Re: [PATCH][4.17] EFI: don't convert memory marked for runtime use to ordinary RAM

[Jan Beulich <jbeulich@xxxxxxxx>]

On 04.10.2022 12:49, Andrew Cooper wrote:
> On 04/10/2022 11:23, Jan Beulich wrote:
>> On 04.10.2022 11:33, Roger Pau Monné wrote:
>>> On Tue, Oct 04, 2022 at 10:06:36AM +0200, Jan Beulich wrote:
>>>> On 30.09.2022 16:28, Roger Pau Monné wrote:
>>>>> On Fri, Sep 30, 2022 at 09:50:40AM +0200, Jan Beulich wrote:
>>>>>> efi_init_memory() in both relevant places is treating EFI_MEMORY_RUNTIME
>>>>>> higher priority than the type of the range. To avoid accessing memory at
>>>>>> runtime which was re-used for other purposes, make
>>>>>> efi_arch_process_memory_map() follow suit. While on x86 in theory the
>>>>>> same would apply to EfiACPIReclaimMemory, we don't actually "reclaim"
>>>>>> E820_ACPI memory there and hence that type's handling can be left alone.
>>>>> What about dom0?  Should it be translated to E820_RESERVED so that
>>>>> dom0 doesn't try to use it either?
>>>> I'm afraid I don't understand the questions. Not the least because I
>>>> think "it" can't really mean "dom0" from the earlier sentence.
>>> Sorry, let me try again:
>>>
>>> The memory map provided to dom0 will contain E820_ACPI entries for
>>> memory ranges with the EFI_MEMORY_RUNTIME attributes in the EFI memory
>>> map.  Is there a risk from dom0 reclaiming such E820_ACPI ranges,
>>> overwriting the data needed for runtime services?
>> How would Dom0 go about doing so?
> 
> Zeroing the memory and putting it into its own heap.

This makes no sense.

> You seem to be presuming that some unwritten and unenforced rules exist.

There's the PV interface. All memory management related functionality
has to be based on the E820 map handed to the domain (irrespective of
it being Dom0 or DomU). That map has no E820_ACPI entries for PV (and
PVH Dom0 is as of yet unsupported). Dom0 is also handed the host E820,
but it is supposed to use it only for resource management (e.g. to
determine where BARs may be placed, or how to arrange its PFN space).

> Once dom0 has booted, Xen cannot safety touch any ACPI reclaimable
> range.

I clearly disagree, and I expect existing behavior also disagrees with
you.

Jan

>  It doesn't go wrong in practice because OSes don't actually
> reclaim the reclaimable ranges (which is also why Xen HVM guests don't
> explode either.)
> 
> ~Andrew