[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Xen-changelog] merge



# HG changeset patch
# User awilliam@xxxxxxxxxxx
# Node ID 0ed4a312765bf6160a36dfe1548fdb289cfae52f
# Parent  dc50cdd66c5ca20aba3bcc57aac22fd7a82d01f2
# Parent  c445d4a0dd76b4859d058368ffab7c65f732acab
merge

diff -r dc50cdd66c5c -r 0ed4a312765b Config.mk
--- a/Config.mk Tue Mar 14 20:10:21 2006
+++ b/Config.mk Tue Mar 14 20:50:35 2006
@@ -1,4 +1,7 @@
 # -*- mode: Makefile; -*-
+
+# A debug build of Xen and tools?
+debug ?= n
 
 # Currently supported architectures: x86_32, x86_64
 XEN_COMPILE_ARCH    ?= $(shell uname -m | sed -e s/i.86/x86_32/)
@@ -27,6 +30,22 @@
 INSTALL_DATA = $(INSTALL) -m0644
 INSTALL_PROG = $(INSTALL) -m0755
 
+ifneq ($(debug),y)
+# Optimisation flags are overridable
+CFLAGS    ?= -O2 -fomit-frame-pointer
+CFLAGS    += -DNDEBUG
+else
+CFLAGS    += -g
+endif
+
+ifeq ($(XEN_TARGET_ARCH),x86_32)
+CFLAGS  += -m32 -march=i686
+endif
+
+ifeq ($(XEN_TARGET_ARCH),x86_64)
+CFLAGS  += -m64
+endif
+
 ifeq ($(XEN_TARGET_ARCH),x86_64)
 LIBDIR = lib64
 else
@@ -39,6 +58,8 @@
 endif
 
 test-gcc-flag = $(shell $(1) -v --help 2>&1 | grep -q " $(2) " && echo $(2))
+
+CFLAGS += -Wall -Wstrict-prototypes
 
 HOSTCFLAGS += $(call test-gcc-flag,$(HOSTCC),-Wdeclaration-after-statement)
 CFLAGS     += $(call test-gcc-flag,$(CC),-Wdeclaration-after-statement)
diff -r dc50cdd66c5c -r 0ed4a312765b buildconfigs/linux-defconfig_xen0_x86_64
--- a/buildconfigs/linux-defconfig_xen0_x86_64  Tue Mar 14 20:10:21 2006
+++ b/buildconfigs/linux-defconfig_xen0_x86_64  Tue Mar 14 20:50:35 2006
@@ -108,6 +108,7 @@
 CONFIG_X86_IO_APIC=y
 CONFIG_X86_XEN_GENAPIC=y
 CONFIG_X86_LOCAL_APIC=y
+CONFIG_MTRR=y
 # CONFIG_SMP is not set
 CONFIG_PREEMPT_NONE=y
 # CONFIG_PREEMPT_VOLUNTARY is not set
diff -r dc50cdd66c5c -r 0ed4a312765b buildconfigs/linux-defconfig_xen_x86_64
--- a/buildconfigs/linux-defconfig_xen_x86_64   Tue Mar 14 20:10:21 2006
+++ b/buildconfigs/linux-defconfig_xen_x86_64   Tue Mar 14 20:50:35 2006
@@ -111,6 +111,7 @@
 CONFIG_X86_IO_APIC=y
 CONFIG_X86_XEN_GENAPIC=y
 CONFIG_X86_LOCAL_APIC=y
+CONFIG_MTRR=y
 CONFIG_SMP=y
 CONFIG_PREEMPT_NONE=y
 # CONFIG_PREEMPT_VOLUNTARY is not set
diff -r dc50cdd66c5c -r 0ed4a312765b extras/mini-os/Makefile
--- a/extras/mini-os/Makefile   Tue Mar 14 20:10:21 2006
+++ b/extras/mini-os/Makefile   Tue Mar 14 20:50:35 2006
@@ -32,6 +32,7 @@
 OBJS += $(patsubst %.c,%.o,$(wildcard *.c))
 OBJS += $(patsubst %.c,%.o,$(wildcard lib/*.c))
 OBJS += $(patsubst %.c,%.o,$(wildcard xenbus/*.c))
+#OBJS += $(patsubst %.c,%.o,$(wildcard console/*.c))
                                                                                
   
 HDRS := $(wildcard include/*.h)
 HDRS += $(wildcard include/xen/*.h)
diff -r dc50cdd66c5c -r 0ed4a312765b extras/mini-os/domain_config
--- a/extras/mini-os/domain_config      Tue Mar 14 20:10:21 2006
+++ b/extras/mini-os/domain_config      Tue Mar 14 20:50:35 2006
@@ -15,3 +15,5 @@
 
 # A name for your domain. All domains must have different names.
 name = "Mini-OS"
+
+on_crash = 'destroy'
diff -r dc50cdd66c5c -r 0ed4a312765b extras/mini-os/include/lib.h
--- a/extras/mini-os/include/lib.h      Tue Mar 14 20:10:21 2006
+++ b/extras/mini-os/include/lib.h      Tue Mar 14 20:50:35 2006
@@ -57,6 +57,7 @@
 
 #include <stdarg.h>
 
+
 /* printing */
 #define printk  printf
 #define kprintf printf
diff -r dc50cdd66c5c -r 0ed4a312765b extras/mini-os/include/mm.h
--- a/extras/mini-os/include/mm.h       Tue Mar 14 20:10:21 2006
+++ b/extras/mini-os/include/mm.h       Tue Mar 14 20:50:35 2006
@@ -25,18 +25,34 @@
 #ifndef _MM_H_
 #define _MM_H_
 
-#ifdef __i386__
+#if defined(__i386__)
 #include <xen/arch-x86_32.h>
+#elif defined(__x86_64__)
+#include <xen/arch-x86_64.h>
+#else
+#error "Unsupported architecture"
 #endif
 
-#ifdef __x86_64__
-#include <xen/arch-x86_64.h>
-#endif
+#include <lib.h>
 
-
-#ifdef __x86_64__
+#define L1_FRAME                1
+#define L2_FRAME                2
+#define L3_FRAME                3
 
 #define L1_PAGETABLE_SHIFT      12
+
+#if defined(__i386__)
+
+#define L2_PAGETABLE_SHIFT      22
+
+#define L1_PAGETABLE_ENTRIES    1024
+#define L2_PAGETABLE_ENTRIES    1024
+
+#define PADDR_BITS              32
+#define PADDR_MASK              (~0UL)
+
+#elif defined(__x86_64__)
+
 #define L2_PAGETABLE_SHIFT      21
 #define L3_PAGETABLE_SHIFT      30
 #define L4_PAGETABLE_SHIFT      39
@@ -52,29 +68,29 @@
 #define PADDR_MASK              ((1UL << PADDR_BITS)-1)
 #define VADDR_MASK              ((1UL << VADDR_BITS)-1)
 
-#define pte_to_mfn(_pte) (((_pte) & (PADDR_MASK&PAGE_MASK)) >> 
L1_PAGETABLE_SHIFT)
+/* Get physical address of page mapped by pte (paddr_t). */
+#define l1e_get_paddr(x)           \
+    ((unsigned long)(((x) & (PADDR_MASK&PAGE_MASK))))
+#define l2e_get_paddr(x)           \
+    ((unsigned long)(((x) & (PADDR_MASK&PAGE_MASK))))
+#define l3e_get_paddr(x)           \
+    ((unsigned long)(((x) & (PADDR_MASK&PAGE_MASK))))
+#define l4e_get_paddr(x)           \
+    ((unsigned long)(((x) & (PADDR_MASK&PAGE_MASK))))
+
+#define L2_MASK  ((1UL << L3_PAGETABLE_SHIFT) - 1)
+#define L3_MASK  ((1UL << L4_PAGETABLE_SHIFT) - 1)
 
 #endif
 
-
-
-#ifdef __i386__
-
-#define L1_PAGETABLE_SHIFT      12
-#define L2_PAGETABLE_SHIFT      22
-
-#define L1_PAGETABLE_ENTRIES    1024
-#define L2_PAGETABLE_ENTRIES    1024
-
-#elif defined(__x86_64__)
-#endif
+#define L1_MASK  ((1UL << L2_PAGETABLE_SHIFT) - 1)
 
 /* Given a virtual address, get an entry offset into a page table. */
 #define l1_table_offset(_a) \
   (((_a) >> L1_PAGETABLE_SHIFT) & (L1_PAGETABLE_ENTRIES - 1))
 #define l2_table_offset(_a) \
   (((_a) >> L2_PAGETABLE_SHIFT) & (L2_PAGETABLE_ENTRIES - 1))
-#ifdef __x86_64__
+#if defined(__x86_64__)
 #define l3_table_offset(_a) \
   (((_a) >> L3_PAGETABLE_SHIFT) & (L3_PAGETABLE_ENTRIES - 1))
 #define l4_table_offset(_a) \
@@ -92,8 +108,15 @@
 #define _PAGE_PSE      0x080UL
 #define _PAGE_GLOBAL   0x100UL
 
-#define L1_PROT (_PAGE_PRESENT | _PAGE_RW | _PAGE_ACCESSED)
-#define L2_PROT (_PAGE_PRESENT | _PAGE_RW | _PAGE_ACCESSED | _PAGE_DIRTY | 
_PAGE_USER)
+#if defined(__i386__)
+#define L1_PROT (_PAGE_PRESENT|_PAGE_RW|_PAGE_ACCESSED)
+#define L2_PROT (_PAGE_PRESENT|_PAGE_RW|_PAGE_ACCESSED|_PAGE_DIRTY |_PAGE_USER)
+#elif defined(__x86_64__)
+#define L1_PROT (_PAGE_PRESENT|_PAGE_RW|_PAGE_ACCESSED|_PAGE_USER)
+#define L2_PROT (_PAGE_PRESENT|_PAGE_RW|_PAGE_ACCESSED|_PAGE_DIRTY|_PAGE_USER)
+#define L3_PROT (_PAGE_PRESENT|_PAGE_RW|_PAGE_ACCESSED|_PAGE_DIRTY|_PAGE_USER)
+#define L4_PROT (_PAGE_PRESENT|_PAGE_RW|_PAGE_ACCESSED|_PAGE_DIRTY|_PAGE_USER)
+#endif
 
 #define PAGE_SIZE       (1UL << L1_PAGETABLE_SHIFT)
 #define PAGE_SHIFT      L1_PAGETABLE_SHIFT
@@ -124,9 +147,9 @@
     return phys;
 }
 
-#ifdef __x86_64__
+#if defined(__x86_64__)
 #define VIRT_START              0xFFFFFFFF00000000UL
-#else
+#elif defined(__i386__)
 #define VIRT_START              0xC0000000UL
 #endif
 
@@ -136,6 +159,11 @@
 #define virt_to_pfn(_virt)         (PFN_DOWN(to_phys(_virt)))
 #define mach_to_virt(_mach)        (to_virt(machine_to_phys(_mach)))
 #define mfn_to_virt(_mfn)          (mach_to_virt(_mfn << PAGE_SHIFT))
+#define pfn_to_virt(_pfn)          (to_virt(_pfn << PAGE_SHIFT))
+
+/* Pagetable walking. */
+#define pte_to_mfn(_pte)           (((_pte) & (PADDR_MASK&PAGE_MASK)) >> 
L1_PAGETABLE_SHIFT)
+#define pte_to_virt(_pte)          to_virt(mfn_to_pfn(pte_to_mfn(_pte)) << 
PAGE_SHIFT)
 
 void init_mm(void);
 unsigned long alloc_pages(int order);
diff -r dc50cdd66c5c -r 0ed4a312765b extras/mini-os/include/os.h
--- a/extras/mini-os/include/os.h       Tue Mar 14 20:10:21 2006
+++ b/extras/mini-os/include/os.h       Tue Mar 14 20:50:35 2006
@@ -59,6 +59,8 @@
 
 void trap_init(void);
 
+
+
 /* 
  * The use of 'barrier' in the following reflects their use as local-lock
  * operations. Reentrancy must be prevented (e.g., __cli()) /before/ following
diff -r dc50cdd66c5c -r 0ed4a312765b extras/mini-os/mm.c
--- a/extras/mini-os/mm.c       Tue Mar 14 20:10:21 2006
+++ b/extras/mini-os/mm.c       Tue Mar 14 20:50:35 2006
@@ -51,7 +51,8 @@
 unsigned long *phys_to_machine_mapping;
 extern char *stack;
 extern char _text, _etext, _edata, _end;
-
+extern void do_exit(void);
+extern void page_walk(unsigned long virt_addr);
 
 /*********************
  * ALLOCATION BITMAP
@@ -63,7 +64,6 @@
 
 #define allocated_in_map(_pn) \
 (alloc_bitmap[(_pn)/PAGES_PER_MAPWORD] & (1<<((_pn)&(PAGES_PER_MAPWORD-1))))
-
 
 /*
  * Hint regarding bitwise arithmetic in map_{alloc,free}:
@@ -208,7 +208,6 @@
     unsigned long range, bitmap_size;
     chunk_head_t *ch;
     chunk_tail_t *ct;
-
     for ( i = 0; i < FREELIST_SIZE; i++ )
     {
         free_head[i]       = &free_tail[i];
@@ -366,106 +365,181 @@
     free_head[order] = freed_ch;   
    
 }
+
+
+void new_pt_frame(unsigned long *pt_pfn, unsigned long prev_l_mfn, 
+                                unsigned long offset, unsigned long level)
+{   
+    unsigned long *tab = (unsigned long *)start_info.pt_base;
+    unsigned long pt_page = (unsigned long)pfn_to_virt(*pt_pfn); 
+    unsigned long prot_e, prot_t, pincmd;
+    mmu_update_t mmu_updates[0];
+    struct mmuext_op pin_request;
+    
+    DEBUG("Allocating new L%d pt frame for pt_pfn=%lx, "
+           "prev_l_mfn=%lx, offset=%lx\n", 
+           level, *pt_pfn, prev_l_mfn, offset);
+
+    if (level == L1_FRAME)
+    {
+         prot_e = L1_PROT;
+         prot_t = L2_PROT;
+         pincmd = MMUEXT_PIN_L1_TABLE;
+    }
+#if (defined __x86_64__)
+    else if (level == L2_FRAME)
+    {
+         prot_e = L2_PROT;
+         prot_t = L3_PROT;
+         pincmd = MMUEXT_PIN_L2_TABLE;
+    }
+    else if (level == L3_FRAME)
+    {
+         prot_e = L3_PROT;
+         prot_t = L4_PROT;
+         pincmd = MMUEXT_PIN_L3_TABLE;
+    }
+#endif
+    else
+    {
+         printk("new_pt_frame() called with invalid level number %d\n", level);
+         do_exit();
+    }    
+
+    /* Update the entry */
+#if (defined __x86_64__)
+    tab = pte_to_virt(tab[l4_table_offset(pt_page)]);
+    tab = pte_to_virt(tab[l3_table_offset(pt_page)]);
+#endif
+    mmu_updates[0].ptr = (tab[l2_table_offset(pt_page)] & PAGE_MASK) + 
+                         sizeof(void *)* l1_table_offset(pt_page);
+    mmu_updates[0].val = pfn_to_mfn(*pt_pfn) << PAGE_SHIFT | 
+                         (prot_e & ~_PAGE_RW);
+    if(HYPERVISOR_mmu_update(mmu_updates, 1, NULL, DOMID_SELF) < 0)
+    {
+         printk("PTE for new page table page could not be updated\n");
+         do_exit();
+    }
+                        
+    /* Pin the page to provide correct protection */
+    pin_request.cmd = pincmd;
+    pin_request.arg1.mfn = pfn_to_mfn(*pt_pfn);
+    if(HYPERVISOR_mmuext_op(&pin_request, 1, NULL, DOMID_SELF) < 0)
+    {
+        printk("ERROR: pinning failed\n");
+        do_exit();
+    }
+
+    /* Now fill the new page table page with entries.
+       Update the page directory as well. */
+    mmu_updates[0].ptr = (prev_l_mfn << PAGE_SHIFT) + sizeof(void *) * offset;
+    mmu_updates[0].val = pfn_to_mfn(*pt_pfn) << PAGE_SHIFT | prot_t;
+    if(HYPERVISOR_mmu_update(mmu_updates, 1, NULL, DOMID_SELF) < 0) 
+    {            
+       printk("ERROR: mmu_update failed\n");
+       do_exit();
+    }
+
+    *pt_pfn += 1;
+}
+
 void build_pagetable(unsigned long *start_pfn, unsigned long *max_pfn)
 {
-    unsigned long pfn_to_map, pt_frame;
-    unsigned long mach_ptd, max_mach_ptd;
-    int count;
-    unsigned long mach_pte, virt_pte;
-    unsigned long *ptd = (unsigned long *)start_info.pt_base;
-    mmu_update_t mmu_updates[L1_PAGETABLE_ENTRIES + 1];
-    struct mmuext_op pin_request;
-    
-    /* Firstly work out what is the first pfn that is not yet in page tables
-       NB. Assuming that builder fills whole pt_frames (which it does at the
-       moment)
-     */  
+    unsigned long start_address, end_address;
+    unsigned long pfn_to_map, pt_pfn = *start_pfn;
+    static mmu_update_t mmu_updates[L1_PAGETABLE_ENTRIES + 1];
+    unsigned long *tab = (unsigned long *)start_info.pt_base;
+    unsigned long mfn = pfn_to_mfn(virt_to_pfn(start_info.pt_base));
+    unsigned long page, offset;
+    int count = 0;
+
+#if defined(__x86_64__)
+    pfn_to_map = (start_info.nr_pt_frames - 3) * L1_PAGETABLE_ENTRIES;
+#else
     pfn_to_map = (start_info.nr_pt_frames - 1) * L1_PAGETABLE_ENTRIES;
-    DEBUG("start_pfn=%ld, first pfn_to_map %ld, max_pfn=%ld", 
-            *start_pfn, pfn_to_map, *max_pfn);
-
-    /* Machine address of page table directory */
-    mach_ptd = phys_to_machine(to_phys(start_info.pt_base));
-    mach_ptd += sizeof(void *) * 
-        l2_table_offset((unsigned long)to_virt(PFN_PHYS(pfn_to_map)));
-  
-    max_mach_ptd = sizeof(void *) * 
-        l2_table_offset((unsigned long)to_virt(PFN_PHYS(*max_pfn)));
-    
-    /* Check that we are not trying to access Xen region */
-    if(max_mach_ptd > sizeof(void *) * l2_table_offset(HYPERVISOR_VIRT_START))
-    {
-        printk("WARNING: mini-os will not use all the memory supplied\n");
-        max_mach_ptd = sizeof(void *) * l2_table_offset(HYPERVISOR_VIRT_START);
-        *max_pfn = virt_to_pfn(HYPERVISOR_VIRT_START - PAGE_SIZE);
-    }
-    max_mach_ptd += phys_to_machine(to_phys(start_info.pt_base));
-    DEBUG("Max_mach_ptd 0x%lx", max_mach_ptd); 
-   
-    pt_frame = *start_pfn;
-    /* Should not happen - no empty, mapped pages */
-    if(pt_frame >= pfn_to_map)
-    {
-        printk("ERROR: Not even a single empty, mapped page\n");
-        *(int*)0=0;
-    }
-    
-    while(mach_ptd < max_mach_ptd)
-    {
-        /* Correct protection needs to be set for the new page table frame */
-        virt_pte = (unsigned long)to_virt(PFN_PHYS(pt_frame));
-        mach_pte = ptd[l2_table_offset(virt_pte)] & ~(PAGE_SIZE-1);
-        mach_pte += sizeof(void *) * l1_table_offset(virt_pte);
-        DEBUG("New page table page: pfn=0x%lx, mfn=0x%lx, virt_pte=0x%lx, "
-                "mach_pte=0x%lx", pt_frame, pfn_to_mfn(pt_frame), 
-                virt_pte, mach_pte);
+#endif
+    start_address = (unsigned long)pfn_to_virt(pfn_to_map);
+    end_address = (unsigned long)pfn_to_virt(*max_pfn);
+    
+    /* We worked out the virtual memory range to map, now mapping loop */
+    printk("Mapping memory range 0x%lx - 0x%lx\n", start_address, end_address);
+
+    while(start_address < end_address)
+    {
+        tab = (unsigned long *)start_info.pt_base;
+        mfn = pfn_to_mfn(virt_to_pfn(start_info.pt_base));
+
+#if defined(__x86_64__)
+        offset = l4_table_offset(start_address);
+        /* Need new L3 pt frame */
+        if(!(start_address & L3_MASK)) 
+            new_pt_frame(&pt_pfn, mfn, offset, L3_FRAME);
         
-        /* Update the entry */
-        mmu_updates[0].ptr = mach_pte;
-        mmu_updates[0].val = pfn_to_mfn(pt_frame) << PAGE_SHIFT | 
-                                                    (L1_PROT & ~_PAGE_RW);
-        if(HYPERVISOR_mmu_update(mmu_updates, 1, NULL, DOMID_SELF) < 0)
+        page = tab[offset];
+        mfn = pte_to_mfn(page);
+        tab = to_virt(mfn_to_pfn(mfn) << PAGE_SHIFT);
+        offset = l3_table_offset(start_address);
+        /* Need new L2 pt frame */
+        if(!(start_address & L2_MASK)) 
+            new_pt_frame(&pt_pfn, mfn, offset, L2_FRAME);
+
+        page = tab[offset];
+        mfn = pte_to_mfn(page);
+        tab = to_virt(mfn_to_pfn(mfn) << PAGE_SHIFT);
+#endif
+        offset = l2_table_offset(start_address);        
+        /* Need new L1 pt frame */
+        if(!(start_address & L1_MASK)) 
+            new_pt_frame(&pt_pfn, mfn, offset, L1_FRAME);
+       
+        page = tab[offset];
+        mfn = pte_to_mfn(page);
+        offset = l1_table_offset(start_address);
+
+        mmu_updates[count].ptr = (mfn << PAGE_SHIFT) + sizeof(void *) * offset;
+        mmu_updates[count].val = 
+            pfn_to_mfn(pfn_to_map++) << PAGE_SHIFT | L1_PROT;
+        count++;
+        if (count == L1_PAGETABLE_ENTRIES || pfn_to_map == *max_pfn)
         {
-            printk("PTE for new page table page could not be updated\n");
-            *(int*)0=0;
+            if(HYPERVISOR_mmu_update(mmu_updates, count, NULL, DOMID_SELF) < 0)
+            {
+                printk("PTE could not be updated\n");
+                do_exit();
+            }
+            count = 0;
         }
-        
-        /* Pin the page to provide correct protection */
-        pin_request.cmd = MMUEXT_PIN_L1_TABLE;
-        pin_request.arg1.mfn = pfn_to_mfn(pt_frame);
-        if(HYPERVISOR_mmuext_op(&pin_request, 1, NULL, DOMID_SELF) < 0)
+        start_address += PAGE_SIZE;
+    }
+
+    *start_pfn = pt_pfn;
+}
+
+
+void mem_test(unsigned long *start_add, unsigned long *end_add)
+{
+    unsigned long mask = 0x10000;
+    unsigned long *pointer;
+
+    for(pointer = start_add; pointer < end_add; pointer++)
+    {
+        if(!(((unsigned long)pointer) & 0xfffff))
         {
-            printk("ERROR: pinning failed\n");
-            *(int*)0=0;
+            printk("Writing to %lx\n", pointer);
+            page_walk((unsigned long)pointer);
         }
-        
-        /* Now fill the new page table page with entries.
-           Update the page directory as well. */
-        count = 0;
-        mmu_updates[count].ptr = mach_ptd;
-        mmu_updates[count].val = pfn_to_mfn(pt_frame) << PAGE_SHIFT |
-                                                         L2_PROT;
-        count++;
-        mach_ptd += sizeof(void *);
-        mach_pte = phys_to_machine(PFN_PHYS(pt_frame++));
-        
-        for(;count <= L1_PAGETABLE_ENTRIES && pfn_to_map <= *max_pfn; count++)
-        {
-            mmu_updates[count].ptr = mach_pte;
-            mmu_updates[count].val = 
-                pfn_to_mfn(pfn_to_map++) << PAGE_SHIFT | L1_PROT;
-            if(count == 1) DEBUG("mach_pte 0x%lx", mach_pte);
-            mach_pte += sizeof(void *);
-        }
-        if(HYPERVISOR_mmu_update(mmu_updates, count, NULL, DOMID_SELF) < 0) 
-        {            
-            printk("ERROR: mmu_update failed\n");
-            *(int*)0=0;
-        }
-        (*start_pfn)++;
-    }
-
-    *start_pfn = pt_frame;
+        *pointer = (unsigned long)pointer & ~mask;
+    }
+
+    for(pointer = start_add; pointer < end_add; pointer++)
+    {
+        if(((unsigned long)pointer & ~mask) != *pointer)
+            printk("Read error at 0x%lx. Read: 0x%lx, should read 0x%lx\n",
+                (unsigned long)pointer, 
+                *pointer, 
+                ((unsigned long)pointer & ~mask));
+    }
+
 }
 
 void init_mm(void)
@@ -485,23 +559,21 @@
     phys_to_machine_mapping = (unsigned long *)start_info.mfn_list;
    
     /* First page follows page table pages and 3 more pages (store page etc) */
-    start_pfn = PFN_UP(to_phys(start_info.pt_base)) + start_info.nr_pt_frames 
+ 3;
+    start_pfn = PFN_UP(to_phys(start_info.pt_base)) + 
+                start_info.nr_pt_frames + 3;
     max_pfn = start_info.nr_pages;
-
+   
     printk("  start_pfn:    %lx\n", start_pfn);
     printk("  max_pfn:      %lx\n", max_pfn);
 
-
-#ifdef __i386__
     build_pagetable(&start_pfn, &max_pfn);
-#endif
-
+    
     /*
      * now we can initialise the page allocator
      */
     printk("MM: Initialise page allocator for %lx(%lx)-%lx(%lx)\n",
            (u_long)to_virt(PFN_PHYS(start_pfn)), PFN_PHYS(start_pfn), 
            (u_long)to_virt(PFN_PHYS(max_pfn)), PFN_PHYS(max_pfn));
-    init_page_allocator(PFN_PHYS(start_pfn), PFN_PHYS(max_pfn));   
+    init_page_allocator(PFN_PHYS(start_pfn), PFN_PHYS(max_pfn));
     printk("MM: done\n");
 }
diff -r dc50cdd66c5c -r 0ed4a312765b extras/mini-os/traps.c
--- a/extras/mini-os/traps.c    Tue Mar 14 20:10:21 2006
+++ b/extras/mini-os/traps.c    Tue Mar 14 20:50:35 2006
@@ -69,6 +69,30 @@
 DO_ERROR(12, "stack segment", stack_segment)
 DO_ERROR_INFO(17, "alignment check", alignment_check, BUS_ADRALN, 0)
 DO_ERROR(18, "machine check", machine_check)
+
+void page_walk(unsigned long virt_address)
+{
+        unsigned long *tab = (unsigned long *)start_info.pt_base;
+        unsigned long addr = virt_address, page;
+        printk("Pagetable walk from virt %lx, base %lx:\n", virt_address, 
start_info.pt_base);
+    
+#if defined(__x86_64__)
+        page = tab[l4_table_offset(addr)];
+        tab = to_virt(mfn_to_pfn(pte_to_mfn(page)) << PAGE_SHIFT);
+        printk(" L4 = %p (%p)  [offset = %lx]\n", page, tab, 
l4_table_offset(addr));
+
+        page = tab[l3_table_offset(addr)];
+        tab = to_virt(mfn_to_pfn(pte_to_mfn(page)) << PAGE_SHIFT);
+        printk("  L3 = %p (%p)  [offset = %lx]\n", page, tab, 
l3_table_offset(addr));
+#endif
+        page = tab[l2_table_offset(addr)];
+        tab =  to_virt(mfn_to_pfn(pte_to_mfn(page)) << PAGE_SHIFT);
+        printk("   L2 = %p (%p)  [offset = %lx]\n", page, tab, 
l2_table_offset(addr));
+        
+        page = tab[l1_table_offset(addr)];
+        printk("    L1 = %p (%p)  [offset = %lx]\n", page, tab, 
l1_table_offset(addr));
+
+}
 
 void do_page_fault(struct pt_regs *regs, unsigned long error_code,
                                                                                
     unsigned long addr)
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/arch/i386/kernel/cpu/mtrr/main-xen.c
--- a/linux-2.6-xen-sparse/arch/i386/kernel/cpu/mtrr/main-xen.c Tue Mar 14 
20:10:21 2006
+++ b/linux-2.6-xen-sparse/arch/i386/kernel/cpu/mtrr/main-xen.c Tue Mar 14 
20:50:35 2006
@@ -7,6 +7,8 @@
 
 #include <asm/mtrr.h>
 #include "mtrr.h"
+
+static DECLARE_MUTEX(mtrr_sem);
 
 void generic_get_mtrr(unsigned int reg, unsigned long *base,
                      unsigned int *size, mtrr_type * type)
@@ -63,18 +65,23 @@
        int error;
        dom0_op_t op;
 
+       down(&mtrr_sem);
+
        op.cmd = DOM0_ADD_MEMTYPE;
        op.u.add_memtype.mfn     = base;
        op.u.add_memtype.nr_mfns = size;
        op.u.add_memtype.type    = type;
        error = HYPERVISOR_dom0_op(&op);
        if (error) {
+               up(&mtrr_sem);
                BUG_ON(error > 0);
                return error;
        }
 
        if (increment)
                ++usage_table[op.u.add_memtype.reg];
+
+       up(&mtrr_sem);
 
        return op.u.add_memtype.reg;
 }
@@ -104,17 +111,18 @@
 
 int mtrr_del_page(int reg, unsigned long base, unsigned long size)
 {
-       int i, max;
+       unsigned i;
        mtrr_type ltype;
        unsigned long lbase;
        unsigned int lsize;
        int error = -EINVAL;
        dom0_op_t op;
 
-       max = num_var_ranges;
+       down(&mtrr_sem);
+
        if (reg < 0) {
                /*  Search for existing MTRR  */
-               for (i = 0; i < max; ++i) {
+               for (i = 0; i < num_var_ranges; ++i) {
                        mtrr_if->get(i, &lbase, &lsize, &ltype);
                        if (lbase == base && lsize == size) {
                                reg = i;
@@ -143,6 +151,7 @@
        }
        error = reg;
  out:
+       up(&mtrr_sem);
        return error;
 }
 
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/arch/i386/kernel/entry-xen.S
--- a/linux-2.6-xen-sparse/arch/i386/kernel/entry-xen.S Tue Mar 14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/arch/i386/kernel/entry-xen.S Tue Mar 14 20:50:35 2006
@@ -79,6 +79,10 @@
 /* Pseudo-eflags. */
 NMI_MASK       = 0x80000000
 
+#ifndef CONFIG_XEN
+#define DISABLE_INTERRUPTS     cli
+#define ENABLE_INTERRUPTS      sti
+#else
 /* Offsets into shared_info_t. */
 #define evtchn_upcall_pending          /* 0 */
 #define evtchn_upcall_mask             1
@@ -86,33 +90,24 @@
 #define sizeof_vcpu_shift              6
 
 #ifdef CONFIG_SMP
-#define preempt_disable(reg)   incl TI_preempt_count(reg)
-#define preempt_enable(reg)    decl TI_preempt_count(reg)
-#define XEN_GET_VCPU_INFO(reg) preempt_disable(%ebp)                   ; \
-                               movl TI_cpu(%ebp),reg                   ; \
-                               shl  $sizeof_vcpu_shift,reg             ; \
-                               addl HYPERVISOR_shared_info,reg
-#define XEN_PUT_VCPU_INFO(reg) preempt_enable(%ebp)
-#define XEN_PUT_VCPU_INFO_fixup .byte 0xff,0xff,0xff
+#define GET_VCPU_INFO          movl TI_cpu(%ebp),%esi                  ; \
+                               shl  $sizeof_vcpu_shift,%esi            ; \
+                               addl HYPERVISOR_shared_info,%esi
 #else
-#define XEN_GET_VCPU_INFO(reg) movl HYPERVISOR_shared_info,reg
-#define XEN_PUT_VCPU_INFO(reg)
-#define XEN_PUT_VCPU_INFO_fixup
-#endif
-
-#define XEN_LOCKED_BLOCK_EVENTS(reg)   movb $1,evtchn_upcall_mask(reg)
-#define XEN_LOCKED_UNBLOCK_EVENTS(reg) movb $0,evtchn_upcall_mask(reg)
-#define XEN_BLOCK_EVENTS(reg)  XEN_GET_VCPU_INFO(reg)                  ; \
-                               XEN_LOCKED_BLOCK_EVENTS(reg)            ; \
-                               XEN_PUT_VCPU_INFO(reg)
-#define XEN_UNBLOCK_EVENTS(reg)        XEN_GET_VCPU_INFO(reg)                  
; \
-                               XEN_LOCKED_UNBLOCK_EVENTS(reg)          ; \
-                               XEN_PUT_VCPU_INFO(reg)
-#define XEN_TEST_PENDING(reg)  testb $0xFF,evtchn_upcall_pending(reg)
+#define GET_VCPU_INFO          movl HYPERVISOR_shared_info,%esi
+#endif
+
+#define __DISABLE_INTERRUPTS   movb $1,evtchn_upcall_mask(%esi)
+#define __ENABLE_INTERRUPTS    movb $0,evtchn_upcall_mask(%esi)
+#define DISABLE_INTERRUPTS     GET_VCPU_INFO                           ; \
+                               __DISABLE_INTERRUPTS
+#define ENABLE_INTERRUPTS      GET_VCPU_INFO                           ; \
+                               __ENABLE_INTERRUPTS
+#define __TEST_PENDING         testb $0xFF,evtchn_upcall_pending(%esi)
+#endif
 
 #ifdef CONFIG_PREEMPT
-#define preempt_stop           GET_THREAD_INFO(%ebp)                   ; \
-                               XEN_BLOCK_EVENTS(%esi)
+#define preempt_stop           cli
 #else
 #define preempt_stop
 #define resume_kernel          restore_nocheck
@@ -159,21 +154,6 @@
 .previous
 
 
-#define RESTORE_ALL    \
-       RESTORE_REGS    \
-       addl $4, %esp;  \
-1:     iret;           \
-.section .fixup,"ax";   \
-2:     pushl $0;       \
-       pushl $do_iret_error;   \
-       jmp error_code; \
-.previous;             \
-.section __ex_table,"a";\
-       .align 4;       \
-       .long 1b,2b;    \
-.previous
-
-
 ENTRY(ret_from_fork)
        pushl %eax
        call schedule_tail
@@ -199,7 +179,7 @@
        testl $(VM_MASK | 2), %eax
        jz resume_kernel
 ENTRY(resume_userspace)
-       XEN_BLOCK_EVENTS(%esi)          # make sure we don't miss an interrupt
+       DISABLE_INTERRUPTS              # make sure we don't miss an interrupt
                                        # setting need_resched or sigpending
                                        # between sampling and the iret
        movl TI_flags(%ebp), %ecx
@@ -210,15 +190,15 @@
 
 #ifdef CONFIG_PREEMPT
 ENTRY(resume_kernel)
-       XEN_BLOCK_EVENTS(%esi)
+       cli
        cmpl $0,TI_preempt_count(%ebp)  # non-zero preempt_count ?
        jnz restore_nocheck
 need_resched:
        movl TI_flags(%ebp), %ecx       # need_resched set ?
        testb $_TIF_NEED_RESCHED, %cl
        jz restore_all
-       testb $0xFF,EVENT_MASK(%esp)    # interrupts off (exception path) ?
-       jnz restore_all
+       testl $IF_MASK,EFLAGS(%esp)     # interrupts off (exception path) ?
+       jz restore_all
        call preempt_schedule_irq
        jmp need_resched
 #endif
@@ -289,7 +269,7 @@
        call *sys_call_table(,%eax,4)
        movl %eax,EAX(%esp)             # store the return value
 syscall_exit:
-       XEN_BLOCK_EVENTS(%esi)          # make sure we don't miss an interrupt
+       DISABLE_INTERRUPTS              # make sure we don't miss an interrupt
                                        # setting need_resched or sigpending
                                        # between sampling and the iret
        movl TI_flags(%ebp), %ecx
@@ -297,7 +277,7 @@
        jne syscall_exit_work
 
 restore_all:
-#if 0 /* XEN */
+#ifndef CONFIG_XEN
        movl EFLAGS(%esp), %eax         # mix EFLAGS, SS and CS
        # Warning: OLDSS(%esp) contains the wrong/random values if we
        # are returning to the kernel.
@@ -307,22 +287,26 @@
        andl $(VM_MASK | (4 << 8) | 3), %eax
        cmpl $((4 << 8) | 3), %eax
        je ldt_ss                       # returning to user-space with LDT SS
-#endif /* XEN */
+restore_nocheck:
+#else
 restore_nocheck:
        testl $(VM_MASK|NMI_MASK), EFLAGS(%esp)
        jnz hypervisor_iret
        movb EVENT_MASK(%esp), %al
        notb %al                        # %al == ~saved_mask
-       XEN_GET_VCPU_INFO(%esi)
+       GET_VCPU_INFO
        andb evtchn_upcall_mask(%esi),%al
        andb $1,%al                     # %al == mask & ~saved_mask
        jnz restore_all_enable_events   #     != 0 => reenable event delivery
-       XEN_PUT_VCPU_INFO(%esi)
+#endif
        RESTORE_REGS
        addl $4, %esp
 1:     iret
 .section .fixup,"ax"
 iret_exc:
+#ifndef CONFIG_XEN
+       sti
+#endif
        pushl $0                        # no error code
        pushl $do_iret_error
        jmp error_code
@@ -332,13 +316,7 @@
        .long 1b,iret_exc
 .previous
 
-hypervisor_iret:
-       andl $~NMI_MASK, EFLAGS(%esp)
-       RESTORE_REGS
-       addl $4, %esp
-       jmp  hypercall_page + (__HYPERVISOR_iret * 32)
-
-#if 0 /* XEN */
+#ifndef CONFIG_XEN
 ldt_ss:
        larl OLDSS(%esp), %eax
        jnz restore_nocheck
@@ -363,7 +341,13 @@
        .align 4
        .long 1b,iret_exc
 .previous
-#endif /* XEN */
+#else
+hypervisor_iret:
+       andl $~NMI_MASK, EFLAGS(%esp)
+       RESTORE_REGS
+       addl $4, %esp
+       jmp  hypercall_page + (__HYPERVISOR_iret * 32)
+#endif
 
        # perform work that needs to be done immediately before resumption
        ALIGN
@@ -372,7 +356,7 @@
        jz work_notifysig
 work_resched:
        call schedule
-       XEN_BLOCK_EVENTS(%esi)          # make sure we don't miss an interrupt
+       DISABLE_INTERRUPTS              # make sure we don't miss an interrupt
                                        # setting need_resched or sigpending
                                        # between sampling and the iret
        movl TI_flags(%ebp), %ecx
@@ -424,7 +408,7 @@
 syscall_exit_work:
        testb $(_TIF_SYSCALL_TRACE|_TIF_SYSCALL_AUDIT|_TIF_SINGLESTEP), %cl
        jz work_pending
-       XEN_UNBLOCK_EVENTS(%esi)        # could let do_syscall_trace() call
+       ENABLE_INTERRUPTS               # could let do_syscall_trace() call
                                        # schedule() instead
        movl %esp, %eax
        movl $1, %edx
@@ -444,7 +428,7 @@
        movl $-ENOSYS,EAX(%esp)
        jmp resume_userspace
 
-#if 0 /* XEN */
+#ifndef CONFIG_XEN
 #define FIXUP_ESPFIX_STACK \
        movl %esp, %eax; \
        /* switch to 32bit stack using the pointer on top of 16bit stack */ \
@@ -503,7 +487,9 @@
 
 /* The include is where all of the SMP etc. interrupts come from */
 #include "entry_arch.h"
-#endif /* XEN */
+#else
+#define UNWIND_ESPFIX_STACK
+#endif
 
 ENTRY(divide_error)
        pushl $0                        # no error code
@@ -522,7 +508,7 @@
        pushl %ebx
        cld
        pushl %es
-#      UNWIND_ESPFIX_STACK
+       UNWIND_ESPFIX_STACK
        popl %ecx
        movl ES(%esp), %edi             # get the function address
        movl ORIG_EAX(%esp), %edx       # get the error code
@@ -535,6 +521,7 @@
        call *%edi
        jmp ret_from_exception
 
+#ifdef CONFIG_XEN
 # A note on the "critical region" in our callback handler.
 # We want to avoid stacking callback handlers due to events occurring
 # during handling of the last event. To do this, we keep events disabled
@@ -560,15 +547,24 @@
        jmp  ret_from_intr
 
         ALIGN
-restore_all_enable_events:  
-       XEN_LOCKED_UNBLOCK_EVENTS(%esi)
+restore_all_enable_events:
+       __ENABLE_INTERRUPTS
 scrit: /**** START OF CRITICAL REGION ****/
-       XEN_TEST_PENDING(%esi)
+       __TEST_PENDING
        jnz  14f                        # process more events if necessary...
-       XEN_PUT_VCPU_INFO(%esi)
-       RESTORE_ALL
-14:    XEN_LOCKED_BLOCK_EVENTS(%esi)
-       XEN_PUT_VCPU_INFO(%esi)
+       RESTORE_REGS
+       addl $4, %esp
+1:     iret
+.section .fixup,"ax"
+2:     pushl $0
+       pushl $do_iret_error
+       jmp error_code
+.previous
+.section __ex_table,"a"
+       .align 4
+       .long 1b,2b
+.previous
+14:    __DISABLE_INTERRUPTS
        jmp  11b
 ecrit:  /**** END OF CRITICAL REGION ****/
 # [How we do the fixup]. We want to merge the current stack frame with the
@@ -577,14 +573,13 @@
 # registers are in each frame. We do this quickly using the lookup table
 # 'critical_fixup_table'. For each byte offset in the critical region, it
 # provides the number of bytes which have already been popped from the
-# interrupted stack frame. 
+# interrupted stack frame.
 critical_region_fixup:
        addl $critical_fixup_table-scrit,%eax
        movzbl (%eax),%eax              # %eax contains num bytes popped
        cmpb $0xff,%al                  # 0xff => vcpu_info critical region
        jne  15f
        GET_THREAD_INFO(%ebp)
-       XEN_PUT_VCPU_INFO(%esi)         # abort vcpu_info critical region
         xorl %eax,%eax
 15:    mov  %esp,%esi
        add  %eax,%esi                  # %esi points at end of src region
@@ -602,9 +597,8 @@
        jmp  11b
 
 critical_fixup_table:
-       .byte 0xff,0xff,0xff            # testb $0xff,(%esi) = XEN_TEST_PENDING
+       .byte 0xff,0xff,0xff            # testb $0xff,(%esi) = __TEST_PENDING
        .byte 0xff,0xff                 # jnz  14f
-       XEN_PUT_VCPU_INFO_fixup
        .byte 0x00                      # pop  %ebx
        .byte 0x04                      # pop  %ecx
        .byte 0x08                      # pop  %edx
@@ -617,7 +611,6 @@
        .byte 0x24,0x24,0x24            # add  $4,%esp
        .byte 0x28                      # iret
        .byte 0xff,0xff,0xff,0xff       # movb $1,1(%esi)
-       XEN_PUT_VCPU_INFO_fixup
        .byte 0x00,0x00                 # jmp  11b
 
 # Hypervisor uses this for application faults while it executes.
@@ -646,6 +639,7 @@
        .long 3b,8b;    \
        .long 4b,9b;    \
 .previous
+#endif
 
 ENTRY(coprocessor_error)
        pushl $0
@@ -660,7 +654,17 @@
 ENTRY(device_not_available)
        pushl $-1                       # mark this as an int
        SAVE_ALL
-       #preempt_stop /* This is already an interrupt gate on Xen. */
+#ifndef CONFIG_XEN
+       movl %cr0, %eax
+       testl $0x4, %eax                # EM (math emulation bit)
+       je device_available_emulate
+       pushl $0                        # temporary storage for ORIG_EIP
+       call math_emulate
+       addl $4, %esp
+       jmp ret_from_exception
+device_available_emulate:
+#endif
+       preempt_stop
        call math_state_restore
        jmp ret_from_exception
 
@@ -703,16 +707,7 @@
        jmp ret_from_exception
        .previous .text
 
-ENTRY(nmi)
-       pushl %eax
-       SAVE_ALL
-       xorl %edx,%edx          # zero error code
-       movl %esp,%eax          # pt_regs pointer
-       call do_nmi
-       orl  $NMI_MASK, EFLAGS(%esp)
-       jmp restore_all
-
-#if 0 /* XEN */
+#ifndef CONFIG_XEN
 /*
  * NMI is doubly nasty. It can happen _while_ we're handling
  * a debug fault, and the debug fault hasn't yet been able to
@@ -783,7 +778,16 @@
        .align 4
        .long 1b,iret_exc
 .previous
-#endif /* XEN */
+#else
+ENTRY(nmi)
+       pushl %eax
+       SAVE_ALL
+       xorl %edx,%edx          # zero error code
+       movl %esp,%eax          # pt_regs pointer
+       call do_nmi
+       orl  $NMI_MASK, EFLAGS(%esp)
+       jmp restore_all
+#endif
 
 KPROBE_ENTRY(int3)
        pushl $-1                       # mark this as an int
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/arch/i386/kernel/head-xen.S
--- a/linux-2.6-xen-sparse/arch/i386/kernel/head-xen.S  Tue Mar 14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/arch/i386/kernel/head-xen.S  Tue Mar 14 20:50:35 2006
@@ -29,8 +29,6 @@
 
        /* Set up the stack pointer */
        movl $(init_thread_union+THREAD_SIZE),%esp
-
-checkCPUtype:
 
        /* get vendor info */
        xorl %eax,%eax                  # call CPUID with 0 -> return vendor ID
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/arch/i386/kernel/process-xen.c
--- a/linux-2.6-xen-sparse/arch/i386/kernel/process-xen.c       Tue Mar 14 
20:10:21 2006
+++ b/linux-2.6-xen-sparse/arch/i386/kernel/process-xen.c       Tue Mar 14 
20:50:35 2006
@@ -107,9 +107,9 @@
 {
        local_irq_disable();
 
-       if (need_resched()) {
+       if (need_resched())
                local_irq_enable();
-       } else {
+       else {
                clear_thread_flag(TIF_POLLING_NRFLAG);
                smp_mb__after_clear_bit();
                stop_hz_timer();
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/arch/i386/kernel/time-xen.c
--- a/linux-2.6-xen-sparse/arch/i386/kernel/time-xen.c  Tue Mar 14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/arch/i386/kernel/time-xen.c  Tue Mar 14 20:50:35 2006
@@ -157,18 +157,26 @@
 }
 __setup("independent_wallclock", __independent_wallclock);
 
+/* Permitted clock jitter, in usecs, beyond which a warning will be printed. */
+static unsigned long permitted_clock_jitter = 10000UL;
+static int __init __permitted_clock_jitter(char *str)
+{
+       permitted_clock_jitter = simple_strtoul(str, NULL, 0);
+       return 1;
+}
+__setup("permitted_clock_jitter=", __permitted_clock_jitter);
+
 int tsc_disable __devinitdata = 0;
 
 static void delay_tsc(unsigned long loops)
 {
        unsigned long bclock, now;
-       
+
        rdtscl(bclock);
-       do
-       {
+       do {
                rep_nop();
                rdtscl(now);
-       } while ((now-bclock) < loops);
+       } while ((now - bclock) < loops);
 }
 
 struct timer_opts timer_tsc = {
@@ -187,7 +195,7 @@
        u32 tmp1, tmp2;
 #endif
 
-       if ( shift < 0 )
+       if (shift < 0)
                delta >>= -shift;
        else
                delta <<= shift;
@@ -226,7 +234,7 @@
        struct vcpu_time_info *info;
        info = &HYPERVISOR_shared_info->vcpu_info[0].time;
        do_div(__cpu_khz, info->tsc_to_system_mul);
-       if ( info->tsc_shift < 0 )
+       if (info->tsc_shift < 0)
                cpu_khz = __cpu_khz << -info->tsc_shift;
        else
                cpu_khz = __cpu_khz >> info->tsc_shift;
@@ -284,8 +292,7 @@
                shadow_tv.tv_sec  = s->wc_sec;
                shadow_tv.tv_nsec = s->wc_nsec;
                rmb();
-       }
-       while ((s->wc_version & 1) | (shadow_tv_version ^ s->wc_version));
+       } while ((s->wc_version & 1) | (shadow_tv_version ^ s->wc_version));
 
        if (!independent_wallclock)
                __update_wallclock(shadow_tv.tv_sec, shadow_tv.tv_nsec);
@@ -312,8 +319,7 @@
                dst->tsc_to_nsec_mul   = src->tsc_to_system_mul;
                dst->tsc_shift         = src->tsc_shift;
                rmb();
-       }
-       while ((src->version & 1) | (dst->version ^ src->version));
+       } while ((src->version & 1) | (dst->version ^ src->version));
 
        dst->tsc_to_usec_mul = dst->tsc_to_nsec_mul / 1000;
 }
@@ -324,8 +330,9 @@
        struct shadow_time_info *dst;
 
        src = &HYPERVISOR_shared_info->vcpu_info[cpu].time;
-       dst = &per_cpu(shadow_time, cpu); 
-
+       dst = &per_cpu(shadow_time, cpu);
+
+       rmb();
        return (dst->version == src->version);
 }
 
@@ -454,7 +461,7 @@
         * overflows. If that were to happen then our shadow time values would
         * be stale, so we can retry with fresh ones.
         */
-       for ( ; ; ) {
+       for (;;) {
                nsec = tv->tv_nsec - get_nsec_offset(shadow);
                if (time_values_up_to_date(cpu))
                        break;
@@ -552,11 +559,11 @@
 
        do {
                local_time_version = shadow->version;
-               smp_rmb();
+               barrier();
                time = shadow->system_timestamp + get_nsec_offset(shadow);
                if (!time_values_up_to_date(cpu))
                        get_time_values_from_xen();
-               smp_rmb();
+               barrier();
        } while (local_time_version != shadow->version);
 
        put_cpu();
@@ -614,7 +621,7 @@
                get_time_values_from_xen();
 
                /* Obtain a consistent snapshot of elapsed wallclock cycles. */
-               delta = delta_cpu = 
+               delta = delta_cpu =
                        shadow->system_timestamp + get_nsec_offset(shadow);
                delta     -= processed_system_time;
                delta_cpu -= per_cpu(processed_system_time, cpu);
@@ -633,13 +640,13 @@
                                per_cpu(processed_blocked_time, cpu);
                        barrier();
                } while (sched_time != runstate->state_entry_time);
-       }
-       while (!time_values_up_to_date(cpu));
-
-       if ((unlikely(delta < -1000000LL) || unlikely(delta_cpu < 0))
+       } while (!time_values_up_to_date(cpu));
+
+       if ((unlikely(delta < -(s64)permitted_clock_jitter) ||
+            unlikely(delta_cpu < -(s64)permitted_clock_jitter))
            && printk_ratelimit()) {
                printk("Timer ISR/%d: Time went backwards: "
-                      "delta=%lld cpu_delta=%lld shadow=%lld "
+                      "delta=%lld delta_cpu=%lld shadow=%lld "
                       "off=%lld processed=%lld cpu_processed=%lld\n",
                       cpu, delta, delta_cpu, shadow->system_timestamp,
                       (s64)get_nsec_offset(shadow),
@@ -669,8 +676,10 @@
         * HACK: Passing NULL to account_steal_time()
         * ensures that the ticks are accounted as stolen.
         */
-       if (stolen > 0) {
+       if ((stolen > 0) && (delta_cpu > 0)) {
                delta_cpu -= stolen;
+               if (unlikely(delta_cpu < 0))
+                       stolen += delta_cpu; /* clamp local-time progress */
                do_div(stolen, NS_PER_TICK);
                per_cpu(processed_stolen_time, cpu) += stolen * NS_PER_TICK;
                per_cpu(processed_system_time, cpu) += stolen * NS_PER_TICK;
@@ -682,8 +691,10 @@
         * HACK: Passing idle_task to account_steal_time()
         * ensures that the ticks are accounted as idle/wait.
         */
-       if (blocked > 0) {
+       if ((blocked > 0) && (delta_cpu > 0)) {
                delta_cpu -= blocked;
+               if (unlikely(delta_cpu < 0))
+                       blocked += delta_cpu; /* clamp local-time progress */
                do_div(blocked, NS_PER_TICK);
                per_cpu(processed_blocked_time, cpu) += blocked * NS_PER_TICK;
                per_cpu(processed_system_time, cpu)  += blocked * NS_PER_TICK;
@@ -938,7 +949,7 @@
 }
 
 /* Convert jiffies to system time. */
-static inline u64 jiffies_to_st(unsigned long j) 
+u64 jiffies_to_st(unsigned long j)
 {
        unsigned long seq;
        long delta;
@@ -949,13 +960,14 @@
                delta = j - jiffies;
                /* NB. The next check can trigger in some wrap-around cases,
                 * but that's ok: we'll just end up with a shorter timeout. */
-               if (delta < 1) 
+               if (delta < 1)
                        delta = 1;
                st = processed_system_time + (delta * (u64)NS_PER_TICK);
        } while (read_seqretry(&xtime_lock, seq));
 
        return st;
 }
+EXPORT_SYMBOL(jiffies_to_st);
 
 /*
  * stop_hz_timer / start_hz_timer - enter/exit 'tickless mode' on an idle cpu
@@ -965,7 +977,7 @@
 {
        unsigned int cpu = smp_processor_id();
        unsigned long j;
-       
+
        /* We must do this /before/ checking rcu_pending(). */
        cpu_set(cpu, nohz_cpu_mask);
        smp_mb();
@@ -1012,7 +1024,7 @@
        do {
                seq = read_seqbegin(&xtime_lock);
                /* Use cpu0 timestamp: cpu's shadow is not initialised yet. */
-               per_cpu(processed_system_time, cpu) = 
+               per_cpu(processed_system_time, cpu) =
                        per_cpu(shadow_time, 0).system_timestamp;
                init_missing_ticks_accounting(cpu);
        } while (read_seqretry(&xtime_lock, seq));
@@ -1041,13 +1053,31 @@
  * now however.
  */
 static ctl_table xen_subtable[] = {
-       {1, "independent_wallclock", &independent_wallclock,
-        sizeof(independent_wallclock), 0644, NULL, proc_dointvec},
-       {0}
+       {
+               .ctl_name       = 1,
+               .procname       = "independent_wallclock",
+               .data           = &independent_wallclock,
+               .maxlen         = sizeof(independent_wallclock),
+               .mode           = 0644,
+               .proc_handler   = proc_dointvec
+       },
+       {
+               .ctl_name       = 2,
+               .procname       = "permitted_clock_jitter",
+               .data           = &permitted_clock_jitter,
+               .maxlen         = sizeof(permitted_clock_jitter),
+               .mode           = 0644,
+               .proc_handler   = proc_doulongvec_minmax
+       },
+       { 0 }
 };
 static ctl_table xen_table[] = {
-       {123, "xen", NULL, 0, 0555, xen_subtable},
-       {0}
+       {
+               .ctl_name       = 123,
+               .procname       = "xen",
+               .mode           = 0555,
+               .child          = xen_subtable},
+       { 0 }
 };
 static int __init xen_sysctl_init(void)
 {
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/arch/i386/mm/hypervisor.c
--- a/linux-2.6-xen-sparse/arch/i386/mm/hypervisor.c    Tue Mar 14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/arch/i386/mm/hypervisor.c    Tue Mar 14 20:50:35 2006
@@ -201,56 +201,6 @@
        BUG_ON(HYPERVISOR_mmuext_op(&op, 1, NULL, DOMID_SELF) < 0);
 }
 
-void xen_pte_pin(unsigned long ptr)
-{
-       struct mmuext_op op;
-       op.cmd = MMUEXT_PIN_L1_TABLE;
-       op.arg1.mfn = pfn_to_mfn(ptr >> PAGE_SHIFT);
-       BUG_ON(HYPERVISOR_mmuext_op(&op, 1, NULL, DOMID_SELF) < 0);
-}
-
-void xen_pte_unpin(unsigned long ptr)
-{
-       struct mmuext_op op;
-       op.cmd = MMUEXT_UNPIN_TABLE;
-       op.arg1.mfn = pfn_to_mfn(ptr >> PAGE_SHIFT);
-       BUG_ON(HYPERVISOR_mmuext_op(&op, 1, NULL, DOMID_SELF) < 0);
-}
-
-#ifdef CONFIG_X86_64
-void xen_pud_pin(unsigned long ptr)
-{
-       struct mmuext_op op;
-       op.cmd = MMUEXT_PIN_L3_TABLE;
-       op.arg1.mfn = pfn_to_mfn(ptr >> PAGE_SHIFT);
-       BUG_ON(HYPERVISOR_mmuext_op(&op, 1, NULL, DOMID_SELF) < 0);
-}
-
-void xen_pud_unpin(unsigned long ptr)
-{
-       struct mmuext_op op;
-       op.cmd = MMUEXT_UNPIN_TABLE;
-       op.arg1.mfn = pfn_to_mfn(ptr >> PAGE_SHIFT);
-       BUG_ON(HYPERVISOR_mmuext_op(&op, 1, NULL, DOMID_SELF) < 0);
-}
-
-void xen_pmd_pin(unsigned long ptr)
-{
-       struct mmuext_op op;
-       op.cmd = MMUEXT_PIN_L2_TABLE;
-       op.arg1.mfn = pfn_to_mfn(ptr >> PAGE_SHIFT);
-       BUG_ON(HYPERVISOR_mmuext_op(&op, 1, NULL, DOMID_SELF) < 0);
-}
-
-void xen_pmd_unpin(unsigned long ptr)
-{
-       struct mmuext_op op;
-       op.cmd = MMUEXT_UNPIN_TABLE;
-       op.arg1.mfn = pfn_to_mfn(ptr >> PAGE_SHIFT);
-       BUG_ON(HYPERVISOR_mmuext_op(&op, 1, NULL, DOMID_SELF) < 0);
-}
-#endif /* CONFIG_X86_64 */
-
 void xen_set_ldt(unsigned long ptr, unsigned long len)
 {
        struct mmuext_op op;
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/arch/i386/mm/init-xen.c
--- a/linux-2.6-xen-sparse/arch/i386/mm/init-xen.c      Tue Mar 14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/arch/i386/mm/init-xen.c      Tue Mar 14 20:50:35 2006
@@ -556,10 +556,15 @@
 
        kmap_init();
 
-       /* Switch to the real shared_info page, and clear the dummy page. */
-       set_fixmap(FIX_SHARED_INFO, xen_start_info->shared_info);
-       HYPERVISOR_shared_info = (shared_info_t *)fix_to_virt(FIX_SHARED_INFO);
-       memset(empty_zero_page, 0, sizeof(empty_zero_page));
+       if (!xen_feature(XENFEAT_auto_translated_physmap) ||
+           xen_start_info->shared_info >= xen_start_info->nr_pages) {
+               /* Switch to the real shared_info page, and clear the
+                * dummy page. */
+               set_fixmap(FIX_SHARED_INFO, xen_start_info->shared_info);
+               HYPERVISOR_shared_info =
+                       (shared_info_t *)fix_to_virt(FIX_SHARED_INFO);
+               memset(empty_zero_page, 0, sizeof(empty_zero_page));
+       }
 
        /* Setup mapping of lower 1st MB */
        for (i = 0; i < NR_FIX_ISAMAPS; i++)
diff -r dc50cdd66c5c -r 0ed4a312765b linux-2.6-xen-sparse/arch/x86_64/Kconfig
--- a/linux-2.6-xen-sparse/arch/x86_64/Kconfig  Tue Mar 14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/arch/x86_64/Kconfig  Tue Mar 14 20:50:35 2006
@@ -222,7 +222,7 @@
 
 config MTRR
        bool "MTRR (Memory Type Range Register) support"
-       depends on !X86_64_XEN
+       depends on !XEN_UNPRIVILEGED_GUEST
        ---help---
          On Intel P6 family processors (Pentium Pro, Pentium II and later)
          the Memory Type Range Registers (MTRRs) may be used to control
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/arch/x86_64/kernel/process-xen.c
--- a/linux-2.6-xen-sparse/arch/x86_64/kernel/process-xen.c     Tue Mar 14 
20:10:21 2006
+++ b/linux-2.6-xen-sparse/arch/x86_64/kernel/process-xen.c     Tue Mar 14 
20:50:35 2006
@@ -124,9 +124,9 @@
 {
        local_irq_disable();
 
-       if (need_resched()) {
+       if (need_resched())
                local_irq_enable();
-       } else {
+       else {
                clear_thread_flag(TIF_POLLING_NRFLAG);
                smp_mb__after_clear_bit();
                stop_hz_timer();
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/arch/x86_64/kernel/setup-xen.c
--- a/linux-2.6-xen-sparse/arch/x86_64/kernel/setup-xen.c       Tue Mar 14 
20:10:21 2006
+++ b/linux-2.6-xen-sparse/arch/x86_64/kernel/setup-xen.c       Tue Mar 14 
20:50:35 2006
@@ -664,6 +664,13 @@
 
        setup_xen_features();
 
+       if (xen_feature(XENFEAT_auto_translated_physmap) &&
+           xen_start_info->shared_info < xen_start_info->nr_pages) {
+               HYPERVISOR_shared_info =
+                       (shared_info_t *)__va(xen_start_info->shared_info);
+               memset(empty_zero_page, 0, sizeof(empty_zero_page));
+       }
+
        HYPERVISOR_vm_assist(VMASST_CMD_enable,
                             VMASST_TYPE_writable_pagetables);
 
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/arch/x86_64/mm/init-xen.c
--- a/linux-2.6-xen-sparse/arch/x86_64/mm/init-xen.c    Tue Mar 14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/arch/x86_64/mm/init-xen.c    Tue Mar 14 20:50:35 2006
@@ -244,7 +244,6 @@
        if (pud_none(*pud)) {
                pmd = (pmd_t *) spp_getpage(); 
                make_page_readonly(pmd, XENFEAT_writable_page_tables);
-               xen_pmd_pin(__pa(pmd));
                set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE | _PAGE_USER));
                if (pmd != pmd_offset(pud, 0)) {
                        printk("PAGETABLE BUG #01! %p <-> %p\n", pmd, 
pmd_offset(pud,0));
@@ -255,7 +254,6 @@
        if (pmd_none(*pmd)) {
                pte = (pte_t *) spp_getpage();
                make_page_readonly(pte, XENFEAT_writable_page_tables);
-               xen_pte_pin(__pa(pte));
                set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE | _PAGE_USER));
                if (pte != pte_offset_kernel(pmd, 0)) {
                        printk("PAGETABLE BUG #02!\n");
@@ -297,7 +295,6 @@
 
                pmd = (pmd_t *) spp_getpage(); 
                make_page_readonly(pmd, XENFEAT_writable_page_tables);
-               xen_pmd_pin(__pa(pmd));
 
                set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE | _PAGE_USER));
 
@@ -311,7 +308,6 @@
        if (pmd_none(*pmd)) {
                pte = (pte_t *) spp_getpage();
                make_page_readonly(pte, XENFEAT_writable_page_tables);
-               xen_pte_pin(__pa(pte));
 
                set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE | _PAGE_USER));
                if (pte != pte_offset_kernel(pmd, 0)) {
@@ -461,7 +457,6 @@
                }
                pte = pte_save;
                early_make_page_readonly(pte, XENFEAT_writable_page_tables);
-               xen_pte_pin(pte_phys);
                set_pmd(pmd, __pmd(pte_phys | _KERNPG_TABLE));
        }
 }
@@ -500,7 +495,6 @@
 
                pmd = alloc_static_page(&pmd_phys);
                early_make_page_readonly(pmd, XENFEAT_writable_page_tables);
-               xen_pmd_pin(pmd_phys);
                spin_lock(&init_mm.page_table_lock);
                set_pud(pud, __pud(pmd_phys | _KERNPG_TABLE));
                phys_pmd_init(pmd, paddr, end);
@@ -545,9 +539,6 @@
 
        xen_pgd_pin(__pa_symbol(init_level4_pgt));
        xen_pgd_pin(__pa_symbol(init_level4_user_pgt));
-       xen_pud_pin(__pa_symbol(level3_kernel_pgt));
-       xen_pud_pin(__pa_symbol(level3_user_pgt));
-       xen_pmd_pin(__pa_symbol(level2_kernel_pgt));
 
        set_pgd((pgd_t *)(init_level4_user_pgt + 511), 
                mk_kernel_pgd(__pa_symbol(level3_user_pgt)));
@@ -581,7 +572,6 @@
                        pte_page = alloc_static_page(&phys);
                        early_make_page_readonly(
                                pte_page, XENFEAT_writable_page_tables);
-                       xen_pte_pin(phys);
                        set_pmd(pmd, __pmd(phys | _KERNPG_TABLE | _PAGE_USER));
                } else {
                        addr = page[pmd_index(va)];
@@ -662,7 +652,6 @@
                        pud = alloc_static_page(&pud_phys);
                        early_make_page_readonly(pud, 
XENFEAT_writable_page_tables);
                }
-               xen_pud_pin(pud_phys);
                next = start + PGDIR_SIZE;
                if (next > end) 
                        next = end; 
@@ -757,10 +746,16 @@
        free_area_init_node(0, NODE_DATA(0), zones,
                            __pa(PAGE_OFFSET) >> PAGE_SHIFT, holes);
 
-       set_fixmap(FIX_SHARED_INFO, xen_start_info->shared_info);
-       HYPERVISOR_shared_info = (shared_info_t *)fix_to_virt(FIX_SHARED_INFO);
-
-       memset(empty_zero_page, 0, sizeof(empty_zero_page));
+       if (!xen_feature(XENFEAT_auto_translated_physmap) ||
+           xen_start_info->shared_info >= xen_start_info->nr_pages) {
+               /* Switch to the real shared_info page, and clear the
+                * dummy page. */
+               set_fixmap(FIX_SHARED_INFO, xen_start_info->shared_info);
+               HYPERVISOR_shared_info =
+                       (shared_info_t *)fix_to_virt(FIX_SHARED_INFO);
+               memset(empty_zero_page, 0, sizeof(empty_zero_page));
+       }
+
        init_mm.context.pinned = 1;
 
        /* Setup mapping of lower 1st MB */
@@ -937,7 +932,6 @@
                ClearPageReserved(virt_to_page(addr));
                set_page_count(virt_to_page(addr), 1);
                memset((void *)(addr & ~(PAGE_SIZE-1)), 0xcc, PAGE_SIZE); 
-               xen_pte_unpin(__pa(addr));
                make_page_writable(
                        __va(__pa(addr)), XENFEAT_writable_page_tables);
                /*
diff -r dc50cdd66c5c -r 0ed4a312765b linux-2.6-xen-sparse/drivers/xen/Kconfig
--- a/linux-2.6-xen-sparse/drivers/xen/Kconfig  Tue Mar 14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/drivers/xen/Kconfig  Tue Mar 14 20:50:35 2006
@@ -30,12 +30,14 @@
        default !XEN_PRIVILEGED_GUEST
 
 config XEN_PCIDEV_BACKEND
-       bool "PCI device backend driver"
-       select PCI
-       default y if XEN_PRIVILEGED_GUEST
+       tristate "PCI device backend driver"
+       depends PCI
+       default XEN_PRIVILEGED_GUEST
        help
          The PCI device backend driver allows the kernel to export arbitrary
-         PCI devices to other guests.
+         PCI devices to other guests. If you select this to be a module, you
+         will need to make sure no other driver has bound to the device(s)
+         you want to make visible to other guests.
 
 choice
        prompt "PCI Backend Mode"
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/drivers/xen/balloon/balloon.c
--- a/linux-2.6-xen-sparse/drivers/xen/balloon/balloon.c        Tue Mar 14 
20:10:21 2006
+++ b/linux-2.6-xen-sparse/drivers/xen/balloon/balloon.c        Tue Mar 14 
20:50:35 2006
@@ -468,6 +468,7 @@
                return -1;
 
        current_pages = min(xen_start_info->nr_pages, max_pfn);
+       totalram_pages = current_pages;
        target_pages  = current_pages;
        balloon_low   = 0;
        balloon_high  = 0;
@@ -547,6 +548,7 @@
                &init_mm, vstart, PAGE_SIZE << order, dealloc_pte_fn, NULL);
        BUG_ON(ret);
        current_pages -= 1UL << order;
+       totalram_pages = current_pages;
        balloon_unlock(flags);
 
        schedule_work(&balloon_worker);
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/drivers/xen/blkfront/blkfront.c
--- a/linux-2.6-xen-sparse/drivers/xen/blkfront/blkfront.c      Tue Mar 14 
20:10:21 2006
+++ b/linux-2.6-xen-sparse/drivers/xen/blkfront/blkfront.c      Tue Mar 14 
20:50:35 2006
@@ -95,20 +95,16 @@
                xenbus_dev_fatal(dev, -ENOMEM, "allocating info structure");
                return -ENOMEM;
        }
+
+       memset(info, 0, sizeof(*info));
        info->xbdev = dev;
        info->vdevice = vdevice;
        info->connected = BLKIF_STATE_DISCONNECTED;
-       info->mi = NULL;
-       info->gd = NULL;
        INIT_WORK(&info->work, blkif_restart_queue, (void *)info);
 
