Re: [Xen-devel] Xen 3.1.2 can corrupt BIOS resevered memory between 1M and 16M.

[Keir Fraser <Keir.Fraser@xxxxxxxxxxxx>]

Hopefully this is fixed by c/s 15546 in xen-3.1-testing.hg. It would be
great if you could confirm this fixes the issue.

 Thanks,
 Keir


On 7/12/07 15:43, "Kimball Murray" <kimball.murray@xxxxxxxxx> wrote:

> One of the hypervisor patches applied after the 3.1.0 build (15044.patch) can
> cause BIOS-reserved memory regions between 1M and 16M to be overwritten.
> 
> Originally, memory in this area was added to the boot allocator only if it
> was not reserved, but the 15044 patch removed that code and added this:
> 
> +    init_boot_pages(1<<20, 16<<20); /* Initial seed: 15MB */
> 
> Stratus is one vendor whose BIOS e820 tables define a 256K reseverved area
> starting at 15M (0xf00000).  Here are the e820 tables for that platform:
> 
> (XEN) Xen-e820 RAM map:
> (XEN)  0000000000000000 - 000000000009a000 (usable)
> (XEN)  000000000009a800 - 00000000000a0000 (reserved)
> (XEN)  00000000000cc000 - 00000000000d0000 (reserved)
> (XEN)  00000000000dc000 - 0000000000100000 (reserved)
> (XEN)  0000000000100000 - 0000000000f00000 (usable)
> (XEN)  0000000000f00000 - 0000000000f40000 (reserved)
> (XEN)  0000000000f40000 - 000000007fef0000 (usable)
> (XEN)  000000007fef0000 - 000000007fefa000 (ACPI data)
> (XEN)  000000007fefa000 - 000000007ff00000 (ACPI NVS)
> (XEN)  000000007ff00000 - 0000000080000000 (reserved)
> (XEN)  00000000e0000000 - 00000000f0000000 (reserved)
> (XEN)  00000000fec80000 - 00000000fec90000 (reserved)
> (XEN)  00000000fee00000 - 00000000fee01000 (reserved)
> (XEN)  00000000ff000000 - 0000000100000000 (reserved)
> (XEN)  0000000100000000 - 0000000180000000 (usable)
> 
> It turns out that the reserved area at 15M was used by the system's SMI
> handler
> as a register restore area.  Because the hypervisor was stepping on this
> memory,
> the system MTRR settings would change from write-back to write-through after
> any SMI was triggered.  Other, more spectacular, failures could result on
> other
> platforms.
> 
> The attached patch re-adds code that pays attention to the e820 tables
> when seeding the boot allocator with low-memory pages.
> 
> 
> Signed-off-by: Kimball Murray (kimball.murray@xxxxxxxxx)
> 
> 
> ---------------------------- snip -----------------------
> diff -Naur xen/arch/x86/setup.c ../kernel-2.6.18-55bb/xen/arch/x86/setup.c
> --- xen/arch/x86/setup.c 2007-10-23 15:23:10.000000000 -0400
> +++ ../kernel-2.6.18-55bb/xen/arch/x86/setup.c 2007-11-30 16:04:21.000000000
> -0500
> @@ -441,6 +441,39 @@
>      return p;
>  }
>  
> +/*
> + * Add some low memory pages (from "lower" to "upper") to the boot
> + * allocator, but be careful not to add any reserved areas (pay
> + * attention to e820 map).
> + */
> +static void seed_boot_allocator(unsigned long lower, unsigned long upper)
> +{
> +    int i;
> +
> +    for ( i = 0; i < e820_raw_nr; i++ )
> +    {
> +        uint64_t start, end;
> +
> +        if (e820_raw[i].type != E820_RAM)
> +            continue;
> +
> +        start = e820_raw[i].addr;
> +        if (start >= upper)
> +            continue;
> +        if (start < lower)
> +            start = lower;
> +
> +        end = e820_raw[i].addr + e820_raw[i].size;
> +        if (end <= lower)
> +            continue;
> +
> +        if (end > upper)
> +            end = upper;
> +
> +        init_boot_pages(start, end);
> +    }
> +}
> +
>  void __init __start_xen(unsigned long mbi_p)
>  {
>      char *memmap_type = NULL;
> @@ -810,9 +843,10 @@
>      xenheap_phys_end += xen_phys_start;
>      reserve_in_boot_e820(xen_phys_start,
>                           xen_phys_start + (opt_xenheap_megabytes<<20));
> -    init_boot_pages(1<<20, 16<<20); /* Initial seed: 15MB */
> +    /* Initial seed, lower 1M - 16M, but pay attention to e820 tables */
> +    seed_boot_allocator(1 << 20, 16 << 20);
>  #else
> -    init_boot_pages(xenheap_phys_end, 16<<20); /* Initial seed: 4MB */
> +    seed_boot_allocator(xenheap_phys_end, 16<<20); /* Initial seed: 4MB */
>  #endif
>  
>      if ( kexec_crash_area.size != 0 )
> 
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@xxxxxxxxxxxxxxxxxxx
> http://lists.xensource.com/xen-devel



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel