bitkeeper revision 1.1159.1.448 (41a4e1873FIBJhbUOyKJjtxPlJiEgA)

Merge arcadians.cl.cam.ac.uk:/auto/groups/xeno/BK/xen-unstable.bk
into arcadians.cl.cam.ac.uk:/auto/groups/xeno/users/cl349/BK/xen.bk-smp

.rootkeys

@@ -127,7 +127,6 @@
 3e5a4e683HKVU-sxtagrDasRB8eBVw linux-2.4.27-xen-sparse/mm/swapfile.c
 41180721bNns9Na7w1nJ0ZVt8bhUNA linux-2.4.27-xen-sparse/mm/vmalloc.c
 41505c57WAd5l1rlfCLNSCpx9J13vA linux-2.4.27-xen-sparse/net/core/skbuff.c
-41a270bfmh73b5G5UMWfoUZhxoIjTg linux-2.6.9-xen-sparse/Makefile
 40f562372u3A7_kfbYYixPHJJxYUxA linux-2.6.9-xen-sparse/arch/xen/Kconfig
 40f56237utH41NPukqHksuNf29IC9A linux-2.6.9-xen-sparse/arch/xen/Kconfig.drivers
 40f56237penAAlWVBVDpeQZNFIg8CA linux-2.6.9-xen-sparse/arch/xen/Makefile

xen/arch/x86/x86_32/mm.c

@@ -190,16 +190,38 @@ int check_descriptor(unsigned long *d)
     limit++; /* We add one because limit is inclusive. */
     if ( (b & _SEGMENT_G) )
         limit <<= 12;
-    if ( ((base + limit) <= base) || 
-         ((base + limit) > PAGE_OFFSET) )
+
+    if ( (b & (3<<10)) == 1 )
     {
-        /* Need to truncate. Calculate and poke a best-effort limit. */
-        limit = PAGE_OFFSET - base;
-        if ( (b & _SEGMENT_G) )
-            limit >>= 12;
-        limit--;
-        d[0] &= ~0x0ffff; d[0] |= limit & 0x0ffff;
-        d[1] &= ~0xf0000; d[1] |= limit & 0xf0000;
+        /*
+         * Grows-down limit check. 
+         * NB. limit == 0xFFFFF provides no access      (if G=1).
+         *     limit == 0x00000 provides 4GB-4kB access (if G=1).
+         */
+        if ( (base + limit) > base )
+        {
+            limit = -(base & PAGE_MASK);
+            goto truncate;
+        }
+    }
+    else
+    {
+        /*
+         * Grows-up limit check.
+         * NB. limit == 0xFFFFF provides 4GB access (if G=1).
+         *     limit == 0x00000 provides 4kB access (if G=1).
+         */
+        if ( ((base + limit) <= base) || 
+             ((base + limit) > PAGE_OFFSET) )
+        {
+            limit = PAGE_OFFSET - base;
+        truncate:
+            if ( !(b & _SEGMENT_G) )
+                goto bad; /* too dangerous; too hard to work out... */
+            limit = (limit >> 12) - 1;
+            d[0] &= ~0x0ffff; d[0] |= limit & 0x0ffff;
+            d[1] &= ~0xf0000; d[1] |= limit & 0xf0000;
+        }
     }
 
  good:

xen/arch/x86/x86_32/seg_fixup.c

@@ -225,8 +225,7 @@ int fixup_seg(u16 seg, int positive_access)
         if ( ((base + limit) < PAGE_SIZE) && positive_access )
         {
             /* Flip to expands-up. */
-            limit >>= 12;
-            limit -= (-PAGE_OFFSET/PAGE_SIZE) + 2;
+            limit = PAGE_OFFSET - base;
             goto flip;
         }
     }
@@ -236,8 +235,7 @@ int fixup_seg(u16 seg, int positive_access)
         if ( ((PAGE_OFFSET - (base + limit)) < PAGE_SIZE) && !positive_access )
         {
             /* Flip to expands-down. */
-            limit >>= 12;
-            limit += (-PAGE_OFFSET/PAGE_SIZE) + 0;
+            limit = -(base & PAGE_MASK);
             goto flip;
         }
     }
@@ -249,9 +247,10 @@ int fixup_seg(u16 seg, int positive_access)
     return 0;
 
  flip:
+    limit = (limit >> 12) - 1;
     a &= ~0x0ffff; a |= limit & 0x0ffff;
     b &= ~0xf0000; b |= limit & 0xf0000;
-    b ^= 1 << 10;
+    b ^= 1 << 10; /* grows-up <-> grows-down */
     /* NB. These can't fault. Checked readable above; must also be writable. */
     table[2*idx+0] = a;
     table[2*idx+1] = b;