From nobody  Mon Nov 24 12:14:25 1997
Received: (from nobody@localhost)
          by hub.freebsd.org (8.8.7/8.8.7) id MAA00815;
          Mon, 24 Nov 1997 12:14:25 -0800 (PST)
          (envelope-from nobody)
Message-Id: <199711242014.MAA00815@hub.freebsd.org>
Date: Mon, 24 Nov 1997 12:14:25 -0800 (PST)
From: Joel.Faedi@esial.u-nancy.fr
To: freebsd-gnats-submit@freebsd.org
Subject: very early kernel panic (bios32 detection) on some Compaq Prolinea
X-Send-Pr-Version: www-1.0

>Number:         5140
>Category:       kern
>Synopsis:       very early kernel panic (bios32 detection) on some Compaq Prolinea
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    msmith
>State:          closed
>Quarter:
>Keywords:
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Nov 24 12:20:00 PST 1997
>Closed-Date:    Thu Jan 1 05:27:11 PST 1998
>Last-Modified:  Thu Jan  1 05:28:49 PST 1998
>Originator:     Joel Faedi
>Release:        3.0-971123-SNAP (problem since bios32 is detected)
>Organization:
ESIAL - Nancy (France)
>Environment:
>Description:
On Compaq Prolinea with Pentium CPU (Prolinea 575/590/5133/5150, I have
only these models), all kernels will panic. The problem is due to due
to a call at "bios32_SDCI" address. This addess is given bios_sigsearch
function in bios.c (see fix) after a cast in bios32_SDheader structure
and on Compaq Prolinea, this value is too big (perhaps coded diffently).
>How-To-Repeat:
Boot 3.0-971123-SNAP (or some more older versions) from boot floppy,
kernel will panic very quickly.
>Fix:
Fix bios32_init function in /usr/src/sys/i386/i386/bios.c: very value of
sdh->entry, I think in should be less than BIOS max address:

	/* get a virtual pointer to the structure */
	sdh = (struct bios32_SDheader *)BIOS_PADDRTOVADDR(sigaddr);
	for (cv = (u_int8_t *)sdh, ck = 0, i = 0; i < (sdh->len * 16); i++) {
	    ck += cv[i];
	}
	/* If checksum is OK, enable use of the entrypoint */
	if (ck == 0 && sdh->entry < (BIOS_START + BIOS_SIZE)) { <<<<-
	    bios32_SDCI = (caddr_t)BIOS_PADDRTOVADDR(sdh->entry);

>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->closed 
State-Changed-By: msmith 
State-Changed-When: Thu Jan 1 05:27:11 PST 1998 
State-Changed-Why:  
Suggested range check implemented. 


Responsible-Changed-From-To: freebsd-bugs->msmith 
Responsible-Changed-By: msmith 
Responsible-Changed-When: Thu Jan 1 05:27:11 PST 1998 
Responsible-Changed-Why:  
My code. 
>Unformatted:
