ACPI_BIOS_USING_OS_MEMORY

ACPI_BIOS_USING_OS_MEMORY

 

最近我们的BIOS碰到一个奇怪的bug，最初是插上4G的Memory， BIOS Setup中只能显示3G，后来BIOS修改代码以后总算在Setup menu里面显示出了4G。显示虽然对了可再也进不去OS了，每次都是蓝底白字直接blue screen。死状如下图1所示。

    

 图 1

 

          可能是因为SWPM知道我之前有写过一篇讲述ACPI debug的文章，于是她就请我support让我帮帮分析这个问题。说实话蓝屏分析我实在没经 验，从没分析过L。不过最近也不是很忙，那就当作业练习一下了。架起WinDbg，将1394转PCIE的接口插到板子上(开发板上没有1394接口)。然后让debuggee run，一旦蓝屏WinDbg就会被断下，让我们来看看蓝屏的信息吧。 

Waiting to reconnect...

Connected to Windows 6001 x86 compatible target, ptr64 FALSE

Kernel Debugger connection established.

Symbol search path is: D:/Vista32-sp1symbol;D:/websymbols-sp1;C:/WINNT/Symbols

Executable search path is:

Windows Kernel Version 6001 MP (1 procs) Free x86 compatible

Built by: 6001.18000.x86fre.longhorn_rtm.080118-1840

Kernel base = 0x8203d000 PsLoadedModuleList = 0x82154c70

System Uptime: not available

 

*** Fatal System Error: 0x000000a5

                       (0x00001000,0x00000000,0xFFFFFF00,0x00000105)

 

Break instruction exception - code 80000003 (first chance)

 

A fatal system error has occurred.

Debugger entered on first try; Bugcheck callbacks have not been invoked.

 

A fatal system error has occurred.

 

Connected to Windows 6001 x86 compatible target, ptr64 FALSE

Loading Kernel Symbols

........................................

Loading User Symbols

 

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

 

Use !analyze -v to get detailed debugging information.

 

BugCheck A5, {1000, 0, ffffff00, 105}

 

Probably caused by : acpi.sys ( acpi!MapPhysMem+39 )

 

Followup: MachineOwner

---------

 

nt!RtlpBreakWithStatusInstruction:

820f5514 cc              int     3

 

由上面的信息我们知道系统发生了致命的错误错误代码为0x000000a5。Fatal System Error: 0x000000a5而且这个错误应该是由于acpi.sys (acpi!MapPhysMem+39)导致的。能获得的信息就是这么多了。更详细的信息需要输入

0: kd> !analyze –v

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

 

ACPI_BIOS_ERROR (a5)

The ACPI Bios in the system is not fully compliant with the ACPI specification.

The first value indicates where the incompatibility lies:

This bug check covers a great variety of ACPI problems.  If a kernel debugger

is attached, use "!analyze -v".  This command will analyze the precise problem,

and display whatever information is most useful for debugging the specific

error.

Arguments:

Arg1: 00001000, ACPI_BIOS_USING_OS_MEMORY

   ACPI had a fatal error when processing a memory

operation region.The memory operation region tried to

map memory that has been allocated for OS usage.

Arg2: 00000000, The high portion of the physical address

 of the memory region.

Arg3: ffffff00, The low portion of the physical address

 of the memory region.

Arg4: 00000105, The length of memory being mapped.

 

Debugging Details:

------------------

 

 

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

 

BUGCHECK_STR:  0xA5

 

PROCESS_NAME:  System

 

CURRENT_IRQL:  2

 

LOCK_ADDRESS:  821715e0 -- (!locks 821715e0)

 

Resource @ nt!PiEngineLock (0x821715e0)    Exclusively owned

     Threads: 85d28668-01<*>

1 total locks, 1 locks currently held

 

PNP_TRIAGE:

   Lock address  : 0x821715e0

   Thread Count  : 1

   Thread address: 0x85d28668

   Thread wait   : 0x28

 

LAST_CONTROL_TRANSFER:  from 8210a2d7 to 820f5514

 

STACK_TEXT: 

8039920c 8210a2d7 00000003 bac8867b 00000000 nt!RtlpBreakWithStatusInstruction

8039925c 8210adbd 00000003 00000105 ffffff00 nt!KiBugCheckDebugBreak+0x1c

80399628 8210a163 000000a5 00001000 00000000 nt!KeBugCheck2+0x66d

8039964c 80627376 000000a5 00001000 00000000 nt!KeBugCheckEx+0x1e

80399674 80627f9b ffffff00 00000105 85d60e58 acpi!MapPhysMem+0x39

80399690 8062aba1 85d5f000 ffffff00 00000105 acpi!MapUnmapPhysMem+0x2f

803996b4 8062f4cb 85d5f000 00000000 00008000 acpi!OpRegion+0xcb

803996d0 806287dc 85d5f000 85d60e58 00000000 acpi!ParseTerm+0x14d

803996f8 80629c75 00000000 00000000 806374b8 acpi!RunContext+0x65

80399710 80629d40 85d5f000 00000000 806374b8 acpi!InsertReadyQueue+0xa7

8039972c 8062991b 85d5f000 00000000 0000205b acpi!RestartContext+0x27

80399768 80623af9 85d5f000 86121380 85d5f000 acpi!SyncLoadDDB+0xde

8039977c 8063c4b9 ffd19010 8039979c 80636fc4 acpi!AMLILoadDDB+0x66

80399794 8063c521 86a972b0 00000000 8200df60 acpi!ACPIInitializeDDB+0x37

803997b0 8063c645 8200dec0 80637b60 80637d00 acpi!ACPIInitializeDDBs+0x47

803997c4 8061b43c 86a97bf8 86a97a38 00000000 acpi!ACPIInitialize+0xe9

803997f4 80640f7c 86a97bf8 86a7e3b0 80640ec8 acpi!ACPIInitStartACPI+0x6a

80399820 80616e4b 86a97bf8 86a7e3b0 86a7e3b0 acpi!ACPIRootIrpStartDevice+0xb4

80399850 820f9053 86a97bf8 86a97a38 803998cc acpi!ACPIDispatchIrp+0xff

80399868 821a1605 00000000 85d104c0 86a97878 nt!IofCallDriver+0x63

80399884 8204912a 803998a8 82048f47 86a97878 nt!PnpAsynchronousCall+0x96

803998d0 821a24f6 82048f47 86a97878 86a7edc8 nt!PnpStartDevice+0xb7

8039992c 821a23b1 86a97878 00000012 00000000 nt!PnpStartDeviceNode+0x13a

80399948 8219f4db 00000000 00000000 8216f530 nt!PipProcessStartPhase1+0x65

80399b44 820489e8 85d58260 00000000 80399b88 nt!PipProcessDevNodeTree+0x187

80399b9c 820488f8 00000000 86a7e5d0 833fa3b8 nt!PnpDeviceActionWorker+0xde

80399bb8 82396078 00000000 00000007 00000000 nt!PnpRequestDeviceAction+0x127

80399c34 82398ff1 808108c4 8080e430 00000000 nt!IopInitializeBootDrivers+0x3b0

80399c94 8239ccb3 808108c4 85d28990 85d28668 nt!IoInitSystem+0x5af

80399d74 82195af1 80399dc0 82212a1c 808108c4 nt!Phase1InitializationDiscard+0xb86

80399d7c 82212a1c 808108c4 bac889e7 00000000 nt!Phase1Initialization+0xd

80399dc0 8206ba3e 82195ae4 808108c4 00000000 nt!PspSystemThreadStartup+0x9d

00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

 

 

STACK_COMMAND:  kb

 

FOLLOWUP_IP:

acpi!MapPhysMem+39

80627376 6a00            push    0

 

SYMBOL_STACK_INDEX:  4

 

FOLLOWUP_NAME:  MachineOwner

 

