From mboxrd@z Thu Jan 1 00:00:00 1970 From: Keir Fraser Subject: Re: [PATCH] x86/boot: Fix BIOS memory corruption on certain IBM systems Date: Wed, 04 Dec 2013 07:17:03 +0000 Message-ID: References: <1386102859-14477-1-git-send-email-andrew.cooper3@citrix.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1386102859-14477-1-git-send-email-andrew.cooper3@citrix.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Andrew Cooper , Xen-devel Cc: George Dunlap , Keir Fraser , Jan Beulich List-Id: xen-devel@lists.xenproject.org On 03/12/2013 20:34, "Andrew Cooper" wrote: > IBM System x3530 M4 BIOSes (including the latest available at the time of this > patch) will corrupt a byte at physical address 0x105ff1 to the value of 0x86 > if %esp has the value 0x00080000 when issuing an `int $0x15 (ax=0xec00)` to > inform the system about our intended operating mode. > > Xen gets unhappy when the bootloader has placed it's .text section in over > this specific region of RAM. > > After dropping into 16bit mode, initialise as much state as we possibly can to > sane values. This includes 0 for all the GPRs and %cs for %fs and %gs which > would otherwise be unreal segment selectors. > > Signed-off-by: Andrew Cooper > CC: Keir Fraser > CC: Jan Beulich > CC: George Dunlap Acked-by: Keir Fraser > --- > > George: > * This fixes a memory corruption issue, so counts towards both #1 and #2 as > far as a freeze exception goes. > --- > xen/arch/x86/boot/trampoline.S | 9 ++++++++- > 1 file changed, 8 insertions(+), 1 deletion(-) > > diff --git a/xen/arch/x86/boot/trampoline.S b/xen/arch/x86/boot/trampoline.S > index 827f412..f4dfb94 100644 > --- a/xen/arch/x86/boot/trampoline.S > +++ b/xen/arch/x86/boot/trampoline.S > @@ -140,10 +140,12 @@ trampoline_boot_cpu_entry: > 1: mov %cs,%ax > mov %ax,%ds > mov %ax,%es > + mov %ax,%fs > + mov %ax,%gs > mov %ax,%ss > > /* Initialise stack pointer and IDT, and enable irqs. */ > - xor %sp,%sp > + xor %esp,%esp > lidt bootsym(rm_idt) > sti > > @@ -151,6 +153,11 @@ trampoline_boot_cpu_entry: > * Declare that our target operating mode is long mode. > * Initialise 32-bit registers since some buggy BIOSes depend on it. > */ > + xor %ecx,%ecx > + xor %edx,%edx > + xor %esi,%esi > + xor %edi,%edi > + xor %ebp,%ebp > movl $0xec00,%eax # declare target operating mode > movl $0x0002,%ebx # long mode > int $0x15