1.1 --- a/xen/arch/x86/hvm/svm/svm.c	Fri Oct 20 16:06:53 2006 +0100
     1.2 +++ b/xen/arch/x86/hvm/svm/svm.c	Fri Oct 20 17:52:32 2006 +0100
     1.3 @@ -1555,9 +1555,8 @@ static int svm_set_cr0(unsigned long val
     1.4      if ((value & X86_CR0_PE) && (value & X86_CR0_PG) && !paging_enabled) 
     1.5      {
     1.6          /* The guest CR3 must be pointing to the guest physical. */
     1.7 -        if (!VALID_MFN(mfn = 
     1.8 -                       get_mfn_from_gpfn(v->arch.hvm_svm.cpu_cr3 >> PAGE_SHIFT))
     1.9 -            || !get_page(mfn_to_page(mfn), v->domain))
    1.10 +        mfn = get_mfn_from_gpfn(v->arch.hvm_svm.cpu_cr3 >> PAGE_SHIFT);
    1.11 +        if ( !VALID_MFN(mfn) || !get_page(mfn_to_page(mfn), v->domain))
    1.12          {
    1.13              printk("Invalid CR3 value = %lx\n", v->arch.hvm_svm.cpu_cr3);
    1.14              domain_crash_synchronous(); /* need to take a clean path */
    1.15 @@ -1741,9 +1740,8 @@ static int mov_to_cr(int gpreg, int cr, 
    1.16               * first.
    1.17               */
    1.18              HVM_DBG_LOG(DBG_LEVEL_VMMU, "CR3 value = %lx", value);
    1.19 -            if (((value >> PAGE_SHIFT) > v->domain->max_pages) 
    1.20 -                || !VALID_MFN(mfn = get_mfn_from_gpfn(value >> PAGE_SHIFT))
    1.21 -                || !get_page(mfn_to_page(mfn), v->domain))
    1.22 +            mfn = get_mfn_from_gpfn(value >> PAGE_SHIFT);
    1.23 +            if ( !VALID_MFN(mfn) || !get_page(mfn_to_page(mfn), v->domain))
    1.24              {
    1.25                  printk("Invalid CR3 value=%lx\n", value);
    1.26                  domain_crash_synchronous(); /* need to take a clean path */
    1.27 @@ -1777,9 +1775,8 @@ static int mov_to_cr(int gpreg, int cr, 
    1.28                  /* The guest is a 32-bit PAE guest. */
    1.29  #if CONFIG_PAGING_LEVELS >= 3
    1.30                  unsigned long mfn, old_base_mfn;
    1.31 -
    1.32 -                if ( !VALID_MFN(mfn = get_mfn_from_gpfn(
    1.33 -                    v->arch.hvm_svm.cpu_cr3 >> PAGE_SHIFT)) ||
    1.34 +                mfn = get_mfn_from_gpfn(v->arch.hvm_svm.cpu_cr3 >> PAGE_SHIFT);
    1.35 +                if ( !VALID_MFN(mfn) || 
    1.36                       !get_page(mfn_to_page(mfn), v->domain) )
    1.37                  {
    1.38                      printk("Invalid CR3 value = %lx", v->arch.hvm_svm.cpu_cr3);

     2.1 --- a/xen/arch/x86/hvm/vmx/vmx.c	Fri Oct 20 16:06:53 2006 +0100
     2.2 +++ b/xen/arch/x86/hvm/vmx/vmx.c	Fri Oct 20 17:52:32 2006 +0100
     2.3 @@ -1323,12 +1323,13 @@ static int vmx_world_restore(struct vcpu
     2.4           * first.
