bitkeeper revision 1.1640 (429f380cmOBrQfCPrfaJptORVNmNSQ)

Fix page-table initialisation (MPT, linear mappings, and mapcache).
In particular, we were mapping garbage pages into the idle page
directory which caused bogus unflushable mappings to get speculatively
loaded into the TLB (nasty crashes).
Signed-off-by: Keir Fraser <keir@xensource.com>

diff --git a/xen/arch/x86/x86_32/domain_page.c b/xen/arch/x86/x86_32/domain_page.c
index 6322f5d411d3f622c4d904c5b73e1ea40bd34169..4ede10b0553eb1e4b0a89337f39b6ab1199fc5e4 100644 (file)
--- a/xen/arch/x86/x86_32/domain_page.c
+++ b/xen/arch/x86/x86_32/domain_page.c
@@ -29,13 +29,11 @@ static spinlock_t map_lock = SPIN_LOCK_UNLOCKED;
 static void flush_all_ready_maps(void)
 {
     l1_pgentry_t *cache = mapcache;
+    unsigned int i;
 
-    /* A bit skanky -- depends on having an aligned PAGE_SIZE set of PTEs. */
-    do {
-        if ( (l1e_get_flags(*cache) & READY_FOR_TLB_FLUSH) )
-            *cache = l1e_empty();
-    }
-    while ( ((unsigned long)(++cache) & ~PAGE_MASK) != 0 );
+    for ( i = 0; i < MAPCACHE_ENTRIES; i++ )
+        if ( (l1e_get_flags(cache[i]) & READY_FOR_TLB_FLUSH) )
+            cache[i] = l1e_empty();
 }
 
 

diff --git a/xen/arch/x86/x86_32/mm.c b/xen/arch/x86/x86_32/mm.c
index 507407ffc092dd8addc00c7f6e98f535ee0c5697..885f064ffb48d403ca7edc74c302b0c2d6c05db9 100644 (file)
--- a/xen/arch/x86/x86_32/mm.c
+++ b/xen/arch/x86/x86_32/mm.c
@@ -59,8 +59,9 @@ l2_pgentry_t *virt_to_xen_l2e(unsigned long v)
 void __init paging_init(void)
 {
     void *ioremap_pt;
-    unsigned long v,v2,i;
+    unsigned long v;
     struct pfn_info *pg;
+    int i, mapcache_order;
 
 #ifdef CONFIG_X86_PAE
     printk("PAE enabled, limit: %d GB\n", MACHPHYS_MBYTES);
@@ -70,64 +71,56 @@ void __init paging_init(void)
 
     idle0_exec_domain.arch.monitor_table = mk_pagetable(__pa(idle_pg_table));
 
-    /* Allocate and map the machine-to-phys table and create read-only
-     * mapping of MPT for guest-OS use.  Without PAE we'll end up with
-     * one 4MB page, with PAE we'll allocate 2MB pages depending on
-     * the amout of memory installed, but at least 4MB to cover 4GB
-     * address space.  This is needed to make PCI I/O memory address
-     * lookups work in guests. -- kraxel */
-    mpt_size = max_page * 4;
-    if (mpt_size < 4*1024*1024)
+    /*
+     * Allocate and map the machine-to-phys table and create read-only mapping 
+     * of MPT for guest-OS use.  Without PAE we'll end up with one 4MB page, 
+     * with PAE we'll allocate 2MB pages depending on the amount of memory 
+     * installed, but at least 4MB to cover 4GB address space.  This is needed 
+     * to make PCI I/O memory address lookups work in guests.
+     */
+    if ( (mpt_size = max_page * 4) < (4*1024*1024) )
         mpt_size = 4*1024*1024;
-    for (v  = RDWR_MPT_VIRT_START, v2 = RO_MPT_VIRT_START;
-         v != RDWR_MPT_VIRT_END && mpt_size > (v - RDWR_MPT_VIRT_START);
-         v += (1 << L2_PAGETABLE_SHIFT), v2 += (1 << L2_PAGETABLE_SHIFT)) {
+    for ( i = 0; i < (mpt_size >> L2_PAGETABLE_SHIFT); i++ )
+    {
         if ( (pg = alloc_domheap_pages(NULL, PAGETABLE_ORDER)) == NULL )
             panic("Not enough memory to bootstrap Xen.\n");
-        idle_pg_table_l2[l2_linear_offset(v)] =
+        idle_pg_table_l2[l2_linear_offset(RDWR_MPT_VIRT_START) + i] =
             l2e_from_page(pg, __PAGE_HYPERVISOR | _PAGE_PSE);
-        idle_pg_table_l2[l2_linear_offset(v2)] =
+        idle_pg_table_l2[l2_linear_offset(RO_MPT_VIRT_START) + i] =
             l2e_from_page(pg, (__PAGE_HYPERVISOR | _PAGE_PSE) & ~_PAGE_RW);
     }
     memset((void *)RDWR_MPT_VIRT_START, 0x55, mpt_size);
 
-    /* Xen 2/4MB mappings can all be GLOBAL. */
+    /* Xen PSE mappings can all be GLOBAL. */
     if ( cpu_has_pge )
     {
-        for ( v = HYPERVISOR_VIRT_START; v; v += (1 << L2_PAGETABLE_SHIFT) ) {
-            if (!l2e_get_flags(idle_pg_table_l2[l2_linear_offset(v)]) & _PAGE_PSE)
+        for ( v = HYPERVISOR_VIRT_START; v; v += (1 << L2_PAGETABLE_SHIFT) )
+        {
+            if ( (l2e_get_flags(idle_pg_table_l2[l2_linear_offset(v)]) &
+                  (_PAGE_PSE|_PAGE_PRESENT)) != (_PAGE_PSE|_PAGE_PRESENT) )
                 continue;
-            if (v >= RO_MPT_VIRT_START && v < RO_MPT_VIRT_END)
+            if ( (v >= RO_MPT_VIRT_START) && (v < RO_MPT_VIRT_END) )
                 continue;
-            l2e_add_flags(idle_pg_table_l2[l2_linear_offset(v)],
-                          _PAGE_GLOBAL);
+            l2e_add_flags(idle_pg_table_l2[l2_linear_offset(v)], _PAGE_GLOBAL);
         }
     }
 
-    /* Create page table(s) for ioremap(). */
-    for (v = IOREMAP_VIRT_START; v != IOREMAP_VIRT_END; v += (1 << L2_PAGETABLE_SHIFT)) {
+    /* Create page tables for ioremap(). */
+    for ( i = 0; i < (IOREMAP_MBYTES >> (L2_PAGETABLE_SHIFT - 20)); i++ )
+    {
         ioremap_pt = (void *)alloc_xenheap_page();
         clear_page(ioremap_pt);
-        idle_pg_table_l2[l2_linear_offset(v)] =
+        idle_pg_table_l2[l2_linear_offset(IOREMAP_VIRT_START) + i] =
             l2e_from_page(virt_to_page(ioremap_pt), __PAGE_HYPERVISOR);
     }
 
