[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Xen-changelog] [xen-unstable] merge with xen-unstable.hg



# HG changeset patch
# User Isaku Yamahata <yamahata@xxxxxxxxxxxxx>
# Date 1216782620 -32400
# Node ID 1970781956c7f779a27f6b92fc07634269ae1cf0
# Parent  1e7a371cee11c6bf30f5f2f79dc56f315611a74c
# Parent  f86941c1b523e4c301210a8d74ab251fb3e2d6c8
merge with xen-unstable.hg
---
 .hgignore                                   |    1 
 extras/mini-os/arch/ia64/mm.c               |    5 
 extras/mini-os/arch/ia64/sched.c            |    5 
 extras/mini-os/arch/x86/mm.c                |   23 
 extras/mini-os/arch/x86/traps.c             |   93 +++
 extras/mini-os/fs-front.c                   |   39 +
 extras/mini-os/include/ia64/traps.h         |    2 
 extras/mini-os/include/list.h               |    6 
 extras/mini-os/include/mm.h                 |    1 
 extras/mini-os/include/x86/traps.h          |    1 
 extras/mini-os/kernel.c                     |    1 
 stubdom/Makefile                            |   12 
 stubdom/README                              |    4 
 tools/Makefile                              |    1 
 tools/examples/Makefile                     |    1 
 tools/examples/blktap                       |    1 
 tools/examples/block                        |    8 
 tools/examples/stubdom-ExampleHVMDomain     |   14 
 tools/examples/xmexample.hvm                |   14 
 tools/examples/xmexample.hvm-stubdom        |  320 +++++++++++++
 tools/flask/libflask/flask_op.c             |    6 
 tools/flask/libflask/include/flask.h        |    6 
 tools/fs-back/fs-backend.c                  |    2 
 tools/fs-back/fs-ops.c                      |    4 
 tools/ioemu/hw/pc.c                         |    6 
 tools/ioemu/hw/vga.c                        |   89 +--
 tools/libxc/xc_linux.c                      |   23 
 tools/libxc/xenctrl.h                       |   17 
 tools/python/xen/xend/XendNode.py           |   28 -
 tools/python/xen/xend/balloon.py            |   14 
 tools/python/xen/xend/image.py              |    4 
 tools/python/xen/xend/osdep.py              |   46 +
 tools/python/xen/xm/create.py               |   11 
 xen/arch/x86/acpi/cpufreq/cpufreq.c         |   41 -
 xen/arch/x86/domain.c                       |    4 
 xen/arch/x86/i8259.c                        |    2 
 xen/arch/x86/setup.c                        |   25 -
 xen/arch/x86/time.c                         |  104 ++--
 xen/common/keyhandler.c                     |    2 
 xen/drivers/passthrough/amd/pci_amd_iommu.c |   38 +
 xen/drivers/passthrough/vtd/dmar.h          |    2 
 xen/drivers/passthrough/vtd/iommu.c         |   49 +-
 xen/include/asm-x86/hvm/vpt.h               |    2 
 xen/include/public/xsm/flask_op.h           |    8 
 xen/include/xen/pci.h                       |    6 
 xen/include/xsm/xsm.h                       |    6 
 xen/xsm/dummy.c                             |    6 
 xen/xsm/flask/avc.c                         |    4 
 xen/xsm/flask/flask_op.c                    |  652 ++++++++++------------------
 xen/xsm/flask/hooks.c                       |   13 
 xen/xsm/flask/include/avc.h                 |    2 
 51 files changed, 1097 insertions(+), 677 deletions(-)

diff -r 1e7a371cee11 -r 1970781956c7 .hgignore
--- a/.hgignore Wed Jul 23 11:21:47 2008 +0900
+++ b/.hgignore Wed Jul 23 12:10:20 2008 +0900
@@ -138,6 +138,7 @@
 ^tools/firmware/vgabios/vbetables-gen$
 ^tools/firmware/vgabios/vbetables\.h$
 ^tools/flask/loadpolicy/flask-loadpolicy$
+^tools/fs-back/fs-backend$
 ^tools/include/xen/.*$
 ^tools/include/xen-foreign/.*\.(c|h|size)$
 ^tools/include/xen-foreign/checker$
diff -r 1e7a371cee11 -r 1970781956c7 extras/mini-os/arch/ia64/mm.c
--- a/extras/mini-os/arch/ia64/mm.c     Wed Jul 23 11:21:47 2008 +0900
+++ b/extras/mini-os/arch/ia64/mm.c     Wed Jul 23 12:10:20 2008 +0900
@@ -130,6 +130,11 @@ arch_init_demand_mapping_area(unsigned l
        max_pfn = max_pfn;
 }
 
+unsigned long allocate_ondemand(unsigned long n, unsigned long alignment)
+{
+        return 0;
+}
+
 /* Helper function used in gnttab.c. */
 void do_map_frames(unsigned long addr,
         unsigned long *f, unsigned long n, unsigned long stride,
diff -r 1e7a371cee11 -r 1970781956c7 extras/mini-os/arch/ia64/sched.c
--- a/extras/mini-os/arch/ia64/sched.c  Wed Jul 23 11:21:47 2008 +0900
+++ b/extras/mini-os/arch/ia64/sched.c  Wed Jul 23 12:10:20 2008 +0900
@@ -33,6 +33,11 @@
 
 /* The function is implemented in fw.S */
 extern void thread_starter(void);
+
+void stack_walk(void)
+{
+    /* TODO */
+}
 
 struct thread*
 arch_create_thread(char *name, void (*function)(void *), void *data)
diff -r 1e7a371cee11 -r 1970781956c7 extras/mini-os/arch/x86/mm.c
--- a/extras/mini-os/arch/x86/mm.c      Wed Jul 23 11:21:47 2008 +0900
+++ b/extras/mini-os/arch/x86/mm.c      Wed Jul 23 12:10:20 2008 +0900
@@ -492,9 +492,7 @@ void do_map_frames(unsigned long addr,
     }
 }
 
-void *map_frames_ex(unsigned long *f, unsigned long n, unsigned long stride,
-       unsigned long increment, unsigned long alignment, domid_t id,
-       int may_fail, unsigned long prot)
+unsigned long allocate_ondemand(unsigned long n, unsigned long alignment)
 {
     unsigned long x;
     unsigned long y = 0;
@@ -517,13 +515,24 @@ void *map_frames_ex(unsigned long *f, un
     }
     if (y != n) {
         printk("Failed to find %ld frames!\n", n);
+        return 0;
+    }
+    return demand_map_area_start + x * PAGE_SIZE;
+}
+
+void *map_frames_ex(unsigned long *f, unsigned long n, unsigned long stride,
+       unsigned long increment, unsigned long alignment, domid_t id,
+       int may_fail, unsigned long prot)
+{
+    unsigned long addr = allocate_ondemand(n, alignment);
+
+    if (!addr)
         return NULL;
-    }
 
     /* Found it at x.  Map it in. */
-    do_map_frames(demand_map_area_start + x * PAGE_SIZE, f, n, stride, 
increment, id, may_fail, prot);
-
-    return (void *)(unsigned long)(demand_map_area_start + x * PAGE_SIZE);
+    do_map_frames(addr, f, n, stride, increment, id, may_fail, prot);
+
+    return (void *)addr;
 }
 
 static void clear_bootstrap(void)
diff -r 1e7a371cee11 -r 1970781956c7 extras/mini-os/arch/x86/traps.c
--- a/extras/mini-os/arch/x86/traps.c   Wed Jul 23 11:21:47 2008 +0900
+++ b/extras/mini-os/arch/x86/traps.c   Wed Jul 23 12:10:20 2008 +0900
@@ -112,7 +112,7 @@ void page_walk(unsigned long virt_addres
         printk("   L2 = %"PRIpte" (%p)  [offset = %lx]\n", page, tab, 
l2_table_offset(addr));
         
         page = tab[l1_table_offset(addr)];
-        printk("    L1 = %"PRIpte" (%p)  [offset = %lx]\n", page, tab, 
l1_table_offset(addr));
+        printk("    L1 = %"PRIpte" [offset = %lx]\n", page, 
l1_table_offset(addr));
 
 }
 
@@ -155,6 +155,40 @@ static int handle_cow(unsigned long addr
        return 0;
 }
 
+static void do_stack_walk(unsigned long frame_base)
+{
+    unsigned long *frame = (void*) frame_base;
+    printk("base is %#lx ", frame_base);
+    printk("caller is %#lx\n", frame[1]);
+    if (frame[0])
+       do_stack_walk(frame[0]);
+}
+
+void stack_walk(void)
+{
+    unsigned long bp;
+#ifdef __x86_64__
+    asm("movq %%rbp, %0":"=r"(bp));
+#else
+    asm("movl %%ebp, %0":"=r"(bp));
+#endif
+    do_stack_walk(bp);
+}
+
+static void dump_mem(unsigned long addr)
+{
+    unsigned long i;
+    if (addr < PAGE_SIZE)
+       return;
+
+    for (i = ((addr)-16 ) & ~15; i < (((addr)+48 ) & ~15); i++)
+    {
+       if (!(i%16))
+           printk("\n%lx:", i);
+       printk(" %02x", *(unsigned char *)i);
+    }
+    printk("\n");
+}
 #define read_cr2() \
         (HYPERVISOR_shared_info->vcpu_info[smp_processor_id()].arch.cr2)
 
@@ -163,6 +197,7 @@ void do_page_fault(struct pt_regs *regs,
 void do_page_fault(struct pt_regs *regs, unsigned long error_code)
 {
     unsigned long addr = read_cr2();
+    struct sched_shutdown sched_shutdown = { .reason = SHUTDOWN_crash };
 
     if ((error_code & TRAP_PF_WRITE) && handle_cow(addr))
        return;
@@ -170,37 +205,61 @@ void do_page_fault(struct pt_regs *regs,
     /* If we are already handling a page fault, and got another one
        that means we faulted in pagetable walk. Continuing here would cause
        a recursive fault */       
-    if(handling_pg_fault) 
+    if(handling_pg_fault == 1) 
     {
         printk("Page fault in pagetable walk (access to invalid memory?).\n"); 
-        do_exit();
+        HYPERVISOR_sched_op(SCHEDOP_shutdown, &sched_shutdown);
     }
-    handling_pg_fault = 1;
-
-#if defined(__x86_64__)
-    printk("Page fault at linear address %p, rip %p, code %lx\n",
-           addr, regs->rip, error_code);
-#else
-    printk("Page fault at linear address %p, eip %p, code %lx\n",
-           addr, regs->eip, error_code);
-#endif
-
-    dump_regs(regs);
+    handling_pg_fault++;
+    barrier();
+
+#if defined(__x86_64__)
+    printk("Page fault at linear address %p, rip %p, regs %p, sp %p, our_sp 
%p, code %lx\n",
+           addr, regs->rip, regs, regs->rsp, &addr, error_code);
+#else
+    printk("Page fault at linear address %p, eip %p, regs %p, sp %p, our_sp 
%p, code %lx\n",
+           addr, regs->eip, regs, regs->esp, &addr, error_code);
+#endif
+
+    dump_regs(regs);
+#if defined(__x86_64__)
+    do_stack_walk(regs->rbp);
+    dump_mem(regs->rsp);
+    dump_mem(regs->rbp);
+    dump_mem(regs->rip);
+#else
+    do_stack_walk(regs->ebp);
+    dump_mem(regs->esp);
+    dump_mem(regs->ebp);
+    dump_mem(regs->eip);
+#endif
     page_walk(addr);
-    do_exit();
+    HYPERVISOR_sched_op(SCHEDOP_shutdown, &sched_shutdown);
     /* We should never get here ... but still */
-    handling_pg_fault = 0;
+    handling_pg_fault--;
 }
 
 void do_general_protection(struct pt_regs *regs, long error_code)
 {
+    struct sched_shutdown sched_shutdown = { .reason = SHUTDOWN_crash };
 #ifdef __i386__
     printk("GPF eip: %p, error_code=%lx\n", regs->eip, error_code);
 #else    
     printk("GPF rip: %p, error_code=%lx\n", regs->rip, error_code);
 #endif
     dump_regs(regs);
-    do_exit();
+#if defined(__x86_64__)
+    do_stack_walk(regs->rbp);
+    dump_mem(regs->rsp);
+    dump_mem(regs->rbp);
+    dump_mem(regs->rip);
+#else
+    do_stack_walk(regs->ebp);
+    dump_mem(regs->esp);
+    dump_mem(regs->ebp);
+    dump_mem(regs->eip);
+#endif
+    HYPERVISOR_sched_op(SCHEDOP_shutdown, &sched_shutdown);
 }
 
 
diff -r 1e7a371cee11 -r 1970781956c7 extras/mini-os/fs-front.c
--- a/extras/mini-os/fs-front.c Wed Jul 23 11:21:47 2008 +0900
+++ b/extras/mini-os/fs-front.c Wed Jul 23 12:10:20 2008 +0900
@@ -183,12 +183,13 @@ int fs_open(struct fs_import *import, ch
 
     /* Prepare request for the backend */
     back_req_id = reserve_fsif_request(import);
-    DEBUG("Backend request id=%d, gref=%d\n", back_req_id, fsr->gref);
+    DEBUG("Backend request id=%d\n", back_req_id);
 
     /* Prepare our private request structure */
     priv_req_id = get_id_from_freelist(import->freelist);
     DEBUG("Request id for fs_open call is: %d\n", priv_req_id);
     fsr = &import->requests[priv_req_id];
+    DEBUG("gref id=%d\n", fsr->gref);
     fsr->thread = current;
     sprintf(fsr->page, "%s", file);
 
@@ -221,7 +222,7 @@ int fs_close(struct fs_import *import, i
 
     /* Prepare request for the backend */
     back_req_id = reserve_fsif_request(import);
-    DEBUG("Backend request id=%d, gref=%d\n", back_req_id, fsr->gref);
+    DEBUG("Backend request id=%d\n", back_req_id);
 
     /* Prepare our private request structure */
     priv_req_id = get_id_from_freelist(import->freelist);
@@ -261,12 +262,13 @@ ssize_t fs_read(struct fs_import *import
 
     /* Prepare request for the backend */
     back_req_id = reserve_fsif_request(import);
-    DEBUG("Backend request id=%d, gref=%d\n", back_req_id, fsr->gref);
+    DEBUG("Backend request id=%d\n", back_req_id);
 
     /* Prepare our private request structure */
     priv_req_id = get_id_from_freelist(import->freelist);
     DEBUG("Request id for fs_read call is: %d\n", priv_req_id);
     fsr = &import->requests[priv_req_id];
+    DEBUG("gref=%d\n", fsr->gref);
     fsr->thread = current;
     memset(fsr->page, 0, PAGE_SIZE);
 
@@ -307,12 +309,13 @@ ssize_t fs_write(struct fs_import *impor
 
     /* Prepare request for the backend */
     back_req_id = reserve_fsif_request(import);
-    DEBUG("Backend request id=%d, gref=%d\n", back_req_id, fsr->gref);
+    DEBUG("Backend request id=%d\n", back_req_id);
 
     /* Prepare our private request structure */
     priv_req_id = get_id_from_freelist(import->freelist);
     DEBUG("Request id for fs_read call is: %d\n", priv_req_id);
     fsr = &import->requests[priv_req_id];
+    DEBUG("gref=%d\n", fsr->gref);
     fsr->thread = current;
     memcpy(fsr->page, buf, len);
     BUG_ON(len > PAGE_SIZE);
@@ -352,12 +355,13 @@ int fs_stat(struct fs_import *import,
 
     /* Prepare request for the backend */
     back_req_id = reserve_fsif_request(import);
-    DEBUG("Backend request id=%d, gref=%d\n", back_req_id, fsr->gref);
+    DEBUG("Backend request id=%d\n", back_req_id);
 
     /* Prepare our private request structure */
     priv_req_id = get_id_from_freelist(import->freelist);
     DEBUG("Request id for fs_stat call is: %d\n", priv_req_id);
     fsr = &import->requests[priv_req_id];
+    DEBUG("gref=%d\n", fsr->gref);
     fsr->thread = current;
     memset(fsr->page, 0, PAGE_SIZE);
 
@@ -394,7 +398,7 @@ int fs_truncate(struct fs_import *import
 
     /* Prepare request for the backend */
     back_req_id = reserve_fsif_request(import);
-    DEBUG("Backend request id=%d, gref=%d\n", back_req_id, fsr->gref);
+    DEBUG("Backend request id=%d\n", back_req_id);
 
