Free shadows of any pages which are released by a domain back to Xen.

This should fix the "Assertion '! IS_INVALID_M2P_ENTRY(gpfn)'"-crash in
free_shadow_page on domain destruction.

Signed-off-by: Christian Limpach <Christian.Limpach@cl.cam.ac.uk>

diff --git a/xen/include/asm-x86/shadow.h b/xen/include/asm-x86/shadow.h
index ca988bbecea23ed3cb3a57a39881a9fbf57077a8..28d50466ea004519cdfcb2710db3af2797242419 100644 (file)
--- a/xen/include/asm-x86/shadow.h
+++ b/xen/include/asm-x86/shadow.h
@@ -1506,6 +1506,7 @@ static inline void guest_physmap_remove_page(
     struct domain *d, unsigned long gpfn, unsigned long mfn)
 {
     struct domain_mmap_cache c1, c2;
+    unsigned long type;
 
     if ( likely(!shadow_mode_translate(d)) )
         return;
@@ -1514,6 +1515,8 @@ static inline void guest_physmap_remove_page(
     domain_mmap_cache_init(&c2);
     shadow_lock(d);
     shadow_sync_and_drop_references(d, mfn_to_page(mfn));
+    while ( (type = shadow_max_pgtable_type(d, gpfn, NULL)) != PGT_none )
+        free_shadow_page(__shadow_status(d, gpfn, type));
     set_p2m_entry(d, gpfn, -1, &c1, &c2);
     set_gpfn_from_mfn(mfn, INVALID_M2P_ENTRY);
     shadow_unlock(d);