Buggy BIOS hard disk workaround missing; causes: "Geom Error"

This a problem in grub-setup.

grub2 ships a 'default' boot sector /boot/grub/boot.img created from boot/i386/pc/boot.S

grub-setup is supposed to modify the code, over-writing a couple of instructions with non-operations (nops =0x90) if it knows it is installing onto the first hard disk of the target:

  /* If DEST_DRIVE is a hard disk, enable the workaround, which is
     for buggy BIOSes which don't pass boot drive correctly. Instead,
     they pass 0x00 or 0x01 even when booted from 0x80. */
  if (dest_dev->disk->id & 0x80)
    /* Replace the jmp (2 bytes) with double nop's. */
    *boot_drive_check = 0x9090;

The result of this is that the two bytes at offset 0x66 (decimal 102) in the sector written to the hard disk should be nops to replace the jmp instruction at 0x66:

00000065 FA cli
00000066 EB07 jmp short 0x6f
00000068 F6C280 test dl,0x80
0000006B 7502 jnz 0x6f
0000006D B280 mov dl,0x80

I manually wrote the nops to the boot sector and grub2 started correctly. I'll now figure out why grub-setup is not doing this over-write itself.

As a temporary workaround for this issue you can fix this by:

1. Boot from a LiveCD image from CD or network (via PXE).
2. Open a terminal (there are two ways)
 a. press Ctrl+Alt+F1 *twice* to get to virtual console #1
 b. Applications > Accessories > Terminal
3. Create a file containing the nops:
 echo -e -n "\0220\0220" >/tmp/nop.bin
4. Write the nops into the boot sector (replace /dev/sda if necessary with the boot device name on *your* system):
 sudo dd if=/tmp/nop.bin of=/dev/sda bs=2 count=1 seek=102
5. Restart and test.

My reading of the source-code path for gub-setup.c indicates that dest_dev->disk->id is not set by the time the drive number test is done.

utils/i386/pc/grub-setup.c::setup()
   dest_dev = grub_device_open (dest);
   kern/device.c::grub_device_open(const char *dest name)
    disk = grub_disk_open(name);
    kern/disk.c::grub_disk_open(const char *name)
      disk = (grub_disk_t) grub_zalloc(sizeof(*disk));
      disk->name = grub_strdup (name);
      ...
      disk->dev = dev;
      ...
      return disk;
   dev->disk = disk;
   return dev;
 ...
 /* If DEST_DRIVE is a hard disk, enable the workaround, which is
    for buggy BIOSes which don't pass boot drive correctly. Instead,
    they pass 0x00 or 0x01 even when booted from 0x80. */
 if (dest_dev->disk->id & 0x80)
 /* Replace the jmp (2 bytes) with double nop's. */
 *boot_drive_check = 0x9090;

To test this I added a small patch to report the value of disk->id (attached) and built the binary. When run on the target system it reveals:

./grub-setup: info: the size of hd0 is 78140160
./grub-setup: info: setting the root device to 'hd0,1'.
./grub-setup: info: disk->id = 0.

and the resulting boot sector contained the jmp instruction.

*** IMPORTANT ***

I've noticed that the workaround in comment #1 give and incorrect set of options for using dd to write to the disk. Please DO NOT use that command as it will try to truncate the output.

It should read:

4. Write the nops into the boot sector (replace /dev/sda if necessary with the boot device name on *your* system):

 sudo dd if=/tmp/nop.bin of=/dev/sda conv=notrunc bs=2 count=1 seek=102

After adding several debugging fprintf statements the reason for this problem seems to become clear. grub-setup calls grub_disk_open() which in turn calls an open() function via an array of pointers. Here's the source-code peppered with my debug print statements from kern/desk.c::grub_disk_open():

  grub_dprintf("disk", "grub_disk_dev_list %s\n", raw);
  for (dev = grub_disk_dev_list; dev; dev = dev->next)
    {
      grub_dprintf("disk", "dev->open (%p)\n", (void *) dev->open);
      if ((dev->open) (raw, disk) == GRUB_ERR_NONE) {
       grub_dprintf("disk", "%s\n", "GRUB_ERR_NONE");
 break;
      }
      else if (grub_errno == GRUB_ERR_UNKNOWN_DEVICE) {
 grub_errno = GRUB_ERR_NONE;
       grub_dprintf("disk", "%s\n", "GRUB_ERR_UNKNOWN_DEVICE");
      }
      else
 goto fail;
    }