     /* Prepare our private request structure */
     priv_req_id = get_id_from_freelist(import->freelist);
@@ -432,12 +436,13 @@ int fs_remove(struct fs_import *import, 
 
     /* Prepare request for the backend */
     back_req_id = reserve_fsif_request(import);
-    DEBUG("Backend request id=%d, gref=%d\n", back_req_id, fsr->gref);
+    DEBUG("Backend request id=%d\n", back_req_id);
 
     /* Prepare our private request structure */
     priv_req_id = get_id_from_freelist(import->freelist);
     DEBUG("Request id for fs_open call is: %d\n", priv_req_id);
     fsr = &import->requests[priv_req_id];
+    DEBUG("gref=%d\n", fsr->gref);
     fsr->thread = current;
     sprintf(fsr->page, "%s", file);
 
@@ -475,12 +480,13 @@ int fs_rename(struct fs_import *import,
 
     /* Prepare request for the backend */
     back_req_id = reserve_fsif_request(import);
-    DEBUG("Backend request id=%d, gref=%d\n", back_req_id, fsr->gref);
+    DEBUG("Backend request id=%d\n", back_req_id);
 
     /* Prepare our private request structure */
     priv_req_id = get_id_from_freelist(import->freelist);
     DEBUG("Request id for fs_open call is: %d\n", priv_req_id);
     fsr = &import->requests[priv_req_id];
+    DEBUG("gref=%d\n", fsr->gref);
     fsr->thread = current;
     sprintf(fsr->page, "%s%s%c%s%s", 
             old_header, old_file_name, '\0', new_header, new_file_name);
@@ -521,12 +527,13 @@ int fs_create(struct fs_import *import, 
 
     /* Prepare request for the backend */
     back_req_id = reserve_fsif_request(import);
-    DEBUG("Backend request id=%d, gref=%d\n", back_req_id, fsr->gref);
+    DEBUG("Backend request id=%d\n", back_req_id);
 
     /* Prepare our private request structure */
     priv_req_id = get_id_from_freelist(import->freelist);
     DEBUG("Request id for fs_create call is: %d\n", priv_req_id);
     fsr = &import->requests[priv_req_id];
+    DEBUG("gref=%d\n", fsr->gref);
     fsr->thread = current;
     sprintf(fsr->page, "%s", name);
 
@@ -566,12 +573,13 @@ char** fs_list(struct fs_import *import,
 
     /* Prepare request for the backend */
     back_req_id = reserve_fsif_request(import);
-    DEBUG("Backend request id=%d, gref=%d\n", back_req_id, fsr->gref);
+    DEBUG("Backend request id=%d\n", back_req_id);
 
     /* Prepare our private request structure */
     priv_req_id = get_id_from_freelist(import->freelist);
     DEBUG("Request id for fs_list call is: %d\n", priv_req_id);
     fsr = &import->requests[priv_req_id];
+    DEBUG("gref=%d\n", fsr->gref);
     fsr->thread = current;
     sprintf(fsr->page, "%s", name);
 
@@ -615,7 +623,7 @@ int fs_chmod(struct fs_import *import, i
 
     /* Prepare request for the backend */
     back_req_id = reserve_fsif_request(import);
-    DEBUG("Backend request id=%d, gref=%d\n", back_req_id, fsr->gref);
+    DEBUG("Backend request id=%d\n", back_req_id);
 
     /* Prepare our private request structure */
     priv_req_id = get_id_from_freelist(import->freelist);
@@ -653,12 +661,13 @@ int64_t fs_space(struct fs_import *impor
 
     /* Prepare request for the backend */
     back_req_id = reserve_fsif_request(import);
-    DEBUG("Backend request id=%d, gref=%d\n", back_req_id, fsr->gref);
+    DEBUG("Backend request id=%d\n", back_req_id);
 
     /* Prepare our private request structure */
     priv_req_id = get_id_from_freelist(import->freelist);
     DEBUG("Request id for fs_space is: %d\n", priv_req_id);
     fsr = &import->requests[priv_req_id];
+    DEBUG("gref=%d\n", fsr->gref);
     fsr->thread = current;
     sprintf(fsr->page, "%s", location);
 
@@ -691,7 +700,7 @@ int fs_sync(struct fs_import *import, in
 
     /* Prepare request for the backend */
     back_req_id = reserve_fsif_request(import);
-    DEBUG("Backend request id=%d, gref=%d\n", back_req_id, fsr->gref);
+    DEBUG("Backend request id=%d\n", back_req_id);
 
     /* Prepare our private request structure */
     priv_req_id = get_id_from_freelist(import->freelist);
@@ -737,7 +746,7 @@ static void fsfront_handler(evtchn_port_
 
     DEBUG("Event from import [%d:%d].\n", import->dom_id, import->export_id);
 moretodo:   
-    rp = import->ring.sring->req_prod;
+    rp = import->ring.sring->rsp_prod;
     rmb(); /* Ensure we see queued responses up to 'rp'. */
     cons = import->ring.rsp_cons;
     while (cons != rp)
@@ -747,7 +756,7 @@ moretodo:
 
         rsp = RING_GET_RESPONSE(&import->ring, cons); 
         DEBUG("Response at idx=%d to request id=%d, ret_val=%lx\n", 
-            import->ring.rsp_cons, rsp->id, rsp->ret_val);
+            cons, rsp->id, rsp->ret_val);
         req = &import->requests[rsp->id];
         memcpy(&req->shadow_rsp, rsp, sizeof(struct fsif_response));
         DEBUG("Waking up: %s\n", req->thread->name);
diff -r 1e7a371cee11 -r 1970781956c7 extras/mini-os/include/ia64/traps.h
--- a/extras/mini-os/include/ia64/traps.h       Wed Jul 23 11:21:47 2008 +0900
+++ b/extras/mini-os/include/ia64/traps.h       Wed Jul 23 12:10:20 2008 +0900
@@ -48,5 +48,7 @@ inline static void trap_fini(void)
 
 #include "ia64_cpu.h"
 
+void stack_walk(void);
+
 #endif /* !defined(_TRAPS_H_) */
 
diff -r 1e7a371cee11 -r 1970781956c7 extras/mini-os/include/list.h
--- a/extras/mini-os/include/list.h     Wed Jul 23 11:21:47 2008 +0900
+++ b/extras/mini-os/include/list.h     Wed Jul 23 12:10:20 2008 +0900
@@ -23,6 +23,12 @@ struct list_head {
 #define INIT_LIST_HEAD(ptr) do { \
        (ptr)->next = (ptr); (ptr)->prev = (ptr); \
 } while (0)
+
+#define list_top(head, type, member)                                     \
+({                                                                       \
+       struct list_head *_head = (head);                                 \
+       list_empty(_head) ? NULL : list_entry(_head->next, type, member); \
+})
 
 /*
  * Insert a new entry between two known consecutive entries. 
diff -r 1e7a371cee11 -r 1970781956c7 extras/mini-os/include/mm.h
--- a/extras/mini-os/include/mm.h       Wed Jul 23 11:21:47 2008 +0900
+++ b/extras/mini-os/include/mm.h       Wed Jul 23 12:10:20 2008 +0900
@@ -63,6 +63,7 @@ void arch_init_mm(unsigned long* start_p
 void arch_init_mm(unsigned long* start_pfn_p, unsigned long* max_pfn_p);
 void arch_init_p2m(unsigned long max_pfn_p);
 
+unsigned long allocate_ondemand(unsigned long n, unsigned long alignment);
 /* map f[i*stride]+i*increment for i in 0..n-1, aligned on alignment pages */
 void *map_frames_ex(unsigned long *f, unsigned long n, unsigned long stride,
        unsigned long increment, unsigned long alignment, domid_t id,
diff -r 1e7a371cee11 -r 1970781956c7 extras/mini-os/include/x86/traps.h
--- a/extras/mini-os/include/x86/traps.h        Wed Jul 23 11:21:47 2008 +0900
+++ b/extras/mini-os/include/x86/traps.h        Wed Jul 23 12:10:20 2008 +0900
@@ -69,6 +69,7 @@ struct pt_regs {
 #endif
 
 void dump_regs(struct pt_regs *regs);
+void stack_walk(void);
 
 #define TRAP_PF_PROT   0x1
 #define TRAP_PF_WRITE  0x2
diff -r 1e7a371cee11 -r 1970781956c7 extras/mini-os/kernel.c
--- a/extras/mini-os/kernel.c   Wed Jul 23 11:21:47 2008 +0900
+++ b/extras/mini-os/kernel.c   Wed Jul 23 12:10:20 2008 +0900
@@ -592,6 +592,7 @@ void do_exit(void)
 void do_exit(void)
 {
     printk("Do_exit called!\n");
+    stack_walk();
     for( ;; )
     {
         struct sched_shutdown sched_shutdown = { .reason = SHUTDOWN_crash };
diff -r 1e7a371cee11 -r 1970781956c7 stubdom/Makefile
--- a/stubdom/Makefile  Wed Jul 23 11:21:47 2008 +0900
+++ b/stubdom/Makefile  Wed Jul 23 12:10:20 2008 +0900
@@ -85,7 +85,7 @@ NEWLIB_STAMPFILE=$(CROSS_ROOT)/$(GNU_TAR
 NEWLIB_STAMPFILE=$(CROSS_ROOT)/$(GNU_TARGET_ARCH)-xen-elf/lib/libc.a
 .PHONY: cross-newlib
 cross-newlib: $(NEWLIB_STAMPFILE)
-$(NEWLIB_STAMPFILE): newlib-$(NEWLIB_VERSION)
+$(NEWLIB_STAMPFILE): mk-headers newlib-$(NEWLIB_VERSION)
        mkdir -p newlib-build
        ( cd newlib-build && \
          CC_FOR_TARGET="$(CC) $(TARGET_CPPFLAGS) $(TARGET_CFLAGS) 
$(NEWLIB_CFLAGS)" AR_FOR_TARGET=$(AR) LD_FOR_TARGET=$(LD) 
RANLIB_FOR_TARGET=$(RANLIB) ../newlib-$(NEWLIB_VERSION)/configure 
--prefix=$(CROSS_PREFIX) --verbose --target=$(GNU_TARGET_ARCH)-xen-elf 
--enable-newlib-io-long-long --disable-multilib && \
@@ -205,7 +205,7 @@ TARGETS_MINIOS=$(addprefix mini-os-,$(TA
 
 .PHONY: libxc
 libxc: libxc/libxenctrl.a libxc/libxenguest.a
-libxc/libxenctrl.a libxc/libxenguest.a:: cross-zlib mk-headers
+libxc/libxenctrl.a libxc/libxenguest.a:: cross-zlib
        CPPFLAGS="$(TARGET_CPPFLAGS)" CFLAGS="$(TARGET_CFLAGS)" $(MAKE) -C libxc
 
 #######
@@ -213,7 +213,7 @@ libxc/libxenctrl.a libxc/libxenguest.a::
 #######
 
 .PHONY: ioemu
-ioemu: cross-zlib cross-libpci mk-headers libxc
+ioemu: cross-zlib cross-libpci libxc
 ifeq ($(CONFIG_QEMU),ioemu)
        [ -f ioemu/config-host.mak ] || \
          ( cd ioemu ; \
@@ -231,7 +231,7 @@ endif
 ######
 
 .PHONY: caml
-caml: cross-newlib mk-headers
+caml: $(CROSS_ROOT)
        CPPFLAGS="$(TARGET_CPPFLAGS)" CFLAGS="$(TARGET_CFLAGS)" $(MAKE) -C $@ 
LWIPDIR=$(CURDIR)/lwip 
 
 ###
@@ -239,7 +239,7 @@ caml: cross-newlib mk-headers
 ###
 
 .PHONY: c
-c: cross-newlib mk-headers
+c: $(CROSS_ROOT)
        CPPFLAGS="$(TARGET_CPPFLAGS)" CFLAGS="$(TARGET_CFLAGS)" $(MAKE) -C $@ 
LWIPDIR=$(CURDIR)/lwip 
 
 ######
@@ -257,7 +257,7 @@ grub-upstream: grub-$(GRUB_VERSION).tar.
        done
 
 .PHONY: grub
-grub: grub-upstream cross-newlib mk-headers
+grub: grub-upstream $(CROSS_ROOT)
        CPPFLAGS="$(TARGET_CPPFLAGS)" CFLAGS="$(TARGET_CFLAGS)" $(MAKE) -C $@
 
 ########
diff -r 1e7a371cee11 -r 1970781956c7 stubdom/README
--- a/stubdom/README    Wed Jul 23 11:21:47 2008 +0900
+++ b/stubdom/README    Wed Jul 23 12:10:20 2008 +0900
@@ -87,8 +87,8 @@ To run
 To run
 ======
 
-mkdir -p /exports/usr/share/qemu
-ln -s /usr/share/qemu/keymaps /exports/usr/share/qemu
+mkdir -p /exports/usr/share/xen/qemu
+ln -s /usr/share/xen/qemu/keymaps /exports/usr/share/xen/qemu
 mkdir -p /exports/var/lib
 ln -s /var/lib/xen /exports/var/lib
 /usr/sbin/fs-backend &
diff -r 1e7a371cee11 -r 1970781956c7 tools/Makefile
--- a/tools/Makefile    Wed Jul 23 11:21:47 2008 +0900
+++ b/tools/Makefile    Wed Jul 23 12:10:20 2008 +0900
@@ -22,6 +22,7 @@ SUBDIRS-y += blktap
 SUBDIRS-y += blktap
 SUBDIRS-y += libfsimage
 SUBDIRS-$(LIBXENAPI_BINDINGS) += libxen
+SUBDIRS-y += fs-back
 
 ifeq (ioemu,$(CONFIG_QEMU))
 SUBDIRS-$(CONFIG_IOEMU) += ioemu
diff -r 1e7a371cee11 -r 1970781956c7 tools/examples/Makefile
--- a/tools/examples/Makefile   Wed Jul 23 11:21:47 2008 +0900
+++ b/tools/examples/Makefile   Wed Jul 23 12:10:20 2008 +0900
@@ -28,6 +28,7 @@ XEN_SCRIPTS += vtpm vtpm-delete
 XEN_SCRIPTS += vtpm vtpm-delete
 XEN_SCRIPTS += xen-hotplug-cleanup
 XEN_SCRIPTS += external-device-migrate
+XEN_SCRIPTS += vscsi
 XEN_SCRIPT_DATA = xen-script-common.sh locking.sh logging.sh
 XEN_SCRIPT_DATA += xen-hotplug-common.sh xen-network-common.sh vif-common.sh
 XEN_SCRIPT_DATA += block-common.sh vtpm-common.sh vtpm-hotplug-common.sh
diff -r 1e7a371cee11 -r 1970781956c7 tools/examples/blktap
--- a/tools/examples/blktap     Wed Jul 23 11:21:47 2008 +0900
+++ b/tools/examples/blktap     Wed Jul 23 12:10:20 2008 +0900
@@ -69,7 +69,6 @@ if [ -L "$p" ]; then
 if [ -L "$p" ]; then
     file=$(readlink -f "$p") || fatal "$p link does not exist."
 else
-    [ -f "$p" ] || { fatal "$p file does not exist."; }
     file="$p"
 fi
 
diff -r 1e7a371cee11 -r 1970781956c7 tools/examples/block
--- a/tools/examples/block      Wed Jul 23 11:21:47 2008 +0900
+++ b/tools/examples/block      Wed Jul 23 12:10:20 2008 +0900
@@ -209,6 +209,14 @@ case "$command" in
         FRONTEND_ID=$(xenstore_read "$XENBUS_PATH/frontend-id")
         FRONTEND_UUID=$(xenstore_read_default \
             "/local/domain/$FRONTEND_ID/vm" 'unknown')
+
+        if [ -L "$dev" ]
+        then
+          dev=$(readlink -f "$dev") || fatal "$dev link does not exist."
+        fi
+        test -e "$dev" || fatal "$dev does not exist."
+        test -b "$dev" || fatal "$dev is not a block device."
+
         claim_lock "block"
         check_device_sharing "$dev" "$mode"
        write_dev "$dev"
diff -r 1e7a371cee11 -r 1970781956c7 tools/examples/stubdom-ExampleHVMDomain
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/tools/examples/stubdom-ExampleHVMDomain   Wed Jul 23 12:10:20 2008 +0900
@@ -0,0 +1,14 @@
+# Not to be started directly,
+# See xmexample.hvm-stubdom and stubdom/README for more details
+
+kernel = "/usr/lib/xen/boot/ioemu-stubdom.gz"
+
+# Must be the same as in xmexample.hvm-stubdom, with a prepended vif for TCP/IP
+# networking in the stubdomain itself, here just ''
+vif = [ '', 'type=ioemu, bridge=xenbr0' ]
+
+# Set here instead of in xmexample.hvm-stubdom
+disk = [ 'file:/var/images/min-el3-i386.img,hda,w', ',hdc:cdrom,r' ]
+
+# Actual output via PVFB
+vfb = [ 'type=sdl' ]
diff -r 1e7a371cee11 -r 1970781956c7 tools/examples/xmexample.hvm
--- a/tools/examples/xmexample.hvm      Wed Jul 23 11:21:47 2008 +0900
+++ b/tools/examples/xmexample.hvm      Wed Jul 23 12:10:20 2008 +0900
@@ -119,7 +119,7 @@ disk = [ 'file:/var/images/min-el3-i386.
 
