1.1 --- a/xen/arch/x86/mm/shadow/common.c	Mon Dec 04 19:13:55 2006 +0000
     1.2 +++ b/xen/arch/x86/mm/shadow/common.c	Tue Dec 05 12:42:29 2006 +0000
     1.3 @@ -1246,7 +1246,7 @@ sh_gfn_to_mfn_foreign(struct domain *d, 
     1.4  /* Read another domain's p2m entries */
     1.5  {
     1.6      mfn_t mfn;
     1.7 -    unsigned long addr = gpfn << PAGE_SHIFT;
     1.8 +    paddr_t addr = ((paddr_t)gpfn) << PAGE_SHIFT;
     1.9      l2_pgentry_t *l2e;
    1.10      l1_pgentry_t *l1e;
    1.11      
    1.12 @@ -1274,7 +1274,16 @@ sh_gfn_to_mfn_foreign(struct domain *d, 
    1.13  #if CONFIG_PAGING_LEVELS >= 3
    1.14      {
    1.15          l3_pgentry_t *l3e = sh_map_domain_page(mfn);
    1.16 -        l3e += l3_table_offset(addr);
    1.17 +#if CONFIG_PAGING_LEVELS == 3
    1.18 +        /* On PAE hosts the p2m has eight l3 entries, not four (see
    1.19 +         * shadow_set_p2m_entry()) so we can't use l3_table_offset.
    1.20 +         * Instead, just count the number of l3es from zero.  It's safe
    1.21 +         * to do this because we already checked that the gfn is within
    1.22 +         * the bounds of the p2m. */
    1.23 +        l3e += (((addr) & VADDR_MASK) >> L3_PAGETABLE_SHIFT);
    1.24 +#else
    1.25 +        l3e += l3_table_offset(addr);        
    1.26 +#endif
    1.27          if ( (l3e_get_flags(*l3e) & _PAGE_PRESENT) == 0 )
    1.28          {
    1.29              sh_unmap_domain_page(l3e);