Fix VMX domains not cleaning up properly, since some page refncts are

not zero. One reason for this is that in function shadow_set_l1e(),
before calling function shadow_update_min_max(), one should call
__shadow_get_sl2e() again, since the sl2 entry may be changed.

Signed-off-by: Xin Xiaohui <Xiaohui.xin@intel.com>
Signed-off-by: Li Chengyuan <Chengyuan.li@intel.com>

diff --git a/xen/arch/x86/shadow.c b/xen/arch/x86/shadow.c
index f29cfcc23474e1c813f33b9ebc6ef60ed841fd9a..18e44cc9c04796839a8f72c3c9d9414e5a9ed47f 100644 (file)
--- a/xen/arch/x86/shadow.c
+++ b/xen/arch/x86/shadow.c
@@ -697,6 +697,8 @@ shadow_set_l1e(unsigned long va, l1_pgentry_t new_spte, int create_l1_shadow)
         }
     }
 
+    __shadow_get_l2e(v, va, &sl2e);
+
     if ( shadow_mode_refcounts(d) )
     {
         l1_pgentry_t old_spte;

diff --git a/xen/include/asm-x86/shadow.h b/xen/include/asm-x86/shadow.h
index 48dbef854611ecd89c799c18ddd534c6283bc33b..0e48038889d201b80b3a3650ca1effe944ad7b9a 100644 (file)
--- a/xen/include/asm-x86/shadow.h
+++ b/xen/include/asm-x86/shadow.h
@@ -1595,6 +1595,8 @@ shadow_set_l1e(unsigned long va, l1_pgentry_t new_spte, int create_l1_shadow)
         }
     }
 
+    __shadow_get_l2e(v, va, &sl2e);
+
     if ( shadow_mode_refcounts(d) )
     {
         l1_pgentry_t old_spte = shadow_linear_pg_table[l1_linear_offset(va)];