With debug=y, Xen calls map_pages_to_xen() to remap its own page
tables. On pae builds, the pte writes are nonatomic. This causes Xen
to crash under kvm (and presumably under other shadow page table caching
VMMs), because after the first half of the pte update, the code under
eip is no longer accessible. It's also possible under bare metal if an
SMI arrives exactly at the wrong moment, and in addition that SMI
flushes the tlb.
Fix by using atomic pte writes. With this, xen pae debug=y boots under kvm.
Reported by Jeremy Fitzhardinge <[EMAIL PROTECTED]>.
Signed-off-by: Avi Kivity <[EMAIL PROTECTED]>
--
error compiling committee.c: too many arguments to function
diff -r 039daabebad5 xen/arch/x86/mm.c
--- a/xen/arch/x86/mm.c Fri Apr 13 16:07:48 2007 +0100
+++ b/xen/arch/x86/mm.c Sun Apr 15 18:36:59 2007 +0300
@@ -3454,14 +3454,14 @@ int map_pages_to_xen(
l1e_write(&pl1e[i],
l1e_from_pfn(l2e_get_pfn(*pl2e) + i,
l2e_get_flags(*pl2e) & ~_PAGE_PSE));
- l2e_write(pl2e, l2e_from_pfn(virt_to_mfn(pl1e),
+ l2e_write_atomic(pl2e, l2e_from_pfn(virt_to_mfn(pl1e),
__PAGE_HYPERVISOR));
local_flush_tlb_pge();
}
pl1e = l2e_to_l1e(*pl2e) + l1_table_offset(virt);
ol1e = *pl1e;
- l1e_write(pl1e, l1e_from_pfn(mfn, flags));
+ l1e_write_atomic(pl1e, l1e_from_pfn(mfn, flags));
if ( (l1e_get_flags(ol1e) & _PAGE_PRESENT) )
local_flush_tlb_one(virt);
-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
kvm-devel mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/kvm-devel
