[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Xen-changelog] [xen-unstable] merge with xen-unstable.hg



# HG changeset patch
# User awilliam@xxxxxxxxxxx
# Node ID b725c9e51a7cebc8069c95986179a819ff6bf563
# Parent  5176c3ea32938ab37f9b60d3716de33ee3192d9e
# Parent  7da100019e00018346877608d9110f1bde8817d5
merge with xen-unstable.hg
---
 linux-2.6-xen-sparse/arch/i386/mm/ioremap-xen.c      |    8 
 linux-2.6-xen-sparse/arch/ia64/xen/hypervisor.c      |   14 
 linux-2.6-xen-sparse/drivers/xen/balloon/balloon.c   |  142 +++--
 linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c   |   51 --
 linux-2.6-xen-sparse/drivers/xen/blktap/blktap.c     |  136 +----
 linux-2.6-xen-sparse/drivers/xen/netback/common.h    |    2 
 linux-2.6-xen-sparse/drivers/xen/netback/interface.c |   26 -
 linux-2.6-xen-sparse/drivers/xen/netback/netback.c   |  162 +++---
 linux-2.6-xen-sparse/drivers/xen/netback/xenbus.c    |   89 ---
 linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c |  170 ++++--
 linux-2.6-xen-sparse/drivers/xen/privcmd/privcmd.c   |  170 ++++--
 linux-2.6-xen-sparse/drivers/xen/tpmback/common.h    |    8 
 linux-2.6-xen-sparse/drivers/xen/tpmback/interface.c |   19 
 linux-2.6-xen-sparse/drivers/xen/tpmback/tpmback.c   |   14 
 linux-2.6-xen-sparse/include/asm-ia64/hypervisor.h   |    1 
 linux-2.6-xen-sparse/include/xen/balloon.h           |   20 
 linux-2.6-xen-sparse/mm/memory.c                     |    5 
 tools/blktap/drivers/Makefile                        |    3 
 tools/blktap/drivers/blktapctrl.c                    |   16 
 tools/blktap/lib/blktaplib.h                         |    4 
 tools/blktap/lib/xenbus.c                            |  191 ++++---
 tools/blktap/lib/xs_api.c                            |  103 +---
 tools/blktap/lib/xs_api.h                            |    2 
 tools/examples/block                                 |    1 
 tools/examples/xend-config.sxp                       |    5 
 tools/examples/xmexample.hvm                         |    5 
 tools/firmware/acpi/acpi_dsdt.asl                    |   66 +-
 tools/firmware/acpi/acpi_dsdt.c                      |  470 +++++++++----------
 tools/firmware/hvmloader/smbios.c                    |    1 
 tools/ioemu/vl.c                                     |   35 +
 tools/ioemu/vl.h                                     |    4 
 tools/ioemu/vnc.c                                    |   14 
 tools/libxc/xc_load_elf.c                            |    2 
 tools/misc/mbootpack/Makefile                        |   17 
 tools/misc/mbootpack/buildimage.c                    |   19 
 tools/misc/mbootpack/mbootpack.c                     |   20 
 tools/misc/miniterm/miniterm.c                       |   25 -
 tools/python/xen/util/blkif.py                       |    2 
 tools/python/xen/xend/XendDomainInfo.py              |    2 
 tools/python/xen/xend/XendRoot.py                    |    6 
 tools/python/xen/xend/image.py                       |    5 
 tools/python/xen/xm/create.py                        |    9 
 tools/python/xen/xm/main.py                          |    5 
 tools/xenstore/xenstore_client.c                     |   21 
 tools/xenstore/xenstored_transaction.c               |    2 
 xen/arch/x86/Makefile                                |   17 
 xen/arch/x86/domain_build.c                          |    4 
 xen/arch/x86/hvm/hvm.c                               |    4 
 xen/arch/x86/hvm/svm/intr.c                          |    9 
 xen/arch/x86/hvm/svm/svm.c                           |   10 
 xen/arch/x86/hvm/vmx/vmx.c                           |  126 ++---
 xen/arch/x86/microcode.c                             |   11 
 xen/arch/x86/mm/shadow/multi.c                       |  138 ++---
 xen/arch/x86/platform_hypercall.c                    |   16 
 xen/arch/x86/x86_32/asm-offsets.c                    |    1 
 xen/arch/x86/x86_64/asm-offsets.c                    |    1 
 xen/common/elf.c                                     |    2 
 xen/include/asm-x86/hvm/vmx/vmcs.h                   |   15 
 xen/include/asm-x86/hvm/vmx/vmx.h                    |   32 -
 xen/include/asm-x86/msr.h                            |    8 
 xen/include/asm-x86/multicall.h                      |    2 
 xen/include/asm-x86/perfc_defn.h                     |    4 
 62 files changed, 1275 insertions(+), 1217 deletions(-)

diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/arch/i386/mm/ioremap-xen.c
--- a/linux-2.6-xen-sparse/arch/i386/mm/ioremap-xen.c   Sun Oct 08 18:55:12 
2006 -0600
+++ b/linux-2.6-xen-sparse/arch/i386/mm/ioremap-xen.c   Sat Oct 14 13:28:45 
2006 -0600
@@ -28,6 +28,8 @@ static int direct_remap_area_pte_fn(pte_
                                    void *data)
 {
        mmu_update_t **v = (mmu_update_t **)data;
+
+       BUG_ON(!pte_none(*pte));
 
        (*v)->ptr = ((u64)pfn_to_mfn(page_to_pfn(pmd_page)) <<
                     PAGE_SHIFT) | ((unsigned long)pte & ~PAGE_MASK);
@@ -110,11 +112,13 @@ int direct_remap_pfn_range(struct vm_are
                           pgprot_t prot,
                           domid_t  domid)
 {
-       /* Same as remap_pfn_range(). */
-       vma->vm_flags |= VM_IO | VM_RESERVED | VM_PFNMAP;
+       if (xen_feature(XENFEAT_auto_translated_physmap))
+               return remap_pfn_range(vma, address, mfn, size, prot);
 
        if (domid == DOMID_SELF)
                return -EINVAL;
+
+       vma->vm_flags |= VM_IO | VM_RESERVED;
 
        vma->vm_mm->context.has_foreign_mappings = 1;
 
diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/arch/ia64/xen/hypervisor.c
--- a/linux-2.6-xen-sparse/arch/ia64/xen/hypervisor.c   Sun Oct 08 18:55:12 
2006 -0600
+++ b/linux-2.6-xen-sparse/arch/ia64/xen/hypervisor.c   Sat Oct 14 13:28:45 
2006 -0600
@@ -478,6 +478,7 @@ struct xen_ia64_privcmd_range {
 };
 
 struct xen_ia64_privcmd_vma {
+       int                             is_privcmd_mmapped;
        struct xen_ia64_privcmd_range*  range;
 
        unsigned long                   num_entries;
@@ -616,12 +617,15 @@ static void
 static void
 xen_ia64_privcmd_vma_open(struct vm_area_struct* vma)
 {
+       struct xen_ia64_privcmd_vma* old_privcmd_vma = (struct 
xen_ia64_privcmd_vma*)vma->vm_private_data;
        struct xen_ia64_privcmd_vma* privcmd_vma = (struct 
xen_ia64_privcmd_vma*)vma->vm_private_data;
        struct xen_ia64_privcmd_range* privcmd_range = privcmd_vma->range;
 
        atomic_inc(&privcmd_range->ref_count);
        // vm_op->open() can't fail.
        privcmd_vma = kmalloc(sizeof(*privcmd_vma), GFP_KERNEL | __GFP_NOFAIL);
+       // copy original value if necessary
+       privcmd_vma->is_privcmd_mmapped = old_privcmd_vma->is_privcmd_mmapped;
 
        __xen_ia64_privcmd_vma_open(vma, privcmd_vma, privcmd_range);
 }
@@ -654,6 +658,14 @@ xen_ia64_privcmd_vma_close(struct vm_are
                kfree(privcmd_range->res);
                vfree(privcmd_range);
        }
+}
+
+int
+privcmd_enforce_singleshot_mapping(struct vm_area_struct *vma)
+{
+       struct xen_ia64_privcmd_vma* privcmd_vma =
+               (struct xen_ia64_privcmd_vma *)vma->vm_private_data;
+       return (xchg(&privcmd_vma->is_privcmd_mmapped, 1) == 0);
 }
 
 int
@@ -681,6 +693,8 @@ privcmd_mmap(struct file * file, struct 
        if (privcmd_vma == NULL) {
                goto out_enomem1;
        }
+       privcmd_vma->is_privcmd_mmapped = 0;
+
        res = kzalloc(sizeof(*res), GFP_KERNEL);
        if (res == NULL) {
                goto out_enomem1;
diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/drivers/xen/balloon/balloon.c
--- a/linux-2.6-xen-sparse/drivers/xen/balloon/balloon.c        Sun Oct 08 
18:55:12 2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/balloon/balloon.c        Sat Oct 14 
13:28:45 2006 -0600
@@ -534,74 +534,86 @@ static int dealloc_pte_fn(
        return 0;
 }
 
-struct page *balloon_alloc_empty_page_range(unsigned long nr_pages)
-{
-       unsigned long vstart, flags;
-       unsigned int  order = get_order(nr_pages * PAGE_SIZE);
-       int ret;
-       unsigned long i;
-       struct page *page;
-
-       vstart = __get_free_pages(GFP_KERNEL, order);
-       if (vstart == 0)
+struct page **alloc_empty_pages_and_pagevec(int nr_pages)
+{
+       unsigned long vaddr, flags;
+       struct page *page, **pagevec;
+       int i, ret;
+
+       pagevec = kmalloc(sizeof(page) * nr_pages, GFP_KERNEL);
+       if (pagevec == NULL)
                return NULL;
 
-       scrub_pages(vstart, 1 << order);
-
+       for (i = 0; i < nr_pages; i++) {
+               page = pagevec[i] = alloc_page(GFP_KERNEL);
+               if (page == NULL)
+                       goto err;
+
+               vaddr = (unsigned long)page_address(page);
+
+               scrub_pages(vaddr, 1);
+
+               balloon_lock(flags);
+
+               if (xen_feature(XENFEAT_auto_translated_physmap)) {
+                       unsigned long gmfn = page_to_pfn(page);
+                       struct xen_memory_reservation reservation = {
+                               .nr_extents   = 1,
+                               .extent_order = 0,
+                               .domid        = DOMID_SELF
+                       };
+                       set_xen_guest_handle(reservation.extent_start, &gmfn);
+                       ret = HYPERVISOR_memory_op(XENMEM_decrease_reservation,
+                                                  &reservation);
+                       if (ret == 1)
+                               ret = 0; /* success */
+               } else {
+                       ret = apply_to_page_range(&init_mm, vaddr, PAGE_SIZE,
+                                                 dealloc_pte_fn, NULL);
+               }
+
+               if (ret != 0) {
+                       balloon_unlock(flags);
+                       __free_page(page);
+                       goto err;
+               }
+
+               totalram_pages = --current_pages;
+
+               balloon_unlock(flags);
+       }
+
+ out:
+       schedule_work(&balloon_worker);
+       flush_tlb_all();
+       return pagevec;
+
+ err:
        balloon_lock(flags);
-       if (xen_feature(XENFEAT_auto_translated_physmap)) {
-               unsigned long gmfn = __pa(vstart) >> PAGE_SHIFT;
-               struct xen_memory_reservation reservation = {
-                       .nr_extents   = 1,
-                       .extent_order = order,
-                       .domid        = DOMID_SELF
-               };
-               set_xen_guest_handle(reservation.extent_start, &gmfn);
-               ret = HYPERVISOR_memory_op(XENMEM_decrease_reservation,
-                                          &reservation);
-               if (ret == -ENOSYS)
-                       goto err;
-               BUG_ON(ret != 1);
-       } else {
-               ret = apply_to_page_range(&init_mm, vstart, PAGE_SIZE << order,
-                                         dealloc_pte_fn, NULL);
-               if (ret == -ENOSYS)
-                       goto err;
-               BUG_ON(ret);
-       }
-       current_pages -= 1UL << order;
-       totalram_pages = current_pages;
+       while (--i >= 0)
+               balloon_append(pagevec[i]);
        balloon_unlock(flags);
-
-       schedule_work(&balloon_worker);
-
-       flush_tlb_all();
-
-       page = virt_to_page(vstart);
-
-       for (i = 0; i < (1UL << order); i++)
-               set_page_count(page + i, 1);
-
-       return page;
-
- err:
-       free_pages(vstart, order);
+       kfree(pagevec);
+       pagevec = NULL;
+       goto out;
+}
+
+void free_empty_pages_and_pagevec(struct page **pagevec, int nr_pages)
+{
+       unsigned long flags;
+       int i;
+
+       if (pagevec == NULL)
+               return;
+
+       balloon_lock(flags);
+       for (i = 0; i < nr_pages; i++) {
+               BUG_ON(page_count(pagevec[i]) != 1);
+               balloon_append(pagevec[i]);
+       }
        balloon_unlock(flags);
-       return NULL;
-}
-
-void balloon_dealloc_empty_page_range(
-       struct page *page, unsigned long nr_pages)
-{
-       unsigned long i, flags;
-       unsigned int  order = get_order(nr_pages * PAGE_SIZE);
-
-       balloon_lock(flags);
-       for (i = 0; i < (1UL << order); i++) {
-               BUG_ON(page_count(page + i) != 1);
-               balloon_append(page + i);
-       }
-       balloon_unlock(flags);
+
+       kfree(pagevec);
 
        schedule_work(&balloon_worker);
 }
@@ -619,8 +631,8 @@ void balloon_release_driver_page(struct 
 }
 
 EXPORT_SYMBOL_GPL(balloon_update_driver_allowance);
-EXPORT_SYMBOL_GPL(balloon_alloc_empty_page_range);
-EXPORT_SYMBOL_GPL(balloon_dealloc_empty_page_range);
+EXPORT_SYMBOL_GPL(alloc_empty_pages_and_pagevec);
+EXPORT_SYMBOL_GPL(free_empty_pages_and_pagevec);
 EXPORT_SYMBOL_GPL(balloon_release_driver_page);
 
 MODULE_LICENSE("Dual BSD/GPL");
diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c
--- a/linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c        Sun Oct 08 
18:55:12 2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c        Sat Oct 14 
13:28:45 2006 -0600
@@ -55,8 +55,6 @@ static int blkif_reqs = 64;
 static int blkif_reqs = 64;
 module_param_named(reqs, blkif_reqs, int, 0);
 MODULE_PARM_DESC(reqs, "Number of blkback requests to allocate");
-
-static int mmap_pages;
 
 /* Run-time switchable: /sys/module/blkback/parameters/ */
 static unsigned int log_stats = 0;
@@ -87,8 +85,7 @@ static DECLARE_WAIT_QUEUE_HEAD(pending_f
 
 #define BLKBACK_INVALID_HANDLE (~0)
 
-static unsigned long mmap_vstart;
-static unsigned long *pending_vaddrs;
+static struct page **pending_pages;
 static grant_handle_t *pending_grant_handles;
 
 static inline int vaddr_pagenr(pending_req_t *req, int seg)
@@ -98,7 +95,8 @@ static inline int vaddr_pagenr(pending_r
 
 static inline unsigned long vaddr(pending_req_t *req, int seg)
 {
-       return pending_vaddrs[vaddr_pagenr(req, seg)];
+       unsigned long pfn = page_to_pfn(pending_pages[vaddr_pagenr(req, seg)]);
+       return (unsigned long)pfn_to_kaddr(pfn);
 }
 
 #define pending_handle(_req, _seg) \
@@ -506,52 +504,43 @@ static void make_response(blkif_t *blkif
 
 static int __init blkif_init(void)
 {
-       struct page *page;
-       int i;
+       int i, mmap_pages;
 
        if (!is_running_on_xen())
                return -ENODEV;
 
-       mmap_pages            = blkif_reqs * BLKIF_MAX_SEGMENTS_PER_REQUEST;
-
-       page = balloon_alloc_empty_page_range(mmap_pages);
-       if (page == NULL)
-               return -ENOMEM;
-       mmap_vstart = (unsigned long)pfn_to_kaddr(page_to_pfn(page));
+       mmap_pages = blkif_reqs * BLKIF_MAX_SEGMENTS_PER_REQUEST;
 
        pending_reqs          = kmalloc(sizeof(pending_reqs[0]) *
                                        blkif_reqs, GFP_KERNEL);
        pending_grant_handles = kmalloc(sizeof(pending_grant_handles[0]) *
                                        mmap_pages, GFP_KERNEL);
-       pending_vaddrs        = kmalloc(sizeof(pending_vaddrs[0]) *
-                                       mmap_pages, GFP_KERNEL);
-       if (!pending_reqs || !pending_grant_handles || !pending_vaddrs) {
-               kfree(pending_reqs);
-               kfree(pending_grant_handles);
-               kfree(pending_vaddrs);
-               printk("%s: out of memory\n", __FUNCTION__);
-               return -ENOMEM;
-       }
+       pending_pages         = alloc_empty_pages_and_pagevec(mmap_pages);
+
+       if (!pending_reqs || !pending_grant_handles || !pending_pages)
+               goto out_of_memory;
+
+       for (i = 0; i < mmap_pages; i++)
+               pending_grant_handles[i] = BLKBACK_INVALID_HANDLE;
 
        blkif_interface_init();
-       
-       printk("%s: reqs=%d, pages=%d, mmap_vstart=0x%lx\n",
-              __FUNCTION__, blkif_reqs, mmap_pages, mmap_vstart);
-       BUG_ON(mmap_vstart == 0);
-       for (i = 0; i < mmap_pages; i++) {
-               pending_vaddrs[i] = mmap_vstart + (i << PAGE_SHIFT);
-               pending_grant_handles[i] = BLKBACK_INVALID_HANDLE;
-       }
 
        memset(pending_reqs, 0, sizeof(pending_reqs));
        INIT_LIST_HEAD(&pending_free);
 
        for (i = 0; i < blkif_reqs; i++)
                list_add_tail(&pending_reqs[i].free_list, &pending_free);
-    
+
        blkif_xenbus_init();
 
        return 0;
+
+ out_of_memory:
+       kfree(pending_reqs);
+       kfree(pending_grant_handles);
+       free_empty_pages_and_pagevec(pending_pages, mmap_pages);
+       printk("%s: out of memory\n", __FUNCTION__);
+       return -ENOMEM;
 }
 
 module_init(blkif_init);
diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/drivers/xen/blktap/blktap.c
--- a/linux-2.6-xen-sparse/drivers/xen/blktap/blktap.c  Sun Oct 08 18:55:12 
2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/blktap/blktap.c  Sat Oct 14 13:28:45 
2006 -0600
@@ -186,16 +186,18 @@ static inline unsigned int RTN_PEND_IDX(
 
 #define BLKBACK_INVALID_HANDLE (~0)
 
-typedef struct mmap_page {
-       unsigned long start;
-       struct page *mpage;
-} mmap_page_t;
-
-static mmap_page_t mmap_start[MAX_DYNAMIC_MEM];
+static struct page **foreign_pages[MAX_DYNAMIC_MEM];
+static inline unsigned long idx_to_kaddr(
+       unsigned int mmap_idx, unsigned int req_idx, unsigned int sg_idx)
+{
+       unsigned int arr_idx = req_idx*BLKIF_MAX_SEGMENTS_PER_REQUEST + sg_idx;
+       unsigned long pfn = page_to_pfn(foreign_pages[mmap_idx][arr_idx]);
+       return (unsigned long)pfn_to_kaddr(pfn);
+}
+
 static unsigned short mmap_alloc = 0;
 static unsigned short mmap_lock = 0;
 static unsigned short mmap_inuse = 0;
-static unsigned long *pending_addrs[MAX_DYNAMIC_MEM];
 
 /******************************************************************
  * GRANT HANDLES
@@ -726,63 +728,21 @@ static int req_increase(void)
 static int req_increase(void)
 {
        int i, j;
-       struct page *page;
-       int ret;
-
-       ret = -EINVAL;
+
        if (mmap_alloc >= MAX_PENDING_REQS || mmap_lock) 
-               goto done;
-
-#ifdef __ia64__
-       extern unsigned long alloc_empty_foreign_map_page_range(
-               unsigned long pages);
-       mmap_start[mmap_alloc].start = (unsigned long)
-               alloc_empty_foreign_map_page_range(mmap_pages);
-#else /* ! ia64 */
-       page = balloon_alloc_empty_page_range(mmap_pages);
-       ret = -ENOMEM;
-       if (page == NULL) {
-               printk("%s balloon_alloc_empty_page_range gave NULL\n", 
__FUNCTION__);
-               goto done;
-       }
-
-       /* Pin all of the pages. */
-       for (i=0; i<mmap_pages; i++)
-               get_page(&page[i]);
-
-       mmap_start[mmap_alloc].start = 
-               (unsigned long)pfn_to_kaddr(page_to_pfn(page));
-       mmap_start[mmap_alloc].mpage = page;
-
-#endif
-
-       pending_reqs[mmap_alloc]  = kzalloc(sizeof(pending_req_t) *
-                                       blkif_reqs, GFP_KERNEL);
-       pending_addrs[mmap_alloc] = kzalloc(sizeof(unsigned long) *
-                                       mmap_pages, GFP_KERNEL);
-
-       ret = -ENOMEM;
-       if (!pending_reqs[mmap_alloc] || !pending_addrs[mmap_alloc]) {
-               kfree(pending_reqs[mmap_alloc]);
-               kfree(pending_addrs[mmap_alloc]);
-               WPRINTK("%s: out of memory\n", __FUNCTION__);
-               ret = -ENOMEM;
-               goto done;
-       }
-
-       ret = 0;
-
-       DPRINTK("%s: reqs=%d, pages=%d, mmap_vstart=0x%lx\n",
-               __FUNCTION__, blkif_reqs, mmap_pages, 
-              mmap_start[mmap_alloc].start);
-
-       BUG_ON(mmap_start[mmap_alloc].start == 0);
-
-       for (i = 0; i < mmap_pages; i++) 
-               pending_addrs[mmap_alloc][i] = 
-                       mmap_start[mmap_alloc].start + (i << PAGE_SHIFT);
-
-       for (i = 0; i < MAX_PENDING_REQS ; i++) {
+               return -EINVAL;
+
+       pending_reqs[mmap_alloc]  = kzalloc(sizeof(pending_req_t)
+                                           * blkif_reqs, GFP_KERNEL);
+       foreign_pages[mmap_alloc] = alloc_empty_pages_and_pagevec(mmap_pages);
+
+       if (!pending_reqs[mmap_alloc] || !foreign_pages[mmap_alloc])
+               goto out_of_memory;
+
+       DPRINTK("%s: reqs=%d, pages=%d\n",
+               __FUNCTION__, blkif_reqs, mmap_pages);
+
+       for (i = 0; i < MAX_PENDING_REQS; i++) {
                list_add_tail(&pending_reqs[mmap_alloc][i].free_list, 
                              &pending_free);
                pending_reqs[mmap_alloc][i].mem_idx = mmap_alloc;
@@ -793,30 +753,24 @@ static int req_increase(void)
 
        mmap_alloc++;
        DPRINTK("# MMAPs increased to %d\n",mmap_alloc);
-done:
-       return ret;
+       return 0;
+
+ out_of_memory:
+       free_empty_pages_and_pagevec(foreign_pages[mmap_alloc], mmap_pages);
+       kfree(pending_reqs[mmap_alloc]);
+       WPRINTK("%s: out of memory\n", __FUNCTION__);
+       return -ENOMEM;
 }
 
 static void mmap_req_del(int mmap)
 {
-       int i;
-       struct page *page;
-
-       /*Spinlock already acquired*/
+       BUG_ON(!spin_is_locked(&pending_free_lock));
+
        kfree(pending_reqs[mmap]);
-       kfree(pending_addrs[mmap]);
-
-#ifdef __ia64__
-       /*Not sure what goes here yet!*/
-#else
-
-       /* Unpin all of the pages. */
-       page = mmap_start[mmap].mpage;
-       for (i=0; i<mmap_pages; i++)
-               put_page(&page[i]);
-
-       balloon_dealloc_empty_page_range(mmap_start[mmap].mpage, mmap_pages);
-#endif
+       pending_reqs[mmap] = NULL;
+
+       free_empty_pages_and_pagevec(foreign_pages[mmap_alloc], mmap_pages);
+       foreign_pages[mmap] = NULL;
 
        mmap_lock = 0;
        DPRINTK("# MMAPs decreased to %d\n",mmap_alloc);
@@ -887,7 +841,7 @@ static void fast_flush_area(pending_req_
        mmap_idx = req->mem_idx;
 
        for (i = 0; i < req->nr_pages; i++) {
-               kvaddr = MMAP_VADDR(mmap_start[mmap_idx].start, k_idx, i);
+               kvaddr = idx_to_kaddr(mmap_idx, k_idx, i);
                uvaddr = MMAP_VADDR(info->user_vstart, u_idx, i);
 
                khandle = &pending_handle(mmap_idx, k_idx, i);
@@ -896,7 +850,7 @@ static void fast_flush_area(pending_req_
                        continue;
                }
                gnttab_set_unmap_op(&unmap[invcount], 
-                       MMAP_VADDR(mmap_start[mmap_idx].start, k_idx, i), 
+                                   idx_to_kaddr(mmap_idx, k_idx, i), 
                                    GNTMAP_host_map, khandle->kernel);
                invcount++;
 
@@ -1030,9 +984,8 @@ static int blktap_read_ufe_ring(tap_blki
                        struct page *pg;
                        int offset;
 
-                       uvaddr  = MMAP_VADDR(info->user_vstart, usr_idx, j);
-                       kvaddr = MMAP_VADDR(mmap_start[mmap_idx].start, 
-                                           pending_idx, j);
+                       uvaddr = MMAP_VADDR(info->user_vstart, usr_idx, j);
+                       kvaddr = idx_to_kaddr(mmap_idx, pending_idx, j);
 
                        pg = pfn_to_page(__pa(kvaddr) >> PAGE_SHIFT);
                        ClearPageReserved(pg);
@@ -1214,8 +1167,7 @@ static void dispatch_rw_block_io(blkif_t
                uint32_t flags;
 
                uvaddr = MMAP_VADDR(info->user_vstart, usr_idx, i);
-               kvaddr = MMAP_VADDR(mmap_start[mmap_idx].start, 
-                                   pending_idx, i);
+               kvaddr = idx_to_kaddr(mmap_idx, pending_idx, i);
                page = virt_to_page(kvaddr);
 
                sector = req->sector_number + (8*i);
@@ -1267,8 +1219,7 @@ static void dispatch_rw_block_io(blkif_t
                struct page *pg;
 
                uvaddr = MMAP_VADDR(info->user_vstart, usr_idx, i/2);
-               kvaddr = MMAP_VADDR(mmap_start[mmap_idx].start, 
-                                   pending_idx, i/2);
+               kvaddr = idx_to_kaddr(mmap_idx, pending_idx, i/2);
 
                if (unlikely(map[i].status != 0)) {
                        WPRINTK("invalid kernel buffer -- "
@@ -1298,8 +1249,7 @@ static void dispatch_rw_block_io(blkif_t
                unsigned long kvaddr;
                struct page *pg;
 
-               kvaddr = MMAP_VADDR(mmap_start[mmap_idx].start, 
-                                   pending_idx, i);
+               kvaddr = idx_to_kaddr(mmap_idx, pending_idx, i);
                pg = pfn_to_page(__pa(kvaddr) >> PAGE_SHIFT);
                SetPageReserved(pg);
        }
diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/drivers/xen/netback/common.h
--- a/linux-2.6-xen-sparse/drivers/xen/netback/common.h Sun Oct 08 18:55:12 
2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/netback/common.h Sat Oct 14 13:28:45 
2006 -0600
@@ -106,7 +106,7 @@ typedef struct netif_st {
 
 void netif_disconnect(netif_t *netif);
 
-netif_t *netif_alloc(domid_t domid, unsigned int handle, u8 be_mac[ETH_ALEN]);
+netif_t *netif_alloc(domid_t domid, unsigned int handle);
 int netif_map(netif_t *netif, unsigned long tx_ring_ref,
              unsigned long rx_ring_ref, unsigned int evtchn);
 
diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/drivers/xen/netback/interface.c
--- a/linux-2.6-xen-sparse/drivers/xen/netback/interface.c      Sun Oct 08 
18:55:12 2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/netback/interface.c      Sat Oct 14 
13:28:45 2006 -0600
@@ -62,6 +62,7 @@ static void __netif_down(netif_t *netif)
 {
        disable_irq(netif->irq);
        netif_deschedule_work(netif);
+       del_timer_sync(&netif->credit_timeout);
 }
 
 static int net_open(struct net_device *dev)
@@ -125,7 +126,7 @@ static struct ethtool_ops network_ethtoo
        .get_link = ethtool_op_get_link,
 };
 
-netif_t *netif_alloc(domid_t domid, unsigned int handle, u8 be_mac[ETH_ALEN])
+netif_t *netif_alloc(domid_t domid, unsigned int handle)
 {
        int err = 0, i;
        struct net_device *dev;
@@ -152,6 +153,7 @@ netif_t *netif_alloc(domid_t domid, unsi
        netif->credit_bytes = netif->remaining_credit = ~0UL;
        netif->credit_usec  = 0UL;
        init_timer(&netif->credit_timeout);
+       netif->credit_timeout.expires = jiffies;
 
        dev->hard_start_xmit = netif_be_start_xmit;
        dev->get_stats       = netif_be_get_stats;
@@ -167,20 +169,14 @@ netif_t *netif_alloc(domid_t domid, unsi
                printk(KERN_WARNING "netbk: WARNING: device '%s' has non-zero "
                       "queue length (%lu)!\n", dev->name, dev->tx_queue_len);
 