MODULE_NAME: acpi

 

IMAGE_NAME:  acpi.sys

 

DEBUG_FLR_IMAGE_TIMESTAMP:  47918b80

 

SYMBOL_NAME:  acpi!MapPhysMem+39

 

FAILURE_BUCKET_ID:  0xA5_acpi!MapPhysMem+39

 

BUCKET_ID:  0xA5_acpi!MapPhysMem+39

 

Followup: MachineOwner

---------

 

0: kd> lmvm acpi

start    end        module name

8060e000 80654000   acpi       (pdb symbols)          C:/WINNT/Symbols/sys/acpi.pdb

    Loaded symbol image file: acpi.sys

    Image path: /SystemRoot/system32/drivers/acpi.sys

    Image name: acpi.sys

    Timestamp:        Fri Jan 18 21:32:48 2008 (47918B80)

    CheckSum:         00041A1F

    ImageSize:        00046000

    File version:     6.0.6001.18000

    Product version:  6.0.6001.18000

    File flags:       0 (Mask 3F)

    File OS:          40004 NT Win32

    File type:        3.7 Driver

    File date:        00000000.00000000

    Translations:     0409.04b0

    CompanyName:      Microsoft Corporation

    ProductName:      Microsoft? Windows? Operating System

    InternalName:     ACPI.sys

    OriginalFilename: ACPI.sys

    ProductVersion:   6.0.6001.18000

    FileVersion:      6.0.6001.18000 (longhorn_rtm.080118-1840)

    FileDescription:  ACPI Driver for NT

    LegalCopyright:   ? Microsoft Corporation. All rights reserved.

 

这次信息比较详细了，给出了call stack以及acpi.pdb这个符号文件的信息了经过分析我得出了导致蓝屏的主要原因如下：最直接的原因是acpi!MapPhysMem+39该处的代码导致的，而该代码会出错又是因为BIOS中的ACPI memory map出错，OS使用的memory被BIOS占用了。原因大概明了了，那么到底是哪段BIOS code出了问题了呢？静下心来，我开始努力搜索脑海中的记忆，既然是ACPI出错那么应该是在asl code中，我记得以前看过的 asl code中当需要使用系统资源的时候通常要声OperationRegion比如我需要使用一些IO资源那么我要这么写：

OperationRegion( IO_, SystemIO, 0x62, 5 ) 

如需要使用SystemMemory则需要下面的写法:

OperationRegion(XPEX, SystemMemory, 0xE0020100, 0x100)

 

bug analysis info报出如下错误：

Arguments:

Arg1: 00001000, ACPI_BIOS_USING_OS_MEMORY

   ACPI had a fatal error when processing a memory

operation region.The memory operation region tried to

map memory that has been allocated for OS usage.

Arg2: 00000000, The high portion of the physical address

 of the memory region.

Arg3: ffffff00, The low portion of the physical address

 of the memory region.

Arg4: 00000105, The length of memory being mapped.

 

从字面上看我觉得应该是在asl code中声明一段System Memory然后acpi.sys这支driver解析该段System Memory的时候出错了。么到底是哪一段code导致的呢？arg3、arg4道出了天机。应该是像下面写法的一段code导致的：

OperationRegion(？？？, SystemMemory, 0xffffff00, 0x105)

那么我就开始搜索asl code 最终在发现了罪犯的踪迹,下面的一段aslcode存在重大作案嫌疑：

Scope(/) { OperationRegion(ATFB,SystemMemory,0xFFFFFF00,0x105)// Relocatable operationRegion. Field(ATFB,AnyAcc,NoLock,Preserve) // Field { BCMD,8, DID,32, INFO,2048, } }

 

   BIOS拿掉这段code以后，板子工作正常了，愉快的进入了OS。Bug是解掉了，可是到底为什么这么声明一段区域会导致错误呢？BIOS给出的解释是这部分code没有被用到，可是它和BIOS声明给OS的资源在地址上有冲突。于是就蓝屏了J。

 

Peter