 #============================================================================
 
-# New stuff
+# Device Model to be used
 device_model = '/usr/' + arch_libdir + '/xen/bin/qemu-dm'
 
 #-----------------------------------------------------------------------------
@@ -247,12 +247,14 @@ serial='pty'
 #vcpus=8
 #
 # Example for amd, expose a 5-core processor :
-# cpuid = ['1:ebx=xxxxxxxx00000001xxxxxxxxxxxxxxxx,
+# cpuid = ['1:ebx=xxxxxxxx00001010xxxxxxxxxxxxxxxx,
 #             edx=xxx1xxxxxxxxxxxxxxxxxxxxxxxxxxxx',
-# '0x80000008:ecx=xxxxxxxxxxxxxxxx0000xxxx00001010']
-#  - CPUID.1[EBX] : (Thread * Cores ) per processors
-#  - CPUID.1[EDX][HT] : Enable HT
-#  - CPUID.0x80000008[ECX] : Number of vcpus * 2
+# '0x80000001:ecx=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx1x',
+# '0x80000008:ecx=xxxxxxxxxxxxxxxxxxxxxxxxxx001001']
+#   - CPUID.1[EBX] : Threads per Core * Cores per Socket (2 * #vcpus)
+#   - CPUID.1[EDX][HT] : Enable HT
+#   - CPUID.0x80000001[CmpLegacy] : Use legacy method
+#   - CPUID.0x80000008[ECX] : #vcpus * 2 - 1
 #vcpus=5
 #
 #  Downgrade the cpuid to make a better compatibility for migration :
diff -r 1e7a371cee11 -r 1970781956c7 tools/examples/xmexample.hvm-stubdom
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/tools/examples/xmexample.hvm-stubdom      Wed Jul 23 12:10:20 2008 +0900
@@ -0,0 +1,320 @@
+#  -*- mode: python; -*-
+#============================================================================
+# Python configuration setup for 'xm create'.
+# This script sets the parameters used when a domain is created using 'xm 
create'.
+# You use a separate script for each domain you want to create, or 
+# you can set the parameters for the domain on the xm command line.
+#============================================================================
+#
+# This is a version using a stubdomain for device model, see
+# stubdom-ExampleHVMDomain and stubdom/README for more details
+# The differences with xmexample.hvm are marked with "STUBDOM"
+
+#----------------------------------------------------------------------------
+# Kernel image file.
+kernel = "/usr/lib/xen/boot/hvmloader"
+
+# The domain build function. HVM domain uses 'hvm'.
+builder='hvm'
+
+# Initial memory allocation (in megabytes) for the new domain.
+#
+# WARNING: Creating a domain with insufficient memory may cause out of
+#          memory errors. The domain needs enough memory to boot kernel
+#          and modules. Allocating less than 32MBs is not recommended.
+memory = 128
+
+# Shadow pagetable memory for the domain, in MB.
+# If not explicictly set, xend will pick an appropriate value.  
+# Should be at least 2KB per MB of domain memory, plus a few MB per vcpu.
+# shadow_memory = 8
+
+# A name for your domain. All domains must have different names.
+name = "ExampleHVMDomain"
+
+# 128-bit UUID for the domain.  The default behavior is to generate a new UUID
+# on each call to 'xm create'.
+#uuid = "06ed00fe-1162-4fc4-b5d8-11993ee4a8b9"
+
+#-----------------------------------------------------------------------------
+# The number of cpus guest platform has, default=1
+#vcpus=1
+
+# Enable/disable HVM guest PAE, default=1 (enabled)
+#pae=1
+
+# Enable/disable HVM guest ACPI, default=1 (enabled)
+#acpi=1
+
+# Enable/disable HVM APIC mode, default=1 (enabled)
+# Note that this option is ignored if vcpus > 1
+#apic=1
+
+# List of which CPUS this domain is allowed to use, default Xen picks
+#cpus = ""         # leave to Xen to pick
+#cpus = "0"        # all vcpus run on CPU0
+#cpus = "0-3,5,^1" # all vcpus run on cpus 0,2,3,5
+#cpus = ["2", "3"] # VCPU0 runs on CPU2, VCPU1 runs on CPU3
+
+# Optionally define mac and/or bridge for the network interfaces.
+# Random MACs are assigned if not given.
+#vif = [ 'type=ioemu, mac=00:16:3e:00:00:11, bridge=xenbr0, model=ne2k_pci' ]
+# type=ioemu specify the NIC is an ioemu device not netfront
+vif = [ 'type=ioemu, bridge=xenbr0' ]
+
+#----------------------------------------------------------------------------
+# Define the disk devices you want the domain to have access to, and
+# what you want them accessible as.
+# Each disk entry is of the form phy:UNAME,DEV,MODE
+# where UNAME is the device, DEV is the device name the domain will see,
+# and MODE is r for read-only, w for read-write.
+#
+# STUBDOM: do not put it here but in stubdom-ExampleHVMDomain
+
+#disk = [ 'phy:hda1,hda1,r' ]
+#disk = [ 'file:/var/images/min-el3-i386.img,hda,w', ',hdc:cdrom,r' ]
+
+#----------------------------------------------------------------------------
+# Configure the behaviour when a domain exits.  There are three 'reasons'
+# for a domain to stop: poweroff, reboot, and crash.  For each of these you
+# may specify:
+#
+#   "destroy",        meaning that the domain is cleaned up as normal;
+#   "restart",        meaning that a new domain is started in place of the old
+#                     one;
+#   "preserve",       meaning that no clean-up is done until the domain is
+#                     manually destroyed (using xm destroy, for example); or
+#   "rename-restart", meaning that the old domain is not cleaned up, but is
+#                     renamed and a new domain started in its place.
+#
+# In the event a domain stops due to a crash, you have the additional options:
+#
+#   "coredump-destroy", meaning dump the crashed domain's core and then 
destroy;
+#   "coredump-restart', meaning dump the crashed domain's core and the restart.
+#
+# The default is
+#
+#   on_poweroff = 'destroy'
+#   on_reboot   = 'restart'
+#   on_crash    = 'restart'
+#
+# For backwards compatibility we also support the deprecated option restart
+#
+# restart = 'onreboot' means on_poweroff = 'destroy'
+#                            on_reboot   = 'restart'
+#                            on_crash    = 'destroy'
+#
+# restart = 'always'   means on_poweroff = 'restart'
+#                            on_reboot   = 'restart'
+#                            on_crash    = 'restart'
+#
+# restart = 'never'    means on_poweroff = 'destroy'
+#                            on_reboot   = 'destroy'
+#                            on_crash    = 'destroy'
+
+#on_poweroff = 'destroy'
+#on_reboot   = 'restart'
+#on_crash    = 'restart'
+
+#============================================================================
+
+# Device Model to be used
+#
+# STUBDOM: this is a script that creates the stub domain running the device
+# model
+device_model = '/usr/lib/xen/bin/stubdom-dm'
+
+#-----------------------------------------------------------------------------
+# boot on floppy (a), hard disk (c), Network (n) or CD-ROM (d) 
+# default: hard disk, cd-rom, floppy
+#boot="cda"
+
+#-----------------------------------------------------------------------------
+#  write to temporary files instead of disk image files
+#snapshot=1
+
+#----------------------------------------------------------------------------
+# enable SDL library for graphics, default = 0
+# 
+# STUBDOM: always disable since the stub domain doesn't have direct X access
+sdl=0
+
+#----------------------------------------------------------------------------
+# enable OpenGL for texture rendering inside the SDL window, default = 1
+# valid only if sdl is enabled.
+# 
+# STUBDOM: always disable for the same reason
+opengl=0
+
+#----------------------------------------------------------------------------
+# enable VNC library for graphics, default = 1
+vnc=0
+
+#----------------------------------------------------------------------------
+# address that should be listened on for the VNC server if vnc is set.
+# default is to use 'vnc-listen' setting from /etc/xen/xend-config.sxp
+#vnclisten="127.0.0.1"
+
+#----------------------------------------------------------------------------
+# set VNC display number, default = domid
+#vncdisplay=1
+
+#----------------------------------------------------------------------------
+# try to find an unused port for the VNC server, default = 1
+#vncunused=1
+
+#----------------------------------------------------------------------------
+# enable spawning vncviewer for domain's console
+# (only valid when vnc=1), default = 0
+#vncconsole=0
+
+#----------------------------------------------------------------------------
+# set password for domain's VNC console
+# default is depents on vncpasswd in xend-config.sxp
+vncpasswd=''
+
+#----------------------------------------------------------------------------
+# no graphics, use serial port
+#nographic=0
+
+#----------------------------------------------------------------------------
+# enable stdvga, default = 0 (use cirrus logic device model)
+stdvga=0
+
+#-----------------------------------------------------------------------------
+#   serial port re-direct to pty deivce, /dev/pts/n 
+#   then xm console or minicom can connect
+# 
+# STUBDOM: always disable as the stub domain doesn't have access to dom0's
+# ptys
+#serial='pty'
+
+
+#-----------------------------------------------------------------------------
+#   Qemu Monitor, default is disable
+#   Use ctrl-alt-2 to connect
+#monitor=1
+
+
+#-----------------------------------------------------------------------------
+#   enable sound card support, [sb16|es1370|all|..,..], default none
+# 
+# STUBDOM: not supported
+#soundhw='sb16'
+
+
+#-----------------------------------------------------------------------------
+#    set the real time clock to local time [default=0 i.e. set to utc]
+#localtime=1
+
+
+#-----------------------------------------------------------------------------
+#    set the real time clock offset in seconds [default=0 i.e. same as dom0]
+#rtc_timeoffset=3600
+
+#-----------------------------------------------------------------------------
+#    start in full screen
+#full-screen=1   
+
+
+#-----------------------------------------------------------------------------
+#   Enable USB support (specific devices specified at runtime through the
+#                      monitor window)
+#usb=1
+
+#   Enable USB mouse support (only enable one of the following, `mouse' for
+#                            PS/2 protocol relative mouse, `tablet' for
+#                            absolute mouse)
+#usbdevice='mouse'
+#usbdevice='tablet'
+
+#-----------------------------------------------------------------------------
+#   Set keyboard layout, default is en-us keyboard. 
+#keymap='ja'
+
+#-----------------------------------------------------------------------------
+#   Configure guest CPUID responses:
+#
+#cpuid=[ '1:ecx=xxxxxxxxxxx00xxxxxxxxxxxxxxxxxxx,
+#           eax=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' ]
+# - Unset the SSE4 features (CPUID.1[ECX][20-19])
+# - Default behaviour for all other bits in ECX And EAX registers.
+# 
+# Each successive character represent a lesser-significant bit:
+#  '1' -> force the corresponding bit to 1
+#  '0' -> force to 0
+#  'x' -> Get a safe value (pass through and mask with the default policy)
+#  'k' -> pass through the host bit value
+#  's' -> as 'k' but preserve across save/restore and migration
+# 
+#   Expose to the guest multi-core cpu instead of multiple processors
+# Example for intel, expose a 8-core processor :
+#cpuid=['1:edx=xxx1xxxxxxxxxxxxxxxxxxxxxxxxxxxx,
+#          ebx=xxxxxxxx00010000xxxxxxxxxxxxxxxx',
+#     '4,0:eax=001111xxxxxxxxxxxxxxxxxxxxxxxxxx']
+#  - CPUID.1[EDX][HT] : Enable HT
+#  - CPUID.1[EBX] : Number of vcpus * 2
+#  - CPUID.4,0[EAX] : Number of vcpus * 2 - 1
+#vcpus=8
+#
+# Example for amd, expose a 5-core processor :
+# cpuid = ['1:ebx=xxxxxxxx00001010xxxxxxxxxxxxxxxx,
+#             edx=xxx1xxxxxxxxxxxxxxxxxxxxxxxxxxxx',
+# '0x80000001:ecx=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx1x',
+# '0x80000008:ecx=xxxxxxxxxxxxxxxxxxxxxxxxxx001001']
+#   - CPUID.1[EBX] : Threads per Core * Cores per Socket (2 * #vcpus)
+#   - CPUID.1[EDX][HT] : Enable HT
+#   - CPUID.0x80000001[CmpLegacy] : Use legacy method
+#   - CPUID.0x80000008[ECX] : #vcpus * 2 - 1
+#vcpus=5
+#
+#  Downgrade the cpuid to make a better compatibility for migration :
+# Look like a generic 686 :
+# cpuid = [ '0:eax=0x3,ebx=0x0,ecx=0x0,edx=0x0',
+#           '1:eax=0x06b1,
+#              ecx=xxxxxxxxxx0000xx00xxx0000000xx0,
+#              edx=xx00000xxxxxxx0xxxxxxxxx0xxxxxx',
+#           '4:eax=0x3,ebx=0x0,ecx=0x0,edx=0x0',
+#  '0x80000000:eax=0x3,ebx=0x0,ecx=0x0,edx=0x0']
+#  with the highest leaf
+#  - CPUID.0[EAX] : Set the highest leaf
+#  - CPUID.1[EAX] : 686 
+#  - CPUID.1[ECX] : Mask some features
+#  - CPUID.1[EDX] : Mask some features
+#  - CPUID.4 : Reply like the highest leaf, in our case CPUID.3
+#  - CPUID.0x80000000 : No extension we are on a Pentium III, reply like the
+#  highest leaf (CPUID.3).
+#
+#   Configure host CPUID consistency checks, which must be satisfied for this
+#   VM to be allowed to run on this host's processor type:
+#cpuid_check=[ '1:ecx=xxxxxxxxxxxxxxxxxxxxxxxxxx1xxxxx' ]
+# - Host must have VMX feature flag set
+#
+# The format is similar to the above for 'cpuid':
+#  '1' -> the bit must be '1'
+#  '0' -> the bit must be '0'
+#  'x' -> we don't care (do not check)
+#  's' -> the bit must be the same as on the host that started this VM
+
+
+#-----------------------------------------------------------------------------
+#   Configure PVSCSI devices:
+#
+#vscsi=[ 'PDEV, VDEV' ]
+#
+#   PDEV   gives physical SCSI device to be attached to specified guest
+#          domain by one of the following identifier format.
+#          - XX:XX:XX:XX (4-tuples with decimal notation which shows
+#                          "host:channel:target:lun")
+#          - /dev/sdxx or sdx
+#          - /dev/stxx or stx
+#          - /dev/sgxx or sgx
+#          - result of 'scsi_id -gu -s'.
+#            ex. # scsi_id -gu -s /block/sdb
+#                  36000b5d0006a0000006a0257004c0000
+#
+#   VDEV   gives virtual SCSI device by 4-tuples (XX:XX:XX:XX) as 
+#          which the specified guest domain recognize.
+#
+
+#vscsi = [ '/dev/sdx, 0:0:0:0' ]
diff -r 1e7a371cee11 -r 1970781956c7 tools/flask/libflask/flask_op.c
--- a/tools/flask/libflask/flask_op.c   Wed Jul 23 11:21:47 2008 +0900
+++ b/tools/flask/libflask/flask_op.c   Wed Jul 23 12:10:20 2008 +0900
@@ -22,7 +22,7 @@
 #include <flask.h>
 #include <xenctrl.h>
 
-int flask_load(int xc_handle, char *buf, int size)
+int flask_load(int xc_handle, char *buf, uint32_t size)
 {
     int err;
     flask_op_t op;
@@ -37,7 +37,7 @@ int flask_load(int xc_handle, char *buf,
     return 0;
 }
 
-int flask_context_to_sid(int xc_handle, char *buf, int size, uint32_t *sid)
+int flask_context_to_sid(int xc_handle, char *buf, uint32_t size, uint32_t 
*sid)
 {
     int err;
     flask_op_t op;
@@ -54,7 +54,7 @@ int flask_context_to_sid(int xc_handle, 
     return 0;
 }
 
-int flask_sid_to_context(int xc_handle, int sid, char *buf, int size)
+int flask_sid_to_context(int xc_handle, int sid, char *buf, uint32_t size)
 {
     int err;
     flask_op_t op;
diff -r 1e7a371cee11 -r 1970781956c7 tools/flask/libflask/include/flask.h
--- a/tools/flask/libflask/include/flask.h      Wed Jul 23 11:21:47 2008 +0900
+++ b/tools/flask/libflask/include/flask.h      Wed Jul 23 12:10:20 2008 +0900
@@ -15,8 +15,8 @@
 #include <xen/xen.h>
 #include <xen/xsm/flask_op.h>
 
-int flask_load(int xc_handle, char *buf, int size);
-int flask_context_to_sid(int xc_handle, char *buf, int size, uint32_t *sid);
-int flask_sid_to_context(int xc_handle, int sid, char *buf, int size);
+int flask_load(int xc_handle, char *buf, uint32_t size);
+int flask_context_to_sid(int xc_handle, char *buf, uint32_t size, uint32_t 
*sid);
+int flask_sid_to_context(int xc_handle, int sid, char *buf, uint32_t size);
 
 #endif /* __FLASK_H__ */
diff -r 1e7a371cee11 -r 1970781956c7 tools/fs-back/fs-backend.c
--- a/tools/fs-back/fs-backend.c        Wed Jul 23 11:21:47 2008 +0900
+++ b/tools/fs-back/fs-backend.c        Wed Jul 23 12:10:20 2008 +0900
@@ -239,7 +239,7 @@ static void handle_connection(int fronte
                                     mount->dom_id,
                                     mount->gref,
                                     PROT_READ | PROT_WRITE);
-    BACK_RING_INIT(&mount->ring, sring, PAGE_SIZE);
+    BACK_RING_INIT(&mount->ring, sring, XC_PAGE_SIZE);
     mount->nr_entries = mount->ring.nr_ents; 
     for (i = 0; i < MAX_FDS; i++)
         mount->fds[i] = -1;
diff -r 1e7a371cee11 -r 1970781956c7 tools/fs-back/fs-ops.c
--- a/tools/fs-back/fs-ops.c    Wed Jul 23 11:21:47 2008 +0900
+++ b/tools/fs-back/fs-ops.c    Wed Jul 23 12:10:20 2008 +0900
@@ -515,9 +515,9 @@ void dispatch_list(struct mount *mount, 
     /* If there was any error with reading the directory, errno will be set */
     error_code = errno;
     /* Copy file names of the remaining non-NULL dirents into buf */
-    assert(NAME_MAX < PAGE_SIZE >> 1);
+    assert(NAME_MAX < XC_PAGE_SIZE >> 1);
     while(dirent != NULL && 
-            (PAGE_SIZE - ((unsigned long)buf & PAGE_MASK) > NAME_MAX))
+            (XC_PAGE_SIZE - ((unsigned long)buf & XC_PAGE_MASK) > NAME_MAX))
     {
         int curr_length = strlen(dirent->d_name) + 1;
         
diff -r 1e7a371cee11 -r 1970781956c7 tools/ioemu/hw/pc.c
--- a/tools/ioemu/hw/pc.c       Wed Jul 23 11:21:47 2008 +0900
+++ b/tools/ioemu/hw/pc.c       Wed Jul 23 12:10:20 2008 +0900
@@ -591,9 +591,9 @@ static void load_linux(const char *kerne
             "qemu: real_addr     = %#zx\n"
             "qemu: cmdline_addr  = %#zx\n"
             "qemu: prot_addr     = %#zx\n",
-            real_addr,
-            cmdline_addr,
-            prot_addr);
+            (size_t)real_addr,
+            (size_t)cmdline_addr,
+            (size_t)prot_addr);
 
     /* highest address for loading the initrd */
     if (protocol >= 0x203)
diff -r 1e7a371cee11 -r 1970781956c7 tools/ioemu/hw/vga.c
--- a/tools/ioemu/hw/vga.c      Wed Jul 23 11:21:47 2008 +0900
+++ b/tools/ioemu/hw/vga.c      Wed Jul 23 12:10:20 2008 +0900
@@ -1511,51 +1511,52 @@ static void vga_draw_graphic(VGAState *s
            width, height, v, line_offset, s->cr[9], s->cr[0x17], 
s->line_compare, s->sr[0x01]);
 #endif
 
-    if (height - 1 > s->line_compare || multi_run || (s->cr[0x17] & 3) != 3
-            || !s->lfb_addr) {
-        /* Tricky things happen, just track all video memory */
-        start = 0;
-        end = s->vram_size;
-    } else {
-        /* Tricky things won't have any effect, i.e. we are in the very simple
-         * (and very usual) case of a linear buffer. */
-        /* use page table dirty bit tracking for the LFB plus border */
-        start = (s->start_addr * 4) & TARGET_PAGE_MASK;
-        end = ((s->start_addr * 4 + height * line_offset) + TARGET_PAGE_SIZE - 
1) & TARGET_PAGE_MASK;
-    }
-
-    for (y = 0 ; y < start; y += TARGET_PAGE_SIZE)
-        /* We will not read that anyway. */
-        cpu_physical_memory_set_dirty(s->vram_offset + y);
-
-    {
-        unsigned long npages = (end - y) / TARGET_PAGE_SIZE;
-        const int width = sizeof(unsigned long) * 8;
-        unsigned long bitmap[(npages + width - 1) / width];
-        int err;
-
-        if (!(err = xc_hvm_track_dirty_vram(xc_handle, domid,
-                    (s->lfb_addr + y) / TARGET_PAGE_SIZE, npages, bitmap))) {
-            int i, j;
-            for (i = 0; i < sizeof(bitmap) / sizeof(*bitmap); i++) {
-                unsigned long map = bitmap[i];
-                for (j = i * width; map && j < npages; map >>= 1, j++)
-                    if (map & 1)
-                        cpu_physical_memory_set_dirty(s->vram_offset + y
-                            + j * TARGET_PAGE_SIZE);
+    if (s->lfb_addr) {
+        if (height - 1 > s->line_compare || multi_run || (s->cr[0x17] & 3) != 
3) {
+            /* Tricky things happen, just track all video memory */
+            start = 0;
+            end = s->vram_size;
+        } else {
+            /* Tricky things won't have any effect, i.e. we are in the very 
simple
+             * (and very usual) case of a linear buffer. */
+            /* use page table dirty bit tracking for the LFB plus border */
+            start = (s->start_addr * 4) & TARGET_PAGE_MASK;
+            end = ((s->start_addr * 4 + height * line_offset) + 
TARGET_PAGE_SIZE - 1) & TARGET_PAGE_MASK;
+        }
+
+        for (y = 0 ; y < start; y += TARGET_PAGE_SIZE)
+            /* We will not read that anyway. */
+            cpu_physical_memory_set_dirty(s->vram_offset + y);
+
+        {
+            unsigned long npages = (end - y) / TARGET_PAGE_SIZE;
+            const int width = sizeof(unsigned long) * 8;
+            unsigned long bitmap[(npages + width - 1) / width];
+            int err;
+
+            if (!(err = xc_hvm_track_dirty_vram(xc_handle, domid,
+                        (s->lfb_addr + y) / TARGET_PAGE_SIZE, npages, 
bitmap))) {
+                int i, j;
+                for (i = 0; i < sizeof(bitmap) / sizeof(*bitmap); i++) {
+                    unsigned long map = bitmap[i];
+                    for (j = i * width; map && j < npages; map >>= 1, j++)
+                        if (map & 1)
+                            cpu_physical_memory_set_dirty(s->vram_offset + y
+                                + j * TARGET_PAGE_SIZE);
+                }
+                y += npages * TARGET_PAGE_SIZE;
+            } else {
+                /* ENODATA just means we have changed mode and will succeed
+                 * next time */
+                if (err != -ENODATA)
+                    fprintf(stderr, "track_dirty_vram(%lx, %lx) failed 
(%d)\n", s->lfb_addr + y, npages, err);
             }
-            y += npages * TARGET_PAGE_SIZE;
-        } else {
-            /* ENODATA just means we have changed mode and will succeed
-             * next time */
-            if (err != -ENODATA)
-                fprintf(stderr, "track_dirty_vram(%lx, %lx) failed (%d)\n", 
s->lfb_addr + y, npages, err);
-        }
-    }
-
-    for ( ; y < s->vram_size; y += TARGET_PAGE_SIZE)
-        /* We will not read that anyway. */
-        cpu_physical_memory_set_dirty(s->vram_offset + y);
+        }
+
+        for ( ; y < s->vram_size; y += TARGET_PAGE_SIZE)
+            /* We will not read that anyway. */
+            cpu_physical_memory_set_dirty(s->vram_offset + y);
+    }
 
     addr1 = (s->start_addr * 4);
     bwidth = (width * bits + 7) / 8;
diff -r 1e7a371cee11 -r 1970781956c7 tools/libxc/xc_linux.c
--- a/tools/libxc/xc_linux.c    Wed Jul 23 11:21:47 2008 +0900
+++ b/tools/libxc/xc_linux.c    Wed Jul 23 12:10:20 2008 +0900
@@ -418,9 +418,10 @@ void *xc_gnttab_map_grant_ref(int xcg_ha
     return addr;
 }
 
-void *xc_gnttab_map_grant_refs(int xcg_handle,
+static void *do_gnttab_map_grant_refs(int xcg_handle,
                                uint32_t count,
                                uint32_t *domids,
+                               int domids_stride,
                                uint32_t *refs,
                                int prot)
 {
@@ -435,7 +436,7 @@ void *xc_gnttab_map_grant_refs(int xcg_h
 
     for ( i = 0; i < count; i++ )
     {
-        map->refs[i].domid = domids[i];
+        map->refs[i].domid = domids[i * domids_stride];
         map->refs[i].ref   = refs[i];
     }
 
@@ -464,6 +465,24 @@ void *xc_gnttab_map_grant_refs(int xcg_h
     return addr;
 }
 
+void *xc_gnttab_map_grant_refs(int xcg_handle,
+                               uint32_t count,
+                               uint32_t *domids,
+                               uint32_t *refs,
+                               int prot)
+{
+    return do_gnttab_map_grant_refs(xcg_handle, count, domids, 1, refs, prot);
+}
+
+void *xc_gnttab_map_domain_grant_refs(int xcg_handle,
+                               uint32_t count,
+                               uint32_t domid,
+                               uint32_t *refs,
+                               int prot)
+{
+    return do_gnttab_map_grant_refs(xcg_handle, count, &domid, 0, refs, prot);
+}
+
 int xc_gnttab_munmap(int xcg_handle,
                      void *start_address,
                      uint32_t count)
diff -r 1e7a371cee11 -r 1970781956c7 tools/libxc/xenctrl.h
--- a/tools/libxc/xenctrl.h     Wed Jul 23 11:21:47 2008 +0900
+++ b/tools/libxc/xenctrl.h     Wed Jul 23 12:10:20 2008 +0900
@@ -865,6 +865,23 @@ void *xc_gnttab_map_grant_refs(int xcg_h
                                uint32_t *refs,
                                int prot);
 
+/**
+ * Memory maps one or more grant references from one domain to a
+ * contiguous local address range. Mappings should be unmapped with
+ * xc_gnttab_munmap.  Returns NULL on failure.
+ *
+ * @parm xcg_handle a handle on an open grant table interface
+ * @parm count the number of grant references to be mapped
+ * @parm domid the domain to map memory from
+ * @parm refs an array of @count grant references to be mapped
+ * @parm prot same flag as in mmap()
+ */
+void *xc_gnttab_map_domain_grant_refs(int xcg_handle,
+                                      uint32_t count,
+                                      uint32_t domid,
+                                      uint32_t *refs,
+                                      int prot);
+
 /*
  * Unmaps the @count pages starting at @start_address, which were mapped by a
  * call to xc_gnttab_map_grant_ref or xc_gnttab_map_grant_refs. Returns zero
diff -r 1e7a371cee11 -r 1970781956c7 tools/python/xen/xend/XendNode.py
--- a/tools/python/xen/xend/XendNode.py Wed Jul 23 11:21:47 2008 +0900
+++ b/tools/python/xen/xend/XendNode.py Wed Jul 23 12:10:20 2008 +0900
@@ -23,6 +23,7 @@ from xen.util import Brctl
 from xen.util import Brctl
 from xen.util import pci as PciUtil
 from xen.xend import XendAPIStore
+from xen.xend import osdep
 
 import uuid, arch
 from XendPBD import XendPBD
@@ -91,7 +92,7 @@ class XendNode:
         for cpu_uuid, cpu in saved_cpus.items():
             self.cpus[cpu_uuid] = cpu
 
-        cpuinfo = parse_proc_cpuinfo()
+        cpuinfo = osdep.get_cpuinfo()
         physinfo = self.physinfo_dict()
         cpu_count = physinfo['nr_cpus']
         cpu_features = physinfo['hw_caps']
@@ -743,31 +744,6 @@ class XendNode:
     def info_dict(self):
         return dict(self.info())
 
-def parse_proc_cpuinfo():
-    cpuinfo = {}
-    f = file('/proc/cpuinfo', 'r')
-    try:
-        p = -1
-        d = {}
-        for line in f:
-            keyvalue = line.split(':')
-            if len(keyvalue) != 2:
-                continue
-            key = keyvalue[0].strip()
-            val = keyvalue[1].strip()
-            if key == 'processor':
-                if p != -1:
-                    cpuinfo[p] = d
-                p = int(val)
-                d = {}
-            else:
-                d[key] = val
-        cpuinfo[p] = d
-        return cpuinfo
-    finally:
-        f.close()
-
-
 def instance():
     global inst
     try:
diff -r 1e7a371cee11 -r 1970781956c7 tools/python/xen/xend/balloon.py
--- a/tools/python/xen/xend/balloon.py  Wed Jul 23 11:21:47 2008 +0900
+++ b/tools/python/xen/xend/balloon.py  Wed Jul 23 12:10:20 2008 +0900
@@ -39,11 +39,11 @@ SLEEP_TIME_GROWTH = 0.1
 
 # A mapping between easy-to-remember labels and the more verbose
 # label actually shown in the PROC_XEN_BALLOON file.
-labels = { 'current'      : 'Current allocation',
-           'target'       : 'Requested target',
-           'low-balloon'  : 'Low-mem balloon',
-           'high-balloon' : 'High-mem balloon',
-           'limit'        : 'Xen hard limit' }
+#labels = { 'current'      : 'Current allocation',
+#           'target'       : 'Requested target',
+#           'low-balloon'  : 'Low-mem balloon',
+#           'high-balloon' : 'High-mem balloon',
+#           'limit'        : 'Xen hard limit' }
 
 def _get_proc_balloon(label):
     """Returns the value for the named label.  Returns None if the label was
@@ -54,7 +54,7 @@ def get_dom0_current_alloc():
 def get_dom0_current_alloc():
     """Returns the current memory allocation (in KiB) of dom0."""
 
-    kb = _get_proc_balloon(labels['current'])
+    kb = _get_proc_balloon('current')
     if kb == None:
         raise VmError('Failed to query current memory allocation of dom0.')
     return kb
@@ -62,7 +62,7 @@ def get_dom0_target_alloc():
 def get_dom0_target_alloc():
     """Returns the target memory allocation (in KiB) of dom0."""
 
-    kb = _get_proc_balloon(labels['target'])
+    kb = _get_proc_balloon('target')
     if kb == None:
         raise VmError('Failed to query target memory allocation of dom0.')
     return kb
diff -r 1e7a371cee11 -r 1970781956c7 tools/python/xen/xend/image.py
--- a/tools/python/xen/xend/image.py    Wed Jul 23 11:21:47 2008 +0900
+++ b/tools/python/xen/xend/image.py    Wed Jul 23 12:10:20 2008 +0900
@@ -265,9 +265,12 @@ class ImageHandler:
         has_vnc = int(vmConfig['platform'].get('vnc', 0)) != 0
         has_sdl = int(vmConfig['platform'].get('sdl', 0)) != 0
         opengl = 1
+        keymap = vmConfig['platform'].get("keymap")
         for dev_uuid in vmConfig['console_refs']:
             dev_type, dev_info = vmConfig['devices'][dev_uuid]
             if dev_type == 'vfb':
+                if 'keymap' in dev_info:
+                    keymap = dev_info.get('keymap',{})
                 vfb_type = dev_info.get('type', {})
                 if vfb_type == 'sdl':
                     self.display = dev_info.get('display', {})
@@ -279,7 +282,6 @@ class ImageHandler:
                     has_vnc = True
                 break
 
-        keymap = vmConfig['platform'].get("keymap")
         if keymap:
             ret.append("-k")
             ret.append(keymap)
diff -r 1e7a371cee11 -r 1970781956c7 tools/python/xen/xend/osdep.py
--- a/tools/python/xen/xend/osdep.py    Wed Jul 23 11:21:47 2008 +0900
+++ b/tools/python/xen/xend/osdep.py    Wed Jul 23 12:10:20 2008 +0900
@@ -41,12 +41,18 @@ def _linux_balloon_stat(label):
 def _linux_balloon_stat(label):
     """Returns the value for the named label, or None if an error occurs."""
 
+    xend2linux_labels = { 'current'      : 'Current allocation',
+                          'target'       : 'Requested target',
+                          'low-balloon'  : 'Low-mem balloon',
+                          'high-balloon' : 'High-mem balloon',
+                          'limit'        : 'Xen hard limit' }
+
     PROC_XEN_BALLOON = '/proc/xen/balloon'
     f = file(PROC_XEN_BALLOON, 'r')
     try:
         for line in f:
             keyvalue = line.split(':')
-            if keyvalue[0] == label:
+            if keyvalue[0] == xend2linux_labels[label]:
                 values = keyvalue[1].split()
                 if values[0].isdigit():
                     return int(values[0])
@@ -67,11 +73,11 @@ def _solaris_balloon_stat(label):
     BLN_IOCTL_LOW = 0x42410003
     BLN_IOCTL_HIGH = 0x42410004
     BLN_IOCTL_LIMIT = 0x42410005
-    label_to_ioctl = { 'Current allocation' : BLN_IOCTL_CURRENT,
-                       'Requested target'   : BLN_IOCTL_TARGET,
-                       'Low-mem balloon'    : BLN_IOCTL_LOW,
-                       'High-mem balloon'   : BLN_IOCTL_HIGH,
-                       'Xen hard limit'     : BLN_IOCTL_LIMIT }
+    label_to_ioctl = { 'current'      : BLN_IOCTL_CURRENT,
+                       'target'       : BLN_IOCTL_TARGET,
+                       'low-balloon'  : BLN_IOCTL_LOW,
+                       'high-balloon' : BLN_IOCTL_HIGH,
+                       'limit'        : BLN_IOCTL_LIMIT }
 
     f = file(DEV_XEN_BALLOON, 'r')
     try:
@@ -87,6 +93,33 @@ _balloon_stat = {
     "SunOS": _solaris_balloon_stat
 }
 
+def _linux_get_cpuinfo():
+    cpuinfo = {}
+    f = file('/proc/cpuinfo', 'r')
+    try:    
+        p = -1  
+        d = {}  
+        for line in f:
+            keyvalue = line.split(':')
+            if len(keyvalue) != 2:
+                continue 
+            key = keyvalue[0].strip()
+            val = keyvalue[1].strip()
+            if key == 'processor':
+                if p != -1:
+                    cpuinfo[p] = d
+                p = int(val)
+                d = {}
+            else:
+                d[key] = val
+        cpuinfo[p] = d
+        return cpuinfo
+    finally:
+        f.close()
+
+_get_cpuinfo = {
+}
+
 def _get(var, default=None):
     return var.get(os.uname()[0], default)
 
@@ -95,3 +128,4 @@ pygrub_path = _get(_pygrub_path, "/usr/b
 pygrub_path = _get(_pygrub_path, "/usr/bin/pygrub")
 vif_script = _get(_vif_script, "vif-bridge")
 lookup_balloon_stat = _get(_balloon_stat, _linux_balloon_stat)
+get_cpuinfo = _get(_get_cpuinfo, _linux_get_cpuinfo)
diff -r 1e7a371cee11 -r 1970781956c7 tools/python/xen/xm/create.py
--- a/tools/python/xen/xm/create.py     Wed Jul 23 11:21:47 2008 +0900
+++ b/tools/python/xen/xm/create.py     Wed Jul 23 12:10:20 2008 +0900
@@ -325,7 +325,7 @@ gopts.var('irq', val='IRQ',
          For example 'irq=7'.
          This option may be repeated to add more than one IRQ.""")
 
-gopts.var('vfb', 
val="type={vnc,sdl},vncunused=1,vncdisplay=N,vnclisten=ADDR,display=DISPLAY,xauthority=XAUTHORITY,vncpasswd=PASSWORD,opengl=1",
+gopts.var('vfb', 
val="type={vnc,sdl},vncunused=1,vncdisplay=N,vnclisten=ADDR,display=DISPLAY,xauthority=XAUTHORITY,vncpasswd=PASSWORD,opengl=1,keymap=FILE",
           fn=append_value, default=[],
           use="""Make the domain a framebuffer backend.
           The backend type should be either sdl or vnc.
@@ -336,7 +336,8 @@ gopts.var('vfb', val="type={vnc,sdl},vnc
           default password.
           For type=sdl, a viewer will be started automatically using the
           given DISPLAY and XAUTHORITY, which default to the current user's
-          ones.  OpenGL will be used by default unless opengl is set to 0.""")
+          ones.  OpenGL will be used by default unless opengl is set to 0.
+          keymap overrides the XendD configured default layout file.""")
 
 gopts.var('vif', 
val="type=TYPE,mac=MAC,bridge=BRIDGE,ip=IPADDR,script=SCRIPT," + \
           "backend=DOM,vifname=NAME,rate=RATE,model=MODEL,accel=ACCEL",
@@ -741,7 +742,7 @@ def configure_vfbs(config_devs, vals):
         for (k,v) in d.iteritems():
             if not k in [ 'vnclisten', 'vncunused', 'vncdisplay', 'display',
                           'videoram', 'xauthority', 'type', 'vncpasswd',
-                          'opengl' ]:
+                          'opengl', 'keymap' ]:
                 err("configuration option %s unknown to vfbs" % k)
             config.append([k,v])
         if not d.has_key("keymap"):
@@ -955,6 +956,10 @@ def preprocess_cpuid(vals, attr_name):
                 if reg_match == None:
                     err("cpuid's syntax is (eax|ebx|ecx|edx)=value")
                 res = reg_match.groupdict()
+                if (res['val'][:2] != '0x' and len(res['val']) != 32):
+                    err("cpuid: We should specify all the bits " \
+                        "of the register %s for input %s\n"
+                        % (res['reg'], input) )
                 cpuid[input][res['reg']] = res['val'] # new register
     setattr(vals, attr_name, cpuid)
 
diff -r 1e7a371cee11 -r 1970781956c7 xen/arch/x86/acpi/cpufreq/cpufreq.c
--- a/xen/arch/x86/acpi/cpufreq/cpufreq.c       Wed Jul 23 11:21:47 2008 +0900
+++ b/xen/arch/x86/acpi/cpufreq/cpufreq.c       Wed Jul 23 12:10:20 2008 +0900
@@ -237,9 +237,9 @@ static u32 get_cur_val(cpumask_t mask)
  * Only IA32_APERF/IA32_MPERF ratio is architecturally defined and
  * no meaning should be associated with absolute values of these MSRs.
  */
-/* FIXME: handle query on non-current cpu later */
-static unsigned int get_measured_perf(unsigned int cpu)
-{
+static void  __get_measured_perf(void *perf_percent)
+{
+    unsigned int *ratio = perf_percent;
     union {
         struct {
             uint32_t lo;
@@ -248,9 +248,6 @@ static unsigned int get_measured_perf(un
         uint64_t whole;
     } aperf_cur, mperf_cur;
 
-    unsigned int perf_percent;
-    unsigned int retval;
-
     rdmsr(MSR_IA32_APERF, aperf_cur.split.lo, aperf_cur.split.hi);
     rdmsr(MSR_IA32_MPERF, mperf_cur.split.lo, mperf_cur.split.hi);
 
@@ -264,10 +261,21 @@ static unsigned int get_measured_perf(un
     }
 
     if (aperf_cur.whole && mperf_cur.whole)
-        perf_percent = (aperf_cur.whole * 100) / mperf_cur.whole;
+        *ratio = (aperf_cur.whole * 100) / mperf_cur.whole;
     else
-        perf_percent = 0;
-
+        *ratio = 0;
+}
+
+static unsigned int get_measured_perf(unsigned int cpu)
+{
+    unsigned int retval, perf_percent;
+    cpumask_t cpumask;
+
+    if (!cpu_online(cpu))
+        return 0;
+
+    cpumask = cpumask_of_cpu(cpu);
+    on_selected_cpus(cpumask, __get_measured_perf, (void *)&perf_percent,0,1);
 
     retval = drv_data[cpu]->max_freq * perf_percent / 100;
     return retval;
@@ -433,16 +441,13 @@ acpi_cpufreq_cpu_init(struct cpufreq_pol
     perf = data->acpi_data;
     policy->shared_type = perf->shared_type;
 
-    /*
-     * Will let policy->cpus know about dependency only when software
-     * coordination is required.
+    /* 
+     * Currently the latest linux (kernel version 2.6.26) 
+     * still has issue when handle the situation _psd HW_ALL coordination.
+     * In Xen hypervisor, we handle _psd HW_ALL coordination in same way as
+     * _psd SW_ALL coordination for the seek of safety.
      */
-    if (policy->shared_type == CPUFREQ_SHARED_TYPE_ALL ||
-        policy->shared_type == CPUFREQ_SHARED_TYPE_ANY) {
-        policy->cpus = perf->shared_cpu_map;
-    } else {
-        policy->cpus = cpumask_of_cpu(cpu);    
-    }
+    policy->cpus = perf->shared_cpu_map;
 
     /* capability check */
     if (perf->state_count <= 1) {
diff -r 1e7a371cee11 -r 1970781956c7 xen/arch/x86/domain.c
--- a/xen/arch/x86/domain.c     Wed Jul 23 11:21:47 2008 +0900
+++ b/xen/arch/x86/domain.c     Wed Jul 23 12:10:20 2008 +0900
@@ -286,10 +286,6 @@ int vcpu_initialise(struct vcpu *v)
 
     v->arch.flags = TF_kernel_mode;
 
-    /* Ensure that update_vcpu_system_time() fires at least once. */
-    if ( !is_idle_domain(d) )
-        vcpu_info(v, time).tsc_timestamp = ~0ull;
-
 #if defined(__i386__)
     mapcache_vcpu_init(v);
 #endif
diff -r 1e7a371cee11 -r 1970781956c7 xen/arch/x86/i8259.c
--- a/xen/arch/x86/i8259.c      Wed Jul 23 11:21:47 2008 +0900
+++ b/xen/arch/x86/i8259.c      Wed Jul 23 12:10:20 2008 +0900
@@ -411,7 +411,7 @@ void __init init_IRQ(void)
     apic_intr_init();
 
     /* Set the clock to HZ Hz */
-#define CLOCK_TICK_RATE 1193180 /* crystal freq (Hz) */
+#define CLOCK_TICK_RATE 1193182 /* crystal freq (Hz) */
 #define LATCH (((CLOCK_TICK_RATE)+(HZ/2))/HZ)
     outb_p(0x34, PIT_MODE);        /* binary, mode 2, LSB/MSB, ch 0 */
     outb_p(LATCH & 0xff, PIT_CH0); /* LSB */
diff -r 1e7a371cee11 -r 1970781956c7 xen/arch/x86/setup.c
--- a/xen/arch/x86/setup.c      Wed Jul 23 11:21:47 2008 +0900
+++ b/xen/arch/x86/setup.c      Wed Jul 23 12:10:20 2008 +0900
@@ -521,14 +521,6 @@ void __init __start_xen(unsigned long mb
     if ( ((unsigned long)cpu0_stack & (STACK_SIZE-1)) != 0 )
         EARLY_FAIL("Misaligned CPU0 stack.\n");
 
-    /*
-     * Since there are some stubs getting built on the stacks which use
-     * direct calls/jumps, the heap must be confined to the lower 2G so
-     * that those branches can reach their targets.
-     */
-    if ( opt_xenheap_megabytes > 2048 )
-        opt_xenheap_megabytes = 2048;
-
     if ( e820_raw_nr != 0 )
     {
         memmap_type = "Xen-e820";
@@ -599,6 +591,23 @@ void __init __start_xen(unsigned long mb
 
     /* Sanitise the raw E820 map to produce a final clean version. */
     max_page = init_e820(memmap_type, e820_raw, &e820_raw_nr);
+
+#ifdef CONFIG_X86_64
+    /*
+     * On x86/64 we are able to account for the allocation bitmap
+     * (allocated in common/page_alloc.c:init_boot_allocator()) stealing
+     * from the Xen heap. Here we make the Xen heap appropriately larger.
+     */
+    opt_xenheap_megabytes += (max_page / 8) >> 20;
+#endif
+
+    /*
+     * Since there are some stubs getting built on the stacks which use
+     * direct calls/jumps, the heap must be confined to the lower 2G so
+     * that those branches can reach their targets.
+     */
+    if ( opt_xenheap_megabytes > 2048 )
+        opt_xenheap_megabytes = 2048;
 
     /* Create a temporary copy of the E820 map. */
     memcpy(&boot_e820, &e820, sizeof(e820));
diff -r 1e7a371cee11 -r 1970781956c7 xen/arch/x86/time.c
--- a/xen/arch/x86/time.c       Wed Jul 23 11:21:47 2008 +0900
+++ b/xen/arch/x86/time.c       Wed Jul 23 12:10:20 2008 +0900
@@ -214,7 +214,7 @@ static struct irqaction irq0 = { timer_i
  * Return processor ticks per second / CALIBRATE_FRAC.
  */
 
-#define CLOCK_TICK_RATE 1193180 /* system crystal frequency (Hz) */
+#define CLOCK_TICK_RATE 1193182 /* system crystal frequency (Hz) */
 #define CALIBRATE_FRAC  20      /* calibrate over 50ms */
 #define CALIBRATE_LATCH ((CLOCK_TICK_RATE+(CALIBRATE_FRAC/2))/CALIBRATE_FRAC)
 
@@ -484,40 +484,29 @@ static int init_pmtimer(struct platform_
  * PLATFORM TIMER 5: TSC
  */
 
-#define platform_timer_is_tsc() (!strcmp(plt_src.name, "TSC"))
-static u64 tsc_freq;
-
-static u64 read_tsc_count(void)
-{
+static const char plt_tsc_name[] = "TSC";
+#define platform_timer_is_tsc() (plt_src.name == plt_tsc_name)
+
+static int init_tsctimer(struct platform_timesource *pts)
+{
+    if ( !tsc_invariant )
+        return 0;
+
+    pts->name = (char *)plt_tsc_name;
+    return 1;
+}
+
+static void make_tsctimer_record(void)
+{
+    struct cpu_time *t = &this_cpu(cpu_time);
+    s_time_t now;
     u64 tsc;
+
     rdtscll(tsc);
-    return tsc;
-}
-
-static int init_tsctimer(struct platform_timesource *pts)
-{
-    unsigned int cpu;
-
-    /*
-     * TODO: evaluate stability of TSC here, return 0 if not stable.
-     * For now we assume all TSCs are synchronised and hence can all share
-     * CPU 0's calibration values.
-     */
-    for_each_cpu ( cpu )
-    {
-        if ( cpu == 0 )
-            continue;
-        memcpy(&per_cpu(cpu_time, cpu),
-               &per_cpu(cpu_time, 0),
-               sizeof(struct cpu_time));
-    }
-
-    pts->name = "TSC";
-    pts->frequency = tsc_freq;
-    pts->read_counter = read_tsc_count;
-    pts->counter_bits = 64;
-
-    return 1;
+    now = scale_delta(tsc, &t->tsc_scale);
+
+    t->local_tsc_stamp = tsc;
+    t->stime_local_stamp = t->stime_master_stamp = now;
 }
 
 /************************************************************
@@ -585,6 +574,12 @@ static void platform_time_calibration(vo
 
 static void resume_platform_timer(void)
 {
+    if ( platform_timer_is_tsc() )
+    {
+        /* TODO: Save/restore TSC values. */
+        return;
+    }
+
     /* No change in platform_stime across suspend/resume. */
     platform_timer_stamp = plt_stamp64;
     plt_stamp = plt_src.read_counter();
@@ -619,6 +614,12 @@ static void init_platform_timer(void)
          !init_hpet(pts) &&
          !init_pmtimer(pts) )
         init_pit(pts);
+
+    if ( platform_timer_is_tsc() )
+    {
+        printk("Platform timer is TSC\n");
+        return;
+    }
 
     plt_mask = (u64)~0ull >> (64 - pts->counter_bits);
 
@@ -907,6 +908,14 @@ static void local_time_calibration(void 
     /* The overall calibration scale multiplier. */
     u32 calibration_mul_frac;
 
+    if ( platform_timer_is_tsc() )
+    {
+        make_tsctimer_record(); 
+        update_vcpu_system_time(current);
+        set_timer(&t->calibration_timer, NOW() + MILLISECS(10*1000));
+        return;
+    }
+
     prev_tsc          = t->local_tsc_stamp;
     prev_local_stime  = t->stime_local_stamp;
     prev_master_stime = t->stime_master_stamp;
@@ -1025,16 +1034,20 @@ void init_percpu_time(void)
     s_time_t now;
 
     if ( platform_timer_is_tsc() )
-        return;
+    {
+        make_tsctimer_record();
+        goto out;
+    }
 
     local_irq_save(flags);
     rdtscll(t->local_tsc_stamp);
-    now = read_platform_stime();
+    now = !plt_src.read_counter ? 0 : read_platform_stime();
     local_irq_restore(flags);
 
     t->stime_master_stamp = now;
     t->stime_local_stamp  = now;
 
+ out:
     init_timer(&t->calibration_timer, local_time_calibration,
                NULL, smp_processor_id());
     set_timer(&t->calibration_timer, NOW() + EPOCH);
@@ -1043,19 +1056,19 @@ void init_percpu_time(void)
 /* Late init function (after all CPUs are booted). */
 int __init init_xen_time(void)
 {
-    wc_sec = get_cmos_time();
-
     local_irq_disable();
+
+    /* check if TSC is invariant during deep C state
+       this is a new feature introduced by Nehalem*/
+    if ( cpuid_edx(0x80000007) & (1u<<8) )
+        tsc_invariant = 1;
+
+    init_percpu_time();
 
     stime_platform_stamp = 0;
     init_platform_timer();
 
-    init_percpu_time();
-
-    /* check if TSC is invariant during deep C state
-       this is a new feature introduced by Nehalem*/
-    if ( cpuid_edx(0x80000007) & (1U<<8) )
-        tsc_invariant = 1;
+    do_settime(get_cmos_time(), 0, NOW());
 
     local_irq_enable();
 
@@ -1068,7 +1081,6 @@ void __init early_time_init(void)
 {
     u64 tmp = init_pit_and_calibrate_tsc();
 
-    tsc_freq = tmp;
     set_time_scale(&this_cpu(cpu_time).tsc_scale, tmp);
 
     do_div(tmp, 1000);
@@ -1170,9 +1182,9 @@ int time_resume(void)
 
     resume_platform_timer();
 
-    do_settime(get_cmos_time() + cmos_utc_offset, 0, read_platform_stime());
-
     init_percpu_time();
+
+    do_settime(get_cmos_time() + cmos_utc_offset, 0, NOW());
 
     if ( !is_idle_vcpu(current) )
         update_vcpu_system_time(current);
diff -r 1e7a371cee11 -r 1970781956c7 xen/common/keyhandler.c
--- a/xen/common/keyhandler.c   Wed Jul 23 11:21:47 2008 +0900
+++ b/xen/common/keyhandler.c   Wed Jul 23 12:10:20 2008 +0900
@@ -240,10 +240,12 @@ static void read_clocks_slave(void *unus
 static void read_clocks_slave(void *unused)
 {
     unsigned int cpu = smp_processor_id();
+    local_irq_disable();
     while ( !cpu_isset(cpu, read_clocks_cpumask) )
         cpu_relax();
     read_clocks_time[cpu] = NOW();
     cpu_clear(cpu, read_clocks_cpumask);
+    local_irq_enable();
 }
 
 static void read_clocks(unsigned char key)
diff -r 1e7a371cee11 -r 1970781956c7 xen/drivers/passthrough/amd/pci_amd_iommu.c
--- a/xen/drivers/passthrough/amd/pci_amd_iommu.c       Wed Jul 23 11:21:47 
2008 +0900
+++ b/xen/drivers/passthrough/amd/pci_amd_iommu.c       Wed Jul 23 12:10:20 
2008 +0900
@@ -620,11 +620,49 @@ static int amd_iommu_return_device(
 
 static int amd_iommu_add_device(struct pci_dev *pdev)
 {
+    struct amd_iommu *iommu;
+    u16 bdf;
+    if ( !pdev->domain )
+        return -EINVAL;
+
+    bdf = (pdev->bus << 8) | pdev->devfn;
+    iommu = (bdf < ivrs_bdf_entries) ?
+    find_iommu_for_device(pdev->bus, pdev->devfn) : NULL;
+
+    if ( !iommu )
+    {
+        amd_iov_error("Fail to find iommu."
+            " %x:%x.%x cannot be assigned to domain %d\n", 
+            pdev->bus, PCI_SLOT(pdev->devfn),
+            PCI_FUNC(pdev->devfn), pdev->domain->domain_id);
+        return -ENODEV;
+    }
+
+    amd_iommu_setup_domain_device(pdev->domain, iommu, bdf);
     return 0;
 }
 
 static int amd_iommu_remove_device(struct pci_dev *pdev)
 {
+    struct amd_iommu *iommu;
+    u16 bdf;
+    if ( !pdev->domain )
+        return -EINVAL;
+
+    bdf = (pdev->bus << 8) | pdev->devfn;
+    iommu = (bdf < ivrs_bdf_entries) ?
+    find_iommu_for_device(pdev->bus, pdev->devfn) : NULL;
+
+    if ( !iommu )
+    {
+        amd_iov_error("Fail to find iommu."
+            " %x:%x.%x cannot be removed from domain %d\n", 
+            pdev->bus, PCI_SLOT(pdev->devfn),
+            PCI_FUNC(pdev->devfn), pdev->domain->domain_id);
+        return -ENODEV;
+    }
+
+    amd_iommu_disable_domain_device(pdev->domain, iommu, bdf);
     return 0;
 }
 
diff -r 1e7a371cee11 -r 1970781956c7 xen/drivers/passthrough/vtd/dmar.h
--- a/xen/drivers/passthrough/vtd/dmar.h        Wed Jul 23 11:21:47 2008 +0900
+++ b/xen/drivers/passthrough/vtd/dmar.h        Wed Jul 23 12:10:20 2008 +0900
@@ -76,7 +76,7 @@ struct acpi_atsr_unit {
 #define for_each_rmrr_device(rmrr, bdf, idx)            \
     list_for_each_entry(rmrr, &acpi_rmrr_units, list)   \
         /* assume there never is a bdf == 0 */          \
-        for (idx = 0; (bdf = rmrr->scope.devices[i]) && \
+        for (idx = 0; (bdf = rmrr->scope.devices[idx]) && \
                  idx < rmrr->scope.devices_cnt; idx++)
 
 struct acpi_drhd_unit * acpi_find_matched_drhd_unit(u8 bus, u8 devfn);
diff -r 1e7a371cee11 -r 1970781956c7 xen/drivers/passthrough/vtd/iommu.c
--- a/xen/drivers/passthrough/vtd/iommu.c       Wed Jul 23 11:21:47 2008 +0900
+++ b/xen/drivers/passthrough/vtd/iommu.c       Wed Jul 23 12:10:20 2008 +0900
@@ -1294,11 +1294,18 @@ static int domain_context_mapping(struct
     return ret;
 }
 
-static int domain_context_unmap_one(struct iommu *iommu, u8 bus, u8 devfn)
+static int domain_context_unmap_one(
+    struct domain *domain,
+    struct iommu *iommu,
+    u8 bus, u8 devfn)
 {
     struct context_entry *context, *context_entries;
     unsigned long flags;
     u64 maddr;
+    struct acpi_rmrr_unit *rmrr;
+    u16 bdf;
+    int i;
+    unsigned int is_rmrr_device = 0;
 
     maddr = bus_to_context_maddr(iommu, bus);
     context_entries = (struct context_entry *)map_vtd_domain_page(maddr);
@@ -1311,18 +1318,32 @@ static int domain_context_unmap_one(stru
     }
 
     spin_lock_irqsave(&iommu->lock, flags);
-    context_clear_present(*context);
-    context_clear_entry(*context);
-    iommu_flush_cache_entry(context);
-    iommu_flush_context_global(iommu, 0);
-    iommu_flush_iotlb_global(iommu, 0);
+    if ( domain->domain_id == 0 )
+    {
+        for_each_rmrr_device ( rmrr, bdf, i )
+        {
+            if ( PCI_BUS(bdf) == bus && PCI_DEVFN2(bdf) == devfn )
+            {
+                is_rmrr_device = 1;
+                break;
+            }
+        }
+    }
+    if ( !is_rmrr_device )
+    {
+        context_clear_present(*context);
+        context_clear_entry(*context);
+        iommu_flush_cache_entry(context);
+        iommu_flush_context_domain(iommu, domain_iommu_domid(domain), 0);
+        iommu_flush_iotlb_dsi(iommu, domain_iommu_domid(domain), 0);
+    }
     unmap_vtd_domain_page(context_entries);
     spin_unlock_irqrestore(&iommu->lock, flags);
 
     return 0;
 }
 
-static int domain_context_unmap(u8 bus, u8 devfn)
+static int domain_context_unmap(struct domain *domain, u8 bus, u8 devfn)
 {
     struct acpi_drhd_unit *drhd;
     u16 sec_bus, sub_bus;
@@ -1345,18 +1366,18 @@ static int domain_context_unmap(u8 bus, 
                                  PCI_SUBORDINATE_BUS);
         /*dmar_scope_remove_buses(&drhd->scope, sec_bus, sub_bus);*/
         if ( DEV_TYPE_PCI_BRIDGE )
-            ret = domain_context_unmap_one(drhd->iommu, bus, devfn);
+            ret = domain_context_unmap_one(domain, drhd->iommu, bus, devfn);
         break;
 
     case DEV_TYPE_PCIe_ENDPOINT:
-        ret = domain_context_unmap_one(drhd->iommu, bus, devfn);
+        ret = domain_context_unmap_one(domain, drhd->iommu, bus, devfn);
         break;
 
     case DEV_TYPE_PCI:
         if ( find_pcie_endpoint(&bus, &devfn, &secbus) )
-            ret = domain_context_unmap_one(drhd->iommu, bus, devfn);
+            ret = domain_context_unmap_one(domain, drhd->iommu, bus, devfn);
         if ( bus != secbus )
-            domain_context_unmap_one(drhd->iommu, secbus, 0);
+            domain_context_unmap_one(domain, drhd->iommu, secbus, 0);
         break;
 
     default:
@@ -1386,7 +1407,7 @@ static int reassign_device_ownership(
 
     drhd = acpi_find_matched_drhd_unit(bus, devfn);
     pdev_iommu = drhd->iommu;
-    domain_context_unmap(bus, devfn);
+    domain_context_unmap(source, bus, devfn);
 
     write_lock(&pcidevs_lock);
     list_move(&pdev->domain_list, &target->arch.pdev_list);
@@ -1584,7 +1605,9 @@ static int intel_iommu_add_device(struct
 
 static int intel_iommu_remove_device(struct pci_dev *pdev)
 {
-    return domain_context_unmap(pdev->bus, pdev->devfn);
+    if ( !pdev->domain )
+        return -EINVAL;
+    return domain_context_unmap(pdev->domain, pdev->bus, pdev->devfn);
 }
 
 static void setup_dom0_devices(struct domain *d)
diff -r 1e7a371cee11 -r 1970781956c7 xen/include/asm-x86/hvm/vpt.h
--- a/xen/include/asm-x86/hvm/vpt.h     Wed Jul 23 11:21:47 2008 +0900
+++ b/xen/include/asm-x86/hvm/vpt.h     Wed Jul 23 12:10:20 2008 +0900
@@ -95,7 +95,7 @@ struct periodic_time {
 };
 
 
-#define PIT_FREQ 1193181
+#define PIT_FREQ 1193182
 #define PIT_BASE 0x40
 
 typedef struct PITState {
diff -r 1e7a371cee11 -r 1970781956c7 xen/include/public/xsm/flask_op.h
--- a/xen/include/public/xsm/flask_op.h Wed Jul 23 11:21:47 2008 +0900
+++ b/xen/include/public/xsm/flask_op.h Wed Jul 23 12:10:20 2008 +0900
@@ -32,10 +32,12 @@
 #define FLASK_AVC_CACHESTATS    19
 #define FLASK_MEMBER            20
 
+#define FLASK_LAST              FLASK_MEMBER
+
 typedef struct flask_op {
-    int   cmd;
-    int   size;
-    char *buf;
+    uint32_t  cmd;
+    uint32_t  size;
+    char      *buf;
 } flask_op_t;
 
 DEFINE_XEN_GUEST_HANDLE(flask_op_t);
diff -r 1e7a371cee11 -r 1970781956c7 xen/include/xen/pci.h
--- a/xen/include/xen/pci.h     Wed Jul 23 11:21:47 2008 +0900
+++ b/xen/include/xen/pci.h     Wed Jul 23 12:10:20 2008 +0900
@@ -24,10 +24,10 @@
 #define PCI_BUS(bdf)    (((bdf) >> 8) & 0xff)
 #define PCI_SLOT(bdf)   (((bdf) >> 3) & 0x1f)
 #define PCI_FUNC(bdf)   ((bdf) & 0x07)
-#define PCI_DEVFN(d,f)  (((d & 0x1f) << 3) | (f & 0x07))
+#define PCI_DEVFN(d,f)  ((((d) & 0x1f) << 3) | ((f) & 0x07))
 #define PCI_DEVFN2(bdf) ((bdf) & 0xff)
-#define PCI_BDF(b,d,f)  (((b * 0xff) << 8) | PCI_DEVFN(d,f))
-#define PCI_BDF2(b,df)  (((b & 0xff) << 8) | (df & 0xff))
+#define PCI_BDF(b,d,f)  ((((b) & 0xff) << 8) | PCI_DEVFN(d,f))
+#define PCI_BDF2(b,df)  ((((b) & 0xff) << 8) | ((df) & 0xff))
 
 struct pci_dev {
     struct list_head alldevs_list;
diff -r 1e7a371cee11 -r 1970781956c7 xen/include/xsm/xsm.h
--- a/xen/include/xsm/xsm.h     Wed Jul 23 11:21:47 2008 +0900
+++ b/xen/include/xsm/xsm.h     Wed Jul 23 12:10:20 2008 +0900
@@ -108,7 +108,6 @@ struct xsm_operations {
     int (*schedop_shutdown) (struct domain *d1, struct domain *d2);
 
     long (*__do_xsm_op) (XEN_GUEST_HANDLE(xsm_op_t) op);
-    void (*complete_init) (struct domain *d);
 
 #ifdef CONFIG_X86
     int (*shadow_control) (struct domain *d, uint32_t op);
@@ -392,11 +391,6 @@ static inline long __do_xsm_op (XEN_GUES
     return xsm_call(__do_xsm_op(op));
 }
 
-static inline void xsm_complete_init (struct domain *d)
-{
-    xsm_call(complete_init(d));
-}
-
 #ifdef XSM_ENABLE
 extern int xsm_init(unsigned int *initrdidx, const multiboot_info_t *mbi,
                                           unsigned long initial_images_start);
diff -r 1e7a371cee11 -r 1970781956c7 xen/xsm/dummy.c
--- a/xen/xsm/dummy.c   Wed Jul 23 11:21:47 2008 +0900
+++ b/xen/xsm/dummy.c   Wed Jul 23 12:10:20 2008 +0900
@@ -250,11 +250,6 @@ static int dummy_alloc_security_evtchn (
 }
 
 static void dummy_free_security_evtchn (struct evtchn *chn)
-{
-    return;
-}
-
-static void dummy_complete_init (struct domain *d)
 {
     return;
 }
@@ -462,7 +457,6 @@ void xsm_fixup_ops (struct xsm_operation
     set_to_dummy_if_null(ops, schedop_shutdown);
 
     set_to_dummy_if_null(ops, __do_xsm_op);
-    set_to_dummy_if_null(ops, complete_init);
 
