SeaBIOS

seabios@seabios.org

4 participants
3806 discussions

[RFC v2 0/1] Add LBA 64bit support.
by Max Tottenham 25 Jan '24

25 Jan '24

Changes since V1: * De-duplicate blksize check and capacity logging * Fix off by 1 error for returned sector count (LBA addresses start from 0). Max Tottenham (1): Add LBA 64bit support for reads beyond 2TB. src/hw/blockcmd.c | 61 +++++++++++++++++++++++++++++++++++------------ src/hw/blockcmd.h | 27 +++++++++++++++++++++ 2 files changed, 73 insertions(+), 15 deletions(-) -- 2.34.1

3 9

[RFC] Add LBA 64bit support for reads beyond 2TB.
by Max Tottenham 25 Jan '24

25 Jan '24

When booting from a >2TB drive/filesystem, it's possible what the kernel/bootloader may be updated and written out at an LBA address beyond what is normally accessible by the READ(10) SCSI commands. If this happens to the kernel grub will fail to boot the kernel as it will call into the BIOS with an LBA address >2TB, and the BIOS will return an error. Per the SCSI spec, >2TB drives should return 0XFFFFFFFF, and a READ CAPACITY(16) command should be issues to determine the full size of the drive, READ(16) commands can then be used in order to read data at LBA addresses beyond 2TB (64 bit LBA addresses). --- src/hw/blockcmd.c | 75 +++++++++++++++++++++++++++++++++++------------ src/hw/blockcmd.h | 27 +++++++++++++++++ 2 files changed, 84 insertions(+), 18 deletions(-) diff --git a/src/hw/blockcmd.c b/src/hw/blockcmd.c index 6b6fea97..4f5dc2d7 100644 --- a/src/hw/blockcmd.c +++ b/src/hw/blockcmd.c @@ -66,6 +66,23 @@ cdb_test_unit_ready(struct disk_op_s *op) return process_op(op); } +static int +cdb_read_capacity16(struct disk_op_s *op, struct cdbres_read_capacity_16 *data) +{ + struct cdb_sai_read_capacity_16 cmd; + memset(&cmd, 0, sizeof(cmd)); + cmd.command = CDB_CMD_SERVICE_ACTION_IN; + cmd.flags = CDB_CMD_SAI_READ_CAPACITY_16; + cmd.len = cpu_to_be32(sizeof(struct cdbres_read_capacity_16)); + op->command = CMD_SCSI; + op->count = 1; + op->buf_fl = data; + op->cdbcmd = &cmd; + op->blocksize = sizeof(*data); + return process_op(op); +} + + // Request capacity static int cdb_read_capacity(struct disk_op_s *op, struct cdbres_read_capacity *data) @@ -111,13 +128,23 @@ scsi_fill_cmd(struct disk_op_s *op, void *cdbcmd, int maxcdb) switch (op->command) { case CMD_READ: case CMD_WRITE: ; - struct cdb_rwdata_10 *cmd = cdbcmd; - memset(cmd, 0, maxcdb); - cmd->command = (op->command == CMD_READ ? CDB_CMD_READ_10 - : CDB_CMD_WRITE_10); - cmd->lba = cpu_to_be32(op->lba); - cmd->count = cpu_to_be16(op->count); - return GET_FLATPTR(op->drive_fl->blksize); + if (op->lba < 0xFFFFFFFFULL) { + struct cdb_rwdata_10 *cmd = cdbcmd; + memset(cmd, 0, maxcdb); + cmd->command = (op->command == CMD_READ ? CDB_CMD_READ_10 + : CDB_CMD_WRITE_10); + cmd->lba = cpu_to_be32(op->lba); + cmd->count = cpu_to_be16(op->count); + return GET_FLATPTR(op->drive_fl->blksize); + } else { + struct cdb_rwdata_16 *cmd = cdbcmd; + memset(cmd, 