[Xen-devel] Xen 3.1.2 can corrupt BIOS resevered memory between 1M and 16M.

[Kimball Murray <kimball.murray@xxxxxxxxx>]

One of the hypervisor patches applied after the 3.1.0 build (15044.patch) can
cause BIOS-reserved memory regions between 1M and 16M to be overwritten.

Originally, memory in this area was added to the boot allocator only if it
was not reserved, but the 15044 patch removed that code and added this:

+    init_boot_pages(1<<20, 16<<20); /* Initial seed: 15MB */

Stratus is one vendor whose BIOS e820 tables define a 256K reseverved area
starting at 15M (0xf00000).  Here are the e820 tables for that platform:

(XEN) Xen-e820 RAM map:
(XEN)  0000000000000000 - 000000000009a000 (usable)
(XEN)  000000000009a800 - 00000000000a0000 (reserved)
(XEN)  00000000000cc000 - 00000000000d0000 (reserved)
(XEN)  00000000000dc000 - 0000000000100000 (reserved)
(XEN)  0000000000100000 - 0000000000f00000 (usable)
(XEN)  0000000000f00000 - 0000000000f40000 (reserved)
(XEN)  0000000000f40000 - 000000007fef0000 (usable)
(XEN)  000000007fef0000 - 000000007fefa000 (ACPI data)
(XEN)  000000007fefa000 - 000000007ff00000 (ACPI NVS)
(XEN)  000000007ff00000 - 0000000080000000 (reserved)
(XEN)  00000000e0000000 - 00000000f0000000 (reserved)
(XEN)  00000000fec80000 - 00000000fec90000 (reserved)
(XEN)  00000000fee00000 - 00000000fee01000 (reserved)
(XEN)  00000000ff000000 - 0000000100000000 (reserved)
(XEN)  0000000100000000 - 0000000180000000 (usable)

It turns out that the reserved area at 15M was used by the system's SMI handler
as a register restore area.  Because the hypervisor was stepping on this memory,
the system MTRR settings would change from write-back to write-through after
any SMI was triggered.  Other, more spectacular, failures could result on other
platforms.

The attached patch re-adds code that pays attention to the e820 tables
when seeding the boot allocator with low-memory pages.


Signed-off-by: Kimball Murray (kimball.murray@xxxxxxxxx)


---------------------------- snip -----------------------
diff -Naur xen/arch/x86/setup.c ../kernel-2.6.18-55bb/xen/arch/x86/setup.c
--- xen/arch/x86/setup.c        2007-10-23 15:23:10.000000000 -0400
+++ ../kernel-2.6.18-55bb/xen/arch/x86/setup.c  2007-11-30 16:04:21.000000000 
-0500
@@ -441,6 +441,39 @@
     return p;
 }
 
+/*
+ * Add some low memory pages (from "lower" to "upper") to the boot
+ * allocator, but be careful not to add any reserved areas (pay
+ * attention to e820 map).
+ */
+static void seed_boot_allocator(unsigned long lower, unsigned long upper)
+{
+    int i;
+
+    for ( i = 0; i < e820_raw_nr; i++ )
+    {
+        uint64_t start, end;
+
+        if (e820_raw[i].type != E820_RAM)
+            continue;
+
+        start = e820_raw[i].addr;
+        if (start >= upper)
+            continue;
+        if (start < lower)
+            start = lower;
+
+        end = e820_raw[i].addr + e820_raw[i].size;
+        if (end <= lower)
+            continue;
+
+        if (end > upper)
+            end = upper;
+
+        init_boot_pages(start, end);
+    }
+}
+
 void __init __start_xen(unsigned long mbi_p)
 {
     char *memmap_type = NULL;
@@ -810,9 +843,10 @@
     xenheap_phys_end += xen_phys_start;
     reserve_in_boot_e820(xen_phys_start,
                          xen_phys_start + (opt_xenheap_megabytes<<20));
-    init_boot_pages(1<<20, 16<<20); /* Initial seed: 15MB */
+    /* Initial seed, lower 1M - 16M, but pay attention to e820 tables */
+    seed_boot_allocator(1 << 20, 16 << 20);
 #else
-    init_boot_pages(xenheap_phys_end, 16<<20); /* Initial seed: 4MB */
+    seed_boot_allocator(xenheap_phys_end, 16<<20); /* Initial seed: 4MB */
 #endif
 
     if ( kexec_crash_area.size != 0 )

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel