Re: [PATCH][4.17] EFI: don't convert memory marked for runtime use to ordinary RAM

[Jan Beulich <jbeulich@xxxxxxxx>]

On 04.10.2022 12:38, Roger Pau Monné wrote:
> On Tue, Oct 04, 2022 at 12:23:23PM +0200, Jan Beulich wrote:
>> On 04.10.2022 11:33, Roger Pau Monné wrote:
>>> On Tue, Oct 04, 2022 at 10:06:36AM +0200, Jan Beulich wrote:
>>>> On 30.09.2022 16:28, Roger Pau Monné wrote:
>>>>> On Fri, Sep 30, 2022 at 09:50:40AM +0200, Jan Beulich wrote:
>>>>>> efi_init_memory() in both relevant places is treating EFI_MEMORY_RUNTIME
>>>>>> higher priority than the type of the range. To avoid accessing memory at
>>>>>> runtime which was re-used for other purposes, make
>>>>>> efi_arch_process_memory_map() follow suit. While on x86 in theory the
>>>>>> same would apply to EfiACPIReclaimMemory, we don't actually "reclaim"
>>>>>> E820_ACPI memory there and hence that type's handling can be left alone.
>>>>>
>>>>> What about dom0?  Should it be translated to E820_RESERVED so that
>>>>> dom0 doesn't try to use it either?
>>>>
>>>> I'm afraid I don't understand the questions. Not the least because I
>>>> think "it" can't really mean "dom0" from the earlier sentence.
>>>
>>> Sorry, let me try again:
>>>
>>> The memory map provided to dom0 will contain E820_ACPI entries for
>>> memory ranges with the EFI_MEMORY_RUNTIME attributes in the EFI memory
>>> map.  Is there a risk from dom0 reclaiming such E820_ACPI ranges,
>>> overwriting the data needed for runtime services?
>>
>> How would Dom0 go about doing so? It has no control over what we hand
>> to the page allocator - it can only free pages which were actually
>> allocated to it. E820_ACPI and E820_RESERVED pages are assigned to
>> DomIO - Dom0 can map and access them, but it cannot free them.
> 
> Maybe I'm very confused, but what about dom0 overwriting the data
> there, won't it cause issues to runtime services?

If it overwrites it, of course there are going to be issues. Just like
there are going to be problems from anything else Dom0 does wrong.

> If the memory is reported in the memory map provided to dom0 as
> E820_ACPI dom0 is free to reclaim the region for it's own usage.

Could you outline to me how such a "reclaim" process would look like?
For the range to become ordinary RAM, Xen needs to be involved. But
there's no hypercall allowing Dom0 to free a page which wasn't
allocated to it. And the Dom0 kernel simply re-using the range as if
it was RAM is flawed - it would break the latest once Dom0 would try
to balloon out such a page.

Jan