SeaBIOS

seabios@seabios.org

2 participants
3799 discussions

unbounded-writes, causes buffer overflow
by Datta manikanta sri hari Danduri 25 Nov '23

25 Nov '23

Hi There are a few bugs related to Buffer write operations that do not control the length of data, which may overflow. I attached a reference patch. Please make changes as needed. If possible, assign CVE, as the content written to these buffers is tainted and coming from the user, which can lead to security risks. Thanks Srihari

1 0

[PATCH v6] limit address space used for pci devices.
by Gerd Hoffmann 13 Nov '23

13 Nov '23

For better compatibility with old linux kernels, see source code comment. Also rename some variables to make the code more readable, following suggestions by Kevin. Related (same problem in ovmf): https://github.com/tianocore/edk2/commit/c1e853769046 Cc: Kevin O'Connor <kevin(a)koconnor.net> Reported-by: Claudio Fontana <cfontana(a)suse.de> Signed-off-by: Gerd Hoffmann <kraxel(a)redhat.com> --- src/fw/pciinit.c | 38 ++++++++++++++++++++++++++------------ 1 file changed, 26 insertions(+), 12 deletions(-) diff --git a/src/fw/pciinit.c b/src/fw/pciinit.c index c7084f5e397e..6b13cd5b7d1c 100644 --- a/src/fw/pciinit.c +++ b/src/fw/pciinit.c @@ -46,12 +46,16 @@ static const char *region_type_name[] = { [ PCI_REGION_TYPE_PREFMEM ] = "prefmem", }; +// Memory ranges exported to legacy ACPI type table generation u64 pcimem_start = BUILD_PCIMEM_START; u64 pcimem_end = BUILD_PCIMEM_END; u64 pcimem64_start = BUILD_PCIMEM64_START; u64 pcimem64_end = BUILD_PCIMEM64_END; -u64 pci_io_low_end = 0xa000; -u32 pci_use_64bit = 0; + +// Resource allocation limits +static u64 pci_io_low_end = 0xa000; +static u64 pci_mem64_top = 0; +static u32 pci_pad_mem64 = 0; struct pci_region_entry { struct pci_device *dev; @@ -966,8 +970,9 @@ static int pci_bios_check_devices(struct pci_bus *busses) int resource_optional = 0; if (hotplug_support == HOTPLUG_PCIE) resource_optional = pcie_cap && (type == PCI_REGION_TYPE_IO); - if (hotplug_support && pci_use_64bit && is64 && (type == PCI_REGION_TYPE_PREFMEM)) - align = (u64)1 << (CPUPhysBits - 11); + if (hotplug_support && pci_pad_mem64 && is64 + && (type == PCI_REGION_TYPE_PREFMEM)) + align = pci_mem64_top >> 11; if (align > sum && hotplug_support && !resource_optional) sum = align; /* reserve min size for hot-plug */ if (size > sum) { @@ -1111,7 +1116,7 @@ static void pci_bios_map_devices(struct pci_bus *busses) panic("PCI: out of I/O address space\n"); dprintf(1, "PCI: 32: %016llx - %016llx\n", pcimem_start, pcimem_end); - if (pci_use_64bit || pci_bios_init_root_regions_mem(busses)) { + if (pci_pad_mem64 || pci_bios_init_root_regions_mem(busses)) { struct pci_region r64_mem, r64_pref; r64_mem.list.first = NULL; r64_pref.list.first = NULL; @@ -1131,14 +1136,13 @@ static void pci_bios_map_devices(struct pci_bus *busses) r64_mem.base = le64_to_cpu(romfile_loadint("etc/reserved-memory-end", 0)); if (r64_mem.base < 0x100000000LL + RamSizeOver4G) r64_mem.base = 0x100000000LL + RamSizeOver4G; - if (CPUPhysBits) { - u64 top = 1LL << CPUPhysBits; + if (pci_mem64_top) { u64 size = (ALIGN(sum_mem, (1LL<<30)) + ALIGN(sum_pref, (1LL<<30))); - if (pci_use_64bit) - size = ALIGN(size, (1LL<<(CPUPhysBits-3))); - if (r64_mem.base < top - size) { - r64_mem.base = top - size; + if (pci_pad_mem64) + size = ALIGN(size, pci_mem64_top >> 3); + if (r64_mem.base < pci_mem64_top - size) { + r64_mem.base = pci_mem64_top - size; } if (e820_is_used(r64_mem.base, size)) r64_mem.base -= size; @@ -1181,8 +1185,18 @@ pci_setup(void) dprintf(3, "pci setup\n"); + if (CPUPhysBits) { + pci_mem64_top = 1LL << CPUPhysBits; + if (CPUPhysBits > 46) { + // Old linux kernels have trouble dealing with more than 46 + // phys-bits, so avoid that for now. Seems to be a bug in the + // virtio-pci driver. Reported: centos-7, ubuntu-18.04 + pci_mem64_top = 1LL << 46; + } + } + if (CPUPhysBits >= 36 && CPULongMode && RamSizeOver4G) - pci_use_64bit = 1; + pci_pad_mem64 = 1; dprintf(1, "=== PCI bus & bridge init ===\n"); if (pci_probe_host() != 0) { -- 2.41.0