0, maxcdb); + cmd->command = (op->command == CMD_READ ? CDB_CMD_READ_16 + : CDB_CMD_WRITE_16); + cmd->lba = cpu_to_be64(op->lba); + cmd->count = cpu_to_be32(op->count); + return GET_FLATPTR(op->drive_fl->blksize); + } case CMD_SCSI: if (MODESEGMENT) return -1; @@ -331,18 +358,30 @@ scsi_drive_setup(struct drive_s *drive, const char *s, int prio) if (ret) return ret; - // READ CAPACITY returns the address of the last block. - // We do not bother with READ CAPACITY(16) because BIOS does not support - // 64-bit LBA anyway. - drive->blksize = be32_to_cpu(capdata.blksize); - if (drive->blksize != DISK_SECTOR_SIZE) { - dprintf(1, "%s: unsupported block size %d\n", s, drive->blksize); - return -1; - } - drive->sectors = (u64)be32_to_cpu(capdata.sectors) + 1; - dprintf(1, "%s blksize=%d sectors=%u\n" - , s, drive->blksize, (unsigned)drive->sectors); + if (be32_to_cpu(capdata.sectors) == 0xFFFFFFFFUL) { + dprintf(1, "%s: >2TB Detected trying READCAP(16)\n", s); + struct cdbres_read_capacity_16 capdata16; + ret = cdb_read_capacity16(&dop, &capdata16); + + drive->blksize = be32_to_cpu(capdata16.blksize); + if (drive->blksize != DISK_SECTOR_SIZE) { + dprintf(1, "%s: unsupported block size %d\n", s, drive->blksize); + return -1; + } + drive->sectors = be64_to_cpu(capdata16.sectors); + dprintf(1, "READCAP(16) %s blksize=%d sectors=%llX\n" + , s, drive->blksize, drive->sectors); + } else { + drive->blksize = be32_to_cpu(capdata.blksize); + if (drive->blksize != DISK_SECTOR_SIZE) { + dprintf(1, "%s: unsupported block size %d\n", s, drive->blksize); + return -1; + } + drive->sectors = (u64)be32_to_cpu(capdata.sectors) + 1; + dprintf(1, "%s blksize=%d sectors=%u\n" + , s, drive->blksize, (unsigned)drive->sectors); + } // We do not recover from USB stalls, so try to be safe and avoid // sending the command if the (obsolete, but still provided by QEMU) // fixed disk geometry page may not be supported. diff --git a/src/hw/blockcmd.h b/src/hw/blockcmd.h index f18543ed..2683186c 100644 --- a/src/hw/blockcmd.h +++ b/src/hw/blockcmd.h @@ -18,6 +18,16 @@ struct cdb_rwdata_10 { u8 pad[6]; } PACKED; +#define CDB_CMD_READ_16 0x88 +#define CDB_CMD_WRITE_16 0x8A +struct cdb_rwdata_16 { + u8 command; + u8 flags; + u64 lba; + u32 count; + u16 reserved_14; +} PACKED; + #define CDB_CMD_READ_CAPACITY 0x25 struct cdb_read_capacity { @@ -32,6 +42,23 @@ struct cdbres_read_capacity { u32 blksize; } PACKED; + +#define CDB_CMD_SERVICE_ACTION_IN 0x9E +#define CDB_CMD_SAI_READ_CAPACITY_16 0x10 +struct cdb_sai_read_capacity_16 { + u8 command; + u8 flags; + u64 lba; //marked as obsolete? + u32 len; + u16 reserved_14; +} PACKED; + +struct cdbres_read_capacity_16 { + u64 sectors; + u32 blksize; + u8 reserved_12[20]; +} PACKED; + #define CDB_CMD_TEST_UNIT_READY 0x00 #define CDB_CMD_INQUIRY 0x12 #define CDB_CMD_REQUEST_SENSE 0x03 -- 2.34.1

2 1

[PATCH] Add AHCI Power ON + ICC_ACTIVE into port setup code
by Andrej Kruták 25 Jan '24