-       info->shadow_free = 0;
-       memset(info->shadow, 0, sizeof(info->shadow));
        for (i = 0; i < BLK_RING_SIZE; i++)
                info->shadow[i].req.id = i+1;
        info->shadow[BLK_RING_SIZE-1].req.id = 0x0fffffff;
-
-       info->users = 0;
 
        /* Front end dir is a number, which is used as the id. */
        info->handle = simple_strtoul(strrchr(dev->nodename,'/')+1, NULL, 0);
@@ -182,9 +178,8 @@
        }
 
        err = xenbus_switch_state(dev, xbt, XenbusStateInitialised);
-       if (err) {
+       if (err)
                goto abort_transaction;
-       }
 
        err = xenbus_transaction_end(xbt, 0);
        if (err) {
@@ -295,17 +290,17 @@
 /* ** Connection ** */
 
 
-/* 
-** Invoked when the backend is finally 'ready' (and has told produced 
-** the details about the physical device - #sectors, size, etc). 
-*/
+/*
+ * Invoked when the backend is finally 'ready' (and has told produced
+ * the details about the physical device - #sectors, size, etc).
+ */
 static void connect(struct blkfront_info *info)
 {
        unsigned long sectors, sector_size;
        unsigned int binfo;
        int err;
 
-        if( (info->connected == BLKIF_STATE_CONNECTED) || 
+       if ((info->connected == BLKIF_STATE_CONNECTED) ||
            (info->connected == BLKIF_STATE_SUSPENDED) )
                return;
 
@@ -330,7 +325,7 @@
                return;
        }
 
-       (void)xenbus_switch_state(info->xbdev, XBT_NULL, XenbusStateConnected); 
+       (void)xenbus_switch_state(info->xbdev, XBT_NULL, XenbusStateConnected);
 
        /* Kick pending requests. */
        spin_lock_irq(&blkif_io_lock);
@@ -353,11 +348,7 @@
 
        DPRINTK("blkfront_closing: %s removed\n", dev->nodename);
 
-       if (info->mi) {
-               DPRINTK("Calling xlvbd_del\n");
-               xlvbd_del(info);
-               info->mi = NULL;
-       }
+       xlvbd_del(info);
 
        xenbus_switch_state(dev, XBT_NULL, XenbusStateClosed);
 }
@@ -463,8 +454,7 @@
        DPRINTK_IOCTL("command: 0x%x, argument: 0x%lx, dev: 0x%04x\n",
                      command, (long)argument, inode->i_rdev);
 
-       switch ( command )
-       {
+       switch (command) {
        case HDIO_GETGEO:
                /* return ENOSYS to use defaults */
                return -ENOSYS;
@@ -490,7 +480,7 @@
  * blkif_queue_request
  *
  * request block io
- * 
+ *
  * id: for guest use only.
  * operation: BLKIF_OP_{READ,WRITE,PROBE}
  * buffer: buffer to read/write into. this should be a
@@ -557,7 +547,7 @@
                        ring_req->seg[ring_req->nr_segments] =
                                (struct blkif_request_segment) {
                                        .gref       = ref,
-                                       .first_sect = fsect, 
+                                       .first_sect = fsect,
                                        .last_sect  = lsect };
 
                        ring_req->nr_segments++;
@@ -679,9 +669,8 @@
                RING_FINAL_CHECK_FOR_RESPONSES(&info->ring, more_to_do);
                if (more_to_do)
                        goto again;
-       } else {
+       } else
                info->ring.sring->rsp_event = i + 1;
-       }
 
        kick_pending_request_queues(info);
 
@@ -694,8 +683,8 @@
 {
        /* Prevent new requests being issued until we fix things up. */
        spin_lock_irq(&blkif_io_lock);
-       info->connected = suspend ? 
-               BLKIF_STATE_SUSPENDED : BLKIF_STATE_DISCONNECTED; 
+       info->connected = suspend ?
+               BLKIF_STATE_SUSPENDED : BLKIF_STATE_DISCONNECTED;
        spin_unlock_irq(&blkif_io_lock);
 
        /* Free resources associated with old device channel. */
@@ -706,7 +695,7 @@
                info->ring.sring = NULL;
        }
        if (info->irq)
-               unbind_from_irqhandler(info->irq, info); 
+               unbind_from_irqhandler(info->irq, info);
        info->evtchn = info->irq = 0;
 
 }
@@ -767,11 +756,11 @@
 
        kfree(copy);
 
-       (void)xenbus_switch_state(info->xbdev, XBT_NULL, XenbusStateConnected); 
-       
+       (void)xenbus_switch_state(info->xbdev, XBT_NULL, XenbusStateConnected);
+
        /* Now safe for us to use the shared ring */
        spin_lock_irq(&blkif_io_lock);
-        info->connected = BLKIF_STATE_CONNECTED;
+       info->connected = BLKIF_STATE_CONNECTED;
        spin_unlock_irq(&blkif_io_lock);
 
        /* Send off requeued requests */
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/drivers/xen/blkfront/block.h
--- a/linux-2.6-xen-sparse/drivers/xen/blkfront/block.h Tue Mar 14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/drivers/xen/blkfront/block.h Tue Mar 14 20:50:35 2006
@@ -55,24 +55,24 @@
 #include <asm/atomic.h>
 #include <asm/uaccess.h>
 
-#if 1 
+#if 1
 #define IPRINTK(fmt, args...) \
     printk(KERN_INFO "xen_blk: " fmt, ##args)
 #else
 #define IPRINTK(fmt, args...) ((void)0)
 #endif
 
-#if 1 
+#if 1
 #define WPRINTK(fmt, args...) \
     printk(KERN_WARNING "xen_blk: " fmt, ##args)
 #else
 #define WPRINTK(fmt, args...) ((void)0)
 #endif
- 
-#define DPRINTK(_f, _a...) pr_debug ( _f , ## _a )
+
+#define DPRINTK(_f, _a...) pr_debug(_f, ## _a)
 
 #if 0
-#define DPRINTK_IOCTL(_f, _a...) printk ( KERN_ALERT _f , ## _a )
+#define DPRINTK_IOCTL(_f, _a...) printk(KERN_ALERT _f, ## _a)
 #else
 #define DPRINTK_IOCTL(_f, _a...) ((void)0)
 #endif
@@ -139,7 +139,7 @@
                        unsigned command, unsigned long argument);
 extern int blkif_check(dev_t dev);
 extern int blkif_revalidate(dev_t dev);
-extern void do_blkif_request (request_queue_t *rq); 
+extern void do_blkif_request (request_queue_t *rq);
 
 /* Virtual block-device subsystem. */
 /* Note that xlvbd_add doesn't call add_disk for you: you're expected
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/drivers/xen/blkfront/vbd.c
--- a/linux-2.6-xen-sparse/drivers/xen/blkfront/vbd.c   Tue Mar 14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/drivers/xen/blkfront/vbd.c   Tue Mar 14 20:50:35 2006
@@ -216,6 +216,10 @@
        int nr_minors = 1;
        int err = -ENODEV;
 
+       BUG_ON(info->gd != NULL);
+       BUG_ON(info->mi != NULL);
+       BUG_ON(info->rq != NULL);
+
        mi = xlbd_get_major_info(vdevice);
        if (mi == NULL)
                goto out;
@@ -268,6 +272,7 @@
  out:
        if (mi)
                xlbd_put_major_info(mi);
+       info->mi = NULL;
        return err;
 }
 
@@ -294,22 +299,20 @@
 void
 xlvbd_del(struct blkfront_info *info)
 {
-       struct block_device *bd;
-
-       bd = bdget(info->dev);
-       if (bd == NULL)
+       if (info->mi == NULL)
                return;
 
-       if (info->gd == NULL)
-               return;
-
+       BUG_ON(info->gd == NULL);
        del_gendisk(info->gd);
        put_disk(info->gd);
+       info->gd = NULL;
+
        xlbd_put_major_info(info->mi);
        info->mi = NULL;
+
+       BUG_ON(info->rq == NULL);
        blk_cleanup_queue(info->rq);
-
-       bdput(bd);
+       info->rq = NULL;
 }
 
 /*
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/drivers/xen/console/console.c
--- a/linux-2.6-xen-sparse/drivers/xen/console/console.c        Tue Mar 14 
20:10:21 2006
+++ b/linux-2.6-xen-sparse/drivers/xen/console/console.c        Tue Mar 14 
20:50:35 2006
@@ -85,8 +85,7 @@
        else if (!strncmp(str, "off", 3))
                xc_mode = XC_OFF;
 
-       switch ( xc_mode )
-       {
+       switch (xc_mode) {
        case XC_SERIAL:
                n = simple_strtol(str+4, &q, 10);
                if (q > (str + 4))
@@ -227,7 +226,7 @@
        va_list args;
        int printk_len;
        static char printk_buf[1024];
-    
+
        /* Emit the output into the temporary buffer */
        va_start(args, fmt);
        printk_len = vsnprintf(printk_buf, sizeof(printk_buf), fmt, args);
@@ -485,7 +484,7 @@
 
        spin_lock_irqsave(&xencons_lock, flags);
        __xencons_tx_flush();
-       spin_unlock_irqrestore(&xencons_lock, flags);    
+       spin_unlock_irqrestore(&xencons_lock, flags);
 }
 
 static void xencons_wait_until_sent(struct tty_struct *tty, int timeout)
@@ -495,17 +494,15 @@
        if (TTY_INDEX(tty) != 0)
                return;
 
-       while (DRV(tty->driver)->chars_in_buffer(tty))
-       {
+       while (DRV(tty->driver)->chars_in_buffer(tty)) {
                set_current_state(TASK_INTERRUPTIBLE);
                schedule_timeout(1);
                if (signal_pending(current))
                        break;
-               if ( (timeout != 0) &&
-                    time_after(jiffies, orig_jiffies + timeout) )
+               if (timeout && time_after(jiffies, orig_jiffies + timeout))
                        break;
        }
-    
+
        set_current_state(TASK_RUNNING);
 }
 
@@ -521,7 +518,7 @@
        if (xencons_tty == NULL)
                xencons_tty = tty;
        __xencons_tx_flush();
-       spin_unlock_irqrestore(&xencons_lock, flags);    
+       spin_unlock_irqrestore(&xencons_lock, flags);
 
        return 0;
 }
@@ -543,7 +540,7 @@
                tty->closing = 0;
                spin_lock_irqsave(&xencons_lock, flags);
                xencons_tty = NULL;
-               spin_unlock_irqrestore(&xencons_lock, flags);    
+               spin_unlock_irqrestore(&xencons_lock, flags);
        }
 }
 
@@ -574,7 +571,7 @@
 
        xencons_ring_init();
 
-       xencons_driver = alloc_tty_driver((xc_mode == XC_SERIAL) ? 
+       xencons_driver = alloc_tty_driver((xc_mode == XC_SERIAL) ?
                                          1 : MAX_NR_CONSOLES);
        if (xencons_driver == NULL)
                return -ENOMEM;
@@ -584,15 +581,14 @@
        DRV(xencons_driver)->type            = TTY_DRIVER_TYPE_SERIAL;
        DRV(xencons_driver)->subtype         = SERIAL_TYPE_NORMAL;
        DRV(xencons_driver)->init_termios    = tty_std_termios;
-       DRV(xencons_driver)->flags           = 
+       DRV(xencons_driver)->flags           =
                TTY_DRIVER_REAL_RAW |
                TTY_DRIVER_RESET_TERMIOS |
                TTY_DRIVER_NO_DEVFS;
        DRV(xencons_driver)->termios         = xencons_termios;
        DRV(xencons_driver)->termios_locked  = xencons_termios_locked;
 
-       if (xc_mode == XC_SERIAL)
-       {
+       if (xc_mode == XC_SERIAL) {
                DRV(xencons_driver)->name        = "ttyS";
                DRV(xencons_driver)->minor_start = 64 + xc_num;
                DRV(xencons_driver)->name_base   = 0 + xc_num;
@@ -630,7 +626,7 @@
        printk("Xen virtual console successfully installed as %s%d\n",
               DRV(xencons_driver)->name,
               DRV(xencons_driver)->name_base );
-    
+
        return 0;
 }
 
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/drivers/xen/console/xencons_ring.c
--- a/linux-2.6-xen-sparse/drivers/xen/console/xencons_ring.c   Tue Mar 14 
20:10:21 2006
+++ b/linux-2.6-xen-sparse/drivers/xen/console/xencons_ring.c   Tue Mar 14 
20:50:35 2006
@@ -55,7 +55,7 @@
        notify_daemon();
 
        return sent;
-}      
+}
 
 static irqreturn_t handle_input(int irq, void *unused, struct pt_regs *regs)
 {
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/drivers/xen/core/evtchn.c
--- a/linux-2.6-xen-sparse/drivers/xen/core/evtchn.c    Tue Mar 14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/drivers/xen/core/evtchn.c    Tue Mar 14 20:50:35 2006
@@ -72,7 +72,7 @@
 
 /* IRQ <-> IPI mapping. */
 #ifndef NR_IPIS
-#define NR_IPIS 1 
+#define NR_IPIS 1
 #endif
 DEFINE_PER_CPU(int, ipi_to_irq[NR_IPIS]);
 
@@ -209,7 +209,7 @@
        irq_bindcount[irq]++;
 
        spin_unlock(&irq_mapping_update_lock);
-    
+
        return irq;
 }
 
@@ -238,7 +238,7 @@
        irq_bindcount[irq]++;
 
        spin_unlock(&irq_mapping_update_lock);
-    
+
        return irq;
 }
 
@@ -535,9 +535,9 @@
        /* NB. We are happy to share unless we are probing. */
        op.u.bind_pirq.flags = probing_irq(irq) ? 0 : BIND_PIRQ__WILL_SHARE;
        if (HYPERVISOR_event_channel_op(&op) != 0) {
-               if ( !probing_irq(irq) )
-                       printk(KERN_INFO "Failed to obtain physical "
-                              "IRQ %d\n", irq);
+               if (!probing_irq(irq))
+                       printk(KERN_INFO "Failed to obtain physical IRQ %d\n",
+                              irq);
                return 0;
        }
        evtchn = op.u.bind_pirq.port;
@@ -669,7 +669,7 @@
         * like a real IO-APIC we 'lose the interrupt edge' if the channel is
         * masked.
         */
-       if (synch_test_bit(port, &s->evtchn_pending[0]) && 
+       if (synch_test_bit(port, &s->evtchn_pending[0]) &&
            !synch_test_and_set_bit(port / BITS_PER_LONG,
                                    &vcpu_info->evtchn_pending_sel)) {
                vcpu_info->evtchn_upcall_pending = 1;
@@ -722,7 +722,7 @@
                op.u.bind_virq.vcpu = 0;
                BUG_ON(HYPERVISOR_event_channel_op(&op) != 0);
                evtchn = op.u.bind_virq.port;
-        
+
                /* Record the new mapping. */
                evtchn_to_irq[evtchn] = irq;
                irq_info[irq] = mk_irq_info(IRQT_VIRQ, virq, evtchn);
@@ -744,7 +744,7 @@
                op.u.bind_ipi.vcpu = 0;
                BUG_ON(HYPERVISOR_event_channel_op(&op) != 0);
                evtchn = op.u.bind_ipi.port;
-        
+
                /* Record the new mapping. */
                evtchn_to_irq[evtchn] = irq;
                irq_info[irq] = mk_irq_info(IRQT_IPI, ipi, evtchn);
@@ -794,8 +794,7 @@
        }
 
        /* Phys IRQ space is statically bound (1:1 mapping). Nail refcnts. */
-       for (i = 0; i < NR_PIRQS; i++)
-       {
+       for (i = 0; i < NR_PIRQS; i++) {
                irq_bindcount[pirq_to_irq(i)] = 1;
 
 #ifdef RTC_IRQ
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/drivers/xen/core/features.c
--- a/linux-2.6-xen-sparse/drivers/xen/core/features.c  Tue Mar 14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/drivers/xen/core/features.c  Tue Mar 14 20:50:35 2006
@@ -19,7 +19,7 @@
        xen_feature_info_t fi;
        int i, j;
 
-       for (i=0; i<XENFEAT_NR_SUBMAPS; i++) {
+       for (i = 0; i < XENFEAT_NR_SUBMAPS; i++) {
                fi.submap_idx = i;
                if (HYPERVISOR_xen_version(XENVER_get_features, &fi) < 0)
                        break;
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/drivers/xen/core/gnttab.c
--- a/linux-2.6-xen-sparse/drivers/xen/core/gnttab.c    Tue Mar 14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/drivers/xen/core/gnttab.c    Tue Mar 14 20:50:35 2006
@@ -31,6 +31,8 @@
 #include <linux/config.h>
 #include <linux/module.h>
 #include <linux/sched.h>
+#include <linux/mm.h>
+#include <linux/vmalloc.h>
 #include <asm/pgtable.h>
 #include <xen/interface/xen.h>
 #include <asm/fixmap.h>
@@ -40,7 +42,7 @@
 
 #if 1
 #define ASSERT(_p)                                                           \
-       if ( !(_p) ) { printk(KERN_ALERT"Assertion '%s': line %d, file %s\n", \
+       if (!(_p)) { printk(KERN_ALERT"Assertion '%s': line %d, file %s\n",   \
        #_p , __LINE__, __FILE__); *(int*)0=0; }
 #else
 #define ASSERT(_p) ((void)0)
@@ -77,7 +79,7 @@
 static grant_ref_t gnttab_free_head;
 static spinlock_t gnttab_list_lock = SPIN_LOCK_UNLOCKED;
 
-static grant_entry_t *shared;
+static grant_entry_t *shared = NULL;
 
 static struct gnttab_free_callback *gnttab_free_callback_list = NULL;
 
@@ -152,7 +154,7 @@
 gnttab_grant_foreign_access(domid_t domid, unsigned long frame, int readonly)
 {
        int ref;
-    
+
        if (unlikely((ref = get_free_entry()) == -1))
                return -ENOSPC;
 
@@ -192,13 +194,12 @@
 
        nflags = shared[ref].flags;
        do {
-               if ( (flags = nflags) & (GTF_reading|GTF_writing) ) {
+               if ((flags = nflags) & (GTF_reading|GTF_writing)) {
                        printk(KERN_ALERT "WARNING: g.e. still in use!\n");
                        return 0;
                }
-       }
-       while ((nflags = synch_cmpxchg(&shared[ref].flags, flags, 0)) !=
-              flags);
+       } while ((nflags = synch_cmpxchg(&shared[ref].flags, flags, 0)) !=
+                flags);
 
        return 1;
 }
@@ -211,8 +212,7 @@
                if (page != 0) {
                        free_page(page);
                }
-       }
-       else {
+       } else {
                /* XXX This needs to be fixed so that the ref and page are
                   placed on a list to be freed up later. */
                printk(KERN_WARNING
@@ -253,7 +253,7 @@
          * reference and return failure (== 0).
          */
        while (!((flags = shared[ref].flags) & GTF_transfer_committed)) {
-               if ( synch_cmpxchg(&shared[ref].flags, flags, 0) == flags )
+               if (synch_cmpxchg(&shared[ref].flags, flags, 0) == flags)
                        return 0;
                cpu_relax();
        }
@@ -356,12 +356,35 @@
        spin_unlock_irqrestore(&gnttab_list_lock, flags);
 }
 
+#ifndef __ia64__
+static int map_pte_fn(pte_t *pte, struct page *pte_page,
+                     unsigned long addr, void *data)
+{
+       unsigned long **frames = (unsigned long **)data;
+
+       set_pte_at(&init_mm, addr, pte, pfn_pte_ma((*frames)[0], PAGE_KERNEL));
+       (*frames)++;
+       return 0;
+}
+
+static int unmap_pte_fn(pte_t *pte, struct page *pte_page,
+                     unsigned long addr, void *data)
+{
+
+       set_pte_at(&init_mm, addr, pte, __pte(0));
+       return 0;
+}
+#endif
+
 int
 gnttab_resume(void)
 {
        gnttab_setup_table_t setup;
-       unsigned long        frames[NR_GRANT_FRAMES];
-       int                  i;
+       unsigned long frames[NR_GRANT_FRAMES];
+#ifndef __ia64__
+       void *pframes = frames;
+       struct vm_struct *area;
+#endif
 
        setup.dom        = DOMID_SELF;
        setup.nr_frames  = NR_GRANT_FRAMES;
@@ -370,12 +393,18 @@
        BUG_ON(HYPERVISOR_grant_table_op(GNTTABOP_setup_table, &setup, 1));
        BUG_ON(setup.status != 0);
 
-#ifdef __ia64__
+#ifndef __ia64__
+       if (shared == NULL) {
+               area = get_vm_area(PAGE_SIZE * NR_GRANT_FRAMES, VM_IOREMAP);
+               BUG_ON(area == NULL);
+               shared = area->addr;
+       }
+       BUG_ON(generic_page_range(&init_mm, (unsigned long)shared,
+                                 PAGE_SIZE * NR_GRANT_FRAMES,
+                                 map_pte_fn, &pframes));
+#else
        shared = __va(frames[0] << PAGE_SHIFT);
        printk("grant table at %p\n", shared);
-#else
-       for (i = 0; i < NR_GRANT_FRAMES; i++)
-               set_fixmap(FIX_GNTTAB_END - i, frames[i] << PAGE_SHIFT);
 #endif
 
        return 0;
@@ -384,10 +413,12 @@
 int
 gnttab_suspend(void)
 {
-       int i;
-
-       for (i = 0; i < NR_GRANT_FRAMES; i++)
-               clear_fixmap(FIX_GNTTAB_END - i);
+
+#ifndef __ia64__
+       generic_page_range(&init_mm, (unsigned long)shared,
+                          PAGE_SIZE * NR_GRANT_FRAMES,
+                          unmap_pte_fn, NULL);
+#endif
 
        return 0;
 }
@@ -401,10 +432,6 @@
                return -ENODEV;
 
        BUG_ON(gnttab_resume());
-
-#ifndef __ia64__
-       shared = (grant_entry_t *)fix_to_virt(FIX_GNTTAB_END);
-#endif
 
        for (i = NR_RESERVED_ENTRIES; i < NR_GRANT_ENTRIES; i++)
                gnttab_list[i] = i + 1;
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/drivers/xen/core/reboot.c
--- a/linux-2.6-xen-sparse/drivers/xen/core/reboot.c    Tue Mar 14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/drivers/xen/core/reboot.c    Tue Mar 14 20:50:35 2006
@@ -29,10 +29,11 @@
 #define SHUTDOWN_POWEROFF  0
 #define SHUTDOWN_REBOOT    1
 #define SHUTDOWN_SUSPEND   2
-// Code 3 is SHUTDOWN_CRASH, which we don't use because the domain can only
-// report a crash, not be instructed to crash!
-// HALT is the same as POWEROFF, as far as we're concerned.  The tools use
-// the distinction when we return the reason code to them.
+/* Code 3 is SHUTDOWN_CRASH, which we don't use because the domain can only
+ * report a crash, not be instructed to crash!
+ * HALT is the same as POWEROFF, as far as we're concerned.  The tools use
+ * the distinction when we return the reason code to them.
+ */
 #define SHUTDOWN_HALT      4
 
 void machine_emergency_restart(void)
@@ -84,13 +85,13 @@
 {
        int i, j, k, fpp;
 
-       extern int gnttab_suspend(void);
-       extern int gnttab_resume(void);
-
-       extern void time_resume(void);
        extern unsigned long max_pfn;
        extern unsigned long *pfn_to_mfn_frame_list_list;
        extern unsigned long *pfn_to_mfn_frame_list[];
+
+       extern int gnttab_suspend(void);
+       extern int gnttab_resume(void);
+       extern void time_resume(void);
 
 #ifdef CONFIG_SMP
        cpumask_t prev_online_cpus;
@@ -167,26 +168,26 @@
         */
        HYPERVISOR_suspend(virt_to_mfn(xen_start_info));
 
-       shutting_down = SHUTDOWN_INVALID; 
+       shutting_down = SHUTDOWN_INVALID;
 
        set_fixmap(FIX_SHARED_INFO, xen_start_info->shared_info);
 
        HYPERVISOR_shared_info = (shared_info_t *)fix_to_virt(FIX_SHARED_INFO);
 
        memset(empty_zero_page, 0, PAGE_SIZE);
-            
+
        HYPERVISOR_shared_info->arch.pfn_to_mfn_frame_list_list =
                virt_to_mfn(pfn_to_mfn_frame_list_list);
-  
+
        fpp = PAGE_SIZE/sizeof(unsigned long);
        for (i = 0, j = 0, k = -1; i < max_pfn; i += fpp, j++) {
                if ((j % fpp) == 0) {
                        k++;
-                       pfn_to_mfn_frame_list_list[k] = 
+                       pfn_to_mfn_frame_list_list[k] =
                                virt_to_mfn(pfn_to_mfn_frame_list[k]);
                        j = 0;
                }
-               pfn_to_mfn_frame_list[k][j] = 
+               pfn_to_mfn_frame_list[k][j] =
                        virt_to_mfn(&phys_to_machine_mapping[i]);
        }
        HYPERVISOR_shared_info->arch.max_pfn = max_pfn;
@@ -207,7 +208,7 @@
 
 #endif
 
-       /* 
+       /*
         * Only resume xenbus /after/ we've prepared our VCPUs; otherwise
         * the VCPU hotplug callback can race with our vcpu_prepare
         */
@@ -231,7 +232,7 @@
 
 static int shutdown_process(void *__unused)
 {
-       static char *envp[] = { "HOME=/", "TERM=linux", 
+       static char *envp[] = { "HOME=/", "TERM=linux",
                                "PATH=/sbin:/usr/sbin:/bin:/usr/bin", NULL };
        static char *restart_argv[]  = { "/sbin/reboot", NULL };
        static char *poweroff_argv[] = { "/sbin/poweroff", NULL };
@@ -291,7 +292,7 @@
        else
                err = kthread_create_on_cpu(__do_suspend, NULL, "suspend", 0);
 
-       if ( err < 0 ) {
+       if (err < 0) {
                printk(KERN_WARNING "Error creating shutdown process (%d): "
                       "retrying...\n", -err);
                schedule_delayed_work(&shutdown_work, HZ/2);
@@ -406,14 +407,12 @@
        err2 = register_xenbus_watch(&sysrq_watch);
 #endif
 
-       if (err1) {
+       if (err1)
                printk(KERN_ERR "Failed to set shutdown watcher\n");
-       }
-    
+
 #ifdef CONFIG_MAGIC_SYSRQ
-       if (err2) {
+       if (err2)
                printk(KERN_ERR "Failed to set sysrq watcher\n");
-       }
 #endif
 
        return NOTIFY_DONE;
@@ -421,11 +420,11 @@
 
 static int __init setup_shutdown_event(void)
 {
-    
+
        xenstore_notifier.notifier_call = setup_shutdown_watcher;
 
        register_xenstore_notifier(&xenstore_notifier);
-    
+
        return 0;
 }
 
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/drivers/xen/net_driver_util.c
--- a/linux-2.6-xen-sparse/drivers/xen/net_driver_util.c        Tue Mar 14 
20:10:21 2006
+++ b/linux-2.6-xen-sparse/drivers/xen/net_driver_util.c        Tue Mar 14 
20:50:35 2006
@@ -40,9 +40,8 @@
        int i;
        char *e;
        char *macstr = xenbus_read(XBT_NULL, dev->nodename, "mac", NULL);
-       if (IS_ERR(macstr)) {
+       if (IS_ERR(macstr))
                return PTR_ERR(macstr);
-       }
        s = macstr;
        for (i = 0; i < ETH_ALEN; i++) {
                mac[i] = simple_strtoul(s, &e, 16);
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c
--- a/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c      Tue Mar 14 
20:10:21 2006
+++ b/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c      Tue Mar 14 
20:50:35 2006
@@ -91,7 +91,7 @@
 
        struct net_device_stats stats;
        unsigned int tx_full;
-    
+
        netif_tx_front_ring_t tx;
        netif_rx_front_ring_t rx;
 
@@ -129,9 +129,9 @@
        struct sk_buff *rx_skbs[NET_RX_RING_SIZE+1];
 
        grant_ref_t gref_tx_head;
-       grant_ref_t grant_tx_ref[NET_TX_RING_SIZE + 1]; 
+       grant_ref_t grant_tx_ref[NET_TX_RING_SIZE + 1];
        grant_ref_t gref_rx_head;
-       grant_ref_t grant_rx_ref[NET_TX_RING_SIZE + 1]; 
+       grant_ref_t grant_rx_ref[NET_TX_RING_SIZE + 1];
 
        struct xenbus_device *xbdev;
        int tx_ring_ref;
@@ -433,7 +433,7 @@
 
        skb = arp_create(ARPOP_REPLY, ETH_P_ARP,
                         dst_ip, dev, src_ip,
-                        /*dst_hw*/ NULL, /*src_hw*/ NULL, 
+                        /*dst_hw*/ NULL, /*src_hw*/ NULL,
                         /*target_hw*/ dev->dev_addr);
        if (skb == NULL)
                return -ENOMEM;
@@ -480,7 +480,7 @@
                                printk(KERN_ALERT "network_tx_buf_gc: warning "
                                       "-- grant still in use by backend "
                                       "domain.\n");
-                               goto out; 
+                               goto out;
                        }
                        gnttab_end_foreign_access_ref(
                                np->grant_tx_ref[id], GNTMAP_readonly);
@@ -490,9 +490,9 @@
                        ADD_ID_TO_FREELIST(np->tx_skbs, id);
                        dev_kfree_skb_irq(skb);
                }
-        
+
                np->tx.rsp_cons = prod;
-        
+
                /*
                 * Set a new event, then check for race with update of tx_cons.
                 * Note that it is essential to schedule a callback, no matter
@@ -506,7 +506,7 @@
                mb();
        } while (prod != np->tx.sring->rsp_prod);
 
- out: 
+ out:
        if (np->tx_full &&
            ((np->tx.sring->req_prod - prod) < NET_TX_RING_SIZE)) {
                np->tx_full = 0;
@@ -582,7 +582,7 @@
                id = GET_ID_FROM_FREELIST(np->rx_skbs);
 
                np->rx_skbs[id] = skb;
-        
+
                RING_GET_REQUEST(&np->rx, req_prod + i)->id = id;
                ref = gnttab_claim_grant_reference(&np->gref_rx_head);
                BUG_ON((signed short)ref < 0);
@@ -628,11 +628,10 @@
                /* Check return status of HYPERVISOR_memory_op(). */
                if (unlikely(rx_mcl[i].result != i))
                        panic("Unable to reduce memory reservation\n");
-       } else {
+       } else
                if (HYPERVISOR_memory_op(XENMEM_decrease_reservation,
                                         &reservation) != i)
                        panic("Unable to reduce memory reservation\n");
-       }
 
        /* Above is a suitable barrier to ensure backend will see requests. */
        np->rx.req_prod_pvt = req_prod + i;
@@ -668,7 +667,7 @@
                dev_kfree_skb(skb);
                skb = nskb;
        }
-    
+
        spin_lock_irq(&np->tx_lock);
 
        if (np->backend_state != BEST_CONNECTED) {
@@ -765,7 +764,7 @@
        rp = np->rx.sring->rsp_prod;
        rmb(); /* Ensure we see queued responses up to 'rp'. */
 
-       for (i = np->rx.rsp_cons, work_done = 0; 
+       for (i = np->rx.rsp_cons, work_done = 0;
             (i != rp) && (work_done < budget);
             i++, work_done++) {
                rx = RING_GET_RESPONSE(&np->rx, i);
@@ -807,7 +806,7 @@
                skb->len  = rx->status;
                skb->tail = skb->data + skb->len;
 
-               if ( rx->flags & NETRXF_csum_valid )
+               if (rx->flags & NETRXF_csum_valid)
                        skb->ip_summed = CHECKSUM_UNNECESSARY;
 
                np->stats.rx_packets++;
@@ -862,7 +861,7 @@
                 * Enough room in skbuff for the data we were passed? Also,
                 * Linux expects at least 16 bytes headroom in each rx buffer.
                 */
-               if (unlikely(skb->tail > skb->end) || 
+               if (unlikely(skb->tail > skb->end) ||
                    unlikely((skb->data - skb->head) < 16)) {
                        if (net_ratelimit()) {
                                if (skb->tail > skb->end)
@@ -894,7 +893,7 @@
                        if ((skb = nskb) == NULL)
                                continue;
                }
-        
+
                /* Set the shinfo area, which is hidden behind the data. */
                init_skb_shinfo(skb);
                /* Ethernet work: Delayed to here as it peeks the header. */
@@ -995,9 +994,9 @@
 
                tx->id = i;
                gnttab_grant_foreign_access_ref(
-                       np->grant_tx_ref[i], np->xbdev->otherend_id, 
+                       np->grant_tx_ref[i], np->xbdev->otherend_id,
                        virt_to_mfn(np->tx_skbs[i]->data),
-                       GNTMAP_readonly); 
+                       GNTMAP_readonly);
                tx->gref = np->grant_tx_ref[i];
                tx->offset = (unsigned long)skb->data & ~PAGE_MASK;
                tx->size = skb->len;
@@ -1012,7 +1011,7 @@
        RING_PUSH_REQUESTS(&np->tx);
 
        /* Rebuild the RX buffer freelist and the RX ring itself. */
-       for (requeue_idx = 0, i = 1; i <= NET_RX_RING_SIZE; i++) { 
+       for (requeue_idx = 0, i = 1; i <= NET_RX_RING_SIZE; i++) {
                if ((unsigned long)np->rx_skbs[i] < __PAGE_OFFSET)
                        continue;
                gnttab_grant_foreign_transfer_ref(
@@ -1021,7 +1020,7 @@
                RING_GET_REQUEST(&np->rx, requeue_idx)->gref =
                        np->grant_rx_ref[i];
                RING_GET_REQUEST(&np->rx, requeue_idx)->id = i;
-               requeue_idx++; 
+               requeue_idx++;
        }
 
        np->rx.req_prod_pvt = requeue_idx;
@@ -1055,9 +1054,8 @@
                        np->evtchn,
                        np->tx,
                        np->rx);
-       } else {
+       } else
                IPRINTK("<vif NULL>\n");
-       }
 #endif
 }
 
@@ -1150,7 +1148,7 @@
        SET_ETHTOOL_OPS(netdev, &network_ethtool_ops);
        SET_MODULE_OWNER(netdev);
        SET_NETDEV_DEV(netdev, &dev->dev);
-    
+
        if ((err = register_netdev(netdev)) != 0) {
                printk(KERN_WARNING "%s> register_netdev err=%d\n",
                       __FUNCTION__, err);
@@ -1181,16 +1179,16 @@
  * We use this notifier to send out a fake ARP reply to reset switches and
  * router ARP caches when an IP interface is brought up on a VIF.
  */
-static int 
+static int
 inetdev_notify(struct notifier_block *this, unsigned long event, void *ptr)
 {
-       struct in_ifaddr  *ifa = (struct in_ifaddr *)ptr; 
+       struct in_ifaddr  *ifa = (struct in_ifaddr *)ptr;
        struct net_device *dev = ifa->ifa_dev->dev;
 
        /* UP event and is it one of our devices? */
        if (event == NETDEV_UP && dev->open == network_open)
                (void)send_fake_arp(dev);
-        
+
        return NOTIFY_DONE;
 }
 
@@ -1336,8 +1334,8 @@
 module_exit(netif_exit);
 
 MODULE_LICENSE("Dual BSD/GPL");
- 
- 
+
+
 /* ** /proc **/
 
 
@@ -1354,9 +1352,8 @@
                (struct net_device *)((unsigned long)data & ~3UL);
        struct netfront_info *np = netdev_priv(dev);
        int len = 0, which_target = (long)data & 3;
-    
-       switch (which_target)
-       {
+
+       switch (which_target) {
        case TARGET_MIN:
                len = sprintf(page, "%d\n", np->rx_min_target);
                break;
@@ -1403,8 +1400,7 @@
 
        spin_lock(&np->rx_lock);
 
-       switch (which_target)
-       {
+       switch (which_target) {
        case TARGET_MIN:
                if (target > np->rx_max_target)
                        np->rx_max_target = target;
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/drivers/xen/pciback/Makefile
--- a/linux-2.6-xen-sparse/drivers/xen/pciback/Makefile Tue Mar 14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/drivers/xen/pciback/Makefile Tue Mar 14 20:50:35 2006
@@ -1,9 +1,9 @@
-obj-y += pciback.o
+obj-$(CONFIG_XEN_PCIDEV_BACKEND) += pciback.o
 
 pciback-y := pci_stub.o pciback_ops.o xenbus.o
 pciback-y += conf_space.o conf_space_header.o
-pciback-${CONFIG_XEN_PCIDEV_BACKEND_VPCI} += vpci.o
-pciback-${CONFIG_XEN_PCIDEV_BACKEND_PASS} += passthrough.o
+pciback-$(CONFIG_XEN_PCIDEV_BACKEND_VPCI) += vpci.o
+pciback-$(CONFIG_XEN_PCIDEV_BACKEND_PASS) += passthrough.o
 
 ifeq ($(CONFIG_XEN_PCIDEV_BE_DEBUG),y)
 EXTRA_CFLAGS += -DDEBUG
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/drivers/xen/pciback/conf_space.c
--- a/linux-2.6-xen-sparse/drivers/xen/pciback/conf_space.c     Tue Mar 14 
20:10:21 2006
+++ b/linux-2.6-xen-sparse/drivers/xen/pciback/conf_space.c     Tue Mar 14 
20:50:35 2006
@@ -13,6 +13,9 @@
 #include <linux/pci.h>
 #include "pciback.h"
 #include "conf_space.h"
+
+static int permissive = 0;
+module_param(permissive, bool, 0644);
 
 #define DEFINE_PCI_CONFIG(op,size,type)                                        
\
 int pciback_##op##_config_##size                                               
        \
@@ -198,7 +201,7 @@
 
 int pciback_config_write(struct pci_dev *dev, int offset, int size, u32 value)
 {
-       int err = 0;
+       int err = 0, handled = 0;
        struct pciback_dev_data *dev_data = pci_get_drvdata(dev);
        struct config_field_entry *cfg_entry;
        struct config_field *field;
@@ -233,6 +236,21 @@
                                              field_start - req_start);
 
                        err = conf_space_write(dev, cfg_entry, offset, tmp_val);
+                       handled = 1;
+               }
+       }
+
+       if (!handled && !err && permissive) {
+               switch (size) {
+               case 1:
+                       err = pci_write_config_byte(dev, offset, (u8)value);
+                       break;
+               case 2:
+                       err = pci_write_config_word(dev, offset, (u16)value);
+                       break;
+               case 4:
+                       err = pci_write_config_dword(dev, offset, (u32)value);
+                       break;
                }
        }
 
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/drivers/xen/pciback/conf_space_header.c
--- a/linux-2.6-xen-sparse/drivers/xen/pciback/conf_space_header.c      Tue Mar 
14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/drivers/xen/pciback/conf_space_header.c      Tue Mar 
14 20:50:35 2006
@@ -24,21 +24,19 @@
                if (unlikely(verbose_request))
                        printk(KERN_DEBUG "pciback: %s: enable\n",
                               pci_name(dev));
-               dev->is_enabled = 1;
-               pcibios_enable_device(dev, (1 << PCI_NUM_RESOURCES) - 1);
+               pci_enable_device(dev);
        } else if (dev->is_enabled && !is_enable_cmd(value)) {
                if (unlikely(verbose_request))
                        printk(KERN_DEBUG "pciback: %s: disable\n",
                               pci_name(dev));
-               pciback_disable_device(dev);
+               pci_disable_device(dev);
        }
 
        if (!dev->is_busmaster && is_master_cmd(value)) {
                if (unlikely(verbose_request))
                        printk(KERN_DEBUG "pciback: %s: set bus master\n",
                               pci_name(dev));
-               dev->is_busmaster = 1;
-               pcibios_set_master(dev);
+               pci_set_master(dev);
        }
 
        if (value & PCI_COMMAND_INVALIDATE) {
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/drivers/xen/pciback/pci_stub.c
--- a/linux-2.6-xen-sparse/drivers/xen/pciback/pci_stub.c       Tue Mar 14 
20:10:21 2006
+++ b/linux-2.6-xen-sparse/drivers/xen/pciback/pci_stub.c       Tue Mar 14 
20:50:35 2006
@@ -207,8 +207,6 @@
 
        return 0;
 }
-
-device_initcall(pcistub_init_devices_late);
 
 static int __devinit pcistub_seize(struct pci_dev *dev)
 {
@@ -367,6 +365,7 @@
        return -EINVAL;
 }
 
+#ifndef MODULE
 /*
  * fs_initcall happens before device_initcall
  * so pciback *should* get called first (b/c we 
@@ -375,3 +374,34 @@
  * driver to register)
  */
 fs_initcall(pcistub_init);
+#endif
+
+static int __init pciback_init(void)
+{
+#ifdef MODULE
+       int err;
+
+       err = pcistub_init();
+       if (err < 0)
+               return err;
+#endif
+
+       if (list_empty(&pci_stub_device_ids))
+               return -ENODEV;
+       pcistub_init_devices_late();
+       pciback_xenbus_register();
+
+       __unsafe(THIS_MODULE);
+
+       return 0;
+}
+
+static void pciback_cleanup(void)
+{
+       BUG();
+}
+
+module_init(pciback_init);
+module_exit(pciback_cleanup);
+
+MODULE_LICENSE("Dual BSD/GPL");
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/drivers/xen/pciback/pciback.h
--- a/linux-2.6-xen-sparse/drivers/xen/pciback/pciback.h        Tue Mar 14 
20:10:21 2006
+++ b/linux-2.6-xen-sparse/drivers/xen/pciback/pciback.h        Tue Mar 14 
20:50:35 2006
@@ -43,7 +43,6 @@
 void pcistub_put_pci_dev(struct pci_dev *dev);
 
 /* Ensure a device is turned off or reset */
-void pciback_disable_device(struct pci_dev *dev);
 void pciback_reset_device(struct pci_dev *pdev);
 
 /* Access a virtual configuration space for a PCI device */
@@ -69,5 +68,7 @@
 /* Handles events from front-end */
 irqreturn_t pciback_handle_event(int irq, void *dev_id, struct pt_regs *regs);
 
+int pciback_xenbus_register(void);
+
 extern int verbose_request;
 #endif
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/drivers/xen/pciback/pciback_ops.c
--- a/linux-2.6-xen-sparse/drivers/xen/pciback/pciback_ops.c    Tue Mar 14 
20:10:21 2006
+++ b/linux-2.6-xen-sparse/drivers/xen/pciback/pciback_ops.c    Tue Mar 14 
20:50:35 2006
@@ -5,21 +5,11 @@
  */
 #include <linux/module.h>
 #include <asm/bitops.h>
+#include <xen/evtchn.h>
 #include "pciback.h"
 
 int verbose_request = 0;
 module_param(verbose_request, int, 0644);
-
-/* For those architectures without a pcibios_disable_device */
-void __attribute__ ((weak)) pcibios_disable_device(struct pci_dev *dev) { }
-
-void pciback_disable_device(struct pci_dev *dev)
-{
-       if (dev->is_enabled) {
-               dev->is_enabled = 0;
-               pcibios_disable_device(dev);
-       }
-}
 
 /* Ensure a device is "turned off" and ready to be exported.
  * This also sets up the device's private data to keep track of what should
@@ -32,7 +22,7 @@
 
        /* Disable devices (but not bridges) */
        if (dev->hdr_type == PCI_HEADER_TYPE_NORMAL) {
-               pciback_disable_device(dev);
+               pci_disable_device(dev);
 
                pci_write_config_word(dev, PCI_COMMAND, 0);
 
@@ -78,6 +68,7 @@
 
        wmb();
        clear_bit(_XEN_PCIF_active, (unsigned long *)&pdev->sh_info->flags);
+       notify_remote_via_irq(pdev->evtchn_irq);
 
       out:
        return IRQ_HANDLED;
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/drivers/xen/pciback/xenbus.c
--- a/linux-2.6-xen-sparse/drivers/xen/pciback/xenbus.c Tue Mar 14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/drivers/xen/pciback/xenbus.c Tue Mar 14 20:50:35 2006
@@ -430,10 +430,7 @@
        .otherend_changed       = pciback_frontend_changed,
 };
 
-static __init int pciback_xenbus_register(void)
+int __init pciback_xenbus_register(void)
 {
        return xenbus_register_backend(&xenbus_pciback_driver);
 }
-
-/* Must only initialize our xenbus driver after the pcistub driver */
-device_initcall(pciback_xenbus_register);
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/drivers/xen/pcifront/pci.c
--- a/linux-2.6-xen-sparse/drivers/xen/pcifront/pci.c   Tue Mar 14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/drivers/xen/pcifront/pci.c   Tue Mar 14 20:50:35 2006
@@ -18,8 +18,10 @@
 
        spin_lock(&pcifront_dev_lock);
 
-       if (!pcifront_dev)
+       if (!pcifront_dev) {
                dev_info(&pdev->xdev->dev, "Installing PCI frontend\n");
+               pcifront_dev = pdev;
+       }
        else {
                dev_err(&pdev->xdev->dev, "PCI frontend already installed!\n");
                err = -EEXIST;
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/drivers/xen/pcifront/pci_op.c
--- a/linux-2.6-xen-sparse/drivers/xen/pcifront/pci_op.c        Tue Mar 14 
20:10:21 2006
+++ b/linux-2.6-xen-sparse/drivers/xen/pcifront/pci_op.c        Tue Mar 14 
20:50:35 2006
@@ -40,9 +40,8 @@
 {
        int err = 0;
        struct xen_pci_op *active_op = &pdev->sh_info->op;
-       unsigned long irq_flags;
-
-       unsigned int volatile ttl = (1U << 29);
+       unsigned long irq_flags, poll_end;
+       evtchn_port_t port = pdev->evtchn;
 
        spin_lock_irqsave(&pdev->sh_info_lock, irq_flags);
 
@@ -51,14 +50,17 @@
        /* Go */
        wmb();
        set_bit(_XEN_PCIF_active, (unsigned long *)&pdev->sh_info->flags);
-       notify_remote_via_evtchn(pdev->evtchn);
-
-       /* IRQs are disabled for the pci config. space reads/writes,
-        * which means no event channel to notify us that the backend
-        * is done so spin while waiting for the answer */
-       while (test_bit
-              (_XEN_PCIF_active, (unsigned long *)&pdev->sh_info->flags)) {
-               if (!ttl) {
+       notify_remote_via_evtchn(port);
+
+       poll_end = jiffies + 5*HZ;
+       clear_evtchn(port);
+
+       while (test_bit(_XEN_PCIF_active,
+                       (unsigned long *)&pdev->sh_info->flags)) {
+               if (HYPERVISOR_poll(&port, 1, poll_end))
+                       BUG();
+               clear_evtchn(port);
+               if (time_after(jiffies, poll_end)) {
                        dev_err(&pdev->xdev->dev,
                                "pciback not responding!!!\n");
                        clear_bit(_XEN_PCIF_active,
@@ -66,7 +68,6 @@
                        err = XEN_PCI_ERR_dev_not_found;
                        goto out;
                }
-               ttl--;
        }
 
        memcpy(op, active_op, sizeof(struct xen_pci_op));
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/drivers/xen/tpmfront/tpmfront.c
--- a/linux-2.6-xen-sparse/drivers/xen/tpmfront/tpmfront.c      Tue Mar 14 
20:10:21 2006
+++ b/linux-2.6-xen-sparse/drivers/xen/tpmfront/tpmfront.c      Tue Mar 14 
20:50:35 2006
@@ -310,7 +310,8 @@
                goto abort_transaction;
        }
 
-       err = xenbus_switch_state(dev, xbt, XenbusStateInitialised);
+       err = xenbus_printf(xbt, dev->nodename,
+                           "state", "%d", XenbusStateInitialised);
        if (err) {
                goto abort_transaction;
        }
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/drivers/xen/xenbus/Makefile
--- a/linux-2.6-xen-sparse/drivers/xen/xenbus/Makefile  Tue Mar 14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/drivers/xen/xenbus/Makefile  Tue Mar 14 20:50:35 2006
@@ -1,8 +1,8 @@
 obj-y  += xenbus.o
 
 xenbus-objs =
-xenbus-objs += xenbus_client.o 
+xenbus-objs += xenbus_client.o
 xenbus-objs += xenbus_comms.o
 xenbus-objs += xenbus_xs.o
-xenbus-objs += xenbus_probe.o 
-xenbus-objs += xenbus_dev.o 
+xenbus-objs += xenbus_probe.o
+xenbus-objs += xenbus_dev.o
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_client.c
--- a/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_client.c   Tue Mar 14 
20:10:21 2006
+++ b/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_client.c   Tue Mar 14 
20:50:35 2006
@@ -39,7 +39,7 @@
     pr_debug("xenbus_client (%s:%d) " fmt ".\n", __FUNCTION__, __LINE__, 
##args)
 
 int xenbus_watch_path(struct xenbus_device *dev, const char *path,
-                     struct xenbus_watch *watch, 
+                     struct xenbus_watch *watch,
                      void (*callback)(struct xenbus_watch *,
                                       const char **, unsigned int))
 {
@@ -62,7 +62,7 @@
 
 
 int xenbus_watch_path2(struct xenbus_device *dev, const char *path,
-                      const char *path2, struct xenbus_watch *watch, 
+                      const char *path2, struct xenbus_watch *watch,
                       void (*callback)(struct xenbus_watch *,
                                        const char **, unsigned int))
 {
@@ -74,9 +74,8 @@
        }
        err = xenbus_watch_path(dev, state, watch, callback);
 
-       if (err) {
+       if (err)
                kfree(state);
-       }
        return err;
 }
 EXPORT_SYMBOL(xenbus_watch_path2);
@@ -190,7 +189,7 @@
        va_start(ap, fmt);
        _dev_error(dev, err, fmt, ap);
        va_end(ap);
-       
+
        xenbus_switch_state(dev, XBT_NULL, XenbusStateClosing);
 }
 EXPORT_SYMBOL(xenbus_dev_fatal);
@@ -213,7 +212,6 @@
                .u.alloc_unbound.dom = DOMID_SELF,
                .u.alloc_unbound.remote_dom = dev->otherend_id
        };
-
        int err = HYPERVISOR_event_channel_op(&op);
        if (err)
                xenbus_dev_fatal(dev, err, "allocating event channel");
@@ -231,7 +229,6 @@
                .u.bind_interdomain.remote_dom = dev->otherend_id,
                .u.bind_interdomain.remote_port = remote_port,
        };
-
        int err = HYPERVISOR_event_channel_op(&op);
        if (err)
                xenbus_dev_fatal(dev, err,
@@ -388,7 +385,6 @@
 XenbusState xenbus_read_driver_state(const char *path)
 {
        XenbusState result;
-
        int err = xenbus_gather(XBT_NULL, path, "state", "%d", &result, NULL);
        if (err)
                result = XenbusStateClosed;
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_comms.c
--- a/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_comms.c    Tue Mar 14 
20:10:21 2006
+++ b/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_comms.c    Tue Mar 14 
20:50:35 2006
@@ -38,8 +38,8 @@
 
 static int xenbus_irq;
 
-extern void xenbus_probe(void *); 
-extern int xenstored_ready; 
+extern void xenbus_probe(void *);
+extern int xenstored_ready;
 static DECLARE_WORK(probe_work, xenbus_probe, NULL);
 
 DECLARE_WAIT_QUEUE_HEAD(xb_waitq);
@@ -52,9 +52,9 @@
 static irqreturn_t wake_waiting(int irq, void *unused, struct pt_regs *regs)
 {
        if (unlikely(xenstored_ready == 0)) {
-               xenstored_ready = 1; 
-               schedule_work(&probe_work); 
-       } 
+               xenstored_ready = 1;
+               schedule_work(&probe_work);
+       }
 
        wake_up(&xb_waitq);
        return IRQ_HANDLED;
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_probe.c
--- a/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_probe.c    Tue Mar 14 
20:10:21 2006
+++ b/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_probe.c    Tue Mar 14 
20:50:35 2006
@@ -366,7 +366,6 @@
        xenbus_dev_error(dev, err, "xenbus_dev_probe on %s", dev->nodename);
        xenbus_switch_state(dev, XBT_NULL, XenbusStateClosed);
        return -ENODEV;
-       
 }
 
 static int xenbus_dev_remove(struct device *_dev)
@@ -495,9 +494,8 @@
 
 static void xenbus_dev_release(struct device *dev)
 {
-       if (dev) {
+       if (dev)
                xenbus_dev_free(to_xenbus_device(dev));
-       }
 }
 
 /* Simplified asprintf. */
@@ -600,7 +598,7 @@
        nodename = kasprintf("%s/%s/%s", xenbus_frontend.root, type, name);
        if (!nodename)
                return -ENOMEM;
-       
+
        DPRINTK("%s", nodename);
 
        err = xenbus_probe_node(&xenbus_frontend, type, nodename);
@@ -959,9 +957,8 @@
        if ((size > PAGE_SIZE) || (vma->vm_pgoff != 0))
                return -EINVAL;
 
-       vma->vm_pgoff = mfn_to_pfn(xen_start_info->store_mfn);
-
-       if (remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
+       if (remap_pfn_range(vma, vma->vm_start,
+                           mfn_to_pfn(xen_start_info->store_mfn),
                            size, vma->vm_page_prot))
                return -EAGAIN;
 
@@ -972,6 +969,7 @@
                         int count, int *eof, void *data)
 {
        int len;
+
        len  = sprintf(page, "0x%p", mfn_to_virt(xen_start_info->store_mfn));
        *eof = 1;
        return len;
@@ -1006,8 +1004,8 @@
        device_register(&xenbus_backend.dev);
 
        /*
-       ** Domain0 doesn't have a store_evtchn or store_mfn yet.
-       */
+        * Domain0 doesn't have a store_evtchn or store_mfn yet.
+        */
        dom0 = (xen_start_info->store_evtchn == 0);
 
        if (dom0) {
@@ -1029,7 +1027,7 @@
                xen_start_info->store_mfn =
                        pfn_to_mfn(virt_to_phys((void *)page) >>
                                   PAGE_SHIFT);
-               
+
                /* Next allocate a local port which xenstored can bind to */
                op.cmd = EVTCHNOP_alloc_unbound;
                op.u.alloc_unbound.dom        = DOMID_SELF;
@@ -1040,14 +1038,16 @@
                xen_start_info->store_evtchn = op.u.alloc_unbound.port;
 
                /* And finally publish the above info in /proc/xen */
-               if ((xsd_kva_intf = create_xen_proc_entry("xsd_kva", 0400))) {
+               xsd_kva_intf = create_xen_proc_entry("xsd_kva", 0600);
+               if (xsd_kva_intf) {
                        memcpy(&xsd_kva_fops, xsd_kva_intf->proc_fops,
                               sizeof(xsd_kva_fops));
                        xsd_kva_fops.mmap = xsd_kva_mmap;
                        xsd_kva_intf->proc_fops = &xsd_kva_fops;
                        xsd_kva_intf->read_proc = xsd_kva_read;
                }
-               if ((xsd_port_intf = create_xen_proc_entry("xsd_port", 0400)))
+               xsd_port_intf = create_xen_proc_entry("xsd_port", 0400);
+               if (xsd_port_intf)
                        xsd_port_intf->read_proc = xsd_port_read;
        }
 
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_xs.c
--- a/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_xs.c       Tue Mar 14 
20:10:21 2006
+++ b/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_xs.c       Tue Mar 14 
20:50:35 2006
@@ -176,9 +176,8 @@
        if (err) {
                msg->type = XS_ERROR;
                ret = ERR_PTR(err);
-       } else {
+       } else
                ret = read_reply(&msg->type, &msg->len);
-       }
 
        up(&xs_state.request_mutex);
 
@@ -275,7 +274,7 @@
        return num;
 }
 
-/* Return the path to dir with /name appended. Buffer must be kfree()'ed. */ 
+/* Return the path to dir with /name appended. Buffer must be kfree()'ed. */
 static char *join(const char *dir, const char *name)
 {
        char *buffer;
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/fixmap.h
--- a/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/fixmap.h       Tue Mar 
14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/fixmap.h       Tue Mar 
14 20:50:35 2006
@@ -84,8 +84,6 @@
        FIX_PCIE_MCFG,
 #endif
        FIX_SHARED_INFO,
-       FIX_GNTTAB_BEGIN,
-       FIX_GNTTAB_END = FIX_GNTTAB_BEGIN + NR_GRANT_FRAMES - 1,
 #define NR_FIX_ISAMAPS 256
        FIX_ISAMAP_END,
        FIX_ISAMAP_BEGIN = FIX_ISAMAP_END + NR_FIX_ISAMAPS - 1,
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/hypercall.h
--- a/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/hypercall.h    Tue Mar 
14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/hypercall.h    Tue Mar 
14 20:50:35 2006
@@ -33,6 +33,7 @@
 #include <xen/interface/xen.h>
 #include <xen/interface/sched.h>
 #include <xen/interface/nmi.h>
+#include <linux/errno.h>
 
 #define __STR(x) #x
 #define STR(x) __STR(x)
@@ -167,6 +168,31 @@
        int cmd, unsigned long arg)
 {
        return _hypercall2(int, sched_op, cmd, arg);
+}
+
+static inline int
+HYPERVISOR_sched_op_new(
+       int cmd, void *arg)
+{
+       return _hypercall2(int, sched_op_new, cmd, arg);
+}
+
+static inline int
+HYPERVISOR_poll(
+       evtchn_port_t *ports, unsigned int nr_ports, u64 timeout)
+{
+       struct sched_poll sched_poll = {
+               .ports = ports,
+               .nr_ports = nr_ports,
+               .timeout = jiffies_to_st(timeout)
+       };
+
+       int rc = HYPERVISOR_sched_op_new(SCHEDOP_poll, &sched_poll);
+
+       if (rc == -ENOSYS)
+               rc = HYPERVISOR_sched_op(SCHEDOP_yield, 0);
+
+       return rc;
 }
 
 static inline long
@@ -304,8 +330,7 @@
 
 static inline int
 HYPERVISOR_nmi_op(
-       unsigned long op,
-       unsigned long arg)
+       unsigned long op, void *arg)
 {
        return _hypercall2(int, nmi_op, op, arg);
 }
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/hypervisor.h
--- a/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/hypervisor.h   Tue Mar 
14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/hypervisor.h   Tue Mar 
14 20:50:35 2006
@@ -79,12 +79,6 @@
 void xen_l4_entry_update(pgd_t *ptr, pgd_t val); /* x86_64 only */
 void xen_pgd_pin(unsigned long ptr);
 void xen_pgd_unpin(unsigned long ptr);
-void xen_pud_pin(unsigned long ptr); /* x86_64 only */
-void xen_pud_unpin(unsigned long ptr); /* x86_64 only */
-void xen_pmd_pin(unsigned long ptr); /* x86_64 only */
-void xen_pmd_unpin(unsigned long ptr); /* x86_64 only */
-void xen_pte_pin(unsigned long ptr);
-void xen_pte_unpin(unsigned long ptr);
 
 void xen_set_ldt(unsigned long ptr, unsigned long bytes);
 void xen_machphys_update(unsigned long mfn, unsigned long pfn);
@@ -102,6 +96,9 @@
     unsigned long vstart, unsigned int order, unsigned int address_bits);
 void xen_destroy_contiguous_region(
     unsigned long vstart, unsigned int order);
+
+/* Turn jiffies into Xen system time. */
+u64 jiffies_to_st(unsigned long jiffies);
 
 #include <asm/hypercall.h>
 
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/page.h
--- a/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/page.h Tue Mar 14 
20:10:21 2006
+++ b/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/page.h Tue Mar 14 
20:50:35 2006
@@ -71,7 +71,8 @@
 {
        if (xen_feature(XENFEAT_auto_translated_physmap))
                return pfn;
-       return phys_to_machine_mapping[(unsigned int)(pfn)] & 
~FOREIGN_FRAME_BIT;
+       return phys_to_machine_mapping[(unsigned int)(pfn)] &
+               ~FOREIGN_FRAME_BIT;
 }
 
 static inline int phys_to_machine_mapping_valid(unsigned long pfn)
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/pgtable-3level.h
--- a/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/pgtable-3level.h       
Tue Mar 14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/pgtable-3level.h       
Tue Mar 14 20:50:35 2006
@@ -131,8 +131,8 @@
        return !pte.pte_low && !pte.pte_high;
 }
 
-#define pte_mfn(_pte) ( ((_pte).pte_low >> PAGE_SHIFT) |\
-                       (((_pte).pte_high & 0xfff) << (32-PAGE_SHIFT)) )
+#define pte_mfn(_pte) (((_pte).pte_low >> PAGE_SHIFT) |\
+                      (((_pte).pte_high & 0xfff) << (32-PAGE_SHIFT)))
 #define pte_pfn(_pte) mfn_to_local_pfn(pte_mfn(_pte))
 
 extern unsigned long long __supported_pte_mask;
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/pgtable.h
--- a/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/pgtable.h      Tue Mar 
14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/pgtable.h      Tue Mar 
14 20:50:35 2006
@@ -272,7 +272,16 @@
        pte_t pte;
        if (full) {
                pte = *ptep;
+#ifdef CONFIG_X86_PAE
+               /* Cannot do this in a single step, as the compiler may
+                  issue the two stores in either order, but the hypervisor
+                  must not see the high part before the low one. */
+               ptep->pte_low = 0;
+               barrier();
+               ptep->pte_high = 0;
+#else
                *ptep = __pte(0);
+#endif
        } else {
                pte = ptep_get_and_clear(mm, addr, ptep);
        }
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/system.h
--- a/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/system.h       Tue Mar 
14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/system.h       Tue Mar 
14 20:50:35 2006
@@ -596,7 +596,7 @@
        _vcpu = &HYPERVISOR_shared_info->vcpu_info[__vcpu_id];          \
        _vcpu->evtchn_upcall_mask = 0;                                  \
        barrier(); /* unmask then check (avoid races) */                \
-       if ( unlikely(_vcpu->evtchn_upcall_pending) )                   \
+       if (unlikely(_vcpu->evtchn_upcall_pending))                     \
                force_evtchn_callback();                                \
        preempt_enable();                                               \
 } while (0)
@@ -618,7 +618,7 @@
        _vcpu = &HYPERVISOR_shared_info->vcpu_info[__vcpu_id];          \
        if ((_vcpu->evtchn_upcall_mask = (x)) == 0) {                   \
                barrier(); /* unmask then check (avoid races) */        \
-               if ( unlikely(_vcpu->evtchn_upcall_pending) )           \
+               if (unlikely(_vcpu->evtchn_upcall_pending))             \
                        force_evtchn_callback();                        \
                preempt_enable();                                       \
        } else                                                          \
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/include/asm-i386/mach-xen/setup_arch_post.h
--- a/linux-2.6-xen-sparse/include/asm-i386/mach-xen/setup_arch_post.h  Tue Mar 
14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/include/asm-i386/mach-xen/setup_arch_post.h  Tue Mar 
14 20:50:35 2006
@@ -35,12 +35,21 @@
 static void __init machine_specific_arch_setup(void)
 {
        struct xen_platform_parameters pp;
+       struct xennmi_callback cb;
+
+       if (xen_feature(XENFEAT_auto_translated_physmap) &&
+           xen_start_info->shared_info < xen_start_info->nr_pages) {
+               HYPERVISOR_shared_info =
+                       (shared_info_t *)__va(xen_start_info->shared_info);
+               memset(empty_zero_page, 0, sizeof(empty_zero_page));
+       }
 
        HYPERVISOR_set_callbacks(
            __KERNEL_CS, (unsigned long)hypervisor_callback,
            __KERNEL_CS, (unsigned long)failsafe_callback);
 
-       HYPERVISOR_nmi_op(XENNMI_register_callback, (unsigned long)&nmi);
+       cb.handler_address = (unsigned long)&nmi;
+       HYPERVISOR_nmi_op(XENNMI_register_callback, &cb);
 
        machine_specific_modify_cpu_capabilities(&boot_cpu_data);
 
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/include/asm-ia64/hypercall.h
--- a/linux-2.6-xen-sparse/include/asm-ia64/hypercall.h Tue Mar 14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/include/asm-ia64/hypercall.h Tue Mar 14 20:50:35 2006
@@ -33,6 +33,7 @@
 #include <xen/interface/xen.h>
 #include <xen/interface/sched.h>
 #include <xen/interface/dom0_ops.h>
+#include <linux/errno.h>
 
 /* FIXME: temp place to hold these page related macros */
 #include <asm/page.h>
@@ -166,6 +167,31 @@
        return _hypercall2(int, sched_op, cmd, arg);
 }
 
+static inline int
+HYPERVISOR_sched_op_new(
+       int cmd, void *arg)
+{
+       return _hypercall2(int, sched_op_new, cmd, arg);
+}
+
+static inline int
+HYPERVISOR_poll(
+       evtchn_port_t *ports, unsigned int nr_ports, unsigned long timeout)
+{
+       struct sched_poll sched_poll = {
+               .ports = ports,
+               .nr_ports = nr_ports,
+               .timeout = jiffies_to_st(timeout)
+       };
+
+       int rc = HYPERVISOR_sched_op_new(SCHEDOP_poll, &sched_poll);
+
+       if (rc == -ENOSYS)
+               rc = HYPERVISOR_sched_op(SCHEDOP_yield, 0);
+
+       return rc;
+}
+
 static inline long
 HYPERVISOR_set_timer_op(
     u64 timeout)
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/include/asm-ia64/hypervisor.h
--- a/linux-2.6-xen-sparse/include/asm-ia64/hypervisor.h        Tue Mar 14 
20:10:21 2006
+++ b/linux-2.6-xen-sparse/include/asm-ia64/hypervisor.h        Tue Mar 14 
20:50:35 2006
@@ -44,6 +44,9 @@
 
 void force_evtchn_callback(void);
 
+/* Turn jiffies into Xen system time. XXX Implement me. */
+#define jiffies_to_st(j)       0
+
 #include <asm/hypercall.h>
 
 // for drivers/xen/privcmd/privcmd.c
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/asm/fixmap.h
--- a/linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/asm/fixmap.h     Tue Mar 
14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/asm/fixmap.h     Tue Mar 
14 20:50:35 2006
@@ -52,8 +52,6 @@
        FIX_ACPI_END = FIX_ACPI_BEGIN + FIX_ACPI_PAGES - 1,
 #endif
        FIX_SHARED_INFO,
-       FIX_GNTTAB_BEGIN,
-       FIX_GNTTAB_END = FIX_GNTTAB_BEGIN + NR_GRANT_FRAMES - 1,
 #define NR_FIX_ISAMAPS 256
        FIX_ISAMAP_END,
        FIX_ISAMAP_BEGIN = FIX_ISAMAP_END + NR_FIX_ISAMAPS - 1,
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/asm/hypercall.h
--- a/linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/asm/hypercall.h  Tue Mar 
14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/asm/hypercall.h  Tue Mar 
14 20:50:35 2006
@@ -36,6 +36,8 @@
 
 #include <xen/interface/xen.h>
 #include <xen/interface/sched.h>
+#include <xen/interface/nmi.h>
+#include <linux/errno.h>
 
 #define __STR(x) #x
 #define STR(x) __STR(x)
@@ -173,6 +175,31 @@
        return _hypercall2(int, sched_op, cmd, arg);
 }
 
