From mboxrd@z Thu Jan  1 00:00:00 1970
From: Gianluca Guida <gianluca.guida@eu.citrix.com>
Subject: [PATCH] Fix 2-on-3 shadow mode.
Date: Tue, 17 Mar 2009 13:16:36 +0000
Message-ID: <49BFA2B4.7050307@eu.citrix.com>
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="------------000004090708030108030708"
Return-path: <xen-devel-bounces@lists.xensource.com>
List-Unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xensource.com>
List-Help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-Subscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
Sender: xen-devel-bounces@lists.xensource.com
Errors-To: xen-devel-bounces@lists.xensource.com
To: "xen-devel@lists.xensource.com" <xen-devel@lists.xensource.com>
Cc: Keir Fraser <keir.fraser@eu.citrix.com>, Christian Limpach <Christian.Limpach@eu.citrix.com>
List-Id: xen-devel@lists.xenproject.org

This is a multi-part message in MIME format.
--------------000004090708030108030708
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

A wrong #ifdef in multi.c may cause memory corruption in some 32 bit HVM 
guests.

This patch fixes it, and should be applied hopefully to xen-3.3 and 
unstable.

Thanks,
Gianluca


--------------000004090708030108030708
Content-Type: text/x-diff;
 name="fix-2-on-3.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="fix-2-on-3.patch"

diff -r 587e81dd3540 xen/arch/x86/mm/shadow/multi.c
--- a/xen/arch/x86/mm/shadow/multi.c	Mon Mar 02 14:19:35 2009 +0000
+++ b/xen/arch/x86/mm/shadow/multi.c	Tue Mar 17 13:11:46 2009 +0000
@@ -2753,14 +2753,13 @@ int sh_safe_not_to_sync(struct vcpu *v, 
         return 0;
     smfn = _mfn(sp->up >> PAGE_SHIFT);
     ASSERT(mfn_valid(smfn));
-
-#if (GUEST_PAGING_LEVELS == 2)
+#endif
+
+#if (GUEST_PAGING_LEVELS == 2 && SHADOW_PAGING_LEVELS == 3)
     /* In 2-on-3 shadow mode the up pointer contains the link to the
      * shadow page, but the shadow_table contains only the first of the
      * four pages that makes the PAE top shadow tables. */
     smfn = _mfn(mfn_x(smfn) & ~0x3UL);
-#endif
-
 #endif
 
     if ( pagetable_get_pfn(v->arch.shadow_table[0]) == mfn_x(smfn)

--------------000004090708030108030708
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

--------------000004090708030108030708--