1 0

[PATCH v5] limit physical address space size
by Gerd Hoffmann 10 Nov '23

10 Nov '23

For better compatibility with old linux kernels, see source code comment. Related (same problem in ovmf): https://github.com/tianocore/edk2/commit/c1e853769046 Cc: Claudio Fontana <cfontana(a)suse.de> Signed-off-by: Gerd Hoffmann <kraxel(a)redhat.com> --- src/fw/paravirt.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/fw/paravirt.c b/src/fw/paravirt.c index e5d4eca0cb5a..a2c9c64d5e78 100644 --- a/src/fw/paravirt.c +++ b/src/fw/paravirt.c @@ -182,6 +182,14 @@ static void physbits(int qemu_quirk) __func__, signature, pae ? "yes" : "no", CPULongMode ? "yes" : "no", physbits, valid ? "yes" : "no"); + if (valid && physbits > 46) { + // Old linux kernels have trouble dealing with more than 46 + // phys-bits, so avoid that for now. Seems to be a bug in the + // virtio-pci driver. Reported: centos-7, ubuntu-18.04 + dprintf(1, "%s: using phys-bits=46 (old linux kernel compatibility)\n", __func__); + physbits = 46; + } + if (valid) CPUPhysBits = physbits; } -- 2.41.0

3 6

Regarding the contribution to the seabios project
by Aditya Patil 07 Nov '23

07 Nov '23

I am attaching the patch with this email. The fixes were about the code optimizations in the Python scripts. These were mainly about file handling and this patch addresses the issues with file handling. Some of the files that were opened by the script were not closed. There has been an addition to the code optimization by using "with" statements providing more readable code.

2 2

Git Not working?
by Pvt Snafu 07 Nov '23

07 Nov '23

I started getting intermittent 502 server errors last week when I checked for updates. Now I'm consistently getting them. Is the server misconfigured or failed? Does it need to be reset? Using https://git.seabios.org/seabios.git/ as my origin. If I check https://git.seabios.org/ in my browser, it redirects to coreboot.org and says to clone from ssh://review.coreboot.org:29418/seabios, but when I do that, it starts complaining about not having the key (I guess the ssh server mirror isn't configged for public access?) I'm not trying to submit anything, just looking to keep my repo up to date.

2 1

new release tag?
by Niklas Cassel 12 Sep '23

12 Sep '23

Hello Seabios maintainers, I was wondering, is there any chance of getting a new release tag (e.g. rel-1.16.3) anytime soon? Or is there any plan on when it will be tagged? I'm waiting to send out a (AHCI specific) QEMU patch, but I can't do so until: 1) there is a new Seabios tag 2) QEMU has updated to the latest Seabios release tag No trying to stress anyone, just looking forward to cross things from my todo list :) Kind regards, Niklas

2 3

Malloc Question
by Kieran Kunhya 11 Sep '23

11 Sep '23

Hello, I'm trying to update this patch for 2017 as I have the same issue as the author in that I can't use the KVM virtual keyboard and a physical keyboard at the same time: https://patchew.org/Seabios/20171215100946.58298-1-stef.van.os@prodrive-tec… I have implemented a linked list as recommended but this has not worked as expected. Assuming I have not made an obvious mistake, I think maybe this patch is not working because I'm using the wrong malloc. Which one should I be using? Thanks for your help. Regards, Kieran Kunhya

