[bios] Fix screen clearing on even more buggy BIOSes

Some BIOSes (observed with a ProLiant DL360p Gen8 SE) perform no range
checking whatsoever on the parameters passed to INT10,06 and will
therefore happily write to an area beyond the end of video RAM.  The
area immediately following the video RAM tends to be the VGA BIOS ROM
image.  Overwriting the VGA BIOS leads to an interesting variety of
crashes and reboots.

Fix by specifying an exact width and height to be cleared, rather than
passing in large values and relying upon the BIOS to truncate them to
the appropriate range.

Reported-by: Alex Davies <adavies@jumptrading.com>
Signed-off-by: Michael Brown <mcb30@ipxe.org>

diff --git a/src/arch/i386/firmware/pcbios/bios_console.c b/src/arch/i386/firmware/pcbios/bios_console.c
index 035831c87bff0356ff847bdf73c34349b1557cf9..b2b7bf2d8c310b75740d6a054ff5fddea240652c 100644 (file)
--- a/src/arch/i386/firmware/pcbios/bios_console.c
+++ b/src/arch/i386/firmware/pcbios/bios_console.c
@@ -101,7 +101,9 @@ static void bios_handle_ed ( struct ansiesc_context *ctx __unused,
                                           "int $0x10\n\t"
                                           "cli\n\t" )
                               : : "a" ( 0x0600 ), "b" ( bios_attr << 8 ),
-                                  "c" ( 0 ), "d" ( 0xfefe ) );
+                                  "c" ( 0 ),
+                                  "d" ( ( ( console_height - 1 ) << 8 ) |
+                                        ( console_width - 1 ) ) );
 }
 
 /**