-       for (i = 0; i < ETH_ALEN; i++)
-               if (be_mac[i] != 0)
-                       break;
-       if (i == ETH_ALEN) {
-               /*
-                * Initialise a dummy MAC address. We choose the numerically
-                * largest non-broadcast address to prevent the address getting
-                * stolen by an Ethernet bridge for STP purposes.
-                * (FE:FF:FF:FF:FF:FF)
-                */ 
-               memset(dev->dev_addr, 0xFF, ETH_ALEN);
-               dev->dev_addr[0] &= ~0x01;
-       } else
-               memcpy(dev->dev_addr, be_mac, ETH_ALEN);
+       /*
+        * Initialise a dummy MAC address. We choose the numerically
+        * largest non-broadcast address to prevent the address getting
+        * stolen by an Ethernet bridge for STP purposes.
+        * (FE:FF:FF:FF:FF:FF)
+        */ 
+       memset(dev->dev_addr, 0xFF, ETH_ALEN);
+       dev->dev_addr[0] &= ~0x01;
 
        rtnl_lock();
        err = register_netdevice(dev);
diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/drivers/xen/netback/netback.c
--- a/linux-2.6-xen-sparse/drivers/xen/netback/netback.c        Sun Oct 08 
18:55:12 2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/netback/netback.c        Sat Oct 14 
13:28:45 2006 -0600
@@ -70,14 +70,15 @@ static struct timer_list net_timer;
 
 static struct sk_buff_head rx_queue;
 
-static unsigned long mmap_vstart;
-#define MMAP_VADDR(_req) (mmap_vstart + ((_req) * PAGE_SIZE))
-
-static void *rx_mmap_area;
+static struct page **mmap_pages;
+static inline unsigned long idx_to_kaddr(unsigned int idx)
+{
+       return (unsigned long)pfn_to_kaddr(page_to_pfn(mmap_pages[idx]));
+}
 
 #define PKT_PROT_LEN 64
 
-static struct {
+static struct pending_tx_info {
        netif_tx_request_t req;
        netif_t *netif;
 } pending_tx_info[MAX_PENDING_REQS];
@@ -373,14 +374,22 @@ static u16 netbk_gop_frag(netif_t *netif
                   flipped. */
                meta->copy = 1;
                copy_gop = npo->copy + npo->copy_prod++;
-               copy_gop->source.domid = DOMID_SELF;
+               copy_gop->flags = GNTCOPY_dest_gref;
+               if (PageForeign(page)) {
+                       struct pending_tx_info *src_pend =
+                               &pending_tx_info[page->index];
+                       copy_gop->source.domid = src_pend->netif->domid;
+                       copy_gop->source.u.ref = src_pend->req.gref;
+                       copy_gop->flags |= GNTCOPY_source_gref;
+               } else {
+                       copy_gop->source.domid = DOMID_SELF;
+                       copy_gop->source.u.gmfn = old_mfn;
+               }
                copy_gop->source.offset = offset;
-               copy_gop->source.u.gmfn = old_mfn;
                copy_gop->dest.domid = netif->domid;
                copy_gop->dest.offset = 0;
                copy_gop->dest.u.ref = req->gref;
                copy_gop->len = size;
-               copy_gop->flags = GNTCOPY_dest_gref;
        } else {
                meta->copy = 0;
                if (!xen_feature(XENFEAT_auto_translated_physmap)) {
@@ -792,10 +801,27 @@ void netif_deschedule_work(netif_t *neti
 }
 
 
+static void tx_add_credit(netif_t *netif)
+{
+       unsigned long max_burst;
+
+       /*
+        * Allow a burst big enough to transmit a jumbo packet of up to 128kB.
+        * Otherwise the interface can seize up due to insufficient credit.
+        */
+       max_burst = RING_GET_REQUEST(&netif->tx, netif->tx.req_cons)->size;
+       max_burst = min(max_burst, 131072UL);
+       max_burst = max(max_burst, netif->credit_bytes);
+
+       netif->remaining_credit = min(netif->remaining_credit +
+                                     netif->credit_bytes,
+                                     max_burst);
+}
+
 static void tx_credit_callback(unsigned long data)
 {
        netif_t *netif = (netif_t *)data;
-       netif->remaining_credit = netif->credit_bytes;
+       tx_add_credit(netif);
        netif_schedule_work(netif);
 }
 
@@ -819,7 +845,7 @@ inline static void net_tx_action_dealloc
        gop = tx_unmap_ops;
        while (dc != dp) {
                pending_idx = dealloc_ring[MASK_PEND_IDX(dc++)];
-               gnttab_set_unmap_op(gop, MMAP_VADDR(pending_idx),
+               gnttab_set_unmap_op(gop, idx_to_kaddr(pending_idx),
                                    GNTMAP_host_map,
                                    grant_tx_handle[pending_idx]);
                gop++;
@@ -857,20 +883,28 @@ static void netbk_tx_err(netif_t *netif,
        netif_put(netif);
 }
 
-static int netbk_count_requests(netif_t *netif, netif_tx_request_t *txp,
-                               int work_to_do)
-{
-       netif_tx_request_t *first = txp;
+static int netbk_count_requests(netif_t *netif, netif_tx_request_t *first,
+                               netif_tx_request_t *txp, int work_to_do)
+{
        RING_IDX cons = netif->tx.req_cons;
        int frags = 0;
 
-       while (txp->flags & NETTXF_more_data) {
+       if (!(first->flags & NETTXF_more_data))
+               return 0;
+
+       do {
                if (frags >= work_to_do) {
                        DPRINTK("Need more frags\n");
                        return -frags;
                }
 
-               txp = RING_GET_REQUEST(&netif->tx, cons + frags);
+               if (unlikely(frags >= MAX_SKB_FRAGS)) {
+                       DPRINTK("Too many frags\n");
+                       return -frags;
+               }
+
+               memcpy(txp, RING_GET_REQUEST(&netif->tx, cons + frags),
+                      sizeof(*txp));
                if (txp->size > first->size) {
                        DPRINTK("Frags galore\n");
                        return -frags;
@@ -884,30 +918,28 @@ static int netbk_count_requests(netif_t 
                                txp->offset, txp->size);
                        return -frags;
                }
-       }
+       } while ((txp++)->flags & NETTXF_more_data);
 
        return frags;
 }
 
 static gnttab_map_grant_ref_t *netbk_get_requests(netif_t *netif,
                                                  struct sk_buff *skb,
+                                                 netif_tx_request_t *txp,
                                                  gnttab_map_grant_ref_t *mop)
 {
        struct skb_shared_info *shinfo = skb_shinfo(skb);
        skb_frag_t *frags = shinfo->frags;
-       netif_tx_request_t *txp;
        unsigned long pending_idx = *((u16 *)skb->data);
-       RING_IDX cons = netif->tx.req_cons;
        int i, start;
 
        /* Skip first skb fragment if it is on same page as header fragment. */
        start = ((unsigned long)shinfo->frags[0].page == pending_idx);
 
-       for (i = start; i < shinfo->nr_frags; i++) {
-               txp = RING_GET_REQUEST(&netif->tx, cons++);
+       for (i = start; i < shinfo->nr_frags; i++, txp++) {
                pending_idx = pending_ring[MASK_PEND_IDX(pending_cons++)];
 
-               gnttab_set_map_op(mop++, MMAP_VADDR(pending_idx),
+               gnttab_set_map_op(mop++, idx_to_kaddr(pending_idx),
                                  GNTMAP_host_map | GNTMAP_readonly,
                                  txp->gref, netif->domid);
 
@@ -940,7 +972,7 @@ static int netbk_tx_check_mop(struct sk_
                netif_put(netif);
        } else {
                set_phys_to_machine(
-                       __pa(MMAP_VADDR(pending_idx)) >> PAGE_SHIFT,
+                       __pa(idx_to_kaddr(pending_idx)) >> PAGE_SHIFT,
                        FOREIGN_FRAME(mop->dev_bus_addr >> PAGE_SHIFT));
                grant_tx_handle[pending_idx] = mop->handle;
        }
@@ -957,7 +989,7 @@ static int netbk_tx_check_mop(struct sk_
                newerr = (++mop)->status;
                if (likely(!newerr)) {
                        set_phys_to_machine(
-                               __pa(MMAP_VADDR(pending_idx))>>PAGE_SHIFT,
+                               __pa(idx_to_kaddr(pending_idx))>>PAGE_SHIFT,
                                FOREIGN_FRAME(mop->dev_bus_addr>>PAGE_SHIFT));
                        grant_tx_handle[pending_idx] = mop->handle;
                        /* Had a previous error? Invalidate this fragment. */
@@ -1005,7 +1037,7 @@ static void netbk_fill_frags(struct sk_b
 
                pending_idx = (unsigned long)frag->page;
                txp = &pending_tx_info[pending_idx].req;
-               frag->page = virt_to_page(MMAP_VADDR(pending_idx));
+               frag->page = virt_to_page(idx_to_kaddr(pending_idx));
                frag->size = txp->size;
                frag->page_offset = txp->offset;
 
@@ -1018,7 +1050,7 @@ int netbk_get_extras(netif_t *netif, str
 int netbk_get_extras(netif_t *netif, struct netif_extra_info *extras,
                     int work_to_do)
 {
-       struct netif_extra_info *extra;
+       struct netif_extra_info extra;
        RING_IDX cons = netif->tx.req_cons;
 
        do {
@@ -1027,18 +1059,18 @@ int netbk_get_extras(netif_t *netif, str
                        return -EBADR;
                }
 
-               extra = (struct netif_extra_info *)
-                       RING_GET_REQUEST(&netif->tx, cons);
-               if (unlikely(!extra->type ||
-                            extra->type >= XEN_NETIF_EXTRA_TYPE_MAX)) {
+               memcpy(&extra, RING_GET_REQUEST(&netif->tx, cons),
+                      sizeof(extra));
+               if (unlikely(!extra.type ||
+                            extra.type >= XEN_NETIF_EXTRA_TYPE_MAX)) {
                        netif->tx.req_cons = ++cons;
-                       DPRINTK("Invalid extra type: %d\n", extra->type);
+                       DPRINTK("Invalid extra type: %d\n", extra.type);
                        return -EINVAL;
                }
 
-               memcpy(&extras[extra->type - 1], extra, sizeof(*extra));
+               memcpy(&extras[extra.type - 1], &extra, sizeof(extra));
                netif->tx.req_cons = ++cons;
-       } while (extra->flags & XEN_NETIF_EXTRA_FLAG_MORE);
+       } while (extra.flags & XEN_NETIF_EXTRA_FLAG_MORE);
 
        return work_to_do;
 }
@@ -1073,6 +1105,7 @@ static void net_tx_action(unsigned long 
        struct sk_buff *skb;
        netif_t *netif;
        netif_tx_request_t txreq;
+       netif_tx_request_t txfrags[MAX_SKB_FRAGS];
        struct netif_extra_info extras[XEN_NETIF_EXTRA_TYPE_MAX - 1];
        u16 pending_idx;
        RING_IDX i;
@@ -1101,6 +1134,7 @@ static void net_tx_action(unsigned long 
                i = netif->tx.req_cons;
                rmb(); /* Ensure that we see the request before we copy it. */
                memcpy(&txreq, RING_GET_REQUEST(&netif->tx, i), sizeof(txreq));
+
                /* Credit-based scheduling. */
                if (txreq.size > netif->remaining_credit) {
                        unsigned long now = jiffies;
@@ -1109,25 +1143,27 @@ static void net_tx_action(unsigned long 
                                msecs_to_jiffies(netif->credit_usec / 1000);
 
                        /* Timer could already be pending in rare cases. */
-                       if (timer_pending(&netif->credit_timeout))
-                               break;
+                       if (timer_pending(&netif->credit_timeout)) {
+                               netif_put(netif);
+                               continue;
+                       }
 
                        /* Passed the point where we can replenish credit? */
                        if (time_after_eq(now, next_credit)) {
                                netif->credit_timeout.expires = now;
-                               netif->remaining_credit = netif->credit_bytes;
+                               tx_add_credit(netif);
                        }
 
                        /* Still too big to send right now? Set a callback. */
                        if (txreq.size > netif->remaining_credit) {
-                               netif->remaining_credit = 0;
                                netif->credit_timeout.data     =
                                        (unsigned long)netif;
                                netif->credit_timeout.function =
                                        tx_credit_callback;
                                __mod_timer(&netif->credit_timeout,
                                            next_credit);
-                               break;
+                               netif_put(netif);
+                               continue;
                        }
                }
                netif->remaining_credit -= txreq.size;
@@ -1146,18 +1182,12 @@ static void net_tx_action(unsigned long 
                        }
                }
 
-               ret = netbk_count_requests(netif, &txreq, work_to_do);
+               ret = netbk_count_requests(netif, &txreq, txfrags, work_to_do);
                if (unlikely(ret < 0)) {
                        netbk_tx_err(netif, &txreq, i - ret);
                        continue;
                }
                i += ret;
-
-               if (unlikely(ret > MAX_SKB_FRAGS)) {
-                       DPRINTK("Too many frags\n");
-                       netbk_tx_err(netif, &txreq, i);
-                       continue;
-               }
 
                if (unlikely(txreq.size < ETH_HLEN)) {
                        DPRINTK("Bad packet size: %d\n", txreq.size);
@@ -1201,7 +1231,7 @@ static void net_tx_action(unsigned long 
                        }
                }
 
-               gnttab_set_map_op(mop, MMAP_VADDR(pending_idx),
+               gnttab_set_map_op(mop, idx_to_kaddr(pending_idx),
                                  GNTMAP_host_map | GNTMAP_readonly,
                                  txreq.gref, netif->domid);
                mop++;
@@ -1227,7 +1257,7 @@ static void net_tx_action(unsigned long 
 
                pending_cons++;
 
-               mop = netbk_get_requests(netif, skb, mop);
+               mop = netbk_get_requests(netif, skb, txfrags, mop);
 
                netif->tx.req_cons = i;
                netif_schedule_work(netif);
@@ -1260,8 +1290,8 @@ static void net_tx_action(unsigned long 
                }
 
                data_len = skb->len;
-               memcpy(skb->data, 
-                      (void *)(MMAP_VADDR(pending_idx)|txp->offset),
+               memcpy(skb->data,
+                      (void *)(idx_to_kaddr(pending_idx)|txp->offset),
                       data_len);
                if (data_len < txp->size) {
                        /* Append the packet payload as a fragment. */
@@ -1315,18 +1345,10 @@ static void netif_idx_release(u16 pendin
 
 static void netif_page_release(struct page *page)
 {
-       u16 pending_idx = page - virt_to_page(mmap_vstart);
-
        /* Ready for next use. */
        set_page_count(page, 1);
 
-       netif_idx_release(pending_idx);
-}
-
-static void netif_rx_page_release(struct page *page)
-{
-       /* Ready for next use. */
-       set_page_count(page, 1);
+       netif_idx_release(page->index);
 }
 
 irqreturn_t netif_be_int(int irq, void *dev_id, struct pt_regs *regs)
@@ -1446,27 +1468,17 @@ static int __init netback_init(void)
        init_timer(&net_timer);
        net_timer.data = 0;
        net_timer.function = net_alarm;
-    
-       page = balloon_alloc_empty_page_range(MAX_PENDING_REQS);
-       if (page == NULL)
+
+       mmap_pages = alloc_empty_pages_and_pagevec(MAX_PENDING_REQS);
+       if (mmap_pages == NULL) {
+               printk("%s: out of memory\n", __FUNCTION__);
                return -ENOMEM;
-
-       mmap_vstart = (unsigned long)pfn_to_kaddr(page_to_pfn(page));
+       }
 
        for (i = 0; i < MAX_PENDING_REQS; i++) {
-               page = virt_to_page(MMAP_VADDR(i));
-               set_page_count(page, 1);
+               page = mmap_pages[i];
                SetPageForeign(page, netif_page_release);
-       }
-
-       page = balloon_alloc_empty_page_range(NET_RX_RING_SIZE);
-       BUG_ON(page == NULL);
-       rx_mmap_area = pfn_to_kaddr(page_to_pfn(page));
-
-       for (i = 0; i < NET_RX_RING_SIZE; i++) {
-               page = virt_to_page(rx_mmap_area + (i * PAGE_SIZE));
-               set_page_count(page, 1);
-               SetPageForeign(page, netif_rx_page_release);
+               page->index = i;
        }
 
        pending_cons = 0;
diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/drivers/xen/netback/xenbus.c
--- a/linux-2.6-xen-sparse/drivers/xen/netback/xenbus.c Sun Oct 08 18:55:12 
2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/netback/xenbus.c Sat Oct 14 13:28:45 
2006 -0600
@@ -28,29 +28,20 @@
     printk("netback/xenbus (%s:%d) " fmt ".\n", __FUNCTION__, __LINE__, ##args)
 #endif
 
-struct backend_info
-{
+struct backend_info {
        struct xenbus_device *dev;
        netif_t *netif;
-       struct xenbus_watch backend_watch;
        enum xenbus_state frontend_state;
 };
 
 static int connect_rings(struct backend_info *);
 static void connect(struct backend_info *);
-static void maybe_connect(struct backend_info *);
-static void backend_changed(struct xenbus_watch *, const char **,
-                           unsigned int);
+static void backend_create_netif(struct backend_info *be);
 
 static int netback_remove(struct xenbus_device *dev)
 {
        struct backend_info *be = dev->dev.driver_data;
 
-       if (be->backend_watch.node) {
-               unregister_xenbus_watch(&be->backend_watch);
-               kfree(be->backend_watch.node);
-               be->backend_watch.node = NULL;
-       }
        if (be->netif) {
                netif_disconnect(be->netif);
                be->netif = NULL;
@@ -63,8 +54,7 @@ static int netback_remove(struct xenbus_
 
 /**
  * Entry point to this code when a new device is created.  Allocate the basic
- * structures, and watch the store waiting for the hotplug scripts to tell us
- * the device's handle.  Switch to InitWait.
+ * structures and switch to InitWait.
  */
 static int netback_probe(struct xenbus_device *dev,
                         const struct xenbus_device_id *id)
@@ -83,11 +73,6 @@ static int netback_probe(struct xenbus_d
        be->dev = dev;
        dev->dev.driver_data = be;
 
-       err = xenbus_watch_path2(dev, dev->nodename, "handle",
-                                &be->backend_watch, backend_changed);
-       if (err)
-               goto fail;
-
        do {
                err = xenbus_transaction_start(&xbt);
                if (err) {
@@ -108,7 +93,8 @@ static int netback_probe(struct xenbus_d
                        goto abort_transaction;
                }
 
-               err = xenbus_printf(xbt, dev->nodename, "feature-rx-copy", 
"%d", 1);
+               err = xenbus_printf(xbt, dev->nodename,
+                                   "feature-rx-copy", "%d", 1);
                if (err) {
                        message = "writing feature-copying";
                        goto abort_transaction;
@@ -123,9 +109,11 @@ static int netback_probe(struct xenbus_d
        }
 
        err = xenbus_switch_state(dev, XenbusStateInitWait);
-       if (err) {
+       if (err)
                goto fail;
-       }
+
+       /* This kicks hotplug scripts, so do it immediately. */
+       backend_create_netif(be);
 
        return 0;
 
@@ -175,48 +163,30 @@ static int netback_uevent(struct xenbus_
 }
 
 
-/**
- * Callback received when the hotplug scripts have placed the handle node.
- * Read it, and create a netif structure.  If the frontend is ready, connect.
- */
-static void backend_changed(struct xenbus_watch *watch,
-                           const char **vec, unsigned int len)
+static void backend_create_netif(struct backend_info *be)
 {
        int err;
        long handle;
-       struct backend_info *be
-               = container_of(watch, struct backend_info, backend_watch);
        struct xenbus_device *dev = be->dev;
 
-       DPRINTK("");
+       if (be->netif != NULL)
+               return;
 
        err = xenbus_scanf(XBT_NIL, dev->nodename, "handle", "%li", &handle);
-       if (XENBUS_EXIST_ERR(err)) {
-               /* Since this watch will fire once immediately after it is
-                  registered, we expect this.  Ignore it, and wait for the
-                  hotplug scripts. */
-               return;
-       }
        if (err != 1) {
                xenbus_dev_fatal(dev, err, "reading handle");
                return;
        }
 
-       if (be->netif == NULL) {
-               u8 be_mac[ETH_ALEN] = { 0, 0, 0, 0, 0, 0 };
-
-               be->netif = netif_alloc(dev->otherend_id, handle, be_mac);
-               if (IS_ERR(be->netif)) {
-                       err = PTR_ERR(be->netif);
-                       be->netif = NULL;
-                       xenbus_dev_fatal(dev, err, "creating interface");
-                       return;
-               }
-
-               kobject_uevent(&dev->dev.kobj, KOBJ_ONLINE);
-
-               maybe_connect(be);
-       }
+       be->netif = netif_alloc(dev->otherend_id, handle);
+       if (IS_ERR(be->netif)) {
+               err = PTR_ERR(be->netif);
+               be->netif = NULL;
+               xenbus_dev_fatal(dev, err, "creating interface");
+               return;
+       }
+
+       kobject_uevent(&dev->dev.kobj, KOBJ_ONLINE);
 }
 
 
@@ -249,11 +219,9 @@ static void frontend_changed(struct xenb
                break;
 
        case XenbusStateConnected:
-               if (!be->netif) {
-                       /* reconnect: setup be->netif */
-                       backend_changed(&be->backend_watch, NULL, 0);
-               }
-               maybe_connect(be);
+               backend_create_netif(be);
+               if (be->netif)
+                       connect(be);
                break;
 
        case XenbusStateClosing:
@@ -279,15 +247,6 @@ static void frontend_changed(struct xenb
 }
 
 
-/* ** Connection ** */
-
-
-static void maybe_connect(struct backend_info *be)
-{
-       if (be->netif && (be->frontend_state == XenbusStateConnected))
-               connect(be);
-}
-
 static void xen_net_read_rate(struct xenbus_device *dev,
                              unsigned long *bytes, unsigned long *usec)
 {
diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c
--- a/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c      Sun Oct 08 
18:55:12 2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c      Sat Oct 14 
13:28:45 2006 -0600
@@ -47,6 +47,7 @@
 #include <linux/in.h>
 #include <linux/if_ether.h>
 #include <linux/io.h>
+#include <linux/moduleparam.h>
 #include <net/sock.h>
 #include <net/pkt_sched.h>
 #include <net/arp.h>
@@ -85,17 +86,42 @@ static const int MODPARM_rx_flip = 0;
 #define RX_COPY_THRESHOLD 256
 
 /* If we don't have GSO, fake things up so that we never try to use it. */
-#ifndef NETIF_F_GSO
-#define netif_needs_gso(dev, skb)      0
-#define dev_disable_gso_features(dev)  ((void)0)
-#else
+#if defined(NETIF_F_GSO)
 #define HAVE_GSO                       1
+#define HAVE_TSO                       1 /* TSO is a subset of GSO */
 static inline void dev_disable_gso_features(struct net_device *dev)
 {
        /* Turn off all GSO bits except ROBUST. */
        dev->features &= (1 << NETIF_F_GSO_SHIFT) - 1;
        dev->features |= NETIF_F_GSO_ROBUST;
 }
+#elif defined(NETIF_F_TSO)
+#define HAVE_TSO                       1
+#define gso_size tso_size
+#define gso_segs tso_segs
+static inline void dev_disable_gso_features(struct net_device *dev)
+{
+       /* Turn off all TSO bits. */
+       dev->features &= ~NETIF_F_TSO;
+}
+static inline int skb_is_gso(const struct sk_buff *skb)
+{
+        return skb_shinfo(skb)->tso_size;
+}
+static inline int skb_gso_ok(struct sk_buff *skb, int features)
+{
+        return (features & NETIF_F_TSO);
+}
+
+static inline int netif_needs_gso(struct net_device *dev, struct sk_buff *skb)
+{
+        return skb_is_gso(skb) &&
+               (!skb_gso_ok(skb, dev->features) ||
+                unlikely(skb->ip_summed != CHECKSUM_HW));
+}
+#else
+#define netif_needs_gso(dev, skb)      0
+#define dev_disable_gso_features(dev)  ((void)0)
 #endif
 
 #define GRANT_INVALID_REF      0
@@ -115,7 +141,6 @@ struct netfront_info {
        spinlock_t   tx_lock;
        spinlock_t   rx_lock;
 
-       unsigned int handle;
        unsigned int evtchn, irq;
        unsigned int copying_receiver;
 
@@ -139,7 +164,7 @@ struct netfront_info {
        grant_ref_t gref_tx_head;
        grant_ref_t grant_tx_ref[NET_TX_RING_SIZE + 1];
        grant_ref_t gref_rx_head;
-       grant_ref_t grant_rx_ref[NET_TX_RING_SIZE];
+       grant_ref_t grant_rx_ref[NET_RX_RING_SIZE];
 
        struct xenbus_device *xbdev;
        int tx_ring_ref;
@@ -204,9 +229,8 @@ static inline grant_ref_t xennet_get_rx_
 #define WPRINTK(fmt, args...)                          \
        printk(KERN_WARNING "netfront: " fmt, ##args)
 
-static int talk_to_backend(struct xenbus_device *, struct netfront_info *);
 static int setup_device(struct xenbus_device *, struct netfront_info *);
-static struct net_device *create_netdev(int, int, struct xenbus_device *);
+static struct net_device *create_netdev(struct xenbus_device *);
 
 static void netfront_closing(struct xenbus_device *);
 
@@ -216,7 +240,7 @@ static void close_netdev(struct netfront
 static void close_netdev(struct netfront_info *);
 static void netif_free(struct netfront_info *);
 
-static void network_connect(struct net_device *);
+static int network_connect(struct net_device *);
 static void network_tx_buf_gc(struct net_device *);
 static void network_alloc_rx_buffers(struct net_device *);
 static int send_fake_arp(struct net_device *);
@@ -239,8 +263,7 @@ static inline int xennet_can_sg(struct n
 /**
  * Entry point to this code when a new device is created.  Allocate the basic
  * structures and the ring buffers for communication with the backend, and
- * inform the backend of the appropriate details for those.  Switch to
- * Connected state.
+ * inform the backend of the appropriate details for those.
  */
 static int __devinit netfront_probe(struct xenbus_device *dev,
                                    const struct xenbus_device_id *id)
@@ -248,32 +271,8 @@ static int __devinit netfront_probe(stru
        int err;
        struct net_device *netdev;
        struct netfront_info *info;
-       unsigned int handle, feature_rx_copy, feature_rx_flip, use_copy;
-
-       err = xenbus_scanf(XBT_NIL, dev->nodename, "handle", "%u", &handle);
-       if (err != 1) {
-               xenbus_dev_fatal(dev, err, "reading handle");
-               return err;
-       }
-
-       err = xenbus_scanf(XBT_NIL, dev->otherend, "feature-rx-copy", "%u",
-                          &feature_rx_copy);
-       if (err != 1)
-               feature_rx_copy = 0;
-       err = xenbus_scanf(XBT_NIL, dev->otherend, "feature-rx-flip", "%u",
-                          &feature_rx_flip);
-       if (err != 1)
-               feature_rx_flip = 1;
-
-       /*
-        * Copy packets on receive path if:
-        *  (a) This was requested by user, and the backend supports it; or
-        *  (b) Flipping was requested, but this is unsupported by the backend.
-        */
-       use_copy = (MODPARM_rx_copy && feature_rx_copy) ||
-               (MODPARM_rx_flip && !feature_rx_flip);
-
-       netdev = create_netdev(handle, use_copy, dev);
+
+       netdev = create_netdev(dev);
        if (IS_ERR(netdev)) {
                err = PTR_ERR(netdev);
                xenbus_dev_fatal(dev, err, "creating netdev");
@@ -283,23 +282,13 @@ static int __devinit netfront_probe(stru
        info = netdev_priv(netdev);
        dev->dev.driver_data = info;
 
-       err = talk_to_backend(dev, info);
-       if (err)
-               goto fail_backend;
-
        err = open_netdev(info);
        if (err)
-               goto fail_open;
-
-       IPRINTK("Created netdev %s with %sing receive path.\n",
-               netdev->name, info->copying_receiver ? "copy" : "flipp");
+               goto fail;
 
        return 0;
 
- fail_open:
-       xennet_sysfs_delif(info->netdev);
-       unregister_netdev(netdev);
- fail_backend:
+ fail:
        free_netdev(netdev);
        dev->dev.driver_data = NULL;
        return err;
@@ -319,7 +308,7 @@ static int netfront_resume(struct xenbus
        DPRINTK("%s\n", dev->nodename);
 
        netif_disconnect_backend(info);
-       return talk_to_backend(dev, info);
+       return 0;
 }
 
 static int xen_net_read_mac(struct xenbus_device *dev, u8 mac[])
@@ -408,7 +397,7 @@ again:
                goto abort_transaction;
        }
 
-#ifdef HAVE_GSO
+#ifdef HAVE_TSO
        err = xenbus_printf(xbt, dev->nodename, "feature-gso-tcpv4", "%d", 1);
        if (err) {
                message = "writing feature-gso-tcpv4";
@@ -430,7 +419,7 @@ again:
        xenbus_transaction_end(xbt, 1);
        xenbus_dev_fatal(dev, err, "%s", message);
  destroy_ring:
-       netif_free(info);
+       netif_disconnect_backend(info);
  out:
        return err;
 }
@@ -520,7 +509,10 @@ static void backend_changed(struct xenbu
                break;
 
        case XenbusStateInitWait:
-               network_connect(netdev);
+               if (network_connect(netdev) != 0) {
+                       netif_free(np);
+                       break;
+               }
                xenbus_switch_state(dev, XenbusStateConnected);
                (void)send_fake_arp(netdev);
                break;
@@ -940,7 +932,7 @@ static int network_start_xmit(struct sk_
                tx->flags |= NETTXF_data_validated;
 #endif
 
-#ifdef HAVE_GSO
+#ifdef HAVE_TSO
        if (skb_shinfo(skb)->gso_size) {
                struct netif_extra_info *gso = (struct netif_extra_info *)
                        RING_GET_REQUEST(&np->tx, ++i);
@@ -1094,6 +1086,7 @@ static int xennet_get_responses(struct n
                        if (net_ratelimit())
                                WPRINTK("rx->offset: %x, size: %u\n",
                                        rx->offset, rx->status);
+                       xennet_move_rx_slot(np, skb, ref);
                        err = -EINVAL;
                        goto next;
                }
@@ -1104,7 +1097,8 @@ static int xennet_get_responses(struct n
                 * situation to the system controller to reboot the backed.
                 */
                if (ref == GRANT_INVALID_REF) {
-                       WPRINTK("Bad rx response id %d.\n", rx->id);
+                       if (net_ratelimit())
+                               WPRINTK("Bad rx response id %d.\n", rx->id);
                        err = -EINVAL;
                        goto next;
                }
@@ -1176,6 +1170,9 @@ next:
                err = -E2BIG;
        }
 
