[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[XenPPC] [xenppc-unstable] [XEN][POWERPC] Merge: also includes support for recursive spinlocks



# HG changeset patch
# User Jimi Xenidis <jimix@xxxxxxxxxxxxxx>
# Node ID 4d4f0d52c1934a50a67d3fe9bd30b4f7e23427fe
# Parent  b30cb72ed5e20d4957207145022e648b913c033b
# Parent  b8a2db59150a084e4e1a5a1cae660dbf7cc14c2d
[XEN][POWERPC] Merge: also includes support for recursive spinlocks

Signed-off-by: Jimi Xenidis <jimix@xxxxxxxxxxxxxx>
---
 tools/firmware/acpi/Makefile                                                   
       |   68 
 tools/firmware/acpi/README                                                     
       |   22 
 tools/firmware/acpi/acpi2_0.h                                                  
       |  331 
 tools/firmware/acpi/acpi_build.c                                               
       |  232 
 tools/firmware/acpi/acpi_dsdt.asl                                              
       |  521 
 tools/firmware/acpi/acpi_dsdt.c                                                
       |  300 
 tools/firmware/acpi/acpi_facs.c                                                
       |   72 
 tools/firmware/acpi/acpi_facs.h                                                
       |   32 
 tools/firmware/acpi/acpi_fadt.c                                                
       |  193 
 tools/firmware/acpi/acpi_fadt.h                                                
       |  165 
 tools/firmware/acpi/acpi_gen.c                                                 
       |   53 
 tools/firmware/acpi/acpi_madt.c                                                
       |   68 
 tools/firmware/acpi/acpi_madt.h                                                
       |   44 
 tools/firmware/acpi/acpi_rsdt.c                                                
       |   68 
 tools/security/example.txt                                                     
       |  376 
 tools/security/install.txt                                                     
       |   87 
 xen/arch/ia64/vmx/mm.c                                                         
       |  153 
 xen/include/asm-ia64/linux/asm/acpi.h                                          
       |  121 
 xen/include/asm-ia64/linux/asm/numa.h                                          
       |   74 
 xen/include/asm-ia64/vmx_uaccess.h                                             
       |  156 
 xen/include/asm-x86/hvm/vpit.h                                                 
       |  103 
 .hgignore                                                                      
       |    6 
 Config.mk                                                                      
       |   11 
 buildconfigs/Rules.mk                                                          
       |    4 
 buildconfigs/linux-defconfig_xen0_ia64                                         
       |   10 
 buildconfigs/linux-defconfig_xenU_ia64                                         
       |    8 
 buildconfigs/linux-defconfig_xen_ia64                                          
       |   10 
 config/Linux.mk                                                                
       |   35 
 config/OpenBSD.mk                                                              
       |    1 
 config/StdGNU.mk                                                               
       |   30 
 config/SunOS.mk                                                                
       |    8 
 config/x86_32.mk                                                               
       |    8 
 config/x86_64.mk                                                               
       |    8 
 docs/man/xm.pod.1                                                              
       |    4 
 docs/src/interface.tex                                                         
       |   42 
 docs/src/user.tex                                                              
       |   26 
 docs/xen-api/Makefile                                                          
       |   23 
 docs/xen-api/coversheet.tex                                                    
       |   50 
 docs/xen-api/fdl.tex                                                           
       |  488 
 docs/xen-api/presentation.tex                                                  
       |  149 
 docs/xen-api/todo.tex                                                          
       |  140 
 docs/xen-api/vm-lifecycle.tex                                                  
       |   24 
 docs/xen-api/vm_lifecycle.dot                                                  
       |   15 
 docs/xen-api/wire-protocol.tex                                                 
       |  287 
 docs/xen-api/xen.eps                                                           
       |   49 
 docs/xen-api/xenapi-coversheet.tex                                             
       |   40 
 docs/xen-api/xenapi-datamodel-graph.dot                                        
       |   17 
 docs/xen-api/xenapi-datamodel.tex                                              
       | 9648 ++++++++++
 docs/xen-api/xenapi.tex                                                        
       |   56 
 linux-2.6-xen-sparse/arch/i386/kernel/fixup.c                                  
       |    3 
 linux-2.6-xen-sparse/arch/i386/kernel/microcode-xen.c                          
       |   38 
 linux-2.6-xen-sparse/arch/i386/kernel/sysenter.c                               
       |    2 
 linux-2.6-xen-sparse/arch/i386/mm/hypervisor.c                                 
       |    4 
 linux-2.6-xen-sparse/arch/i386/mm/init-xen.c                                   
       |    4 
 linux-2.6-xen-sparse/arch/ia64/Kconfig                                         
       |   14 
 linux-2.6-xen-sparse/arch/ia64/kernel/Makefile                                 
       |   62 
 linux-2.6-xen-sparse/arch/ia64/kernel/gate.lds.S                               
       |    1 
 linux-2.6-xen-sparse/arch/ia64/kernel/setup.c                                  
       |    4 
 linux-2.6-xen-sparse/arch/ia64/xen/Makefile                                    
       |    3 
 linux-2.6-xen-sparse/arch/ia64/xen/hypervisor.c                                
       |  361 
 linux-2.6-xen-sparse/arch/ia64/xen/util.c                                      
       |    2 
 linux-2.6-xen-sparse/arch/ia64/xen/xcom_hcall.c                                
       |  273 
 linux-2.6-xen-sparse/arch/ia64/xen/xcom_mini.c                                 
       |  319 
 linux-2.6-xen-sparse/arch/ia64/xen/xcom_privcmd.c                              
       |  629 
 linux-2.6-xen-sparse/arch/ia64/xen/xencomm.c                                   
       |  263 
 linux-2.6-xen-sparse/arch/ia64/xen/xensetup.S                                  
       |   21 
 linux-2.6-xen-sparse/arch/x86_64/mm/init-xen.c                                 
       |    4 
 linux-2.6-xen-sparse/drivers/char/tpm/tpm_xen.c                                
       |   12 
 linux-2.6-xen-sparse/drivers/xen/balloon/Makefile                              
       |    2 
 linux-2.6-xen-sparse/drivers/xen/balloon/balloon.c                             
       |   91 
 linux-2.6-xen-sparse/drivers/xen/balloon/common.h                              
       |   58 
 linux-2.6-xen-sparse/drivers/xen/balloon/sysfs.c                               
       |  165 
 linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c                             
       |   26 
 linux-2.6-xen-sparse/drivers/xen/blkfront/blkfront.c                           
       |   25 
 linux-2.6-xen-sparse/drivers/xen/blkfront/vbd.c                                
       |   10 
 linux-2.6-xen-sparse/drivers/xen/blktap/blktap.c                               
       |  577 
 linux-2.6-xen-sparse/drivers/xen/blktap/xenbus.c                               
       |    6 
 linux-2.6-xen-sparse/drivers/xen/core/Makefile                                 
       |    2 
 linux-2.6-xen-sparse/drivers/xen/core/features.c                               
       |    4 
 linux-2.6-xen-sparse/drivers/xen/core/gnttab.c                                 
       |    4 
 linux-2.6-xen-sparse/drivers/xen/core/machine_reboot.c                         
       |  185 
 linux-2.6-xen-sparse/drivers/xen/core/reboot.c                                 
       |  212 
 linux-2.6-xen-sparse/drivers/xen/netback/common.h                              
       |    5 
 linux-2.6-xen-sparse/drivers/xen/netback/interface.c                           
       |   57 
 linux-2.6-xen-sparse/drivers/xen/netback/netback.c                             
       |   58 
 linux-2.6-xen-sparse/drivers/xen/netback/xenbus.c                              
       |   16 
 linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c                           
       |   47 
 linux-2.6-xen-sparse/drivers/xen/privcmd/privcmd.c                             
       |   31 
 linux-2.6-xen-sparse/drivers/xen/tpmback/xenbus.c                              
       |    8 
 linux-2.6-xen-sparse/drivers/xen/xenbus/Makefile                               
       |    1 
 linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_client.c                        
       |    4 
 linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_comms.c                         
       |   11 
 linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_dev.c                           
       |    5 
 linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_probe.c                         
       |  260 
 linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_probe.h                         
       |   77 
 linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_probe_backend.c                 
       |  271 
 linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_xs.c                            
       |    6 
 linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/fixmap.h                    
       |    1 
 linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/hypercall.h                 
       |   10 
 linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/hypervisor.h                
       |    8 
 linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/synch_bitops.h              
       |    4 
 linux-2.6-xen-sparse/include/asm-i386/mach-xen/setup_arch_post.h               
       |   15 
 linux-2.6-xen-sparse/include/asm-ia64/hypercall.h                              
       |  277 
 linux-2.6-xen-sparse/include/asm-ia64/hypervisor.h                             
       |   27 
 linux-2.6-xen-sparse/include/asm-ia64/maddr.h                                  
       |   15 
 linux-2.6-xen-sparse/include/asm-ia64/xen/privop.h                             
       |    3 
 linux-2.6-xen-sparse/include/asm-ia64/xen/xcom_hcall.h                         
       |   76 
 linux-2.6-xen-sparse/include/asm-ia64/xen/xencomm.h                            
       |   60 
 linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/asm/fixmap.h                  
       |    1 
 linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/asm/hypercall.h               
       |   10 
 linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/setup_arch_post.h             
       |   17 
 linux-2.6-xen-sparse/include/xen/gnttab.h                                      
       |    5 
 linux-2.6-xen-sparse/include/xen/xenbus.h                                      
       |    1 
 linux-2.6-xen-sparse/lib/Makefile                                              
       |    2 
 patches/linux-2.6.16.29/net-gso-5-rcv-mss.patch                                
       |   11 
 tools/blktap/drivers/blktapctrl.c                                              
       |  108 
 tools/blktap/drivers/tapdisk.c                                                 
       |   63 
 tools/blktap/drivers/tapdisk.h                                                 
       |    9 
 tools/blktap/lib/blktaplib.h                                                   
       |    7 
 tools/check/check_brctl                                                        
       |   31 
 tools/check/check_iproute                                                      
       |   29 
 tools/check/check_python                                                       
       |   17 
 tools/check/check_zlib_devel                                                   
       |   17 
 tools/check/check_zlib_lib                                                     
       |   17 
 tools/check/chk                                                                
       |   19 
 tools/console/Makefile                                                         
       |    2 
 tools/examples/blktap                                                          
       |    2 
 tools/examples/block                                                           
       |   30 
 tools/examples/external-device-migrate                                         
       |   56 
 tools/examples/vif-bridge                                                      
       |    2 
 tools/examples/vif-nat                                                         
       |    4 
 tools/examples/vif-route                                                       
       |    2 
 tools/examples/vtpm-common.sh                                                  
       |    6 
 tools/examples/xend-config.sxp                                                 
       |    6 
 tools/examples/xmexample.hvm                                                   
       |    8 
 tools/examples/xmexample.vti                                                   
       |    5 
 tools/firmware/Makefile                                                        
       |    1 
 tools/firmware/hvmloader/Makefile                                              
       |   21 
 tools/firmware/hvmloader/acpi/Makefile                                         
       |   63 
 tools/firmware/hvmloader/acpi/README                                           
       |   24 
 tools/firmware/hvmloader/acpi/acpi2_0.h                                        
       |  324 
 tools/firmware/hvmloader/acpi/build.c                                          
       |  241 
 tools/firmware/hvmloader/acpi/dsdt.asl                                         
       |  521 
 tools/firmware/hvmloader/acpi/dsdt.c                                           
       |  300 
 tools/firmware/hvmloader/acpi/gen.c                                            
       |   53 
 tools/firmware/hvmloader/acpi/static_tables.c                                  
       |  184 
 tools/firmware/hvmloader/acpi_madt.c                                           
       |  176 
 tools/firmware/hvmloader/acpi_ssdt_tpm.asl                                     
       |   29 
 tools/firmware/hvmloader/acpi_ssdt_tpm.h                                       
       |   25 
 tools/firmware/hvmloader/acpi_utils.c                                          
       |  207 
 tools/firmware/hvmloader/acpi_utils.h                                          
       |   36 
 tools/firmware/hvmloader/hvmloader.c                                           
       |   16 
 tools/firmware/hvmloader/util.c                                                
       |    5 
 tools/firmware/vmxassist/Makefile                                              
       |    9 
 tools/firmware/vmxassist/head.S                                                
       |    2 
 tools/firmware/vmxassist/setup.c                                               
       |    3 
 tools/firmware/vmxassist/trap.S                                                
       |    2 
 tools/firmware/vmxassist/util.c                                                
       |   25 
 tools/firmware/vmxassist/util.h                                                
       |    1 
 tools/firmware/vmxassist/vm86.c                                                
       |   48 
 tools/ioemu/Makefile.target                                                    
       |   15 
 tools/ioemu/d3des.c                                                            
       |  434 
 tools/ioemu/d3des.h                                                            
       |   51 
 tools/ioemu/hw/ide.c                                                           
       |    4 
 tools/ioemu/hw/ne2000.c                                                        
       |   35 
 tools/ioemu/hw/pc.c                                                            
       |    3 
 tools/ioemu/hw/serial.c                                                        
       |   44 
 tools/ioemu/hw/tpm_tis.c                                                       
       | 1114 +
 tools/ioemu/hw/xen_platform.c                                                  
       |    8 
 tools/ioemu/keymaps/ja                                                         
       |    3 
 tools/ioemu/patches/domain-timeoffset                                          
       |    8 
 tools/ioemu/patches/hypervisor-rtc                                             
       |   26 
 tools/ioemu/patches/ide-cd-dma                                                 
       |   18 
 tools/ioemu/patches/qemu-bootorder                                             
       |   22 
 tools/ioemu/patches/qemu-cleanup                                               
       |   33 
 tools/ioemu/patches/qemu-daemonize                                             
       |    4 
 tools/ioemu/patches/qemu-logging                                               
       |    3 
 tools/ioemu/patches/qemu-target-i386-dm                                        
       |   18 
 tools/ioemu/patches/serial-port-rate-limit                                     
       |   47 
 tools/ioemu/patches/series                                                     
       |    6 
 tools/ioemu/patches/vnc-access-monitor-vt                                      
       |    8 
 tools/ioemu/patches/vnc-backoff-screen-scan                                    
       |   42 
 tools/ioemu/patches/vnc-display-find-unused                                    
       |   15 
 tools/ioemu/patches/vnc-fixes                                                  
       |   17 
 tools/ioemu/patches/vnc-listen-specific-interface                              
       |  142 
 tools/ioemu/patches/vnc-password                                               
       |  119 
 tools/ioemu/patches/vnc-protocol-fixes                                         
       |   46 
 tools/ioemu/patches/vnc-start-vncviewer                                        
       |    8 
 tools/ioemu/patches/vnc-title-domain-name                                      
       |    8 
 tools/ioemu/patches/xen-build                                                  
       |   13 
 tools/ioemu/patches/xen-platform-device                                        
       |   12 
 tools/ioemu/patches/xen-support-buffered-ioreqs                                
       |    8 
 tools/ioemu/patches/xenstore-block-device-config                               
       |   47 
 tools/ioemu/patches/xenstore-write-vnc-port                                    
       |   12 
 tools/ioemu/target-i386-dm/exec-dm.c                                           
       |   50 
 tools/ioemu/target-i386-dm/helper2.c                                           
       |   86 
 tools/ioemu/target-i386-dm/i8259-dm.c                                          
       |   42 
 tools/ioemu/target-i386-dm/qemu-dm.debug                                       
       |    7 
 tools/ioemu/target-i386-dm/rtc-dm.c                                            
       |  107 
 tools/ioemu/vl.c                                                               
       |   29 
 tools/ioemu/vl.h                                                               
       |   27 
 tools/ioemu/vnc.c                                                              
       |  114 
 tools/ioemu/vnc_keysym.h                                                       
       |   10 
 tools/ioemu/xenstore.c                                                         
       |  188 
 tools/libxc/Makefile                                                           
       |    2 
 tools/libxc/ia64/xc_ia64_hvm_build.c                                           
       |   12 
 tools/libxc/ia64/xc_ia64_linux_restore.c                                       
       |    3 
 tools/libxc/ia64/xc_ia64_linux_save.c                                          
       |    3 
 tools/libxc/xc_acm.c                                                           
       |    6 
 tools/libxc/xc_core.c                                                          
       |    2 
 tools/libxc/xc_domain.c                                                        
       |   53 
 tools/libxc/xc_evtchn.c                                                        
       |    6 
 tools/libxc/xc_hvm_build.c                                                     
       |  295 
 tools/libxc/xc_linux_build.c                                                   
       |  205 
 tools/libxc/xc_linux_restore.c                                                 
       |   10 
 tools/libxc/xc_linux_save.c                                                    
       |   42 
 tools/libxc/xc_misc.c                                                          
       |   32 
 tools/libxc/xc_private.c                                                       
       |  154 
 tools/libxc/xc_private.h                                                       
       |   16 
 tools/libxc/xc_ptrace.c                                                        
       |   29 
 tools/libxc/xc_ptrace_core.c                                                   
       |   24 
 tools/libxc/xc_tbuf.c                                                          
       |    4 
 tools/libxc/xenctrl.h                                                          
       |   43 
 tools/libxc/xenguest.h                                                         
       |   34 
 tools/libxc/xg_private.c                                                       
       |   82 
 tools/libxc/xg_private.h                                                       
       |    2 
 tools/libxen/COPYING                                                           
       |  510 
 tools/libxen/Makefile                                                          
       |   37 
 tools/libxen/README                                                            
       |   54 
 tools/libxen/include/xen_boot_type.h                                           
       |   87 
 tools/libxen/include/xen_boot_type_internal.h                                  
       |   37 
 tools/libxen/include/xen_common.h                                              
       |  145 
 tools/libxen/include/xen_cpu_feature.h                                         
       |  387 
 tools/libxen/include/xen_cpu_feature_internal.h                                
       |   37 
 tools/libxen/include/xen_driver_type.h                                         
       |   77 
 tools/libxen/include/xen_driver_type_internal.h                                
       |   37 
 tools/libxen/include/xen_host.h                                                
       |  285 
 tools/libxen/include/xen_host_cpu.h                                            
       |  232 
 tools/libxen/include/xen_host_cpu_decl.h                                       
       |   30 
 tools/libxen/include/xen_host_decl.h                                           
       |   30 
 tools/libxen/include/xen_int_float_map.h                                       
       |   53 
 tools/libxen/include/xen_internal.h                                            
       |  192 
 tools/libxen/include/xen_network.h                                             
       |  266 
 tools/libxen/include/xen_network_decl.h                                        
       |   30 
 tools/libxen/include/xen_on_crash_behaviour.h                                  
       |   97 
 tools/libxen/include/xen_on_crash_behaviour_internal.h                         
       |   38 
 tools/libxen/include/xen_on_normal_exit.h                                      
       |   77 
 tools/libxen/include/xen_on_normal_exit_internal.h                             
       |   37 
 tools/libxen/include/xen_pif.h                                                 
       |  283 
 tools/libxen/include/xen_pif_decl.h                                            
       |   30 
 tools/libxen/include/xen_sr.h                                                  
       |  275 
 tools/libxen/include/xen_sr_decl.h                                             
       |   30 
 tools/libxen/include/xen_string_string_map.h                                   
       |   53 
 tools/libxen/include/xen_user.h                                                
       |  197 
 tools/libxen/include/xen_user_decl.h                                           
       |   30 
 tools/libxen/include/xen_vbd.h                                                 
       |  278 
 tools/libxen/include/xen_vbd_decl.h                                            
       |   30 
 tools/libxen/include/xen_vbd_mode.h                                            
       |   77 
 tools/libxen/include/xen_vbd_mode_internal.h                                   
       |   37 
 tools/libxen/include/xen_vdi.h                                                 
       |  337 
 tools/libxen/include/xen_vdi_decl.h                                            
       |   30 
 tools/libxen/include/xen_vdi_type.h                                            
       |   82 
 tools/libxen/include/xen_vdi_type_internal.h                                   
       |   37 
 tools/libxen/include/xen_vif.h                                                 
       |  298 
 tools/libxen/include/xen_vif_decl.h                                            
       |   30 
 tools/libxen/include/xen_vm.h                                                  
       |  810 
 tools/libxen/include/xen_vm_decl.h                                             
       |   30 
 tools/libxen/include/xen_vm_power_state.h                                      
       |   97 
 tools/libxen/include/xen_vm_power_state_internal.h                             
       |   37 
 tools/libxen/include/xen_vtpm.h                                                
       |  209 
 tools/libxen/include/xen_vtpm_decl.h                                           
       |   31 
 tools/libxen/src/xen_boot_type.c                                               
       |   83 
 tools/libxen/src/xen_common.c                                                  
       | 1363 +
 tools/libxen/src/xen_cpu_feature.c                                             
       |  143 
 tools/libxen/src/xen_driver_type.c                                             
       |   81 
 tools/libxen/src/xen_host.c                                                    
       |  376 
 tools/libxen/src/xen_host_cpu.c                                                
       |  273 
 tools/libxen/src/xen_int_float_map.c                                           
       |   37 
 tools/libxen/src/xen_network.c                                                 
       |  350 
 tools/libxen/src/xen_on_crash_behaviour.c                                      
       |   85 
 tools/libxen/src/xen_on_normal_exit.c                                          
       |   81 
 tools/libxen/src/xen_pif.c                                                     
       |  389 
 tools/libxen/src/xen_sr.c                                                      
       |  374 
 tools/libxen/src/xen_string_string_map.c                                       
       |   49 
 tools/libxen/src/xen_user.c                                                    
       |  187 
 tools/libxen/src/xen_vbd.c                                                     
       |  373 
 tools/libxen/src/xen_vbd_mode.c                                                
       |   81 
 tools/libxen/src/xen_vdi.c                                                     
       |  519 
 tools/libxen/src/xen_vdi_type.c                                                
       |   82 
 tools/libxen/src/xen_vif.c                                                     
       |  426 
 tools/libxen/src/xen_vm.c                                                      
       | 1596 +
 tools/libxen/src/xen_vm_power_state.c                                          
       |   85 
 tools/libxen/src/xen_vtpm.c                                                    
       |  213 
 tools/libxen/test/test_bindings.c                                              
       |  424 
 tools/misc/xenperf.c                                                           
       |   26 
 tools/pygrub/Makefile                                                          
       |    6 
 tools/pygrub/setup.py                                                          
       |    2 
 tools/python/Makefile                                                          
       |    6 
 tools/python/README.XendConfig                                                 
       |  159 
 tools/python/README.sxpcfg                                                     
       |  116 
 tools/python/scripts/README                                                    
       |   49 
 tools/python/scripts/README.lifecycle                                          
       |  136 
 tools/python/scripts/xapi.domcfg.py                                            
       |   39 
 tools/python/scripts/xapi.py                                                   
       |  492 
 tools/python/scripts/xapi.vbdcfg.py                                            
       |   12 
 tools/python/scripts/xapi.vdicfg.py                                            
       |    7 
 tools/python/scripts/xapi.vifcfg.py                                            
       |   10 
 tools/python/setup.py                                                          
       |    3 
 tools/python/xen/lowlevel/acm/acm.c                                            
       |   19 
 tools/python/xen/lowlevel/xc/xc.c                                              
       |   90 
 tools/python/xen/util/blkif.py                                                 
       |    3 
 tools/python/xen/util/security.py                                              
       |   30 
 tools/python/xen/util/xmlrpclib2.py                                            
       |   36 
 tools/python/xen/xend/Args.py                                                  
       |    2 
 tools/python/xen/xend/PrettyPrint.py                                           
       |    2 
 tools/python/xen/xend/XendAPI.py                                               
       | 1463 +
 tools/python/xen/xend/XendAPIConstants.py                                      
       |   75 
 tools/python/xen/xend/XendAuthSessions.py                                      
       |  137 
 tools/python/xen/xend/XendBootloader.py                                        
       |    6 
 tools/python/xen/xend/XendCheckpoint.py                                        
       |   28 
 tools/python/xen/xend/XendConfig.py                                            
       |  866 
 tools/python/xen/xend/XendConstants.py                                         
       |   96 
 tools/python/xen/xend/XendDevices.py                                           
       |   68 
 tools/python/xen/xend/XendDomain.py                                            
       | 1289 +
 tools/python/xen/xend/XendDomainInfo.py                                        
       | 2596 +-
 tools/python/xen/xend/XendError.py                                             
       |   16 
 tools/python/xen/xend/XendNode.py                                              
       |  125 
 tools/python/xen/xend/XendProtocol.py                                          
       |    2 
 tools/python/xen/xend/XendRoot.py                                              
       |   34 
 tools/python/xen/xend/XendStorageRepository.py                                 
       |  381 
 tools/python/xen/xend/XendVDI.py                                               
       |  155 
 tools/python/xen/xend/image.py                                                 
       |  245 
 tools/python/xen/xend/server/DevController.py                                  
       |   73 
 tools/python/xen/xend/server/SrvDaemon.py                                      
       |   17 
 tools/python/xen/xend/server/SrvDomainDir.py                                   
       |    2 
 tools/python/xen/xend/server/SrvServer.py                                      
       |   30 
 tools/python/xen/xend/server/XMLRPCServer.py                                   
       |  105 
 tools/python/xen/xend/server/blkif.py                                          
       |   57 
 tools/python/xen/xend/server/iopif.py                                          
       |    4 
 tools/python/xen/xend/server/irqif.py                                          
       |    2 
 tools/python/xen/xend/server/netif.py                                          
       |   38 
 tools/python/xen/xend/server/pciif.py                                          
       |   61 
 tools/python/xen/xend/server/tpmif.py                                          
       |   32 
 tools/python/xen/xend/sxp.py                                                   
       |   24 
 tools/python/xen/xend/uuid.py                                                  
       |   10 
 tools/python/xen/xm/addlabel.py                                                
       |    9 
 tools/python/xen/xm/cfgbootpolicy.py                                           
       |  134 
 tools/python/xen/xm/create.py                                                  
       |  105 
 tools/python/xen/xm/getlabel.py                                                
       |    3 
 tools/python/xen/xm/main.py                                                    
       |  111 
 tools/python/xen/xm/new.py                                                     
       |   68 
 tools/python/xen/xm/opts.py                                                    
       |    6 
 tools/python/xen/xm/rmlabel.py                                                 
       |    3 
 tools/security/policy.txt                                                      
       |  163 
 tools/security/policytools.txt                                                 
       |  148 
 tools/security/readme.txt                                                      
       |   31 
 tools/security/secpol_tool.c                                                   
       |   14 
 tools/security/secpol_xml2bin.c                                                
       |   10 
 tools/xcutils/Makefile                                                         
       |    2 
 tools/xenmon/Makefile                                                          
       |    2 
 tools/xenmon/xenmon.py                                                         
       |    4 
 tools/xenstat/libxenstat/src/xenstat.c                                         
       |   20 
 tools/xenstat/xentop/xentop.1                                                  
       |    3 
 tools/xenstat/xentop/xentop.c                                                  
       |    6 
 tools/xenstore/Makefile                                                        
       |   16 
 tools/xentrace/formats                                                         
       |   29 
 tools/xentrace/xenctx.c                                                        
       |  108 
 tools/xm-test/README                                                           
       |   36 
 tools/xm-test/configure.ac                                                     
       |   26 
 tools/xm-test/grouptest/default                                                
       |    1 
 tools/xm-test/grouptest/security                                               
       |    1 
 tools/xm-test/lib/XmTestLib/Console.py                                         
       |    5 
 tools/xm-test/lib/XmTestLib/XenDomain.py                                       
       |    8 
 tools/xm-test/lib/XmTestLib/acm.py                                             
       |   91 
 tools/xm-test/lib/XmTestLib/arch.py                                            
       |   24 
 tools/xm-test/lib/XmTestLib/block_utils.py                                     
       |    2 
 tools/xm-test/lib/XmTestReport/arch.py                                         
       |    4 
 tools/xm-test/ramdisk/Makefile.am                                              
       |   31 
 tools/xm-test/ramdisk/README-XenSource-initrd-1.0-img                          
       |   46 
 tools/xm-test/ramdisk/README-XenSource-initrd-1.1-img                          
       |   45 
 tools/xm-test/ramdisk/configs/buildroot-i386                                   
       |   24 
 tools/xm-test/ramdisk/configs/buildroot-powerpc                                
       |   12 
 tools/xm-test/ramdisk/make-release.sh                                          
       |   47 
 tools/xm-test/ramdisk/patches/buildroot/add_xvd_devices.patch                  
       |    5 
 tools/xm-test/runtest.sh                                                       
       |   19 
 tools/xm-test/tests/Makefile.am                                                
       |    1 
 tools/xm-test/tests/block-create/01_block_attach_device_pos.py                 
       |   10 
 tools/xm-test/tests/block-create/02_block_attach_file_device_pos.py            
       |    8 
 tools/xm-test/tests/block-create/04_block_attach_device_repeatedly_pos.py      
       |   16 
 
tools/xm-test/tests/block-create/05_block_attach_and_dettach_device_repeatedly_pos.py
 |   18 
 tools/xm-test/tests/block-create/06_block_attach_baddomain_neg.py              
       |    8 
 tools/xm-test/tests/block-create/07_block_attach_baddevice_neg.py              
       |   14 
 tools/xm-test/tests/block-create/08_block_attach_bad_filedevice_neg.py         
       |   16 
 
tools/xm-test/tests/block-create/09_block_attach_and_dettach_device_check_data_pos.py
 |   44 
 tools/xm-test/tests/block-create/10_block_attach_dettach_multiple_devices.py   
       |   30 
 tools/xm-test/tests/block-create/11_block_attach_shared_dom0.py                
       |    2 
 tools/xm-test/tests/block-create/12_block_attach_shared_domU.py                
       |    2 
 tools/xm-test/tests/block-destroy/01_block-destroy_btblock_pos.py              
       |    8 
 tools/xm-test/tests/block-destroy/02_block-destroy_rtblock_pos.py              
       |    8 
 tools/xm-test/tests/block-destroy/04_block-destroy_nonattached_neg.py          
       |    2 
 tools/xm-test/tests/block-destroy/05_block-destroy_byname_pos.py               
       |    8 
 tools/xm-test/tests/block-destroy/06_block-destroy_check_list_pos.py           
       |   10 
 tools/xm-test/tests/block-integrity/01_block_device_read_verify.py             
       |    4 
 tools/xm-test/tests/block-integrity/02_block_device_write_verify.py            
       |    4 
 tools/xm-test/tests/block-list/01_block-list_pos.py                            
       |    6 
 tools/xm-test/tests/block-list/02_block-list_attachbd_pos.py                   
       |    6 
 tools/xm-test/tests/block-list/03_block-list_anotherbd_pos.py                  
       |   10 
 tools/xm-test/tests/block-list/06_block-list_checkremove_pos.py                
       |   24 
 tools/xm-test/tests/create/11_create_concurrent_pos.py                         
       |    2 
 tools/xm-test/tests/create/12_create_concurrent_stress_pos.py                  
       |    9 
 tools/xm-test/tests/create/14_create_blockroot_pos.py                          
       |   11 
 tools/xm-test/tests/create/15_create_smallmem_pos.py                           
       |    4 
 tools/xm-test/tests/create/16_create_smallmem_neg.py                           
       |    8 
 tools/xm-test/tests/network-attach/04_network_attach_baddomain_neg.py          
       |    6 
 tools/xm-test/tests/security-acm/01_security-acm_basic.py                      
       |  121 
 tools/xm-test/tests/security-acm/02_security-acm_dom_start.py                  
       |   64 
 tools/xm-test/tests/security-acm/03_security-acm_dom_conflict.py               
       |   60 
 tools/xm-test/tests/security-acm/04_security-acm_dom_res.py                    
       |   69 
 tools/xm-test/tests/security-acm/05_security-acm_dom_res_conf.py               
       |   38 
 tools/xm-test/tests/security-acm/06_security-acm_dom_block_attach.py           
       |   82 
 tools/xm-test/tests/security-acm/Makefile.am                                   
       |   28 
 tools/xm-test/tests/security-acm/acm_utils.py                                  
       |   15 
 tools/xm-test/tests/security-acm/xm-test-security_policy.xml                   
       |  110 
 unmodified_drivers/linux-2.6/Makefile                                          
       |    1 
 unmodified_drivers/linux-2.6/blkfront/Makefile                                 
       |    3 
 unmodified_drivers/linux-2.6/compat-include/asm-generic/pgtable-nopmd.h        
       |   14 
 unmodified_drivers/linux-2.6/compat-include/asm-generic/pgtable-nopud.h        
       |   15 
 unmodified_drivers/linux-2.6/compat-include/linux/io.h                         
       |   10 
 unmodified_drivers/linux-2.6/compat-include/linux/mutex.h                      
       |   31 
 unmodified_drivers/linux-2.6/compat-include/xen/platform-compat.h              
       |   67 
 unmodified_drivers/linux-2.6/mkbuildtree                                       
       |   55 
 unmodified_drivers/linux-2.6/netfront/Makefile                                 
       |    3 
 unmodified_drivers/linux-2.6/overrides.mk                                      
       |    2 
 unmodified_drivers/linux-2.6/platform-pci/Kbuild                               
       |    7 
 unmodified_drivers/linux-2.6/platform-pci/Makefile                             
       |    3 
 unmodified_drivers/linux-2.6/platform-pci/evtchn.c                             
       |   12 
 unmodified_drivers/linux-2.6/platform-pci/platform-compat.c                    
       |  116 
 unmodified_drivers/linux-2.6/platform-pci/platform-pci.c                       
       |   12 
 unmodified_drivers/linux-2.6/platform-pci/xen_support.c                        
       |    4 
 unmodified_drivers/linux-2.6/util/Kbuild                                       
       |    3 
 unmodified_drivers/linux-2.6/util/Makefile                                     
       |    3 
 unmodified_drivers/linux-2.6/xenbus/Makefile                                   
       |    3 
 xen/COPYING                                                                    
       |   20 
 xen/Makefile                                                                   
       |    8 
 xen/Rules.mk                                                                   
       |   13 
 xen/acm/acm_chinesewall_hooks.c                                                
       |    2 
 xen/acm/acm_core.c                                                             
       |  107 
 xen/acm/acm_simple_type_enforcement_hooks.c                                    
       |    2 
 xen/arch/ia64/Rules.mk                                                         
       |   22 
 xen/arch/ia64/asm-offsets.c                                                    
       |    3 
 xen/arch/ia64/linux-xen/Makefile                                               
       |    2 
 xen/arch/ia64/linux-xen/README.origin                                          
       |    2 
 xen/arch/ia64/linux-xen/entry.S                                                
       |    8 
 xen/arch/ia64/linux-xen/mca.c                                                  
       |   13 
 xen/arch/ia64/linux-xen/mm_contig.c                                            
       |    2 
 xen/arch/ia64/linux-xen/mm_numa.c                                              
       |   75 
 xen/arch/ia64/linux-xen/numa.c                                                 
       |   67 
 xen/arch/ia64/linux-xen/sal.c                                                  
       |   75 
 xen/arch/ia64/linux-xen/setup.c                                                
       |    2 
 xen/arch/ia64/linux-xen/smpboot.c                                              
       |    3 
 xen/arch/ia64/linux-xen/tlb.c                                                  
       |    9 
 xen/arch/ia64/linux-xen/unaligned.c                                            
       |   20 
 xen/arch/ia64/tools/p2m_expose/Makefile                                        
       |   28 
 xen/arch/ia64/tools/p2m_expose/README.p2m_expose                               
       |   12 
 xen/arch/ia64/tools/p2m_expose/expose_p2m.c                                    
       |  185 
 xen/arch/ia64/vmx/Makefile                                                     
       |    1 
 xen/arch/ia64/vmx/mmio.c                                                       
       |  112 
 xen/arch/ia64/vmx/optvfault.S                                                  
       |  596 
 xen/arch/ia64/vmx/pal_emul.c                                                   
       |  515 
 xen/arch/ia64/vmx/vlsapic.c                                                    
       |  227 
 xen/arch/ia64/vmx/vmmu.c                                                       
       |  106 
 xen/arch/ia64/vmx/vmx_entry.S                                                  
       |    2 
 xen/arch/ia64/vmx/vmx_hypercall.c                                              
       |    2 
 xen/arch/ia64/vmx/vmx_init.c                                                   
       |   26 
 xen/arch/ia64/vmx/vmx_interrupt.c                                              
       |   19 
 xen/arch/ia64/vmx/vmx_ivt.S                                                    
       |   26 
 xen/arch/ia64/vmx/vmx_phy_mode.c                                               
       |   69 
 xen/arch/ia64/vmx/vmx_process.c                                                
       |  238 
 xen/arch/ia64/vmx/vmx_support.c                                                
       |   21 
 xen/arch/ia64/vmx/vmx_vcpu.c                                                   
       |   72 
 xen/arch/ia64/vmx/vmx_virt.c                                                   
       |   36 
 xen/arch/ia64/vmx/vtlb.c                                                       
       |   44 
 xen/arch/ia64/xen/Makefile                                                     
       |    4 
 xen/arch/ia64/xen/acpi.c                                                       
       |    2 
 xen/arch/ia64/xen/dom0_ops.c                                                   
       |   90 
 xen/arch/ia64/xen/dom_fw.c                                                     
       |   26 
 xen/arch/ia64/xen/domain.c                                                     
       |  254 
 xen/arch/ia64/xen/faults.c                                                     
       |   50 
 xen/arch/ia64/xen/flushtlb.c                                                   
       |  117 
 xen/arch/ia64/xen/fw_emul.c                                                    
       |  119 
 xen/arch/ia64/xen/hypercall.c                                                  
       |  105 
 xen/arch/ia64/xen/hyperprivop.S                                                
       |    2 
 xen/arch/ia64/xen/irq.c                                                        
       |   16 
 xen/arch/ia64/xen/mm.c                                                         
       |  322 
 xen/arch/ia64/xen/privop.c                                                     
       | 1054 -
 xen/arch/ia64/xen/regionreg.c                                                  
       |   12 
 xen/arch/ia64/xen/tlb_track.c                                                  
       |  507 
 xen/arch/ia64/xen/vcpu.c                                                       
       | 2254 +-
 xen/arch/ia64/xen/vhpt.c                                                       
       |  343 
 xen/arch/ia64/xen/xen.lds.S                                                    
       |    3 
 xen/arch/ia64/xen/xenasm.S                                                     
       |   32 
 xen/arch/ia64/xen/xencomm.c                                                    
       |  380 
 xen/arch/ia64/xen/xenmem.c                                                     
       |   95 
 xen/arch/ia64/xen/xenmisc.c                                                    
       |    8 
 xen/arch/ia64/xen/xenpatch.c                                                   
       |  122 
 xen/arch/ia64/xen/xensetup.c                                                   
       |   33 
 xen/arch/ia64/xen/xentime.c                                                    
       |   47 
 xen/arch/powerpc/Makefile                                                      
       |    5 
 xen/arch/powerpc/backtrace.c                                                   
       |   20 
 xen/arch/powerpc/domain.c                                                      
       |   39 
 xen/arch/powerpc/domain_build.c                                                
       |    2 
 xen/arch/powerpc/memory.c                                                      
       |    4 
 xen/arch/powerpc/mm.c                                                          
       |   11 
 xen/arch/powerpc/numa.c                                                        
       |    1 
 xen/arch/powerpc/of-devwalk.c                                                  
       |   18 
 xen/arch/powerpc/papr/xlate.c                                                  
       |    2 
 xen/arch/powerpc/powerpc64/domain.c                                            
       |    6 
 xen/arch/powerpc/setup.c                                                       
       |   28 
 xen/arch/powerpc/shadow.c                                                      
       |    4 
 xen/arch/powerpc/smpboot.c                                                     
       |   30 
 xen/arch/x86/Makefile                                                          
       |    7 
 xen/arch/x86/Rules.mk                                                          
       |   37 
 xen/arch/x86/boot/mkelf32.c                                                    
       |    5 
 xen/arch/x86/boot/x86_32.S                                                     
       |    2 
 xen/arch/x86/boot/x86_64.S                                                     
       |    2 
 xen/arch/x86/domain.c                                                          
       |  151 
 xen/arch/x86/domain_build.c                                                    
       |  101 
 xen/arch/x86/domctl.c                                                          
       |   57 
 xen/arch/x86/e820.c                                                            
       |    2 
 xen/arch/x86/extable.c                                                         
       |    2 
 xen/arch/x86/hvm/Makefile                                                      
       |    2 
 xen/arch/x86/hvm/hvm.c                                                         
       |  473 
 xen/arch/x86/hvm/i8254.c                                                       
       |   34 
 xen/arch/x86/hvm/i8259.c                                                       
       |  321 
 xen/arch/x86/hvm/instrlen.c                                                    
       |    5 
 xen/arch/x86/hvm/intercept.c                                                   
       |  154 
 xen/arch/x86/hvm/io.c                                                          
       |  141 
 xen/arch/x86/hvm/platform.c                                                    
       |  875 
 xen/arch/x86/hvm/pmtimer.c                                                     
       |   63 
 xen/arch/x86/hvm/rtc.c                                                         
       |  393 
 xen/arch/x86/hvm/svm/intr.c                                                    
       |  108 
 xen/arch/x86/hvm/svm/svm.c                                                     
       |  361 
 xen/arch/x86/hvm/svm/vmcb.c                                                    
       |  447 
 xen/arch/x86/hvm/svm/x86_32/exits.S                                            
       |   12 
 xen/arch/x86/hvm/svm/x86_64/exits.S                                            
       |   15 
 xen/arch/x86/hvm/vioapic.c                                                     
       |  985 -
 xen/arch/x86/hvm/vlapic.c                                                      
       |  639 
 xen/arch/x86/hvm/vmx/io.c                                                      
       |   50 
 xen/arch/x86/hvm/vmx/vmcs.c                                                    
       |  479 
 xen/arch/x86/hvm/vmx/vmx.c                                                     
       | 1064 -
 xen/arch/x86/hvm/vmx/x86_32/exits.S                                            
       |    6 
 xen/arch/x86/hvm/vmx/x86_64/exits.S                                            
       |    5 
 xen/arch/x86/io_apic.c                                                         
       |   14 
 xen/arch/x86/irq.c                                                             
       |   15 
 xen/arch/x86/mm.c                                                              
       |   33 
 xen/arch/x86/mm/shadow/common.c                                                
       |  324 
 xen/arch/x86/mm/shadow/multi.c                                                 
       | 1595 -
 xen/arch/x86/mm/shadow/multi.h                                                 
       |    4 
 xen/arch/x86/mm/shadow/private.h                                               
       |  192 
 xen/arch/x86/mm/shadow/types.h                                                 
       |  219 
 xen/arch/x86/numa.c                                                            
       |  308 
 xen/arch/x86/oprofile/op_model_athlon.c                                        
       |   28 
 xen/arch/x86/oprofile/op_model_p4.c                                            
       |   10 
 xen/arch/x86/oprofile/op_model_ppro.c                                          
       |   10 
 xen/arch/x86/oprofile/xenoprof.c                                               
       |   39 
 xen/arch/x86/platform_hypercall.c                                              
       |    2 
 xen/arch/x86/setup.c                                                           
       |   88 
 xen/arch/x86/smpboot.c                                                         
       |    3 
 xen/arch/x86/srat.c                                                            
       |  315 
 xen/arch/x86/time.c                                                            
       |    7 
 xen/arch/x86/traps.c                                                           
       |  114 
 xen/arch/x86/x86_32/asm-offsets.c                                              
       |    1 
 xen/arch/x86/x86_32/domain_page.c                                              
       |    2 
 xen/arch/x86/x86_32/entry.S                                                    
       |    2 
 xen/arch/x86/x86_32/seg_fixup.c                                                
       |   50 
 xen/arch/x86/x86_32/supervisor_mode_kernel.S                                   
       |    2 
 xen/arch/x86/x86_32/traps.c                                                    
       |   16 
 xen/arch/x86/x86_64/asm-offsets.c                                              
       |    1 
 xen/arch/x86/x86_64/entry.S                                                    
       |    2 
 xen/arch/x86/x86_64/traps.c                                                    
       |   24 
 xen/arch/x86/x86_emulate.c                                                     
       |   12 
 xen/common/Makefile                                                            
       |    3 
 xen/common/domain.c                                                            
       |  101 
 xen/common/domctl.c                                                            
       |   44 
 xen/common/event_channel.c                                                     
       |    3 
 xen/common/grant_table.c                                                       
       |   95 
 xen/common/keyhandler.c                                                        
       |    5 
 xen/common/lib.c                                                               
       |   17 
 xen/common/memory.c                                                            
       |   35 
 xen/common/multicall.c                                                         
       |    2 
 xen/common/page_alloc.c                                                        
       |  218 
 xen/common/perfc.c                                                             
       |   13 
 xen/common/sched_credit.c                                                      
       |  520 
 xen/common/sched_sedf.c                                                        
       |   50 
 xen/common/schedule.c                                                          
       |   29 
 xen/common/time.c                                                              
       |   77 
 xen/common/trace.c                                                             
       |    4 
 xen/common/vsprintf.c                                                          
       |    2 
 xen/common/xmalloc.c                                                           
       |   90 
 xen/drivers/acpi/Makefile                                                      
       |    1 
 xen/drivers/acpi/numa.c                                                        
       |  216 
 xen/drivers/char/console.c                                                     
       |  270 
 xen/drivers/char/serial.c                                                      
       |    4 
 xen/include/acm/acm_hooks.h                                                    
       |   14 
 xen/include/asm-ia64/config.h                                                  
       |   15 
 xen/include/asm-ia64/debugger.h                                                
       |    1 
 xen/include/asm-ia64/dom_fw.h                                                  
       |    9 
 xen/include/asm-ia64/domain.h                                                  
       |   58 
 xen/include/asm-ia64/flushtlb.h                                                
       |   89 
 xen/include/asm-ia64/guest_access.h                                            
       |  152 
 xen/include/asm-ia64/ia64_int.h                                                
       |    4 
 xen/include/asm-ia64/linux-null/asm/mmzone.h                                   
       |    1 
 xen/include/asm-ia64/linux-xen/asm/README.origin                               
       |    2 
 xen/include/asm-ia64/linux-xen/asm/acpi.h                                      
       |  123 
 xen/include/asm-ia64/linux-xen/asm/cache.h                                     
       |    2 
 xen/include/asm-ia64/linux-xen/asm/numa.h                                      
       |   80 
 xen/include/asm-ia64/linux-xen/asm/pgtable.h                                   
       |   34 
 xen/include/asm-ia64/linux-xen/asm/processor.h                                 
       |   18 
 xen/include/asm-ia64/linux-xen/asm/spinlock.h                                  
       |    8 
 xen/include/asm-ia64/linux-xen/asm/system.h                                    
       |    1 
 xen/include/asm-ia64/linux/README.origin                                       
       |    1 
 xen/include/asm-ia64/linux/asm/README.origin                                   
       |    3 
 xen/include/asm-ia64/linux/asm/nodedata.h                                      
       |   52 
 xen/include/asm-ia64/linux/asm/sal.h                                           
       |   10 
 xen/include/asm-ia64/linux/hash.h                                              
       |   58 
 xen/include/asm-ia64/mm.h                                                      
       |   26 
 xen/include/asm-ia64/p2m_entry.h                                               
       |   76 
 xen/include/asm-ia64/perfc_defn.h                                              
       |   65 
 xen/include/asm-ia64/privop.h                                                  
       |    4 
 xen/include/asm-ia64/tlb_track.h                                               
       |  155 
 xen/include/asm-ia64/tlbflush.h                                                
       |   10 
 xen/include/asm-ia64/uaccess.h                                                 
       |   18 
 xen/include/asm-ia64/vcpu.h                                                    
       |  321 
 xen/include/asm-ia64/vcpumask.h                                                
       |   60 
 xen/include/asm-ia64/vhpt.h                                                    
       |   43 
 xen/include/asm-ia64/vlsapic.h                                                 
       |    1 
 xen/include/asm-ia64/vmmu.h                                                    
       |    3 
 xen/include/asm-ia64/vmx.h                                                     
       |    3 
 xen/include/asm-ia64/vmx_pal_vsa.h                                             
       |    7 
 xen/include/asm-ia64/vmx_phy_mode.h                                            
       |    9 
 xen/include/asm-ia64/vmx_platform.h                                            
       |    6 
 xen/include/asm-ia64/vmx_vcpu.h                                                
       |  803 
 xen/include/asm-ia64/vmx_vpd.h                                                 
       |    1 
 xen/include/asm-ia64/xenkregs.h                                                
       |    3 
 xen/include/asm-ia64/xenpage.h                                                 
       |    4 
 xen/include/asm-ia64/xensystem.h                                               
       |    1 
 xen/include/asm-powerpc/acpi.h                                                 
       |    2 
 xen/include/asm-powerpc/config.h                                               
       |    1 
 xen/include/asm-powerpc/numa.h                                                 
       |    2 
 xen/include/asm-powerpc/smp.h                                                  
       |    7 
 xen/include/asm-powerpc/spinlock.h                                             
       |   43 
 xen/include/asm-x86/acpi.h                                                     
       |    4 
 xen/include/asm-x86/bitops.h                                                   
       |   58 
 xen/include/asm-x86/config.h                                                   
       |   12 
 xen/include/asm-x86/domain.h                                                   
       |   17 
 xen/include/asm-x86/grant_table.h                                              
       |    4 
 xen/include/asm-x86/hvm/domain.h                                               
       |   14 
 xen/include/asm-x86/hvm/hvm.h                                                  
       |   31 
 xen/include/asm-x86/hvm/io.h                                                   
       |   56 
 xen/include/asm-x86/hvm/support.h                                              
       |   23 
 xen/include/asm-x86/hvm/svm/vmcb.h                                             
       |   25 
 xen/include/asm-x86/hvm/vcpu.h                                                 
       |    9 
 xen/include/asm-x86/hvm/vioapic.h                                              
       |  113 
 xen/include/asm-x86/hvm/vlapic.h                                               
       |  110 
 xen/include/asm-x86/hvm/vmx/vmcs.h                                             
       |    6 
 xen/include/asm-x86/hvm/vmx/vmx.h                                              
       |  178 
 xen/include/asm-x86/hvm/vpic.h                                                 
       |   41 
 xen/include/asm-x86/hvm/vpt.h                                                  
       |  152 
 xen/include/asm-x86/mach-generic/mach_apic.h                                   
       |    6 
 xen/include/asm-x86/mm.h                                                       
       |   26 
 xen/include/asm-x86/numa.h                                                     
       |   78 
 xen/include/asm-x86/page.h                                                     
       |   12 
 xen/include/asm-x86/perfc_defn.h                                               
       |    5 
 xen/include/asm-x86/processor.h                                                
       |    2 
 xen/include/asm-x86/regs.h                                                     
       |    2 
 xen/include/asm-x86/shadow.h                                                   
       |   77 
 xen/include/asm-x86/spinlock.h                                                 
       |    8 
 xen/include/asm-x86/x86_32/page-2level.h                                       
       |    3 
 xen/include/asm-x86/x86_32/page-3level.h                                       
       |   11 
 xen/include/asm-x86/x86_64/page.h                                              
       |    3 
 xen/include/public/COPYING                                                     
       |   16 
 xen/include/public/acm.h                                                       
       |   18 
 xen/include/public/acm_ops.h                                                   
       |   18 
 xen/include/public/arch-ia64.h                                                 
       |  106 
 xen/include/public/arch-x86_32.h                                               
       |   21 
 xen/include/public/arch-x86_64.h                                               
       |   27 
 xen/include/public/callback.h                                                  
       |   18 
 xen/include/public/dom0_ops.h                                                  
       |   18 
 xen/include/public/domctl.h                                                    
       |   63 
 xen/include/public/elfnote.h                                                   
       |   18 
 xen/include/public/event_channel.h                                             
       |   18 
 xen/include/public/features.h                                                  
       |   18 
 xen/include/public/grant_table.h                                               
       |   18 
 xen/include/public/hvm/e820.h                                                  
       |   27 
 xen/include/public/hvm/hvm_info_table.h                                        
       |   18 
 xen/include/public/hvm/hvm_op.h                                                
       |   25 
 xen/include/public/hvm/ioreq.h                                                 
       |   50 
 xen/include/public/hvm/params.h                                                
       |   42 
 xen/include/public/hvm/vmx_assist.h                                            
       |   18 
 xen/include/public/io/blkif.h                                                  
       |   18 
 xen/include/public/io/console.h                                                
       |   18 
 xen/include/public/io/netif.h                                                  
       |   18 
 xen/include/public/io/pciif.h                                                  
       |   18 
 xen/include/public/io/ring.h                                                   
       |   18 
 xen/include/public/io/tpmif.h                                                  
       |   18 
 xen/include/public/io/xenbus.h                                                 
       |   18 
 xen/include/public/io/xs_wire.h                                                
       |   19 
 xen/include/public/memory.h                                                    
       |   18 
 xen/include/public/nmi.h                                                       
       |   18 
 xen/include/public/physdev.h                                                   
       |   20 
 xen/include/public/platform.h                                                  
       |   18 
 xen/include/public/sched.h                                                     
       |   18 
 xen/include/public/sysctl.h                                                    
       |   18 
 xen/include/public/trace.h                                                     
       |   31 
 xen/include/public/vcpu.h                                                      
       |   18 
 xen/include/public/version.h                                                   
       |   18 
 xen/include/public/xen-compat.h                                                
       |   18 
 xen/include/public/xen.h                                                       
       |   18 
 xen/include/public/xenoprof.h                                                  
       |   18 
 xen/include/xen/config.h                                                       
       |   76 
 xen/include/xen/console.h                                                      
       |    3 
 xen/include/xen/cpumask.h                                                      
       |    8 
 xen/include/xen/domain.h                                                       
       |   16 
 xen/include/xen/event.h                                                        
       |    7 
 xen/include/xen/lib.h                                                          
       |    9 
 xen/include/xen/mm.h                                                           
       |    7 
 xen/include/xen/nodemask.h                                                     
       |  338 
 xen/include/xen/numa.h                                                         
       |   13 
 xen/include/xen/sched-if.h                                                     
       |    6 
 xen/include/xen/sched.h                                                        
       |   61 
 xen/include/xen/softirq.h                                                      
       |    5 
 xen/include/xen/spinlock.h                                                     
       |    8 
 xen/include/xen/stdarg.h                                                       
       |    5 
 xen/include/xen/time.h                                                         
       |   14 
 734 files changed, 59683 insertions(+), 18343 deletions(-), 3 modifications(!)