 #ifdef CONFIG_X86
     set_to_dummy_if_null(ops, shadow_control);
diff -r 1e7a371cee11 -r 1970781956c7 xen/xsm/flask/avc.c
--- a/xen/xsm/flask/avc.c       Wed Jul 23 11:21:47 2008 +0900
+++ b/xen/xsm/flask/avc.c       Wed Jul 23 12:10:20 2008 +0900
@@ -250,7 +250,7 @@ void __init avc_init(void)
     printk("AVC INITIALIZED\n");
 }
 
-int avc_get_hash_stats(char *page)
+int avc_get_hash_stats(char *buf, uint32_t size)
 {
     int i, chain_len, max_chain_len, slots_used;
     struct avc_node *node;
@@ -274,7 +274,7 @@ int avc_get_hash_stats(char *page)
 
     rcu_read_unlock();
     
-    return snprintf(page, PAGE_SIZE, "entries: %d\nbuckets used: %d/%d\n"
+    return snprintf(buf, size, "entries: %d\nbuckets used: %d/%d\n"
                                 "longest chain: %d\n",
                                 atomic_read(&avc_cache.active_nodes),
                                 slots_used, AVC_CACHE_SLOTS, max_chain_len);
diff -r 1e7a371cee11 -r 1970781956c7 xen/xsm/flask/flask_op.c
--- a/xen/xsm/flask/flask_op.c  Wed Jul 23 11:21:47 2008 +0900
+++ b/xen/xsm/flask/flask_op.c  Wed Jul 23 12:10:20 2008 +0900
@@ -29,6 +29,43 @@ integer_param("flask_enabled", flask_ena
 integer_param("flask_enabled", flask_enabled);
 #endif
 
+#define MAX_POLICY_SIZE 0x4000000
+#define FLASK_COPY_IN \
+    ( \
+        1UL<<FLASK_LOAD | \
+        1UL<<FLASK_SETENFORCE | \
+        1UL<<FLASK_CONTEXT_TO_SID | \
+        1UL<<FLASK_SID_TO_CONTEXT | \
+        1UL<<FLASK_ACCESS | \
+        1UL<<FLASK_CREATE | \
+        1UL<<FLASK_RELABEL | \
+        1UL<<FLASK_USER | \
+        1UL<<FLASK_GETBOOL | \
+        1UL<<FLASK_SETBOOL | \
+        1UL<<FLASK_COMMITBOOLS | \
+        1UL<<FLASK_DISABLE | \
+        1UL<<FLASK_SETAVC_THRESHOLD | \
+        1UL<<FLASK_MEMBER \
+    )
+
+#define FLASK_COPY_OUT \
+    ( \
+        1UL<<FLASK_GETENFORCE | \
+        1UL<<FLASK_CONTEXT_TO_SID | \
+        1UL<<FLASK_SID_TO_CONTEXT | \
+        1UL<<FLASK_ACCESS | \
+        1UL<<FLASK_CREATE | \
+        1UL<<FLASK_RELABEL | \
+        1UL<<FLASK_USER | \
+        1UL<<FLASK_POLICYVERS | \
+        1UL<<FLASK_GETBOOL | \
+        1UL<<FLASK_MLS | \
+        1UL<<FLASK_GETAVC_THRESHOLD | \
+        1UL<<FLASK_AVC_HASHSTATS | \
+        1UL<<FLASK_AVC_CACHESTATS | \
+        1UL<<FLASK_MEMBER \
+    )
+
 static DEFINE_SPINLOCK(sel_sem);
 
 /* global data for booleans */
@@ -51,7 +88,7 @@ static int domain_has_security(struct do
                                                                 perms, NULL);
 }
 
-static int flask_security_user(char *buf, int size)
+static int flask_security_user(char *buf, uint32_t size)
 {
     char *page = NULL;
     char *con, *user, *ptr;
@@ -82,12 +119,8 @@ static int flask_security_user(char *buf
         goto out2;
     memset(page, 0, PAGE_SIZE);
 
-    length = -EFAULT;
-    if ( copy_from_user(page, buf, size) )
-        goto out2;
-        
     length = -EINVAL;
-    if ( sscanf(page, "%s %s", con, user) != 2 )
+    if ( sscanf(buf, "%s %s", con, user) != 2 )
         goto out2;
 
     length = security_context_to_sid(con, strlen(con)+1, &sid);
@@ -98,7 +131,6 @@ static int flask_security_user(char *buf
     if ( length < 0 )
         goto out2;
     
-    memset(page, 0, PAGE_SIZE);
     length = snprintf(page, PAGE_SIZE, "%u", nsids) + 1;
     ptr = page + length;
     for ( i = 0; i < nsids; i++ )
@@ -121,8 +153,16 @@ static int flask_security_user(char *buf
         length += len;
     }
     
-    if ( copy_to_user(buf, page, length) )
-        length = -EFAULT;
+    if ( length > size )
+    {
+        printk( "%s:  context size (%u) exceeds payload "
+                "max\n", __FUNCTION__, length);
+        length = -ERANGE;
+        goto out3;
+    }
+
+    memset(buf, 0, size);
+    memcpy(buf, page, length);
         
 out3:
     xfree(sids);
@@ -135,7 +175,7 @@ out:
     return length;
 }
 
-static int flask_security_relabel(char *buf, int size)
+static int flask_security_relabel(char *buf, uint32_t size)
 {
     char *scon, *tcon;
     u32 ssid, tsid, newsid;
@@ -178,15 +218,81 @@ static int flask_security_relabel(char *
     if ( length < 0 )
         goto out2;
             
-    if ( len > PAGE_SIZE )
-    {
+    if ( len > size )
+    {
+        printk( "%s:  context size (%u) exceeds payload "
+                "max\n", __FUNCTION__, len);
         length = -ERANGE;
         goto out3;
     }
-        
-    if ( copy_to_user(buf, newcon, len) )
-        len = -EFAULT;
-
+
+    memset(buf, 0, size);
+    memcpy(buf, newcon, len);
+    length = len;
+
+out3:
+    xfree(newcon);
+out2:
+    xfree(tcon);
+out:
+    xfree(scon);
+    return length;
+}
+
+static int flask_security_create(char *buf, uint32_t size)
+{
+    char *scon, *tcon;
+    u32 ssid, tsid, newsid;
+    u16 tclass;
+    int length;
+    char *newcon;
+    u32 len;
+
+    length = domain_has_security(current->domain, SECURITY__COMPUTE_CREATE);
+    if ( length )
+        return length;
+
+    length = -ENOMEM;
+    scon = xmalloc_array(char, size+1);
+    if ( !scon )
+        return length;
+    memset(scon, 0, size+1);
+
+    tcon = xmalloc_array(char, size+1);
+    if ( !tcon )
+        goto out;
+    memset(tcon, 0, size+1);
+
+    length = -EINVAL;
+    if ( sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3 )
+        goto out2;
+
+    length = security_context_to_sid(scon, strlen(scon)+1, &ssid);
+    if ( length < 0 )
+        goto out2;
+
+    length = security_context_to_sid(tcon, strlen(tcon)+1, &tsid);
+    if ( length < 0 )
+        goto out2;
+
+    length = security_transition_sid(ssid, tsid, tclass, &newsid);
+    if ( length < 0 )
+        goto out2;
+
+    length = security_sid_to_context(newsid, &newcon, &len);
+    if ( length < 0 )    
+        goto out2;
+
+    if ( len > size )
+    {
+        printk( "%s:  context size (%u) exceeds payload "
+                "max\n", __FUNCTION__, len);
+        length = -ERANGE;
+        goto out3;
+    }
+
+    memset(buf, 0, size);
+    memcpy(buf, newcon, len);
     length = len;
         
 out3:
@@ -198,75 +304,8 @@ out:
     return length;
 }
 
-static int flask_security_create(char *buf, int size)
-{
-    char *scon, *tcon;
-    u32 ssid, tsid, newsid;
-    u16 tclass;
-    int length;
-    char *newcon;
-    u32 len;
-
-    length = domain_has_security(current->domain, SECURITY__COMPUTE_CREATE);
-    if ( length )
-        return length;
-
-    length = -ENOMEM;
-    scon = xmalloc_array(char, size+1);
-    if ( !scon )
-        return length;
-    memset(scon, 0, size+1);
-
-    tcon = xmalloc_array(char, size+1);
-    if ( !tcon )
-        goto out;
-    memset(tcon, 0, size+1);
-
-    length = -EINVAL;
-    if ( sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3 )
-        goto out2;
-
-    length = security_context_to_sid(scon, strlen(scon)+1, &ssid);
-    if ( length < 0 )
-        goto out2;
-
-    length = security_context_to_sid(tcon, strlen(tcon)+1, &tsid);
-    if ( length < 0 )
-        goto out2;
-
-    length = security_transition_sid(ssid, tsid, tclass, &newsid);
-    if ( length < 0 )
-        goto out2;
-
-    length = security_sid_to_context(newsid, &newcon, &len);
-    if ( length < 0 )    
-        goto out2;
-
-    if ( len > PAGE_SIZE )
-    {
-        printk( "%s:  context size (%u) exceeds payload "
-                "max\n", __FUNCTION__, len);
-        length = -ERANGE;
-        goto out3;
-    }
-
-    if ( copy_to_user(buf, newcon, len) )
-        len = -EFAULT;
-
-    length = len;
-        
-out3:
-    xfree(newcon);
-out2:
-    xfree(tcon);
-out:
-    xfree(scon);
-    return length;
-}
-
-static int flask_security_access(char *buf, int size)
-{
-    char *page = NULL;
+static int flask_security_access(char *buf, uint32_t size)
+{
     char *scon, *tcon;
     u32 ssid, tsid;
     u16 tclass;
@@ -305,23 +344,12 @@ static int flask_security_access(char *b
     if ( length < 0 )
         goto out2;
 
-    page = (char *)xmalloc_bytes(PAGE_SIZE);
-    if ( !page )
-    {
-        length = -ENOMEM;
-        goto out2;
-    }
-
-    memset(page, 0, PAGE_SIZE);
-
-    length = snprintf(page, PAGE_SIZE, "%x %x %x %x %u", 
+    memset(buf, 0, size);
+    length = snprintf(buf, size, "%x %x %x %x %u", 
                                         avd.allowed, avd.decided,
                                         avd.auditallow, avd.auditdeny, 
                                         avd.seqno);
                 
-    if ( copy_to_user(buf, page, length) )
-        length = -EFAULT;
-        
 out2:
     xfree(tcon);
 out:
@@ -329,7 +357,7 @@ out:
     return length;
 }
 
-static int flask_security_member(char *buf, int size)
+static int flask_security_member(char *buf, uint32_t size)
 {
     char *scon, *tcon;
     u32 ssid, tsid, newsid;
@@ -373,7 +401,7 @@ static int flask_security_member(char *b
     if ( length < 0 )
         goto out2;
 
-    if ( len > PAGE_SIZE )
+    if ( len > size )
     {
         printk("%s:  context size (%u) exceeds payload "
                 "max\n", __FUNCTION__, len);
@@ -381,9 +409,8 @@ static int flask_security_member(char *b
         goto out3;
     }
 
-    if ( copy_to_user(buf, newcon, len) )
-        len = -EFAULT;
-
+    memset(buf, 0, size);
+    memcpy(buf, newcon, len);
     length = len;
 
 out3:
@@ -395,26 +422,13 @@ out:
     return length;
 }
 
-static int flask_security_setenforce(char *buf, int count)
-{
-    char *page = NULL;
+static int flask_security_setenforce(char *buf, uint32_t count)
+{
     int length;
     int new_value;
 
-    if ( count < 0 || count >= PAGE_SIZE )
-        return -ENOMEM;
-
-    page = (char *)xmalloc_bytes(PAGE_SIZE);
-    if ( !page )
-        return -ENOMEM;
-    memset(page, 0, PAGE_SIZE);
-    length = -EFAULT;
-    if ( copy_from_user(page, buf, count) )
-        goto out;
-
-    length = -EINVAL;
-    if ( sscanf(page, "%d", &new_value) != 1 )
-        goto out;
+    if ( sscanf(buf, "%d", &new_value) != 1 )
+        return -EINVAL;
 
     if ( new_value != flask_enforcing )
     {
@@ -428,13 +442,11 @@ static int flask_security_setenforce(cha
     length = count;
 
 out:
-    xfree(page);
-    return length;
-}
-
-static int flask_security_context(char *buf, int count)
-{
-    char *page = NULL;
+    return length;
+}
+
+static int flask_security_context(char *buf, uint32_t count)
+{
     u32 sid;
     int length;
 
@@ -442,35 +454,19 @@ static int flask_security_context(char *
     if ( length )
         goto out;
 
-    if ( count < 0 || count >= PAGE_SIZE )
-        return -ENOMEM;
-
-    page = (char *)xmalloc_bytes(PAGE_SIZE);
-    if ( !page )
-        return -ENOMEM;
-    memset(page, 0, PAGE_SIZE);
-    length = -EFAULT;
-    if ( copy_from_user(page, buf, count) )
-        goto out;
-
-    length = security_context_to_sid(page, count, &sid);
-    if ( length < 0 )
-        goto out;
-
-    memset(page, 0, PAGE_SIZE);
-    length = snprintf(page, PAGE_SIZE, "%u", sid);
-
-    if ( copy_to_user(buf, page, count) )
-        length = -EFAULT;
-
-out:
-    xfree(page);
-    return length;
-}
-
-static int flask_security_sid(char *buf, int count)
-{
-    char *page = NULL;
+    length = security_context_to_sid(buf, count, &sid);
+    if ( length < 0 )
+        goto out;
+
+    memset(buf, 0, count);
+    length = snprintf(buf, count, "%u", sid);
+
+out:
+    return length;
+}
+
+static int flask_security_sid(char *buf, uint32_t count)
+{
     char *context;
     u32 sid;
     u32 len;
@@ -480,31 +476,20 @@ static int flask_security_sid(char *buf,
     if ( length )
         goto out;
 
-    if ( count < 0 || count >= PAGE_SIZE )
-        return -ENOMEM;
-
-    page = (char *)xmalloc_bytes(PAGE_SIZE);
-    if ( !page )
-        return -ENOMEM;
-    memset(page, 0, PAGE_SIZE);
-    length = -EFAULT;
-    if ( copy_from_user(page, buf, count) )
-        goto out;
-
-    if ( sscanf(page, "%u", &sid) != 1 )
+    if ( sscanf(buf, "%u", &sid) != 1 )
         goto out;
 
     length = security_sid_to_context(sid, &context, &len);
     if ( length < 0 )
         goto out;
 
-    if ( copy_to_user(buf, context, len) )
-        length = -EFAULT;
-    
+    memset(buf, 0, count);
+    memcpy(buf, context, len);
+    length = len;
+
     xfree(context);
 
 out:
-    xfree(page);
     return length;
 }
 
@@ -534,24 +519,13 @@ int flask_disable(void)
     return 0;
 }
 
-static int flask_security_disable(char *buf, int count)
-{
-    char *page = NULL;
+static int flask_security_disable(char *buf, uint32_t count)
+{
     int length;
     int new_value;
 
-    if ( count < 0 || count >= PAGE_SIZE )
-        return -ENOMEM;
-    page = (char *)xmalloc_bytes(PAGE_SIZE);
-    if ( !page )
-        return -ENOMEM;
-    memset(page, 0, PAGE_SIZE);
-    length = -EFAULT;
-    if ( copy_from_user(page, buf, count) )
-        goto out;
-
     length = -EINVAL;
-    if ( sscanf(page, "%d", &new_value) != 1 )
+    if ( sscanf(buf, "%d", &new_value) != 1 )
         goto out;
 
     if ( new_value )
@@ -564,57 +538,35 @@ static int flask_security_disable(char *
     length = count;
 
 out:
-    xfree(page);
-    return length;
-}
-
-static int flask_security_setavc_threshold(char *buf, int count)
-{
-    char *page = NULL;
+    return length;
+}
+
+static int flask_security_setavc_threshold(char *buf, uint32_t count)
+{
     int ret;
     int new_value;
 
