number of trailing padding bytes. Thus, any memory region may be used. romfile_loadfile: It is now a wrapper around romfile_loadfile_g. Functionality is the same. Signed-off-by: Riku Viitanen <riku.viitanen(a)protonmail.com> --- src/romfile.c | 25 ++++++++++++++++++++----- src/romfile.h | 2 ++ 2 files changed, 22 insertions(+), 5 deletions(-) diff --git a/src/romfile.c b/src/romfile.c index b598274e..8bf95713 100644 --- a/src/romfile.c +++ b/src/romfile.c @@ -47,10 +47,12 @@ romfile_find(const char *name) return __romfile_findprefix(name, strlen(name) + 1, NULL); } -// Helper function to find, malloc_tmphigh, and copy a romfile. This -// function adds a trailing zero to the malloc'd copy. +// Generic function to find romfile, malloc (using provided function +// pointer), and copy a romfile. add_len specifies how many additional +// trailing bytes to reserve. The extra bytes will not be initialised. void * -romfile_loadfile(const char *name, int *psize) +romfile_loadfile_g(const char *name, int *psize, + void *(*malloc_fn)(), int add_len) { struct romfile_s *file = romfile_find(name); if (!file) @@ -60,7 +62,7 @@ romfile_loadfile(const char *name, int *psize) if (!filesize) return NULL; - char *data = malloc_tmphigh(filesize+1); + char *data = malloc_fn(filesize+add_len); if (!data) { warn_noalloc(); return NULL; @@ -74,7 +76,20 @@ romfile_loadfile(const char *name, int *psize) } if (psize) *psize = filesize; - data[filesize] = '\0'; + + return data; +} + +// Helper function to find, malloc_tmphigh, and copy a romfile. This +// function adds a trailing zero to the malloc'd copy. +void * +romfile_loadfile(const char *name, int *psize) +{ + char *data = romfile_loadfile_g(name, psize, &malloc_tmphigh, 1); + if (!data) + return NULL; + + data[*psize] = '\0'; return data; } diff --git a/src/romfile.h b/src/romfile.h index 3e0f8200..a320a5bc 100644 --- a/src/romfile.h +++ b/src/romfile.h @@ -13,6 +13,8 @@ struct romfile_s { void romfile_add(struct romfile_s *file); struct romfile_s *romfile_findprefix(const char *prefix, struct romfile_s *prev); struct romfile_s *romfile_find(const char *name); +void *romfile_loadfile_g(const char *name, int *psize, + void *(*malloc_fn)(), int add_len); void *romfile_loadfile(const char *name, int *psize); u64 romfile_loadint(const char *name, u64 defval); -- 2.43.0

2 1

[PATCH 2/2] vgahooks, optionroms: implement mxm 3.0 interrupts
by Riku Viitanen 10 Feb '24