+static inline int
+HYPERVISOR_sched_op_new(
+       int cmd, void *arg)
+{
+       return _hypercall2(int, sched_op_new, cmd, arg);
+}
+
+static inline int
+HYPERVISOR_poll(
+       evtchn_port_t *ports, unsigned int nr_ports, u64 timeout)
+{
+       struct sched_poll sched_poll = {
+               .ports = ports,
+               .nr_ports = nr_ports,
+               .timeout = jiffies_to_st(timeout)
+       };
+
+       int rc = HYPERVISOR_sched_op_new(SCHEDOP_poll, &sched_poll);
+
+       if (rc == -ENOSYS)
+               rc = HYPERVISOR_sched_op(SCHEDOP_yield, 0);
+
+       return rc;
+}
+
 static inline long
 HYPERVISOR_set_timer_op(
        u64 timeout)
@@ -304,8 +331,7 @@
 
 static inline int
 HYPERVISOR_nmi_op(
-       unsigned long op,
-       unsigned long arg)
+       unsigned long op, void *arg)
 {
        return _hypercall2(int, nmi_op, op, arg);
 }
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/asm/page.h
--- a/linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/asm/page.h       Tue Mar 
14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/asm/page.h       Tue Mar 
14 20:50:35 2006
@@ -89,7 +89,8 @@
 {
        if (xen_feature(XENFEAT_auto_translated_physmap))
                return pfn;
-       return phys_to_machine_mapping[(unsigned int)(pfn)] & 
~FOREIGN_FRAME_BIT;
+       return phys_to_machine_mapping[(unsigned int)(pfn)] &
+               ~FOREIGN_FRAME_BIT;
 }
 
 static inline int phys_to_machine_mapping_valid(unsigned long pfn)
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/asm/pgalloc.h
--- a/linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/asm/pgalloc.h    Tue Mar 
14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/asm/pgalloc.h    Tue Mar 
14 20:50:35 2006
@@ -181,7 +181,6 @@
 static inline void pte_free_kernel(pte_t *pte)
 {
        BUG_ON((unsigned long)pte & (PAGE_SIZE-1));
-        xen_pte_unpin(__pa(pte));
         make_page_writable(pte, XENFEAT_writable_page_tables);
        free_page((unsigned long)pte); 
 }
diff -r dc50cdd66c5c -r 0ed4a312765b 
linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/setup_arch_post.h
--- a/linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/setup_arch_post.h        
Tue Mar 14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/setup_arch_post.h        
Tue Mar 14 20:50:35 2006
@@ -23,13 +23,18 @@
 
 static void __init machine_specific_arch_setup(void)
 {
+#ifdef CONFIG_X86_LOCAL_APIC
+       struct xennmi_callback cb;
+#endif
+
        HYPERVISOR_set_callbacks(
                 (unsigned long) hypervisor_callback,
                 (unsigned long) failsafe_callback,
                 (unsigned long) system_call);
 
 #ifdef CONFIG_X86_LOCAL_APIC
-       HYPERVISOR_nmi_op(XENNMI_register_callback, (unsigned long)&nmi);
+       cb.handler_address = (unsigned long)&nmi;
+       HYPERVISOR_nmi_op(XENNMI_register_callback, &cb);
 #endif
 
        machine_specific_modify_cpu_capabilities(&boot_cpu_data);
diff -r dc50cdd66c5c -r 0ed4a312765b linux-2.6-xen-sparse/include/linux/mm.h
--- a/linux-2.6-xen-sparse/include/linux/mm.h   Tue Mar 14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/include/linux/mm.h   Tue Mar 14 20:50:35 2006
@@ -1020,9 +1020,9 @@
 #define FOLL_ANON      0x08    /* give ZERO_PAGE if no pgtable */
 
 #ifdef CONFIG_XEN
-typedef int (*pte_fn_t)(pte_t *pte, struct page *pte_page, unsigned long addr, 
+typedef int (*pte_fn_t)(pte_t *pte, struct page *pte_page, unsigned long addr,
                         void *data);
-extern int generic_page_range(struct mm_struct *mm, unsigned long address, 
+extern int generic_page_range(struct mm_struct *mm, unsigned long address,
                               unsigned long size, pte_fn_t fn, void *data);
 #endif
 
diff -r dc50cdd66c5c -r 0ed4a312765b linux-2.6-xen-sparse/include/xen/xenbus.h
--- a/linux-2.6-xen-sparse/include/xen/xenbus.h Tue Mar 14 20:10:21 2006
+++ b/linux-2.6-xen-sparse/include/xen/xenbus.h Tue Mar 14 20:50:35 2006
@@ -28,8 +28,8 @@
  * IN THE SOFTWARE.
  */
 
-#ifndef _ASM_XEN_XENBUS_H
-#define _ASM_XEN_XENBUS_H
+#ifndef _XEN_XENBUS_H
+#define _XEN_XENBUS_H
 
 #include <linux/device.h>
 #include <linux/notifier.h>
@@ -170,7 +170,7 @@
  * be saved in the store.
  */
 int xenbus_watch_path(struct xenbus_device *dev, const char *path,
-                     struct xenbus_watch *watch, 
+                     struct xenbus_watch *watch,
                      void (*callback)(struct xenbus_watch *,
                                       const char **, unsigned int));
 
@@ -185,7 +185,7 @@
  * saved in the store.
  */
 int xenbus_watch_path2(struct xenbus_device *dev, const char *path,
-                      const char *path2, struct xenbus_watch *watch, 
+                      const char *path2, struct xenbus_watch *watch,
                       void (*callback)(struct xenbus_watch *,
                                        const char **, unsigned int));
 
@@ -216,8 +216,8 @@
  * page to that address, and sets *vaddr to that address.
  * xenbus_map_ring does not allocate the virtual address space (you must do
  * this yourself!). It only maps in the page to the specified address.
- * Returns 0 on success, and GNTST_* (see xen/include/public/grant_table.h) or
- * -ENOMEM on error. If an error is returned, device will switch to
+ * Returns 0 on success, and GNTST_* (see xen/include/interface/grant_table.h)
+ * or -ENOMEM on error. If an error is returned, device will switch to
  * XenbusStateClosing and the error message will be saved in XenStore.
  */
 int xenbus_map_ring_valloc(struct xenbus_device *dev,
@@ -231,7 +231,7 @@
  * Use xenbus_unmap_ring_vfree if you mapped in your memory with
  * xenbus_map_ring_valloc (it will free the virtual address space).
  * Returns 0 on success and returns GNTST_* on error
- * (see xen/include/public/grant_table.h).
+ * (see xen/include/interface/grant_table.h).
  */
 int xenbus_unmap_ring_vfree(struct xenbus_device *dev, void *vaddr);
 int xenbus_unmap_ring(struct xenbus_device *dev,
@@ -285,7 +285,7 @@
                      ...);
 
 
-#endif /* _ASM_XEN_XENBUS_H */
+#endif /* _XEN_XENBUS_H */
 
 /*
  * Local variables:
diff -r dc50cdd66c5c -r 0ed4a312765b tools/Rules.mk
--- a/tools/Rules.mk    Tue Mar 14 20:10:21 2006
+++ b/tools/Rules.mk    Tue Mar 14 20:50:35 2006
@@ -9,16 +9,6 @@
 XEN_LIBXC          = $(XEN_ROOT)/tools/libxc
 XEN_XENSTORE       = $(XEN_ROOT)/tools/xenstore
 XEN_LIBXENSTAT     = $(XEN_ROOT)/tools/xenstat/libxenstat/src
-
-ifeq ($(XEN_TARGET_ARCH),x86_32)
-CFLAGS  += -m32 -march=i686
-LDFLAGS += -m32
-endif
-
-ifeq ($(XEN_TARGET_ARCH),x86_64)
-CFLAGS  += -m64
-LDFLAGS += -m64
-endif
 
 X11_LDPATH = -L/usr/X11R6/$(LIBDIR)
 
diff -r dc50cdd66c5c -r 0ed4a312765b tools/blktap/Makefile
--- a/tools/blktap/Makefile     Tue Mar 14 20:10:21 2006
+++ b/tools/blktap/Makefile     Tue Mar 14 20:50:35 2006
@@ -22,11 +22,8 @@
 SRCS     :=
 SRCS     += blktaplib.c xenbus.c blkif.c
 
-CFLAGS   += -Wall
 CFLAGS   += -Werror
 CFLAGS   += -Wno-unused
-#CFLAGS   += -O3
-CFLAGS   += -g3
 CFLAGS   += -fno-strict-aliasing
 CFLAGS   += -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE
 # get asprintf():
diff -r dc50cdd66c5c -r 0ed4a312765b tools/blktap/parallax/Makefile
--- a/tools/blktap/parallax/Makefile    Tue Mar 14 20:10:21 2006
+++ b/tools/blktap/parallax/Makefile    Tue Mar 14 20:50:35 2006
@@ -31,11 +31,8 @@
 VDI_TOOLS += vdi_tree
 VDI_TOOLS += vdi_validate
 
-CFLAGS   += -Wall
 CFLAGS   += -Werror
 CFLAGS   += -Wno-unused
-#CFLAGS   += -O3
-CFLAGS   += -g3
 CFLAGS   += -fno-strict-aliasing
 CFLAGS   += $(INCLUDES)
 CFLAGS   += -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE
@@ -58,7 +55,7 @@
        $(CC) $(CFLAGS) -o parallax -L.. $(LDFLAGS) $(PLX_SRCS)
 
 ${VDI_TOOLS}: %: %.c $(VDI_SRCS)
-       $(CC) $(CFLAGS) -g3 -o $@ $@.c $(LDFLAGS) $(VDI_SRCS)
+       $(CC) $(CFLAGS) -o $@ $@.c $(LDFLAGS) $(VDI_SRCS)
 
 .PHONY: TAGS clean install rpm
--include $(DEPS)
\ No newline at end of file
+-include $(DEPS)
diff -r dc50cdd66c5c -r 0ed4a312765b tools/blktap/ublkback/Makefile
--- a/tools/blktap/ublkback/Makefile    Tue Mar 14 20:10:21 2006
+++ b/tools/blktap/ublkback/Makefile    Tue Mar 14 20:50:35 2006
@@ -9,11 +9,8 @@
 IBIN         = ublkback
 INSTALL_DIR  = /usr/sbin
 
-CFLAGS   += -Wall
 CFLAGS   += -Werror
 CFLAGS   += -Wno-unused
-#CFLAGS   += -O3
-CFLAGS   += -g3
 CFLAGS   += -fno-strict-aliasing
 CFLAGS   += -I $(XEN_LIBXC)
 CFLAGS   += $(INCLUDES) -I.
diff -r dc50cdd66c5c -r 0ed4a312765b tools/console/Makefile
--- a/tools/console/Makefile    Tue Mar 14 20:10:21 2006
+++ b/tools/console/Makefile    Tue Mar 14 20:50:35 2006
@@ -9,7 +9,7 @@
 INSTALL_PROG    = $(INSTALL) -m0755
 INSTALL_DIR     = $(INSTALL) -d -m0755
 
-CFLAGS  += -Wall -Werror -g3
+CFLAGS  += -Werror -g
 
 CFLAGS  += -I $(XEN_LIBXC)
 CFLAGS  += -I $(XEN_XENSTORE)
diff -r dc50cdd66c5c -r 0ed4a312765b tools/console/testsuite/Makefile
--- a/tools/console/testsuite/Makefile  Tue Mar 14 20:10:21 2006
+++ b/tools/console/testsuite/Makefile  Tue Mar 14 20:50:35 2006
@@ -1,5 +1,6 @@
-CFLAGS=-g -Wall
-CC=gcc
+XEN_ROOT = ../../..
+include $(XEN_ROOT)/tools/Rules.mk
+
 LDFLAGS=-static
 
 all: console-dom0 console-domU procpipe
diff -r dc50cdd66c5c -r 0ed4a312765b 
tools/debugger/gdb/gdb-6.2.1-xen-sparse/gdb/gdbserver/linux-xen-low.c
--- a/tools/debugger/gdb/gdb-6.2.1-xen-sparse/gdb/gdbserver/linux-xen-low.c     
Tue Mar 14 20:10:21 2006
+++ b/tools/debugger/gdb/gdb-6.2.1-xen-sparse/gdb/gdbserver/linux-xen-low.c     
Tue Mar 14 20:50:35 2006
@@ -229,8 +229,6 @@
   if (xc_waitdomain(xc_handle, current_domid, &w, 0))
       return -1;
   
-  linux_set_inferior();
-
   *status = 'T';
   if (expect_signal)
       return expect_signal;
diff -r dc50cdd66c5c -r 0ed4a312765b tools/debugger/libxendebug/Makefile
--- a/tools/debugger/libxendebug/Makefile       Tue Mar 14 20:10:21 2006
+++ b/tools/debugger/libxendebug/Makefile       Tue Mar 14 20:50:35 2006
@@ -7,14 +7,12 @@
 MAJOR    = 3.0
 MINOR    = 0
 
-CC       = gcc
-
 XEN_ROOT = ../../..
 include $(XEN_ROOT)/tools/Rules.mk
 
 SRCS     := xendebug.c
 
-CFLAGS   += -Wall -Werror -O3 -fno-strict-aliasing
+CFLAGS   += -Werror -fno-strict-aliasing
 CFLAGS   += $(INCLUDES) -I. -I$(XEN_ROOT)/tools/libxc
 # Get gcc to generate the dependencies for us.
 CFLAGS   += -Wp,-MD,.$(@F).d
diff -r dc50cdd66c5c -r 0ed4a312765b tools/debugger/pdb/Makefile
--- a/tools/debugger/pdb/Makefile       Tue Mar 14 20:10:21 2006
+++ b/tools/debugger/pdb/Makefile       Tue Mar 14 20:50:35 2006
@@ -20,7 +20,6 @@
 INCLUDES   += -I $(OCAML_ROOT)/lib/ocaml
 
 CFLAGS     += $(INCLUDES)
-CFLAGS     += -Wall
 CFLAGS     += -Werror
 CFLAGS     += -g
 
diff -r dc50cdd66c5c -r 0ed4a312765b tools/firmware/acpi/Makefile
--- a/tools/firmware/acpi/Makefile      Tue Mar 14 20:10:21 2006
+++ b/tools/firmware/acpi/Makefile      Tue Mar 14 20:50:35 2006
@@ -16,11 +16,12 @@
 # *
 # */
 #
+
+XEN_ROOT = ../../..
+include $(XEN_ROOT)/tools/Rules.mk
+
 # Compiler flag
-CFLAG=-I. -I../../libxc
-       
-# Compiler tool        
-CC=gcc
+HOSTCFLAGS += -I. -I../../libxc
 
 # TARGET
 C_SRC=$(shell ls *.c)
@@ -33,7 +34,7 @@
 
 vpath iasl $(PATH)
 all:$(ACPI_BIN)
-       
+
 acpi_dsdt.c:acpi_dsdt.asl
        $(MAKE) iasl
        iasl -oa -tc acpi_dsdt.asl
@@ -54,15 +55,13 @@
        install $(IASL_VER)/compiler/iasl /usr/bin/iasl
 
 $(ACPI_GEN):$(C_SRC) $(H_SRC) acpi_dsdt.c
-       $(CC) -o $(ACPI_GEN) $(CFLAG) $(shell ls *.c)
+       $(HOSTCC) -o $(ACPI_GEN) $(HOSTCFLAGS) $(shell ls *.c)
 
 $(ACPI_BIN):$(ACPI_GEN)
        ./$(ACPI_GEN) $(ACPI_BIN)
-       
+
 clean:
        rm -rf *.o $(ACPI_GEN) $(ACPI_BIN) $(IASL_VER) 
-#   rm -f acpi_dsdt.c
        rm -rf  $(IASL_VER).tar.gz
-install:all
-               
-       
+
+install: all
diff -r dc50cdd66c5c -r 0ed4a312765b tools/ioemu/Makefile
--- a/tools/ioemu/Makefile      Tue Mar 14 20:10:21 2006
+++ b/tools/ioemu/Makefile      Tue Mar 14 20:50:35 2006
@@ -3,7 +3,7 @@
 
 -include config-host.mak
 
-CFLAGS+=-Wall -O2 -g -fno-strict-aliasing 
+CFLAGS+=-g -fno-strict-aliasing 
 ifdef CONFIG_DARWIN
 CFLAGS+= -mdynamic-no-pic
 endif
diff -r dc50cdd66c5c -r 0ed4a312765b tools/ioemu/configure
--- a/tools/ioemu/configure     Tue Mar 14 20:10:21 2006
+++ b/tools/ioemu/configure     Tue Mar 14 20:50:35 2006
@@ -392,17 +392,17 @@
 echo "configdir=$configdir" >> $config_mak
 echo "LIBDIR=$libdir" >> $config_mak
 echo "#define CONFIG_QEMU_SHAREDIR \"$datadir\"" >> $config_h
-echo "MAKE=$make" >> $config_mak
-echo "CC=$cc" >> $config_mak
-if test "$have_gcc3_options" = "yes" ; then
-  echo "HAVE_GCC3_OPTIONS=yes" >> $config_mak
-fi
-echo "HOST_CC=$host_cc" >> $config_mak
-echo "AR=$ar" >> $config_mak
-echo "STRIP=$strip -s -R .comment -R .note" >> $config_mak
-echo "CFLAGS=$CFLAGS" >> $config_mak
-echo "LDFLAGS=$LDFLAGS" >> $config_mak
-echo "EXESUF=$EXESUF" >> $config_mak
+#echo "MAKE=$make" >> $config_mak
+#echo "CC=$cc" >> $config_mak
+#if test "$have_gcc3_options" = "yes" ; then
+#  echo "HAVE_GCC3_OPTIONS=yes" >> $config_mak
+#fi
+#echo "HOST_CC=$host_cc" >> $config_mak
+#echo "AR=$ar" >> $config_mak
+#echo "STRIP=$strip -s -R .comment -R .note" >> $config_mak
+#echo "CFLAGS=$CFLAGS" >> $config_mak
+#echo "LDFLAGS=$LDFLAGS" >> $config_mak
+#echo "EXESUF=$EXESUF" >> $config_mak
 
 if test "$bigendian" = "yes" ; then
   echo "WORDS_BIGENDIAN=yes" >> $config_mak
diff -r dc50cdd66c5c -r 0ed4a312765b tools/ioemu/monitor.c
--- a/tools/ioemu/monitor.c     Tue Mar 14 20:10:21 2006
+++ b/tools/ioemu/monitor.c     Tue Mar 14 20:50:35 2006
@@ -407,6 +407,7 @@
 
 static void do_eject(int force, const char *filename)
 {
+    char cmd[1024];
     BlockDriverState *bs;
 
     bs = bdrv_find(filename);
@@ -415,6 +416,9 @@
         return;
     }
     eject_device(bs, force);
+    sprintf(cmd, "eject %s", filename);
+    system(cmd);
+
 }
 
 static void do_change(const char *device, const char *filename)
diff -r dc50cdd66c5c -r 0ed4a312765b tools/ioemu/target-i386-dm/Makefile
--- a/tools/ioemu/target-i386-dm/Makefile       Tue Mar 14 20:10:21 2006
+++ b/tools/ioemu/target-i386-dm/Makefile       Tue Mar 14 20:50:35 2006
@@ -13,7 +13,7 @@
 VPATH+=:$(SRC_PATH)/linux-user
 DEFINES+=-I$(SRC_PATH)/linux-user -I$(SRC_PATH)/linux-user/$(TARGET_ARCH)
 endif
-CFLAGS+=-Wall -O2 -g -fno-strict-aliasing
+CFLAGS+=-g -fno-strict-aliasing
 LDFLAGS=-g
 LIBS=
 HELPER_CFLAGS=$(CFLAGS)
@@ -99,7 +99,6 @@
 endif
 
 ifeq ($(ARCH),i386)
-CFLAGS+=-fomit-frame-pointer
 OP_CFLAGS=$(CFLAGS) -mpreferred-stack-boundary=2
 ifeq ($(HAVE_GCC3_OPTIONS),yes)
 OP_CFLAGS+= -falign-functions=0 -fno-gcse
@@ -236,7 +235,7 @@
 all: $(PROGS)
 
 $(QEMU_USER): $(OBJS)
-       $(CC) $(LDFLAGS) -o $@ $^  $(LIBS)
+       $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $^  $(LIBS)
 ifeq ($(ARCH),alpha)
 # Mark as 32 bit binary, i. e. it will be mapped into the low 31 bit of
 # the address space (31 bit so sign extending doesn't matter)
@@ -312,7 +311,7 @@
 endif
 
 $(QEMU_SYSTEM): $(VL_OBJS) libqemu.a
-       $(CC) $(VL_LDFLAGS) -o $@ $^ $(LIBS) $(SDL_LIBS) $(VNC_LIBS) $(VL_LIBS) 
-lpthread
+       $(CC) $(CFLAGS) $(VL_LDFLAGS) -o $@ $^ $(LIBS) $(SDL_LIBS) $(VNC_LIBS) 
$(VL_LIBS) -lpthread
 
 vnc.o: vnc.c keyboard_rdesktop.c
        $(CC) $(CFLAGS) $(DEFINES) $(VNC_CFLAGS) -c -o $@ $<
diff -r dc50cdd66c5c -r 0ed4a312765b tools/ioemu/vl.h
--- a/tools/ioemu/vl.h  Tue Mar 14 20:10:21 2006
+++ b/tools/ioemu/vl.h  Tue Mar 14 20:50:35 2006
@@ -697,7 +697,7 @@
 void tcx_init(DisplayState *ds, uint32_t addr);
 
 /* sched.c */
-void sched_init();
+void sched_init(uint32_t, uint32_t);
 
 /* magic-load.c */
 void magic_init(const char *kfn, int kloadaddr, uint32_t addr);
@@ -799,7 +799,7 @@
 
 int gdbserver_start(int port);
 void update_select_wakeup_events(void);
-void tun_receive_handler();
+void tun_receive_handler(fd_set *);
 
 extern char domain_name[];
 #endif /* VL_H */
diff -r dc50cdd66c5c -r 0ed4a312765b tools/libxc/Makefile
--- a/tools/libxc/Makefile      Tue Mar 14 20:10:21 2006
+++ b/tools/libxc/Makefile      Tue Mar 14 20:50:35 2006
@@ -6,8 +6,6 @@
 
 MAJOR    = 3.0
 MINOR    = 0
-
-CC       = gcc
 
 XEN_ROOT = ../..
 include $(XEN_ROOT)/tools/Rules.mk
@@ -48,9 +46,7 @@
 BUILD_SRCS += xc_hvm_build.c
 endif
 
-CFLAGS   += -Wall
 CFLAGS   += -Werror
-CFLAGS   += -O3
 CFLAGS   += -fno-strict-aliasing
 CFLAGS   += $(INCLUDES) -I.
 
diff -r dc50cdd66c5c -r 0ed4a312765b tools/libxc/xc_core.c
--- a/tools/libxc/xc_core.c     Tue Mar 14 20:10:21 2006
+++ b/tools/libxc/xc_core.c     Tue Mar 14 20:50:35 2006
@@ -6,18 +6,17 @@
 #include <zlib.h>
 
 /* number of pages to write at a time */
-#define DUMP_INCREMENT 4 * 1024
+#define DUMP_INCREMENT (4 * 1024)
 #define round_pgup(_p)    (((_p)+(PAGE_SIZE-1))&PAGE_MASK)
 
 static int
 copy_from_domain_page(int xc_handle,
                       uint32_t domid,
-                      unsigned long *page_array,
-                      unsigned long src_pfn,
+                      unsigned long mfn,
                       void *dst_page)
 {
     void *vaddr = xc_map_foreign_range(
-        xc_handle, domid, PAGE_SIZE, PROT_READ, page_array[src_pfn]);
+        xc_handle, domid, PAGE_SIZE, PROT_READ, mfn);
     if ( vaddr == NULL )
         return -1;
     memcpy(dst_page, vaddr, PAGE_SIZE);
@@ -26,93 +25,152 @@
 }
 
 int 
-xc_domain_dumpcore(int xc_handle,
-                   uint32_t domid,
-                   const char *corename)
+xc_domain_dumpcore_via_callback(int xc_handle,
+                                uint32_t domid,
+                                void *args,
+                                dumpcore_rtn_t dump_rtn)
 {
     unsigned long nr_pages;
-    unsigned long *page_array;
+    unsigned long *page_array = NULL;
     xc_dominfo_t info;
-    int i, nr_vcpus = 0, dump_fd;
+    int i, nr_vcpus = 0;
     char *dump_mem, *dump_mem_start = NULL;
     struct xc_core_header header;
     vcpu_guest_context_t  ctxt[MAX_VIRT_CPUS];
+    char dummy[PAGE_SIZE];
+    int dummy_len;
+    int sts;
 
- 
-    if ((dump_fd = open(corename, O_CREAT|O_RDWR, S_IWUSR|S_IRUSR)) < 0) {
-        PERROR("Could not open corefile %s: %s", corename, strerror(errno));
-        goto error_out;
-    }
- 
-    if ((dump_mem_start = malloc(DUMP_INCREMENT*PAGE_SIZE)) == NULL) {
+    if ( (dump_mem_start = malloc(DUMP_INCREMENT*PAGE_SIZE)) == NULL )
+    {
         PERROR("Could not allocate dump_mem");
         goto error_out;
     }
  
-    if (xc_domain_getinfo(xc_handle, domid, 1, &info) != 1) {
+    if ( xc_domain_getinfo(xc_handle, domid, 1, &info) != 1 )
+    {
         PERROR("Could not get info for domain");
         goto error_out;
     }
  
-    for (i = 0; i < info.max_vcpu_id; i++)
-        if (xc_vcpu_getcontext(xc_handle, domid,
-                                       i, &ctxt[nr_vcpus]) == 0)
+    if ( domid != info.domid )
+    {
+        PERROR("Domain %d does not exist", domid);
+        goto error_out;
+    }
+
+    for ( i = 0; i <= info.max_vcpu_id; i++ )
+        if ( xc_vcpu_getcontext(xc_handle, domid, i, &ctxt[nr_vcpus]) == 0)
             nr_vcpus++;
  
     nr_pages = info.nr_pages;
 
-    header.xch_magic = XC_CORE_MAGIC;
+    header.xch_magic = XC_CORE_MAGIC; 
     header.xch_nr_vcpus = nr_vcpus;
     header.xch_nr_pages = nr_pages;
     header.xch_ctxt_offset = sizeof(struct xc_core_header);
     header.xch_index_offset = sizeof(struct xc_core_header) +
         sizeof(vcpu_guest_context_t)*nr_vcpus;
-    header.xch_pages_offset = round_pgup(sizeof(struct xc_core_header) +
-                                         (sizeof(vcpu_guest_context_t) * 
nr_vcpus) +
-                                         (nr_pages * sizeof(unsigned long)));
+    dummy_len = (sizeof(struct xc_core_header) +
+                 (sizeof(vcpu_guest_context_t) * nr_vcpus) +
+                 (nr_pages * sizeof(unsigned long)));
+    header.xch_pages_offset = round_pgup(dummy_len);
+    
+    sts = dump_rtn(args, (char *)&header, sizeof(struct xc_core_header));
+    if ( sts != 0 )
+        goto error_out;
 
-    if (write(dump_fd, &header, sizeof(struct xc_core_header)) < 0 ||
-        write(dump_fd, &ctxt, sizeof(ctxt[0]) * nr_vcpus) < 0)
+    sts = dump_rtn(args, (char *)&ctxt, sizeof(ctxt[0]) * nr_vcpus);
+    if ( sts != 0 )
+        goto error_out;
+
+    if ( (page_array = malloc(nr_pages * sizeof(unsigned long))) == NULL )
     {
-        PERROR("write failed");
-        goto error_out;
-    }
-
-    if ((page_array = malloc(nr_pages * sizeof(unsigned long))) == NULL) {
         printf("Could not allocate memory\n");
         goto error_out;
     }
-    if (xc_get_pfn_list(xc_handle, domid, page_array, nr_pages) != nr_pages) {
+    if ( xc_get_pfn_list(xc_handle, domid, page_array, nr_pages) != nr_pages )
+    {
         printf("Could not get the page frame list\n");
         goto error_out;
     }
-    if (write(dump_fd, page_array, nr_pages * sizeof(unsigned long)) < 0)
+    sts = dump_rtn(args, (char *)page_array, nr_pages * sizeof(unsigned long));
+    if ( sts != 0 )
+        goto error_out;
+
+    /* Pad the output data to page alignment. */
+    memset(dummy, 0, PAGE_SIZE);
+    sts = dump_rtn(args, dummy, header.xch_pages_offset - dummy_len);
+    if ( sts != 0 )
+        goto error_out;
+
+    for ( dump_mem = dump_mem_start, i = 0; i < nr_pages; i++ )
     {
-        PERROR("write failed");
-        goto error_out;
-    }
-    lseek(dump_fd, header.xch_pages_offset, SEEK_SET);
-    for (dump_mem = dump_mem_start, i = 0; i < nr_pages; i++) {
-        copy_from_domain_page(xc_handle, domid, page_array, i, dump_mem);
+        copy_from_domain_page(xc_handle, domid, page_array[i], dump_mem);
         dump_mem += PAGE_SIZE;
-        if (((i + 1) % DUMP_INCREMENT == 0) || (i + 1) == nr_pages) {
-            if (write(dump_fd, dump_mem_start, dump_mem - dump_mem_start) < 
-                dump_mem - dump_mem_start) {
-                PERROR("Partial write, file system full?");
+        if ( ((i + 1) % DUMP_INCREMENT == 0) || ((i + 1) == nr_pages) )
+        {
+            sts = dump_rtn(args, dump_mem_start, dump_mem - dump_mem_start);
+            if ( sts != 0 )
                 goto error_out;
-            }
             dump_mem = dump_mem_start;
         }
     }
 
-    close(dump_fd);
     free(dump_mem_start);
+    free(page_array);
     return 0;
+
  error_out:
-    if (dump_fd != -1)
-        close(dump_fd);
     free(dump_mem_start);
+    free(page_array);
     return -1;
+}
+
+/* Callback args for writing to a local dump file. */
+struct dump_args {
+    int     fd;
+};
+
+/* Callback routine for writing to a local dump file. */
+static int local_file_dump(void *args, char *buffer, unsigned int length)
+{
+    struct dump_args *da = args;
+    int bytes, offset;
+
+    for ( offset = 0; offset < length; offset += bytes )
+    {
+        bytes = write(da->fd, &buffer[offset], length-offset);
+        if ( bytes <= 0 )
+        {
+            PERROR("Failed to write buffer: %s", strerror(errno));
+            return -errno;
+        }
+    }
+
+    return 0;
+}
+
+int 
+xc_domain_dumpcore(int xc_handle,
+                   uint32_t domid,
+                   const char *corename)
+{
+    struct dump_args da;
+    int sts;
+
+    if ( (da.fd = open(corename, O_CREAT|O_RDWR, S_IWUSR|S_IRUSR)) < 0 )
+    {
+        PERROR("Could not open corefile %s: %s", corename, strerror(errno));
+        return -errno;
+    }
+ 
+    sts = xc_domain_dumpcore_via_callback(
+        xc_handle, domid, &da, &local_file_dump);
+
+    close(da.fd);
+
+    return sts;
 }
 
 /*
diff -r dc50cdd66c5c -r 0ed4a312765b tools/libxc/xc_hvm_build.c
--- a/tools/libxc/xc_hvm_build.c        Tue Mar 14 20:10:21 2006
+++ b/tools/libxc/xc_hvm_build.c        Tue Mar 14 20:50:35 2006
@@ -132,7 +132,7 @@
 }
 
 /*
- * Use E820 reserved memory 0x9F800 to pass HVM info to vmxloader
+ * Use E820 reserved memory 0x9F800 to pass HVM info to hvmloader
  * hvmloader will use this info to set BIOS accordingly
  */
 static int set_hvm_info(int xc_handle, uint32_t dom,
@@ -338,24 +338,29 @@
     return -1;
 }
 
-int xc_hvm_build(int xc_handle,
-                 uint32_t domid,
-                 int memsize,
-                 const char *image_name,
-                 unsigned int vcpus,
-                 unsigned int pae,
-                 unsigned int acpi,
-                 unsigned int apic,
-                 unsigned int store_evtchn,
-                 unsigned long *store_mfn)
+static int xc_hvm_build_internal(int xc_handle,
+                                 uint32_t domid,
+                                 int memsize,
+                                 char *image,
+                                 unsigned long image_size,
+                                 unsigned int vcpus,
+                                 unsigned int pae,
+                                 unsigned int acpi,
+                                 unsigned int apic,
+                                 unsigned int store_evtchn,
+                                 unsigned long *store_mfn)
 {
     dom0_op_t launch_op, op;
     int rc, i;
     vcpu_guest_context_t st_ctxt, *ctxt = &st_ctxt;
     unsigned long nr_pages;
-    char         *image = NULL;
-    unsigned long image_size;
     xen_capabilities_info_t xen_caps;
+
+    if ( (image == NULL) || (image_size == 0) )
+    {
+        ERROR("Image required");
+        goto error_out;
+    }
 
     if ( (rc = xc_version(xc_handle, XENVER_capabilities, &xen_caps)) != 0 )
     {
@@ -375,9 +380,6 @@
         PERROR("Could not find total pages for domain");
         goto error_out;
     }
-
-    if ( (image = xc_read_kernel_image(image_name, &image_size)) == NULL )
-        goto error_out;
 
     if ( mlock(&st_ctxt, sizeof(st_ctxt) ) )
     {
@@ -404,8 +406,6 @@
         ERROR("Error constructing guest OS");
         goto error_out;
     }
-
-    free(image);
 
     /* FPU is set up to default initial state. */
     memset(&ctxt->fpu_ctxt, 0, sizeof(ctxt->fpu_ctxt));
@@ -450,7 +450,6 @@
     return rc;
 
  error_out:
-    free(image);
     return -1;
 }
 
@@ -580,6 +579,92 @@
     return 0;
 }
 
+/* xc_hvm_build
+ *
+ * Create a domain for a virtualized Linux, using files/filenames
+ *
+ */
+
+int xc_hvm_build(int xc_handle,
+                 uint32_t domid,
+                 int memsize,
+                 const char *image_name,
+                 unsigned int vcpus,
+                 unsigned int pae,
+                 unsigned int acpi,
+                 unsigned int apic,
+                 unsigned int store_evtchn,
+                 unsigned long *store_mfn)
+{
+    char *image;
+    int  sts;
+    unsigned long image_size;
+
+    if ( (image_name == NULL) ||
+         ((image = xc_read_image(image_name, &image_size)) == NULL) )
+        return -1;
+
+    sts = xc_hvm_build_internal(xc_handle, domid, memsize,
+                                image, image_size,
+                                vcpus, pae, acpi, apic,
+                                store_evtchn, store_mfn);
+
+    free(image);
+
+    return sts;
+}
+
+/* xc_hvm_build_mem
+ *
+ * Create a domain for a virtualized Linux, using buffers
+ *
+ */
+
+int xc_hvm_build_mem(int xc_handle,
+                     uint32_t domid,
+                     int memsize,
+                     const char *image_buffer,
+                     unsigned long image_size,
+                     unsigned int vcpus,
+                     unsigned int pae,
+                     unsigned int acpi,
+                     unsigned int apic,
+                     unsigned int store_evtchn,
+                     unsigned long *store_mfn)
+{
+    int           sts;
+    unsigned long img_len;
+    char         *img;
+
+    /* Validate that there is a kernel buffer */
+
+    if ( (image_buffer == NULL) || (image_size == 0) )
+    {
+        ERROR("kernel image buffer not present");
+        return -1;
+    }
+
+    img = xc_inflate_buffer(image_buffer, image_size, &img_len);
+    if (img == NULL)
+    {
+        ERROR("unable to inflate ram disk buffer");
+        return -1;
+    }
+
+    sts = xc_hvm_build_internal(xc_handle, domid, memsize,
+                                img, img_len,
+                                vcpus, pae, acpi, apic,
+                                store_evtchn, store_mfn);
+
+    /* xc_inflate_buffer may return the original buffer pointer (for
+       for already inflated buffers), so exercise some care in freeing */
+
+    if ( (img != NULL) && (img != image_buffer) )
+        free(img);
+
+    return sts;
+}
+
 /*
  * Local variables:
  * mode: C
diff -r dc50cdd66c5c -r 0ed4a312765b tools/libxc/xc_ia64_stubs.c
--- a/tools/libxc/xc_ia64_stubs.c       Tue Mar 14 20:10:21 2006
+++ b/tools/libxc/xc_ia64_stubs.c       Tue Mar 14 20:50:35 2006
@@ -658,7 +658,7 @@
         goto error_out;
     }
 
-    if ( (image = xc_read_kernel_image(image_name, &image_size)) == NULL ){
+    if ( (image = xc_read_image(image_name, &image_size)) == NULL ){
         PERROR("Could not read guest firmware image %s",image_name);
         goto error_out;
     }
diff -r dc50cdd66c5c -r 0ed4a312765b tools/libxc/xc_linux_build.c
--- a/tools/libxc/xc_linux_build.c      Tue Mar 14 20:10:21 2006
+++ b/tools/libxc/xc_linux_build.c      Tue Mar 14 20:50:35 2006
@@ -45,6 +45,15 @@
 #ifdef __ia64__
 #define probe_aout9(image,image_size,load_funcs) 1
 #endif
+
+struct initrd_info {
+    enum { INITRD_none, INITRD_file, INITRD_mem } type;
+    unsigned long len;
+    union {
+        gzFile file_handle;
+        char *mem_addr;
+    } u;
+};
 
 static const char *feature_names[XENFEAT_NR_SUBMAPS*32] = {
     [XENFEAT_writable_page_tables]       = "writable_page_tables",
@@ -117,7 +126,7 @@
     return -EINVAL;
 }
 
-static int probeimageformat(char *image,
+static int probeimageformat(const char *image,
                             unsigned long image_size,
                             struct load_funcs *load_funcs)
 {
@@ -127,6 +136,42 @@
     {
         ERROR( "Unrecognized image format" );
         return -EINVAL;
+    }
+
+    return 0;
+}
+
+int load_initrd(int xc_handle, domid_t dom,
+                struct initrd_info *initrd,
+                unsigned long physbase,
+                unsigned long *phys_to_mach)
+{
+    char page[PAGE_SIZE];
+    unsigned long pfn_start, pfn, nr_pages;
+
+    if ( initrd->type == INITRD_none )
+        return 0;
+
+    pfn_start = physbase >> PAGE_SHIFT;
+    nr_pages  = (initrd->len + PAGE_SIZE - 1) >> PAGE_SHIFT;
+
+    for ( pfn = pfn_start; pfn < (pfn_start + nr_pages); pfn++ )
+    {
+        if ( initrd->type == INITRD_mem )
+        {
+            xc_copy_to_domain_page(
+                xc_handle, dom, phys_to_mach[pfn],
+                &initrd->u.mem_addr[(pfn - pfn_start) << PAGE_SHIFT]);
+        }
+        else
+        {
+            if ( gzread(initrd->u.file_handle, page, PAGE_SIZE) == -1 )
+            {
+                PERROR("Error reading initrd image, could not");
+                return -EINVAL;
+            }
+            xc_copy_to_domain_page(xc_handle, dom, phys_to_mach[pfn], page);
+        }
     }
 
     return 0;
@@ -406,8 +451,8 @@
 
 static int setup_guest(int xc_handle,
                        uint32_t dom,
-                       char *image, unsigned long image_size,
-                       gzFile initrd_gfd, unsigned long initrd_len,
+                       const char *image, unsigned long image_size,
+                       struct initrd_info *initrd,
                        unsigned long nr_pages,
                        unsigned long *pvsi, unsigned long *pvke,
                        unsigned long *pvss, vcpu_guest_context_t *ctxt,
@@ -427,7 +472,6 @@
     unsigned long start_page, pgnr;
     start_info_t *start_info;
     int rc;
-    unsigned long i;
 
     rc = probeimageformat(image, image_size, &load_funcs);
     if ( rc != 0 )
@@ -441,7 +485,7 @@
 
     dsi.v_start      = round_pgdown(dsi.v_start);
     vinitrd_start    = round_pgup(dsi.v_end);
-    vinitrd_end      = vinitrd_start + initrd_len;
+    vinitrd_end      = vinitrd_start + initrd->len;
     v_end            = round_pgup(vinitrd_end);
 
     start_page = dsi.v_start >> PAGE_SHIFT;
@@ -452,7 +496,8 @@
         goto error_out;
     }
 
-    if ( xc_ia64_get_pfn_list(xc_handle, dom, page_array, start_page, pgnr) != 
pgnr )
+    if ( xc_ia64_get_pfn_list(xc_handle, dom, page_array,
+                              start_page, pgnr) != pgnr )
     {
         PERROR("Could not get the page frame list");
         goto error_out;
@@ -472,23 +517,9 @@
     (load_funcs.loadimage)(image, image_size, xc_handle, dom, page_array,
                            &dsi);
 
-    /* Load the initial ramdisk image. */
-    if ( initrd_len != 0 )
-    {
-        for ( i = (vinitrd_start - dsi.v_start);
-              i < (vinitrd_end - dsi.v_start); i += PAGE_SIZE )
-        {
-            char page[PAGE_SIZE];
-            if ( gzread(initrd_gfd, page, PAGE_SIZE) == -1 )
-            {
-                PERROR("Error reading initrd image, could not");
-                goto error_out;
-            }
-            xc_copy_to_domain_page(xc_handle, dom,
-                                   page_array[i>>PAGE_SHIFT], page);
-        }
-    }
-
+    if ( load_initrd(xc_handle, dom, initrd,
+                     vinitrd_start - dsi.v_start, page_array) )
+        goto error_out;
 
     *pvke = dsi.v_kernentry;
 
@@ -522,11 +553,11 @@
     start_info->store_evtchn = store_evtchn;
     start_info->console_mfn   = nr_pages - 1;
     start_info->console_evtchn = console_evtchn;
-    start_info->nr_pages       = nr_pages;     // FIXME?: nr_pages - 2 ????
-    if ( initrd_len != 0 )
+    start_info->nr_pages       = nr_pages; // FIXME?: nr_pages - 2 ????
+    if ( initrd->len != 0 )
     {
         ctxt->initrd.start    = vinitrd_start;
-        ctxt->initrd.size     = initrd_len;
+        ctxt->initrd.size     = initrd->len;
     }
     else
     {
@@ -550,8 +581,8 @@
 #else /* x86 */
 static int setup_guest(int xc_handle,
                        uint32_t dom,
-                       char *image, unsigned long image_size,
-                       gzFile initrd_gfd, unsigned long initrd_len,
+                       const char *image, unsigned long image_size,
+                       struct initrd_info *initrd,
                        unsigned long nr_pages,
                        unsigned long *pvsi, unsigned long *pvke,
                        unsigned long *pvss, vcpu_guest_context_t *ctxt,
@@ -578,15 +609,11 @@
     struct load_funcs load_funcs;
     struct domain_setup_info dsi;
     unsigned long vinitrd_start;
-    unsigned long vinitrd_end;
     unsigned long vphysmap_start;
-    unsigned long vphysmap_end;
     unsigned long vstartinfo_start;
-    unsigned long vstartinfo_end;
     unsigned long vstoreinfo_start;
-    unsigned long vstoreinfo_end;
     unsigned long vconsole_start;
-    unsigned long vconsole_end;
+    unsigned long vsharedinfo_start = 0; /* XXX gcc */
     unsigned long vstack_start;
     unsigned long vstack_end;
     unsigned long vpt_start;
@@ -612,6 +639,34 @@
         goto error_out;
     }
 
+    /* Parse and validate kernel features. */
+    p = strstr(dsi.xen_guest_string, "FEATURES=");
+    if ( p != NULL )
+    {
+        if ( !parse_features(p + strlen("FEATURES="),
+                             supported_features,
+                             required_features) )
+        {
+            ERROR("Failed to parse guest kernel features.\n");
+            goto error_out;
+        }
+
+        printf("Supported features  = { %08x }.\n", supported_features[0]);
+        printf("Required features   = { %08x }.\n", required_features[0]);
+    }
+
+    for ( i = 0; i < XENFEAT_NR_SUBMAPS; i++ )
+    {
+        if ( (supported_features[i]&required_features[i]) != 
required_features[i] )
+        {
+            ERROR("Guest kernel does not support a required feature.\n");
+            goto error_out;
+        }
+    }
+
+    shadow_mode_enabled = test_feature_bit(XENFEAT_auto_translated_physmap,
+                                           required_features);
+
     /*
      * Why do we need this? The number of page-table frames depends on the 
      * size of the bootstrap address space. But the size of the address space 
@@ -619,17 +674,22 @@
      * read-only). We have a pair of simultaneous equations in two unknowns, 
      * which we solve by exhaustive search.
      */
-    vinitrd_start    = round_pgup(dsi.v_end);
-    vinitrd_end      = vinitrd_start + initrd_len;
-    vphysmap_start   = round_pgup(vinitrd_end);
-    vphysmap_end     = vphysmap_start + (nr_pages * sizeof(unsigned long));
-    vstartinfo_start = round_pgup(vphysmap_end);
-    vstartinfo_end   = vstartinfo_start + PAGE_SIZE;
-    vstoreinfo_start = vstartinfo_end;
-    vstoreinfo_end   = vstoreinfo_start + PAGE_SIZE;
-    vconsole_start   = vstoreinfo_end;
-    vconsole_end     = vconsole_start + PAGE_SIZE;
-    vpt_start        = vconsole_end; 
+    v_end = round_pgup(dsi.v_end);
+    vinitrd_start = v_end;
+    v_end += round_pgup(initrd->len);
+    vphysmap_start = v_end;
+    v_end += round_pgup(nr_pages * sizeof(unsigned long));
+    vstartinfo_start = v_end;
+    v_end += PAGE_SIZE;
+    vstoreinfo_start = v_end;
+    v_end += PAGE_SIZE;
+    vconsole_start = v_end;
+    v_end += PAGE_SIZE;
+    if ( shadow_mode_enabled ) {
+        vsharedinfo_start = v_end;
+        v_end += PAGE_SIZE;
+    }
+    vpt_start = v_end;
 
     for ( nr_pt_pages = 2; ; nr_pt_pages++ )
     {
@@ -669,26 +729,22 @@
 
 #define _p(a) ((void *) (a))
 
-    printf("VIRTUAL MEMORY ARRANGEMENT:\n"
-           " Loaded kernel: %p->%p\n"
-           " Init. ramdisk: %p->%p\n"
-           " Phys-Mach map: %p->%p\n"
-           " Start info:    %p->%p\n"
-           " Store page:    %p->%p\n"
-           " Console page:  %p->%p\n"
-           " Page tables:   %p->%p\n"
-           " Boot stack:    %p->%p\n"
-           " TOTAL:         %p->%p\n",
-           _p(dsi.v_kernstart), _p(dsi.v_kernend), 
-           _p(vinitrd_start), _p(vinitrd_end),
-           _p(vphysmap_start), _p(vphysmap_end),
-           _p(vstartinfo_start), _p(vstartinfo_end),
-           _p(vstoreinfo_start), _p(vstoreinfo_end),
-           _p(vconsole_start), _p(vconsole_end),
-           _p(vpt_start), _p(vpt_end),
-           _p(vstack_start), _p(vstack_end),
-           _p(dsi.v_start), _p(v_end));
-    printf(" ENTRY ADDRESS: %p\n", _p(dsi.v_kernentry));
+    printf("VIRTUAL MEMORY ARRANGEMENT:\n");
+    printf(" Loaded kernel:    %p->%p\n", _p(dsi.v_kernstart),
+           _p(dsi.v_kernend));
+    if ( initrd->len )
+        printf(" Initial ramdisk:  %p->%p\n", _p(vinitrd_start),
+               _p(vinitrd_start + initrd->len));
+    printf(" Phys-Mach map:    %p\n", _p(vphysmap_start));
+    printf(" Start info:       %p\n", _p(vstartinfo_start));
+    printf(" Store page:       %p\n", _p(vstoreinfo_start));
+    printf(" Console page:     %p\n", _p(vconsole_start));
+    if ( shadow_mode_enabled )
+        printf(" Shared Info page: %p\n", _p(vsharedinfo_start));
+    printf(" Page tables:      %p\n", _p(vpt_start));
+    printf(" Boot stack:       %p\n", _p(vstack_start));
+    printf(" TOTAL:            %p->%p\n", _p(dsi.v_start), _p(v_end));
+    printf(" ENTRY ADDRESS:    %p\n", _p(dsi.v_kernentry));
 
     if ( ((v_end - dsi.v_start)>>PAGE_SHIFT) > nr_pages )
     {
@@ -710,54 +766,13 @@
         goto error_out;
     }
 
-    (load_funcs.loadimage)(image, image_size, xc_handle, dom, page_array,
+    (load_funcs.loadimage)(image, image_size,
+                           xc_handle, dom, page_array,
                            &dsi);
 
-    /* Parse and validate kernel features. */
-    p = strstr(dsi.xen_guest_string, "FEATURES=");
-    if ( p != NULL )
-    {
-        if ( !parse_features(p + strlen("FEATURES="),
-                             supported_features,
-                             required_features) )
-        {
-            ERROR("Failed to parse guest kernel features.\n");
-            goto error_out;
-        }
-
-        fprintf(stderr, "Supported features  = { %08x }.\n",
-                supported_features[0]);
-        fprintf(stderr, "Required features   = { %08x }.\n",
-                required_features[0]);
-    }
-
-    for ( i = 0; i < XENFEAT_NR_SUBMAPS; i++ )
-    {
-        if ( (supported_features[i]&required_features[i]) != 
required_features[i] )
-        {
-            ERROR("Guest kernel does not support a required feature.\n");
-            goto error_out;
-        }
-    }
-
-    shadow_mode_enabled = test_feature_bit(XENFEAT_auto_translated_physmap, 
required_features);
-
-    /* Load the initial ramdisk image. */
-    if ( initrd_len != 0 )
-    {
-        for ( i = (vinitrd_start - dsi.v_start); 
-              i < (vinitrd_end - dsi.v_start); i += PAGE_SIZE )
-        {
-            char page[PAGE_SIZE];
-            if ( gzread(initrd_gfd, page, PAGE_SIZE) == -1 )
-            {
-                PERROR("Error reading initrd image, could not");
-                goto error_out;
-            }
-            xc_copy_to_domain_page(xc_handle, dom,
-                                   page_array[i>>PAGE_SHIFT], page);
-        }
-    }
+    if ( load_initrd(xc_handle, dom, initrd,
+                     vinitrd_start - dsi.v_start, page_array) )
+        goto error_out;
 
     /* setup page tables */
 #if defined(__i386__)
@@ -851,7 +866,7 @@
 
     if ( shadow_mode_enabled )
     {
-        struct xen_reserved_phys_area xrpa;
+        struct xen_add_to_physmap xatp;
 
         /* Enable shadow translate mode */
         if ( xc_shadow_control(xc_handle, dom,
@@ -862,17 +877,36 @@
             goto error_out;
         }
 
-        /* Find the shared info frame.  It's guaranteed to be at the
-           start of the PFN hole. */
-        xrpa.domid = dom;
-        xrpa.idx   = 0;
-        rc = xc_memory_op(xc_handle, XENMEM_reserved_phys_area, &xrpa);
+        guest_shared_info_mfn = (vsharedinfo_start-dsi.v_start) >> PAGE_SHIFT;
+
+        /* Map shared info frame into guest physmap. */
+        xatp.domid = dom;
+        xatp.space = XENMAPSPACE_shared_info;
+        xatp.idx   = 0;
+        xatp.gpfn  = guest_shared_info_mfn;
+        rc = xc_memory_op(xc_handle, XENMEM_add_to_physmap, &xatp);
         if ( rc != 0 )
         {
-            PERROR("Cannot find shared info pfn");
+            PERROR("Cannot map shared info pfn");
             goto error_out;
         }
-        guest_shared_info_mfn = xrpa.first_gpfn;
+
+        /* Map grant table frames into guest physmap. */
+        for ( i = 0; ; i++ )
+        {
+            xatp.domid = dom;
+            xatp.space = XENMAPSPACE_grant_table;
+            xatp.idx   = i;
+            xatp.gpfn  = nr_pages + i;
+            rc = xc_memory_op(xc_handle, XENMEM_add_to_physmap, &xatp);
+            if ( rc != 0 )
+            {
+                if ( errno == EINVAL )
+                    break; /* done all grant tables */
+                PERROR("Cannot map grant table pfn");
+                goto error_out;
+            }
+        }
     }
     else
     {
@@ -914,10 +948,10 @@
     start_info->store_evtchn = store_evtchn;
     start_info->console_mfn   = guest_console_mfn;
     start_info->console_evtchn = console_evtchn;
-    if ( initrd_len != 0 )
+    if ( initrd->len != 0 )
     {
         start_info->mod_start    = vinitrd_start;
-        start_info->mod_len      = initrd_len;
+        start_info->mod_len      = initrd->len;
     }
     if ( cmdline != NULL )
     { 
@@ -970,27 +1004,24 @@
 }
 #endif
 
-int xc_linux_build(int xc_handle,
-                   uint32_t domid,
-                   const char *image_name,
-                   const char *ramdisk_name,
-                   const char *cmdline,
-                   const char *features,
-                   unsigned long flags,
-                   unsigned int store_evtchn,
-                   unsigned long *store_mfn,
-                   unsigned int console_evtchn,
-                   unsigned long *console_mfn)
+static int xc_linux_build_internal(int xc_handle,
+                                   uint32_t domid,
+                                   char *image,
+                                   unsigned long image_size,
+                                   struct initrd_info *initrd,
+                                   const char *cmdline,
+                                   const char *features,
+                                   unsigned long flags,
+                                   unsigned int store_evtchn,
+                                   unsigned long *store_mfn,
+                                   unsigned int console_evtchn,
+                                   unsigned long *console_mfn)
 {
     dom0_op_t launch_op;
     DECLARE_DOM0_OP;
-    int initrd_fd = -1;
-    gzFile initrd_gfd = NULL;
     int rc, i;
     vcpu_guest_context_t st_ctxt, *ctxt = &st_ctxt;
     unsigned long nr_pages;
-    char         *image = NULL;
-    unsigned long image_size, initrd_size=0;
     unsigned long vstartinfo_start, vkern_entry, vstack_start;
     uint32_t      features_bitmap[XENFEAT_NR_SUBMAPS] = { 0, };
 
@@ -1007,26 +1038,6 @@
     {
         PERROR("Could not find total pages for domain");
         goto error_out;
-    }
-
-    if ( (image = xc_read_kernel_image(image_name, &image_size)) == NULL )
-        goto error_out;
-
-    if ( (ramdisk_name != NULL) && (strlen(ramdisk_name) != 0) )
-    {
-        if ( (initrd_fd = open(ramdisk_name, O_RDONLY)) < 0 )
-        {
-            PERROR("Could not open the initial ramdisk image");
-            goto error_out;
-        }
-
-        initrd_size = xc_get_filesz(initrd_fd);
-
-        if ( (initrd_gfd = gzdopen(initrd_fd, "rb")) == NULL )
-        {
-            PERROR("Could not allocate decompression state for initrd");
-            goto error_out;
-        }
     }
 
 #ifdef VALGRIND
@@ -1051,7 +1062,8 @@
     memset(ctxt, 0, sizeof(*ctxt));
 
     if ( setup_guest(xc_handle, domid, image, image_size, 
-                     initrd_gfd, initrd_size, nr_pages, 
+                     initrd,
+                     nr_pages, 
                      &vstartinfo_start, &vkern_entry,
                      &vstack_start, ctxt, cmdline,
                      op.u.getdomaininfo.shared_info_frame,
@@ -1062,12 +1074,6 @@
         ERROR("Error constructing guest OS");
         goto error_out;
     }
-
-    if ( initrd_fd >= 0 )
-        close(initrd_fd);
-    if ( initrd_gfd )
-        gzclose(initrd_gfd);
-    free(image);
 
 #ifdef __ia64__
     /* based on new_thread in xen/arch/ia64/domain.c */
@@ -1154,12 +1160,129 @@
     return rc;
 
  error_out:
-    if ( initrd_gfd != NULL )
-        gzclose(initrd_gfd);
-    else if ( initrd_fd >= 0 )
-        close(initrd_fd);
+    return -1;
+}
+
+int xc_linux_build_mem(int xc_handle,
+                       uint32_t domid,
+                       const char *image_buffer,
+                       unsigned long image_size,
+                       const char *initrd,
+                       unsigned long initrd_len,
+                       const char *cmdline,
+                       const char *features,
+                       unsigned long flags,
+                       unsigned int store_evtchn,
+                       unsigned long *store_mfn,
+                       unsigned int console_evtchn,
+                       unsigned long *console_mfn)
+{
+    int            sts;
+    char          *img_buf;
+    unsigned long  img_len;
+    struct initrd_info initrd_info = { .type = INITRD_none };
+
+    /* A kernel buffer is required */
+    if ( (image_buffer == NULL) || (image_size == 0) )
+    {
+        ERROR("kernel image buffer not present");
+        return -1;
+    }
+
+    /* If it's gzipped, inflate it;  otherwise, use as is */
+    /* xc_inflate_buffer may return the same buffer pointer if */
+    /* the buffer is already inflated */
+    img_buf = xc_inflate_buffer(image_buffer, image_size, &img_len);
+    if ( img_buf == NULL )
+    {
+        ERROR("unable to inflate kernel image buffer");
+        return -1;
+    }
+
+    /* RAM disks are optional; if we get one, inflate it */
+    if ( initrd != NULL )
+    {
+        initrd_info.type = INITRD_mem;
+        initrd_info.u.mem_addr = xc_inflate_buffer(
+            initrd, initrd_len, &initrd_info.len);
+        if ( initrd_info.u.mem_addr == NULL )
+        {
+            ERROR("unable to inflate ram disk buffer");
+            sts = -1;
+            goto out;
+        }
+    }
+
+    sts = xc_linux_build_internal(xc_handle, domid, img_buf, img_len,
+                                  &initrd_info, cmdline, features, flags,
+                                  store_evtchn, store_mfn,
+                                  console_evtchn, console_mfn);
+
+ out:
+    /* The inflation routines may pass back the same buffer so be */
+    /* sure that we have a buffer and that it's not the one passed in. */
+    /* Don't unnecessarily annoy/surprise/confound the caller */
+    if ( (img_buf != NULL) && (img_buf != image_buffer) )
+        free(img_buf);
+    if ( (initrd_info.u.mem_addr != NULL) &&
+         (initrd_info.u.mem_addr != initrd) )
+        free(initrd_info.u.mem_addr);
+
+    return sts;
+}
+
+int xc_linux_build(int xc_handle,
+                   uint32_t domid,
+                   const char *image_name,
+                   const char *initrd_name,
+                   const char *cmdline,
+                   const char *features,
+                   unsigned long flags,
+                   unsigned int store_evtchn,
+                   unsigned long *store_mfn,
+                   unsigned int console_evtchn,
+                   unsigned long *console_mfn)
+{
+    char *image = NULL;
+    unsigned long image_size;
+    struct initrd_info initrd_info = { .type = INITRD_none };
+    int fd = -1, sts = -1;
+
+    if ( (image_name == NULL) ||
+         ((image = xc_read_image(image_name, &image_size)) == NULL ))
+        return -1;
+
+    if ( (initrd_name != NULL) && (strlen(initrd_name) != 0) )
+    {
+        initrd_info.type = INITRD_file;
+
+        if ( (fd = open(initrd_name, O_RDONLY)) < 0 )
+        {
+            PERROR("Could not open the initial ramdisk image");
+            goto error_out;
+        }
+
+        initrd_info.len = xc_get_filesz(fd);
+        if ( (initrd_info.u.file_handle = gzdopen(fd, "rb")) == NULL )
+        {
+            PERROR("Could not allocate decompression state for initrd");
+            goto error_out;
+        }
+    }
+
+    sts = xc_linux_build_internal(xc_handle, domid, image, image_size,
+                                  &initrd_info, cmdline, features, flags,
+                                  store_evtchn, store_mfn,
+                                  console_evtchn, console_mfn);
+
+ error_out:
     free(image);
-    return -1;
+    if ( fd >= 0 )
+        close(fd);
+    if ( initrd_info.u.file_handle )
+        gzclose(initrd_info.u.file_handle);
+
+    return sts;
 }
 
 /*
diff -r dc50cdd66c5c -r 0ed4a312765b tools/libxc/xc_load_aout9.c
--- a/tools/libxc/xc_load_aout9.c       Tue Mar 14 20:10:21 2006
+++ b/tools/libxc/xc_load_aout9.c       Tue Mar 14 20:50:35 2006
@@ -12,20 +12,19 @@
 #error "Unsupported architecture"
 #endif
 
-
 #define round_pgup(_p)    (((_p)+(PAGE_SIZE-1))&PAGE_MASK)
 #define KZERO             0x80000000
 #define KOFFSET(_p)       ((_p)&~KZERO)
 
-static int parseaout9image(char *, unsigned long, struct domain_setup_info *);
-static int loadaout9image(char *, unsigned long, int, uint32_t, unsigned long 
*, struct domain_setup_info *);
-static void copyout(int, uint32_t, unsigned long *, unsigned long, void *, 
int);
-struct Exec *get_header(char *, unsigned long, struct Exec *);
+static int parseaout9image(const char *, unsigned long, struct 
domain_setup_info *);
+static int loadaout9image(const char *, unsigned long, int, uint32_t, unsigned 
long *, struct domain_setup_info *);
+static void copyout(int, uint32_t, unsigned long *, unsigned long, const char 
*, int);
+struct Exec *get_header(const char *, unsigned long, struct Exec *);
 
 
 int 
 probe_aout9(
-    char *image,
+    const char *image,
     unsigned long image_size,
     struct load_funcs *load_funcs)
 {
@@ -43,7 +42,7 @@
 
 static int 
 parseaout9image(
-    char *image,
+    const char *image,
     unsigned long image_size,
     struct domain_setup_info *dsi)
 {
@@ -77,7 +76,7 @@
 
 static int 
 loadaout9image(
-    char *image,
+    const char *image,
     unsigned long image_size,
     int xch, uint32_t dom,
     unsigned long *parray,
@@ -111,7 +110,7 @@
     int xch, uint32_t dom,
     unsigned long *parray,
     unsigned long addr,
-    void *buf,
+    const char *buf,
     int sz)
 {
     unsigned long pgoff, chunksz, off;
@@ -143,7 +142,7 @@
  */
 struct Exec *
 get_header(
-    char *image,
+    const char *image,
     unsigned long image_size,
     struct Exec *ehdr)
 {
diff -r dc50cdd66c5c -r 0ed4a312765b tools/libxc/xc_load_bin.c
--- a/tools/libxc/xc_load_bin.c Tue Mar 14 20:10:21 2006
+++ b/tools/libxc/xc_load_bin.c Tue Mar 14 20:50:35 2006
@@ -99,23 +99,22 @@
 #define FLAGS_REQUIRED XEN_REACTOS_FLAG_ADDRSVALID
 
 static struct xen_bin_image_table *
-findtable(char *image, unsigned long image_size);
+findtable(const char *image, unsigned long image_size);
 static int
 parsebinimage(
-    char *image, unsigned long image_size, struct domain_setup_info *dsi);
+    const char *image, unsigned long image_size,
+    struct domain_setup_info *dsi);
 static int
 loadbinimage(
-    char *image, unsigned long image_size, int xch, uint32_t dom,
+    const char *image, unsigned long image_size, int xch, uint32_t dom,
     unsigned long *parray, struct domain_setup_info *dsi);
 
-int probe_bin(char *image,
+int probe_bin(const char *image,
               unsigned long image_size,
               struct load_funcs *load_funcs)
 {
-    if ( NULL == findtable(image, image_size) )
-    {
-        return -EINVAL;
-    }
+    if ( findtable(image, image_size) == NULL )
+        return -EINVAL;
 
     load_funcs->parseimage = parsebinimage;
     load_funcs->loadimage = loadbinimage;
@@ -124,7 +123,7 @@
 }
 
 static struct xen_bin_image_table *
-findtable(char *image, unsigned long image_size)
+findtable(const char *image, unsigned long image_size)
 {
     struct xen_bin_image_table *table;
     unsigned long *probe_ptr;
@@ -133,15 +132,12 @@
 
     /* Don't go outside the image */
     if ( image_size < sizeof(struct xen_bin_image_table) )
-    {
         return NULL;
-    }
+
     probe_count = image_size;
     /* Restrict to first 8k */
-    if ( 8192 < probe_count )
-    {
+    if ( probe_count > 8192 )
         probe_count = 8192;
-    }
     probe_count = (probe_count - sizeof(struct xen_bin_image_table)) /
                   sizeof(unsigned long);
 
@@ -165,7 +161,7 @@
     return NULL;
 }
 
-static int parsebinimage(char *image, 
+static int parsebinimage(const char *image, 
                          unsigned long image_size,
                          struct domain_setup_info *dsi)
 {
@@ -238,7 +234,7 @@
 
 static int
 loadbinimage(
-    char *image, unsigned long image_size, int xch, uint32_t dom,
+    const char *image, unsigned long image_size, int xch, uint32_t dom,
     unsigned long *parray, struct domain_setup_info *dsi)
 {
     unsigned long size;
diff -r dc50cdd66c5c -r 0ed4a312765b tools/libxc/xc_load_elf.c
--- a/tools/libxc/xc_load_elf.c Tue Mar 14 20:10:21 2006
+++ b/tools/libxc/xc_load_elf.c Tue Mar 14 20:50:35 2006
@@ -19,26 +19,25 @@
 
 static int
 parseelfimage(
-    char *image, unsigned long image_size, struct domain_setup_info *dsi);
+    const char *image, unsigned long image_size,
+    struct domain_setup_info *dsi);
 static int
 loadelfimage(
-    char *image, unsigned long image_size, int xch, uint32_t dom,
+    const char *image, unsigned long image_size, int xch, uint32_t dom,
     unsigned long *parray, struct domain_setup_info *dsi);
 static int
 loadelfsymtab(
-    char *image, int xch, uint32_t dom, unsigned long *parray,
+    const char *image, int xch, uint32_t dom, unsigned long *parray,
     struct domain_setup_info *dsi);
 
-int probe_elf(char *image,
+int probe_elf(const char *image,
               unsigned long image_size,
               struct load_funcs *load_funcs)
 {
     Elf_Ehdr *ehdr = (Elf_Ehdr *)image;
 
     if ( !IS_ELF(*ehdr) )
-    {
-        return -EINVAL;
-    }
+        return -EINVAL;
 
     load_funcs->parseimage = parseelfimage;
     load_funcs->loadimage = loadelfimage;
@@ -52,7 +51,7 @@
             ((phdr->p_flags & (PF_W|PF_X)) != 0));
 }
 
-static int parseelfimage(char *image, 
+static int parseelfimage(const char *image, 
                          unsigned long elfsize,
                          struct domain_setup_info *dsi)
 {
@@ -60,7 +59,8 @@
     Elf_Phdr *phdr;
     Elf_Shdr *shdr;
     unsigned long kernstart = ~0UL, kernend=0UL;
-    char *shstrtab, *guestinfo=NULL, *p;
+    const char *shstrtab;
+    char *guestinfo=NULL, *p;
     int h;
 
     if ( !IS_ELF(*ehdr) )
@@ -98,7 +98,7 @@
         if ( strcmp(&shstrtab[shdr->sh_name], "__xen_guest") != 0 )
             continue;
 
-        guestinfo = image + shdr->sh_offset;
+        guestinfo = (char *)image + shdr->sh_offset;
 
         if ( (strstr(guestinfo, "LOADER=generic") == NULL) &&
              (strstr(guestinfo, "GUEST_OS=linux") == NULL) )
@@ -171,7 +171,7 @@
 
 static int
 loadelfimage(
-    char *image, unsigned long elfsize, int xch, uint32_t dom,
+    const char *image, unsigned long elfsize, int xch, uint32_t dom,
     unsigned long *parray, struct domain_setup_info *dsi)
 {
     Elf_Ehdr *ehdr = (Elf_Ehdr *)image;
@@ -222,7 +222,7 @@
 
 static int
 loadelfsymtab(
-    char *image, int xch, uint32_t dom, unsigned long *parray,
+    const char *image, int xch, uint32_t dom, unsigned long *parray,
     struct domain_setup_info *dsi)
 {
     Elf_Ehdr *ehdr = (Elf_Ehdr *)image, *sym_ehdr;
@@ -271,8 +271,9 @@
              (shdr[h].sh_type == SHT_SYMTAB) )
         {
             if ( parray != NULL )
-                xc_map_memcpy(maxva, image + shdr[h].sh_offset, 
shdr[h].sh_size,
-                           xch, dom, parray, dsi->v_start);
+                xc_map_memcpy(maxva, image + shdr[h].sh_offset,
+                              shdr[h].sh_size,
+                              xch, dom, parray, dsi->v_start);
 
             /* Mangled to be based on ELF header location. */
             shdr[h].sh_offset = maxva - dsi->symtab_addr;
diff -r dc50cdd66c5c -r 0ed4a312765b tools/libxc/xc_private.c
--- a/tools/libxc/xc_private.c  Tue Mar 14 20:10:21 2006
+++ b/tools/libxc/xc_private.c  Tue Mar 14 20:50:35 2006
@@ -231,8 +231,8 @@
             goto out1;
         }
         break;
-    case XENMEM_reserved_phys_area:
-        if ( mlock(arg, sizeof(struct xen_reserved_phys_area)) )
+    case XENMEM_add_to_physmap:
+        if ( mlock(arg, sizeof(struct xen_add_to_physmap)) )
         {
             PERROR("Could not mlock");
             goto out1;
@@ -277,8 +277,8 @@
         safe_munlock(xmml->extent_start,
                      xmml->max_extents * sizeof(unsigned long));
         break;
-    case XENMEM_reserved_phys_area:
-        safe_munlock(arg, sizeof(struct xen_reserved_phys_area));
+    case XENMEM_add_to_physmap:
+        safe_munlock(arg, sizeof(struct xen_add_to_physmap));
         break;
     case XENMEM_translate_gpfn_list:
             safe_munlock(trans->mfn_list, trans->nr_gpfns * sizeof(long));
@@ -364,7 +364,7 @@
 int xc_copy_to_domain_page(int xc_handle,
                            uint32_t domid,
                            unsigned long dst_pfn, 
-                           void *src_page)
+                           const char *src_page)
 {
     void *vaddr = xc_map_foreign_range(
         xc_handle, domid, PAGE_SIZE, PROT_WRITE, dst_pfn);
@@ -410,7 +410,7 @@
     return sz;
 }
 
