1.1 --- a/xen/arch/x86/mm/shadow/common.c	Fri Apr 06 11:27:36 2007 +0100
     1.2 +++ b/xen/arch/x86/mm/shadow/common.c	Fri Apr 06 14:34:43 2007 +0100
     1.3 @@ -1245,9 +1245,6 @@ static unsigned int sh_set_allocation(st
     1.4              list_del(&sp->list);
     1.5              d->arch.paging.shadow.free_pages -= 1<<SHADOW_MAX_ORDER;
     1.6              d->arch.paging.shadow.total_pages -= 1<<SHADOW_MAX_ORDER;
     1.7 -            for ( j = 0; j < 1<<SHADOW_MAX_ORDER; j++ ) 
     1.8 -                /* Keep the page allocator happy */
     1.9 -                ((struct page_info *)sp)[j].count_info = 0;
    1.10              free_domheap_pages((struct page_info *)sp, SHADOW_MAX_ORDER);
    1.11          }
    1.12  

     2.1 --- a/xen/common/page_alloc.c	Fri Apr 06 11:27:36 2007 +0100
     2.2 +++ b/xen/common/page_alloc.c	Fri Apr 06 14:34:43 2007 +0100
     2.3 @@ -445,7 +445,19 @@ static void free_heap_pages(
     2.4  
     2.5      for ( i = 0; i < (1 << order); i++ )
     2.6      {
     2.7 -        BUG_ON(pg[i].count_info != 0);
     2.8 +        /*
     2.9 +         * Cannot assume that count_info == 0, as there are some corner cases
    2.10 +         * where it isn't the case and yet it isn't a bug:
    2.11 +         *  1. page_get_owner() is NULL
    2.12 +         *  2. page_get_owner() is a domain that was never accessible by
    2.13 +         *     its domid (e.g., failed to fully construct the domain).
    2.14 +         *  3. page was never addressable by the guest (e.g., it's an
    2.15 +         *     auto-translate-physmap guest and the page was never included
    2.16 +         *     in its pseudophysical address space).
    2.17 +         * In all the above cases there can be no guest mappings of this page.
    2.18 +         */
    2.19 +        pg[i].count_info = 0;
    2.20 +
    2.21          if ( (d = page_get_owner(&pg[i])) != NULL )
    2.22          {
    2.23              pg[i].tlbflush_timestamp = tlbflush_current_time();