ACPI acpi_scan_rsdp() breaks some PCs by not honouring ACPI specification

Bug #144336 reported by TJ
4
Affects Status Importance Assigned to Milestone
linux-source-2.6.22 (Ubuntu)
Fix Released
High
Unassigned

Bug Description

Binary package hint: linux-source-2.6.22

I've been debugging an ACPI-disabled-at-boot failure on an Acer Travelmate C104TCi (C100) with a Wistron BIOS.

[ 0.000000] DMI 2.3 present.
[ 0.000000] ACPI: RSDP 000EC2D0, 0014 (r0 Acer )
[ 0.000000] ACPI:  00000000, F000FF5A (r195 Zÿ F000FF57 Zÿ F000FEA5)
[ 27.751333] ACPI: Core revision 20070126
[ 27.751501] ACPI Exception (tbxface-0618): AE_NO_ACPI_TABLES, While loading namespace from ACPI tables [20070126]
[ 27.751654] ACPI: Unable to load the System Description Tables
[ 27.783596] ACPI: Interpreter disabled.

There are several references to this problem around the net and a couple of invasive kernel patches that don't address the cause.

I wrote a user-space application that scans memory using the method described in the ACPI specifications. It reports:

$ sudo ./find-RSDP

find-RSDP version 0.1 © 2007 TJ http://intuitivenipple.net
Licensed on the terms of GPL version 3

Finds ACPI Root System Descriptor Pointer (for supported BIOS's only).

0x00000000FFFFFFFF Memory size
0x00000000000EC2D0 "RSD PTR "
0x00000000000FE030 "RSD PTR " RSDT @ 0FFE0000 OEM: "Acer " sum: 0
0x0000000005FBFE10 "RSD PTR "

Unfortunately the kernel function arch/i386/kernel/acpi/boot.c::acpi_scan_rsdp() doesn't fully implement the ACPI specification - it simply looks for the first "RSD PTR " signature but doesn't check it has found a valid table by calculating the checksum.

Because this series of BIOSs happen to have multiple instances of "RSD PTR " and an invalid instance appears first in memory, the kernel tries to use an invalid pointer to the RSDT, leading to the problems.

I've prepared a simple patch that calculates the checksum and only returns an RSDT pointer if the checksum == 0.

CVE References

Revision history for this message
TJ (tj) wrote :

I am submitting this patch to the kernel linux-acpi mailing list for inclusion in the mainline.

Changed in linux-source-2.6.22:
assignee: nobody → ubuntu-kernel-acpi
importance: Undecided → High
status: New → Confirmed
Revision history for this message
TJ (tj) wrote :
Revision history for this message
Ben Dailey (bendailey) wrote :

I confirm that this issue is present in Gutsy beta running kernel 2.6.22-12-generic on an Acer TravelMate C102Ti (C100)

Revision history for this message
Tim Gardner (timg-tpi) wrote :

Gutsy commit aaed87be2dd4cd3499b092d429e805a50dd797c1

Changed in linux-source-2.6.22:
status: Confirmed → Fix Committed
Revision history for this message
Kyle McMartin (kyle) wrote :
Download full text (5.9 KiB)

linux-source-2.6.22 (2.6.22-13.40) gutsy; urgency=low

  [Amit Kucheria]

  * Enable CONFIG_VM86 for LPIA
    - LP: #146311
  * Update configuration files
  * Disable MSI by default
  * Add mmconf documentation
  * Update configuration files

  [Bartlomiej Zolnierkiewicz]

  * ide-disk: workaround for buggy HPA support on ST340823A (take 3)
    - LP: #26119

  [Ben Collins]

  * ubuntu/cell: Fixup ps3 related modules for d-i, enable RTAS console
  * ubuntu/cell: Enable CELLEB and related modules (pata_scc)
  * ubuntu/cell: Move ps3rom to storage-core. Also use spidernet, not
    spider_net.
  * ubuntu/cell: Set PS3_MANAGER=y
  * ubuntu: Set NR_CPUS=256 for sparc64-smp

  [Chuck Short]

  * [USB] USB] Support for MediaTek MT6227 in cdc-acm.
    - LP: #134123
  * [XEN] Fix xen vif create with more than 14 guests.
    - LP: #14486

  [Jorge Juan Chico]

  * ide: ST320413A has the same problem as ST340823A
    - LP: #26119

  [Kyle McMartin]

  * fix -rt build
  * fix ia32entry-xen.S for CVE-2007-4573
  * fix build when CONFIG_PCI_MSI is not set

  [Matthew Garrett]

  * hostap: send events on data interface as well as master interface
    - LP: #57146
  * A malformed _GTF object should not prevent ATA device recovery
    - LP: #139079
  * hostap: send events on data interface as well as master interface
    - LP: #57146
  * A malformed _GTF object should not prevent ATA device recovery
    - LP: #139079
  * Don't lose appletouch button release events
  * Fix build with appletouch change
  * Disable Thinkpad backlight support on machines with ACPI video
    - LP: #148055
  * Don't attempt to register a callback if there is no CMOS object
    - LP: #145857
  * Update ACPI bay hotswap code to support locking
    - LP: #148219
  * Update ACPI bay hotswap code to support locking
    - LP: #148219
  * Don't attempt to register a callback if there is no CMOS object
    - LP: #145857
  * Disable Thinkpad backlight support on machines with ACPI video
    - LP: #148055

  [Steffen Klassert]

  * 3c59x: fix duplex configuration
    - LP: #94186

  [Thomas Gleixner]

  * clockevents: remove the suspend/resume workaround^Wthinko

  [Tim Gardner]

  * orinoco_cs.ko missing
    - LP: #125832
  * Marvell Technology ethernet card not recognized and not operational
    - LP: #135316
  * Marvell Technology ethernet card not recognized and not operational
    - LP: #135316
  * acpi_scan_rsdp() breaks some PCs by not honouring ACPI specification
    - LP: #144336
  * VIA southbridge Intel id missing
    - LP: #128289
  * Add T-Sinus 111card to hostap_cs driver to be able to upload firmware
    - LP: #132466
  * RTL8111 PCI Express Gigabit driver r8169 big files produce slow file
    transfer
    - LP: #114171
  * Guest OS does not recognize a lun with non zero target id on Vmware ESX
    Server
    - LP: #140761
  * Modualrize vesafb
    - LP: #139505
  * Nikon cameras need support in unusual_devs.h
    - LP: #134477
  * agp for i830m broken in gutsy
    - LP: #139767
  * hdaps: Added support for Thinkpad T61
    - LP: #147383
  * xen: Update config for i386
    - LP: #139047
  * xen: resync for amd64
    - LP: #139047
  * ide-disk: workaround for buggy HPA support ...

Read more...

Changed in linux-source-2.6.22:
status: Fix Committed → Fix Released
Curtis Hovey (sinzui)
Changed in linux-source-2.6.22 (Ubuntu):
assignee: Registry Administrators (registry) → nobody
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.