10 Feb '24

VGAROMs on MXM graphics cards need certain int15h functions present. Tested on a HP EliteBook 8560w with coreboot and Quadro 2000M. A warning is displayed for 30 seconds and performance is nerfed: ERROR: Valid MXM Structure not found. POST halted for 30 seconds, P-state limited to P10... This patch implements the minimum required on this system (and implemented by the OEM BIOS): functions 0 and 1. These functions are specific to the MXM 3.0 Software Specification, earlier versions are not implemented due to lack of hardware. Documentation for versions 2.1 and 3.0 can be found freely online. Functions aren't specific to mainboards or GPUs (though some mainboards could need more functions implemented). The structure is mainboard-specific and is read from romfile "mxm-30-sis". It can be extracted from vendor BIOS by running those same interrupts. I wrote a tool to do it on Linux: https://codeberg.org/Riku_V/mxmdump/ Signed-off-by: Riku Viitanen <riku.viitanen(a)protonmail.com> --- src/optionroms.c | 9 +++++++ src/vgahooks.c | 69 ++++++++++++++++++++++++++++++++++++++++++++++++ src/vgahooks.h | 9 +++++++ 3 files changed, 87 insertions(+) create mode 100644 src/vgahooks.h diff --git a/src/optionroms.c b/src/optionroms.c index e906ab97..fcce7900 100644 --- a/src/optionroms.c +++ b/src/optionroms.c @@ -22,6 +22,7 @@ #include "string.h" // memset #include "util.h" // get_pnp_offset #include "tcgbios.h" // tpm_* +#include "vgahooks.h" // MXM30SIS static int EnforceChecksum, S3ResumeVga, RunPCIroms; @@ -463,6 +464,14 @@ vgarom_setup(void) RunPCIroms = romfile_loadint("etc/pci-optionrom-exec", 2); ScreenAndDebug = romfile_loadint("etc/screen-and-debug", 1); + // Load MXM 3.0 System Information Structure + void *mxm_sis = romfile_loadfile_g("mxm-30-sis", NULL, &malloc_low, 0); + if (mxm_sis) { + MXM30SIS = (u32)mxm_sis; + } else { + MXM30SIS = 0; + } + // Clear option rom memory memset((void*)BUILD_ROM_START, 0, rom_get_max() - BUILD_ROM_START); diff --git a/src/vgahooks.c b/src/vgahooks.c index 1f149532..a94840b2 100644 --- a/src/vgahooks.c +++ b/src/vgahooks.c @@ -18,8 +18,10 @@ #define VH_VIA 1 #define VH_INTEL 2 #define VH_SMI 3 +#define VH_MXM 4 int VGAHookHandlerType VARFSEG; +u32 MXM30SIS VARFSEG; static void handle_155fXX(struct bregs *regs) @@ -59,6 +61,7 @@ via_155f02(struct bregs *regs) dprintf(1, "Warning: VGA TV/CRT output type is hardcoded\n"); } + static void via_155f18(struct bregs *regs) { @@ -296,6 +299,69 @@ winent_mb6047_setup(struct pci_device *pci) SmiBootDisplay = 0x02; } +/**************************************************************** + * MXM VGA hooks + ****************************************************************/ + +// Function 0: Return Specification Support Level +static void +mxm_V30_F00(struct bregs *regs) +{ + regs->ax = 0x005f; // Success + regs->bl = 0x30; // MXM 3.0 + regs->cx = 0x0003; // Supported Functions + set_success(regs); +} + +// Function 1: Return a Pointer to the MXM Structure +static void +mxm_V30_F01(struct bregs *regs) +{ + switch (regs->cx) { + case 0x0030: + regs->ax = 0x005f; // Success + regs->es = GET_GLOBAL(MXM30SIS)/16; + regs->di = GET_GLOBAL(MXM30SIS)%16; + set_success(regs); + break; + default: + handle_155fXX(regs); + break; + } +} + +static void +mxm_V30(struct bregs *regs) +{ + switch (regs->bx) { + case 0xff00: mxm_V30_F00(regs); break; + case 0xff01: mxm_V30_F01(regs); break; + default: handle_155fXX(regs); break; + } +} + +static void +mxm_155f80(struct bregs *regs) +{ + // TODO: implement other versions, like 2.1 + mxm_V30(regs); +} + +static void +mxm_155f(struct bregs *regs) +{ + switch (regs->al) { + case 0x80: mxm_155f80(regs); break; + default: handle_155fXX(regs); break; + } +} + +void +mxm_setup(void) +{ + VGAHookHandlerType = VH_MXM; +} + /**************************************************************** * Entry and setup ****************************************************************/ @@ -313,6 +379,7 @@ handle_155f(struct bregs *regs) switch (htype) { case VH_VIA: via_155f(regs); break; case VH_INTEL: intel_155f(regs); break; + case VH_MXM: mxm_155f(regs); break; default: handle_155fXX(regs); break; } } @@ -352,4 +419,6 @@ vgahook_setup(struct pci_device *pci) via_setup(pci); else if (pci->vendor == PCI_VENDOR_ID_INTEL) intel_setup(pci); + else if (GET_GLOBAL(MXM30SIS)) + mxm_setup(); } diff --git a/src/vgahooks.h b/src/vgahooks.h new file mode 100644 index 00000000..f0c203af --- /dev/null +++ b/src/vgahooks.h @@ -0,0 +1,9 @@ +#ifndef __VGAHOOKS_H +#define __VGAHOOKS_H + +#include "types.h" // u32 + +extern u32 MXM30SIS; + + +#endif // vgahooks.h -- 2.43.0

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

SeaBIOS February 2024