25 Jan '24

Windows appears to put the AHCI port into 'Partial power management state' during reboot, the command puts it back into 'active state'. AHCI/1: link down 0x00000231 (SCR STAT register) -> AHCI/1: link up 0x00000133 Signed-off-by: Andrej Krutak andrej.krutak(a)sysgo.com --- src/hw/ahci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/hw/ahci.c b/src/hw/ahci.c index 3fa845aa..4f0f640a 100644 --- a/src/hw/ahci.c +++ b/src/hw/ahci.c @@ -444,7 +444,8 @@ static int ahci_port_setup(struct ahci_port_s *port) ahci_port_writel(ctrl, pnr, PORT_CMD, cmd); /* spin up */ - cmd |= PORT_CMD_SPIN_UP; + cmd &= ~PORT_CMD_ICC_MASK; + cmd |= PORT_CMD_SPIN_UP | PORT_CMD_POWER_ON | PORT_CMD_ICC_ACTIVE; ahci_port_writel(ctrl, pnr, PORT_CMD, cmd); u32 end = timer_calc(AHCI_LINK_TIMEOUT); for (;;) { -- 2.34.1

2 1

[PATCH] esp-scsi: terminate DMA transfer when ESP data transfer completes
by Mark Cave-Ayland 25 Jan '24

25 Jan '24

When the ESP data transfer completes indicated by the STAT_TC flag being set, terminate the DMA transfer by issuing a DMA IDLE command. Otherwise in the case where the guest sends a reset followed by an ESP command, the DMA signal remains enabled and so the next SeaBIOS DMA transfer begins immediately when the next ESP command is received rather than waiting until the data is ready and the DMA command is issued. With this fix it is possible to boot a Windows XP ISO to the installer and complete a full installation within QEMU directly using SeaBIOS. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland(a)ilande.co.uk> --- src/hw/esp-scsi.c | 2 ++ 1 file changed, 2 insertions(+) [This fixes the Windows XP setup issue reported by Paolo when DC390 support was first added to QEMU (see https://lore.kernel.org/all/501A94D0.3080502@redhat.com/ for the original thread) way back in 2012.] diff --git a/src/hw/esp-scsi.c b/src/hw/esp-scsi.c index f19804f..8612069 100644 --- a/src/hw/esp-scsi.c +++ b/src/hw/esp-scsi.c @@ -147,6 +147,8 @@ esp_scsi_process_op(struct disk_op_s *op) /* At end of DMA TC is set again -> complete command. */ if (state == 1 && (stat & ESP_STAT_TC)) { state++; + /* Terminate esp_scsi_dma() command */ + outb(0, iobase + ESP_DMA_CMD); continue; } -- 2.39.2

2 1

Re: [PATCH 0/8] SeaVGABios/cbvga: Assume VGA compatible GPU in, text-mode
by segfault_bilibili 20 Jan '24

20 Jan '24

Hi Patrick, First, apologies for my bad English grammar and email composing skills. I tried your patch [7/8] to fix bugcheck 50 bsod on my Dell Latitude E6430 which is running Libreboot. In short, your patch initially did not fix the bsod, but after an one-line change of code it successfully fixed bsod, although I still don't know the full situation. According to my observation, _rom_header_size must be set to some value greater than 0x40, like 0x41. Under vendor BIOS, igdkmd64 is observed to have a "reattempt memmap" logic only if _rom_header_size > 0x40. After this reattempt of memmap completed, the driver was loaded correctly and it won't bsod. Otherwise, if _rom_header_size <= 0x40, such logic was seemed to be skipped, and then at certain breakpoint I observed that nothing but "??" representing unreadable bytes filled up windbg's memory peek window, because the vmaddr which was supposed to point to VBT actually pointed to invalid address. `!vtop` command confirmed this as well. In vgasrc/cbvga.c, related lines: > /* Increment rom header size */ > size +=3D (GET_FARVAR(0, vbt->hdr_vbt_size) + 512 - 1) >> 9; > SET_VGA(_rom_header_size, size); I set `size` to at least 0x41, like: size +=3D (GET_FARVAR(0, vbt->hdr_vbt_size) + 512 - 1) >> 9; if (size <= 0x40) size = 0x40 + 1; // newly added line SET_VGA(_rom_header_size, size); and then the bsod is gone. Cheers, segfault