+       if (unlikely(err))
+               np->rx.rsp_cons = cons + frags;
+
        *pages_flipped_p = pages_flipped;
 
        return err;
@@ -1228,12 +1225,14 @@ static int xennet_set_skb_gso(struct sk_
                return -EINVAL;
        }
 
+#ifdef HAVE_TSO
+       skb_shinfo(skb)->gso_size = gso->u.gso.size;
 #ifdef HAVE_GSO
-       skb_shinfo(skb)->gso_size = gso->u.gso.size;
        skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
 
        /* Header must be checked, and gso_segs computed. */
        skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
+#endif
        skb_shinfo(skb)->gso_segs = 0;
 
        return 0;
@@ -1278,9 +1277,9 @@ static int netif_poll(struct net_device 
        rp = np->rx.sring->rsp_prod;
        rmb(); /* Ensure we see queued responses up to 'rp'. */
 
-       for (i = np->rx.rsp_cons, work_done = 0;
-            (i != rp) && (work_done < budget);
-            np->rx.rsp_cons = ++i, work_done++) {
+       i = np->rx.rsp_cons;
+       work_done = 0;
+       while ((i != rp) && (work_done < budget)) {
                memcpy(rx, RING_GET_RESPONSE(&np->rx, i), sizeof(*rx));
                memset(extras, 0, sizeof(extras));
 
@@ -1288,12 +1287,11 @@ static int netif_poll(struct net_device 
                                           &pages_flipped);
 
                if (unlikely(err)) {
-err:
-                       i = np->rx.rsp_cons + skb_queue_len(&tmpq) - 1;
-                       work_done--;
+err:   
                        while ((skb = __skb_dequeue(&tmpq)))
                                __skb_queue_tail(&errq, skb);
                        np->stats.rx_errors++;
+                       i = np->rx.rsp_cons;
                        continue;
                }
 
@@ -1305,6 +1303,7 @@ err:
 
                        if (unlikely(xennet_set_skb_gso(skb, gso))) {
                                __skb_queue_head(&tmpq, skb);
+                               np->rx.rsp_cons += skb_queue_len(&tmpq);
                                goto err;
                        }
                }
@@ -1368,6 +1367,9 @@ err:
                np->stats.rx_bytes += skb->len;
 
                __skb_queue_tail(&rxq, skb);
+
+               np->rx.rsp_cons = ++i;
+               work_done++;
        }
 
        if (pages_flipped) {
@@ -1584,7 +1586,7 @@ static int xennet_set_sg(struct net_devi
 
 static int xennet_set_tso(struct net_device *dev, u32 data)
 {
-#ifdef HAVE_GSO
+#ifdef HAVE_TSO
        if (data) {
                struct netfront_info *np = netdev_priv(dev);
                int val;
@@ -1615,15 +1617,40 @@ static void xennet_set_features(struct n
                xennet_set_tso(dev, 1);
 }
 
-static void network_connect(struct net_device *dev)
+static int network_connect(struct net_device *dev)
 {
        struct netfront_info *np = netdev_priv(dev);
-       int i, requeue_idx;
+       int i, requeue_idx, err;
        struct sk_buff *skb;
        grant_ref_t ref;
        netif_rx_request_t *req;
+       unsigned int feature_rx_copy, feature_rx_flip;
+
+       err = xenbus_scanf(XBT_NIL, np->xbdev->otherend,
+                          "feature-rx-copy", "%u", &feature_rx_copy);
+       if (err != 1)
+               feature_rx_copy = 0;
+       err = xenbus_scanf(XBT_NIL, np->xbdev->otherend,
+                          "feature-rx-flip", "%u", &feature_rx_flip);
+       if (err != 1)
+               feature_rx_flip = 1;
+
+       /*
+        * Copy packets on receive path if:
+        *  (a) This was requested by user, and the backend supports it; or
+        *  (b) Flipping was requested, but this is unsupported by the backend.
+        */
+       np->copying_receiver = ((MODPARM_rx_copy && feature_rx_copy) ||
+                               (MODPARM_rx_flip && !feature_rx_flip));
+
+       err = talk_to_backend(np->xbdev, np);
+       if (err)
+               return err;
 
        xennet_set_features(dev);
+
+       IPRINTK("device %s has %sing receive path.\n",
+               dev->name, np->copying_receiver ? "copy" : "flipp");
 
        spin_lock_irq(&np->tx_lock);
        spin_lock(&np->rx_lock);
@@ -1680,6 +1707,8 @@ static void network_connect(struct net_d
 
        spin_unlock(&np->rx_lock);
        spin_unlock_irq(&np->tx_lock);
+
+       return 0;
 }
 
 static void netif_uninit(struct net_device *dev)
@@ -1845,8 +1874,7 @@ static void network_set_multicast_list(s
 {
 }
 
-static struct net_device * __devinit
-create_netdev(int handle, int copying_receiver, struct xenbus_device *dev)
+static struct net_device * __devinit create_netdev(struct xenbus_device *dev)
 {
        int i, err = 0;
        struct net_device *netdev = NULL;
@@ -1860,9 +1888,7 @@ create_netdev(int handle, int copying_re
        }
 
        np                   = netdev_priv(netdev);
-       np->handle           = handle;
        np->xbdev            = dev;
-       np->copying_receiver = copying_receiver;
 
        netif_carrier_off(netdev);
 
@@ -1993,10 +2019,12 @@ static int open_netdev(struct netfront_i
 
        err = xennet_sysfs_addif(info->netdev);
        if (err) {
-               /* This can be non-fatal: it only means no tuning parameters */
+               unregister_netdev(info->netdev);
                printk(KERN_WARNING "%s: add sysfs failed err=%d\n",
                       __FUNCTION__, err);
-       }
+               return err;
+       }
+
        return 0;
 }
 
diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/drivers/xen/privcmd/privcmd.c
--- a/linux-2.6-xen-sparse/drivers/xen/privcmd/privcmd.c        Sun Oct 08 
18:55:12 2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/privcmd/privcmd.c        Sat Oct 14 
13:28:45 2006 -0600
@@ -34,6 +34,10 @@
 
 static struct proc_dir_entry *privcmd_intf;
 static struct proc_dir_entry *capabilities_intf;
+
+#ifndef HAVE_ARCH_PRIVCMD_MMAP
+static int privcmd_enforce_singleshot_mapping(struct vm_area_struct *vma);
+#endif
 
 static int privcmd_ioctl(struct inode *inode, struct file *file,
                         unsigned int cmd, unsigned long data)
@@ -89,10 +93,12 @@ static int privcmd_ioctl(struct inode *i
        break;
 
        case IOCTL_PRIVCMD_MMAP: {
-#define PRIVCMD_MMAP_SZ 32
                privcmd_mmap_t mmapcmd;
-               privcmd_mmap_entry_t msg[PRIVCMD_MMAP_SZ];
+               privcmd_mmap_entry_t msg;
                privcmd_mmap_entry_t __user *p;
+               struct mm_struct *mm = current->mm;
+               struct vm_area_struct *vma;
+               unsigned long va;
                int i, rc;
 
                if (!is_initial_xendomain())
@@ -102,47 +108,60 @@ static int privcmd_ioctl(struct inode *i
                        return -EFAULT;
 
                p = mmapcmd.entry;
-
-               for (i = 0; i < mmapcmd.num;
-                    i += PRIVCMD_MMAP_SZ, p += PRIVCMD_MMAP_SZ) {
-                       int j, n = ((mmapcmd.num-i)>PRIVCMD_MMAP_SZ)?
-                               PRIVCMD_MMAP_SZ:(mmapcmd.num-i);
-
-                       if (copy_from_user(&msg, p,
-                                          n*sizeof(privcmd_mmap_entry_t)))
-                               return -EFAULT;
-     
-                       for (j = 0; j < n; j++) {
-                               struct vm_area_struct *vma = 
-                                       find_vma( current->mm, msg[j].va );
-
-                               if (!vma)
-                                       return -EINVAL;
-
-                               if (msg[j].va > PAGE_OFFSET)
-                                       return -EINVAL;
-
-                               if ((msg[j].va + (msg[j].npages << PAGE_SHIFT))
-                                   > vma->vm_end )
-                                       return -EINVAL;
-
-                               if ((rc = direct_remap_pfn_range(
-                                       vma,
-                                       msg[j].va&PAGE_MASK, 
-                                       msg[j].mfn, 
-                                       msg[j].npages<<PAGE_SHIFT, 
-                                       vma->vm_page_prot,
-                                       mmapcmd.dom)) < 0)
-                                       return rc;
-                       }
-               }
-               ret = 0;
+               if (copy_from_user(&msg, p, sizeof(msg)))
+                       return -EFAULT;
+
+               down_read(&mm->mmap_sem);
+
+               vma = find_vma(mm, msg.va);
+               rc = -EINVAL;
+               if (!vma || (msg.va != vma->vm_start) ||
+                   !privcmd_enforce_singleshot_mapping(vma))
+                       goto mmap_out;
+
+               va = vma->vm_start;
+
+               for (i = 0; i < mmapcmd.num; i++) {
+                       rc = -EFAULT;
+                       if (copy_from_user(&msg, p, sizeof(msg)))
+                               goto mmap_out;
+
+                       /* Do not allow range to wrap the address space. */
+                       rc = -EINVAL;
+                       if ((msg.npages > (LONG_MAX >> PAGE_SHIFT)) ||
+                           ((unsigned long)(msg.npages << PAGE_SHIFT) >= -va))
+                               goto mmap_out;
+
+                       /* Range chunks must be contiguous in va space. */
+                       if ((msg.va != va) ||
+                           ((msg.va+(msg.npages<<PAGE_SHIFT)) > vma->vm_end))
+                               goto mmap_out;
+
+                       if ((rc = direct_remap_pfn_range(
+                               vma,
+                               msg.va & PAGE_MASK, 
+                               msg.mfn, 
+                               msg.npages << PAGE_SHIFT, 
+                               vma->vm_page_prot,
+                               mmapcmd.dom)) < 0)
+                               goto mmap_out;
+
+                       p++;
+                       va += msg.npages << PAGE_SHIFT;
+               }
+
+               rc = 0;
+
+       mmap_out:
+               up_read(&mm->mmap_sem);
+               ret = rc;
        }
        break;
 
        case IOCTL_PRIVCMD_MMAPBATCH: {
                privcmd_mmapbatch_t m;
-               struct vm_area_struct *vma = NULL;
+               struct mm_struct *mm = current->mm;
+               struct vm_area_struct *vma;
                xen_pfn_t __user *p;
                unsigned long addr, mfn;
                int i;
@@ -150,37 +169,31 @@ static int privcmd_ioctl(struct inode *i
                if (!is_initial_xendomain())
                        return -EPERM;
 
-               if (copy_from_user(&m, udata, sizeof(m))) {
-                       ret = -EFAULT;
-                       goto batch_err;
-               }
-
-               if (m.dom == DOMID_SELF) {
-                       ret = -EINVAL;
-                       goto batch_err;
-               }
-
-               vma = find_vma(current->mm, m.addr);
-               if (!vma) {
-                       ret = -EINVAL;
-                       goto batch_err;
-               }
-
-               if (m.addr > PAGE_OFFSET) {
-                       ret = -EFAULT;
-                       goto batch_err;
-               }
-
-               if ((m.addr + (m.num<<PAGE_SHIFT)) > vma->vm_end) {
-                       ret = -EFAULT;
-                       goto batch_err;
+               if (copy_from_user(&m, udata, sizeof(m)))
+                       return -EFAULT;
+
+               if ((m.num <= 0) || (m.num > (LONG_MAX >> PAGE_SHIFT)))
+                       return -EINVAL;
+
+               down_read(&mm->mmap_sem);
+
+               vma = find_vma(mm, m.addr);
+               if (!vma ||
+                   (m.addr != vma->vm_start) ||
+                   ((m.addr + ((unsigned long)m.num<<PAGE_SHIFT)) !=
+                    vma->vm_end) ||
+                   !privcmd_enforce_singleshot_mapping(vma)) {
+                       up_read(&mm->mmap_sem);
+                       return -EINVAL;
                }
 
                p = m.arr;
                addr = m.addr;
                for (i = 0; i < m.num; i++, addr += PAGE_SIZE, p++) {
-                       if (get_user(mfn, p))
+                       if (get_user(mfn, p)) {
+                               up_read(&mm->mmap_sem);
                                return -EFAULT;
+                       }
 
                        ret = direct_remap_pfn_range(vma, addr & PAGE_MASK,
                                                     mfn, PAGE_SIZE,
@@ -189,15 +202,8 @@ static int privcmd_ioctl(struct inode *i
                                put_user(0xF0000000 | mfn, p);
                }
 
+               up_read(&mm->mmap_sem);
                ret = 0;
-               break;
-
-       batch_err:
-               printk("batch_err ret=%d vma=%p addr=%lx "
-                      "num=%d arr=%p %lx-%lx\n", 
-                      ret, vma, (unsigned long)m.addr, m.num, m.arr,
-                      vma ? vma->vm_start : 0, vma ? vma->vm_end : 0);
-               break;
        }
        break;
 
@@ -210,12 +216,34 @@ static int privcmd_ioctl(struct inode *i
 }
 
 #ifndef HAVE_ARCH_PRIVCMD_MMAP
+static struct page *privcmd_nopage(struct vm_area_struct *vma,
+                                  unsigned long address,
+                                  int *type)
+{
+       return NOPAGE_SIGBUS;
+}
+
+static struct vm_operations_struct privcmd_vm_ops = {
+       .nopage = privcmd_nopage
+};
+
 static int privcmd_mmap(struct file * file, struct vm_area_struct * vma)
 {
+       /* Unsupported for auto-translate guests. */
+       if (xen_feature(XENFEAT_auto_translated_physmap))
+               return -ENOSYS;
+
        /* DONTCOPY is essential for Xen as copy_page_range is broken. */
        vma->vm_flags |= VM_RESERVED | VM_IO | VM_DONTCOPY;
+       vma->vm_ops = &privcmd_vm_ops;
+       vma->vm_private_data = NULL;
 
        return 0;
+}
+
+static int privcmd_enforce_singleshot_mapping(struct vm_area_struct *vma)
+{
+       return (xchg(&vma->vm_private_data, (void *)1) == NULL);
 }
 #endif
 
diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/drivers/xen/tpmback/common.h
--- a/linux-2.6-xen-sparse/drivers/xen/tpmback/common.h Sun Oct 08 18:55:12 
2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/tpmback/common.h Sat Oct 14 13:28:45 
2006 -0600
@@ -46,11 +46,10 @@ typedef struct tpmif_st {
        atomic_t refcnt;
 
        struct backend_info *bi;
-       unsigned long mmap_vstart;
 
        grant_handle_t shmem_handle;
        grant_ref_t shmem_ref;
-       struct page *pagerange;
+       struct page **mmap_pages;
 
        char devname[20];
 } tpmif_t;
@@ -80,6 +79,9 @@ int vtpm_release_packets(tpmif_t * tpmif
 
 extern int num_frontends;
 
-#define MMAP_VADDR(t,_req) ((t)->mmap_vstart + ((_req) * PAGE_SIZE))
+static inline unsigned long idx_to_kaddr(tpmif_t *t, unsigned int idx)
+{
+       return (unsigned long)pfn_to_kaddr(page_to_pfn(t->mmap_pages[idx]));
+}
 
 #endif /* __TPMIF__BACKEND__COMMON_H__ */
diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/drivers/xen/tpmback/interface.c
--- a/linux-2.6-xen-sparse/drivers/xen/tpmback/interface.c      Sun Oct 08 
18:55:12 2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/tpmback/interface.c      Sat Oct 14 
13:28:45 2006 -0600
@@ -25,8 +25,8 @@ static tpmif_t *alloc_tpmif(domid_t domi
        tpmif_t *tpmif;
 
        tpmif = kmem_cache_alloc(tpmif_cachep, GFP_KERNEL);
-       if (!tpmif)
-               return ERR_PTR(-ENOMEM);
+       if (tpmif == NULL)
+               goto out_of_memory;
 
        memset(tpmif, 0, sizeof (*tpmif));
        tpmif->domid = domid;
@@ -35,22 +35,27 @@ static tpmif_t *alloc_tpmif(domid_t domi
        snprintf(tpmif->devname, sizeof(tpmif->devname), "tpmif%d", domid);
        atomic_set(&tpmif->refcnt, 1);
 
-       tpmif->pagerange = balloon_alloc_empty_page_range(TPMIF_TX_RING_SIZE);
-       BUG_ON(tpmif->pagerange == NULL);
-       tpmif->mmap_vstart = (unsigned long)pfn_to_kaddr(
-                                           page_to_pfn(tpmif->pagerange));
+       tpmif->mmap_pages = alloc_empty_pages_and_pagevec(TPMIF_TX_RING_SIZE);
+       if (tpmif->mmap_pages == NULL)
+               goto out_of_memory;
 
        list_add(&tpmif->tpmif_list, &tpmif_list);
        num_frontends++;
 
        return tpmif;
+
+ out_of_memory:
+       if (tpmif != NULL)
+               kmem_cache_free(tpmif_cachep, tpmif);
+       printk("%s: out of memory\n", __FUNCTION__);
+       return ERR_PTR(-ENOMEM);
 }
 
 static void free_tpmif(tpmif_t * tpmif)
 {
        num_frontends--;
        list_del(&tpmif->tpmif_list);
-       balloon_dealloc_empty_page_range(tpmif->pagerange, TPMIF_TX_RING_SIZE);
+       free_empty_pages_and_pagevec(tpmif->mmap_pages, TPMIF_TX_RING_SIZE);
        kmem_cache_free(tpmif_cachep, tpmif);
 }
 
diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/drivers/xen/tpmback/tpmback.c
--- a/linux-2.6-xen-sparse/drivers/xen/tpmback/tpmback.c        Sun Oct 08 
18:55:12 2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/tpmback/tpmback.c        Sat Oct 14 
13:28:45 2006 -0600
@@ -253,7 +253,7 @@ int _packet_write(struct packet *pak,
                        return 0;
                }
 
-               gnttab_set_map_op(&map_op, MMAP_VADDR(tpmif, i),
+               gnttab_set_map_op(&map_op, idx_to_kaddr(tpmif, i),
                                  GNTMAP_host_map, tx->ref, tpmif->domid);
 
                if (unlikely(HYPERVISOR_grant_table_op(GNTTABOP_map_grant_ref,
@@ -270,7 +270,7 @@ int _packet_write(struct packet *pak,
 
                tocopy = min_t(size_t, size - offset, PAGE_SIZE);
 
-               if (copy_from_buffer((void *)(MMAP_VADDR(tpmif, i) |
+               if (copy_from_buffer((void *)(idx_to_kaddr(tpmif, i) |
                                              (tx->addr & ~PAGE_MASK)),
                                     &data[offset], tocopy, isuserbuffer)) {
                        tpmif_put(tpmif);
@@ -278,7 +278,7 @@ int _packet_write(struct packet *pak,
                }
                tx->size = tocopy;
 
-               gnttab_set_unmap_op(&unmap_op, MMAP_VADDR(tpmif, i),
+               gnttab_set_unmap_op(&unmap_op, idx_to_kaddr(tpmif, i),
                                    GNTMAP_host_map, handle);
 
                if (unlikely
@@ -391,7 +391,7 @@ static int packet_read_shmem(struct pack
 
                tx = &tpmif->tx->ring[i].req;
 
-               gnttab_set_map_op(&map_op, MMAP_VADDR(tpmif, i),
+               gnttab_set_map_op(&map_op, idx_to_kaddr(tpmif, i),
                                  GNTMAP_host_map, tx->ref, tpmif->domid);
 
                if (unlikely(HYPERVISOR_grant_table_op(GNTTABOP_map_grant_ref,
@@ -414,10 +414,10 @@ static int packet_read_shmem(struct pack
                }
 
                DPRINTK("Copying from mapped memory at %08lx\n",
-                       (unsigned long)(MMAP_VADDR(tpmif, i) |
+                       (unsigned long)(idx_to_kaddr(tpmif, i) |
                                        (tx->addr & ~PAGE_MASK)));
 
-               src = (void *)(MMAP_VADDR(tpmif, i) |
+               src = (void *)(idx_to_kaddr(tpmif, i) |
                               ((tx->addr & ~PAGE_MASK) + pg_offset));
                if (copy_to_buffer(&buffer[offset],
                                   src, to_copy, isuserbuffer)) {
@@ -428,7 +428,7 @@ static int packet_read_shmem(struct pack
                        tpmif->domid, buffer[offset], buffer[offset + 1],
                        buffer[offset + 2], buffer[offset + 3]);
 
-               gnttab_set_unmap_op(&unmap_op, MMAP_VADDR(tpmif, i),
+               gnttab_set_unmap_op(&unmap_op, idx_to_kaddr(tpmif, i),
                                    GNTMAP_host_map, handle);
 
                if (unlikely
diff -r 5176c3ea3293 -r b725c9e51a7c 
linux-2.6-xen-sparse/include/asm-ia64/hypervisor.h
--- a/linux-2.6-xen-sparse/include/asm-ia64/hypervisor.h        Sun Oct 08 
18:55:12 2006 -0600
+++ b/linux-2.6-xen-sparse/include/asm-ia64/hypervisor.h        Sat Oct 14 
13:28:45 2006 -0600
@@ -127,6 +127,7 @@ int direct_remap_pfn_range(struct vm_are
                           pgprot_t prot,
                           domid_t  domid);
 struct file;
+int privcmd_enforce_singleshot_mapping(struct vm_area_struct *vma);
 int privcmd_mmap(struct file * file, struct vm_area_struct * vma);
 #define HAVE_ARCH_PRIVCMD_MMAP
 
diff -r 5176c3ea3293 -r b725c9e51a7c linux-2.6-xen-sparse/include/xen/balloon.h
--- a/linux-2.6-xen-sparse/include/xen/balloon.h        Sun Oct 08 18:55:12 
2006 -0600
+++ b/linux-2.6-xen-sparse/include/xen/balloon.h        Sat Oct 14 13:28:45 
2006 -0600
@@ -38,23 +38,13 @@
  * Inform the balloon driver that it should allow some slop for device-driver
  * memory activities.
  */
-void
-balloon_update_driver_allowance(
-       long delta);
+void balloon_update_driver_allowance(long delta);
 
-/* Allocate an empty low-memory page range. */
-struct page *
-balloon_alloc_empty_page_range(
-       unsigned long nr_pages);
+/* Allocate/free a set of empty pages in low memory (i.e., no RAM mapped). */
+struct page **alloc_empty_pages_and_pagevec(int nr_pages);
+void free_empty_pages_and_pagevec(struct page **pagevec, int nr_pages);
 
-/* Deallocate an empty page range, adding to the balloon. */
-void
-balloon_dealloc_empty_page_range(
-       struct page *page, unsigned long nr_pages);
-
-void
-balloon_release_driver_page(
-       struct page *page);
+void balloon_release_driver_page(struct page *page);
 
 /*
  * Prevent the balloon driver from changing the memory reservation during
diff -r 5176c3ea3293 -r b725c9e51a7c linux-2.6-xen-sparse/mm/memory.c
--- a/linux-2.6-xen-sparse/mm/memory.c  Sun Oct 08 18:55:12 2006 -0600
+++ b/linux-2.6-xen-sparse/mm/memory.c  Sat Oct 14 13:28:45 2006 -0600
@@ -390,7 +390,7 @@ struct page *vm_normal_page(struct vm_ar
 
        if (vma->vm_flags & VM_PFNMAP) {
                unsigned long off = (addr - vma->vm_start) >> PAGE_SHIFT;
-               if ((pfn == vma->vm_pgoff + off) || !pfn_valid(pfn))
+               if (pfn == vma->vm_pgoff + off)
                        return NULL;
                if (!is_cow_mapping(vma->vm_flags))
                        return NULL;
@@ -405,7 +405,8 @@ struct page *vm_normal_page(struct vm_ar
         * Remove this test eventually!
         */
        if (unlikely(!pfn_valid(pfn))) {
-               print_bad_pte(vma, pte, addr);
+               if (!(vma->vm_flags & VM_RESERVED))
+                       print_bad_pte(vma, pte, addr);
                return NULL;
        }
 
diff -r 5176c3ea3293 -r b725c9e51a7c tools/blktap/drivers/Makefile
--- a/tools/blktap/drivers/Makefile     Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/blktap/drivers/Makefile     Sat Oct 14 13:28:45 2006 -0600
@@ -10,11 +10,8 @@ INSTALL_DIR  = /usr/sbin
 INSTALL_DIR  = /usr/sbin
 LIBAIO_DIR   = ../../libaio/src
 
-CFLAGS   += -fPIC
-CFLAGS   += -Wall
 CFLAGS   += -Werror
 CFLAGS   += -Wno-unused
-CFLAGS   += -g3
 CFLAGS   += -fno-strict-aliasing
 CFLAGS   += -I $(XEN_LIBXC) -I $(LIBAIO_DIR)
 CFLAGS   += $(INCLUDES) -I. -I../../xenstore 
diff -r 5176c3ea3293 -r b725c9e51a7c tools/blktap/drivers/blktapctrl.c
--- a/tools/blktap/drivers/blktapctrl.c Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/blktap/drivers/blktapctrl.c Sat Oct 14 13:28:45 2006 -0600
@@ -73,11 +73,6 @@ static int write_msg(int fd, int msgtype
 static int write_msg(int fd, int msgtype, void *ptr, void *ptr2);
 static int read_msg(int fd, int msgtype, void *ptr);
 static driver_list_entry_t *active_disks[MAX_DISK_TYPES];
-
-void sig_handler(int sig)
-{
-       run = 0;        
-}
 
 static void init_driver_list(void)
 {
@@ -669,6 +664,7 @@ int main(int argc, char *argv[])
                goto open_failed;
        }
 
+
  retry:
        /* Set up store connection and watch. */
        h = xs_daemon_open();
@@ -682,15 +678,11 @@ int main(int argc, char *argv[])
                 } else goto open_failed;
        }
        
-       ret = add_blockdevice_probe_watch(h, "Domain-0");
+       ret = setup_probe_watch(h);
        if (ret != 0) {
                DPRINTF("Failed adding device probewatch\n");
-                if (count < MAX_ATTEMPTS) {
-                        count++;
-                        sleep(2);
-                        xs_daemon_close(h);
-                        goto retry;
-                } else goto open_failed;
+               xs_daemon_close(h);
+               goto open_failed;
        }
 
        ioctl(ctlfd, BLKTAP_IOCTL_SETMODE, BLKTAP_MODE_INTERPOSE );
diff -r 5176c3ea3293 -r b725c9e51a7c tools/blktap/lib/blktaplib.h
--- a/tools/blktap/lib/blktaplib.h      Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/blktap/lib/blktaplib.h      Sat Oct 14 13:28:45 2006 -0600
@@ -193,8 +193,8 @@ typedef struct msg_pid {
 #define CTLMSG_PID_RSP     10
 
 /* xenstore/xenbus: */
-extern int add_blockdevice_probe_watch(struct xs_handle *h, 
-                                       const char *domname);
+#define DOMNAME "Domain-0"
+int setup_probe_watch(struct xs_handle *h);
 int xs_fire_next_watch(struct xs_handle *h);
 
 
diff -r 5176c3ea3293 -r b725c9e51a7c tools/blktap/lib/xenbus.c
--- a/tools/blktap/lib/xenbus.c Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/blktap/lib/xenbus.c Sat Oct 14 13:28:45 2006 -0600
@@ -166,60 +166,58 @@ static void ueblktap_setup(struct xs_han
                goto fail;
        }
 
-        deverr = xs_gather(h, bepath, "physical-device", "%li", &pdev, NULL);
-        if (!deverr) {
-                DPRINTF("pdev set to %ld\n",pdev);
-                if (be->pdev && be->pdev != pdev) {
-                        DPRINTF("changing physical-device not supported");
-                        goto fail;
-                }
-                be->pdev = pdev;
-        }
-
-        /*Check to see if device is to be opened read-only*/
-        asprintf(&path, "%s/%s", bepath, "read-only");
-        if (xs_exists(h, path))
-                be->readonly = 1;
-
-        if (be->blkif == NULL) {
-
-                /* Front end dir is a number, which is used as the handle. */
-                p = strrchr(be->frontpath, '/') + 1;
-                handle = strtoul(p, NULL, 0);
-
-                be->blkif = alloc_blkif(be->frontend_id);
-       
-                if (be->blkif == NULL)
-                        goto fail;
+       deverr = xs_gather(h, bepath, "physical-device", "%li", &pdev, NULL);
+       if (!deverr) {
+               DPRINTF("pdev set to %ld\n",pdev);
+               if (be->pdev && be->pdev != pdev) {
+                       DPRINTF("changing physical-device not supported");
+                       goto fail;
+               }
+               be->pdev = pdev;
+       }
+
+       /* Check to see if device is to be opened read-only. */
+       asprintf(&path, "%s/%s", bepath, "read-only");
+       if (xs_exists(h, path))
+               be->readonly = 1;
+
+       if (be->blkif == NULL) {
+               /* Front end dir is a number, which is used as the handle. */
+               p = strrchr(be->frontpath, '/') + 1;
+               handle = strtoul(p, NULL, 0);
+
+               be->blkif = alloc_blkif(be->frontend_id);
+               if (be->blkif == NULL)
+                       goto fail;
 
                be->blkif->be_id = get_be_id(bepath);
                
-                /*Insert device specific info*/
-                blk = malloc(sizeof(blkif_info_t));
+               /* Insert device specific info, */
+               blk = malloc(sizeof(blkif_info_t));
                if (!blk) {
                        DPRINTF("Out of memory - blkif_info_t\n");
                        goto fail;
                }
-                er = xs_gather(h, bepath, "params", NULL, &blk->params, NULL);
-                if (er)
-                        goto fail;
-                be->blkif->info = blk;
+               er = xs_gather(h, bepath, "params", NULL, &blk->params, NULL);
+               if (er)
+                       goto fail;
+               be->blkif->info = blk;
                