     2.5           */
     2.6          HVM_DBG_LOG(DBG_LEVEL_VMMU, "CR3 c->cr3 = %x", c->cr3);
     2.7 -        if ((c->cr3 >> PAGE_SHIFT) > v->domain->max_pages) {
     2.8 +        mfn = get_mfn_from_gpfn(c->cr3 >> PAGE_SHIFT);
     2.9 +        if ( !VALID_MFN(mfn) )
    2.10 +        {
    2.11              printk("Invalid CR3 value=%x", c->cr3);
    2.12              domain_crash_synchronous();
    2.13              return 0;
    2.14          }
    2.15 -        mfn = get_mfn_from_gpfn(c->cr3 >> PAGE_SHIFT);
    2.16          if(!get_page(mfn_to_page(mfn), v->domain))
    2.17                  return 0;
    2.18          old_base_mfn = pagetable_get_pfn(v->arch.guest_table);
    2.19 @@ -1508,9 +1509,8 @@ static int vmx_set_cr0(unsigned long val
    2.20           * Trying to enable guest paging.
    2.21           * The guest CR3 must be pointing to the guest physical.
    2.22           */
    2.23 -        if ( !VALID_MFN(mfn = get_mfn_from_gpfn(
    2.24 -            v->arch.hvm_vmx.cpu_cr3 >> PAGE_SHIFT)) ||
    2.25 -             !get_page(mfn_to_page(mfn), v->domain) )
    2.26 +        mfn = get_mfn_from_gpfn(v->arch.hvm_vmx.cpu_cr3 >> PAGE_SHIFT);
    2.27 +        if ( !VALID_MFN(mfn) || !get_page(mfn_to_page(mfn), v->domain) )
    2.28          {
    2.29              printk("Invalid CR3 value = %lx (mfn=%lx)\n", 
    2.30                     v->arch.hvm_vmx.cpu_cr3, mfn);
    2.31 @@ -1712,11 +1712,10 @@ static int mov_to_cr(int gp, int cr, str
    2.32               * first.
    2.33               */
    2.34              HVM_DBG_LOG(DBG_LEVEL_VMMU, "CR3 value = %lx", value);
    2.35 -            if ( ((value >> PAGE_SHIFT) > v->domain->max_pages ) ||
    2.36 -                 !VALID_MFN(mfn = get_mfn_from_gpfn(value >> PAGE_SHIFT)) ||
    2.37 -                 !get_page(mfn_to_page(mfn), v->domain) )
    2.38 +            mfn = get_mfn_from_gpfn(value >> PAGE_SHIFT);
    2.39 +            if ( !VALID_MFN(mfn) || !get_page(mfn_to_page(mfn), v->domain) )
    2.40              {
    2.41 -                printk("Invalid CR3 value=%lx", value);
    2.42 +                printk("Invalid CR3 value=%lx\n", value);
    2.43                  domain_crash_synchronous(); /* need to take a clean path */
    2.44              }
    2.45              old_base_mfn = pagetable_get_pfn(v->arch.guest_table);
    2.46 @@ -1745,16 +1744,14 @@ static int mov_to_cr(int gp, int cr, str
    2.47                  /* The guest is a 32-bit PAE guest. */
    2.48  #if CONFIG_PAGING_LEVELS >= 3
    2.49                  unsigned long mfn, old_base_mfn;
    2.50 -
    2.51 -                if ( !VALID_MFN(mfn = get_mfn_from_gpfn(
    2.52 -                                    v->arch.hvm_vmx.cpu_cr3 >> PAGE_SHIFT)) ||
    2.53 +                mfn = get_mfn_from_gpfn(v->arch.hvm_vmx.cpu_cr3 >> PAGE_SHIFT);
    2.54 +                if ( !VALID_MFN(mfn) ||
    2.55                       !get_page(mfn_to_page(mfn), v->domain) )
    2.56                  {
    2.57                      printk("Invalid CR3 value = %lx", v->arch.hvm_vmx.cpu_cr3);
    2.58                      domain_crash_synchronous(); /* need to take a clean path */
    2.59                  }
    2.60  
    2.61 -
    2.62                  /*
    2.63                   * Now arch.guest_table points to machine physical.
    2.64                   */