diff --git a/hypervisor/arch/x86/guest/guest.c b/hypervisor/arch/x86/guest/guest.c
index a1eceb1d8..8329d5f55 100644
--- a/hypervisor/arch/x86/guest/guest.c
+++ b/hypervisor/arch/x86/guest/guest.c
@@ -603,6 +603,59 @@ int prepare_vm0_memmap_and_e820(struct vm *vm)
 	return 0;
 }
 
+uint64_t e820_alloc_low_memory(uint32_t size)
+{
+	uint32_t i;
+	struct e820_entry *entry, *new_entry;
+
+	/* We want memory in page boundary and integral multiple of pages */
+	size = ROUND_PAGE_UP(size);
+
+	for (i = 0; i < e820_entries; i++) {
+		entry = &e820[i];
+		uint64_t start, end, length;
+
+		start = ROUND_PAGE_UP(entry->baseaddr);
+		end = ROUND_PAGE_DOWN(entry->baseaddr + entry->length);
+		length = end - start;
+		length = (end > start) ? (end - start) : 0;
+
+		/* Search for available low memory */
+		if ((entry->type != E820_TYPE_RAM)
+			|| (length < size)
+			|| (start + size > MEM_1M)) {
+			continue;
+		}
+
+		/* found exact size of e820 entry */
+		if (length == size) {
+			entry->type = E820_TYPE_RESERVED;
+			e820_mem.total_mem_size -= size;
+			return start;
+		}
+
+		/*
+		 * found entry with available memory larger than requested
+		 * alocate memory from the end of this entry at page boundary
+		 */
+		new_entry = &e820[e820_entries];
+		new_entry->type = E820_TYPE_RESERVED;
+		new_entry->baseaddr = end - size;
+		new_entry->length = entry->baseaddr +
+			entry->length - new_entry->baseaddr;
+
+		/* Shrink the existing entry and total available memory */
+		entry->length -= new_entry->length;
+		e820_mem.total_mem_size -= new_entry->length;
+		e820_entries++;
+
+		return new_entry->baseaddr;
+	}
+
+	pr_fatal("Can't allocate memory under 1M from E820\n");
+	return ACRN_INVALID_HPA;
+}
+
 #ifdef CONFIG_START_VM0_BSP_64BIT
 /*******************************************************************
  *         GUEST initial page table
diff --git a/hypervisor/bsp/uefi/efi/malloc.c b/hypervisor/bsp/uefi/efi/malloc.c
index 879f7d62c..40581db4e 100644
--- a/hypervisor/bsp/uefi/efi/malloc.c
+++ b/hypervisor/bsp/uefi/efi/malloc.c
@@ -164,6 +164,65 @@ fail:
 	return err;
 }
 
+EFI_STATUS emalloc_for_low_mem(EFI_PHYSICAL_ADDRESS *addr, UINTN size)
+{
+	UINTN map_size, map_key, desc_size;
+	EFI_MEMORY_DESCRIPTOR *map_buf;
+	UINTN d, map_end;
+	UINT32 desc_version;
+	EFI_STATUS err;
+	UINTN nr_pages = EFI_SIZE_TO_PAGES(size);
+
+	err = memory_map(&map_buf, &map_size, &map_key,
+			 &desc_size, &desc_version);
+
+	if (err != EFI_SUCCESS)
+		goto fail;
+
+	d = (UINTN)map_buf;
+	map_end = (UINTN)map_buf + map_size;
+
+	for (; d < map_end; d += desc_size) {
+		EFI_MEMORY_DESCRIPTOR *desc;
+		EFI_PHYSICAL_ADDRESS start, end, aligned;
+
+		desc = (EFI_MEMORY_DESCRIPTOR *)d;
+		if (desc->Type != EfiConventionalMemory)
+			continue;
+
+		if (desc->NumberOfPages < nr_pages)
+			continue;
+
+		start = desc->PhysicalStart;
+		end = start + (desc->NumberOfPages << EFI_PAGE_SHIFT);
+		size = nr_pages << EFI_PAGE_SHIFT;
+
+		/* allocate in low memory only */
+		if (start >= 1 << 20)
+			continue;
+
+		if (end > 1 << 20)
+			end = (1 << 20);
+
+		if (end - start >= size) {
+			aligned = end - size;
+			err = allocate_pages(AllocateAddress, EfiReservedMemoryType,
+						 nr_pages, &aligned);
+			if (err == EFI_SUCCESS) {
+				*addr = aligned;
+				break;
+			}
+		}
+	}
+
+	if (d == map_end)
+		err = EFI_OUT_OF_RESOURCES;
+
+	free_pool(map_buf);
+fail:
+	return err;
+}
+
 /* FIXME: This function cannot guarantee to return address under 4G,
  * and the hypervisor cannot handle params, which address is above 4G,
  * delivered from efi stub.
diff --git a/hypervisor/bsp/uefi/efi/stdlib.h b/hypervisor/bsp/uefi/efi/stdlib.h
index 8fbbff980..5e1c20df1 100644
--- a/hypervisor/bsp/uefi/efi/stdlib.h
+++ b/hypervisor/bsp/uefi/efi/stdlib.h
@@ -50,6 +50,7 @@ extern void *calloc(UINTN nmemb, UINTN size);
 
 extern EFI_STATUS emalloc(UINTN, UINTN, EFI_PHYSICAL_ADDRESS *);
 extern EFI_STATUS __emalloc(UINTN, UINTN, EFI_PHYSICAL_ADDRESS *, EFI_MEMORY_TYPE);
+extern EFI_STATUS emalloc_for_low_mem(EFI_PHYSICAL_ADDRESS *addr, UINTN size);
 extern void efree(EFI_PHYSICAL_ADDRESS, UINTN);
 
 static inline void memset(void *dstv, char ch, UINTN size)
diff --git a/hypervisor/include/arch/x86/guest/guest.h b/hypervisor/include/arch/x86/guest/guest.h
index 4b9aac2ca..57ea5621e 100644
--- a/hypervisor/include/arch/x86/guest/guest.h
+++ b/hypervisor/include/arch/x86/guest/guest.h
@@ -60,6 +60,7 @@ struct e820_mem_params {
 };
 
 int prepare_vm0_memmap_and_e820(struct vm *vm);
+uint64_t e820_alloc_low_memory(uint32_t size);
 
 /* Definition for a mem map lookup */
 struct vm_lu_mem_map {