     /* Set up mapping cache for domain pages. */
-    mapcache = (l1_pgentry_t*)alloc_xenheap_pages(10-PAGETABLE_ORDER);
-    for (v = MAPCACHE_VIRT_START, i = 0;
-         v != MAPCACHE_VIRT_END;
-         v += (1 << L2_PAGETABLE_SHIFT), i++) {
-        clear_page(mapcache + i*L1_PAGETABLE_ENTRIES);
-        idle_pg_table_l2[l2_linear_offset(v)] =
-            l2e_from_page(virt_to_page(mapcache + i*L1_PAGETABLE_ENTRIES),
-                            __PAGE_HYPERVISOR);
-    }
-
-    for (v = LINEAR_PT_VIRT_START; v != LINEAR_PT_VIRT_END; v += (1 << L2_PAGETABLE_SHIFT)) {
-        idle_pg_table_l2[l2_linear_offset(v)] =
-            l2e_from_page(virt_to_page(idle_pg_table_l2 + ((v-RDWR_MPT_VIRT_START) >> PAGETABLE_ORDER)),
-                            __PAGE_HYPERVISOR);
-    }
+    mapcache_order = get_order(MAPCACHE_MBYTES << (20 - PAGETABLE_ORDER));
+    mapcache = (l1_pgentry_t *)alloc_xenheap_pages(mapcache_order);
+    memset(mapcache, 0, PAGE_SIZE << mapcache_order);
+    for ( i = 0; i < (MAPCACHE_MBYTES >> (L2_PAGETABLE_SHIFT - 20)); i++ )
+        idle_pg_table_l2[l2_linear_offset(MAPCACHE_VIRT_START) + i] =
+            l2e_from_page(virt_to_page(mapcache) + i, __PAGE_HYPERVISOR);
 }
 
 void __init zap_low_mappings(l2_pgentry_t *base)
@@ -148,7 +141,8 @@ void __init zap_low_mappings(l2_pgentry_t *base)
 
 void subarch_init_memory(struct domain *dom_xen)
 {
-    unsigned long i, v, m2p_start_mfn;
+    unsigned long m2p_start_mfn;
+    int i;
 
     /*
      * We are rather picky about the layout of 'struct pfn_info'. The
@@ -164,21 +158,18 @@ void subarch_init_memory(struct domain *dom_xen)
                offsetof(struct pfn_info, count_info),
                offsetof(struct pfn_info, u.inuse._domain),
                sizeof(struct pfn_info));
-        for ( ; ; )
-            __asm__ __volatile__ ( "hlt" );
+        BUG();
     }
 
     /* M2P table is mappable read-only by privileged domains. */
-    for (v  = RDWR_MPT_VIRT_START;
-         v != RDWR_MPT_VIRT_END && mpt_size > (v - RDWR_MPT_VIRT_START);
-         v += (1 << L2_PAGETABLE_SHIFT)) {
+    for ( i = 0; i < (mpt_size >> L2_PAGETABLE_SHIFT); i++ )
+    {
         m2p_start_mfn = l2e_get_pfn(
-            idle_pg_table_l2[l2_linear_offset(v)]);
+            idle_pg_table_l2[l2_linear_offset(RDWR_MPT_VIRT_START) + i]);
         for ( i = 0; i < L2_PAGETABLE_ENTRIES; i++ )
         {
             frame_table[m2p_start_mfn+i].count_info = PGC_allocated | 1;
-            /* gdt to make sure it's only mapped read-only by non-privileged
-               domains. */
+            /* Ensure it's only mapped read-only by domains. */
             frame_table[m2p_start_mfn+i].u.inuse.type_info = PGT_gdt_page | 1;
             page_set_owner(&frame_table[m2p_start_mfn+i], dom_xen);
         }

diff --git a/xen/include/asm-x86/x86_32/domain_page.h b/xen/include/asm-x86/x86_32/domain_page.h
index 7ebb72eb72e91c9a2c73866a8b12674869b0fcf2..d46f21b67a5ac04c942346dd154e548d74228a25 100644 (file)
--- a/xen/include/asm-x86/x86_32/domain_page.h
+++ b/xen/include/asm-x86/x86_32/domain_page.h
@@ -11,7 +11,8 @@
 #include <xen/sched.h>
 
 extern l1_pgentry_t *mapcache;
-#define MAPCACHE_ENTRIES        1024
+#define MAPCACHE_ORDER    10
+#define MAPCACHE_ENTRIES  (1 << MAPCACHE_ORDER)
 
 /*
  * Maps a given physical address, returning corresponding virtual address.