1 0

trying to boot off vhost-user-fs-pci device?
by Michael Tokarev 29 Dec '23

29 Dec '23

Hi! While debugging an unrelated issue, I come to an interesting effect. When I run qemu with two devices, one vhost-user-fs-pci and another, say, virtio-blk, - both these devices have bootindex property. If I specify virtio-blk first and vhost-user-fs-pci second, everything works as expected and seabios boots the OS out of virtio-blk device. But if I specify vhost-user-fs-pci first, seabios will try to boot off virtiofs one, which isn't even a block device, and for which seabios does not have any driver. And in this case the boot just fails: Booting from Hard Disk.. Boot failed: could not read the boot disk next it tries pxe boot, cdrom, and fails. Does it make sense to try to boot off unsupported devices? Thanks, /mjt

2 1

Uninitialized local leads to undefined memory dereference
by Datta manikanta sri hari Danduri 25 Nov '23

25 Nov '23

Hi ISSUE-1: seabios-1.15.0/scripts/kconfig/menu.c function get_prompt_str, the variable jump is uninitialized and may lead to illegal access at if (i > 0) { str_printf(r, _(" Location:\n")); for (j = 4; --i >= 0; j += 2) { menu = submenu[i]; if (head && location && menu == location) jump->offset = strlen(r->s); str_printf(r, "%*c-> %s", j, ' ', _(menu_get_prompt(menu))); if (menu->sym) { str_printf(r, " (%s [=%s])", menu->sym->name ? menu->sym->name : _("<choice>"), sym_get_string_value(menu->sym)); } str_append(r, "\n"); } } ISSUE-2: seabios-1.15.0/src/hw/usb-ohci.c function start_ohci, the check is incorrect for (;;) { u32 status = readl(&cntl->regs->cmdstatus); if (! status & OHCI_HCR) break; if (timer_check(end)) { warn_timeout(); return -1; } } Thanks Srihari

1 0

unbounded-writes, causes buffer overflow
by Datta manikanta sri hari Danduri 25 Nov '23

25 Nov '23

Hi There are a few bugs related to Buffer write operations that do not control the length of data, which may overflow. I attached a reference patch. Please make changes as needed. If possible, assign CVE, as the content written to these buffers is tainted and coming from the user, which can lead to security risks. Thanks Srihari