3 3

[PATCH] add multiple usb-hid support
by Kieran Kunhya 11 Sep '23

11 Sep '23

Based on a patch from Stef van Os --- src/hw/usb-hid.c | 49 +++++++++++++++++++++++++++++++++++++----------- 1 file changed, 38 insertions(+), 11 deletions(-) diff --git a/src/hw/usb-hid.c b/src/hw/usb-hid.c index dec198a..62c046a 100644 --- a/src/hw/usb-hid.c +++ b/src/hw/usb-hid.c @@ -11,8 +11,14 @@ #include "usb.h" // usb_ctrlrequest #include "usb-hid.h" // usb_keyboard_setup #include "util.h" // process_key +#include "malloc.h" // malloc_low -struct usb_pipe *keyboard_pipe VARFSEG; +struct keyboard_list { + struct usb_pipe *keyboard_pipe; + struct keyboard_list *next; +}; + +struct keyboard_list *keyboard_list VARFSEG; struct usb_pipe *mouse_pipe VARFSEG; @@ -62,11 +68,13 @@ static int usb_kbd_setup(struct usbdevice_s *usbdev , struct usb_endpoint_descriptor *epdesc) { + int kbd_idx = 0; + struct usb_pipe *keyboard_pipe; + struct keyboard_list *prev; + struct keyboard_list *end; + if (! CONFIG_USB_KEYBOARD) return -1; - if (keyboard_pipe) - // XXX - this enables the first found keyboard (could be random) - return -1; if (epdesc->wMaxPacketSize < sizeof(struct keyevent) || epdesc->wMaxPacketSize > MAX_KBD_EVENT) { @@ -91,7 +99,26 @@ usb_kbd_setup(struct usbdevice_s *usbdev if (!keyboard_pipe) return -1; - dprintf(1, "USB keyboard initialized\n"); + prev = end = GET_GLOBAL(keyboard_list); + while (end) { + prev = end; + end = end->next; + kbd_idx++; + } + + end = malloc_low(sizeof(*end)); + if (!end) + return -1; + + end->keyboard_pipe = keyboard_pipe; + end->next = NULL; + + if (!prev) + keyboard_list = end; + else + prev->next = end; + + dprintf(1, "USB keyboard %d initialized\n", kbd_idx); return 0; } @@ -321,13 +348,10 @@ handle_key(struct keyevent *data) // Check if a USB keyboard event is pending and process it if so. static void -usb_check_key(void) +usb_check_key(struct usb_pipe *pipe) { if (! CONFIG_USB_KEYBOARD) return; - struct usb_pipe *pipe = GET_GLOBAL(keyboard_pipe); - if (!pipe) - return; for (;;) { u8 data[MAX_KBD_EVENT]; @@ -344,7 +368,7 @@ usb_kbd_active(void) { if (! CONFIG_USB_KEYBOARD) return 0; - return GET_GLOBAL(keyboard_pipe) != NULL; + return GET_GLOBAL(keyboard_list) != NULL; } // Handle a ps2 style keyboard command. @@ -451,6 +475,9 @@ usb_mouse_command(int command, u8 *param) void usb_check_event(void) { - usb_check_key(); + struct keyboard_list *kbd_list = GET_GLOBAL(keyboard_list); + + for(; kbd_list != NULL; kbd_list = kbd_list->next) + usb_check_key(kbd_list->keyboard_pipe); usb_check_mouse(); } -- 2.25.1

2 1

[PATCH v4 0/6] misc tweaks for kvm and the 64bit pci window
by Gerd Hoffmann 11 Sep '23

11 Sep '23

v4 changes: - fix handling of 32bit memory bars. v3 changes: - rename variables, use u8 for CPULongMode. v2 changes: - e820 conflict fix Gerd Hoffmann (6): better kvm detection detect physical address space size move 64bit pci window to end of address space be less conservative with the 64bit pci io window qemu: log reservations in fw_cfg e820 table check for e820 conflict src/e820map.h | 1 + src/fw/paravirt.h | 2 ++ src/e820map.c | 15 ++++++++ src/fw/paravirt.c | 89 +++++++++++++++++++++++++++++++++++++++++------ src/fw/pciinit.c | 26 +++++++++++--- 5 files changed, 119 insertions(+), 14 deletions(-) -- 2.41.0

2 8

[PATCH v3 0/3] esp-scsi: fix reliance on QEMU ESP SCSI implementation bugs
by Mark Cave-Ayland 24 Aug '23

24 Aug '23

Whilst trying to improve QEMU's ESP SCSI implementation with regard to the NCR datasheet, I noticed that SeaBIOS would fail to boot one of my Debian test images with my patches applied. Further investigation revealed that the SeaBIOS esp-scsi driver inadvertently relies on existing bugs in QEMU's ESP SCSI emulation to work correctly, so this series changes the driver to work as described in the NCR datasheet. With this series applied it is possible for the updated SeaBIOS to boot both QEMU current git HEAD as well as my local WIP branch containing various fixes and improvements to QEMU's ESP SCSI emulation. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland(a)ilande.co.uk> v3: - Add R-B tags for patches 1 and 2 from Paolo - Add patch 3 to handle another bug to be fixed in QEMU's ESP emulation v2: - Fix typo in patch 2 commit message - Add reference to datasheet in patch 2 commit message as requested by Paul Mark Cave-Ayland (3): esp-scsi: flush FIFO before sending SCSI command esp-scsi: check for INTR_BS/INTR_FC instead of STAT_TC for command completion esp-scsi: handle non-DMA SCSI commands with no data phase src/hw/esp-scsi.c | 49 +++++++++++++++++++++++++++++++++-------------- 1 file changed, 35 insertions(+), 14 deletions(-) -- 2.39.2

3 5

← Newer
1
...
4
5
6
7
8
9
10
...
380
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

SeaBIOS