Index: qemu-kvm/kvm/user/config-x86-common.mak
===================================================================
--- qemu-kvm.orig/kvm/user/config-x86-common.mak
+++ qemu-kvm/kvm/user/config-x86-common.mak
@@ -42,6 +42,9 @@ $(TEST_DIR)/sieve.flat: $(cstart.o) $(TE
 		$(TEST_DIR)/print.o $(TEST_DIR)/vm.o
  
 $(TEST_DIR)/vmexit.flat: $(cstart.o) $(TEST_DIR)/vmexit.o
+
+$(TEST_DIR)/slot_deletion.flat: $(cstart.o) $(TEST_DIR)/slot_deletion.o \
+		$(TEST_DIR)/print.o $(TEST_DIR)/vm.o
  
 $(TEST_DIR)/test32.flat: $(TEST_DIR)/test32.o
 
Index: qemu-kvm/kvm/user/config-x86_64.mak
===================================================================
--- qemu-kvm.orig/kvm/user/config-x86_64.mak
+++ qemu-kvm/kvm/user/config-x86_64.mak
@@ -7,6 +7,7 @@ CFLAGS += -D__x86_64__
 tests = $(TEST_DIR)/access.flat $(TEST_DIR)/sieve.flat \
       $(TEST_DIR)/simple.flat $(TEST_DIR)/stringio.flat \
       $(TEST_DIR)/memtest1.flat $(TEST_DIR)/emulator.flat \
-      $(TEST_DIR)/hypercall.flat $(TEST_DIR)/apic.flat
+      $(TEST_DIR)/hypercall.flat $(TEST_DIR)/apic.flat \
+      $(TEST_DIR)/slot_deletion.flat
 
 include config-x86-common.mak
Index: qemu-kvm/kvm/user/test/x86/slot_deletion.c
===================================================================
--- /dev/null
+++ qemu-kvm/kvm/user/test/x86/slot_deletion.c
@@ -0,0 +1,130 @@
+/* test parallel faults vs slot deletion */
+
+#include "libcflat.h"
+#include "vm.h"
+#include "smp.h"
+
+static unsigned int inl(unsigned short port)
+{
+    unsigned int val;
+    asm volatile ("inl %w1, %0":"=a" (val):"Nd" (port));
+    return val;
+}
+
+static void outl(unsigned int data, unsigned short port)
+{
+    asm volatile ("outl %0, %1"::"a" (data), "d" (port));
+}
+
+static int write_mem_slot (unsigned long start, unsigned long end)
+{
+    outl(start, 0x2018);
+    outl((unsigned long) start >> 32, 0x201c);
+
+    outl(end, 0x2020);
+    outl((unsigned long) end >> 32, 0x2024);
+    return 0;
+}
+
+#define CMD_CREATE_SLOT 0x0
+#define CMD_DELETE_SLOT 0x1
+
+int create_mem_slot(unsigned long start, unsigned long end)
+{
+    write_mem_slot (start, end);
+    outl(CMD_CREATE_SLOT, 0x2028);
+    return 0;
+}
+
+int delete_mem_slot(unsigned long start, unsigned long end)
+{
+    write_mem_slot (start, end);
+    outl(CMD_DELETE_SLOT, 0x2028);
+    return 0;
+}
+
+void map_addr_with_pte_phys(void *virt_addr, unsigned long pte_phys,
+			    void *target_page)
+{
+    /* 1:1 map the pagetable inside memslot */
+    install_page(phys_to_virt(read_cr3()), pte_phys, (void *)pte_phys);
+    install_pte(phys_to_virt(read_cr3()), 1, virt_addr,
+	        virt_to_phys(target_page) | PTE_PRESENT | PTE_WRITE,
+	        (void *) pte_phys);
+}
+
+#define define_barrier(x) int count_##x = 0;            \
+static void barrier_##x(void) {                         \
+    count_##x++;                                        \
+    while (count_##x < cpu_count());                    \
+}
+
+define_barrier(cr3);
+define_barrier(fault);
+define_barrier(done);
+
+static void fault_vaddr(void *data)
+{
+    unsigned long *target_map = data;
+
+    barrier_fault();
+    *target_map = 0;
+    barrier_done();
+}
+
+void run_test(void)
+{
+    unsigned long start, end, pte_phys;
+    void *target_page, *virt_addr;
+    int i;
+
+    start = inl(0xd1);
+    end = start + (PAGE_SIZE * 1000);
+    create_mem_slot(start, end);
+    target_page = alloc_page();
+
+    pte_phys = start;
+    virt_addr = (void *) 0xfffffa000;
+    for (i = 2; i <= cpu_count(); i++) {
+        map_addr_with_pte_phys(virt_addr, pte_phys, target_page);
+        pte_phys += PAGE_SIZE;
+        virt_addr += PAGE_SIZE * 512;
+    }
+
+    count_fault = 0;
+    count_done = 0;
+    pte_phys = start;
+    virt_addr = (void *)0xfffffa000;
+    for (i = 2; i <= cpu_count(); i++) {
+        on_cpu_noipi(i-1, fault_vaddr, virt_addr);
+        pte_phys += PAGE_SIZE;
+        virt_addr += PAGE_SIZE * 512;
+    }
+
+    barrier_fault();
+    delete_mem_slot(start, end);
+    barrier_done();
+}
+
+static void setup_cr3 (void *cr3)
+{
+    load_cr3(virt_to_phys(cr3));
+    barrier_cr3();
+}
+
+int main (void)
+{
+    int i;
+
+    setup_vm();
+    for (i = 2; i <= cpu_count(); i++)
+        on_cpu_noipi(i-1, setup_cr3, (void *)read_cr3());
+
+    barrier_cr3();
+
+    for (i = 0; i < 100; i++)
+        run_test();
+
+    printf("SUCCESS\n");
+    return 0;
+}