-                if (deverr) {
-                        /*Dev number was not available, try to set manually*/
-                        pdev = convert_dev_name_to_num(blk->params);
-                        be->pdev = pdev;
-                }
-
-                er = blkif_init(be->blkif, handle, be->pdev, be->readonly);
-
-                if (er != 0) {
-                        DPRINTF("Unable to open device %s\n",blk->params);
-                       goto fail;
-               }
-
-                DPRINTF("[BECHG]: ADDED A NEW BLKIF (%s)\n", bepath);
-        }      
+               if (deverr) {
+                       /*Dev number was not available, try to set manually*/
+                       pdev = convert_dev_name_to_num(blk->params);
+                       be->pdev = pdev;
+               }
+
+               er = blkif_init(be->blkif, handle, be->pdev, be->readonly);
+               if (er != 0) {
+                       DPRINTF("Unable to open device %s\n",blk->params);
+                       goto fail;
+               }
+
+               DPRINTF("[BECHG]: ADDED A NEW BLKIF (%s)\n", bepath);
+       }
+
        /* Supply the information about the device to xenstore */
        er = xs_printf(h, be->backpath, "sectors", "%lu",
                        be->blkif->ops->get_size(be->blkif));
@@ -283,10 +281,10 @@ static void ueblktap_probe(struct xs_han
         *asserts that xenstore structure is always 7 levels deep
         *e.g. /local/domain/0/backend/vbd/1/2049
         */
-        len = strsep_len(bepath, '/', 7);
-        if (len < 0) 
-               goto free_be;     
-        bepath[len] = '\0';
+       len = strsep_len(bepath, '/', 7);
+       if (len < 0) 
+               goto free_be;
+       bepath[len] = '\0';
        
        be = malloc(sizeof(*be));
        if (!be) {
@@ -318,22 +316,21 @@ static void ueblktap_probe(struct xs_han
                if ( (be != NULL) && (be->blkif != NULL) ) 
                        backend_remove(h, be);
                else goto free_be;
-               if (bepath)
+               if (bepath)
                        free(bepath);
                return;
        }
        
-        /* Are we already tracking this device? */
-        if (be_exists_be(bepath)) {
+       /* Are we already tracking this device? */
+       if (be_exists_be(bepath))
                goto free_be;
-       }
        
        be->backpath = bepath;
-               be->frontpath = frontend;
-       
-        list_add(&be->list, &belist);
-       
-        DPRINTF("[PROBE]\tADDED NEW DEVICE (%s)\n", bepath);
+       be->frontpath = frontend;
+       
+       list_add(&be->list, &belist);
+       
+       DPRINTF("[PROBE]\tADDED NEW DEVICE (%s)\n", bepath);
        DPRINTF("\tFRONTEND (%s),(%ld)\n", frontend,be->frontend_id);
        
        ueblktap_setup(h, bepath);      
@@ -342,11 +339,10 @@ static void ueblktap_probe(struct xs_han
  free_be:
        if (frontend)
                free(frontend);
-        if (bepath)
+       if (bepath)
                free(bepath);
        if (be) 
                free(be);
-       return;
 }
 
 /**
@@ -356,16 +352,10 @@ static void ueblktap_probe(struct xs_han
  *are created, we initalise the state and attach a disk.
  */
 
-int add_blockdevice_probe_watch(struct xs_handle *h, const char *domname)
-{
-       char *domid, *path;
+int add_blockdevice_probe_watch(struct xs_handle *h, const char *domid)
+{
+       char *path;
        struct xenbus_watch *vbd_watch;
-       int er;
-       
-       domid = get_dom_domid(h, domname);
-
-       DPRINTF("%s: %s\n", 
-               domname, (domid != NULL) ? domid : "[ not found! ]");
        
        asprintf(&path, "/local/domain/%s/backend/tap", domid);
        if (path == NULL) 
@@ -378,10 +368,67 @@ int add_blockdevice_probe_watch(struct x
        }       
        vbd_watch->node     = path;
        vbd_watch->callback = ueblktap_probe;
-       er = register_xenbus_watch(h, vbd_watch);
-       if (er == 0) {
+       if (register_xenbus_watch(h, vbd_watch) != 0) {
                DPRINTF("ERROR: adding vbd probe watch %s\n", path);
                return -EINVAL;
        }
        return 0;
 }
+
+/* Asynch callback to check for /local/domain/<DOMID>/name */
+void check_dom(struct xs_handle *h, struct xenbus_watch *w, 
+              const char *bepath_im)
+{
+       char *domid;
+
+       domid = get_dom_domid(h);
+       if (domid == NULL)
+               return;
+
+       add_blockdevice_probe_watch(h, domid);
+       free(domid);
+       unregister_xenbus_watch(h, w);
+}
+
+/* We must wait for xend to register /local/domain/<DOMID> */
+int watch_for_domid(struct xs_handle *h)
+{
+       struct xenbus_watch *domid_watch;
+       char *path = NULL;
+
+       asprintf(&path, "/local/domain");
+       if (path == NULL) 
+               return -ENOMEM;
+
+       domid_watch = malloc(sizeof(struct xenbus_watch));
+       if (domid_watch == NULL) {
+               DPRINTF("ERROR: unable to malloc domid_watch [%s]\n", path);
+               return -EINVAL;
+       }       
+
+       domid_watch->node     = path;
+       domid_watch->callback = check_dom;
+
+       if (register_xenbus_watch(h, domid_watch) != 0) {
+               DPRINTF("ERROR: adding vbd probe watch %s\n", path);
+               return -EINVAL;
+       }
+
+       DPRINTF("Set async watch for /local/domain\n");
+
+       return 0;
+}
+
+int setup_probe_watch(struct xs_handle *h)
+{
+       char *domid;
+       int ret;
+       
+       domid = get_dom_domid(h);
+       if (domid == NULL)
+               return watch_for_domid(h);
+
+       ret = add_blockdevice_probe_watch(h, domid);
+       free(domid);
+       return ret;
+}
diff -r 5176c3ea3293 -r b725c9e51a7c tools/blktap/lib/xs_api.c
--- a/tools/blktap/lib/xs_api.c Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/blktap/lib/xs_api.c Sat Oct 14 13:28:45 2006 -0600
@@ -106,7 +106,7 @@ again:
        if (!xs_transaction_end(xs, xth, ret)) {
                if (ret == 0 && errno == EAGAIN)
                        goto again;
-                else
+               else
                        ret = errno;
        }
 
@@ -118,25 +118,25 @@ int xs_printf(struct xs_handle *h, const
 int xs_printf(struct xs_handle *h, const char *dir, const char *node, 
              const char *fmt, ...)
 {
-        char *buf, *path;
-        va_list ap;
-        int ret;
-       
-        va_start(ap, fmt);
-        ret = vasprintf(&buf, fmt, ap);
-        va_end(ap);
-       
-        asprintf(&path, "%s/%s", dir, node);
-       
-        if ( (path == NULL) || (buf == NULL) )
+       char *buf, *path;
+       va_list ap;
+       int ret;
+       
+       va_start(ap, fmt);
+       ret = vasprintf(&buf, fmt, ap);
+       va_end(ap);
+       
+       asprintf(&path, "%s/%s", dir, node);
+       
+       if ((path == NULL) || (buf == NULL))
                return 0;
 
-        ret = xs_write(h, XBT_NULL, path, buf, strlen(buf)+1);
-       
-        free(buf);
-        free(path);
-       
-        return ret;
+       ret = xs_write(h, XBT_NULL, path, buf, strlen(buf)+1);
+       
+       free(buf);
+       free(path);
+       
+       return ret;
 }
 
 
@@ -165,7 +165,7 @@ int xs_exists(struct xs_handle *h, const
  * This assumes that the domain name we are looking for is unique. 
  * Name parameter Domain-0 
  */
-char *get_dom_domid(struct xs_handle *h, const char *name)
+char *get_dom_domid(struct xs_handle *h)
 {
        char **e, *val, *domid = NULL;
        unsigned int num, len;
@@ -179,7 +179,9 @@ char *get_dom_domid(struct xs_handle *h,
        }
        
        e = xs_directory(h, xth, "/local/domain", &num);
-       
+       if (e == NULL)
+               return NULL;
+
        for (i = 0; (i < num) && (domid == NULL); i++) {
                asprintf(&path, "/local/domain/%s/name", e[i]);
                val = xs_read(h, xth, path, &len);
@@ -187,7 +189,7 @@ char *get_dom_domid(struct xs_handle *h,
                if (val == NULL)
                        continue;
                
-               if (strcmp(val, name) == 0) {
+               if (strcmp(val, DOMNAME) == 0) {
                        /* match! */
                        asprintf(&path, "/local/domain/%s/domid", e[i]);
                        domid = xs_read(h, xth, path, &len);
@@ -249,12 +251,12 @@ int convert_dev_name_to_num(char *name) 
                ret = BASE_DEV_VAL;
        }
 
-        free(p_sd);
-        free(p_hd);
-        free(p_xvd);
-        free(p_plx);
-        free(alpha);
-        
+       free(p_sd);
+       free(p_hd);
+       free(p_xvd);
+       free(p_plx);
+       free(alpha);
+
        return ret;
 }
 
@@ -281,42 +283,39 @@ int register_xenbus_watch(struct xs_hand
 {
        /* Pointer in ascii is the token. */
        char token[sizeof(watch) * 2 + 1];
-       int er;
-       
+
        sprintf(token, "%lX", (long)watch);
-       if (find_watch(token)) 
-       {
+       if (find_watch(token)) {
                DPRINTF("watch collision!\n");
                return -EINVAL;
        }
        
-       er = xs_watch(h, watch->node, token);
-       if (er != 0) {
-               list_add(&watch->list, &watches);
-       } 
-        
-       return er;
+       if (!xs_watch(h, watch->node, token)) {
+               DPRINTF("unable to set watch!\n");
+               return -EINVAL;
+       }
+
+       list_add(&watch->list, &watches);
+
+       return 0;
 }
 
 int unregister_xenbus_watch(struct xs_handle *h, struct xenbus_watch *watch)
 {
        char token[sizeof(watch) * 2 + 1];
-       int er;
        
        sprintf(token, "%lX", (long)watch);
-       if (!find_watch(token))
-       {
+       if (!find_watch(token)) {
                DPRINTF("no such watch!\n");
                return -EINVAL;
        }
-       
-       
-       er = xs_unwatch(h, watch->node, token);
+
+       if (!xs_unwatch(h, watch->node, token))
+               DPRINTF("XENBUS Failed to release watch %s: %i\n",
+                       watch->node, er);
+
        list_del(&watch->list);
        
-       if (er == 0)
-               DPRINTF("XENBUS Failed to release watch %s: %i\n",
-                    watch->node, er);
        return 0;
 }
 
@@ -354,14 +353,10 @@ int xs_fire_next_watch(struct xs_handle 
        token = res[XS_WATCH_TOKEN];
        
        w = find_watch(token);
-       if (!w)
-       {
-               DPRINTF("unregistered watch fired\n");
-               goto done;
-       }
-       w->callback(h, w, node);
-       
- done:
+       if (w)
+               w->callback(h, w, node);
+
        free(res);
+
        return 1;
 }
diff -r 5176c3ea3293 -r b725c9e51a7c tools/blktap/lib/xs_api.h
--- a/tools/blktap/lib/xs_api.h Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/blktap/lib/xs_api.h Sat Oct 14 13:28:45 2006 -0600
@@ -42,7 +42,7 @@ int xs_printf(struct xs_handle *h, const
 int xs_printf(struct xs_handle *h, const char *dir, const char *node, 
              const char *fmt, ...);
 int xs_exists(struct xs_handle *h, const char *path);
-char *get_dom_domid(struct xs_handle *h, const char *name);
+char *get_dom_domid(struct xs_handle *h);
 int convert_dev_name_to_num(char *name);
 int register_xenbus_watch(struct xs_handle *h, struct xenbus_watch *watch);
 int unregister_xenbus_watch(struct xs_handle *h, struct xenbus_watch *watch);
diff -r 5176c3ea3293 -r b725c9e51a7c tools/examples/block
--- a/tools/examples/block      Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/examples/block      Sat Oct 14 13:28:45 2006 -0600
@@ -377,7 +377,6 @@ mount it read-write in a guest domain."
       "")
         claim_lock "block"
         success
-        echo happy gun \"$t\" >>/tmp/block.$$
         release_lock "block"
        ;;
     esac
diff -r 5176c3ea3293 -r b725c9e51a7c tools/examples/xend-config.sxp
--- a/tools/examples/xend-config.sxp    Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/examples/xend-config.sxp    Sat Oct 14 13:28:45 2006 -0600
@@ -130,3 +130,8 @@
 
 # The tool used for initiating virtual TPM migration
 #(external-migration-tool '')
+
+# The interface for VNC servers to listen on. Defaults
+# to 127.0.0.1  To restore old 'listen everywhere' behaviour
+# set this to 0.0.0.0
+#(vnc-listen '127.0.0.1')
diff -r 5176c3ea3293 -r b725c9e51a7c tools/examples/xmexample.hvm
--- a/tools/examples/xmexample.hvm      Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/examples/xmexample.hvm      Sat Oct 14 13:28:45 2006 -0600
@@ -132,6 +132,11 @@ vnc=1
 vnc=1
 
 #----------------------------------------------------------------------------
+# address that should be listened on for the VNC server if vnc is set.
+# default is to use 'vnc-listen' setting from /etc/xen/xend-config.sxp
+#vnclisten="127.0.0.1"
+
+#----------------------------------------------------------------------------
 # set VNC display number, default = domid
 #vncdisplay=1
 
diff -r 5176c3ea3293 -r b725c9e51a7c tools/firmware/acpi/acpi_dsdt.asl
--- a/tools/firmware/acpi/acpi_dsdt.asl Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/firmware/acpi/acpi_dsdt.asl Sat Oct 14 13:28:45 2006 -0600
@@ -115,20 +115,15 @@ DefinitionBlock ("DSDT.aml", "DSDT", 1, 
                         0x0000,
                         0xF300)
 
-                /* reserve what device model consumed for PCI VGA device       
 */
+                /* reserve memory for pci devices */
 
                     DWordMemory (ResourceConsumer, PosDecode, MinFixed, 
MaxFixed, Cacheable, ReadWrite,
                         0x00000000,
                         0xF0000000,
-                        0xF1FFFFFF,
+                        0xF4FFFFFF,
                         0x00000000,
-                        0x02000000)
-                    DWordMemory (ResourceConsumer, PosDecode, MinFixed, 
MaxFixed, Cacheable, ReadWrite,
-                        0x00000000,
-                        0xF2000000,
-                        0xF2000FFF,
-                        0x00000000,
-                        0x00001000)
+                        0x05000000)
+
                 })
                 Return (PRT0)
             }
@@ -299,38 +294,43 @@ DefinitionBlock ("DSDT.aml", "DSDT", 1, 
                Return (PRTP)  
                } // end _PRT
 
-        Name(PRTP, Package(){
-                        Package(){0x0000ffff, 0, \_SB.PCI0.LNKA, 0}, // Slot 
1, INTA
-                        Package(){0x0000ffff, 1, \_SB.PCI0.LNKB, 0}, // Slot 
1, INTB
-                        Package(){0x0000ffff, 2, \_SB.PCI0.LNKC, 0}, // Slot 
1, INTC
-                        Package(){0x0000ffff, 3, \_SB.PCI0.LNKD, 0}, // Slot 
1, INTD
-
-                        Package(){0x0001ffff, 0, \_SB.PCI0.LNKB, 0}, // Slot 
2, INTB
-                        Package(){0x0001ffff, 1, \_SB.PCI0.LNKC, 0}, // Slot 
2, INTC
-                        Package(){0x0001ffff, 2, \_SB.PCI0.LNKD, 0}, // Slot 
2, INTD
-                        Package(){0x0001ffff, 3, \_SB.PCI0.LNKA, 0}, // Slot 
2, INTA
+        Name(PRTP, Package() {
+                        // Slot 1, INTA - INTD
+                        Package(){0x0000ffff, 0, \_SB.PCI0.LNKA, 0},
+                        Package(){0x0000ffff, 1, \_SB.PCI0.LNKB, 0},
+                        Package(){0x0000ffff, 2, \_SB.PCI0.LNKC, 0},
+                        Package(){0x0000ffff, 3, \_SB.PCI0.LNKD, 0},
+
+                        // Slot 2, INTA - INTD
+                        Package(){0x0001ffff, 0, \_SB.PCI0.LNKB, 0},
+                        Package(){0x0001ffff, 1, \_SB.PCI0.LNKC, 0},
+                        Package(){0x0001ffff, 2, \_SB.PCI0.LNKD, 0},
+                        Package(){0x0001ffff, 3, \_SB.PCI0.LNKA, 0},
                         
-                        Package(){0x0002ffff, 0, \_SB.PCI0.LNKC, 0}, // Slot 
3, INTC
-                        Package(){0x0002ffff, 1, \_SB.PCI0.LNKD, 0}, // Slot 
3, INTD
-                        Package(){0x0002ffff, 2, \_SB.PCI0.LNKA, 0}, // Slot 
3, INTA
-                        Package(){0x0002ffff, 3, \_SB.PCI0.LNKB, 0}, // Slot 
3, INTB
+                        // Slot 3, INTA - INTD
+                        Package(){0x0002ffff, 0, \_SB.PCI0.LNKC, 0},
+                        Package(){0x0002ffff, 1, \_SB.PCI0.LNKD, 0},
+                        Package(){0x0002ffff, 2, \_SB.PCI0.LNKA, 0},
+                        Package(){0x0002ffff, 3, \_SB.PCI0.LNKB, 0},
                         
-                        Package(){0x0003ffff, 0, \_SB.PCI0.LNKD, 0}, // Slot 
2, INTD
-                        Package(){0x0003ffff, 1, \_SB.PCI0.LNKA, 0}, // Slot 
2, INTA
-                        Package(){0x0003ffff, 2, \_SB.PCI0.LNKB, 0}, // Slot 
2, INTB
-                        Package(){0x0003ffff, 3, \_SB.PCI0.LNKC, 0}, // Slot 
2, INTC
+                        // Slot 4, INTA - INTD
+                        Package(){0x0003ffff, 0, \_SB.PCI0.LNKD, 0},
+                        Package(){0x0003ffff, 1, \_SB.PCI0.LNKA, 0},
+                        Package(){0x0003ffff, 2, \_SB.PCI0.LNKB, 0},
+                        Package(){0x0003ffff, 3, \_SB.PCI0.LNKC, 0},
                         
+                        // Slot 5, INTA - INTD
+                        Package(){0x0004ffff, 0, \_SB.PCI0.LNKA, 0},
+                        Package(){0x0004ffff, 1, \_SB.PCI0.LNKB, 0},
+                        Package(){0x0004ffff, 2, \_SB.PCI0.LNKC, 0},
+                        Package(){0x0004ffff, 3, \_SB.PCI0.LNKD, 0},
                         }
             )
         Name(PRTA, Package(){
-                        Package(){0x0001ffff, 0, 0, 5}, // Device 1, INTA
-
+                        Package(){0x0001ffff, 0, 0, 5},  // Device 1, INTA
                         Package(){0x0002ffff, 0, 0, 7},  // Device 2, INTA
-                       
                         Package(){0x0003ffff, 0, 0, 10}, // Device 3, INTA
-
-                        Package(){0x0004ffff, 0, 0, 11},  // Device 4, INTA    
                            
-                        
+                        Package(){0x0004ffff, 0, 0, 11}, // Device 4, INTA
                         }
             )
             