-void xc_map_memcpy(unsigned long dst, char *src, unsigned long size,
+void xc_map_memcpy(unsigned long dst, const char *src, unsigned long size,
                    int xch, uint32_t dom, unsigned long *parray,
                    unsigned long vstart)
 {
diff -r dc50cdd66c5c -r 0ed4a312765b tools/libxc/xc_ptrace.c
--- a/tools/libxc/xc_ptrace.c   Tue Mar 14 20:10:21 2006
+++ b/tools/libxc/xc_ptrace.c   Tue Mar 14 20:50:35 2006
@@ -1,5 +1,4 @@
 #define XC_PTRACE_PRIVATE
-
 
 #include <sys/ptrace.h>
 #include <sys/wait.h>
@@ -8,6 +7,36 @@
 #include "xc_private.h"
 #include "xg_private.h"
 #include "xc_ptrace.h"
+
+#ifdef DEBUG
+static char *ptrace_names[] = {
+    "PTRACE_TRACEME",
+    "PTRACE_PEEKTEXT",
+    "PTRACE_PEEKDATA",
+    "PTRACE_PEEKUSER",
+    "PTRACE_POKETEXT",
+    "PTRACE_POKEDATA",
+    "PTRACE_POKEUSER",
+    "PTRACE_CONT",
+    "PTRACE_KILL",
+    "PTRACE_SINGLESTEP",
+    "PTRACE_INVALID",
+    "PTRACE_INVALID",
+    "PTRACE_GETREGS",
+    "PTRACE_SETREGS",
+    "PTRACE_GETFPREGS",
+    "PTRACE_SETFPREGS",
+    "PTRACE_ATTACH",
+    "PTRACE_DETACH",
+    "PTRACE_GETFPXREGS",
+    "PTRACE_SETFPXREGS",
+    "PTRACE_INVALID",
+    "PTRACE_INVALID",
+    "PTRACE_INVALID",
+    "PTRACE_INVALID",
+    "PTRACE_SYSCALL",
+};
+#endif
 
 /* XXX application state */
 static long                     nr_pages = 0;
diff -r dc50cdd66c5c -r 0ed4a312765b tools/libxc/xc_ptrace.h
--- a/tools/libxc/xc_ptrace.h   Tue Mar 14 20:10:21 2006
+++ b/tools/libxc/xc_ptrace.h   Tue Mar 14 20:50:35 2006
@@ -9,8 +9,6 @@
 #define BSD_PAGE_MASK (PAGE_SIZE-1)
 #define PDRSHIFT        22
 #define PSL_T  0x00000100 /* trace enable bit */
-
-extern const char const * ptrace_names[];
 
 struct gdb_regs {
     long ebx; /* 0 */
diff -r dc50cdd66c5c -r 0ed4a312765b tools/libxc/xenctrl.h
--- a/tools/libxc/xenctrl.h     Tue Mar 14 20:10:21 2006
+++ b/tools/libxc/xenctrl.h     Tue Mar 14 20:50:35 2006
@@ -139,9 +139,27 @@
                      uint32_t *pdomid);
 
 
+/* Functions to produce a dump of a given domain
+ *  xc_domain_dumpcore - produces a dump to a specified file
+ *  xc_domain_dumpcore_via_callback - produces a dump, using a specified
+ *                                    callback function
+ */
 int xc_domain_dumpcore(int xc_handle, 
                        uint32_t domid,
                        const char *corename);
+
+/* Define the callback function type for xc_domain_dumpcore_via_callback.
+ *
+ * This function is called by the coredump code for every "write",
+ * and passes an opaque object for the use of the function and
+ * created by the caller of xc_domain_dumpcore_via_callback.
+ */
+typedef int (dumpcore_rtn_t)(void *arg, char *buffer, unsigned int length);
+
+int xc_domain_dumpcore_via_callback(int xc_handle, 
+                                    uint32_t domid,
+                                    void *arg,
+                                    dumpcore_rtn_t dump_rtn);
 
 /*
  * This function sets the maximum number of vcpus that a domain may create.
@@ -372,13 +390,13 @@
                                           unsigned long nr_extents,
                                           unsigned int extent_order,
                                           unsigned int address_bits,
-                                         unsigned long *extent_start);
+                                          unsigned long *extent_start);
 
 int xc_domain_memory_decrease_reservation(int xc_handle,
                                           uint32_t domid, 
                                           unsigned long nr_extents,
                                           unsigned int extent_order,
-                                         unsigned long *extent_start);
+                                          unsigned long *extent_start);
 
 int xc_domain_memory_populate_physmap(int xc_handle,
                                       uint32_t domid,
@@ -411,7 +429,7 @@
                                uint8_t allow_access);
 
 unsigned long xc_make_page_below_4G(int xc_handle, uint32_t domid, 
-                                   unsigned long mfn);
+                                    unsigned long mfn);
 
 typedef dom0_perfc_desc_t xc_perfc_desc_t;
 /* IMPORTANT: The caller is responsible for mlock()'ing the @desc array. */
@@ -457,7 +475,7 @@
  * @parm virt the virtual address to translate
  */
 unsigned long xc_translate_foreign_address(int xc_handle, uint32_t dom,
-                                          int vcpu, unsigned long long virt);
+                                           int vcpu, unsigned long long virt);
 
 int xc_get_pfn_list(int xc_handle, uint32_t domid, unsigned long *pfn_buf, 
                     unsigned long max_pfns);
@@ -467,7 +485,7 @@
                          unsigned int start_page, unsigned int nr_pages);
 
 int xc_copy_to_domain_page(int xc_handle, uint32_t domid,
-                          unsigned long dst_pfn, void *src_page);
+                           unsigned long dst_pfn, const char *src_page);
 
 int xc_clear_domain_page(int xc_handle, uint32_t domid,
                          unsigned long dst_pfn);
@@ -478,7 +496,7 @@
 long xc_get_max_pages(int xc_handle, uint32_t domid);
 
 int xc_mmuext_op(int xc_handle, struct mmuext_op *op, unsigned int nr_ops,
-                domid_t dom);
+                 domid_t dom);
 
 int xc_memory_op(int xc_handle, int cmd, void *arg);
 
diff -r dc50cdd66c5c -r 0ed4a312765b tools/libxc/xenguest.h
--- a/tools/libxc/xenguest.h    Tue Mar 14 20:10:21 2006
+++ b/tools/libxc/xenguest.h    Tue Mar 14 20:50:35 2006
@@ -42,6 +42,22 @@
                      unsigned long *store_mfn, unsigned int console_evtchn,
                      unsigned long *console_mfn);
 
+/**
+ * This function will create a domain for a paravirtualized Linux
+ * using file names pointing to kernel and ramdisk
+ *
+ * @parm xc_handle a handle to an open hypervisor interface
+ * @parm domid the id of the domain
+ * @param image_name name of the kernel image file
+ * @param ramdisk_name name of the ramdisk image file
+ * @parm cmdline command line string
+ * @parm flags domain creation flags
+ * @parm store_evtchn the store event channel for this domain to use
+ * @parm store_mfn returned with the mfn of the store page
+ * @parm console_evtchn the console event channel for this domain to use
+ * @parm conole_mfn returned with the mfn of the console page
+ * @return 0 on success, -1 on failure
+ */
 int xc_linux_build(int xc_handle,
                    uint32_t domid,
                    const char *image_name,
@@ -54,6 +70,38 @@
                    unsigned int console_evtchn,
                    unsigned long *console_mfn);
 
+/**
+ * This function will create a domain for a paravirtualized Linux
+ * using buffers for kernel and initrd
+ *
+ * @param xc_handle a handle to an open hypervisor interface
+ * @param domid the id of the domain
+ * @param image_buffer buffer containing kernel image
+ * @param image_size size of the kernel image buffer
+ * @param initrd_buffer name of the ramdisk image file
+ * @param initrd_size size of the ramdisk buffer
+ * @param cmdline command line string
+ * @param flags domain creation flags
+ * @param store_evtchn the store event channel for this domain to use
+ * @param store_mfn returned with the mfn of the store page
+ * @param console_evtchn the console event channel for this domain to use
+ * @param conole_mfn returned with the mfn of the console page
+ * @return 0 on success, -1 on failure
+ */
+int xc_linux_build_mem(int xc_handle,
+                       uint32_t domid,
+                       const char *image_buffer,
+                       unsigned long image_size,
+                       const char *initrd_buffer,
+                       unsigned long initrd_size,
+                       const char *cmdline,
+                       const char *features,
+                       unsigned long flags,
+                       unsigned int store_evtchn,
+                       unsigned long *store_mfn,
+                       unsigned int console_evtchn,
+                       unsigned long *console_mfn);
+
 int xc_hvm_build(int xc_handle,
                  uint32_t domid,
                  int memsize,
@@ -65,4 +113,16 @@
                  unsigned int store_evtchn,
                  unsigned long *store_mfn);
 
-#endif // XENGUEST_H
+int xc_hvm_build_mem(int xc_handle,
+                     uint32_t domid,
+                     int memsize,
+                     const char *image_buffer,
+                     unsigned long image_size,
+                     unsigned int vcpus,
+                     unsigned int pae,
+                     unsigned int acpi,
+                     unsigned int apic,
+                     unsigned int store_evtchn,
+                     unsigned long *store_mfn);
+
+#endif /* XENGUEST_H */
diff -r dc50cdd66c5c -r 0ed4a312765b tools/libxc/xg_private.c
--- a/tools/libxc/xg_private.c  Tue Mar 14 20:10:21 2006
+++ b/tools/libxc/xg_private.c  Tue Mar 14 20:50:35 2006
@@ -10,15 +10,15 @@
 
 #include "xg_private.h"
 
-char *xc_read_kernel_image(const char *filename, unsigned long *size)
+char *xc_read_image(const char *filename, unsigned long *size)
 {
     int kernel_fd = -1;
     gzFile kernel_gfd = NULL;
     char *image = NULL;
     unsigned int bytes;
 
-    if ( filename == NULL )
-        goto out;
+    if ( (filename == NULL) || (size == NULL) )
+        return NULL;
 
     if ( (kernel_fd = open(filename, O_RDONLY)) < 0 )
     {
@@ -60,6 +60,62 @@
     return image;
 }
 
+char *xc_inflate_buffer(const char *in_buf, unsigned long in_size,
+                        unsigned long *out_size)
+{
+    int           sts;
+    z_stream      zStream;
+    unsigned long out_len;
+    char         *out_buf;
+
+    /* Not compressed? Then return the original buffer. */
+    if ( ((unsigned char)in_buf[0] != 0x1F) ||
+         ((unsigned char)in_buf[1] != 0x8B) )
+    {
+        if ( out_size != NULL )
+            *out_size = in_size;
+        return (char *)in_buf;
+    }
+
+    out_len = in_buf[in_size-4] +
+        (256 * (in_buf[in_size-3] +
+                (256 * (in_buf[in_size-2] +
+                        (256 * in_buf[in_size-1])))));
+    bzero(&zStream, sizeof(zStream));
+    out_buf = malloc(out_len + 16);        /* Leave a little extra space */
+    if ( out_buf == NULL )
+    {
+        ERROR("Error mallocing buffer\n");
+        return NULL;
+    }
+
+    zStream.next_in = (unsigned char *)in_buf;
+    zStream.avail_in = in_size;
+    zStream.next_out = (unsigned char *)out_buf;
+    zStream.avail_out = out_len+16;
+    sts = inflateInit2(&zStream, (MAX_WBITS+32)); /* +32 means "handle gzip" */
+    if ( sts != Z_OK )
+    {
+        ERROR("inflateInit failed, sts %d\n", sts);
+        free(out_buf);
+        return NULL;
+    }
+
+    /* Inflate in one pass/call */
+    sts = inflate(&zStream, Z_FINISH);
+    if ( sts != Z_STREAM_END )
+    {
+        ERROR("inflate failed, sts %d\n", sts);
+        free(out_buf);
+        return NULL;
+    }
+
+    if ( out_size != NULL )
+        *out_size = out_len;
+
+    return out_buf;
+}
+
 /*******************/
 
 int pin_table(
@@ -77,7 +133,7 @@
 }
 
 /* This is shared between save and restore, and may generally be useful. */
-unsigned long csum_page (void * page)
+unsigned long csum_page(void *page)
 {
     int i;
     unsigned long *p = page;
diff -r dc50cdd66c5c -r 0ed4a312765b tools/libxc/xg_private.h
--- a/tools/libxc/xg_private.h  Tue Mar 14 20:10:21 2006
+++ b/tools/libxc/xg_private.h  Tue Mar 14 20:50:35 2006
@@ -26,7 +26,11 @@
 #endif
 
 
-char *xc_read_kernel_image(const char *filename, unsigned long *size);
+char *xc_read_image(const char *filename, unsigned long *size);
+char *xc_inflate_buffer(const char *in_buf,
+                        unsigned long in_size,
+                        unsigned long *out_size);
+
 unsigned long csum_page (void * page);
 
 #define _PAGE_PRESENT   0x001
@@ -89,7 +93,7 @@
 #define l2_table_offset_pae(_a) \
   (((_a) >> L2_PAGETABLE_SHIFT_PAE) & (L2_PAGETABLE_ENTRIES_PAE - 1))
 #define l3_table_offset_pae(_a) \
-       (((_a) >> L3_PAGETABLE_SHIFT_PAE) & (L3_PAGETABLE_ENTRIES_PAE - 1))
+  (((_a) >> L3_PAGETABLE_SHIFT_PAE) & (L3_PAGETABLE_ENTRIES_PAE - 1))
 
 #if defined(__i386__)
 #define l1_table_offset(_a) \
@@ -102,9 +106,9 @@
 #define l2_table_offset(_a) \
   (((_a) >> L2_PAGETABLE_SHIFT) & (L2_PAGETABLE_ENTRIES - 1))
 #define l3_table_offset(_a) \
-       (((_a) >> L3_PAGETABLE_SHIFT) & (L3_PAGETABLE_ENTRIES - 1))
+  (((_a) >> L3_PAGETABLE_SHIFT) & (L3_PAGETABLE_ENTRIES - 1))
 #define l4_table_offset(_a) \
-       (((_a) >> L4_PAGETABLE_SHIFT) & (L4_PAGETABLE_ENTRIES - 1))
+  (((_a) >> L4_PAGETABLE_SHIFT) & (L4_PAGETABLE_ENTRIES - 1))
 #endif
 
 #define ERROR(_m, _a...)                                \
@@ -141,11 +145,12 @@
     char *xen_guest_string;
 };
 
-typedef int (*parseimagefunc)(char *image, unsigned long image_size,
-                             struct domain_setup_info *dsi);
-typedef int (*loadimagefunc)(char *image, unsigned long image_size, int xch,
-                            uint32_t dom, unsigned long *parray,
-                            struct domain_setup_info *dsi);
+typedef int (*parseimagefunc)(const char *image, unsigned long image_size,
+                              struct domain_setup_info *dsi);
+typedef int (*loadimagefunc)(const char *image, unsigned long image_size,
+                             int xch,
+                             uint32_t dom, unsigned long *parray,
+                             struct domain_setup_info *dsi);
 
 struct load_funcs
 {
@@ -167,21 +172,24 @@
 } mfn_mapper_t;
 
 int xc_copy_to_domain_page(int xc_handle, uint32_t domid,
-                            unsigned long dst_pfn, void *src_page);
+                            unsigned long dst_pfn, const char *src_page);
 
 unsigned long xc_get_filesz(int fd);
 
-void xc_map_memcpy(unsigned long dst, char *src, unsigned long size,
+void xc_map_memcpy(unsigned long dst, const char *src, unsigned long size,
                    int xch, uint32_t dom, unsigned long *parray,
                    unsigned long vstart);
 
 int pin_table(int xc_handle, unsigned int type, unsigned long mfn,
-             domid_t dom);
+              domid_t dom);
 
 /* image loading */
-int probe_elf(char *image, unsigned long image_size, struct load_funcs *funcs);
-int probe_bin(char *image, unsigned long image_size, struct load_funcs *funcs);
-int probe_aout9(char *image, unsigned long image_size, struct load_funcs 
*funcs);
+int probe_elf(const char *image, unsigned long image_size,
+              struct load_funcs *funcs);
+int probe_bin(const char *image, unsigned long image_size,
+              struct load_funcs *funcs);
+int probe_aout9(const char *image, unsigned long image_size,
+                struct load_funcs *funcs);
 
 #endif
 
diff -r dc50cdd66c5c -r 0ed4a312765b tools/misc/Makefile
--- a/tools/misc/Makefile       Tue Mar 14 20:10:21 2006
+++ b/tools/misc/Makefile       Tue Mar 14 20:50:35 2006
@@ -5,7 +5,7 @@
 XEN_ROOT=../..
 include $(XEN_ROOT)/tools/Rules.mk
 
-CFLAGS   += -Wall -Werror -O3 
+CFLAGS   += -Werror
 
 INCLUDES += -I $(XEN_XC)
 INCLUDES += -I $(XEN_LIBXC)
diff -r dc50cdd66c5c -r 0ed4a312765b tools/misc/cpuperf/Makefile
--- a/tools/misc/cpuperf/Makefile       Tue Mar 14 20:10:21 2006
+++ b/tools/misc/cpuperf/Makefile       Tue Mar 14 20:50:35 2006
@@ -16,8 +16,6 @@
 # these are for Xen
 XEN_ROOT=../../..
 include $(XEN_ROOT)/tools/Rules.mk
-
-CFLAGS      += -Wall -O3 
 
 HDRS         = $(wildcard *.h)
 SRCS         = $(wildcard *.c)
diff -r dc50cdd66c5c -r 0ed4a312765b tools/misc/cpuperf/cpuperf_xeno.h
--- a/tools/misc/cpuperf/cpuperf_xeno.h Tue Mar 14 20:10:21 2006
+++ b/tools/misc/cpuperf/cpuperf_xeno.h Tue Mar 14 20:50:35 2006
@@ -13,7 +13,7 @@
 
 static int xc_handle;
 
-void xen_init()
+void xen_init(void)
 {
     if ( (xc_handle = xc_interface_open()) == -1 )
     {
@@ -24,12 +24,12 @@
 
 }
 
-void dom0_wrmsr( int cpu_mask, int msr, unsigned int low, unsigned int high )
+void dom0_wrmsr(int cpu_mask, int msr, unsigned int low, unsigned int high)
 {
     xc_msr_write (xc_handle, cpu_mask, msr, low, high);
 }
 
-unsigned long long dom0_rdmsr( int cpu_mask, int msr )
+unsigned long long dom0_rdmsr(int cpu_mask, int msr)
 {
     return xc_msr_read(xc_handle, cpu_mask, msr);
 }
diff -r dc50cdd66c5c -r 0ed4a312765b tools/misc/lomount/Makefile
--- a/tools/misc/lomount/Makefile       Tue Mar 14 20:10:21 2006
+++ b/tools/misc/lomount/Makefile       Tue Mar 14 20:50:35 2006
@@ -6,7 +6,7 @@
 XEN_ROOT=../../..
 include $(XEN_ROOT)/tools/Rules.mk
 
-CFLAGS  += -Wall -Werror -O3
+CFLAGS  += -Werror
 
 HDRS     = $(wildcard *.h)
 OBJS     = $(patsubst %.c,%.o,$(wildcard *.c))
diff -r dc50cdd66c5c -r 0ed4a312765b tools/misc/lomount/lomount.c
--- a/tools/misc/lomount/lomount.c      Tue Mar 14 20:10:21 2006
+++ b/tools/misc/lomount/lomount.c      Tue Mar 14 20:50:35 2006
@@ -195,7 +195,7 @@
        return fail;
 }
 
-void usage()
+void usage(void)
 {
        fprintf(stderr, "You must specify at least -diskimage and 
-partition.\n");
        fprintf(stderr, "All other arguments are passed through to 'mount'.\n");
diff -r dc50cdd66c5c -r 0ed4a312765b tools/misc/mbootpack/Makefile
--- a/tools/misc/mbootpack/Makefile     Tue Mar 14 20:10:21 2006
+++ b/tools/misc/mbootpack/Makefile     Tue Mar 14 20:50:35 2006
@@ -20,10 +20,8 @@
 INCS   := -I. -I-
 DEFS   := 
 LDFLAGS        := 
-CFLAGS := -Wall -Wpointer-arith -Wcast-qual -Wno-unused -Wno-format
-CFLAGS += -Wmissing-prototypes
-#CFLAGS        += -pipe -g -O0 -Wcast-align
-CFLAGS += -pipe -O3 
+CFLAGS += -Wpointer-arith -Wcast-qual -Wno-unused -Wno-format
+CFLAGS += -Wmissing-prototypes -pipe
 
 #  What object files need building for the program
 OBJS   := mbootpack.o buildimage.o
@@ -33,7 +31,7 @@
 DEPS     = .*.d
 
 mbootpack: $(OBJS)
-       $(HOSTCC) -o $@ $(filter-out %.a, $^) $(LDFLAGS)
+       $(HOSTCC) -o $@ $(filter-out %.a, $^)
 
 clean:
        $(RM) mbootpack *.o $(DEPS) bootsect setup bzimage_header.c bin2c
diff -r dc50cdd66c5c -r 0ed4a312765b tools/misc/miniterm/Makefile
--- a/tools/misc/miniterm/Makefile      Tue Mar 14 20:10:21 2006
+++ b/tools/misc/miniterm/Makefile      Tue Mar 14 20:50:35 2006
@@ -1,9 +1,10 @@
+XEN_ROOT:=../../..
+include $(XEN_ROOT)/tools/Rules.mk
+
 INSTALL                = install
 INSTALL_PROG   = $(INSTALL) -m0755
 INSTALL_DIR    = $(INSTALL) -d -m0755
 
-CC     = gcc
-CFLAGS = -Wall -O3
 TARGET = miniterm
 
 all: $(TARGET)
@@ -16,4 +17,4 @@
        $(RM) *.o $(TARGET) *~
 
 $(TARGET): $(TARGET).c
-       $(CC) $(CFLAGS) -o $@ $<
+       $(HOSTCC) $(HOSTCFLAGS) -o $@ $<
diff -r dc50cdd66c5c -r 0ed4a312765b tools/misc/nsplitd/Makefile
--- a/tools/misc/nsplitd/Makefile       Tue Mar 14 20:10:21 2006
+++ b/tools/misc/nsplitd/Makefile       Tue Mar 14 20:50:35 2006
@@ -1,6 +1,6 @@
+XEN_ROOT := ../../..
+include $(XEN_ROOT)/tools/Rules.mk
 
-CC     = gcc
-CFLAGS = -Wall -O3
 CFILES = $(wildcard *.c)
 
 HDRS     = $(wildcard *.h)
@@ -16,7 +16,7 @@
        $(RM) *.o $(TARGET) *~
 
 $(TARGET): $(OBJS)
-       $(CC) $(CFLAGS) -o $@ $^
+       $(HOSTCC) $(HOSTCFLAGS) -o $@ $^
 
 %.o: %.c $(HDRS) Makefile
-       $(CC) $(CFLAGS) -c -o $@ $<
+       $(HOSTCC) $(HOSTCFLAGS) -c -o $@ $<
diff -r dc50cdd66c5c -r 0ed4a312765b tools/misc/xc_shadow.c
--- a/tools/misc/xc_shadow.c    Tue Mar 14 20:10:21 2006
+++ b/tools/misc/xc_shadow.c    Tue Mar 14 20:50:35 2006
@@ -18,7 +18,7 @@
 #include <errno.h>
 #include <string.h>
 
-void usage()
+void usage(void)
 {
     printf("xc_shadow: -[0|1|2]\n");
     printf("    set shadow mode\n");
@@ -28,7 +28,7 @@
 int main(int argc, char *argv[])
 {
     int xc_handle;
-    int mode;
+    int mode = 0;
 
     if ( argc > 1 )
     {
diff -r dc50cdd66c5c -r 0ed4a312765b tools/python/Makefile
--- a/tools/python/Makefile     Tue Mar 14 20:10:21 2006
+++ b/tools/python/Makefile     Tue Mar 14 20:50:35 2006
@@ -9,10 +9,10 @@
 
 ifndef XEN_PYTHON_NATIVE_INSTALL
 install: all
-       CFLAGS="$(CFLAGS)" python setup.py install --home="$(DESTDIR)/usr"
+       CFLAGS="$(CFLAGS)" python setup.py install --home="$(DESTDIR)/usr" 
--force
 else
 install: all
-       CFLAGS="$(CFLAGS)" python setup.py install --root="$(DESTDIR)"
+       CFLAGS="$(CFLAGS)" python setup.py install --root="$(DESTDIR)" --force
 endif
 
 test:
diff -r dc50cdd66c5c -r 0ed4a312765b tools/python/xen/web/httpserver.py
--- a/tools/python/xen/web/httpserver.py        Tue Mar 14 20:10:21 2006
+++ b/tools/python/xen/web/httpserver.py        Tue Mar 14 20:50:35 2006
@@ -13,7 +13,9 @@
 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 #============================================================================
 # Copyright (C) 2005 Mike Wray <mike.wray@xxxxxx>
+# Copyright (C) 2006 XenSource Ltd.
 #============================================================================
+
 import threading
 
 import string
@@ -28,6 +30,7 @@
 from xen.xend.XendError import XendError
 
 import http
+import unix
 from resource import Resource, ErrorPage
 from SrvDir import SrvDir
 
@@ -267,30 +270,27 @@
 
     closed = False
 
-    def __init__(self, interface='', port=8080, root=None):
-        if root is None:
-            root = SrvDir()
+    def __init__(self, root, interface, port=8080):
+        self.root = root
         self.interface = interface
         self.port = port
-        self.root = root
         # ready indicates when we are ready to begin accept connections
         # it should be set after a successful bind
         self.ready = False
-
-    def getRoot(self):
-        return self.root
-
-    def getPort(self):
-        return self.port
 
     def run(self):
         self.bind()
         self.listen()
         self.ready = True
-        self.requestLoop()
+
+        while not self.closed:
+            (sock, addr) = self.accept()
+            self.processRequest(sock, addr)
+
 
     def stop(self):
         self.close()
+
 
     def bind(self):
         self.socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
@@ -303,23 +303,12 @@
     def accept(self):
         return self.socket.accept()
 
-    def requestLoop(self):
-        while not self.closed:
-            self.acceptRequest()
-
     def close(self):
         self.closed = True
         try:
             self.socket.close()
         except:
             pass
-
-    def acceptRequest(self):
-        try:
-            (sock, addr) = self.accept()
-            self.processRequest(sock, addr)
-        except socket.error:
-            return
 
     def processRequest(self, sock, addr):
         try:
@@ -340,23 +329,12 @@
     def getResource(self, req):
         return self.root.getRequestResource(req)
 
+
 class UnixHttpServer(HttpServer):
 
-    def __init__(self, path=None, root=None):
-        HttpServer.__init__(self, interface='localhost', root=root)
+    def __init__(self, root, path):
+        HttpServer.__init__(self, root, 'localhost')
         self.path = path
         
     def bind(self):
-        pathdir = os.path.dirname(self.path)
-        if not os.path.exists(pathdir):
-            os.makedirs(pathdir)
-        else:
-            try:
-                os.unlink(self.path)
-            except SystemExit:
-                raise
-            except Exception, ex:
-                pass
-        self.socket = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-        #self.socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-        self.socket.bind(self.path)
+        self.socket = unix.bind(self.path)
diff -r dc50cdd66c5c -r 0ed4a312765b tools/python/xen/web/unix.py
--- a/tools/python/xen/web/unix.py      Tue Mar 14 20:10:21 2006
+++ b/tools/python/xen/web/unix.py      Tue Mar 14 20:50:35 2006
@@ -13,15 +13,34 @@
 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 #============================================================================
 # Copyright (C) 2005 Mike Wray <mike.wray@xxxxxx>
-# Copyright (C) 2005 XenSource Ltd.
+# Copyright (C) 2005-2006 XenSource Ltd.
 #============================================================================
 
 
-import socket
 import os
 import os.path
+import socket
+import stat
 
 import connection
+
+
+def bind(path):
+    """Create a Unix socket, and bind it to the given path.  The socket is
+created such that only the current user may access it."""
+
+    parent = os.path.dirname(path)
+    if os.path.exists(parent):
+        os.chown(parent, os.geteuid(), os.getegid())
+        os.chmod(parent, stat.S_IRWXU)
+        if os.path.exists(path):
+            os.unlink(path)
+    else:
+        os.makedirs(parent, stat.S_IRWXU)
+
+    sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+    sock.bind(path)
+    return sock
 
 
 class UnixListener(connection.SocketListener):
@@ -31,19 +50,7 @@
 
 
     def createSocket(self):
-        pathdir = os.path.dirname(self.path)
-        if not os.path.exists(pathdir):
-            os.makedirs(pathdir)
-        else:
-            try:
-                os.unlink(self.path)
-            except SystemExit:
-                raise
-            except Exception, ex:
-                pass
-        sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-        sock.bind(self.path)
-        return sock
+        return bind(self.path)
 
 
     def acceptConnection(self, sock, _):
diff -r dc50cdd66c5c -r 0ed4a312765b tools/python/xen/xend/XendDomain.py
--- a/tools/python/xen/xend/XendDomain.py       Tue Mar 14 20:10:21 2006
+++ b/tools/python/xen/xend/XendDomain.py       Tue Mar 14 20:50:35 2006
@@ -487,7 +487,17 @@
         """
         dominfo = self.domain_lookup(domid)
         try:
-            return xc.sedf_domain_get(dominfo.getDomid())
+            
+            sedf_info = xc.sedf_domain_get(dominfo.getDomid())
+            # return sxpr
+            return ['sedf',
+                    ['domain',    sedf_info['domain']],
+                    ['period',    sedf_info['period']],
+                    ['slice',     sedf_info['slice']],
+                    ['latency',   sedf_info['latency']],
+                    ['extratime', sedf_info['extratime']],
+                    ['weight',    sedf_info['weight']]]
+
         except Exception, ex:
             raise XendError(str(ex))
 
diff -r dc50cdd66c5c -r 0ed4a312765b tools/python/xen/xend/XendDomainInfo.py
--- a/tools/python/xen/xend/XendDomainInfo.py   Tue Mar 14 20:10:21 2006
+++ b/tools/python/xen/xend/XendDomainInfo.py   Tue Mar 14 20:50:35 2006
@@ -1580,10 +1580,11 @@
     controllerClasses[device_class] = cls
 
 
-from xen.xend.server import blkif, netif, tpmif, pciif, iopif, usbif
+from xen.xend.server import blkif, netif, tpmif, pciif, iopif, irqif, usbif
 addControllerClass('vbd',  blkif.BlkifController)
 addControllerClass('vif',  netif.NetifController)
 addControllerClass('vtpm', tpmif.TPMifController)
 addControllerClass('pci',  pciif.PciController)
 addControllerClass('ioports', iopif.IOPortsController)
+addControllerClass('irq',  irqif.IRQController)
 addControllerClass('usb',  usbif.UsbifController)
diff -r dc50cdd66c5c -r 0ed4a312765b tools/python/xen/xend/XendLogging.py
--- a/tools/python/xen/xend/XendLogging.py      Tue Mar 14 20:10:21 2006
+++ b/tools/python/xen/xend/XendLogging.py      Tue Mar 14 20:50:35 2006
@@ -13,7 +13,7 @@
 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 #============================================================================
 # Copyright (C) 2004, 2005 Mike Wray <mike.wray@xxxxxx>
-# Copyright (C) 2005 XenSource Ltd
+# Copyright (C) 2005, 2006 XenSource Ltd.
 #============================================================================
 
 
@@ -22,9 +22,10 @@
 import logging
 import logging.handlers
 
+from xen.xend.server import params
 
-__all__ = [ 'log', 'init', 'getLogFilename', 'addLogStderr',
-            'removeLogStderr' ]
+
+__all__ = [ 'log', 'init', 'getLogFilename' ]
 
 
 if not 'TRACE' in logging.__dict__:
@@ -38,37 +39,28 @@
 log = logging.getLogger("xend")
 
 
-DEFAULT_MAX_BYTES = 1 << 20  # 1MB
-DEFAULT_BACKUP_COUNT = 5
+MAX_BYTES = 1 << 20  # 1MB
+BACKUP_COUNT = 5
 
 STDERR_FORMAT = "[%(name)s] %(levelname)s (%(module)s:%(lineno)d) %(message)s"
 LOGFILE_FORMAT = "[%(asctime)s %(name)s] %(levelname)s (%(module)s:%(lineno)d) 
%(message)s"
 DATE_FORMAT = "%Y-%m-%d %H:%M:%S"
 
 
-stderrHandler = logging.StreamHandler()
-stderrHandler.setFormatter(logging.Formatter(STDERR_FORMAT, DATE_FORMAT))
-
 logfilename = None
 
 
-def init(filename, level=logging.INFO, maxBytes=None, backupCount=None):
-    """Initialise logging. Logs to 'filename' by default, but does not log to
-    stderr unless addLogStderr() is called.
+def init(filename, level):
+    """Initialise logging.  Logs to the given filename, and logs to stderr if
+    XEND_DEBUG is set.
     """
 
     global logfilename
 
     def openFileHandler(fname):
-        return logging.handlers.RotatingFileHandler(fname,
-                                                    mode='a',
-                                                    maxBytes=maxBytes,
-                                                    backupCount=backupCount)
-
-    if not maxBytes:
-        maxBytes = DEFAULT_MAX_BYTES
-    if not backupCount:
-        backupCount = DEFAULT_BACKUP_COUNT
+        return logging.handlers.RotatingFileHandler(fname, mode = 'a',
+                                                    maxBytes = MAX_BYTES,
+                                                    backupCount = BACKUP_COUNT)
 
     # Rather unintuitively, getLevelName will get the number corresponding to
     # a level name, as well as getting the name corresponding to a level
@@ -89,16 +81,12 @@
     fileHandler.setFormatter(logging.Formatter(LOGFILE_FORMAT, DATE_FORMAT))
     log.addHandler(fileHandler)
 
+    if params.XEND_DEBUG:
+        stderrHandler = logging.StreamHandler()
+        stderrHandler.setFormatter(logging.Formatter(STDERR_FORMAT,
+                                                     DATE_FORMAT))
+        log.addHandler(stderrHandler)
+
 
 def getLogFilename():
     return logfilename
-
-
-def addLogStderr():
-    """Add logging to stderr."""
-    log.addHandler(stderrHandler)
-
-
-def removeLogStderr():
-    """Remove logging to stderr."""
-    log.removeHandler(stderrHandler)
diff -r dc50cdd66c5c -r 0ed4a312765b tools/python/xen/xend/XendRoot.py
--- a/tools/python/xen/xend/XendRoot.py Tue Mar 14 20:10:21 2006
+++ b/tools/python/xen/xend/XendRoot.py Tue Mar 14 20:50:35 2006
@@ -102,15 +102,14 @@
         """
         print >>sys.stderr, "xend [ERROR]", fmt % args
 
+
     def configure(self):
         self.set_config()
-        logfile = self.get_config_value("logfile", self.logfile_default)
-        loglevel = self.get_config_value("loglevel", self.loglevel_default)
-        XendLogging.init(logfile, level = loglevel)
-
-        from xen.xend.server import params
-        if params.XEND_DEBUG:
-            XendLogging.addLogStderr()
+        XendLogging.init(self.get_config_value("logfile",
+                                               self.logfile_default),
+                         self.get_config_value("loglevel",
+                                               self.loglevel_default))
+
 
     def set_config(self):
         """If the config file exists, read it. If not, ignore it.
diff -r dc50cdd66c5c -r 0ed4a312765b tools/python/xen/xend/balloon.py
--- a/tools/python/xen/xend/balloon.py  Tue Mar 14 20:10:21 2006
+++ b/tools/python/xen/xend/balloon.py  Tue Mar 14 20:50:35 2006
@@ -27,7 +27,8 @@
 from XendError import VmError
 
 
-PROC_XEN_BALLOON = "/proc/xen/balloon"
+PROC_XEN_BALLOON = '/proc/xen/balloon'
+
 BALLOON_OUT_SLACK = 1 # MiB.  We need this because the physinfo details are
                       # rounded.
 RETRY_LIMIT = 10
@@ -39,6 +40,47 @@
 # such requirements.
 SLEEP_TIME_GROWTH = 0.1
 
+# A mapping between easy-to-remember labels and the more verbose
+# label actually shown in the PROC_XEN_BALLOON file.
+labels = { 'current'      : 'Current allocation',
+           'target'       : 'Requested target',
+           'low-balloon'  : 'Low-mem balloon',
+           'high-balloon' : 'High-mem balloon',
+           'limit'        : 'Xen hard limit' }
+
+def _get_proc_balloon(label):
+    """Returns the value for the named label.  Returns None if the label was
+       not found or the value was non-numeric."""
+
+    f = file(PROC_XEN_BALLOON, 'r')
+    try:
+        for line in f:
+            keyvalue = line.split(':')
+            if keyvalue[0] == label:
+                values = keyvalue[1].split()
+                if values[0].isdigit():
+                    return int(values[0])
+                else:
+                    return None
+        return None
+    finally:
+        f.close()
+
+def get_dom0_current_alloc():
+    """Returns the current memory allocation (in MiB) of dom0."""
+
+    kb = _get_proc_balloon(labels['current'])
+    if kb == None:
+        raise VmError('Failed to query current memory allocation of dom0.')
+    return kb / 1024
+
+def get_dom0_target_alloc():
+    """Returns the target memory allocation (in MiB) of dom0."""
+
+    kb = _get_proc_balloon(labels['target'])
+    if kb == None:
+        raise VmError('Failed to query target memory allocation of dom0.')
+    return kb / 1024
 
 def free(required):
     """Balloon out memory from the privileged domain so that there is the
@@ -88,7 +130,7 @@
                 log.debug("Balloon: free %d; need %d.", free_mem, need_mem)
 
             if dom0_min_mem > 0:
-                dom0_alloc = _get_dom0_alloc()
+                dom0_alloc = get_dom0_current_alloc()
                 new_alloc = dom0_alloc - (need_mem - free_mem)
 
                 if (new_alloc >= dom0_min_mem and
@@ -121,20 +163,3 @@
 
     finally:
         del xc
-
-
-def _get_dom0_alloc():
-    """Return current allocation memory of dom0 (in MiB). Return 0 on error"""
-
-    f = file(PROC_XEN_BALLOON, 'r')
-    try:
-        line = f.readline()
-        for x in line.split():
-            for n in x:
-                if not n.isdigit():
-                    break
-            else:
-                return int(x) / 1024
-        return 0
-    finally:
-        f.close()
diff -r dc50cdd66c5c -r 0ed4a312765b tools/python/xen/xend/server/SrvServer.py
--- a/tools/python/xen/xend/server/SrvServer.py Tue Mar 14 20:10:21 2006
+++ b/tools/python/xen/xend/server/SrvServer.py Tue Mar 14 20:50:35 2006
@@ -13,6 +13,7 @@
 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 #============================================================================
 # Copyright (C) 2004, 2005 Mike Wray <mike.wray@xxxxxx>
+# Copyright (C) 2006 XenSource Ltd.
 #============================================================================
 
 """Example xend HTTP
@@ -106,11 +107,11 @@
     root.putChild('xend', SrvRoot())
     servers = XendServers()
     if xroot.get_xend_http_server():
-        port = xroot.get_xend_port()
-        interface = xroot.get_xend_address()
-        servers.add(HttpServer(root=root, interface=interface, port=port))
+        servers.add(HttpServer(root,
+                               xroot.get_xend_address(),
+                               xroot.get_xend_port()))
     if xroot.get_xend_unix_server():
         path = xroot.get_xend_unix_path()
         log.info('unix path=' + path)
-        servers.add(UnixHttpServer(path=path, root=root))
+        servers.add(UnixHttpServer(root, path))
     return servers
diff -r dc50cdd66c5c -r 0ed4a312765b tools/python/xen/xend/server/iopif.py
--- a/tools/python/xen/xend/server/iopif.py     Tue Mar 14 20:10:21 2006
+++ b/tools/python/xen/xend/server/iopif.py     Tue Mar 14 20:50:35 2006
@@ -83,4 +83,4 @@
                 'ioports: Failed to configure legacy i/o range: %s - %s' %
                 (io_from, io_to))
 
-        return (dev, {}, {})
+        return (None, {}, {})
diff -r dc50cdd66c5c -r 0ed4a312765b tools/python/xen/xend/server/netif.py
--- a/tools/python/xen/xend/server/netif.py     Tue Mar 14 20:10:21 2006
+++ b/tools/python/xen/xend/server/netif.py     Tue Mar 14 20:50:35 2006
@@ -72,8 +72,6 @@
                               sxp.child_value(config, 'script',
                                               xroot.get_vif_script()))
         typ = sxp.child_value(config, 'type')
-        if typ == 'ioemu':
-            return (None,{},{})
         bridge  = sxp.child_value(config, 'bridge')
         mac     = sxp.child_value(config, 'mac')
         vifname = sxp.child_value(config, 'vifname')
@@ -87,15 +85,19 @@
         back = { 'script' : script,
                  'mac'    : mac,
                  'handle' : "%i" % devid }
+
+        if typ == 'ioemu':
+            front = {}
+            back['type'] = 'ioemu'
+        else:
+            front = { 'handle' : "%i" % devid,
+                      'mac'    : mac }
         if ipaddr:
             back['ip'] = ' '.join(ipaddr)
         if bridge:
             back['bridge'] = bridge
         if vifname:
             back['vifname'] = vifname
-
-        front = { 'handle' : "%i" % devid,
-                  'mac'    : mac }
 
         return (devid, back, front)
 
diff -r dc50cdd66c5c -r 0ed4a312765b tools/python/xen/xm/create.py
--- a/tools/python/xen/xm/create.py     Tue Mar 14 20:10:21 2006
+++ b/tools/python/xen/xm/create.py     Tue Mar 14 20:50:35 2006
@@ -252,14 +252,20 @@
 gopts.var('pci', val='BUS:DEV.FUNC',
           fn=append_value, default=[],
           use="""Add a PCI device to a domain, using given params (in hex).
-         For example '-pci c0:02.1a'.
+         For example 'pci=c0:02.1a'.
          The option may be repeated to add more than one pci device.""")
 
 gopts.var('ioports', val='FROM[-TO]',
           fn=append_value, default=[],
           use="""Add a legacy I/O range to a domain, using given params (in 
hex).
-         For example '-ioports 02f8-02ff'.
+         For example 'ioports=02f8-02ff'.
          The option may be repeated to add more than one i/o range.""")
+
+gopts.var('irq', val='IRQ',
+          fn=append_value, default=[],
+          use="""Add an IRQ (interrupt line) to a domain.
+         For example 'irq=7'.
+         This option may be repeated to add more than one IRQ.""")
 
 gopts.var('usb', val='PATH',
           fn=append_value, default=[],
@@ -487,6 +493,13 @@
     for (io_from, io_to) in vals.ioports:
         config_ioports = ['ioports', ['from', io_from], ['to', io_to]]
         config_devs.append(['device', config_ioports])
+
+def configure_irq(config_devs, vals):
+    """Create the config for irqs.
+    """
+    for irq in vals.irq:
+        config_irq = ['irq', ['irq', irq]]
+        config_devs.append(['device', config_irq])
 
 def configure_usb(config_devs, vals):
     for path in vals.usb:
@@ -615,6 +628,7 @@
     configure_disks(config_devs, vals)
     configure_pci(config_devs, vals)
     configure_ioports(config_devs, vals)
+    configure_irq(config_devs, vals)
     configure_vifs(config_devs, vals)
     configure_usb(config_devs, vals)
     configure_vtpm(config_devs, vals)
diff -r dc50cdd66c5c -r 0ed4a312765b tools/python/xen/xm/main.py
--- a/tools/python/xen/xm/main.py       Tue Mar 14 20:10:21 2006
+++ b/tools/python/xen/xm/main.py       Tue Mar 14 20:50:35 2006
@@ -83,7 +83,18 @@
                                     parameters"""
 sched_bvt_ctxallow_help = """sched-bvt-ctxallow <Allow>       Set the BVT 
scheduler context switch
                                     allowance"""
-sched_sedf_help = "sched-sedf <Parameters>          Set simple EDF parameters"
+sched_sedf_help = "sched-sedf [DOM] [OPTIONS]       Show|Set simple EDF 
parameters\n" + \
+"              -p, --period          Relative deadline(ms).\n\
+              -s, --slice           Worst-case execution time(ms)\n\
+                                    (slice < period).\n\
+              -l, --latency         scaled period(ms) in case the domain\n\
+                                    is doing heavy I/O.\n\
+              -e, --extra           flag (0/1) which controls whether the\n\
+                                    domain can run in extra-time\n\
+              -w, --weight          mutually exclusive with period/slice and\n\
+                                    specifies another way of setting a 
domain's\n\
+                                    cpu period/slice."
+
 block_attach_help = """block-attach <DomId> <BackDev> <FrontDev> <Mode>
                 [BackDomId]         Create a new virtual block device"""
 block_detach_help = """block-detach  <DomId> <DevId>    Destroy a domain's 
virtual block device,
@@ -148,8 +159,7 @@
 host_commands = [
     "dmesg",
     "info",
-    "log",
-    "top",
+    "log"
     ]
 
 scheduler_commands = [
@@ -374,6 +384,20 @@
         'state'    : get_info('state',        str,   '??'),
         'cpu_time' : get_info('cpu_time',     float, 0),
         'ssidref'  : get_info('ssidref',      int,   0),
+        }
+
+
+def parse_sedf_info(info):
+    def get_info(n, t, d):
+        return t(sxp.child_value(info, n, d))
+
+    return {
+        'dom'      : get_info('domain',        int,   -1),
+        'period'   : get_info('period',        int,   -1),
+        'slice'    : get_info('slice',         int,   -1),
+        'latency'  : get_info('latency',       int,   -1),
+        'extratime': get_info('extratime',     int,   -1),
+        'weight'   : get_info('weight',        int,   -1),
         }
 
 
@@ -617,12 +641,86 @@
     server.xend_node_cpu_bvt_slice_set(slice)
 
 def xm_sched_sedf(args):
-    arg_check(args, "sched-sedf", 6)
-    
-    dom = args[0]
-    v = map(int, args[1:6])
-    from xen.xend.XendClient import server
-    server.xend_domain_cpu_sedf_set(dom, *v)
+    def ns_to_ms(val):
+        return float(val) * 0.000001
+    
+    def ms_to_ns(val):
+        return (float(val) / 0.000001)
+
+    def print_sedf(info):
+        info['period']  = ns_to_ms(info['period'])
+        info['slice']   = ns_to_ms(info['slice'])
+        info['latency'] = ns_to_ms(info['latency'])
+        print( ("%(name)-32s %(dom)3d %(period)9.1f %(slice)9.1f" +
+                " %(latency)7.1f %(extratime)6d %(weight)6d") % info)
+
+    def domid_match(domid, info):
+        return domid is None or domid == info['name'] or domid == 
str(info['dom'])
+
+    # we want to just display current info if no parameters are passed
+    if len(args) == 0:
+        domid = None
+    else:
+        # we expect at least a domain id (name or number)
+        # and at most a domid up to 5 options with values
+        arg_check(args, "sched-sedf", 1, 11)
+        domid = args[0]
+        # drop domid from args since get_opt doesn't recognize it
+        args = args[1:] 
+
+    opts = {}
+    try:
+        (options, params) = getopt.gnu_getopt(args, 'p:s:l:e:w:',
+            ['period=', 'slice=', 'latency=', 'extratime=', 'weight='])
+    except getopt.GetoptError, opterr:
+        err(opterr)
+        sys.exit(1)
+    
+    # convert to nanoseconds if needed 
+    for (k, v) in options:
+        if k in ['-p', '--period']:
+            opts['period'] = ms_to_ns(v)
+        elif k in ['-s', '--slice']:
+            opts['slice'] = ms_to_ns(v)
+        elif k in ['-l', '--latency']:
+            opts['latency'] = ms_to_ns(v)
+        elif k in ['-e', '--extratime']:
+            opts['extratime'] = v
+        elif k in ['-w', '--weight']:
+            opts['weight'] = v
+
+    # print header if we aren't setting any parameters
+    if len(opts.keys()) == 0:
+        print '%-33s %-2s %-4s %-4s %-7s %-5s %-6s'%('Name','ID','Period(ms)',
+                                                     'Slice(ms)', 'Lat(ms)',
+                                                     'Extra','Weight')
+
+    from xen.xend.XendClient import server
+    doms = filter(lambda x : domid_match(domid, x),
+                        [parse_doms_info(dom) for dom in getDomains("")])
+    for d in doms:
+        # fetch current values so as not to clobber them
+        sedf_info = \
+            parse_sedf_info(server.xend_domain_cpu_sedf_get(d['dom']))
+        sedf_info['name'] = d['name']
+
+        # update values in case of call to set
+        if len(opts.keys()) > 0:
+            for k in opts.keys():
+                sedf_info[k]=opts[k]
+         
+            # send the update, converting user input
+            v = map(int, [sedf_info['period'], sedf_info['slice'],
+                          sedf_info['latency'],sedf_info['extratime'], 
+                          sedf_info['weight']])
+            rv = server.xend_domain_cpu_sedf_set(d['dom'], *v)
+            if int(rv) != 0:
+                err("Failed to set sedf parameters (rv=%d)."%(rv))
+
+        # not setting values, display info
+        else:
+            print_sedf(sedf_info)
+
 
 def xm_info(args):
     arg_check(args, "info", 0)
diff -r dc50cdd66c5c -r 0ed4a312765b tools/security/Makefile
--- a/tools/security/Makefile   Tue Mar 14 20:10:21 2006
+++ b/tools/security/Makefile   Tue Mar 14 20:50:35 2006
@@ -1,9 +1,7 @@
 XEN_ROOT = ../..
 include $(XEN_ROOT)/tools/Rules.mk
 
-CFLAGS   += -Wall
 CFLAGS   += -Werror
-CFLAGS   += -O3
 CFLAGS   += -fno-strict-aliasing
 CFLAGS   += -I.
 
diff -r dc50cdd66c5c -r 0ed4a312765b tools/vnet/libxutil/Makefile
--- a/tools/vnet/libxutil/Makefile      Tue Mar 14 20:10:21 2006
+++ b/tools/vnet/libxutil/Makefile      Tue Mar 14 20:50:35 2006
@@ -29,8 +29,7 @@
 LIB_OBJS := $(LIB_SRCS:.c=.o)
 PIC_OBJS := $(LIB_SRCS:.c=.opic)
 
-CFLAGS   += -Wall -Werror -O3 -fno-strict-aliasing
-CFLAGS   += -g
+CFLAGS   += -Werror -fno-strict-aliasing
 
 # Get gcc to generate the dependencies for us.
 CFLAGS   += -Wp,-MD,.$(@F).d
diff -r dc50cdd66c5c -r 0ed4a312765b tools/vnet/vnetd/Makefile
--- a/tools/vnet/vnetd/Makefile Tue Mar 14 20:10:21 2006
+++ b/tools/vnet/vnetd/Makefile Tue Mar 14 20:50:35 2006
@@ -42,9 +42,6 @@
 CPPFLAGS += -D __ARCH_I386_ATOMIC__
 
 #----------------------------------------------------------------------------
-CFLAGS += -g
-CFLAGS += -O2
-CFLAGS += -Wall
 CFLAGS += $(INCLUDES) $(LIBS)
 
 LDFLAGS += $(LIBS)
diff -r dc50cdd66c5c -r 0ed4a312765b tools/vtpm/Rules.mk
--- a/tools/vtpm/Rules.mk       Tue Mar 14 20:10:21 2006
+++ b/tools/vtpm/Rules.mk       Tue Mar 14 20:50:35 2006
@@ -14,7 +14,7 @@
 TOOLS_INSTALL_DIR = $(DESTDIR)/usr/bin
 
 # General compiler flags
-CFLAGS   = -Wall -Werror -g3 -I.
+CFLAGS   = -Werror -g3 -I.
 
 # For generating dependencies
 CFLAGS += -Wp,-MD,.$(@F).d
diff -r dc50cdd66c5c -r 0ed4a312765b tools/vtpm_manager/Rules.mk
--- a/tools/vtpm_manager/Rules.mk       Tue Mar 14 20:10:21 2006
+++ b/tools/vtpm_manager/Rules.mk       Tue Mar 14 20:50:35 2006
@@ -14,7 +14,7 @@
 TOOLS_INSTALL_DIR = $(DESTDIR)/usr/bin
 
 # General compiler flags
-CFLAGS = -Wall -Werror -g3 -I.
+CFLAGS = -Werror -g3 -I.
 
 # For generating dependencies
 CFLAGS += -Wp,-MD,.$(@F).d
diff -r dc50cdd66c5c -r 0ed4a312765b tools/vtpm_manager/manager/Makefile
--- a/tools/vtpm_manager/manager/Makefile       Tue Mar 14 20:10:21 2006
+++ b/tools/vtpm_manager/manager/Makefile       Tue Mar 14 20:50:35 2006
@@ -20,7 +20,7 @@
        rm -f $(BIN) *~
 
 $(BIN): $(OBJS)
-       $(CC) $(LDFLAGS) $^ $(LIBS) -o $@
+       $(CC) $(CFLAGS) $(LDFLAGS) $^ $(LIBS) -o $@
 
 # libraries
 LIBS += ../tcs/libTCS.a ../util/libTCGUtils.a ../crypto/libtcpaCrypto.a
diff -r dc50cdd66c5c -r 0ed4a312765b tools/xcutils/Makefile
--- a/tools/xcutils/Makefile    Tue Mar 14 20:10:21 2006
+++ b/tools/xcutils/Makefile    Tue Mar 14 20:50:35 2006
@@ -19,7 +19,7 @@
 
 INCLUDES += -I $(XEN_LIBXC)
 
-CFLAGS += -Wall -Werror -O3 -fno-strict-aliasing
+CFLAGS += -Werror -fno-strict-aliasing
 CFLAGS += $(INCLUDES)
 
 # Make gcc generate dependencies.
diff -r dc50cdd66c5c -r 0ed4a312765b tools/xenmon/Makefile
--- a/tools/xenmon/Makefile     Tue Mar 14 20:10:21 2006
+++ b/tools/xenmon/Makefile     Tue Mar 14 20:50:35 2006
@@ -20,7 +20,7 @@
 XEN_ROOT=../..
 include $(XEN_ROOT)/tools/Rules.mk
 
-CFLAGS += -Wall -Werror -g
+CFLAGS  += -Werror -g
 CFLAGS  += -I $(XEN_XC)
 CFLAGS  += -I $(XEN_LIBXC)
 LDFLAGS += -L $(XEN_LIBXC)
diff -r dc50cdd66c5c -r 0ed4a312765b tools/xenmon/xenbaked.c
--- a/tools/xenmon/xenbaked.c   Tue Mar 14 20:10:21 2006
+++ b/tools/xenmon/xenbaked.c   Tue Mar 14 20:50:35 2006
@@ -299,7 +299,7 @@
         exit(EXIT_FAILURE);
     }
 
-    tbufs_mapped = xc_map_foreign_range(xc_handle, 0 /* Dom 0 ID */,
+    tbufs_mapped = xc_map_foreign_range(xc_handle, DOMID_XEN,
                                         size * num, PROT_READ | PROT_WRITE,
                                         tbufs_mfn);
 
@@ -379,7 +379,7 @@
 /**
  * get_num_cpus - get the number of logical CPUs
  */
-unsigned int get_num_cpus()
+unsigned int get_num_cpus(void)
 {
     dom0_op_t op;
     int xc_handle = xc_interface_open();
@@ -409,7 +409,7 @@
 /**
  * monitor_tbufs - monitor the contents of tbufs
  */
-int monitor_tbufs()
+int monitor_tbufs(void)
 {
     int i;
     extern void process_record(int, struct t_rec *);
diff -r dc50cdd66c5c -r 0ed4a312765b tools/xenmon/xenmon.py
--- a/tools/xenmon/xenmon.py    Tue Mar 14 20:10:21 2006
+++ b/tools/xenmon/xenmon.py    Tue Mar 14 20:50:35 2006
@@ -452,6 +452,12 @@
         if c == ord('c'):
             cpu = (cpu + 1) % ncpu
 
+        # n/p = cycle to the next/previous CPU
+        if c == ord('n'):
+            cpu = (cpu + 1) % ncpu
+        if c == ord('p'):
+            cpu = (cpu - 1) % ncpu
+
         stdscr.erase()
 
     _c.nocbreak()
@@ -502,6 +508,7 @@
     shm = mmap.mmap(shmf.fileno(), QOS_DATA_SIZE)
 
     interval = 0
+    curr = last = time.time()
     outfiles = {}
     for dom in range(0, NDOMAINS):
         outfiles[dom] = Delayed("%s-dom%d.log" % (options.prefix, dom), 'w')
@@ -561,9 +568,10 @@
                                      h1[dom][4], 
                                      h1[dom][5][0], h1[dom][5][1]))
                     outfiles[dom].flush()
-
-        interval += options.interval
-        time.sleep(1)
+            curr = time.time()
+            interval += (curr - last) * 1000
+            last = curr
+        time.sleep(options.interval / 1000.0)
 
     for dom in range(0, NDOMAINS):
         outfiles[dom].close()
diff -r dc50cdd66c5c -r 0ed4a312765b tools/xenstat/libxenstat/Makefile
--- a/tools/xenstat/libxenstat/Makefile Tue Mar 14 20:10:21 2006
+++ b/tools/xenstat/libxenstat/Makefile Tue Mar 14 20:50:35 2006
@@ -48,7 +48,7 @@
        $(RANLIB) $@
 
 $(SHLIB): $(OBJECTS)
-       $(CC) $(LDFLAGS) $(SONAME_FLAGS) -shared -o $@ $(OBJECTS)
+       $(CC) $(CFLAGS) $(LDFLAGS) $(SONAME_FLAGS) -shared -o $@ $(OBJECTS)
 
 src/xenstat.o: src/xenstat.c src/xenstat.h src/xen-interface.h
        $(CC) $(CFLAGS) $(WARN_FLAGS) -c -o $@ $<
diff -r dc50cdd66c5c -r 0ed4a312765b 
tools/xenstat/libxenstat/src/xen-interface.c
--- a/tools/xenstat/libxenstat/src/xen-interface.c      Tue Mar 14 20:10:21 2006
+++ b/tools/xenstat/libxenstat/src/xen-interface.c      Tue Mar 14 20:50:35 2006
@@ -31,7 +31,7 @@
 
 /* Initialize for xen-interface.  Returns a handle to be used with subsequent
  * calls to the xen-interface functions or NULL if an error occurs. */
-xi_handle *xi_init()
+xi_handle *xi_init(void)
 {
        xi_handle *handle;
 
diff -r dc50cdd66c5c -r 0ed4a312765b 
tools/xenstat/libxenstat/src/xen-interface.h
--- a/tools/xenstat/libxenstat/src/xen-interface.h      Tue Mar 14 20:10:21 2006
+++ b/tools/xenstat/libxenstat/src/xen-interface.h      Tue Mar 14 20:50:35 2006
@@ -26,7 +26,7 @@
 
 /* Initialize for xen-interface.  Returns a handle to be used with subsequent
  * calls to the xen-interface functions or NULL if an error occurs. */
-xi_handle *xi_init();
+xi_handle *xi_init(void);
 
 /* Release the handle to libxc, free resources, etc. */
 void xi_uninit(xi_handle *handle);
diff -r dc50cdd66c5c -r 0ed4a312765b tools/xenstat/libxenstat/src/xenstat.c
--- a/tools/xenstat/libxenstat/src/xenstat.c    Tue Mar 14 20:10:21 2006
+++ b/tools/xenstat/libxenstat/src/xenstat.c    Tue Mar 14 20:50:35 2006
@@ -129,7 +129,7 @@
 /*
  * libxenstat API
  */
-xenstat_handle *xenstat_init()
+xenstat_handle *xenstat_init(void)
 {
        xenstat_handle *handle;
 
diff -r dc50cdd66c5c -r 0ed4a312765b tools/xenstat/libxenstat/src/xenstat.h
--- a/tools/xenstat/libxenstat/src/xenstat.h    Tue Mar 14 20:10:21 2006
+++ b/tools/xenstat/libxenstat/src/xenstat.h    Tue Mar 14 20:50:35 2006
@@ -26,7 +26,7 @@
 
 /* Initialize the xenstat library.  Returns a handle to be used with
  * subsequent calls to the xenstat library, or NULL if an error occurs. */
-xenstat_handle *xenstat_init();
+xenstat_handle *xenstat_init(void);
 
 /* Release the handle to libxc, free resources, etc. */
 void xenstat_uninit(xenstat_handle * handle);
diff -r dc50cdd66c5c -r 0ed4a312765b tools/xenstore/Makefile
--- a/tools/xenstore/Makefile   Tue Mar 14 20:10:21 2006
+++ b/tools/xenstore/Makefile   Tue Mar 14 20:50:35 2006
@@ -12,7 +12,7 @@
 # Make gcc generate dependencies.
 BASECFLAGS += -Wp,-MD,.$(@F).d
 PROG_DEP = .*.d
-BASECFLAGS+= -O3 $(PROFILE)
+BASECFLAGS+= $(PROFILE)
 #BASECFLAGS+= -I$(XEN_ROOT)/tools
 BASECFLAGS+= -I$(XEN_ROOT)/tools/libxc
 BASECFLAGS+= -I.
diff -r dc50cdd66c5c -r 0ed4a312765b tools/xenstore/xenstored_core.c
--- a/tools/xenstore/xenstored_core.c   Tue Mar 14 20:10:21 2006
+++ b/tools/xenstore/xenstored_core.c   Tue Mar 14 20:50:35 2006
@@ -66,7 +66,7 @@
 static TDB_CONTEXT *tdb_ctx;
 
 static void corrupt(struct connection *conn, const char *fmt, ...);
-static void check_store();
+static void check_store(void);
 
 #define log(...)                                                       \
        do {                                                            \
@@ -238,7 +238,7 @@
 }
 
 
-static void reopen_log()
+static void reopen_log(void)
 {
        if (tracefile) {
                if (tracefd > 0)
@@ -1612,7 +1612,7 @@
 }
 
 
-static void check_store()
+static void check_store(void)
 {
        char * root = talloc_strdup(NULL, "/");
        struct hashtable * reachable =
diff -r dc50cdd66c5c -r 0ed4a312765b tools/xentrace/Makefile
--- a/tools/xentrace/Makefile   Tue Mar 14 20:10:21 2006
+++ b/tools/xentrace/Makefile   Tue Mar 14 20:50:35 2006
@@ -6,7 +6,7 @@
 XEN_ROOT=../..
 include $(XEN_ROOT)/tools/Rules.mk
 
-CFLAGS  += -Wall -Werror -O3
+CFLAGS  += -Werror
 
 CFLAGS  += -I $(XEN_XC)
 CFLAGS  += -I $(XEN_LIBXC)
diff -r dc50cdd66c5c -r 0ed4a312765b tools/xentrace/xentrace.c
--- a/tools/xentrace/xentrace.c Tue Mar 14 20:10:21 2006
+++ b/tools/xentrace/xentrace.c Tue Mar 14 20:50:35 2006
@@ -144,7 +144,7 @@
         exit(EXIT_FAILURE);
     }
 
-    tbufs_mapped = xc_map_foreign_range(xc_handle, 0 /* Dom 0 ID */,
+    tbufs_mapped = xc_map_foreign_range(xc_handle, DOMID_XEN,
                                         size * num, PROT_READ | PROT_WRITE,
                                         tbufs_mfn);
 
@@ -258,7 +258,7 @@
 /**
  * get_num_cpus - get the number of logical CPUs
  */
-unsigned int get_num_cpus()
+unsigned int get_num_cpus(void)
 {
     dom0_op_t op;
     int xc_handle = xc_interface_open();
diff -r dc50cdd66c5c -r 0ed4a312765b tools/xm-test/README
--- a/tools/xm-test/README      Tue Mar 14 20:10:21 2006
+++ b/tools/xm-test/README      Tue Mar 14 20:50:35 2006
@@ -120,8 +120,9 @@
    # ./runtest.sh <logfile>
 
 This will run all tests, as well as generate and submit a report at
-the end.  All output files will begin with "<logfile>."  If you wish to
-prevent submission of a report, add "-d" to the command line like this:
+the end. All output files will begin with "<logfile>."
+If you wish to prevent submission of a report, add "-d" to the 
+command line like this:
 
    # ./runtest.sh -d <logfile>
 
@@ -131,15 +132,19 @@
 
    # ./runtest.sh -s <logfile>
 
-For people needing a quick test run instead the full suite, a quick
-mode has been added that will attempt to run a representative subset
-of tests.  This is not a substitute for the whole suite, but will
-verify that some of the major functions of xen and xm are working:
-
-   # ./runtest.sh -q <logfile>
-
-Because of the current structure of the reporting software, submission
-of quick test run results is not supported.
+Group test sets are supported in xm-test. This is form of layering of 
+tests groups/cases/tests. In the framework directory "grouptest",
+files exist for group processing. The user can add groups, casenames
+and test lists as required. Default group run is "grouptest/default".
+
+   # ./runtest.sh -g <groupname> <logfile>
+
+* NOTE: There is a quick set of tests in group mode, that was added to
+run certain casenames and tests. It is not a substitute for the full
+xm-test test suite.
+   # ./runtest.sh -g quick <logfile>
+
+
 
 It may be desirable to run a specific test group.  This can be
 accomplished by doing the following:
diff -r dc50cdd66c5c -r 0ed4a312765b tools/xm-test/lib/XmTestLib/Test.py
--- a/tools/xm-test/lib/XmTestLib/Test.py       Tue Mar 14 20:10:21 2006
+++ b/tools/xm-test/lib/XmTestLib/Test.py       Tue Mar 14 20:50:35 2006
@@ -32,6 +32,7 @@
 import select
 import signal
 import re
+import glob
 
 TEST_PASS = 0
 TEST_FAIL = 255
@@ -184,7 +185,16 @@
     domain.destroy()
 
     return False
-    
+
+#
+# We currently can only load as many concurrent HVM domains as loop 
+# devices, need to find how many devices the system has.
+def getMaxHVMDomains():
+    nodes = glob.glob("/dev/loop*")
+    maxd = len(nodes)
+
+    return maxd
+
 
 if __name__ == "__main__":
 
diff -r dc50cdd66c5c -r 0ed4a312765b tools/xm-test/runtest.sh
--- a/tools/xm-test/runtest.sh  Tue Mar 14 20:10:21 2006
+++ b/tools/xm-test/runtest.sh  Tue Mar 14 20:50:35 2006
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/sh 
 
 ##
 ## Test driver script
@@ -11,7 +11,7 @@
     echo "  Where opts are:"
     echo "  -d          : do not submit a report for this run"
     echo "  -b          : do not ask any questions (batch mode)"
-    echo "  -q          : run a quick test set"
+    echo "  -g          : run a group test set"
     echo "  -e <email>  : set email address for report"
     echo "  -s <report> : just submit report <report>"
     echo "  -h | --help : show this help"
@@ -92,11 +92,12 @@
     echo "Running sanity checks..."
     make -C tests/_sanity check 2>&1 | grep REASON
     if [ $? -eq 0 ]; then
-       echo "Sanity checks failed"
-       exit 1
-    fi
-
-}
+        echo "Sanity checks failed"
+        exit 1
+    fi
+
+}
+
 
