Index: sys/arch/xen/xen/clock.c
===================================================================
RCS file: /cvsroot/src/sys/arch/xen/xen/clock.c,v
retrieving revision 1.64
diff -p -u -r1.64 clock.c
--- sys/arch/xen/xen/clock.c	12 Jun 2016 09:08:09 -0000	1.64
+++ sys/arch/xen/xen/clock.c	29 Oct 2017 15:06:51 -0000
@@ -118,22 +118,29 @@ get_time_values_from_xen(struct cpu_info
 	KASSERT(mutex_owned(&tmutex));
 
 	do {
-		shadow->time_version = t->version;
+		if (1 & (shadow->time_version = t->version)) {
+			/* update in progress */
+			SPINLOCK_BACKOFF_HOOK;
+			continue;
+		}
 		xen_rmb();
 		shadow->tsc_stamp = t->tsc_timestamp;
 		shadow->system_time = t->system_time;
 		shadow->freq_mul = t->tsc_to_system_mul;
 		shadow->freq_shift = t->tsc_shift;
 		xen_rmb();
-	} while ((t->version & 1) || (shadow->time_version != t->version));
+	} while (shadow->time_version != t->version);
 	do {
-		tversion = HYPERVISOR_shared_info->wc_version;
+		if (1 & (tversion = HYPERVISOR_shared_info->wc_version)) {
+			/* update in progress */
+			SPINLOCK_BACKOFF_HOOK;
+			continue;
+		}
 		xen_rmb();
 		shadow->ts.tv_sec = HYPERVISOR_shared_info->wc_sec;
 		shadow->ts.tv_nsec = HYPERVISOR_shared_info->wc_nsec;
 		xen_rmb();
-	} while ((HYPERVISOR_shared_info->wc_version & 1) ||
-	    (tversion != HYPERVISOR_shared_info->wc_version));
+	} while (tversion != HYPERVISOR_shared_info->wc_version);
 }
 
 /*
@@ -537,11 +544,23 @@ xen_timer_handler(void *arg, struct intr
 	struct cpu_info *ci = curcpu();
 	KASSERT(arg == ci);
 	int err;
+
+	/*
+	 * The only time the clock bias should be nonzero is while
+	 * we're going through and running some missed hardclock ticks.
+	 */
+	KASSERT(xen_clock_bias[ci->ci_cpuid] == 0);
+
 again:
 	mutex_enter(&tmutex);
 	delta = (int64_t)(get_vcpu_time(ci) - vcpu_system_time[ci->ci_cpuid]);
 	mutex_exit(&tmutex);
 
+	if (delta < 0) {
+		printf("Xen clock ran backwards by %"PRId64" nanoseconds!\n",
+		    -delta);
+	}
+
 	/* Several ticks may have passed without our being run; catch up. */
 	while (delta >= (int64_t)NS_PER_TICK) {
 		mutex_enter(&tmutex);
@@ -560,12 +579,16 @@ again:
 	    vcpu_system_time[ci->ci_cpuid] + NS_PER_TICK);
 	if (err)
 		goto again;
-	
-	if (xen_clock_bias[ci->ci_cpuid]) {
-		mutex_enter(&tmutex);
-		xen_clock_bias[ci->ci_cpuid] = 0;
-		mutex_exit(&tmutex);
-	}
+
+	/*
+	 * Add any remaining delta to the system time.  If we didn't go
+	 * through the loop at all, then xen_clock_bias will still be
+	 * zero.
+	 */
+	KASSERT(xen_clock_bias[ci->ci_cpuid] == 0 ||
+	    xen_clock_bias[ci->ci_cpuid] == delta);
+	vcpu_system_time[ci->ci_cpuid] += MAX(0, delta);
+	xen_clock_bias[ci->ci_cpuid] = 0;
 
 	return 0;
 }