diff -r b30cb72ed5e2 -r 4d4f0d52c193 .hgignore
--- a/.hgignore Fri Nov 03 16:53:17 2006 -0500
+++ b/.hgignore Thu Nov 09 15:37:17 2006 -0500
@@ -98,7 +98,7 @@
 ^tools/firmware/.*\.bin$
 ^tools/firmware/.*\.sym$
 ^tools/firmware/.*bios/.*bios.*\.txt$
-^tools/firmware/acpi/acpigen$
+^tools/firmware/hvmloader/acpi/acpigen$
 ^tools/firmware/hvmloader/hvmloader$
 ^tools/firmware/hvmloader/roms\.h$
 ^tools/firmware/rombios/BIOS-bochs-[^/]*$
@@ -123,6 +123,7 @@
 ^tools/ioemu/qemu\.1$
 ^tools/ioemu/qemu\.pod$
 ^tools/libxc/xen/.*$
+^tools/libxen/test/test_bindings$
 ^tools/libaio/src/.*\.ol$
 ^tools/libaio/src/.*\.os$
 ^tools/misc/cpuperf/cpuperf-perfcntr$
@@ -189,8 +190,9 @@
 ^tools/xm-test/aclocal.m4$
 ^tools/xm-test/autom4te
 ^tools/xm-test/install-sh$
+^tools/xm-test/mkinstalldirs$
 ^tools/xm-test/missing$
-^tools/xm-test/config(ure|.log|.status)$
+^tools/xm-test/config(ure|.log|.status|.guess|.sub)$
 ^tools/xm-test/Makefile(.in)*$
 ^tools/xm-test/.*/Makefile(.in)*$
 ^tools/xm-test/lib/XmTestLib/config.py$
diff -r b30cb72ed5e2 -r 4d4f0d52c193 Config.mk
--- a/Config.mk Fri Nov 03 16:53:17 2006 -0500
+++ b/Config.mk Thu Nov 09 15:37:17 2006 -0500
@@ -26,7 +26,10 @@ EXTRA_LIB += $(EXTRA_PREFIX)/$(LIBDIR)
 EXTRA_LIB += $(EXTRA_PREFIX)/$(LIBDIR)
 endif
 
-test-gcc-flag = $(shell $(1) -v --help 2>&1 | $(GREP) -q " $(2) " && echo $(2))
+# cc-option
+# Usage: cflags-y += $(call cc-option,$(CC),-march=winchip-c6,-march=i586)
+cc-option = $(shell if test -z "`$(1) $(2) -S -o /dev/null -xc \
+              /dev/null 2>&1`"; then echo "$(2)"; else echo "$(3)"; fi ;)
 
 ifneq ($(debug),y)
 CFLAGS += -DNDEBUG
@@ -34,14 +37,16 @@ CFLAGS += -g
 CFLAGS += -g
 endif
 
+CFLAGS += -std=gnu99
+
 CFLAGS += -Wall -Wstrict-prototypes
 
 # -Wunused-value makes GCC 4.x too aggressive for my taste: ignoring the
 # result of any casted expression causes a warning.
 CFLAGS += -Wno-unused-value
 
-HOSTCFLAGS += $(call test-gcc-flag,$(HOSTCC),-Wdeclaration-after-statement)
-CFLAGS     += $(call test-gcc-flag,$(CC),-Wdeclaration-after-statement)
+HOSTCFLAGS += $(call cc-option,$(HOSTCC),-Wdeclaration-after-statement,)
+CFLAGS     += $(call cc-option,$(CC),-Wdeclaration-after-statement,)
 
 LDFLAGS += $(foreach i, $(EXTRA_LIB), -L$(i)) 
 CFLAGS += $(foreach i, $(EXTRA_INCLUDES), -I$(i))
diff -r b30cb72ed5e2 -r 4d4f0d52c193 buildconfigs/Rules.mk
--- a/buildconfigs/Rules.mk     Fri Nov 03 16:53:17 2006 -0500
+++ b/buildconfigs/Rules.mk     Thu Nov 09 15:37:17 2006 -0500
@@ -22,7 +22,7 @@ endif
 
 # Expand Linux series to Linux version
 LINUX_SERIES   ?= 2.6
-LINUX_VER      ?= $(shell $(GREP) "^LINUX_VER " buildconfigs/mk.linux-2.6-xen 
| sed -e 's/.*=[ ]*//')
+LINUX_VER      ?= $(shell grep "^LINUX_VER " buildconfigs/mk.linux-2.6-xen | 
sed -e 's/.*=[ ]*//')
 
 # Setup Linux search path
 LINUX_SRC_PATH ?= .:..
@@ -125,7 +125,7 @@ ifeq ($(XEN_TARGET_X86_PAE),y)
 ifeq ($(XEN_TARGET_X86_PAE),y)
        sed -e 's!^CONFIG_HIGHMEM4G=y$$!\# CONFIG_HIGHMEM4G is not set!;s!^\# 
CONFIG_HIGHMEM64G is not set$$!CONFIG_HIGHMEM64G=y!' $(CONFIG_FILE) > 
$(CONFIG_FILE)- && mv $(CONFIG_FILE)- $(CONFIG_FILE)
 else
-       $(GREP) '^CONFIG_HIGHMEM64G=y' $(CONFIG_FILE) >/dev/null && ( sed -e 
's!^CONFIG_HIGHMEM64G=y$$!\# CONFIG_HIGHMEM64G is not set!;s!^\# 
CONFIG_HIGHMEM4G is not set$$!CONFIG_HIGHMEM4G=y!' $(CONFIG_FILE) > 
$(CONFIG_FILE)- && mv $(CONFIG_FILE)- $(CONFIG_FILE) ) || true
+       grep '^CONFIG_HIGHMEM64G=y' $(CONFIG_FILE) >/dev/null && ( sed -e 
's!^CONFIG_HIGHMEM64G=y$$!\# CONFIG_HIGHMEM64G is not set!;s!^\# 
CONFIG_HIGHMEM4G is not set$$!CONFIG_HIGHMEM4G=y!' $(CONFIG_FILE) > 
$(CONFIG_FILE)- && mv $(CONFIG_FILE)- $(CONFIG_FILE) ) || true
 endif
 
 # never delete any intermediate files.
diff -r b30cb72ed5e2 -r 4d4f0d52c193 buildconfigs/linux-defconfig_xen0_ia64
--- a/buildconfigs/linux-defconfig_xen0_ia64    Fri Nov 03 16:53:17 2006 -0500
+++ b/buildconfigs/linux-defconfig_xen0_ia64    Thu Nov 09 15:37:17 2006 -0500
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.16.13-xen0
-# Fri Sep  1 11:03:26 2006
+# Linux kernel version: 2.6.16.29-xen0
+# Wed Oct  4 12:54:36 2006
 #
 
 #
@@ -92,6 +92,8 @@ CONFIG_GENERIC_IOMAP=y
 CONFIG_GENERIC_IOMAP=y
 CONFIG_XEN=y
 CONFIG_XEN_IA64_VDSO_PARAVIRT=y
+CONFIG_XEN_IA64_EXPOSE_P2M=y
+CONFIG_XEN_IA64_EXPOSE_P2M_USE_DTR=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_DMA_IS_DMA32=y
 # CONFIG_IA64_GENERIC is not set
@@ -119,6 +121,7 @@ CONFIG_SMP=y
 CONFIG_SMP=y
 CONFIG_NR_CPUS=16
 CONFIG_HOTPLUG_CPU=y
+CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
 # CONFIG_SCHED_SMT is not set
 # CONFIG_PREEMPT is not set
 CONFIG_SELECT_MEMORY_MODEL=y
@@ -1041,7 +1044,6 @@ CONFIG_SND_ATIIXP=y
 # CONFIG_SND_ES1968 is not set
 CONFIG_SND_FM801=y
 # CONFIG_SND_FM801_TEA575X_BOOL is not set
-CONFIG_SND_FM801_TEA575X=y
 # CONFIG_SND_HDA_INTEL is not set
 # CONFIG_SND_HDSP is not set
 # CONFIG_SND_HDSPM is not set
@@ -1527,7 +1529,7 @@ CONFIG_XEN_XENBUS_DEV=y
 CONFIG_XEN_XENBUS_DEV=y
 CONFIG_XEN_BACKEND=y
 CONFIG_XEN_BLKDEV_BACKEND=y
-# CONFIG_XEN_BLKDEV_TAP is not set
+CONFIG_XEN_BLKDEV_TAP=y
 CONFIG_XEN_NETDEV_BACKEND=y
 # CONFIG_XEN_NETDEV_PIPELINED_TRANSMITTER is not set
 CONFIG_XEN_NETDEV_LOOPBACK=y
diff -r b30cb72ed5e2 -r 4d4f0d52c193 buildconfigs/linux-defconfig_xenU_ia64
--- a/buildconfigs/linux-defconfig_xenU_ia64    Fri Nov 03 16:53:17 2006 -0500
+++ b/buildconfigs/linux-defconfig_xenU_ia64    Thu Nov 09 15:37:17 2006 -0500
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.16.13-xenU
-# Fri Sep  1 10:50:54 2006
+# Linux kernel version: 2.6.16.29-xenU
+# Wed Oct  4 12:54:26 2006
 #
 
 #
@@ -89,6 +89,8 @@ CONFIG_GENERIC_IOMAP=y
 CONFIG_GENERIC_IOMAP=y
 CONFIG_XEN=y
 CONFIG_XEN_IA64_VDSO_PARAVIRT=y
+CONFIG_XEN_IA64_EXPOSE_P2M=y
+CONFIG_XEN_IA64_EXPOSE_P2M_USE_DTR=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_DMA_IS_DMA32=y
 # CONFIG_IA64_GENERIC is not set
@@ -116,6 +118,7 @@ CONFIG_SMP=y
 CONFIG_SMP=y
 CONFIG_NR_CPUS=16
 # CONFIG_HOTPLUG_CPU is not set
+CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
 # CONFIG_SCHED_SMT is not set
 # CONFIG_PREEMPT is not set
 CONFIG_SELECT_MEMORY_MODEL=y
@@ -940,7 +943,6 @@ CONFIG_SND_AC97_BUS=y
 # CONFIG_SND_ES1968 is not set
 CONFIG_SND_FM801=y
 # CONFIG_SND_FM801_TEA575X_BOOL is not set
-CONFIG_SND_FM801_TEA575X=y
 # CONFIG_SND_HDA_INTEL is not set
 # CONFIG_SND_HDSP is not set
 # CONFIG_SND_HDSPM is not set
diff -r b30cb72ed5e2 -r 4d4f0d52c193 buildconfigs/linux-defconfig_xen_ia64
--- a/buildconfigs/linux-defconfig_xen_ia64     Fri Nov 03 16:53:17 2006 -0500
+++ b/buildconfigs/linux-defconfig_xen_ia64     Thu Nov 09 15:37:17 2006 -0500
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.16.13-xen
-# Fri Sep  1 10:58:55 2006
+# Linux kernel version: 2.6.16.29-xen
+# Wed Oct  4 12:31:45 2006
 #
 
 #
@@ -92,6 +92,8 @@ CONFIG_GENERIC_IOMAP=y
 CONFIG_GENERIC_IOMAP=y
 CONFIG_XEN=y
 CONFIG_XEN_IA64_VDSO_PARAVIRT=y
+CONFIG_XEN_IA64_EXPOSE_P2M=y
+CONFIG_XEN_IA64_EXPOSE_P2M_USE_DTR=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_DMA_IS_DMA32=y
 # CONFIG_IA64_GENERIC is not set
@@ -119,6 +121,7 @@ CONFIG_SMP=y
 CONFIG_SMP=y
 CONFIG_NR_CPUS=16
 CONFIG_HOTPLUG_CPU=y
+CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
 # CONFIG_SCHED_SMT is not set
 # CONFIG_PREEMPT is not set
 CONFIG_SELECT_MEMORY_MODEL=y
@@ -1047,7 +1050,6 @@ CONFIG_SND_ATIIXP=y
 # CONFIG_SND_ES1968 is not set
 CONFIG_SND_FM801=y
 # CONFIG_SND_FM801_TEA575X_BOOL is not set
-CONFIG_SND_FM801_TEA575X=y
 # CONFIG_SND_HDA_INTEL is not set
 # CONFIG_SND_HDSP is not set
 # CONFIG_SND_HDSPM is not set
@@ -1533,7 +1535,7 @@ CONFIG_XEN_XENBUS_DEV=y
 CONFIG_XEN_XENBUS_DEV=y
 CONFIG_XEN_BACKEND=y
 CONFIG_XEN_BLKDEV_BACKEND=y
-# CONFIG_XEN_BLKDEV_TAP is not set
+CONFIG_XEN_BLKDEV_TAP=y
 CONFIG_XEN_NETDEV_BACKEND=y
 # CONFIG_XEN_NETDEV_PIPELINED_TRANSMITTER is not set
 CONFIG_XEN_NETDEV_LOOPBACK=y
diff -r b30cb72ed5e2 -r 4d4f0d52c193 config/Linux.mk
--- a/config/Linux.mk   Fri Nov 03 16:53:17 2006 -0500
+++ b/config/Linux.mk   Thu Nov 09 15:37:17 2006 -0500
@@ -1,37 +1,4 @@
-# -*- mode: Makefile; -*-
-
-AS         = $(CROSS_COMPILE)as
-LD         = $(CROSS_COMPILE)ld
-CC         = $(CROSS_COMPILE)gcc
-CPP        = $(CROSS_COMPILE)gcc -E
-AR         = $(CROSS_COMPILE)ar
-RANLIB     = $(CROSS_COMPILE)ranlib
-NM         = $(CROSS_COMPILE)nm
-STRIP      = $(CROSS_COMPILE)strip
-OBJCOPY    = $(CROSS_COMPILE)objcopy
-OBJDUMP    = $(CROSS_COMPILE)objdump
-
-GREP       = grep
-
-INSTALL      = install
-INSTALL_DIR  = $(INSTALL) -d -m0755
-INSTALL_DATA = $(INSTALL) -m0644
-INSTALL_PROG = $(INSTALL) -m0755
-
-LIB64DIR = lib64
-
-SOCKET_LIBS =
-CURSES_LIBS = -lncurses
-SONAME_LDFLAG = -soname
-SHLIB_CFLAGS = -shared
-
-ifneq ($(debug),y)
-# Optimisation flags are overridable
-CFLAGS ?= -O2 -fomit-frame-pointer
-else
-# Less than -O1 produces bad code and large stack frames
-CFLAGS ?= -O1 -fno-omit-frame-pointer
-endif
+include $(XEN_ROOT)/config/StdGNU.mk
 
 # You may use wildcards, e.g. KERNELS=*2.6*
 KERNELS ?= linux-2.6-xen
diff -r b30cb72ed5e2 -r 4d4f0d52c193 config/SunOS.mk
--- a/config/SunOS.mk   Fri Nov 03 16:53:17 2006 -0500
+++ b/config/SunOS.mk   Thu Nov 09 15:37:17 2006 -0500
@@ -1,5 +1,3 @@
-# -*- mode: Makefile; -*-
-
 AS         = $(CROSS_COMPILE)gas
 LD         = $(CROSS_COMPILE)gld
 CC         = $(CROSS_COMPILE)gcc
@@ -11,7 +9,6 @@ OBJCOPY    = $(CROSS_COMPILE)gobjcopy
 OBJCOPY    = $(CROSS_COMPILE)gobjcopy
 OBJDUMP    = $(CROSS_COMPILE)gobjdump
 
-GREP       = ggrep
 SHELL      = bash
 
 INSTALL      = ginstall
@@ -24,7 +21,7 @@ SOCKET_LIBS = -lsocket
 SOCKET_LIBS = -lsocket
 CURSES_LIBS = -lcurses
 SONAME_LDFLAG = -h
-SHLIB_CFLAGS = -static-libgcc -shared
+SHLIB_CFLAGS = -R /usr/sfw/$(LIBDIR) -shared
 
 ifneq ($(debug),y)
 # Optimisation flags are overridable
@@ -34,4 +31,5 @@ CFLAGS ?= -O1 -fno-omit-frame-pointer
 CFLAGS ?= -O1 -fno-omit-frame-pointer
 endif
 
-CFLAGS += -Wa,--divide
+CFLAGS += -Wa,--divide -D_POSIX_C_SOURCE=200112L -D__EXTENSIONS__
+
diff -r b30cb72ed5e2 -r 4d4f0d52c193 config/x86_32.mk
--- a/config/x86_32.mk  Fri Nov 03 16:53:17 2006 -0500
+++ b/config/x86_32.mk  Thu Nov 09 15:37:17 2006 -0500
@@ -7,5 +7,11 @@ CONFIG_IOEMU := y
 CONFIG_IOEMU := y
 
 CFLAGS += -m32 -march=i686
-LDFLAGS += -m32
 LIBDIR := lib
+
+# Use only if calling $(LD) directly.
+ifeq ($(XEN_OS),OpenBSD)
+LDFLAGS_DIRECT += -melf_i386_obsd
+else
+LDFLAGS_DIRECT += -melf_i386
+endif
diff -r b30cb72ed5e2 -r 4d4f0d52c193 config/x86_64.mk
--- a/config/x86_64.mk  Fri Nov 03 16:53:17 2006 -0500
+++ b/config/x86_64.mk  Thu Nov 09 15:37:17 2006 -0500
@@ -7,5 +7,11 @@ CONFIG_IOEMU := y
 CONFIG_IOEMU := y
 
 CFLAGS += -m64
-LDFLAGS += -m64
 LIBDIR = $(LIB64DIR)
+
+# Use only if calling $(LD) directly.
+ifeq ($(XEN_OS),OpenBSD)
+LDFLAGS_DIRECT += -melf_x86_64_obsd
+else
+LDFLAGS_DIRECT += -melf_x86_64
+endif
diff -r b30cb72ed5e2 -r 4d4f0d52c193 docs/man/xm.pod.1
--- a/docs/man/xm.pod.1 Fri Nov 03 16:53:17 2006 -0500
+++ b/docs/man/xm.pod.1 Thu Nov 09 15:37:17 2006 -0500
@@ -810,13 +810,13 @@ Loads the binary representation of the I
 Loads the binary representation of the I<policy> into Xen. The binary
 representation can be created with the B<makepolicy> subcommand.
 
-=item B<cfgbootpolicy> I<policy> [I<kernelversion>]
+=item B<cfgbootpolicy> I<policy> [I<boot title>]
 
 Configures I<policy> as the boot policy for Xen. It copies the binary
 policy representation into the /boot directory and adds a module line
 specifying the binary policy to the /boot/grub/menu.lst file. If your
 boot configuration includes multiple Xen boot titles, then use the
-I<kernelversion> parameter to select the proper title.
+I<boot title> parameter to specify a unique part of the proper title.
 
 =item B<dumppolicy>
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 docs/src/interface.tex
--- a/docs/src/interface.tex    Fri Nov 03 16:53:17 2006 -0500
+++ b/docs/src/interface.tex    Thu Nov 09 15:37:17 2006 -0500
@@ -955,7 +955,6 @@ A {\bf /vm} entry contains the following
 A {\bf /vm} entry contains the following information:
 
 \begin{description}
-\item[ssidref] ssid reference for domain
 \item[uuid] uuid of the domain (somewhat redundant)
 \item[on\_reboot] the action to take on a domain reboot request (destroy or 
restart)
 \item[on\_poweroff] the action to take on a domain halt request (destroy or 
restart)
@@ -1125,6 +1124,16 @@ This path contains:
       \end{description}
     \end{description}
 
+  \item[security/] access control information for the domain
+    \begin{description}
+    \item[ssidref] security reference identifier used inside the hypervisor
+    \item[access\_control/] security label used by management tools
+      \begin{description}
+       \item[label] security label name
+       \item[policy] security policy name
+      \end{description}
+    \end{description}
+
   \item[store/] per-domain information for the store
     \begin{description}
     \item[port] the event channel used for the store ring queue 
@@ -2168,18 +2177,45 @@ implementing them (in {\tt xen/common/do
 implementing them (in {\tt xen/common/dom0\_ops.c}) and in 
 the user-space tools that use them (mostly in {\tt tools/libxc}). 
 
+\section{Access Control Module Hypercalls}
+\label{s:acmops}
+
 Hypercalls relating to the management of the Access Control Module are
-also restricted to domain 0 access for now:
+also restricted to domain 0 access for now. For more details on any or
+all of these, please see {\tt xen/include/public/acm\_ops.h}.  A
+complete list is given below:
 
 \begin{quote}
 
-\hypercall{acm\_op(struct acm\_op * u\_acm\_op)}
+\hypercall{acm\_op(int cmd, void *args)}
 
 This hypercall can be used to configure the state of the ACM, query
 that state, request access control decisions and dump additional
 information.
 
+\begin{description}
+
+\item [ACMOP\_SETPOLICY:] set the access control policy
+
+\item [ACMOP\_GETPOLICY:] get the current access control policy and
+  status
+
+\item [ACMOP\_DUMPSTATS:] get current access control hook invocation
+  statistics
+
+\item [ACMOP\_GETSSID:] get security access control information for a
+  domain
+
+\item [ACMOP\_GETDECISION:] get access decision based on the currently
+  enforced access control policy
+
+\end{description}
 \end{quote}
+
+Most of the above are best understood by looking at the code
+implementing them (in {\tt xen/common/acm\_ops.c}) and in the
+user-space tools that use them (mostly in {\tt tools/security} and
+{\tt tools/python/xen/lowlevel/acm}).
 
 
 \section{Debugging Hypercalls} 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 docs/src/user.tex
--- a/docs/src/user.tex Fri Nov 03 16:53:17 2006 -0500
+++ b/docs/src/user.tex Thu Nov 09 15:37:17 2006 -0500
@@ -3192,6 +3192,15 @@ editing \path{grub.conf}.
   input to DOM0 when it boots --- if it is `x' then auto-switching is
   disabled.  Any other value, or omitting the character, enables
   auto-switching.  [NB. Default switch-char is `a'.]
+\item [ loglvl=$<$level$>/<$level$>$ ]
+  Specify logging level. Messages of the specified severity level (and
+  higher) will be printed to the Xen console. Valid levels are `none',
+  `error', `warning', `info', `debug', and `all'. The second level
+  specifier is optional: it is used to specify message severities
+  which are to be rate limited. Default is `loglvl=warning'.
+\item [ guest\_loglvl=$<$level$>/<$level$>$ ] As for loglvl, but
+  applies to messages relating to guests. Default is
+  `guest\_loglvl=none/warning'. 
 \item [ nmi=xxx ]
   Specify what to do with an NMI parity or I/O error. \\
   `nmi=fatal':  Xen prints a diagnostic and then hangs. \\
@@ -3202,12 +3211,21 @@ editing \path{grub.conf}.
   ignored. This parameter may be specified with a B, K, M or G suffix,
   representing bytes, kilobytes, megabytes and gigabytes respectively.
   The default unit, if no suffix is specified, is kilobytes.
-\item [ dom0\_mem=xxx ] Set the amount of memory to be allocated to
-  domain0. In Xen 3.x the parameter may be specified with a B, K, M or
+\item [ dom0\_mem=$<$specifier list$>$ ] Set the amount of memory to
+  be allocated to domain 0. This is a comma-separated list containing
+  the following optional components:
+  \begin{description}
+  \item[ min:$<$min\_amt$>$ ] Minimum amount to allocate to domain 0
+  \item[ max:$<$min\_amt$>$ ] Maximum amount to allocate to domain 0
+  \item[ $<$amt$>$ ] Precise amount to allocate to domain 0
+  \end{description}
+  Each numeric parameter may be specified with a B, K, M or
   G suffix, representing bytes, kilobytes, megabytes and gigabytes
   respectively; if no suffix is specified, the parameter defaults to
-  kilobytes. In previous versions of Xen, suffixes were not supported
-  and the value is always interpreted as kilobytes.
+  kilobytes. Negative values are subtracted from total available
+  memory. If $<$amt$>$ is not specified, it defaults to all available
+  memory less a small amount (clamped to 128MB) for uses such as DMA
+  buffers.
 \item [ dom0\_vcpus\_pin ] Pins domain 0 VCPUs on their respective
   physical CPUS (default=false).
 \item [ tbuf\_size=xxx ] Set the size of the per-cpu trace buffers, in
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/arch/i386/kernel/fixup.c
--- a/linux-2.6-xen-sparse/arch/i386/kernel/fixup.c     Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/arch/i386/kernel/fixup.c     Thu Nov 09 15:37:17 
2006 -0500
@@ -46,6 +46,9 @@ fastcall void do_fixup_4gb_segment(struc
        if (test_and_set_bit(0, &printed))
                return;
 
+        if (current->tgid == 1) /* Ignore statically linked init */
+                return; 
+            
        HYPERVISOR_vm_assist(
                VMASST_CMD_disable, VMASST_TYPE_4gb_segments_notify);
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/arch/i386/kernel/microcode-xen.c
--- a/linux-2.6-xen-sparse/arch/i386/kernel/microcode-xen.c     Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/arch/i386/kernel/microcode-xen.c     Thu Nov 09 
15:37:17 2006 -0500
@@ -50,9 +50,6 @@ MODULE_LICENSE("GPL");
 
 /* no concurrent ->write()s are allowed on /dev/cpu/microcode */
 static DECLARE_MUTEX(microcode_sem);
-
-static void __user *user_buffer;       /* user area microcode data buffer */
-static unsigned int user_buffer_size;  /* it's size */
                                
 static int microcode_open (struct inode *unused1, struct file *unused2)
 {
@@ -60,21 +57,26 @@ static int microcode_open (struct inode 
 }
 
 
-static int do_microcode_update (void)
+static int do_microcode_update (const void __user *ubuf, size_t len)
 {
        int err;
-       dom0_op_t op;
+       void *kbuf;
 
-       err = sys_mlock((unsigned long)user_buffer, user_buffer_size);
-       if (err != 0)
-               return err;
+       kbuf = vmalloc(len);
+       if (!kbuf)
+               return -ENOMEM;
 
-       op.cmd = DOM0_MICROCODE;
-       set_xen_guest_handle(op.u.microcode.data, user_buffer);
-       op.u.microcode.length = user_buffer_size;
-       err = HYPERVISOR_dom0_op(&op);
+       if (copy_from_user(kbuf, ubuf, len) == 0) {
+               dom0_op_t op;
 
-       (void)sys_munlock((unsigned long)user_buffer, user_buffer_size);
+               op.cmd = DOM0_MICROCODE;
+               set_xen_guest_handle(op.u.microcode.data, kbuf);
+               op.u.microcode.length = len;
+               err = HYPERVISOR_dom0_op(&op);
+       } else
+               err = -EFAULT;
+
+       vfree(kbuf);
 
        return err;
 }
@@ -88,17 +90,9 @@ static ssize_t microcode_write (struct f
                return -EINVAL;
        }
 
-       if ((len >> PAGE_SHIFT) > num_physpages) {
-               printk(KERN_ERR "microcode: too much data (max %ld pages)\n", 
num_physpages);
-               return -EINVAL;
-       }
-
        down(&microcode_sem);
 
-       user_buffer = (void __user *) buf;
-       user_buffer_size = (int) len;
-
-       ret = do_microcode_update();
+       ret = do_microcode_update(buf, len);
        if (!ret)
                ret = (ssize_t)len;
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/arch/i386/kernel/sysenter.c
--- a/linux-2.6-xen-sparse/arch/i386/kernel/sysenter.c  Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/arch/i386/kernel/sysenter.c  Thu Nov 09 15:37:17 
2006 -0500
@@ -60,7 +60,7 @@ int __init sysenter_setup(void)
 
 #ifdef CONFIG_XEN
        if (boot_cpu_has(X86_FEATURE_SEP)) {
-               struct callback_register sysenter = {
+               static struct callback_register __initdata sysenter = {
                        .type = CALLBACKTYPE_sysenter,
                        .address = { __KERNEL_CS, (unsigned long)sysenter_entry 
},
                };
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/arch/i386/mm/hypervisor.c
--- a/linux-2.6-xen-sparse/arch/i386/mm/hypervisor.c    Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/arch/i386/mm/hypervisor.c    Thu Nov 09 15:37:17 
2006 -0500
@@ -325,6 +325,7 @@ int xen_create_contiguous_region(
        success = (exchange.nr_exchanged == (1UL << order));
        BUG_ON(!success && ((exchange.nr_exchanged != 0) || (rc == 0)));
        BUG_ON(success && (rc != 0));
+#ifdef CONFIG_XEN_COMPAT_030002
        if (unlikely(rc == -ENOSYS)) {
                /* Compatibility when XENMEM_exchange is unsupported. */
                if (HYPERVISOR_memory_op(XENMEM_decrease_reservation,
@@ -341,6 +342,7 @@ int xen_create_contiguous_region(
                                BUG();
                }
        }
+#endif
 
        /* 3. Map the new extent in place of old pages. */
        for (i = 0; i < (1UL<<order); i++) {
@@ -419,6 +421,7 @@ void xen_destroy_contiguous_region(unsig
        success = (exchange.nr_exchanged == 1);
        BUG_ON(!success && ((exchange.nr_exchanged != 0) || (rc == 0)));
        BUG_ON(success && (rc != 0));
+#ifdef CONFIG_XEN_COMPAT_030002
        if (unlikely(rc == -ENOSYS)) {
                /* Compatibility when XENMEM_exchange is unsupported. */
                if (HYPERVISOR_memory_op(XENMEM_decrease_reservation,
@@ -429,6 +432,7 @@ void xen_destroy_contiguous_region(unsig
                        BUG();
                success = 1;
        }
+#endif
 
        /* 4. Map new pages in place of old pages. */
        for (i = 0; i < (1UL<<order); i++) {
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/arch/i386/mm/init-xen.c
--- a/linux-2.6-xen-sparse/arch/i386/mm/init-xen.c      Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/arch/i386/mm/init-xen.c      Thu Nov 09 15:37:17 
2006 -0500
@@ -663,8 +663,8 @@ void __init mem_init(void)
        totalram_pages += free_all_bootmem();
        /* XEN: init and count low-mem pages outside initial allocation. */
        for (pfn = xen_start_info->nr_pages; pfn < max_low_pfn; pfn++) {
-               ClearPageReserved(&mem_map[pfn]);
-               set_page_count(&mem_map[pfn], 1);
+               ClearPageReserved(pfn_to_page(pfn));
+               set_page_count(pfn_to_page(pfn), 1);
                totalram_pages++;
        }
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 linux-2.6-xen-sparse/arch/ia64/Kconfig
--- a/linux-2.6-xen-sparse/arch/ia64/Kconfig    Fri Nov 03 16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/arch/ia64/Kconfig    Thu Nov 09 15:37:17 2006 -0500
@@ -63,6 +63,20 @@ config XEN_IA64_VDSO_PARAVIRT
        default y
        help
          vDSO paravirtualization
+
+config XEN_IA64_EXPOSE_P2M
+       bool "Xen/IA64 exposure p2m table"
+       depends on XEN
+       default y
+       help
+         expose p2m from xen
+
+config XEN_IA64_EXPOSE_P2M_USE_DTR
+       bool "Xen/IA64 map p2m table with dtr"
+       depends on XEN_IA64_EXPOSE_P2M
+       default y
+       help
+         use dtr to map the exposed p2m table
 
 config SCHED_NO_NO_OMIT_FRAME_POINTER
        bool
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/arch/ia64/kernel/gate.lds.S
--- a/linux-2.6-xen-sparse/arch/ia64/kernel/gate.lds.S  Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/arch/ia64/kernel/gate.lds.S  Thu Nov 09 15:37:17 
2006 -0500
@@ -13,6 +13,7 @@ SECTIONS
   . = GATE_ADDR + SIZEOF_HEADERS;
 
   .hash                                : { *(.hash) }                          
:readable
+  .gnu.hash                    : { *(.gnu.hash) }
   .dynsym                      : { *(.dynsym) }
   .dynstr                      : { *(.dynstr) }
   .gnu.version                 : { *(.gnu.version) }
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/arch/ia64/kernel/setup.c
--- a/linux-2.6-xen-sparse/arch/ia64/kernel/setup.c     Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/arch/ia64/kernel/setup.c     Thu Nov 09 15:37:17 
2006 -0500
@@ -63,6 +63,7 @@
 #include <asm/system.h>
 #ifdef CONFIG_XEN
 #include <asm/hypervisor.h>
+#include <asm/xen/xencomm.h>
 #endif
 #include <linux/dma-mapping.h>
 
@@ -433,6 +434,9 @@ setup_arch (char **cmdline_p)
 
 #ifdef CONFIG_XEN
        if (is_running_on_xen()) {
+               /* Must be done before any hypercall.  */
+               xencomm_init();
+
                setup_xen_features();
                /* Register a call for panic conditions. */
                notifier_chain_register(&panic_notifier_list, &xen_panic_block);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 linux-2.6-xen-sparse/arch/ia64/xen/Makefile
--- a/linux-2.6-xen-sparse/arch/ia64/xen/Makefile       Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/arch/ia64/xen/Makefile       Thu Nov 09 15:37:17 
2006 -0500
@@ -3,6 +3,7 @@
 #
 
 obj-y := hypercall.o xenivt.o xenentry.o xensetup.o xenpal.o xenhpski.o \
-        hypervisor.o pci-dma-xen.o util.o
+        hypervisor.o pci-dma-xen.o util.o xencomm.o xcom_hcall.o \
+        xcom_mini.o xcom_privcmd.o
 
 pci-dma-xen-y := ../../i386/kernel/pci-dma-xen.o
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/arch/ia64/xen/hypervisor.c
--- a/linux-2.6-xen-sparse/arch/ia64/xen/hypervisor.c   Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/arch/ia64/xen/hypervisor.c   Thu Nov 09 15:37:17 
2006 -0500
@@ -40,59 +40,11 @@ int running_on_xen;
 int running_on_xen;
 EXPORT_SYMBOL(running_on_xen);
 
-//XXX xen/ia64 copy_from_guest() is broken.
-//    This is a temporal work around until it is fixed.
-//    used by balloon.c netfront.c
-
-// get_xen_guest_handle is defined only when __XEN_TOOLS__ is defined
-// if the definition in arch-ia64.h is changed, this must be updated.
-#define get_xen_guest_handle(val, hnd)  do { val = (hnd).p; } while (0)
-
-int
-ia64_xenmem_reservation_op(unsigned long op,
-                          struct xen_memory_reservation* reservation__)
-{
-       struct xen_memory_reservation reservation = *reservation__;
-       unsigned long* frame_list;
-       unsigned long nr_extents = reservation__->nr_extents;
-       int ret = 0;
-       get_xen_guest_handle(frame_list, reservation__->extent_start);
-
-       BUG_ON(op != XENMEM_increase_reservation &&
-              op != XENMEM_decrease_reservation &&
-              op != XENMEM_populate_physmap);
-
-       while (nr_extents > 0) {
-               int tmp_ret;
-               volatile unsigned long dummy;
-
-               set_xen_guest_handle(reservation.extent_start, frame_list);
-               reservation.nr_extents = nr_extents;
-
-               dummy = frame_list[0];// re-install tlb entry before hypercall
-               tmp_ret = ____HYPERVISOR_memory_op(op, &reservation);
-               if (tmp_ret < 0) {
-                       if (ret == 0) {
-                               ret = tmp_ret;
-                       }
-                       break;
-               }
-               if (tmp_ret == 0) {
-                       //XXX dirty work around for skbuff_ctor()
-                       //    of a non-privileged domain, 
-                       if ((op == XENMEM_increase_reservation ||
-                            op == XENMEM_populate_physmap) &&
-                           !is_initial_xendomain() &&
-                           reservation.extent_order > 0)
-                               return ret;
-               }
-               frame_list += tmp_ret;
-               nr_extents -= tmp_ret;
-               ret += tmp_ret;
-       }
-       return ret;
-}
-EXPORT_SYMBOL(ia64_xenmem_reservation_op);
+#ifdef CONFIG_XEN_IA64_EXPOSE_P2M
+static int p2m_expose_init(void);
+#else
+#define p2m_expose_init() (-ENOSYS)
+#endif
 
 //XXX same as i386, x86_64 contiguous_bitmap_set(), contiguous_bitmap_clear()
 // move those to lib/contiguous_bitmap?
@@ -371,8 +323,6 @@ int
 int
 HYPERVISOR_grant_table_op(unsigned int cmd, void *uop, unsigned int count)
 {
-       __u64 va1, va2, pa1, pa2;
-
        if (cmd == GNTTABOP_map_grant_ref) {
                unsigned int i;
                for (i = 0; i < count; i++) {
@@ -380,29 +330,7 @@ HYPERVISOR_grant_table_op(unsigned int c
                                (struct gnttab_map_grant_ref*)uop + i);
                }
        }
-       va1 = (__u64)uop & PAGE_MASK;
-       pa1 = pa2 = 0;
-       if ((REGION_NUMBER(va1) == 5) &&
-           ((va1 - KERNEL_START) >= KERNEL_TR_PAGE_SIZE)) {
-               pa1 = ia64_tpa(va1);
-               if (cmd <= GNTTABOP_transfer) {
-                       static uint32_t uop_size[GNTTABOP_transfer + 1] = {
-                               sizeof(struct gnttab_map_grant_ref),
-                               sizeof(struct gnttab_unmap_grant_ref),
-                               sizeof(struct gnttab_setup_table),
-                               sizeof(struct gnttab_dump_table),
-                               sizeof(struct gnttab_transfer),
-                       };
-                       va2 = (__u64)uop + (uop_size[cmd] * count) - 1;
-                       va2 &= PAGE_MASK;
-                       if (va1 != va2) {
-                               /* maximum size of uop is 2pages */
-                               BUG_ON(va2 > va1 + PAGE_SIZE);
-                               pa2 = ia64_tpa(va2);
-                       }
-               }
-       }
-       return ____HYPERVISOR_grant_table_op(cmd, uop, count, pa1, pa2);
+       return xencomm_mini_hypercall_grant_table_op(cmd, uop, count);
 }
 EXPORT_SYMBOL(HYPERVISOR_grant_table_op);
 
@@ -526,6 +454,10 @@ out:
               privcmd_resource_min, privcmd_resource_max, 
               (privcmd_resource_max - privcmd_resource_min) >> 20);
        BUG_ON(privcmd_resource_min >= privcmd_resource_max);
+
+       // XXX this should be somewhere appropriate
+       (void)p2m_expose_init();
+
        return 0;
 }
 late_initcall(xen_ia64_privcmd_init);
@@ -845,3 +777,276 @@ time_resume(void)
        /* Just trigger a tick.  */
        ia64_cpu_local_tick();
 }
+
+///////////////////////////////////////////////////////////////////////////
+// expose p2m table
+#ifdef CONFIG_XEN_IA64_EXPOSE_P2M
+#include <linux/cpu.h>
+#include <asm/uaccess.h>
+
+int p2m_initialized __read_mostly = 0;
+
+unsigned long p2m_min_low_pfn __read_mostly;
+unsigned long p2m_max_low_pfn __read_mostly;
+unsigned long p2m_convert_min_pfn __read_mostly;
+unsigned long p2m_convert_max_pfn __read_mostly;
+
+static struct resource p2m_resource = {
+       .name    = "Xen p2m table",
+       .flags   = IORESOURCE_MEM,
+};
+static unsigned long p2m_assign_start_pfn __read_mostly;
+static unsigned long p2m_assign_end_pfn __read_mostly;
+volatile const pte_t* p2m_pte __read_mostly;
+
+#define GRNULE_PFN     PTRS_PER_PTE
+static unsigned long p2m_granule_pfn __read_mostly = GRNULE_PFN;
+
+#define ROUNDDOWN(x, y)  ((x) & ~((y) - 1))
+#define ROUNDUP(x, y)    (((x) + (y) - 1) & ~((y) - 1))
+
+#define P2M_PREFIX     "Xen p2m: "
+
+static int xen_ia64_p2m_expose __read_mostly = 1;
+module_param(xen_ia64_p2m_expose, int, 0);
+MODULE_PARM_DESC(xen_ia64_p2m_expose,
+                 "enable/disable xen/ia64 p2m exposure optimization\n");
+
+#ifdef CONFIG_XEN_IA64_EXPOSE_P2M_USE_DTR
+static int xen_ia64_p2m_expose_use_dtr __read_mostly = 1;
+module_param(xen_ia64_p2m_expose_use_dtr, int, 0);
+MODULE_PARM_DESC(xen_ia64_p2m_expose_use_dtr,
+                 "use/unuse dtr to map exposed p2m table\n");
+
+static const int p2m_page_shifts[] = {
+       _PAGE_SIZE_4K,
+       _PAGE_SIZE_8K,
+       _PAGE_SIZE_16K,
+       _PAGE_SIZE_64K,
+       _PAGE_SIZE_256K,
+       _PAGE_SIZE_1M,
+       _PAGE_SIZE_4M,
+       _PAGE_SIZE_16M,
+       _PAGE_SIZE_64M,
+       _PAGE_SIZE_256M,
+};
+
+struct p2m_itr_arg {
+       unsigned long vaddr;
+       unsigned long pteval;
+       unsigned long log_page_size;
+};
+static struct p2m_itr_arg p2m_itr_arg __read_mostly;
+
+// This should be in asm-ia64/kregs.h
+#define IA64_TR_P2M_TABLE      3
+
+static void
+p2m_itr(void* info)
+{
+       struct p2m_itr_arg* arg = (struct p2m_itr_arg*)info;
+       ia64_itr(0x2, IA64_TR_P2M_TABLE,
+                arg->vaddr, arg->pteval, arg->log_page_size);
+       ia64_srlz_d();
+}
+
+static int
+p2m_expose_dtr_call(struct notifier_block *self,
+                    unsigned long event, void* ptr)
+{
+       unsigned int cpu = (unsigned int)(long)ptr;
+       if (event != CPU_ONLINE)
+               return 0;
+       if (!(p2m_initialized && xen_ia64_p2m_expose_use_dtr))
+               smp_call_function_single(cpu, &p2m_itr, &p2m_itr_arg, 1, 1);
+       return 0;
+}
+
+static struct notifier_block p2m_expose_dtr_hotplug_notifier = {
+       .notifier_call = p2m_expose_dtr_call,
+       .next          = NULL,
+       .priority      = 0
+};
+#endif
+
+static int
+p2m_expose_init(void)
+{
+       unsigned long num_pfn;
+       unsigned long size = 0;
+       unsigned long p2m_size = 0;
+       unsigned long align = ~0UL;
+       int error = 0;
+#ifdef CONFIG_XEN_IA64_EXPOSE_P2M_USE_DTR
+       int i;
+       unsigned long page_size;
+       unsigned long log_page_size = 0;
+#endif
+
+       if (!xen_ia64_p2m_expose)
+               return -ENOSYS;
+       if (p2m_initialized)
+               return 0;
+
+#ifdef CONFIG_XEN_IA64_EXPOSE_P2M_USE_DTR
+       error = register_cpu_notifier(&p2m_expose_dtr_hotplug_notifier);
+       if (error < 0)
+               return error;
+#endif
+
+       lock_cpu_hotplug();
+       if (p2m_initialized)
+               goto out;
+
+#ifdef CONFIG_DISCONTIGMEM
+       p2m_min_low_pfn = min_low_pfn;
+       p2m_max_low_pfn = max_low_pfn;
+#else
+       p2m_min_low_pfn = 0;
+       p2m_max_low_pfn = max_pfn;
+#endif
+
+#ifdef CONFIG_XEN_IA64_EXPOSE_P2M_USE_DTR
+       if (xen_ia64_p2m_expose_use_dtr) {
+               unsigned long granule_pfn = 0;
+               p2m_size = p2m_max_low_pfn - p2m_min_low_pfn;
+               for (i = 0;
+                    i < sizeof(p2m_page_shifts)/sizeof(p2m_page_shifts[0]);
+                    i++) {
+                       log_page_size = p2m_page_shifts[i];
+                       page_size = 1UL << log_page_size;
+                       if (page_size < p2m_size)
+                               continue;
+
+                       granule_pfn = max(page_size >> PAGE_SHIFT,
+                                         p2m_granule_pfn);
+                       p2m_convert_min_pfn = ROUNDDOWN(p2m_min_low_pfn,
+                                                       granule_pfn);
+                       p2m_convert_max_pfn = ROUNDUP(p2m_max_low_pfn,
+                                                     granule_pfn);
+                       num_pfn = p2m_convert_max_pfn - p2m_convert_min_pfn;
+                       size = num_pfn << PAGE_SHIFT;
+                       p2m_size = num_pfn / PTRS_PER_PTE;
+                       p2m_size = ROUNDUP(p2m_size, granule_pfn << PAGE_SHIFT);
+                       if (p2m_size == page_size)
+                               break;
+               }
+               if (p2m_size != page_size) {
+                       printk(KERN_ERR "p2m_size != page_size\n");
+                       error = -EINVAL;
+                       goto out;
+               }
+               align = max(privcmd_resource_align, granule_pfn << PAGE_SHIFT);
+       } else
+#endif
+       {
+               BUG_ON(p2m_granule_pfn & (p2m_granule_pfn - 1));
+               p2m_convert_min_pfn = ROUNDDOWN(p2m_min_low_pfn,
+                                               p2m_granule_pfn);
+               p2m_convert_max_pfn = ROUNDUP(p2m_max_low_pfn, p2m_granule_pfn);
+               num_pfn = p2m_convert_max_pfn - p2m_convert_min_pfn;
+               size = num_pfn << PAGE_SHIFT;
+               p2m_size = num_pfn / PTRS_PER_PTE;
+               p2m_size = ROUNDUP(p2m_size, p2m_granule_pfn << PAGE_SHIFT);
+               align = max(privcmd_resource_align,
+                           p2m_granule_pfn << PAGE_SHIFT);
+       }
+       
+       // use privcmd region
+       error = allocate_resource(&iomem_resource, &p2m_resource, p2m_size,
+                                 privcmd_resource_min, privcmd_resource_max,
+                                 align, NULL, NULL);
+       if (error) {
+               printk(KERN_ERR P2M_PREFIX
+                      "can't allocate region for p2m exposure "
+                      "[0x%016lx, 0x%016lx) 0x%016lx\n",
+                      p2m_convert_min_pfn, p2m_convert_max_pfn, p2m_size);
+               goto out;
+       }
+
+       p2m_assign_start_pfn = p2m_resource.start >> PAGE_SHIFT;
+       p2m_assign_end_pfn = p2m_resource.end >> PAGE_SHIFT;
+       
+       error = HYPERVISOR_expose_p2m(p2m_convert_min_pfn,
+                                     p2m_assign_start_pfn,
+                                     size, p2m_granule_pfn);
+       if (error) {
+               printk(KERN_ERR P2M_PREFIX "failed expose p2m hypercall %d\n",
+                      error);
+               printk(KERN_ERR P2M_PREFIX "conv 0x%016lx assign 0x%016lx "
+                      "size 0x%016lx granule 0x%016lx\n",
+                      p2m_convert_min_pfn, p2m_assign_start_pfn,
+                      size, p2m_granule_pfn);;
+               release_resource(&p2m_resource);
+               goto out;
+       }
+       p2m_pte = (volatile const pte_t*)pfn_to_kaddr(p2m_assign_start_pfn);
+#ifdef CONFIG_XEN_IA64_EXPOSE_P2M_USE_DTR
+       if (xen_ia64_p2m_expose_use_dtr) {
+               p2m_itr_arg.vaddr = (unsigned long)__va(p2m_assign_start_pfn
+                                                       << PAGE_SHIFT);
+               p2m_itr_arg.pteval = pte_val(pfn_pte(p2m_assign_start_pfn,
+                                                    PAGE_KERNEL));
+               p2m_itr_arg.log_page_size = log_page_size;
+               smp_mb();
+               smp_call_function(&p2m_itr, &p2m_itr_arg, 1, 1);
+               p2m_itr(&p2m_itr_arg);
+       }
+#endif 
+       smp_mb();
+       p2m_initialized = 1;
+       printk(P2M_PREFIX "assign p2m table of [0x%016lx, 0x%016lx)\n",
+              p2m_convert_min_pfn << PAGE_SHIFT,
+              p2m_convert_max_pfn << PAGE_SHIFT);
+       printk(P2M_PREFIX "to [0x%016lx, 0x%016lx) (%ld KBytes)\n",
+              p2m_assign_start_pfn << PAGE_SHIFT,
+              p2m_assign_end_pfn << PAGE_SHIFT,
+              p2m_size / 1024);
+out:
+       unlock_cpu_hotplug();
+       return error;
+}
+
+#ifdef notyet
+void
+p2m_expose_cleanup(void)
+{
+       BUG_ON(!p2m_initialized);
+#ifdef CONFIG_XEN_IA64_EXPOSE_P2M_USE_DTR
+       unregister_cpu_notifier(&p2m_expose_dtr_hotplug_notifier);
+#endif
+       release_resource(&p2m_resource);
+}
+#endif
+
+//XXX inlinize?
+unsigned long
+p2m_phystomach(unsigned long gpfn)
+{
+       volatile const pte_t* pte;
+       unsigned long mfn;
+       unsigned long pteval;
+       
+       if (!p2m_initialized ||
+           gpfn < p2m_min_low_pfn || gpfn > p2m_max_low_pfn
+           /* || !pfn_valid(gpfn) */)
+               return INVALID_MFN;
+       pte = p2m_pte + (gpfn - p2m_convert_min_pfn);
+
+       mfn = INVALID_MFN;
+       if (likely(__get_user(pteval, (unsigned long __user *)pte) == 0 &&
+                  pte_present(__pte(pteval)) &&
+                  pte_pfn(__pte(pteval)) != (INVALID_MFN >> PAGE_SHIFT)))
+               mfn = (pteval & _PFN_MASK) >> PAGE_SHIFT;
+
+       return mfn;
+}
+
+EXPORT_SYMBOL_GPL(p2m_initialized);
+EXPORT_SYMBOL_GPL(p2m_min_low_pfn);
+EXPORT_SYMBOL_GPL(p2m_max_low_pfn);
+EXPORT_SYMBOL_GPL(p2m_convert_min_pfn);
+EXPORT_SYMBOL_GPL(p2m_convert_max_pfn);
+EXPORT_SYMBOL_GPL(p2m_pte);
+EXPORT_SYMBOL_GPL(p2m_phystomach);
+#endif
diff -r b30cb72ed5e2 -r 4d4f0d52c193 linux-2.6-xen-sparse/arch/ia64/xen/util.c
--- a/linux-2.6-xen-sparse/arch/ia64/xen/util.c Fri Nov 03 16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/arch/ia64/xen/util.c Thu Nov 09 15:37:17 2006 -0500
@@ -28,6 +28,8 @@
 #include <linux/vmalloc.h>
 #include <asm/uaccess.h>
 #include <xen/driver_util.h>
+#include <xen/interface/memory.h>
+#include <asm/hypercall.h>
 
 struct vm_struct *alloc_vm_area(unsigned long size)
 {
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/arch/ia64/xen/xensetup.S
--- a/linux-2.6-xen-sparse/arch/ia64/xen/xensetup.S     Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/arch/ia64/xen/xensetup.S     Thu Nov 09 15:37:17 
2006 -0500
@@ -23,12 +23,11 @@ GLOBAL_ENTRY(early_xen_setup)
        
        mov cr.iva=r10
 
-#if XSI_BASE != 0xf100000000000000UL
-       /* Backward compatibility.  */
-(isBP) mov r2=0x600
+       /* Set xsi base.  */
+#define FW_HYPERCALL_SET_SHARED_INFO_VA                        0x600
+(isBP) mov r2=FW_HYPERCALL_SET_SHARED_INFO_VA
 (isBP) movl r28=XSI_BASE;;
 (isBP) break 0x1000;;
-#endif
 
        br.ret.sptk.many rp
        ;;
@@ -38,18 +37,18 @@ END(early_xen_setup)
 