diff -r 5176c3ea3293 -r b725c9e51a7c tools/firmware/acpi/acpi_dsdt.c
--- a/tools/firmware/acpi/acpi_dsdt.c   Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/firmware/acpi/acpi_dsdt.c   Sat Oct 14 13:28:45 2006 -0600
@@ -1,19 +1,19 @@
 /*
  * 
  * Intel ACPI Component Architecture
- * ASL Optimizing Compiler / AML Disassembler version 20050513 [Jun  8 2005]
+ * ASL Optimizing Compiler / AML Disassembler version 20050513 [Oct 12 2006]
  * Copyright (C) 2000 - 2005 Intel Corporation
  * Supports ACPI Specification Revision 3.0
  * 
- * Compilation of "acpi_dsdt.asl" - Mon Aug 14 18:15:09 2006
+ * Compilation of "acpi_dsdt.asl" - Thu Oct 12 14:08:49 2006
  * 
  * C source code output
  *
  */
 unsigned char AmlCode[] = 
 {
-    0x44,0x53,0x44,0x54,0xBA,0x08,0x00,0x00,  /* 00000000    "DSDT...." */
-    0x01,0x1D,0x49,0x4E,0x54,0x45,0x4C,0x00,  /* 00000008    "..INTEL." */
+    0x44,0x53,0x44,0x54,0xDA,0x08,0x00,0x00,  /* 00000000    "DSDT...." */
+    0x01,0x26,0x49,0x4E,0x54,0x45,0x4C,0x00,  /* 00000008    ".&INTEL." */
     0x69,0x6E,0x74,0x2D,0x78,0x65,0x6E,0x00,  /* 00000010    "int-xen." */
     0xD6,0x07,0x00,0x00,0x49,0x4E,0x54,0x4C,  /* 00000018    "....INTL" */
     0x13,0x05,0x05,0x20,0x08,0x50,0x4D,0x42,  /* 00000020    "... .PMB" */
@@ -34,7 +34,7 @@ unsigned char AmlCode[] =
     0x12,0x08,0x04,0x0A,0x07,0x0A,0x07,0x00,  /* 00000098    "........" */
     0x00,0x08,0x50,0x49,0x43,0x44,0x00,0x14,  /* 000000A0    "..PICD.." */
     0x0C,0x5F,0x50,0x49,0x43,0x01,0x70,0x68,  /* 000000A8    "._PIC.ph" */
-    0x50,0x49,0x43,0x44,0x10,0x45,0x80,0x5F,  /* 000000B0    "PICD.E._" */
+    0x50,0x49,0x43,0x44,0x10,0x45,0x82,0x5F,  /* 000000B0    "PICD.E._" */
     0x53,0x42,0x5F,0x5B,0x82,0x49,0x04,0x4D,  /* 000000B8    "SB_[.I.M" */
     0x45,0x4D,0x30,0x08,0x5F,0x48,0x49,0x44,  /* 000000C0    "EM0._HID" */
     0x0C,0x41,0xD0,0x0C,0x02,0x08,0x5F,0x43,  /* 000000C8    ".A...._C" */
@@ -45,7 +45,7 @@ unsigned char AmlCode[] =
     0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,  /* 000000F0    "........" */
     0x00,0x00,0x00,0x00,0x00,0x00,0x0A,0x00,  /* 000000F8    "........" */
     0x00,0x00,0x00,0x00,0x79,0x00,0x5B,0x82,  /* 00000100    "....y.[." */
-    0x42,0x7B,0x50,0x43,0x49,0x30,0x08,0x5F,  /* 00000108    "B{PCI0._" */
+    0x42,0x7D,0x50,0x43,0x49,0x30,0x08,0x5F,  /* 00000108    "B}PCI0._" */
     0x48,0x49,0x44,0x0C,0x41,0xD0,0x0A,0x03,  /* 00000110    "HID.A..." */
     0x08,0x5F,0x55,0x49,0x44,0x00,0x08,0x5F,  /* 00000118    "._UID.._" */
     0x41,0x44,0x52,0x00,0x08,0x5F,0x42,0x42,  /* 00000120    "ADR.._BB" */
@@ -55,9 +55,9 @@ unsigned char AmlCode[] =
     0x33,0x03,0x49,0x52,0x51,0x35,0x05,0x49,  /* 00000140    "3.IRQ5.I" */
     0x52,0x51,0x37,0x07,0x49,0x52,0x51,0x39,  /* 00000148    "RQ7.IRQ9" */
     0x09,0x49,0x52,0x51,0x41,0x0A,0x49,0x52,  /* 00000150    ".IRQA.IR" */
-    0x51,0x42,0x0B,0x14,0x44,0x08,0x5F,0x43,  /* 00000158    "QB..D._C" */
+    0x51,0x42,0x0B,0x14,0x4A,0x06,0x5F,0x43,  /* 00000158    "QB..J._C" */
     0x52,0x53,0x00,0x08,0x50,0x52,0x54,0x30,  /* 00000160    "RS..PRT0" */
-    0x11,0x42,0x07,0x0A,0x6E,0x88,0x0D,0x00,  /* 00000168    ".B..n..." */
+    0x11,0x48,0x05,0x0A,0x54,0x88,0x0D,0x00,  /* 00000168    ".H..T..." */
     0x02,0x0F,0x00,0x00,0x00,0x00,0x00,0xFF,  /* 00000170    "........" */
     0x00,0x00,0x00,0x00,0x01,0x47,0x01,0xF8,  /* 00000178    ".....G.." */
     0x0C,0xF8,0x0C,0x01,0x08,0x88,0x0D,0x00,  /* 00000180    "........" */
@@ -66,231 +66,235 @@ unsigned char AmlCode[] =
     0x01,0x0C,0x03,0x00,0x00,0x00,0x0D,0xFF,  /* 00000198    "........" */
     0xFF,0x00,0x00,0x00,0xF3,0x87,0x17,0x00,  /* 000001A0    "........" */
     0x00,0x0D,0x03,0x00,0x00,0x00,0x00,0x00,  /* 000001A8    "........" */
-    0x00,0x00,0xF0,0xFF,0xFF,0xFF,0xF1,0x00,  /* 000001B0    "........" */
-    0x00,0x00,0x00,0x00,0x00,0x00,0x02,0x87,  /* 000001B8    "........" */
-    0x17,0x00,0x00,0x0D,0x03,0x00,0x00,0x00,  /* 000001C0    "........" */
-    0x00,0x00,0x00,0x00,0xF2,0xFF,0x0F,0x00,  /* 000001C8    "........" */
-    0xF2,0x00,0x00,0x00,0x00,0x00,0x10,0x00,  /* 000001D0    "........" */
-    0x00,0x79,0x00,0xA4,0x50,0x52,0x54,0x30,  /* 000001D8    ".y..PRT0" */
-    0x08,0x42,0x55,0x46,0x41,0x11,0x09,0x0A,  /* 000001E0    ".BUFA..." */
-    0x06,0x23,0xF8,0xDC,0x18,0x79,0x00,0x08,  /* 000001E8    ".#...y.." */
-    0x42,0x55,0x46,0x42,0x11,0x09,0x0A,0x06,  /* 000001F0    "BUFB...." */
-    0x23,0x00,0x00,0x18,0x79,0x00,0x8B,0x42,  /* 000001F8    "#...y..B" */
-    0x55,0x46,0x42,0x01,0x49,0x52,0x51,0x56,  /* 00000200    "UFB.IRQV" */
-    0x08,0x42,0x55,0x46,0x43,0x11,0x07,0x0A,  /* 00000208    ".BUFC..." */
-    0x04,0x05,0x07,0x0A,0x0B,0x8C,0x42,0x55,  /* 00000210    "......BU" */
-    0x46,0x43,0x01,0x50,0x49,0x51,0x41,0x8C,  /* 00000218    "FC.PIQA." */
-    0x42,0x55,0x46,0x43,0x01,0x50,0x49,0x51,  /* 00000220    "BUFC.PIQ" */
-    0x42,0x8C,0x42,0x55,0x46,0x43,0x01,0x50,  /* 00000228    "B.BUFC.P" */
-    0x49,0x51,0x43,0x8C,0x42,0x55,0x46,0x43,  /* 00000230    "IQC.BUFC" */
-    0x01,0x50,0x49,0x51,0x44,0x5B,0x82,0x48,  /* 00000238    ".PIQD[.H" */
-    0x08,0x4C,0x4E,0x4B,0x41,0x08,0x5F,0x48,  /* 00000240    ".LNKA._H" */
-    0x49,0x44,0x0C,0x41,0xD0,0x0C,0x0F,0x08,  /* 00000248    "ID.A...." */
-    0x5F,0x55,0x49,0x44,0x01,0x14,0x1C,0x5F,  /* 00000250    "_UID..._" */
-    0x53,0x54,0x41,0x00,0x7B,0x50,0x49,0x52,  /* 00000258    "STA.{PIR" */
-    0x41,0x0A,0x80,0x60,0xA0,0x08,0x93,0x60,  /* 00000260    "A..`...`" */
-    0x0A,0x80,0xA4,0x0A,0x09,0xA1,0x04,0xA4,  /* 00000268    "........" */
-    0x0A,0x0B,0x14,0x0B,0x5F,0x50,0x52,0x53,  /* 00000270    "...._PRS" */
-    0x00,0xA4,0x42,0x55,0x46,0x41,0x14,0x11,  /* 00000278    "..BUFA.." */
-    0x5F,0x44,0x49,0x53,0x00,0x7D,0x50,0x49,  /* 00000280    "_DIS.}PI" */
-    0x52,0x41,0x0A,0x80,0x50,0x49,0x52,0x41,  /* 00000288    "RA..PIRA" */
-    0x14,0x1A,0x5F,0x43,0x52,0x53,0x00,0x7B,  /* 00000290    ".._CRS.{" */
-    0x50,0x49,0x52,0x42,0x0A,0x0F,0x60,0x79,  /* 00000298    "PIRB..`y" */
-    0x01,0x60,0x49,0x52,0x51,0x56,0xA4,0x42,  /* 000002A0    ".`IRQV.B" */
-    0x55,0x46,0x42,0x14,0x1B,0x5F,0x53,0x52,  /* 000002A8    "UFB.._SR" */
-    0x53,0x01,0x8B,0x68,0x01,0x49,0x52,0x51,  /* 000002B0    "S..h.IRQ" */
-    0x31,0x82,0x49,0x52,0x51,0x31,0x60,0x76,  /* 000002B8    "1.IRQ1`v" */
-    0x60,0x70,0x60,0x50,0x49,0x52,0x41,0x5B,  /* 000002C0    "`p`PIRA[" */
-    0x82,0x49,0x08,0x4C,0x4E,0x4B,0x42,0x08,  /* 000002C8    ".I.LNKB." */
-    0x5F,0x48,0x49,0x44,0x0C,0x41,0xD0,0x0C,  /* 000002D0    "_HID.A.." */
-    0x0F,0x08,0x5F,0x55,0x49,0x44,0x0A,0x02,  /* 000002D8    ".._UID.." */
-    0x14,0x1C,0x5F,0x53,0x54,0x41,0x00,0x7B,  /* 000002E0    ".._STA.{" */
-    0x50,0x49,0x52,0x42,0x0A,0x80,0x60,0xA0,  /* 000002E8    "PIRB..`." */
-    0x08,0x93,0x60,0x0A,0x80,0xA4,0x0A,0x09,  /* 000002F0    "..`....." */
-    0xA1,0x04,0xA4,0x0A,0x0B,0x14,0x0B,0x5F,  /* 000002F8    "......._" */
-    0x50,0x52,0x53,0x00,0xA4,0x42,0x55,0x46,  /* 00000300    "PRS..BUF" */
-    0x41,0x14,0x11,0x5F,0x44,0x49,0x53,0x00,  /* 00000308    "A.._DIS." */
-    0x7D,0x50,0x49,0x52,0x42,0x0A,0x80,0x50,  /* 00000310    "}PIRB..P" */
-    0x49,0x52,0x42,0x14,0x1A,0x5F,0x43,0x52,  /* 00000318    "IRB.._CR" */
-    0x53,0x00,0x7B,0x50,0x49,0x52,0x42,0x0A,  /* 00000320    "S.{PIRB." */
-    0x0F,0x60,0x79,0x01,0x60,0x49,0x52,0x51,  /* 00000328    ".`y.`IRQ" */
-    0x56,0xA4,0x42,0x55,0x46,0x42,0x14,0x1B,  /* 00000330    "V.BUFB.." */
-    0x5F,0x53,0x52,0x53,0x01,0x8B,0x68,0x01,  /* 00000338    "_SRS..h." */
-    0x49,0x52,0x51,0x31,0x82,0x49,0x52,0x51,  /* 00000340    "IRQ1.IRQ" */
-    0x31,0x60,0x76,0x60,0x70,0x60,0x50,0x49,  /* 00000348    "1`v`p`PI" */
-    0x52,0x42,0x5B,0x82,0x49,0x08,0x4C,0x4E,  /* 00000350    "RB[.I.LN" */
-    0x4B,0x43,0x08,0x5F,0x48,0x49,0x44,0x0C,  /* 00000358    "KC._HID." */
-    0x41,0xD0,0x0C,0x0F,0x08,0x5F,0x55,0x49,  /* 00000360    "A...._UI" */
-    0x44,0x0A,0x03,0x14,0x1C,0x5F,0x53,0x54,  /* 00000368    "D...._ST" */
-    0x41,0x00,0x7B,0x50,0x49,0x52,0x43,0x0A,  /* 00000370    "A.{PIRC." */
-    0x80,0x60,0xA0,0x08,0x93,0x60,0x0A,0x80,  /* 00000378    ".`...`.." */
-    0xA4,0x0A,0x09,0xA1,0x04,0xA4,0x0A,0x0B,  /* 00000380    "........" */
-    0x14,0x0B,0x5F,0x50,0x52,0x53,0x00,0xA4,  /* 00000388    ".._PRS.." */
-    0x42,0x55,0x46,0x41,0x14,0x11,0x5F,0x44,  /* 00000390    "BUFA.._D" */
-    0x49,0x53,0x00,0x7D,0x50,0x49,0x52,0x43,  /* 00000398    "IS.}PIRC" */
-    0x0A,0x80,0x50,0x49,0x52,0x43,0x14,0x1A,  /* 000003A0    "..PIRC.." */
-    0x5F,0x43,0x52,0x53,0x00,0x7B,0x50,0x49,  /* 000003A8    "_CRS.{PI" */
-    0x52,0x43,0x0A,0x0F,0x60,0x79,0x01,0x60,  /* 000003B0    "RC..`y.`" */
-    0x49,0x52,0x51,0x56,0xA4,0x42,0x55,0x46,  /* 000003B8    "IRQV.BUF" */
-    0x42,0x14,0x1B,0x5F,0x53,0x52,0x53,0x01,  /* 000003C0    "B.._SRS." */
-    0x8B,0x68,0x01,0x49,0x52,0x51,0x31,0x82,  /* 000003C8    ".h.IRQ1." */
-    0x49,0x52,0x51,0x31,0x60,0x76,0x60,0x70,  /* 000003D0    "IRQ1`v`p" */
-    0x60,0x50,0x49,0x52,0x43,0x5B,0x82,0x49,  /* 000003D8    "`PIRC[.I" */
-    0x08,0x4C,0x4E,0x4B,0x44,0x08,0x5F,0x48,  /* 000003E0    ".LNKD._H" */
-    0x49,0x44,0x0C,0x41,0xD0,0x0C,0x0F,0x08,  /* 000003E8    "ID.A...." */
-    0x5F,0x55,0x49,0x44,0x0A,0x04,0x14,0x1C,  /* 000003F0    "_UID...." */
-    0x5F,0x53,0x54,0x41,0x00,0x7B,0x50,0x49,  /* 000003F8    "_STA.{PI" */
-    0x52,0x44,0x0A,0x80,0x60,0xA0,0x08,0x93,  /* 00000400    "RD..`..." */
-    0x60,0x0A,0x80,0xA4,0x0A,0x09,0xA1,0x04,  /* 00000408    "`......." */
-    0xA4,0x0A,0x0B,0x14,0x0B,0x5F,0x50,0x52,  /* 00000410    "....._PR" */
-    0x53,0x00,0xA4,0x42,0x55,0x46,0x41,0x14,  /* 00000418    "S..BUFA." */
-    0x11,0x5F,0x44,0x49,0x53,0x00,0x7D,0x50,  /* 00000420    "._DIS.}P" */
-    0x49,0x52,0x44,0x0A,0x80,0x50,0x49,0x52,  /* 00000428    "IRD..PIR" */
-    0x44,0x14,0x1A,0x5F,0x43,0x52,0x53,0x00,  /* 00000430    "D.._CRS." */
-    0x7B,0x50,0x49,0x52,0x44,0x0A,0x0F,0x60,  /* 00000438    "{PIRD..`" */
-    0x79,0x01,0x60,0x49,0x52,0x51,0x56,0xA4,  /* 00000440    "y.`IRQV." */
-    0x42,0x55,0x46,0x42,0x14,0x1B,0x5F,0x53,  /* 00000448    "BUFB.._S" */
-    0x52,0x53,0x01,0x8B,0x68,0x01,0x49,0x52,  /* 00000450    "RS..h.IR" */
-    0x51,0x31,0x82,0x49,0x52,0x51,0x31,0x60,  /* 00000458    "Q1.IRQ1`" */
-    0x76,0x60,0x70,0x60,0x50,0x49,0x52,0x44,  /* 00000460    "v`p`PIRD" */
-    0x14,0x16,0x5F,0x50,0x52,0x54,0x00,0xA0,  /* 00000468    ".._PRT.." */
-    0x0A,0x50,0x49,0x43,0x44,0xA4,0x50,0x52,  /* 00000470    ".PICD.PR" */
-    0x54,0x41,0xA4,0x50,0x52,0x54,0x50,0x08,  /* 00000478    "TA.PRTP." */
-    0x50,0x52,0x54,0x50,0x12,0x43,0x0E,0x10,  /* 00000480    "PRTP.C.." */
-    0x12,0x0B,0x04,0x0B,0xFF,0xFF,0x00,0x4C,  /* 00000488    ".......L" */
-    0x4E,0x4B,0x41,0x00,0x12,0x0B,0x04,0x0B,  /* 00000490    "NKA....." */
-    0xFF,0xFF,0x01,0x4C,0x4E,0x4B,0x42,0x00,  /* 00000498    "...LNKB." */
-    0x12,0x0C,0x04,0x0B,0xFF,0xFF,0x0A,0x02,  /* 000004A0    "........" */
-    0x4C,0x4E,0x4B,0x43,0x00,0x12,0x0C,0x04,  /* 000004A8    "LNKC...." */
-    0x0B,0xFF,0xFF,0x0A,0x03,0x4C,0x4E,0x4B,  /* 000004B0    ".....LNK" */
-    0x44,0x00,0x12,0x0D,0x04,0x0C,0xFF,0xFF,  /* 000004B8    "D......." */
-    0x01,0x00,0x00,0x4C,0x4E,0x4B,0x42,0x00,  /* 000004C0    "...LNKB." */
-    0x12,0x0D,0x04,0x0C,0xFF,0xFF,0x01,0x00,  /* 000004C8    "........" */
-    0x01,0x4C,0x4E,0x4B,0x43,0x00,0x12,0x0E,  /* 000004D0    ".LNKC..." */
-    0x04,0x0C,0xFF,0xFF,0x01,0x00,0x0A,0x02,  /* 000004D8    "........" */
-    0x4C,0x4E,0x4B,0x44,0x00,0x12,0x0E,0x04,  /* 000004E0    "LNKD...." */
-    0x0C,0xFF,0xFF,0x01,0x00,0x0A,0x03,0x4C,  /* 000004E8    ".......L" */
-    0x4E,0x4B,0x41,0x00,0x12,0x0D,0x04,0x0C,  /* 000004F0    "NKA....." */
-    0xFF,0xFF,0x02,0x00,0x00,0x4C,0x4E,0x4B,  /* 000004F8    ".....LNK" */
-    0x43,0x00,0x12,0x0D,0x04,0x0C,0xFF,0xFF,  /* 00000500    "C......." */
-    0x02,0x00,0x01,0x4C,0x4E,0x4B,0x44,0x00,  /* 00000508    "...LNKD." */
-    0x12,0x0E,0x04,0x0C,0xFF,0xFF,0x02,0x00,  /* 00000510    "........" */
-    0x0A,0x02,0x4C,0x4E,0x4B,0x41,0x00,0x12,  /* 00000518    "..LNKA.." */
-    0x0E,0x04,0x0C,0xFF,0xFF,0x02,0x00,0x0A,  /* 00000520    "........" */
-    0x03,0x4C,0x4E,0x4B,0x42,0x00,0x12,0x0D,  /* 00000528    ".LNKB..." */
-    0x04,0x0C,0xFF,0xFF,0x03,0x00,0x00,0x4C,  /* 00000530    ".......L" */
-    0x4E,0x4B,0x44,0x00,0x12,0x0D,0x04,0x0C,  /* 00000538    "NKD....." */
-    0xFF,0xFF,0x03,0x00,0x01,0x4C,0x4E,0x4B,  /* 00000540    ".....LNK" */
-    0x41,0x00,0x12,0x0E,0x04,0x0C,0xFF,0xFF,  /* 00000548    "A......." */
-    0x03,0x00,0x0A,0x02,0x4C,0x4E,0x4B,0x42,  /* 00000550    "....LNKB" */
-    0x00,0x12,0x0E,0x04,0x0C,0xFF,0xFF,0x03,  /* 00000558    "........" */
-    0x00,0x0A,0x03,0x4C,0x4E,0x4B,0x43,0x00,  /* 00000560    "...LNKC." */
-    0x08,0x50,0x52,0x54,0x41,0x12,0x32,0x04,  /* 00000568    ".PRTA.2." */
-    0x12,0x0B,0x04,0x0C,0xFF,0xFF,0x01,0x00,  /* 00000570    "........" */
-    0x00,0x00,0x0A,0x05,0x12,0x0B,0x04,0x0C,  /* 00000578    "........" */
-    0xFF,0xFF,0x02,0x00,0x00,0x00,0x0A,0x07,  /* 00000580    "........" */
-    0x12,0x0B,0x04,0x0C,0xFF,0xFF,0x03,0x00,  /* 00000588    "........" */
-    0x00,0x00,0x0A,0x0A,0x12,0x0B,0x04,0x0C,  /* 00000590    "........" */
-    0xFF,0xFF,0x04,0x00,0x00,0x00,0x0A,0x0B,  /* 00000598    "........" */
-    0x5B,0x82,0x48,0x31,0x49,0x53,0x41,0x5F,  /* 000005A0    "[.H1ISA_" */
-    0x08,0x5F,0x41,0x44,0x52,0x00,0x5B,0x80,  /* 000005A8    "._ADR.[." */
-    0x50,0x49,0x52,0x51,0x02,0x0A,0x60,0x0A,  /* 000005B0    "PIRQ..`." */
-    0x04,0x10,0x2E,0x5C,0x00,0x5B,0x81,0x29,  /* 000005B8    "...\.[.)" */
-    0x5C,0x2F,0x04,0x5F,0x53,0x42,0x5F,0x50,  /* 000005C0    "\/._SB_P" */
-    0x43,0x49,0x30,0x49,0x53,0x41,0x5F,0x50,  /* 000005C8    "CI0ISA_P" */
-    0x49,0x52,0x51,0x01,0x50,0x49,0x52,0x41,  /* 000005D0    "IRQ.PIRA" */
-    0x08,0x50,0x49,0x52,0x42,0x08,0x50,0x49,  /* 000005D8    ".PIRB.PI" */
-    0x52,0x43,0x08,0x50,0x49,0x52,0x44,0x08,  /* 000005E0    "RC.PIRD." */
-    0x5B,0x82,0x46,0x0B,0x53,0x59,0x53,0x52,  /* 000005E8    "[.F.SYSR" */
-    0x08,0x5F,0x48,0x49,0x44,0x0C,0x41,0xD0,  /* 000005F0    "._HID.A." */
-    0x0C,0x02,0x08,0x5F,0x55,0x49,0x44,0x01,  /* 000005F8    "..._UID." */
-    0x08,0x43,0x52,0x53,0x5F,0x11,0x4E,0x08,  /* 00000600    ".CRS_.N." */
-    0x0A,0x8A,0x47,0x01,0x10,0x00,0x10,0x00,  /* 00000608    "..G....." */
-    0x00,0x10,0x47,0x01,0x22,0x00,0x22,0x00,  /* 00000610    "..G."."." */
-    0x00,0x0C,0x47,0x01,0x30,0x00,0x30,0x00,  /* 00000618    "..G.0.0." */
-    0x00,0x10,0x47,0x01,0x44,0x00,0x44,0x00,  /* 00000620    "..G.D.D." */
-    0x00,0x1C,0x47,0x01,0x62,0x00,0x62,0x00,  /* 00000628    "..G.b.b." */
-    0x00,0x02,0x47,0x01,0x65,0x00,0x65,0x00,  /* 00000630    "..G.e.e." */
-    0x00,0x0B,0x47,0x01,0x72,0x00,0x72,0x00,  /* 00000638    "..G.r.r." */
-    0x00,0x0E,0x47,0x01,0x80,0x00,0x80,0x00,  /* 00000640    "..G....." */
-    0x00,0x01,0x47,0x01,0x84,0x00,0x84,0x00,  /* 00000648    "..G....." */
-    0x00,0x03,0x47,0x01,0x88,0x00,0x88,0x00,  /* 00000650    "..G....." */
-    0x00,0x01,0x47,0x01,0x8C,0x00,0x8C,0x00,  /* 00000658    "..G....." */
-    0x00,0x03,0x47,0x01,0x90,0x00,0x90,0x00,  /* 00000660    "..G....." */
-    0x00,0x10,0x47,0x01,0xA2,0x00,0xA2,0x00,  /* 00000668    "..G....." */
-    0x00,0x1C,0x47,0x01,0xE0,0x00,0xE0,0x00,  /* 00000670    "..G....." */
-    0x00,0x10,0x47,0x01,0xA0,0x08,0xA0,0x08,  /* 00000678    "..G....." */
-    0x00,0x04,0x47,0x01,0xC0,0x0C,0xC0,0x0C,  /* 00000680    "..G....." */
-    0x00,0x10,0x47,0x01,0xD0,0x04,0xD0,0x04,  /* 00000688    "..G....." */
-    0x00,0x02,0x79,0x00,0x14,0x0B,0x5F,0x43,  /* 00000690    "..y..._C" */
-    0x52,0x53,0x00,0xA4,0x43,0x52,0x53,0x5F,  /* 00000698    "RS..CRS_" */
-    0x5B,0x82,0x2B,0x50,0x49,0x43,0x5F,0x08,  /* 000006A0    "[.+PIC_." */
-    0x5F,0x48,0x49,0x44,0x0B,0x41,0xD0,0x08,  /* 000006A8    "_HID.A.." */
-    0x5F,0x43,0x52,0x53,0x11,0x18,0x0A,0x15,  /* 000006B0    "_CRS...." */
-    0x47,0x01,0x20,0x00,0x20,0x00,0x01,0x02,  /* 000006B8    "G. . ..." */
-    0x47,0x01,0xA0,0x00,0xA0,0x00,0x01,0x02,  /* 000006C0    "G......." */
-    0x22,0x04,0x00,0x79,0x00,0x5B,0x82,0x47,  /* 000006C8    ""..y.[.G" */
-    0x05,0x44,0x4D,0x41,0x30,0x08,0x5F,0x48,  /* 000006D0    ".DMA0._H" */
-    0x49,0x44,0x0C,0x41,0xD0,0x02,0x00,0x08,  /* 000006D8    "ID.A...." */
-    0x5F,0x43,0x52,0x53,0x11,0x41,0x04,0x0A,  /* 000006E0    "_CRS.A.." */
-    0x3D,0x2A,0x10,0x04,0x47,0x01,0x00,0x00,  /* 000006E8    "=*..G..." */
-    0x00,0x00,0x00,0x10,0x47,0x01,0x81,0x00,  /* 000006F0    "....G..." */
-    0x81,0x00,0x00,0x03,0x47,0x01,0x87,0x00,  /* 000006F8    "....G..." */
-    0x87,0x00,0x00,0x01,0x47,0x01,0x89,0x00,  /* 00000700    "....G..." */
-    0x89,0x00,0x00,0x03,0x47,0x01,0x8F,0x00,  /* 00000708    "....G..." */
-    0x8F,0x00,0x00,0x01,0x47,0x01,0xC0,0x00,  /* 00000710    "....G..." */
-    0xC0,0x00,0x00,0x20,0x47,0x01,0x80,0x04,  /* 00000718    "... G..." */
-    0x80,0x04,0x00,0x10,0x79,0x00,0x5B,0x82,  /* 00000720    "....y.[." */
-    0x25,0x54,0x4D,0x52,0x5F,0x08,0x5F,0x48,  /* 00000728    "%TMR_._H" */
-    0x49,0x44,0x0C,0x41,0xD0,0x01,0x00,0x08,  /* 00000730    "ID.A...." */
-    0x5F,0x43,0x52,0x53,0x11,0x10,0x0A,0x0D,  /* 00000738    "_CRS...." */
-    0x47,0x01,0x40,0x00,0x40,0x00,0x00,0x04,  /* 00000740    "G.@.@..." */
-    0x22,0x01,0x00,0x79,0x00,0x5B,0x82,0x25,  /* 00000748    ""..y.[.%" */
-    0x52,0x54,0x43,0x5F,0x08,0x5F,0x48,0x49,  /* 00000750    "RTC_._HI" */
-    0x44,0x0C,0x41,0xD0,0x0B,0x00,0x08,0x5F,  /* 00000758    "D.A...._" */
-    0x43,0x52,0x53,0x11,0x10,0x0A,0x0D,0x47,  /* 00000760    "CRS....G" */
-    0x01,0x70,0x00,0x70,0x00,0x00,0x02,0x22,  /* 00000768    ".p.p..."" */
-    0x00,0x01,0x79,0x00,0x5B,0x82,0x22,0x53,  /* 00000770    "..y.[."S" */
-    0x50,0x4B,0x52,0x08,0x5F,0x48,0x49,0x44,  /* 00000778    "PKR._HID" */
-    0x0C,0x41,0xD0,0x08,0x00,0x08,0x5F,0x43,  /* 00000780    ".A...._C" */
-    0x52,0x53,0x11,0x0D,0x0A,0x0A,0x47,0x01,  /* 00000788    "RS....G." */
-    0x61,0x00,0x61,0x00,0x00,0x01,0x79,0x00,  /* 00000790    "a.a...y." */
-    0x5B,0x82,0x31,0x50,0x53,0x32,0x4D,0x08,  /* 00000798    "[.1PS2M." */
-    0x5F,0x48,0x49,0x44,0x0C,0x41,0xD0,0x0F,  /* 000007A0    "_HID.A.." */
-    0x13,0x08,0x5F,0x43,0x49,0x44,0x0C,0x41,  /* 000007A8    ".._CID.A" */
-    0xD0,0x0F,0x13,0x14,0x09,0x5F,0x53,0x54,  /* 000007B0    "....._ST" */
-    0x41,0x00,0xA4,0x0A,0x0F,0x08,0x5F,0x43,  /* 000007B8    "A....._C" */
-    0x52,0x53,0x11,0x08,0x0A,0x05,0x22,0x00,  /* 000007C0    "RS...."." */
-    0x10,0x79,0x00,0x5B,0x82,0x42,0x04,0x50,  /* 000007C8    ".y.[.B.P" */
-    0x53,0x32,0x4B,0x08,0x5F,0x48,0x49,0x44,  /* 000007D0    "S2K._HID" */
-    0x0C,0x41,0xD0,0x03,0x03,0x08,0x5F,0x43,  /* 000007D8    ".A...._C" */
-    0x49,0x44,0x0C,0x41,0xD0,0x03,0x0B,0x14,  /* 000007E0    "ID.A...." */
-    0x09,0x5F,0x53,0x54,0x41,0x00,0xA4,0x0A,  /* 000007E8    "._STA..." */
-    0x0F,0x08,0x5F,0x43,0x52,0x53,0x11,0x18,  /* 000007F0    ".._CRS.." */
-    0x0A,0x15,0x47,0x01,0x60,0x00,0x60,0x00,  /* 000007F8    "..G.`.`." */
-    0x00,0x01,0x47,0x01,0x64,0x00,0x64,0x00,  /* 00000800    "..G.d.d." */
-    0x00,0x01,0x22,0x02,0x00,0x79,0x00,0x5B,  /* 00000808    ".."..y.[" */
-    0x82,0x3A,0x46,0x44,0x43,0x30,0x08,0x5F,  /* 00000810    ".:FDC0._" */
-    0x48,0x49,0x44,0x0C,0x41,0xD0,0x07,0x00,  /* 00000818    "HID.A..." */
-    0x14,0x09,0x5F,0x53,0x54,0x41,0x00,0xA4,  /* 00000820    ".._STA.." */
-    0x0A,0x0F,0x08,0x5F,0x43,0x52,0x53,0x11,  /* 00000828    "..._CRS." */
-    0x1B,0x0A,0x18,0x47,0x01,0xF0,0x03,0xF0,  /* 00000830    "...G...." */
-    0x03,0x01,0x06,0x47,0x01,0xF7,0x03,0xF7,  /* 00000838    "...G...." */
-    0x03,0x01,0x01,0x22,0x40,0x00,0x2A,0x04,  /* 00000840    "..."@.*." */
-    0x00,0x79,0x00,0x5B,0x82,0x35,0x55,0x41,  /* 00000848    ".y.[.5UA" */
-    0x52,0x31,0x08,0x5F,0x48,0x49,0x44,0x0C,  /* 00000850    "R1._HID." */
-    0x41,0xD0,0x05,0x01,0x08,0x5F,0x55,0x49,  /* 00000858    "A...._UI" */
-    0x44,0x01,0x14,0x09,0x5F,0x53,0x54,0x41,  /* 00000860    "D..._STA" */
-    0x00,0xA4,0x0A,0x0F,0x08,0x5F,0x43,0x52,  /* 00000868    "....._CR" */
-    0x53,0x11,0x10,0x0A,0x0D,0x47,0x01,0xF8,  /* 00000870    "S....G.." */
-    0x03,0xF8,0x03,0x01,0x08,0x22,0x10,0x00,  /* 00000878    ".....".." */
-    0x79,0x00,0x5B,0x82,0x36,0x4C,0x54,0x50,  /* 00000880    "y.[.6LTP" */
-    0x31,0x08,0x5F,0x48,0x49,0x44,0x0C,0x41,  /* 00000888    "1._HID.A" */
-    0xD0,0x04,0x00,0x08,0x5F,0x55,0x49,0x44,  /* 00000890    "...._UID" */
-    0x0A,0x02,0x14,0x09,0x5F,0x53,0x54,0x41,  /* 00000898    "...._STA" */
-    0x00,0xA4,0x0A,0x0F,0x08,0x5F,0x43,0x52,  /* 000008A0    "....._CR" */
-    0x53,0x11,0x10,0x0A,0x0D,0x47,0x01,0x78,  /* 000008A8    "S....G.x" */
-    0x03,0x78,0x03,0x08,0x08,0x22,0x80,0x00,  /* 000008B0    ".x...".." */
+    0x00,0x00,0xF0,0xFF,0xFF,0xFF,0xF4,0x00,  /* 000001B0    "........" */
+    0x00,0x00,0x00,0x00,0x00,0x00,0x05,0x79,  /* 000001B8    ".......y" */
+    0x00,0xA4,0x50,0x52,0x54,0x30,0x08,0x42,  /* 000001C0    "..PRT0.B" */
+    0x55,0x46,0x41,0x11,0x09,0x0A,0x06,0x23,  /* 000001C8    "UFA....#" */
+    0xF8,0xDC,0x18,0x79,0x00,0x08,0x42,0x55,  /* 000001D0    "...y..BU" */
+    0x46,0x42,0x11,0x09,0x0A,0x06,0x23,0x00,  /* 000001D8    "FB....#." */
+    0x00,0x18,0x79,0x00,0x8B,0x42,0x55,0x46,  /* 000001E0    "..y..BUF" */
+    0x42,0x01,0x49,0x52,0x51,0x56,0x08,0x42,  /* 000001E8    "B.IRQV.B" */
+    0x55,0x46,0x43,0x11,0x07,0x0A,0x04,0x05,  /* 000001F0    "UFC....." */
+    0x07,0x0A,0x0B,0x8C,0x42,0x55,0x46,0x43,  /* 000001F8    "....BUFC" */
+    0x01,0x50,0x49,0x51,0x41,0x8C,0x42,0x55,  /* 00000200    ".PIQA.BU" */
+    0x46,0x43,0x01,0x50,0x49,0x51,0x42,0x8C,  /* 00000208    "FC.PIQB." */
+    0x42,0x55,0x46,0x43,0x01,0x50,0x49,0x51,  /* 00000210    "BUFC.PIQ" */
+    0x43,0x8C,0x42,0x55,0x46,0x43,0x01,0x50,  /* 00000218    "C.BUFC.P" */
+    0x49,0x51,0x44,0x5B,0x82,0x48,0x08,0x4C,  /* 00000220    "IQD[.H.L" */
+    0x4E,0x4B,0x41,0x08,0x5F,0x48,0x49,0x44,  /* 00000228    "NKA._HID" */
+    0x0C,0x41,0xD0,0x0C,0x0F,0x08,0x5F,0x55,  /* 00000230    ".A...._U" */
+    0x49,0x44,0x01,0x14,0x1C,0x5F,0x53,0x54,  /* 00000238    "ID..._ST" */
+    0x41,0x00,0x7B,0x50,0x49,0x52,0x41,0x0A,  /* 00000240    "A.{PIRA." */
+    0x80,0x60,0xA0,0x08,0x93,0x60,0x0A,0x80,  /* 00000248    ".`...`.." */
+    0xA4,0x0A,0x09,0xA1,0x04,0xA4,0x0A,0x0B,  /* 00000250    "........" */
+    0x14,0x0B,0x5F,0x50,0x52,0x53,0x00,0xA4,  /* 00000258    ".._PRS.." */
+    0x42,0x55,0x46,0x41,0x14,0x11,0x5F,0x44,  /* 00000260    "BUFA.._D" */
+    0x49,0x53,0x00,0x7D,0x50,0x49,0x52,0x41,  /* 00000268    "IS.}PIRA" */
+    0x0A,0x80,0x50,0x49,0x52,0x41,0x14,0x1A,  /* 00000270    "..PIRA.." */
+    0x5F,0x43,0x52,0x53,0x00,0x7B,0x50,0x49,  /* 00000278    "_CRS.{PI" */
+    0x52,0x42,0x0A,0x0F,0x60,0x79,0x01,0x60,  /* 00000280    "RB..`y.`" */
+    0x49,0x52,0x51,0x56,0xA4,0x42,0x55,0x46,  /* 00000288    "IRQV.BUF" */
+    0x42,0x14,0x1B,0x5F,0x53,0x52,0x53,0x01,  /* 00000290    "B.._SRS." */
+    0x8B,0x68,0x01,0x49,0x52,0x51,0x31,0x82,  /* 00000298    ".h.IRQ1." */
+    0x49,0x52,0x51,0x31,0x60,0x76,0x60,0x70,  /* 000002A0    "IRQ1`v`p" */
+    0x60,0x50,0x49,0x52,0x41,0x5B,0x82,0x49,  /* 000002A8    "`PIRA[.I" */
+    0x08,0x4C,0x4E,0x4B,0x42,0x08,0x5F,0x48,  /* 000002B0    ".LNKB._H" */
+    0x49,0x44,0x0C,0x41,0xD0,0x0C,0x0F,0x08,  /* 000002B8    "ID.A...." */
+    0x5F,0x55,0x49,0x44,0x0A,0x02,0x14,0x1C,  /* 000002C0    "_UID...." */
+    0x5F,0x53,0x54,0x41,0x00,0x7B,0x50,0x49,  /* 000002C8    "_STA.{PI" */
+    0x52,0x42,0x0A,0x80,0x60,0xA0,0x08,0x93,  /* 000002D0    "RB..`..." */
+    0x60,0x0A,0x80,0xA4,0x0A,0x09,0xA1,0x04,  /* 000002D8    "`......." */
+    0xA4,0x0A,0x0B,0x14,0x0B,0x5F,0x50,0x52,  /* 000002E0    "....._PR" */
+    0x53,0x00,0xA4,0x42,0x55,0x46,0x41,0x14,  /* 000002E8    "S..BUFA." */
+    0x11,0x5F,0x44,0x49,0x53,0x00,0x7D,0x50,  /* 000002F0    "._DIS.}P" */
+    0x49,0x52,0x42,0x0A,0x80,0x50,0x49,0x52,  /* 000002F8    "IRB..PIR" */
+    0x42,0x14,0x1A,0x5F,0x43,0x52,0x53,0x00,  /* 00000300    "B.._CRS." */
+    0x7B,0x50,0x49,0x52,0x42,0x0A,0x0F,0x60,  /* 00000308    "{PIRB..`" */
+    0x79,0x01,0x60,0x49,0x52,0x51,0x56,0xA4,  /* 00000310    "y.`IRQV." */
+    0x42,0x55,0x46,0x42,0x14,0x1B,0x5F,0x53,  /* 00000318    "BUFB.._S" */
+    0x52,0x53,0x01,0x8B,0x68,0x01,0x49,0x52,  /* 00000320    "RS..h.IR" */
+    0x51,0x31,0x82,0x49,0x52,0x51,0x31,0x60,  /* 00000328    "Q1.IRQ1`" */
+    0x76,0x60,0x70,0x60,0x50,0x49,0x52,0x42,  /* 00000330    "v`p`PIRB" */
+    0x5B,0x82,0x49,0x08,0x4C,0x4E,0x4B,0x43,  /* 00000338    "[.I.LNKC" */
+    0x08,0x5F,0x48,0x49,0x44,0x0C,0x41,0xD0,  /* 00000340    "._HID.A." */
+    0x0C,0x0F,0x08,0x5F,0x55,0x49,0x44,0x0A,  /* 00000348    "..._UID." */
+    0x03,0x14,0x1C,0x5F,0x53,0x54,0x41,0x00,  /* 00000350    "..._STA." */
+    0x7B,0x50,0x49,0x52,0x43,0x0A,0x80,0x60,  /* 00000358    "{PIRC..`" */
+    0xA0,0x08,0x93,0x60,0x0A,0x80,0xA4,0x0A,  /* 00000360    "...`...." */
+    0x09,0xA1,0x04,0xA4,0x0A,0x0B,0x14,0x0B,  /* 00000368    "........" */
+    0x5F,0x50,0x52,0x53,0x00,0xA4,0x42,0x55,  /* 00000370    "_PRS..BU" */
+    0x46,0x41,0x14,0x11,0x5F,0x44,0x49,0x53,  /* 00000378    "FA.._DIS" */
+    0x00,0x7D,0x50,0x49,0x52,0x43,0x0A,0x80,  /* 00000380    ".}PIRC.." */
+    0x50,0x49,0x52,0x43,0x14,0x1A,0x5F,0x43,  /* 00000388    "PIRC.._C" */
+    0x52,0x53,0x00,0x7B,0x50,0x49,0x52,0x43,  /* 00000390    "RS.{PIRC" */
+    0x0A,0x0F,0x60,0x79,0x01,0x60,0x49,0x52,  /* 00000398    "..`y.`IR" */
+    0x51,0x56,0xA4,0x42,0x55,0x46,0x42,0x14,  /* 000003A0    "QV.BUFB." */
+    0x1B,0x5F,0x53,0x52,0x53,0x01,0x8B,0x68,  /* 000003A8    "._SRS..h" */
+    0x01,0x49,0x52,0x51,0x31,0x82,0x49,0x52,  /* 000003B0    ".IRQ1.IR" */
+    0x51,0x31,0x60,0x76,0x60,0x70,0x60,0x50,  /* 000003B8    "Q1`v`p`P" */
+    0x49,0x52,0x43,0x5B,0x82,0x49,0x08,0x4C,  /* 000003C0    "IRC[.I.L" */
+    0x4E,0x4B,0x44,0x08,0x5F,0x48,0x49,0x44,  /* 000003C8    "NKD._HID" */
+    0x0C,0x41,0xD0,0x0C,0x0F,0x08,0x5F,0x55,  /* 000003D0    ".A...._U" */
+    0x49,0x44,0x0A,0x04,0x14,0x1C,0x5F,0x53,  /* 000003D8    "ID...._S" */
+    0x54,0x41,0x00,0x7B,0x50,0x49,0x52,0x44,  /* 000003E0    "TA.{PIRD" */
+    0x0A,0x80,0x60,0xA0,0x08,0x93,0x60,0x0A,  /* 000003E8    "..`...`." */
+    0x80,0xA4,0x0A,0x09,0xA1,0x04,0xA4,0x0A,  /* 000003F0    "........" */
+    0x0B,0x14,0x0B,0x5F,0x50,0x52,0x53,0x00,  /* 000003F8    "..._PRS." */
+    0xA4,0x42,0x55,0x46,0x41,0x14,0x11,0x5F,  /* 00000400    ".BUFA.._" */
+    0x44,0x49,0x53,0x00,0x7D,0x50,0x49,0x52,  /* 00000408    "DIS.}PIR" */
+    0x44,0x0A,0x80,0x50,0x49,0x52,0x44,0x14,  /* 00000410    "D..PIRD." */
+    0x1A,0x5F,0x43,0x52,0x53,0x00,0x7B,0x50,  /* 00000418    "._CRS.{P" */
+    0x49,0x52,0x44,0x0A,0x0F,0x60,0x79,0x01,  /* 00000420    "IRD..`y." */
+    0x60,0x49,0x52,0x51,0x56,0xA4,0x42,0x55,  /* 00000428    "`IRQV.BU" */
+    0x46,0x42,0x14,0x1B,0x5F,0x53,0x52,0x53,  /* 00000430    "FB.._SRS" */
+    0x01,0x8B,0x68,0x01,0x49,0x52,0x51,0x31,  /* 00000438    "..h.IRQ1" */
+    0x82,0x49,0x52,0x51,0x31,0x60,0x76,0x60,  /* 00000440    ".IRQ1`v`" */
+    0x70,0x60,0x50,0x49,0x52,0x44,0x14,0x16,  /* 00000448    "p`PIRD.." */
+    0x5F,0x50,0x52,0x54,0x00,0xA0,0x0A,0x50,  /* 00000450    "_PRT...P" */
+    0x49,0x43,0x44,0xA4,0x50,0x52,0x54,0x41,  /* 00000458    "ICD.PRTA" */
+    0xA4,0x50,0x52,0x54,0x50,0x08,0x50,0x52,  /* 00000460    ".PRTP.PR" */
+    0x54,0x50,0x12,0x4D,0x11,0x14,0x12,0x0B,  /* 00000468    "TP.M...." */
+    0x04,0x0B,0xFF,0xFF,0x00,0x4C,0x4E,0x4B,  /* 00000470    ".....LNK" */
+    0x41,0x00,0x12,0x0B,0x04,0x0B,0xFF,0xFF,  /* 00000478    "A......." */
+    0x01,0x4C,0x4E,0x4B,0x42,0x00,0x12,0x0C,  /* 00000480    ".LNKB..." */
+    0x04,0x0B,0xFF,0xFF,0x0A,0x02,0x4C,0x4E,  /* 00000488    "......LN" */
+    0x4B,0x43,0x00,0x12,0x0C,0x04,0x0B,0xFF,  /* 00000490    "KC......" */
+    0xFF,0x0A,0x03,0x4C,0x4E,0x4B,0x44,0x00,  /* 00000498    "...LNKD." */
+    0x12,0x0D,0x04,0x0C,0xFF,0xFF,0x01,0x00,  /* 000004A0    "........" */
+    0x00,0x4C,0x4E,0x4B,0x42,0x00,0x12,0x0D,  /* 000004A8    ".LNKB..." */
+    0x04,0x0C,0xFF,0xFF,0x01,0x00,0x01,0x4C,  /* 000004B0    ".......L" */
+    0x4E,0x4B,0x43,0x00,0x12,0x0E,0x04,0x0C,  /* 000004B8    "NKC....." */
+    0xFF,0xFF,0x01,0x00,0x0A,0x02,0x4C,0x4E,  /* 000004C0    "......LN" */
+    0x4B,0x44,0x00,0x12,0x0E,0x04,0x0C,0xFF,  /* 000004C8    "KD......" */
+    0xFF,0x01,0x00,0x0A,0x03,0x4C,0x4E,0x4B,  /* 000004D0    ".....LNK" */
+    0x41,0x00,0x12,0x0D,0x04,0x0C,0xFF,0xFF,  /* 000004D8    "A......." */
+    0x02,0x00,0x00,0x4C,0x4E,0x4B,0x43,0x00,  /* 000004E0    "...LNKC." */
+    0x12,0x0D,0x04,0x0C,0xFF,0xFF,0x02,0x00,  /* 000004E8    "........" */
+    0x01,0x4C,0x4E,0x4B,0x44,0x00,0x12,0x0E,  /* 000004F0    ".LNKD..." */
+    0x04,0x0C,0xFF,0xFF,0x02,0x00,0x0A,0x02,  /* 000004F8    "........" */
+    0x4C,0x4E,0x4B,0x41,0x00,0x12,0x0E,0x04,  /* 00000500    "LNKA...." */
+    0x0C,0xFF,0xFF,0x02,0x00,0x0A,0x03,0x4C,  /* 00000508    ".......L" */
+    0x4E,0x4B,0x42,0x00,0x12,0x0D,0x04,0x0C,  /* 00000510    "NKB....." */
+    0xFF,0xFF,0x03,0x00,0x00,0x4C,0x4E,0x4B,  /* 00000518    ".....LNK" */
+    0x44,0x00,0x12,0x0D,0x04,0x0C,0xFF,0xFF,  /* 00000520    "D......." */
+    0x03,0x00,0x01,0x4C,0x4E,0x4B,0x41,0x00,  /* 00000528    "...LNKA." */
+    0x12,0x0E,0x04,0x0C,0xFF,0xFF,0x03,0x00,  /* 00000530    "........" */
+    0x0A,0x02,0x4C,0x4E,0x4B,0x42,0x00,0x12,  /* 00000538    "..LNKB.." */
+    0x0E,0x04,0x0C,0xFF,0xFF,0x03,0x00,0x0A,  /* 00000540    "........" */
+    0x03,0x4C,0x4E,0x4B,0x43,0x00,0x12,0x0D,  /* 00000548    ".LNKC..." */
+    0x04,0x0C,0xFF,0xFF,0x04,0x00,0x00,0x4C,  /* 00000550    ".......L" */
+    0x4E,0x4B,0x41,0x00,0x12,0x0D,0x04,0x0C,  /* 00000558    "NKA....." */
+    0xFF,0xFF,0x04,0x00,0x01,0x4C,0x4E,0x4B,  /* 00000560    ".....LNK" */
+    0x42,0x00,0x12,0x0E,0x04,0x0C,0xFF,0xFF,  /* 00000568    "B......." */
+    0x04,0x00,0x0A,0x02,0x4C,0x4E,0x4B,0x43,  /* 00000570    "....LNKC" */
+    0x00,0x12,0x0E,0x04,0x0C,0xFF,0xFF,0x04,  /* 00000578    "........" */
+    0x00,0x0A,0x03,0x4C,0x4E,0x4B,0x44,0x00,  /* 00000580    "...LNKD." */
+    0x08,0x50,0x52,0x54,0x41,0x12,0x32,0x04,  /* 00000588    ".PRTA.2." */
+    0x12,0x0B,0x04,0x0C,0xFF,0xFF,0x01,0x00,  /* 00000590    "........" */
+    0x00,0x00,0x0A,0x05,0x12,0x0B,0x04,0x0C,  /* 00000598    "........" */
+    0xFF,0xFF,0x02,0x00,0x00,0x00,0x0A,0x07,  /* 000005A0    "........" */
+    0x12,0x0B,0x04,0x0C,0xFF,0xFF,0x03,0x00,  /* 000005A8    "........" */
+    0x00,0x00,0x0A,0x0A,0x12,0x0B,0x04,0x0C,  /* 000005B0    "........" */
+    0xFF,0xFF,0x04,0x00,0x00,0x00,0x0A,0x0B,  /* 000005B8    "........" */
+    0x5B,0x82,0x48,0x31,0x49,0x53,0x41,0x5F,  /* 000005C0    "[.H1ISA_" */
+    0x08,0x5F,0x41,0x44,0x52,0x00,0x5B,0x80,  /* 000005C8    "._ADR.[." */
+    0x50,0x49,0x52,0x51,0x02,0x0A,0x60,0x0A,  /* 000005D0    "PIRQ..`." */
+    0x04,0x10,0x2E,0x5C,0x00,0x5B,0x81,0x29,  /* 000005D8    "...\.[.)" */
+    0x5C,0x2F,0x04,0x5F,0x53,0x42,0x5F,0x50,  /* 000005E0    "\/._SB_P" */
+    0x43,0x49,0x30,0x49,0x53,0x41,0x5F,0x50,  /* 000005E8    "CI0ISA_P" */
+    0x49,0x52,0x51,0x01,0x50,0x49,0x52,0x41,  /* 000005F0    "IRQ.PIRA" */
+    0x08,0x50,0x49,0x52,0x42,0x08,0x50,0x49,  /* 000005F8    ".PIRB.PI" */
+    0x52,0x43,0x08,0x50,0x49,0x52,0x44,0x08,  /* 00000600    "RC.PIRD." */
+    0x5B,0x82,0x46,0x0B,0x53,0x59,0x53,0x52,  /* 00000608    "[.F.SYSR" */
+    0x08,0x5F,0x48,0x49,0x44,0x0C,0x41,0xD0,  /* 00000610    "._HID.A." */
+    0x0C,0x02,0x08,0x5F,0x55,0x49,0x44,0x01,  /* 00000618    "..._UID." */
+    0x08,0x43,0x52,0x53,0x5F,0x11,0x4E,0x08,  /* 00000620    ".CRS_.N." */
+    0x0A,0x8A,0x47,0x01,0x10,0x00,0x10,0x00,  /* 00000628    "..G....." */
+    0x00,0x10,0x47,0x01,0x22,0x00,0x22,0x00,  /* 00000630    "..G."."." */
+    0x00,0x0C,0x47,0x01,0x30,0x00,0x30,0x00,  /* 00000638    "..G.0.0." */
+    0x00,0x10,0x47,0x01,0x44,0x00,0x44,0x00,  /* 00000640    "..G.D.D." */
+    0x00,0x1C,0x47,0x01,0x62,0x00,0x62,0x00,  /* 00000648    "..G.b.b." */
+    0x00,0x02,0x47,0x01,0x65,0x00,0x65,0x00,  /* 00000650    "..G.e.e." */
+    0x00,0x0B,0x47,0x01,0x72,0x00,0x72,0x00,  /* 00000658    "..G.r.r." */
+    0x00,0x0E,0x47,0x01,0x80,0x00,0x80,0x00,  /* 00000660    "..G....." */
+    0x00,0x01,0x47,0x01,0x84,0x00,0x84,0x00,  /* 00000668    "..G....." */
+    0x00,0x03,0x47,0x01,0x88,0x00,0x88,0x00,  /* 00000670    "..G....." */
+    0x00,0x01,0x47,0x01,0x8C,0x00,0x8C,0x00,  /* 00000678    "..G....." */
+    0x00,0x03,0x47,0x01,0x90,0x00,0x90,0x00,  /* 00000680    "..G....." */
+    0x00,0x10,0x47,0x01,0xA2,0x00,0xA2,0x00,  /* 00000688    "..G....." */
+    0x00,0x1C,0x47,0x01,0xE0,0x00,0xE0,0x00,  /* 00000690    "..G....." */
+    0x00,0x10,0x47,0x01,0xA0,0x08,0xA0,0x08,  /* 00000698    "..G....." */
+    0x00,0x04,0x47,0x01,0xC0,0x0C,0xC0,0x0C,  /* 000006A0    "..G....." */
+    0x00,0x10,0x47,0x01,0xD0,0x04,0xD0,0x04,  /* 000006A8    "..G....." */
+    0x00,0x02,0x79,0x00,0x14,0x0B,0x5F,0x43,  /* 000006B0    "..y..._C" */
+    0x52,0x53,0x00,0xA4,0x43,0x52,0x53,0x5F,  /* 000006B8    "RS..CRS_" */
+    0x5B,0x82,0x2B,0x50,0x49,0x43,0x5F,0x08,  /* 000006C0    "[.+PIC_." */
+    0x5F,0x48,0x49,0x44,0x0B,0x41,0xD0,0x08,  /* 000006C8    "_HID.A.." */
+    0x5F,0x43,0x52,0x53,0x11,0x18,0x0A,0x15,  /* 000006D0    "_CRS...." */
+    0x47,0x01,0x20,0x00,0x20,0x00,0x01,0x02,  /* 000006D8    "G. . ..." */
+    0x47,0x01,0xA0,0x00,0xA0,0x00,0x01,0x02,  /* 000006E0    "G......." */
+    0x22,0x04,0x00,0x79,0x00,0x5B,0x82,0x47,  /* 000006E8    ""..y.[.G" */
+    0x05,0x44,0x4D,0x41,0x30,0x08,0x5F,0x48,  /* 000006F0    ".DMA0._H" */
+    0x49,0x44,0x0C,0x41,0xD0,0x02,0x00,0x08,  /* 000006F8    "ID.A...." */
+    0x5F,0x43,0x52,0x53,0x11,0x41,0x04,0x0A,  /* 00000700    "_CRS.A.." */
+    0x3D,0x2A,0x10,0x04,0x47,0x01,0x00,0x00,  /* 00000708    "=*..G..." */
+    0x00,0x00,0x00,0x10,0x47,0x01,0x81,0x00,  /* 00000710    "....G..." */
+    0x81,0x00,0x00,0x03,0x47,0x01,0x87,0x00,  /* 00000718    "....G..." */
+    0x87,0x00,0x00,0x01,0x47,0x01,0x89,0x00,  /* 00000720    "....G..." */
+    0x89,0x00,0x00,0x03,0x47,0x01,0x8F,0x00,  /* 00000728    "....G..." */
+    0x8F,0x00,0x00,0x01,0x47,0x01,0xC0,0x00,  /* 00000730    "....G..." */
+    0xC0,0x00,0x00,0x20,0x47,0x01,0x80,0x04,  /* 00000738    "... G..." */
+    0x80,0x04,0x00,0x10,0x79,0x00,0x5B,0x82,  /* 00000740    "....y.[." */
+    0x25,0x54,0x4D,0x52,0x5F,0x08,0x5F,0x48,  /* 00000748    "%TMR_._H" */
+    0x49,0x44,0x0C,0x41,0xD0,0x01,0x00,0x08,  /* 00000750    "ID.A...." */
+    0x5F,0x43,0x52,0x53,0x11,0x10,0x0A,0x0D,  /* 00000758    "_CRS...." */
+    0x47,0x01,0x40,0x00,0x40,0x00,0x00,0x04,  /* 00000760    "G.@.@..." */
+    0x22,0x01,0x00,0x79,0x00,0x5B,0x82,0x25,  /* 00000768    ""..y.[.%" */
+    0x52,0x54,0x43,0x5F,0x08,0x5F,0x48,0x49,  /* 00000770    "RTC_._HI" */
+    0x44,0x0C,0x41,0xD0,0x0B,0x00,0x08,0x5F,  /* 00000778    "D.A...._" */
+    0x43,0x52,0x53,0x11,0x10,0x0A,0x0D,0x47,  /* 00000780    "CRS....G" */
+    0x01,0x70,0x00,0x70,0x00,0x00,0x02,0x22,  /* 00000788    ".p.p..."" */
+    0x00,0x01,0x79,0x00,0x5B,0x82,0x22,0x53,  /* 00000790    "..y.[."S" */
+    0x50,0x4B,0x52,0x08,0x5F,0x48,0x49,0x44,  /* 00000798    "PKR._HID" */
+    0x0C,0x41,0xD0,0x08,0x00,0x08,0x5F,0x43,  /* 000007A0    ".A...._C" */
+    0x52,0x53,0x11,0x0D,0x0A,0x0A,0x47,0x01,  /* 000007A8    "RS....G." */
+    0x61,0x00,0x61,0x00,0x00,0x01,0x79,0x00,  /* 000007B0    "a.a...y." */
+    0x5B,0x82,0x31,0x50,0x53,0x32,0x4D,0x08,  /* 000007B8    "[.1PS2M." */
+    0x5F,0x48,0x49,0x44,0x0C,0x41,0xD0,0x0F,  /* 000007C0    "_HID.A.." */
+    0x13,0x08,0x5F,0x43,0x49,0x44,0x0C,0x41,  /* 000007C8    ".._CID.A" */
+    0xD0,0x0F,0x13,0x14,0x09,0x5F,0x53,0x54,  /* 000007D0    "....._ST" */
+    0x41,0x00,0xA4,0x0A,0x0F,0x08,0x5F,0x43,  /* 000007D8    "A....._C" */
+    0x52,0x53,0x11,0x08,0x0A,0x05,0x22,0x00,  /* 000007E0    "RS...."." */
+    0x10,0x79,0x00,0x5B,0x82,0x42,0x04,0x50,  /* 000007E8    ".y.[.B.P" */
+    0x53,0x32,0x4B,0x08,0x5F,0x48,0x49,0x44,  /* 000007F0    "S2K._HID" */
+    0x0C,0x41,0xD0,0x03,0x03,0x08,0x5F,0x43,  /* 000007F8    ".A...._C" */
+    0x49,0x44,0x0C,0x41,0xD0,0x03,0x0B,0x14,  /* 00000800    "ID.A...." */
+    0x09,0x5F,0x53,0x54,0x41,0x00,0xA4,0x0A,  /* 00000808    "._STA..." */
+    0x0F,0x08,0x5F,0x43,0x52,0x53,0x11,0x18,  /* 00000810    ".._CRS.." */
+    0x0A,0x15,0x47,0x01,0x60,0x00,0x60,0x00,  /* 00000818    "..G.`.`." */
+    0x00,0x01,0x47,0x01,0x64,0x00,0x64,0x00,  /* 00000820    "..G.d.d." */
+    0x00,0x01,0x22,0x02,0x00,0x79,0x00,0x5B,  /* 00000828    ".."..y.[" */
+    0x82,0x3A,0x46,0x44,0x43,0x30,0x08,0x5F,  /* 00000830    ".:FDC0._" */
+    0x48,0x49,0x44,0x0C,0x41,0xD0,0x07,0x00,  /* 00000838    "HID.A..." */
+    0x14,0x09,0x5F,0x53,0x54,0x41,0x00,0xA4,  /* 00000840    ".._STA.." */
+    0x0A,0x0F,0x08,0x5F,0x43,0x52,0x53,0x11,  /* 00000848    "..._CRS." */
+    0x1B,0x0A,0x18,0x47,0x01,0xF0,0x03,0xF0,  /* 00000850    "...G...." */
+    0x03,0x01,0x06,0x47,0x01,0xF7,0x03,0xF7,  /* 00000858    "...G...." */
+    0x03,0x01,0x01,0x22,0x40,0x00,0x2A,0x04,  /* 00000860    "..."@.*." */
+    0x00,0x79,0x00,0x5B,0x82,0x35,0x55,0x41,  /* 00000868    ".y.[.5UA" */
+    0x52,0x31,0x08,0x5F,0x48,0x49,0x44,0x0C,  /* 00000870    "R1._HID." */
+    0x41,0xD0,0x05,0x01,0x08,0x5F,0x55,0x49,  /* 00000878    "A...._UI" */
+    0x44,0x01,0x14,0x09,0x5F,0x53,0x54,0x41,  /* 00000880    "D..._STA" */
+    0x00,0xA4,0x0A,0x0F,0x08,0x5F,0x43,0x52,  /* 00000888    "....._CR" */
+    0x53,0x11,0x10,0x0A,0x0D,0x47,0x01,0xF8,  /* 00000890    "S....G.." */
+    0x03,0xF8,0x03,0x01,0x08,0x22,0x10,0x00,  /* 00000898    ".....".." */
+    0x79,0x00,0x5B,0x82,0x36,0x4C,0x54,0x50,  /* 000008A0    "y.[.6LTP" */
+    0x31,0x08,0x5F,0x48,0x49,0x44,0x0C,0x41,  /* 000008A8    "1._HID.A" */
+    0xD0,0x04,0x00,0x08,0x5F,0x55,0x49,0x44,  /* 000008B0    "...._UID" */
+    0x0A,0x02,0x14,0x09,0x5F,0x53,0x54,0x41,  /* 000008B8    "...._STA" */
+    0x00,0xA4,0x0A,0x0F,0x08,0x5F,0x43,0x52,  /* 000008C0    "....._CR" */
+    0x53,0x11,0x10,0x0A,0x0D,0x47,0x01,0x78,  /* 000008C8    "S....G.x" */
+    0x03,0x78,0x03,0x08,0x08,0x22,0x80,0x00,  /* 000008D0    ".x...".." */
     0x79,0x00,
 };
 int DsdtLen=sizeof(AmlCode);
diff -r 5176c3ea3293 -r b725c9e51a7c tools/firmware/hvmloader/smbios.c
--- a/tools/firmware/hvmloader/smbios.c Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/firmware/hvmloader/smbios.c Sat Oct 14 13:28:45 2006 -0600
@@ -92,7 +92,6 @@ write_smbios_tables(void *start,
        unsigned cpu_num, nr_structs = 0, max_struct_size = 0;
        char *p, *q;
        char cpu_manufacturer[15];
-       size_t structure_table_length;
 
