[Xen-devel] [PATCH] Make pte writes in map_pages_to_xen() atomic

[Avi Kivity <avi@xxxxxxxxxxxx>]

With debug=y, Xen calls map_pages_to_xen() to remap its own page 
tables.  On pae builds, the pte writes are nonatomic.  This causes Xen 
to crash under kvm (and presumably under other shadow page table caching 
VMMs), because after the first half of the pte update, the code under 
eip is no longer accessible.  It's also possible under bare metal if an 
SMI arrives exactly at the wrong moment, and in addition that SMI 
flushes the tlb.
Fix by using atomic pte writes.  With this, xen pae debug=y boots under kvm.

Reported by Jeremy Fitzhardinge <jeremy@xxxxxxxx>.

Signed-off-by: Avi Kivity <avi@xxxxxxxxxxxx>

--
error compiling committee.c: too many arguments to function

diff -r 039daabebad5 xen/arch/x86/mm.c
--- a/xen/arch/x86/mm.c Fri Apr 13 16:07:48 2007 +0100
+++ b/xen/arch/x86/mm.c Sun Apr 15 18:36:59 2007 +0300
@@ -3454,14 +3454,14 @@ int map_pages_to_xen(
                     l1e_write(&pl1e[i],
                               l1e_from_pfn(l2e_get_pfn(*pl2e) + i,
                                            l2e_get_flags(*pl2e) & ~_PAGE_PSE));
-                l2e_write(pl2e, l2e_from_pfn(virt_to_mfn(pl1e),
+                l2e_write_atomic(pl2e, l2e_from_pfn(virt_to_mfn(pl1e),
                                              __PAGE_HYPERVISOR));
                 local_flush_tlb_pge();
             }
 
             pl1e  = l2e_to_l1e(*pl2e) + l1_table_offset(virt);
             ol1e  = *pl1e;
-            l1e_write(pl1e, l1e_from_pfn(mfn, flags));
+            l1e_write_atomic(pl1e, l1e_from_pfn(mfn, flags));
             if ( (l1e_get_flags(ol1e) & _PAGE_PRESENT) )
                 local_flush_tlb_one(virt);
 

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel