Re: [PATCH] x86/boot: Fix BIOS memory corruption on certain IBM systems

[Keir Fraser <keir.xen@gmail.com>]

On 03/12/2013 20:34, "Andrew Cooper" <andrew.cooper3@citrix.com> wrote:

> IBM System x3530 M4 BIOSes (including the latest available at the time of this
> patch) will corrupt a byte at physical address 0x105ff1 to the value of 0x86
> if %esp has the value 0x00080000 when issuing an `int $0x15 (ax=0xec00)` to
> inform the system about our intended operating mode.
> 
> Xen gets unhappy when the bootloader has placed it's .text section in over
> this specific region of RAM.
> 
> After dropping into 16bit mode, initialise as much state as we possibly can to
> sane values. This includes 0 for all the GPRs and %cs for %fs and %gs which
> would otherwise be unreal segment selectors.
> 
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
> CC: Keir Fraser <keir@xen.org>
> CC: Jan Beulich <JBeulich@suse.com>
> CC: George Dunlap <george.dunlap@eu.citrix.com>

Acked-by: Keir Fraser <keir@xen.org>

> ---
> 
> George:
>  * This fixes a memory corruption issue, so counts towards both #1 and #2 as
>    far as a freeze exception goes.
> ---
>  xen/arch/x86/boot/trampoline.S |    9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/xen/arch/x86/boot/trampoline.S b/xen/arch/x86/boot/trampoline.S
> index 827f412..f4dfb94 100644
> --- a/xen/arch/x86/boot/trampoline.S
> +++ b/xen/arch/x86/boot/trampoline.S
> @@ -140,10 +140,12 @@ trampoline_boot_cpu_entry:
>  1:      mov     %cs,%ax
>          mov     %ax,%ds
>          mov     %ax,%es
> +        mov     %ax,%fs
> +        mov     %ax,%gs
>          mov     %ax,%ss
>  
>          /* Initialise stack pointer and IDT, and enable irqs. */
> -        xor     %sp,%sp
> +        xor     %esp,%esp
>          lidt    bootsym(rm_idt)
>          sti
>  
> @@ -151,6 +153,11 @@ trampoline_boot_cpu_entry:
>           * Declare that our target operating mode is long mode.
>           * Initialise 32-bit registers since some buggy BIOSes depend on it.
>           */
> +        xor     %ecx,%ecx
> +        xor     %edx,%edx
> +        xor     %esi,%esi
> +        xor     %edi,%edi
> +        xor     %ebp,%ebp
>          movl    $0xec00,%eax      # declare target operating mode
>          movl    $0x0002,%ebx      # long mode
>          int     $0x15