Running grub-setup with extra debug info output to stdout:

sudo ./grub-setup -vvv '(hd0)' >grub-setup.log 2>grub-setup.stderr.log

shows:

grub-setup: opening destination 'hd0'
/home/all/SourceCode/grub/grub2-1.98/kern/disk.c:245: Opening `hd0'...
/home/all/SourceCode/grub/grub2-1.98/kern/disk.c:268: grub_disk_dev_list hd0
/home/all/SourceCode/grub/grub2-1.98/kern/disk.c:271: dev->open (0x80754f7)
/home/all/SourceCode/grub/grub2-1.98/kern/disk.c:278: GRUB_ERR_UNKNOWN_DEVICE
/home/all/SourceCode/grub/grub2-1.98/kern/disk.c:271: dev->open (0x80740b0)
/home/all/SourceCode/grub/grub2-1.98/kern/disk.c:278: GRUB_ERR_UNKNOWN_DEVICE
/home/all/SourceCode/grub/grub2-1.98/kern/disk.c:271: dev->open (0x804b6d6)
grub_util_biosdisk_open(hd0)
find_grub_drive(hd0)
i=0 hd0
find_grub_drive(hd0) returned 0
setting disk->id=0
/home/all/SourceCode/grub/grub2-1.98/kern/disk.c:273: GRUB_ERR_NONE
grub-setup: testing: disk->id = 0

So find_grub_drive() is the function returning 0.

That function simply iterates through an array called 'map' that contains the contents of /boot/grub/device.map. The first entry in 'map' (map[0]) represents the first line in the device.map file.

From that it is now possible to see why the id is set to 0 and therefore why the buggy BIOS work-around never gets applied to the boot sector.

This patch may not be the perfect solution - that may need upstream's input - but it follows the same process used in biosdisk routines: where the GRUB device name begins "hd" set bit 7 (& 0x80) to indicate a hard disk.

In this case we don't have access to the same data but we can still apply the patch when the 'dest' begins "hd". It is slightly ropier that I've allowed it to also compare on drive->id == 0 since that, we now know, only relates to which line of 'device.map' the device is on. I'm relying on 'device.map' usually having the BIOS's first hard disk as the first listed.

grub2 (1.98-1ubuntu4) lucid; urgency=low

  * Ensure buggy BIOS workaround is applied by grub-setup (LP: #555500).

 -- TJ <email address hidden> Thu, 08 Apr 2010 04:30:00 +0100

Thanks for your investigation and your proposed patch. I have a slightly different plan here involving getting util/hostdisk.c to check for "hd", which I think would be neater. Work in progress ...

Could you try this patch:

  http://bazaar.launchpad.net/~ubuntu-core-dev/ubuntu/lucid/grub2/lucid/annotate/head%3A/debian/patches/975_hostdisk_hd.diff

Based on inspection of the resulting boot sector, it seems to be doing the right thing for me.

On Thu, 2010-04-08 at 17:06 +0000, Colin Watson wrote:
> Could you try this patch:
>
> http://bazaar.launchpad.net/~ubuntu-core-
> dev/ubuntu/lucid/grub2/lucid/annotate/head%3A/debian/patches/975_hostdisk_hd.diff
>
> Based on inspection of the resulting boot sector, it seems to be doing
> the right thing for me.

Confirmed, it works. Thanks for figuring out the 'proper' way to do it.
It helps when someone is familiar with the source :)

This bug was fixed in the package grub2 - 1.98-1ubuntu4

---------------
grub2 (1.98-1ubuntu4) lucid; urgency=low

  * Only use the first word of GRUB_DISTRIBUTOR for --class, to avoid
    problems if somebody puts spaces in GRUB_DISTRIBUTOR (LP: #557606).
  * Probe all devices in 'grub-probe --target=drive' if
    /boot/grub/device.map is missing (LP: #549980).
  * Adjust hostdisk id for hard disks, allowing grub-setup to use its
    standard workaround for broken BIOSes (thanks to TJ for detailed
    investigation; LP: #555500).
 -- Colin Watson <email address hidden> Fri, 09 Apr 2010 09:46:44 +0100