 # Get contact info if needed
 get_contact_info() {
@@ -128,26 +129,21 @@
 
 # Run the tests
 run_tests() {
-    output=$1
-    echo Running real tests...
-    TEST_VERBOSE=1 make -k check > $output 2>&1
-}
-
-run_tests_quick() {
-
-    output=$1
-
-    create_tests="01_create_basic_pos.test 07_create_mem64_pos.test 
10_create_fastdestroy.test 14_create_blockroot_pos.test"
-    unpause_tests="01_unpause_basic_pos.test"
-    memset_tests="01_memset_basic_pos.test 03_memset_random_pos.test"
-    help_tests="06_help_allcmds.test"
-    testgroups="create unpause memset help"
-
-    echo "*** Quick test" > $output
-    for group in $testgroups; do
-       eval $(echo list=\$${group}_tests)
-       echo "*** Running tests [$list] from $group"
-       (cd tests/$group && TEST_VERBOSE=1 make -k check TESTS="$list") >> 
$output 2>&1
+    groupentered=$1
+    output=$2
+
+    exec <  grouptest/$groupentered
+    while read casename testlist; do
+       echo Running $casename tests...
+       echo "*** case $casename from group $groupentered" >> $output
+       if [ -z "$testlist" ]; then
+          echo "*** Running tests for case $casename" >> $output
+          (cd tests/$casename && TEST_VERBOSE=1 make -k check) >> $output 2>&1
+       else
+          echo "*** Running tests $testlist from case $casename" >> $output
+          (cd tests/$casename && TEST_VERBOSE=1 make -k check 
TESTS="$testlist") >> $output 2>&1
+       fi
+
     done
 
 }
@@ -195,6 +191,7 @@
 report=yes
 batch=no
 run=yes
+GROUPENTERED=default
 
 # Resolve options
 while [ $# -gt 0 ]
@@ -213,8 +210,13 @@
          echo $1 > contact_info
          echo "(Email set to $1)"
          ;;
-      -q)
-         run=quick
+      -g)
+         shift
+          GROUPENTERED=$1
+          if [ ! -f grouptest/$GROUPENTERED ]; then
+             echo "No file for group $GROUPENTERED"
+             exit 1
+          fi
          ;;
       -s)
          run=no
@@ -265,18 +267,15 @@
 if [ "$run" != "no" ]; then
     runnable_tests
     make_environment_report $OSREPORTTEMP $PROGREPORTTEMP
-    if [ "$run" = "yes" ]; then
-       run_tests $OUTPUT
-    else
-       run_tests_quick $OUTPUT
-    fi
+    run_tests $GROUPENTERED $OUTPUT
     make_text_reports $PASSFAIL $FAILURES $OUTPUT $TXTREPORT
     make_result_report $OUTPUT $RESULTREPORTTEMP
     cat $OSREPORTTEMP $PROGREPORTTEMP $RESULTREPORTTEMP > $XMLREPORT
     rm $OSREPORTTEMP $PROGREPORTTEMP $RESULTREPORTTEMP
-fi
-
-if [ "$report" = "yes" ] && [ "$run" = "yes" ]; then
+
+fi
+
+if [ "$report" = "yes" ]; then
     if [ ! -f "$XMLREPORT" ]; then
        echo "No such file: $XMLREPORT"
        exit 1
diff -r dc50cdd66c5c -r 0ed4a312765b 
tools/xm-test/tests/create/11_create_concurrent_pos.py
--- a/tools/xm-test/tests/create/11_create_concurrent_pos.py    Tue Mar 14 
20:10:21 2006
+++ b/tools/xm-test/tests/create/11_create_concurrent_pos.py    Tue Mar 14 
20:50:35 2006
@@ -8,8 +8,14 @@
 import time
 import random
 
-MIN_DOMS    = 10
-MAX_DOMS    = 50
+if ENABLE_HVM_SUPPORT:
+    MAX_DOMS = getMaxHVMDomains()
+    if MAX_DOMS > 50:
+        MAX_DOMS = 50
+else:
+    MAX_DOMS = 50
+
+MIN_DOMS    = 5
 MEM_PER_DOM = 24
 
 domains = []
diff -r dc50cdd66c5c -r 0ed4a312765b 
tools/xm-test/tests/create/13_create_multinic_pos.py
--- a/tools/xm-test/tests/create/13_create_multinic_pos.py      Tue Mar 14 
20:10:21 2006
+++ b/tools/xm-test/tests/create/13_create_multinic_pos.py      Tue Mar 14 
20:50:35 2006
@@ -5,8 +5,16 @@
 
 from XmTestLib import *
 
-for i in range(0,10):
-    config = {"vif": ['' for _ in range(0, i)]}
+# The current device model, qemu-dm, only supports 8 MAX_NICS currently.
+if ENABLE_HVM_SUPPORT:
+    MAX_NICS = 8
+    nic = "type=ioemu, bridge=xenbr0"
+else:
+    MAX_NICS = 10
+    nic = ''
+
+for i in range(0,MAX_NICS):
+    config = {"vif": [ nic ] * i}
     domain = XmTestDomain(extraConfig=config)
 
     try:
diff -r dc50cdd66c5c -r 0ed4a312765b tools/xm-test/tests/list/06_list_nonroot.py
--- a/tools/xm-test/tests/list/06_list_nonroot.py       Tue Mar 14 20:10:21 2006
+++ b/tools/xm-test/tests/list/06_list_nonroot.py       Tue Mar 14 20:50:35 2006
@@ -12,4 +12,4 @@
 eyecatcher = "Error: Most commands need root access"
 where = output.find(eyecatcher)
 if where == -1:
-    FAIL("xm help: didn't see the root hint, saw %s" % output)
+    FAIL("xm list: didn't see the root hint, saw %s" % output)
diff -r dc50cdd66c5c -r 0ed4a312765b tools/xm-test/tests/network/Makefile.am
--- a/tools/xm-test/tests/network/Makefile.am   Tue Mar 14 20:10:21 2006
+++ b/tools/xm-test/tests/network/Makefile.am   Tue Mar 14 20:50:35 2006
@@ -1,10 +1,15 @@
 
 SUBDIRS =
-
 TESTS = \
        02_network_local_ping_pos.test          \
+       03_network_local_tcp_pos.test           \
+       04_network_local_udp_pos.test           \
        05_network_dom0_ping_pos.test           \
-       11_network_domU_ping_pos.test
+       06_network_dom0_tcp_pos.test            \
+       07_network_dom0_udp_pos.test            \
+       11_network_domU_ping_pos.test           \
+       12_network_domU_tcp_pos.test            \
+       13_network_domU_udp_pos.test
 
 
 
diff -r dc50cdd66c5c -r 0ed4a312765b tools/xm-test/tests/sedf/Makefile.am
--- a/tools/xm-test/tests/sedf/Makefile.am      Tue Mar 14 20:10:21 2006
+++ b/tools/xm-test/tests/sedf/Makefile.am      Tue Mar 14 20:50:35 2006
@@ -1,7 +1,11 @@
-
 SUBDIRS =
 
-TESTS = 01_sedf_multi_pos.test
+TESTS = 01_sedf_period_slice_pos.test \
+        02_sedf_period_lower_neg.test \
+        03_sedf_slice_lower_neg.test  \
+        04_sedf_slice_upper_neg.test  \
+        05_sedf_extratime_pos.test    \
+        06_sedf_extratime_disable_neg.test
 
 XFAIL_TESTS = 
 
diff -r dc50cdd66c5c -r 0ed4a312765b xen/Makefile
--- a/xen/Makefile      Tue Mar 14 20:10:21 2006
+++ b/xen/Makefile      Tue Mar 14 20:50:35 2006
@@ -6,7 +6,7 @@
 # All other places this is stored (eg. compile.h) should be autogenerated.
 export XEN_VERSION       = 3
 export XEN_SUBVERSION    = 0
-export XEN_EXTRAVERSION  = .0
+export XEN_EXTRAVERSION  = -unstable
 export XEN_FULLVERSION   = $(XEN_VERSION).$(XEN_SUBVERSION)$(XEN_EXTRAVERSION)
 
 export BASEDIR          := $(CURDIR)
diff -r dc50cdd66c5c -r 0ed4a312765b xen/Rules.mk
--- a/xen/Rules.mk      Tue Mar 14 20:10:21 2006
+++ b/xen/Rules.mk      Tue Mar 14 20:50:35 2006
@@ -4,7 +4,6 @@
 # 'make clean' before rebuilding.
 #
 verbose     ?= n
-debug       ?= n
 perfc       ?= n
 perfc_arrays?= n
 crash_debug ?= n
@@ -47,12 +46,7 @@
 
 CFLAGS += -g -D__XEN__
 
-ifneq ($(debug),y)
-CFLAGS += -DNDEBUG
-ifeq ($(verbose),y)
-CFLAGS += -DVERBOSE
-endif
-else
+ifneq ($(debug)$(verbose),nn)
 CFLAGS += -DVERBOSE
 endif
 
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/ia64/Rules.mk
--- a/xen/arch/ia64/Rules.mk    Tue Mar 14 20:10:21 2006
+++ b/xen/arch/ia64/Rules.mk    Tue Mar 14 20:50:35 2006
@@ -12,7 +12,7 @@
             -I$(BASEDIR)/include/asm-ia64/linux-null                   \
              -I$(BASEDIR)/arch/ia64/linux -I$(BASEDIR)/arch/ia64/linux-xen
 
-CFLAGS  := -nostdinc -fno-builtin -fno-common -fno-strict-aliasing
+CFLAGS  += -nostdinc -fno-builtin -fno-common -fno-strict-aliasing
 #CFLAGS  += -O3                # -O3 over-inlines making debugging tough!
 CFLAGS  += -O2         # but no optimization causes compile errors!
 #CFLAGS  += -iwithprefix include -Wall -DMONITOR_BASE=$(MONITOR_BASE)
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/ia64/vmx/vmx_hypercall.c
--- a/xen/arch/ia64/vmx/vmx_hypercall.c Tue Mar 14 20:10:21 2006
+++ b/xen/arch/ia64/vmx/vmx_hypercall.c Tue Mar 14 20:50:35 2006
@@ -22,7 +22,7 @@
 #include <xen/config.h>
 #include <xen/errno.h>
 #include <asm/vmx_vcpu.h>
-//#include <public/xen.h>
+#include <xen/guest_access.h>
 #include <public/event_channel.h>
 #include <asm/vmmu.h>
 #include <asm/tlb.h>
@@ -100,7 +100,7 @@
     VCPU *vcpu=current;
     u64 r32,ret;
     vcpu_get_gr_nat(vcpu,16,&r32);
-    ret=do_dom0_op((dom0_op_t *)r32);
+    ret=do_dom0_op(guest_handle_from_ptr(r32, dom0_op_t));
     vcpu_set_gr(vcpu, 8, ret, 0);
 
     vmx_vcpu_increment_iip(vcpu);
@@ -111,7 +111,7 @@
     VCPU *vcpu=current;
     u64 r32,ret;
     vcpu_get_gr_nat(vcpu,16,&r32);
-    ret=do_event_channel_op((evtchn_op_t *)r32);
+    ret=do_event_channel_op(guest_handle_from_ptr(r32, evtchn_op_t));
     vcpu_set_gr(vcpu, 8, ret, 0);
     vmx_vcpu_increment_iip(vcpu);
 }
@@ -122,7 +122,7 @@
     u64 r32,r33,ret;
     vcpu_get_gr_nat(vcpu,16,&r32);
     vcpu_get_gr_nat(vcpu,17,&r33);
-    ret=do_xen_version((int )r32,(void *)r33);
+    ret=do_xen_version((int )r32,guest_handle_from_ptr(r33, void));
     vcpu_set_gr(vcpu, 8, ret, 0);
     vmx_vcpu_increment_iip(vcpu);
 }
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/ia64/xen/hypercall.c
--- a/xen/arch/ia64/xen/hypercall.c     Tue Mar 14 20:10:21 2006
+++ b/xen/arch/ia64/xen/hypercall.c     Tue Mar 14 20:50:35 2006
@@ -10,6 +10,7 @@
 #include <xen/sched.h>
 #include <xen/hypercall.h>
 #include <xen/multicall.h>
+#include <xen/guest_access.h>
 
 #include <linux/efi.h> /* FOR EFI_UNIMPLEMENTED */
 #include <asm/sal.h>   /* FOR struct ia64_sal_retval */
@@ -175,7 +176,8 @@
                        (int) vcpu_get_gr(v,33));
                break;
            case __HYPERVISOR_dom0_op:
-               regs->r8 = do_dom0_op((struct dom0_op *) regs->r14);
+               regs->r8 = do_dom0_op(guest_handle_from_ptr(regs->r14,
+                                                           dom0_op_t));
                break;
 
            case __HYPERVISOR_memory_op:
@@ -194,30 +196,30 @@
                            regs->r8 = reservation.nr_extents;
                        break;
                    default:
-                       regs->r8 = do_memory_op((int) regs->r14, (void 
*)regs->r15);
+                       regs->r8 = do_memory_op((int) regs->r14, 
guest_handle_from_ptr(regs->r15, void));
                        break;
                    }
                }
                break;
 
            case __HYPERVISOR_event_channel_op:
-               regs->r8 = do_event_channel_op((struct evtchn_op *) regs->r14);
+               regs->r8 = do_event_channel_op(guest_handle_from_ptr(regs->r14, 
evtchn_op_t));
                break;
 
            case __HYPERVISOR_grant_table_op:
-               regs->r8 = do_grant_table_op((unsigned int) regs->r14, (void *) 
regs->r15, (unsigned int) regs->r16);
+               regs->r8 = do_grant_table_op((unsigned int) regs->r14, 
guest_handle_from_ptr(regs->r15, void), (unsigned int) regs->r16);
                break;
 
            case __HYPERVISOR_console_io:
-               regs->r8 = do_console_io((int) regs->r14, (int) regs->r15, 
(char *) regs->r16);
+               regs->r8 = do_console_io((int) regs->r14, (int) regs->r15, 
guest_handle_from_ptr(regs->r16, char));
                break;
 
            case __HYPERVISOR_xen_version:
-               regs->r8 = do_xen_version((int) regs->r14, (void *) regs->r15);
+               regs->r8 = do_xen_version((int) regs->r14, 
guest_handle_from_ptr(regs->r15, void));
                break;
 
            case __HYPERVISOR_multicall:
-               regs->r8 = do_multicall((struct multicall_entry *) regs->r14, 
(unsigned int) regs->r15);
+               regs->r8 = do_multicall(guest_handle_from_ptr(regs->r14, 
multicall_entry_t), (unsigned int) regs->r15);
                break;
 
            default:
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/ia64/xen/process.c
--- a/xen/arch/ia64/xen/process.c       Tue Mar 14 20:10:21 2006
+++ b/xen/arch/ia64/xen/process.c       Tue Mar 14 20:50:35 2006
@@ -810,7 +810,6 @@
             case 'l':
                 arg = (unsigned long)va_arg(args, unsigned long);
                 break;
-            case 'p':
             case 'h':
                 arg = (unsigned long)va_arg(args, void *);
                 break;
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/x86/Rules.mk
--- a/xen/arch/x86/Rules.mk     Tue Mar 14 20:10:21 2006
+++ b/xen/arch/x86/Rules.mk     Tue Mar 14 20:50:35 2006
@@ -9,14 +9,10 @@
 supervisor_mode_kernel ?= n
 
 CFLAGS  += -nostdinc -fno-builtin -fno-common -fno-strict-aliasing
-CFLAGS  += -iwithprefix include -Wall -Werror -Wno-pointer-arith -pipe
+CFLAGS  += -iwithprefix include -Werror -Wno-pointer-arith -pipe
 CFLAGS  += -I$(BASEDIR)/include 
 CFLAGS  += -I$(BASEDIR)/include/asm-x86/mach-generic
 CFLAGS  += -I$(BASEDIR)/include/asm-x86/mach-default
-
-ifneq ($(debug),y)
-CFLAGS  += -O3 -fomit-frame-pointer
-endif
 
 # Prevent floating-point variables from creeping into Xen.
 CFLAGS  += -msoft-float
@@ -26,19 +22,20 @@
 CFLAGS  += $(call test-gcc-flag,$(CC),-fno-stack-protector)
 CFLAGS  += $(call test-gcc-flag,$(CC),-fno-stack-protector-all)
 
-ifeq ($(TARGET_SUBARCH),x86_32)
-CFLAGS  += -m32 -march=i686
-LDFLAGS += -m elf_i386 
-ifeq ($(pae),y)
+ifeq ($(TARGET_SUBARCH)$(pae),x86_32y)
 CFLAGS  += -DCONFIG_X86_PAE=1
 endif
-endif
+
 ifeq ($(supervisor_mode_kernel),y)
 CFLAGS  += -DCONFIG_X86_SUPERVISOR_MODE_KERNEL=1
 endif
 
+ifeq ($(XEN_TARGET_ARCH),x86_32)
+LDFLAGS += -m elf_i386 
+endif
+
 ifeq ($(TARGET_SUBARCH),x86_64)
-CFLAGS  += -m64 -mno-red-zone -fpic -fno-reorder-blocks
+CFLAGS  += -mno-red-zone -fpic -fno-reorder-blocks
 CFLAGS  += -fno-asynchronous-unwind-tables
 LDFLAGS += -m elf_x86_64
 endif
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/x86/apic.c
--- a/xen/arch/x86/apic.c       Tue Mar 14 20:10:21 2006
+++ b/xen/arch/x86/apic.c       Tue Mar 14 20:50:35 2006
@@ -892,9 +892,9 @@
     return result;
 }
 
-unsigned int get_apic_bus_scale(void)
-{
-    return bus_scale;
+u32 get_apic_bus_cycle(void)
+{
+    return bus_cycle;
 }
 
 static unsigned int calibration_result;
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/x86/audit.c
--- a/xen/arch/x86/audit.c      Tue Mar 14 20:10:21 2006
+++ b/xen/arch/x86/audit.c      Tue Mar 14 20:50:35 2006
@@ -350,7 +350,7 @@
         unmap_domain_page(pt);
     }
 
-    void adjust_shadow_tables()
+    void adjust_shadow_tables(void)
     {
         struct shadow_status *a;
         unsigned long smfn, gmfn;
@@ -402,7 +402,7 @@
         }
     }
 
-    void adjust_oos_list()
+    void adjust_oos_list(void)
     {
         struct out_of_sync_entry *oos;
 
@@ -426,7 +426,7 @@
         }
     }
 
-    void adjust_for_pgtbase()
+    void adjust_for_pgtbase(void)
     {
         struct vcpu *v;
 
@@ -443,7 +443,7 @@
         }
     }
 
-    void adjust_guest_pages()
+    void adjust_guest_pages(void)
     {
         struct list_head *list_ent = d->page_list.next;
         struct page_info *page;
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/x86/dom0_ops.c
--- a/xen/arch/x86/dom0_ops.c   Tue Mar 14 20:10:21 2006
+++ b/xen/arch/x86/dom0_ops.c   Tue Mar 14 20:50:35 2006
@@ -458,7 +458,7 @@
 {
     memcpy(c, &v->arch.guest_context, sizeof(*c));
 
-    if ( HVM_DOMAIN(v) )
+    if ( hvm_guest(v) )
     {
         hvm_store_cpu_guest_regs(v, &c->user_regs);
         hvm_store_cpu_guest_ctrl_regs(v, c->ctrlreg);
@@ -473,9 +473,9 @@
     c->flags = 0;
     if ( test_bit(_VCPUF_fpu_initialised, &v->vcpu_flags) )
         c->flags |= VGCF_I387_VALID;
-    if ( KERNEL_MODE(v, &v->arch.guest_context.user_regs) )
+    if ( guest_kernel_mode(v, &v->arch.guest_context.user_regs) )
         c->flags |= VGCF_IN_KERNEL;
-    if ( HVM_DOMAIN(v) )
+    if ( hvm_guest(v) )
         c->flags |= VGCF_HVM_GUEST;
 
     c->ctrlreg[3] = pagetable_get_paddr(v->arch.guest_table);
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/x86/domain.c
--- a/xen/arch/x86/domain.c     Tue Mar 14 20:10:21 2006
+++ b/xen/arch/x86/domain.c     Tue Mar 14 20:50:35 2006
@@ -312,7 +312,8 @@
             goto fail_nomem;
 
         memset(d->shared_info, 0, PAGE_SIZE);
-        SHARE_PFN_WITH_DOMAIN(virt_to_page(d->shared_info), d);
+        share_xen_page_with_guest(
+            virt_to_page(d->shared_info), d, XENSHARE_writable);
     }
 
     return 0;
@@ -451,6 +452,43 @@
     return 0;
 }
 
+long
+arch_do_vcpu_op(
+    int cmd, struct vcpu *v, GUEST_HANDLE(void) arg)
+{
+    long rc = 0;
+
+    switch ( cmd )
+    {
+    case VCPUOP_register_runstate_memory_area:
+    {
+        struct vcpu_register_runstate_memory_area area;
+
+        rc = -EINVAL;
+        if ( v != current )
+            break;
+
+        rc = -EFAULT;
+        if ( copy_from_guest(&area, arg, 1) )
+            break;
+
+        if ( !access_ok(area.addr.v, sizeof(*area.addr.v)) )
+            break;
+
+        rc = 0;
+        v->runstate_guest = area.addr.v;
+        __copy_to_user(v->runstate_guest, &v->runstate, sizeof(v->runstate));
+
+        break;
+    }
+
+    default:
+        rc = -ENOSYS;
+        break;
+    }
+
+    return rc;
+}
 
 void new_thread(struct vcpu *d,
                 unsigned long start_pc,
@@ -682,7 +720,7 @@
                stack_regs,
                CTXT_SWITCH_STACK_BYTES);
         unlazy_fpu(p);
-        if ( !HVM_DOMAIN(p) )
+        if ( !hvm_guest(p) )
         {
             save_segments(p);
         }
@@ -711,7 +749,7 @@
             loaddebug(&n->arch.guest_context, 7);
         }
 
-        if ( !HVM_DOMAIN(n) )
+        if ( !hvm_guest(n) )
         {
             set_int80_direct_trap(n);
             switch_kernel_stack(n, cpu);
@@ -775,7 +813,7 @@
         /* Re-enable interrupts before restoring state which may fault. */
         local_irq_enable();
 
-        if ( !HVM_DOMAIN(next) )
+        if ( !hvm_guest(next) )
         {
             load_LDT(next);
             load_segments(next);
@@ -831,7 +869,6 @@
     {                                                                       \
     case 'i': __arg = (unsigned long)va_arg(args, unsigned int);  break;    \
     case 'l': __arg = (unsigned long)va_arg(args, unsigned long); break;    \
-    case 'p': __arg = (unsigned long)va_arg(args, void *);        break;    \
     case 'h': __arg = (unsigned long)va_arg(args, void *);        break;    \
     default:  __arg = 0; BUG();                                             \
     }                                                                       \
@@ -994,7 +1031,7 @@
             v->arch.guest_table_user = mk_pagetable(0);
         }
 
-        if ( HVM_DOMAIN(v) )
+        if ( hvm_guest(v) )
             hvm_relinquish_guest_resources(v);
     }
 
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/x86/hvm/hvm.c
--- a/xen/arch/x86/hvm/hvm.c    Tue Mar 14 20:10:21 2006
+++ b/xen/arch/x86/hvm/hvm.c    Tue Mar 14 20:50:35 2006
@@ -186,7 +186,7 @@
 {
     struct hvm_domain *platform;
 
-    if ( !HVM_DOMAIN(current) || (current->vcpu_id != 0) )
+    if ( !hvm_guest(current) || (current->vcpu_id != 0) )
         return;
 
     shadow_direct_map_init(d);
@@ -205,12 +205,10 @@
     }
 }
 
-void pic_irq_request(int *interrupt_request, int level)
-{
-    if (level)
-        *interrupt_request = 1;
-    else
-        *interrupt_request = 0;
+void pic_irq_request(void *data, int level)
+{
+    int *interrupt_request = data;
+    *interrupt_request = level;
 }
 
 void hvm_pic_assist(struct vcpu *v)
@@ -324,7 +322,7 @@
     int rc = 0;
 
     /* current must be HVM domain BSP */
-    if ( !(HVM_DOMAIN(bsp) && bsp->vcpu_id == 0) ) {
+    if ( !(hvm_guest(bsp) && bsp->vcpu_id == 0) ) {
         printk("Not calling hvm_bringup_ap from BSP context.\n");
         domain_crash_synchronous();
     }
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/x86/hvm/i8259.c
--- a/xen/arch/x86/hvm/i8259.c  Tue Mar 14 20:10:21 2006
+++ b/xen/arch/x86/hvm/i8259.c  Tue Mar 14 20:50:35 2006
@@ -407,7 +407,7 @@
     pic_reset(s);
 }
 
-void pic_init(struct hvm_virpic *s, void (*irq_request)(), 
+void pic_init(struct hvm_virpic *s, void (*irq_request)(void *, int),
               void *irq_request_opaque)
 {
     memset(s, 0, sizeof(*s));
@@ -422,7 +422,8 @@
     return; 
 }
 
-void pic_set_alt_irq_func(struct hvm_virpic *s, void (*alt_irq_func)(),
+void pic_set_alt_irq_func(struct hvm_virpic *s,
+                          void (*alt_irq_func)(void *, int, int),
                           void *alt_irq_opaque)
 {
     s->alt_irq_func = alt_irq_func;
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/x86/hvm/svm/intr.c
--- a/xen/arch/x86/hvm/svm/intr.c       Tue Mar 14 20:10:21 2006
+++ b/xen/arch/x86/hvm/svm/intr.c       Tue Mar 14 20:50:35 2006
@@ -187,7 +187,7 @@
             }
             /* let's inject this interrupt */
             TRACE_3D(TRC_VMX_INT, v->domain->domain_id, intr_vector, 0);
-            svm_inject_extint(v, intr_vector, VMX_INVALID_ERROR_CODE);
+            svm_inject_extint(v, intr_vector, VMX_DELIVER_NO_ERROR_CODE);
             interrupt_post_injection(v, intr_vector, intr_type);
             break;
         case VLAPIC_DELIV_MODE_SMI:
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/x86/hvm/svm/x86_64/exits.S
--- a/xen/arch/x86/hvm/svm/x86_64/exits.S       Tue Mar 14 20:10:21 2006
+++ b/xen/arch/x86/hvm/svm/x86_64/exits.S       Tue Mar 14 20:50:35 2006
@@ -157,6 +157,7 @@
         jnz   svm_process_softirqs
 svm_restore_all_guest:
         call svm_intr_assist
+        call svm_asid
         call svm_load_cr2
         sti
         /*
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/x86/hvm/vlapic.c
--- a/xen/arch/x86/hvm/vlapic.c Tue Mar 14 20:10:21 2006
+++ b/xen/arch/x86/hvm/vlapic.c Tue Mar 14 20:50:35 2006
@@ -37,7 +37,9 @@
 /* XXX remove this definition after GFW enabled */
 #define VLAPIC_NO_BIOS
 
-extern unsigned int get_apic_bus_scale(void);
+extern u32 get_apic_bus_cycle(void);
+
+#define APIC_BUS_CYCLE_NS (((s_time_t)get_apic_bus_cycle()) / 1000)
 
 static unsigned int vlapic_lvt_mask[VLAPIC_LVT_NUM] =
 {
@@ -50,7 +52,8 @@
 
     result = find_highest_bit((uint32_t *)&vlapic->irr[0], INTR_LEN_32);
 
-    if (result != -1 && result < 16) {
+    if ( result != -1 && result < 16 )
+    {
         printk("VLAPIC: irr on reserved bits %d\n ", result);
         domain_crash_synchronous();
     }
@@ -78,10 +81,11 @@
 
     result = find_highest_bit((uint32_t *)&vlapic->isr[0], INTR_LEN_32);
 
-    if (result != -1 && result < 16) {
+    if ( result != -1 && result < 16 )
+    {
         int i = 0;
         printk("VLAPIC: isr on reserved bits %d, isr is\n ", result);
-        for (i = 0; i < INTR_LEN_32; i += 2)
+        for ( i = 0; i < INTR_LEN_32; i += 2 )
             printk("%d: 0x%08x%08x\n", i, vlapic->isr[i], vlapic->isr[i+1]);
         return -1;
     }
@@ -97,12 +101,12 @@
     tpr = (vlapic->task_priority >> 4) & 0xf;      /* we want 7:4 */
 
     isr = vlapic_find_highest_isr(vlapic);
-    if (isr != -1)
+    if ( isr != -1 )
         isrv = (isr >> 4) & 0xf;   /* ditto */
     else
         isrv = 0;
 
-    if (tpr >= isrv)
+    if ( tpr >= isrv )
         ppr = vlapic->task_priority & 0xff;
     else
         ppr = isrv << 4;  /* low 4 bits of PPR have to be cleared */
@@ -110,7 +114,7 @@
     vlapic->processor_priority = ppr;
 
     HVM_DBG_LOG(DBG_LEVEL_VLAPIC_INTERRUPT,
-                "vlapic_update_ppr: vlapic %p ppr %x isr %x isrv %x",
+                "vlapic %p, ppr 0x%x, isr 0x%x, isrv 0x%x.",
                 vlapic, ppr, isr, isrv);
 
     return ppr;
@@ -124,46 +128,52 @@
     int result = 0;
     struct vlapic *target = VLAPIC(v);
 
-    HVM_DBG_LOG(DBG_LEVEL_VLAPIC, "vlapic_match_dest: "
-                "target %p source %p dest %x dest_mode %x short_hand %x "
-                "delivery_mode %x",
+    HVM_DBG_LOG(DBG_LEVEL_VLAPIC, "target %p, source %p, dest 0x%x, "
+                "dest_mode 0x%x, short_hand 0x%x, delivery_mode 0x%x.",
                 target, source, dest, dest_mode, short_hand, delivery_mode);
 
-    if ( unlikely(!target) &&
-         ( (delivery_mode != VLAPIC_DELIV_MODE_INIT) &&
-           (delivery_mode != VLAPIC_DELIV_MODE_STARTUP) &&
-           (delivery_mode != VLAPIC_DELIV_MODE_NMI) )) {
-        HVM_DBG_LOG(DBG_LEVEL_VLAPIC, "vlapic_match_dest "
-                    "uninitialized target v %p delivery_mode %x dest %x\n",
-                    v, delivery_mode, dest); 
-        return result; 
-    }
-
-    switch (short_hand) {
+    if ( unlikely(target == NULL) &&
+         ((delivery_mode != VLAPIC_DELIV_MODE_INIT) &&
+          (delivery_mode != VLAPIC_DELIV_MODE_STARTUP) &&
+          (delivery_mode != VLAPIC_DELIV_MODE_NMI)) )
+    {
+        HVM_DBG_LOG(DBG_LEVEL_VLAPIC, "uninitialized target vcpu %p, "
+                    "delivery_mode 0x%x, dest 0x%x.\n", v, delivery_mode, 
dest);
+        return result;
+    }
+
+    switch ( short_hand ) {
     case VLAPIC_NO_SHORTHAND:
-        if (!dest_mode) {   /* Physical */
-            result = ((target ? target->id : v->vcpu_id ) == dest);
-        } else {            /* Logical */
-            if (!target) 
+        if ( !dest_mode )   /* Physical */
+        {
+            result = (target != NULL ? target->id : v->vcpu_id) == dest;
+        }
+        else                /* Logical */
+        {
+            if ( target == NULL )
                 break;
-            if (((target->dest_format >> 28) & 0xf) == 0xf) {   /* Flat mode */
+            if ( ((target->dest_format >> 28) & 0xf) == 0xf )   /* Flat mode */
+            {
                 result = (target->logical_dest >> 24) & dest;
-            } else {
-                if ((delivery_mode == VLAPIC_DELIV_MODE_LPRI) &&
-                   (dest == 0xff)) {
+            }
+            else
+            {
+                if ( (delivery_mode == VLAPIC_DELIV_MODE_LPRI) &&
+                     (dest == 0xff) )
+                {
                     /* What shall we do now? */
                     printk("Broadcast IPI with lowest priority "
                            "delivery mode\n");
                     domain_crash_synchronous();
                 }
                 result = (target->logical_dest == (dest & 0xf)) ?
-                  ((target->logical_dest >> 4) & (dest >> 4)) : 0;
+                         ((target->logical_dest >> 4) & (dest >> 4)) : 0;
             }
         }
         break;
 
     case VLAPIC_SHORTHAND_SELF:
-        if (target == source)
+        if ( target == source )
             result = 1;
         break;
 
@@ -172,7 +182,7 @@
         break;
 
     case VLAPIC_SHORTHAND_EXCLUDE_SELF:
-        if (target != source)
+        if ( target != source )
             result = 1;
         break;
 
@@ -190,27 +200,30 @@
 static int vlapic_accept_irq(struct vcpu *v, int delivery_mode,
                              int vector, int level, int trig_mode)
 {
-    int        result = 0;
+    int result = 0;
     struct vlapic *vlapic = VLAPIC(v);
 
-    switch (delivery_mode) {
+    switch ( delivery_mode ) {
     case VLAPIC_DELIV_MODE_FIXED:
     case VLAPIC_DELIV_MODE_LPRI:
         /* FIXME add logic for vcpu on reset */
-        if (unlikely(!vlapic || !vlapic_enabled(vlapic)))
-            return result;
-
-        if (test_and_set_bit(vector, &vlapic->irr[0])) {
+        if ( unlikely(vlapic == NULL || !vlapic_enabled(vlapic)) )
+            break;
+
+        if ( test_and_set_bit(vector, &vlapic->irr[0]) )
+        {
             printk("<vlapic_accept_irq>"
-                    "level trig mode repeatedly for vector %d\n", vector);
-            result = 0;
-        } else {
-            if (level) {
-                printk("<vlapic_accept_irq> level trig mode for vector %d\n", 
vector);
-                set_bit(vector, &vlapic->tmr[0]);
-            }
-        }
-        evtchn_set_pending(vlapic->vcpu, iopacket_port(vlapic->vcpu));
+                   "level trig mode repeatedly for vector %d\n", vector);
+            break;
+        }
+
+        if ( level )
+        {
+            printk("<vlapic_accept_irq> level trig mode for vector %d\n",
+                   vector);
+            set_bit(vector, &vlapic->tmr[0]);
+        }
+        evtchn_set_pending(v, iopacket_port(v));
         result = 1;
         break;
 
@@ -225,11 +238,13 @@
         break;
 
     case VLAPIC_DELIV_MODE_INIT:
-        if ( !level && trig_mode == 1 ) {        //Deassert
+        if ( !level && trig_mode == 1 )     //Deassert
             printk("This hvm_vlapic is for P4, no work for De-assert init\n");
-        } else {
+        else
+        {
             /* FIXME How to check the situation after vcpu reset? */
-            if ( test_and_clear_bit(_VCPUF_initialised, &v->vcpu_flags) ) {
+            if ( test_and_clear_bit(_VCPUF_initialised, &v->vcpu_flags) )
+            {
                 printk("Reset hvm vcpu not supported yet\n");
                 domain_crash_synchronous();
             }
@@ -247,7 +262,8 @@
         v->arch.hvm_vcpu.init_sipi_sipi_state =
                 HVM_VCPU_INIT_SIPI_SIPI_STATE_NORM;
 
-        if ( test_bit(_VCPUF_initialised, &v->vcpu_flags) ) {
+        if ( test_bit(_VCPUF_initialised, &v->vcpu_flags) )
+        {
             printk("SIPI for initialized vcpu vcpuid %x\n", v->vcpu_id);
             domain_crash_synchronous();
         }
@@ -257,7 +273,7 @@
         break;
 
     default:
-        printk("TODO: not support interrup type %x\n", delivery_mode);
+        printk("TODO: not support interrupt type %x\n", delivery_mode);
         domain_crash_synchronous();
         break;
     }
@@ -276,13 +292,15 @@
     int next, old;
     struct vlapic* target = NULL;
 
-    if (dest_mode == 0) { //Physical mode
-        printk("<apic_round_robin> lowest priority for physical mode\n");
+    if ( dest_mode == 0 )   //Physical mode
+    {
+        printk("<apic_round_robin> lowest priority for physical mode.\n");
         return NULL;
     }
 
-    if (!bitmap) {
-        printk("<apic_round_robin> no bit on bitmap\n");
+    if ( !bitmap )
+    {
+        printk("<apic_round_robin> no bit set in bitmap.\n");
         return NULL;
     }
 
@@ -292,10 +310,12 @@
 
     do {
         /* the vcpu array is arranged according to vcpu_id */
-        if (test_bit(next, &bitmap)) {
+        if ( test_bit(next, &bitmap) )
+        {
             target = d->vcpu[next]->arch.hvm_vcpu.vlapic;
 
-            if (!target || !vlapic_enabled(target)) {
+            if ( target == NULL || !vlapic_enabled(target) )
+            {
                 printk("warning: targe round robin local apic disabled\n");
                 /* XXX should we domain crash?? Or should we return NULL */
             }
@@ -303,48 +323,47 @@
         }
 
         next ++;
-        if (!d->vcpu[next] ||
-            !test_bit(_VCPUF_initialised, &d->vcpu[next]->vcpu_flags) ||
-            next == MAX_VIRT_CPUS)
+        if ( !d->vcpu[next] ||
+             !test_bit(_VCPUF_initialised, &d->vcpu[next]->vcpu_flags) ||
+             next == MAX_VIRT_CPUS )
             next = 0;
-    }while(next != old);
+    } while ( next != old );
 
     d->arch.hvm_domain.round_info[vector] = next;
     spin_unlock(&d->arch.hvm_domain.round_robin_lock);
+
     return target;
 }
 
-void
-vlapic_EOI_set(struct vlapic *vlapic)
+void vlapic_EOI_set(struct vlapic *vlapic)
 {
     int vector = vlapic_find_highest_isr(vlapic);
 
     /* Not every write EOI will has correpsoning ISR,
        one example is when Kernel check timer on setup_IO_APIC */
-    if (vector == -1) {
+    if ( vector == -1 )
         return ;
-    }
-
-    vlapic_clear_isr(vlapic, vector);
+
+    clear_bit(vector, &vlapic->isr[0]);
     vlapic_update_ppr(vlapic);
 
-    if (test_and_clear_bit(vector, &vlapic->tmr[0]))
+    if ( test_and_clear_bit(vector, &vlapic->tmr[0]) )
         ioapic_update_EOI(vlapic->domain, vector);
 }
 
 int vlapic_check_vector(struct vlapic *vlapic,
                         unsigned char dm, int vector)
 {
-    if ((dm == VLAPIC_DELIV_MODE_FIXED) && (vector < 16)) {
+    if ( (dm == VLAPIC_DELIV_MODE_FIXED) && (vector < 16) )
+    {
         vlapic->err_status |= 0x40;
         vlapic_accept_irq(vlapic->vcpu, VLAPIC_DELIV_MODE_FIXED,
-          vlapic_lvt_vector(vlapic, VLAPIC_LVT_ERROR), 0, 0);
-        printk("<vlapic_check_vector>: check fail\n");
+                          vlapic_lvt_vector(vlapic, VLAPIC_LVT_ERROR), 0, 0);
+        printk("<vlapic_check_vector>: check failed.\n");
         return 0;
     }
     return 1;
 }
-
 
 void vlapic_ipi(struct vlapic *vlapic)
 {
@@ -360,68 +379,47 @@
     struct vcpu *v = NULL;
     uint32_t lpr_map;
 
-    HVM_DBG_LOG(DBG_LEVEL_VLAPIC, "vlapic_ipi: "
-                "icr_high %x icr_low %x "
-                "short_hand %x dest %x trig_mode %x level %x "
-                "dest_mode %x delivery_mode %x vector %x",
-                vlapic->icr_high, vlapic->icr_low,
-                short_hand, dest, trig_mode, level, dest_mode,
-                delivery_mode, vector);
-
-    for_each_vcpu ( vlapic->domain, v ) {
-        if (vlapic_match_dest(v, vlapic, short_hand,
-                              dest, dest_mode, delivery_mode)) {
-            if (delivery_mode == VLAPIC_DELIV_MODE_LPRI) {
+    HVM_DBG_LOG(DBG_LEVEL_VLAPIC, "icr_high 0x%x, icr_low 0x%x, "
+                "short_hand 0x%x, dest 0x%x, trig_mode 0x%x, level 0x%x, "
+                "dest_mode 0x%x, delivery_mode 0x%x, vector 0x%x.",
+                vlapic->icr_high, vlapic->icr_low, short_hand, dest,
+                trig_mode, level, dest_mode, delivery_mode, vector);
+
+    for_each_vcpu ( vlapic->domain, v )
+    {
+        if ( vlapic_match_dest(v, vlapic, short_hand,
+                               dest, dest_mode, delivery_mode) )
+        {
+            if ( delivery_mode == VLAPIC_DELIV_MODE_LPRI )
                 set_bit(v->vcpu_id, &lpr_map);
-            } else
+            else
                 vlapic_accept_irq(v, delivery_mode,
                                   vector, level, trig_mode);
         }
     }
 
-    if (delivery_mode == VLAPIC_DELIV_MODE_LPRI) {
+    if ( delivery_mode == VLAPIC_DELIV_MODE_LPRI )
+    {
         v = vlapic->vcpu;
         target = apic_round_robin(v->domain, dest_mode, vector, lpr_map);
 
-        if (target)
+        if ( target )
             vlapic_accept_irq(target->vcpu, delivery_mode,
                               vector, level, trig_mode);
     }
 }
 
-static void vlapic_begin_timer(struct vlapic *vlapic)
-{
-    s_time_t cur = NOW(), offset;
-
-    offset = vlapic->timer_current *
-      (262144 / get_apic_bus_scale()) * vlapic->timer_divide_counter;
-    vlapic->vlapic_timer.expires = cur + offset;
-
-    set_timer(&(vlapic->vlapic_timer), vlapic->vlapic_timer.expires );
-
-    HVM_DBG_LOG(DBG_LEVEL_VLAPIC, "vlapic_begin_timer: "
-                "bus_scale %x now %08x%08x expire %08x%08x "
-                "offset %08x%08x current %x",
-                get_apic_bus_scale(), (uint32_t)(cur >> 32), (uint32_t)cur,
-                (uint32_t)(vlapic->vlapic_timer.expires >> 32),
-                (uint32_t) vlapic->vlapic_timer.expires,
-                (uint32_t)(offset >> 32), (uint32_t)offset,
-                vlapic->timer_current);
-}
-
-void vlapic_read_aligned(struct vlapic *vlapic, unsigned int offset,
+static void vlapic_read_aligned(struct vlapic *vlapic, unsigned int offset,
                          unsigned int len, unsigned int *result)
 {
-    if (len != 4) {
-        HVM_DBG_LOG(DBG_LEVEL_VLAPIC,
-                    "local apic read with len=%d (should be 4)", len);
-    }
+    if ( len != 4 )
+        printk("<vlapic_read_aligned> read with len=%d (should be 4).\n", len);
 
     *result = 0;
 
-    switch (offset) {
+    switch ( offset ) {
     case APIC_ID:
-        *result = (vlapic->id) << 24;
+        *result = vlapic->id << 24;
         break;
 
     case APIC_LVR:
@@ -433,7 +431,7 @@
         break;
 
     case APIC_ARBPRI:
-        printk("Access local APIC ARBPRI register which is for P6\n");
+        printk("access local APIC ARBPRI register which is for P6\n");
         break;
 
     case APIC_PROCPRI:
@@ -489,7 +487,7 @@
         break;
 
     case APIC_ESR:
-        if (vlapic->err_write_count)
+        if ( vlapic->err_write_count )
             *result = vlapic->err_status;
         break;
 
@@ -501,51 +499,58 @@
         *result = vlapic->icr_high;
         break;
 
-    case APIC_LVTT:     /* LVT Timer Reg */
-    case APIC_LVTTHMR:     /* LVT Thermal Monitor */
-    case APIC_LVTPC:     /* LVT Performance Counter */
-    case APIC_LVT0:     /* LVT LINT0 Reg */
-    case APIC_LVT1:     /* LVT Lint1 Reg */
-    case APIC_LVTERR:     /* LVT Error Reg */
+    case APIC_LVTT:         /* LVT Timer Reg */
+    case APIC_LVTTHMR:      /* LVT Thermal Monitor */
+    case APIC_LVTPC:        /* LVT Performance Counter */
+    case APIC_LVT0:         /* LVT LINT0 Reg */
+    case APIC_LVT1:         /* LVT Lint1 Reg */
+    case APIC_LVTERR:       /* LVT Error Reg */
         *result = vlapic->lvt[(offset - APIC_LVTT) >> 4];
         break;
 
     case APIC_TMICT:
-        *result = vlapic->timer_initial;
-        break;
-
-    case APIC_TMCCT:         //Timer CCR
-        {
-            uint32_t counter;
-            s_time_t passed, cur = NOW();
-
-            if (cur <= vlapic->timer_current_update) {
-                passed = ~0x0LL - vlapic->timer_current_update + cur;
-                HVM_DBG_LOG(DBG_LEVEL_VLAPIC,"time elapsed");
-            }else
-                passed = cur - vlapic->timer_current_update;
-
-            counter = (passed * get_apic_bus_scale()) / (262144* 
vlapic->timer_divide_counter);
-            if (vlapic->timer_current > counter)
-                *result = vlapic->timer_current - counter;
-            else {
-                if (!vlapic_lvt_timer_period(vlapic))
-                    *result = 0;
-                //FIXME should we add interrupt here?
+        *result = vlapic->timer_initial_count;
+        break;
+
+    case APIC_TMCCT:        //Timer CCR
+        {
+            uint32_t counter_passed;
+            s_time_t passed, now = NOW();
+
+            if ( unlikely(now <= vlapic->timer_current_update) )
+            {
+                passed = ~0x0LL - vlapic->timer_current_update + now;
+                HVM_DBG_LOG(DBG_LEVEL_VLAPIC, "time elapsed.");
+            }
+            else
+                passed = now - vlapic->timer_current_update;
+
+            counter_passed = passed /
+                             (APIC_BUS_CYCLE_NS * vlapic->timer_divide_count);
+            vlapic->timer_current_count -= counter_passed;
+            if ( vlapic->timer_current_count <= 0 )
+            {
+                if ( unlikely(!vlapic_lvt_timer_period(vlapic)) )
+                {
+                    vlapic->timer_current_count = 0;
+                    // FIXME: should we add interrupt here?
+                }
                 else
-                    //*result = counter % vlapic->timer_initial;
-                    *result = vlapic->timer_initial - (counter - 
vlapic->timer_current);
+                {
+                    do {
+                        vlapic->timer_current_count += 
vlapic->timer_initial_count;
+                    } while ( vlapic->timer_current_count < 0 );
+                }
             }
-            vlapic->timer_current = *result;
-            vlapic->timer_current_update = NOW();
+
+            *result = vlapic->timer_current_count;
+            vlapic->timer_current_update = now;
 
             HVM_DBG_LOG(DBG_LEVEL_VLAPIC_TIMER,
-                        "initial %x timer current %x "
-                        "update %08x%08x cur %08x%08x offset %d",
-                        vlapic->timer_initial, vlapic->timer_current,
-                        (uint32_t)(vlapic->timer_current_update >> 32),
-                        (uint32_t)vlapic->timer_current_update ,
-                        (uint32_t)(cur >> 32), (uint32_t)cur, counter);
+                        "timer initial count 0x%x, timer current count 0x%x, "
+                        "update 0x%016"PRIx64", now 0x%016"PRIx64", offset 
0x%x.",
+                        vlapic->timer_initial_count, 
vlapic->timer_current_count,
+                        vlapic->timer_current_update, now, counter_passed);
         }
         break;
 
@@ -554,7 +559,7 @@
         break;
 
     default:
-        printk("Read local APIC address %x not implemented\n",offset);
+        printk("Read local APIC address 0x%x not implemented\n", offset);
         *result = 0;
         break;
     }
@@ -569,17 +574,16 @@
     struct vlapic *vlapic = VLAPIC(v);
     unsigned int offset = address - vlapic->base_address;
 
-    if ( len != 4) {
-        /* some bugs on kernel cause read this with byte*/
+    /* some bugs on kernel cause read this with byte*/
+    if ( len != 4 )
         HVM_DBG_LOG(DBG_LEVEL_VLAPIC,
-                    "Local APIC read with len = %lx, should be 4 instead\n",
+                    "read with len=0x%lx, should be 4 instead.\n",
                     len);
-    }
 
     alignment = offset & 0x3;
 
     vlapic_read_aligned(vlapic, offset & ~0x3, 4, &tmp);
-    switch (len) {
+    switch ( len ) {
     case 1:
         result = *((unsigned char *)&tmp + alignment);
         break;
@@ -593,14 +597,14 @@
         break;
 
     default:
-        printk("Local APIC read with len = %lx, should be 4 instead\n", len);
+        printk("Local APIC read with len=0x%lx, should be 4 instead.\n", len);
         domain_crash_synchronous();
         break;
     }
 
-    HVM_DBG_LOG(DBG_LEVEL_VLAPIC,
-                "vlapic_read offset %x with length %lx and the result is %lx",
-                offset, len, result);
+    HVM_DBG_LOG(DBG_LEVEL_VLAPIC, "offset 0x%x with length 0x%lx, "
+                "and the result is 0x%lx.", offset, len, result);
+
     return result;
 }
 
@@ -610,40 +614,42 @@
     struct vlapic *vlapic = VLAPIC(v);
     unsigned int offset = address - vlapic->base_address;
 
-    if (offset != 0xb0)
+    if ( offset != 0xb0 )
         HVM_DBG_LOG(DBG_LEVEL_VLAPIC,
-          "vlapic_write offset %x with length %lx source %lx",
-          offset, len, val);
+                    "offset 0x%x with length 0x%lx, and value is 0x%lx.",
+                    offset, len, val);
 
     /*
      * According to IA 32 Manual, all resgiters should be accessed with
      * 32 bits alignment.
      */
-    if (len != 4) {
+    if ( len != 4 )
+    {
         unsigned int tmp;
         unsigned char alignment;
 
         /* Some kernel do will access with byte/word alignment*/
         printk("Notice: Local APIC write with len = %lx\n",len);
         alignment = offset & 0x3;
-        tmp = vlapic_read(v, offset & (~0x3), 4);
-        switch (len) {
+        tmp = vlapic_read(v, offset & ~0x3, 4);
+        switch ( len ) {
         case 1:
             /* XXX the saddr is a tmp variable from caller, so should be ok
-               But we should still change the following ref to val to 
+               But we should still change the following ref to val to
                local variable later */
-            val  = (tmp & ~(0xff << alignment)) |
-                        ((val & 0xff) << alignment);
+            val = (tmp & ~(0xff << alignment)) |
+                  ((val & 0xff) << alignment);
             break;
 
         case 2:
-            if (alignment != 0x0 && alignment != 0x2) {
+            if ( alignment != 0x0 && alignment != 0x2 )
+            {
                 printk("alignment error for vlapic with len == 2\n");
-                    domain_crash_synchronous();
+                domain_crash_synchronous();
             }
 
             val = (tmp & ~(0xffff << alignment)) |
-                        ((val & 0xffff)  << alignment);
+                  ((val & 0xffff) << alignment);
             break;
 
         case 3:
@@ -661,7 +667,7 @@
 
     offset &= 0xff0;
 
-    switch (offset) {
+    switch ( offset ) {
     case APIC_ID:   /* Local APIC ID */
         vlapic->id = ((val) >> 24) & VAPIC_ID_MASK;
         break;
@@ -685,9 +691,10 @@
 
     case APIC_SPIV:
         vlapic->spurious_vec = val & 0x1ff;
-        if (!(vlapic->spurious_vec & 0x100)) {
-            int i = 0;
-            for (i = 0; i < VLAPIC_LVT_NUM; i++)
+        if ( !(vlapic->spurious_vec & 0x100) )
+        {
+            int i;
+            for ( i = 0; i < VLAPIC_LVT_NUM; i++ )
                 vlapic->lvt[i] |= 0x10000;
             vlapic->status |= VLAPIC_SOFTWARE_DISABLE_MASK;
         }
@@ -697,7 +704,7 @@
 
     case APIC_ESR:
         vlapic->err_write_count = !vlapic->err_write_count;
-        if (!vlapic->err_write_count)
+        if ( !vlapic->err_write_count )
             vlapic->err_status = 0;
         break;
 
@@ -711,30 +718,32 @@
         vlapic->icr_high = val & 0xff000000;
         break;
 
-    case APIC_LVTT: // LVT Timer Reg
-    case APIC_LVTTHMR: // LVT Thermal Monitor
-    case APIC_LVTPC: // LVT Performance Counter
-    case APIC_LVT0: // LVT LINT0 Reg
-    case APIC_LVT1: // LVT Lint1 Reg
-    case APIC_LVTERR: // LVT Error Reg
+    case APIC_LVTT:         // LVT Timer Reg
+    case APIC_LVTTHMR:      // LVT Thermal Monitor
+    case APIC_LVTPC:        // LVT Performance Counter
+    case APIC_LVT0:         // LVT LINT0 Reg
+    case APIC_LVT1:         // LVT Lint1 Reg
+    case APIC_LVTERR:       // LVT Error Reg
         {
             int vt = (offset - APIC_LVTT) >> 4;
 
             vlapic->lvt[vt] = val & vlapic_lvt_mask[vt];
-            if (vlapic->status & VLAPIC_SOFTWARE_DISABLE_MASK)
+            if ( vlapic->status & VLAPIC_SOFTWARE_DISABLE_MASK )
                 vlapic->lvt[vt] |= VLAPIC_LVT_BIT_MASK;
 
             /* On hardware, when write vector less than 0x20 will error */
             vlapic_check_vector(vlapic, vlapic_lvt_dm(vlapic->lvt[vt]),
-              vlapic_lvt_vector(vlapic, vt));
-
-            if (!vlapic->vcpu_id && (offset == APIC_LVT0)) {
-                if ((vlapic->lvt[VLAPIC_LVT_LINT0] & VLAPIC_LVT_BIT_DELIMOD)
-                            == 0x700) {
-                    if (!(vlapic->lvt[VLAPIC_LVT_LINT0] & 
VLAPIC_LVT_BIT_MASK)) {
+                                vlapic_lvt_vector(vlapic, vt));
+
+            if ( !vlapic->vcpu_id && (offset == APIC_LVT0) )
+            {
+                if ( (vlapic->lvt[VLAPIC_LVT_LINT0] & VLAPIC_LVT_BIT_DELIMOD)
+                      == 0x700 )
+                {
+                    if ( vlapic->lvt[VLAPIC_LVT_LINT0] & VLAPIC_LVT_BIT_MASK )
+                        clear_bit(_VLAPIC_BSP_ACCEPT_PIC, &vlapic->status);
+                    else
                         set_bit(_VLAPIC_BSP_ACCEPT_PIC, &vlapic->status);
-                    }else
-                        clear_bit(_VLAPIC_BSP_ACCEPT_PIC, &vlapic->status);
                 }
                 else
                     clear_bit(_VLAPIC_BSP_ACCEPT_PIC, &vlapic->status);
@@ -744,33 +753,41 @@
         break;
 
     case APIC_TMICT:
-        if (vlapic_timer_active(vlapic))
-            stop_timer(&(vlapic->vlapic_timer));
-
-        vlapic->timer_initial = val;
-        vlapic->timer_current = val;
-        vlapic->timer_current_update = NOW();
-
-        vlapic_begin_timer(vlapic);
-
-        HVM_DBG_LOG(DBG_LEVEL_VLAPIC, "timer_init %x timer_current %x"
-                    "timer_current_update %08x%08x",
-                    vlapic->timer_initial, vlapic->timer_current,
-                    (uint32_t)(vlapic->timer_current_update >> 32),
-                    (uint32_t)vlapic->timer_current_update);
+        {
+            s_time_t now = NOW(), offset;
+
+            if ( vlapic_timer_active(vlapic) )
+                stop_timer(&vlapic->vlapic_timer);
+
+            vlapic->timer_initial_count = val;
+            vlapic->timer_current_count = val;
+            vlapic->timer_current_update = now;
+
+            offset = APIC_BUS_CYCLE_NS *
+                     vlapic->timer_divide_count *
+                     vlapic->timer_initial_count;
+
+            set_timer(&vlapic->vlapic_timer, now + offset);
+
+            HVM_DBG_LOG(DBG_LEVEL_VLAPIC,
+                        "bus cycle is %"PRId64"ns, now 0x%016"PRIx64", "
+                        "timer initial count 0x%x, offset 0x%016"PRIx64", "
+                        "expire @ 0x%016"PRIx64".",
+                        APIC_BUS_CYCLE_NS, now, vlapic->timer_initial_count,
+                        offset, now + offset);
+        }
         break;
 
     case APIC_TDCR:
         {
-            //FIXME clean this code
-            unsigned char tmp1,tmp2;
-            tmp1 = (val & 0xf);
-            tmp2 = ((tmp1 & 0x3 )|((tmp1 & 0x8) >>1)) + 1;
-            vlapic->timer_divide_counter = 0x1<<tmp2;
-
-            HVM_DBG_LOG(DBG_LEVEL_VLAPIC_TIMER,
-                        "timer divider is 0x%x",
-                        vlapic->timer_divide_counter);
+            unsigned int tmp1, tmp2;
+
+            tmp1 = val & 0xf;
+            tmp2 = ((tmp1 & 0x3) | ((tmp1 & 0x8) >> 1)) + 1;
+            vlapic->timer_divide_count = 0x1 << (tmp2 & 0x7);
+
+            HVM_DBG_LOG(DBG_LEVEL_VLAPIC_TIMER, "timer divide count is 0x%x",
+                        vlapic->timer_divide_count);
         }
         break;
 
@@ -784,9 +801,9 @@
 {
     struct vlapic *vlapic = VLAPIC(v);
 
-    if (vlapic_global_enabled(vlapic) &&
-        (addr >= vlapic->base_address) &&
-        (addr <= (vlapic->base_address + VLOCAL_APIC_MEM_LENGTH)))
+    if ( vlapic_global_enabled(vlapic) &&
+         (addr >= vlapic->base_address) &&
+         (addr <= vlapic->base_address + VLOCAL_APIC_MEM_LENGTH) )
         return 1;
 
     return 0;
@@ -801,23 +818,21 @@
 void vlapic_msr_set(struct vlapic *vlapic, uint64_t value)
 {
     /* When apic disabled */
-    if (!vlapic)
+    if ( vlapic == NULL )
         return;
 
-    if (vlapic->vcpu_id)
+    if ( vlapic->vcpu_id )
         value &= ~MSR_IA32_APICBASE_BSP;
 
     vlapic->apic_base_msr = value;
     vlapic->base_address = vlapic_get_base_address(vlapic);
 
-    if (!(value & 0x800))
+    if ( !(value & 0x800) )
         set_bit(_VLAPIC_GLOB_DISABLE, &vlapic->status );
 
     HVM_DBG_LOG(DBG_LEVEL_VLAPIC,
-                "apic base msr = 0x%08x%08x,\nbase address = 0x%lx",
-                (uint32_t)(vlapic->apic_base_msr >> 32),
-                (uint32_t)vlapic->apic_base_msr,
-                vlapic->base_address);
+                "apic base msr is 0x%016"PRIx64", and base address is 0x%lx.",
+                vlapic->apic_base_msr, vlapic->base_address);
 }
 
 static inline int vlapic_get_init_id(struct vcpu *v)
@@ -827,42 +842,51 @@
 
 void vlapic_timer_fn(void *data)
 {
-    struct vlapic *vlapic;
-
-    vlapic = data;
-    if (!vlapic_enabled(vlapic)) return;
-
-    vlapic->timer_current_update = NOW();
-
-    if (vlapic_lvt_timer_enabled(vlapic)) {
-        if (!vlapic_irr_status(vlapic,
-              vlapic_lvt_vector(vlapic, VLAPIC_LVT_TIMER))) {
-            test_and_set_bit(vlapic_lvt_vector(vlapic, VLAPIC_LVT_TIMER),
-              &vlapic->irr[0]);
-        }
-        else
-            vlapic->intr_pending_count[vlapic_lvt_vector(vlapic, 
VLAPIC_LVT_TIMER)]++;
-        evtchn_set_pending(vlapic->vcpu, iopacket_port(vlapic->vcpu));
-    }
-
-    vlapic->timer_current_update = NOW();
-    if (vlapic_lvt_timer_period(vlapic)) {
+    struct vlapic *vlapic = data;
+    struct vcpu *v;
+    uint32_t timer_vector;
+    s_time_t now;
+
+    if ( unlikely(!vlapic_enabled(vlapic) ||
+                  !vlapic_lvt_timer_enabled(vlapic)) )
+        return;
+
+    v = vlapic->vcpu;
+    timer_vector = vlapic_lvt_vector(vlapic, VLAPIC_LVT_TIMER);
+    now = NOW();
+
+    vlapic->timer_current_update = now;
+
+    if ( test_and_set_bit(timer_vector, &vlapic->irr[0]) )
+        vlapic->intr_pending_count[timer_vector]++;
+
+    if ( vlapic_lvt_timer_period(vlapic) )
+    {
         s_time_t offset;
 
-        vlapic->timer_current = vlapic->timer_initial;
-        offset = vlapic->timer_current * (262144/get_apic_bus_scale()) * 
vlapic->timer_divide_counter;
-        vlapic->vlapic_timer.expires = NOW() + offset;
-        set_timer(&(vlapic->vlapic_timer), vlapic->vlapic_timer.expires);
-    }else {
-        vlapic->timer_current = 0;
-    }
+        vlapic->timer_current_count = vlapic->timer_initial_count;
+
+        offset = APIC_BUS_CYCLE_NS *
+                 vlapic->timer_divide_count *
+                 vlapic->timer_initial_count;
+        set_timer(&vlapic->vlapic_timer, now + offset);
+    }
+    else
+        vlapic->timer_current_count = 0;
+
+#if 0
+    if ( test_bit(_VCPUF_running, &v->vcpu_flags) )
+    {
+        /* TODO: add guest time handling here */
+    }
+#endif
 
     HVM_DBG_LOG(DBG_LEVEL_VLAPIC_TIMER,
-      "vlapic_timer_fn: now: %08x%08x expire %08x%08x init %x current %x",
-      (uint32_t)(NOW() >> 32),(uint32_t)NOW(),
-      (uint32_t)(vlapic->vlapic_timer.expires >> 32),
-      (uint32_t)vlapic->vlapic_timer.expires,
-      vlapic->timer_initial,vlapic->timer_current);
+                "now 0x%016"PRIx64", expire @ 0x%016"PRIx64", "
+                "timer initial count 0x%x, timer current count 0x%x.",
+                now, vlapic->vlapic_timer.expires,
+                vlapic->timer_initial_count,
+                vlapic->timer_current_count);
 }
 
 #if 0
@@ -873,7 +897,7 @@
     int type;
 
     type = __fls(vlapic->direct_intr.deliver_mode);
-    if (type == -1)
+    if ( type == -1 )
         return -1;
 
     *mode = type;
@@ -881,15 +905,45 @@
 }
 #endif
 
-int
-vlapic_accept_pic_intr(struct vcpu *v)
+int vlapic_accept_pic_intr(struct vcpu *v)
 {
     struct vlapic *vlapic = VLAPIC(v);
 
     return vlapic ? test_bit(_VLAPIC_BSP_ACCEPT_PIC, &vlapic->status) : 1;
 }
 
-int cpu_get_apic_interrupt(struct vcpu* v, int *mode)
+int cpu_get_apic_interrupt(struct vcpu *v, int *mode)
+{
+    struct vlapic *vlapic = VLAPIC(v);
+
+    if ( vlapic && vlapic_enabled(vlapic) )
+    {
+        int highest_irr = vlapic_find_highest_irr(vlapic);
+
+        if ( highest_irr != -1 && highest_irr >= vlapic->processor_priority )
+        {
+            if ( highest_irr < 0x10 )
+            {
+                uint32_t err_vector;
+
+                vlapic->err_status |= 0x20;
+                err_vector = vlapic_lvt_vector(vlapic, VLAPIC_LVT_ERROR);
+
+                HVM_DBG_LOG(DBG_LEVEL_VLAPIC,
+                            "Sending an illegal vector 0x%x.", highest_irr);
+
+                set_bit(err_vector, &vlapic->irr[0]);
+                highest_irr = err_vector;
+            }
+
+            *mode = VLAPIC_DELIV_MODE_FIXED;
+            return highest_irr;
+        }
+    }
+    return -1;
+}
+
+int cpu_has_apic_interrupt(struct vcpu* v)
 {
     struct vlapic *vlapic = VLAPIC(v);
 
@@ -897,47 +951,35 @@
         int highest_irr = vlapic_find_highest_irr(vlapic);
 
         if (highest_irr != -1 && highest_irr >= vlapic->processor_priority) {
-            if (highest_irr < 0x10) {
-                vlapic->err_status |= 0x20;
-                /* XXX What will happen if this vector illegal stil */
-                HVM_DBG_LOG(DBG_LEVEL_VLAPIC,
-                  "hvm_intr_assist: illegal vector number %x err_status %x",
-                  highest_irr,  vlapic_lvt_vector(vlapic, VLAPIC_LVT_ERROR));
-
-                set_bit(vlapic_lvt_vector(vlapic, VLAPIC_LVT_ERROR), 
&vlapic->irr[0]);
-                highest_irr = vlapic_lvt_vector(vlapic, VLAPIC_LVT_ERROR);
-            }
-
-            *mode = VLAPIC_DELIV_MODE_FIXED;
-            return highest_irr;
-        }
-    }
-    return -1;
-}
-
-void vlapic_post_injection(struct vcpu *v, int vector, int deliver_mode) {
-    struct vlapic  *vlapic = VLAPIC(v);
-
-    if (!vlapic)
+            return 1;
+        }
+    }
+    return 0;
+}
+ 
+void vlapic_post_injection(struct vcpu *v, int vector, int deliver_mode)
+{
+    struct vlapic *vlapic = VLAPIC(v);
+
+    if ( unlikely(vlapic == NULL) )
         return;
 
-    switch (deliver_mode) {
+    switch ( deliver_mode ) {
     case VLAPIC_DELIV_MODE_FIXED:
     case VLAPIC_DELIV_MODE_LPRI:
-        vlapic_set_isr(vlapic, vector);
-        vlapic_clear_irr(vlapic, vector);
+        set_bit(vector, &vlapic->isr[0]);
+        clear_bit(vector, &vlapic->irr[0]);
         vlapic_update_ppr(vlapic);
 
-        if (vector == vlapic_lvt_vector(vlapic, VLAPIC_LVT_TIMER)) {
+        if ( vector == vlapic_lvt_vector(vlapic, VLAPIC_LVT_TIMER) )
+        {
             vlapic->intr_pending_count[vector]--;
-            if (vlapic->intr_pending_count[vector] > 0)
-                test_and_set_bit(vlapic_lvt_vector(vlapic, VLAPIC_LVT_TIMER),
-                  &vlapic->irr[0]);
-        }
-
-        break;
-        /*XXX deal with these later */
-
+            if ( vlapic->intr_pending_count[vector] > 0 )
+                test_and_set_bit(vector, &vlapic->irr[0]);
+        }
+        break;
+
+    /*XXX deal with these later */
     case VLAPIC_DELIV_MODE_RESERVED:
         printk("Ignore deliver mode 3 in vlapic_post_injection\n");
         break;
@@ -950,7 +992,7 @@
         break;
 
     default:
-        printk("<vlapic_post_injection> error deliver mode\n");
+        printk("<vlapic_post_injection> invalid deliver mode\n");
         break;
     }
 }
@@ -978,12 +1020,12 @@
 
     vlapic->apic_base_msr = VLAPIC_BASE_MSR_INIT_VALUE;
 
-    if (apic_id == 0)
+    if ( apic_id == 0 )
         vlapic->apic_base_msr |= MSR_IA32_APICBASE_BSP;
 
     vlapic->base_address = vlapic_get_base_address(vlapic);
 
-    for (i = 0; i < VLAPIC_LVT_NUM; i++)
+    for ( i = 0; i < VLAPIC_LVT_NUM; i++ )
         vlapic->lvt[i] = VLAPIC_LVT_BIT_MASK;
 
     vlapic->dest_format = 0xffffffffU;
@@ -1000,18 +1042,18 @@
      * XXX According to mp sepcific, BIOS will enable LVT0/1,
      * remove it after BIOS enabled
      */
-    if (!v->vcpu_id) {
+    if ( !v->vcpu_id )
+    {
         vlapic->lvt[VLAPIC_LVT_LINT0] = 0x700;
         vlapic->lvt[VLAPIC_LVT_LINT1] = 0x500;
         set_bit(_VLAPIC_BSP_ACCEPT_PIC, &vlapic->status);
     }
 #endif
 
