[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Xen-devel] [PATCH 0/5 v4] xen/arm: fix guest builder cache cohenrency (again, again)

George gave a release ack to v3.

The last patch here is new and renames the cache flushing functions to
make it clearer what they do (which is clean but not invalidate, which
caught me out). In principal this could wait for 4.5 but given it is a
pure rename I think it might as well go in along with the rest, so that
is what I intend to do unless George objects.

Both 32 and 64 bit have survived ~10,000 boots with this version.

Changes in v4:
                make sure to actually invalidate the cache, not just
                clean it
                rename existing cache flush functions to avoid catching
                me out that way again.

                switch to using a start + length in the domctl interface
Changes in v3:
        xc interface takes a length instead of an end
        make the domctl range inclusive.
        make xc interface internal -- it isn't needed from libxl
        in the current design and it is easier to expose an
        interface in the future than to hide it.
Changes in v2:
        Flush on page alloc and do targeted flushes at domain build time
        rather than a big flush after domain build. This adds a new call
        to common code, which is stubbed out on x86. This avoid needing
        to worry about preemptability of the new domctl and also catches
        cases related to ballooning where things might not be flushed
        (e.g. a guest scrubs a page but doesn't clean the cache)

This has done 12000 boot loops on arm32 and 10000 on arm64.

Given the security aspect I would like to put this in 4.4.

Original blurb:

On ARM we need to take care of cache coherency for guests which we have
just built because they start with their caches disabled.

Our current strategy for dealing with this, which is to make guest
memory default to cacheable regardless of the in guest configuration
(the HCR.DC bit), is flawed because it doesn't handle guests which
enable their MMU before enabling their caches, which at least FreeBSD
does. (NB: Setting HCR.DC while the guest MMU is enabled is
UNPREDICTABLE, hence we must disable it when the guest turns its MMU

There is also a security aspect here since the current strategy means
that a guest which enables its MMU before its caches can potentially see
unscrubbed data in RAM (because the scrubbed bytes are still held in the

As well as the new stuff this series removes the HCR.DC support and
performs two purely cosmetic renames.


Xen-devel mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.