From: "Jan Beulich" <jbeulich@novell.com>
Subject: [PATCH] fix c/s 18720 & 18731
Date: Wed, 29 Oct 2008 11:30:35 +0000
Message-ID: <4908576B.76E4.0078.0@novell.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable
Return-path: <xen-devel-bounces@lists.xensource.com>
Content-Disposition: inline
List-Unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xensource.com>
List-Help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-Subscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
Sender: xen-devel-bounces@lists.xensource.com
Errors-To: xen-devel-bounces@lists.xensource.com
To: xen-devel@lists.xensource.com
List-Id: xen-devel@lists.xenproject.org

Entirely removing the tail of free_page_type() wasn't correct - the
type reference must still be dropped for partial pages.

Admittedly, I'm not sure the flush time stamp update is also needed
here, but it seems safer to also copy it from free_page_type()'s former
tail.

Signed-off-by: Jan Beulich <jbeulich@novell.com>

Index: 2008-10-27/xen/arch/x86/domain.c
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
--- 2008-10-27.orig/xen/arch/x86/domain.c	2008-10-28 15:30:37.0000000=
00 +0100
+++ 2008-10-27/xen/arch/x86/domain.c	2008-10-28 15:31:15.000000000 =
+0100
@@ -42,6 +42,7 @@
 #include <asm/mpspec.h>
 #include <asm/ldt.h>
 #include <asm/hypercall.h>
+#include <asm/shadow.h>
 #include <asm/hvm/hvm.h>
 #include <asm/hvm/support.h>
 #include <asm/debugreg.h>
@@ -1687,6 +1688,16 @@ static int relinquish_memory(
             {
                 if ( free_page_type(page, x, 0) !=3D 0 )
                     BUG();
+
+                if ( !(shadow_mode_enabled(d) &&
+                       (page->count_info & PGC_page_table)) )
+                    page->tlbflush_timestamp =3D tlbflush_current_time();
+
+                if ( x & PGT_partial )
+                {
+                    wmb();
+                    page->u.inuse.type_info--;
+                }
                 break;
             }
         }