bug-grub
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[bug #50715] GRUB stack overwriting PXE stack (or the other way around)


From: Tomasz Kępczyński
Subject: [bug #50715] GRUB stack overwriting PXE stack (or the other way around)
Date: Tue, 11 Apr 2017 02:34:39 -0400 (EDT)
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0

Follow-up Comment #2, bug #50715 (project grub):

Well, the stack location is highly error prone from every view point you look
at it... Some hints and remarks you may want to consider:
1. PXE option rom allocates its own 2KB stack with which it call network
bootstrap program (grub in this case). You may save SS:[E]SP somewhere and use
this stack when doing real mode calls. SS should point to the segment pointed
by word 0x40:0x13 (multiplied by 64 to convert it from kB units to paragraphs)
and SP starts with stack size and when it reaches 0 you've exhausted it.
2. As for using stack at the top of conventional memory, this is hard to get
it right. I've seen platforms where EBDA was 80kB large BEFORE iSCSI option
rom loaded adding additional 25kB on top of it. Theoretically it should have
refused loading (PCI firmware specification 3.0 limits permanent memory usage
below 1MB to 40kB total, shared between all option roms), but try to explain
that to customers. Having 80kB EBDA and 86-88kB PXE places grub stack around
472-474kB.
3. I personally think stack should go just below bootstrap code at 0:0x7C00,
as any loaded program goes there and stack below it should be safe.

One more remark: isn't it possible to hardcode protstack for the code running
before the memory management code has executed but adjust it right after? If
this stack is only used for calls made in real mode it probably shouldn't be a
problem, should it?

    _______________________________________________________

Reply to this item at:

  <http://savannah.gnu.org/bugs/?50715>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.gnu.org/




reply via email to

[Prev in Thread] Current Thread [Next in Thread]