The domain structure maintains several shadow mode stats,

such as shadow page counts for l1 & l2, hl2 tables, snapshots,
etc.  These counts are not decremented properly when we
free shadow pages.  The following patch fixes this problem.

Signed-off-by: Khoa Huynh <khoa@us.ibm.com>

xen/arch/x86/shadow32.c

@@ -399,22 +399,26 @@ void free_shadow_page(unsigned long smfn)
         perfc_decr(shadow_l1_pages);
         shadow_demote(d, gpfn, gmfn);
         free_shadow_l1_table(d, smfn);
+        d->arch.shadow_page_count--;
         break;
 
     case PGT_l2_shadow:
         perfc_decr(shadow_l2_pages);
         shadow_demote(d, gpfn, gmfn);
         free_shadow_l2_table(d, smfn, page->u.inuse.type_info);
+        d->arch.shadow_page_count--;
         break;
 
     case PGT_hl2_shadow:
         perfc_decr(hl2_table_pages);
         shadow_demote(d, gpfn, gmfn);
         free_shadow_hl2_table(d, smfn);
+        d->arch.hl2_page_count--;
         break;
 
     case PGT_snapshot:
         perfc_decr(snapshot_pages);
+        d->arch.snapshot_page_count--;
         break;
 
     default:
@@ -423,8 +427,6 @@ void free_shadow_page(unsigned long smfn)
         break;
     }
 
-    d->arch.shadow_page_count--;
-
     // No TLB flushes are needed the next time this page gets allocated.
     //
     page->tlbflush_timestamp = 0;

xen/arch/x86/shadow_public.c

@@ -595,18 +595,21 @@ void free_shadow_page(unsigned long smfn)
         perfc_decr(shadow_l1_pages);
         shadow_demote(d, gpfn, gmfn);
         free_shadow_l1_table(d, smfn);
+        d->arch.shadow_page_count--;
         break;
 #if defined (__i386__)
     case PGT_l2_shadow:
         perfc_decr(shadow_l2_pages);
         shadow_demote(d, gpfn, gmfn);
         free_shadow_l2_table(d, smfn, page->u.inuse.type_info);
+        d->arch.shadow_page_count--;
         break;
 
     case PGT_hl2_shadow:
         perfc_decr(hl2_table_pages);
         shadow_demote(d, gpfn, gmfn);
         free_shadow_hl2_table(d, smfn);
+        d->arch.hl2_page_count--;
         break;
 #else
     case PGT_l2_shadow:
@@ -614,12 +617,13 @@ void free_shadow_page(unsigned long smfn)
     case PGT_l4_shadow:
         shadow_demote(d, gpfn, gmfn);
         free_shadow_tables(d, smfn, shadow_type_to_level(type));
+        d->arch.shadow_page_count--;
         break;
 
     case PGT_fl1_shadow:
         free_shadow_fl1_table(d, smfn);
+        d->arch.shadow_page_count--;
         break;
-
 #endif
 
     case PGT_snapshot:
@@ -632,8 +636,6 @@ void free_shadow_page(unsigned long smfn)
         break;
     }
 
-    d->arch.shadow_page_count--;
-
     // No TLB flushes are needed the next time this page gets allocated.
     //
     page->tlbflush_timestamp = 0;