 /* Stub for suspend.
    Just force the stacked registers to be written in memory.  */       
-GLOBAL_ENTRY(HYPERVISOR_suspend)
+GLOBAL_ENTRY(xencomm_arch_hypercall_suspend)
+       mov r15=r32
+       ;; 
        alloc r20=ar.pfs,0,0,0,0
-       mov r14=2
-       mov r15=r12
-       ;;
+       mov r2=__HYPERVISOR_sched_op
+       ;; 
        /* We don't want to deal with RSE.  */
        flushrs
-       mov r2=__HYPERVISOR_sched_op
-       st4 [r12]=r14
+       mov r14=2 // SCHEDOP_shutdown
        ;;
        break 0x1000
        ;; 
        mov ar.pfs=r20
        br.ret.sptk.many b0
-END(HYPERVISOR_suspend)
+END(xencomm_arch_hypercall_suspend)
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/arch/x86_64/mm/init-xen.c
--- a/linux-2.6-xen-sparse/arch/x86_64/mm/init-xen.c    Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/arch/x86_64/mm/init-xen.c    Thu Nov 09 15:37:17 
2006 -0500
@@ -913,8 +913,8 @@ void __init mem_init(void)
 #endif
        /* XEN: init and count pages outside initial allocation. */
        for (pfn = xen_start_info->nr_pages; pfn < max_pfn; pfn++) {
-               ClearPageReserved(&mem_map[pfn]);
-               set_page_count(&mem_map[pfn], 1);
+               ClearPageReserved(pfn_to_page(pfn));
+               set_page_count(pfn_to_page(pfn), 1);
                totalram_pages++;
        }
        reservedpages = end_pfn - totalram_pages - e820_hole_size(0, end_pfn);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/char/tpm/tpm_xen.c
--- a/linux-2.6-xen-sparse/drivers/char/tpm/tpm_xen.c   Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/char/tpm/tpm_xen.c   Thu Nov 09 15:37:17 
2006 -0500
@@ -41,6 +41,7 @@
 #include <xen/evtchn.h>
 #include <xen/interface/grant_table.h>
 #include <xen/interface/io/tpmif.h>
+#include <xen/gnttab.h>
 #include <xen/xenbus.h>
 #include "tpm.h"
 #include "tpm_vtpm.h"
@@ -343,6 +344,7 @@ static void backend_changed(struct xenbu
        case XenbusStateInitialising:
        case XenbusStateInitWait:
        case XenbusStateInitialised:
+       case XenbusStateUnknown:
                break;
 
        case XenbusStateConnected:
@@ -351,13 +353,14 @@ static void backend_changed(struct xenbu
 
        case XenbusStateClosing:
                tpmif_set_connected_state(tp, 0);
+               xenbus_frontend_closed(dev);
                break;
 
-       case XenbusStateUnknown:
        case XenbusStateClosed:
+               tpmif_set_connected_state(tp, 0);
                if (tp->is_suspended == 0)
                        device_unregister(&dev->dev);
-               xenbus_switch_state(dev, XenbusStateClosed);
+               xenbus_frontend_closed(dev);
                break;
        }
 }
@@ -419,9 +422,10 @@ static int tpmfront_suspend(struct xenbu
        mutex_lock(&suspend_lock);
        tp->is_suspended = 1;
 
-       for (ctr = 0; atomic_read(&tp->tx_busy) && ctr <= 25; ctr++) {
+       for (ctr = 0; atomic_read(&tp->tx_busy) && ctr <= 300; ctr++) {
                if ((ctr % 10) == 0)
-                       printk("TPM-FE [INFO]: Waiting for outstanding 
request.\n");
+                       printk("TPM-FE [INFO]: Waiting for outstanding "
+                              "request.\n");
                /*
                 * Wait for a request to be responded to.
                 */
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/balloon/Makefile
--- a/linux-2.6-xen-sparse/drivers/xen/balloon/Makefile Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/balloon/Makefile Thu Nov 09 15:37:17 
2006 -0500
@@ -1,2 +1,2 @@
 
-obj-y += balloon.o
+obj-y := balloon.o sysfs.o
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/balloon/balloon.c
--- a/linux-2.6-xen-sparse/drivers/xen/balloon/balloon.c        Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/balloon/balloon.c        Thu Nov 09 
15:37:17 2006 -0500
@@ -53,10 +53,8 @@
 #include <asm/uaccess.h>
 #include <asm/tlb.h>
 #include <linux/list.h>
-
 #include <xen/xenbus.h>
-
-#define PAGES2KB(_p) ((_p)<<(PAGE_SHIFT-10))
+#include "common.h"
 
 #ifdef CONFIG_PROC_FS
 static struct proc_dir_entry *balloon_pde;
@@ -71,9 +69,7 @@ static DECLARE_MUTEX(balloon_mutex);
  */
 DEFINE_SPINLOCK(balloon_lock);
 
-/* We aim for 'current allocation' == 'target allocation'. */
-static unsigned long current_pages;
-static unsigned long target_pages;
+struct balloon_stats balloon_stats;
 
 /* We increase/decrease in batches which fit in a page */
 static unsigned long frame_list[PAGE_SIZE / sizeof(unsigned long)];
@@ -81,18 +77,8 @@ static unsigned long frame_list[PAGE_SIZ
 /* VM /proc information for memory */
 extern unsigned long totalram_pages;
 
-/* We may hit the hard limit in Xen. If we do then we remember it. */
-static unsigned long hard_limit;
-
-/*
- * Drivers may alter the memory reservation independently, but they must
- * inform the balloon driver so that we can avoid hitting the hard limit.
- */
-static unsigned long driver_pages;
-
 /* List of ballooned pages, threaded through the mem_map array. */
 static LIST_HEAD(ballooned_pages);
-static unsigned long balloon_low, balloon_high;
 
 /* Main work function, always executed in process context. */
 static void balloon_process(void *unused);
@@ -124,10 +110,10 @@ static void balloon_append(struct page *
        /* Lowmem is re-populated first, so highmem pages go at list tail. */
        if (PageHighMem(page)) {
                list_add_tail(PAGE_TO_LIST(page), &ballooned_pages);
-               balloon_high++;
+               bs.balloon_high++;
        } else {
                list_add(PAGE_TO_LIST(page), &ballooned_pages);
-               balloon_low++;
+               bs.balloon_low++;
        }
 }
 
@@ -143,9 +129,9 @@ static struct page *balloon_retrieve(voi
        UNLIST_PAGE(page);
 
        if (PageHighMem(page))
-               balloon_high--;
+               bs.balloon_high--;
        else
-               balloon_low--;
+               bs.balloon_low--;
 
        return page;
 }
@@ -172,9 +158,9 @@ static void balloon_alarm(unsigned long 
 
 static unsigned long current_target(void)
 {
-       unsigned long target = min(target_pages, hard_limit);
-       if (target > (current_pages + balloon_low + balloon_high))
-               target = current_pages + balloon_low + balloon_high;
+       unsigned long target = min(bs.target_pages, bs.hard_limit);
+       if (target > (bs.current_pages + bs.balloon_low + bs.balloon_high))
+               target = bs.current_pages + bs.balloon_low + bs.balloon_high;
        return target;
 }
 
@@ -216,7 +202,8 @@ static int increase_reservation(unsigned
                        BUG_ON(ret != rc);
                }
                if (rc >= 0)
-                       hard_limit = current_pages + rc - driver_pages;
+                       bs.hard_limit = (bs.current_pages + rc -
+                                        bs.driver_pages);
                goto out;
        }
 
@@ -248,8 +235,8 @@ static int increase_reservation(unsigned
                __free_page(page);
        }
 
-       current_pages += nr_pages;
-       totalram_pages = current_pages;
+       bs.current_pages += nr_pages;
+       totalram_pages = bs.current_pages;
 
  out:
        balloon_unlock(flags);
@@ -317,8 +304,8 @@ static int decrease_reservation(unsigned
        ret = HYPERVISOR_memory_op(XENMEM_decrease_reservation, &reservation);
        BUG_ON(ret != nr_pages);
 
-       current_pages -= nr_pages;
-       totalram_pages = current_pages;
+       bs.current_pages -= nr_pages;
+       totalram_pages = bs.current_pages;
 
        balloon_unlock(flags);
 
@@ -339,7 +326,7 @@ static void balloon_process(void *unused
        down(&balloon_mutex);
 
        do {
-               credit = current_target() - current_pages;
+               credit = current_target() - bs.current_pages;
                if (credit > 0)
                        need_sleep = (increase_reservation(credit) != 0);
                if (credit < 0)
@@ -352,18 +339,18 @@ static void balloon_process(void *unused
        } while ((credit != 0) && !need_sleep);
 
        /* Schedule more work if there is some still to be done. */
-       if (current_target() != current_pages)
+       if (current_target() != bs.current_pages)
                mod_timer(&balloon_timer, jiffies + HZ);
 
        up(&balloon_mutex);
 }
 
 /* Resets the Xen limit, sets new target, and kicks off processing. */
-static void set_new_target(unsigned long target)
+void balloon_set_new_target(unsigned long target)
 {
        /* No need for lock. Not read-modify-write updates. */
-       hard_limit   = ~0UL;
-       target_pages = target;
+       bs.hard_limit   = ~0UL;
+       bs.target_pages = target;
        schedule_work(&balloon_worker);
 }
 
@@ -388,7 +375,7 @@ static void watch_target(struct xenbus_w
        /* The given memory/target value is in KiB, so it needs converting to
         * pages. PAGE_SHIFT converts bytes to pages, hence PAGE_SHIFT - 10.
         */
-       set_new_target(new_target >> (PAGE_SHIFT - 10));
+       balloon_set_new_target(new_target >> (PAGE_SHIFT - 10));
 }
 
 static int balloon_init_watcher(struct notifier_block *notifier,
@@ -424,7 +411,7 @@ static int balloon_write(struct file *fi
        memstring[sizeof(memstring)-1] = '\0';
 
        target_bytes = memparse(memstring, &endchar);
-       set_new_target(target_bytes >> PAGE_SHIFT);
+       balloon_set_new_target(target_bytes >> PAGE_SHIFT);
 
        return count;
 }
@@ -442,12 +429,13 @@ static int balloon_read(char *page, char
                "High-mem balloon:   %8lu kB\n"
                "Driver pages:       %8lu kB\n"
                "Xen hard limit:     ",
-               PAGES2KB(current_pages), PAGES2KB(target_pages), 
-               PAGES2KB(balloon_low), PAGES2KB(balloon_high),
-               PAGES2KB(driver_pages));
-
-       if (hard_limit != ~0UL)
-               len += sprintf(page + len, "%8lu kB\n", PAGES2KB(hard_limit));
+               PAGES2KB(bs.current_pages), PAGES2KB(bs.target_pages), 
+               PAGES2KB(bs.balloon_low), PAGES2KB(bs.balloon_high),
+               PAGES2KB(bs.driver_pages));
+
+       if (bs.hard_limit != ~0UL)
+               len += sprintf(page + len, "%8lu kB\n",
+                              PAGES2KB(bs.hard_limit));
        else
                len += sprintf(page + len, "     ??? kB\n");
 
@@ -468,13 +456,13 @@ static int __init balloon_init(void)
 
        IPRINTK("Initialising balloon driver.\n");
 
-       current_pages = min(xen_start_info->nr_pages, max_pfn);
-       totalram_pages = current_pages;
-       target_pages  = current_pages;
-       balloon_low   = 0;
-       balloon_high  = 0;
-       driver_pages  = 0UL;
-       hard_limit    = ~0UL;
+       bs.current_pages = min(xen_start_info->nr_pages, max_pfn);
+       totalram_pages   = bs.current_pages;
+       bs.target_pages  = bs.current_pages;
+       bs.balloon_low   = 0;
+       bs.balloon_high  = 0;
+       bs.driver_pages  = 0UL;
+       bs.hard_limit    = ~0UL;
 
        init_timer(&balloon_timer);
        balloon_timer.data = 0;
@@ -489,6 +477,7 @@ static int __init balloon_init(void)
        balloon_pde->read_proc  = balloon_read;
        balloon_pde->write_proc = balloon_write;
 #endif
+       balloon_sysfs_init();
     
        /* Initialise the balloon with excess memory space. */
        for (pfn = xen_start_info->nr_pages; pfn < max_pfn; pfn++) {
@@ -512,7 +501,7 @@ void balloon_update_driver_allowance(lon
        unsigned long flags;
 
        balloon_lock(flags);
-       driver_pages += delta;
+       bs.driver_pages += delta;
        balloon_unlock(flags);
 }
 
@@ -578,7 +567,7 @@ struct page **alloc_empty_pages_and_page
                        goto err;
                }
 
-               totalram_pages = --current_pages;
+               totalram_pages = --bs.current_pages;
 
                balloon_unlock(flags);
        }
@@ -624,7 +613,7 @@ void balloon_release_driver_page(struct 
 
        balloon_lock(flags);
        balloon_append(page);
-       driver_pages--;
+       bs.driver_pages--;
        balloon_unlock(flags);
 
        schedule_work(&balloon_worker);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c
--- a/linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c        Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c        Thu Nov 09 
15:37:17 2006 -0500
@@ -293,7 +293,7 @@ static int do_block_io_op(blkif_t *blkif
 static int do_block_io_op(blkif_t *blkif)
 {
        blkif_back_ring_t *blk_ring = &blkif->blk_ring;
-       blkif_request_t *req;
+       blkif_request_t req;
        pending_req_t *pending_req;
        RING_IDX rc, rp;
        int more_to_do = 0;
@@ -311,22 +311,22 @@ static int do_block_io_op(blkif_t *blkif
                        break;
                }
 
-               req = RING_GET_REQUEST(blk_ring, rc);
+               memcpy(&req, RING_GET_REQUEST(blk_ring, rc), sizeof(req));
                blk_ring->req_cons = ++rc; /* before make_response() */
 
-               switch (req->operation) {
+               switch (req.operation) {
                case BLKIF_OP_READ:
                        blkif->st_rd_req++;
-                       dispatch_rw_block_io(blkif, req, pending_req);
+                       dispatch_rw_block_io(blkif, &req, pending_req);
                        break;
                case BLKIF_OP_WRITE:
                        blkif->st_wr_req++;
-                       dispatch_rw_block_io(blkif, req, pending_req);
+                       dispatch_rw_block_io(blkif, &req, pending_req);
                        break;
                default:
                        DPRINTK("error: unknown block io operation [%d]\n",
-                               req->operation);
-                       make_response(blkif, req->id, req->operation,
+                               req.operation);
+                       make_response(blkif, req.id, req.operation,
                                      BLKIF_RSP_ERROR);
                        free_req(pending_req);
                        break;
@@ -375,7 +375,7 @@ static void dispatch_rw_block_io(blkif_t
                        req->seg[i].first_sect + 1;
 
                if ((req->seg[i].last_sect >= (PAGE_SIZE >> 9)) ||
-                   (seg[i].nsec <= 0))
+                   (req->seg[i].last_sect < req->seg[i].first_sect))
                        goto fail_response;
                preq.nr_sects += seg[i].nsec;
 
@@ -392,16 +392,24 @@ static void dispatch_rw_block_io(blkif_t
        for (i = 0; i < nseg; i++) {
                if (unlikely(map[i].status != 0)) {
                        DPRINTK("invalid buffer -- could not remap it\n");
-                       goto fail_flush;
+                       map[i].handle = BLKBACK_INVALID_HANDLE;
+                       ret |= 1;
                }
 
                pending_handle(pending_req, i) = map[i].handle;
+
+               if (ret)
+                       continue;
+
                set_phys_to_machine(__pa(vaddr(
                        pending_req, i)) >> PAGE_SHIFT,
                        FOREIGN_FRAME(map[i].dev_bus_addr >> PAGE_SHIFT));
                seg[i].buf  = map[i].dev_bus_addr | 
                        (req->seg[i].first_sect << 9);
        }
+
+       if (ret)
+               goto fail_flush;
 
        if (vbd_translate(&preq, blkif, operation) != 0) {
                DPRINTK("access denied: %s of [%llu,%llu] on dev=%04x\n", 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/blkfront/blkfront.c
--- a/linux-2.6-xen-sparse/drivers/xen/blkfront/blkfront.c      Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/blkfront/blkfront.c      Thu Nov 09 
15:37:17 2006 -0500
@@ -48,6 +48,10 @@
 #include <asm/hypervisor.h>
 #include <asm/maddr.h>
 
+#ifdef HAVE_XEN_PLATFORM_COMPAT_H
+#include <xen/platform-compat.h>
+#endif
+
 #define BLKIF_STATE_DISCONNECTED 0
 #define BLKIF_STATE_CONNECTED    1
 #define BLKIF_STATE_SUSPENDED    2
@@ -468,6 +472,27 @@ int blkif_ioctl(struct inode *inode, str
                      command, (long)argument, inode->i_rdev);
 
        switch (command) {
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,16)
+       case HDIO_GETGEO: {
+               struct block_device *bd = inode->i_bdev;
+               struct hd_geometry geo;
+               int ret;
+
+                if (!argument)
+                        return -EINVAL;
+
+               geo.start = get_start_sect(bd);
+               ret = blkif_getgeo(bd, &geo);
+               if (ret)
+                       return ret;
+
+               if (copy_to_user((struct hd_geometry __user *)argument, &geo,
+                                sizeof(geo)))
+                        return -EFAULT;
+
+                return 0;
+       }
+#endif
        case CDROMMULTISESSION:
                DPRINTK("FIXME: support multisession CDs later\n");
                for (i = 0; i < sizeof(struct cdrom_multisession); i++)
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/blkfront/vbd.c
--- a/linux-2.6-xen-sparse/drivers/xen/blkfront/vbd.c   Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/blkfront/vbd.c   Thu Nov 09 15:37:17 
2006 -0500
@@ -36,6 +36,10 @@
 #include <linux/blkdev.h>
 #include <linux/list.h>
 
+#ifdef HAVE_XEN_PLATFORM_COMPAT_H
+#include <xen/platform-compat.h>
+#endif
+
 #define BLKIF_MAJOR(dev) ((dev)>>8)
 #define BLKIF_MINOR(dev) ((dev) & 0xff)
 
@@ -91,7 +95,9 @@ static struct block_device_operations xl
        .open = blkif_open,
        .release = blkif_release,
        .ioctl  = blkif_ioctl,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,16)
        .getgeo = blkif_getgeo
+#endif
 };
 
 DEFINE_SPINLOCK(blkif_io_lock);
@@ -186,7 +192,11 @@ xlvbd_init_blk_queue(struct gendisk *gd,
        if (rq == NULL)
                return -1;
 
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,10)
        elevator_init(rq, "noop");
+#else
+       elevator_init(rq, &elevator_noop);
+#endif
 
        /* Hard sector size and max sectors impersonate the equiv. hardware. */
        blk_queue_hardsect_size(rq, sector_size);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/blktap/blktap.c
--- a/linux-2.6-xen-sparse/drivers/xen/blktap/blktap.c  Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/blktap/blktap.c  Thu Nov 09 15:37:17 
2006 -0500
@@ -9,6 +9,9 @@
  * Based on the blkback driver code.
  * 
  * Copyright (c) 2004-2005, Andrew Warfield and Julian Chesterfield
+ *
+ * Clean ups and fix ups:
+ *    Copyright (c) 2006, Steven Rostedt - Red Hat, Inc.
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License version 2
@@ -51,7 +54,7 @@
 #include <asm/tlbflush.h>
 #include <linux/devfs_fs_kernel.h>
 
-#define MAX_TAP_DEV 100     /*the maximum number of tapdisk ring devices    */
+#define MAX_TAP_DEV 256     /*the maximum number of tapdisk ring devices    */
 #define MAX_DEV_NAME 100    /*the max tapdisk ring device name e.g. blktap0 */
 
 
@@ -90,8 +93,9 @@ int setup_xen_class(void)
  * mmap_alloc is initialised to 2 and should be adjustable on the fly via
  * sysfs.
  */
-#define MAX_DYNAMIC_MEM 64
-#define MAX_PENDING_REQS 64   
+#define BLK_RING_SIZE          __RING_SIZE((blkif_sring_t *)0, PAGE_SIZE)
+#define MAX_DYNAMIC_MEM                BLK_RING_SIZE
+#define MAX_PENDING_REQS       BLK_RING_SIZE
 #define MMAP_PAGES (MAX_PENDING_REQS * BLKIF_MAX_SEGMENTS_PER_REQUEST)
 #define MMAP_VADDR(_start, _req,_seg)                                   \
         (_start +                                                       \
@@ -104,6 +108,12 @@ static int mmap_pages = MMAP_PAGES;
                      * have a bunch of pages reserved for shared
                      * memory rings.
                      */
+
+/*Data struct handed back to userspace for tapdisk device to VBD mapping*/
+typedef struct domid_translate {
+       unsigned short domid;
+       unsigned short busid;
+} domid_translate_t ;
 
 /*Data struct associated with each of the tapdisk devices*/
 typedef struct tap_blkif {
@@ -123,17 +133,11 @@ typedef struct tap_blkif {
        unsigned long *idx_map;       /*Record the user ring id to kern 
                                        [req id, idx] tuple                  */
        blkif_t *blkif;               /*Associate blkif with tapdev          */
-       int sysfs_set;                /*Set if it has a class device.        */
+       struct domid_translate trans; /*Translation from domid to bus.       */
 } tap_blkif_t;
 
-/*Data struct handed back to userspace for tapdisk device to VBD mapping*/
-typedef struct domid_translate {
-       unsigned short domid;
-       unsigned short busid;
-} domid_translate_t ;
-
-static domid_translate_t  translate_domid[MAX_TAP_DEV];
-static tap_blkif_t *tapfds[MAX_TAP_DEV];
+static struct tap_blkif *tapfds[MAX_TAP_DEV];
+static int blktap_next_minor;
 
 static int __init set_blkif_reqs(char *str)
 {
@@ -212,6 +216,7 @@ struct grant_handle_pair
         grant_handle_t kernel;
         grant_handle_t user;
 };
+#define INVALID_GRANT_HANDLE   0xFFFF
 
 static struct grant_handle_pair 
     pending_grant_handles[MAX_DYNAMIC_MEM][MMAP_PAGES];
@@ -290,10 +295,11 @@ static inline int GET_NEXT_REQ(unsigned 
 
 
 #define BLKTAP_INVALID_HANDLE(_g) \
-    (((_g->kernel) == 0xFFFF) && ((_g->user) == 0xFFFF))
+    (((_g->kernel) == INVALID_GRANT_HANDLE) &&  \
+     ((_g->user) == INVALID_GRANT_HANDLE))
 
 #define BLKTAP_INVALIDATE_HANDLE(_g) do {       \
-    (_g)->kernel = 0xFFFF; (_g)->user = 0xFFFF; \
+    (_g)->kernel = INVALID_GRANT_HANDLE; (_g)->user = INVALID_GRANT_HANDLE; \
     } while(0)
 
 
@@ -322,7 +328,7 @@ struct vm_operations_struct blktap_vm_op
  */
  
 /*Function Declarations*/
-static int get_next_free_dev(void);
+static tap_blkif_t *get_next_free_dev(void);
 static int blktap_open(struct inode *inode, struct file *filp);
 static int blktap_release(struct inode *inode, struct file *filp);
 static int blktap_mmap(struct file *filp, struct vm_area_struct *vma);
@@ -340,51 +346,96 @@ static struct file_operations blktap_fop
 };
 
 
-static int get_next_free_dev(void)
+static tap_blkif_t *get_next_free_dev(void)
 {
        tap_blkif_t *info;
-       int i = 0, ret = -1;
-       unsigned long flags;
-
-       spin_lock_irqsave(&pending_free_lock, flags);
-       
-       while (i < MAX_TAP_DEV) {
+       int minor;
+
+       /*
+        * This is called only from the ioctl, which
+        * means we should always have interrupts enabled.
+        */
+       BUG_ON(irqs_disabled());
+
+       spin_lock_irq(&pending_free_lock);
+
+       /* tapfds[0] is always NULL */
+
+       for (minor = 1; minor < blktap_next_minor; minor++) {
+               info = tapfds[minor];
+               /* we could have failed a previous attempt. */
+               if (!info ||
+                   ((info->dev_inuse == 0) &&
+                    (info->dev_pending == 0)) ) {
+                       info->dev_pending = 1;
+                       goto found;
+               }
+       }
+       info = NULL;
+       minor = -1;
+
+       /*
+        * We didn't find free device. If we can still allocate
+        * more, then we grab the next device minor that is
+        * available.  This is done while we are still under
+        * the protection of the pending_free_lock.
+        */
+       if (blktap_next_minor < MAX_TAP_DEV)
+               minor = blktap_next_minor++;
+found:
+       spin_unlock_irq(&pending_free_lock);
+
+       if (!info && minor > 0) {
+               info = kzalloc(sizeof(*info), GFP_KERNEL);
+               if (unlikely(!info)) {
+                       /*
+                        * If we failed here, try to put back
+                        * the next minor number. But if one
+                        * was just taken, then we just lose this
+                        * minor.  We can try to allocate this
+                        * minor again later.
+                        */
+                       spin_lock_irq(&pending_free_lock);
+                       if (blktap_next_minor == minor+1)
+                               blktap_next_minor--;
+                       spin_unlock_irq(&pending_free_lock);
+                       goto out;
+               }
+
+               info->minor = minor;
+               /*
+                * Make sure that we have a minor before others can
+                * see us.
+                */
+               wmb();
+               tapfds[minor] = info;
+
+               class_device_create(xen_class, NULL,
+                                   MKDEV(blktap_major, minor), NULL,
+                                   "blktap%d", minor);
+               devfs_mk_cdev(MKDEV(blktap_major, minor),
+                       S_IFCHR|S_IRUGO|S_IWUSR, "xen/blktap%d", minor);
+       }
+
+out:
+       return info;
+}
+
+int dom_to_devid(domid_t domid, int xenbus_id, blkif_t *blkif) 
+{
+       tap_blkif_t *info;
+       int i;
+
+       for (i = 1; i < blktap_next_minor; i++) {
                info = tapfds[i];
-               if ( (tapfds[i] != NULL) && (info->dev_inuse == 0)
-                       && (info->dev_pending == 0) ) {
-                       info->dev_pending = 1;
-                       ret = i;
-                       goto done;
-               }
-               i++;
-       }
-       
-done:
-       spin_unlock_irqrestore(&pending_free_lock, flags);
-
-       /*
-        * We are protected by having the dev_pending set.
-        */
-       if (!tapfds[i]->sysfs_set && xen_class) {
-               class_device_create(xen_class, NULL,
-                                   MKDEV(blktap_major, ret), NULL,
-                                   "blktap%d", ret);
-               tapfds[i]->sysfs_set = 1;
-       }
-       return ret;
-}
-
-int dom_to_devid(domid_t domid, int xenbus_id, blkif_t *blkif) 
-{
-       int i;
-               
-       for (i = 0; i < MAX_TAP_DEV; i++)
-               if ( (translate_domid[i].domid == domid)
-                   && (translate_domid[i].busid == xenbus_id) ) {
-                       tapfds[i]->blkif = blkif;
-                       tapfds[i]->status = RUNNING;
+               if ( info &&
+                    (info->trans.domid == domid) &&
+                    (info->trans.busid == xenbus_id) ) {
+                       info->blkif = blkif;
+                       info->status = RUNNING;
                        return i;
                }
+       }
        return -1;
 }
 
@@ -394,12 +445,16 @@ void signal_tapdisk(int idx)
        struct task_struct *ptask;
 
        info = tapfds[idx];
-       if ( (idx > 0) && (idx < MAX_TAP_DEV) && (info->pid > 0) ) {
+       if ((idx < 0) || (idx > MAX_TAP_DEV) || !info)
+               return;
+
+       if (info->pid > 0) {
                ptask = find_task_by_pid(info->pid);
                if (ptask)
                        info->status = CLEANSHUTDOWN;
        }
        info->blkif = NULL;
+
        return;
 }
 
@@ -410,14 +465,19 @@ static int blktap_open(struct inode *ino
        tap_blkif_t *info;
        int i;
        
-       if (tapfds[idx] == NULL) {
+       /* ctrl device, treat differently */
+       if (!idx)
+               return 0;
+
+       info = tapfds[idx];
+
+       if ((idx < 0) || (idx > MAX_TAP_DEV) || !info) {
                WPRINTK("Unable to open device /dev/xen/blktap%d\n",
-                      idx);
-               return -ENOMEM;
-       }
+                       idx);
+               return -ENODEV;
+       }
+
        DPRINTK("Opening device /dev/xen/blktap%d\n",idx);
-       
-       info = tapfds[idx];
        
        /*Only one process can access device at a time*/
        if (test_and_set_bit(0, &info->dev_inuse))
@@ -458,12 +518,10 @@ static int blktap_release(struct inode *
 {
        tap_blkif_t *info = filp->private_data;
        
-       /* can this ever happen? - sdr */
-       if (!info) {
-               WPRINTK("Trying to free device that doesn't exist "
-                      "[/dev/xen/blktap%d]\n",iminor(inode) - BLKTAP_MINOR);
-               return -EBADF;
-       }
+       /* check for control device */
+       if (!info)
+               return 0;
+
        info->dev_inuse = 0;
        DPRINTK("Freeing device [/dev/xen/blktap%d]\n",info->minor);
 
@@ -480,8 +538,10 @@ static int blktap_release(struct inode *
        }
        
        if ( (info->status != CLEANSHUTDOWN) && (info->blkif != NULL) ) {
-               kthread_stop(info->blkif->xenblkd);
-               info->blkif->xenblkd = NULL;
+               if (info->blkif->xenblkd != NULL) {
+                       kthread_stop(info->blkif->xenblkd);
+                       info->blkif->xenblkd = NULL;
+               }
                info->status = CLEANSHUTDOWN;
        }       
        return 0;
@@ -533,8 +593,6 @@ static int blktap_mmap(struct file *filp
        info->user_vstart  = info->rings_vstart + (RING_PAGES << PAGE_SHIFT);
     
        /* Map the ring pages to the start of the region and reserve it. */
-       vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
-
        if (remap_pfn_range(vma, vma->vm_start, 
                            __pa(info->ufe_ring.sring) >> PAGE_SHIFT, 
                            PAGE_SIZE, vma->vm_page_prot)) {
@@ -619,33 +677,31 @@ static int blktap_ioctl(struct inode *in
        {               
                uint64_t val = (uint64_t)arg;
                domid_translate_t *tr = (domid_translate_t *)&val;
-               int newdev;
 
                DPRINTK("NEWINTF Req for domid %d and bus id %d\n", 
                       tr->domid, tr->busid);
-               newdev = get_next_free_dev();
-               if (newdev < 1) {
+               info = get_next_free_dev();
+               if (!info) {
                        WPRINTK("Error initialising /dev/xen/blktap - "
                                "No more devices\n");
                        return -1;
                }
-               translate_domid[newdev].domid = tr->domid;
-               translate_domid[newdev].busid = tr->busid;
-               return newdev;
+               info->trans.domid = tr->domid;
+               info->trans.busid = tr->busid;
+               return info->minor;
        }
        case BLKTAP_IOCTL_FREEINTF:
        {
                unsigned long dev = arg;
                unsigned long flags;
 
-               /* Looking at another device */
-               info = NULL;
-
-               if ( (dev > 0) && (dev < MAX_TAP_DEV) )
-                       info = tapfds[dev];
+               info = tapfds[dev];
+
+               if ((dev > MAX_TAP_DEV) || !info)
+                       return 0; /* should this be an error? */
 
                spin_lock_irqsave(&pending_free_lock, flags);
-               if ( (info != NULL) && (info->dev_pending) )
+               if (info->dev_pending)
                        info->dev_pending = 0;
                spin_unlock_irqrestore(&pending_free_lock, flags);
 
@@ -655,16 +711,12 @@ static int blktap_ioctl(struct inode *in
        {
                unsigned long dev = arg;
 
-               /* Looking at another device */
-               info = NULL;
-               
-               if ( (dev > 0) && (dev < MAX_TAP_DEV) )
-                       info = tapfds[dev];
-               
-               if (info != NULL)
-                       return info->minor;
-               else
-                       return -1;
+               info = tapfds[dev];
+
+               if ((dev > MAX_TAP_DEV) || !info)
+                       return -EINVAL;
+
+               return info->minor;
        }
        case BLKTAP_IOCTL_MAJOR:
                return blktap_major;
@@ -683,13 +735,8 @@ static unsigned int blktap_poll(struct f
 {
        tap_blkif_t *info = filp->private_data;
        
-       if (!info) {
-               WPRINTK(" poll, retrieving idx failed\n");
-               return 0;
-       }
-
        /* do not work on the control device */
-       if (!info->minor)
+       if (!info)
                return 0;
 
        poll_wait(filp, &info->wait, wait);
@@ -704,13 +751,12 @@ void blktap_kick_user(int idx)
 {
        tap_blkif_t *info;
 
-       if (idx == 0)
+       info = tapfds[idx];
+
+       if ((idx < 0) || (idx > MAX_TAP_DEV) || !info)
                return;
-       
-       info = tapfds[idx];
-       
-       if (info != NULL)
-               wake_up_interruptible(&info->wait);
+
+       wake_up_interruptible(&info->wait);
 
        return;
 }
@@ -822,8 +868,8 @@ static void free_req(pending_req_t *req)
                wake_up(&pending_free_wq);
 }
 
-static void fast_flush_area(pending_req_t *req, int k_idx, int u_idx, int 
-                           tapidx)
+static void fast_flush_area(pending_req_t *req, int k_idx, int u_idx,
+                           int tapidx)
 {
        struct gnttab_unmap_grant_ref unmap[BLKIF_MAX_SEGMENTS_PER_REQUEST*2];
        unsigned int i, invcount = 0;
@@ -831,13 +877,25 @@ static void fast_flush_area(pending_req_
        uint64_t ptep;
        int ret, mmap_idx;
        unsigned long kvaddr, uvaddr;
-
-       tap_blkif_t *info = tapfds[tapidx];
+       tap_blkif_t *info;
        
-       if (info == NULL) {
+
+       info = tapfds[tapidx];
+
+       if ((tapidx < 0) || (tapidx > MAX_TAP_DEV) || !info) {
                WPRINTK("fast_flush: Couldn't get info!\n");
                return;
        }
+
+       if (info->vma != NULL &&
+           xen_feature(XENFEAT_auto_translated_physmap)) {
+               down_write(&info->vma->vm_mm->mmap_sem);
+               zap_page_range(info->vma, 
+                              MMAP_VADDR(info->user_vstart, u_idx, 0), 
+                              req->nr_pages << PAGE_SHIFT, NULL);
+               up_write(&info->vma->vm_mm->mmap_sem);
+       }
+
        mmap_idx = req->mem_idx;
 
        for (i = 0; i < req->nr_pages; i++) {
@@ -845,35 +903,39 @@ static void fast_flush_area(pending_req_
                uvaddr = MMAP_VADDR(info->user_vstart, u_idx, i);
 
                khandle = &pending_handle(mmap_idx, k_idx, i);
-               if (BLKTAP_INVALID_HANDLE(khandle)) {
-                       WPRINTK("BLKTAP_INVALID_HANDLE\n");
-                       continue;
-               }
-               gnttab_set_unmap_op(&unmap[invcount], 
-                                   idx_to_kaddr(mmap_idx, k_idx, i), 
-                                   GNTMAP_host_map, khandle->kernel);
-               invcount++;
-
-               if (create_lookup_pte_addr(
-                   info->vma->vm_mm,
-                   MMAP_VADDR(info->user_vstart, u_idx, i), 
-                   &ptep) !=0) {
-                       WPRINTK("Couldn't get a pte addr!\n");
-                       return;
-               }
-
-               gnttab_set_unmap_op(&unmap[invcount], 
-                       ptep, GNTMAP_host_map,
-                       khandle->user);
-               invcount++;
-            
+
+               if (khandle->kernel != INVALID_GRANT_HANDLE) {
+                       gnttab_set_unmap_op(&unmap[invcount],
+                                           idx_to_kaddr(mmap_idx, k_idx, i),
+                                           GNTMAP_host_map, khandle->kernel);
+                       invcount++;
+               }
+
+               if (khandle->user != INVALID_GRANT_HANDLE) {
+                       BUG_ON(xen_feature(XENFEAT_auto_translated_physmap));
+                       if (create_lookup_pte_addr(
+                               info->vma->vm_mm,
+                               MMAP_VADDR(info->user_vstart, u_idx, i),
+                               &ptep) !=0) {
+                               WPRINTK("Couldn't get a pte addr!\n");
+                               return;
+                       }
+
+                       gnttab_set_unmap_op(&unmap[invcount], ptep,
+                                           GNTMAP_host_map
+                                           | GNTMAP_application_map
+                                           | GNTMAP_contains_pte,
+                                           khandle->user);
+                       invcount++;
+               }
+
                BLKTAP_INVALIDATE_HANDLE(khandle);
        }
        ret = HYPERVISOR_grant_table_op(
                GNTTABOP_unmap_grant_ref, unmap, invcount);
        BUG_ON(ret);
        
-       if (info->vma != NULL)
+       if (info->vma != NULL && !xen_feature(XENFEAT_auto_translated_physmap))
                zap_page_range(info->vma, 
                               MMAP_VADDR(info->user_vstart, u_idx, 0), 
                               req->nr_pages << PAGE_SHIFT, NULL);
@@ -957,11 +1019,14 @@ static int blktap_read_ufe_ring(tap_blki
        rmb();
         
        for (i = info->ufe_ring.rsp_cons; i != rp; i++) {
+               blkif_response_t res;
                resp = RING_GET_RESPONSE(&info->ufe_ring, i);
+               memcpy(&res, resp, sizeof(res));
+               mb(); /* rsp_cons read by RING_FULL() in do_block_io_op(). */
                ++info->ufe_ring.rsp_cons;
 
                /*retrieve [usr_idx] to [mmap_idx,pending_idx] mapping*/
-               usr_idx = (int)resp->id;
+               usr_idx = (int)res.id;
                pending_idx = MASK_PEND_IDX(ID_TO_IDX(info->idx_map[usr_idx]));
                mmap_idx = ID_TO_MIDX(info->idx_map[usr_idx]);
 
@@ -994,8 +1059,8 @@ static int blktap_read_ufe_ring(tap_blki
                        map[offset] = NULL;
                }
                fast_flush_area(pending_req, pending_idx, usr_idx, info->minor);
-               make_response(blkif, pending_req->id, resp->operation,
-                             resp->status);
+               make_response(blkif, pending_req->id, res.operation,
+                             res.status);
                info->idx_map[usr_idx] = INVALID_REQ;
                blkif_put(pending_req->blkif);
                free_req(pending_req);
@@ -1030,7 +1095,7 @@ static int do_block_io_op(blkif_t *blkif
 static int do_block_io_op(blkif_t *blkif)
 {
        blkif_back_ring_t *blk_ring = &blkif->blk_ring;
-       blkif_request_t *req;
+       blkif_request_t req;
        pending_req_t *pending_req;
        RING_IDX rc, rp;
        int more_to_do = 0;
@@ -1041,7 +1106,7 @@ static int do_block_io_op(blkif_t *blkif
        rmb(); /* Ensure we see queued requests up to 'rp'. */
 
        /*Check blkif has corresponding UE ring*/
-       if (blkif->dev_num == -1) {
+       if (blkif->dev_num < 0) {
                /*oops*/
                if (print_dbug) {
                        WPRINTK("Corresponding UE " 
@@ -1052,7 +1117,8 @@ static int do_block_io_op(blkif_t *blkif
        }
 
        info = tapfds[blkif->dev_num];
-       if (info == NULL || !info->dev_inuse) {
+
+       if (blkif->dev_num > MAX_TAP_DEV || !info || !info->dev_inuse) {
                if (print_dbug) {
                        WPRINTK("Can't get UE info!\n");
                        print_dbug = 0;
@@ -1082,24 +1148,24 @@ static int do_block_io_op(blkif_t *blkif
                        break;
                }
 
-               req = RING_GET_REQUEST(blk_ring, rc);
+               memcpy(&req, RING_GET_REQUEST(blk_ring, rc), sizeof(req));
                blk_ring->req_cons = ++rc; /* before make_response() */ 
 
-               switch (req->operation) {
+               switch (req.operation) {
                case BLKIF_OP_READ:
                        blkif->st_rd_req++;
-                       dispatch_rw_block_io(blkif, req, pending_req);
+                       dispatch_rw_block_io(blkif, &req, pending_req);
                        break;
 
                case BLKIF_OP_WRITE:
                        blkif->st_wr_req++;
-                       dispatch_rw_block_io(blkif, req, pending_req);
+                       dispatch_rw_block_io(blkif, &req, pending_req);
                        break;
 
                default:
                        WPRINTK("unknown operation [%d]\n",
-                               req->operation);
-                       make_response(blkif, req->id, req->operation,
+                               req.operation);
+                       make_response(blkif, req.id, req.operation,
                                      BLKIF_RSP_ERROR);
                        free_req(pending_req);
                        break;
@@ -1120,17 +1186,27 @@ static void dispatch_rw_block_io(blkif_t
        struct gnttab_map_grant_ref map[BLKIF_MAX_SEGMENTS_PER_REQUEST*2];
        unsigned int nseg;
        int ret, i;
-       tap_blkif_t *info = tapfds[blkif->dev_num];
+       tap_blkif_t *info;
        uint64_t sector;
-       
        blkif_request_t *target;
        int pending_idx = RTN_PEND_IDX(pending_req,pending_req->mem_idx);
-       int usr_idx = GET_NEXT_REQ(info->idx_map);
+       int usr_idx;
        uint16_t mmap_idx = pending_req->mem_idx;
 
-       /*Check we have space on user ring - should never fail*/
-       if(usr_idx == INVALID_REQ) goto fail_flush;
-       
+       if (blkif->dev_num < 0 || blkif->dev_num > MAX_TAP_DEV)
+               goto fail_response;
+
+       info = tapfds[blkif->dev_num];
+       if (info == NULL)
+               goto fail_response;
+
+       /* Check we have space on user ring - should never fail. */
+       usr_idx = GET_NEXT_REQ(info->idx_map);
+       if (usr_idx == INVALID_REQ) {
+               BUG();
+               goto fail_response;
+       }
+
        /* Check that number of segments is sane. */
        nseg = req->nr_segments;
        if ( unlikely(nseg == 0) || 
@@ -1163,14 +1239,12 @@ static void dispatch_rw_block_io(blkif_t
                unsigned long uvaddr;
                unsigned long kvaddr;
                uint64_t ptep;
-               struct page *page;
                uint32_t flags;
 
                uvaddr = MMAP_VADDR(info->user_vstart, usr_idx, i);
                kvaddr = idx_to_kaddr(mmap_idx, pending_idx, i);
-               page = virt_to_page(kvaddr);
-
-               sector = req->sector_number + (8*i);
+
+               sector = req->sector_number + ((PAGE_SIZE / 512) * i);
                if( (blkif->sectors > 0) && (sector >= blkif->sectors) ) {
                        WPRINTK("BLKTAP: Sector request greater" 
                               "than size\n");
@@ -1180,7 +1254,7 @@ static void dispatch_rw_block_io(blkif_t
                                BLKIF_OP_WRITE ? "WRITE" : "READ"),
                                (long long unsigned) sector,
                                (long long unsigned) sector>>9,
-                               blkif->sectors);
+                               (long long unsigned) blkif->sectors);
                }
 
                flags = GNTMAP_host_map;
@@ -1190,60 +1264,103 @@ static void dispatch_rw_block_io(blkif_t
                                  req->seg[i].gref, blkif->domid);
                op++;
 
-               /* Now map it to user. */
-               ret = create_lookup_pte_addr(info->vma->vm_mm, 
-                                            uvaddr, &ptep);
-               if (ret) {
-                       WPRINTK("Couldn't get a pte addr!\n");
-                       fast_flush_area(pending_req, pending_idx, usr_idx, 
-                                       blkif->dev_num);
-                       goto fail_flush;
-               }
-
-               flags = GNTMAP_host_map | GNTMAP_application_map
-                       | GNTMAP_contains_pte;
-               if (operation == WRITE)
-                       flags |= GNTMAP_readonly;
-               gnttab_set_map_op(&map[op], ptep, flags,
-                                 req->seg[i].gref, blkif->domid);
-               op++;
+               if (!xen_feature(XENFEAT_auto_translated_physmap)) {
+                       /* Now map it to user. */
+                       ret = create_lookup_pte_addr(info->vma->vm_mm, 
+                                                    uvaddr, &ptep);
+                       if (ret) {
+                               WPRINTK("Couldn't get a pte addr!\n");
+                               goto fail_flush;
+                       }
+
+                       flags = GNTMAP_host_map | GNTMAP_application_map
+                               | GNTMAP_contains_pte;
+                       if (operation == WRITE)
+                               flags |= GNTMAP_readonly;
+                       gnttab_set_map_op(&map[op], ptep, flags,
+                                         req->seg[i].gref, blkif->domid);
+                       op++;
+               }
        }
 
        ret = HYPERVISOR_grant_table_op(GNTTABOP_map_grant_ref, map, op);
        BUG_ON(ret);
 
-       for (i = 0; i < (nseg*2); i+=2) {
-               unsigned long uvaddr;
-               unsigned long kvaddr;
-               unsigned long offset;
-               struct page *pg;
-
-               uvaddr = MMAP_VADDR(info->user_vstart, usr_idx, i/2);
-               kvaddr = idx_to_kaddr(mmap_idx, pending_idx, i/2);
-
-               if (unlikely(map[i].status != 0)) {
-                       WPRINTK("invalid kernel buffer -- "
-                               "could not remap it\n");
-                       goto fail_flush;
-               }
-
-               if (unlikely(map[i+1].status != 0)) {
-                       WPRINTK("invalid user buffer -- "
-                               "could not remap it\n");
-                       goto fail_flush;
-               }
-
-               pending_handle(mmap_idx, pending_idx, i/2).kernel 
-                       = map[i].handle;
-               pending_handle(mmap_idx, pending_idx, i/2).user   
-                       = map[i+1].handle;
-               set_phys_to_machine(__pa(kvaddr) >> PAGE_SHIFT,
-                       FOREIGN_FRAME(map[i].dev_bus_addr >> PAGE_SHIFT));
-               offset = (uvaddr - info->vma->vm_start) >> PAGE_SHIFT;
-               pg = pfn_to_page(__pa(kvaddr) >> PAGE_SHIFT);
-               ((struct page **)info->vma->vm_private_data)[offset] =
-                       pg;
-       }
+       if (!xen_feature(XENFEAT_auto_translated_physmap)) {
+               for (i = 0; i < (nseg*2); i+=2) {
+                       unsigned long uvaddr;
+                       unsigned long kvaddr;
+                       unsigned long offset;
+                       struct page *pg;
+
+                       uvaddr = MMAP_VADDR(info->user_vstart, usr_idx, i/2);
+                       kvaddr = idx_to_kaddr(mmap_idx, pending_idx, i/2);
+
+                       if (unlikely(map[i].status != 0)) {
+                               WPRINTK("invalid kernel buffer -- "
+                                       "could not remap it\n");
+                               ret |= 1;
+                               map[i].handle = INVALID_GRANT_HANDLE;
+                       }
+
+                       if (unlikely(map[i+1].status != 0)) {
+                               WPRINTK("invalid user buffer -- "
+                                       "could not remap it\n");
+                               ret |= 1;
+                               map[i+1].handle = INVALID_GRANT_HANDLE;
+                       }
+
+                       pending_handle(mmap_idx, pending_idx, i/2).kernel 
+                               = map[i].handle;
+                       pending_handle(mmap_idx, pending_idx, i/2).user   
+                               = map[i+1].handle;
+
+                       if (ret)
+                               continue;
+
+                       set_phys_to_machine(__pa(kvaddr) >> PAGE_SHIFT,
+                                           FOREIGN_FRAME(map[i].dev_bus_addr
+                                                         >> PAGE_SHIFT));
+                       offset = (uvaddr - info->vma->vm_start) >> PAGE_SHIFT;
+                       pg = pfn_to_page(__pa(kvaddr) >> PAGE_SHIFT);
+                       ((struct page **)info->vma->vm_private_data)[offset] =
+                               pg;
+               }
+       } else {
+               for (i = 0; i < nseg; i++) {
+                       unsigned long uvaddr;
+                       unsigned long kvaddr;
+                       unsigned long offset;
+                       struct page *pg;
+
+                       uvaddr = MMAP_VADDR(info->user_vstart, usr_idx, i);
+                       kvaddr = idx_to_kaddr(mmap_idx, pending_idx, i);
+
+                       if (unlikely(map[i].status != 0)) {
+                               WPRINTK("invalid kernel buffer -- "
+                                       "could not remap it\n");
+                               ret |= 1;
+                               map[i].handle = INVALID_GRANT_HANDLE;
+                       }
+
+                       pending_handle(mmap_idx, pending_idx, i).kernel 
+                               = map[i].handle;
+
+                       if (ret)
+                               continue;
+
+                       offset = (uvaddr - info->vma->vm_start) >> PAGE_SHIFT;
+                       pg = pfn_to_page(__pa(kvaddr) >> PAGE_SHIFT);
+                       ((struct page **)info->vma->vm_private_data)[offset] =
+                               pg;
+               }
+       }
+
+       if (ret)
+               goto fail_flush;
+
+       if (xen_feature(XENFEAT_auto_translated_physmap))
+               down_write(&info->vma->vm_mm->mmap_sem);
        /* Mark mapped pages as reserved: */
        for (i = 0; i < req->nr_segments; i++) {
                unsigned long kvaddr;
@@ -1252,7 +1369,18 @@ static void dispatch_rw_block_io(blkif_t
                kvaddr = idx_to_kaddr(mmap_idx, pending_idx, i);
                pg = pfn_to_page(__pa(kvaddr) >> PAGE_SHIFT);
                SetPageReserved(pg);
-       }
+               if (xen_feature(XENFEAT_auto_translated_physmap)) {
+                       ret = vm_insert_page(info->vma,
+                                            MMAP_VADDR(info->user_vstart,
+                                                       usr_idx, i), pg);
+                       if (ret) {
+                               up_write(&info->vma->vm_mm->mmap_sem);
+                               goto fail_flush;
+                       }
+               }
+       }
+       if (xen_feature(XENFEAT_auto_translated_physmap))
+               up_write(&info->vma->vm_mm->mmap_sem);
        
        /*record [mmap_idx,pending_idx] to [usr_idx] mapping*/
        info->idx_map[usr_idx] = MAKE_ID(mmap_idx, pending_idx);
@@ -1263,6 +1391,7 @@ static void dispatch_rw_block_io(blkif_t
                                  info->ufe_ring.req_prod_pvt);
        memcpy(target, req, sizeof(*req));
        target->id = usr_idx;
+       wmb(); /* blktap_poll() reads req_prod_pvt asynchronously */
        info->ufe_ring.req_prod_pvt++;
        return;
 
@@ -1320,7 +1449,6 @@ static int __init blkif_init(void)
 static int __init blkif_init(void)
 {
        int i,ret,blktap_dir;
-       tap_blkif_t *info;
 
        if (!is_running_on_xen())
                return -ENODEV;
@@ -1339,9 +1467,6 @@ static int __init blkif_init(void)
        alloc_pending_reqs = 0;
 
        tap_blkif_xenbus_init();
-
-       /*Create the blktap devices, but do not map memory or waitqueue*/
-       for(i = 0; i < MAX_TAP_DEV; i++) translate_domid[i].domid = 0xFFFF;
 
        /* Dynamically allocate a major for this device */
        ret = register_chrdev(0, "blktap", &blktap_fops);
@@ -1354,24 +1479,17 @@ static int __init blkif_init(void)
        
        blktap_major = ret;
 
-       for(i = 0; i < MAX_TAP_DEV; i++ ) {
-               info = tapfds[i] = kzalloc(sizeof(tap_blkif_t),GFP_KERNEL);
-               if(tapfds[i] == NULL)
-                       return -ENOMEM;
-               info->minor = i;
-               info->pid = 0;
-               info->blkif = NULL;
-
-               ret = devfs_mk_cdev(MKDEV(blktap_major, i),
-                       S_IFCHR|S_IRUGO|S_IWUSR, "xen/blktap%d", i);
-
-               if(ret != 0)
-                       return -ENOMEM;
-               info->dev_pending = info->dev_inuse = 0;
-
-               DPRINTK("Created misc_dev [/dev/xen/blktap%d]\n",i);
-       }
-       
+       /* tapfds[0] is always NULL */
+       blktap_next_minor++;
+
+       ret = devfs_mk_cdev(MKDEV(blktap_major, i),
+                           S_IFCHR|S_IRUGO|S_IWUSR, "xen/blktap%d", i);
+
+       if(ret != 0)
+               return -ENOMEM;
+
+       DPRINTK("Created misc_dev [/dev/xen/blktap%d]\n",i);
+
        /* Make sure the xen class exists */
        if (!setup_xen_class()) {
                /*
@@ -1384,7 +1502,6 @@ static int __init blkif_init(void)
                class_device_create(xen_class, NULL,
                                    MKDEV(blktap_major, 0), NULL,
                                    "blktap0");
-               tapfds[0]->sysfs_set = 1;
        } else {
                /* this is bad, but not fatal */
                WPRINTK("blktap: sysfs xen_class not created\n");
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/blktap/xenbus.c
--- a/linux-2.6-xen-sparse/drivers/xen/blktap/xenbus.c  Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/blktap/xenbus.c  Thu Nov 09 15:37:17 
2006 -0500
@@ -189,7 +189,7 @@ static int blktap_probe(struct xenbus_de
        return 0;
 
 fail:
-       DPRINTK("blktap probe failed");
+       DPRINTK("blktap probe failed\n");
        blktap_remove(dev);
        return err;
 }
@@ -243,7 +243,7 @@ static void tap_frontend_changed(struct 
        struct backend_info *be = dev->dev.driver_data;
        int err;
 
-       DPRINTK("");
+       DPRINTK("\n");
 
        switch (frontend_state) {
        case XenbusStateInitialising:
@@ -318,7 +318,7 @@ static int connect_ring(struct backend_i
        unsigned int evtchn;
        int err;
 