        get_cpu_manufacturer(cpu_manufacturer, 15);
 
diff -r 5176c3ea3293 -r b725c9e51a7c tools/ioemu/vl.c
--- a/tools/ioemu/vl.c  Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/ioemu/vl.c  Sat Oct 14 13:28:45 2006 -0600
@@ -122,6 +122,7 @@ int nographic;
 int nographic;
 int vncviewer;
 int vncunused;
+struct sockaddr_in vnclisten_addr;
 const char* keyboard_layout = NULL;
 int64_t ticks_per_sec;
 char *boot_device = NULL;
@@ -2783,10 +2784,22 @@ fail:
     return -1;
 }
 
+int parse_host(struct sockaddr_in *saddr, const char *buf)
+{
+    struct hostent *he;
+
+    if ((he = gethostbyname(buf)) != NULL) {
+        saddr->sin_addr = *(struct in_addr *)he->h_addr;
+    } else {
+        if (!inet_aton(buf, &saddr->sin_addr))
+            return -1;
+    }
+    return 0;
+}
+
 int parse_host_port(struct sockaddr_in *saddr, const char *str)
 {
     char buf[512];
-    struct hostent *he;
     const char *p, *r;
     int port;
 
@@ -2797,14 +2810,8 @@ int parse_host_port(struct sockaddr_in *
     if (buf[0] == '\0') {
         saddr->sin_addr.s_addr = 0;
     } else {
-        if (isdigit(buf[0])) {
-            if (!inet_aton(buf, &saddr->sin_addr))
-                return -1;
-        } else {
-            if ((he = gethostbyname(buf)) == NULL)
-                return - 1;
-            saddr->sin_addr = *(struct in_addr *)he->h_addr;
-        }
+        if (parse_host(saddr, buf) == -1)
+            return -1;
     }
     port = strtol(p, (char **)&r, 0);
     if (r == p)
@@ -5352,6 +5359,7 @@ void help(void)
           "-vnc display    start a VNC server on display\n"
            "-vncviewer      start a vncviewer process for this domain\n"
            "-vncunused      bind the VNC server to an unused port\n"
+           "-vnclisten      bind the VNC server to this address\n"
            "-timeoffset     time offset (in seconds) from local time\n"
            "-acpi           disable or enable ACPI of HVM domain \n"
            "\n"
@@ -5444,6 +5452,7 @@ enum {
     QEMU_OPTION_acpi,
     QEMU_OPTION_vncviewer,
     QEMU_OPTION_vncunused,
+    QEMU_OPTION_vnclisten,
 };
 
 typedef struct QEMUOption {
@@ -5522,6 +5531,7 @@ const QEMUOption qemu_options[] = {
     { "vnc", HAS_ARG, QEMU_OPTION_vnc },
     { "vncviewer", 0, QEMU_OPTION_vncviewer },
     { "vncunused", 0, QEMU_OPTION_vncunused },
+    { "vnclisten", HAS_ARG, QEMU_OPTION_vnclisten },
     
     /* temporary options */
     { "usb", 0, QEMU_OPTION_usb },
@@ -5928,6 +5938,8 @@ int main(int argc, char **argv)
 
     nb_nics = 0;
     /* default mac address of the first network interface */
+
+    memset(&vnclisten_addr.sin_addr, 0, sizeof(vnclisten_addr.sin_addr));
     
     /* init debug */
     sprintf(qemu_dm_logfilename, "/var/log/xen/qemu-dm.%d.log", getpid());
@@ -6312,6 +6324,9 @@ int main(int argc, char **argv)
                 if (vnc_display == -1)
                     vnc_display = 0;
                 break;
+            case QEMU_OPTION_vnclisten:
+                parse_host(&vnclisten_addr, optarg);
+                break;
             }
         }
     }
@@ -6548,7 +6563,7 @@ int main(int argc, char **argv)
     if (nographic) {
         dumb_display_init(ds);
     } else if (vnc_display != -1) {
-       vnc_display = vnc_display_init(ds, vnc_display, vncunused);
+       vnc_display = vnc_display_init(ds, vnc_display, vncunused, 
&vnclisten_addr);
        if (vncviewer)
            vnc_start_viewer(vnc_display);
        xenstore_write_vncport(vnc_display);
diff -r 5176c3ea3293 -r b725c9e51a7c tools/ioemu/vl.h
--- a/tools/ioemu/vl.h  Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/ioemu/vl.h  Sat Oct 14 13:28:45 2006 -0600
@@ -37,6 +37,8 @@
 #include <unistd.h>
 #include <fcntl.h>
 #include <sys/stat.h>
+#include <sys/socket.h>
+#include <sys/types.h>
 #include "xenctrl.h"
 #include "xs.h"
 #include <xen/hvm/e820.h>
@@ -786,7 +788,7 @@ void cocoa_display_init(DisplayState *ds
 void cocoa_display_init(DisplayState *ds, int full_screen);
 
 /* vnc.c */
-int vnc_display_init(DisplayState *ds, int display, int find_unused);
+int vnc_display_init(DisplayState *ds, int display, int find_unused, struct 
sockaddr_in *addr);
 int vnc_start_viewer(int port);
 
 /* ide.c */
diff -r 5176c3ea3293 -r b725c9e51a7c tools/ioemu/vnc.c
--- a/tools/ioemu/vnc.c Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/ioemu/vnc.c Sat Oct 14 13:28:45 2006 -0600
@@ -1250,9 +1250,8 @@ static void vnc_listen_read(void *opaque
     }
 }
 
-int vnc_display_init(DisplayState *ds, int display, int find_unused)
-{
-    struct sockaddr_in addr;
+int vnc_display_init(DisplayState *ds, int display, int find_unused, struct 
sockaddr_in *addr)
+{
     int reuse_addr, ret;
     VncState *vs;
 
@@ -1290,11 +1289,10 @@ int vnc_display_init(DisplayState *ds, i
     }
 
  retry:
-    addr.sin_family = AF_INET;
-    addr.sin_port = htons(5900 + display);
-    memset(&addr.sin_addr, 0, sizeof(addr.sin_addr));
-
-    if (bind(vs->lsock, (struct sockaddr *)&addr, sizeof(addr)) == -1) {
+    addr->sin_family = AF_INET;
+    addr->sin_port = htons(5900 + display);
+
+    if (bind(vs->lsock, (struct sockaddr *)addr, sizeof(struct sockaddr_in)) 
== -1) {
        if (find_unused && errno == EADDRINUSE) {
            display++;
            goto retry;
diff -r 5176c3ea3293 -r b725c9e51a7c tools/libxc/xc_load_elf.c
--- a/tools/libxc/xc_load_elf.c Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/libxc/xc_load_elf.c Sat Oct 14 13:28:45 2006 -0600
@@ -364,7 +364,7 @@ static int parseelfimage(const char *ima
         if ( p != NULL && strncmp(p, "yes", 3) == 0 )
         {
             dsi->pae_kernel = PAEKERN_yes;
-            if ( !strncmp(p+4, "[extended-cr3]", 14) )
+            if ( !strncmp(p+3, "[extended-cr3]", 14) )
                 dsi->pae_kernel = PAEKERN_extended_cr3;
         }
     }
diff -r 5176c3ea3293 -r b725c9e51a7c tools/misc/mbootpack/Makefile
--- a/tools/misc/mbootpack/Makefile     Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/misc/mbootpack/Makefile     Sat Oct 14 13:28:45 2006 -0600
@@ -20,12 +20,8 @@ install: build
 
 #  Tools etc.
 RM     := rm -f
-GDB    := gdb
 INCS   := -I. -I-
 DEFS   := 
-LDFLAGS        := 
-CFLAGS += -Wpointer-arith -Wcast-qual -Wno-unused -Wno-format
-CFLAGS += -Wmissing-prototypes -pipe
 
 #  What object files need building for the program
 OBJS   := mbootpack.o buildimage.o
@@ -35,22 +31,22 @@ DEPS     = .*.d
 DEPS     = .*.d
 
 mbootpack: $(OBJS)
-       $(HOSTCC) -o $@ $(filter-out %.a, $^)
+       $(HOSTCC) $(HOSTCFLAGS) -o $@ $(filter-out %.a, $^)
 
 .PHONY: clean
 clean:
        $(RM) mbootpack *.o $(DEPS) bootsect setup bzimage_header.c bin2c
 
 bootsect: bootsect.S
-       $(CC) $(CFLAGS) $(INCS) $(DEFS) -D__MB_ASM -c bootsect.S -o bootsect.o
+       $(CC) -m32 $(INCS) $(DEFS) -D__MB_ASM -c bootsect.S -o bootsect.o
        $(LD) -m elf_i386 -Ttext 0x0 -s --oformat binary bootsect.o -o $@
 
 setup: setup.S
-       $(CC) $(CFLAGS) $(INCS) $(DEFS) -D__MB_ASM -c setup.S -o setup.o
+       $(CC) -m32 $(INCS) $(DEFS) -D__MB_ASM -c setup.S -o setup.o
        $(LD) -m elf_i386 -Ttext 0x0 -s --oformat binary setup.o -o $@
 
 bin2c: bin2c.o 
-       $(HOSTCC) -o $@ $^ 
+       $(HOSTCC) $(HOSTCFLAGS) -o $@ $^ 
 
 bzimage_header.c: bootsect setup bin2c
        ./bin2c -n 8 -b1 -a bzimage_bootsect bootsect > bzimage_header.c
@@ -59,11 +55,8 @@ buildimage.c: bzimage_header.c
 buildimage.c: bzimage_header.c
        @
 
-%.o: %.S
-       $(HOSTCC) $(DEPFLAGS) $(CFLAGS) $(INCS) $(DEFS) -c $< -o $@
-
 %.o: %.c
-       $(HOSTCC) $(DEPFLAGS) $(CFLAGS) $(INCS) $(DEFS) -c $< -o $@
+       $(HOSTCC) $(DEPFLAGS) $(HOSTCFLAGS) $(INCS) $(DEFS) -c $< -o $@
 
 .PRECIOUS: $(OBJS) $(OBJS:.o=.c) $(DEPS)
 .SUFFIXES: 
diff -r 5176c3ea3293 -r b725c9e51a7c tools/misc/mbootpack/buildimage.c
--- a/tools/misc/mbootpack/buildimage.c Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/misc/mbootpack/buildimage.c Sat Oct 14 13:28:45 2006 -0600
@@ -24,8 +24,6 @@
  * $Id: buildimage.c,v 1.2 2005/03/23 10:39:19 tjd21 Exp $
  *
  */
-
-
 
 #include <assert.h>
 #include <stdio.h>
@@ -77,20 +75,22 @@
 /* Bring in the bzImage boot sector and setup code */
 #include "bzimage_header.c"
 
+#define _p(x) ((void *)(unsigned long)(x))
+
 address_t place_mbi(long int size) 
 /* Find space at the top of *low* memory for the MBI and associated red tape */
 {
     address_t start;
     start = 0xa000 - size;
     if (start < 0x9000 + sizeof(bzimage_bootsect) + sizeof(bzimage_setup)) {
-        printf("Fatal: command-lines too long: need %i, have %i bytes\n",
+        printf("Fatal: command-lines too long: need %ld, have %ld bytes\n",
                size, 
-               0x1000 - (sizeof(bzimage_bootsect) + sizeof(bzimage_setup)));
-        exit(1);        
+               0x1000L - (sizeof(bzimage_bootsect) + sizeof(bzimage_setup)));
+        exit(1);
     }
     if (!quiet) {
         printf("Placed MBI and strings (%p+%p)\n", 
-               start, size);
+               _p(start), _p(size));
     }
     return start;
 }
@@ -108,7 +108,7 @@ void make_bzImage(section_t *sections,
     /* Patch the kernel and mbi addresses into the setup code */
     *(address_t *)(bzimage_setup + BZ_ENTRY_OFFSET) = eswap(entry);
     *(address_t *)(bzimage_setup + BZ_MBI_OFFSET) = eswap(mbi);
-    if (!quiet) printf("Kernel entry is %p, MBI is %p.\n", entry, mbi);
+    if (!quiet) printf("Kernel entry is %p, MBI is %p.\n",_p(entry), _p(mbi));
 
     /* Write out header and trampoline */
     if (fseek(fp, 0, SEEK_SET) < 0) {
@@ -127,8 +127,9 @@ void make_bzImage(section_t *sections,
         exit(1);
     }
 
-    if (!quiet) printf("Wrote bzImage header: %i + %i bytes.\n", 
-                       sizeof(bzimage_bootsect), sizeof(bzimage_setup));
+    if (!quiet) printf("Wrote bzImage header: %ld + %ld bytes.\n", 
+                       (long)sizeof(bzimage_bootsect),
+                       (long)sizeof(bzimage_setup));
 
     /* Sorted list of sections below 1MB: write them out */
     for (s = sections, i = 0; s; s = s->next) {
diff -r 5176c3ea3293 -r b725c9e51a7c tools/misc/mbootpack/mbootpack.c
--- a/tools/misc/mbootpack/mbootpack.c  Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/misc/mbootpack/mbootpack.c  Sat Oct 14 13:28:45 2006 -0600
@@ -128,6 +128,7 @@ static void usage(void)
     exit(1);
 }
 
+#define _p(x) ((void *)(unsigned long)(x))
 
 static void place_kernel_section(address_t start, long int size)
 /* Place the kernel in memory, checking for the memory hole. */
@@ -136,7 +137,8 @@ static void place_kernel_section(address
         /* Above the memory hole: easy */
         next_free_space = MAX(next_free_space, start + size);
         if (!quiet) {
-            printf("Placed kernel section (%p+%p)\n", start, size);
+            printf("Placed kernel section (%p+%p)\n",
+                   _p(start), _p(size));
         }
         return;
     }
@@ -144,14 +146,14 @@ static void place_kernel_section(address
     if (start >= MEM_HOLE_START) {
         /* In the memory hole.  Not so good */
         printf("Fatal: kernel load address (%p) is in the memory hole.\n",
-               start);
+               _p(start));
         exit(1);
     }
     
     if (start + size > MEM_HOLE_START) {
         /* Too big for low memory */
         printf("Fatal: kernel (%p+%p) runs into the memory hole.\n",
-               start, size);
+               _p(start), _p(size));
         exit(1);
     }  
     
@@ -159,7 +161,7 @@ static void place_kernel_section(address
     next_free_space = MAX(next_free_space, start + size);
 
     if (!quiet) {
-        printf("Placed kernel section (%p+%p)\n", start, size);
+        printf("Placed kernel section (%p+%p)\n", _p(start), _p(size));
     }
 }
 
@@ -182,12 +184,10 @@ static address_t place_section(long int 
 
     if (!quiet) {
         printf("Placed section (%p+%p), align=%p\n", 
-               start, size, align);
+               _p(start), _p(size), _p(align));
     }
     return start;
 }
-
-
 
 
 static address_t load_kernel(const char *filename)
@@ -296,7 +296,7 @@ static address_t load_kernel(const char 
                 size = loadsize;
             
             if (loadsize > size) {
-                printf("Fatal: can't load %i bytes of kernel into %i bytes " 
+                printf("Fatal: can't load %ld bytes of kernel into %ld bytes "
                        "of memory.\n", loadsize, size);
                 exit(1);
             }
@@ -466,8 +466,6 @@ static address_t load_kernel(const char 
 }
 
 
-
-
 int main(int argc, char **argv) 
 {
     char *buffer, *imagename, *command_line, *p;
@@ -480,7 +478,7 @@ int main(int argc, char **argv)
     struct mod_list *modp;
     address_t start, kernel_entry;
     long int size, mod_command_line_space, command_line_len;
-    int modules, opt, mbi_reloc_offset, make_multiboot;
+    int modules, opt, mbi_reloc_offset;
 
     static const char short_options[] = "hc:m:o:qM";
     static const struct option options[] = {
diff -r 5176c3ea3293 -r b725c9e51a7c tools/misc/miniterm/miniterm.c
--- a/tools/misc/miniterm/miniterm.c    Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/misc/miniterm/miniterm.c    Sat Oct 14 13:28:45 2006 -0600
@@ -32,10 +32,11 @@
 #include <signal.h>
 #include <sys/types.h>
 #include <sys/wait.h>
+#include <string.h>
 
 #define DEFAULT_BAUDRATE   115200
 #define DEFAULT_SERDEVICE  "/dev/ttyS0"
-#define ENDMINITERM        2  /* ctrl-b to quit miniterm */
+#define ENDMINITERM        0x1d
 
 volatile int stop = 0;
 
@@ -76,7 +77,11 @@ int main(int argc, char **argv)
     char            *sername = DEFAULT_SERDEVICE;
     struct termios   oldsertio, newsertio, oldstdtio, newstdtio;
     struct sigaction sa;
- 
+    static char start_str[] = 
+        "************ REMOTE CONSOLE: CTRL-] TO QUIT ********\r\n";
+    static char end_str[] =
+        "\n************ REMOTE CONSOLE EXITED *****************\n";
+
     while ( --argc != 0 )
     {
         char *p = argv[argc];
@@ -121,7 +126,7 @@ int main(int argc, char **argv)
     newsertio.c_iflag = IGNBRK | IGNPAR;
 
     /* Raw output. */
-    newsertio.c_oflag = 0; 
+    newsertio.c_oflag = OPOST;
 
     /* No echo and no signals. */
     newsertio.c_lflag = 0;
@@ -137,7 +142,13 @@ int main(int argc, char **argv)
     /* next stop echo and buffering for stdin */
     tcgetattr(0,&oldstdtio);
     tcgetattr(0,&newstdtio); /* get working stdtio */
-    newstdtio.c_lflag &= ~(ICANON | ECHO);
+    newstdtio.c_iflag &= ~(BRKINT | ICRNL | INPCK | ISTRIP | IXON);
+    newstdtio.c_oflag &= ~OPOST;
+    newstdtio.c_cflag &= ~(CSIZE | PARENB);
+    newstdtio.c_cflag |= CS8;
+    newstdtio.c_lflag &= ~(ECHO | ICANON | IEXTEN | ISIG);
+    newstdtio.c_cc[VMIN]=1;
+    newstdtio.c_cc[VTIME]=0;
     tcsetattr(0,TCSANOW,&newstdtio);
 
     /* Terminal settings done: now enter the main I/O loops. */
@@ -145,7 +156,7 @@ int main(int argc, char **argv)
     {
     case 0:
         close(1); /* stdout not needed */
-        for ( c = getchar(); c != ENDMINITERM ; c = getchar() ) 
+        for ( c = (char)getchar(); c != ENDMINITERM; c = (char)getchar() )
             write(fd,&c,1);
         tcsetattr(fd,TCSANOW,&oldsertio);
         tcsetattr(0,TCSANOW,&oldstdtio);
@@ -158,7 +169,7 @@ int main(int argc, char **argv)
         close(fd);
         exit(-1);
     default:
-        printf("** ctrl-b quits miniterm **\n");
+        write(1, start_str, strlen(start_str));
         close(0); /* stdin not needed */
         sa.sa_handler = child_handler;
         sa.sa_flags = 0;
@@ -166,9 +177,11 @@ int main(int argc, char **argv)
         while ( !stop )
         {
             read(fd,&c,1); /* modem */
+            c = (char)c;
             write(1,&c,1); /* stdout */
         }
         wait(NULL); /* wait for child to die or it will become a zombie */
+        write(1, end_str, strlen(end_str));
         break;
     }
 
diff -r 5176c3ea3293 -r b725c9e51a7c tools/python/xen/util/blkif.py
--- a/tools/python/xen/util/blkif.py    Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/python/xen/util/blkif.py    Sat Oct 14 13:28:45 2006 -0600
@@ -64,7 +64,7 @@ def blkdev_uname_to_file(uname):
     """Take a blkdev uname and return the corresponding filename."""
     fn = None
     if uname.find(":") != -1:
-        (typ, fn) = uname.split(":")
+        (typ, fn) = uname.split(":", 1)
         if typ == "phy" and not fn.startswith("/"):
             fn = "/dev/%s" %(fn,)
         if typ == "tap":
diff -r 5176c3ea3293 -r b725c9e51a7c tools/python/xen/xend/XendDomainInfo.py
--- a/tools/python/xen/xend/XendDomainInfo.py   Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/python/xen/xend/XendDomainInfo.py   Sat Oct 14 13:28:45 2006 -0600
@@ -1745,7 +1745,7 @@ class XendDomainInfo:
         blcfg = None
         # FIXME: this assumes that we want to use the first disk device
         for (n,c) in self.info['device']:
-            if not n or not c or n != "vbd":
+            if not n or not c or not(n in ["vbd", "tap"]):
                 continue
             disk = sxp.child_value(c, "uname")
             if disk is None:
diff -r 5176c3ea3293 -r b725c9e51a7c tools/python/xen/xend/XendRoot.py
--- a/tools/python/xen/xend/XendRoot.py Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/python/xen/xend/XendRoot.py Sat Oct 14 13:28:45 2006 -0600
@@ -95,6 +95,9 @@ class XendRoot:
     dom0_min_mem_default = '0'
 
     dom0_vcpus_default = '0'
+
+    """Default interface to listen for VNC connections on"""
+    xend_vnc_listen_default = '127.0.0.1'
 
     components = {}
 
@@ -272,6 +275,9 @@ class XendRoot:
     def get_console_limit(self):
         return self.get_config_int('console-limit', 1024)
 
+    def get_vnclisten_address(self):
+        return self.get_config_value('vnc-listen', 
self.xend_vnc_listen_default)
+
 def instance():
     """Get an instance of XendRoot.
     Use this instead of the constructor.
diff -r 5176c3ea3293 -r b725c9e51a7c tools/python/xen/xend/image.py
--- a/tools/python/xen/xend/image.py    Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/python/xen/xend/image.py    Sat Oct 14 13:28:45 2006 -0600
@@ -361,6 +361,11 @@ class HVMImageHandler(ImageHandler):
             else:
                 ret += ['-vnc', '%d' % vncdisplay]
             ret += ['-k', 'en-us']
+            vnclisten = sxp.child_value(config, 'vnclisten')
+            if not(vnclisten):
+                vnclisten = 
xen.xend.XendRoot.instance().get_vnclisten_address()
+            if vnclisten:
+                ret += ['-vnclisten', vnclisten]
         return ret
 
     def createDeviceModel(self):
diff -r 5176c3ea3293 -r b725c9e51a7c tools/python/xen/xm/create.py
--- a/tools/python/xen/xm/create.py     Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/python/xen/xm/create.py     Sat Oct 14 13:28:45 2006 -0600
@@ -414,6 +414,10 @@ gopts.var('vncdisplay', val='',
 gopts.var('vncdisplay', val='',
           fn=set_value, default=None,
           use="""VNC display to use""")
+
+gopts.var('vnclisten', val='',
+          fn=set_value, default=None,
+          use="""Address for VNC server to listen on.""")
 
 gopts.var('vncunused', val='',
           fn=set_bool, default=1,
@@ -633,8 +637,9 @@ def configure_hvm(config_image, vals):
     """
     args = [ 'device_model', 'pae', 'vcpus', 'boot', 'fda', 'fdb',
              'localtime', 'serial', 'stdvga', 'isa', 'nographic', 'soundhw',
-             'vnc', 'vncdisplay', 'vncunused', 'vncconsole', 'sdl', 'display',
-             'acpi', 'apic', 'xauthority', 'usb', 'usbdevice' ]
+             'vnc', 'vncdisplay', 'vncunused', 'vncconsole', 'vnclisten',
+             'sdl', 'display', 'xauthority',
+             'acpi', 'apic', 'usb', 'usbdevice' ]
     for a in args:
         if (vals.__dict__[a]):
             config_image.append([a, vals.__dict__[a]])
diff -r 5176c3ea3293 -r b725c9e51a7c tools/python/xen/xm/main.py
--- a/tools/python/xen/xm/main.py       Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/python/xen/xm/main.py       Sat Oct 14 13:28:45 2006 -0600
@@ -290,6 +290,11 @@ all_commands = (domain_commands + host_c
 
 def cmdHelp(cmd):
     """Print help for a specific subcommand."""
+    
+    for fc in SUBCOMMAND_HELP.keys():
+        if fc[:len(cmd)] == cmd:
+            cmd = fc
+            break
     
     try:
         args, desc = SUBCOMMAND_HELP[cmd]
diff -r 5176c3ea3293 -r b725c9e51a7c tools/xenstore/xenstore_client.c
--- a/tools/xenstore/xenstore_client.c  Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/xenstore/xenstore_client.c  Sat Oct 14 13:28:45 2006 -0600
@@ -267,12 +267,13 @@ main(int argc, char **argv)
 main(int argc, char **argv)
 {
     struct xs_handle *xsh;
-    xs_transaction_t xth;
+    xs_transaction_t xth = XBT_NULL;
     int ret = 0, socket = 0;
     int prefix = 0;
     int tidy = 0;
     int upto = 0;
     int recurse = 0;
+    int transaction;
 
     while (1) {
        int c, index = 0;
@@ -339,18 +340,28 @@ main(int argc, char **argv)
     }
 #endif
 
+#if defined(CLIENT_read)
+    transaction = (argc - optind) > 1;
+#elif defined(CLIENT_write)
+    transaction = (argc - optind) > 2;
+#else
+    transaction = 1;
+#endif
+
     xsh = socket ? xs_daemon_open() : xs_domain_open();
     if (xsh == NULL)
        err(1, socket ? "xs_daemon_open" : "xs_domain_open");
 
   again:
-    xth = xs_transaction_start(xsh);
-    if (xth == XBT_NULL)
-       errx(1, "couldn't start transaction");
+    if (transaction) {
+       xth = xs_transaction_start(xsh);
+       if (xth == XBT_NULL)
+           errx(1, "couldn't start transaction");
+    }
 
     ret = perform(optind, argc, argv, xsh, xth, prefix, tidy, upto, recurse);
 
-    if (!xs_transaction_end(xsh, xth, ret)) {
+    if (transaction && !xs_transaction_end(xsh, xth, ret)) {
        if (ret == 0 && errno == EAGAIN) {
            output_pos = 0;
            goto again;
diff -r 5176c3ea3293 -r b725c9e51a7c tools/xenstore/xenstored_transaction.c
--- a/tools/xenstore/xenstored_transaction.c    Sun Oct 08 18:55:12 2006 -0600
+++ b/tools/xenstore/xenstored_transaction.c    Sat Oct 14 13:28:45 2006 -0600
@@ -133,7 +133,7 @@ void do_transaction_start(struct connect
                return;
        }
 
-       if (conn->transaction_started > quota_max_transaction) {
+       if (conn->id && conn->transaction_started > quota_max_transaction) {
                send_error(conn, ENOSPC);
                return;
        }
diff -r 5176c3ea3293 -r b725c9e51a7c xen/arch/x86/Makefile
--- a/xen/arch/x86/Makefile     Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/arch/x86/Makefile     Sat Oct 14 13:28:45 2006 -0600
@@ -53,18 +53,18 @@ obj-$(crash_debug) += gdbstub.o
        $(MAKE) -f $(BASEDIR)/Rules.mk $(BASEDIR)/common/symbols-dummy.o
        $(LD) $(LDFLAGS) -T xen.lds -N \
            boot/$(TARGET_SUBARCH).o $(ALL_OBJS) \
-           $(BASEDIR)/common/symbols-dummy.o -o $@
-       $(NM) -n $@ | $(BASEDIR)/tools/symbols >$(BASEDIR)/xen-syms.S
-       $(MAKE) -f $(BASEDIR)/Rules.mk $(BASEDIR)/xen-syms.o
+           $(BASEDIR)/common/symbols-dummy.o -o $(@D)/.$(@F).0
+       $(NM) -n $(@D)/.$(@F).0 | $(BASEDIR)/tools/symbols >$(@D)/.$(@F).0.S
+       $(MAKE) -f $(BASEDIR)/Rules.mk $(@D)/.$(@F).0.o
        $(LD) $(LDFLAGS) -T xen.lds -N \
            boot/$(TARGET_SUBARCH).o $(ALL_OBJS) \
-           $(BASEDIR)/xen-syms.o -o $@
-       $(NM) -n $@ | $(BASEDIR)/tools/symbols >$(BASEDIR)/xen-syms.S
-       $(MAKE) -f $(BASEDIR)/Rules.mk $(BASEDIR)/xen-syms.o
+           $(@D)/.$(@F).0.o -o $(@D)/.$(@F).1
+       $(NM) -n $(@D)/.$(@F).1 | $(BASEDIR)/tools/symbols >$(@D)/.$(@F).1.S
+       $(MAKE) -f $(BASEDIR)/Rules.mk $(@D)/.$(@F).1.o
        $(LD) $(LDFLAGS) -T xen.lds -N \
            boot/$(TARGET_SUBARCH).o $(ALL_OBJS) \
-           $(BASEDIR)/xen-syms.o -o $@
-       rm -f $(BASEDIR)/xen-syms.S $(BASEDIR)/xen-syms.o
+           $(@D)/.$(@F).1.o -o $@
+       rm -f $(@D)/.$(@F).[0-9]*
 
 asm-offsets.s: $(TARGET_SUBARCH)/asm-offsets.c $(HDRS)
        $(CC) $(CFLAGS) -S -o $@ $<
@@ -78,3 +78,4 @@ boot/mkelf32: boot/mkelf32.c
 .PHONY: clean
 clean::
        rm -f asm-offsets.s xen.lds boot/*.o boot/*~ boot/core boot/mkelf32
+       rm -f $(BASEDIR)/.xen-syms.[0-9]*
diff -r 5176c3ea3293 -r b725c9e51a7c xen/arch/x86/domain_build.c
--- a/xen/arch/x86/domain_build.c       Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/arch/x86/domain_build.c       Sat Oct 14 13:28:45 2006 -0600
@@ -401,11 +401,11 @@ int construct_dom0(struct domain *d,
            _p(dsi.v_start), _p(v_end));
     printk(" ENTRY ADDRESS: %p\n", _p(dsi.v_kernentry));
 
-    if ( (v_end - dsi.v_start) > (nr_pages * PAGE_SIZE) )
+    if ( ((v_end - dsi.v_start)>>PAGE_SHIFT) > nr_pages )
     {
         printk("Initial guest OS requires too much space\n"
                "(%luMB is greater than %luMB limit)\n",
-               (v_end-dsi.v_start)>>20, (nr_pages<<PAGE_SHIFT)>>20);
+               (v_end-dsi.v_start)>>20, nr_pages>>(20-PAGE_SHIFT));
         return -ENOMEM;
     }
 
diff -r 5176c3ea3293 -r b725c9e51a7c xen/arch/x86/hvm/hvm.c
--- a/xen/arch/x86/hvm/hvm.c    Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/arch/x86/hvm/hvm.c    Sat Oct 14 13:28:45 2006 -0600
@@ -653,15 +653,15 @@ int hvm_bringup_ap(int vcpuid, int tramp
     if ( rc != 0 )
     {
         DPRINTK("AP %d bringup failed in boot_vcpu %x.\n", vcpuid, rc);
-        return rc;
+        goto out;
     }
 
     if ( test_and_clear_bit(_VCPUF_down, &d->vcpu[vcpuid]->vcpu_flags) )
         vcpu_wake(d->vcpu[vcpuid]);
     DPRINTK("AP %d bringup suceeded.\n", vcpuid);
 
+ out:
     xfree(ctxt);
-
     return rc;
 }
 
diff -r 5176c3ea3293 -r b725c9e51a7c xen/arch/x86/hvm/svm/intr.c
--- a/xen/arch/x86/hvm/svm/intr.c       Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/arch/x86/hvm/svm/intr.c       Sat Oct 14 13:28:45 2006 -0600
@@ -74,6 +74,7 @@ asmlinkage void svm_intr_assist(void)
     int intr_type = APIC_DM_EXTINT;
     int intr_vector = -1;
     int re_injecting = 0;
+    unsigned long rflags;
 
     ASSERT(vmcb);
 
@@ -86,6 +87,14 @@ asmlinkage void svm_intr_assist(void)
         re_injecting = 1;
     }
 
+    /* Guest's interrputs masked? */
+    rflags = vmcb->rflags;
+    if (irq_masked(rflags)) {
+        HVM_DBG_LOG(DBG_LEVEL_1, "Guest IRQs masked: rflags: %lx", rflags);
+        /* bail out, we won't be injecting an interrupt this time */
+        return;
+    }
+    
     /* Previous interrupt still pending? */
     if (vmcb->vintr.fields.irq) {
 //        printk("Re-injecting IRQ from Vintr\n");
diff -r 5176c3ea3293 -r b725c9e51a7c xen/arch/x86/hvm/svm/svm.c
--- a/xen/arch/x86/hvm/svm/svm.c        Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/arch/x86/hvm/svm/svm.c        Sat Oct 14 13:28:45 2006 -0600
@@ -840,7 +840,15 @@ int start_svm(void)
     
     if (!(test_bit(X86_FEATURE_SVME, &boot_cpu_data.x86_capability)))
         return 0;
-    
+
+    /* check whether SVM feature is disabled in BIOS */
+    rdmsr(MSR_K8_VM_CR, eax, edx);
+    if ( eax & K8_VMCR_SVME_DISABLE )
+    {
+        printk("AMD SVM Extension is disabled in BIOS.\n");
+        return 0;
+    }
+
     if (!(hsa[cpu] = alloc_host_save_area()))
         return 0;
     
diff -r 5176c3ea3293 -r b725c9e51a7c xen/arch/x86/hvm/vmx/vmx.c
--- a/xen/arch/x86/hvm/vmx/vmx.c        Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/arch/x86/hvm/vmx/vmx.c        Sat Oct 14 13:28:45 2006 -0600
@@ -226,21 +226,10 @@ static inline int long_mode_do_msr_read(
     case MSR_EFER:
         HVM_DBG_LOG(DBG_LEVEL_2, "EFER msr_content 0x%"PRIx64, msr_content);
         msr_content = msr->msr_items[VMX_INDEX_MSR_EFER];
-
-        /* the following code may be not needed */
-        if ( test_bit(VMX_CPU_STATE_LME_ENABLED, &v->arch.hvm_vmx.cpu_state) )
-            msr_content |= EFER_LME;
-        else
-            msr_content &= ~EFER_LME;
-
-        if ( VMX_LONG_GUEST(v) )
-            msr_content |= EFER_LMA;
-        else
-            msr_content &= ~EFER_LMA;
         break;
 
     case MSR_FS_BASE:
-        if ( !(VMX_LONG_GUEST(v)) )
+        if ( !(vmx_long_mode_enabled(v)) )
             /* XXX should it be GP fault */
             domain_crash_synchronous();
 
@@ -248,7 +237,7 @@ static inline int long_mode_do_msr_read(
         break;
 
     case MSR_GS_BASE:
-        if ( !(VMX_LONG_GUEST(v)) )
+        if ( !(vmx_long_mode_enabled(v)) )
             domain_crash_synchronous();
 
         __vmread(GUEST_GS_BASE, &msr_content);
@@ -296,21 +285,25 @@ static inline int long_mode_do_msr_write
             return 0;
         }
 
-        /* LME: 0 -> 1 */
-        if ( msr_content & EFER_LME &&
-             !test_bit(VMX_CPU_STATE_LME_ENABLED, &v->arch.hvm_vmx.cpu_state) )
-        {
-            if ( vmx_paging_enabled(v) ||
-                 !test_bit(VMX_CPU_STATE_PAE_ENABLED,
-                           &v->arch.hvm_vmx.cpu_state) )
+        if ( (msr_content & EFER_LME)
+             &&  !(msr->msr_items[VMX_INDEX_MSR_EFER] & EFER_LME) )
+        {
+            if ( unlikely(vmx_paging_enabled(v)) )
             {
-                printk("Trying to set LME bit when "
-                       "in paging mode or PAE bit is not set\n");
+                printk("Trying to set EFER.LME with paging enabled\n");
                 vmx_inject_hw_exception(v, TRAP_gp_fault, 0);
                 return 0;
             }
-
-            set_bit(VMX_CPU_STATE_LME_ENABLED, &v->arch.hvm_vmx.cpu_state);
+        }
+        else if ( !(msr_content & EFER_LME)
+                  && (msr->msr_items[VMX_INDEX_MSR_EFER] & EFER_LME) )
+        {
+            if ( unlikely(vmx_paging_enabled(v)) )
+            {
+                printk("Trying to clear EFER.LME with paging enabled\n");
+                vmx_inject_hw_exception(v, TRAP_gp_fault, 0);
+                return 0;
+            }
         }
 
         msr->msr_items[VMX_INDEX_MSR_EFER] = msr_content;
@@ -318,7 +311,7 @@ static inline int long_mode_do_msr_write
 
     case MSR_FS_BASE:
     case MSR_GS_BASE:
-        if ( !(VMX_LONG_GUEST(v)) )
+        if ( !(vmx_long_mode_enabled(v)) )
             domain_crash_synchronous();
 
         if ( !IS_CANO_ADDRESS(msr_content) )
@@ -336,7 +329,7 @@ static inline int long_mode_do_msr_write
         break;
 
     case MSR_SHADOW_GS_BASE:
-        if ( !(VMX_LONG_GUEST(v)) )
+        if ( !(vmx_long_mode_enabled(v)) )
             domain_crash_synchronous();
 
         v->arch.hvm_vmx.msr_content.shadow_gs = msr_content;
@@ -1257,7 +1250,7 @@ static int vmx_world_save(struct vcpu *v
 
 static int vmx_world_restore(struct vcpu *v, struct vmx_assist_context *c)
 {
-    unsigned long mfn, old_cr4, old_base_mfn;
+    unsigned long mfn, old_base_mfn;
     int error = 0;
 
     error |= __vmwrite(GUEST_RIP, c->eip);
@@ -1307,14 +1300,11 @@ static int vmx_world_restore(struct vcpu
 
  skip_cr3:
 
-    shadow_update_paging_modes(v);
     if (!vmx_paging_enabled(v))
         HVM_DBG_LOG(DBG_LEVEL_VMMU, "switching to vmxassist. use phys table");
     else
         HVM_DBG_LOG(DBG_LEVEL_VMMU, "Update CR3 value = %x", c->cr3);
-    __vmwrite(GUEST_CR3, v->arch.hvm_vcpu.hw_cr3);
-
-    error |= __vmread(CR4_READ_SHADOW, &old_cr4);
+
     error |= __vmwrite(GUEST_CR4, (c->cr4 | VMX_CR4_HOST_MASK));
     error |= __vmwrite(CR4_READ_SHADOW, c->cr4);
 
@@ -1363,6 +1353,9 @@ static int vmx_world_restore(struct vcpu
     error |= __vmwrite(GUEST_LDTR_LIMIT, c->ldtr_limit);
     error |= __vmwrite(GUEST_LDTR_BASE, c->ldtr_base);
     error |= __vmwrite(GUEST_LDTR_AR_BYTES, c->ldtr_arbytes.bytes);
+
+    shadow_update_paging_modes(v);
+    __vmwrite(GUEST_CR3, v->arch.hvm_vcpu.hw_cr3);
 
     return !error;
 }
@@ -1408,6 +1401,7 @@ static int vmx_assist(struct vcpu *v, in
                 goto error;
             if (!vmx_world_restore(v, &c))
                 goto error;
+            v->arch.hvm_vmx.vmxassist_enabled = 1;            
             return 1;
         }
         break;
@@ -1425,6 +1419,7 @@ static int vmx_assist(struct vcpu *v, in
                 goto error;
             if (!vmx_world_restore(v, &c))
                 goto error;
+            v->arch.hvm_vmx.vmxassist_enabled = 0;
             return 1;
         }
         break;
@@ -1480,26 +1475,23 @@ static int vmx_set_cr0(unsigned long val
         }
 
 #if defined(__x86_64__)
-        if ( test_bit(VMX_CPU_STATE_LME_ENABLED,
-                      &v->arch.hvm_vmx.cpu_state) &&
-             !test_bit(VMX_CPU_STATE_PAE_ENABLED,
-                       &v->arch.hvm_vmx.cpu_state) )
-        {
-            HVM_DBG_LOG(DBG_LEVEL_1, "Enable paging before PAE enabled\n");
-            vmx_inject_hw_exception(v, TRAP_gp_fault, 0);
-        }
-
-        if ( test_bit(VMX_CPU_STATE_LME_ENABLED,
-                     &v->arch.hvm_vmx.cpu_state) )
-        {
-            /* Here the PAE is should be opened */
-            HVM_DBG_LOG(DBG_LEVEL_1, "Enable long mode\n");
-            set_bit(VMX_CPU_STATE_LMA_ENABLED,
-                    &v->arch.hvm_vmx.cpu_state);
-
-            __vmread(VM_ENTRY_CONTROLS, &vm_entry_value);
-            vm_entry_value |= VM_ENTRY_IA32E_MODE;
-            __vmwrite(VM_ENTRY_CONTROLS, vm_entry_value);
+        if ( vmx_lme_is_set(v) )
+        {
+            if ( !(v->arch.hvm_vmx.cpu_shadow_cr4 & X86_CR4_PAE) )
+            {
+                HVM_DBG_LOG(DBG_LEVEL_1, "Guest enabled paging "
+                            "with EFER.LME set but not CR4.PAE\n");
+                vmx_inject_hw_exception(v, TRAP_gp_fault, 0);
+            }
+            else 
+            {
+                HVM_DBG_LOG(DBG_LEVEL_1, "Enabling long mode\n");
+                v->arch.hvm_vmx.msr_content.msr_items[VMX_INDEX_MSR_EFER]
+                    |= EFER_LMA;
+                __vmread(VM_ENTRY_CONTROLS, &vm_entry_value);
+                vm_entry_value |= VM_ENTRY_IA32E_MODE;
+                __vmwrite(VM_ENTRY_CONTROLS, vm_entry_value);
+            }
         }
 #endif
 
@@ -1546,11 +1538,10 @@ static int vmx_set_cr0(unsigned long val
              * Disable paging here.
              * Same to PE == 1 && PG == 0
              */
-            if ( test_bit(VMX_CPU_STATE_LMA_ENABLED,
-                          &v->arch.hvm_vmx.cpu_state) )
+            if ( vmx_long_mode_enabled(v) )
             {
-                clear_bit(VMX_CPU_STATE_LMA_ENABLED,
-                          &v->arch.hvm_vmx.cpu_state);
+                v->arch.hvm_vmx.msr_content.msr_items[VMX_INDEX_MSR_EFER]
+                    &= ~EFER_LMA;
                 __vmread(VM_ENTRY_CONTROLS, &vm_entry_value);
                 vm_entry_value &= ~VM_ENTRY_IA32E_MODE;
                 __vmwrite(VM_ENTRY_CONTROLS, vm_entry_value);
@@ -1559,22 +1550,19 @@ static int vmx_set_cr0(unsigned long val
 
         if ( vmx_assist(v, VMX_ASSIST_INVOKE) )
         {
-            set_bit(VMX_CPU_STATE_ASSIST_ENABLED, &v->arch.hvm_vmx.cpu_state);
             __vmread(GUEST_RIP, &eip);
             HVM_DBG_LOG(DBG_LEVEL_1,
                         "Transfering control to vmxassist %%eip 0x%lx\n", eip);
             return 0; /* do not update eip! */
         }
-    } else if ( test_bit(VMX_CPU_STATE_ASSIST_ENABLED,
-                         &v->arch.hvm_vmx.cpu_state) )
+    }
+    else if ( v->arch.hvm_vmx.vmxassist_enabled )
     {
         __vmread(GUEST_RIP, &eip);
         HVM_DBG_LOG(DBG_LEVEL_1,
                     "Enabling CR0.PE at %%eip 0x%lx\n", eip);
         if ( vmx_assist(v, VMX_ASSIST_RESTORE) )
         {
-            clear_bit(VMX_CPU_STATE_ASSIST_ENABLED,
-                      &v->arch.hvm_vmx.cpu_state);
             __vmread(GUEST_RIP, &eip);
             HVM_DBG_LOG(DBG_LEVEL_1,
                         "Restoring to %%eip 0x%lx\n", eip);
@@ -1583,8 +1571,8 @@ static int vmx_set_cr0(unsigned long val
     }
     else if ( (value & (X86_CR0_PE | X86_CR0_PG)) == X86_CR0_PE )
     {
+        shadow_update_paging_modes(v);
         __vmwrite(GUEST_CR3, v->arch.hvm_vcpu.hw_cr3);
-        shadow_update_paging_modes(v);
     }
 
     return 1;
@@ -1705,8 +1693,6 @@ static int mov_to_cr(int gp, int cr, str
 
         if ( value & X86_CR4_PAE && !(old_cr & X86_CR4_PAE) )
         {
-            set_bit(VMX_CPU_STATE_PAE_ENABLED, &v->arch.hvm_vmx.cpu_state);
-
             if ( vmx_pgbit_test(v) )
             {
                 /* The guest is a 32-bit PAE guest. */
@@ -1745,14 +1731,14 @@ static int mov_to_cr(int gp, int cr, str
 #endif
             }
         }
-        else if ( value & X86_CR4_PAE )
-            set_bit(VMX_CPU_STATE_PAE_ENABLED, &v->arch.hvm_vmx.cpu_state);
-        else
-        {
-            if ( test_bit(VMX_CPU_STATE_LMA_ENABLED, 
&v->arch.hvm_vmx.cpu_state) )
+        else if ( !(value & X86_CR4_PAE) )
+        {
+            if ( unlikely(vmx_long_mode_enabled(v)) )
+            {
+                HVM_DBG_LOG(DBG_LEVEL_1, "Guest cleared CR4.PAE while "
+                            "EFER.LMA is set\n");
                 vmx_inject_hw_exception(v, TRAP_gp_fault, 0);
-
-            clear_bit(VMX_CPU_STATE_PAE_ENABLED, &v->arch.hvm_vmx.cpu_state);
+            }
         }
 
         __vmwrite(GUEST_CR4, value| VMX_CR4_HOST_MASK);
diff -r 5176c3ea3293 -r b725c9e51a7c xen/arch/x86/microcode.c
--- a/xen/arch/x86/microcode.c  Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/arch/x86/microcode.c  Sat Oct 14 13:28:45 2006 -0600
@@ -455,7 +455,7 @@ out:
        return error;
 }
 
-int microcode_update(void *buf, unsigned long len)
+int microcode_update(XEN_GUEST_HANDLE(void) buf, unsigned long len)
 {
        int ret;
 
@@ -464,10 +464,15 @@ int microcode_update(void *buf, unsigned
                return -EINVAL;
        }
 
+       if (len != (typeof(user_buffer_size))len) {
+               printk(KERN_ERR "microcode: too much data\n");
+               return -E2BIG;
+       }
+
        mutex_lock(&microcode_mutex);
 
-       user_buffer = (void __user *) buf;
-       user_buffer_size = (int) len;
+       user_buffer = buf.p;
+       user_buffer_size = len;
 
        ret = do_microcode_update();
 
diff -r 5176c3ea3293 -r b725c9e51a7c xen/arch/x86/mm/shadow/multi.c
--- a/xen/arch/x86/mm/shadow/multi.c    Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/arch/x86/mm/shadow/multi.c    Sat Oct 14 13:28:45 2006 -0600
@@ -1375,80 +1375,6 @@ static int shadow_set_l1e(struct vcpu *v
 
 
 /**************************************************************************/
-/* These functions take a vcpu and a virtual address, and return a pointer
- * to the appropriate level N entry from the shadow tables.  
- * If the necessary tables are not present in the shadow, they return NULL. */
-
-/* N.B. The use of GUEST_PAGING_LEVELS here is correct.  If the shadow has
- * more levels than the guest, the upper levels are always fixed and do not 
- * reflect any information from the guest, so we do not use these functions 
- * to access them. */
-
-#if GUEST_PAGING_LEVELS >= 4
-static shadow_l4e_t *
-shadow_get_l4e(struct vcpu *v, unsigned long va)
-{
-    /* Reading the top level table is always valid. */
-    return sh_linear_l4_table(v) + shadow_l4_linear_offset(va);
-}
-#endif /* GUEST_PAGING_LEVELS >= 4 */
-
-
-#if GUEST_PAGING_LEVELS >= 3
-static shadow_l3e_t *
-shadow_get_l3e(struct vcpu *v, unsigned long va)
-{
-#if GUEST_PAGING_LEVELS >= 4 /* 64bit... */
-    /* Get the l4 */
-    shadow_l4e_t *sl4e = shadow_get_l4e(v, va);
-    ASSERT(sl4e != NULL);
-    if ( !(shadow_l4e_get_flags(*sl4e) & _PAGE_PRESENT) )
-        return NULL;
-    ASSERT(valid_mfn(shadow_l4e_get_mfn(*sl4e)));
-    /* l4 was present; OK to get the l3 */
-    return sh_linear_l3_table(v) + shadow_l3_linear_offset(va);
-#else /* PAE... */
-    /* Top level is always mapped */
-    ASSERT(v->arch.shadow_vtable);
-    return ((shadow_l3e_t *)v->arch.shadow_vtable) + 
shadow_l3_linear_offset(va);
-#endif 
-}
-#endif /* GUEST_PAGING_LEVELS >= 3 */
-
-
-static shadow_l2e_t *
-shadow_get_l2e(struct vcpu *v, unsigned long va)
-{
-#if GUEST_PAGING_LEVELS >= 3  /* 64bit/PAE... */
-    /* Get the l3 */
-    shadow_l3e_t *sl3e = shadow_get_l3e(v, va);
-    if ( sl3e == NULL || !(shadow_l3e_get_flags(*sl3e) & _PAGE_PRESENT) )
-        return NULL;
-    ASSERT(valid_mfn(shadow_l3e_get_mfn(*sl3e)));
-    /* l3 was present; OK to get the l2 */
-#endif
-    return sh_linear_l2_table(v) + shadow_l2_linear_offset(va);
-}
-
-
-#if 0 // avoid the compiler warning for now...
-
-static shadow_l1e_t *
-shadow_get_l1e(struct vcpu *v, unsigned long va)
-{
-    /* Get the l2 */
-    shadow_l2e_t *sl2e = shadow_get_l2e(v, va);
-    if ( sl2e == NULL || !(shadow_l2e_get_flags(*sl2e) & _PAGE_PRESENT) )
-        return NULL;
-    ASSERT(valid_mfn(shadow_l2e_get_mfn(*sl2e)));
-    /* l2 was present; OK to get the l1 */
-    return sh_linear_l1_table(v) + shadow_l1_linear_offset(va);
-}
-
-#endif
-
-
-/**************************************************************************/
 /* Macros to walk pagetables.  These take the shadow of a pagetable and 
  * walk every "interesting" entry.  That is, they don't touch Xen mappings, 
  * and for 32-bit l2s shadowed onto PAE or 64-bit, they only touch every 
@@ -2050,6 +1976,12 @@ sh_make_monitor_table(struct vcpu *v)
  * they are needed.  The "demand" argument is non-zero when handling
  * a demand fault (so we know what to do about accessed bits &c).
  * If the necessary tables are not present in the guest, they return NULL. */
+
+/* N.B. The use of GUEST_PAGING_LEVELS here is correct.  If the shadow has
+ * more levels than the guest, the upper levels are always fixed and do not 
+ * reflect any information from the guest, so we do not use these functions 
+ * to access them. */
+
 #if GUEST_PAGING_LEVELS >= 4
 static shadow_l4e_t * shadow_get_and_create_l4e(struct vcpu *v, 
                                                 walk_t *gw, 
@@ -2324,11 +2256,11 @@ static void sh_destroy_l3_subshadow(stru
 /* Tear down just a single 4-entry l3 on a 2-page l3 shadow. */
 {
     int i;
+    mfn_t sl3mfn = _mfn(maddr_from_mapped_domain_page(sl3e) >> PAGE_SHIFT);
     ASSERT((unsigned long)sl3e % (4 * sizeof (shadow_l3e_t)) == 0); 
     for ( i = 0; i < GUEST_L3_PAGETABLE_ENTRIES; i++ ) 
         if ( shadow_l3e_get_flags(sl3e[i]) & _PAGE_PRESENT ) 
-            sh_put_ref(v, shadow_l3e_get_mfn(sl3e[i]),
-                        maddr_from_mapped_domain_page(sl3e));
+            shadow_set_l3e(v, &sl3e[i], shadow_l3e_empty(), sl3mfn);
 }
 #endif
 
@@ -3223,26 +3155,62 @@ sh_invlpg(struct vcpu *v, unsigned long 
  * instruction should be issued on the hardware, or 0 if it's safe not
  * to do so. */
 {
-    shadow_l2e_t *ptr_sl2e = shadow_get_l2e(v, va);
-
-    // XXX -- might be a good thing to prefetch the va into the shadow
-
-    // no need to flush anything if there's no SL2...
-    //
-    if ( !ptr_sl2e )
+    shadow_l2e_t sl2e;
+    
+    perfc_incrc(shadow_invlpg);
+
+    /* First check that we can safely read the shadow l2e.  SMP/PAE linux can
+     * run as high as 6% of invlpg calls where we haven't shadowed the l2 
+     * yet. */
+#if SHADOW_PAGING_LEVELS == 4
+    {
+        shadow_l3e_t sl3e;
+        if ( !(shadow_l4e_get_flags(
+                   sh_linear_l4_table(v)[shadow_l4_linear_offset(va)])
+               & _PAGE_PRESENT) )
+            return 0;
+        /* This must still be a copy-from-user because we don't have the
+         * shadow lock, and the higher-level shadows might disappear
+         * under our feet. */
+        if ( __copy_from_user(&sl3e, (sh_linear_l3_table(v) 
+                                      + shadow_l3_linear_offset(va)),
+                              sizeof (sl3e)) != 0 )
+        {
+            perfc_incrc(shadow_invlpg_fault);
+            return 0;
+        }
+        if ( (!shadow_l3e_get_flags(sl3e) & _PAGE_PRESENT) )
+            return 0;
+    }
+#elif SHADOW_PAGING_LEVELS == 3
+    if ( !(shadow_l3e_get_flags(
+          ((shadow_l3e_t *)v->arch.shadow_vtable)[shadow_l3_linear_offset(va)])
+           & _PAGE_PRESENT) )
+        // no need to flush anything if there's no SL2...
         return 0;
+#endif
+
+    /* This must still be a copy-from-user because we don't have the shadow
+     * lock, and the higher-level shadows might disappear under our feet. */
+    if ( __copy_from_user(&sl2e, 
+                          sh_linear_l2_table(v) + shadow_l2_linear_offset(va),
+                          sizeof (sl2e)) != 0 )
+    {
+        perfc_incrc(shadow_invlpg_fault);
+        return 0;
+    }
 
     // If there's nothing shadowed for this particular sl2e, then
     // there is no need to do an invlpg, either...
     //
-    if ( !(shadow_l2e_get_flags(*ptr_sl2e) & _PAGE_PRESENT) )
+    if ( !(shadow_l2e_get_flags(sl2e) & _PAGE_PRESENT) )
         return 0;
 
     // Check to see if the SL2 is a splintered superpage...
     // If so, then we'll need to flush the entire TLB (because that's
     // easier than invalidating all of the individual 4K pages).
     //
-    if ( (mfn_to_page(shadow_l2e_get_mfn(*ptr_sl2e))->count_info &
+    if ( (mfn_to_page(shadow_l2e_get_mfn(sl2e))->count_info &
           PGC_SH_type_mask) == PGC_SH_fl1_shadow )
     {
         local_flush_tlb();
diff -r 5176c3ea3293 -r b725c9e51a7c xen/arch/x86/platform_hypercall.c
--- a/xen/arch/x86/platform_hypercall.c Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/arch/x86/platform_hypercall.c Sat Oct 14 13:28:45 2006 -0600
@@ -58,12 +58,13 @@ long do_platform_op(XEN_GUEST_HANDLE(xen
             op->u.add_memtype.nr_mfns,
             op->u.add_memtype.type,
             1);
-        if ( ret > 0 )
+        if ( ret >= 0 )
         {
             op->u.add_memtype.handle = 0;
             op->u.add_memtype.reg    = ret;
-            (void)copy_to_guest(u_xenpf_op, op, 1);
-            ret = 0;
+            ret = copy_to_guest(u_xenpf_op, op, 1) ? -EFAULT : 0;
+            if ( ret != 0 )
+                mtrr_del_page(ret, 0, 0);
         }
     }
     break;
@@ -75,7 +76,7 @@ long do_platform_op(XEN_GUEST_HANDLE(xen
             && (int)op->u.del_memtype.reg >= 0)
         {
             ret = mtrr_del_page(op->u.del_memtype.reg, 0, 0);
-            if (ret > 0)
+            if ( ret > 0 )
                 ret = 0;
         }
         else
@@ -96,16 +97,15 @@ long do_platform_op(XEN_GUEST_HANDLE(xen
             op->u.read_memtype.mfn     = mfn;
             op->u.read_memtype.nr_mfns = nr_mfns;
             op->u.read_memtype.type    = type;
-            (void)copy_to_guest(u_xenpf_op, op, 1);
-            ret = 0;
+            ret = copy_to_guest(u_xenpf_op, op, 1) ? -EFAULT : 0;
         }
     }
     break;
 
     case XENPF_microcode_update:
     {
-        extern int microcode_update(void *buf, unsigned long len);
-        ret = microcode_update(op->u.microcode.data.p,
+        extern int microcode_update(XEN_GUEST_HANDLE(void), unsigned long len);
+        ret = microcode_update(op->u.microcode.data,
                                op->u.microcode.length);
     }
     break;
diff -r 5176c3ea3293 -r b725c9e51a7c xen/arch/x86/x86_32/asm-offsets.c
--- a/xen/arch/x86/x86_32/asm-offsets.c Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/arch/x86/x86_32/asm-offsets.c Sat Oct 14 13:28:45 2006 -0600
@@ -118,7 +118,6 @@ void __dummy__(void)
     OFFSET(MULTICALL_arg3, struct multicall_entry, args[3]);
     OFFSET(MULTICALL_arg4, struct multicall_entry, args[4]);
     OFFSET(MULTICALL_arg5, struct multicall_entry, args[5]);
-    OFFSET(MULTICALL_arg6, struct multicall_entry, args[6]);
     OFFSET(MULTICALL_result, struct multicall_entry, result);
     BLANK();
 
diff -r 5176c3ea3293 -r b725c9e51a7c xen/arch/x86/x86_64/asm-offsets.c
--- a/xen/arch/x86/x86_64/asm-offsets.c Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/arch/x86/x86_64/asm-offsets.c Sat Oct 14 13:28:45 2006 -0600
@@ -112,7 +112,6 @@ void __dummy__(void)
     OFFSET(MULTICALL_arg3, struct multicall_entry, args[3]);
     OFFSET(MULTICALL_arg4, struct multicall_entry, args[4]);
     OFFSET(MULTICALL_arg5, struct multicall_entry, args[5]);
-    OFFSET(MULTICALL_arg6, struct multicall_entry, args[6]);
     OFFSET(MULTICALL_result, struct multicall_entry, result);
     BLANK();
 
diff -r 5176c3ea3293 -r b725c9e51a7c xen/common/elf.c
--- a/xen/common/elf.c  Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/common/elf.c  Sat Oct 14 13:28:45 2006 -0600
@@ -304,7 +304,7 @@ int parseelfimage(struct domain_setup_in
         if ( p != NULL && strncmp(p, "yes", 3) == 0 )
         {
             dsi->pae_kernel = PAEKERN_yes;
-            if ( !strncmp(p+4, "[extended-cr3]", 14) )
+            if ( !strncmp(p+3, "[extended-cr3]", 14) )
                 dsi->pae_kernel = PAEKERN_extended_cr3;
         }
     }
diff -r 5176c3ea3293 -r b725c9e51a7c xen/include/asm-x86/hvm/vmx/vmcs.h
--- a/xen/include/asm-x86/hvm/vmx/vmcs.h        Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/include/asm-x86/hvm/vmx/vmcs.h        Sat Oct 14 13:28:45 2006 -0600
@@ -28,19 +28,6 @@ extern void vmcs_dump_vcpu(void);
 extern void vmcs_dump_vcpu(void);
 extern void vmx_init_vmcs_config(void);
 extern void setup_vmcs_dump(void);
-
-enum {
-    VMX_CPU_STATE_PAE_ENABLED=0,
-    VMX_CPU_STATE_LME_ENABLED,
-    VMX_CPU_STATE_LMA_ENABLED,
-    VMX_CPU_STATE_ASSIST_ENABLED,
-};
-
-#define VMX_LONG_GUEST(ed)    \
-  (test_bit(VMX_CPU_STATE_LMA_ENABLED, &ed->arch.hvm_vmx.cpu_state))
-
-#define VMX_PAE_GUEST(ed)       \
-  (test_bit(VMX_CPU_STATE_PAE_ENABLED, &ed->arch.hvm_vmx.cpu_state))
 
 struct vmcs_struct {
     u32 vmcs_revision_id;
@@ -93,10 +80,10 @@ struct arch_vmx_struct {
     unsigned long        cpu_shadow_cr4; /* copy of guest read shadow CR4 */
     unsigned long        cpu_cr2; /* save CR2 */
     unsigned long        cpu_cr3;
-    unsigned long        cpu_state;
     unsigned long        cpu_based_exec_control;
     struct vmx_msr_state msr_content;
     void                *io_bitmap_a, *io_bitmap_b;
+    unsigned long        vmxassist_enabled:1; 
 };
 
 #define vmx_schedule_tail(next)         \
diff -r 5176c3ea3293 -r b725c9e51a7c xen/include/asm-x86/hvm/vmx/vmx.h
--- a/xen/include/asm-x86/hvm/vmx/vmx.h Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/include/asm-x86/hvm/vmx/vmx.h Sat Oct 14 13:28:45 2006 -0600
@@ -335,26 +335,30 @@ static inline int __vmxon (u64 addr)
     return rc;
 }
 
-/* Works only for vcpu == current */
 static inline int vmx_paging_enabled(struct vcpu *v)
 {
     unsigned long cr0;
-
     __vmread_vcpu(v, CR0_READ_SHADOW, &cr0);
-    return (cr0 & X86_CR0_PE) && (cr0 & X86_CR0_PG);
-}
-
-/* Works only for vcpu == current */
+    return ((cr0 & (X86_CR0_PE|X86_CR0_PG)) == (X86_CR0_PE|X86_CR0_PG));
+}
+
+static inline int vmx_pae_enabled(struct vcpu *v)
+{
+    unsigned long cr4;
+    __vmread_vcpu(v, CR4_READ_SHADOW, &cr4);
+    return (vmx_paging_enabled(v) && (cr4 & X86_CR4_PAE));
+}
+
 static inline int vmx_long_mode_enabled(struct vcpu *v)
 {
-    ASSERT(v == current);
-    return VMX_LONG_GUEST(current);
-}
-
-static inline int vmx_pae_enabled(struct vcpu *v)
-{
-    ASSERT(v == current);
-    return VMX_PAE_GUEST(current);
+    u64 efer = v->arch.hvm_vmx.msr_content.msr_items[VMX_INDEX_MSR_EFER];
+    return efer & EFER_LMA;
+}
+
+static inline int vmx_lme_is_set(struct vcpu *v)
+{
+    u64 efer = v->arch.hvm_vmx.msr_content.msr_items[VMX_INDEX_MSR_EFER];
+    return efer & EFER_LME;
 }
 
 /* Works only for vcpu == current */
diff -r 5176c3ea3293 -r b725c9e51a7c xen/include/asm-x86/msr.h
--- a/xen/include/asm-x86/msr.h Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/include/asm-x86/msr.h Sat Oct 14 13:28:45 2006 -0600
@@ -302,8 +302,14 @@ static inline void wrmsrl(unsigned int m
 
 #define MSR_K8_TOP_MEM1                        0xC001001A
 #define MSR_K8_TOP_MEM2                        0xC001001D
+#define MSR_K8_SYSCFG                  0xC0010010
+#define MSR_K8_HWCR                    0xC0010015
+#define MSR_K8_VM_CR                   0xC0010114
 #define MSR_K8_VM_HSAVE_PA             0xC0010117
-#define MSR_K8_SYSCFG                  0xC0000010      
+
+/* MSR_K8_VM_CR bits: */
+#define _K8_VMCR_SVME_DISABLE          4
+#define K8_VMCR_SVME_DISABLE           (1 << _K8_VMCR_SVME_DISABLE)
 
 /* Centaur-Hauls/IDT defined MSRs. */
 #define MSR_IDT_FCR1                   0x107
diff -r 5176c3ea3293 -r b725c9e51a7c xen/include/asm-x86/multicall.h
--- a/xen/include/asm-x86/multicall.h   Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/include/asm-x86/multicall.h   Sat Oct 14 13:28:45 2006 -0600
@@ -16,7 +16,7 @@
             "    movq  "STR(MULTICALL_op)"(%0),%%rax; "      \
             "    cmpq  $("STR(NR_hypercalls)"),%%rax; "      \
             "    jae   2f; "                                 \
-            "    leaq  "STR(hypercall_table)"(%%rip),%%rdi; "\
+            "    leaq  hypercall_table(%%rip),%%rdi; "       \
             "    leaq  (%%rdi,%%rax,8),%%rax; "              \
             "    movq  "STR(MULTICALL_arg0)"(%0),%%rdi; "    \
             "    movq  "STR(MULTICALL_arg1)"(%0),%%rsi; "    \
diff -r 5176c3ea3293 -r b725c9e51a7c xen/include/asm-x86/perfc_defn.h
--- a/xen/include/asm-x86/perfc_defn.h  Sun Oct 08 18:55:12 2006 -0600
+++ b/xen/include/asm-x86/perfc_defn.h  Sat Oct 14 13:28:45 2006 -0600
@@ -81,8 +81,8 @@ PERFCOUNTER_CPU(shadow_unshadow_bf,    "
 PERFCOUNTER_CPU(shadow_unshadow_bf,    "shadow unshadow brute-force")
 PERFCOUNTER_CPU(shadow_get_page_fail,  "shadow_get_page_from_l1e failed")
 PERFCOUNTER_CPU(shadow_guest_walk,     "shadow walks guest tables")
-PERFCOUNTER_CPU(shadow_walk_cache_hit, "shadow walk-cache hits")
-PERFCOUNTER_CPU(shadow_walk_cache_miss, "shadow walk-cache misses")
+PERFCOUNTER_CPU(shadow_invlpg,         "shadow emulates invlpg")
+PERFCOUNTER_CPU(shadow_invlpg_fault,   "shadow invlpg faults")
 
 
 /*#endif*/ /* __XEN_PERFC_DEFN_H__ */

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog


 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.