-    HVM_DBG_LOG(DBG_LEVEL_VLAPIC, "vlapic_reset: "
-                "vcpu=%p id=%d vlapic_apic_base_msr=%08x%08x "
-                "vlapic_base_address=%0lx",
-                v, vlapic->id, (uint32_t)(vlapic->apic_base_msr >> 32),
-                (uint32_t)vlapic->apic_base_msr, vlapic->base_address);
+    HVM_DBG_LOG(DBG_LEVEL_VLAPIC,
+                "vcpu=%p, id=%d, vlapic_apic_base_msr=0x%016"PRIx64", "
+                "base_address=0x%0lx.",
+                v, vlapic->id, vlapic->apic_base_msr, vlapic->base_address);
 
     return 1;
 }
@@ -1025,7 +1067,8 @@
     HVM_DBG_LOG(DBG_LEVEL_VLAPIC, "vlapic_init %d", v->vcpu_id);
 
     vlapic = xmalloc_bytes(sizeof(struct vlapic));
-    if (!vlapic) {
+    if ( vlapic == NULL )
+    {
         printk("malloc vlapic error for vcpu %x\n", v->vcpu_id);
         return -ENOMEM;
     }
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/x86/hvm/vmx/io.c
--- a/xen/arch/x86/hvm/vmx/io.c Tue Mar 14 20:10:21 2006
+++ b/xen/arch/x86/hvm/vmx/io.c Tue Mar 14 20:50:35 2006
@@ -86,28 +86,53 @@
 }
 
 static inline void
-enable_irq_window(unsigned long cpu_exec_control)
-{
-    if (!(cpu_exec_control & CPU_BASED_VIRTUAL_INTR_PENDING)) {
-        cpu_exec_control |= CPU_BASED_VIRTUAL_INTR_PENDING;
-        __vmwrite(CPU_BASED_VM_EXEC_CONTROL, cpu_exec_control);
+enable_irq_window(struct vcpu *v)
+{
+    u32  *cpu_exec_control = &v->arch.hvm_vcpu.u.vmx.exec_control;
+    
+    if (!(*cpu_exec_control & CPU_BASED_VIRTUAL_INTR_PENDING)) {
+        *cpu_exec_control |= CPU_BASED_VIRTUAL_INTR_PENDING;
+        __vmwrite(CPU_BASED_VM_EXEC_CONTROL, *cpu_exec_control);
     }
 }
 
 static inline void
-disable_irq_window(unsigned long cpu_exec_control)
-{
-    if ( cpu_exec_control & CPU_BASED_VIRTUAL_INTR_PENDING ) {
-        cpu_exec_control &= ~CPU_BASED_VIRTUAL_INTR_PENDING;
-        __vmwrite(CPU_BASED_VM_EXEC_CONTROL, cpu_exec_control);
-    }
+disable_irq_window(struct vcpu *v)
+{
+    u32  *cpu_exec_control = &v->arch.hvm_vcpu.u.vmx.exec_control;
+    
+    if ( *cpu_exec_control & CPU_BASED_VIRTUAL_INTR_PENDING ) {
+        *cpu_exec_control &= ~CPU_BASED_VIRTUAL_INTR_PENDING;
+        __vmwrite(CPU_BASED_VM_EXEC_CONTROL, *cpu_exec_control);
+    }
+}
+
+static inline int is_interruptibility_state(void)
+{
+    int  interruptibility;
+    __vmread(GUEST_INTERRUPTIBILITY_INFO, &interruptibility);
+    return interruptibility;
+}
+
+/* check to see if there is pending interrupt  */
+int cpu_has_pending_irq(struct vcpu *v)
+{
+    struct hvm_domain *plat = &v->domain->arch.hvm_domain;
+
+    /* APIC */
+    if ( cpu_has_apic_interrupt(v) ) return 1;
+    
+    /* PIC */
+    if ( !vlapic_accept_pic_intr(v) ) return 0;
+
+    return plat->interrupt_request;
 }
 
 asmlinkage void vmx_intr_assist(void)
 {
     int intr_type = 0;
     int highest_vector;
-    unsigned long intr_fields, eflags, interruptibility, cpu_exec_control;
+    unsigned long eflags;
     struct vcpu *v = current;
     struct hvm_domain *plat=&v->domain->arch.hvm_domain;
     struct hvm_virpit *vpit = &plat->vpit;
@@ -121,42 +146,26 @@
         pic_set_irq(pic, 0, 1);
     }
 
-    __vmread_vcpu(v, CPU_BASED_VM_EXEC_CONTROL, &cpu_exec_control);
-    __vmread(VM_ENTRY_INTR_INFO_FIELD, &intr_fields);
-
-    if (intr_fields & INTR_INFO_VALID_MASK) {
-        enable_irq_window(cpu_exec_control);
-        HVM_DBG_LOG(DBG_LEVEL_1, "vmx_intr_assist: intr_fields: %lx",
-                    intr_fields);
-        return;
-    }
-
-    __vmread(GUEST_INTERRUPTIBILITY_INFO, &interruptibility);
-
-    if (interruptibility) {
-        enable_irq_window(cpu_exec_control);
-        HVM_DBG_LOG(DBG_LEVEL_1, "interruptibility: %lx",interruptibility);
+    if ( !cpu_has_pending_irq(v) ) return;
+
+    if ( is_interruptibility_state() ) {    /* pre-cleared for emulated 
instruction */
+        enable_irq_window(v);
+        HVM_DBG_LOG(DBG_LEVEL_1, "interruptibility");
         return;
     }
 
     __vmread(GUEST_RFLAGS, &eflags);
     if (irq_masked(eflags)) {
-        enable_irq_window(cpu_exec_control);
+        enable_irq_window(v);
         return;
     }
 
     highest_vector = cpu_get_interrupt(v, &intr_type); 
-
-    if (highest_vector == -1) {
-        disable_irq_window(cpu_exec_control);
-        return;
-    }
-
     switch (intr_type) {
     case VLAPIC_DELIV_MODE_EXT:
     case VLAPIC_DELIV_MODE_FIXED:
     case VLAPIC_DELIV_MODE_LPRI:
-        vmx_inject_extint(v, highest_vector, VMX_INVALID_ERROR_CODE);
+        vmx_inject_extint(v, highest_vector, VMX_DELIVER_NO_ERROR_CODE);
         TRACE_3D(TRC_VMX_INT, v->domain->domain_id, highest_vector, 0);
         break;
     case VLAPIC_DELIV_MODE_SMI:
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/x86/hvm/vmx/vmcs.c
--- a/xen/arch/x86/hvm/vmx/vmcs.c       Tue Mar 14 20:10:21 2006
+++ b/xen/arch/x86/hvm/vmx/vmcs.c       Tue Mar 14 20:50:35 2006
@@ -79,7 +79,7 @@
 {
     struct vcpu *v = (struct vcpu *)info;
 
-    ASSERT(HVM_DOMAIN(v));
+    ASSERT(hvm_guest(v));
 
     if (v->arch.hvm_vmx.launch_cpu == smp_processor_id())
         __vmpclear(virt_to_maddr(v->arch.hvm_vmx.vmcs));
@@ -87,7 +87,7 @@
 
 void vmx_request_clear_vmcs(struct vcpu *v)
 {
-    ASSERT(HVM_DOMAIN(v));
+    ASSERT(hvm_guest(v));
 
     if (v->arch.hvm_vmx.launch_cpu == smp_processor_id())
         __vmpclear(virt_to_maddr(v->arch.hvm_vmx.vmcs));
@@ -219,6 +219,7 @@
     error |= __vmwrite(CR0_READ_SHADOW, cr0);
     error |= __vmwrite(CPU_BASED_VM_EXEC_CONTROL,
                        MONITOR_CPU_BASED_EXEC_CONTROLS);
+    v->arch.hvm_vcpu.u.vmx.exec_control = MONITOR_CPU_BASED_EXEC_CONTROLS;
 
     __asm__ __volatile__ ("mov %%cr4,%0" : "=r" (cr4) : );
 
@@ -362,7 +363,7 @@
     return error;
 }
 
-static inline int construct_vmcs_host()
+static inline int construct_vmcs_host(void)
 {
     int error = 0;
 #ifdef __x86_64__
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/x86/hvm/vmx/vmx.c
--- a/xen/arch/x86/hvm/vmx/vmx.c        Tue Mar 14 20:10:21 2006
+++ b/xen/arch/x86/hvm/vmx/vmx.c        Tue Mar 14 20:50:35 2006
@@ -223,6 +223,11 @@
 
     switch (regs->ecx){
     case MSR_EFER:
+        /* offending reserved bit will cause #GP */
+        if ( msr_content &
+                ~( EFER_LME | EFER_LMA | EFER_NX | EFER_SCE ) )
+             vmx_inject_exception(vc, TRAP_gp_fault, 0);
+
         if ((msr_content & EFER_LME) ^
             test_bit(VMX_CPU_STATE_LME_ENABLED,
                      &vc->arch.hvm_vmx.cpu_state)){
@@ -236,18 +241,9 @@
         if (msr_content & EFER_LME)
             set_bit(VMX_CPU_STATE_LME_ENABLED,
                     &vc->arch.hvm_vmx.cpu_state);
-        /* No update for LME/LMA since it have no effect */
+
         msr->msr_items[VMX_INDEX_MSR_EFER] =
             msr_content;
-        if (msr_content & ~(EFER_LME | EFER_LMA)){
-            msr->msr_items[VMX_INDEX_MSR_EFER] = msr_content;
-            if (!test_bit(VMX_INDEX_MSR_EFER, &msr->flags)){
-                rdmsrl(MSR_EFER,
-                       host_state->msr_items[VMX_INDEX_MSR_EFER]);
-                set_bit(VMX_INDEX_MSR_EFER, &host_state->flags);
-                set_bit(VMX_INDEX_MSR_EFER, &msr->flags);
-            }
-        }
         break;
 
     case MSR_FS_BASE:
@@ -483,12 +479,13 @@
 
 void do_nmi(struct cpu_user_regs *);
 
-static int check_vmx_controls(ctrls, msr)
+static int check_vmx_controls(u32 ctrls, u32 msr)
 {
     u32 vmx_msr_low, vmx_msr_high;
 
     rdmsr(msr, vmx_msr_low, vmx_msr_high);
-    if (ctrls < vmx_msr_low || ctrls > vmx_msr_high) {
+    if ( (ctrls < vmx_msr_low) || (ctrls > vmx_msr_high) )
+    {
         printk("Insufficient VMX capability 0x%x, "
                "msr=0x%x,low=0x%8x,high=0x%x\n",
                ctrls, msr, vmx_msr_low, vmx_msr_high);
@@ -599,6 +596,7 @@
 
     __vmread(GUEST_RIP, &current_eip);
     __vmwrite(GUEST_RIP, current_eip + inst_len);
+    __vmwrite(GUEST_INTERRUPTIBILITY_INFO, 0);
 }
 
 
@@ -1919,7 +1917,7 @@
     /* don't bother H/W interrutps */
     if (exit_reason != EXIT_REASON_EXTERNAL_INTERRUPT &&
         exit_reason != EXIT_REASON_VMCALL &&
-        exit_reason != EXIT_REASON_IO_INSTRUCTION)
+        exit_reason != EXIT_REASON_IO_INSTRUCTION) 
         HVM_DBG_LOG(DBG_LEVEL_0, "exit reason = %x", exit_reason);
 
     if (exit_reason & VMX_EXIT_REASONS_FAILED_VMENTRY) {
@@ -2029,6 +2027,7 @@
     case EXIT_REASON_PENDING_INTERRUPT:
         __vmwrite(CPU_BASED_VM_EXEC_CONTROL,
                   MONITOR_CPU_BASED_EXEC_CONTROLS);
+        v->arch.hvm_vcpu.u.vmx.exec_control = MONITOR_CPU_BASED_EXEC_CONTROLS;
         break;
     case EXIT_REASON_TASK_SWITCH:
         __hvm_bug(&regs);
@@ -2053,6 +2052,7 @@
         __update_guest_eip(inst_len);
         break;
     }
+#if 0 /* keep this for debugging */
     case EXIT_REASON_VMCALL:
         __get_instruction_length(inst_len);
         __vmread(GUEST_RIP, &eip);
@@ -2061,6 +2061,7 @@
         hvm_print_line(v, regs.eax); /* provides the current domain */
         __update_guest_eip(inst_len);
         break;
+#endif
     case EXIT_REASON_CR_ACCESS:
     {
         __vmread(GUEST_RIP, &eip);
@@ -2101,6 +2102,21 @@
     case EXIT_REASON_MWAIT_INSTRUCTION:
         __hvm_bug(&regs);
         break;
+    case EXIT_REASON_VMCALL:
+    case EXIT_REASON_VMCLEAR:
+    case EXIT_REASON_VMLAUNCH:
+    case EXIT_REASON_VMPTRLD:
+    case EXIT_REASON_VMPTRST:
+    case EXIT_REASON_VMREAD:
+    case EXIT_REASON_VMRESUME:
+    case EXIT_REASON_VMWRITE:
+    case EXIT_REASON_VMOFF:
+    case EXIT_REASON_VMON:
+        /* Report invalid opcode exception when a VMX guest tries to execute 
+            any of the VMX instructions */
+        vmx_inject_exception(v, TRAP_invalid_op, VMX_DELIVER_NO_ERROR_CODE);
+        break;
+
     default:
         __hvm_bug(&regs);       /* should not happen */
     }
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/x86/mm.c
--- a/xen/arch/x86/mm.c Tue Mar 14 20:10:21 2006
+++ b/xen/arch/x86/mm.c Tue Mar 14 20:50:35 2006
@@ -176,10 +176,9 @@
 
 void arch_init_memory(void)
 {
-    extern void subarch_init_memory(struct domain *);
+    extern void subarch_init_memory(void);
 
     unsigned long i, pfn, rstart_pfn, rend_pfn;
-    struct page_info *page;
 
     memset(percpu_info, 0, sizeof(percpu_info));
 
@@ -189,6 +188,7 @@
      * their domain field set to dom_xen.
      */
     dom_xen = alloc_domain();
+    spin_lock_init(&dom_xen->page_alloc_lock);
     atomic_set(&dom_xen->refcnt, 1);
     dom_xen->domain_id = DOMID_XEN;
 
@@ -198,17 +198,13 @@
      * array. Mappings occur at the priv of the caller.
      */
     dom_io = alloc_domain();
+    spin_lock_init(&dom_io->page_alloc_lock);
     atomic_set(&dom_io->refcnt, 1);
     dom_io->domain_id = DOMID_IO;
 
     /* First 1MB of RAM is historically marked as I/O. */
     for ( i = 0; i < 0x100; i++ )
-    {
-        page = mfn_to_page(i);
-        page->count_info        = PGC_allocated | 1;
-        page->u.inuse.type_info = PGT_writable_page | PGT_validated | 1;
-        page_set_owner(page, dom_io);
-    }
+        share_xen_page_with_guest(mfn_to_page(i), dom_io, XENSHARE_writable);
  
     /* Any areas not specified as RAM by the e820 map are considered I/O. */
     for ( i = 0, pfn = 0; i < e820.nr_map; i++ )
@@ -221,17 +217,47 @@
         for ( ; pfn < rstart_pfn; pfn++ )
         {
             BUG_ON(!mfn_valid(pfn));
-            page = mfn_to_page(pfn);
-            page->count_info        = PGC_allocated | 1;
-            page->u.inuse.type_info = PGT_writable_page | PGT_validated | 1;
-            page_set_owner(page, dom_io);
+            share_xen_page_with_guest(
+                mfn_to_page(pfn), dom_io, XENSHARE_writable);
         }
         /* Skip the RAM region. */
         pfn = rend_pfn;
     }
     BUG_ON(pfn != max_page);
 
-    subarch_init_memory(dom_xen);
+    subarch_init_memory();
+}
+
+void share_xen_page_with_guest(
+    struct page_info *page, struct domain *d, int readonly)
+{
+    if ( page_get_owner(page) == d )
+        return;
+
+    set_gpfn_from_mfn(page_to_mfn(page), INVALID_M2P_ENTRY);
+
+    spin_lock(&d->page_alloc_lock);
+
+    /* The incremented type count pins as writable or read-only. */
+    page->u.inuse.type_info  = (readonly ? PGT_none : PGT_writable_page);
+    page->u.inuse.type_info |= PGT_validated | 1;
+
+    page_set_owner(page, d);
+    wmb(); /* install valid domain ptr before updating refcnt. */
+    ASSERT(page->count_info == 0);
+    page->count_info |= PGC_allocated | 1;
+
+    if ( unlikely(d->xenheap_pages++ == 0) )
+        get_knownalive_domain(d);
+    list_add_tail(&page->list, &d->xenpage_list);
+
+    spin_unlock(&d->page_alloc_lock);
+}
+
+void share_xen_page_with_privileged_guests(
+    struct page_info *page, int readonly)
+{
+    share_xen_page_with_guest(page, dom_xen, readonly);
 }
 
 void write_ptbase(struct vcpu *v)
@@ -751,9 +777,8 @@
     unsigned long *backptr, unsigned long offset_in_l2, unsigned long l2_type)
 {
     unsigned long l2_backptr = l2_type & PGT_va_mask;
-    BUG_ON(l2_backptr == PGT_va_unknown);
-    if ( l2_backptr == PGT_va_mutable )
-        return 0;
+    ASSERT(l2_backptr != PGT_va_unknown);
+    ASSERT(l2_backptr != PGT_va_mutable);
     *backptr = 
         ((l2_backptr >> PGT_va_shift) << L3_PAGETABLE_SHIFT) | 
         (offset_in_l2 << L2_PAGETABLE_SHIFT);
@@ -767,8 +792,8 @@
     unsigned long *backptr, unsigned long offset_in_l2, unsigned long l2_type)
 {
     unsigned long l2_backptr = l2_type & PGT_va_mask;
-    BUG_ON(l2_backptr == PGT_va_unknown);
-
+    ASSERT(l2_backptr != PGT_va_unknown);
+    ASSERT(l2_backptr != PGT_va_mutable);
     *backptr = ((l2_backptr >> PGT_va_shift) << L3_PAGETABLE_SHIFT) | 
         (offset_in_l2 << L2_PAGETABLE_SHIFT);
     return 1;
@@ -778,8 +803,8 @@
     unsigned long *backptr, unsigned long offset_in_l3, unsigned long l3_type)
 {
     unsigned long l3_backptr = l3_type & PGT_va_mask;
-    BUG_ON(l3_backptr == PGT_va_unknown);
-
+    ASSERT(l3_backptr != PGT_va_unknown);
+    ASSERT(l3_backptr != PGT_va_mutable);
     *backptr = ((l3_backptr >> PGT_va_shift) << L4_PAGETABLE_SHIFT) | 
         (offset_in_l3 << L3_PAGETABLE_SHIFT);
     return 1;
@@ -788,9 +813,6 @@
 static inline int l3_backptr(
     unsigned long *backptr, unsigned long offset_in_l4, unsigned long l4_type)
 {
-    unsigned long l4_backptr = l4_type & PGT_va_mask;
-    BUG_ON(l4_backptr == PGT_va_unknown);
-
     *backptr = (offset_in_l4 << L4_PAGETABLE_SHIFT);
     return 1;
 }
@@ -1412,9 +1434,8 @@
                 nx &= ~PGT_validated;
             }
         }
-        else if ( unlikely(((nx & (PGT_pinned | PGT_count_mask)) == 
-                            (PGT_pinned | 1)) &&
-                           ((nx & PGT_type_mask) != PGT_writable_page)) )
+        else if ( unlikely((nx & (PGT_pinned|PGT_type_mask|PGT_count_mask)) == 
+                           (PGT_pinned|PGT_l1_page_table|1)) )
         {
             /* Page is now only pinned. Make the back pointer mutable again. */
             nx |= PGT_va_mutable;
@@ -1507,14 +1528,19 @@
                     nx &= ~PGT_va_mask;
                     nx |= type; /* we know the actual type is correct */
                 }
-                else if ( ((type & PGT_va_mask) != PGT_va_mutable) &&
-                          ((type & PGT_va_mask) != (x & PGT_va_mask)) )
+                else
                 {
+                    ASSERT((type & PGT_va_mask) != (x & PGT_va_mask));
+                    ASSERT((type & PGT_va_mask) != PGT_va_mutable);
 #ifdef CONFIG_X86_PAE
                     /* We use backptr as extra typing. Cannot be unknown. */
                     if ( (type & PGT_type_mask) == PGT_l2_page_table )
                         return 0;
 #endif
+                    /* Fixme: add code to propagate va_unknown to subtables. */
+                    if ( ((type & PGT_type_mask) >= PGT_l2_page_table) &&
+                         !shadow_mode_refcounts(page_get_owner(page)) )
+                        return 0;
                     /* This table is possibly mapped at multiple locations. */
                     nx &= ~PGT_va_mask;
                     nx |= PGT_va_unknown;
@@ -1732,14 +1758,15 @@
 }
 
 int do_mmuext_op(
-    struct mmuext_op *uops,
+    GUEST_HANDLE(mmuext_op_t) uops,
     unsigned int count,
-    unsigned int *pdone,
+    GUEST_HANDLE(uint) pdone,
     unsigned int foreigndom)
 {
     struct mmuext_op op;
     int rc = 0, i = 0, okay, cpu = smp_processor_id();
-    unsigned long mfn, type, done = 0;
+    unsigned long mfn, type;
+    unsigned int done = 0;
     struct page_info *page;
     struct vcpu *v = current;
     struct domain *d = v->domain;
@@ -1751,8 +1778,8 @@
     if ( unlikely(count & MMU_UPDATE_PREEMPTED) )
     {
         count &= ~MMU_UPDATE_PREEMPTED;
-        if ( unlikely(pdone != NULL) )
-            (void)get_user(done, pdone);
+        if ( unlikely(!guest_handle_is_null(pdone)) )
+            (void)copy_from_guest(&done, pdone, 1);
     }
 
     if ( !set_foreigndom(cpu, foreigndom) )
@@ -1761,7 +1788,7 @@
         goto out;
     }
 
-    if ( unlikely(!array_access_ok(uops, count, sizeof(op))) )
+    if ( unlikely(!guest_handle_okay(uops, count)) )
     {
         rc = -EFAULT;
         goto out;
@@ -1772,14 +1799,14 @@
         if ( hypercall_preempt_check() )
         {
             rc = hypercall_create_continuation(
-                __HYPERVISOR_mmuext_op, "pipi",
+                __HYPERVISOR_mmuext_op, "hihi",
                 uops, (count - i) | MMU_UPDATE_PREEMPTED, pdone, foreigndom);
             break;
         }
 
-        if ( unlikely(__copy_from_user(&op, uops, sizeof(op)) != 0) )
-        {
-            MEM_LOG("Bad __copy_from_user");
+        if ( unlikely(__copy_from_guest(&op, uops, 1) != 0) )
+        {
+            MEM_LOG("Bad __copy_from_guest");
             rc = -EFAULT;
             break;
         }
@@ -1792,6 +1819,16 @@
         {
         case MMUEXT_PIN_L1_TABLE:
             type = PGT_l1_page_table | PGT_va_mutable;
+            goto pin_page;
+
+        case MMUEXT_PIN_L2_TABLE:
+        case MMUEXT_PIN_L3_TABLE:
+        case MMUEXT_PIN_L4_TABLE:
+            /* Ignore pinning of subdirectories. */
+            if ( (op.cmd - MMUEXT_PIN_L1_TABLE) != (CONFIG_PAGING_LEVELS - 1) )
+                break;
+
+            type = PGT_root_page_table;
 
         pin_page:
             if ( shadow_mode_refcounts(FOREIGNDOM) )
@@ -1814,20 +1851,6 @@
             }
             
             break;
-
-#ifndef CONFIG_X86_PAE /* Unsafe on PAE because of Xen-private mappings. */
-        case MMUEXT_PIN_L2_TABLE:
-            type = PGT_l2_page_table | PGT_va_mutable;
-            goto pin_page;
-#endif
-
-        case MMUEXT_PIN_L3_TABLE:
-            type = PGT_l3_page_table | PGT_va_mutable;
-            goto pin_page;
-
-        case MMUEXT_PIN_L4_TABLE:
-            type = PGT_l4_page_table | PGT_va_mutable;
-            goto pin_page;
 
         case MMUEXT_UNPIN_TABLE:
             if ( shadow_mode_refcounts(d) )
@@ -1969,24 +1992,25 @@
             break;
         }
 
-        uops++;
+        guest_handle_add_offset(uops, 1);
     }
 
  out:
     process_deferred_ops(cpu);
 
     /* Add incremental work we have done to the @done output parameter. */
-    if ( unlikely(pdone != NULL) )
-        __put_user(done + i, pdone);
+    done += i;
+    if ( unlikely(!guest_handle_is_null(pdone)) )
+        copy_to_guest(pdone, &done, 1);
 
     UNLOCK_BIGLOCK(d);
     return rc;
 }
 
 int do_mmu_update(
-    struct mmu_update *ureqs,
+    GUEST_HANDLE(mmu_update_t) ureqs,
     unsigned int count,
-    unsigned int *pdone,
+    GUEST_HANDLE(uint) pdone,
     unsigned int foreigndom)
 {
     struct mmu_update req;
@@ -2010,8 +2034,8 @@
     if ( unlikely(count & MMU_UPDATE_PREEMPTED) )
     {
         count &= ~MMU_UPDATE_PREEMPTED;
-        if ( unlikely(pdone != NULL) )
-            (void)get_user(done, pdone);
+        if ( unlikely(!guest_handle_is_null(pdone)) )
+            (void)copy_from_guest(&done, pdone, 1);
     }
 
     domain_mmap_cache_init(&mapcache);
@@ -2027,7 +2051,7 @@
     perfc_addc(num_page_updates, count);
     perfc_incr_histo(bpt_updates, count, PT_UPDATES);
 
-    if ( unlikely(!array_access_ok(ureqs, count, sizeof(req))) )
+    if ( unlikely(!guest_handle_okay(ureqs, count)) )
     {
         rc = -EFAULT;
         goto out;
@@ -2038,14 +2062,14 @@
         if ( hypercall_preempt_check() )
         {
             rc = hypercall_create_continuation(
-                __HYPERVISOR_mmu_update, "pipi",
+                __HYPERVISOR_mmu_update, "hihi",
                 ureqs, (count - i) | MMU_UPDATE_PREEMPTED, pdone, foreigndom);
             break;
         }
 
-        if ( unlikely(__copy_from_user(&req, ureqs, sizeof(req)) != 0) )
-        {
-            MEM_LOG("Bad __copy_from_user");
+        if ( unlikely(__copy_from_guest(&req, ureqs, 1) != 0) )
+        {
+            MEM_LOG("Bad __copy_from_guest");
             rc = -EFAULT;
             break;
         }
@@ -2212,7 +2236,7 @@
             break;
         }
 
-        ureqs++;
+        guest_handle_add_offset(ureqs, 1);
     }
 
  out:
@@ -2222,8 +2246,9 @@
     process_deferred_ops(cpu);
 
     /* Add incremental work we have done to the @done output parameter. */
-    if ( unlikely(pdone != NULL) )
-        __put_user(done + i, pdone);
+    done += i;
+    if ( unlikely(!guest_handle_is_null(pdone)) )
+        copy_to_guest(pdone, &done, 1);
 
     if ( unlikely(shadow_mode_enabled(d)) )
         check_pagetable(v, "post-mmu"); /* debug */
@@ -2684,7 +2709,7 @@
 }
 
 
-long do_set_gdt(unsigned long *frame_list, unsigned int entries)
+long do_set_gdt(GUEST_HANDLE(ulong) frame_list, unsigned int entries)
 {
     int nr_pages = (entries + 511) / 512;
     unsigned long frames[16];
@@ -2694,7 +2719,7 @@
     if ( entries > FIRST_RESERVED_GDT_ENTRY )
         return -EINVAL;
     
-    if ( copy_from_user(frames, frame_list, nr_pages * sizeof(unsigned long)) )
+    if ( copy_from_guest((unsigned long *)frames, frame_list, nr_pages) )
         return -EFAULT;
 
     LOCK_BIGLOCK(current->domain);
@@ -2790,52 +2815,60 @@
 
 long arch_memory_op(int op, GUEST_HANDLE(void) arg)
 {
-    struct xen_reserved_phys_area xrpa;
-    unsigned long pfn;
-    struct domain *d;
-    unsigned int i;
-
     switch ( op )
     {
-    case XENMEM_reserved_phys_area:
-        if ( copy_from_guest(&xrpa, arg, 1) )
+    case XENMEM_add_to_physmap:
+    {
+        struct xen_add_to_physmap xatp;
+        unsigned long mfn = 0, gpfn;
+        struct domain *d;
+
+        if ( copy_from_guest(&xatp, arg, 1) )
             return -EFAULT;
 
-        /* No guest has more than one reserved area. */
-        if ( xrpa.idx != 0 )
+        if ( (d = find_domain_by_id(xatp.domid)) == NULL )
             return -ESRCH;
 
-        if ( (d = find_domain_by_id(xrpa.domid)) == NULL )
-            return -ESRCH;
-
-        /* Only initialised translated guests have a reserved area. */
-        if ( !shadow_mode_translate(d) || (d->max_pages == 0) )
+        switch ( xatp.space )
+        {
+        case XENMAPSPACE_shared_info:
+            if ( xatp.idx == 0 )
+                mfn = virt_to_mfn(d->shared_info);
+            break;
+        case XENMAPSPACE_grant_table:
+            if ( xatp.idx < NR_GRANT_FRAMES )
+                mfn = virt_to_mfn(d->grant_table->shared) + xatp.idx;
+            break;
+        default:
+            break;
+        }
+        
+        if ( !shadow_mode_translate(d) || (mfn == 0) )
         {
             put_domain(d);
-            return -ESRCH;
+            return -EINVAL;
         }
 
         LOCK_BIGLOCK(d);
-        if ( d->arch.first_reserved_pfn == 0 )
-        {
-            d->arch.first_reserved_pfn = pfn = d->max_pages;
-            guest_physmap_add_page(
-                d, pfn + 0, virt_to_maddr(d->shared_info) >> PAGE_SHIFT);
-            for ( i = 0; i < NR_GRANT_FRAMES; i++ )
-                guest_physmap_add_page(
-                    d, pfn + 1 + i, gnttab_shared_mfn(d, d->grant_table, i));
-        }
+
+        /* Remove previously mapped page if it was present. */
+        if ( mfn_valid(gmfn_to_mfn(d, xatp.gpfn)) )
+            guest_remove_page(d, xatp.gpfn);
+
+        /* Unmap from old location, if any. */
+        gpfn = get_gpfn_from_mfn(mfn);
+        if ( gpfn != INVALID_M2P_ENTRY )
+            guest_physmap_remove_page(d, gpfn, mfn);
+
+        /* Map at new location. */
+        guest_physmap_add_page(d, xatp.gpfn, mfn);
+
         UNLOCK_BIGLOCK(d);
 
-        xrpa.first_gpfn = d->arch.first_reserved_pfn;
-        xrpa.nr_gpfns   = 32;
-
         put_domain(d);
 
-        if ( copy_to_guest(arg, &xrpa, 1) )
-            return -EFAULT;
-
         break;
+    }
 
     default:
         return subarch_memory_op(op, arg);
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/x86/physdev.c
--- a/xen/arch/x86/physdev.c    Tue Mar 14 20:10:21 2006
+++ b/xen/arch/x86/physdev.c    Tue Mar 14 20:50:35 2006
@@ -6,6 +6,7 @@
 #include <xen/sched.h>
 #include <xen/irq.h>
 #include <xen/event.h>
+#include <xen/guest_access.h>
 #include <asm/current.h>
 #include <asm/smpboot.h>
 #include <public/xen.h>
@@ -21,13 +22,13 @@
 /*
  * Demuxing hypercall.
  */
-long do_physdev_op(struct physdev_op *uop)
+long do_physdev_op(GUEST_HANDLE(physdev_op_t) uop)
 {
     struct physdev_op op;
     long ret;
     int  irq;
 
-    if ( unlikely(copy_from_user(&op, uop, sizeof(op)) != 0) )
+    if ( unlikely(copy_from_guest(&op, uop, 1) != 0) )
         return -EFAULT;
 
     switch ( op.cmd )
@@ -101,7 +102,7 @@
         break;
     }
 
-    if ( copy_to_user(uop, &op, sizeof(op)) )
+    if ( copy_to_guest(uop, &op, 1) )
         ret = -EFAULT;
 
     return ret;
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/x86/shadow.c
--- a/xen/arch/x86/shadow.c     Tue Mar 14 20:10:21 2006
+++ b/xen/arch/x86/shadow.c     Tue Mar 14 20:50:35 2006
@@ -202,6 +202,16 @@
  * tlbflush_timestamp holds a min & max index of valid page table entries
  * within the shadow page.
  */
+static inline void
+shadow_page_info_init(struct page_info *page,
+                      unsigned long gmfn,
+                      u32 psh_type)
+{
+    ASSERT( (gmfn & ~PGT_mfn_mask) == 0 );
+    page->u.inuse.type_info = psh_type | gmfn;
+    page->count_info = 0;
+    page->tlbflush_timestamp = 0;
+}
 
 static inline unsigned long
 alloc_shadow_page(struct domain *d,
@@ -249,6 +259,11 @@
                 l1 = map_domain_page(page_to_mfn(page + 1));
                 memset(l1, 0, PAGE_SIZE);
                 unmap_domain_page(l1);
+
+                /* we'd like to initialize the second continuous page here
+                 * and leave the first page initialization later */
+
+                shadow_page_info_init(page+1, gmfn, psh_type);
 #else
                 page = alloc_domheap_page(NULL);
                 if (!page)
@@ -294,10 +309,7 @@
 
     smfn = page_to_mfn(page);
 
-    ASSERT( (gmfn & ~PGT_mfn_mask) == 0 );
-    page->u.inuse.type_info = psh_type | gmfn;
-    page->count_info = 0;
-    page->tlbflush_timestamp = 0;
+    shadow_page_info_init(page, gmfn, psh_type);
 
     switch ( psh_type )
     {
@@ -3401,7 +3413,9 @@
     l1_pgentry_t sl1e;
     l1_pgentry_t old_sl1e;
     l2_pgentry_t sl2e;
+#ifdef __x86_64__
     u64 nx = 0;
+#endif
     int put_ref_check = 0;
     /* Check if gpfn is 2M aligned */
 
@@ -3416,7 +3430,9 @@
     l2e_remove_flags(tmp_l2e, _PAGE_PSE);
     if (l2e_get_flags(gl2e) & _PAGE_NX) {
         l2e_remove_flags(tmp_l2e, _PAGE_NX);
-        nx = 1ULL << 63;
+#ifdef __x86_64__
+        nx = PGT_high_mfn_nx;
+#endif
     }
 
 
@@ -3424,7 +3440,11 @@
     if ( !__shadow_get_l2e(v, va, &sl2e) )
         sl2e = l2e_empty();
 
+#ifdef __x86_64__
     l1_mfn = __shadow_status(d, start_gpfn | nx, PGT_fl1_shadow);
+#else
+    l1_mfn = __shadow_status(d, start_gpfn, PGT_fl1_shadow);
+#endif
 
     /* Check the corresponding l2e */
     if (l1_mfn) {
@@ -3442,7 +3462,11 @@
     } else {
         /* Allocate a new page as shadow page table if need */
         gmfn = gmfn_to_mfn(d, start_gpfn);
+#ifdef __x86_64__
         l1_mfn = alloc_shadow_page(d, start_gpfn | nx, gmfn, PGT_fl1_shadow);
+#else
+        l1_mfn = alloc_shadow_page(d, start_gpfn, gmfn, PGT_fl1_shadow);
+#endif
         if (unlikely(!l1_mfn)) {
             BUG();
         }
@@ -3582,6 +3606,11 @@
     base_idx = get_cr3_idxval(v);
 
     ASSERT( d->arch.ops->guest_paging_levels >= PAGING_L3 );
+
+#if CONFIG_PAGING_LEVELS >= 4
+    if ( (error_code & (ERROR_I | ERROR_P)) == (ERROR_I | ERROR_P) )
+        return 1;
+#endif
 
 #if CONFIG_PAGING_LEVELS == 4
     if ( d->arch.ops->guest_paging_levels == PAGING_L4 ) 
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/x86/traps.c
--- a/xen/arch/x86/traps.c      Tue Mar 14 20:10:21 2006
+++ b/xen/arch/x86/traps.c      Tue Mar 14 20:50:35 2006
@@ -132,10 +132,10 @@
     int i;
     unsigned long *stack, addr;
 
-    if ( HVM_DOMAIN(current) )
+    if ( hvm_guest(current) )
         return;
 
-    if ( VM86_MODE(regs) )
+    if ( vm86_mode(regs) )
     {
         stack = (unsigned long *)((regs->ss << 4) + (regs->esp & 0xffff));
         printk("Guest stack trace from ss:sp = %04x:%04x (VM86)\n   ",
@@ -254,7 +254,7 @@
     unsigned long *stack = ESP_BEFORE_EXCEPTION(regs), addr;
     int i;
 
-    if ( GUEST_MODE(regs) )
+    if ( guest_mode(regs) )
         return show_guest_stack(regs);
 
     printk("Xen stack trace from "__OP"sp=%p:\n   ", stack);
@@ -333,7 +333,7 @@
 
     DEBUGGER_trap_entry(trapnr, regs);
 
-    if ( !GUEST_MODE(regs) )
+    if ( !guest_mode(regs) )
         goto xen_fault;
 
     ti = &current->arch.guest_context.trap_ctxt[trapnr];
@@ -399,7 +399,7 @@
 
     DEBUGGER_trap_entry(TRAP_int3, regs);
 
-    if ( !GUEST_MODE(regs) )
+    if ( !guest_mode(regs) )
     {
         DEBUGGER_trap_fatal(TRAP_int3, regs);
         show_registers(regs);
@@ -430,6 +430,11 @@
 
     v->arch.guest_context.ctrlreg[2] = addr;
     v->vcpu_info->arch.cr2           = addr;
+
+    /* Re-set error_code.user flag appropriately for the guest. */
+    error_code &= ~4;
+    if ( !guest_kernel_mode(v, guest_cpu_user_regs()) )
+        error_code |= 4;
 
     ti = &v->arch.guest_context.trap_ctxt[TRAP_page_fault];
     tb->flags = TBF_EXCEPTION | TBF_EXCEPTION_ERRCODE;
@@ -469,7 +474,7 @@
         if ( unlikely(ret == 0) )
         {
             /* In hypervisor mode? Leave it to the #PF handler to fix up. */
-            if ( !GUEST_MODE(regs) )
+            if ( !guest_mode(regs) )
                 return 0;
             /* In guest mode? Propagate #PF to guest, with adjusted %cr2. */
             propagate_page_fault(
@@ -501,7 +506,7 @@
 
     if ( unlikely(IN_HYPERVISOR_RANGE(addr)) )
     {
-        if ( shadow_mode_external(d) && GUEST_MODE(regs) )
+        if ( shadow_mode_external(d) && guest_mode(regs) )
             return shadow_fault(addr, regs);
         if ( (addr >= GDT_LDT_VIRT_START) && (addr < GDT_LDT_VIRT_END) )
             return handle_gdt_ldt_mapping_fault(
@@ -523,7 +528,7 @@
             return EXCRET_fault_fixed;
         }
 
-        if ( KERNEL_MODE(v, regs) &&
+        if ( guest_kernel_mode(v, regs) &&
              /* Protection violation on write? No reserved-bit violation? */
              ((regs->error_code & 0xb) == 0x3) &&
              ptwr_do_page_fault(d, addr, regs) )
@@ -541,7 +546,7 @@
  * #PF error code:
  *  Bit 0: Protection violation (=1) ; Page not present (=0)
  *  Bit 1: Write access
- *  Bit 2: Supervisor mode
+ *  Bit 2: User mode (=1) ; Supervisor mode (=0)
  *  Bit 3: Reserved bit violation
  *  Bit 4: Instruction fetch
  */
@@ -559,7 +564,7 @@
     if ( unlikely((rc = fixup_page_fault(addr, regs)) != 0) )
         return rc;
 
-    if ( unlikely(!GUEST_MODE(regs)) )
+    if ( unlikely(!guest_mode(regs)) )
     {
         if ( likely((fixup = search_exception_table(regs->eip)) != 0) )
         {
@@ -615,7 +620,7 @@
 #define TOGGLE_MODE() ((void)0)
 #endif
 
-    if ( v->arch.iopl >= (KERNEL_MODE(v, regs) ? 1 : 3) )
+    if ( v->arch.iopl >= (guest_kernel_mode(v, regs) ? 1 : 3) )
         return 1;
 
     if ( v->arch.iobmp_limit > (port + bytes) )
@@ -844,7 +849,7 @@
 
     case 0xfa: /* CLI */
     case 0xfb: /* STI */
-        if ( v->arch.iopl < (KERNEL_MODE(v, regs) ? 1 : 3) )
+        if ( v->arch.iopl < (guest_kernel_mode(v, regs) ? 1 : 3) )
             goto fail;
         /*
          * This is just too dangerous to allow, in my opinion. Consider if the
@@ -863,7 +868,7 @@
     }
 
     /* Remaining instructions only emulated from guest kernel. */
-    if ( !KERNEL_MODE(v, regs) )
+    if ( !guest_kernel_mode(v, regs) )
         goto fail;
 
     /* Privileged (ring 0) instructions. */
@@ -1065,7 +1070,7 @@
     if ( regs->error_code & 1 )
         goto hardware_gp;
 
-    if ( !GUEST_MODE(regs) )
+    if ( !guest_mode(regs) )
         goto gp_in_kernel;
 
     /*
@@ -1092,7 +1097,7 @@
     {
         /* This fault must be due to <INT n> instruction. */
         ti = &current->arch.guest_context.trap_ctxt[regs->error_code>>3];
-        if ( PERMIT_SOFTINT(TI_GET_DPL(ti), v, regs) )
+        if ( permit_softint(TI_GET_DPL(ti), v, regs) )
         {
             tb->flags = TBF_EXCEPTION;
             regs->eip += 2;
@@ -1300,7 +1305,7 @@
 
     DEBUGGER_trap_entry(TRAP_debug, regs);
 
-    if ( !GUEST_MODE(regs) )
+    if ( !guest_mode(regs) )
     {
         /* Clear TF just for absolute sanity. */
         regs->eflags &= ~EF_TF;
@@ -1404,14 +1409,14 @@
 }
 
 
-long do_set_trap_table(struct trap_info *traps)
+long do_set_trap_table(GUEST_HANDLE(trap_info_t) traps)
 {
     struct trap_info cur;
     struct trap_info *dst = current->arch.guest_context.trap_ctxt;
     long rc = 0;
 
     /* If no table is presented then clear the entire virtual IDT. */
-    if ( traps == NULL )
+    if ( guest_handle_is_null(traps) )
     {
         memset(dst, 0, 256 * sizeof(*dst));
         init_int80_direct_trap(current);
@@ -1423,11 +1428,11 @@
         if ( hypercall_preempt_check() )
         {
             rc = hypercall_create_continuation(
-                __HYPERVISOR_set_trap_table, "p", traps);
-            break;
-        }
-
-        if ( copy_from_user(&cur, traps, sizeof(cur)) ) 
+                __HYPERVISOR_set_trap_table, "h", traps);
+            break;
+        }
+
+        if ( copy_from_guest(&cur, traps, 1) )
         {
             rc = -EFAULT;
             break;
@@ -1443,7 +1448,7 @@
         if ( cur.vector == 0x80 )
             init_int80_direct_trap(current);
 
-        traps++;
+        guest_handle_add_offset(traps, 1);
     }
 
     return rc;
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/x86/x86_32/domain_page.c
--- a/xen/arch/x86/x86_32/domain_page.c Tue Mar 14 20:10:21 2006
+++ b/xen/arch/x86/x86_32/domain_page.c Tue Mar 14 20:50:35 2006
@@ -28,7 +28,7 @@
      * then it means we are running on the idle domain's page table and must
      * therefore use its mapcache.
      */
-    if ( unlikely(!pagetable_get_pfn(v->arch.guest_table)) && !HVM_DOMAIN(v) )
+    if ( unlikely(!pagetable_get_pfn(v->arch.guest_table)) && !hvm_guest(v) )
     {
         /* If we really are idling, perform lazy context switch now. */
         if ( (v = idle_vcpu[smp_processor_id()]) == current )
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/x86/x86_32/entry.S
--- a/xen/arch/x86/x86_32/entry.S       Tue Mar 14 20:10:21 2006
+++ b/xen/arch/x86/x86_32/entry.S       Tue Mar 14 20:50:35 2006
@@ -586,6 +586,13 @@
         movl %eax,UREGS_eax(%ecx)
         jmp  do_sched_op
 
+do_arch_sched_op_new:
+        # Ensure we return success even if we return via schedule_tail()
+        xorl %eax,%eax
+        GET_GUEST_REGS(%ecx)
+        movl %eax,UREGS_eax(%ecx)
+        jmp  do_sched_op_new
+
 .data
 
 ENTRY(exception_table)
@@ -640,6 +647,7 @@
         .long do_mmuext_op
         .long do_acm_op
         .long do_nmi_op
+        .long do_arch_sched_op_new
         .rept NR_hypercalls-((.-hypercall_table)/4)
         .long do_ni_hypercall
         .endr
@@ -674,6 +682,7 @@
         .byte 4 /* do_mmuext_op         */
         .byte 1 /* do_acm_op            */
         .byte 2 /* do_nmi_op            */
+        .byte 2 /* do_arch_sched_op_new */
         .rept NR_hypercalls-(.-hypercall_args_table)
         .byte 0 /* do_ni_hypercall      */
         .endr
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/x86/x86_32/mm.c
--- a/xen/arch/x86/x86_32/mm.c  Tue Mar 14 20:10:21 2006
+++ b/xen/arch/x86/x86_32/mm.c  Tue Mar 14 20:50:35 2006
@@ -144,7 +144,7 @@
     flush_tlb_all_pge();
 }
 
-void subarch_init_memory(struct domain *dom_xen)
+void subarch_init_memory(void)
 {
     unsigned long m2p_start_mfn;
     unsigned int i, j;
@@ -175,10 +175,7 @@
         for ( j = 0; j < L2_PAGETABLE_ENTRIES; j++ )
         {
             struct page_info *page = mfn_to_page(m2p_start_mfn + j);
-            page->count_info = PGC_allocated | 1;
-            /* Ensure it's only mapped read-only by domains. */
-            page->u.inuse.type_info = PGT_gdt_page | 1;
-            page_set_owner(page, dom_xen);
+            share_xen_page_with_privileged_guests(page, XENSHARE_readonly);
         }
     }
 
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/x86/x86_32/seg_fixup.c
--- a/xen/arch/x86/x86_32/seg_fixup.c   Tue Mar 14 20:10:21 2006
+++ b/xen/arch/x86/x86_32/seg_fixup.c   Tue Mar 14 20:50:35 2006
@@ -280,7 +280,7 @@
     int            gs_override = 0;
 
     /* WARNING: We only work for ring-3 segments. */
-    if ( unlikely(VM86_MODE(regs)) || unlikely(!RING_3(regs)) )
+    if ( unlikely(vm86_mode(regs)) || unlikely(!ring_3(regs)) )
     {
         DPRINTK("Taken fault at bad CS %04x\n", regs->cs);
         goto fail;
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/x86/x86_32/traps.c
--- a/xen/arch/x86/x86_32/traps.c       Tue Mar 14 20:10:21 2006
+++ b/xen/arch/x86/x86_32/traps.c       Tue Mar 14 20:50:35 2006
@@ -24,7 +24,7 @@
     char taint_str[TAINT_STRING_MAX_LEN];
     const char *context;
 
-    if ( HVM_DOMAIN(current) && GUEST_MODE(regs) )
+    if ( hvm_guest(current) && guest_mode(regs) )
     {
         context = "hvm";
         hvm_store_cpu_guest_regs(current, &fault_regs);
@@ -32,9 +32,9 @@
     }
     else
     {
-        context = GUEST_MODE(regs) ? "guest" : "hypervisor";
-
-        if ( !GUEST_MODE(regs) )
+        context = guest_mode(regs) ? "guest" : "hypervisor";
+
+        if ( !guest_mode(regs) )
         {
             fault_regs.esp = (unsigned long)&regs->esp;
             fault_regs.ss = read_segment_register(ss);
@@ -53,7 +53,7 @@
            print_tainted(taint_str));
     printk("CPU:    %d\nEIP:    %04x:[<%08x>]",
            smp_processor_id(), fault_regs.cs, fault_regs.eip);
-    if ( !GUEST_MODE(regs) )
+    if ( !guest_mode(regs) )
         print_symbol(" %s", fault_regs.eip);
     printk("\nEFLAGS: %08x   CONTEXT: %s\n", fault_regs.eflags, context);
     printk("eax: %08x   ebx: %08x   ecx: %08x   edx: %08x\n",
@@ -172,17 +172,17 @@
     regs->esp += 4;
     regs->eflags = (eflags & ~X86_EFLAGS_IOPL) | X86_EFLAGS_IF;
 
-    if ( VM86_MODE(regs) )
+    if ( vm86_mode(regs) )
     {
         /* Return to VM86 mode: pop and restore ESP,SS,ES,DS,FS and GS. */
         if ( __copy_from_user(&regs->esp, (void __user *)regs->esp, 24) )
             domain_crash_synchronous();
     }
-    else if ( unlikely(RING_0(regs)) )
-    {
-        domain_crash_synchronous();
-    }
-    else if ( !RING_1(regs) )
+    else if ( unlikely(ring_0(regs)) )
+    {
+        domain_crash_synchronous();
+    }
+    else if ( !ring_1(regs) )
     {
         /* Return to ring 2/3: pop and restore ESP and SS. */
         if ( __copy_from_user(&regs->esp, (void __user *)regs->esp, 8) )
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/x86/x86_64/entry.S
--- a/xen/arch/x86/x86_64/entry.S       Tue Mar 14 20:10:21 2006
+++ b/xen/arch/x86/x86_64/entry.S       Tue Mar 14 20:50:35 2006
@@ -495,6 +495,13 @@
         movq  %rax,UREGS_rax(%r10)
         jmp   do_sched_op
 
+do_arch_sched_op_new:
+        # Ensure we return success even if we return via schedule_tail()
+        xorl  %eax,%eax
+        GET_GUEST_REGS(%r10)
+        movq  %rax,UREGS_rax(%r10)
+        jmp   do_sched_op_new
+
 .data
 
 ENTRY(exception_table)
@@ -549,6 +556,7 @@
         .quad do_mmuext_op
         .quad do_acm_op
         .quad do_nmi_op
+        .quad do_arch_sched_op_new
         .rept NR_hypercalls-((.-hypercall_table)/8)
         .quad do_ni_hypercall
         .endr
@@ -583,6 +591,7 @@
         .byte 4 /* do_mmuext_op         */
         .byte 1 /* do_acm_op            */
         .byte 2 /* do_nmi_op            */
+        .byte 2 /* do_arch_sched_op_new */
         .rept NR_hypercalls-(.-hypercall_args_table)
         .byte 0 /* do_ni_hypercall      */
         .endr
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/x86/x86_64/mm.c
--- a/xen/arch/x86/x86_64/mm.c  Tue Mar 14 20:10:21 2006
+++ b/xen/arch/x86/x86_64/mm.c  Tue Mar 14 20:50:35 2006
@@ -134,7 +134,7 @@
     flush_tlb_all_pge();
 }
 
-void subarch_init_memory(struct domain *dom_xen)
+void subarch_init_memory(void)
 {
     unsigned long i, v, m2p_start_mfn;
     l3_pgentry_t l3e;
@@ -174,11 +174,7 @@
         for ( i = 0; i < L1_PAGETABLE_ENTRIES; i++ )
         {
             struct page_info *page = mfn_to_page(m2p_start_mfn + i);
-            page->count_info = PGC_allocated | 1;
-            /* gdt to make sure it's only mapped read-only by non-privileged
-               domains. */
-            page->u.inuse.type_info = PGT_gdt_page | 1;
-            page_set_owner(page, dom_xen);
+            share_xen_page_with_privileged_guests(page, XENSHARE_readonly);
         }
     }
 }
diff -r dc50cdd66c5c -r 0ed4a312765b xen/arch/x86/x86_64/traps.c
--- a/xen/arch/x86/x86_64/traps.c       Tue Mar 14 20:10:21 2006
+++ b/xen/arch/x86/x86_64/traps.c       Tue Mar 14 20:50:35 2006
@@ -24,7 +24,7 @@
     char taint_str[TAINT_STRING_MAX_LEN];
     const char *context;
 
-    if ( HVM_DOMAIN(current) && GUEST_MODE(regs) )
+    if ( hvm_guest(current) && guest_mode(regs) )
     {
         context = "hvm";
         hvm_store_cpu_guest_regs(current, &fault_regs);
@@ -32,7 +32,7 @@
     }
     else
     {
-        context = GUEST_MODE(regs) ? "guest" : "hypervisor";
+        context = guest_mode(regs) ? "guest" : "hypervisor";
         fault_crs[0] = read_cr0();
         fault_crs[3] = read_cr3();
         fault_regs.ds = read_segment_register(ds);
@@ -46,7 +46,7 @@
            print_tainted(taint_str));
     printk("CPU:    %d\nRIP:    %04x:[<%016lx>]",
            smp_processor_id(), fault_regs.cs, fault_regs.rip);
-    if ( !GUEST_MODE(regs) )
+    if ( !guest_mode(regs) )
         print_symbol(" %s", fault_regs.rip);
     printk("\nRFLAGS: %016lx   CONTEXT: %s\n", fault_regs.rflags, context);
     printk("rax: %016lx   rbx: %016lx   rcx: %016lx\n",
diff -r dc50cdd66c5c -r 0ed4a312765b xen/common/acm_ops.c
--- a/xen/common/acm_ops.c      Tue Mar 14 20:10:21 2006
+++ b/xen/common/acm_ops.c      Tue Mar 14 20:50:35 2006
@@ -25,13 +25,14 @@
 #include <xen/event.h>
 #include <xen/trace.h>
 #include <xen/console.h>
+#include <xen/guest_access.h>
 #include <asm/shadow.h>
 #include <public/sched_ctl.h>
 #include <acm/acm_hooks.h>
 
 #ifndef ACM_SECURITY
 
-long do_acm_op(struct acm_op * u_acm_op)
+long do_acm_op(GUEST_HANDLE(acm_op_t) u_acm_op)
 {
     return -ENOSYS;
 }
@@ -56,7 +57,7 @@
     return 0;
 }
 
-long do_acm_op(struct acm_op * u_acm_op)
+long do_acm_op(GUEST_HANDLE(acm_op_t) u_acm_op)
 {
     long ret = 0;
     struct acm_op curop, *op = &curop;
@@ -64,7 +65,7 @@
     if (acm_authorize_acm_ops(current->domain, POLICY))
         return -EPERM;
 
-    if (copy_from_user(op, u_acm_op, sizeof(*op)))
+    if (copy_from_guest(op, u_acm_op, 1))
         return -EFAULT;
 
     if (op->interface_version != ACM_INTERFACE_VERSION)
@@ -88,7 +89,7 @@
             ret = acm_get_policy(op->u.getpolicy.pullcache,
                                  op->u.getpolicy.pullcache_size);
         if (!ret)
-            copy_to_user(u_acm_op, op, sizeof(*op));
+            copy_to_guest(u_acm_op, op, 1);
     }
     break;
 
@@ -99,7 +100,7 @@
             ret = acm_dump_statistics(op->u.dumpstats.pullcache,
                                       op->u.dumpstats.pullcache_size);
         if (!ret)
-            copy_to_user(u_acm_op, op, sizeof(*op));
+            copy_to_guest(u_acm_op, op, 1);
     }
     break;
 
@@ -139,7 +140,7 @@
                            op->u.getssid.ssidbuf,
                            op->u.getssid.ssidbuf_size);
         if (!ret)
-            copy_to_user(u_acm_op, op, sizeof(*op));
+            copy_to_guest(u_acm_op, op, 1);
     }
     break;
 
@@ -215,7 +216,7 @@
             ret = -ESRCH;
 
         if (!ret)
-            copy_to_user(u_acm_op, op, sizeof(*op));
+            copy_to_guest(u_acm_op, op, 1);
     }
     break;
 
diff -r dc50cdd66c5c -r 0ed4a312765b xen/common/bitmap.c
--- a/xen/common/bitmap.c       Tue Mar 14 20:10:21 2006
+++ b/xen/common/bitmap.c       Tue Mar 14 20:50:35 2006
@@ -10,7 +10,6 @@
 #include <xen/errno.h>
 #include <xen/bitmap.h>
 #include <xen/bitops.h>
-#include <asm/uaccess.h>
 
 /*
  * bitmaps provide an array of bits, implemented using an an
diff -r dc50cdd66c5c -r 0ed4a312765b xen/common/domain.c
--- a/xen/common/domain.c       Tue Mar 14 20:10:21 2006
+++ b/xen/common/domain.c       Tue Mar 14 20:50:35 2006
@@ -18,6 +18,7 @@
 #include <xen/domain_page.h>
 #include <xen/rangeset.h>
 #include <xen/guest_access.h>
+#include <xen/hypercall.h>
 #include <asm/debugger.h>
 #include <public/dom0_ops.h>
 #include <public/sched.h>
@@ -399,7 +400,7 @@
     return arch_set_info_guest(v, ctxt);
 }
 
-long do_vcpu_op(int cmd, int vcpuid, void *arg)
+long do_vcpu_op(int cmd, int vcpuid, GUEST_HANDLE(void) arg)
 {
     struct domain *d = current->domain;
     struct vcpu *v;
@@ -421,7 +422,7 @@
             break;
         }
 
-        if ( copy_from_user(ctxt, arg, sizeof(*ctxt)) )
+        if ( copy_from_guest(ctxt, arg, 1) )
         {
             xfree(ctxt);
             rc = -EFAULT;
@@ -457,35 +458,13 @@
     {
         struct vcpu_runstate_info runstate;
         vcpu_runstate_get(v, &runstate);
-        if ( copy_to_user(arg, &runstate, sizeof(runstate)) )
+        if ( copy_to_guest(arg, &runstate, 1) )
             rc = -EFAULT;
         break;
     }
 
-    case VCPUOP_register_runstate_memory_area:
-    {
-        struct vcpu_register_runstate_memory_area area;
-
-        rc = -EINVAL;
-        if ( v != current )
-            break;
-
-        rc = -EFAULT;
-        if ( copy_from_user(&area, arg, sizeof(area)) )
-            break;
-
-        if ( !access_ok(area.addr.v, sizeof(*area.addr.v)) )
-            break;
-
-        rc = 0;
-        v->runstate_guest = area.addr.v;
-        __copy_to_user(v->runstate_guest, &v->runstate, sizeof(v->runstate));
-
-        break;
-    }
-
     default:
-        rc = -ENOSYS;
+        rc = arch_do_vcpu_op(cmd, v, arg);
         break;
     }
 
diff -r dc50cdd66c5c -r 0ed4a312765b xen/common/event_channel.c
--- a/xen/common/event_channel.c        Tue Mar 14 20:10:21 2006
+++ b/xen/common/event_channel.c        Tue Mar 14 20:50:35 2006
@@ -23,6 +23,7 @@
 #include <xen/event.h>
 #include <xen/irq.h>
 #include <xen/iocap.h>
+#include <xen/guest_access.h>
 #include <asm/current.h>
 
 #include <public/xen.h>
@@ -437,6 +438,47 @@
     return ret;
 }
 
+void evtchn_set_pending(struct vcpu *v, int port)
+{
+    struct domain *d = v->domain;
+    shared_info_t *s = d->shared_info;
+
+    /*
+     * The following bit operations must happen in strict order.
+     * NB. On x86, the atomic bit operations also act as memory barriers.
+     * There is therefore sufficiently strict ordering for this architecture --
+     * others may require explicit memory barriers.
+     */
+
+    if ( test_and_set_bit(port, &s->evtchn_pending[0]) )
+        return;
+
+    if ( !test_bit        (port, &s->evtchn_mask[0])    &&
+         !test_and_set_bit(port / BITS_PER_LONG,
+                           &v->vcpu_info->evtchn_pending_sel) &&
+         !test_and_set_bit(0, &v->vcpu_info->evtchn_upcall_pending) )
+    {
+        evtchn_notify(v);
+    }
+    else if ( unlikely(test_bit(_VCPUF_blocked, &v->vcpu_flags) &&
+                       v->vcpu_info->evtchn_upcall_mask) )
+    {
+        /*
+         * Blocked and masked will usually mean that the VCPU executed 
+         * SCHEDOP_poll. Kick the VCPU in case this port is in its poll list.
+         */
+        vcpu_unblock(v);
+    }
+}
+
+void send_guest_virq(struct vcpu *v, int virq)
+{
+    int port = v->virq_to_evtchn[virq];
+
+    if ( likely(port != 0) )
+        evtchn_set_pending(v, port);
+}
+
 void send_guest_pirq(struct domain *d, int pirq)
 {
     int port = d->pirq_to_evtchn[pirq];
@@ -578,12 +620,12 @@
     return 0;
 }
 
-long do_event_channel_op(struct evtchn_op *uop)
+long do_event_channel_op(GUEST_HANDLE(evtchn_op_t) uop)
 {
     long rc;
     struct evtchn_op op;
 
-    if ( copy_from_user(&op, uop, sizeof(op)) != 0 )
+    if ( copy_from_guest(&op, uop, 1) != 0 )
         return -EFAULT;
 
     if (acm_pre_event_channel(&op))
@@ -593,31 +635,31 @@
     {
     case EVTCHNOP_alloc_unbound:
         rc = evtchn_alloc_unbound(&op.u.alloc_unbound);
-        if ( (rc == 0) && (copy_to_user(uop, &op, sizeof(op)) != 0) )
+        if ( (rc == 0) && (copy_to_guest(uop, &op, 1) != 0) )
             rc = -EFAULT; /* Cleaning up here would be a mess! */
         break;
 
     case EVTCHNOP_bind_interdomain:
         rc = evtchn_bind_interdomain(&op.u.bind_interdomain);
-        if ( (rc == 0) && (copy_to_user(uop, &op, sizeof(op)) != 0) )
+        if ( (rc == 0) && (copy_to_guest(uop, &op, 1) != 0) )
             rc = -EFAULT; /* Cleaning up here would be a mess! */
         break;
 
     case EVTCHNOP_bind_virq:
         rc = evtchn_bind_virq(&op.u.bind_virq);
-        if ( (rc == 0) && (copy_to_user(uop, &op, sizeof(op)) != 0) )
+        if ( (rc == 0) && (copy_to_guest(uop, &op, 1) != 0) )
             rc = -EFAULT; /* Cleaning up here would be a mess! */
         break;
 
     case EVTCHNOP_bind_ipi:
         rc = evtchn_bind_ipi(&op.u.bind_ipi);
-        if ( (rc == 0) && (copy_to_user(uop, &op, sizeof(op)) != 0) )
+        if ( (rc == 0) && (copy_to_guest(uop, &op, 1) != 0) )
             rc = -EFAULT; /* Cleaning up here would be a mess! */
         break;
 
     case EVTCHNOP_bind_pirq:
         rc = evtchn_bind_pirq(&op.u.bind_pirq);
-        if ( (rc == 0) && (copy_to_user(uop, &op, sizeof(op)) != 0) )
+        if ( (rc == 0) && (copy_to_guest(uop, &op, 1) != 0) )
             rc = -EFAULT; /* Cleaning up here would be a mess! */
         break;
 
@@ -631,7 +673,7 @@
 
     case EVTCHNOP_status:
         rc = evtchn_status(&op.u.status);
-        if ( (rc == 0) && (copy_to_user(uop, &op, sizeof(op)) != 0) )
+        if ( (rc == 0) && (copy_to_guest(uop, &op, 1) != 0) )
             rc = -EFAULT;
         break;
 
diff -r dc50cdd66c5c -r 0ed4a312765b xen/common/gdbstub.c
--- a/xen/common/gdbstub.c      Tue Mar 14 20:10:21 2006
+++ b/xen/common/gdbstub.c      Tue Mar 14 20:50:35 2006
@@ -35,7 +35,6 @@
    than any actual intention.  It doesn't at the moment. */
 
 #include <xen/lib.h>
-#include <asm/uaccess.h>
 #include <xen/spinlock.h>
 #include <xen/serial.h>
 #include <xen/irq.h>
@@ -348,7 +347,10 @@
         }
     }
 
-    gdb_write_to_packet_str((x != length) ? "OK" : "E11", ctx);
+    if (x == length)
+        gdb_write_to_packet_str("OK", ctx);
+    else
+        gdb_write_to_packet_str("E11", ctx);
 
     dbg_printk("Write done.\n");
 
@@ -397,13 +399,18 @@
         break;
     case 'M': /* Write memory */
         addr = simple_strtoul(ctx->in_buf + 1, &ptr, 16);
-        if ( (ptr == (ctx->in_buf + 1)) || (ptr[0] != ':') )
+        if ( (ptr == (ctx->in_buf + 1)) || (ptr[0] != ',') )
         {
             gdb_send_reply("E03", ctx);
             return 0;
         }
         length = simple_strtoul(ptr + 1, &ptr, 16);
-        gdb_cmd_write_mem(addr, length, ptr, ctx);
+        if ( ptr[0] != ':')
+        {
+            gdb_send_reply("E04", ctx);
+            return 0;
+        }
+        gdb_cmd_write_mem(addr, length, ptr + 1, ctx);
         break;
     case 'p': /* read register */
         addr = simple_strtoul(ctx->in_buf + 1, &ptr, 16);
@@ -419,12 +426,6 @@
         }
         gdb_arch_read_reg(addr, regs, ctx);
         break;
-    case 'Z': /* We need to claim to support these or gdb
-                 won't let you continue the process. */
-    case 'z':
-        gdb_send_reply("OK", ctx);
-        break;
-
     case 'D':
         ctx->currently_attached = 0;
         gdb_send_reply("OK", ctx);
diff -r dc50cdd66c5c -r 0ed4a312765b xen/common/grant_table.c
--- a/xen/common/grant_table.c  Tue Mar 14 20:10:21 2006
+++ b/xen/common/grant_table.c  Tue Mar 14 20:50:35 2006
@@ -28,8 +28,9 @@
 #include <xen/sched.h>
 #include <xen/shadow.h>
 #include <xen/mm.h>
+#include <xen/trace.h>
+#include <xen/guest_access.h>
 #include <acm/acm_hooks.h>
-#include <xen/trace.h>
 
 #define PIN_FAIL(_lbl, _rc, _f, _a...)          \
     do {                                        \
@@ -187,7 +188,7 @@
 
             /* Merge two 16-bit values into a 32-bit combined update. */
             /* NB. Endianness! */
-            prev_scombo = scombo = ((u32)sdom << 16) | (u32)sflags;
+            scombo = ((u32)sdom << 16) | (u32)sflags;
 
             new_scombo = scombo | GTF_reading;
             if ( !(op->flags & GNTMAP_readonly) )
@@ -198,12 +199,7 @@
                              "Attempt to write-pin a r/o grant entry.\n");
             }
 
-            /* NB. prev_scombo is updated in place to seen value. */
-            if ( unlikely(cmpxchg_user((u32 *)&sha->flags,
-                                       prev_scombo,
-                                       new_scombo)) )
-                PIN_FAIL(unlock_out, GNTST_general_error,
-                         "Fault while modifying shared flags and domid.\n");
+            prev_scombo = cmpxchg((u32 *)&sha->flags, scombo, new_scombo);
 
             /* Did the combined update work (did we see what we expected?). */
             if ( likely(prev_scombo == scombo) )
@@ -306,17 +302,17 @@
 
 static long
 gnttab_map_grant_ref(
-    struct gnttab_map_grant_ref *uop, unsigned int count)
+    GUEST_HANDLE(gnttab_map_grant_ref_t) uop, unsigned int count)
 {
     int i;
     struct gnttab_map_grant_ref op;
 
     for ( i = 0; i < count; i++ )
     {
-        if ( unlikely(__copy_from_user(&op, &uop[i], sizeof(op))) )
+        if ( unlikely(__copy_from_guest_offset(&op, uop, i, 1)) )
             return -EFAULT;
         __gnttab_map_grant_ref(&op);
-        if ( unlikely(__copy_to_user(&uop[i], &op, sizeof(op))) )
+        if ( unlikely(__copy_to_guest_offset(uop, i, &op, 1)) )
             return -EFAULT;
     }
 
@@ -443,17 +439,17 @@
 
 static long
 gnttab_unmap_grant_ref(
-    struct gnttab_unmap_grant_ref *uop, unsigned int count)
+    GUEST_HANDLE(gnttab_unmap_grant_ref_t) uop, unsigned int count)
 {
     int i;
     struct gnttab_unmap_grant_ref op;
 
     for ( i = 0; i < count; i++ )
     {
-        if ( unlikely(__copy_from_user(&op, &uop[i], sizeof(op))) )
+        if ( unlikely(__copy_from_guest_offset(&op, uop, i, 1)) )
             goto fault;
         __gnttab_unmap_grant_ref(&op);
-        if ( unlikely(__copy_to_user(&uop[i], &op, sizeof(op))) )
+        if ( unlikely(__copy_to_guest_offset(uop, i, &op, 1)) )
             goto fault;
     }
 
@@ -467,7 +463,7 @@
 
 static long 
 gnttab_setup_table(
-    struct gnttab_setup_table *uop, unsigned int count)
+    GUEST_HANDLE(gnttab_setup_table_t) uop, unsigned int count)
 {
     struct gnttab_setup_table op;
     struct domain *d;
@@ -478,7 +474,7 @@
     if ( count != 1 )
         return -EINVAL;
 
