Bug in tmem: refcount leak leaves zombie saved domains

[Keir Fraser <keir.fraser@eu.citrix.com>]

Dan,

Just doing some save/restore testing on xen-unstable tip, I noticed that:
# xm create ./pv_config
# xm save PV1

Would leave the saved guest as a zombie in the DOMDYING_dead state with no
pages, yet with refcnt=1. This happens absolutely consistently. Just as
consistently, it does not happen when I boot Xen with no-tmem. My conclusion
is that tmem is leaking a domain reference count during domain save. This
doesn't happen if I merely "xm create ...; xm destroy ...".

My pv_config file contains nothing exciting:
kernel = "/nfs/keir/xen/xen64.hg/dist/install/boot/vmlinuz-2.6.18.8-xenU"
memory = 750
name = "PV1"
vcpus = 2
vif = [ 'mac=00:1a:00:00:01:01' ]
disk = [ 'phy:/dev/VG/Suse10.1_64_1,sda1,w' ]
root = "/dev/sda1 ro xencons=tty"
extra = ""
tsc_native = 1
on_poweroff = 'destroy'
on_reboot   = 'restart'
on_crash    = 'preserve'

The dom{0,U} kernels are tip of linux-2.6.18-xen, default -xen{0,U} configs.

 -- Keir