1 0

[PATCH v6] limit address space used for pci devices.
by Gerd Hoffmann 13 Nov '23

13 Nov '23

For better compatibility with old linux kernels, see source code comment. Also rename some variables to make the code more readable, following suggestions by Kevin. Related (same problem in ovmf): https://github.com/tianocore/edk2/commit/c1e853769046 Cc: Kevin O'Connor <kevin(a)koconnor.net> Reported-by: Claudio Fontana <cfontana(a)suse.de> Signed-off-by: Gerd Hoffmann <kraxel(a)redhat.com> --- src/fw/pciinit.c | 38 ++++++++++++++++++++++++++------------ 1 file changed, 26 insertions(+), 12 deletions(-) diff --git a/src/fw/pciinit.c b/src/fw/pciinit.c index c7084f5e397e..6b13cd5b7d1c 100644 --- a/src/fw/pciinit.c +++ b/src/fw/pciinit.c @@ -46,12 +46,16 @@ static const char *region_type_name[] = { [ PCI_REGION_TYPE_PREFMEM ] = "prefmem", }; +// Memory ranges exported to legacy ACPI type table generation u64 pcimem_start = BUILD_PCIMEM_START; u64 pcimem_end = BUILD_PCIMEM_END; u64 pcimem64_start = BUILD_PCIMEM64_START; u64 pcimem64_end = BUILD_PCIMEM64_END; -u64 pci_io_low_end = 0xa000; -u32 pci_use_64bit = 0; + +// Resource allocation limits +static u64 pci_io_low_end = 0xa000; +static u64 pci_mem64_top = 0; +static u32 pci_pad_mem64 = 0; struct pci_region_entry { struct pci_device *dev; @@ -966,8 +970,9 @@ static int pci_bios_check_devices(struct pci_bus *busses) int resource_optional = 0; if (hotplug_support == HOTPLUG_PCIE) resource_optional = pcie_cap && (type == PCI_REGION_TYPE_IO); - if (hotplug_support && pci_use_64bit && is64 && (type == PCI_REGION_TYPE_PREFMEM)) - align = (u64)1 << (CPUPhysBits - 11); + if (hotplug_support && pci_pad_mem64 && is64 + && (type == PCI_REGION_TYPE_PREFMEM)) + align = pci_mem64_top >> 11; if (align > sum && hotplug_support && !resource_optional) sum = align; /* reserve min size for hot-plug */ if (size > sum) { @@ -1111,7 +1116,7 @@ static void pci_bios_map_devices(struct pci_bus *busses) panic("PCI: out of I/O address space\n"); dprintf(1, "PCI: 32: %016llx - %016llx\n", pcimem_start, pcimem_end); - if (pci_use_64bit || pci_bios_init_root_regions_mem(busses)) { + if (pci_pad_mem64 || pci_bios_init_root_regions_mem(busses)) { struct pci_region r64_mem, r64_pref; r64_mem.list.first = NULL; r64_pref.list.first = NULL; @@ -1131,14 +1136,13 @@ static void pci_bios_map_devices(struct pci_bus *busses) r64_mem.base = le64_to_cpu(romfile_loadint("etc/reserved-memory-end", 0)); if (r64_mem.base < 0x100000000LL + RamSizeOver4G) r64_mem.base = 0x100000000LL + RamSizeOver4G; - if (CPUPhysBits) { - u64 top = 1LL << CPUPhysBits; + if (pci_mem64_top) { u64 size = (ALIGN(sum_mem, (1LL<<30)) + ALIGN(sum_pref, (1LL<<30))); - if (pci_use_64bit) - size = ALIGN(size, (1LL<<(CPUPhysBits-3))); - if (r64_mem.base < top - size) { - r64_mem.base = top - size; + if (pci_pad_mem64) + size = ALIGN(size, pci_mem64_top >> 3); + if (r64_mem.base < pci_mem64_top - size) { + r64_mem.base = pci_mem64_top - size; } if (e820_is_used(r64_mem.base, size)) r64_mem.base -= size; @@ -1181,8 +1185,18 @@ pci_setup(void) dprintf(3, "pci setup\n"); + if (CPUPhysBits) { + pci_mem64_top = 1LL << CPUPhysBits; + if (CPUPhysBits > 46) { + // Old linux kernels have trouble dealing with more than 46 + // phys-bits, so avoid that for now. Seems to be a bug in the + // virtio-pci driver. Reported: centos-7, ubuntu-18.04 + pci_mem64_top = 1LL << 46; + } + } + if (CPUPhysBits >= 36 && CPULongMode && RamSizeOver4G) - pci_use_64bit = 1; + pci_pad_mem64 = 1; dprintf(1, "=== PCI bus & bridge init ===\n"); if (pci_probe_host() != 0) { -- 2.41.0

1 0

[PATCH v5] limit physical address space size
by Gerd Hoffmann 10 Nov '23

10 Nov '23

For better compatibility with old linux kernels, see source code comment. Related (same problem in ovmf): https://github.com/tianocore/edk2/commit/c1e853769046 Cc: Claudio Fontana <cfontana(a)suse.de> Signed-off-by: Gerd Hoffmann <kraxel(a)redhat.com> --- src/fw/paravirt.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/fw/paravirt.c b/src/fw/paravirt.c index e5d4eca0cb5a..a2c9c64d5e78 100644 --- a/src/fw/paravirt.c +++ b/src/fw/paravirt.c @@ -182,6 +182,14 @@ static void physbits(int qemu_quirk) __func__, signature, pae ? "yes" : "no", CPULongMode ? "yes" : "no", physbits, valid ? "yes" : "no"); + if (valid && physbits > 46) { + // Old linux kernels have trouble dealing with more than 46 + // phys-bits, so avoid that for now. Seems to be a bug in the + // virtio-pci driver. Reported: centos-7, ubuntu-18.04 + dprintf(1, "%s: using phys-bits=46 (old linux kernel compatibility)\n", __func__); + physbits = 46; + } + if (valid) CPUPhysBits = physbits; } -- 2.41.0

3 6

← Newer
1
...
4
5
6
7
8
9
10
...
381
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

SeaBIOS