-    if ( unlikely(copy_from_user(&op, uop, sizeof(op)) != 0) )
+    if ( unlikely(copy_from_guest(&op, uop, 1) != 0) )
     {
         DPRINTK("Fault while reading gnttab_setup_table_t.\n");
         return -EFAULT;
@@ -517,14 +513,14 @@
         for ( i = 0; i < op.nr_frames; i++ )
         {
             gmfn = gnttab_shared_gmfn(d, d->grant_table, i);
-            (void)copy_to_user(&op.frame_list[i], &gmfn, sizeof(gmfn));
+            (void)copy_to_guest_offset(op.frame_list, i, &gmfn, 1);
         }
     }
 
     put_domain(d);
 
  out:
-    if ( unlikely(copy_to_user(uop, &op, sizeof(op))) )
+    if ( unlikely(copy_to_guest(uop, &op, 1)) )
         return -EFAULT;
 
     return 0;
@@ -572,15 +568,10 @@
 
         /* Merge two 16-bit values into a 32-bit combined update. */
         /* NB. Endianness! */
-        prev_scombo = scombo = ((u32)sdom << 16) | (u32)sflags;
-
-        /* NB. prev_scombo is updated in place to seen value. */
-        if ( unlikely(cmpxchg_user((u32 *)&sha->flags, prev_scombo, 
-                                   prev_scombo | GTF_transfer_committed)) )
-        {
-            DPRINTK("Fault while modifying shared flags and domid.\n");
-            goto fail;
-        }
+        scombo = ((u32)sdom << 16) | (u32)sflags;
+
+        prev_scombo = cmpxchg((u32 *)&sha->flags, scombo,
+                              scombo | GTF_transfer_committed);
 
         /* Did the combined update work (did we see what we expected?). */
         if ( likely(prev_scombo == scombo) )
@@ -608,7 +599,7 @@
 
 static long
 gnttab_transfer(
-    struct gnttab_transfer *uop, unsigned int count)
+    GUEST_HANDLE(gnttab_transfer_t) uop, unsigned int count)
 {
     struct domain *d = current->domain;
     struct domain *e;
@@ -621,7 +612,7 @@
     for ( i = 0; i < count; i++ )
     {
         /* Read from caller address space. */
-        if ( unlikely(__copy_from_user(&gop, &uop[i], sizeof(gop))) )
+        if ( unlikely(__copy_from_guest_offset(&gop, uop, i, 1)) )
         {
             DPRINTK("gnttab_transfer: error reading req %d/%d\n", i, count);
             return -EFAULT;
@@ -708,7 +699,7 @@
         gop.status = GNTST_okay;
 
     copyback:
-        if ( unlikely(__copy_from_user(&uop[i], &gop, sizeof(gop))) )
+        if ( unlikely(__copy_to_guest_offset(uop, i, &gop, 1)) )
         {
             DPRINTK("gnttab_transfer: error writing resp %d/%d\n", i, count);
             return -EFAULT;
@@ -718,9 +709,9 @@
     return 0;
 }
 
-long 
+long
 do_grant_table_op(
-    unsigned int cmd, void *uop, unsigned int count)
+    unsigned int cmd, GUEST_HANDLE(void) uop, unsigned int count)
 {
     long rc;
     struct domain *d = current->domain;
@@ -736,27 +727,38 @@
     switch ( cmd )
     {
     case GNTTABOP_map_grant_ref:
-        if ( unlikely(!array_access_ok(
-            uop, count, sizeof(gnttab_map_grant_ref_t))) )
+    {
+        GUEST_HANDLE(gnttab_map_grant_ref_t) map =
+            guest_handle_cast(uop, gnttab_map_grant_ref_t);
+        if ( unlikely(!guest_handle_okay(map, count)) )
             goto out;
-        rc = gnttab_map_grant_ref((gnttab_map_grant_ref_t *)uop, count);
+        rc = gnttab_map_grant_ref(map, count);
         break;
+    }
     case GNTTABOP_unmap_grant_ref:
-        if ( unlikely(!array_access_ok(
-            uop, count, sizeof(gnttab_unmap_grant_ref_t))) )
+    {
+        GUEST_HANDLE(gnttab_unmap_grant_ref_t) unmap =
+            guest_handle_cast(uop, gnttab_unmap_grant_ref_t);
+        if ( unlikely(!guest_handle_okay(unmap, count)) )
             goto out;
-        rc = gnttab_unmap_grant_ref(
-            (gnttab_unmap_grant_ref_t *)uop, count);
+        rc = gnttab_unmap_grant_ref(unmap, count);
         break;
+    }
     case GNTTABOP_setup_table:
-        rc = gnttab_setup_table((gnttab_setup_table_t *)uop, count);
+    {
+        rc = gnttab_setup_table(
+            guest_handle_cast(uop, gnttab_setup_table_t), count);
         break;
+    }
     case GNTTABOP_transfer:
-        if (unlikely(!array_access_ok(
-            uop, count, sizeof(gnttab_transfer_t))))
+    {
+        GUEST_HANDLE(gnttab_transfer_t) transfer =
+            guest_handle_cast(uop, gnttab_transfer_t);
+        if ( unlikely(!guest_handle_okay(transfer, count)) )
             goto out;
-        rc = gnttab_transfer(uop, count);
+        rc = gnttab_transfer(transfer, count);
         break;
+    }
     default:
         rc = -ENOSYS;
         break;
diff -r dc50cdd66c5c -r 0ed4a312765b xen/common/kernel.c
--- a/xen/common/kernel.c       Tue Mar 14 20:10:21 2006
+++ b/xen/common/kernel.c       Tue Mar 14 20:50:35 2006
@@ -11,6 +11,7 @@
 #include <xen/compile.h>
 #include <xen/sched.h>
 #include <xen/shadow.h>
+#include <xen/guest_access.h>
 #include <asm/current.h>
 #include <public/nmi.h>
 #include <public/version.h>
@@ -116,7 +117,7 @@
  * Simple hypercalls.
  */
 
-long do_xen_version(int cmd, void *arg)
+long do_xen_version(int cmd, GUEST_HANDLE(void) arg)
 {
     switch ( cmd )
     {
@@ -129,7 +130,7 @@
     {
         xen_extraversion_t extraversion;
         safe_strcpy(extraversion, XEN_EXTRAVERSION);
-        if ( copy_to_user(arg, extraversion, sizeof(extraversion)) )
+        if ( copy_to_guest(arg, (char *)extraversion, sizeof(extraversion)) )
             return -EFAULT;
         return 0;
     }
@@ -141,7 +142,7 @@
         safe_strcpy(info.compile_by,     XEN_COMPILE_BY);
         safe_strcpy(info.compile_domain, XEN_COMPILE_DOMAIN);
         safe_strcpy(info.compile_date,   XEN_COMPILE_DATE);
-        if ( copy_to_user(arg, &info, sizeof(info)) )
+        if ( copy_to_guest(arg, &info, 1) )
             return -EFAULT;
         return 0;
     }
@@ -154,7 +155,7 @@
         memset(info, 0, sizeof(info));
         arch_get_xen_caps(info);
 
-        if ( copy_to_user(arg, info, sizeof(info)) )
+        if ( copy_to_guest(arg, (char *)info, sizeof(info)) )
             return -EFAULT;
         return 0;
     }
@@ -164,7 +165,7 @@
         xen_platform_parameters_t params = {
             .virt_start = HYPERVISOR_VIRT_START
         };
-        if ( copy_to_user(arg, &params, sizeof(params)) )
+        if ( copy_to_guest(arg, &params, 1) )
             return -EFAULT;
         return 0;
         
@@ -174,7 +175,7 @@
     {
         xen_changeset_info_t chgset;
         safe_strcpy(chgset, XEN_CHANGESET);
-        if ( copy_to_user(arg, chgset, sizeof(chgset)) )
+        if ( copy_to_guest(arg, (char *)chgset, sizeof(chgset)) )
             return -EFAULT;
         return 0;
     }
@@ -183,7 +184,7 @@
     {
         xen_feature_info_t fi;
 
-        if ( copy_from_user(&fi, arg, sizeof(fi)) )
+        if ( copy_from_guest(&fi, arg, 1) )
             return -EFAULT;
 
         switch ( fi.submap_idx )
@@ -202,7 +203,7 @@
             return -EINVAL;
         }
 
-        if ( copy_to_user(arg, &fi, sizeof(fi)) )
+        if ( copy_to_guest(arg, &fi, 1) )
             return -EFAULT;
         return 0;
     }
@@ -212,31 +213,34 @@
     return -ENOSYS;
 }
 
-long do_nmi_op(unsigned int cmd, void *arg)
+long do_nmi_op(unsigned int cmd, GUEST_HANDLE(void) arg)
 {
     struct vcpu *v = current;
     struct domain *d = current->domain;
+    struct xennmi_callback cb;
     long rc = 0;
 
     switch ( cmd )
     {
     case XENNMI_register_callback:
+        rc = -EINVAL;
         if ( (d->domain_id != 0) || (v->vcpu_id != 0) )
-        { 
-           rc = -EINVAL;
-        }
-        else
-        {
-            v->nmi_addr = (unsigned long)arg;
+            break;
+
+        rc = -EFAULT;
+        if ( copy_from_guest(&cb, arg, 1) )
+            break;
+
+        v->nmi_addr = cb.handler_address;
 #ifdef CONFIG_X86
-            /*
-             * If no handler was registered we can 'lose the NMI edge'.
-             * Re-assert it now.
-             */
-            if ( d->shared_info->arch.nmi_reason != 0 )
-                set_bit(_VCPUF_nmi_pending, &v->vcpu_flags);
+        /*
+         * If no handler was registered we can 'lose the NMI edge'. Re-assert 
+         * it now.
+         */
+        if ( d->shared_info->arch.nmi_reason != 0 )
+            set_bit(_VCPUF_nmi_pending, &v->vcpu_flags);
 #endif
-        }
+        rc = 0;
         break;
     case XENNMI_unregister_callback:
         v->nmi_addr = 0;
diff -r dc50cdd66c5c -r 0ed4a312765b xen/common/keyhandler.c
--- a/xen/common/keyhandler.c   Tue Mar 14 20:10:21 2006
+++ b/xen/common/keyhandler.c   Tue Mar 14 20:50:35 2006
@@ -14,6 +14,7 @@
 #include <xen/rangeset.h>
 #include <asm/debugger.h>
 #include <asm/shadow.h>
+#include <asm/div64.h>
 
 #define KEY_MAX 256
 #define STR_MAX  64
@@ -168,6 +169,58 @@
     read_unlock(&domlist_lock);
 }
 
+static cpumask_t read_clocks_cpumask = CPU_MASK_NONE;
+static s_time_t read_clocks_time[NR_CPUS];
+
+static void read_clocks_slave(void *unused)
+{
+    unsigned int cpu = smp_processor_id();
+    while ( !cpu_isset(cpu, read_clocks_cpumask) )
+        cpu_relax();
+    read_clocks_time[cpu] = NOW();
+    cpu_clear(cpu, read_clocks_cpumask);
+}
+
+static void read_clocks(unsigned char key)
+{
+    unsigned int cpu = smp_processor_id(), min_cpu, max_cpu;
+    u64 min, max, dif, difus;
+    static DEFINE_SPINLOCK(lock);
+
+    spin_lock(&lock);
+
+    smp_call_function(read_clocks_slave, NULL, 0, 0);
+
+    local_irq_disable();
+    read_clocks_cpumask = cpu_online_map;
+    read_clocks_time[cpu] = NOW();
+    cpu_clear(cpu, read_clocks_cpumask);
+    local_irq_enable();
+
+    while ( !cpus_empty(read_clocks_cpumask) )
+        cpu_relax();
+
+    min_cpu = max_cpu = cpu;
+    for_each_online_cpu ( cpu )
+    {
+        if ( read_clocks_time[cpu] < read_clocks_time[min_cpu] )
+            min_cpu = cpu;
+        if ( read_clocks_time[cpu] > read_clocks_time[max_cpu] )
+            max_cpu = cpu;
+    }
+
+    min = read_clocks_time[min_cpu];
+    max = read_clocks_time[max_cpu];
+
+    spin_unlock(&lock);
+
+    dif = difus = max - min;
+    do_div(difus, 1000);
+    printk("Min = %"PRIu64" ; Max = %"PRIu64" ; Diff = %"PRIu64
+           " (%"PRIu64" microseconds)\n",
+           min, max, dif, difus);
+}
+
 extern void dump_runq(unsigned char key);
 #ifndef NDEBUG
 extern void audit_domains_key(unsigned char key);
@@ -178,7 +231,7 @@
 extern void perfc_reset(unsigned char key);
 #endif
 
-void do_debug_key(unsigned char key, struct cpu_user_regs *regs)
+static void do_debug_key(unsigned char key, struct cpu_user_regs *regs)
 {
     (void)debugger_trap_fatal(0xf001, regs);
     nop(); /* Prevent the compiler doing tail call
@@ -187,7 +240,7 @@
 }
 
 #ifndef NDEBUG
-void debugtrace_key(unsigned char key)
+static void debugtrace_key(unsigned char key)
 {
     debugtrace_send_to_console = !debugtrace_send_to_console;
     debugtrace_dump();
@@ -210,6 +263,9 @@
         'r', dump_runq,      "dump run queues");
     register_irq_keyhandler(
         'R', halt_machine,   "reboot machine"); 
+
+    register_keyhandler(
+        't', read_clocks, "display multi-cpu clock info");
 
 #ifndef NDEBUG
     register_keyhandler(
diff -r dc50cdd66c5c -r 0ed4a312765b xen/common/lib.c
--- a/xen/common/lib.c  Tue Mar 14 20:10:21 2006
+++ b/xen/common/lib.c  Tue Mar 14 20:50:35 2006
@@ -158,8 +158,7 @@
  * leading zeros).
  */
 u64
-__qdivrem(uq, vq, arq)
-       u64 uq, vq, *arq;
+__qdivrem(u64 uq, u64 vq, u64 *arq)
 {
        union uu tmp;
        digit *u, *v, *q;
@@ -382,8 +381,7 @@
  * Divide two unsigned quads.
  */
 u64
-__udivdi3(a, b)
-        u64 a, b;
+__udivdi3(u64 a, u64 b)
 {
 
         return (__qdivrem(a, b, (u64 *)0));
diff -r dc50cdd66c5c -r 0ed4a312765b xen/common/memory.c
--- a/xen/common/memory.c       Tue Mar 14 20:10:21 2006
+++ b/xen/common/memory.c       Tue Mar 14 20:50:35 2006
@@ -137,7 +137,43 @@
  out:
     return i;
 }
-    
+
+int
+guest_remove_page(
+    struct domain *d,
+    unsigned long gmfn)
+{
+    struct page_info *page;
+    unsigned long mfn;
+
+    mfn = gmfn_to_mfn(d, gmfn);
+    if ( unlikely(!mfn_valid(mfn)) )
+    {
+        DPRINTK("Domain %u page number %lx invalid\n",
+                d->domain_id, mfn);
+        return 0;
+    }
+            
+    page = mfn_to_page(mfn);
+    if ( unlikely(!get_page(page, d)) )
+    {
+        DPRINTK("Bad page free for domain %u\n", d->domain_id);
+        return 0;
+    }
+
+    if ( test_and_clear_bit(_PGT_pinned, &page->u.inuse.type_info) )
+        put_page_and_type(page);
+            
+    if ( test_and_clear_bit(_PGC_allocated, &page->count_info) )
+        put_page(page);
+
+    guest_physmap_remove_page(d, gmfn, mfn);
+
+    put_page(page);
+
+    return 1;
+}
+
 static long
 decrease_reservation(
     struct domain *d,
@@ -147,8 +183,7 @@
     unsigned int   flags,
     int           *preempted)
 {
-    struct page_info *page;
-    unsigned long    i, j, gmfn, mfn;
+    unsigned long    i, j, gmfn;
 
     if ( !guest_handle_okay(extent_list, nr_extents) )
         return 0;
@@ -166,30 +201,8 @@
 
         for ( j = 0; j < (1 << extent_order); j++ )
         {
-            mfn = gmfn_to_mfn(d, gmfn + j);
-            if ( unlikely(!mfn_valid(mfn)) )
-            {
-                DPRINTK("Domain %u page number %lx invalid\n",
-                        d->domain_id, mfn);
+            if ( !guest_remove_page(d, gmfn + j) )
                 return i;
-            }
-            
-            page = mfn_to_page(mfn);
-            if ( unlikely(!get_page(page, d)) )
-            {
-                DPRINTK("Bad page free for domain %u\n", d->domain_id);
-                return i;
-            }
-
-            if ( test_and_clear_bit(_PGT_pinned, &page->u.inuse.type_info) )
-                put_page_and_type(page);
-            
-            if ( test_and_clear_bit(_PGC_allocated, &page->count_info) )
-                put_page(page);
-
-            guest_physmap_remove_page(d, gmfn + j, mfn);
-
-            put_page(page);
         }
     }
 
diff -r dc50cdd66c5c -r 0ed4a312765b xen/common/multicall.c
--- a/xen/common/multicall.c    Tue Mar 14 20:10:21 2006
+++ b/xen/common/multicall.c    Tue Mar 14 20:50:35 2006
@@ -10,12 +10,15 @@
 #include <xen/sched.h>
 #include <xen/event.h>
 #include <xen/multicall.h>
+#include <xen/guest_access.h>
 #include <asm/current.h>
 #include <asm/hardirq.h>
 
 struct mc_state mc_state[NR_CPUS];
 
-long do_multicall(struct multicall_entry *call_list, unsigned int nr_calls)
+long
+do_multicall(
+    GUEST_HANDLE(multicall_entry_t) call_list, unsigned int nr_calls)
 {
     struct mc_state *mcs = &mc_state[smp_processor_id()];
     unsigned int     i;
@@ -26,22 +29,16 @@
         return -EINVAL;
     }
 
-    if ( unlikely(!array_access_ok(call_list, nr_calls, sizeof(*call_list))) )
-    {
-        DPRINTK("Bad memory range %p for %u*%u bytes.\n",
-                call_list, nr_calls, (unsigned int)sizeof(*call_list));
+    if ( unlikely(!guest_handle_okay(call_list, nr_calls)) )
         goto fault;
-    }
 
     for ( i = 0; i < nr_calls; i++ )
     {
-        if ( unlikely(__copy_from_user(&mcs->call, &call_list[i], 
-                                       sizeof(*call_list))) )
-        {
-            DPRINTK("Error copying from user range %p for %u bytes.\n",
-                    &call_list[i], (unsigned int)sizeof(*call_list));
+        if ( hypercall_preempt_check() )
+            goto preempted;
+
+        if ( unlikely(__copy_from_guest(&mcs->call, call_list, 1)) )
             goto fault;
-        }
 
         do_multicall_call(&mcs->call);
 
@@ -53,38 +50,21 @@
              */
             struct multicall_entry corrupt;
             memset(&corrupt, 0xAA, sizeof(corrupt));
-            (void)__copy_to_user(&call_list[i], &corrupt, sizeof(corrupt));
+            (void)__copy_to_guest(call_list, &corrupt, 1);
         }
 #endif
 
-        if ( unlikely(__copy_to_user(&call_list[i].result,
-                                     &mcs->call.result,
-                                     sizeof(mcs->call.result))) )
+        if ( unlikely(__copy_field_to_guest(call_list, &mcs->call, result)) )
+            goto fault;
+
+        if ( test_bit(_MCSF_call_preempted, &mcs->flags) )
         {
-            DPRINTK("Error writing result back to multicall block.\n");
-            goto fault;
+            /* Copy the sub-call continuation. */
+            (void)__copy_to_guest(call_list, &mcs->call, 1);
+            goto preempted;
         }
 
-        if ( hypercall_preempt_check() )
-        {
-            /*
-             * Copy the sub-call continuation if it was preempted.
-             * Otherwise skip over the sub-call entirely.
-             */
-            if ( !test_bit(_MCSF_call_preempted, &mcs->flags) )
-                i++;
-            else
-                (void)__copy_to_user(&call_list[i], &mcs->call,
-                                     sizeof(*call_list));
-
-            /* Only create a continuation if there is work left to be done. */
-            if ( i < nr_calls )
-            {
-                mcs->flags = 0;
-                return hypercall_create_continuation(
-                    __HYPERVISOR_multicall, "pi", &call_list[i], nr_calls-i);
-            }
-        }
+        guest_handle_add_offset(call_list, 1);
     }
 
     mcs->flags = 0;
@@ -93,6 +73,11 @@
  fault:
     mcs->flags = 0;
     return -EFAULT;
+
+ preempted:
+    mcs->flags = 0;
+    return hypercall_create_continuation(
+        __HYPERVISOR_multicall, "hi", call_list, nr_calls-i);
 }
 
 /*
diff -r dc50cdd66c5c -r 0ed4a312765b xen/common/perfc.c
--- a/xen/common/perfc.c        Tue Mar 14 20:10:21 2006
+++ b/xen/common/perfc.c        Tue Mar 14 20:50:35 2006
@@ -8,7 +8,6 @@
 #include <xen/mm.h>
 #include <xen/guest_access.h>
 #include <public/dom0_ops.h>
-#include <asm/uaccess.h>
 
 #undef  PERFCOUNTER
 #undef  PERFCOUNTER_CPU
diff -r dc50cdd66c5c -r 0ed4a312765b xen/common/sched_sedf.c
--- a/xen/common/sched_sedf.c   Tue Mar 14 20:10:21 2006
+++ b/xen/common/sched_sedf.c   Tue Mar 14 20:50:35 2006
@@ -56,6 +56,12 @@
 #define EXTRA_QUANTUM (MICROSECS(500)) 
 #define WEIGHT_PERIOD (MILLISECS(100))
 #define WEIGHT_SAFETY (MILLISECS(5))
+
+/* FIXME: need to validate that these are sane */
+#define PERIOD_MAX ULONG_MAX
+#define PERIOD_MIN (MICROSECS(10))
+#define SLICE_MAX ULONG_MAX
+#define SLICE_MIN (MICROSECS(5))
 
 #define IMPLY(a, b) (!(a) || (b))
 #define EQ(a, b) ((!!(a)) == (!!(b)))
@@ -579,7 +585,7 @@
                 curinf->deadl_abs += 
                     DIV_UP(now - curinf->deadl_abs,
                            curinf->period) * curinf->period;
-            ASSERT(curinf->deadl_abs > now);
+            ASSERT(curinf->deadl_abs >= now);
             /*give a fresh slice*/
             curinf->cputime = 0;
             if (PERIOD_BEGIN(curinf) > now)
@@ -1609,7 +1615,10 @@
                  * Sanity checking: note that disabling extra weight requires
                  * that we set a non-zero slice.
                  */
-                if ( (cmd->u.sedf.slice == 0) ||
+                if ( (cmd->u.sedf.period > PERIOD_MAX) ||
+                     (cmd->u.sedf.period < PERIOD_MIN) ||
+                     (cmd->u.sedf.slice  > SLICE_MAX)  ||
+                     (cmd->u.sedf.slice  < SLICE_MIN)  ||
                      (cmd->u.sedf.slice > cmd->u.sedf.period) )
                     return -EINVAL;
                 EDOM_INFO(v)->weight = 0;
diff -r dc50cdd66c5c -r 0ed4a312765b xen/common/schedule.c
--- a/xen/common/schedule.c     Tue Mar 14 20:10:21 2006
+++ b/xen/common/schedule.c     Tue Mar 14 20:50:35 2006
@@ -27,6 +27,7 @@
 #include <xen/softirq.h>
 #include <xen/trace.h>
 #include <xen/mm.h>
+#include <xen/guest_access.h>
 #include <public/sched.h>
 #include <public/sched_ctl.h>
 
@@ -42,6 +43,7 @@
 static void s_timer_fn(void *unused);
 static void t_timer_fn(void *unused);
 static void dom_timer_fn(void *data);
+static void poll_timer_fn(void *data);
 
 /* This is global for now so that private implementations can reach it */
 struct schedule_data schedule_data[NR_CPUS];
@@ -164,8 +166,9 @@
 
 void sched_add_domain(struct vcpu *v) 
 {
-    /* Initialise the per-domain timer. */
+    /* Initialise the per-domain timers. */
     init_timer(&v->timer, dom_timer_fn, v, v->processor);
+    init_timer(&v->poll_timer, poll_timer_fn, v, v->processor);
 
     if ( is_idle_vcpu(v) )
     {
@@ -181,6 +184,8 @@
 void sched_rem_domain(struct vcpu *v) 
 {
     kill_timer(&v->timer);
+    kill_timer(&v->poll_timer);
+
     SCHED_OP(rem_task, v);
     TRACE_2D(TRC_SCHED_DOM_REM, v->domain->domain_id, v->vcpu_id);
 }
@@ -270,6 +275,55 @@
     return 0;
 }
 
+static long do_poll(struct sched_poll *sched_poll)
+{
+    struct vcpu  *v = current;
+    evtchn_port_t port;
+    long          rc = 0;
+    unsigned int  i;
+
+    /* Fairly arbitrary limit. */
+    if ( sched_poll->nr_ports > 128 )
+        return -EINVAL;
+
+    if ( !guest_handle_okay(sched_poll->ports, sched_poll->nr_ports) )
+        return -EFAULT;
+
+    /* Ensure that upcalls are disabled: tested by evtchn_set_pending(). */
+    if ( !v->vcpu_info->evtchn_upcall_mask )
+        return -EINVAL;
+
+    set_bit(_VCPUF_blocked, &v->vcpu_flags);
+
+    /* Check for events /after/ blocking: avoids wakeup waiting race. */
+    for ( i = 0; i < sched_poll->nr_ports; i++ )
+    {
+        rc = -EFAULT;
+        if ( __copy_from_guest_offset(&port, sched_poll->ports, i, 1) )
+            goto out;
+
+        rc = -EINVAL;
+        if ( port >= MAX_EVTCHNS )
+            goto out;
+
+        rc = 0;
+        if ( evtchn_pending(v->domain, port) )
+            goto out;
+    }
+
+    if ( sched_poll->timeout != 0 )
+        set_timer(&v->poll_timer, sched_poll->timeout);
+
+    TRACE_2D(TRC_SCHED_BLOCK, v->domain->domain_id, v->vcpu_id);
+    __enter_scheduler();
+
+    stop_timer(&v->poll_timer);
+
+ out:
+    clear_bit(_VCPUF_blocked, &v->vcpu_flags);
+    return rc;
+}
+
 /* Voluntarily yield the processor for this allocation. */
 static long do_yield(void)
 {
@@ -301,6 +355,61 @@
         TRACE_3D(TRC_SCHED_SHUTDOWN,
                  current->domain->domain_id, current->vcpu_id, arg);
         domain_shutdown(current->domain, (u8)arg);
+        break;
+    }
+
+    default:
+        ret = -ENOSYS;
+    }
+
+    return ret;
+}
+
+long do_sched_op_new(int cmd, GUEST_HANDLE(void) arg)
+{
+    long ret = 0;
+
+    switch ( cmd )
+    {
+    case SCHEDOP_yield:
+    {
+        ret = do_yield();
+        break;
+    }
+
+    case SCHEDOP_block:
+    {
+        ret = do_block();
+        break;
+    }
+
+    case SCHEDOP_shutdown:
+    {
+        struct sched_shutdown sched_shutdown;
+
+        ret = -EFAULT;
+        if ( copy_from_guest(&sched_shutdown, arg, 1) )
+            break;
+
+        ret = 0;
+        TRACE_3D(TRC_SCHED_SHUTDOWN,
+                 current->domain->domain_id, current->vcpu_id,
+                 sched_shutdown.reason);
+        domain_shutdown(current->domain, (u8)sched_shutdown.reason);
+
+        break;
+    }
+
+    case SCHEDOP_poll:
+    {
+        struct sched_poll sched_poll;
+
+        ret = -EFAULT;
+        if ( copy_from_guest(&sched_poll, arg, 1) )
+            break;
+
+        ret = do_poll(&sched_poll);
+
         break;
     }
 
@@ -518,6 +627,13 @@
     send_guest_virq(v, VIRQ_TIMER);
 }
 
+/* SCHEDOP_poll timeout callback. */
+static void poll_timer_fn(void *data)
+{
+    struct vcpu *v = data;
+    vcpu_unblock(v);
+}
+
 /* Initialise the data structures. */
 void __init scheduler_init(void)
 {
diff -r dc50cdd66c5c -r 0ed4a312765b xen/common/trace.c
--- a/xen/common/trace.c        Tue Mar 14 20:10:21 2006
+++ b/xen/common/trace.c        Tue Mar 14 20:50:35 2006
@@ -83,8 +83,9 @@
 
     /* Share pages so that xentrace can map them. */
     for ( i = 0; i < nr_pages; i++ )
-        SHARE_PFN_WITH_DOMAIN(virt_to_page(rawbuf + i * PAGE_SIZE), dom0);
-    
+        share_xen_page_with_privileged_guests(
+            virt_to_page(rawbuf) + i, XENSHARE_writable);
+
     for_each_online_cpu ( i )
     {
         buf = t_bufs[i] = (struct t_buf *)&rawbuf[i*opt_tbuf_size*PAGE_SIZE];
diff -r dc50cdd66c5c -r 0ed4a312765b xen/drivers/char/console.c
--- a/xen/drivers/char/console.c        Tue Mar 14 20:10:21 2006
+++ b/xen/drivers/char/console.c        Tue Mar 14 20:50:35 2006
@@ -22,7 +22,6 @@
 #include <xen/delay.h>
 #include <xen/guest_access.h>
 #include <asm/current.h>
-#include <asm/uaccess.h>
 #include <asm/debugger.h>
 #include <asm/io.h>
 
@@ -320,7 +319,7 @@
     __serial_rx(c, regs);
 }
 
-long guest_console_write(char *buffer, int count)
+static long guest_console_write(GUEST_HANDLE(char) buffer, int count)
 {
     char kbuf[128], *kptr;
     int kcount;
@@ -336,11 +335,11 @@
 
         if ( hypercall_preempt_check() )
             return hypercall_create_continuation(
-                __HYPERVISOR_console_io, "iip",
+                __HYPERVISOR_console_io, "iih",
                 CONSOLEIO_write, count, buffer);
 
         kcount = min_t(int, count, sizeof(kbuf)-1);
-        if ( copy_from_user(kbuf, buffer, kcount) )
+        if ( copy_from_guest((char *)kbuf, buffer, kcount) )
             return -EFAULT;
         kbuf[kcount] = '\0';
 
@@ -349,14 +348,14 @@
         for ( kptr = kbuf; *kptr != '\0'; kptr++ )
             putchar_console(*kptr);
 
-        buffer += kcount;
-        count  -= kcount;
+        guest_handle_add_offset(buffer, kcount);
+        count -= kcount;
     }
 
     return 0;
 }
 
-long do_console_io(int cmd, int count, char *buffer)
+long do_console_io(int cmd, int count, GUEST_HANDLE(char) buffer)
 {
     long rc;
     unsigned int idx, len;
@@ -382,7 +381,7 @@
                 len = SERIAL_RX_SIZE - idx;
             if ( (rc + len) > count )
                 len = count - rc;
-            if ( copy_to_user(&buffer[rc], &serial_rx_ring[idx], len) )
+            if ( copy_to_guest_offset(buffer, rc, &serial_rx_ring[idx], len) )
             {
                 rc = -EFAULT;
                 break;
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/asm-ia64/guest_access.h
--- a/xen/include/asm-ia64/guest_access.h       Tue Mar 14 20:10:21 2006
+++ b/xen/include/asm-ia64/guest_access.h       Tue Mar 14 20:50:35 2006
@@ -21,6 +21,8 @@
     (GUEST_HANDLE(type)) { _x };                \
 })
 
+#define guest_handle_from_ptr(ptr, type) ((GUEST_HANDLE(type)) { (type *)ptr })
+
 /*
  * Copy an array of objects to guest context via a guest handle,
  * specifying an offset into the guest array.
@@ -39,6 +41,20 @@
     const typeof(ptr) _x = (hnd).p;                     \
     const typeof(ptr) _y = (ptr);                       \
     copy_from_user(_y, _x+(off), sizeof(*_x)*(nr));     \
+})
+
+/* Copy sub-field of a structure to guest context via a guest handle. */
+#define copy_field_to_guest(hnd, ptr, field) ({         \
+    const typeof(&(ptr)->field) _x = &(hnd).p->field;   \
+    const typeof(&(ptr)->field) _y = &(ptr)->field;     \
+    copy_to_user(_x, _y, sizeof(*_x));                  \
+})
+
+/* Copy sub-field of a structure from guest context via a guest handle. */
+#define copy_field_from_guest(ptr, hnd, field) ({       \
+    const typeof(&(ptr)->field) _x = &(hnd).p->field;   \
+    const typeof(&(ptr)->field) _y = &(ptr)->field;     \
+    copy_from_user(_y, _x, sizeof(*_x));                \
 })
 
 /*
@@ -60,4 +76,16 @@
     __copy_from_user(_y, _x+(off), sizeof(*_x)*(nr));   \
 })
 
+#define __copy_field_to_guest(hnd, ptr, field) ({       \
+    const typeof(&(ptr)->field) _x = &(hnd).p->field;   \
+    const typeof(&(ptr)->field) _y = &(ptr)->field;     \
+    __copy_to_user(_x, _y, sizeof(*_x));                \
+})
+
+#define __copy_field_from_guest(ptr, hnd, field) ({     \
+    const typeof(&(ptr)->field) _x = &(hnd).p->field;   \
+    const typeof(&(ptr)->field) _y = &(ptr)->field;     \
+    __copy_from_user(_y, _x, sizeof(*_x));              \
+})
+
 #endif /* __ASM_IA64_GUEST_ACCESS_H__ */
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/asm-ia64/hypercall.h
--- a/xen/include/asm-ia64/hypercall.h  Tue Mar 14 20:10:21 2006
+++ b/xen/include/asm-ia64/hypercall.h  Tue Mar 14 20:50:35 2006
@@ -16,4 +16,6 @@
     u64 *pdone,
     u64 foreigndom);
 
+#define arch_do_vcpu_op(cmd, vcpu, arg) (-ENOSYS)
+
 #endif /* __ASM_IA64_HYPERCALL_H__ */
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/asm-ia64/mm.h
--- a/xen/include/asm-ia64/mm.h Tue Mar 14 20:10:21 2006
+++ b/xen/include/asm-ia64/mm.h Tue Mar 14 20:50:35 2006
@@ -131,7 +131,8 @@
 #define page_set_owner(_p, _d) ((_p)->u.inuse._domain = pickle_domptr(_d))
 
 /* Dummy now */
-#define SHARE_PFN_WITH_DOMAIN(_pfn, _dom) do { } while (0)
+#define share_xen_page_with_guest(p, d, r) do { } while (0)
+#define share_xen_page_with_privileged_guests(p, r) do { } while (0)
 
 extern struct page_info *frame_table;
 extern unsigned long frame_table_size;
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/asm-ia64/xensystem.h
--- a/xen/include/asm-ia64/xensystem.h  Tue Mar 14 20:10:21 2006
+++ b/xen/include/asm-ia64/xensystem.h  Tue Mar 14 20:50:35 2006
@@ -75,35 +75,7 @@
 // FIXME SMP... see system.h, does this need to be different?
 #define switch_to(prev,next,last)      __switch_to(prev, next, last)
 
-#define __cmpxchg_user(ptr, new, old, _size)                           \
-({                                                                     \
-       register long __gu_r8 asm ("r8");                               \
-       asm volatile ("mov ar.ccv=%0;;" :: "rO"(old));                  \
-       asm volatile ("mov %1=r0;;\n"                                   \
-               "[1:]\tcmpxchg"_size".acq %0=[%2],%3,ar.ccv\n"          \
-               "\t.xdata4 \"__ex_table\", 1b-., 1f-.\n"                \
-               "[1:]"                                                  \
-               : "=r"(old), "=r"(__gu_r8) :                            \
-               "r"(ptr), "r"(new) : "memory");                         \
-       __gu_r8;                                                        \
-})
-
-
-// NOTE: Xen defines args as pointer,old,new whereas ia64 uses pointer,new,old
-//  so reverse them here
-#define cmpxchg_user(_p,_o,_n)                                 \
-({                                                             \
-       register long _rc;                                      \
-       ia64_mf();                                              \
-       switch ( sizeof(*(_p)) ) {                              \
-           case 1: _rc = __cmpxchg_user(_p,_n,_o,"1"); break;  \
-           case 2: _rc = __cmpxchg_user(_p,_n,_o,"2"); break;  \
-           case 4: _rc = __cmpxchg_user(_p,_n,_o,"4"); break;  \
-           case 8: _rc = __cmpxchg_user(_p,_n,_o,"8"); break;  \
-       }                                                       \
-       ia64_mf();                                              \
-       _rc;                                                    \
-})
+#define local_irq_is_enabled() (!irqs_disabled())
 
 #endif // __ASSEMBLY__
 #endif // _ASM_IA64_XENSYSTEM_H
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/asm-x86/debugger.h
--- a/xen/include/asm-x86/debugger.h    Tue Mar 14 20:10:21 2006
+++ b/xen/include/asm-x86/debugger.h    Tue Mar 14 20:50:35 2006
@@ -88,7 +88,7 @@
 {
     struct vcpu *v = current;
 
-    if ( KERNEL_MODE(v, regs) &&
+    if ( guest_kernel_mode(v, regs) &&
          test_bit(_DOMF_debugging, &v->domain->domain_flags) &&
          ((vector == TRAP_int3) || (vector == TRAP_debug)) )
     {
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/asm-x86/grant_table.h
--- a/xen/include/asm-x86/grant_table.h Tue Mar 14 20:10:21 2006
+++ b/xen/include/asm-x86/grant_table.h Tue Mar 14 20:50:35 2006
@@ -23,11 +23,9 @@
 
 #define gnttab_create_shared_page(d, t, i)                               \
     do {                                                                 \
-        SHARE_PFN_WITH_DOMAIN(                                           \
-            virt_to_page((char *)(t)->shared + ((i) * PAGE_SIZE)), (d)); \
-        set_gpfn_from_mfn(                                               \
-            (virt_to_maddr((t)->shared) >> PAGE_SHIFT) + (i),            \
-            INVALID_M2P_ENTRY);                                          \
+        share_xen_page_with_guest(                                       \
+            virt_to_page((char *)(t)->shared + ((i) * PAGE_SIZE)),       \
+            (d), XENSHARE_writable);                                     \
     } while ( 0 )
 
 #define gnttab_shared_mfn(d, t, i)                      \
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/asm-x86/guest_access.h
--- a/xen/include/asm-x86/guest_access.h        Tue Mar 14 20:10:21 2006
+++ b/xen/include/asm-x86/guest_access.h        Tue Mar 14 20:50:35 2006
@@ -41,6 +41,20 @@
     copy_from_user(_y, _x+(off), sizeof(*_x)*(nr));     \
 })
 
+/* Copy sub-field of a structure to guest context via a guest handle. */
+#define copy_field_to_guest(hnd, ptr, field) ({         \
+    const typeof(&(ptr)->field) _x = &(hnd).p->field;   \
+    const typeof(&(ptr)->field) _y = &(ptr)->field;     \
+    copy_to_user(_x, _y, sizeof(*_x));                  \
+})
+
+/* Copy sub-field of a structure from guest context via a guest handle. */
+#define copy_field_from_guest(ptr, hnd, field) ({       \
+    const typeof(&(ptr)->field) _x = &(hnd).p->field;   \
+    const typeof(&(ptr)->field) _y = &(ptr)->field;     \
+    copy_from_user(_y, _x, sizeof(*_x));                \
+})
+
 /*
  * Pre-validate a guest handle.
  * Allows use of faster __copy_* functions.
@@ -60,4 +74,16 @@
     __copy_from_user(_y, _x+(off), sizeof(*_x)*(nr));   \
 })
 
+#define __copy_field_to_guest(hnd, ptr, field) ({       \
+    const typeof(&(ptr)->field) _x = &(hnd).p->field;   \
+    const typeof(&(ptr)->field) _y = &(ptr)->field;     \
+    __copy_to_user(_x, _y, sizeof(*_x));                \
+})
+
+#define __copy_field_from_guest(ptr, hnd, field) ({     \
+    const typeof(&(ptr)->field) _x = &(hnd).p->field;   \
+    const typeof(&(ptr)->field) _y = &(ptr)->field;     \
+    __copy_from_user(_y, _x, sizeof(*_x));              \
+})
+
 #endif /* __ASM_X86_GUEST_ACCESS_H__ */
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/asm-x86/hvm/io.h
--- a/xen/include/asm-x86/hvm/io.h      Tue Mar 14 20:10:21 2006
+++ b/xen/include/asm-x86/hvm/io.h      Tue Mar 14 20:50:35 2006
@@ -151,9 +151,10 @@
 extern void hvm_wait_io(void);
 extern void hvm_safe_block(void);
 extern void hvm_io_assist(struct vcpu *v);
-extern void pic_irq_request(int *interrupt_request, int level);
+extern void pic_irq_request(void *data, int level);
 extern void hvm_pic_assist(struct vcpu *v);
 extern int cpu_get_interrupt(struct vcpu *v, int *type);
+extern int cpu_has_pending_irq(struct vcpu *v);
 
 // XXX - think about this, maybe use bit 30 of the mfn to signify an MMIO 
frame.
 #define mmio_space(gpa) (!VALID_MFN(get_mfn_from_gpfn((gpa) >> PAGE_SHIFT)))
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/asm-x86/hvm/support.h
--- a/xen/include/asm-x86/hvm/support.h Tue Mar 14 20:10:21 2006
+++ b/xen/include/asm-x86/hvm/support.h Tue Mar 14 20:50:35 2006
@@ -32,7 +32,7 @@
 #define HVM_DEBUG 0
 #endif
 
-#define        HVM_DOMAIN(v)   ((v)->arch.guest_context.flags & VGCF_HVM_GUEST)
+#define        hvm_guest(v)    ((v)->arch.guest_context.flags & VGCF_HVM_GUEST)
 
 static inline shared_iopage_t *get_sp(struct domain *d)
 {
@@ -99,7 +99,7 @@
 
 #define PC_DEBUG_PORT   0x80
 
-#define VMX_INVALID_ERROR_CODE  -1
+#define VMX_DELIVER_NO_ERROR_CODE  -1
 
 /*
  * This works for both 32bit & 64bit eflags filteration
@@ -122,9 +122,9 @@
 
 extern unsigned int opt_hvm_debug_level;
 #define HVM_DBG_LOG(level, _f, _a...)           \
-    if ((level) & opt_hvm_debug_level)          \
-        printk("[HVM:%d.%d] " _f "\n",          \
-               current->domain->domain_id, current->vcpu_id, ## _a)
+    if ( (level) & opt_hvm_debug_level )        \
+        printk("[HVM:%d.%d] <%s> " _f "\n",     \
+               current->domain->domain_id, current->vcpu_id, __func__, ## _a)
 #else
 #define HVM_DBG_LOG(level, _f, _a...)
 #endif
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/asm-x86/hvm/vlapic.h
--- a/xen/include/asm-x86/hvm/vlapic.h  Tue Mar 14 20:10:21 2006
+++ b/xen/include/asm-x86/hvm/vlapic.h  Tue Mar 14 20:50:35 2006
@@ -101,15 +101,14 @@
 #define VLAPIC_LVT_BIT_TRIG             (1 << 15)
 #define VLAPIC_LVT_TIMERMODE            (1 << 17)
 
-#define VLAPIC_DELIV_MODE_FIXED          0x0
-#define VLAPIC_DELIV_MODE_LPRI           0x1
-#define VLAPIC_DELIV_MODE_SMI            0x2
-#define VLAPIC_DELIV_MODE_RESERVED       0x3
-#define VLAPIC_DELIV_MODE_NMI            0x4
-#define VLAPIC_DELIV_MODE_INIT           0x5
-#define VLAPIC_DELIV_MODE_STARTUP        0x6
-#define VLAPIC_DELIV_MODE_EXT            0x7
-
+#define VLAPIC_DELIV_MODE_FIXED         0x0
+#define VLAPIC_DELIV_MODE_LPRI          0x1
+#define VLAPIC_DELIV_MODE_SMI           0x2
+#define VLAPIC_DELIV_MODE_RESERVED      0x3
+#define VLAPIC_DELIV_MODE_NMI           0x4
+#define VLAPIC_DELIV_MODE_INIT          0x5
+#define VLAPIC_DELIV_MODE_STARTUP       0x6
+#define VLAPIC_DELIV_MODE_EXT           0x7
 
 
 #define VLAPIC_NO_SHORTHAND             0x0
@@ -118,41 +117,29 @@
 #define VLAPIC_SHORTHAND_EXCLUDE_SELF   0x3
 
 #define vlapic_lvt_timer_enabled(vlapic)    \
-  (!(vlapic->lvt[VLAPIC_LVT_TIMER] & VLAPIC_LVT_BIT_MASK))
-
-#define vlapic_lvt_vector(vlapic, type)   \
-  (vlapic->lvt[type] & VLAPIC_LVT_BIT_VECTOR)
-
-#define vlapic_lvt_dm(value)        ((value >> 8) && 7)
-#define vlapic_lvt_timer_period(vlapic) \
-  (vlapic->lvt[VLAPIC_LVT_TIMER] & VLAPIC_LVT_TIMERMODE)
-
-#define vlapic_isr_status(vlapic,vector)    \
-  test_bit(vector, &vlapic->isr[0])
-
-#define vlapic_irr_status(vlapic,vector)    \
-  test_bit(vector, &vlapic->irr[0])
-
-#define vlapic_set_isr(vlapic,vector) \
-  test_and_set_bit(vector, &vlapic->isr[0])
-
-#define vlapic_set_irr(vlapic,vector)      \
-  test_and_set_bit(vector, &vlapic->irr[0])
-
-#define vlapic_clear_irr(vlapic,vector)      \
-  clear_bit(vector, &vlapic->irr[0])
-#define vlapic_clear_isr(vlapic,vector)     \
-  clear_bit(vector, &vlapic->isr[0])
-
-#define vlapic_enabled(vlapic)               \
-  (!(vlapic->status &                           \
-     (VLAPIC_GLOB_DISABLE_MASK | VLAPIC_SOFTWARE_DISABLE_MASK)))
-
-#define vlapic_global_enabled(vlapic)               \
-  !(test_bit(_VLAPIC_GLOB_DISABLE, &(vlapic)->status))
-
-#define VLAPIC_IRR(t) ((t)->irr[0])
-#define VLAPIC_ID(t)  ((t)->id)
+    (!((vlapic)->lvt[VLAPIC_LVT_TIMER] & VLAPIC_LVT_BIT_MASK))
+
+#define vlapic_lvt_vector(vlapic, type)     \
+    ((vlapic)->lvt[(type)] & VLAPIC_LVT_BIT_VECTOR)
+
+#define vlapic_lvt_dm(value)            (((value) >> 8) && 7)
+#define vlapic_lvt_timer_period(vlapic)     \
+    ((vlapic)->lvt[VLAPIC_LVT_TIMER] & VLAPIC_LVT_TIMERMODE)
+
+#define _VLAPIC_GLOB_DISABLE            0x0
+#define VLAPIC_GLOB_DISABLE_MASK        0x1
+#define VLAPIC_SOFTWARE_DISABLE_MASK    0x2
+#define _VLAPIC_BSP_ACCEPT_PIC          0x3
+
+#define vlapic_enabled(vlapic)              \
+    (!((vlapic)->status &                   \
+       (VLAPIC_GLOB_DISABLE_MASK | VLAPIC_SOFTWARE_DISABLE_MASK)))
+
+#define vlapic_global_enabled(vlapic)       \
+    (!(test_bit(_VLAPIC_GLOB_DISABLE, &(vlapic)->status)))
+
+#define VLAPIC_IRR(t)   ((t)->irr[0])
+#define VLAPIC_ID(t)    ((t)->id)
 
 typedef struct direct_intr_info {
     int deliver_mode;
@@ -163,10 +150,6 @@
 {
     //FIXME check what would be 64 bit on EM64T
     uint32_t           version;
-#define _VLAPIC_GLOB_DISABLE            0x0
-#define VLAPIC_GLOB_DISABLE_MASK        0x1
-#define VLAPIC_SOFTWARE_DISABLE_MASK    0x2
-#define _VLAPIC_BSP_ACCEPT_PIC          0x3
     uint32_t           status;
     uint32_t           id;
     uint32_t           vcpu_id;
@@ -180,10 +163,10 @@
     uint32_t           dest_format;
     uint32_t           spurious_vec;
     uint32_t           lvt[6];
-    uint32_t           timer_initial;
-    uint32_t           timer_current;
+    uint32_t           timer_initial_count;
+    uint32_t           timer_current_count;
     uint32_t           timer_divconf;
-    uint32_t           timer_divide_counter;
+    uint32_t           timer_divide_count;
     struct timer       vlapic_timer;
     int                intr_pending_count[MAX_VECTOR];
     s_time_t           timer_current_update;
@@ -203,16 +186,16 @@
     int ret;
 
     ret = test_and_set_bit(vec, &t->irr[0]);
-    if (trig)
-       test_and_set_bit(vec, &t->tmr[0]);
+    if ( trig )
+       set_bit(vec, &t->tmr[0]);
 
     /* We may need to wake up target vcpu, besides set pending bit here */
     return ret;
 }
 
-static inline int  vlapic_timer_active(struct vlapic *vlapic)
-{
-    return  active_timer(&(vlapic->vlapic_timer));
+static inline int vlapic_timer_active(struct vlapic *vlapic)
+{
+    return active_timer(&vlapic->vlapic_timer);
 }
 
 int vlapic_find_highest_irr(struct vlapic *vlapic);
@@ -226,6 +209,7 @@
 
 void vlapic_post_injection(struct vcpu* v, int vector, int deliver_mode);
 
+int cpu_has_apic_interrupt(struct vcpu* v);
 int cpu_get_apic_interrupt(struct vcpu* v, int *mode);
 
 extern uint32_t vlapic_update_ppr(struct vlapic *vlapic);
@@ -244,6 +228,7 @@
                                 uint32_t bitmap);
 
 s_time_t get_apictime_scheduled(struct vcpu *v);
+
 int hvm_apic_support(struct domain *d);
 
 #endif /* __ASM_X86_HVM_VLAPIC_H__ */
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/asm-x86/hvm/vmx/vmcs.h
--- a/xen/include/asm-x86/hvm/vmx/vmcs.h        Tue Mar 14 20:10:21 2006
+++ b/xen/include/asm-x86/hvm/vmx/vmcs.h        Tue Mar 14 20:50:35 2006
@@ -69,6 +69,7 @@
 struct arch_vmx_struct {
     struct vmcs_struct      *vmcs;  /* VMCS pointer in virtual. */
     unsigned int            launch_cpu; /* VMCS is valid on this CPU. */
+    u32                     exec_control; /* cache of cpu execution control */
     unsigned long           flags;  /* VMCS flags */
     unsigned long           cpu_cr0; /* copy of guest CR0 */
     unsigned long           cpu_shadow_cr0; /* copy of guest read shadow CR0 */
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/asm-x86/hvm/vmx/vmx.h
--- a/xen/include/asm-x86/hvm/vmx/vmx.h Tue Mar 14 20:10:21 2006
+++ b/xen/include/asm-x86/hvm/vmx/vmx.h Tue Mar 14 20:50:35 2006
@@ -119,7 +119,15 @@
 #define EXIT_REASON_RDPMC               15
 #define EXIT_REASON_RDTSC               16
 #define EXIT_REASON_VMCALL              18
-
+#define EXIT_REASON_VMCLEAR             19
+#define EXIT_REASON_VMLAUNCH            20
+#define EXIT_REASON_VMPTRLD             21
+#define EXIT_REASON_VMPTRST             22
+#define EXIT_REASON_VMREAD              23
+#define EXIT_REASON_VMRESUME            24
+#define EXIT_REASON_VMWRITE             25
+#define EXIT_REASON_VMOFF               26
+#define EXIT_REASON_VMON                27
 #define EXIT_REASON_CR_ACCESS           28
 #define EXIT_REASON_DR_ACCESS           29
 #define EXIT_REASON_IO_INSTRUCTION      30
@@ -425,7 +433,7 @@
 
     /* Reflect it back into the guest */
     intr_fields = (INTR_INFO_VALID_MASK | type | trap);
-    if (error_code != VMX_INVALID_ERROR_CODE) {
+    if (error_code != VMX_DELIVER_NO_ERROR_CODE) {
         __vmwrite(VM_ENTRY_EXCEPTION_ERROR_CODE, error_code);
         intr_fields |= INTR_INFO_DELIEVER_CODE_MASK;
      }
@@ -455,7 +463,7 @@
     if (vector & INTR_INFO_DELIEVER_CODE_MASK)
         __vmread(VM_EXIT_INTR_ERROR_CODE, &error_code);
     else
-        error_code = VMX_INVALID_ERROR_CODE;
+        error_code = VMX_DELIVER_NO_ERROR_CODE;
     vector &= 0xff;
 
 #ifndef NDEBUG
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/asm-x86/hvm/vpic.h
--- a/xen/include/asm-x86/hvm/vpic.h    Tue Mar 14 20:10:21 2006
+++ b/xen/include/asm-x86/hvm/vpic.h    Tue Mar 14 20:50:35 2006
@@ -55,7 +55,7 @@
     /* 0 is master pic, 1 is slave pic */
     /* XXX: better separation between the two pics */
     PicState pics[2];
-    void (*irq_request)(int *opaque, int level);
+    void (*irq_request)(void *opaque, int level);
     void *irq_request_opaque;
     /* IOAPIC callback support */
     void (*alt_irq_func)(void *opaque, int irq_num, int level);
@@ -66,10 +66,10 @@
 void pic_set_irq(struct hvm_virpic *s, int irq, int level);
 void pic_set_irq_new(void *opaque, int irq, int level);
 void pic_init(struct hvm_virpic *s, 
-              void (*irq_request)(),
+              void (*irq_request)(void *, int),
               void *irq_request_opaque);
 void pic_set_alt_irq_func(struct hvm_virpic *s, 
-                          void(*alt_irq_func)(),
+                          void (*alt_irq_func)(void *, int, int),
                           void *alt_irq_opaque);
 int pic_read_irq(struct hvm_virpic *s);
 void pic_update_irq(struct hvm_virpic *s);
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/asm-x86/hvm/vpit.h
--- a/xen/include/asm-x86/hvm/vpit.h    Tue Mar 14 20:10:21 2006
+++ b/xen/include/asm-x86/hvm/vpit.h    Tue Mar 14 20:50:35 2006
@@ -38,8 +38,8 @@
 struct hvm_virpit {
     /* for simulation of counter 0 in mode 2 */
     u64 period_cycles;          /* pit frequency in cpu cycles */
-    u64 inject_point;           /* the time inject virt intr */
     u64 shift;                  /* save the value of offset - drift */
+    s_time_t inject_point;      /* the time inject virt intr */
     s_time_t scheduled;         /* scheduled timer interrupt */
     struct timer pit_timer;     /* periodic timer for mode 2*/
     unsigned int channel;       /* the pit channel, counter 0~2 */
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/asm-x86/hypercall.h
--- a/xen/include/asm-x86/hypercall.h   Tue Mar 14 20:10:21 2006
+++ b/xen/include/asm-x86/hypercall.h   Tue Mar 14 20:50:35 2006
@@ -5,22 +5,22 @@
 #ifndef __ASM_X86_HYPERCALL_H__
 #define __ASM_X86_HYPERCALL_H__
 
-struct trap_info;
+#include <public/physdev.h>
+
 extern long
 do_set_trap_table(
-    struct trap_info *traps);
+    GUEST_HANDLE(trap_info_t) traps);
 
-struct mmu_update;
 extern int
 do_mmu_update(
-    struct mmu_update *ureqs,
+    GUEST_HANDLE(mmu_update_t) ureqs,
     unsigned int count,
-    unsigned int *pdone,
+    GUEST_HANDLE(uint) pdone,
     unsigned int foreigndom);
 
 extern long
 do_set_gdt(
-    unsigned long *frame_list,
+    GUEST_HANDLE(ulong) frame_list,
     unsigned int entries);
 
 extern long
@@ -52,10 +52,9 @@
     u64 val64,
     unsigned long flags);
 
-struct physdev_op;
 extern long
 do_physdev_op(
-    struct physdev_op *uop);
+    GUEST_HANDLE(physdev_op_t) uop);
 
 extern int
 do_update_va_mapping_otherdomain(
@@ -66,14 +65,19 @@
 
 extern int
 do_mmuext_op(
-    struct mmuext_op *uops,
+    GUEST_HANDLE(mmuext_op_t) uops,
     unsigned int count,
-    unsigned int *pdone,
+    GUEST_HANDLE(uint) pdone,
     unsigned int foreigndom);
 
 extern unsigned long
 do_iret(
     void);
+
+struct vcpu;
+extern long
+arch_do_vcpu_op(
+    int cmd, struct vcpu *v, GUEST_HANDLE(void) arg);
 
 #ifdef __x86_64__
 
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/asm-x86/mm.h
--- a/xen/include/asm-x86/mm.h  Tue Mar 14 20:10:21 2006
+++ b/xen/include/asm-x86/mm.h  Tue Mar 14 20:50:35 2006
@@ -98,8 +98,17 @@
  /* 16-bit count of uses of this frame as its current type. */
 #define PGT_count_mask      ((1U<<16)-1)
 
+#ifdef __x86_64__
+#define PGT_high_mfn_shift  52
+#define PGT_high_mfn_mask   (0x7ffUL << PGT_high_mfn_shift)
+#define PGT_mfn_mask        (((1U<<23)-1) | PGT_high_mfn_mask)
+#define PGT_high_mfn_nx     (0x800UL << PGT_high_mfn_shift)
+#else
  /* 23-bit mfn mask for shadow types: good for up to 32GB RAM. */
 #define PGT_mfn_mask        ((1U<<23)-1)
+ /* NX for PAE xen is not supported yet */
+#define PGT_high_mfn_nx     (1ULL << 63)
+#endif
 
 #define PGT_score_shift     23
 #define PGT_score_mask      (((1U<<4)-1)<<PGT_score_shift)
@@ -138,21 +147,12 @@
 #define page_get_owner(_p)    (unpickle_domptr((_p)->u.inuse._domain))
 #define page_set_owner(_p,_d) ((_p)->u.inuse._domain = pickle_domptr(_d))
 
-#define SHARE_PFN_WITH_DOMAIN(_pfn, _dom)                                   \
-    do {                                                                    \
-        page_set_owner((_pfn), (_dom));                                     \
-        /* The incremented type count is intended to pin to 'writable'. */  \
-        (_pfn)->u.inuse.type_info = PGT_writable_page | PGT_validated | 1;  \
-        wmb(); /* install valid domain ptr before updating refcnt. */       \
-        spin_lock(&(_dom)->page_alloc_lock);                                \
-        /* _dom holds an allocation reference */                            \
-        ASSERT((_pfn)->count_info == 0);                                    \
-        (_pfn)->count_info |= PGC_allocated | 1;                            \
-        if ( unlikely((_dom)->xenheap_pages++ == 0) )                       \
-            get_knownalive_domain(_dom);                                    \
-        list_add_tail(&(_pfn)->list, &(_dom)->xenpage_list);                \
-        spin_unlock(&(_dom)->page_alloc_lock);                              \
-    } while ( 0 )
+#define XENSHARE_writable 0
+#define XENSHARE_readonly 1
+extern void share_xen_page_with_guest(
+    struct page_info *page, struct domain *d, int readonly);
+extern void share_xen_page_with_privileged_guests(
+    struct page_info *page, int readonly);
 
 extern struct page_info *frame_table;
 extern unsigned long max_page;
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/asm-x86/page.h
--- a/xen/include/asm-x86/page.h        Tue Mar 14 20:10:21 2006
+++ b/xen/include/asm-x86/page.h        Tue Mar 14 20:50:35 2006
@@ -190,6 +190,10 @@
 /* Shorthand versions of the above functions. */
 #define __pa(x)             (virt_to_maddr(x))
 #define __va(x)             (maddr_to_virt(x))
+
+/* Convert between Xen-heap virtual addresses and machine frame numbers. */
+#define virt_to_mfn(va)     (virt_to_maddr(va) >> PAGE_SHIFT)
+#define mfn_to_virt(mfn)    (maddr_to_virt(mfn << PAGE_SHIFT))
 
 /* Convert between machine frame numbers and page-info structures. */
 #define mfn_to_page(mfn)    (frame_table + (mfn))
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/asm-x86/regs.h
--- a/xen/include/asm-x86/regs.h        Tue Mar 14 20:10:21 2006
+++ b/xen/include/asm-x86/regs.h        Tue Mar 14 20:50:35 2006
@@ -31,15 +31,17 @@
     EF_ID   = 0x00200000,   /* id */
 };
 
-#define GUEST_MODE(r)                                                         \
+#define guest_mode(r)                                                         \
 ({                                                                            \
     unsigned long diff = (char *)guest_cpu_user_regs() - (char *)(r);         \
     /* Frame pointer must point into current CPU stack. */                    \
     ASSERT(diff < STACK_SIZE);                                                \
-    /* If a guest frame, it must not be a ring 0 frame (unless HVM guest). */ \
-    ASSERT((diff != 0) || VM86_MODE(r) || !RING_0(r) || HVM_DOMAIN(current)); \
-    /* If not a guest frame, it must be a ring 0 frame. */                    \
-    ASSERT((diff == 0) || (!VM86_MODE(r) && RING_0(r)));                      \
+    /* If a guest frame, it must be have guest privs (unless HVM guest).   */ \
+    /* We permit CS==0 which can come from an uninitialised trap entry. */    \
+    ASSERT((diff != 0) || vm86_mode(r) || ((r->cs&3) >= GUEST_KERNEL_RPL) ||  \
+           (r->cs == 0) || hvm_guest(current));                              \
+    /* If not a guest frame, it must be a hypervisor frame. */                \
+    ASSERT((diff == 0) || (!vm86_mode(r) && (r->cs == __HYPERVISOR_CS)));     \
     /* Return TRUE if it's a guest frame. */                                  \
     (diff == 0);                                                              \
 })
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/asm-x86/shadow.h
--- a/xen/include/asm-x86/shadow.h      Tue Mar 14 20:10:21 2006
+++ b/xen/include/asm-x86/shadow.h      Tue Mar 14 20:50:35 2006
@@ -1646,7 +1646,7 @@
           || (va >= HYPERVISOR_VIRT_END)
 #endif
              ) &&
-         KERNEL_MODE(v, regs) )
+         guest_kernel_mode(v, regs) )
         return 1;
 
     return 0;
@@ -1700,7 +1700,7 @@
     struct domain *d = v->domain;
     int paging_enabled;
 
-    if ( HVM_DOMAIN(v) )
+    if ( hvm_guest(v) )
         paging_enabled = hvm_paging_enabled(v);
     else
         // HACK ALERT: there's currently no easy way to figure out if a domU
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/asm-x86/shadow_64.h
--- a/xen/include/asm-x86/shadow_64.h   Tue Mar 14 20:10:21 2006
+++ b/xen/include/asm-x86/shadow_64.h   Tue Mar 14 20:50:35 2006
@@ -51,8 +51,11 @@
 #define READ_FAULT  0
 #define WRITE_FAULT 1
 
-#define ERROR_W    2
+#define ERROR_P     1
+#define ERROR_W     2
 #define ERROR_U     4
+#define ERROR_I     (1 << 4)
+
 #define X86_64_SHADOW_DEBUG 0
 
 #if X86_64_SHADOW_DEBUG
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/asm-x86/x86_32/regs.h
--- a/xen/include/asm-x86/x86_32/regs.h Tue Mar 14 20:10:21 2006
+++ b/xen/include/asm-x86/x86_32/regs.h Tue Mar 14 20:50:35 2006
@@ -4,16 +4,17 @@
 #include <xen/types.h>
 #include <public/xen.h>
 
-#define VM86_MODE(_r) ((_r)->eflags & EF_VM)
-#define RING_0(_r)    (((_r)->cs & 3) == 0)
-#define RING_1(_r)    (((_r)->cs & 3) == 1)
-#define RING_2(_r)    (((_r)->cs & 3) == 2)
-#define RING_3(_r)    (((_r)->cs & 3) == 3)
+#define vm86_mode(r) ((r)->eflags & EF_VM)
+#define ring_0(r)    (((r)->cs & 3) == 0)
+#define ring_1(r)    (((r)->cs & 3) == 1)
+#define ring_2(r)    (((r)->cs & 3) == 2)
+#define ring_3(r)    (((r)->cs & 3) == 3)
 
-#define KERNEL_MODE(_e, _r) (!VM86_MODE(_r) && RING_1(_r))
+#define guest_kernel_mode(v, r)   \
+    (!vm86_mode(r) && ring_1(r))
 
-#define PERMIT_SOFTINT(_dpl, _e, _r) \
-    ((_dpl) >= (VM86_MODE(_r) ? 3 : ((_r)->cs & 3)))
+#define permit_softint(dpl, v, r) \
+    ((dpl) >= (vm86_mode(r) ? 3 : ((r)->cs & 3)))
 
 /* Number of bytes of on-stack execution state to be context-switched. */
 #define CTXT_SWITCH_STACK_BYTES (sizeof(struct cpu_user_regs))
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/asm-x86/x86_64/regs.h
--- a/xen/include/asm-x86/x86_64/regs.h Tue Mar 14 20:10:21 2006
+++ b/xen/include/asm-x86/x86_64/regs.h Tue Mar 14 20:50:35 2006
@@ -4,16 +4,17 @@
 #include <xen/types.h>
 #include <public/xen.h>
 
-#define VM86_MODE(_r) (0) /* No VM86 support in long mode. */
-#define RING_0(_r)    (((_r)->cs & 3) == 0)
-#define RING_1(_r)    (((_r)->cs & 3) == 1)
-#define RING_2(_r)    (((_r)->cs & 3) == 2)
-#define RING_3(_r)    (((_r)->cs & 3) == 3)
+#define vm86_mode(r) (0) /* No VM86 support in long mode. */
+#define ring_0(r)    (((r)->cs & 3) == 0)
+#define ring_1(r)    (((r)->cs & 3) == 1)
+#define ring_2(r)    (((r)->cs & 3) == 2)
+#define ring_3(r)    (((r)->cs & 3) == 3)
 
-#define KERNEL_MODE(_e, _r) ((_e)->arch.flags & TF_kernel_mode)
+#define guest_kernel_mode(v, r)   \
+    (ring_3(r) && ((v)->arch.flags & TF_kernel_mode))
 
-#define PERMIT_SOFTINT(_dpl, _e, _r) \
-    ((_dpl) >= (KERNEL_MODE(_e, _r) ? 1 : 3))
+#define permit_softint(dpl, v, r) \
+    ((dpl) >= (guest_kernel_mode(v, r) ? 1 : 3))
 
 /* Number of bytes of on-stack execution state to be context-switched. */
 /* NB. Segment registers and bases are not saved/restored on x86/64 stack. */
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/public/acm.h
--- a/xen/include/public/acm.h  Tue Mar 14 20:10:21 2006
+++ b/xen/include/public/acm.h  Tue Mar 14 20:50:35 2006
@@ -152,7 +152,7 @@
     uint32_t ec_eval_count;
     uint32_t gt_eval_count;
     uint32_t ec_denied_count;
-    uint32_t gt_denied_count; 
+    uint32_t gt_denied_count;
     uint32_t ec_cachehit_count;
     uint32_t gt_cachehit_count;
 };
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/public/acm_ops.h
--- a/xen/include/public/acm_ops.h      Tue Mar 14 20:10:21 2006
+++ b/xen/include/public/acm_ops.h      Tue Mar 14 20:50:35 2006
@@ -10,6 +10,7 @@
 
 #include "xen.h"
 #include "sched_ctl.h"
+#include "acm.h"
 
 /*
  * Make sure you increment the interface version whenever you modify this file!
@@ -71,7 +72,7 @@
     int acm_decision;           /* out */
 };
 
-struct acm_op {
+typedef struct acm_op {
     uint32_t cmd;
     uint32_t interface_version;      /* ACM_INTERFACE_VERSION */
     union {
@@ -81,7 +82,8 @@
         struct acm_getssid getssid;
         struct acm_getdecision getdecision;
     } u;
-};
+} acm_op_t;
+DEFINE_GUEST_HANDLE(acm_op_t);
 
 #endif                          /* __XEN_PUBLIC_ACM_OPS_H__ */
 
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/public/arch-ia64.h
--- a/xen/include/public/arch-ia64.h    Tue Mar 14 20:10:21 2006
+++ b/xen/include/public/arch-ia64.h    Tue Mar 14 20:50:35 2006
@@ -60,8 +60,8 @@
 
 #define INVALID_MFN       (~0UL)
 
