Gerd Hoffmann wrote: > Didn't try (yet), but I don't think so. It's not the pgd which is > broken, but the pmd. And I think this way: > > (1) pmd is created > (2) pmd is taken out of the slabcache and used for the kernel/xen > address space (i.e. slot-3 in the PAE pgd). > (3) xen fills in the page table entries for the hypervisor hole > (4) pmd released and put back into the slab cache. > (5) pmd gets reused, but for userspace addresses this time (pgd > slot 0-2). > (6) xen_pin() finds the stale entries for the hypervisor hole > ==> Oops. Ah, right. J