-       DPRINTK("%s", dev->otherend);
+       DPRINTK("%s\n", dev->otherend);
 
        err = xenbus_gather(XBT_NIL, dev->otherend, "ring-ref", "%lu", 
                            &ring_ref, "event-channel", "%u", &evtchn, NULL);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/core/Makefile
--- a/linux-2.6-xen-sparse/drivers/xen/core/Makefile    Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/core/Makefile    Thu Nov 09 15:37:17 
2006 -0500
@@ -9,5 +9,5 @@ obj-$(CONFIG_HOTPLUG_CPU)       += cpu_hotplug
 obj-$(CONFIG_HOTPLUG_CPU)      += cpu_hotplug.o
 obj-$(CONFIG_XEN_SYSFS)                += xen_sysfs.o
 obj-$(CONFIG_XEN_SKBUFF)       += skbuff.o
-obj-$(CONFIG_XEN_REBOOT)       += reboot.o
+obj-$(CONFIG_XEN_REBOOT)       += reboot.o machine_reboot.o
 obj-$(CONFIG_XEN_SMPBOOT)      += smpboot.o
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/core/features.c
--- a/linux-2.6-xen-sparse/drivers/xen/core/features.c  Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/core/features.c  Thu Nov 09 15:37:17 
2006 -0500
@@ -10,6 +10,10 @@
 #include <linux/module.h>
 #include <asm/hypervisor.h>
 #include <xen/features.h>
+
+#ifdef HAVE_XEN_PLATFORM_COMPAT_H
+#include <xen/platform-compat.h>
+#endif
 
 u8 xen_features[XENFEAT_NR_SUBMAPS * 32] __read_mostly;
 /* Not a GPL symbol: used in ubiquitous macros, so too restrictive. */
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/core/gnttab.c
--- a/linux-2.6-xen-sparse/drivers/xen/core/gnttab.c    Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/core/gnttab.c    Thu Nov 09 15:37:17 
2006 -0500
@@ -44,6 +44,10 @@
 #include <asm/io.h>
 #include <xen/interface/memory.h>
 
+#ifdef HAVE_XEN_PLATFORM_COMPAT_H
+#include <xen/platform-compat.h>
+#endif
+
 /* External tools reserve first few grant table entries. */
 #define NR_RESERVED_ENTRIES 8
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/core/reboot.c
--- a/linux-2.6-xen-sparse/drivers/xen/core/reboot.c    Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/core/reboot.c    Thu Nov 09 15:37:17 
2006 -0500
@@ -1,25 +1,15 @@
 #define __KERNEL_SYSCALLS__
 #include <linux/version.h>
 #include <linux/kernel.h>
-#include <linux/mm.h>
 #include <linux/unistd.h>
 #include <linux/module.h>
 #include <linux/reboot.h>
 #include <linux/sysrq.h>
-#include <linux/stringify.h>
-#include <asm/irq.h>
-#include <asm/mmu_context.h>
-#include <xen/evtchn.h>
 #include <asm/hypervisor.h>
-#include <xen/interface/dom0_ops.h>
 #include <xen/xenbus.h>
-#include <linux/cpu.h>
 #include <linux/kthread.h>
-#include <xen/gnttab.h>
-#include <xen/xencons.h>
-#include <xen/cpu_hotplug.h>
-
-extern void ctrl_alt_del(void);
+
+MODULE_LICENSE("Dual BSD/GPL");
 
 #define SHUTDOWN_INVALID  -1
 #define SHUTDOWN_POWEROFF  0
@@ -31,185 +21,17 @@ extern void ctrl_alt_del(void);
  */
 #define SHUTDOWN_HALT      4
 
-#if defined(__i386__) || defined(__x86_64__)
-
-/*
- * Power off function, if any
- */
-void (*pm_power_off)(void);
-EXPORT_SYMBOL(pm_power_off);
-
-void machine_emergency_restart(void)
-{
-       /* We really want to get pending console data out before we die. */
-       xencons_force_flush();
-       HYPERVISOR_shutdown(SHUTDOWN_reboot);
-}
-
-void machine_restart(char * __unused)
-{
-       machine_emergency_restart();
-}
-
-void machine_halt(void)
-{
-       machine_power_off();
-}
-
-void machine_power_off(void)
-{
-       /* We really want to get pending console data out before we die. */
-       xencons_force_flush();
-       if (pm_power_off)
-               pm_power_off();
-       HYPERVISOR_shutdown(SHUTDOWN_poweroff);
-}
-
-int reboot_thru_bios = 0;      /* for dmi_scan.c */
-EXPORT_SYMBOL(machine_restart);
-EXPORT_SYMBOL(machine_halt);
-EXPORT_SYMBOL(machine_power_off);
-
-#endif /* defined(__i386__) || defined(__x86_64__) */
-
-/******************************************************************************
- * Stop/pickle callback handling.
- */
-
 /* Ignore multiple shutdown requests. */
 static int shutting_down = SHUTDOWN_INVALID;
+
 static void __shutdown_handler(void *unused);
 static DECLARE_WORK(shutdown_work, __shutdown_handler, NULL);
 
-#if defined(__i386__) || defined(__x86_64__)
-
-/* Ensure we run on the idle task page tables so that we will
-   switch page tables before running user space. This is needed
-   on architectures with separate kernel and user page tables
-   because the user page table pointer is not saved/restored. */
-static void switch_idle_mm(void)
-{
-       struct mm_struct *mm = current->active_mm;
-
-       if (mm == &init_mm)
-               return;
-
-       atomic_inc(&init_mm.mm_count);
-       switch_mm(mm, &init_mm, current);
-       current->active_mm = &init_mm;
-       mmdrop(mm);
-}
-
-static void pre_suspend(void)
-{
-       HYPERVISOR_shared_info = (shared_info_t *)empty_zero_page;
-       clear_fixmap(FIX_SHARED_INFO);
-
-       xen_start_info->store_mfn = mfn_to_pfn(xen_start_info->store_mfn);
-       xen_start_info->console.domU.mfn =
-               mfn_to_pfn(xen_start_info->console.domU.mfn);
-}
-
-static void post_suspend(void)
-{
-       int i, j, k, fpp;
-       extern unsigned long max_pfn;
-       extern unsigned long *pfn_to_mfn_frame_list_list;
-       extern unsigned long *pfn_to_mfn_frame_list[];
-
-       set_fixmap(FIX_SHARED_INFO, xen_start_info->shared_info);
-
-       HYPERVISOR_shared_info = (shared_info_t *)fix_to_virt(FIX_SHARED_INFO);
-
-       memset(empty_zero_page, 0, PAGE_SIZE);
-
-       HYPERVISOR_shared_info->arch.pfn_to_mfn_frame_list_list =
-               virt_to_mfn(pfn_to_mfn_frame_list_list);
-
-       fpp = PAGE_SIZE/sizeof(unsigned long);
-       for (i = 0, j = 0, k = -1; i < max_pfn; i += fpp, j++) {
-               if ((j % fpp) == 0) {
-                       k++;
-                       pfn_to_mfn_frame_list_list[k] =
-                               virt_to_mfn(pfn_to_mfn_frame_list[k]);
-                       j = 0;
-               }
-               pfn_to_mfn_frame_list[k][j] =
-                       virt_to_mfn(&phys_to_machine_mapping[i]);
-       }
-       HYPERVISOR_shared_info->arch.max_pfn = max_pfn;
-}
-
-#else /* !(defined(__i386__) || defined(__x86_64__)) */
-
-#define switch_idle_mm()       ((void)0)
-#define mm_pin_all()           ((void)0)
-#define pre_suspend()          ((void)0)
-#define post_suspend()         ((void)0)
-
+#ifdef CONFIG_XEN
+int __xen_suspend(void);
+#else
+#define __xen_suspend() (void)0
 #endif
-
-static int __do_suspend(void *ignore)
-{
-       int err;
-
-       extern void time_resume(void);
-
-       BUG_ON(smp_processor_id() != 0);
-       BUG_ON(in_interrupt());
-
-#if defined(__i386__) || defined(__x86_64__)
-       if (xen_feature(XENFEAT_auto_translated_physmap)) {
-               printk(KERN_WARNING "Cannot suspend in "
-                      "auto_translated_physmap mode.\n");
-               return -EOPNOTSUPP;
-       }
-#endif
-
-       err = smp_suspend();
-       if (err)
-               return err;
-
-       xenbus_suspend();
-
-       preempt_disable();
-
-       mm_pin_all();
-       local_irq_disable();
-       preempt_enable();
-
-       gnttab_suspend();
-
-       pre_suspend();
-
-       /*
-        * We'll stop somewhere inside this hypercall. When it returns,
-        * we'll start resuming after the restore.
-        */
-       HYPERVISOR_suspend(virt_to_mfn(xen_start_info));
-
-       shutting_down = SHUTDOWN_INVALID;
-
-       post_suspend();
-
-       gnttab_resume();
-
-       irq_resume();
-
-       time_resume();
-
-       switch_idle_mm();
-
-       local_irq_enable();
-
-       xencons_resume();
-
-       xenbus_resume();
-
-       smp_resume();
-
-       return err;
-}
 
 static int shutdown_process(void *__unused)
 {
@@ -222,16 +44,25 @@ static int shutdown_process(void *__unus
 
        if ((shutting_down == SHUTDOWN_POWEROFF) ||
            (shutting_down == SHUTDOWN_HALT)) {
-               if (execve("/sbin/poweroff", poweroff_argv, envp) < 0) {
+               if (call_usermodehelper("/sbin/poweroff", poweroff_argv, envp, 
0) < 0) {
+#ifdef CONFIG_XEN
                        sys_reboot(LINUX_REBOOT_MAGIC1,
                                   LINUX_REBOOT_MAGIC2,
                                   LINUX_REBOOT_CMD_POWER_OFF,
                                   NULL);
+#endif /* CONFIG_XEN */
                }
        }
 
        shutting_down = SHUTDOWN_INVALID; /* could try again */
 
+       return 0;
+}
+
+static int xen_suspend(void *__unused)
+{
+       __xen_suspend();
+       shutting_down = SHUTDOWN_INVALID;
        return 0;
 }
 
@@ -257,7 +88,7 @@ static void __shutdown_handler(void *unu
                err = kernel_thread(shutdown_process, NULL,
                                    CLONE_FS | CLONE_FILES);
        else
-               err = kthread_create_on_cpu(__do_suspend, NULL, "suspend", 0);
+               err = kthread_create_on_cpu(xen_suspend, NULL, "suspend", 0);
 
        if (err < 0) {
                printk(KERN_WARNING "Error creating shutdown process (%d): "
@@ -298,7 +129,7 @@ static void shutdown_handler(struct xenb
        if (strcmp(str, "poweroff") == 0)
                shutting_down = SHUTDOWN_POWEROFF;
        else if (strcmp(str, "reboot") == 0)
-               ctrl_alt_del();
+               kill_proc(1, SIGINT, 1); /* interrupt init */
        else if (strcmp(str, "suspend") == 0)
                shutting_down = SHUTDOWN_SUSPEND;
        else if (strcmp(str, "halt") == 0)
@@ -364,10 +195,14 @@ static int setup_shutdown_watcher(struct
        err = register_xenbus_watch(&shutdown_watch);
        if (err)
                printk(KERN_ERR "Failed to set shutdown watcher\n");
+       else
+               xenbus_write(XBT_NIL, "control", "feature-reboot", "1");
 
        err = register_xenbus_watch(&sysrq_watch);
        if (err)
                printk(KERN_ERR "Failed to set sysrq watcher\n");
+       else
+               xenbus_write(XBT_NIL, "control", "feature-sysrq", "1");
 
        return NOTIFY_DONE;
 }
@@ -378,6 +213,7 @@ static int __init setup_shutdown_event(v
                .notifier_call = setup_shutdown_watcher
        };
        register_xenstore_notifier(&xenstore_notifier);
+
        return 0;
 }
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/netback/common.h
--- a/linux-2.6-xen-sparse/drivers/xen/netback/common.h Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/netback/common.h Thu Nov 09 15:37:17 
2006 -0500
@@ -92,6 +92,9 @@ typedef struct netif_st {
        unsigned long   remaining_credit;
        struct timer_list credit_timeout;
 
+       /* Enforce draining of the transmit queue. */
+       struct timer_list tx_queue_timeout;
+
        /* Miscellaneous private stuff. */
        struct list_head list;  /* scheduling list */
        atomic_t         refcnt;
@@ -119,6 +122,8 @@ int netif_map(netif_t *netif, unsigned l
 
 void netif_xenbus_init(void);
 
+#define netif_schedulable(dev) (netif_running(dev) && netif_carrier_ok(dev))
+
 void netif_schedule_work(netif_t *netif);
 void netif_deschedule_work(netif_t *netif);
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/netback/interface.c
--- a/linux-2.6-xen-sparse/drivers/xen/netback/interface.c      Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/netback/interface.c      Thu Nov 09 
15:37:17 2006 -0500
@@ -44,12 +44,11 @@
  * For example, consider a packet that holds onto resources belonging to the
  * guest for which it is queued (e.g., packet received on vif1.0, destined for
  * vif1.1 which is not activated in the guest): in this situation the guest
- * will never be destroyed, unless vif1.1 is taken down (which flushes the
- * 'tx_queue').
- * 
- * Only set this parameter to non-zero value if you know what you are doing!
+ * will never be destroyed, unless vif1.1 is taken down. To avoid this, we
+ * run a timer (tx_queue_timeout) to drain the queue when the interface is
+ * blocked.
  */
-static unsigned long netbk_queue_length = 0;
+static unsigned long netbk_queue_length = 32;
 module_param_named(queue_length, netbk_queue_length, ulong, 0);
 
 static void __netif_up(netif_t *netif)
@@ -62,7 +61,6 @@ static void __netif_down(netif_t *netif)
 {
        disable_irq(netif->irq);
        netif_deschedule_work(netif);
-       del_timer_sync(&netif->credit_timeout);
 }
 
 static int net_open(struct net_device *dev)
@@ -153,7 +151,10 @@ netif_t *netif_alloc(domid_t domid, unsi
        netif->credit_bytes = netif->remaining_credit = ~0UL;
        netif->credit_usec  = 0UL;
        init_timer(&netif->credit_timeout);
+       /* Initialize 'expires' now: it's used to track the credit window. */
        netif->credit_timeout.expires = jiffies;
+
+       init_timer(&netif->tx_queue_timeout);
 
        dev->hard_start_xmit = netif_be_start_xmit;
        dev->get_stats       = netif_be_get_stats;
@@ -165,9 +166,6 @@ netif_t *netif_alloc(domid_t domid, unsi
        SET_ETHTOOL_OPS(dev, &network_ethtool_ops);
 
        dev->tx_queue_len = netbk_queue_length;
-       if (dev->tx_queue_len != 0)
-               printk(KERN_WARNING "netbk: WARNING: device '%s' has non-zero "
-                      "queue length (%lu)!\n", dev->name, dev->tx_queue_len);
 
        /*
         * Initialise a dummy MAC address. We choose the numerically
@@ -319,25 +317,6 @@ err_rx:
        return err;
 }
 
-static void netif_free(netif_t *netif)
-{
-       atomic_dec(&netif->refcnt);
-       wait_event(netif->waiting_to_free, atomic_read(&netif->refcnt) == 0);
-
-       if (netif->irq)
-               unbind_from_irqhandler(netif->irq, netif);
-       
-       unregister_netdev(netif->dev);
-
-       if (netif->tx.sring) {
-               unmap_frontend_pages(netif);
-               free_vm_area(netif->tx_comms_area);
-               free_vm_area(netif->rx_comms_area);
-       }
-
-       free_netdev(netif->dev);
-}
-
 void netif_disconnect(netif_t *netif)
 {
        if (netif_carrier_ok(netif->dev)) {
@@ -348,5 +327,23 @@ void netif_disconnect(netif_t *netif)
                rtnl_unlock();
                netif_put(netif);
        }
-       netif_free(netif);
-}
+
+       atomic_dec(&netif->refcnt);
+       wait_event(netif->waiting_to_free, atomic_read(&netif->refcnt) == 0);
+
+       del_timer_sync(&netif->credit_timeout);
+       del_timer_sync(&netif->tx_queue_timeout);
+
+       if (netif->irq)
+               unbind_from_irqhandler(netif->irq, netif);
+       
+       unregister_netdev(netif->dev);
+
+       if (netif->tx.sring) {
+               unmap_frontend_pages(netif);
+               free_vm_area(netif->tx_comms_area);
+               free_vm_area(netif->rx_comms_area);
+       }
+
+       free_netdev(netif->dev);
+}
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/netback/netback.c
--- a/linux-2.6-xen-sparse/drivers/xen/netback/netback.c        Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/netback/netback.c        Thu Nov 09 
15:37:17 2006 -0500
@@ -187,7 +187,7 @@ static struct sk_buff *netbk_copy_skb(st
        if (unlikely(!nskb))
                goto err;
 
-       skb_reserve(nskb, 16);
+       skb_reserve(nskb, 16 + NET_IP_ALIGN);
        headlen = nskb->end - nskb->data;
        if (headlen > skb_headlen(skb))
                headlen = skb_headlen(skb);
@@ -264,6 +264,13 @@ static inline int netbk_queue_full(netif
               ((netif->rx.rsp_prod_pvt + NET_RX_RING_SIZE - peek) < needed);
 }
 
+static void tx_queue_callback(unsigned long data)
+{
+       netif_t *netif = (netif_t *)data;
+       if (netif_schedulable(netif->dev))
+               netif_wake_queue(netif->dev);
+}
+
 int netif_be_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        netif_t *netif = netdev_priv(dev);
@@ -271,20 +278,13 @@ int netif_be_start_xmit(struct sk_buff *
        BUG_ON(skb->dev != dev);
 
        /* Drop the packet if the target domain has no receive buffers. */
-       if (unlikely(!netif_running(dev) || !netif_carrier_ok(dev)))
+       if (unlikely(!netif_schedulable(dev) || netbk_queue_full(netif)))
                goto drop;
 
-       if (unlikely(netbk_queue_full(netif))) {
-               /* Not a BUG_ON() -- misbehaving netfront can trigger this. */
-               if (netbk_can_queue(dev))
-                       DPRINTK("Queue full but not stopped!\n");
-               goto drop;
-       }
-
-       /* Copy the packet here if it's destined for a flipping
-          interface but isn't flippable (e.g. extra references to
-          data)
-       */
+       /*
+        * Copy the packet here if it's destined for a flipping interface
+        * but isn't flippable (e.g. extra references to data).
+        */
        if (!netif->copying_receiver && !is_flippable_skb(skb)) {
                struct sk_buff *nskb = netbk_copy_skb(skb);
                if ( unlikely(nskb == NULL) )
@@ -305,8 +305,19 @@ int netif_be_start_xmit(struct sk_buff *
                netif->rx.sring->req_event = netif->rx_req_cons_peek +
                        netbk_max_required_rx_slots(netif);
                mb(); /* request notification /then/ check & stop the queue */
-               if (netbk_queue_full(netif))
+               if (netbk_queue_full(netif)) {
                        netif_stop_queue(dev);
+                       /*
+                        * Schedule 500ms timeout to restart the queue, thus
+                        * ensuring that an inactive queue will be drained.
+                        * Packets will be immediately be dropped until more
+                        * receive buffers become available (see
+                        * netbk_queue_full() check above).
+                        */
+                       netif->tx_queue_timeout.data = (unsigned long)netif;
+                       netif->tx_queue_timeout.function = tx_queue_callback;
+                       __mod_timer(&netif->tx_queue_timeout, jiffies + HZ/2);
+               }
        }
 
        skb_queue_tail(&rx_queue, skb);
@@ -706,6 +717,7 @@ static void net_rx_action(unsigned long 
                }
 
                if (netif_queue_stopped(netif->dev) &&
+                   netif_schedulable(netif->dev) &&
                    !netbk_queue_full(netif))
                        netif_wake_queue(netif->dev);
 
@@ -763,8 +775,7 @@ static void add_to_net_schedule_list_tai
 
        spin_lock_irq(&net_schedule_list_lock);
        if (!__on_net_schedule_list(netif) &&
-           likely(netif_running(netif->dev) &&
-                  netif_carrier_ok(netif->dev))) {
+           likely(netif_schedulable(netif->dev))) {
                list_add_tail(&netif->list, &net_schedule_list);
                netif_get(netif);
        }
@@ -803,7 +814,7 @@ void netif_deschedule_work(netif_t *neti
 
 static void tx_add_credit(netif_t *netif)
 {
-       unsigned long max_burst;
+       unsigned long max_burst, max_credit;
 
        /*
         * Allow a burst big enough to transmit a jumbo packet of up to 128kB.
@@ -813,9 +824,10 @@ static void tx_add_credit(netif_t *netif
        max_burst = min(max_burst, 131072UL);
        max_burst = max(max_burst, netif->credit_bytes);
 
-       netif->remaining_credit = min(netif->remaining_credit +
-                                     netif->credit_bytes,
-                                     max_burst);
+       /* Take care that adding a new chunk of credit doesn't wrap to zero. */
+       max_credit = max(netif->remaining_credit + netif->credit_bytes, ~0UL);
+
+       netif->remaining_credit = min(max_credit, max_burst);
 }
 
 static void tx_credit_callback(unsigned long data)
@@ -1210,7 +1222,7 @@ static void net_tx_action(unsigned long 
                            ret < MAX_SKB_FRAGS) ?
                        PKT_PROT_LEN : txreq.size;
 
-               skb = alloc_skb(data_len+16, GFP_ATOMIC);
+               skb = alloc_skb(data_len + 16 + NET_IP_ALIGN, GFP_ATOMIC);
                if (unlikely(skb == NULL)) {
                        DPRINTK("Can't allocate a skb in start_xmit.\n");
                        netbk_tx_err(netif, &txreq, i);
@@ -1218,7 +1230,7 @@ static void net_tx_action(unsigned long 
                }
 
                /* Packets passed to netif_rx() must have some headroom. */
-               skb_reserve(skb, 16);
+               skb_reserve(skb, 16 + NET_IP_ALIGN);
 
                if (extras[XEN_NETIF_EXTRA_TYPE_GSO - 1].type) {
                        struct netif_extra_info *gso;
@@ -1358,7 +1370,7 @@ irqreturn_t netif_be_int(int irq, void *
        add_to_net_schedule_list_tail(netif);
        maybe_schedule_tx_action();
 
-       if (netif_queue_stopped(netif->dev) && !netbk_queue_full(netif))
+       if (netif_schedulable(netif->dev) && !netbk_queue_full(netif))
                netif_wake_queue(netif->dev);
 
        return IRQ_HANDLED;
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/netback/xenbus.c
--- a/linux-2.6-xen-sparse/drivers/xen/netback/xenbus.c Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/netback/xenbus.c Thu Nov 09 15:37:17 
2006 -0500
@@ -93,10 +93,22 @@ static int netback_probe(struct xenbus_d
                        goto abort_transaction;
                }
 
+               /* We support rx-copy path. */
                err = xenbus_printf(xbt, dev->nodename,
                                    "feature-rx-copy", "%d", 1);
                if (err) {
-                       message = "writing feature-copying";
+                       message = "writing feature-rx-copy";
+                       goto abort_transaction;
+               }
+
+               /*
+                * We don't support rx-flip path (except old guests who don't
+                * grok this feature flag).
+                */
+               err = xenbus_printf(xbt, dev->nodename,
+                                   "feature-rx-flip", "%d", 0);
+               if (err) {
+                       message = "writing feature-rx-flip";
                        goto abort_transaction;
                }
 
@@ -328,7 +340,7 @@ static void connect(struct backend_info 
 
        /* May not get a kick from the frontend, so start the tx_queue now. */
        if (!netbk_can_queue(be->netif->dev))
-               netif_start_queue(be->netif->dev);
+               netif_wake_queue(be->netif->dev);
 }
 
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c
--- a/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c      Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c      Thu Nov 09 
15:37:17 2006 -0500
@@ -64,6 +64,10 @@
 #include <xen/interface/grant_table.h>
 #include <xen/gnttab.h>
 
+#ifdef HAVE_XEN_PLATFORM_COMPAT_H
+#include <xen/platform-compat.h>
+#endif
+
 /*
  * Mutually-exclusive module options to select receive data path:
  *  rx_copy : Packets are copied by network backend into local memory
@@ -97,6 +101,14 @@ static inline void dev_disable_gso_featu
 }
 #elif defined(NETIF_F_TSO)
 #define HAVE_TSO                       1
+
+/* Some older kernels cannot cope with incorrect checksums,
+ * particularly in netfilter. I'm not sure there is 100% correlation
+ * with the presence of NETIF_F_TSO but it appears to be a good first
+ * approximiation.
+ */
+#define HAVE_NO_CSUM_OFFLOAD           1
+
 #define gso_size tso_size
 #define gso_segs tso_segs
 static inline void dev_disable_gso_features(struct net_device *dev)
@@ -238,7 +250,6 @@ static void netif_disconnect_backend(str
 static void netif_disconnect_backend(struct netfront_info *);
 static int open_netdev(struct netfront_info *);
 static void close_netdev(struct netfront_info *);
-static void netif_free(struct netfront_info *);
 
 static int network_connect(struct net_device *);
 static void network_tx_buf_gc(struct net_device *);
@@ -391,6 +402,14 @@ again:
                goto abort_transaction;
        }
 
+#ifdef HAVE_NO_CSUM_OFFLOAD
+       err = xenbus_printf(xbt, dev->nodename, "feature-no-csum-offload", 
"%d", 1);
+       if (err) {
+               message = "writing feature-no-csum-offload";
+               goto abort_transaction;
+       }
+#endif
+
        err = xenbus_printf(xbt, dev->nodename, "feature-sg", "%d", 1);
        if (err) {
                message = "writing feature-sg";
@@ -423,7 +442,6 @@ again:
  out:
        return err;
 }
-
 
 static int setup_device(struct xenbus_device *dev, struct netfront_info *info)
 {
@@ -484,10 +502,8 @@ static int setup_device(struct xenbus_de
        return 0;
 
  fail:
-       netif_free(info);
        return err;
 }
-
 
 /**
  * Callback received when the backend's state changes.
@@ -509,10 +525,8 @@ static void backend_changed(struct xenbu
                break;
 
        case XenbusStateInitWait:
-               if (network_connect(netdev) != 0) {
-                       netif_free(np);
+               if (network_connect(netdev) != 0)
                        break;
-               }
                xenbus_switch_state(dev, XenbusStateConnected);
                (void)send_fake_arp(netdev);
                break;
@@ -522,7 +536,6 @@ static void backend_changed(struct xenbu
                break;
        }
 }
-
 
 /** Send a packet on a net device to encourage switches to learn the
  * MAC. We send a fake ARP request.
@@ -551,7 +564,6 @@ static int send_fake_arp(struct net_devi
 
        return dev_queue_xmit(skb);
 }
-
 
 static int network_open(struct net_device *dev)
 {
@@ -644,13 +656,11 @@ static void network_tx_buf_gc(struct net
        network_maybe_wake_tx(dev);
 }
 
-
 static void rx_refill_timeout(unsigned long data)
 {
        struct net_device *dev = (struct net_device *)data;
        netif_rx_schedule(dev);
 }
-
 
 static void network_alloc_rx_buffers(struct net_device *dev)
 {
@@ -684,7 +694,7 @@ static void network_alloc_rx_buffers(str
                 * necessary here.
                 * 16 bytes added as necessary headroom for netif_receive_skb.
                 */
-               skb = alloc_skb(RX_COPY_THRESHOLD + 16,
+               skb = alloc_skb(RX_COPY_THRESHOLD + 16 + NET_IP_ALIGN,
                                GFP_ATOMIC | __GFP_NOWARN);
                if (unlikely(!skb))
                        goto no_skb;
@@ -702,7 +712,7 @@ no_skb:
                        break;
                }
 
-               skb_reserve(skb, 16); /* mimic dev_alloc_skb() */
+               skb_reserve(skb, 16 + NET_IP_ALIGN); /* mimic dev_alloc_skb() */
                skb_shinfo(skb)->frags[0].page = page;
                skb_shinfo(skb)->nr_frags = 1;
                __skb_queue_tail(&np->rx_batch, skb);
@@ -2059,14 +2069,6 @@ static void netif_disconnect_backend(str
 }
 
 
-static void netif_free(struct netfront_info *info)
-{
-       close_netdev(info);
-       netif_disconnect_backend(info);
-       free_netdev(info->netdev);
-}
-
-
 static void end_access(int ref, void *page)
 {
        if (ref != GRANT_INVALID_REF)
@@ -2129,6 +2131,9 @@ module_init(netif_init);
 
 static void __exit netif_exit(void)
 {
+       if (is_initial_xendomain())
+               return;
+
        unregister_inetaddr_notifier(&notifier_inetdev);
 
        return xenbus_unregister_driver(&netfront);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/privcmd/privcmd.c
--- a/linux-2.6-xen-sparse/drivers/xen/privcmd/privcmd.c        Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/privcmd/privcmd.c        Thu Nov 09 
15:37:17 2006 -0500
@@ -53,6 +53,8 @@ static int privcmd_ioctl(struct inode *i
                        return -EFAULT;
 
 #if defined(__i386__)
+               if (hypercall.op >= (PAGE_SIZE >> 5))
+                       break;
                __asm__ __volatile__ (
                        "pushl %%ebx; pushl %%ecx; pushl %%edx; "
                        "pushl %%esi; pushl %%edi; "
@@ -69,36 +71,25 @@ static int privcmd_ioctl(struct inode *i
                        "popl %%ecx; popl %%ebx"
                        : "=a" (ret) : "0" (&hypercall) : "memory" );
 #elif defined (__x86_64__)
-               {
+               if (hypercall.op < (PAGE_SIZE >> 5)) {
                        long ign1, ign2, ign3;
                        __asm__ __volatile__ (
                                "movq %8,%%r10; movq %9,%%r8;"
-                               "shlq $5,%%rax ;"
+                               "shll $5,%%eax ;"
                                "addq $hypercall_page,%%rax ;"
                                "call *%%rax"
                                : "=a" (ret), "=D" (ign1),
                                  "=S" (ign2), "=d" (ign3)
-                               : "0" ((unsigned long)hypercall.op), 
-                               "1" ((unsigned long)hypercall.arg[0]), 
-                               "2" ((unsigned long)hypercall.arg[1]),
-                               "3" ((unsigned long)hypercall.arg[2]), 
-                               "g" ((unsigned long)hypercall.arg[3]),
-                               "g" ((unsigned long)hypercall.arg[4])
+                               : "0" ((unsigned int)hypercall.op),
+                               "1" (hypercall.arg[0]),
+                               "2" (hypercall.arg[1]),
+                               "3" (hypercall.arg[2]),
+                               "g" (hypercall.arg[3]),
+                               "g" (hypercall.arg[4])
                                : "r8", "r10", "memory" );
                }
 #elif defined (__ia64__)
-               __asm__ __volatile__ (
-                       ";; mov r14=%2; mov r15=%3; "
-                       "mov r16=%4; mov r17=%5; mov r18=%6;"
-                       "mov r2=%1; break 0x1000;; mov %0=r8 ;;"
-                       : "=r" (ret)
-                       : "r" (hypercall.op),
-                       "r" (hypercall.arg[0]),
-                       "r" (hypercall.arg[1]),
-                       "r" (hypercall.arg[2]),
-                       "r" (hypercall.arg[3]),
-                       "r" (hypercall.arg[4])
-                       : "r14","r15","r16","r17","r18","r2","r8","memory");
+               ret = privcmd_hypercall(&hypercall);
 #endif
        }
        break;
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/tpmback/xenbus.c
--- a/linux-2.6-xen-sparse/drivers/xen/tpmback/xenbus.c Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/tpmback/xenbus.c Thu Nov 09 15:37:17 
2006 -0500
@@ -157,10 +157,12 @@ static void frontend_changed(struct xenb
 
        case XenbusStateClosing:
                be->instance = -1;
-               break;
-
-       case XenbusStateUnknown:
+               xenbus_switch_state(dev, XenbusStateClosing);
+               break;
+
+       case XenbusStateUnknown: /* keep it here */
        case XenbusStateClosed:
+               xenbus_switch_state(dev, XenbusStateClosed);
                device_unregister(&be->dev->dev);
                tpmback_remove(dev);
                break;
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/xenbus/Makefile
--- a/linux-2.6-xen-sparse/drivers/xen/xenbus/Makefile  Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/xenbus/Makefile  Thu Nov 09 15:37:17 
2006 -0500
@@ -9,4 +9,5 @@ xenbus-objs += xenbus_comms.o
 xenbus-objs += xenbus_comms.o
 xenbus-objs += xenbus_xs.o
 xenbus-objs += xenbus_probe.o
+obj-$(CONFIG_XEN_BACKEND) += xenbus_probe_backend.o
 obj-$(CONFIG_XEN_XENBUS_DEV) += xenbus_dev.o
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_client.c
--- a/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_client.c   Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_client.c   Thu Nov 09 
15:37:17 2006 -0500
@@ -34,6 +34,10 @@
 #include <xen/gnttab.h>
 #include <xen/xenbus.h>
 #include <xen/driver_util.h>
+
+#ifdef HAVE_XEN_PLATFORM_COMPAT_H
+#include <xen/platform-compat.h>
+#endif
 
 /* xenbus_probe.c */
 extern char *kasprintf(const char *fmt, ...);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_comms.c
--- a/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_comms.c    Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_comms.c    Thu Nov 09 
15:37:17 2006 -0500
@@ -30,14 +30,21 @@
  * IN THE SOFTWARE.
  */
 
-#include <asm/hypervisor.h>
-#include <xen/evtchn.h>
 #include <linux/wait.h>
 #include <linux/interrupt.h>
 #include <linux/sched.h>
 #include <linux/err.h>
+#include <linux/ptrace.h>
+#include <xen/evtchn.h>
 #include <xen/xenbus.h>
+
+#include <asm/hypervisor.h>
+
 #include "xenbus_comms.h"
+
+#ifdef HAVE_XEN_PLATFORM_COMPAT_H
+#include <xen/platform-compat.h>
+#endif
 
 static int xenbus_irq;
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_dev.c
--- a/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_dev.c      Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_dev.c      Thu Nov 09 
15:37:17 2006 -0500
@@ -40,6 +40,7 @@
 #include <linux/wait.h>
 #include <linux/fs.h>
 #include <linux/poll.h>
+#include <linux/mutex.h>
 
 #include "xenbus_comms.h"
 
@@ -48,6 +49,10 @@
 #include <xen/xenbus.h>
 #include <xen/xen_proc.h>
 #include <asm/hypervisor.h>
+
+#ifdef HAVE_XEN_PLATFORM_COMPAT_H
+#include <xen/platform-compat.h>
+#endif
 
 struct xenbus_dev_transaction {
        struct list_head list;
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_probe.c
--- a/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_probe.c    Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_probe.c    Thu Nov 09 
15:37:17 2006 -0500
@@ -42,6 +42,7 @@
 #include <linux/mm.h>
 #include <linux/notifier.h>
 #include <linux/kthread.h>
+#include <linux/mutex.h>
 
 #include <asm/io.h>
 #include <asm/page.h>
@@ -55,6 +56,11 @@
 #include <xen/hvm.h>
 
 #include "xenbus_comms.h"
+#include "xenbus_probe.h"
+
+#ifdef HAVE_XEN_PLATFORM_COMPAT_H
+#include <xen/platform-compat.h>
+#endif
 
 int xen_store_evtchn;
 struct xenstore_domain_interface *xen_store_interface;
@@ -67,12 +73,7 @@ static void wait_for_devices(struct xenb
 static void wait_for_devices(struct xenbus_driver *xendrv);
 
 static int xenbus_probe_frontend(const char *type, const char *name);
-static int xenbus_uevent_backend(struct device *dev, char **envp,
-                                int num_envp, char *buffer, int buffer_size);
-static int xenbus_probe_backend(const char *type, const char *domid);
-
-static int xenbus_dev_probe(struct device *_dev);
-static int xenbus_dev_remove(struct device *_dev);
+
 static void xenbus_dev_shutdown(struct device *_dev);
 
 /* If something in array of ids matches this device, return it. */
@@ -86,7 +87,7 @@ match_device(const struct xenbus_device_
        return NULL;
 }
 
-static int xenbus_match(struct device *_dev, struct device_driver *_drv)
+int xenbus_match(struct device *_dev, struct device_driver *_drv)
 {
        struct xenbus_driver *drv = to_xenbus_driver(_drv);
 
@@ -95,17 +96,6 @@ static int xenbus_match(struct device *_
 
        return match_device(drv->ids, to_xenbus_device(_dev)) != NULL;
 }
-
-struct xen_bus_type
-{
-       char *root;
-       unsigned int levels;
-       int (*get_bus_id)(char bus_id[BUS_ID_SIZE], const char *nodename);
-       int (*probe)(const char *type, const char *dir);
-       struct bus_type bus;
-       struct device dev;
-};
-
 
 /* device/<type>/<id> => <type>-<id> */
 static int frontend_bus_id(char bus_id[BUS_ID_SIZE], const char *nodename)
@@ -143,7 +133,7 @@ static void free_otherend_watch(struct x
 }
 
 
-static int read_otherend_details(struct xenbus_device *xendev,
+int read_otherend_details(struct xenbus_device *xendev,
                                 char *id_node, char *path_node)
 {
        int err = xenbus_gather(XBT_NIL, xendev->nodename,
@@ -176,12 +166,6 @@ static int read_backend_details(struct x
 }
 
 
-static int read_frontend_details(struct xenbus_device *xendev)
-{
-       return read_otherend_details(xendev, "frontend-id", "frontend");
-}
-
-
 /* Bus type for frontend drivers. */
 static struct xen_bus_type xenbus_frontend = {
        .root = "device",
@@ -191,114 +175,16 @@ static struct xen_bus_type xenbus_fronte
        .bus = {
                .name     = "xen",
                .match    = xenbus_match,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,16)
                .probe    = xenbus_dev_probe,
                .remove   = xenbus_dev_remove,
                .shutdown = xenbus_dev_shutdown,
+#endif
        },
        .dev = {
                .bus_id = "xen",
        },
 };
-
-/* backend/<type>/<fe-uuid>/<id> => <type>-<fe-domid>-<id> */
-static int backend_bus_id(char bus_id[BUS_ID_SIZE], const char *nodename)
-{
-       int domid, err;
-       const char *devid, *type, *frontend;
-       unsigned int typelen;
-
-       type = strchr(nodename, '/');
-       if (!type)
-               return -EINVAL;
-       type++;
-       typelen = strcspn(type, "/");
-       if (!typelen || type[typelen] != '/')
-               return -EINVAL;
-
-       devid = strrchr(nodename, '/') + 1;
-
-       err = xenbus_gather(XBT_NIL, nodename, "frontend-id", "%i", &domid,
-                           "frontend", NULL, &frontend,
-                           NULL);
-       if (err)
-               return err;
-       if (strlen(frontend) == 0)
-               err = -ERANGE;
-       if (!err && !xenbus_exists(XBT_NIL, frontend, ""))
-               err = -ENOENT;
-
-       kfree(frontend);
-
-       if (err)
-               return err;
-
-       if (snprintf(bus_id, BUS_ID_SIZE,
-                    "%.*s-%i-%s", typelen, type, domid, devid) >= BUS_ID_SIZE)
-               return -ENOSPC;
-       return 0;
-}
-
-static struct xen_bus_type xenbus_backend = {
-       .root = "backend",
-       .levels = 3,            /* backend/type/<frontend>/<id> */
-       .get_bus_id = backend_bus_id,
-       .probe = xenbus_probe_backend,
-       .bus = {
-               .name     = "xen-backend",
-               .match    = xenbus_match,
-               .probe    = xenbus_dev_probe,
-               .remove   = xenbus_dev_remove,
-//             .shutdown = xenbus_dev_shutdown,
-               .uevent   = xenbus_uevent_backend,
-       },
-       .dev = {
-               .bus_id = "xen-backend",
-       },
-};
-
-static int xenbus_uevent_backend(struct device *dev, char **envp,
-                                int num_envp, char *buffer, int buffer_size)
-{
-       struct xenbus_device *xdev;
-       struct xenbus_driver *drv;
-       int i = 0;
-       int length = 0;
-
-       DPRINTK("");
-
-       if (dev == NULL)
-               return -ENODEV;
-
-       xdev = to_xenbus_device(dev);
-       if (xdev == NULL)
-               return -ENODEV;
-
-       /* stuff we want to pass to /sbin/hotplug */
-       add_uevent_var(envp, num_envp, &i, buffer, buffer_size, &length,
-                      "XENBUS_TYPE=%s", xdev->devicetype);
-
-       add_uevent_var(envp, num_envp, &i, buffer, buffer_size, &length,
-                      "XENBUS_PATH=%s", xdev->nodename);
-
-       add_uevent_var(envp, num_envp, &i, buffer, buffer_size, &length,
-                      "XENBUS_BASE_PATH=%s", xenbus_backend.root);
-
-       /* terminate, set to next free slot, shrink available space */
-       envp[i] = NULL;
-       envp = &envp[i];
-       num_envp -= i;
-       buffer = &buffer[length];
-       buffer_size -= length;
-
-       if (dev->driver) {
-               drv = to_xenbus_driver(dev->driver);
-               if (drv && drv->uevent)
-                       return drv->uevent(xdev, envp, num_envp, buffer,
-                                          buffer_size);
-       }
-
-       return 0;
-}
 
 static void otherend_changed(struct xenbus_watch *watch,
                             const char **vec, unsigned int len)
@@ -359,7 +245,7 @@ static int watch_otherend(struct xenbus_
 }
 
 
-static int xenbus_dev_probe(struct device *_dev)
+int xenbus_dev_probe(struct device *_dev)
 {
        struct xenbus_device *dev = to_xenbus_device(_dev);
        struct xenbus_driver *drv = to_xenbus_driver(_dev->driver);
@@ -406,7 +292,7 @@ fail:
        return -ENODEV;
 }
 
-static int xenbus_dev_remove(struct device *_dev)
+int xenbus_dev_remove(struct device *_dev)
 {
        struct xenbus_device *dev = to_xenbus_device(_dev);
        struct xenbus_driver *drv = to_xenbus_driver(_dev->driver);
@@ -444,14 +330,21 @@ static void xenbus_dev_shutdown(struct d
        put_device(&dev->dev);
 }
 
-static int xenbus_register_driver_common(struct xenbus_driver *drv,
-                                        struct xen_bus_type *bus)
+int xenbus_register_driver_common(struct xenbus_driver *drv,
+                                 struct xen_bus_type *bus)
 {
        int ret;
 
        drv->driver.name = drv->name;
        drv->driver.bus = &bus->bus;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,10)
        drv->driver.owner = drv->owner;
+#endif
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,16)
+       drv->driver.probe = xenbus_dev_probe;
+       drv->driver.remove = xenbus_dev_remove;
+       drv->driver.shutdown = xenbus_dev_shutdown;
+#endif
 
        mutex_lock(&xenwatch_mutex);
        ret = driver_register(&drv->driver);
@@ -475,14 +368,6 @@ int xenbus_register_frontend(struct xenb
        return 0;
 }
 EXPORT_SYMBOL_GPL(xenbus_register_frontend);
-
-int xenbus_register_backend(struct xenbus_driver *drv)
-{
-       drv->read_otherend_details = read_frontend_details;
-
-       return xenbus_register_driver_common(drv, &xenbus_backend);
-}
-EXPORT_SYMBOL_GPL(xenbus_register_backend);
 
 void xenbus_unregister_driver(struct xenbus_driver *drv)
 {
@@ -581,23 +466,29 @@ char *kasprintf(const char *fmt, ...)
 }
 
 static ssize_t xendev_show_nodename(struct device *dev,
-                                   struct device_attribute *attr, char *buf)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,13)
+                                   struct device_attribute *attr,
+#endif
+                                   char *buf)
 {
        return sprintf(buf, "%s\n", to_xenbus_device(dev)->nodename);
 }
 DEVICE_ATTR(nodename, S_IRUSR | S_IRGRP | S_IROTH, xendev_show_nodename, NULL);
 
 static ssize_t xendev_show_devtype(struct device *dev,
-                                  struct device_attribute *attr, char *buf)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,13)
+                                  struct device_attribute *attr,
+#endif
+                                  char *buf)
 {
        return sprintf(buf, "%s\n", to_xenbus_device(dev)->devicetype);
 }
 DEVICE_ATTR(devtype, S_IRUSR | S_IRGRP | S_IROTH, xendev_show_devtype, NULL);
 
 
-static int xenbus_probe_node(struct xen_bus_type *bus,
-                            const char *type,
-                            const char *nodename)
+int xenbus_probe_node(struct xen_bus_type *bus,
+                     const char *type,
+                     const char *nodename)
 {
        int err;
        struct xenbus_device *xendev;
@@ -667,55 +558,6 @@ static int xenbus_probe_frontend(const c
        return err;
 }
 
-/* backend/<typename>/<frontend-uuid>/<name> */
-static int xenbus_probe_backend_unit(const char *dir,
-                                    const char *type,
-                                    const char *name)
-{
-       char *nodename;
-       int err;
-
-       nodename = kasprintf("%s/%s", dir, name);
-       if (!nodename)
-               return -ENOMEM;
-
-       DPRINTK("%s\n", nodename);
-
-       err = xenbus_probe_node(&xenbus_backend, type, nodename);
-       kfree(nodename);
-       return err;
-}
-
-/* backend/<typename>/<frontend-domid> */
-static int xenbus_probe_backend(const char *type, const char *domid)
-{
-       char *nodename;
-       int err = 0;
-       char **dir;
-       unsigned int i, dir_n = 0;
-
-       DPRINTK("");
-
-       nodename = kasprintf("%s/%s/%s", xenbus_backend.root, type, domid);
-       if (!nodename)
-               return -ENOMEM;
-
-       dir = xenbus_directory(XBT_NIL, nodename, "", &dir_n);
-       if (IS_ERR(dir)) {
-               kfree(nodename);
-               return PTR_ERR(dir);
-       }
-
-       for (i = 0; i < dir_n; i++) {
-               err = xenbus_probe_backend_unit(nodename, type, dir[i]);
-               if (err)
-                       break;
-       }
-       kfree(dir);
-       kfree(nodename);
-       return err;
-}
-
 static int xenbus_probe_device_type(struct xen_bus_type *bus, const char *type)
 {
        int err = 0;
@@ -736,7 +578,7 @@ static int xenbus_probe_device_type(stru
        return err;
 }
 
-static int xenbus_probe_devices(struct xen_bus_type *bus)
+int xenbus_probe_devices(struct xen_bus_type *bus)
 {
        int err = 0;
        char **dir;
@@ -778,7 +620,7 @@ static int strsep_len(const char *str, c
        return (len == 0) ? i : -ERANGE;
 }
 
-static void dev_changed(const char *node, struct xen_bus_type *bus)
+void dev_changed(const char *node, struct xen_bus_type *bus)
 {
        int exists, rootlen;
        struct xenbus_device *dev;
@@ -823,23 +665,10 @@ static void frontend_changed(struct xenb
        dev_changed(vec[XS_WATCH_PATH], &xenbus_frontend);
 }
 
-static void backend_changed(struct xenbus_watch *watch,
-                           const char **vec, unsigned int len)
-{
-       DPRINTK("");
-
-       dev_changed(vec[XS_WATCH_PATH], &xenbus_backend);
-}
-
 /* We watch for devices appearing and vanishing. */
 static struct xenbus_watch fe_watch = {
        .node = "device",
        .callback = frontend_changed,
-};
-
-static struct xenbus_watch be_watch = {
-       .node = "backend",
-       .callback = backend_changed,
 };
 
 static int suspend_dev(struct device *dev, void *data)
@@ -912,7 +741,7 @@ void xenbus_suspend(void)
        DPRINTK("");
 
        bus_for_each_dev(&xenbus_frontend.bus, NULL, NULL, suspend_dev);
-       bus_for_each_dev(&xenbus_backend.bus, NULL, NULL, suspend_dev);
+       xenbus_backend_suspend(suspend_dev);
        xs_suspend();
 }
 EXPORT_SYMBOL_GPL(xenbus_suspend);
@@ -922,7 +751,7 @@ void xenbus_resume(void)
        xb_init_comms();
        xs_resume();
        bus_for_each_dev(&xenbus_frontend.bus, NULL, NULL, resume_dev);
-       bus_for_each_dev(&xenbus_backend.bus, NULL, NULL, resume_dev);
+       xenbus_backend_resume(resume_dev);
 }
 EXPORT_SYMBOL_GPL(xenbus_resume);
 
@@ -955,20 +784,17 @@ void xenbus_probe(void *unused)
 {
        BUG_ON((xenstored_ready <= 0));
 
-       /* Enumerate devices in xenstore. */
+       /* Enumerate devices in xenstore and watch for changes. */
        xenbus_probe_devices(&xenbus_frontend);
-       xenbus_probe_devices(&xenbus_backend);
-
-       /* Watch for changes. */
        register_xenbus_watch(&fe_watch);
-       register_xenbus_watch(&be_watch);
+       xenbus_backend_probe_and_watch();
 
        /* Notify others that xenstore is up */
        notifier_call_chain(&xenstore_chain, 0, NULL);
 }
 
 
-#ifdef CONFIG_PROC_FS
+#if defined(CONFIG_PROC_FS) && defined(CONFIG_XEN_PRIVILEGED_GUEST)
 static struct file_operations xsd_kva_fops;
 static struct proc_dir_entry *xsd_kva_intf;
 static struct proc_dir_entry *xsd_port_intf;
@@ -1020,7 +846,7 @@ static int __init xenbus_probe_init(void
 
        /* Register ourselves with the kernel bus subsystem */
        bus_register(&xenbus_frontend.bus);
-       bus_register(&xenbus_backend.bus);
+       xenbus_backend_bus_register();
 
        /*
         * Domain0 doesn't have a store_evtchn or store_mfn yet.
@@ -1049,7 +875,7 @@ static int __init xenbus_probe_init(void
                xen_store_evtchn = xen_start_info->store_evtchn =
                        alloc_unbound.port;
 
-#ifdef CONFIG_PROC_FS
+#if defined(CONFIG_PROC_FS) && defined(CONFIG_XEN_PRIVILEGED_GUEST)
                /* And finally publish the above info in /proc/xen */
                xsd_kva_intf = create_xen_proc_entry("xsd_kva", 0600);
                if (xsd_kva_intf) {
@@ -1091,7 +917,7 @@ static int __init xenbus_probe_init(void
 
        /* Register ourselves with the kernel device subsystem */
        device_register(&xenbus_frontend.dev);
-       device_register(&xenbus_backend.dev);
+       xenbus_backend_device_register();
 
        if (!is_initial_xendomain())
                xenbus_probe(NULL);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_xs.c
--- a/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_xs.c       Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_xs.c       Thu Nov 09 
15:37:17 2006 -0500
@@ -42,8 +42,14 @@
 #include <linux/fcntl.h>
 #include <linux/kthread.h>
 #include <linux/rwsem.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
 #include <xen/xenbus.h>
 #include "xenbus_comms.h"
+
+#ifdef HAVE_XEN_PLATFORM_COMPAT_H
+#include <xen/platform-compat.h>
+#endif
 
 /* xenbus_probe.c */
 extern char *kasprintf(const char *fmt, ...);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/fixmap.h
--- a/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/fixmap.h       Fri Nov 
03 16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/fixmap.h       Thu Nov 
09 15:37:17 2006 -0500
@@ -27,7 +27,6 @@ extern unsigned long __FIXADDR_TOP;
 #include <asm/acpi.h>
 #include <asm/apicdef.h>
 #include <asm/page.h>
-#include <xen/gnttab.h>
 #ifdef CONFIG_HIGHMEM
 #include <linux/threads.h>
 #include <asm/kmap_types.h>
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/hypercall.h
--- a/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/hypercall.h    Fri Nov 
03 16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/hypercall.h    Thu Nov 
09 15:37:17 2006 -0500
@@ -260,6 +260,8 @@ HYPERVISOR_event_channel_op(
        int cmd, void *arg)
 {
        int rc = _hypercall2(int, event_channel_op, cmd, arg);
+
+#ifdef CONFIG_XEN_COMPAT_030002
        if (unlikely(rc == -ENOSYS)) {
                struct evtchn_op op;
                op.cmd = cmd;
@@ -267,6 +269,8 @@ HYPERVISOR_event_channel_op(
                rc = _hypercall1(int, event_channel_op_compat, &op);
                memcpy(arg, &op.u, sizeof(op.u));
        }
+#endif
+
        return rc;
 }
 
@@ -296,6 +300,8 @@ HYPERVISOR_physdev_op(
        int cmd, void *arg)
 {
        int rc = _hypercall2(int, physdev_op, cmd, arg);
+
+#ifdef CONFIG_XEN_COMPAT_030002
        if (unlikely(rc == -ENOSYS)) {
                struct physdev_op op;
                op.cmd = cmd;
@@ -303,6 +309,8 @@ HYPERVISOR_physdev_op(
                rc = _hypercall1(int, physdev_op_compat, &op);
                memcpy(arg, &op.u, sizeof(op.u));
        }
+#endif
+
        return rc;
 }
 
@@ -350,9 +358,11 @@ HYPERVISOR_suspend(
        int rc = _hypercall3(int, sched_op, SCHEDOP_shutdown,
                             &sched_shutdown, srec);
 
+#ifdef CONFIG_XEN_COMPAT_030002
        if (rc == -ENOSYS)
                rc = _hypercall3(int, sched_op_compat, SCHEDOP_shutdown,
                                 SHUTDOWN_suspend, srec);
+#endif
 
        return rc;
 }
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/hypervisor.h
--- a/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/hypervisor.h   Fri Nov 
03 16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/hypervisor.h   Thu Nov 
09 15:37:17 2006 -0500
@@ -131,8 +131,10 @@ HYPERVISOR_yield(
 {
        int rc = HYPERVISOR_sched_op(SCHEDOP_yield, NULL);
 
+#ifdef CONFIG_XEN_COMPAT_030002
        if (rc == -ENOSYS)
                rc = HYPERVISOR_sched_op_compat(SCHEDOP_yield, 0);
+#endif
 
        return rc;
 }
@@ -143,8 +145,10 @@ HYPERVISOR_block(
 {
        int rc = HYPERVISOR_sched_op(SCHEDOP_block, NULL);
 
+#ifdef CONFIG_XEN_COMPAT_030002
        if (rc == -ENOSYS)
                rc = HYPERVISOR_sched_op_compat(SCHEDOP_block, 0);
+#endif
 
        return rc;
 }
@@ -159,8 +163,10 @@ HYPERVISOR_shutdown(
 
        int rc = HYPERVISOR_sched_op(SCHEDOP_shutdown, &sched_shutdown);
 
+#ifdef CONFIG_XEN_COMPAT_030002
        if (rc == -ENOSYS)
                rc = HYPERVISOR_sched_op_compat(SCHEDOP_shutdown, reason);
+#endif
 
        return rc;
 }
@@ -177,8 +183,10 @@ HYPERVISOR_poll(
        set_xen_guest_handle(sched_poll.ports, ports);
 
        rc = HYPERVISOR_sched_op(SCHEDOP_poll, &sched_poll);
+#ifdef CONFIG_XEN_COMPAT_030002
        if (rc == -ENOSYS)
                rc = HYPERVISOR_sched_op_compat(SCHEDOP_yield, 0);
+#endif
 
        return rc;
 }
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/synch_bitops.h
--- a/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/synch_bitops.h Fri Nov 
03 16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/synch_bitops.h Thu Nov 
09 15:37:17 2006 -0500
@@ -8,6 +8,10 @@
  */
 
 #include <linux/config.h>
+
+#ifdef HAVE_XEN_PLATFORM_COMPAT_H
+#include <xen/platform-compat.h>
+#endif
 
 #define ADDR (*(volatile long *) addr)
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/include/asm-i386/mach-xen/setup_arch_post.h
--- a/linux-2.6-xen-sparse/include/asm-i386/mach-xen/setup_arch_post.h  Fri Nov 
03 16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/include/asm-i386/mach-xen/setup_arch_post.h  Thu Nov 
09 15:37:17 2006 -0500
@@ -56,15 +56,15 @@ static void __init machine_specific_arch
        struct xen_machphys_mapping mapping;
        unsigned long machine_to_phys_nr_ents;
        struct xen_platform_parameters pp;
-       struct callback_register event = {
+       static struct callback_register __initdata event = {
                .type = CALLBACKTYPE_event,
                .address = { __KERNEL_CS, (unsigned long)hypervisor_callback },
        };
-       struct callback_register failsafe = {
+       static struct callback_register __initdata failsafe = {
                .type = CALLBACKTYPE_failsafe,
                .address = { __KERNEL_CS, (unsigned long)failsafe_callback },
        };
-       struct callback_register nmi_cb = {
+       static struct callback_register __initdata nmi_cb = {
                .type = CALLBACKTYPE_nmi,
                .address = { __KERNEL_CS, (unsigned long)nmi },
        };
@@ -72,19 +72,24 @@ static void __init machine_specific_arch
        ret = HYPERVISOR_callback_op(CALLBACKOP_register, &event);
        if (ret == 0)
                ret = HYPERVISOR_callback_op(CALLBACKOP_register, &failsafe);
+#ifdef CONFIG_XEN_COMPAT_030002
        if (ret == -ENOSYS)
                ret = HYPERVISOR_set_callbacks(
                        event.address.cs, event.address.eip,
                        failsafe.address.cs, failsafe.address.eip);
+#endif
        BUG_ON(ret);
 
        ret = HYPERVISOR_callback_op(CALLBACKOP_register, &nmi_cb);
+#ifdef CONFIG_XEN_COMPAT_030002
        if (ret == -ENOSYS) {
-               struct xennmi_callback cb;
+               static struct xennmi_callback __initdata cb = {
+                       .handler_address = (unsigned long)nmi
+               };
 
-               cb.handler_address = nmi_cb.address.eip;
                HYPERVISOR_nmi_op(XENNMI_register_callback, &cb);
        }
+#endif
 
        if (HYPERVISOR_xen_version(XENVER_platform_parameters,
                                   &pp) == 0)
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/include/asm-ia64/hypercall.h
--- a/linux-2.6-xen-sparse/include/asm-ia64/hypercall.h Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/include/asm-ia64/hypercall.h Thu Nov 09 15:37:17 
2006 -0500
@@ -33,11 +33,12 @@
 #ifndef __HYPERCALL_H__
 #define __HYPERCALL_H__
 
-#include <linux/string.h> /* memcpy() */
-
 #ifndef __HYPERVISOR_H__
 # error "please don't include this file directly"
 #endif
+
+#include <asm/xen/xcom_hcall.h>
+struct xencomm_handle;
 
 /*
  * Assembler stubs for hyper-calls.
@@ -157,157 +158,117 @@
        (type)__res;                                            \
 })
 
-static inline int
-HYPERVISOR_sched_op_compat(
-    int cmd, unsigned long arg)
-{
-       return _hypercall2(int, sched_op_compat, cmd, arg);
-}
-
-static inline int
-HYPERVISOR_sched_op(
-       int cmd, void *arg)
+
+static inline int
+xencomm_arch_hypercall_sched_op(int cmd, struct xencomm_handle *arg)
 {
        return _hypercall2(int, sched_op, cmd, arg);
 }
 
 static inline long
-HYPERVISOR_set_timer_op(
-    u64 timeout)
-{
-    unsigned long timeout_hi = (unsigned long)(timeout>>32);
-    unsigned long timeout_lo = (unsigned long)timeout;
-    return _hypercall2(long, set_timer_op, timeout_lo, timeout_hi);
-}
-
-static inline int
-HYPERVISOR_dom0_op(
-    dom0_op_t *dom0_op)
-{
-    dom0_op->interface_version = DOM0_INTERFACE_VERSION;
-    return _hypercall1(int, dom0_op, dom0_op);
-}
-
-static inline int
-HYPERVISOR_multicall(
-    void *call_list, int nr_calls)
-{
-    return _hypercall2(int, multicall, call_list, nr_calls);
-}
-
-//XXX xen/ia64 copy_from_guest() is broken.
-//    This is a temporal work around until it is fixed.
-static inline int
-____HYPERVISOR_memory_op(
-    unsigned int cmd, void *arg)
-{
-    return _hypercall2(int, memory_op, cmd, arg);
-}
-
-#include <xen/interface/memory.h>
-#ifdef CONFIG_VMX_GUEST
-# define ia64_xenmem_reservation_op(op, xmr) (0)
-#else
-int ia64_xenmem_reservation_op(unsigned long op,
-                  struct xen_memory_reservation* reservation__);
-#endif
-static inline int
-HYPERVISOR_memory_op(
-    unsigned int cmd, void *arg)
-{
-    switch (cmd) {
-    case XENMEM_increase_reservation:
-    case XENMEM_decrease_reservation:
-    case XENMEM_populate_physmap:
-        return ia64_xenmem_reservation_op(cmd, 
-                                          (struct xen_memory_reservation*)arg);
-    default:
-        return ____HYPERVISOR_memory_op(cmd, arg);
-    }
-    /* NOTREACHED */
-}
-
-static inline int
-HYPERVISOR_event_channel_op(
-    int cmd, void *arg)
-{
-    int rc = _hypercall2(int, event_channel_op, cmd, arg);
-    if (unlikely(rc == -ENOSYS)) {
-        struct evtchn_op op;
-        op.cmd = cmd;
-        memcpy(&op.u, arg, sizeof(op.u));
-        rc = _hypercall1(int, event_channel_op_compat, &op);
-    }
-    return rc;
-}
-
-static inline int
-HYPERVISOR_acm_op(
-       unsigned int cmd, void *arg)
-{
-    return _hypercall2(int, acm_op, cmd, arg);
-}
-
-static inline int
-HYPERVISOR_xen_version(
-    int cmd, void *arg)
-{
-    return _hypercall2(int, xen_version, cmd, arg);
-}
-
-static inline int
-HYPERVISOR_console_io(
-    int cmd, int count, char *str)
-{
-    return _hypercall3(int, console_io, cmd, count, str);
-}
-
-static inline int
-HYPERVISOR_physdev_op(
-    int cmd, void *arg)
-{
-    int rc = _hypercall2(int, physdev_op, cmd, arg);
-    if (unlikely(rc == -ENOSYS)) {
-        struct physdev_op op;
-        op.cmd = cmd;
-        memcpy(&op.u, arg, sizeof(op.u));
-        rc = _hypercall1(int, physdev_op_compat, &op);
-    }
-    return rc;
-}
-
-//XXX __HYPERVISOR_grant_table_op is used for this hypercall constant.
-static inline int
-____HYPERVISOR_grant_table_op(
-    unsigned int cmd, void *uop, unsigned int count,
-    unsigned long pa1, unsigned long pa2)
-{
-    return _hypercall5(int, grant_table_op, cmd, uop, count, pa1, pa2);
+HYPERVISOR_set_timer_op(u64 timeout)
+{
+       unsigned long timeout_hi = (unsigned long)(timeout >> 32);
+       unsigned long timeout_lo = (unsigned long)timeout;
+       return _hypercall2(long, set_timer_op, timeout_lo, timeout_hi);
+}
+
+static inline int
+xencomm_arch_hypercall_dom0_op(struct xencomm_handle *op)
+{
+       return _hypercall1(int, dom0_op, op);
+}
+
+static inline int
+xencomm_arch_hypercall_sysctl(struct xencomm_handle *op)
+{
+       return _hypercall1(int, sysctl, op);
+}
+
+static inline int
+xencomm_arch_hypercall_domctl(struct xencomm_handle *op)
+{
+       return _hypercall1(int, domctl, op);
+}
+
+static inline int
+xencomm_arch_hypercall_multicall(struct xencomm_handle *call_list,
+                                int nr_calls)
+{
+       return _hypercall2(int, multicall, call_list, nr_calls);
+}
+
+static inline int
+xencomm_arch_hypercall_memory_op(unsigned int cmd, struct xencomm_handle *arg)
+{
+       return _hypercall2(int, memory_op, cmd, arg);
+}
+
+static inline int
+xencomm_arch_hypercall_event_channel_op(int cmd, struct xencomm_handle *arg)
+{
+       return _hypercall2(int, event_channel_op, cmd, arg);
+}
+
+static inline int
+xencomm_arch_hypercall_acm_op(unsigned int cmd, struct xencomm_handle *arg)
+{
+       return _hypercall2(int, acm_op, cmd, arg);
+}
+
+static inline int
+xencomm_arch_hypercall_xen_version(int cmd, struct xencomm_handle *arg)
+{
+       return _hypercall2(int, xen_version, cmd, arg);
+}
+
+static inline int
+xencomm_arch_hypercall_console_io(int cmd, int count,
+                                  struct xencomm_handle *str)
+{
+       return _hypercall3(int, console_io, cmd, count, str);
+}
+
+static inline int
+xencomm_arch_hypercall_physdev_op(int cmd, struct xencomm_handle *arg)
+{
+       return _hypercall2(int, physdev_op, cmd, arg);
+}
+
+static inline int
+xencomm_arch_hypercall_grant_table_op(unsigned int cmd,
+                                      struct xencomm_handle *uop,
+                                      unsigned int count)
+{
+       return _hypercall3(int, grant_table_op, cmd, uop, count);
 }
 
 int HYPERVISOR_grant_table_op(unsigned int cmd, void *uop, unsigned int count);
 
-static inline int
-HYPERVISOR_vcpu_op(
-       int cmd, int vcpuid, void *extra_args)
-{
-    return _hypercall3(int, vcpu_op, cmd, vcpuid, extra_args);
-}
-
-extern int HYPERVISOR_suspend(unsigned long srec);
-
-static inline unsigned long
-HYPERVISOR_hvm_op(
-       int cmd, void *arg)
+extern int xencomm_arch_hypercall_suspend(struct xencomm_handle *arg);
+
+static inline int
+xencomm_arch_hypercall_callback_op(int cmd, struct xencomm_handle *arg)
+{
+       return _hypercall2(int, callback_op, cmd, arg);
+}
+
+static inline unsigned long
+xencomm_arch_hypercall_hvm_op(int cmd, void *arg)
 {
        return _hypercall2(unsigned long, hvm_op, cmd, arg);
 }
 
 static inline int
-HYPERVISOR_callback_op(
-       int cmd, void *arg)
-{
-       return _hypercall2(int, callback_op, cmd, arg);
+HYPERVISOR_physdev_op(int cmd, void *arg)
+{
+       switch (cmd) {
+       case PHYSDEVOP_eoi:
+               return _hypercall1(int, ia64_fast_eoi,
+                                  ((struct physdev_eoi *)arg)->irq);
+       default:
+               return xencomm_hypercall_physdev_op(cmd, arg);
+       }
 }
 
 extern fastcall unsigned int __do_IRQ(unsigned int irq, struct pt_regs *regs);
@@ -322,6 +283,9 @@ static inline void exit_idle(void) {}
 #ifdef CONFIG_XEN
 #include <asm/xen/privop.h>
 #endif /* CONFIG_XEN */
+#ifdef HAVE_XEN_PLATFORM_COMPAT_H
+#include <xen/platform-compat.h>
+#endif
 
 static inline unsigned long
 __HYPERVISOR_ioremap(unsigned long ioaddr, unsigned long size)
@@ -417,7 +381,42 @@ HYPERVISOR_add_physmap(unsigned long gpf
        return ret;
 }
 
+#ifdef CONFIG_XEN_IA64_EXPOSE_P2M
+static inline unsigned long
+HYPERVISOR_expose_p2m(unsigned long conv_start_gpfn,
+                      unsigned long assign_start_gpfn,
+                      unsigned long expose_size, unsigned long granule_pfn)
+{
+       return _hypercall5(unsigned long, ia64_dom0vp_op,
+                          IA64_DOM0VP_expose_p2m, conv_start_gpfn,
+                          assign_start_gpfn, expose_size, granule_pfn);
+}
+#endif
+
 // for balloon driver
 #define HYPERVISOR_update_va_mapping(va, new_val, flags) (0)
 
+/* Use xencomm to do hypercalls.  */
+#ifdef MODULE
+#define HYPERVISOR_sched_op xencomm_mini_hypercall_sched_op
+#define HYPERVISOR_event_channel_op xencomm_mini_hypercall_event_channel_op
+#define HYPERVISOR_callback_op xencomm_mini_hypercall_callback_op
+#define HYPERVISOR_multicall xencomm_mini_hypercall_multicall
+#define HYPERVISOR_xen_version xencomm_mini_hypercall_xen_version
+#define HYPERVISOR_console_io xencomm_mini_hypercall_console_io
+#define HYPERVISOR_hvm_op xencomm_mini_hypercall_hvm_op
+#define HYPERVISOR_memory_op xencomm_mini_hypercall_memory_op
+#else
+#define HYPERVISOR_sched_op xencomm_hypercall_sched_op
+#define HYPERVISOR_event_channel_op xencomm_hypercall_event_channel_op
+#define HYPERVISOR_callback_op xencomm_hypercall_callback_op
+#define HYPERVISOR_multicall xencomm_hypercall_multicall
+#define HYPERVISOR_xen_version xencomm_hypercall_xen_version
+#define HYPERVISOR_console_io xencomm_hypercall_console_io
+#define HYPERVISOR_hvm_op xencomm_hypercall_hvm_op
+#define HYPERVISOR_memory_op xencomm_hypercall_memory_op
+#endif
+
+#define HYPERVISOR_suspend xencomm_hypercall_suspend
+
 #endif /* __HYPERCALL_H__ */
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/include/asm-ia64/hypervisor.h
--- a/linux-2.6-xen-sparse/include/asm-ia64/hypervisor.h        Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/include/asm-ia64/hypervisor.h        Thu Nov 09 
15:37:17 2006 -0500
@@ -75,9 +75,6 @@ HYPERVISOR_yield(
 {
        int rc = HYPERVISOR_sched_op(SCHEDOP_yield, NULL);
 
-       if (rc == -ENOSYS)
-               rc = HYPERVISOR_sched_op_compat(SCHEDOP_yield, 0);
-
        return rc;
 }
 
@@ -86,9 +83,6 @@ HYPERVISOR_block(
        void)
 {
        int rc = HYPERVISOR_sched_op(SCHEDOP_block, NULL);
-
-       if (rc == -ENOSYS)
-               rc = HYPERVISOR_sched_op_compat(SCHEDOP_block, 0);
 
        return rc;
 }
@@ -102,9 +96,6 @@ HYPERVISOR_shutdown(
        };
 
        int rc = HYPERVISOR_sched_op(SCHEDOP_shutdown, &sched_shutdown);
-
-       if (rc == -ENOSYS)
-               rc = HYPERVISOR_sched_op_compat(SCHEDOP_shutdown, reason);
 
        return rc;
 }
@@ -122,8 +113,6 @@ HYPERVISOR_poll(
 
        set_xen_guest_handle(sched_poll.ports, ports);
        rc = HYPERVISOR_sched_op(SCHEDOP_poll, &sched_poll);
-       if (rc == -ENOSYS)
-               rc = HYPERVISOR_sched_op_compat(SCHEDOP_yield, 0);
 
        return rc;
 }
@@ -202,6 +191,22 @@ MULTI_grant_table_op(multicall_entry_t *
        mcl->args[2] = count;
 }
 
+/*
+ * for blktap.c
+ * int create_lookup_pte_addr(struct mm_struct *mm, 
+ *                            unsigned long address,
+ *                            uint64_t *ptep);
+ */
+#define create_lookup_pte_addr(mm, address, ptep)                      \
+       ({                                                              \
+               printk(KERN_EMERG                                       \
+                      "%s:%d "                                         \
+                      "create_lookup_pte_addr() isn't supported.\n",   \
+                      __func__, __LINE__);                             \
+               BUG();                                                  \
+               (-ENOSYS);                                              \
+       })
+
 // for debug
 asmlinkage int xprintk(const char *fmt, ...);
 #define xprintd(fmt, ...)      xprintk("%s:%d " fmt, __func__, __LINE__, \
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/include/asm-ia64/maddr.h
--- a/linux-2.6-xen-sparse/include/asm-ia64/maddr.h     Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/include/asm-ia64/maddr.h     Thu Nov 09 15:37:17 
2006 -0500
@@ -10,11 +10,26 @@
 
 #define INVALID_P2M_ENTRY       (~0UL)
 
+#ifdef CONFIG_XEN_IA64_EXPOSE_P2M
+extern int p2m_initialized;
+extern unsigned long p2m_min_low_pfn;
+extern unsigned long p2m_max_low_pfn;
+extern unsigned long p2m_convert_min_pfn;
+extern unsigned long p2m_convert_max_pfn;
+extern volatile const pte_t* p2m_pte;
+unsigned long p2m_phystomach(unsigned long gpfn);
+#else
+#define p2m_initialized                (0)
+#define p2m_phystomach(gpfn)   INVALID_MFN
+#endif
+
 /* XXX xen page size != page size */
 static inline unsigned long
 pfn_to_mfn_for_dma(unsigned long pfn)
 {
        unsigned long mfn;
+       if (p2m_initialized)
+               return p2m_phystomach(pfn);
        mfn = HYPERVISOR_phystomach(pfn);
        BUG_ON(mfn == 0); // XXX
        BUG_ON(mfn == INVALID_P2M_ENTRY); // XXX
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/include/asm-ia64/xen/privop.h
--- a/linux-2.6-xen-sparse/include/asm-ia64/xen/privop.h        Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/include/asm-ia64/xen/privop.h        Thu Nov 09 
15:37:17 2006 -0500
@@ -14,12 +14,9 @@
 
 #define IA64_PARAVIRTUALIZED
 
-#if 0
-#undef XSI_BASE
 /* At 1 MB, before per-cpu space but still addressable using addl instead
    of movl. */
 #define XSI_BASE                               0xfffffffffff00000
-#endif
 
 /* Address of mapped regs.  */
 #define XMAPPEDREGS_BASE               (XSI_BASE + XSI_SIZE)
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/asm/fixmap.h
--- a/linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/asm/fixmap.h     Fri Nov 
03 16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/asm/fixmap.h     Thu Nov 
09 15:37:17 2006 -0500
@@ -14,7 +14,6 @@
 #include <linux/config.h>
 #include <linux/kernel.h>
 #include <asm/apicdef.h>
-#include <xen/gnttab.h>
 #include <asm/page.h>
 #include <asm/vsyscall.h>
 #include <asm/vsyscall32.h>
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/asm/hypercall.h
--- a/linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/asm/hypercall.h  Fri Nov 
03 16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/asm/hypercall.h  Thu Nov 
09 15:37:17 2006 -0500
@@ -258,6 +258,8 @@ HYPERVISOR_event_channel_op(
        int cmd, void *arg)
 {
        int rc = _hypercall2(int, event_channel_op, cmd, arg);
+
+#ifdef CONFIG_XEN_COMPAT_030002
        if (unlikely(rc == -ENOSYS)) {
                struct evtchn_op op;
                op.cmd = cmd;
@@ -265,6 +267,8 @@ HYPERVISOR_event_channel_op(
                rc = _hypercall1(int, event_channel_op_compat, &op);
                memcpy(arg, &op.u, sizeof(op.u));
        }
+#endif
+
        return rc;
 }
 
@@ -294,6 +298,8 @@ HYPERVISOR_physdev_op(
        int cmd, void *arg)
 {
        int rc = _hypercall2(int, physdev_op, cmd, arg);
+
+#ifdef CONFIG_XEN_COMPAT_030002
        if (unlikely(rc == -ENOSYS)) {
                struct physdev_op op;
                op.cmd = cmd;
@@ -301,6 +307,8 @@ HYPERVISOR_physdev_op(
                rc = _hypercall1(int, physdev_op_compat, &op);
                memcpy(arg, &op.u, sizeof(op.u));
        }
+#endif
+
        return rc;
 }
 
@@ -351,9 +359,11 @@ HYPERVISOR_suspend(
        int rc = _hypercall3(int, sched_op, SCHEDOP_shutdown,
                             &sched_shutdown, srec);
 
+#ifdef CONFIG_XEN_COMPAT_030002
        if (rc == -ENOSYS)
                rc = _hypercall3(int, sched_op_compat, SCHEDOP_shutdown,
                                 SHUTDOWN_suspend, srec);
+#endif
 
        return rc;
 }
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/setup_arch_post.h
--- a/linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/setup_arch_post.h        
Fri Nov 03 16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/setup_arch_post.h        
Thu Nov 09 15:37:17 2006 -0500
@@ -15,20 +15,20 @@ static void __init machine_specific_arch
 static void __init machine_specific_arch_setup(void)
 {
        int ret;
-       struct callback_register event = {
+       static struct callback_register __initdata event = {
                .type = CALLBACKTYPE_event,
                .address = (unsigned long) hypervisor_callback,
        };
-       struct callback_register failsafe = {
+       static struct callback_register __initdata failsafe = {
                .type = CALLBACKTYPE_failsafe,
                .address = (unsigned long)failsafe_callback,
        };
-       struct callback_register syscall = {
+       static struct callback_register __initdata syscall = {
                .type = CALLBACKTYPE_syscall,
                .address = (unsigned long)system_call,
        };
 #ifdef CONFIG_X86_LOCAL_APIC
-       struct callback_register nmi_cb = {
+       static struct callback_register __initdata nmi_cb = {
                .type = CALLBACKTYPE_nmi,
                .address = (unsigned long)nmi,
        };
@@ -39,20 +39,25 @@ static void __init machine_specific_arch
                ret = HYPERVISOR_callback_op(CALLBACKOP_register, &failsafe);
        if (ret == 0)
                ret = HYPERVISOR_callback_op(CALLBACKOP_register, &syscall);
+#ifdef CONFIG_XEN_COMPAT_030002
        if (ret == -ENOSYS)
                ret = HYPERVISOR_set_callbacks(
                        event.address,
                        failsafe.address,
                        syscall.address);
+#endif
        BUG_ON(ret);
 
 #ifdef CONFIG_X86_LOCAL_APIC
        ret = HYPERVISOR_callback_op(CALLBACKOP_register, &nmi_cb);
+#ifdef CONFIG_XEN_COMPAT_030002
        if (ret == -ENOSYS) {
-               struct xennmi_callback cb;
+               static struct xennmi_callback __initdata cb = {
+                       .handler_address = (unsigned long)nmi
+               };
 
-               cb.handler_address = nmi_cb.address;
                HYPERVISOR_nmi_op(XENNMI_register_callback, &cb);
        }
 #endif
+#endif
 }
diff -r b30cb72ed5e2 -r 4d4f0d52c193 linux-2.6-xen-sparse/include/xen/gnttab.h
--- a/linux-2.6-xen-sparse/include/xen/gnttab.h Fri Nov 03 16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/include/xen/gnttab.h Thu Nov 09 15:37:17 2006 -0500
@@ -39,6 +39,7 @@
 
 #include <linux/config.h>
 #include <asm/hypervisor.h>
+#include <asm/maddr.h> /* maddr_t */
 #include <xen/interface/grant_table.h>
 #include <xen/features.h>
 
@@ -118,7 +119,7 @@ int gnttab_resume(void);
 int gnttab_resume(void);
 
 static inline void
-gnttab_set_map_op(struct gnttab_map_grant_ref *map, unsigned long addr,
+gnttab_set_map_op(struct gnttab_map_grant_ref *map, maddr_t addr,
                  uint32_t flags, grant_ref_t ref, domid_t domid)
 {
        if (flags & GNTMAP_contains_pte)
@@ -134,7 +135,7 @@ gnttab_set_map_op(struct gnttab_map_gran
 }
 
 static inline void
-gnttab_set_unmap_op(struct gnttab_unmap_grant_ref *unmap, unsigned long addr,
+gnttab_set_unmap_op(struct gnttab_unmap_grant_ref *unmap, maddr_t addr,
                    uint32_t flags, grant_handle_t handle)
 {
        if (flags & GNTMAP_contains_pte)
diff -r b30cb72ed5e2 -r 4d4f0d52c193 linux-2.6-xen-sparse/include/xen/xenbus.h
--- a/linux-2.6-xen-sparse/include/xen/xenbus.h Fri Nov 03 16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/include/xen/xenbus.h Thu Nov 09 15:37:17 2006 -0500
@@ -38,6 +38,7 @@
 #include <linux/notifier.h>
 #include <linux/mutex.h>
 #include <linux/completion.h>
+#include <linux/init.h>
 #include <xen/interface/xen.h>
 #include <xen/interface/grant_table.h>
 #include <xen/interface/io/xenbus.h>
diff -r b30cb72ed5e2 -r 4d4f0d52c193 linux-2.6-xen-sparse/lib/Makefile
--- a/linux-2.6-xen-sparse/lib/Makefile Fri Nov 03 16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/lib/Makefile Thu Nov 09 15:37:17 2006 -0500
@@ -45,9 +45,7 @@ obj-$(CONFIG_TEXTSEARCH_FSM) += ts_fsm.o
 obj-$(CONFIG_TEXTSEARCH_FSM) += ts_fsm.o
 
 obj-$(CONFIG_SWIOTLB) += swiotlb.o
-ifneq ($(CONFIG_XEN_IA64_DOM0_NON_VP),y)
 swiotlb-$(CONFIG_XEN) := ../arch/i386/kernel/swiotlb.o
-endif
 
 hostprogs-y    := gen_crc32table
 clean-files    := crc32table.h
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/blktap/drivers/blktapctrl.c
--- a/tools/blktap/drivers/blktapctrl.c Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/blktap/drivers/blktapctrl.c Thu Nov 09 15:37:17 2006 -0500
@@ -204,81 +204,49 @@ static blkif_t *test_path(char *path, ch
 
 static void add_disktype(blkif_t *blkif, int type)
 {
-       driver_list_entry_t *entry, *ptr, *last;
-
-       if (type > MAX_DISK_TYPES) return;
+       driver_list_entry_t *entry, **pprev;
+
+       if (type > MAX_DISK_TYPES)
+               return;
 
        entry = malloc(sizeof(driver_list_entry_t));
        entry->blkif = blkif;
-       entry->next = NULL;
-       ptr = active_disks[type];
-
-       if (ptr == NULL) {
-               active_disks[type] = entry;
-               entry->prev = NULL;
-               return;
-       }
-
-       while (ptr != NULL) {
-               last = ptr;
-               ptr = ptr->next;
-       }
-
-       /*We've found the end of the list*/
-        last->next = entry;
-       entry->prev = last;
-       
-       return;
+       entry->next  = NULL;
+
+       pprev = &active_disks[type];
+       while (*pprev != NULL)
+               pprev = &(*pprev)->next;
+
+       *pprev = entry;
+       entry->pprev = pprev;
 }
 
 static int del_disktype(blkif_t *blkif)
 {
-       driver_list_entry_t *ptr, *cur, *last;
+       driver_list_entry_t *entry, **pprev;
        int type = blkif->drivertype, count = 0, close = 0;
 
-       if (type > MAX_DISK_TYPES) return 1;
-
-       ptr = active_disks[type];
-       last = NULL;
-       while (ptr != NULL) {
-               count++;
-               if (blkif == ptr->blkif) {
-                       cur = ptr;
-                       if (ptr->next != NULL) {
-                               /*There's more later in the chain*/
-                               if (!last) {
-                                       /*We're first in the list*/
-                                       active_disks[type] = ptr->next;
-                                       ptr = ptr->next;
-                                       ptr->prev = NULL;
-                               }
-                               else {
-                                       /*We're sandwiched*/
-                                       last->next = ptr->next;
-                                       ptr = ptr->next;
-                                       ptr->prev = last;
-                               }
-                               
-                       } else if (last) {
-                               /*There's more earlier in the chain*/
-                               last->next = NULL;
-                       } else {
-                               /*We're the only entry*/
-                               active_disks[type] = NULL;
-                               if(dtypes[type]->single_handler == 1) 
-                                       close = 1;
-                       }
-                       DPRINTF("DEL_DISKTYPE: Freeing entry\n");
-                       free(cur);
-                       if (dtypes[type]->single_handler == 0) close = 1;
-
-                       return close;
-               }
-               last = ptr;
-               ptr = ptr->next;
-       }
-       DPRINTF("DEL_DISKTYPE: No match\n");
-       return 1;
+       if (type > MAX_DISK_TYPES)
+               return 1;
+
+       pprev = &active_disks[type];
+       while ((*pprev != NULL) && ((*pprev)->blkif != blkif))
+               pprev = &(*pprev)->next;
+
+       if ((entry = *pprev) == NULL) {
+               DPRINTF("DEL_DISKTYPE: No match\n");
+               return 1;
+       }
+
+       *pprev = entry->next;
+       if (entry->next)
+               entry->next->pprev = pprev;
+
+       DPRINTF("DEL_DISKTYPE: Freeing entry\n");
+       free(entry);
+
+       /* Caller should close() if no single controller, or list is empty. */
+       return (!dtypes[type]->single_handler || (active_disks[type] == NULL));
 }
 
 static int write_msg(int fd, int msgtype, void *ptr, void *ptr2)
@@ -592,8 +560,8 @@ int unmap_blktapctrl(blkif_t *blkif)
        if (del_disktype(blkif)) {
                close(blkif->fds[WRITE]);
                close(blkif->fds[READ]);
-
-       }
+       }
+
        return 0;
 }
 
@@ -639,9 +607,11 @@ int main(int argc, char *argv[])
        struct xs_handle *h;
        struct pollfd  pfd[NUM_POLL_FDS];
        pid_t process;
+       char buf[128];
 
        __init_blkif();
-       openlog("BLKTAPCTRL", LOG_CONS|LOG_ODELAY, LOG_DAEMON);
+       snprintf(buf, sizeof(buf), "BLKTAPCTRL[%d]", getpid());
+       openlog(buf, LOG_CONS|LOG_ODELAY, LOG_DAEMON);
        daemon(0,0);
 
        print_drivers();
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/blktap/drivers/tapdisk.c
--- a/tools/blktap/drivers/tapdisk.c    Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/blktap/drivers/tapdisk.c    Thu Nov 09 15:37:17 2006 -0500
@@ -79,31 +79,17 @@ static void unmap_disk(struct td_state *
 {
        tapdev_info_t *info = s->ring_info;
        struct tap_disk *drv = s->drv;
-       fd_list_entry_t *ptr, *prev;
+       fd_list_entry_t *entry;
 
        drv->td_close(s);
 
        if (info != NULL && info->mem > 0)
                munmap(info->mem, getpagesize() * BLKTAP_MMAP_REGION_SIZE);
 
-       ptr = s->fd_entry;
-       prev = ptr->prev;
-
-       if (prev) {
-               /*There are entries earlier in the list*/
-               prev->next = ptr->next;
-               if (ptr->next) {
-                       ptr = ptr->next;
-                       ptr->prev = prev;
-               }
-       } else {
-               /*We are the first entry in list*/
-               if (ptr->next) {
-                       ptr = ptr->next;
-                       fd_start = ptr;
-                       ptr->prev = NULL;
-               } else fd_start = NULL;
-       }
+       entry = s->fd_entry;
+       *entry->pprev = entry->next;
+       if (entry->next)
+               entry->next->pprev = entry->pprev;
 
        close(info->fd);
 
@@ -144,35 +130,29 @@ static inline int LOCAL_FD_SET(fd_set *r
        return 0;
 }
 
-static inline fd_list_entry_t *add_fd_entry(int tap_fd, int io_fd[MAX_IOFD], 
struct td_state *s)
-{
-       fd_list_entry_t *ptr, *last, *entry;
+static inline fd_list_entry_t *add_fd_entry(
+       int tap_fd, int io_fd[MAX_IOFD], struct td_state *s)
+{
+       fd_list_entry_t **pprev, *entry;
        int i;
+
        DPRINTF("Adding fd_list_entry\n");
 
        /*Add to linked list*/
        s->fd_entry = entry = malloc(sizeof(fd_list_entry_t));
        entry->tap_fd = tap_fd;
-       for (i = 0; i < MAX_IOFD; i++) entry->io_fd[i] = io_fd[i];
+       for (i = 0; i < MAX_IOFD; i++)
+               entry->io_fd[i] = io_fd[i];
        entry->s = s;
        entry->next = NULL;
 
-       ptr = fd_start;
-       if (ptr == NULL) {
-               /*We are the first entry*/
-               fd_start = entry;
-               entry->prev = NULL;
-               goto finish;
-       }
-
-       while (ptr != NULL) {
-               last = ptr;
-               ptr = ptr->next;
-       }
-       last->next = entry;
-       entry->prev = last;
-
- finish:
+       pprev = &fd_start;
+       while (*pprev != NULL)
+               pprev = &(*pprev)->next;
+
+       *pprev = entry;
+       entry->pprev = pprev;
+
        return entry;
 }
 
@@ -401,7 +381,6 @@ static inline int write_rsp_to_ring(stru
        
        rsp_d = RING_GET_RESPONSE(&info->fe_ring, info->fe_ring.rsp_prod_pvt);
        memcpy(rsp_d, rsp, sizeof(blkif_response_t));
-       wmb();
        info->fe_ring.rsp_prod_pvt++;
        
        return 0;
@@ -582,12 +561,14 @@ int main(int argc, char *argv[])
        fd_list_entry_t *ptr;
        struct tap_disk *drv;
        struct td_state *s;
+       char openlogbuf[128];
        
        if (argc != 3) usage();
 
        daemonize();
 
-       openlog("TAPDISK", LOG_CONS|LOG_ODELAY, LOG_DAEMON);
+       snprintf(openlogbuf, sizeof(openlogbuf), "TAPDISK[%d]", getpid());
+       openlog(openlogbuf, LOG_CONS|LOG_ODELAY, LOG_DAEMON);
        /*Setup signal handlers*/
        signal (SIGBUS, sig_handler);
        signal (SIGINT, sig_handler);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/blktap/drivers/tapdisk.h
--- a/tools/blktap/drivers/tapdisk.h    Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/blktap/drivers/tapdisk.h    Thu Nov 09 15:37:17 2006 -0500
@@ -61,7 +61,6 @@
 
 /* Things disks need to know about, these should probably be in a higher-level
  * header. */
-#define MAX_REQUESTS            64
 #define MAX_SEGMENTS_PER_REQ    11
 #define SECTOR_SHIFT             9
 #define DEFAULT_SECTOR_SIZE    512
@@ -191,9 +190,8 @@ static disk_info_t *dtypes[] = {
 };
 
 typedef struct driver_list_entry {
-       void *blkif;
-       void *prev;
-       void *next;
+       struct blkif *blkif;
+       struct driver_list_entry **pprev, *next;
 } driver_list_entry_t;
 
 typedef struct fd_list_entry {
@@ -201,8 +199,7 @@ typedef struct fd_list_entry {
        int  tap_fd;
        int  io_fd[MAX_IOFD];
        struct td_state *s;
-       void *prev;
-       void *next;
+       struct fd_list_entry **pprev, *next;
 } fd_list_entry_t;
 
 int qcow_create(const char *filename, uint64_t total_size,
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/blktap/lib/blktaplib.h
--- a/tools/blktap/lib/blktaplib.h      Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/blktap/lib/blktaplib.h      Thu Nov 09 15:37:17 2006 -0500
@@ -41,7 +41,7 @@
 #include <sys/types.h>
 #include <unistd.h>
 
-#define BLK_RING_SIZE __RING_SIZE((blkif_sring_t *)0, getpagesize())
+#define BLK_RING_SIZE __RING_SIZE((blkif_sring_t *)0, XC_PAGE_SIZE)
 
 /* size of the extra VMA area to map in attached pages. */
 #define BLKTAP_VMA_PAGES BLK_RING_SIZE
@@ -74,10 +74,10 @@ static inline int BLKTAP_MODE_VALID(unsi
                ( arg == BLKTAP_MODE_INTERPOSE    ) );
 }
 
-#define MAX_REQUESTS            64
+#define MAX_REQUESTS            BLK_RING_SIZE
 
 #define BLKTAP_IOCTL_KICK 1
-#define MAX_PENDING_REQS 64
+#define MAX_PENDING_REQS       BLK_RING_SIZE
 #define BLKTAP_DEV_DIR   "/dev/xen"
 #define BLKTAP_DEV_NAME  "blktap"
 #define BLKTAP_DEV_MINOR 0
@@ -199,7 +199,6 @@ int xs_fire_next_watch(struct xs_handle 
 
 
 /* Abitrary values, must match the underlying driver... */
-#define MAX_PENDING_REQS 64
 #define MAX_TAP_DEV 100
 
 /* Accessing attached data page mappings */
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/check/check_brctl
--- a/tools/check/check_brctl   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/check/check_brctl   Thu Nov 09 15:37:17 2006 -0500
@@ -1,10 +1,27 @@
-#!/bin/bash
+#!/bin/sh
 # CHECK-INSTALL
 
-function error {
-   echo
-   echo '  *** Check for the bridge control utils (brctl) FAILED'
-   exit 1
-}
+RC=0
 
-which brctl 1>/dev/null 2>&1 || error
+case ${OS} in
+OpenBSD|NetBSD|FreeBSD)
+       # These systems have a bridge builtin
+       TOOL="brconfig"
+       which ${TOOL} 1>/dev/null 2>&1 || RC=1 
+       ;;
+Linux)
+       TOOL="brctl"
+       which ${TOOL} 1>/dev/null 2>&1 || RC=1
+       ;;
+*)
+       TOOL=""
+       echo "Unknown OS" && RC=1
+       ;;
+esac
+
+if test ${RC} -ne 0; then
+       echo
+       echo " *** Check for the bridge control utils (${TOOL}) FAILED"
+fi
+
+exit ${RC} 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/check/check_iproute
--- a/tools/check/check_iproute Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/check/check_iproute Thu Nov 09 15:37:17 2006 -0500
@@ -1,11 +1,26 @@
-#!/bin/bash
+#!/bin/sh
 # CHECK-INSTALL
 
-function error {
-   echo
-   echo '  *** Check for iproute (ip addr) FAILED'
-   exit 1
-}
+RC=0
 
-ip addr list 1>/dev/null 2>&1 || error
+case ${OS} in
+OpenBSD|NetBSD|FreeBSD)
+       TOOL="ifconfig"
+       eval ${TOOL} -a 1>/dev/null 2>&1 || RC=1 
+       ;;
+Linux)
+       TOOL="ip addr"
+       eval ${TOOL} list 1>/dev/null 2>&1 || RC=1 
+       ;;
+*)
+       TOOL=""
+       echo "Unknown OS" && RC=1 
+       ;;
+esac
 
+if test ${RC} -ne 0; then
+       echo
+       echo " *** Check for iproute (${TOOL}) FAILED"
+fi
+
+exit ${RC} 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/check/check_python
--- a/tools/check/check_python  Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/check/check_python  Thu Nov 09 15:37:17 2006 -0500
@@ -1,10 +1,13 @@
-#!/bin/bash
+#!/bin/sh
 # CHECK-BUILD CHECK-INSTALL
 
-function error {
-    echo
-    echo "  *** Check for Python version >= 2.2 FAILED"
-    exit 1
-}
+RC=0
 
-python -V 2>&1 | cut -d ' ' -f 2 | grep -q '^2.[2345]' || error
+python -V 2>&1 | cut -d ' ' -f 2 | grep -q '^2.[2345]' || RC=1
+
+if test ${RC} -ne 0; then
+       echo
+       echo " *** Check for Python version >= 2.2 FAILED"
+fi
+
+exit ${RC} 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/check/check_zlib_devel
--- a/tools/check/check_zlib_devel      Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/check/check_zlib_devel      Thu Nov 09 15:37:17 2006 -0500
@@ -1,11 +1,14 @@
-#!/bin/bash
+#!/bin/sh
 # CHECK-BUILD
 
-function error {
-    echo
-    echo "  *** Check for zlib headers FAILED"
-    exit 1
-}
+RC=0
 
 set -e
-[ -e /usr/include/zlib.h ] || error
+test -r /usr/include/zlib.h || RC=1
+
+if test ${RC} -ne 0; then
+       echo
+       echo " *** Check for zlib headers FAILED"
+fi 
+
+exit ${RC}
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/check/check_zlib_lib
--- a/tools/check/check_zlib_lib        Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/check/check_zlib_lib        Thu Nov 09 15:37:17 2006 -0500
@@ -1,11 +1,14 @@
-#!/bin/bash
+#!/bin/sh
 # CHECK-BUILD CHECK-INSTALL
 
-function error {
-    echo
-    echo "  *** Check for zlib library FAILED"
-    exit 1
-}
+RC=0
 
 set -e
-ldconfig -p | grep -q libz.so || error
+ldconfig -v 2>&1 | grep -q libz.so || RC=1
+
+if test ${RC} -ne 0; then
+       echo
+       echo " *** Check for zlib library FAILED"
+fi
+
+exit ${RC} 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/check/chk
--- a/tools/check/chk   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/check/chk   Thu Nov 09 15:37:17 2006 -0500
@@ -1,8 +1,9 @@
-#!/bin/bash
+#!/bin/sh
 
-function usage {
+func_usage ()
+{
     echo "Usage:"
-    echo "\t$0 [build|install|clean]"
+    echo "     $0 [build|install|clean]"
     echo
     echo "Check suitability for Xen build or install."
     echo "Exit with 0 if OK, 1 if not."
@@ -12,9 +13,13 @@ function usage {
     exit 1
 }
 
-export PATH=${PATH}:/sbin:/usr/sbin
+PATH=${PATH}:/sbin:/usr/sbin
+OS=`uname -s`
+export PATH OS
 
-[ `uname -s` = SunOS ] && exit 0
+if test "${OS}" = "SunOS"; then
+       exit 0
+fi
 
 case $1 in
     build)
@@ -27,7 +32,7 @@ case $1 in
         exit 0
         ;;
     *)
-        usage
+        func_usage
         ;;
 esac
 
@@ -56,4 +61,4 @@ for f in check_* ; do
     fi
 done
 
-exit $failed
+exit ${failed}
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/console/Makefile
--- a/tools/console/Makefile    Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/console/Makefile    Thu Nov 09 15:37:17 2006 -0500
@@ -5,7 +5,7 @@ DAEMON_INSTALL_DIR = /usr/sbin
 DAEMON_INSTALL_DIR = /usr/sbin
 CLIENT_INSTALL_DIR = /usr/$(LIBDIR)/xen/bin
 
-CFLAGS  += -Werror -g
+CFLAGS  += -Werror
 
 CFLAGS  += -I $(XEN_LIBXC)
 CFLAGS  += -I $(XEN_XENSTORE)
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/examples/blktap
--- a/tools/examples/blktap     Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/examples/blktap     Thu Nov 09 15:37:17 2006 -0500
@@ -7,7 +7,7 @@ dir=$(dirname "$0")
 
 findCommand "$@"
 
-if [ "$command" == 'add' ]
+if [ "$command" = 'add' ]
 then
   success
 fi
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/examples/block
--- a/tools/examples/block      Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/examples/block      Thu Nov 09 15:37:17 2006 -0500
@@ -68,7 +68,7 @@ check_sharing()
   local devmm=$(device_major_minor "$dev")
   local file
 
-  if [ "$mode" == 'w' ]
+  if [ "$mode" = 'w' ]
   then
     toskip="^$"
   else
@@ -81,7 +81,7 @@ check_sharing()
     then
       local d=$(device_major_minor "$file")
 
-      if [ "$d" == "$devmm" ]
+      if [ "$d" = "$devmm" ]
       then
         echo 'local'
         return
@@ -96,9 +96,9 @@ check_sharing()
     do
       d=$(xenstore_read_default "$base_path/$dom/$dev/physical-device" "")
 
-      if [ "$d" == "$devmm" ]
+      if [ "$d" = "$devmm" ]
       then
-        if [ "$mode" == 'w' ]
+        if [ "$mode" = 'w' ]
         then
           if ! same_vm $dom
           then
@@ -109,7 +109,7 @@ check_sharing()
           local m=$(xenstore_read "$base_path/$dom/$dev/mode")
           m=$(canonicalise_mode "$m")
 
-          if [ "$m" == 'w' ]
+          if [ "$m" = 'w' ]
           then
             if ! same_vm $dom
             then
@@ -138,7 +138,7 @@ same_vm()
   local othervm=$(xenstore_read_default "/local/domain/$otherdom/vm"         \
                   "$FRONTEND_UUID")
 
-  [ "$FRONTEND_UUID" == "$othervm" ]
+  [ "$FRONTEND_UUID" = "$othervm" ]
 }
 
 
@@ -153,7 +153,7 @@ check_device_sharing()
   local mode=$(canonicalise_mode "$2")
   local result
 
-  if [ "$mode" == '!' ]
+  if [ "x$mode" = 'x!' ]
   then
     return 0
   fi
@@ -202,7 +202,7 @@ do_ebusy()
   local mode="$2"
   local result="$3"
 
-  if [ "$result" == 'guest' ]
+  if [ "$result" = 'guest' ]
   then
     dom='a guest '
     when='now'
@@ -211,7 +211,7 @@ do_ebusy()
     when='by a guest'
   fi
 
-  if [ "$mode" == 'w' ]
+  if [ "$mode" = 'w' ]
   then
     m1=''
     m2=''
@@ -266,7 +266,7 @@ case "$command" in
 
         claim_lock "block"
 
-        if [ "$mode" == 'w' ] && ! stat "$file" -c %A | grep -q w
+        if [ "$mode" = 'w' ] && ! stat "$file" -c %A | grep -q w
         then
           release_lock "block"
           ebusy \
@@ -287,7 +287,7 @@ mount it read-write in a guest domain."
           if [ "$f" ]
           then
             # $dev is in use.  Check sharing.
-            if [ "$mode" == '!' ]
+            if [ "x$mode" = 'x!' ]
             then
               continue
             fi
@@ -307,7 +307,7 @@ mount it read-write in a guest domain."
                 do
                   d=$(xenstore_read_default \
                         "$XENBUS_BASE_PATH/$dom/$domdev/node" "")
-                  if [ "$d" == "$dev" ]
+                  if [ "$d" = "$dev" ]
                   then
                     f=$(xenstore_read "$XENBUS_BASE_PATH/$dom/$domdev/params")
                     found=1
@@ -347,7 +347,7 @@ mount it read-write in a guest domain."
             f=$(readlink -f "$f" || echo $(dirname "$file")/$(basename "$f"))
 
 
-            if [ "$f" == "$file" ]
+            if [ "$f" = "$file" ]
             then
               check_file_sharing "$file" "$dev" "$mode"
             fi
@@ -355,14 +355,14 @@ mount it read-write in a guest domain."
             # $dev is not in use, so we'll remember it for use later; we want
             # to finish the sharing check first.
 
-            if [ "$loopdev" == '' ]
+            if [ "$loopdev" = '' ]
             then
               loopdev="$dev"
             fi
           fi
         done
 
-        if [ "$loopdev" == '' ]
+        if [ "$loopdev" = '' ]
         then
           fatal 'Failed to find an unused loop device'
         fi
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/examples/external-device-migrate
--- a/tools/examples/external-device-migrate    Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/examples/external-device-migrate    Thu Nov 09 15:37:17 2006 -0500
@@ -55,41 +55,27 @@ function evaluate_params()
 {
        local step host domname typ recover filename func stype
        stype=""
-       while [ 1 ]; do
-               if [ "$1" == "-step" ]; then
-                       shift
-                       step=$1
-               elif [ "$1" == "-host" ]; then
-                       shift
-                       host=$1
-               elif [ "$1" == "-domname" ]; then
-                       shift
-                       domname=$1
-               elif [ "$1" == "-type" ]; then
-                       shift
-                       typ=$1
-               elif [ "$1" == "-subtype" ]; then
-                       shift
-                       stype="_$1"
-               elif [ "$1" == "-recover" ]; then
-                       recover=1
-               elif [ "$1" == "-help" ]; then
-                       ext_dev_migrate_usage
-                       exit
-               else
-                       break
-               fi
-               shift
+       while [ $# -ge 1 ]; do
+               case "$1" in
+               -step)          step=$2; shift 2;;
+               -host)          host=$2; shift 2;;
+               -domname)       domname=$2; shift 2;;
+               -type)          type=$2; shift 2;;
+               -subtype)       subtype=$2; shift 2;;
+               -recover)       recover=1; shift;;
+               -help)          ext_dev_migrate_usage; exit 0;;
+               *)              break;;
+               esac
        done
 
-       if [ "$step"    == "" -o \
-            "$host"    == "" -o \
-            "$typ"     == "" -o \
-            "$domname" == "" ]; then
-               echo "Error: Parameter(s) missing (-step/-host/-type/-domname)"
-               echo ""
-               echo "$0 -help for usage."
-               exit
+       if [ "$step"    = "" -o \
+            "$host"    = "" -o \
+            "$typ"     = "" -o \
+            "$domname" = "" ]; then
+               echo "Error: Parameter(s) missing (-step/-host/-type/-domname)" 
1>&2
+               echo "" 1>&2
+               echo "$0 -help for usage." 1>&2
+               exit 1
        fi
 
        filename="$dir/$typ$stype-migration.sh"
@@ -99,7 +85,7 @@ function evaluate_params()
        fi
        . "$filename"
 
-       if [ "$recover" == "1" ]; then
+       if [ "$recover" = "1" ]; then
                func="$typ"_recover
                eval $func $host $domname $step $*
        else
@@ -108,4 +94,4 @@ function evaluate_params()
        fi
 }
 
-evaluate_params $*
+evaluate_params "$@"
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/examples/vif-bridge
--- a/tools/examples/vif-bridge Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/examples/vif-bridge Thu Nov 09 15:37:17 2006 -0500
@@ -61,7 +61,7 @@ handle_iptable
 handle_iptable
 
 log debug "Successful vif-bridge $command for $vif, bridge $bridge."
-if [ "$command" == "online" ]
+if [ "$command" = "online" ]
 then
   success
 fi
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/examples/vif-nat
--- a/tools/examples/vif-nat    Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/examples/vif-nat    Thu Nov 09 15:37:17 2006 -0500
@@ -72,7 +72,7 @@ dotted_quad()
 }
 
 
-if [ "$ip" == "" ]
+if [ "$ip" = "" ]
 then
   ip=$(ip_from_dom)
 fi
@@ -152,7 +152,7 @@ handle_iptable
 handle_iptable
 
 log debug "Successful vif-nat $command for $vif."
-if [ "$command" == "online" ]
+if [ "$command" = "online" ]
 then
   success
 fi
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/examples/vif-route
--- a/tools/examples/vif-route  Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/examples/vif-route  Thu Nov 09 15:37:17 2006 -0500
@@ -50,7 +50,7 @@ handle_iptable
 handle_iptable
 
 log debug "Successful vif-route $command for $vif."
-if [ "$command" == "online" ]
+if [ "$command" = "online" ]
 then
   success
 fi
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/examples/vtpm-common.sh
--- a/tools/examples/vtpm-common.sh     Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/examples/vtpm-common.sh     Thu Nov 09 15:37:17 2006 -0500
@@ -226,7 +226,7 @@ function vtpmdb_remove_entry () {
 # Returns 'resume' or 'create'
 function vtpm_get_create_reason () {
        local resume
-       resume=$(xenstore-read $XENBUS_PATH/resume)
+       resume=$(xenstore_read $XENBUS_PATH/resume)
        if [ "$resume" == "True" ]; then
                echo "resume"
        else
@@ -287,6 +287,8 @@ function vtpm_create_instance () {
 #entry is kept in the VTPMDB file.
 function vtpm_remove_instance () {
        local instance reason domname
+       #Stop script execution quietly if path does not exist (anymore)
+       xenstore-exists "$XENBUS_PATH"/domain
        domname=$(xenstore_read "$XENBUS_PATH"/domain)
 
        if [ "$domname" != "" ]; then
@@ -383,7 +385,7 @@ function vtpm_domid_from_name () {
        local id name ids
        ids=$(xenstore-list /local/domain)
        for id in $ids; do
-               name=$(xenstore-read /local/domain/$id/name)
+               name=$(xenstore_read /local/domain/$id/name)
                if [ "$name" == "$1" ]; then
                        echo "$id"
                        return
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/examples/xend-config.sxp
--- a/tools/examples/xend-config.sxp    Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/examples/xend-config.sxp    Thu Nov 09 15:37:17 2006 -0500
@@ -51,7 +51,7 @@
 # regular expressions will be accepted.
 #
 # For example:
-#  (xend-relocation-hosts-allow '^localhost$ ^.*\.example\.org$')
+#  (xend-relocation-hosts-allow '^localhost$ ^.*\\.example\\.org$')
 #
 #(xend-relocation-hosts-allow '')
 (xend-relocation-hosts-allow '^localhost$ ^localhost\\.localdomain$')
@@ -135,3 +135,7 @@
 # to 127.0.0.1  To restore old 'listen everywhere' behaviour
 # set this to 0.0.0.0
 #(vnc-listen '127.0.0.1')
+
+# The default password for VNC console on HVM domain.
+# Empty string is no authentication.
+(vncpasswd '')
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/examples/xmexample.hvm
--- a/tools/examples/xmexample.hvm      Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/examples/xmexample.hvm      Thu Nov 09 15:37:17 2006 -0500
@@ -47,9 +47,6 @@ name = "ExampleHVMDomain"
 
 # enable/disable HVM guest ACPI, default=0 (disabled)
 #acpi=0
-
-# enable/disable HVM guest APIC, default=0 (disabled)
-#apic=0
 
 # List of which CPUS this domain is allowed to use, default Xen picks
 #cpus = ""         # leave to Xen to pick
@@ -150,6 +147,11 @@ vnc=1
 #vncconsole=0
 
 #----------------------------------------------------------------------------
+# set password for domain's VNC console
+# default is depents on vncpasswd in xend-config.sxp
+vncpasswd=''
+
+#----------------------------------------------------------------------------
 # no graphics, use serial port
 #nographic=0
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/examples/xmexample.vti
--- a/tools/examples/xmexample.vti      Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/examples/xmexample.vti      Thu Nov 09 15:37:17 2006 -0500
@@ -95,6 +95,11 @@ vnc=0
 #vncconsole=0
 
 #----------------------------------------------------------------------------
+# set password for domain's VNC console
+# default is depents on vncpasswd in xend-config.sxp
+vncpasswd=''
+
+#----------------------------------------------------------------------------
 # no graphics, use serial port
 #nographic=0
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/firmware/Makefile
--- a/tools/firmware/Makefile   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/firmware/Makefile   Thu Nov 09 15:37:17 2006 -0500
@@ -9,7 +9,6 @@ SUBDIRS :=
 SUBDIRS :=
 SUBDIRS += rombios
 SUBDIRS += vgabios
-SUBDIRS += acpi
 SUBDIRS += vmxassist
 SUBDIRS += hvmloader
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/firmware/hvmloader/Makefile
--- a/tools/firmware/hvmloader/Makefile Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/firmware/hvmloader/Makefile Thu Nov 09 15:37:17 2006 -0500
@@ -32,35 +32,38 @@ XENINC   =-I$(XEN_ROOT)/tools/libxc
 XENINC   =-I$(XEN_ROOT)/tools/libxc
 
 # Disable PIE/SSP if GCC supports them. They can break us.
-CFLAGS  += $(call test-gcc-flag,$(CC),-nopie)
-CFLAGS  += $(call test-gcc-flag,$(CC),-fno-stack-protector)
-CFLAGS  += $(call test-gcc-flag,$(CC),-fno-stack-protector-all)
+CFLAGS  += $(call cc-option,$(CC),-nopie,)
+CFLAGS  += $(call cc-option,$(CC),-fno-stack-protector,)
+CFLAGS  += $(call cc-option,$(CC),-fno-stack-protector-all,)
 
 OBJCOPY  = objcopy
 CFLAGS  += $(DEFINES) -I. $(XENINC) -fno-builtin -O2 -msoft-float
-LDFLAGS  = -m32 -nostdlib -Wl,-N -Wl,-Ttext -Wl,$(LOADADDR)
+LDFLAGS  = -nostdlib -Wl,-N -Wl,-Ttext -Wl,$(LOADADDR)
 
-SRCS = hvmloader.c acpi_madt.c mp_tables.c util.c smbios.c
+SRCS = hvmloader.c acpi_madt.c mp_tables.c util.c smbios.c acpi_utils.c
 OBJS = $(patsubst %.c,%.o,$(SRCS))
 
 .PHONY: all
 all: hvmloader
 
+acpi/acpi.bin:
+       $(MAKE) -C acpi
+
 hvmloader: roms.h $(SRCS)
        $(CC) $(CFLAGS) -c $(SRCS)
-       $(CC) $(LDFLAGS) -o hvmloader.tmp $(OBJS)
+       $(CC) $(CFLAGS) $(LDFLAGS) -o hvmloader.tmp $(OBJS)
        $(OBJCOPY) hvmloader.tmp hvmloader
        rm -f hvmloader.tmp
 
-roms.h:        ../rombios/BIOS-bochs-latest ../vgabios/VGABIOS-lgpl-latest.bin 
../vgabios/VGABIOS-lgpl-latest.cirrus.bin ../vmxassist/vmxassist.bin 
../acpi/acpi.bin
+roms.h:        ../rombios/BIOS-bochs-latest ../vgabios/VGABIOS-lgpl-latest.bin 
../vgabios/VGABIOS-lgpl-latest.cirrus.bin ../vmxassist/vmxassist.bin 
acpi/acpi.bin
        sh ./mkhex rombios ../rombios/BIOS-bochs-latest > roms.h
        sh ./mkhex vgabios_stdvga ../vgabios/VGABIOS-lgpl-latest.bin >> roms.h
        sh ./mkhex vgabios_cirrusvga ../vgabios/VGABIOS-lgpl-latest.cirrus.bin 
>> roms.h
        sh ./mkhex vmxassist ../vmxassist/vmxassist.bin >> roms.h
-       sh ./mkhex acpi ../acpi/acpi.bin >> roms.h
+       sh ./mkhex acpi acpi/acpi.bin >> roms.h
 
 .PHONY: clean
 clean:
        rm -f roms.h acpi.h
        rm -f hvmloader hvmloader.tmp hvmloader.o $(OBJS)
-
+       $(MAKE) -C acpi clean
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/firmware/hvmloader/acpi_madt.c
--- a/tools/firmware/hvmloader/acpi_madt.c      Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/firmware/hvmloader/acpi_madt.c      Thu Nov 09 15:37:17 2006 -0500
@@ -18,9 +18,9 @@
  * Place - Suite 330, Boston, MA 02111-1307 USA.
  */
 
-#include "../acpi/acpi2_0.h"
-#include "../acpi/acpi_madt.h"
+#include "acpi/acpi2_0.h"
 #include "util.h"
+#include "acpi_utils.h"
 #include <xen/hvm/hvm_info_table.h>
 
 #define NULL ((void*)0)
@@ -29,160 +29,134 @@ static struct hvm_info_table *table = NU
 
 static int validate_hvm_info(struct hvm_info_table *t)
 {
-       char signature[] = "HVM INFO";
-       uint8_t *ptr = (uint8_t *)t;
-       uint8_t sum = 0;
-       int i;
+    char signature[] = "HVM INFO";
+    uint8_t *ptr = (uint8_t *)t;
+    uint8_t sum = 0;
+    int i;
 
-       /* strncmp(t->signature, "HVM INFO", 8) */
-       for (i = 0; i < 8; i++) {
-               if (signature[i] != t->signature[i]) {
-                       puts("Bad hvm info signature\n");
-                       return 0;
-               }
-       }
+    /* strncmp(t->signature, "HVM INFO", 8) */
+    for (i = 0; i < 8; i++) {
+        if (signature[i] != t->signature[i]) {
+            puts("Bad hvm info signature\n");
+            return 0;
+        }
+    }
 
-       for (i = 0; i < t->length; i++)
-               sum += ptr[i];
+    for (i = 0; i < t->length; i++)
+        sum += ptr[i];
 
-       return (sum == 0);
+    return (sum == 0);
 }
 
 /* xc_vmx_builder wrote hvm info at 0x9F800. Return it. */
 struct hvm_info_table *
 get_hvm_info_table(void)
 {
-       struct hvm_info_table *t;
+    struct hvm_info_table *t;
 
-       if (table != NULL)
-               return table;
+    if (table != NULL)
+        return table;
 
-       t = (struct hvm_info_table *)HVM_INFO_PADDR;
+    t = (struct hvm_info_table *)HVM_INFO_PADDR;
 
-       if (!validate_hvm_info(t)) {
-               puts("Bad hvm info table\n");
-               return NULL;
-       }
+    if (!validate_hvm_info(t)) {
+        puts("Bad hvm info table\n");
+        return NULL;
+    }
 
-       table = t;
+    table = t;
 
-       return table;
+    return table;
 }
 
 int
 get_vcpu_nr(void)
 {
-       struct hvm_info_table *t = get_hvm_info_table();
-       return (t ? t->nr_vcpus : 1); /* default 1 vcpu */
+    struct hvm_info_table *t = get_hvm_info_table();
+    return (t ? t->nr_vcpus : 1); /* default 1 vcpu */
 }
 
 int
 get_acpi_enabled(void)
 {
-       struct hvm_info_table *t = get_hvm_info_table();
-       return (t ? t->acpi_enabled : 0); /* default no acpi */
+    struct hvm_info_table *t = get_hvm_info_table();
+    return (t ? t->acpi_enabled : 0); /* default no acpi */
 }
 
 
 static void *
 acpi_madt_get_madt(unsigned char *acpi_start)
 {
-       ACPI_2_0_RSDP *rsdp=NULL;
-       ACPI_2_0_RSDT *rsdt=NULL;
-       ACPI_MULTIPLE_APIC_DESCRIPTION_TABLE *madt;
+    struct acpi_20_rsdt *rsdt;
+    struct acpi_20_madt *madt;
 
-       rsdp = (ACPI_2_0_RSDP *)(acpi_start + sizeof(ACPI_2_0_FACS));
-       if (rsdp->Signature != ACPI_2_0_RSDP_SIGNATURE) {
-               puts("Bad RSDP signature\n");
-               return NULL;
-       }
+    rsdt = acpi_rsdt_get(acpi_start);
+    if (rsdt == NULL)
+        return NULL;
 
-       rsdt= (ACPI_2_0_RSDT *)
-               (acpi_start + rsdp->RsdtAddress - ACPI_PHYSICAL_ADDRESS);
-       if (rsdt->Header.Signature != ACPI_2_0_RSDT_SIGNATURE) {
-               puts("Bad RSDT signature\n");
-               return NULL;
-       }
+    madt = (struct acpi_20_madt *)(acpi_start + rsdt->entry[1] -
+                                   ACPI_PHYSICAL_ADDRESS);
+    if (madt->header.header.signature != ACPI_2_0_MADT_SIGNATURE) {
+        puts("Bad MADT signature \n");
+        return NULL;
+    }
 
-       madt = (ACPI_MULTIPLE_APIC_DESCRIPTION_TABLE *)
-               ( acpi_start+ rsdt->Entry[1] - ACPI_PHYSICAL_ADDRESS);
-       if (madt->Header.Header.Signature !=
-           ACPI_MULTIPLE_APIC_DESCRIPTION_TABLE_SIGNATURE) {
-               puts("Bad MADT signature \n");
-               return NULL;
-       }
-
-       return madt;
-}
-
-static void
-set_checksum(void *start, int checksum_offset, int len)
-{
-       unsigned char sum = 0;
-       unsigned char *ptr;
-
-       ptr = start;
-       ptr[checksum_offset] = 0;
-       while (len--)
-               sum += *ptr++;
-
-       ptr = start;
-       ptr[checksum_offset] = -sum;
+    return madt;
 }
 
 static int
 acpi_madt_set_local_apics(
-       int nr_vcpu,
-       ACPI_MULTIPLE_APIC_DESCRIPTION_TABLE *madt)
+    int nr_vcpu,
+    struct acpi_20_madt *madt)
 {
-       int i;
+    int i;
 
-       if ((nr_vcpu > MAX_VIRT_CPUS) || (nr_vcpu < 0) || !madt)
-               return -1;
+    if ((nr_vcpu > MAX_VIRT_CPUS) || (nr_vcpu < 0) || !madt)
+        return -1;
 
-       for (i = 0; i < nr_vcpu; i++) {
-               madt->LocalApic[i].Type            = ACPI_PROCESSOR_LOCAL_APIC;
-               madt->LocalApic[i].Length          = sizeof 
(ACPI_LOCAL_APIC_STRUCTURE);
-               madt->LocalApic[i].AcpiProcessorId = i;
-               madt->LocalApic[i].ApicId          = i;
-               madt->LocalApic[i].Flags           = 1;
-       }
+    for (i = 0; i < nr_vcpu; i++) {
+        madt->lapic[i].type    = ACPI_PROCESSOR_LOCAL_APIC;
+        madt->lapic[i].length  = sizeof(struct acpi_20_madt_lapic);
+        madt->lapic[i].acpi_processor_id = i;
+        madt->lapic[i].apic_id = i;
+        madt->lapic[i].flags   = 1;
+    }
 
-       madt->Header.Header.Length =
-               sizeof(ACPI_MULTIPLE_APIC_DESCRIPTION_TABLE) -
-               (MAX_VIRT_CPUS - nr_vcpu)* sizeof(ACPI_LOCAL_APIC_STRUCTURE);
+    madt->header.header.length =
+        sizeof(struct acpi_20_madt) -
+        (MAX_VIRT_CPUS - nr_vcpu) * sizeof(struct acpi_20_madt_lapic);
 
-       return 0;
+    return 0;
 }
 
 #define FIELD_OFFSET(TYPE,Field) ((unsigned int)(&(((TYPE *) 0)->Field)))
 
 int acpi_madt_update(unsigned char *acpi_start)
 {
-       int rc;
-       ACPI_MULTIPLE_APIC_DESCRIPTION_TABLE *madt;
+    int rc;
+    struct acpi_20_madt *madt;
 
-       madt = acpi_madt_get_madt(acpi_start);
-       if (!madt)
-               return -1;
+    madt = acpi_madt_get_madt(acpi_start);
+    if (!madt)
+        return -1;
 
-       rc = acpi_madt_set_local_apics(get_vcpu_nr(), madt);
-       if (rc != 0)
-               return rc;
+    rc = acpi_madt_set_local_apics(get_vcpu_nr(), madt);
+    if (rc != 0)
+        return rc;
 
-       set_checksum(
-               madt, FIELD_OFFSET(ACPI_TABLE_HEADER, Checksum),
-               madt->Header.Header.Length);
+    set_checksum(
+        madt, FIELD_OFFSET(struct acpi_header, checksum),
+        madt->header.header.length);
 
-       return 0;
+    return 0;
 }
 
 /*
  * Local variables:
- *  c-file-style: "linux"
- *  indent-tabs-mode: t
- *  c-indent-level: 8
- *  c-basic-offset: 8
- *  tab-width: 8
+ * mode: C
+ * c-set-style: "BSD"
+ * c-basic-offset: 4
+ * tab-width: 4
+ * indent-tabs-mode: nil
  * End:
  */
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/firmware/hvmloader/hvmloader.c
--- a/tools/firmware/hvmloader/hvmloader.c      Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/firmware/hvmloader/hvmloader.c      Thu Nov 09 15:37:17 2006 -0500
@@ -22,9 +22,10 @@
  * Place - Suite 330, Boston, MA 02111-1307 USA.
  */
 #include "roms.h"
-#include "../acpi/acpi2_0.h"  /* for ACPI_PHYSICAL_ADDRESS */
+#include "acpi/acpi2_0.h"  /* for ACPI_PHYSICAL_ADDRESS */
 #include "hypercall.h"
 #include "util.h"
+#include "acpi_utils.h"
 #include "smbios.h"
 #include <xen/version.h>
 #include <xen/hvm/params.h>
@@ -164,8 +165,6 @@ int
 int
 main(void)
 {
-       struct xen_hvm_param hvm_param;
-
        puts("HVM Loader\n");
 
        init_hypercalls();
@@ -176,10 +175,7 @@ main(void)
        puts("Loading ROMBIOS ...\n");
        memcpy((void *)ROMBIOS_PHYSICAL_ADDRESS, rombios, sizeof(rombios));
 
-       hvm_param.domid = DOMID_SELF;
-       hvm_param.index = HVM_PARAM_APIC_ENABLED;
-       if (!hypercall_hvm_op(HVMOP_get_param, &hvm_param) && hvm_param.value)
-               create_mp_tables();
+        create_mp_tables();
        
        if (cirrus_check()) {
                puts("Loading Cirrus VGABIOS ...\n");
@@ -195,12 +191,18 @@ main(void)
                puts("Loading ACPI ...\n");
                acpi_madt_update((unsigned char *) acpi);
                if (ACPI_PHYSICAL_ADDRESS+sizeof(acpi) <= 0xF0000) {
+                       unsigned char *freemem = (unsigned char *)
+                                (ACPI_PHYSICAL_ADDRESS + sizeof(acpi));
                        /*
                         * Make sure acpi table does not overlap rombios
                         * currently acpi less than 8K will be OK.
                         */
                         memcpy((void *)ACPI_PHYSICAL_ADDRESS, acpi,
                                                                sizeof(acpi));
+                       acpi_update((unsigned char *)ACPI_PHYSICAL_ADDRESS,
+                                   sizeof(acpi),
+                                   (unsigned char *)0xF0000,
+                                   &freemem);
                }
        }
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/firmware/hvmloader/util.c
--- a/tools/firmware/hvmloader/util.c   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/firmware/hvmloader/util.c   Thu Nov 09 15:37:17 2006 -0500
@@ -18,7 +18,7 @@
  * Place - Suite 330, Boston, MA 02111-1307 USA.
  */
 
-#include "../acpi/acpi2_0.h"  /* for ACPI_PHYSICAL_ADDRESS */
+#include "acpi/acpi2_0.h"  /* for ACPI_PHYSICAL_ADDRESS */
 #include "util.h"
 #include <stdint.h>
 
@@ -227,4 +227,5 @@ uuid_to_string(char *dest, uint8_t *uuid
                byte_to_hex(p, uuid[i]);
                p += 2;
        }
-}
+       *p = 0;
+}
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/firmware/vmxassist/Makefile
--- a/tools/firmware/vmxassist/Makefile Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/firmware/vmxassist/Makefile Thu Nov 09 15:37:17 2006 -0500
@@ -32,14 +32,13 @@ XENINC=-I$(XEN_ROOT)/tools/libxc
 XENINC=-I$(XEN_ROOT)/tools/libxc
 
 # Disable PIE/SSP if GCC supports them. They can break us.
-CFLAGS  += $(call test-gcc-flag,$(CC),-nopie)
-CFLAGS  += $(call test-gcc-flag,$(CC),-fno-stack-protector)
-CFLAGS  += $(call test-gcc-flag,$(CC),-fno-stack-protector-all)
+CFLAGS  += $(call cc-option,$(CC),-nopie,)
+CFLAGS  += $(call cc-option,$(CC),-fno-stack-protector,)
+CFLAGS  += $(call cc-option,$(CC),-fno-stack-protector-all,)
 
 CPP      = cpp -P
 OBJCOPY  = objcopy -p -O binary -R .note -R .comment -R .bss -S --gap-fill=0
 CFLAGS  += $(DEFINES) -I. $(XENINC) -fno-builtin -O2 -msoft-float
-LDFLAGS  = -m elf_i386
 
 OBJECTS = head.o trap.o vm86.o setup.o util.o
 
@@ -48,7 +47,7 @@ all: vmxassist.bin
 
 vmxassist.bin: vmxassist.ld $(OBJECTS)
        $(CPP) $(DEFINES) vmxassist.ld > vmxassist.tmp
-       $(LD) -o vmxassist $(LDFLAGS) -nostdlib --fatal-warnings -N -T 
vmxassist.tmp $(OBJECTS)
+       $(LD) -o vmxassist $(LDFLAGS_DIRECT) -nostdlib --fatal-warnings -N -T 
vmxassist.tmp $(OBJECTS)
        nm -n vmxassist > vmxassist.sym
        $(OBJCOPY) vmxassist vmxassist.tmp
        dd if=vmxassist.tmp of=vmxassist.bin ibs=512 conv=sync
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/firmware/vmxassist/head.S
--- a/tools/firmware/vmxassist/head.S   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/firmware/vmxassist/head.S   Thu Nov 09 15:37:17 2006 -0500
@@ -59,7 +59,7 @@ _start16:
 
         /* go to protected mode */
         movl    %cr0, %eax
-        orl     $CR0_PE, %eax
+        orl     $(CR0_PE), %eax
         movl    %eax, %cr0
         data32  ljmp $0x08, $1f
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/firmware/vmxassist/setup.c
--- a/tools/firmware/vmxassist/setup.c  Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/firmware/vmxassist/setup.c  Thu Nov 09 15:37:17 2006 -0500
@@ -53,13 +53,10 @@ struct e820entry e820map[] = {
 struct e820entry e820map[] = {
        { 0x0000000000000000ULL, 0x000000000009F800ULL, E820_RAM },
        { 0x000000000009F800ULL, 0x0000000000000800ULL, E820_RESERVED },
-       { 0x00000000000A0000ULL, 0x0000000000020000ULL, E820_IO },
        { 0x00000000000C0000ULL, 0x0000000000040000ULL, E820_RESERVED },
        { 0x0000000000100000ULL, 0x0000000000000000ULL, E820_RAM },
-       { 0x0000000000000000ULL, 0x0000000000001000ULL, E820_SHARED_PAGE },
        { 0x0000000000000000ULL, 0x0000000000003000ULL, E820_NVS },
        { 0x0000000000003000ULL, 0x000000000000A000ULL, E820_ACPI },
-       { 0x00000000FEC00000ULL, 0x0000000001400000ULL, E820_IO },
 };
 #endif /* TEST */
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/firmware/vmxassist/trap.S
--- a/tools/firmware/vmxassist/trap.S   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/firmware/vmxassist/trap.S   Thu Nov 09 15:37:17 2006 -0500
@@ -106,7 +106,7 @@ common_trap:                                /* common trap 
handler *
        pushl   %es
        pushal
 
-       movl    $DATA_SELECTOR, %eax    /* make sure these are sane */
+       movl    $(DATA_SELECTOR), %eax  /* make sure these are sane */
        movl    %eax, %ds
        movl    %eax, %es
        movl    %eax, %fs
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/firmware/vmxassist/util.c
--- a/tools/firmware/vmxassist/util.c   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/firmware/vmxassist/util.c   Thu Nov 09 15:37:17 2006 -0500
@@ -29,6 +29,31 @@ static char *printnum(char *, unsigned l
 static char *printnum(char *, unsigned long, int);
 static void _doprint(void (*)(int), char const *, va_list);
 
+void
+cpuid_addr_value(uint64_t addr, uint64_t *value)
+{
+       uint32_t addr_low   = (uint32_t)addr;
+       uint32_t addr_high  = (uint32_t)(addr >> 32);
+       uint32_t value_low, value_high;
+       static unsigned int addr_leaf;
+
+       if (!addr_leaf) {
+               unsigned int eax, ebx, ecx, edx;
+               __asm__ __volatile__(
+                       "cpuid"
+                       : "=a" (eax), "=b" (ebx), "=c" (ecx), "=d" (edx)
+                       : "0" (0x40000000));
+               addr_leaf = eax + 1;
+       }
+
+       __asm__ __volatile__(
+               "cpuid"
+               : "=c" (value_low), "=d" (value_high)
+               : "a" (addr_leaf), "0" (addr_low), "1" (addr_high)
+               : "ebx");
+
+       *value = (uint64_t)value_high << 32 | value_low;
+}
 
 void
 dump_regs(struct regs *regs)
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/firmware/vmxassist/util.h
--- a/tools/firmware/vmxassist/util.h   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/firmware/vmxassist/util.h   Thu Nov 09 15:37:17 2006 -0500
@@ -31,6 +31,7 @@
 
 struct vmx_assist_context;
 
+extern void cpuid_addr_value(uint64_t addr, uint64_t *value);
 extern void hexdump(unsigned char *, int);
 extern void dump_regs(struct regs *);
 extern void dump_vmx_context(struct vmx_assist_context *);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/firmware/vmxassist/vm86.c
--- a/tools/firmware/vmxassist/vm86.c   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/firmware/vmxassist/vm86.c   Thu Nov 09 15:37:17 2006 -0500
@@ -56,8 +56,8 @@ static char *rnames[] = { "ax", "cx", "d
 #define PT_ENTRY_PRESENT 0x1
 
 /* We only support access to <=4G physical memory due to 1:1 mapping */
-static unsigned
-guest_linear_to_real(uint32_t base)
+static uint64_t
+guest_linear_to_phys(uint32_t base)
 {
        uint32_t gcr3 = oldctx.cr3;
        uint64_t l2_mfn;
@@ -89,23 +89,32 @@ guest_linear_to_real(uint32_t base)
                l2_mfn = ((uint64_t *)(long)gcr3)[(base >> 30) & 0x3];
                if (!(l2_mfn & PT_ENTRY_PRESENT))
                        panic("l3 entry not present\n");
-               l2_mfn &= 0x3fffff000ULL;
-
-               l1_mfn = ((uint64_t *)(long)l2_mfn)[(base >> 21) & 0x1ff];
+               l2_mfn &= 0xffffff000ULL;
+
+               if (l2_mfn & 0xf00000000ULL) {
+                       printf("l2 page above 4G\n");
+                       cpuid_addr_value(l2_mfn + 8 * ((base >> 21) & 0x1ff), 
&l1_mfn);
+               } else
+                       l1_mfn = ((uint64_t *)(long)l2_mfn)[(base >> 21) & 
0x1ff];
                if (!(l1_mfn & PT_ENTRY_PRESENT))
                        panic("l2 entry not present\n");
 
                if (l1_mfn & PDE_PS) { /* CR4.PSE is ignored in PAE mode */
-                       l0_mfn = l1_mfn & 0x3ffe00000ULL;
+                       l0_mfn = l1_mfn & 0xfffe00000ULL;
                        return l0_mfn + (base & 0x1fffff);
                }
 
-               l1_mfn &= 0x3fffff000ULL;
-
-               l0_mfn = ((uint64_t *)(long)l1_mfn)[(base >> 12) & 0x1ff];
+               l1_mfn &= 0xffffff000ULL;
+
+               if (l1_mfn & 0xf00000000ULL) {
+                       printf("l1 page above 4G\n");
+                       cpuid_addr_value(l1_mfn + 8 * ((base >> 12) & 0x1ff), 
&l0_mfn);
+               } else
+                       l0_mfn = ((uint64_t *)(long)l1_mfn)[(base >> 12) & 
0x1ff];
                if (!(l0_mfn & PT_ENTRY_PRESENT))
                        panic("l1 entry not present\n");
-               l0_mfn &= 0x3fffff000ULL;
+
+               l0_mfn &= 0xffffff000ULL;
 
                return l0_mfn + (base & 0xfff);
        }
@@ -114,6 +123,7 @@ static unsigned
 static unsigned
 address(struct regs *regs, unsigned seg, unsigned off)
 {
+       uint64_t gdt_phys_base;
        unsigned long long entry;
        unsigned seg_base, seg_limit;
        unsigned entry_low, entry_high;
@@ -129,8 +139,13 @@ address(struct regs *regs, unsigned seg,
            (mode == VM86_REAL_TO_PROTECTED && regs->cs == seg))
                return ((seg & 0xFFFF) << 4) + off;
 
-       entry = ((unsigned long long *)
-                 guest_linear_to_real(oldctx.gdtr_base))[seg >> 3];
+       gdt_phys_base = guest_linear_to_phys(oldctx.gdtr_base);
+       if (gdt_phys_base != (uint32_t)gdt_phys_base) {
+               printf("gdt base address above 4G\n");
+               cpuid_addr_value(gdt_phys_base + 8 * (seg >> 3), &entry);
+       } else
+               entry = ((unsigned long long *)(long)gdt_phys_base)[seg >> 3];
+
        entry_high = entry >> 32;
        entry_low = entry & 0xFFFFFFFF;
 
@@ -804,6 +819,7 @@ static int
 static int
 load_seg(unsigned long sel, uint32_t *base, uint32_t *limit, union 
vmcs_arbytes *arbytes)
 {
+       uint64_t gdt_phys_base;
        unsigned long long entry;
 
        /* protected mode: use seg as index into gdt */
@@ -815,8 +831,12 @@ load_seg(unsigned long sel, uint32_t *ba
                return 1;
        }
 
-       entry = ((unsigned long long *)
-                 guest_linear_to_real(oldctx.gdtr_base))[sel >> 3];
+       gdt_phys_base = guest_linear_to_phys(oldctx.gdtr_base);
+       if (gdt_phys_base != (uint32_t)gdt_phys_base) {
+               printf("gdt base address above 4G\n");
+               cpuid_addr_value(gdt_phys_base + 8 * (sel >> 3), &entry);
+       } else
+               entry = ((unsigned long long *)(long)gdt_phys_base)[sel >> 3];
 
        /* Check the P bit first */
        if (!((entry >> (15+32)) & 0x1) && sel != 0)
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/Makefile.target
--- a/tools/ioemu/Makefile.target       Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/Makefile.target       Thu Nov 09 15:37:17 2006 -0500
@@ -23,7 +23,7 @@ DEFINES+=-I$(SRC_PATH)/linux-user -I$(SR
 DEFINES+=-I$(SRC_PATH)/linux-user -I$(SRC_PATH)/linux-user/$(TARGET_ARCH)
 endif
 CFLAGS+=-Wall -O2 -g -fno-strict-aliasing
-SSE2 := $(call test-gcc-flag,$(CC),-msse2)
+SSE2 := $(call cc-option,$(CC),-msse2,)
 ifeq ($(SSE2),-msse2)
 CFLAGS += -DUSE_SSE2=1 -msse2
 endif
@@ -294,7 +294,11 @@ endif
 endif
 
 # qemu-dm objects
+ifeq ($(ARCH),ia64)
 LIBOBJS=helper2.o exec-dm.o i8259-dm.o
+else
+LIBOBJS=helper2.o exec-dm.o i8259-dm.o rtc-dm.o
+endif
 
 all: $(PROGS)
 
@@ -354,12 +358,17 @@ ifeq ($(TARGET_BASE_ARCH), i386)
 ifeq ($(TARGET_BASE_ARCH), i386)
 # Hardware support
 VL_OBJS+= ide.o pckbd.o ps2.o vga.o $(SOUND_HW) dma.o $(AUDIODRV)
+ifeq ($(ARCH),ia64)
 VL_OBJS+= fdc.o mc146818rtc.o serial.o pc.o
+else
+VL_OBJS+= fdc.o serial.o pc.o
+endif
 VL_OBJS+= cirrus_vga.o mixeng.o parallel.o acpi.o piix_pci.o
 VL_OBJS+= usb-uhci.o
 VL_OBJS+= piix4acpi.o
 VL_OBJS+= xenstore.o
 VL_OBJS+= xen_platform.o
+VL_OBJS+= tpm_tis.o
 DEFINES += -DHAS_AUDIO
 endif
 ifeq ($(TARGET_BASE_ARCH), ppc)
@@ -398,6 +407,7 @@ VL_OBJS+=sdl.o
 VL_OBJS+=sdl.o
 endif
 VL_OBJS+=vnc.o
+VL_OBJS+=d3des.o
 ifdef CONFIG_COCOA
 VL_OBJS+=cocoa.o
 COCOA_LIBS=-F/System/Library/Frameworks -framework Cocoa -framework IOKit
@@ -456,6 +466,9 @@ sdl.o: sdl.c keymaps.c sdl_keysym.h
        $(CC) $(CFLAGS) $(DEFINES) $(SDL_CFLAGS) -c -o $@ $<
 
 vnc.o: vnc.c keymaps.c sdl_keysym.h vnchextile.h
+       $(CC) $(CFLAGS) $(DEFINES) -c -o $@ $<
+
+d3des.o: d3des.c d3des.h
        $(CC) $(CFLAGS) $(DEFINES) -c -o $@ $<
 
 sdlaudio.o: sdlaudio.c
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/hw/ide.c
--- a/tools/ioemu/hw/ide.c      Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/hw/ide.c      Thu Nov 09 15:37:17 2006 -0500
@@ -557,9 +557,9 @@ static void ide_atapi_identify(IDEState 
     padstr((uint8_t *)(p + 23), QEMU_VERSION, 8); /* firmware version */
     padstr((uint8_t *)(p + 27), "QEMU CD-ROM", 40); /* model */
     put_le16(p + 48, 1); /* dword I/O (XXX: should not be set on CDROM) */
-    put_le16(p + 49, 1 << 9); /* LBA supported, no DMA */
+    put_le16(p + 49, (1 << 11) | (1 << 9) | (1 << 8)); /* DMA and LBA 
supported */
     put_le16(p + 53, 3); /* words 64-70, 54-58 valid */
-    put_le16(p + 63, 0x103); /* DMA modes XXX: may be incorrect */
+    put_le16(p + 63, 0x07); /* mdma0-2 supported */
     put_le16(p + 64, 1); /* PIO modes */
     put_le16(p + 65, 0xb4); /* minimum DMA multiword tx cycle time */
     put_le16(p + 66, 0xb4); /* recommended DMA multiword tx cycle time */
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/hw/ne2000.c
--- a/tools/ioemu/hw/ne2000.c   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/hw/ne2000.c   Thu Nov 09 15:37:17 2006 -0500
@@ -137,6 +137,7 @@ typedef struct NE2000State {
     uint8_t curpag;
     uint8_t mult[8]; /* multicast mask array */
     int irq;
+    int tainted;
     PCIDevice *pci_dev;
     VLANClientState *vc;
     uint8_t macaddr[6];
@@ -226,6 +227,27 @@ static int ne2000_can_receive(void *opaq
 
 #define MIN_BUF_SIZE 60
 
+static inline int ne2000_valid_ring_addr(NE2000State *s, unsigned int addr)
+{
+    addr <<= 8;
+    return addr < s->stop && addr >= s->start;
+}
+
+static inline int ne2000_check_state(NE2000State *s)
+{
+    if (!s->tainted)
+        return 0;
+
+    if (s->start >= s->stop || s->stop > NE2000_MEM_SIZE)
+        return -EINVAL;
+
+    if (!ne2000_valid_ring_addr(s, s->curpag))
+        return -EINVAL;
+
+    s->tainted = 0;
+    return 0;
+}
+
 static void ne2000_receive(void *opaque, const uint8_t *buf, int size)
 {
     NE2000State *s = opaque;
@@ -238,6 +260,12 @@ static void ne2000_receive(void *opaque,
 #if defined(DEBUG_NE2000)
     printf("NE2000: received len=%d\n", size);
 #endif
+
+    if (ne2000_check_state(s))
+        return;
+
+    if (!ne2000_valid_ring_addr(s, s->boundary))
+        return;
 
     if (s->cmd & E8390_STOP || ne2000_buffer_full(s))
         return;
@@ -359,9 +387,11 @@ static void ne2000_ioport_write(void *op
         switch(offset) {
         case EN0_STARTPG:
             s->start = val << 8;
+            s->tainted = 1;
             break;
         case EN0_STOPPG:
             s->stop = val << 8;
+            s->tainted = 1;
             break;
         case EN0_BOUNDARY:
             s->boundary = val;
@@ -406,6 +436,7 @@ static void ne2000_ioport_write(void *op
             break;
         case EN1_CURPAG:
             s->curpag = val;
+            s->tainted = 1;
             break;
         case EN1_MULT ... EN1_MULT + 7:
             s->mult[offset - EN1_MULT] = val;
@@ -509,7 +540,7 @@ static inline void ne2000_mem_writel(NE2
 {
     addr &= ~1; /* XXX: check exact behaviour if not even */
     if (addr < 32 || 
-        (addr >= NE2000_PMEM_START && addr < NE2000_MEM_SIZE)) {
+        (addr >= NE2000_PMEM_START && addr < NE2000_MEM_SIZE - 2)) {
         cpu_to_le32wu((uint32_t *)(s->mem + addr), val);
     }
 }
@@ -539,7 +570,7 @@ static inline uint32_t ne2000_mem_readl(
 {
     addr &= ~1; /* XXX: check exact behaviour if not even */
     if (addr < 32 || 
-        (addr >= NE2000_PMEM_START && addr < NE2000_MEM_SIZE)) {
+        (addr >= NE2000_PMEM_START && addr < NE2000_MEM_SIZE - 2)) {
         return le32_to_cpupu((uint32_t *)(s->mem + addr));
     } else {
         return 0xffffffff;
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/hw/pc.c
--- a/tools/ioemu/hw/pc.c       Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/hw/pc.c       Thu Nov 09 15:37:17 2006 -0500
@@ -875,6 +875,9 @@ static void pc_init1(uint64_t ram_size, 
         }
     }
 
+    if (has_tpm_device())
+        tpm_tis_init(&pic_set_irq_new, isa_pic, 11);
+
     kbd_init();
     DMA_init(0);
 #ifdef HAS_AUDIO
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/hw/serial.c
--- a/tools/ioemu/hw/serial.c   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/hw/serial.c   Thu Nov 09 15:37:17 2006 -0500
@@ -93,6 +93,15 @@ struct SerialState {
     int last_break_enable;
     target_ulong base;
     int it_shift;
+
+    /*
+     * If a character transmitted via UART cannot be written to its
+     * destination immediately we remember it here and retry a few times via
+     * a polling timer.
+     */
+    int write_retries;
+    char write_chr;
+    QEMUTimer *write_retry_timer;
 };
 
 static void serial_update_irq(SerialState *s)
@@ -204,10 +213,32 @@ static void serial_get_token(void)
     tokens_avail--;
 }
 
+static void serial_chr_write(void *opaque)
+{
+    SerialState *s = opaque;
+
+    qemu_del_timer(s->write_retry_timer);
+
+    /* Retry every 100ms for 300ms total. */
+    if (qemu_chr_write(s->chr, &s->write_chr, 1) == -1) {
+        if (s->write_retries++ >= 3)
+            printf("serial: write error\n");
+        else
+            qemu_mod_timer(s->write_retry_timer,
+                           qemu_get_clock(vm_clock) + ticks_per_sec / 10);
+        return;
+    }
+
+    /* Success: Notify guest that THR is empty. */
+    s->thr_ipending = 1;
+    s->lsr |= UART_LSR_THRE;
+    s->lsr |= UART_LSR_TEMT;
+    serial_update_irq(s);
+}
+
 static void serial_ioport_write(void *opaque, uint32_t addr, uint32_t val)
 {
     SerialState *s = opaque;
-    unsigned char ch;
     
     addr &= 7;
 #ifdef DEBUG_SERIAL
@@ -223,12 +254,9 @@ static void serial_ioport_write(void *op
             s->thr_ipending = 0;
             s->lsr &= ~UART_LSR_THRE;
             serial_update_irq(s);
-            ch = val;
-            qemu_chr_write(s->chr, &ch, 1);
-            s->thr_ipending = 1;
-            s->lsr |= UART_LSR_THRE;
-            s->lsr |= UART_LSR_TEMT;
-            serial_update_irq(s);
+            s->write_chr = val;
+            s->write_retries = 0;
+            serial_chr_write(s);
         }
         break;
     case 1:
@@ -424,6 +452,7 @@ SerialState *serial_init(SetIRQFunc *set
     s->lsr = UART_LSR_TEMT | UART_LSR_THRE;
     s->iir = UART_IIR_NO_INT;
     s->msr = UART_MSR_DCD | UART_MSR_DSR | UART_MSR_CTS;
+    s->write_retry_timer = qemu_new_timer(vm_clock, serial_chr_write, s);
 
     register_savevm("serial", base, 1, serial_save, serial_load, s);
 
@@ -511,6 +540,7 @@ SerialState *serial_mm_init (SetIRQFunc 
     s->msr = UART_MSR_DCD | UART_MSR_DSR | UART_MSR_CTS;
     s->base = base;
     s->it_shift = it_shift;
+    s->write_retry_timer = qemu_new_timer(vm_clock, serial_chr_write, s);
 
     register_savevm("serial", base, 1, serial_save, serial_load, s);
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/hw/xen_platform.c
--- a/tools/ioemu/hw/xen_platform.c     Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/hw/xen_platform.c     Thu Nov 09 15:37:17 2006 -0500
@@ -97,7 +97,8 @@ struct pci_config_header {
     uint8_t  bist; /* Built in self test */
     uint32_t base_address_regs[6];
     uint32_t reserved1;
-    uint32_t reserved2;
+    uint16_t subsystem_vendor_id;
+    uint16_t subsystem_id;
     uint32_t rom_addr;
     uint32_t reserved3;
     uint32_t reserved4;
@@ -126,6 +127,11 @@ void pci_xen_platform_init(PCIBus *bus)
     pch->header_type = 0;
     pch->interrupt_pin = 1;
 
+    /* Microsoft WHQL requires non-zero subsystem IDs. */
+    /* http://www.pcisig.com/reflector/msg02205.html.  */
+    pch->subsystem_vendor_id = pch->vendor_id; /* Duplicate vendor id.  */
+    pch->subsystem_id        = 0x0001;         /* Hardcode sub-id as 1. */
+
     pci_register_io_region(d, 0, 0x100, PCI_ADDRESS_SPACE_IO,
                            platform_ioport_map);
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/keymaps/ja
--- a/tools/ioemu/keymaps/ja    Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/keymaps/ja    Thu Nov 09 15:37:17 2006 -0500
@@ -102,3 +102,6 @@ Henkan_Mode 0x79
 Henkan_Mode 0x79
 Katakana 0x70
 Muhenkan 0x7b
+Henkan_Mode_Real 0x79
+Henkan_Mode_Ultra 0x79
+backslash_ja 0x73
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/domain-timeoffset
--- a/tools/ioemu/patches/domain-timeoffset     Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/patches/domain-timeoffset     Thu Nov 09 15:37:17 2006 -0500
@@ -1,7 +1,7 @@ Index: ioemu/hw/mc146818rtc.c
 Index: ioemu/hw/mc146818rtc.c
 ===================================================================
---- ioemu.orig/hw/mc146818rtc.c        2006-09-21 19:33:25.000000000 +0100
-+++ ioemu/hw/mc146818rtc.c     2006-09-21 19:33:30.000000000 +0100
+--- ioemu.orig/hw/mc146818rtc.c        2006-10-24 14:45:21.000000000 +0100
++++ ioemu/hw/mc146818rtc.c     2006-10-24 14:45:39.000000000 +0100
 @@ -178,10 +178,27 @@
      }
  }
@@ -46,8 +46,8 @@ Index: ioemu/hw/mc146818rtc.c
  static void rtc_copy_date(RTCState *s)
 Index: ioemu/hw/pc.c
 ===================================================================
---- ioemu.orig/hw/pc.c 2006-09-21 19:33:30.000000000 +0100
-+++ ioemu/hw/pc.c      2006-09-21 19:33:30.000000000 +0100
+--- ioemu.orig/hw/pc.c 2006-10-24 14:45:38.000000000 +0100
++++ ioemu/hw/pc.c      2006-10-24 14:45:39.000000000 +0100
 @@ -159,7 +159,7 @@
  }
  
@@ -117,8 +117,8 @@ Index: ioemu/hw/pc.c
  QEMUMachine pc_machine = {
 Index: ioemu/vl.c
 ===================================================================
---- ioemu.orig/vl.c    2006-09-21 19:33:30.000000000 +0100
-+++ ioemu/vl.c 2006-09-21 19:33:30.000000000 +0100
+--- ioemu.orig/vl.c    2006-10-24 14:45:38.000000000 +0100
++++ ioemu/vl.c 2006-10-24 14:45:39.000000000 +0100
 @@ -163,6 +163,8 @@
  
  int xc_handle;
@@ -174,8 +174,8 @@ Index: ioemu/vl.c
      if (usb_enabled) {
 Index: ioemu/vl.h
 ===================================================================
---- ioemu.orig/vl.h    2006-09-21 19:33:30.000000000 +0100
-+++ ioemu/vl.h 2006-09-21 19:33:30.000000000 +0100
+--- ioemu.orig/vl.h    2006-10-24 14:45:38.000000000 +0100
++++ ioemu/vl.h 2006-10-24 14:45:39.000000000 +0100
 @@ -576,7 +576,7 @@
                                   int boot_device,
               DisplayState *ds, const char **fd_filename, int snapshot,
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/qemu-bootorder
--- a/tools/ioemu/patches/qemu-bootorder        Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/patches/qemu-bootorder        Thu Nov 09 15:37:17 2006 -0500
@@ -1,9 +1,9 @@ Index: ioemu/vl.c
 Index: ioemu/vl.c
 ===================================================================
---- ioemu.orig/vl.c    2006-09-21 19:33:32.000000000 +0100
-+++ ioemu/vl.c 2006-09-21 19:33:32.000000000 +0100
-@@ -124,7 +124,7 @@
- int vncunused;
+--- ioemu.orig/vl.c    2006-10-24 14:33:47.000000000 +0100
++++ ioemu/vl.c 2006-10-24 14:33:47.000000000 +0100
+@@ -125,7 +125,7 @@
+ struct sockaddr_in vnclisten_addr;
  const char* keyboard_layout = NULL;
  int64_t ticks_per_sec;
 -int boot_device = 'c';
@@ -11,7 +11,7 @@ Index: ioemu/vl.c
  uint64_t ram_size;
  int pit_min_timer_count = 0;
  int nb_nics;
-@@ -6063,14 +6063,14 @@
+@@ -6075,14 +6075,14 @@
                  break;
  #endif /* !CONFIG_DM */
              case QEMU_OPTION_boot:
@@ -32,7 +32,7 @@ Index: ioemu/vl.c
                      exit(1);
                  }
                  break;
-@@ -6334,6 +6334,7 @@
+@@ -6349,6 +6349,7 @@
          fd_filename[0] == '\0')
          help();
      
@@ -40,7 +40,7 @@ Index: ioemu/vl.c
      /* boot to cd by default if no hard disk */
      if (hd_filename[0] == '\0' && boot_device == 'c') {
          if (fd_filename[0] != '\0')
-@@ -6341,6 +6342,7 @@
+@@ -6356,6 +6357,7 @@
          else
              boot_device = 'd';
      }
@@ -48,7 +48,7 @@ Index: ioemu/vl.c
  #endif /* !CONFIG_DM */
  
      setvbuf(stdout, NULL, _IOLBF, 0);
-@@ -6599,6 +6601,7 @@
+@@ -6614,6 +6616,7 @@
                    ds, fd_filename, snapshot,
                    kernel_filename, kernel_cmdline, initrd_filename,
                    timeoffset);
@@ -58,9 +58,9 @@ Index: ioemu/vl.c
      if (usb_enabled) {
 Index: ioemu/vl.h
 ===================================================================
---- ioemu.orig/vl.h    2006-09-21 19:33:32.000000000 +0100
-+++ ioemu/vl.h 2006-09-21 19:33:32.000000000 +0100
-@@ -576,7 +576,7 @@
+--- ioemu.orig/vl.h    2006-10-24 14:33:47.000000000 +0100
++++ ioemu/vl.h 2006-10-24 14:33:47.000000000 +0100
+@@ -578,7 +578,7 @@
  #ifndef QEMU_TOOL
  
  typedef void QEMUMachineInitFunc(uint64_t ram_size, int vga_ram_size, 
@@ -69,7 +69,7 @@ Index: ioemu/vl.h
               DisplayState *ds, const char **fd_filename, int snapshot,
               const char *kernel_filename, const char *kernel_cmdline,
               const char *initrd_filename, time_t timeoffset);
-@@ -1021,7 +1021,7 @@
+@@ -1023,7 +1023,7 @@
                      uint32_t start, uint32_t count);
  int PPC_NVRAM_set_params (m48t59_t *nvram, uint16_t NVRAM_size,
                            const unsigned char *arch,
@@ -80,8 +80,8 @@ Index: ioemu/vl.h
                            uint32_t initrd_image, uint32_t initrd_size,
 Index: ioemu/hw/pc.c
 ===================================================================
---- ioemu.orig/hw/pc.c 2006-09-21 19:33:32.000000000 +0100
-+++ ioemu/hw/pc.c      2006-09-21 19:33:32.000000000 +0100
+--- ioemu.orig/hw/pc.c 2006-10-24 14:33:47.000000000 +0100
++++ ioemu/hw/pc.c      2006-10-24 14:33:47.000000000 +0100
 @@ -158,8 +158,23 @@
      rtc_set_memory(s, info_ofs + 8, sectors);
  }
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/qemu-cleanup
--- a/tools/ioemu/patches/qemu-cleanup  Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/patches/qemu-cleanup  Thu Nov 09 15:37:17 2006 -0500
@@ -1,7 +1,7 @@ Index: ioemu/hw/vga.c
 Index: ioemu/hw/vga.c
 ===================================================================
---- ioemu.orig/hw/vga.c        2006-08-06 02:03:51.906765409 +0100
-+++ ioemu/hw/vga.c     2006-08-06 02:15:10.364150665 +0100
+--- ioemu.orig/hw/vga.c        2006-10-24 14:44:03.000000000 +0100
++++ ioemu/hw/vga.c     2006-10-24 14:45:22.000000000 +0100
 @@ -1622,7 +1622,9 @@
  static void vga_save(QEMUFile *f, void *opaque)
  {
@@ -26,8 +26,8 @@ Index: ioemu/hw/vga.c
          return -EINVAL;
 Index: ioemu/vl.c
 ===================================================================
---- ioemu.orig/vl.c    2006-08-06 02:15:01.774108287 +0100
-+++ ioemu/vl.c 2006-08-06 02:15:31.040845624 +0100
+--- ioemu.orig/vl.c    2006-10-24 14:44:08.000000000 +0100
++++ ioemu/vl.c 2006-10-24 14:45:29.000000000 +0100
 @@ -39,6 +39,7 @@
  #include <sys/ioctl.h>
  #include <sys/socket.h>
@@ -36,6 +36,24 @@ Index: ioemu/vl.c
  #include <dirent.h>
  #include <netdb.h>
  #ifdef _BSD
+@@ -2932,7 +2933,7 @@
+     }
+ 
+     /* XXX: better tmp dir construction */
+-    snprintf(smb_dir, sizeof(smb_dir), "/tmp/qemu-smb.%d", getpid());
++    snprintf(smb_dir, sizeof(smb_dir), "/tmp/qemu-smb.%ld", (long)getpid());
+     if (mkdir(smb_dir, 0700) < 0) {
+         fprintf(stderr, "qemu: could not create samba server dir '%s'\n", 
smb_dir);
+         exit(1);
+@@ -3893,7 +3894,7 @@
+                 perror("Opening pidfile");
+                 exit(1);
+             }
+-            fprintf(f, "%d\n", getpid());
++            fprintf(f, "%ld\n", (long)getpid());
+             fclose(f);
+             pid_filename = qemu_strdup(filename);
+             if (!pid_filename) {
 @@ -5308,7 +5309,9 @@
      QEMU_OPTION_d,
      QEMU_OPTION_hdachs,
@@ -70,8 +88,8 @@ Index: ioemu/vl.c
                      fprintf(stderr, "qemu: too many network clients\n");
 Index: ioemu/vl.h
 ===================================================================
---- ioemu.orig/vl.h    2006-08-06 02:15:01.775108175 +0100
-+++ ioemu/vl.h 2006-08-06 02:15:10.368150219 +0100
+--- ioemu.orig/vl.h    2006-10-24 14:44:08.000000000 +0100
++++ ioemu/vl.h 2006-10-24 14:45:22.000000000 +0100
 @@ -957,7 +957,7 @@
               unsigned long vram_offset, int vram_size, int width, int height);
  
@@ -81,3 +99,18 @@ Index: ioemu/vl.h
  void slavio_intctl_set_cpu(void *opaque, unsigned int cpu, CPUState *env);
  void slavio_pic_info(void *opaque);
  void slavio_irq_info(void *opaque);
+Index: ioemu/usb-linux.c
+===================================================================
+--- ioemu.orig/usb-linux.c     2006-10-24 14:44:03.000000000 +0100
++++ ioemu/usb-linux.c  2006-10-24 14:44:08.000000000 +0100
+@@ -26,7 +26,9 @@
+ #if defined(__linux__)
+ #include <dirent.h>
+ #include <sys/ioctl.h>
+-#include <linux/compiler.h>
++/* Some versions of usbdevice_fs.h need __user to be defined for them.   */
++/* This may (harmlessly) conflict with a definition in linux/compiler.h. */
++#define __user
+ #include <linux/usbdevice_fs.h>
+ #include <linux/version.h>
+ 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/qemu-daemonize
--- a/tools/ioemu/patches/qemu-daemonize        Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/patches/qemu-daemonize        Thu Nov 09 15:37:17 2006 -0500
@@ -2,9 +2,9 @@ Changes required because qemu-dm runs da
 
 Index: ioemu/vl.c
 ===================================================================
---- ioemu.orig/vl.c    2006-09-21 19:33:32.000000000 +0100
-+++ ioemu/vl.c 2006-09-21 19:33:32.000000000 +0100
-@@ -6042,10 +6042,11 @@
+--- ioemu.orig/vl.c    2006-10-24 14:33:47.000000000 +0100
++++ ioemu/vl.c 2006-10-24 14:33:47.000000000 +0100
+@@ -6054,10 +6054,11 @@
                  }
                  break;
              case QEMU_OPTION_nographic:
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/qemu-logging
--- a/tools/ioemu/patches/qemu-logging  Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/patches/qemu-logging  Thu Nov 09 15:37:17 2006 -0500
@@ -1,7 +1,7 @@ Index: ioemu/vl.c
 Index: ioemu/vl.c
 ===================================================================
---- ioemu.orig/vl.c    2006-08-06 02:15:48.550893605 +0100
-+++ ioemu/vl.c 2006-08-06 02:16:31.246133963 +0100
+--- ioemu.orig/vl.c    2006-10-24 14:36:58.000000000 +0100
++++ ioemu/vl.c 2006-10-24 14:37:03.000000000 +0100
 @@ -5234,7 +5234,7 @@
             "-S              freeze CPU at startup (use 'c' to start 
execution)\n"
             "-s              wait gdb connection to port %d\n"
@@ -43,7 +43,7 @@ Index: ioemu/vl.c
      /* default mac address of the first network interface */
      
