[Xen-changelog] [xen-unstable] [XEN] Zero PAE shadow l3es when destroying subshadows.

[Xen patchbot-unstable <patchbot-unstable@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User Tim Deegan <tim.deegan@xxxxxxxxxxxxx>
# Node ID 6e932f32662cd5d4742780be25b88fd7a782b181
# Parent  30f13007be3fa4206332aa7da2e951644d002822
[XEN] Zero PAE shadow l3es when destroying subshadows.

Normally, we can leave the contents of shadows in place when we destroy
them, but this is not the case for l3 subshadows, since they do not get
zeroed on reallocation unless the entire l3 page is unshadowed.
This fixes several crashes seen with SMP PAE HVM RHEL4.2 guests.
Signed-off-by: Tim Deegan <Tim.Deegan@xxxxxxxxxxxxx>
---
 xen/arch/x86/mm/shadow/multi.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff -r 30f13007be3f -r 6e932f32662c xen/arch/x86/mm/shadow/multi.c
--- a/xen/arch/x86/mm/shadow/multi.c    Mon Oct 09 13:50:00 2006 +0100
+++ b/xen/arch/x86/mm/shadow/multi.c    Mon Oct 09 16:43:09 2006 +0100
@@ -2324,11 +2324,11 @@ static void sh_destroy_l3_subshadow(stru
 /* Tear down just a single 4-entry l3 on a 2-page l3 shadow. */
 {
     int i;
+    mfn_t sl3mfn = _mfn(maddr_from_mapped_domain_page(sl3e) >> PAGE_SHIFT);
     ASSERT((unsigned long)sl3e % (4 * sizeof (shadow_l3e_t)) == 0); 
     for ( i = 0; i < GUEST_L3_PAGETABLE_ENTRIES; i++ ) 
         if ( shadow_l3e_get_flags(sl3e[i]) & _PAGE_PRESENT ) 
-            sh_put_ref(v, shadow_l3e_get_mfn(sl3e[i]),
-                        maddr_from_mapped_domain_page(sl3e));
+            shadow_set_l3e(v, &sl3e[i], shadow_l3e_empty(), sl3mfn);
 }
 #endif
 

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog