Re: [Qemu-devel] Stack corruption problem with SeaBIOS/gPXE under QEMU

[Kevin O'Connor]

Hi,

On Thu, Nov 12, 2009 at 01:20:58PM +0200, Naphtali Sprei wrote:
> I've found a problem with the usage of SeaBIOS/gPXE in Qemu.  The
> scenario is when failing to boot from network and falling back to
> booting from hard-disk (-boot nc).  The cause of the problem is that
> both SeaBIOS and gPXE (in it's installation phase) uses same stack
> area, 0x7c00.  The gPXE code corrupts the SeaBIOS stack, so when
> gPXE returns to SeaBIOS chaos occurs.
> 
> Output: "qemu: fatal: Trying to execute code outside RAM or ROM at 
> 0x00000000eb300000"

Thanks for reporting this.

We can move the SeaBIOS stack, but it's not clear to me where to move
it to.  Bochs bios puts the top of the stack at 0x10000, but this
could potentially conflict with the OS load to 0x7c00.  So, in SeaBIOS
the top of stack was moved to 0x7c00 to prevent this conflict.

Maybe the gPXE developers know where the bios typically places its
stack.

However, I'm not sure why gPXE doesn't just use the stack it was
given, or allocate the stack space it needs with PMM.

> A simple hack/patch (attached) solves this problem, but a proper
> patch expected from the SeaBIOS guys.
> 
>  Enjoy,
> 
>   Naphtali
> 
> Patch against current SeaBIOS git

The patch isn't against SeaBIOS.  Did you mean gPXE?

-Kevin


> 
> 
> Signed-off-by: Naphtali Sprei <address@hidden>
> ---
>  src/arch/i386/prefix/pxeprefix.S |    2 +-
>  src/arch/i386/prefix/romprefix.S |    2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/src/arch/i386/prefix/pxeprefix.S 
> b/src/arch/i386/prefix/pxeprefix.S
> index b541e4b..11dd45d 100644
> --- a/src/arch/i386/prefix/pxeprefix.S
> +++ b/src/arch/i386/prefix/pxeprefix.S
> @@ -47,7 +47,7 @@ FILE_LICENCE ( GPL2_OR_LATER )
>       /* Set up stack just below 0x7c00 */
>       xorw    %ax, %ax
>       movw    %ax, %ss
> -     movl    $0x7c00, %esp
> +     movl    $0x7a00, %esp
>       /* Clear direction flag, for the sake of sanity */
>       cld
>       /* Print welcome message */
> diff --git a/src/arch/i386/prefix/romprefix.S 
> b/src/arch/i386/prefix/romprefix.S
> index cb474e8..93f3f17 100644
> --- a/src/arch/i386/prefix/romprefix.S
> +++ b/src/arch/i386/prefix/romprefix.S
> @@ -587,7 +587,7 @@ exec:     /* Set %ds = %cs */
>       /* Obtain a reasonably-sized temporary stack */
>       xorw    %ax, %ax
>       movw    %ax, %ss
> -     movw    $0x7c00, %sp
> +     movw    $0x7a00, %sp
>  
>       /* Install gPXE */
>       movl    image_source, %esi
> -- 
> 1.6.3.3
> 
>