 +    /* init debug */
-+    sprintf(qemu_dm_logfilename, "/var/log/xen/qemu-dm.%d.log", getpid());
++    sprintf(qemu_dm_logfilename, "/var/log/xen/qemu-dm.%ld.log", 
(long)getpid());
 +    cpu_set_log_filename(qemu_dm_logfilename);
 +    cpu_set_log(0);
 +    
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/qemu-target-i386-dm
--- a/tools/ioemu/patches/qemu-target-i386-dm   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/patches/qemu-target-i386-dm   Thu Nov 09 15:37:17 2006 -0500
@@ -1,7 +1,7 @@ Index: ioemu/Makefile.target
 Index: ioemu/Makefile.target
 ===================================================================
---- ioemu.orig/Makefile.target 2006-09-21 11:30:11.000000000 +0100
-+++ ioemu/Makefile.target      2006-09-21 18:54:22.000000000 +0100
+--- ioemu.orig/Makefile.target 2006-10-24 13:47:23.000000000 +0100
++++ ioemu/Makefile.target      2006-10-24 14:30:56.000000000 +0100
 @@ -62,6 +62,8 @@
  QEMU_SYSTEM=qemu-fast
  endif
@@ -32,8 +32,8 @@ Index: ioemu/Makefile.target
  DEFINES += -DHAS_AUDIO
 Index: ioemu/configure
 ===================================================================
---- ioemu.orig/configure       2006-09-21 11:30:11.000000000 +0100
-+++ ioemu/configure    2006-09-21 18:54:21.000000000 +0100
+--- ioemu.orig/configure       2006-10-24 13:47:23.000000000 +0100
++++ ioemu/configure    2006-10-24 14:29:34.000000000 +0100
 @@ -373,6 +373,8 @@
      if [ "$user" = "yes" ] ; then
          target_list="i386-user arm-user armeb-user sparc-user ppc-user 
mips-user mipsel-user $target_list"
@@ -45,8 +45,8 @@ Index: ioemu/configure
  fi
 Index: ioemu/monitor.c
 ===================================================================
---- ioemu.orig/monitor.c       2006-09-21 11:30:11.000000000 +0100
-+++ ioemu/monitor.c    2006-09-21 18:54:23.000000000 +0100
+--- ioemu.orig/monitor.c       2006-10-24 13:47:23.000000000 +0100
++++ ioemu/monitor.c    2006-10-24 14:30:56.000000000 +0100
 @@ -1262,6 +1262,10 @@
        "", "show profiling information", },
      { "capture", "", do_info_capture,
@@ -60,8 +60,8 @@ Index: ioemu/monitor.c
  
 Index: ioemu/vl.c
 ===================================================================
---- ioemu.orig/vl.c    2006-09-21 11:30:11.000000000 +0100
-+++ ioemu/vl.c 2006-09-21 18:54:23.000000000 +0100
+--- ioemu.orig/vl.c    2006-10-24 13:47:23.000000000 +0100
++++ ioemu/vl.c 2006-10-24 14:30:56.000000000 +0100
 @@ -87,7 +87,7 @@
  
  #include "exec-all.h"
@@ -98,8 +98,8 @@ Index: ioemu/vl.c
  {
 Index: ioemu/vl.h
 ===================================================================
---- ioemu.orig/vl.h    2006-09-21 11:30:11.000000000 +0100
-+++ ioemu/vl.h 2006-09-21 18:54:23.000000000 +0100
+--- ioemu.orig/vl.h    2006-10-24 13:47:23.000000000 +0100
++++ ioemu/vl.h 2006-10-24 14:30:56.000000000 +0100
 @@ -37,6 +37,8 @@
  #include <unistd.h>
  #include <fcntl.h>
@@ -132,7 +132,7 @@ Index: ioemu/target-i386-dm/cpu.h
 Index: ioemu/target-i386-dm/cpu.h
 ===================================================================
 --- /dev/null  1970-01-01 00:00:00.000000000 +0000
-+++ ioemu/target-i386-dm/cpu.h 2006-09-21 18:54:22.000000000 +0100
++++ ioemu/target-i386-dm/cpu.h 2006-10-24 14:30:56.000000000 +0100
 @@ -0,0 +1,86 @@
 +/*
 + * i386 virtual CPU header
@@ -223,7 +223,7 @@ Index: ioemu/target-i386-dm/exec-dm.c
 Index: ioemu/target-i386-dm/exec-dm.c
 ===================================================================
 --- /dev/null  1970-01-01 00:00:00.000000000 +0000
-+++ ioemu/target-i386-dm/exec-dm.c     2006-09-21 18:54:22.000000000 +0100
++++ ioemu/target-i386-dm/exec-dm.c     2006-10-24 14:30:56.000000000 +0100
 @@ -0,0 +1,516 @@
 +/*
 + *  virtual page mapping and translated block handling
@@ -744,7 +744,7 @@ Index: ioemu/target-i386-dm/helper2.c
 Index: ioemu/target-i386-dm/helper2.c
 ===================================================================
 --- /dev/null  1970-01-01 00:00:00.000000000 +0000
-+++ ioemu/target-i386-dm/helper2.c     2006-09-21 18:55:31.000000000 +0100
++++ ioemu/target-i386-dm/helper2.c     2006-10-24 14:31:01.000000000 +0100
 @@ -0,0 +1,469 @@
 +/*
 + *  i386 helpers (without register variable usage)
@@ -1205,8 +1205,8 @@ Index: ioemu/target-i386-dm/helper2.c
 +                break;
 +        }
 +
-+        /* Wait up to 100 msec. */
-+        main_loop_wait(100);
++        /* Wait up to 10 msec. */
++        main_loop_wait(10);
 +
 +        if (env->send_event) {
 +            env->send_event = 0;
@@ -1218,7 +1218,7 @@ Index: ioemu/target-i386-dm/i8259-dm.c
 Index: ioemu/target-i386-dm/i8259-dm.c
 ===================================================================
 --- /dev/null  1970-01-01 00:00:00.000000000 +0000
-+++ ioemu/target-i386-dm/i8259-dm.c    2006-09-21 11:30:11.000000000 +0100
++++ ioemu/target-i386-dm/i8259-dm.c    2006-10-24 13:47:23.000000000 +0100
 @@ -0,0 +1,107 @@
 +/* Xen 8259 stub for interrupt controller emulation
 + * 
@@ -1330,7 +1330,7 @@ Index: ioemu/target-i386-dm/qemu-dm.debu
 Index: ioemu/target-i386-dm/qemu-dm.debug
 ===================================================================
 --- /dev/null  1970-01-01 00:00:00.000000000 +0000
-+++ ioemu/target-i386-dm/qemu-dm.debug 2006-09-21 11:30:11.000000000 +0100
++++ ioemu/target-i386-dm/qemu-dm.debug 2006-10-24 13:47:23.000000000 +0100
 @@ -0,0 +1,5 @@
 +#!/bin/sh
 +
@@ -1340,7 +1340,7 @@ Index: ioemu/target-i386-dm/qemu-ifup
 Index: ioemu/target-i386-dm/qemu-ifup
 ===================================================================
 --- /dev/null  1970-01-01 00:00:00.000000000 +0000
-+++ ioemu/target-i386-dm/qemu-ifup     2006-09-21 11:30:11.000000000 +0100
++++ ioemu/target-i386-dm/qemu-ifup     2006-10-24 13:47:23.000000000 +0100
 @@ -0,0 +1,10 @@
 +#!/bin/sh
 +
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/series
--- a/tools/ioemu/patches/series        Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/patches/series        Thu Nov 09 15:37:17 2006 -0500
@@ -32,10 +32,12 @@ fix-vga-scanning-code-overflow
 fix-vga-scanning-code-overflow
 vnc-cleanup
 vnc-fixes
+vnc-protocol-fixes
 vnc-start-vncviewer
 vnc-title-domain-name
 vnc-access-monitor-vt
 vnc-display-find-unused
+vnc-listen-specific-interface
 vnc-backoff-screen-scan
 xenstore-block-device-config
 xenstore-write-vnc-port
@@ -47,3 +49,7 @@ qemu-bootorder
 qemu-bootorder
 qemu-tunable-ide-write-cache
 qemu-pci 
+serial-port-rate-limit
+hypervisor-rtc
+ide-cd-dma
+vnc-password
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/vnc-access-monitor-vt
--- a/tools/ioemu/patches/vnc-access-monitor-vt Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/patches/vnc-access-monitor-vt Thu Nov 09 15:37:17 2006 -0500
@@ -1,8 +1,8 @@ Index: ioemu/vnc.c
 Index: ioemu/vnc.c
 ===================================================================
---- ioemu.orig/vnc.c   2006-09-21 19:33:31.000000000 +0100
-+++ ioemu/vnc.c        2006-09-21 19:33:31.000000000 +0100
-@@ -32,6 +32,10 @@
+--- ioemu.orig/vnc.c   2006-10-24 14:33:46.000000000 +0100
++++ ioemu/vnc.c        2006-10-24 14:33:46.000000000 +0100
+@@ -33,6 +33,10 @@
  #include "vnc_keysym.h"
  #include "keymaps.c"
  
@@ -13,7 +13,7 @@ Index: ioemu/vnc.c
  typedef struct Buffer
  {
      size_t capacity;
-@@ -95,6 +99,8 @@
+@@ -96,6 +100,8 @@
      int visible_h;
  
      int slow_client;
@@ -22,7 +22,7 @@ Index: ioemu/vnc.c
  };
  
  #define DIRTY_PIXEL_BITS 64
-@@ -791,16 +797,80 @@
+@@ -794,16 +800,80 @@
  
  static void do_key_event(VncState *vs, int down, uint32_t sym)
  {
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/vnc-backoff-screen-scan
--- a/tools/ioemu/patches/vnc-backoff-screen-scan       Fri Nov 03 16:53:17 
2006 -0500
+++ b/tools/ioemu/patches/vnc-backoff-screen-scan       Thu Nov 09 15:37:17 
2006 -0500
@@ -1,10 +1,10 @@ Index: ioemu/vnc.c
 Index: ioemu/vnc.c
 ===================================================================
---- ioemu.orig/vnc.c   2006-09-21 19:31:03.000000000 +0100
-+++ ioemu/vnc.c        2006-09-21 19:32:23.000000000 +0100
-@@ -27,7 +27,19 @@
- #include "vl.h"
+--- ioemu.orig/vnc.c   2006-10-24 14:33:17.000000000 +0100
++++ ioemu/vnc.c        2006-10-24 14:33:24.000000000 +0100
+@@ -28,7 +28,19 @@
  #include "qemu_socket.h"
+ #include <assert.h>
  
 -#define VNC_REFRESH_INTERVAL (1000 / 30)
 +/* The refresh interval starts at BASE.  If we scan the buffer and
@@ -23,7 +23,7 @@ Index: ioemu/vnc.c
  
  #include "vnc_keysym.h"
  #include "keymaps.c"
-@@ -64,10 +76,11 @@
+@@ -65,10 +77,11 @@
  struct VncState
  {
      QEMUTimer *timer;
@@ -36,7 +36,7 @@ Index: ioemu/vnc.c
      int width;
      int height;
      uint64_t *dirty_row;      /* screen regions which are possibly dirty */
-@@ -98,8 +111,6 @@
+@@ -99,8 +112,6 @@
      int visible_w;
      int visible_h;
  
@@ -45,7 +45,7 @@ Index: ioemu/vnc.c
      int ctl_keys;               /* Ctrl+Alt starts calibration */
  };
  
-@@ -380,7 +391,7 @@
+@@ -381,7 +392,7 @@
      int y = 0;
      int pitch = ds->linesize;
      VncState *vs = ds->opaque;
@@ -54,19 +54,19 @@ Index: ioemu/vnc.c
  
      if (src_x < vs->visible_x || src_y < vs->visible_y ||
        dst_x < vs->visible_x || dst_y < vs->visible_y ||
-@@ -390,11 +401,6 @@
+@@ -391,10 +402,8 @@
        (dst_y + h) > (vs->visible_y + vs->visible_h))
        updating_client = 0;
  
 -    if (updating_client) {
 -      vs->need_update = 1;
--      _vnc_update_client(vs);
++    if (updating_client)
+       _vnc_update_client(vs);
 -    }
--
+ 
      if (dst_y > src_y) {
        y = h - 1;
-       pitch = -pitch;
-@@ -445,110 +451,145 @@
+@@ -446,110 +455,149 @@
  static void _vnc_update_client(void *opaque)
  {
      VncState *vs = opaque;
@@ -279,12 +279,16 @@ Index: ioemu/vnc.c
 +             interested (e.g. minimised) it'll ignore this, and we
 +             can stop scanning the buffer until it sends another
 +             update request. */
-+          /* Note that there are bugs in xvncviewer which prevent
-+             this from actually working.  Leave the code in place
-+             for correct clients. */
++          /* It turns out that there's a bug in realvncviewer 4.1.2
++             which means that if you send a proper null update (with
++             no update rectangles), it gets a bit out of sync and
++             never sends any further requests, regardless of whether
++             it needs one or not.  Fix this by sending a single 1x1
++             update rectangle instead. */
 +          vnc_write_u8(vs, 0);
 +          vnc_write_u8(vs, 0);
-+          vnc_write_u16(vs, 0);
++          vnc_write_u16(vs, 1);
++          send_framebuffer_update(vs, 0, 0, 1, 1);
 +          vnc_flush(vs);
 +          vs->last_update_time = now;
 +          return;
@@ -295,7 +299,7 @@ Index: ioemu/vnc.c
  }
  
  static void vnc_update_client(void *opaque)
-@@ -561,8 +602,10 @@
+@@ -562,8 +610,10 @@
  
  static void vnc_timer_init(VncState *vs)
  {
@@ -307,7 +311,7 @@ Index: ioemu/vnc.c
  }
  
  static void vnc_dpy_refresh(DisplayState *ds)
-@@ -622,7 +665,6 @@
+@@ -623,7 +673,6 @@
        vs->csock = -1;
        buffer_reset(&vs->input);
        buffer_reset(&vs->output);
@@ -315,7 +319,7 @@ Index: ioemu/vnc.c
        return 0;
      }
      return ret;
-@@ -892,7 +934,6 @@
+@@ -895,7 +944,6 @@
                                       int x_position, int y_position,
                                       int w, int h)
  {
@@ -323,7 +327,7 @@ Index: ioemu/vnc.c
      if (!incremental)
        framebuffer_set_updated(vs, x_position, y_position, w, h);
      vs->visible_x = x_position;
-@@ -1015,6 +1056,7 @@
+@@ -1018,6 +1066,7 @@
  {
      int i;
      uint16_t limit;
@@ -331,7 +335,7 @@ Index: ioemu/vnc.c
  
      switch (data[0]) {
      case 0:
-@@ -1054,12 +1096,18 @@
+@@ -1061,12 +1110,18 @@
        if (len == 1)
            return 8;
  
@@ -352,15 +356,15 @@ Index: ioemu/vnc.c
      case 6:
 Index: ioemu/vl.c
 ===================================================================
---- ioemu.orig/vl.c    2006-09-21 19:31:03.000000000 +0100
-+++ ioemu/vl.c 2006-09-21 19:32:23.000000000 +0100
-@@ -725,6 +725,12 @@
+--- ioemu.orig/vl.c    2006-10-24 14:33:17.000000000 +0100
++++ ioemu/vl.c 2006-10-24 14:33:24.000000000 +0100
+@@ -726,6 +726,12 @@
      }
  }
  
 +void qemu_advance_timer(QEMUTimer *ts, int64_t expire_time)
 +{
-+    if (ts->expire_time > expire_time)
++    if (ts->expire_time > expire_time || !qemu_timer_pending(ts))
 +      qemu_mod_timer(ts, expire_time);
 +}
 +
@@ -369,9 +373,9 @@ Index: ioemu/vl.c
  void qemu_mod_timer(QEMUTimer *ts, int64_t expire_time)
 Index: ioemu/vl.h
 ===================================================================
---- ioemu.orig/vl.h    2006-09-21 19:31:03.000000000 +0100
-+++ ioemu/vl.h 2006-09-21 19:32:23.000000000 +0100
-@@ -405,6 +405,7 @@
+--- ioemu.orig/vl.h    2006-10-24 14:33:17.000000000 +0100
++++ ioemu/vl.h 2006-10-24 14:33:24.000000000 +0100
+@@ -407,6 +407,7 @@
  void qemu_free_timer(QEMUTimer *ts);
  void qemu_del_timer(QEMUTimer *ts);
  void qemu_mod_timer(QEMUTimer *ts, int64_t expire_time);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/vnc-display-find-unused
--- a/tools/ioemu/patches/vnc-display-find-unused       Fri Nov 03 16:53:17 
2006 -0500
+++ b/tools/ioemu/patches/vnc-display-find-unused       Thu Nov 09 15:37:17 
2006 -0500
@@ -1,8 +1,8 @@ Index: ioemu/vnc.c
 Index: ioemu/vnc.c
 ===================================================================
---- ioemu.orig/vnc.c   2006-09-21 19:33:31.000000000 +0100
-+++ ioemu/vnc.c        2006-09-21 19:33:31.000000000 +0100
-@@ -1182,7 +1182,7 @@
+--- ioemu.orig/vnc.c   2006-10-24 14:31:09.000000000 +0100
++++ ioemu/vnc.c        2006-10-24 14:31:36.000000000 +0100
+@@ -1195,7 +1195,7 @@
      }
  }
  
@@ -11,7 +11,7 @@ Index: ioemu/vnc.c
  {
      struct sockaddr_in addr;
      int reuse_addr, ret;
-@@ -1213,10 +1213,6 @@
+@@ -1226,10 +1226,6 @@
        exit(1);
      }
  
@@ -22,7 +22,7 @@ Index: ioemu/vnc.c
      reuse_addr = 1;
      ret = setsockopt(vs->lsock, SOL_SOCKET, SO_REUSEADDR,
                     (const char *)&reuse_addr, sizeof(reuse_addr));
-@@ -1225,7 +1221,16 @@
+@@ -1238,7 +1234,16 @@
        exit(1);
      }
  
@@ -39,7 +39,7 @@ Index: ioemu/vnc.c
        fprintf(stderr, "bind() failed\n");
        exit(1);
      }
-@@ -1246,6 +1251,8 @@
+@@ -1259,6 +1264,8 @@
      vs->ds->dpy_refresh = vnc_dpy_refresh;
  
      vnc_dpy_resize(vs->ds, 640, 400);
@@ -50,8 +50,8 @@ Index: ioemu/vnc.c
  int vnc_start_viewer(int port)
 Index: ioemu/vl.c
 ===================================================================
---- ioemu.orig/vl.c    2006-09-21 19:33:31.000000000 +0100
-+++ ioemu/vl.c 2006-09-21 19:33:31.000000000 +0100
+--- ioemu.orig/vl.c    2006-10-24 14:31:09.000000000 +0100
++++ ioemu/vl.c 2006-10-24 14:31:41.000000000 +0100
 @@ -121,6 +121,7 @@
  static DisplayState display_state;
  int nographic;
@@ -99,7 +99,7 @@ Index: ioemu/vl.c
 +            case QEMU_OPTION_vncunused:
 +                vncunused++;
 +                if (vnc_display == -1)
-+                    vnc_display = -2;
++                    vnc_display = 0;
 +                break;
              }
          }
@@ -115,8 +115,8 @@ Index: ioemu/vl.c
      } else {
 Index: ioemu/vl.h
 ===================================================================
---- ioemu.orig/vl.h    2006-09-21 19:33:31.000000000 +0100
-+++ ioemu/vl.h 2006-09-21 19:33:31.000000000 +0100
+--- ioemu.orig/vl.h    2006-10-24 14:31:09.000000000 +0100
++++ ioemu/vl.h 2006-10-24 14:31:36.000000000 +0100
 @@ -785,7 +785,7 @@
  void cocoa_display_init(DisplayState *ds, int full_screen);
  
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/vnc-fixes
--- a/tools/ioemu/patches/vnc-fixes     Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/patches/vnc-fixes     Thu Nov 09 15:37:17 2006 -0500
@@ -1,7 +1,7 @@ Index: ioemu/vl.c
 Index: ioemu/vl.c
 ===================================================================
---- ioemu.orig/vl.c    2006-09-21 19:08:18.000000000 +0100
-+++ ioemu/vl.c 2006-09-21 19:26:24.000000000 +0100
+--- ioemu.orig/vl.c    2006-10-24 13:47:23.000000000 +0100
++++ ioemu/vl.c 2006-10-24 14:19:36.000000000 +0100
 @@ -6534,8 +6534,10 @@
          }
      }
@@ -17,8 +17,8 @@ Index: ioemu/vl.c
      if (use_gdbstub) {
 Index: ioemu/vnc.c
 ===================================================================
---- ioemu.orig/vnc.c   2006-09-21 19:08:18.000000000 +0100
-+++ ioemu/vnc.c        2006-09-21 19:26:38.000000000 +0100
+--- ioemu.orig/vnc.c   2006-10-24 13:47:23.000000000 +0100
++++ ioemu/vnc.c        2006-10-24 14:20:00.000000000 +0100
 @@ -3,6 +3,7 @@
   * 
   * Copyright (C) 2006 Anthony Liguori <anthony@xxxxxxxxxxxxx>
@@ -483,7 +483,16 @@ Index: ioemu/vnc.c
  
      vga_hw_invalidate();
      vga_hw_update();
-@@ -1010,11 +1101,11 @@
+@@ -924,6 +1015,8 @@
+ {
+     char pad[3] = { 0, 0, 0 };
+ 
++    vga_hw_update();
++
+     vs->width = vs->ds->width;
+     vs->height = vs->ds->height;
+     vnc_write_u16(vs, vs->ds->width);
+@@ -1010,11 +1103,11 @@
        vnc_write(vs, "RFB 003.003\n", 12);
        vnc_flush(vs);
        vnc_read_when(vs, protocol_version, 12);
@@ -497,7 +506,7 @@ Index: ioemu/vnc.c
      }
  }
  
-@@ -1071,17 +1162,15 @@
+@@ -1071,17 +1164,15 @@
        exit(1);
      }
  
@@ -520,8 +529,8 @@ Index: ioemu/vnc.c
  }
 Index: ioemu/vl.h
 ===================================================================
---- ioemu.orig/vl.h    2006-09-21 19:00:48.000000000 +0100
-+++ ioemu/vl.h 2006-09-21 19:26:24.000000000 +0100
+--- ioemu.orig/vl.h    2006-10-24 13:47:23.000000000 +0100
++++ ioemu/vl.h 2006-10-24 14:19:36.000000000 +0100
 @@ -319,6 +319,7 @@
  int is_graphic_console(void);
  CharDriverState *text_console_init(DisplayState *ds);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/vnc-start-vncviewer
--- a/tools/ioemu/patches/vnc-start-vncviewer   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/patches/vnc-start-vncviewer   Thu Nov 09 15:37:17 2006 -0500
@@ -1,8 +1,8 @@ Index: ioemu/vnc.c
 Index: ioemu/vnc.c
 ===================================================================
---- ioemu.orig/vnc.c   2006-09-21 19:26:38.000000000 +0100
-+++ ioemu/vnc.c        2006-09-21 19:29:58.000000000 +0100
-@@ -1174,3 +1174,25 @@
+--- ioemu.orig/vnc.c   2006-10-24 14:33:46.000000000 +0100
++++ ioemu/vnc.c        2006-10-24 14:33:46.000000000 +0100
+@@ -1187,3 +1187,25 @@
  
      vnc_dpy_resize(vs->ds, 640, 400);
  }
@@ -30,8 +30,8 @@ Index: ioemu/vnc.c
 +}
 Index: ioemu/vl.c
 ===================================================================
---- ioemu.orig/vl.c    2006-09-21 19:26:24.000000000 +0100
-+++ ioemu/vl.c 2006-09-21 19:29:50.000000000 +0100
+--- ioemu.orig/vl.c    2006-10-24 14:33:46.000000000 +0100
++++ ioemu/vl.c 2006-10-24 14:33:46.000000000 +0100
 @@ -120,6 +120,7 @@
  int bios_size;
  static DisplayState display_state;
@@ -93,8 +93,8 @@ Index: ioemu/vl.c
          sdl_display_init(ds, full_screen);
 Index: ioemu/vl.h
 ===================================================================
---- ioemu.orig/vl.h    2006-09-21 19:26:24.000000000 +0100
-+++ ioemu/vl.h 2006-09-21 19:29:50.000000000 +0100
+--- ioemu.orig/vl.h    2006-10-24 14:33:46.000000000 +0100
++++ ioemu/vl.h 2006-10-24 14:33:46.000000000 +0100
 @@ -786,6 +786,7 @@
  
  /* vnc.c */
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/vnc-title-domain-name
--- a/tools/ioemu/patches/vnc-title-domain-name Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/patches/vnc-title-domain-name Thu Nov 09 15:37:17 2006 -0500
@@ -1,16 +1,16 @@ Index: ioemu/vnc.c
 Index: ioemu/vnc.c
 ===================================================================
---- ioemu.orig/vnc.c   2006-09-21 19:33:31.000000000 +0100
-+++ ioemu/vnc.c        2006-09-21 19:33:31.000000000 +0100
-@@ -1013,6 +1013,7 @@
+--- ioemu.orig/vnc.c   2006-10-24 14:33:46.000000000 +0100
++++ ioemu/vnc.c        2006-10-24 14:33:46.000000000 +0100
+@@ -1024,6 +1024,7 @@
  
  static int protocol_client_init(VncState *vs, char *data, size_t len)
  {
 +    size_t l;
      char pad[3] = { 0, 0, 0 };
  
-     vs->width = vs->ds->width;
-@@ -1058,8 +1059,10 @@
+     vga_hw_update();
+@@ -1071,8 +1072,10 @@
        
      vnc_write(vs, pad, 3);           /* padding */
  
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/xen-build
--- a/tools/ioemu/patches/xen-build     Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/patches/xen-build     Thu Nov 09 15:37:17 2006 -0500
@@ -1,7 +1,7 @@ Index: ioemu/Makefile
 Index: ioemu/Makefile
 ===================================================================
---- ioemu.orig/Makefile        2006-08-28 20:19:23.000000000 +0100
-+++ ioemu/Makefile     2006-08-28 20:20:08.000000000 +0100
+--- ioemu.orig/Makefile        2006-10-24 14:37:25.000000000 +0100
++++ ioemu/Makefile     2006-10-24 14:37:28.000000000 +0100
 @@ -1,11 +1,14 @@
  # Makefile for QEMU.
  
@@ -85,8 +85,8 @@ Index: ioemu/Makefile
  info: qemu-doc.info qemu-tech.info
 Index: ioemu/Makefile.target
 ===================================================================
---- ioemu.orig/Makefile.target 2006-08-28 20:19:23.000000000 +0100
-+++ ioemu/Makefile.target      2006-08-28 20:19:47.000000000 +0100
+--- ioemu.orig/Makefile.target 2006-10-24 14:37:25.000000000 +0100
++++ ioemu/Makefile.target      2006-10-24 14:40:25.000000000 +0100
 @@ -1,5 +1,8 @@
  include config.mak
  
@@ -112,7 +112,7 @@ Index: ioemu/Makefile.target
  endif
 -CFLAGS=-Wall -O2 -g -fno-strict-aliasing
 +CFLAGS+=-Wall -O2 -g -fno-strict-aliasing
-+SSE2 := $(call test-gcc-flag,$(CC),-msse2)
++SSE2 := $(call cc-option,$(CC),-msse2,)
 +ifeq ($(SSE2),-msse2)
 +CFLAGS += -DUSE_SSE2=1 -msse2
 +endif
@@ -149,17 +149,18 @@ Index: ioemu/Makefile.target
  install: all 
 +      mkdir -p "$(DESTDIR)$(bindir)" "$(DESTDIR)$(configdir)"
  ifneq ($(PROGS),)
-       $(INSTALL) -m 755 -s $(PROGS) "$(DESTDIR)$(bindir)"
- endif
-+      install -m 755 $(TARGET_PATH)/qemu-dm.debug "$(DESTDIR)$(bindir)"
-+      install -m 755 $(TARGET_PATH)/qemu-ifup "$(DESTDIR)$(configdir)"
+-      $(INSTALL) -m 755 -s $(PROGS) "$(DESTDIR)$(bindir)"
++      $(INSTALL_PROG) $(PROGS) "$(DESTDIR)$(bindir)"
+ endif
++      $(INSTALL_PROG) $(TARGET_PATH)/qemu-dm.debug "$(DESTDIR)$(bindir)"
++      $(INSTALL_PROG) $(TARGET_PATH)/qemu-ifup "$(DESTDIR)$(configdir)"
  
  ifneq ($(wildcard .depend),)
  include .depend
 Index: ioemu/configure
 ===================================================================
---- ioemu.orig/configure       2006-08-28 20:19:23.000000000 +0100
-+++ ioemu/configure    2006-08-28 20:19:47.000000000 +0100
+--- ioemu.orig/configure       2006-10-24 14:37:25.000000000 +0100
++++ ioemu/configure    2006-10-24 14:40:20.000000000 +0100
 @@ -18,8 +18,8 @@
  
  # default parameters
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/xen-platform-device
--- a/tools/ioemu/patches/xen-platform-device   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/patches/xen-platform-device   Thu Nov 09 15:37:17 2006 -0500
@@ -3,8 +3,8 @@ will come later.
 
 Index: ioemu/Makefile.target
 ===================================================================
---- ioemu.orig/Makefile.target 2006-09-21 19:33:31.000000000 +0100
-+++ ioemu/Makefile.target      2006-09-21 19:33:32.000000000 +0100
+--- ioemu.orig/Makefile.target 2006-10-24 14:41:01.000000000 +0100
++++ ioemu/Makefile.target      2006-10-24 14:41:01.000000000 +0100
 @@ -359,6 +359,7 @@
  VL_OBJS+= usb-uhci.o
  VL_OBJS+= piix4acpi.o
@@ -15,8 +15,8 @@ Index: ioemu/Makefile.target
  ifeq ($(TARGET_BASE_ARCH), ppc)
 Index: ioemu/hw/pc.c
 ===================================================================
---- ioemu.orig/hw/pc.c 2006-09-21 19:33:31.000000000 +0100
-+++ ioemu/hw/pc.c      2006-09-21 19:33:32.000000000 +0100
+--- ioemu.orig/hw/pc.c 2006-10-24 14:41:00.000000000 +0100
++++ ioemu/hw/pc.c      2006-10-24 14:41:01.000000000 +0100
 @@ -823,6 +823,9 @@
      }
  #endif /* !CONFIG_DM */
@@ -30,8 +30,8 @@ Index: ioemu/hw/xen_platform.c
 Index: ioemu/hw/xen_platform.c
 ===================================================================
 --- /dev/null  1970-01-01 00:00:00.000000000 +0000
-+++ ioemu/hw/xen_platform.c    2006-09-21 19:33:32.000000000 +0100
-@@ -0,0 +1,138 @@
++++ ioemu/hw/xen_platform.c    2006-10-24 14:41:04.000000000 +0100
+@@ -0,0 +1,144 @@
 +/*
 + * XEN platform fake pci device, formerly known as the event channel device
 + * 
@@ -131,7 +131,8 @@ Index: ioemu/hw/xen_platform.c
 +    uint8_t  bist; /* Built in self test */
 +    uint32_t base_address_regs[6];
 +    uint32_t reserved1;
-+    uint32_t reserved2;
++    uint16_t subsystem_vendor_id;
++    uint16_t subsystem_id;
 +    uint32_t rom_addr;
 +    uint32_t reserved3;
 +    uint32_t reserved4;
@@ -160,6 +161,11 @@ Index: ioemu/hw/xen_platform.c
 +    pch->header_type = 0;
 +    pch->interrupt_pin = 1;
 +
++    /* Microsoft WHQL requires non-zero subsystem IDs. */
++    /* http://www.pcisig.com/reflector/msg02205.html.  */
++    pch->subsystem_vendor_id = pch->vendor_id; /* Duplicate vendor id.  */
++    pch->subsystem_id        = 0x0001;         /* Hardcode sub-id as 1. */
++
 +    pci_register_io_region(d, 0, 0x100, PCI_ADDRESS_SPACE_IO,
 +                           platform_ioport_map);
 +
@@ -172,9 +178,9 @@ Index: ioemu/hw/xen_platform.c
 +}
 Index: ioemu/vl.h
 ===================================================================
---- ioemu.orig/vl.h    2006-09-21 19:33:32.000000000 +0100
-+++ ioemu/vl.h 2006-09-21 19:33:32.000000000 +0100
-@@ -1210,6 +1210,9 @@
+--- ioemu.orig/vl.h    2006-10-24 14:41:01.000000000 +0100
++++ ioemu/vl.h 2006-10-24 14:41:01.000000000 +0100
+@@ -1212,6 +1212,9 @@
  void xenstore_check_new_media_present(int timeout);
  void xenstore_write_vncport(int vnc_display);
  
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
tools/ioemu/patches/xen-support-buffered-ioreqs
--- a/tools/ioemu/patches/xen-support-buffered-ioreqs   Fri Nov 03 16:53:17 
2006 -0500
+++ b/tools/ioemu/patches/xen-support-buffered-ioreqs   Thu Nov 09 15:37:17 
2006 -0500
@@ -1,8 +1,8 @@ Index: ioemu/vl.c
 Index: ioemu/vl.c
 ===================================================================
---- ioemu.orig/vl.c    2006-09-21 19:33:32.000000000 +0100
-+++ ioemu/vl.c 2006-09-21 19:33:32.000000000 +0100
-@@ -5844,6 +5844,7 @@
+--- ioemu.orig/vl.c    2006-10-24 14:33:47.000000000 +0100
++++ ioemu/vl.c 2006-10-24 14:33:47.000000000 +0100
+@@ -5854,6 +5854,7 @@
      unsigned long nr_pages, tmp_nr_pages, shared_page_nr;
      xen_pfn_t *page_array;
      extern void *shared_page;
@@ -10,7 +10,7 @@ Index: ioemu/vl.c
  
      char qemu_dm_logfilename[64];
  
-@@ -6425,6 +6426,18 @@
+@@ -6440,6 +6441,18 @@
      fprintf(logfile, "shared page at pfn:%lx, mfn: %"PRIx64"\n",
              shared_page_nr, (uint64_t)(page_array[shared_page_nr]));
  
@@ -31,8 +31,8 @@ Index: ioemu/vl.c
  #elif defined(__ia64__)
 Index: ioemu/target-i386-dm/helper2.c
 ===================================================================
---- ioemu.orig/target-i386-dm/helper2.c        2006-09-21 19:33:30.000000000 
+0100
-+++ ioemu/target-i386-dm/helper2.c     2006-09-21 19:33:32.000000000 +0100
+--- ioemu.orig/target-i386-dm/helper2.c        2006-10-24 14:33:45.000000000 
+0100
++++ ioemu/target-i386-dm/helper2.c     2006-10-24 14:33:47.000000000 +0100
 @@ -76,6 +76,10 @@
  
  shared_iopage_t *shared_page = NULL;
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
tools/ioemu/patches/xenstore-block-device-config
--- a/tools/ioemu/patches/xenstore-block-device-config  Fri Nov 03 16:53:17 
2006 -0500
+++ b/tools/ioemu/patches/xenstore-block-device-config  Thu Nov 09 15:37:17 
2006 -0500
@@ -1,7 +1,7 @@ Index: ioemu/Makefile.target
 Index: ioemu/Makefile.target
 ===================================================================
---- ioemu.orig/Makefile.target 2006-09-21 19:33:31.000000000 +0100
-+++ ioemu/Makefile.target      2006-09-21 19:33:31.000000000 +0100
+--- ioemu.orig/Makefile.target 2006-10-24 14:31:36.000000000 +0100
++++ ioemu/Makefile.target      2006-10-24 14:33:28.000000000 +0100
 @@ -358,6 +358,7 @@
  VL_OBJS+= cirrus_vga.o mixeng.o parallel.o acpi.o piix_pci.o
  VL_OBJS+= usb-uhci.o
@@ -13,7 +13,7 @@ Index: ioemu/xenstore.c
 Index: ioemu/xenstore.c
 ===================================================================
 --- /dev/null  1970-01-01 00:00:00.000000000 +0000
-+++ ioemu/xenstore.c   2006-09-21 19:33:31.000000000 +0100
++++ ioemu/xenstore.c   2006-10-24 14:33:28.000000000 +0100
 @@ -0,0 +1,187 @@
 +/*
 + * This file is subject to the terms and conditions of the GNU General
@@ -204,9 +204,9 @@ Index: ioemu/xenstore.c
 +}
 Index: ioemu/vl.c
 ===================================================================
---- ioemu.orig/vl.c    2006-09-21 19:33:31.000000000 +0100
-+++ ioemu/vl.c 2006-09-21 19:33:31.000000000 +0100
-@@ -5249,9 +5249,11 @@
+--- ioemu.orig/vl.c    2006-10-24 14:33:24.000000000 +0100
++++ ioemu/vl.c 2006-10-24 14:33:28.000000000 +0100
+@@ -5256,9 +5256,11 @@
             "Standard options:\n"
             "-M machine      select emulated machine (-M ? for list)\n"
             "-fda/-fdb file  use 'file' as floppy disk 0/1 image\n"
@@ -218,7 +218,7 @@ Index: ioemu/vl.c
             "-boot [a|c|d]   boot on floppy (a), hard disk (c) or CD-ROM (d)\n"
           "-snapshot       write to temporary files instead of disk image 
files\n"
  #ifdef TARGET_I386
-@@ -5378,11 +5380,13 @@
+@@ -5386,11 +5388,13 @@
      QEMU_OPTION_M,
      QEMU_OPTION_fda,
      QEMU_OPTION_fdb,
@@ -232,7 +232,7 @@ Index: ioemu/vl.c
      QEMU_OPTION_boot,
      QEMU_OPTION_snapshot,
  #ifdef TARGET_I386
-@@ -5454,11 +5458,13 @@
+@@ -5463,11 +5467,13 @@
      { "M", HAS_ARG, QEMU_OPTION_M },
      { "fda", HAS_ARG, QEMU_OPTION_fda },
      { "fdb", HAS_ARG, QEMU_OPTION_fdb },
@@ -246,7 +246,7 @@ Index: ioemu/vl.c
      { "boot", HAS_ARG, QEMU_OPTION_boot },
      { "snapshot", 0, QEMU_OPTION_snapshot },
  #ifdef TARGET_I386
-@@ -5807,10 +5813,16 @@
+@@ -5817,10 +5823,16 @@
  #ifdef CONFIG_GDBSTUB
      int use_gdbstub, gdbstub_port;
  #endif
@@ -265,7 +265,7 @@ Index: ioemu/vl.c
      const char *kernel_filename, *kernel_cmdline;
      DisplayState *ds = &display_state;
      int cyls, heads, secs, translation;
-@@ -5871,8 +5883,10 @@
+@@ -5881,8 +5893,10 @@
      initrd_filename = NULL;
      for(i = 0; i < MAX_FD; i++)
          fd_filename[i] = NULL;
@@ -276,7 +276,7 @@ Index: ioemu/vl.c
      ram_size = DEFAULT_RAM_SIZE * 1024 * 1024;
      vga_ram_size = VGA_RAM_SIZE;
      bios_size = BIOS_SIZE;
-@@ -5886,11 +5900,13 @@
+@@ -5896,11 +5910,13 @@
      vncunused = 0;
      kernel_filename = NULL;
      kernel_cmdline = "";
@@ -290,7 +290,7 @@ Index: ioemu/vl.c
      cyls = heads = secs = 0;
      translation = BIOS_ATA_TRANSLATION_AUTO;
      pstrcpy(monitor_device, sizeof(monitor_device), "vc");
-@@ -5923,7 +5939,11 @@
+@@ -5935,7 +5951,11 @@
              break;
          r = argv[optind];
          if (r[0] != '-') {
@@ -302,7 +302,7 @@ Index: ioemu/vl.c
          } else {
              const QEMUOption *popt;
  
-@@ -5967,6 +5987,7 @@
+@@ -5979,6 +5999,7 @@
              case QEMU_OPTION_initrd:
                  initrd_filename = optarg;
                  break;
@@ -310,7 +310,7 @@ Index: ioemu/vl.c
              case QEMU_OPTION_hda:
              case QEMU_OPTION_hdb:
              case QEMU_OPTION_hdc:
-@@ -5979,6 +6000,7 @@
+@@ -5991,6 +6012,7 @@
                          cdrom_index = -1;
                  }
                  break;
@@ -318,7 +318,7 @@ Index: ioemu/vl.c
              case QEMU_OPTION_snapshot:
                  snapshot = 1;
                  break;
-@@ -6031,11 +6053,13 @@
+@@ -6043,11 +6065,13 @@
              case QEMU_OPTION_append:
                  kernel_cmdline = optarg;
                  break;
@@ -332,7 +332,7 @@ Index: ioemu/vl.c
              case QEMU_OPTION_boot:
                  boot_device = optarg[0];
                  if (boot_device != 'a' && 
-@@ -6290,12 +6314,18 @@
+@@ -6305,12 +6329,18 @@
          }
      }
  
@@ -351,7 +351,7 @@ Index: ioemu/vl.c
      if (!linux_boot && 
          hd_filename[0] == '\0' && 
          (cdrom_index >= 0 && hd_filename[cdrom_index] == '\0') &&
-@@ -6309,6 +6339,7 @@
+@@ -6324,6 +6354,7 @@
          else
              boot_device = 'd';
      }
@@ -359,7 +359,7 @@ Index: ioemu/vl.c
  
      setvbuf(stdout, NULL, _IOLBF, 0);
      
-@@ -6441,6 +6472,7 @@
+@@ -6456,6 +6487,7 @@
  
  #endif /* !CONFIG_DM */
  
@@ -367,7 +367,7 @@ Index: ioemu/vl.c
      /* we always create the cdrom drive, even if no disk is there */
      bdrv_init();
      if (cdrom_index >= 0) {
-@@ -6467,6 +6499,7 @@
+@@ -6482,6 +6514,7 @@
              }
          }
      }
@@ -375,7 +375,7 @@ Index: ioemu/vl.c
  
      /* we always create at least one floppy disk */
      fd_table[0] = bdrv_new("fda");
-@@ -6545,6 +6578,8 @@
+@@ -6560,6 +6593,8 @@
          }
      }
  
@@ -386,8 +386,8 @@ Index: ioemu/vl.c
                    kernel_filename, kernel_cmdline, initrd_filename,
 Index: ioemu/monitor.c
 ===================================================================
---- ioemu.orig/monitor.c       2006-09-21 19:33:30.000000000 +0100
-+++ ioemu/monitor.c    2006-09-21 19:33:31.000000000 +0100
+--- ioemu.orig/monitor.c       2006-10-24 14:31:36.000000000 +0100
++++ ioemu/monitor.c    2006-10-24 14:33:28.000000000 +0100
 @@ -24,6 +24,7 @@
  #include "vl.h"
  #include "disas.h"
@@ -416,8 +416,8 @@ Index: ioemu/monitor.c
      int i;
 Index: ioemu/block.c
 ===================================================================
---- ioemu.orig/block.c 2006-09-21 19:33:25.000000000 +0100
-+++ ioemu/block.c      2006-09-21 19:33:31.000000000 +0100
+--- ioemu.orig/block.c 2006-10-24 14:31:36.000000000 +0100
++++ ioemu/block.c      2006-10-24 14:33:28.000000000 +0100
 @@ -758,6 +758,7 @@
  static void raw_close(BlockDriverState *bs)
  {
@@ -428,9 +428,9 @@ Index: ioemu/block.c
  
 Index: ioemu/vl.h
 ===================================================================
---- ioemu.orig/vl.h    2006-09-21 19:33:31.000000000 +0100
-+++ ioemu/vl.h 2006-09-21 19:33:31.000000000 +0100
-@@ -1189,6 +1189,8 @@
+--- ioemu.orig/vl.h    2006-10-24 14:33:24.000000000 +0100
++++ ioemu/vl.h 2006-10-24 14:33:28.000000000 +0100
+@@ -1191,6 +1191,8 @@
  void term_print_help(void);
  void monitor_readline(const char *prompt, int is_password,
                        char *buf, int buf_size);
@@ -439,7 +439,7 @@ Index: ioemu/vl.h
  
  /* readline.c */
  typedef void ReadLineFunc(void *opaque, const char *str);
-@@ -1201,6 +1203,13 @@
+@@ -1203,6 +1205,13 @@
  void readline_start(const char *prompt, int is_password,
                      ReadLineFunc *readline_func, void *opaque);
  
@@ -455,8 +455,8 @@ Index: ioemu/vl.h
  extern char domain_name[];
 Index: ioemu/hw/ide.c
 ===================================================================
---- ioemu.orig/hw/ide.c        2006-09-21 19:33:30.000000000 +0100
-+++ ioemu/hw/ide.c     2006-09-21 19:33:31.000000000 +0100
+--- ioemu.orig/hw/ide.c        2006-10-24 14:31:36.000000000 +0100
++++ ioemu/hw/ide.c     2006-10-24 14:33:28.000000000 +0100
 @@ -1158,6 +1158,7 @@
          } else {
              ide_atapi_cmd_error(s, SENSE_NOT_READY, 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/xenstore-write-vnc-port
--- a/tools/ioemu/patches/xenstore-write-vnc-port       Fri Nov 03 16:53:17 
2006 -0500
+++ b/tools/ioemu/patches/xenstore-write-vnc-port       Thu Nov 09 15:37:17 
2006 -0500
@@ -1,7 +1,7 @@ Index: ioemu/xenstore.c
 Index: ioemu/xenstore.c
 ===================================================================
---- ioemu.orig/xenstore.c      2006-09-21 19:33:31.000000000 +0100
-+++ ioemu/xenstore.c   2006-09-21 19:33:32.000000000 +0100
+--- ioemu.orig/xenstore.c      2006-10-24 14:33:47.000000000 +0100
++++ ioemu/xenstore.c   2006-10-24 14:33:47.000000000 +0100
 @@ -185,3 +185,31 @@
      free(image);
      free(vec);
@@ -36,10 +36,10 @@ Index: ioemu/xenstore.c
 +}
 Index: ioemu/vl.c
 ===================================================================
---- ioemu.orig/vl.c    2006-09-21 19:33:31.000000000 +0100
-+++ ioemu/vl.c 2006-09-21 19:33:32.000000000 +0100
-@@ -6535,6 +6535,7 @@
-       vnc_display = vnc_display_init(ds, vnc_display, vncunused);
+--- ioemu.orig/vl.c    2006-10-24 14:33:47.000000000 +0100
++++ ioemu/vl.c 2006-10-24 14:33:47.000000000 +0100
+@@ -6550,6 +6550,7 @@
+       vnc_display = vnc_display_init(ds, vnc_display, vncunused, 
&vnclisten_addr);
        if (vncviewer)
            vnc_start_viewer(vnc_display);
 +      xenstore_write_vncport(vnc_display);
@@ -48,9 +48,9 @@ Index: ioemu/vl.c
          sdl_display_init(ds, full_screen);
 Index: ioemu/vl.h
 ===================================================================
---- ioemu.orig/vl.h    2006-09-21 19:33:31.000000000 +0100
-+++ ioemu/vl.h 2006-09-21 19:33:32.000000000 +0100
-@@ -1208,6 +1208,7 @@
+--- ioemu.orig/vl.h    2006-10-24 14:33:47.000000000 +0100
++++ ioemu/vl.h 2006-10-24 14:33:47.000000000 +0100
+@@ -1210,6 +1210,7 @@
  int xenstore_fd(void);
  void xenstore_process_event(void *opaque);
  void xenstore_check_new_media_present(int timeout);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/target-i386-dm/exec-dm.c
--- a/tools/ioemu/target-i386-dm/exec-dm.c      Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/target-i386-dm/exec-dm.c      Thu Nov 09 15:37:17 2006 -0500
@@ -32,6 +32,8 @@
 #include <unistd.h>
 #include <inttypes.h>
 
+#include <xen/hvm/e820.h>
+
 #include "cpu.h"
 #include "exec-all.h"
 
@@ -407,22 +409,36 @@ int iomem_index(target_phys_addr_t addr)
         return 0;
 }
 
+static inline int paddr_is_ram(target_phys_addr_t addr)
+{
+    /* Is this guest physical address RAM-backed? */
+#if defined(CONFIG_DM) && (defined(__i386__) || defined(__x86_64__))
+    if (ram_size <= HVM_BELOW_4G_RAM_END)
+        /* RAM is contiguous */
+        return (addr < ram_size);
+    else
+        /* There is RAM below and above the MMIO hole */
+        return ((addr < HVM_BELOW_4G_MMIO_START) ||
+                ((addr >= HVM_BELOW_4G_MMIO_START + HVM_BELOW_4G_MMIO_LENGTH)
+                 && (addr < ram_size + HVM_BELOW_4G_MMIO_LENGTH)));
+#else
+    return (addr < ram_size);
+#endif
+}
+
 void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf, 
                             int len, int is_write)
 {
     int l, io_index;
     uint8_t *ptr;
     uint32_t val;
-    target_phys_addr_t page;
-    unsigned long pd;
     
     while (len > 0) {
-        page = addr & TARGET_PAGE_MASK;
-        l = (page + TARGET_PAGE_SIZE) - addr;
+        /* How much can we copy before the next page boundary? */
+        l = TARGET_PAGE_SIZE - (addr & ~TARGET_PAGE_MASK); 
         if (l > len)
             l = len;
        
-        pd = page;
         io_index = iomem_index(addr);
         if (is_write) {
             if (io_index) {
@@ -442,15 +458,11 @@ void cpu_physical_memory_rw(target_phys_
                     io_mem_write[io_index][0](io_mem_opaque[io_index], addr, 
val);
                     l = 1;
                 }
-            } else {
-                unsigned long addr1;
-
-                addr1 = (pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK);
-                /* RAM case */
-                ptr = phys_ram_base + addr1;
-                memcpy(ptr, buf, l);
+            } else if (paddr_is_ram(addr)) {
+                /* Reading from RAM */
+                memcpy(phys_ram_base + addr, buf, l);
 #ifdef __ia64__
-                sync_icache((unsigned long)ptr, l);
+                sync_icache((unsigned long)(phys_ram_base + addr), l);
 #endif 
             }
         } else {
@@ -471,14 +483,12 @@ void cpu_physical_memory_rw(target_phys_
                     stb_raw(buf, val);
                     l = 1;
                 }
-            } else if (addr < ram_size) {
-                /* RAM case */
-                ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) + 
-                    (addr & ~TARGET_PAGE_MASK);
-                memcpy(buf, ptr, l);
+            } else if (paddr_is_ram(addr)) {
+                /* Reading from RAM */
+                memcpy(buf, phys_ram_base + addr, l);
             } else {
-                /* unreported MMIO space */
-                memset(buf, 0xff, len);
+                /* Neither RAM nor known MMIO space */
+                memset(buf, 0xff, len); 
             }
         }
         len -= l;
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/target-i386-dm/helper2.c
--- a/tools/ioemu/target-i386-dm/helper2.c      Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/target-i386-dm/helper2.c      Thu Nov 09 15:37:17 2006 -0500
@@ -193,10 +193,10 @@ void sp_info()
     for (i = 0; i < vcpus; i++) {
         req = &(shared_page->vcpu_iodata[i].vp_ioreq);
         term_printf("vcpu %d: event port %d\n", i, ioreq_local_port[i]);
-        term_printf("  req state: %x, pvalid: %x, addr: %"PRIx64", "
+        term_printf("  req state: %x, ptr: %x, addr: %"PRIx64", "
                     "data: %"PRIx64", count: %"PRIx64", size: %"PRIx64"\n",
-                    req->state, req->pdata_valid, req->addr,
-                    req->u.data, req->count, req->size);
+                    req->state, req->data_is_ptr, req->addr,
+                    req->data, req->count, req->size);
         term_printf("  IO totally occurred on this vcpu: %"PRIx64"\n",
                     req->io_count);
     }
@@ -216,10 +216,10 @@ static ioreq_t *__cpu_get_ioreq(int vcpu
     }
 
     fprintf(logfile, "False I/O request ... in-service already: "
-            "%x, pvalid: %x, port: %"PRIx64", "
+            "%x, ptr: %x, port: %"PRIx64", "
             "data: %"PRIx64", count: %"PRIx64", size: %"PRIx64"\n",
-            req->state, req->pdata_valid, req->addr,
-            req->u.data, req->count, req->size);
+            req->state, req->data_is_ptr, req->addr,
+            req->data, req->count, req->size);
     return NULL;
 }
 
@@ -305,26 +305,26 @@ void cpu_ioreq_pio(CPUState *env, ioreq_
     sign = req->df ? -1 : 1;
 
     if (req->dir == IOREQ_READ) {
-        if (!req->pdata_valid) {
-            req->u.data = do_inp(env, req->addr, req->size);
+        if (!req->data_is_ptr) {
+            req->data = do_inp(env, req->addr, req->size);
         } else {
             unsigned long tmp;
 
             for (i = 0; i < req->count; i++) {
                 tmp = do_inp(env, req->addr, req->size);
-                write_physical((target_phys_addr_t) req->u.pdata
+                write_physical((target_phys_addr_t) req->data
                   + (sign * i * req->size),
                   req->size, &tmp);
             }
         }
     } else if (req->dir == IOREQ_WRITE) {
-        if (!req->pdata_valid) {
-            do_outp(env, req->addr, req->size, req->u.data);
+        if (!req->data_is_ptr) {
+            do_outp(env, req->addr, req->size, req->data);
         } else {
             for (i = 0; i < req->count; i++) {
                 unsigned long tmp;
 