-    if ( count < 0 || count >= PAGE_SIZE )
-    {
-        ret = -ENOMEM;
-        goto out;
-    }
-
-    page = (char*)xmalloc_bytes(PAGE_SIZE);
-    if (!page)
-        return -ENOMEM;
-    memset(page, 0, PAGE_SIZE);
-
-    if ( copy_from_user(page, buf, count) )
-    {
-        ret = -EFAULT;
-        goto out_free;
-    }
-
-    if ( sscanf(page, "%u", &new_value) != 1 )
+    if ( sscanf(buf, "%u", &new_value) != 1 )
     {
         ret = -EINVAL;
-        goto out_free;
+        goto out;
     }
 
     if ( new_value != avc_cache_threshold )
     {
         ret = domain_has_security(current->domain, SECURITY__SETSECPARAM);
         if ( ret )
-            goto out_free;
+            goto out;
         avc_cache_threshold = new_value;
     }
     ret = count;
 
-out_free:
-    xfree(page);
 out:
     return ret;
 }
 
-static int flask_security_set_bool(char *buf, int count)
-{
-    char *page = NULL;
+static int flask_security_set_bool(char *buf, uint32_t count)
+{
     int length = -EFAULT;
     int i, new_value;
 
@@ -624,25 +576,8 @@ static int flask_security_set_bool(char 
     if ( length )
         goto out;
 
-    if ( count < 0 || count >= PAGE_SIZE )
-    {
-        length = -ENOMEM;
-        goto out;
-    }
-
-    page = (char *)xmalloc_bytes(PAGE_SIZE);
-    if ( !page )
-    {
-        length = -ENOMEM;
-        goto out;
-    }
-    memset(page, 0, PAGE_SIZE);
-
-    if ( copy_from_user(page, buf, count) )
-        goto out;
-
     length = -EINVAL;
-    if ( sscanf(page, "%d %d", &i, &new_value) != 2 )
+    if ( sscanf(buf, "%d %d", &i, &new_value) != 2 )
         goto out;
 
     if ( new_value )
@@ -655,14 +590,11 @@ static int flask_security_set_bool(char 
 
 out:
     spin_unlock(&sel_sem);
-    if ( page )
-        xfree(page);
-    return length;
-}
-
-static int flask_security_commit_bools(char *buf, int count)
-{
-    char *page = NULL;
+    return length;
+}
+
+static int flask_security_commit_bools(char *buf, uint32_t count)
+{
     int length = -EFAULT;
     int new_value;
 
@@ -672,25 +604,8 @@ static int flask_security_commit_bools(c
     if ( length )
         goto out;
 
-    if ( count < 0 || count >= PAGE_SIZE )
-    {
-        length = -ENOMEM;
-        goto out;
-    }
-
-    page = (char *)xmalloc_bytes(PAGE_SIZE);
-    if ( !page )
-    {
-        length = -ENOMEM;
-        goto out;
-    }
-    memset(page, 0, PAGE_SIZE);
-
-    if ( copy_from_user(page, buf, count) )
-        goto out;
-
     length = -EINVAL;
-    if ( sscanf(page, "%d", &new_value) != 1 )
+    if ( sscanf(buf, "%d", &new_value) != 1 )
         goto out;
 
     if ( new_value )
@@ -700,40 +615,18 @@ static int flask_security_commit_bools(c
 
 out:
     spin_unlock(&sel_sem);
-    if ( page )
-        xfree(page);
-    return length;
-}
-
-static int flask_security_get_bool(char *buf, int count)
-{
-    char *page = NULL;
+    return length;
+}
+
+static int flask_security_get_bool(char *buf, uint32_t count)
+{
     int length;
     int i, cur_enforcing;
     
     spin_lock(&sel_sem);
     
-    length = -EFAULT;
-
-    if ( count < 0 || count > PAGE_SIZE )
-    {
-        length = -EINVAL;
-        goto out;
-    }
-
-    page = (char *)xmalloc_bytes(PAGE_SIZE);
-    if ( !page )
-    {
-        length = -ENOMEM;
-        goto out;
-    }
-    memset(page, 0, PAGE_SIZE);
-
-    if ( copy_from_user(page, buf, count) )
-        goto out;
-
     length = -EINVAL;
-    if ( sscanf(page, "%d", &i) != 1 )
+    if ( sscanf(buf, "%d", &i) != 1 )
         goto out;
 
     cur_enforcing = security_get_bool_value(i);
@@ -743,18 +636,12 @@ static int flask_security_get_bool(char 
         goto out;
     }
 
-    length = snprintf(page, PAGE_SIZE, "%d %d", cur_enforcing,
+    memset(buf, 0, count);
+    length = snprintf(buf, count, "%d %d", cur_enforcing,
                 bool_pending_values[i]);
-    if ( length < 0 )
-        goto out;
-
-    if ( copy_to_user(buf, page, length) )
-        length = -EFAULT;
 
 out:
     spin_unlock(&sel_sem);
-    if ( page )
-        xfree(page);
     return length;
 }
 
@@ -786,7 +673,7 @@ out:
 
 #ifdef FLASK_AVC_STATS
 
-static int flask_security_avc_cachestats(char *buf, int count)
+static int flask_security_avc_cachestats(char *buf, uint32_t count)
 {
     char *page = NULL;
     int len = 0;
@@ -802,9 +689,15 @@ static int flask_security_avc_cachestats
 
     len = snprintf(page, PAGE_SIZE, "lookups hits misses allocations reclaims "
                                                                    "frees\n");
+    if ( len > count ) {
+        length = -EINVAL;
+        goto out;
+    }
+    
     memcpy(buf, page, len);
     buf += len;
     length += len;
+    count -= len;
 
     for ( cpu = idx; cpu < NR_CPUS; ++cpu )
     {
@@ -816,22 +709,27 @@ static int flask_security_avc_cachestats
         len = snprintf(page, PAGE_SIZE, "%u %u %u %u %u %u\n", st->lookups,
                                        st->hits, st->misses, st->allocations,
                                                        st->reclaims, 
st->frees);
+        if ( len > count ) {
+            length = -EINVAL;
+            goto out;
+        }
         memcpy(buf, page, len);
         buf += len;
         length += len;
-    }
-
+        count -= len;
+    }
+
+out:
     xfree(page);    
     return length;
 }
 
 #endif
 
-static int flask_security_load(char *buf, int count)
+static int flask_security_load(char *buf, uint32_t count)
 {
     int ret;
     int length;
-    void *data = NULL;
 
     spin_lock(&sel_sem);
 
@@ -839,18 +737,7 @@ static int flask_security_load(char *buf
     if ( length )
         goto out;
 
-    if ( (count < 0) || (count > 64 * 1024 * 1024) 
-                               || (data = xmalloc_array(char, count)) == NULL )
-    {
-        length = -ENOMEM;
-        goto out;
-    }
-
-    length = -EFAULT;
-    if ( copy_from_user(data, buf, count) != 0 )
-        goto out;
-
-    length = security_load_policy(data, count);
+    length = security_load_policy(buf, count);
     if ( length )
         goto out;
 
@@ -862,7 +749,6 @@ static int flask_security_load(char *buf
 
 out:
     spin_unlock(&sel_sem);
-    xfree(data);
     return length;
 }
 
@@ -871,188 +757,156 @@ long do_flask_op(XEN_GUEST_HANDLE(xsm_op
     flask_op_t curop, *op = &curop;
     int rc = 0;
     int length = 0;
-    char *page = NULL;
+    char *arg = NULL;
 
     if ( copy_from_guest(op, u_flask_op, 1) )
         return -EFAULT;
 
+    if ( op->cmd > FLASK_LAST)
+        return -EINVAL;
+
+    if ( op->size > MAX_POLICY_SIZE )
+        return -EINVAL;
+
+    if ( (op->buf == NULL && op->size != 0) || 
+                                    (op->buf != NULL && op->size == 0) )
+        return -EINVAL;
+
+    arg = xmalloc_bytes(op->size + 1);
+    if ( !arg )
+        return -ENOMEM;
+
+    memset(arg, 0, op->size + 1);
+
+    if ( (FLASK_COPY_IN&(1UL<<op->cmd)) && op->buf != NULL && 
+           copy_from_guest(arg, guest_handle_from_ptr(op->buf, char), 
op->size) )
+    {
+        rc = -EFAULT;
+        goto out;
+    }
+
     switch ( op->cmd )
     {
 
     case FLASK_LOAD:
     {
-        length = flask_security_load(op->buf, op->size);
+        length = flask_security_load(arg, op->size);
     }
     break;
     
     case FLASK_GETENFORCE:
     {
-        page = (char *)xmalloc_bytes(PAGE_SIZE);
-        if ( !page )
-            return -ENOMEM;
-        memset(page, 0, PAGE_SIZE);
-        
-        length = snprintf(page, PAGE_SIZE, "%d", flask_enforcing);
-        
-        if ( copy_to_user(op->buf, page, length) )
-        {
-            rc = -EFAULT;
-            goto out;
-        }
+        length = snprintf(arg, op->size, "%d", flask_enforcing);
     }
     break;    
 
     case FLASK_SETENFORCE:
     {
-        length = flask_security_setenforce(op->buf, op->size);
+        length = flask_security_setenforce(arg, op->size);
     }
     break;    
 
     case FLASK_CONTEXT_TO_SID:
     {
-        length = flask_security_context(op->buf, op->size);
+        length = flask_security_context(arg, op->size);
     }
     break;    
 
     case FLASK_SID_TO_CONTEXT:
     {
-        length = flask_security_sid(op->buf, op->size);
+        length = flask_security_sid(arg, op->size);
     }
     break; 
 
     case FLASK_ACCESS:
     {
-        length = flask_security_access(op->buf, op->size);
+        length = flask_security_access(arg, op->size);
     }
     break;    
 
     case FLASK_CREATE:
     {
-        length = flask_security_create(op->buf, op->size);
+        length = flask_security_create(arg, op->size);
     }
     break;    
 
     case FLASK_RELABEL:
     {
-        length = flask_security_relabel(op->buf, op->size);
+        length = flask_security_relabel(arg, op->size);
     }
     break;
 
     case FLASK_USER:
     {
-        length = flask_security_user(op->buf, op->size);
+        length = flask_security_user(arg, op->size);
     }
     break;    
 
     case FLASK_POLICYVERS:
     {
-        page = (char *)xmalloc_bytes(PAGE_SIZE);
-        if ( !page )
-            return -ENOMEM;
-        memset(page, 0, PAGE_SIZE);
-
-        length = snprintf(page, PAGE_SIZE, "%d", POLICYDB_VERSION_MAX);
-
-        if ( copy_to_user(op->buf, page, length) )
-        {
-            rc = -EFAULT;
-            goto out;
-        }
+        length = snprintf(arg, op->size, "%d", POLICYDB_VERSION_MAX);
     }
     break;    
 
     case FLASK_GETBOOL:
     {
-        length = flask_security_get_bool(op->buf, op->size);
+        length = flask_security_get_bool(arg, op->size);
     }
     break;
 
     case FLASK_SETBOOL:
     {
-        length = flask_security_set_bool(op->buf, op->size);
+        length = flask_security_set_bool(arg, op->size);
     }
     break;
 
     case FLASK_COMMITBOOLS:
     {
-        length = flask_security_commit_bools(op->buf, op->size);
+        length = flask_security_commit_bools(arg, op->size);
     }
     break;
 
     case FLASK_MLS:
     {
-        page = (char *)xmalloc_bytes(PAGE_SIZE);
-        if ( !page )
-            return -ENOMEM;
-        memset(page, 0, PAGE_SIZE);
-
-        length = snprintf(page, PAGE_SIZE, "%d", flask_mls_enabled);
-
-        if ( copy_to_user(op->buf, page, length) )
-        {
-            rc = -EFAULT;
-            goto out;
-        }
+        length = snprintf(arg, op->size, "%d", flask_mls_enabled);
     }
     break;    
 
     case FLASK_DISABLE:
     {
-        length = flask_security_disable(op->buf, op->size);
+        length = flask_security_disable(arg, op->size);
     }
     break;    
 
     case FLASK_GETAVC_THRESHOLD:
     {
-        page = (char *)xmalloc_bytes(PAGE_SIZE);
-        if ( !page )
-            return -ENOMEM;
-        memset(page, 0, PAGE_SIZE);
-
-        length = snprintf(page, PAGE_SIZE, "%d", avc_cache_threshold);
-
-        if ( copy_to_user(op->buf, page, length) )
-        {
-            rc = -EFAULT;
-            goto out;
-        }
+        length = snprintf(arg, op->size, "%d", avc_cache_threshold);
     }
     break;
 
     case FLASK_SETAVC_THRESHOLD:
     {
-        length = flask_security_setavc_threshold(op->buf, op->size);
+        length = flask_security_setavc_threshold(arg, op->size);
     }
     break;
 
     case FLASK_AVC_HASHSTATS:
     {
-        page = (char *)xmalloc_bytes(PAGE_SIZE);
-        if ( !page )
-            return -ENOMEM;
-        memset(page, 0, PAGE_SIZE);
-
-        length = avc_get_hash_stats(page);
-
-        if ( copy_to_user(op->buf, page, length) )
-        {
-            rc = -EFAULT;
-            goto out;
-        }
+        length = avc_get_hash_stats(arg, op->size);
     }
     break;
 
 #ifdef FLASK_AVC_STATS    
     case FLASK_AVC_CACHESTATS:
     {
-        length = flask_security_avc_cachestats(op->buf, op->size);
+        length = flask_security_avc_cachestats(arg, op->size);
     }
     break;
-#endif    
+#endif
 
     case FLASK_MEMBER:
     {
-        length = flask_security_member(op->buf, op->size);
+        length = flask_security_member(arg, op->size);
     }
     break;    
 
@@ -1067,13 +921,19 @@ long do_flask_op(XEN_GUEST_HANDLE(xsm_op
         rc = length;
         goto out;
     }
+    
+    if ( (FLASK_COPY_OUT&(1UL<<op->cmd)) && op->buf != NULL && 
+             copy_to_guest(guest_handle_from_ptr(op->buf, char), arg, 
op->size) )
+    {
+        rc = -EFAULT;
+        goto out;
+    }
+
     op->size = length;
     if ( copy_to_guest(u_flask_op, op, 1) )
         rc = -EFAULT;
 
 out:
-    if ( page )
-        xfree(page);
+    xfree(arg);
     return rc;
 }
-
diff -r 1e7a371cee11 -r 1970781956c7 xen/xsm/flask/hooks.c
--- a/xen/xsm/flask/hooks.c     Wed Jul 23 11:21:47 2008 +0900
+++ b/xen/xsm/flask/hooks.c     Wed Jul 23 12:10:20 2008 +0900
@@ -712,18 +712,6 @@ static int flask_perfcontrol(void)
 static int flask_perfcontrol(void)
 {
     return domain_has_xen(current->domain, XEN__PERFCONTROL);
-}
-
-void flask_complete_init(struct domain *d)
-{
-    struct domain_security_struct *dsec;
-
-    /* Set the security state for the Dom0 domain. */
-    dsec = d->ssid;
-    dsec->sid = SECINITSID_DOM0;
-    dsec->create_sid = SECINITSID_UNLABELED;
-
-    printk("Flask:  Completed initialization.\n");
 }
 
 #ifdef CONFIG_X86
@@ -1101,7 +1089,6 @@ static struct xsm_operations flask_ops =
     .schedop_shutdown = flask_schedop_shutdown,
 
     .__do_xsm_op = do_flask_op,
-    .complete_init = flask_complete_init,    
 
 #ifdef CONFIG_X86
     .shadow_control = flask_shadow_control,
diff -r 1e7a371cee11 -r 1970781956c7 xen/xsm/flask/include/avc.h
--- a/xen/xsm/flask/include/avc.h       Wed Jul 23 11:21:47 2008 +0900
+++ b/xen/xsm/flask/include/avc.h       Wed Jul 23 12:10:20 2008 +0900
@@ -95,7 +95,7 @@ int avc_add_callback(int (*callback)(u32
                                     u32 ssid, u32 tsid, u16 tclass, u32 perms);
 
 /* Exported to selinuxfs */
-int avc_get_hash_stats(char *page);
+int avc_get_hash_stats(char *buf, uint32_t size);
 extern unsigned int avc_cache_threshold;
 
 #ifdef FLASK_AVC_STATS

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog


 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.