-#define MEM_G   (1UL << 30)    
-#define MEM_M   (1UL << 20)    
+#define MEM_G   (1UL << 30)
+#define MEM_M   (1UL << 20)
 
 #define MMIO_START       (3 * MEM_G)
 #define MMIO_SIZE        (512 * MEM_M)
@@ -70,7 +70,7 @@
 #define VGA_IO_SIZE      0x20000
 
 #define LEGACY_IO_START  (MMIO_START + MMIO_SIZE)
-#define LEGACY_IO_SIZE   (64*MEM_M)  
+#define LEGACY_IO_SIZE   (64*MEM_M)
 
 #define IO_PAGE_START (LEGACY_IO_START + LEGACY_IO_SIZE)
 #define IO_PAGE_SIZE  PAGE_SIZE
@@ -82,7 +82,7 @@
 #define IO_SAPIC_SIZE    0x100000
 
 #define PIB_START 0xfee00000UL
-#define PIB_SIZE 0x100000 
+#define PIB_SIZE 0x100000
 
 #define GFW_START        (4*MEM_G -16*MEM_M)
 #define GFW_SIZE         (16*MEM_M)
@@ -300,7 +300,7 @@
 
 typedef struct {
     unsigned long start;
-    unsigned long size; 
+    unsigned long size;
 } arch_initrd_info_t;
 
 #define IA64_COMMAND_LINE_SIZE 512
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/public/arch-x86_32.h
--- a/xen/include/public/arch-x86_32.h  Tue Mar 14 20:10:21 2006
+++ b/xen/include/public/arch-x86_32.h  Tue Mar 14 20:50:35 2006
@@ -102,6 +102,7 @@
     uint16_t      cs;      /* code selector                                 */
     unsigned long address; /* code offset                                   */
 } trap_info_t;
+DEFINE_GUEST_HANDLE(trap_info_t);
 
 typedef struct cpu_user_regs {
     uint32_t ebx;
@@ -125,6 +126,7 @@
     uint16_t fs, _pad4;
     uint16_t gs, _pad5;
 } cpu_user_regs_t;
+DEFINE_GUEST_HANDLE(cpu_user_regs_t);
 
 typedef uint64_t tsc_timestamp_t; /* RDTSC timestamp */
 
@@ -157,7 +159,7 @@
 typedef struct arch_shared_info {
     unsigned long max_pfn;                  /* max pfn that appears in table */
     /* Frame containing list of mfns containing list of mfns containing p2m. */
-    unsigned long pfn_to_mfn_frame_list_list; 
+    unsigned long pfn_to_mfn_frame_list_list;
     unsigned long nmi_reason;
 } arch_shared_info_t;
 
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/public/arch-x86_64.h
--- a/xen/include/public/arch-x86_64.h  Tue Mar 14 20:10:21 2006
+++ b/xen/include/public/arch-x86_64.h  Tue Mar 14 20:50:35 2006
@@ -136,15 +136,6 @@
     uint64_t rax, r11, rcx, flags, rip, cs, rflags, rsp, ss;
     /* Bottom of iret stack frame. */
 };
-/*
- * For compatibility with HYPERVISOR_switch_to_user which is the old
- * name for HYPERVISOR_iret.
- */
-struct switch_to_user {
-    /* Top of stack (%rsp at point of hypercall). */
-    uint64_t rax, r11, rcx, flags, rip, cs, rflags, rsp, ss;
-    /* Bottom of iret stack frame. */
-};
 
 /*
  * Send an array of these to HYPERVISOR_set_trap_table().
@@ -166,6 +157,7 @@
     uint16_t      cs;      /* code selector                                 */
     unsigned long address; /* code offset                                   */
 } trap_info_t;
+DEFINE_GUEST_HANDLE(trap_info_t);
 
 #ifdef __GNUC__
 /* Anonymous union includes both 32- and 64-bit names (e.g., eax/rax). */
@@ -205,6 +197,7 @@
     uint16_t fs, _pad5[3]; /* Non-zero => takes precedence over fs_base.     */
     uint16_t gs, _pad6[3]; /* Non-zero => takes precedence over gs_base_usr. */
 } cpu_user_regs_t;
+DEFINE_GUEST_HANDLE(cpu_user_regs_t);
 
 #undef __DECL_REG
 
@@ -242,7 +235,7 @@
 typedef struct arch_shared_info {
     unsigned long max_pfn;                  /* max pfn that appears in table */
     /* Frame containing list of mfns containing list of mfns containing p2m. */
-    unsigned long pfn_to_mfn_frame_list_list; 
+    unsigned long pfn_to_mfn_frame_list_list;
     unsigned long nmi_reason;
 } arch_shared_info_t;
 
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/public/dom0_ops.h
--- a/xen/include/public/dom0_ops.h     Tue Mar 14 20:10:21 2006
+++ b/xen/include/public/dom0_ops.h     Tue Mar 14 20:50:35 2006
@@ -173,7 +173,7 @@
 } dom0_readconsole_t;
 DEFINE_GUEST_HANDLE(dom0_readconsole_t);
 
-/* 
+/*
  * Set which physical cpus a vcpu can execute on.
  */
 #define DOM0_SETVCPUAFFINITY  20
@@ -231,7 +231,7 @@
 } dom0_sched_id_t;
 DEFINE_GUEST_HANDLE(dom0_sched_id_t);
 
-/* 
+/*
  * Control shadow pagetables operation
  */
 #define DOM0_SHADOW_CONTROL  25
@@ -248,8 +248,8 @@
 typedef struct dom0_shadow_control_stats {
     uint32_t fault_count;
     uint32_t dirty_count;
-    uint32_t dirty_net_count;     
-    uint32_t dirty_block_count;     
+    uint32_t dirty_net_count;
+    uint32_t dirty_block_count;
 } dom0_shadow_control_stats_t;
 DEFINE_GUEST_HANDLE(dom0_shadow_control_stats_t);
 
@@ -402,7 +402,7 @@
 } dom0_getdomaininfolist_t;
 DEFINE_GUEST_HANDLE(dom0_getdomaininfolist_t);
 
-#define DOM0_PLATFORM_QUIRK      39  
+#define DOM0_PLATFORM_QUIRK      39
 #define QUIRK_NOIRQBALANCING  1
 typedef struct dom0_platform_quirk {
     /* IN variables. */
@@ -463,14 +463,14 @@
     uint8_t allow_access;     /* allow (!0) or deny (0) access to range? */
 } dom0_iomem_permission_t;
 DEFINE_GUEST_HANDLE(dom0_iomem_permission_t);
- 
+
 #define DOM0_HYPERCALL_INIT   48
 typedef struct dom0_hypercall_init {
     domid_t  domain;          /* domain to be affected */
     unsigned long mfn;        /* machine frame to be initialised */
 } dom0_hypercall_init_t;
 DEFINE_GUEST_HANDLE(dom0_hypercall_init_t);
- 
+
 typedef struct dom0_op {
     uint32_t cmd;
     uint32_t interface_version; /* DOM0_INTERFACE_VERSION */
@@ -507,7 +507,7 @@
         struct dom0_platform_quirk    platform_quirk;
         struct dom0_physical_memory_map physical_memory_map;
         struct dom0_max_vcpus         max_vcpus;
-        struct dom0_setdomainhandle   setdomainhandle;        
+        struct dom0_setdomainhandle   setdomainhandle;
         struct dom0_setdebugging      setdebugging;
         struct dom0_irq_permission    irq_permission;
         struct dom0_iomem_permission  iomem_permission;
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/public/event_channel.h
--- a/xen/include/public/event_channel.h        Tue Mar 14 20:10:21 2006
+++ b/xen/include/public/event_channel.h        Tue Mar 14 20:50:35 2006
@@ -10,6 +10,7 @@
 #define __XEN_PUBLIC_EVENT_CHANNEL_H__
 
 typedef uint32_t evtchn_port_t;
+DEFINE_GUEST_HANDLE(evtchn_port_t);
 
 /*
  * EVTCHNOP_alloc_unbound: Allocate a port in domain <dom> and mark as
@@ -189,6 +190,7 @@
         evtchn_unmask_t           unmask;
     } u;
 } evtchn_op_t;
+DEFINE_GUEST_HANDLE(evtchn_op_t);
 
 #endif /* __XEN_PUBLIC_EVENT_CHANNEL_H__ */
 
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/public/grant_table.h
--- a/xen/include/public/grant_table.h  Tue Mar 14 20:10:21 2006
+++ b/xen/include/public/grant_table.h  Tue Mar 14 20:50:35 2006
@@ -167,6 +167,7 @@
     grant_handle_t handle;
     uint64_t dev_bus_addr;
 } gnttab_map_grant_ref_t;
+DEFINE_GUEST_HANDLE(gnttab_map_grant_ref_t);
 
 /*
  * GNTTABOP_unmap_grant_ref: Destroy one or more grant-reference mappings
@@ -188,6 +189,7 @@
     /* OUT parameters. */
     int16_t  status;              /* GNTST_* */
 } gnttab_unmap_grant_ref_t;
+DEFINE_GUEST_HANDLE(gnttab_unmap_grant_ref_t);
 
 /*
  * GNTTABOP_setup_table: Set up a grant table for <dom> comprising at least
@@ -205,8 +207,9 @@
     uint32_t nr_frames;
     /* OUT parameters. */
     int16_t  status;              /* GNTST_* */
-    unsigned long *frame_list;
+    GUEST_HANDLE(ulong) frame_list;
 } gnttab_setup_table_t;
+DEFINE_GUEST_HANDLE(gnttab_setup_table_t);
 
 /*
  * GNTTABOP_dump_table: Dump the contents of the grant table to the
@@ -219,6 +222,7 @@
     /* OUT parameters. */
     int16_t status;               /* GNTST_* */
 } gnttab_dump_table_t;
+DEFINE_GUEST_HANDLE(gnttab_dump_table_t);
 
 /*
  * GNTTABOP_transfer_grant_ref: Transfer <frame> to a foreign domain. The
@@ -237,6 +241,7 @@
     /* OUT parameters. */
     int16_t       status;
 } gnttab_transfer_t;
+DEFINE_GUEST_HANDLE(gnttab_transfer_t);
 
 /*
  * Bitfield values for update_pin_status.flags.
@@ -262,7 +267,7 @@
   * GNTMAP_contains_pte subflag:
   *  0 => This map request contains a host virtual address.
   *  1 => This map request contains the machine addess of the PTE to update.
-  */ 
+  */
 #define _GNTMAP_contains_pte    (4)
 #define GNTMAP_contains_pte     (1<<_GNTMAP_contains_pte)
 
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/public/hvm/vmx_assist.h
--- a/xen/include/public/hvm/vmx_assist.h       Tue Mar 14 20:10:21 2006
+++ b/xen/include/public/hvm/vmx_assist.h       Tue Mar 14 20:50:35 2006
@@ -22,13 +22,13 @@
         unsigned int seg_type : 4,
             s         : 1,
             dpl       : 2,
-            p         : 1, 
+            p         : 1,
             reserved0 : 4,
             avl       : 1,
-            reserved1 : 1,     
+            reserved1 : 1,
             default_ops_size: 1,
             g         : 1,
-            null_bit  : 1, 
+            null_bit  : 1,
             reserved2 : 15;
     } fields;
     unsigned int bytes;
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/public/io/ring.h
--- a/xen/include/public/io/ring.h      Tue Mar 14 20:10:21 2006
+++ b/xen/include/public/io/ring.h      Tue Mar 14 20:50:35 2006
@@ -39,7 +39,7 @@
  *
  * These expand out to give you a set of types, as you can see below.
  * The most important of these are:
- *  
+ * 
  *     mytag_sring_t      - The shared ring.
  *     mytag_front_ring_t - The 'front' half of the ring.
  *     mytag_back_ring_t  - The 'back' half of the ring.
@@ -58,7 +58,7 @@
  *     mytag_back_ring_t back_ring;
  *     BACK_RING_INIT(&back_ring, (mytag_sring_t *)shared_page, PAGE_SIZE);
  */
-         
+
 #define DEFINE_RING_TYPES(__name, __req_t, __rsp_t)                     \
                                                                         \
 /* Shared ring entry */                                                 \
@@ -97,7 +97,7 @@
 typedef struct __name##_back_ring __name##_back_ring_t
 
 /*
- * Macros for manipulating rings.  
+ * Macros for manipulating rings.
  * 
  * FRONT_RING_whatever works on the "front end" of a ring: here 
  * requests are pushed on to the ring and responses taken off it.
@@ -105,7 +105,7 @@
  * BACK_RING_whatever works on the "back end" of a ring: here 
  * requests are taken off the ring and responses put on.
  * 
- * N.B. these macros do NO INTERLOCKS OR FLOW CONTROL.  
+ * N.B. these macros do NO INTERLOCKS OR FLOW CONTROL. 
  * This is OK in 1-for-1 request-response situations where the 
  * requestor (front end) never has more than RING_SIZE()-1
  * outstanding requests.
@@ -151,7 +151,7 @@
 #define RING_SIZE(_r)                                                   \
     ((_r)->nr_ents)
 
-/* Test if there is an empty slot available on the front ring. 
+/* Test if there is an empty slot available on the front ring.
  * (This is only meaningful from the front. )
  */
 #define RING_FULL(_r)                                                   \
@@ -159,24 +159,19 @@
 
 /* Test if there are outstanding messages to be processed on a ring. */
 #define RING_HAS_UNCONSUMED_RESPONSES(_r)                               \
-   ( (_r)->rsp_cons != (_r)->sring->rsp_prod )
-   
+    ((_r)->rsp_cons != (_r)->sring->rsp_prod)
+
 #define RING_HAS_UNCONSUMED_REQUESTS(_r)                                \
-   ( ((_r)->req_cons != (_r)->sring->req_prod ) &&                      \
-     (((_r)->req_cons - (_r)->rsp_prod_pvt) !=                          \
-      RING_SIZE(_r)) )
-      
+    (((_r)->req_cons != (_r)->sring->req_prod) &&                       \
+     (((_r)->req_cons - (_r)->rsp_prod_pvt) != RING_SIZE(_r)))
+
 /* Direct access to individual ring elements, by index. */
 #define RING_GET_REQUEST(_r, _idx)                                      \
- (&((_r)->sring->ring[                                                  \
-     ((_idx) & (RING_SIZE(_r) - 1))                                     \
-     ].req))
+    (&((_r)->sring->ring[((_idx) & (RING_SIZE(_r) - 1))].req))
 
 #define RING_GET_RESPONSE(_r, _idx)                                     \
- (&((_r)->sring->ring[                                                  \
-     ((_idx) & (RING_SIZE(_r) - 1))                                     \
-     ].rsp))   
-    
+    (&((_r)->sring->ring[((_idx) & (RING_SIZE(_r) - 1))].rsp))
+
 /* Loop termination condition: Would the specified index overflow the ring? */
 #define RING_REQUEST_CONS_OVERFLOW(_r, _cons)                           \
     (((_cons) - (_r)->rsp_prod_pvt) >= RING_SIZE(_r))
@@ -212,7 +207,7 @@
  *  The second argument is a boolean return value. True indicates that there
  *  are pending messages on the ring (i.e., the connection should not be put
  *  to sleep).
- *  
+ * 
  *  These macros will set the req_event/rsp_event field to trigger a
  *  notification on the very next message that is enqueued. If you want to
  *  create batches of work (i.e., only receive a notification after several
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/public/io/xenbus.h
--- a/xen/include/public/io/xenbus.h    Tue Mar 14 20:10:21 2006
+++ b/xen/include/public/io/xenbus.h    Tue Mar 14 20:50:35 2006
@@ -6,9 +6,8 @@
  * Copyright (C) 2005 XenSource Ltd.
  */
 
-#ifndef _XEN_XENBUS_H
-#define _XEN_XENBUS_H
-
+#ifndef _XEN_PUBLIC_IO_XENBUS_H
+#define _XEN_PUBLIC_IO_XENBUS_H
 
 /* The state of either end of the Xenbus, i.e. the current communication
    status of initialisation across the bus.  States here imply nothing about
@@ -30,8 +29,7 @@
 
 } XenbusState;
 
-
-#endif /* _XEN_XENBUS_H */
+#endif /* _XEN_PUBLIC_IO_XENBUS_H */
 
 /*
  * Local variables:
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/public/memory.h
--- a/xen/include/public/memory.h       Tue Mar 14 20:10:21 2006
+++ b/xen/include/public/memory.h       Tue Mar 14 20:50:35 2006
@@ -80,7 +80,7 @@
      * machphys table is smaller than max_extents * 2MB.
      */
     unsigned int max_extents;
-    
+
     /*
      * Pointer to buffer to fill with list of extent starts. If there are
      * any large discontiguities in the machine address space, 2MB gaps in
@@ -97,25 +97,27 @@
 DEFINE_GUEST_HANDLE(xen_machphys_mfn_list_t);
 
 /*
- * Returns the base and size of the specified reserved 'RAM hole' in the
- * specified guest's pseudophysical address space.
- * arg == addr of xen_reserved_phys_area_t.
+ * Sets the GPFN at which a particular page appears in the specified guest's
+ * pseudophysical address space.
+ * arg == addr of xen_add_to_physmap_t.
  */
-#define XENMEM_reserved_phys_area   7
-typedef struct xen_reserved_phys_area {
-    /* Which domain to report about? */
+#define XENMEM_add_to_physmap      7
+typedef struct xen_add_to_physmap {
+    /* Which domain to change the mapping for. */
     domid_t domid;
 
-    /*
-     * Which reserved area to report? Out-of-range request reports
-     * -ESRCH. Currently no architecture will have more than one reserved area.
-     */
-    unsigned int idx;
+    /* Source mapping space. */
+#define XENMAPSPACE_shared_info 0 /* shared info page */
+#define XENMAPSPACE_grant_table 1 /* grant table page */
+    unsigned int space;
 
-    /* Base and size of the specified reserved area. */
-    unsigned long first_gpfn, nr_gpfns;
-} xen_reserved_phys_area_t;
-DEFINE_GUEST_HANDLE(xen_reserved_phys_area_t);
+    /* Index into source mapping space. */
+    unsigned long idx;
+
+    /* GPFN where the source mapping page should appear. */
+    unsigned long gpfn;
+} xen_add_to_physmap_t;
+DEFINE_GUEST_HANDLE(xen_add_to_physmap_t);
 
 /*
  * Translates a list of domain-specific GPFNs into MFNs. Returns a -ve error
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/public/nmi.h
--- a/xen/include/public/nmi.h  Tue Mar 14 20:10:21 2006
+++ b/xen/include/public/nmi.h  Tue Mar 14 20:50:35 2006
@@ -31,9 +31,14 @@
 /*
  * Register NMI callback for this (calling) VCPU. Currently this only makes
  * sense for domain 0, vcpu 0. All other callers will be returned EINVAL.
- * arg == address of callback function.
+ * arg == pointer to xennmi_callback structure.
  */
 #define XENNMI_register_callback   0
+typedef struct xennmi_callback {
+    unsigned long handler_address;
+    unsigned long pad;
+} xennmi_callback_t;
+DEFINE_GUEST_HANDLE(xennmi_callback_t);
 
 /*
  * Deregister NMI callback for this (calling) VCPU.
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/public/physdev.h
--- a/xen/include/public/physdev.h      Tue Mar 14 20:10:21 2006
+++ b/xen/include/public/physdev.h      Tue Mar 14 20:50:35 2006
@@ -37,14 +37,14 @@
     uint32_t reg;
     /* IN or OUT */
     uint32_t value;
-} physdevop_apic_t; 
+} physdevop_apic_t;
 
 typedef struct physdevop_irq {
     /* IN */
     uint32_t irq;
     /* OUT */
     uint32_t vector;
-} physdevop_irq_t; 
+} physdevop_irq_t;
 
 typedef struct physdev_op {
     uint32_t cmd;
@@ -56,6 +56,7 @@
         physdevop_irq_t                   irq_op;
     } u;
 } physdev_op_t;
+DEFINE_GUEST_HANDLE(physdev_op_t);
 
 #endif /* __XEN_PUBLIC_PHYSDEV_H__ */
 
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/public/sched.h
--- a/xen/include/public/sched.h        Tue Mar 14 20:10:21 2006
+++ b/xen/include/public/sched.h        Tue Mar 14 20:50:35 2006
@@ -9,16 +9,32 @@
 #ifndef __XEN_PUBLIC_SCHED_H__
 #define __XEN_PUBLIC_SCHED_H__
 
+#include "event_channel.h"
+
 /*
- * Prototype for this hypercall is:
- *  int sched_op(int cmd, unsigned long arg)
+ * There are two forms of this hypercall.
+ * 
+ * The first and preferred version is only available from Xen 3.0.2. 
+ * The prototype for this hypercall is:
+ *  long sched_op_new(int cmd, void *arg)
  * @cmd == SCHEDOP_??? (scheduler operation).
- * @arg == Operation-specific extra argument(s).
+ * @arg == Operation-specific extra argument(s), as described below.
+ * 
+ * The legacy version of this hypercall supports only the following commands:
+ * SCHEDOP_yield, SCHEDOP_block, and SCHEDOP_shutdown. The prototype for the
+ * legacy hypercall is:
+ *  long sched_op(int cmd, unsigned long arg)
+ * @cmd == SCHEDOP_??? (scheduler operation).
+ * @arg == 0               (SCHEDOP_yield and SCHEDOP_block)
+ *      == SHUTDOWN_* code (SCHEDOP_shutdown)
+ * 
+ * The sub-command descriptions below describe extra arguments for the
+ * sched_op_new() hypercall.
  */
 
 /*
  * Voluntarily yield the CPU.
- * @arg == 0.
+ * @arg == NULL.
  */
 #define SCHEDOP_yield       0
 
@@ -27,18 +43,35 @@
  * If called with event upcalls masked, this operation will atomically
  * reenable event delivery and check for pending events before blocking the
  * VCPU. This avoids a "wakeup waiting" race.
- * @arg == 0.
+ * @arg == NULL.
  */
 #define SCHEDOP_block       1
 
 /*
  * Halt execution of this domain (all VCPUs) and notify the system controller.
- * @arg == SHUTDOWN_??? (reason for shutdown).
+ * @arg == pointer to sched_shutdown structure.
  */
 #define SCHEDOP_shutdown    2
+typedef struct sched_shutdown {
+    unsigned int reason; /* SHUTDOWN_* */
+} sched_shutdown_t;
+DEFINE_GUEST_HANDLE(sched_shutdown_t);
 
 /*
- * Reason codes for SCHEDOP_shutdown. These may be interpreted by controller
+ * Poll a set of event-channel ports. Return when one or more are pending. An
+ * optional timeout may be specified.
+ * @arg == pointer to sched_poll structure.
+ */
+#define SCHEDOP_poll        3
+typedef struct sched_poll {
+    GUEST_HANDLE(evtchn_port_t) ports;
+    unsigned int nr_ports;
+    uint64_t timeout;
+} sched_poll_t;
+DEFINE_GUEST_HANDLE(sched_poll_t);
+
+/*
+ * Reason codes for SCHEDOP_shutdown. These may be interpreted by control
  * software to determine the appropriate action. For the most part, Xen does
  * not care about the shutdown code.
  */
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/public/sched_ctl.h
--- a/xen/include/public/sched_ctl.h    Tue Mar 14 20:10:21 2006
+++ b/xen/include/public/sched_ctl.h    Tue Mar 14 20:50:35 2006
@@ -34,24 +34,20 @@
     uint32_t direction;
     domid_t  domain;
     union {
-        struct bvt_adjdom
-        {
+        struct bvt_adjdom {
             uint32_t mcu_adv;      /* mcu advance: inverse of weight */
             uint32_t warpback;     /* warp? */
             int32_t  warpvalue;    /* warp value */
             int64_t  warpl;        /* warp limit */
             int64_t  warpu;        /* unwarp time requirement */
         } bvt;
-        
-        struct sedf_adjdom
-        {
+        struct sedf_adjdom {
             uint64_t period;
             uint64_t slice;
             uint64_t latency;
             uint32_t extratime;
             uint32_t weight;
         } sedf;
-
     } u;
 };
 
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/public/xen.h
--- a/xen/include/public/xen.h  Tue Mar 14 20:10:21 2006
+++ b/xen/include/public/xen.h  Tue Mar 14 20:50:35 2006
@@ -54,13 +54,12 @@
 #define __HYPERVISOR_vm_assist            21
 #define __HYPERVISOR_update_va_mapping_otherdomain 22
 #define __HYPERVISOR_iret                 23 /* x86 only */
-#define __HYPERVISOR_switch_vm86          23 /* x86/32 only (obsolete name) */
-#define __HYPERVISOR_switch_to_user       23 /* x86/64 only (obsolete name) */
 #define __HYPERVISOR_vcpu_op              24
 #define __HYPERVISOR_set_segment_base     25 /* x86/64 only */
 #define __HYPERVISOR_mmuext_op            26
 #define __HYPERVISOR_acm_op               27
 #define __HYPERVISOR_nmi_op               28
+#define __HYPERVISOR_sched_op_new         29
 
 /* 
  * VIRTUAL INTERRUPTS
@@ -162,7 +161,7 @@
 #define MMUEXT_NEW_USER_BASEPTR 15
 
 #ifndef __ASSEMBLY__
-struct mmuext_op {
+typedef struct mmuext_op {
     unsigned int cmd;
     union {
         /* [UN]PIN_TABLE, NEW_BASEPTR, NEW_USER_BASEPTR */
@@ -176,7 +175,8 @@
         /* TLB_FLUSH_MULTI, INVLPG_MULTI */
         void *vcpumask;
     } arg2;
-};
+} mmuext_op_t;
+DEFINE_GUEST_HANDLE(mmuext_op_t);
 #endif
 
 /* These are passed as 'flags' to update_va_mapping. They can be ORed. */
@@ -243,6 +243,7 @@
     uint64_t ptr;       /* Machine address of PTE. */
     uint64_t val;       /* New contents of PTE.    */
 } mmu_update_t;
+DEFINE_GUEST_HANDLE(mmu_update_t);
 
 /*
  * Send an array of these to HYPERVISOR_multicall().
@@ -252,6 +253,7 @@
     unsigned long op, result;
     unsigned long args[6];
 } multicall_entry_t;
+DEFINE_GUEST_HANDLE(multicall_entry_t);
 
 /*
  * Event channel endpoints per domain:
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/xen/event.h
--- a/xen/include/xen/event.h   Tue Mar 14 20:10:21 2006
+++ b/xen/include/xen/event.h   Tue Mar 14 20:50:35 2006
@@ -15,41 +15,14 @@
 #include <asm/bitops.h>
 #include <asm/event.h>
 
-/*
- * EVENT-CHANNEL NOTIFICATIONS
- * NB. On x86, the atomic bit operations also act as memory barriers. There
- * is therefore sufficiently strict ordering for this architecture -- others
- * may require explicit memory barriers.
- */
-
-static inline void evtchn_set_pending(struct vcpu *v, int port)
-{
-    struct domain *d = v->domain;
-    shared_info_t *s = d->shared_info;
-
-    /* These four operations must happen in strict order. */
-    if ( !test_and_set_bit(port, &s->evtchn_pending[0]) &&
-         !test_bit        (port, &s->evtchn_mask[0])    &&
-         !test_and_set_bit(port / BITS_PER_LONG,
-                           &v->vcpu_info->evtchn_pending_sel) &&
-         !test_and_set_bit(0, &v->vcpu_info->evtchn_upcall_pending) )
-    {
-        evtchn_notify(v);
-    }
-}
+extern void evtchn_set_pending(struct vcpu *v, int port);
 
 /*
  * send_guest_virq:
  *  @v:        VCPU to which virtual IRQ should be sent
  *  @virq:     Virtual IRQ number (VIRQ_*)
  */
-static inline void send_guest_virq(struct vcpu *v, int virq)
-{
-    int port = v->virq_to_evtchn[virq];
-
-    if ( likely(port != 0) )
-        evtchn_set_pending(v, port);
-}
+extern void send_guest_virq(struct vcpu *v, int virq);
 
 /*
  * send_guest_pirq:
@@ -63,6 +36,9 @@
     (!!(v)->vcpu_info->evtchn_upcall_pending &  \
       !(v)->vcpu_info->evtchn_upcall_mask)
 
+#define evtchn_pending(d, p)                    \
+    (test_bit((p), &(d)->shared_info->evtchn_pending[0]))
+
 /* Send a notification from a local event-channel port. */
 extern long evtchn_send(unsigned int lport);
 
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/xen/gdbstub.h
--- a/xen/include/xen/gdbstub.h Tue Mar 14 20:10:21 2006
+++ b/xen/include/xen/gdbstub.h Tue Mar 14 20:50:35 2006
@@ -20,6 +20,9 @@
 
 #ifndef __XEN_GDBSTUB_H__
 #define __XEN_GDBSTUB_H__
+
+#include <asm/atomic.h>
+#include <asm/page.h>
 
 #ifdef CRASH_DEBUG
 
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/xen/hypercall.h
--- a/xen/include/xen/hypercall.h       Tue Mar 14 20:10:21 2006
+++ b/xen/include/xen/hypercall.h       Tue Mar 14 20:50:35 2006
@@ -9,6 +9,8 @@
 #include <xen/types.h>
 #include <xen/time.h>
 #include <public/xen.h>
+#include <public/acm_ops.h>
+#include <public/event_channel.h>
 #include <asm/hypercall.h>
 
 extern long
@@ -20,46 +22,43 @@
     int cmd,
     unsigned long arg);
 
-struct dom0_op;
 extern long
 do_dom0_op(
-    struct dom0_op *u_dom0_op);
+    GUEST_HANDLE(dom0_op_t) u_dom0_op);
 
 extern long
 do_memory_op(
     int cmd,
-    void *arg);
+    GUEST_HANDLE(void) arg);
 
-struct multicall_entry;
 extern long
 do_multicall(
-    struct multicall_entry *call_list,
+    GUEST_HANDLE(multicall_entry_t) call_list,
     unsigned int nr_calls);
 
 extern long
 do_set_timer_op(
     s_time_t timeout);
 
-struct evtchn_op;
 extern long
 do_event_channel_op(
-    struct evtchn_op *uop);
+    GUEST_HANDLE(evtchn_op_t) uop);
 
 extern long
 do_xen_version(
     int cmd,
-    void *arg);
+    GUEST_HANDLE(void) arg);
 
 extern long
 do_console_io(
     int cmd,
     int count,
-    char *buffer);
+    GUEST_HANDLE(char) buffer);
 
 extern long
 do_grant_table_op(
     unsigned int cmd,
-    void *uop,
+    GUEST_HANDLE(void) uop,
     unsigned int count);
 
 extern long
@@ -71,16 +70,15 @@
 do_vcpu_op(
     int cmd,
     int vcpuid,
-    void *arg);
+    GUEST_HANDLE(void) arg);
 
-struct acm_op;
 extern long
 do_acm_op(
-    struct acm_op *u_acm_op);
+    GUEST_HANDLE(acm_op_t) u_acm_op);
 
 extern long
 do_nmi_op(
     unsigned int cmd,
-    void *arg);
+    GUEST_HANDLE(void) arg);
 
 #endif /* __XEN_HYPERCALL_H__ */
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/xen/mm.h
--- a/xen/include/xen/mm.h      Tue Mar 14 20:10:21 2006
+++ b/xen/include/xen/mm.h      Tue Mar 14 20:50:35 2006
@@ -82,4 +82,6 @@
 #define sync_pagetable_state(d) ((void)0)
 #endif
 
+int guest_remove_page(struct domain *d, unsigned long gmfn);
+
 #endif /* __XEN_MM_H__ */
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/xen/perfc_defn.h
--- a/xen/include/xen/perfc_defn.h      Tue Mar 14 20:10:21 2006
+++ b/xen/include/xen/perfc_defn.h      Tue Mar 14 20:50:35 2006
@@ -26,7 +26,7 @@
 PERFCOUNTER_ARRAY(hypercalls,           "hypercalls", NR_hypercalls)
 PERFCOUNTER_ARRAY(exceptions,           "exceptions", 32)
 
-#define VMX_PERF_EXIT_REASON_SIZE 37
+#define VMX_PERF_EXIT_REASON_SIZE 44
 #define VMX_PERF_VECTOR_SIZE 0x20
 PERFCOUNTER_ARRAY(vmexits,              "vmexits", VMX_PERF_EXIT_REASON_SIZE)
 PERFCOUNTER_ARRAY(cause_vector,         "cause vector", VMX_PERF_VECTOR_SIZE)
diff -r dc50cdd66c5c -r 0ed4a312765b xen/include/xen/sched.h
--- a/xen/include/xen/sched.h   Tue Mar 14 20:10:21 2006
+++ b/xen/include/xen/sched.h   Tue Mar 14 20:50:35 2006
@@ -67,6 +67,8 @@
     struct timer     timer;         /* one-shot timer for timeout values */
     unsigned long    sleep_tick;    /* tick at which this vcpu started sleep */
 
+    struct timer     poll_timer;    /* timeout for SCHEDOP_poll */
+
     void            *sched_priv;    /* scheduler-specific data */
 
     struct vcpu_runstate_info runstate;
@@ -266,7 +268,7 @@
 void sched_rem_domain(struct vcpu *);
 long sched_ctl(struct sched_ctl_cmd *);
 long sched_adjdom(struct sched_adjdom_cmd *);
-int  sched_id();
+int  sched_id(void);
 void vcpu_wake(struct vcpu *d);
 void vcpu_sleep_nosync(struct vcpu *d);
 void vcpu_sleep_sync(struct vcpu *d);
@@ -310,7 +312,6 @@
  * It contains one character per argument as follows:
  *  'i' [unsigned] {char, int}
  *  'l' [unsigned] long
- *  'p' pointer (foo *)
  *  'h' guest handle (GUEST_HANDLE(foo))
  */
 unsigned long hypercall_create_continuation(
diff -r dc50cdd66c5c -r 0ed4a312765b tools/python/xen/xend/server/irqif.py
--- /dev/null   Tue Mar 14 20:10:21 2006
+++ b/tools/python/xen/xend/server/irqif.py     Tue Mar 14 20:50:35 2006
@@ -0,0 +1,73 @@
+#============================================================================
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of version 2.1 of the GNU Lesser General Public
+# License as published by the Free Software Foundation.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+#============================================================================
+# Copyright (C) 2004, 2005 Mike Wray <mike.wray@xxxxxx>
+# Copyright (C) 2005 XenSource Ltd
+# Copyright (C) 2005 Jody Belka
+#============================================================================
+# This code based on tools/python/xen/xend/server/iopif.py and modified
+# to handle interrupts
+#============================================================================
+
+
+import types
+
+import xen.lowlevel.xc;
+
+from xen.xend import sxp
+from xen.xend.XendError import VmError
+
+from xen.xend.server.DevController import DevController
+
+
+xc = xen.lowlevel.xc.xc()
+
+
+class IRQController(DevController):
+
+    def __init__(self, vm):
+        DevController.__init__(self, vm)
+
+
+    def getDeviceDetails(self, config):
+        """@see DevController.getDeviceDetails"""
+
+        def get_param(field):
+            try:
+                val = sxp.child_value(config, field)
+
+                if not val:
+                    raise VmError('irq: Missing %s config setting' % field)
+
+                if isinstance(val, types.StringType):
+                    return int(val,10)
+                    radix = 10
+                else:
+                    return val
+            except:
+                raise VmError('irq: Invalid config setting %s: %s' %
+                              (field, val))
+       
+        pirq = get_param('irq')
+
+        rc = xc.domain_irq_permission(dom          = self.getDomid(),
+                                      pirq         = pirq,
+                                      allow_access = True)
+
+        if rc < 0:
+            #todo non-fatal
+            raise VmError(
+                'irq: Failed to configure irq: %d' % (pirq))
+
+        return (None, {}, {})
diff -r dc50cdd66c5c -r 0ed4a312765b tools/xm-test/grouptest/create
--- /dev/null   Tue Mar 14 20:10:21 2006
+++ b/tools/xm-test/grouptest/create    Tue Mar 14 20:50:35 2006
@@ -0,0 +1,1 @@
+create
diff -r dc50cdd66c5c -r 0ed4a312765b tools/xm-test/grouptest/default
--- /dev/null   Tue Mar 14 20:10:21 2006
+++ b/tools/xm-test/grouptest/default   Tue Mar 14 20:50:35 2006
@@ -0,0 +1,29 @@
+block-create
+block-destroy
+block-list
+console
+create
+destroy
+dmesg
+domid
+domname
+enforce_dom0_cpus
+help
+info
+list
+memmax
+memset
+migrate
+network
+network-attach
+pause
+reboot
+restore
+save
+sedf
+shutdown
+sysrq
+unpause
+vcpu-disable
+vcpu-pin
+vtpm
diff -r dc50cdd66c5c -r 0ed4a312765b tools/xm-test/grouptest/quick
--- /dev/null   Tue Mar 14 20:10:21 2006
+++ b/tools/xm-test/grouptest/quick     Tue Mar 14 20:50:35 2006
@@ -0,0 +1,4 @@
+create 01_create_basic_pos.test 07_create_mem64_pos.test 
10_create_fastdestroy.test 14_create_blockroot_pos.test
+unpause 01_unpause_basic_pos.test
+memset 01_memset_basic_pos.test 03_memset_random_pos.test
+help 06_help_allcmds.test
diff -r dc50cdd66c5c -r 0ed4a312765b 
tools/xm-test/tests/network/03_network_local_tcp_pos.py
--- /dev/null   Tue Mar 14 20:10:21 2006
+++ b/tools/xm-test/tests/network/03_network_local_tcp_pos.py   Tue Mar 14 
20:50:35 2006
@@ -0,0 +1,95 @@
+#!/usr/bin/python
+
+# Copyright (C) International Business Machines Corp., 2006
+# Author:  <dykman@xxxxxxxxxx>
+
+# TCP tests on local interfaces.
+#  - creates a single guest domain
+#  - sets up a single NIC
+#  - conducts hping tcp tests to the local loopback and IP address
+
+# hping2 127.0.0.1 -c 1 -d $size
+# hping2 $local_IP -c 1 -d $size
+#   where $size = 1, 48, 64, 512, 1440, 1448, 1500, 1505,
+#                 4096, 4192, 32767, 65507, 65508
+
+
+trysizes = [ 1, 48, 64, 512, 1440, 1448, 1500, 1505, 4096, 4192, 
+              32767, 65495 ]
+
+
+from XmTestLib import *
+rc = 0
+
+Net = XmNetwork()
+
+try:
+    # read an IP address from the config
+    ip   = Net.ip("dom1", "eth0")
+    mask = Net.mask("dom1", "eth0")
+except NetworkError, e:
+    FAIL(str(e))
+
+# Fire up a guest domain w/1 nic
+if ENABLE_HVM_SUPPORT:
+    brg = "xenbr0"
+    config = {"vif" : ['type=ioemu, bridge=%s' % brg]}
+else:
+    brg = None
+    config = {"vif" : ['ip=%s' % ip]}
+
+domain = XmTestDomain(extraConfig=config)
+try:
+    domain.start()
+except DomainError, e:
+    if verbose:
+        print "Failed to create test domain because:"
+        print e.extra
+    FAIL(str(e))
+
+
+# Attach a console
+try:
+    console = XmConsole(domain.getName(), historySaveCmds=True)
+except ConsoleError, e:
+    FAIL(str(e))
+
+try:
+    # Activate the console
+    console.sendInput("bhs")
+
+    # Bring up the "lo" interface.
+    console.runCmd("ifconfig lo 127.0.0.1")
+
+    console.runCmd("ifconfig eth0 inet "+ip+" netmask "+mask+" up")
+
+    # First do loopback 
+    lofails=""
+    for size in trysizes:
+        out = console.runCmd("hping2 127.0.0.1 -E /dev/urandom -q -c 20 " 
+              + "--fast -d " + str(size))
+        if out["return"]:
+            lofails += " " + str(size)
+
+    # Next comes eth0
+    eth0fails=""
+    for size in trysizes:
+        out = console.runCmd("hping2 " + ip + " -E /dev/urandom -q -c 20 "
+              + "--fast -d "+ str(size))
+        if out["return"]:
+            eth0fails += " " + str(size) 
+except ConsoleError, e:
+        FAIL(str(e))
+except NetworkError, e:
+        FAIL(str(e))
+
+
+# Tally up failures
+failures=""
+if len(lofails):
+        failures += "TCP hping2 over loopback failed for size" + lofails + ". "
+if len(eth0fails):
+        failures += "TCP hping2 over eth0 failed for size" + eth0fails + "."
+if len(failures):
+    FAIL(failures)
+
diff -r dc50cdd66c5c -r 0ed4a312765b 
tools/xm-test/tests/network/04_network_local_udp_pos.py
--- /dev/null   Tue Mar 14 20:10:21 2006
+++ b/tools/xm-test/tests/network/04_network_local_udp_pos.py   Tue Mar 14 
20:50:35 2006
@@ -0,0 +1,96 @@
+#!/usr/bin/python
+
+# Copyright (C) International Business Machines Corp., 2006
+# Author:  <dykman@xxxxxxxxxx>
+
+# UDP tests on local interfaces.
+#  - creates a single guest domain
+#  - sets up a single NIC
+#  - conducts hping udp tests to the local loopback and IP address
+
+# hping2 127.0.0.1 -2 -c 1 -d $size
+# hping2 $local_IP -2 -c 1 -d $size
+#   where $size = 1, 48, 64, 512, 1440, 1448, 1500, 1505,
+#                 4096, 4192, 32767, 65507, 65508
+
+
+trysizes = [ 1, 48, 64, 512, 1440, 1448, 1500, 1505, 4096, 4192, 
+              32767, 65495 ]
+
+from XmTestLib import *
+rc = 0
+
+Net = XmNetwork()
+
+try:
+    # read an IP address from the config
+    ip   = Net.ip("dom1", "eth0")
+    mask = Net.mask("dom1", "eth0")
+except NetworkError, e:
+    FAIL(str(e))
+
+# Fire up a guest domain w/1 nic
+if ENABLE_HVM_SUPPORT:
+    brg = "xenbr0"
+    config = {"vif" : ['type=ioemu, bridge=%s' % brg]}
+else:
+    brg = None
+    config = {"vif" : ['ip=%s' % ip]}
+
+domain = XmTestDomain(extraConfig=config)
+try:
+    domain.start()
+except DomainError, e:
+    if verbose:
+        print "Failed to create test domain because:"
+        print e.extra
+    FAIL(str(e))
+
+
+# Attach a console
+try:
+    console = XmConsole(domain.getName(), historySaveCmds=True)
+except ConsoleError, e:
+    FAIL(str(e))
+
+try:
+    # Activate the console
+    console.sendInput("bhs")
+
+    # Bring up the "lo" interface.
+    console.runCmd("ifconfig lo 127.0.0.1")
+
+    console.runCmd("ifconfig eth0 inet "+ip+" netmask "+mask+" up")
+
+    # First do loopback 
+    lofails=""
+    for size in trysizes:
+        out = console.runCmd("hping2 127.0.0.1 -E /dev/urandom -2 -q -c 20 "
+              + "--fast -d " + str(size))
+        if out["return"]:
+            lofails += " " + str(size)
+            print out["output"]
+
+    # Next comes eth0
+    eth0fails=""
+    for size in trysizes:
+        out = console.runCmd("hping2 " + ip + " -E /dev/urandom -2 -q -c 20 "
+              + "--fast -d " + str(size))
+        if out["return"]:
+            eth0fails += " " + str(size) 
+            print out["output"]
+except ConsoleError, e:
+        FAIL(str(e))
+except NetworkError, e:
+        FAIL(str(e))
+
+
+# Tally up failures
+failures=""
+if len(lofails):
+        failures += "UDP hping2 over loopback failed for size" + lofails + ". "
+if len(eth0fails):
+        failures += "UDP hping2 over eth0 failed for size" + eth0fails + "."
+if len(failures):
+    FAIL(failures)
+
diff -r dc50cdd66c5c -r 0ed4a312765b 
tools/xm-test/tests/network/06_network_dom0_tcp_pos.py
--- /dev/null   Tue Mar 14 20:10:21 2006
+++ b/tools/xm-test/tests/network/06_network_dom0_tcp_pos.py    Tue Mar 14 
20:50:35 2006
@@ -0,0 +1,81 @@
+#!/usr/bin/python
+
+# Copyright (C) International Business Machines Corp., 2006
+# Author:  <dykman@xxxxxxxxxx>
+
+# TCP tests to dom0.
+#  - determines dom0 network
+#  - creates a single guest domain
+#  - sets up a single NIC on same subnet as dom0
+#  - conducts hping2 tcp tests to the dom0 IP address
+
+# hping2 $dom0_IP -c 1 -d $size
+#   where $size = 1, 48, 64, 512, 1440, 1448, 1500, 1505,
+#                 4096, 4192, 32767, 65507, 65508
+
+trysizes = [ 1, 48, 64, 512, 1440, 1500, 1505, 4096, 4192, 
+                32767, 65495 ]
+
+
+
+from XmTestLib import *
+rc = 0
+
+Net = XmNetwork()
+
+try:
+    # read an IP address from the config
+    ip     = Net.ip("dom1", "eth0")
+    mask   = Net.mask("dom1", "eth0")
+except NetworkError, e:
+        FAIL(str(e))
+
+# Fire up a guest domain w/1 nic
+if ENABLE_HVM_SUPPORT:
+    brg = "xenbr0"
+    config = {"vif" : ['type=ioemu, bridge=%s' % brg]}
+else:
+    brg = None
+    config = {"vif"  : ["ip=%s" % ip]}
+
+domain = XmTestDomain(extraConfig=config)
+try:
+    domain.start()
+except DomainError, e:
+    if verbose:
+        print "Failed to create test domain because:"
+        print e.extra
+    FAIL(str(e))
+
+
+# Attach a console
+try:
+    console = XmConsole(domain.getName(), historySaveCmds=True)
+    # Activate the console
+    console.sendInput("bhs")
+except ConsoleError, e:
+    FAIL(str(e))
+
+try:
+    # Add a suitable dom0 IP address 
+    dom0ip = Net.ip("dom0", "eth0", todomname=domain.getName(), toeth="eth0", 
bridge=brg)
+except NetworkError, e:
+        FAIL(str(e))
+
+try:
+    console.runCmd("ifconfig eth0 inet "+ip+" netmask "+mask+" up")
+
+    # Ping dom0
+    fails=""
+    for size in trysizes:
+        out = console.runCmd("hping2 " + dom0ip + " -E /dev/urandom -q -c 20 "
+              + "--fast -d " + str(size))
+        if out["return"]:
+            fails += " " + str(size) 
+            print out["output"]
+except ConsoleError, e:
+        FAIL(str(e))
+
+if len(fails):
+    FAIL("TCP hping2 to dom0 failed for size" + fails + ".")
+
diff -r dc50cdd66c5c -r 0ed4a312765b 
tools/xm-test/tests/network/07_network_dom0_udp_pos.py
--- /dev/null   Tue Mar 14 20:10:21 2006
+++ b/tools/xm-test/tests/network/07_network_dom0_udp_pos.py    Tue Mar 14 
20:50:35 2006
@@ -0,0 +1,81 @@
+#!/usr/bin/python
+
+# Copyright (C) International Business Machines Corp., 2006
+# Author:  <dykman@xxxxxxxxxx>
+
+# UDP tests to dom0.
+#  - determines dom0 network
+#  - creates a single guest domain
+#  - sets up a single NIC on same subnet as dom0
+#  - conducts hping2 udp tests to the dom0 IP address
+
+# hping2 $dom0_IP -2 -c 1 -d $size
+#   where $size = 1, 48, 64, 512, 1440, 1448, 1500, 1505,
+#                 4096, 4192, 32767, 65507, 65508
+
+trysizes = [ 1, 48, 64, 512, 1440, 1500, 1505, 4096, 4192, 
+                32767, 65495 ]
+
+
+
+from XmTestLib import *
+rc = 0
+
+Net = XmNetwork()
+
+try:
+    # read an IP address from the config
+    ip     = Net.ip("dom1", "eth0")
+    mask   = Net.mask("dom1", "eth0")
+except NetworkError, e:
+        FAIL(str(e))
+
+# Fire up a guest domain w/1 nic
+if ENABLE_HVM_SUPPORT:
+    brg = "xenbr0"
+    config = {"vif" : ['type=ioemu, bridge=%s' % brg]}
+else:
+    brg = None
+    config = {"vif"  : ["ip=%s" % ip]}
+
+domain = XmTestDomain(extraConfig=config)
+try:
+    domain.start()
+except DomainError, e:
+    if verbose:
+        print "Failed to create test domain because:"
+        print e.extra
+    FAIL(str(e))
+
+
+# Attach a console
+try:
+    console = XmConsole(domain.getName(), historySaveCmds=True)
+    # Activate the console
+    console.sendInput("bhs")
+except ConsoleError, e:
+    FAIL(str(e))
+
+try:
+    # Add a suitable dom0 IP address 
+    dom0ip = Net.ip("dom0", "eth0", todomname=domain.getName(), toeth="eth0", 
bridge=brg)
+except NetworkError, e:
+        FAIL(str(e))
+
+try:
+    console.runCmd("ifconfig eth0 inet "+ip+" netmask "+mask+" up")
+
+    # Ping dom0
+    fails=""
+    for size in trysizes:
+        out = console.runCmd("hping2 " + dom0ip + " -E /dev/urandom -2 -q -c 
20"
+             + " --fast -d " + str(size))
+        if out["return"]:
+            fails += " " + str(size) 
+            print out["output"]
+except ConsoleError, e:
+        FAIL(str(e))
+
+if len(fails):
+    FAIL("UDP hping2 to dom0 failed for size" + fails + ".")
+
diff -r dc50cdd66c5c -r 0ed4a312765b 
tools/xm-test/tests/network/12_network_domU_tcp_pos.py
--- /dev/null   Tue Mar 14 20:10:21 2006
+++ b/tools/xm-test/tests/network/12_network_domU_tcp_pos.py    Tue Mar 14 
20:50:35 2006
@@ -0,0 +1,82 @@
+#!/usr/bin/python
+
+# Copyright (C) International Business Machines Corp., 2006
+# Author:  <dykman@xxxxxxxxxx>
+
+# TCP tests to domU interface
+#  - creates two guest domains
+#  - sets up a single NIC on each on same subnet 
+#  - conducts tcp tests to the domU IP address.
+
+# hping2 $domU_IP -c 1 -d $size 
+#   where $size = 1, 48, 64, 512, 1440, 1500, 1505, 
+#                 4096, 4192, 32767, 65507, 65508
+
+pingsizes = [ 1, 48, 64, 512, 1440, 1500, 1505, 4096, 4192, 16384, 24567, 
+              32767, 65495 ]
+
+from XmTestLib import *
+
+def netDomain(ip):
+    if ENABLE_HVM_SUPPORT:
+        config = {"vif" : ['type=ioemu']}
+    else:
+        config = {"vif"  : ["ip=%s" % ip]}
+
+    dom = XmTestDomain(extraConfig=config)
+    try:
+        dom.start()
+    except DomainError, e:
+        if verbose:
+            print "Failed to create test domain because:"
+            print e.extra
+        FAIL(str(e))
+    try:
+        # Attach a console
+        console = XmConsole(dom.getName(), historySaveCmds=True)
+        # Activate the console
+        console.sendInput("bhs")
+    except ConsoleError, e:
+        FAIL(str(e))
+    return console
+    
+rc = 0
+
+Net = XmNetwork()
+
+try:
+    # pick an IP address 
+    ip1   = Net.ip("dom1", "eth2")
+    mask1 = Net.mask("dom1", "eth2")
+except NetworkError, e:
+    FAIL(str(e))
+
+try:
+    # pick another IP address 
+    ip2   = Net.ip("dom2", "eth2")
+    mask2 = Net.mask("dom2", "eth2")
+except NetworkError, e:
+    FAIL(str(e))
+
+# Fire up a pair of guest domains w/1 nic each
+src_console = netDomain(ip1)
+dst_console = netDomain(ip2)
+
+try:
+    src_console.runCmd("ifconfig eth0 inet "+ip1+" netmask "+mask1+" up")
+    dst_console.runCmd("ifconfig eth0 inet "+ip2+" netmask "+mask2+" up")
+
+    # Ping the victim over eth0
+    fails=""
+    for size in pingsizes:
+        out = src_console.runCmd("hping2 " + ip2 + " -E /dev/urandom -q -c 20 "
+              + "--fast -d " + str(size))
+        if out["return"]:
+            fails += " " + str(size) 
+            print out["output"]
+except ConsoleError, e:
+    FAIL(str(e))
+
+if len(fails):
+    FAIL("TCP hping2 failed for size" + fails + ".")
+
diff -r dc50cdd66c5c -r 0ed4a312765b 
tools/xm-test/tests/network/13_network_domU_udp_pos.py
--- /dev/null   Tue Mar 14 20:10:21 2006
+++ b/tools/xm-test/tests/network/13_network_domU_udp_pos.py    Tue Mar 14 
20:50:35 2006
@@ -0,0 +1,82 @@
+#!/usr/bin/python
+
+# Copyright (C) International Business Machines Corp., 2006
+# Author:  <dykman@xxxxxxxxxx>
+
+# UDP tests to domU interface
+#  - creates two guest domains
+#  - sets up a single NIC on each on same subnet 
+#  - conducts udp tests to the domU IP address.
+
+# hping2 $domU_IP -2 -c 1 -d $size  
+#   where $size = 1, 48, 64, 512, 1440, 1500, 1505, 
+#                 4096, 4192, 32767, 65507, 65508
+
+pingsizes = [ 1, 48, 64, 512, 1440, 1500, 1505, 4096, 4192, 
+              32767, 65495 ]
+
+from XmTestLib import *
+
+def netDomain(ip):
+    if ENABLE_HVM_SUPPORT:
+        config = {"vif" : ['type=ioemu']}
+    else:
+        config = {"vif"  : ["ip=%s" % ip]}
+
+    dom = XmTestDomain(extraConfig=config)
+    try:
+        dom.start()
+    except DomainError, e:
+        if verbose:
+            print "Failed to create test domain because:"
+            print e.extra
+        FAIL(str(e))
+    try:
+        # Attach a console
+        console = XmConsole(dom.getName(), historySaveCmds=True)
+        # Activate the console
+        console.sendInput("bhs")
+    except ConsoleError, e:
+        FAIL(str(e))
+    return console
+    
+rc = 0
+
+Net = XmNetwork()
+
+try:
+    # pick an IP address 
+    ip1   = Net.ip("dom1", "eth2")
+    mask1 = Net.mask("dom1", "eth2")
+except NetworkError, e:
+    FAIL(str(e))
+
+try:
+    # pick another IP address 
+    ip2   = Net.ip("dom2", "eth2")
+    mask2 = Net.mask("dom2", "eth2")
+except NetworkError, e:
+    FAIL(str(e))
+
+# Fire up a pair of guest domains w/1 nic each
+src_console = netDomain(ip1)
+dst_console = netDomain(ip2)
+
+try:
+    src_console.runCmd("ifconfig eth0 inet "+ip1+" netmask "+mask1+" up")
+    dst_console.runCmd("ifconfig eth0 inet "+ip2+" netmask "+mask2+" up")
+
+    # Ping the victim over eth0
+    fails=""
+    for size in pingsizes:
+        out = src_console.runCmd("hping2 " + ip2 + " -E /dev/urandom -2 -q "
+              + "-c 20 --fast -d " + str(size))
+        if out["return"]:
+            fails += " " + str(size) 
+            print out["output"]
+except ConsoleError, e:
+    FAIL(str(e))
+
+if len(fails):
+    FAIL("UDP hping2 failed for size" + fails + ".")
+
diff -r dc50cdd66c5c -r 0ed4a312765b 
tools/xm-test/tests/sedf/01_sedf_period_slice_pos.py
--- /dev/null   Tue Mar 14 20:10:21 2006
+++ b/tools/xm-test/tests/sedf/01_sedf_period_slice_pos.py      Tue Mar 14 
20:50:35 2006
@@ -0,0 +1,62 @@
+#!/usr/bin/python
+
+# Copyright (C) International Business Machines Corp., 2005
+# Author: Dan Smith <danms@xxxxxxxxxx>
+# Author: Ryan Harper <ryanh@xxxxxxxxxx>
+
+from XmTestLib import *
+
+def get_sedf_params(domain):
+    status, output = traceCommand("xm sched-sedf %s" %(domain.getName()))
+    return (status, output.split('\n')[1].split())
+
+
+domain = XmTestDomain(extraConfig = {"sched":"sedf"})
+
+try:
+    domain.start()
+except DomainError, e:
+    if verbose:
+        print "Failed to create test domain because:"
+        print e.extra
+    FAIL(str(e))
+
+# get current param values as baseline
+(status, params) = get_sedf_params(domain)
+
+# check rv
+if status != 0:
+    FAIL("Getting sedf parameters return non-zero rv (%d)", status)
+
+# parse out current params
+(name, domid, p, s, l, e, w) = params
+
+# NB: setting period requires non-zero slice 
+# scale current period in half
+period = str(float(p) / 2)
+slice  = str(float(p) / 4)
+
+opts = "%s -p %s -s %s" %(domain.getName(), period, slice)
+(status, output) = traceCommand("xm sched-sedf %s" %(opts))
+
+# check rv
+if status != 0:
+    FAIL("Setting sedf parameters return non-zero rv (%d)" % status)
+
+# validate 
+(s,params) = get_sedf_params(domain)
+
+# check rv
+if s != 0:
+    FAIL("Getting sedf parameters return non-zero rv (%d)" % s)
+
+(name,domid,p1,s1,l1,e1,w1) = params
+
+if p1 != period:
+    FAIL("Failed to change domain period from %f to %f" %(p, period))
+
+if s1 != slice:
+    FAIL("Failed to change domain slice from %f to %f" %(s, slice))
+
+# Stop the domain (nice shutdown)
+domain.stop()
diff -r dc50cdd66c5c -r 0ed4a312765b 
tools/xm-test/tests/sedf/02_sedf_period_lower_neg.py
--- /dev/null   Tue Mar 14 20:10:21 2006
+++ b/tools/xm-test/tests/sedf/02_sedf_period_lower_neg.py      Tue Mar 14 
20:50:35 2006
@@ -0,0 +1,44 @@
+#!/usr/bin/python
+
+# Copyright (C) International Business Machines Corp., 2005
+# Author: Dan Smith <danms@xxxxxxxxxx>
+# Author: Ryan Harper <ryanh@xxxxxxxxxx>
+#
+# Test if sched-sedf <dom> -p <period> handles lower bound 
+
+from XmTestLib import *
+
+def get_sedf_params(domain):
+    status, output = traceCommand("xm sched-sedf %s" %(domain.getName()))
+    return (status, output.split('\n')[1].split())
+
+
+domain = XmTestDomain(extraConfig = {"sched":"sedf"})
+
+try:
+    domain.start()
+except DomainError, e:
+    if verbose:
+        print "Failed to create test domain because:"
+        print e.extra
+    FAIL(str(e))
+
+# pick bogus period
+period = "-1"
+
+# NB: setting period requires non-zero slice 
+# scale current period in half
+slice  = "5"
+
+opts = "%s -p %s -s %s" %(domain.getName(), period, slice)
+(status, output) = traceCommand("xm sched-sedf %s" %(opts))
+
+# we should see this output from xm 
+eyecatcher = "Failed to set sedf parameters"
+
+# check for failure
+if output.find(eyecatcher) >= 0:
+    FAIL("sched-sedf let me set bogus period (%s)" %(period))
+
+# Stop the domain (nice shutdown)
+domain.stop()
diff -r dc50cdd66c5c -r 0ed4a312765b 
tools/xm-test/tests/sedf/03_sedf_slice_lower_neg.py
--- /dev/null   Tue Mar 14 20:10:21 2006
+++ b/tools/xm-test/tests/sedf/03_sedf_slice_lower_neg.py       Tue Mar 14 
20:50:35 2006
@@ -0,0 +1,40 @@
+#!/usr/bin/python
+
+# Copyright (C) International Business Machines Corp., 2005
+# Author: Dan Smith <danms@xxxxxxxxxx>
+# Author: Ryan Harper <ryanh@xxxxxxxxxx>
+#
+# Test if sched-sedf <dom> -p <period> handles lower bound 
+
+from XmTestLib import *
+
+def get_sedf_params(domain):
+    status, output = traceCommand("xm sched-sedf %s" %(domain.getName()))
+    return (status, output.split('\n')[1].split())
+
+
+domain = XmTestDomain(extraConfig = {"sched":"sedf"})
+
+try:
+    domain.start()
+except DomainError, e:
+    if verbose:
+        print "Failed to create test domain because:"
+        print e.extra
+    FAIL(str(e))
+
+# pick bogus slice
+slice  = "0"
+
+opts = "%s -s %s" %(domain.getName(), slice)
+(status, output) = traceCommand("xm sched-sedf %s" %(opts))
+
+# we should see this output from xm 
+eyecatcher = "Failed to set sedf parameters"
+
+# check for failure
+if output.find(eyecatcher) >= 0:
+    FAIL("sched-sedf let me set bogus slice (%s)" %(slice))
+
+# Stop the domain (nice shutdown)
+domain.stop()
diff -r dc50cdd66c5c -r 0ed4a312765b 
tools/xm-test/tests/sedf/04_sedf_slice_upper_neg.py
--- /dev/null   Tue Mar 14 20:10:21 2006
+++ b/tools/xm-test/tests/sedf/04_sedf_slice_upper_neg.py       Tue Mar 14 
20:50:35 2006
@@ -0,0 +1,48 @@
+#!/usr/bin/python
+
+# Copyright (C) International Business Machines Corp., 2005
+# Author: Dan Smith <danms@xxxxxxxxxx>
+# Author: Ryan Harper <ryanh@xxxxxxxxxx>
+
+from XmTestLib import *
+
+def get_sedf_params(domain):
+    status, output = traceCommand("xm sched-sedf %s" %(domain.getName()))
+    return (status, output.split('\n')[1].split())
+
+
+domain = XmTestDomain(extraConfig = {"sched":"sedf"})
+
+try:
+    domain.start()
+except DomainError, e:
+    if verbose:
+        print "Failed to create test domain because:"
+        print e.extra
+    FAIL(str(e))
+
+# get current param values as baseline
+(status, params) = get_sedf_params(domain)
+
+# check rv
+if status != 0:
+    FAIL("Getting sedf parameters return non-zero rv (%d)", status)
+
+# parse out current params
+(name, domid, p, s, l, e, w) = params
+
+# set slice > than current period
+slice  = str(float(p)+1)
+
+opts = "%s -s %s" %(domain.getName(), slice)
+(status, output) = traceCommand("xm sched-sedf %s" %(opts))
+
+# we should see this output from xm 
+eyecatcher = "Failed to set sedf parameters"
+
+# check for failure
+if output.find(eyecatcher) >= 0:
+    FAIL("sched-sedf let me set a slice bigger than my period.")
+
+# Stop the domain (nice shutdown)
+domain.stop()
diff -r dc50cdd66c5c -r 0ed4a312765b 
tools/xm-test/tests/sedf/05_sedf_extratime_pos.py
--- /dev/null   Tue Mar 14 20:10:21 2006
+++ b/tools/xm-test/tests/sedf/05_sedf_extratime_pos.py Tue Mar 14 20:50:35 2006
@@ -0,0 +1,63 @@
+#!/usr/bin/python
+
+# Copyright (C) International Business Machines Corp., 2005
+# Author: Dan Smith <danms@xxxxxxxxxx>
+# Author: Ryan Harper <ryanh@xxxxxxxxxx>
+
+from XmTestLib import *
+
+def get_sedf_params(domain):
+    status, output = traceCommand("xm sched-sedf %s" %(domain.getName()))
+    return (status, output.split('\n')[1].split())
+
+
+domain = XmTestDomain(extraConfig = {"sched":"sedf"})
+
+try:
+    domain.start()
+except DomainError, e:
+    if verbose:
+        print "Failed to create test domain because:"
+        print e.extra
+    FAIL(str(e))
+
+# get current param values as baseline
+(status, params) = get_sedf_params(domain)
+
+# check rv
+if status != 0:
+    FAIL("Getting sedf parameters return non-zero rv (%d)", status)
+
+# parse out current params
+(name, domid, p, s, l, e, w) = params
+
+# toggle extratime value
+extratime = str((int(e)+1)%2)
+
+direction = "disable"
+# NB: when disabling extratime(=0), must pass in a slice
+opts = "%s -e %s" %(domain.getName(), extratime)
+if extratime == "0":
+    opts += " -s %s" %( str( (float(p)/2)+1 ) )
+    direction = "enable"
+    
+(status, output) = traceCommand("xm sched-sedf %s" %(opts))
+
+# check rv
+if status != 0:
+   FAIL("Setting sedf parameters return non-zero rv (%d)" % status)
+
+# validate
+(s,params) = get_sedf_params(domain)
+
+# check rv
+if s != 0:
+    FAIL("Getting sedf parameters return non-zero rv (%d)" % s)
+
+(name,domid,p1,s1,l1,e1,w1) = params
+
+if e1 != extratime:
+    FAIL("Failed to %s extratime" %(direction))
+
+# Stop the domain (nice shutdown)
+domain.stop()
diff -r dc50cdd66c5c -r 0ed4a312765b 
tools/xm-test/tests/sedf/06_sedf_extratime_disable_neg.py
--- /dev/null   Tue Mar 14 20:10:21 2006
+++ b/tools/xm-test/tests/sedf/06_sedf_extratime_disable_neg.py Tue Mar 14 
20:50:35 2006
@@ -0,0 +1,71 @@
+#!/usr/bin/python
+
+# Copyright (C) International Business Machines Corp., 2005
+# Author: Dan Smith <danms@xxxxxxxxxx>
+# Author: Ryan Harper <ryanh@xxxxxxxxxx>
+
+from XmTestLib import *
+
+def get_sedf_params(domain):
+    status, output = traceCommand("xm sched-sedf %s" %(domain.getName()))
+    return (status, output.split('\n')[1].split())
+
+
+domain = XmTestDomain(extraConfig = {"sched":"sedf"})
+
+try:
+    domain.start()
+except DomainError, e:
+    if verbose:
+        print "Failed to create test domain because:"
+        print e.extra
+    FAIL(str(e))
+
+# get current param values as baseline
+(status, params) = get_sedf_params(domain)
+
+# check rv
+if status != 0:
+    FAIL("Getting sedf parameters return non-zero rv (%d)", status)
+
+# parse out current params
+(name, domid, p, s, l, e, w) = params
+
+# if extratime is off, turn it on and drop slice to 0
+if str(e) == "0":
+    extratime = 1
+    opts = "%s -e %s" %(domain.getName(), extratime)
+    (status, output) = traceCommand("xm sched-sedf %s" %(opts))
+
+    # check rv
+    if status != 0:
+        FAIL("Failed to force extratime on (%d)" % status)
+
+    # drop slice to 0 now that we are in extratime mode
+    slice = 0
+
+    opts = "%s -s %s" %(domain.getName(), slice)
+    (status, output) = traceCommand("xm sched-sedf %s" %(opts))
+
+    # check rv
+    if status != 0:
+        FAIL("Failed to force slice to 0 (%d)" % status)
+
+
+# ASSERT(extratime=1, slice=0)
+
+# attempt to disable extratime without setting slice
+extratime = "0"
+
+opts = "%s -e %s " %(domain.getName(), extratime)
+(status, output) = traceCommand("xm sched-sedf %s" %(opts))
+
+# we should see this output from xm 
+eyecatcher = "Failed to set sedf parameters"
+
+# check for failure
+if output.find(eyecatcher) >= 0:
+    FAIL("sched-sedf let me disable extratime without a non-zero slice")
+
+# Stop the domain (nice shutdown)
+domain.stop()
diff -r dc50cdd66c5c -r 0ed4a312765b 
tools/xm-test/tests/sedf/01_sedf_multi_pos.py
--- a/tools/xm-test/tests/sedf/01_sedf_multi_pos.py     Tue Mar 14 20:10:21 2006
+++ /dev/null   Tue Mar 14 20:50:35 2006
@@ -1,28 +0,0 @@
-#!/usr/bin/python
-
-# Copyright (C) International Business Machines Corp., 2005
-# Author: Dan Smith <danms@xxxxxxxxxx>
-
-from XmTestLib import *
-
-sedf_opts = "20000000 5000000 0 0 0"
-
-domain = XmTestDomain(extraConfig = {"sched":"sedf"})
-
-try:
-    domain.start()
-except DomainError, e:
-    if verbose:
-        print "Failed to create test domain because:"
-        print e.extra
-    FAIL(str(e))
-
-for i in range(5):
-    status, output = traceCommand("xm sched-sedf %s %s" % (domain.getName(),
-                                                           sedf_opts))
-    if status != 0:
-        FAIL("[%i] xm sedf returned invalid %i != 0" % (i, status))
-
-    
-    
-

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog


 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.