-                read_physical((target_phys_addr_t) req->u.pdata
+                read_physical((target_phys_addr_t) req->data
                   + (sign * i * req->size),
                   req->size, &tmp);
                 do_outp(env, req->addr, req->size, tmp);
@@ -339,18 +339,18 @@ void cpu_ioreq_move(CPUState *env, ioreq
 
     sign = req->df ? -1 : 1;
 
-    if (!req->pdata_valid) {
+    if (!req->data_is_ptr) {
         if (req->dir == IOREQ_READ) {
             for (i = 0; i < req->count; i++) {
                 read_physical(req->addr
                   + (sign * i * req->size),
-                  req->size, &req->u.data);
+                  req->size, &req->data);
             }
         } else if (req->dir == IOREQ_WRITE) {
             for (i = 0; i < req->count; i++) {
                 write_physical(req->addr
                   + (sign * i * req->size),
-                  req->size, &req->u.data);
+                  req->size, &req->data);
             }
         }
     } else {
@@ -361,13 +361,13 @@ void cpu_ioreq_move(CPUState *env, ioreq
                 read_physical(req->addr
                   + (sign * i * req->size),
                   req->size, &tmp);
-                write_physical((target_phys_addr_t )req->u.pdata
+                write_physical((target_phys_addr_t )req->data
                   + (sign * i * req->size),
                   req->size, &tmp);
             }
         } else if (req->dir == IOREQ_WRITE) {
             for (i = 0; i < req->count; i++) {
-                read_physical((target_phys_addr_t) req->u.pdata
+                read_physical((target_phys_addr_t) req->data
                   + (sign * i * req->size),
                   req->size, &tmp);
                 write_physical(req->addr
@@ -382,51 +382,66 @@ void cpu_ioreq_and(CPUState *env, ioreq_
 {
     unsigned long tmp1, tmp2;
 
-    if (req->pdata_valid != 0)
+    if (req->data_is_ptr != 0)
         hw_error("expected scalar value");
 
     read_physical(req->addr, req->size, &tmp1);
     if (req->dir == IOREQ_WRITE) {
-        tmp2 = tmp1 & (unsigned long) req->u.data;
+        tmp2 = tmp1 & (unsigned long) req->data;
         write_physical(req->addr, req->size, &tmp2);
     }
-    req->u.data = tmp1;
-}
-
-void cpu_ioreq_or(CPUState *env, ioreq_t *req)
+    req->data = tmp1;
+}
+
+void cpu_ioreq_add(CPUState *env, ioreq_t *req)
 {
     unsigned long tmp1, tmp2;
 
-    if (req->pdata_valid != 0)
+    if (req->data_is_ptr != 0)
         hw_error("expected scalar value");
 
     read_physical(req->addr, req->size, &tmp1);
     if (req->dir == IOREQ_WRITE) {
-        tmp2 = tmp1 | (unsigned long) req->u.data;
+        tmp2 = tmp1 + (unsigned long) req->data;
         write_physical(req->addr, req->size, &tmp2);
     }
-    req->u.data = tmp1;
-}
-
-void cpu_ioreq_xor(CPUState *env, ioreq_t *req)
+    req->data = tmp1;
+}
+
+void cpu_ioreq_or(CPUState *env, ioreq_t *req)
 {
     unsigned long tmp1, tmp2;
 
-    if (req->pdata_valid != 0)
+    if (req->data_is_ptr != 0)
         hw_error("expected scalar value");
 
     read_physical(req->addr, req->size, &tmp1);
     if (req->dir == IOREQ_WRITE) {
-        tmp2 = tmp1 ^ (unsigned long) req->u.data;
+        tmp2 = tmp1 | (unsigned long) req->data;
         write_physical(req->addr, req->size, &tmp2);
     }
-    req->u.data = tmp1;
+    req->data = tmp1;
+}
+
+void cpu_ioreq_xor(CPUState *env, ioreq_t *req)
+{
+    unsigned long tmp1, tmp2;
+
+    if (req->data_is_ptr != 0)
+        hw_error("expected scalar value");
+
+    read_physical(req->addr, req->size, &tmp1);
+    if (req->dir == IOREQ_WRITE) {
+        tmp2 = tmp1 ^ (unsigned long) req->data;
+        write_physical(req->addr, req->size, &tmp2);
+    }
+    req->data = tmp1;
 }
 
 void __handle_ioreq(CPUState *env, ioreq_t *req)
 {
-    if (!req->pdata_valid && req->dir == IOREQ_WRITE && req->size != 4)
-       req->u.data &= (1UL << (8 * req->size)) - 1;
+    if (!req->data_is_ptr && req->dir == IOREQ_WRITE && req->size != 4)
+       req->data &= (1UL << (8 * req->size)) - 1;
 
     switch (req->type) {
     case IOREQ_TYPE_PIO:
@@ -437,6 +452,9 @@ void __handle_ioreq(CPUState *env, ioreq
         break;
     case IOREQ_TYPE_AND:
         cpu_ioreq_and(env, req);
+        break;
+    case IOREQ_TYPE_ADD:
+        cpu_ioreq_add(env, req);
         break;
     case IOREQ_TYPE_OR:
         cpu_ioreq_or(env, req);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/target-i386-dm/i8259-dm.c
--- a/tools/ioemu/target-i386-dm/i8259-dm.c     Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/target-i386-dm/i8259-dm.c     Thu Nov 09 15:37:17 2006 -0500
@@ -22,58 +22,18 @@
  * THE SOFTWARE.
  */
 #include "vl.h"
-
-/* debug PIC */
-//#define DEBUG_PIC
-
-//#define DEBUG_IRQ_LATENCY
-//#define DEBUG_IRQ_COUNT
-
 #include "xenctrl.h"
 #include <xen/hvm/ioreq.h>
 #include <stdio.h>
 #include "cpu.h"
 #include "cpu-all.h"
 
-extern shared_iopage_t *shared_page;
-
 struct PicState2 {
 };
 
 void pic_set_irq_new(void *opaque, int irq, int level)
 {
-    /* PicState2 *s = opaque; */
-    global_iodata_t  *gio;
-    int  mask;
-
-    gio = &shared_page->sp_global;
-    mask = 1 << irq;
-    if ( gio->pic_elcr & mask ) {
-        /* level */
-       if ( level ) {
-           atomic_clear_bit(irq, &gio->pic_clear_irr);
-           atomic_set_bit(irq, &gio->pic_irr);
-           cpu_single_env->send_event = 1;
-       }
-       else {
-           atomic_clear_bit(irq, &gio->pic_irr);
-           atomic_set_bit(irq, &gio->pic_clear_irr);
-           cpu_single_env->send_event = 1;
-       }
-    }
-    else {
-       /* edge */
-       if ( level ) {
-           if ( (mask & gio->pic_last_irr) == 0 ) { 
-               atomic_set_bit(irq, &gio->pic_irr);
-               atomic_set_bit(irq, &gio->pic_last_irr);
-               cpu_single_env->send_event = 1;
-           }
-       }
-       else {
-           atomic_clear_bit(irq, &gio->pic_last_irr);
-       }
-    }
+    xc_hvm_set_irq_level(xc_handle, domid, irq, level);
 }
 
 /* obsolete function */
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/target-i386-dm/qemu-dm.debug
--- a/tools/ioemu/target-i386-dm/qemu-dm.debug  Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/target-i386-dm/qemu-dm.debug  Thu Nov 09 15:37:17 2006 -0500
@@ -1,5 +1,10 @@
 #!/bin/sh
 
+if [ "`arch`" = "x86_64" ]; then
+    LIBDIR="lib64"
+else
+    LIBDIR="lib"
+fi
 echo $* > /tmp/args
 echo $DISPLAY >> /tmp/args
-exec /usr/lib/xen/bin/qemu-dm $*
+exec /usr/$LIBDIR/xen/bin/qemu-dm $*
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/vl.c
--- a/tools/ioemu/vl.c  Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/vl.c  Thu Nov 09 15:37:17 2006 -0500
@@ -170,6 +170,9 @@ time_t timeoffset = 0;
 
 char domain_name[1024] = { 'H','V', 'M', 'X', 'E', 'N', '-'};
 extern int domid;
+
+char vncpasswd[64];
+unsigned char challenge[AUTHCHALLENGESIZE];
 
 /***********************************************************/
 /* x86 ISA bus support */
@@ -1681,7 +1684,7 @@ static void tty_serial_init(int fd, int 
 
     tty.c_iflag &= ~(IGNBRK|BRKINT|PARMRK|ISTRIP
                           |INLCR|IGNCR|ICRNL|IXON);
-    tty.c_oflag |= OPOST;
+    tty.c_oflag &= ~OPOST; /* no output mangling of raw serial stream */
     tty.c_lflag &= ~(ECHO|ECHONL|ICANON|IEXTEN|ISIG);
     tty.c_cflag &= ~(CSIZE|PARENB|PARODD|CRTSCTS);
     switch(data_bits) {
@@ -5911,6 +5914,7 @@ int main(int argc, char **argv)
     vncunused = 0;
     kernel_filename = NULL;
     kernel_cmdline = "";
+    *vncpasswd = '\0';
 #ifndef CONFIG_DM
 #ifdef TARGET_PPC
     cdrom_index = 1;
@@ -6416,14 +6420,13 @@ int main(int argc, char **argv)
     }
 
 #if defined(__i386__) || defined(__x86_64__)
-    if (xc_get_pfn_list(xc_handle, domid, page_array, nr_pages) != nr_pages) {
+    for ( i = 0; i < tmp_nr_pages; i++)
+        page_array[i] = i;
+    if (xc_domain_translate_gpfn_list(xc_handle, domid, tmp_nr_pages,
+                                      page_array, page_array)) {
         fprintf(logfile, "xc_get_pfn_list returned error %d\n", errno);
         exit(-1);
     }
-
-    if (ram_size > HVM_BELOW_4G_RAM_END)
-        for (i = 0; i < nr_pages - (HVM_BELOW_4G_RAM_END >> PAGE_SHIFT); i++)
-            page_array[tmp_nr_pages - 1 - i] = page_array[nr_pages - 1 - i];
 
     phys_ram_base = xc_map_foreign_batch(xc_handle, domid,
                                          PROT_READ|PROT_WRITE, page_array,
@@ -6444,7 +6447,6 @@ int main(int argc, char **argv)
     fprintf(logfile, "shared page at pfn:%lx, mfn: %"PRIx64"\n",
             shared_page_nr, (uint64_t)(page_array[shared_page_nr]));
 
-    /* not yet add for IA64 */
     buffered_io_page = xc_map_foreign_range(xc_handle, domid, PAGE_SIZE,
                                             PROT_READ|PROT_WRITE,
                                             page_array[shared_page_nr - 2]);
@@ -6461,7 +6463,7 @@ int main(int argc, char **argv)
 #elif defined(__ia64__)
   
     if (xc_ia64_get_pfn_list(xc_handle, domid, page_array,
-                             IO_PAGE_START >> PAGE_SHIFT, 1) != 1) {
+                             IO_PAGE_START >> PAGE_SHIFT, 3) != 3) {
         fprintf(logfile, "xc_ia64_get_pfn_list returned error %d\n", errno);
         exit(-1);
     }
@@ -6472,6 +6474,12 @@ int main(int argc, char **argv)
 
     fprintf(logfile, "shared page at pfn:%lx, mfn: %016lx\n",
             IO_PAGE_START >> PAGE_SHIFT, page_array[0]);
+
+    buffered_io_page =xc_map_foreign_range(xc_handle, domid, PAGE_SIZE,
+                                       PROT_READ|PROT_WRITE,
+                                       page_array[2]);
+    fprintf(logfile, "Buffered IO page at pfn:%lx, mfn: %016lx\n",
+            BUFFER_IO_PAGE_START >> PAGE_SHIFT, page_array[2]);
 
     if (xc_ia64_get_pfn_list(xc_handle, domid,
                              page_array, 0, nr_pages) != nr_pages) {
@@ -6492,6 +6500,7 @@ int main(int argc, char **argv)
         fprintf(logfile, "xc_map_foreign_batch returned error %d\n", errno);
         exit(-1);
     }
+    free(page_array);
 #endif
 #else  /* !CONFIG_DM */
 
@@ -6559,6 +6568,10 @@ int main(int argc, char **argv)
 
     init_ioports();
 
+    /* read vncpasswd from xenstore */
+    if (0 > xenstore_read_vncpasswd(domid))
+        exit(1);
+
     /* terminal init */
     if (nographic) {
         dumb_display_init(ds);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/vl.h
--- a/tools/ioemu/vl.h  Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/vl.h  Thu Nov 09 15:37:17 2006 -0500
@@ -929,6 +929,10 @@ void piix4_pm_init(PCIBus *bus, int devf
 void piix4_pm_init(PCIBus *bus, int devfn);
 void acpi_bios_init(void);
 
+/* tpm_tis.c */
+int has_tpm_device(void);
+void tpm_tis_init(SetIRQFunc *set_irq, void *irq_opaque, int irq);
+
 /* piix4acpi.c */
 extern void pci_piix4_acpi_init(PCIBus *bus, int devfn);
 
@@ -1211,6 +1215,26 @@ void xenstore_process_event(void *opaque
 void xenstore_process_event(void *opaque);
 void xenstore_check_new_media_present(int timeout);
 void xenstore_write_vncport(int vnc_display);
+int xenstore_read_vncpasswd(int domid);
+
+int xenstore_domain_has_devtype(struct xs_handle *handle,
+                                const char *devtype);
+char **xenstore_domain_get_devices(struct xs_handle *handle,
+                                   const char *devtype, unsigned int *num);
+char *xenstore_read_hotplug_status(struct xs_handle *handle,
+                                   const char *devtype, const char *inst);
+char *xenstore_backend_read_variable(struct xs_handle *,
+                                     const char *devtype, const char *inst,
+                                     const char *var);
+int xenstore_subscribe_to_hotplug_status(struct xs_handle *handle,
+                                         const char *devtype,
+                                         const char *inst,
+                                         const char *token);
+int xenstore_unsubscribe_from_hotplug_status(struct xs_handle *handle,
+                                             const char *devtype,
+                                             const char *inst,
+                                             const char *token);
+
 
 /* xen_platform.c */
 void pci_xen_platform_init(PCIBus *bus);
@@ -1222,4 +1246,7 @@ extern char domain_name[];
 
 void destroy_hvm_domain(void);
 
+/* VNC Authentication */
+#define AUTHCHALLENGESIZE 16
+
 #endif /* VL_H */
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/vnc.c
--- a/tools/ioemu/vnc.c Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/vnc.c Thu Nov 09 15:37:17 2006 -0500
@@ -44,6 +44,7 @@
 
 #include "vnc_keysym.h"
 #include "keymaps.c"
+#include "d3des.h"
 
 #define XK_MISCELLANY
 #define XK_LATIN1
@@ -137,6 +138,9 @@ static void vnc_update_client(void *opaq
 static void vnc_update_client(void *opaque);
 static void vnc_client_read(void *opaque);
 static void framebuffer_set_updated(VncState *vs, int x, int y, int w, int h);
+static int make_challenge(char *random, int size);
+static void set_seed(unsigned int *seedp);
+static void get_random(int len, unsigned char *buf);
 
 #if 0
 static inline void vnc_set_bit(uint32_t *d, int k)
@@ -199,6 +203,8 @@ static void set_bits_in_row(VncState *vs
        mask = ~(0ULL);
 
     h += y;
+    if (h > vs->ds->height)
+        h = vs->ds->height;
     for (; y < h; y++)
        row[y] |= mask;
 }
@@ -1208,23 +1214,92 @@ static int protocol_client_init(VncState
     return 0;
 }
 
+static int protocol_response(VncState *vs, char *client_response, size_t len)
+{
+    extern char vncpasswd[64];
+    extern unsigned char challenge[AUTHCHALLENGESIZE];
+    unsigned char cryptchallenge[AUTHCHALLENGESIZE];
+    unsigned char key[8];
+    int passwdlen, i, j;
+
+    memcpy(cryptchallenge, challenge, AUTHCHALLENGESIZE);
+
+    /* Calculate the sent challenge */
+    passwdlen = strlen(vncpasswd);
+    for (i=0; i<8; i++)
+       key[i] = i<passwdlen ? vncpasswd[i] : 0;
+    deskey(key, EN0);
+    for (j = 0; j < AUTHCHALLENGESIZE; j += 8)
+       des(cryptchallenge+j, cryptchallenge+j);
+
+    /* Check the actual response */
+    if (memcmp(cryptchallenge, client_response, AUTHCHALLENGESIZE) != 0) {
+       /* password error */
+       vnc_write_u32(vs, 1);
+       vnc_write_u32(vs, 22);
+       vnc_write(vs, "Authentication failure", 22);
+       vnc_flush(vs);
+       fprintf(stderr, "VNC Password error.\n");
+       vnc_client_error(vs);
+       return 0;
+    }
+
+    vnc_write_u32(vs, 0);
+    vnc_flush(vs);
+
+    vnc_read_when(vs, protocol_client_init, 1);
+
+    return 0;
+}
+
 static int protocol_version(VncState *vs, char *version, size_t len)
 {
+    extern char vncpasswd[64];
+    extern unsigned char challenge[AUTHCHALLENGESIZE];
     char local[13];
-    int maj, min;
+    int  support, maj, min;
 
     memcpy(local, version, 12);
     local[12] = 0;
 
+    /* protocol version check */
     if (sscanf(local, "RFB %03d.%03d\n", &maj, &min) != 2) {
+       fprintf(stderr, "Protocol version error.\n");
        vnc_client_error(vs);
        return 0;
     }
 
-    vnc_write_u32(vs, 1); /* None */
-    vnc_flush(vs);
-
-    vnc_read_when(vs, protocol_client_init, 1);
+
+    support = 0;
+    if (maj = 3) {
+       if (min == 3 || min ==4) {
+           support = 1;
+       }
+    }
+
+    if (! support) {
+       fprintf(stderr, "Client uses unsupported protocol version %d.%d.\n",
+               maj, min);
+       vnc_client_error(vs);
+       return 0;
+    }
+
+    if (*vncpasswd == '\0') {
+       /* AuthType is None */
+       vnc_write_u32(vs, 1);
+       vnc_flush(vs);
+       vnc_read_when(vs, protocol_client_init, 1);
+    } else {
+       /* AuthType is VncAuth */
+       vnc_write_u32(vs, 2);
+
+       /* Challenge-Responce authentication */
+       /* Send Challenge */
+       make_challenge(challenge, AUTHCHALLENGESIZE);
+       vnc_write(vs, challenge, AUTHCHALLENGESIZE);
+       vnc_flush(vs);
+       vnc_read_when(vs, protocol_response, AUTHCHALLENGESIZE);
+    }
 
     return 0;
 }
@@ -1342,3 +1417,32 @@ int vnc_start_viewer(int port)
        return pid;
     }
 }
+
+unsigned int seed;
+
+static int make_challenge(char *random, int size)
+{
+ 
+    set_seed(&seed);
+    get_random(size, random);
+
+    return 0;
+}
+
+static void set_seed(unsigned int *seedp)
+{
+    *seedp += (unsigned int)(time(NULL)+getpid()+getpid()*987654+rand());
+    srand(*seedp);
+
+    return;
+}
+
+static void get_random(int len, unsigned char *buf)
+{
+    int i;
+
+    for (i=0; i<len; i++)
+       buf[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
+
+    return;
+}
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/vnc_keysym.h
--- a/tools/ioemu/vnc_keysym.h  Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/vnc_keysym.h  Thu Nov 09 15:37:17 2006 -0500
@@ -271,5 +271,15 @@ static name2keysym_t name2keysym[]={
 {"Num_Lock", 0xff7f},    /* XK_Num_Lock */
 {"Pause", 0xff13},       /* XK_Pause */
 {"Escape", 0xff1b},      /* XK_Escape */
+
+    /* localized keys */
+{"BackApostrophe", 0xff21},
+{"Muhenkan", 0xff22},
+{"Katakana", 0xff25},
+{"Zenkaku_Hankaku", 0xff29},
+{"Henkan_Mode_Real", 0xff23},
+{"Henkan_Mode_Ultra", 0xff3e},
+{"backslash_ja", 0xffa5},
+
 {0,0},
 };
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/xenstore.c
--- a/tools/ioemu/xenstore.c    Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/xenstore.c    Thu Nov 09 15:37:17 2006 -0500
@@ -213,3 +213,191 @@ void xenstore_write_vncport(int display)
     free(portstr);
     free(buf);
 }
+
+int xenstore_read_vncpasswd(int domid)
+{
+    extern char vncpasswd[64];
+    char *buf = NULL, *path, *uuid = NULL, *passwd = NULL;
+    unsigned int i, len, rc = 0;
+
+    if (xsh == NULL) {
+       return -1;
+    }
+
+    path = xs_get_domain_path(xsh, domid);
+    if (path == NULL) {
+       fprintf(logfile, "xs_get_domain_path() error. domid %d.\n", domid);
+       return -1;
+    }
+
+    pasprintf(&buf, "%s/vm", path);
+    uuid = xs_read(xsh, XBT_NULL, buf, &len);
+    if (uuid == NULL) {
+       fprintf(logfile, "xs_read(): uuid get error. %s.\n", buf);
+       free(path);
+       return -1;
+    }
+
+    pasprintf(&buf, "%s/vncpasswd", uuid);
+    passwd = xs_read(xsh, XBT_NULL, buf, &len);
+    if (passwd == NULL) {
+       fprintf(logfile, "xs_read(): vncpasswd get error. %s.\n", buf);
+       free(uuid);
+       free(path);
+       return rc;
+    }
+
+    for (i=0; i<len && i<63; i++) {
+       vncpasswd[i] = passwd[i];
+       passwd[i] = '\0';
+    }
+    vncpasswd[len] = '\0';
+    pasprintf(&buf, "%s/vncpasswd", uuid);
+    if (xs_write(xsh, XBT_NULL, buf, passwd, len) == 0) {
+       fprintf(logfile, "xs_write() vncpasswd failed.\n");
+       rc = -1;
+    }
+
+    free(passwd);
+    free(uuid);
+    free(path);
+
+    return rc;
+}
+
+
+/*
+ * get all device instances of a certain type
+ */
+char **xenstore_domain_get_devices(struct xs_handle *handle,
+                                   const char *devtype, unsigned int *num)
+{
+    char *path;
+    char *buf = NULL;
+    char **e  = NULL;
+
+    path = xs_get_domain_path(handle, domid);
+    if (path == NULL)
+        goto out;
+
+    if (pasprintf(&buf, "%s/device/%s", path,devtype) == -1)
+       goto out;
+
+    e = xs_directory(handle, XBT_NULL, buf, num);
+
+ out:
+    free(path);
+    free(buf);
+    return e;
+}
+
+/*
+ * Check whether a domain has devices of the given type
+ */
+int xenstore_domain_has_devtype(struct xs_handle *handle, const char *devtype)
+{
+    int rc = 0;
+    unsigned int num;
+    char **e = xenstore_domain_get_devices(handle, devtype, &num);
+    if (e)
+        rc = 1;
+    free(e);
+    return rc;
+}
+
+/*
+ * Function that creates a path to a variable of an instance of a
+ * certain device
+ */
+static char *get_device_variable_path(const char *devtype, const char *inst,
+                                      const char *var)
+{
+    char *buf = NULL;
+    if (pasprintf(&buf, "/local/domain/0/backend/%s/%d/%s/%s",
+                  devtype,
+                  domid,
+                  inst,
+                  var) == -1) {
+        free(buf);
+        buf = NULL;
+    }
+    return buf;
+}
+
+char *xenstore_backend_read_variable(struct xs_handle *handle,
+                                     const char *devtype, const char *inst,
+                                     const char *var)
+{
+    char *value = NULL;
+    char *buf = NULL;
+    unsigned int len;
+
+    buf = get_device_variable_path(devtype, inst, var);
+    if (NULL == buf)
+       goto out;
+
+    value = xs_read(handle, XBT_NULL, buf, &len);
+
+    free(buf);
+
+out:
+    return value;
+}
+
+/*
+  Read the hotplug status variable from the backend given the type
+  of device and its instance.
+*/
+char *xenstore_read_hotplug_status(struct xs_handle *handle,
+                                   const char *devtype, const char *inst)
+{
+    return xenstore_backend_read_variable(handle, devtype, inst,
+                                          "hotplug-status");
+}
+
+/*
+   Subscribe to the hotplug status of a device given the type of device and
+   its instance.
+   In case an error occurrs, a negative number is returned.
+ */
+int xenstore_subscribe_to_hotplug_status(struct xs_handle *handle,
+                                         const char *devtype,
+                                         const char *inst,
+                                         const char *token)
+{
+    int rc = 0;
+    char *path = get_device_variable_path(devtype, inst, "hotplug-status");
+
+    if (path == NULL)
+        return -1;
+
+    if (0 == xs_watch(handle, path, token))
+        rc = -2;
+
+    free(path);
+
+    return rc;
+}
+
+/*
+ * Unsubscribe from a subscription to the status of a hotplug variable of
+ * a device.
+ */
+int xenstore_unsubscribe_from_hotplug_status(struct xs_handle *handle,
+                                             const char *devtype,
+                                             const char *inst,
+                                             const char *token)
+{
+    int rc = 0;
+    char *path;
+    path = get_device_variable_path(devtype, inst, "hotplug-status");
+    if (path == NULL)
+        return -1;
+
+    if (0 == xs_unwatch(handle, path, token))
+        rc = -2;
+
+    free(path);
+
+    return rc;
+}
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/libxc/Makefile
--- a/tools/libxc/Makefile      Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/libxc/Makefile      Thu Nov 09 15:37:17 2006 -0500
@@ -31,7 +31,7 @@ GUEST_SRCS-$(CONFIG_HVM) += xc_hvm_build
 
 -include $(XEN_TARGET_ARCH)/Makefile
 
-CFLAGS   += -Werror
+CFLAGS   += -Werror -Wmissing-prototypes
 CFLAGS   += -fno-strict-aliasing
 CFLAGS   += $(INCLUDES) -I.
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/libxc/ia64/xc_ia64_hvm_build.c
--- a/tools/libxc/ia64/xc_ia64_hvm_build.c      Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/libxc/ia64/xc_ia64_hvm_build.c      Thu Nov 09 15:37:17 2006 -0500
@@ -551,8 +551,9 @@ setup_guest(int xc_handle, uint32_t dom,
             char *image, unsigned long image_size, uint32_t vcpus,
             unsigned int store_evtchn, unsigned long *store_mfn)
 {
-    unsigned long page_array[2];
+    unsigned long page_array[3];
     shared_iopage_t *sp;
+    void *ioreq_buffer_page;
     unsigned long dom_memsize = (memsize << 20);
     DECLARE_DOMCTL;
 
@@ -587,7 +588,7 @@ setup_guest(int xc_handle, uint32_t dom,
 
     /* Retrieve special pages like io, xenstore, etc. */
     if (xc_ia64_get_pfn_list(xc_handle, dom, page_array,
-                             IO_PAGE_START>>PAGE_SHIFT, 2) != 2) {
+                             IO_PAGE_START>>PAGE_SHIFT, 3) != 3) {
         PERROR("Could not get the page frame list");
         goto error_out;
     }
@@ -604,7 +605,10 @@ setup_guest(int xc_handle, uint32_t dom,
 
     memset(sp, 0, PAGE_SIZE);
     munmap(sp, PAGE_SIZE);
-
+    ioreq_buffer_page = xc_map_foreign_range(xc_handle, dom,
+                               PAGE_SIZE, PROT_READ|PROT_WRITE, 
page_array[2]); 
+    memset(ioreq_buffer_page,0,PAGE_SIZE);
+    munmap(ioreq_buffer_page, PAGE_SIZE);
     return 0;
 
 error_out:
@@ -614,7 +618,7 @@ int
 int
 xc_hvm_build(int xc_handle, uint32_t domid, int memsize,
              const char *image_name, unsigned int vcpus, unsigned int pae,
-             unsigned int acpi, unsigned int apic, unsigned int store_evtchn,
+             unsigned int acpi, unsigned int store_evtchn,
              unsigned long *store_mfn)
 {
     struct xen_domctl launch_domctl, domctl;
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/libxc/ia64/xc_ia64_linux_restore.c
--- a/tools/libxc/ia64/xc_ia64_linux_restore.c  Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/libxc/ia64/xc_ia64_linux_restore.c  Thu Nov 09 15:37:17 2006 -0500
@@ -224,6 +224,9 @@ xc_linux_restore(int xc_handle, int io_f
         ERROR("Error when reading ctxt");
         goto out;
     }
+
+    fprintf(stderr, "ip=%016lx, b0=%016lx\n", ctxt.user_regs.cr_iip,
+            ctxt.user_regs.b0);
 
     /* First to initialize.  */
     domctl.cmd = XEN_DOMCTL_setvcpucontext;
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/libxc/ia64/xc_ia64_linux_save.c
--- a/tools/libxc/ia64/xc_ia64_linux_save.c     Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/libxc/ia64/xc_ia64_linux_save.c     Thu Nov 09 15:37:17 2006 -0500
@@ -458,6 +458,9 @@ xc_linux_save(int xc_handle, int io_fd, 
         goto out;
     }
 
+    fprintf(stderr, "ip=%016lx, b0=%016lx\n", ctxt.user_regs.cr_iip,
+            ctxt.user_regs.b0);
+
     mem = xc_map_foreign_range(xc_handle, dom, PAGE_SIZE,
                                PROT_READ|PROT_WRITE, ctxt.privregs_pfn);
     if (mem == NULL) {
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/libxc/xc_acm.c
--- a/tools/libxc/xc_acm.c      Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/libxc/xc_acm.c      Thu Nov 09 15:37:17 2006 -0500
@@ -24,12 +24,12 @@ int xc_acm_op(int xc_handle, int cmd, vo
     hypercall.arg[0] = cmd;
     hypercall.arg[1] = (unsigned long) arg;
 
-    if (mlock(arg, arg_size) != 0) {
-        PERROR("xc_acm_op: arg mlock failed");
+    if (lock_pages(arg, arg_size) != 0) {
+        PERROR("xc_acm_op: arg lock failed");
         goto out;
     }
     ret = do_xen_hypercall(xc_handle, &hypercall);
-    safe_munlock(arg, arg_size);
+    unlock_pages(arg, arg_size);
  out:
     return ret;
 }
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/libxc/xc_core.c
--- a/tools/libxc/xc_core.c     Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/libxc/xc_core.c     Thu Nov 09 15:37:17 2006 -0500
@@ -62,7 +62,7 @@ xc_domain_dumpcore_via_callback(int xc_h
 
     nr_pages = info.nr_pages;
 
-    header.xch_magic = XC_CORE_MAGIC;
+    header.xch_magic = info.hvm ? XC_CORE_MAGIC_HVM : XC_CORE_MAGIC;
     header.xch_nr_vcpus = nr_vcpus;
     header.xch_nr_pages = nr_pages;
     header.xch_ctxt_offset = sizeof(struct xc_core_header);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/libxc/xc_domain.c
--- a/tools/libxc/xc_domain.c   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/libxc/xc_domain.c   Thu Nov 09 15:37:17 2006 -0500
@@ -12,6 +12,7 @@ int xc_domain_create(int xc_handle,
 int xc_domain_create(int xc_handle,
                      uint32_t ssidref,
                      xen_domain_handle_t handle,
+                     uint32_t flags,
                      uint32_t *pdomid)
 {
     int err;
@@ -20,6 +21,7 @@ int xc_domain_create(int xc_handle,
     domctl.cmd = XEN_DOMCTL_createdomain;
     domctl.domain = (domid_t)*pdomid;
     domctl.u.createdomain.ssidref = ssidref;
+    domctl.u.createdomain.flags   = flags;
     memcpy(domctl.u.createdomain.handle, handle, sizeof(xen_domain_handle_t));
     if ( (err = do_domctl(xc_handle, &domctl)) != 0 )
         return err;
@@ -72,7 +74,7 @@ int xc_domain_shutdown(int xc_handle,
     arg.domain_id = domid;
     arg.reason = reason;
 
-    if ( mlock(&arg, sizeof(arg)) != 0 )
+    if ( lock_pages(&arg, sizeof(arg)) != 0 )
     {
         PERROR("Could not lock memory for Xen hypercall");
         goto out1;
@@ -80,7 +82,7 @@ int xc_domain_shutdown(int xc_handle,
 
     ret = do_xen_hypercall(xc_handle, &hypercall);
 
-    safe_munlock(&arg, sizeof(arg));
+    unlock_pages(&arg, sizeof(arg));
 
  out1:
     return ret;
@@ -103,7 +105,7 @@ int xc_vcpu_setaffinity(int xc_handle,
                          (uint8_t *)&cpumap);
     domctl.u.vcpuaffinity.cpumap.nr_cpus = sizeof(cpumap) * 8;
     
-    if ( mlock(&cpumap, sizeof(cpumap)) != 0 )
+    if ( lock_pages(&cpumap, sizeof(cpumap)) != 0 )
     {
         PERROR("Could not lock memory for Xen hypercall");
         goto out;
@@ -111,7 +113,7 @@ int xc_vcpu_setaffinity(int xc_handle,
 
     ret = do_domctl(xc_handle, &domctl);
 
-    safe_munlock(&cpumap, sizeof(cpumap));
+    unlock_pages(&cpumap, sizeof(cpumap));
 
  out:
     return ret;
@@ -134,7 +136,7 @@ int xc_vcpu_getaffinity(int xc_handle,
                          (uint8_t *)cpumap);
     domctl.u.vcpuaffinity.cpumap.nr_cpus = sizeof(*cpumap) * 8;
     
-    if ( mlock(cpumap, sizeof(*cpumap)) != 0 )
+    if ( lock_pages(cpumap, sizeof(*cpumap)) != 0 )
     {
         PERROR("Could not lock memory for Xen hypercall");
         goto out;
@@ -142,7 +144,7 @@ int xc_vcpu_getaffinity(int xc_handle,
 
     ret = do_domctl(xc_handle, &domctl);
 
-    safe_munlock(cpumap, sizeof(*cpumap));
+    unlock_pages(cpumap, sizeof(*cpumap));
 
  out:
     return ret;
@@ -169,15 +171,16 @@ int xc_domain_getinfo(int xc_handle,
             break;
         info->domid      = (uint16_t)domctl.domain;
 
-        info->dying    = !!(domctl.u.getdomaininfo.flags & DOMFLAGS_DYING);
-        info->shutdown = !!(domctl.u.getdomaininfo.flags & DOMFLAGS_SHUTDOWN);
-        info->paused   = !!(domctl.u.getdomaininfo.flags & DOMFLAGS_PAUSED);
-        info->blocked  = !!(domctl.u.getdomaininfo.flags & DOMFLAGS_BLOCKED);
-        info->running  = !!(domctl.u.getdomaininfo.flags & DOMFLAGS_RUNNING);
+        info->dying    = !!(domctl.u.getdomaininfo.flags&XEN_DOMINF_dying);
+        info->shutdown = !!(domctl.u.getdomaininfo.flags&XEN_DOMINF_shutdown);
+        info->paused   = !!(domctl.u.getdomaininfo.flags&XEN_DOMINF_paused);
+        info->blocked  = !!(domctl.u.getdomaininfo.flags&XEN_DOMINF_blocked);
+        info->running  = !!(domctl.u.getdomaininfo.flags&XEN_DOMINF_running);
+        info->hvm      = !!(domctl.u.getdomaininfo.flags&XEN_DOMINF_hvm_guest);
 
         info->shutdown_reason =
-            (domctl.u.getdomaininfo.flags>>DOMFLAGS_SHUTDOWNSHIFT) &
-            DOMFLAGS_SHUTDOWNMASK;
+            (domctl.u.getdomaininfo.flags>>XEN_DOMINF_shutdownshift) &
+            XEN_DOMINF_shutdownmask;
 
         if ( info->shutdown && (info->shutdown_reason == SHUTDOWN_crash) )
         {
@@ -200,7 +203,8 @@ int xc_domain_getinfo(int xc_handle,
         info++;
     }
 
-    if( !nr_doms ) return rc;
+    if ( nr_doms == 0 )
+        return rc;
 
     return nr_doms;
 }
@@ -213,7 +217,7 @@ int xc_domain_getinfolist(int xc_handle,
     int ret = 0;
     DECLARE_SYSCTL;
 
-    if ( mlock(info, max_domains*sizeof(xc_domaininfo_t)) != 0 )
+    if ( lock_pages(info, max_domains*sizeof(xc_domaininfo_t)) != 0 )
         return -1;
 
     sysctl.cmd = XEN_SYSCTL_getdomaininfolist;
@@ -226,8 +230,7 @@ int xc_domain_getinfolist(int xc_handle,
     else
         ret = sysctl.u.getdomaininfolist.num_domains;
 
-    if ( munlock(info, max_domains*sizeof(xc_domaininfo_t)) != 0 )
-        ret = -1;
+    unlock_pages(info, max_domains*sizeof(xc_domaininfo_t));
 
     return ret;
 }
@@ -245,12 +248,12 @@ int xc_vcpu_getcontext(int xc_handle,
     domctl.u.vcpucontext.vcpu   = (uint16_t)vcpu;
     set_xen_guest_handle(domctl.u.vcpucontext.ctxt, ctxt);
 
-    if ( (rc = mlock(ctxt, sizeof(*ctxt))) != 0 )
+    if ( (rc = lock_pages(ctxt, sizeof(*ctxt))) != 0 )
         return rc;
 
     rc = do_domctl(xc_handle, &domctl);
 
-    safe_munlock(ctxt, sizeof(*ctxt));
+    unlock_pages(ctxt, sizeof(*ctxt));
 
     return rc;
 }
@@ -346,7 +349,7 @@ int xc_domain_memory_increase_reservatio
     if ( err == nr_extents )
         return 0;
 
-    if ( err > 0 )
+    if ( err >= 0 )
     {
         DPRINTF("Failed allocation for dom %d: "
                 "%ld pages order %d addr_bits %d\n",
@@ -385,11 +388,11 @@ int xc_domain_memory_decrease_reservatio
     if ( err == nr_extents )
         return 0;
 
-    if ( err > 0 )
+    if ( err >= 0 )
     {
         DPRINTF("Failed deallocation for dom %d: %ld pages order %d\n",
                 domid, nr_extents, extent_order);
-        errno = EBUSY;
+        errno = EINVAL;
         err = -1;
     }
 
@@ -416,7 +419,7 @@ int xc_domain_memory_populate_physmap(in
     if ( err == nr_extents )
         return 0;
 
-    if ( err > 0 )
+    if ( err >= 0 )
     {
         DPRINTF("Failed allocation for dom %d: %ld pages order %d\n",
                 domid, nr_extents, extent_order);
@@ -512,12 +515,12 @@ int xc_vcpu_setcontext(int xc_handle,
     domctl.u.vcpucontext.vcpu = vcpu;
     set_xen_guest_handle(domctl.u.vcpucontext.ctxt, ctxt);
 
-    if ( (rc = mlock(ctxt, sizeof(*ctxt))) != 0 )
+    if ( (rc = lock_pages(ctxt, sizeof(*ctxt))) != 0 )
         return rc;
 
     rc = do_domctl(xc_handle, &domctl);
 
-    safe_munlock(ctxt, sizeof(*ctxt));
+    unlock_pages(ctxt, sizeof(*ctxt));
 
     return rc;
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/libxc/xc_evtchn.c
--- a/tools/libxc/xc_evtchn.c   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/libxc/xc_evtchn.c   Thu Nov 09 15:37:17 2006 -0500
@@ -18,16 +18,16 @@ static int do_evtchn_op(int xc_handle, i
     hypercall.arg[0] = cmd;
     hypercall.arg[1] = (unsigned long)arg;
 
-    if ( mlock(arg, arg_size) != 0 )
+    if ( lock_pages(arg, arg_size) != 0 )
     {
-        PERROR("do_evtchn_op: arg mlock failed");
+        PERROR("do_evtchn_op: arg lock failed");
         goto out;
     }
 
     if ((ret = do_xen_hypercall(xc_handle, &hypercall)) < 0)
         ERROR("do_evtchn_op: HYPERVISOR_event_channel_op failed: %d", ret);
 
-    safe_munlock(arg, arg_size);
+    unlock_pages(arg, arg_size);
  out:
     return ret;
 }
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/libxc/xc_hvm_build.c
--- a/tools/libxc/xc_hvm_build.c        Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/libxc/xc_hvm_build.c        Thu Nov 09 15:37:17 2006 -0500
@@ -12,12 +12,10 @@
 #include <unistd.h>
 #include <zlib.h>
 #include <xen/hvm/hvm_info_table.h>
-#include <xen/hvm/ioreq.h>
 #include <xen/hvm/params.h>
 #include <xen/hvm/e820.h>
 
 #define HVM_LOADER_ENTR_ADDR  0x00100000
-
 static int
 parseelfimage(
     char *elfbase, unsigned long elfsize, struct domain_setup_info *dsi);
@@ -39,13 +37,13 @@ static void xc_set_hvm_param(int handle,
     arg.domid = dom;
     arg.index = param;
     arg.value = value;
-    if ( mlock(&arg, sizeof(arg)) != 0 )
+    if ( lock_pages(&arg, sizeof(arg)) != 0 )
     {
         PERROR("Could not lock memory for set parameter");
         return;
     }
     rc = do_xen_hypercall(handle, &hypercall);
-    safe_munlock(&arg, sizeof(arg));
+    unlock_pages(&arg, sizeof(arg));
     if (rc < 0)
         PERROR("set HVM parameter failed (%d)", rc);
 }
@@ -58,11 +56,12 @@ static void build_e820map(void *e820_pag
     unsigned char nr_map = 0;
 
     /*
-     * physical address space from HVM_BELOW_4G_RAM_END to 4G is reserved
+     * Physical address space from HVM_BELOW_4G_RAM_END to 4G is reserved
      * for PCI devices MMIO. So if HVM has more than HVM_BELOW_4G_RAM_END
      * RAM, memory beyond HVM_BELOW_4G_RAM_END will go to 4G above.
      */
-    if ( mem_size > HVM_BELOW_4G_RAM_END ) {
+    if ( mem_size > HVM_BELOW_4G_RAM_END )
+    {
         extra_mem_size = mem_size - HVM_BELOW_4G_RAM_END;
         mem_size = HVM_BELOW_4G_RAM_END;
     }
@@ -77,9 +76,9 @@ static void build_e820map(void *e820_pag
     e820entry[nr_map].type = E820_RESERVED;
     nr_map++;
 
-    e820entry[nr_map].addr = 0xA0000;
-    e820entry[nr_map].size = 0x20000;
-    e820entry[nr_map].type = E820_IO;
+    e820entry[nr_map].addr = 0xEA000;
+    e820entry[nr_map].size = 0x02000;
+    e820entry[nr_map].type = E820_ACPI;
     nr_map++;
 
     e820entry[nr_map].addr = 0xF0000;
@@ -87,81 +86,14 @@ static void build_e820map(void *e820_pag
     e820entry[nr_map].type = E820_RESERVED;
     nr_map++;
 
-/* ACPI data: 10 pages. */
-#define ACPI_DATA_PAGES     10
-/* ACPI NVS: 3 pages.   */
-#define ACPI_NVS_PAGES      3
-/* buffered io page.    */
-#define BUFFERED_IO_PAGES   1
-/* xenstore page.       */
-#define XENSTORE_PAGES      1
-/* shared io page.      */
-#define SHARED_IO_PAGES     1
-/* totally 16 static pages are reserved in E820 table */
-
-    /* Most of the ram goes here */
+    /* Low RAM goes here. Remove 3 pages for ioreq, bufioreq, and xenstore. */
     e820entry[nr_map].addr = 0x100000;
-    e820entry[nr_map].size = mem_size - 0x100000 - PAGE_SIZE *
-                                                (ACPI_DATA_PAGES +
-                                                 ACPI_NVS_PAGES +
-                                                 BUFFERED_IO_PAGES +
-                                                 XENSTORE_PAGES +
-                                                 SHARED_IO_PAGES);
+    e820entry[nr_map].size = mem_size - 0x100000 - PAGE_SIZE * 3;
     e820entry[nr_map].type = E820_RAM;
     nr_map++;
 
-    /* Statically allocated special pages */
-
-    /* For ACPI data */
-    e820entry[nr_map].addr = mem_size - PAGE_SIZE *
-                                        (ACPI_DATA_PAGES +
-                                         ACPI_NVS_PAGES +
-                                         BUFFERED_IO_PAGES +
-                                         XENSTORE_PAGES +
-                                         SHARED_IO_PAGES);
-    e820entry[nr_map].size = PAGE_SIZE * ACPI_DATA_PAGES;
-    e820entry[nr_map].type = E820_ACPI;
-    nr_map++;
-
-    /* For ACPI NVS */
-    e820entry[nr_map].addr = mem_size - PAGE_SIZE *
-                                        (ACPI_NVS_PAGES +
-                                         BUFFERED_IO_PAGES +
-                                         XENSTORE_PAGES +
-                                         SHARED_IO_PAGES);
-    e820entry[nr_map].size = PAGE_SIZE * ACPI_NVS_PAGES;
-    e820entry[nr_map].type = E820_NVS;
-    nr_map++;
-
-    /* For buffered IO requests */
-    e820entry[nr_map].addr = mem_size - PAGE_SIZE *
-                                        (BUFFERED_IO_PAGES +
-                                         XENSTORE_PAGES +
-                                         SHARED_IO_PAGES);
-    e820entry[nr_map].size = PAGE_SIZE * BUFFERED_IO_PAGES;
-    e820entry[nr_map].type = E820_BUFFERED_IO;
-    nr_map++;
-
-    /* For xenstore */
-    e820entry[nr_map].addr = mem_size - PAGE_SIZE *
-                                        (XENSTORE_PAGES +
-                                         SHARED_IO_PAGES);
-    e820entry[nr_map].size = PAGE_SIZE * XENSTORE_PAGES;
-    e820entry[nr_map].type = E820_XENSTORE;
-    nr_map++;
-
-    /* Shared ioreq_t page */
-    e820entry[nr_map].addr = mem_size - PAGE_SIZE * SHARED_IO_PAGES;
-    e820entry[nr_map].size = PAGE_SIZE * SHARED_IO_PAGES;
-    e820entry[nr_map].type = E820_SHARED_PAGE;
-    nr_map++;
-
-    e820entry[nr_map].addr = 0xFEC00000;
-    e820entry[nr_map].size = 0x1400000;
-    e820entry[nr_map].type = E820_IO;
-    nr_map++;
-
-    if ( extra_mem_size ) {
+    if ( extra_mem_size )
+    {
         e820entry[nr_map].addr = (1ULL << 32);
         e820entry[nr_map].size = extra_mem_size;
         e820entry[nr_map].type = E820_RAM;
@@ -220,28 +152,22 @@ static int setup_guest(int xc_handle,
 static int setup_guest(int xc_handle,
                        uint32_t dom, int memsize,
                        char *image, unsigned long image_size,
-                       unsigned long nr_pages,
                        vcpu_guest_context_t *ctxt,
                        unsigned long shared_info_frame,
                        unsigned int vcpus,
                        unsigned int pae,
                        unsigned int acpi,
-                       unsigned int apic,
                        unsigned int store_evtchn,
                        unsigned long *store_mfn)
 {
     xen_pfn_t *page_array = NULL;
-    unsigned long count, i;
-    unsigned long long ptr;
-    xc_mmu_t *mmu = NULL;
-
+    unsigned long i, nr_pages = (unsigned long)memsize << (20 - PAGE_SHIFT);
+    unsigned long shared_page_nr;
     shared_info_t *shared_info;
     void *e820_page;
-
     struct domain_setup_info dsi;
     uint64_t v_end;
-
-    unsigned long shared_page_nr;
+    int rc;
 
     memset(&dsi, 0, sizeof(struct domain_setup_info));
 
@@ -254,7 +180,6 @@ static int setup_guest(int xc_handle,
         goto error_out;
     }
 
-    /* memsize is in megabytes */
     v_end = (unsigned long long)memsize << 20;
 
     IPRINTF("VIRTUAL MEMORY ARRANGEMENT:\n"
@@ -279,40 +204,33 @@ static int setup_guest(int xc_handle,
         goto error_out;
     }
 
-    if ( xc_get_pfn_list(xc_handle, dom, page_array, nr_pages) != nr_pages )
-    {
-        PERROR("Could not get the page frame list.\n");
+    for ( i = 0; i < nr_pages; i++ )
+        page_array[i] = i;
+    for ( i = HVM_BELOW_4G_RAM_END >> PAGE_SHIFT; i < nr_pages; i++ )
+        page_array[i] += HVM_BELOW_4G_MMIO_LENGTH >> PAGE_SHIFT;
+
+    /* Allocate memory for HVM guest, skipping VGA hole 0xA0000-0xC0000. */
+    rc = xc_domain_memory_populate_physmap(
+        xc_handle, dom, (nr_pages > 0xa0) ? 0xa0 : nr_pages,
+        0, 0, &page_array[0x00]);
+    if ( (rc == 0) && (nr_pages > 0xc0) )
+        rc = xc_domain_memory_populate_physmap(
+            xc_handle, dom, nr_pages - 0xc0, 0, 0, &page_array[0xc0]);
+    if ( rc != 0 )
+    {
+        PERROR("Could not allocate memory for HVM guest.\n");
+        goto error_out;
+    }
+
+    if ( xc_domain_translate_gpfn_list(xc_handle, dom, nr_pages,
+                                       page_array, page_array) )
+    {
+        PERROR("Could not translate addresses of HVM guest.\n");
         goto error_out;
     }
 
     loadelfimage(image, xc_handle, dom, page_array, &dsi);
 
-    if ( (mmu = xc_init_mmu_updates(xc_handle, dom)) == NULL )
-        goto error_out;
-
-    /* Write the machine->phys table entries. */
-    for ( count = 0; count < nr_pages; count++ )
-    {
-        unsigned long gpfn_count_skip;
-
-        ptr = (unsigned long long)page_array[count] << PAGE_SHIFT;
-
-        gpfn_count_skip = 0;
-
-        /*
-         * physical address space from HVM_BELOW_4G_RAM_END to 4G is reserved
-         * for PCI devices MMIO. So if HVM has more than HVM_BELOW_4G_RAM_END
-         * RAM, memory beyond HVM_BELOW_4G_RAM_END will go to 4G above.
-         */
-        if ( count >= (HVM_BELOW_4G_RAM_END >> PAGE_SHIFT) )
-            gpfn_count_skip = HVM_BELOW_4G_MMIO_LENGTH >> PAGE_SHIFT;
-
-        if ( xc_add_mmu_update(xc_handle, mmu,
-                               ptr | MMU_MACHPHYS_UPDATE,
-                               count + gpfn_count_skip) )
-            goto error_out;
-    }
-
     if ( set_hvm_info(xc_handle, dom, page_array, vcpus, acpi) )
     {
         ERROR("Couldn't set hvm info for HVM guest.\n");
@@ -320,7 +238,6 @@ static int setup_guest(int xc_handle,
     }
 
     xc_set_hvm_param(xc_handle, dom, HVM_PARAM_PAE_ENABLED, pae);
-    xc_set_hvm_param(xc_handle, dom, HVM_PARAM_APIC_ENABLED, apic);
 
     if ( (e820_page = xc_map_foreign_range(
               xc_handle, dom, PAGE_SIZE, PROT_READ | PROT_WRITE,
@@ -339,6 +256,8 @@ static int setup_guest(int xc_handle,
     /* Mask all upcalls... */
     for ( i = 0; i < MAX_VIRT_CPUS; i++ )
         shared_info->vcpu_info[i].evtchn_upcall_mask = 1;
+    memset(&shared_info->evtchn_mask[0], 0xff,
+           sizeof(shared_info->evtchn_mask));
     munmap(shared_info, PAGE_SIZE);
 
     if ( v_end > HVM_BELOW_4G_RAM_END )
@@ -346,39 +265,25 @@ static int setup_guest(int xc_handle,
     else
         shared_page_nr = (v_end >> PAGE_SHIFT) - 1;
 
+    /* Paranoia: clean pages. */
+    if ( xc_clear_domain_page(xc_handle, dom, page_array[shared_page_nr]) ||
+         xc_clear_domain_page(xc_handle, dom, page_array[shared_page_nr-1]) ||
+         xc_clear_domain_page(xc_handle, dom, page_array[shared_page_nr-2]) )
+        goto error_out;
+
     *store_mfn = page_array[shared_page_nr - 1];
-
-    xc_set_hvm_param(xc_handle, dom, HVM_PARAM_STORE_PFN, shared_page_nr - 1);
+    xc_set_hvm_param(xc_handle, dom, HVM_PARAM_STORE_PFN, shared_page_nr-1);
     xc_set_hvm_param(xc_handle, dom, HVM_PARAM_STORE_EVTCHN, store_evtchn);
-
-    /* Paranoia */
-    /* clean the shared IO requests page */
-    if ( xc_clear_domain_page(xc_handle, dom, page_array[shared_page_nr]) )
-        goto error_out;
-
-    /* clean the buffered IO requests page */
-    if ( xc_clear_domain_page(xc_handle, dom, page_array[shared_page_nr - 2]) )
-        goto error_out;
-
-    if ( xc_clear_domain_page(xc_handle, dom, *store_mfn) )
-        goto error_out;
-
-    /* Send the page update requests down to the hypervisor. */
-    if ( xc_finish_mmu_updates(xc_handle, mmu) )
-        goto error_out;
-
-    free(mmu);
+    xc_set_hvm_param(xc_handle, dom, HVM_PARAM_BUFIOREQ_PFN, shared_page_nr-2);
+    xc_set_hvm_param(xc_handle, dom, HVM_PARAM_IOREQ_PFN, shared_page_nr);

_______________________________________________
Xen-ppc-devel mailing list
Xen-ppc-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-ppc-devel


 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.