WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-changelog

[Xen-changelog] [xen-unstable] Merge with xenppc-unstable.hg

To: xen-changelog@xxxxxxxxxxxxxxxxxxx
Subject: [Xen-changelog] [xen-unstable] Merge with xenppc-unstable.hg
From: Xen patchbot-unstable <patchbot-unstable@xxxxxxxxxxxxxxxxxxx>
Date: Wed, 14 Feb 2007 15:01:06 -0800
Delivery-date: Wed, 14 Feb 2007 15:40:04 -0800
Envelope-to: www-data@xxxxxxxxxxxxxxxxxx
List-help: <mailto:xen-changelog-request@lists.xensource.com?subject=help>
List-id: BK change log <xen-changelog.lists.xensource.com>
List-post: <mailto:xen-changelog@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-changelog>, <mailto:xen-changelog-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-changelog>, <mailto:xen-changelog-request@lists.xensource.com?subject=unsubscribe>
Reply-to: xen-devel@xxxxxxxxxxxxxxxxxxx
Sender: xen-changelog-bounces@xxxxxxxxxxxxxxxxxxx
# HG changeset patch
# User kfraser@xxxxxxxxxxxxxxxxxxxxx
# Date 1171479695 0
# Node ID 9af0c7e4ff513c02f9bd1548f21612e9cf59b022
# Parent  aea80dbf6d96cbddbb652e7c4ef642778605ba76
# Parent  58e71ae679d5d2e602886297c134f12148540f47
Merge with xenppc-unstable.hg
---
 linux-2.6-xen-sparse/include/asm-i386/a.out.h               |   26 
 xen/include/asm-ia64/kexec.h                                |   25 
 xen/include/asm-ia64/linux/asm/percpu.h                     |   72 
 xen/include/asm-powerpc/kexec.h                             |   25 
 xen/include/asm-x86/kexec.h                                 |   20 
 xen/include/asm-x86/x86_32/kexec.h                          |   39 
 xen/include/asm-x86/x86_64/kexec.h                          |   38 
 .hgignore                                                   |    2 
 buildconfigs/linux-defconfig_xen0_ia64                      |  219 +-
 buildconfigs/linux-defconfig_xenU_ia64                      |  192 +
 buildconfigs/linux-defconfig_xen_ia64                       |  210 +-
 extras/mini-os/gnttab.c                                     |    5 
 extras/mini-os/netfront.c                                   |    4 
 linux-2.6-xen-sparse/arch/i386/kernel/entry-xen.S           |   22 
 linux-2.6-xen-sparse/arch/ia64/kernel/irq_ia64.c            |   73 
 linux-2.6-xen-sparse/arch/ia64/kernel/setup.c               |   11 
 linux-2.6-xen-sparse/arch/ia64/xen/hypervisor.c             |    6 
 linux-2.6-xen-sparse/arch/ia64/xen/xenentry.S               |   16 
 linux-2.6-xen-sparse/drivers/xen/blkback/xenbus.c           |    5 
 linux-2.6-xen-sparse/drivers/xen/blktap/xenbus.c            |    5 
 linux-2.6-xen-sparse/drivers/xen/core/evtchn.c              |    6 
 linux-2.6-xen-sparse/drivers/xen/core/reboot.c              |    3 
 linux-2.6-xen-sparse/drivers/xen/fbfront/xenkbd.c           |  103 -
 linux-2.6-xen-sparse/drivers/xen/netback/xenbus.c           |    2 
 linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c        |    6 
 linux-2.6-xen-sparse/include/asm-ia64/hw_irq.h              |    5 
 linux-2.6-xen-sparse/include/asm-ia64/maddr.h               |    3 
 linux-2.6-xen-sparse/include/asm-ia64/page.h                |   45 
 linux-2.6-xen-sparse/net/core/skbuff.c                      |   46 
 patches/linux-2.6.18/series                                 |    1 
 patches/linux-2.6.18/softlockup-no-idle-hz.patch            |   32 
 tools/examples/block                                        |    8 
 tools/examples/vif-bridge                                   |    7 
 tools/examples/xen-hotplug-common.sh                        |    5 
 tools/firmware/rombios/32bit/tcgbios/tcgbios.c              |   14 
 tools/firmware/rombios/32bit/tcgbios/tpm_drivers.c          |   52 
 tools/firmware/rombios/32bit/util.h                         |   15 
 tools/firmware/rombios/rombios.c                            |   13 
 tools/ioemu/hw/cirrus_vga.c                                 |    4 
 tools/ioemu/hw/ide.c                                        |    4 
 tools/ioemu/hw/rtl8139.c                                    |    6 
 tools/ioemu/hw/tpm_tis.c                                    |   13 
 tools/ioemu/xenstore.c                                      |   60 
 tools/libxc/xc_domain.c                                     |    8 
 tools/libxc/xc_hvm_restore.c                                |   61 
 tools/libxc/xc_hvm_save.c                                   |   91 
 tools/libxc/xenguest.h                                      |    5 
 tools/libxc/xg_private.c                                    |    5 
 tools/misc/Makefile                                         |    6 
 tools/misc/xen-detect.c                                     |  108 +
 tools/python/xen/xend/XendCheckpoint.py                     |    7 
 tools/python/xen/xend/XendConfig.py                         |   41 
 tools/python/xen/xend/XendDomain.py                         |   20 
 tools/python/xen/xend/XendDomainInfo.py                     |   58 
 tools/python/xen/xend/server/BlktapController.py            |   62 
 tools/python/xen/xend/server/DevController.py               |   52 
 tools/xcutils/xc_restore.c                                  |   15 
 tools/xenfb/vncfb.c                                         |   10 
 tools/xentrace/xentrace_format                              |    3 
 unmodified_drivers/linux-2.6/overrides.mk                   |    3 
 unmodified_drivers/linux-2.6/platform-pci/platform-compat.c |    6 
 unmodified_drivers/linux-2.6/platform-pci/platform-pci.c    |   35 
 unmodified_drivers/linux-2.6/platform-pci/xen_support.c     |   17 
 xen/arch/ia64/Rules.mk                                      |    4 
 xen/arch/ia64/asm-offsets.c                                 |    2 
 xen/arch/ia64/asm-xsi-offsets.c                             |    2 
 xen/arch/ia64/linux-xen/head.S                              |   16 
 xen/arch/ia64/linux-xen/mca.c                               |   80 
 xen/arch/ia64/vmx/optvfault.S                               |   75 
 xen/arch/ia64/vmx/vlsapic.c                                 |    7 
 xen/arch/ia64/vmx/vmmu.c                                    |   52 
 xen/arch/ia64/vmx/vmx_entry.S                               |  332 +--
 xen/arch/ia64/vmx/vmx_init.c                                |    7 
 xen/arch/ia64/vmx/vmx_interrupt.c                           |    2 
 xen/arch/ia64/vmx/vmx_ivt.S                                 |  295 ++
 xen/arch/ia64/vmx/vmx_minstate.h                            |    1 
 xen/arch/ia64/vmx/vmx_phy_mode.c                            |    2 
 xen/arch/ia64/vmx/vmx_process.c                             |   90 
 xen/arch/ia64/vmx/vmx_vcpu.c                                |   20 
 xen/arch/ia64/vmx/vmx_virt.c                                |    4 
 xen/arch/ia64/vmx/vtlb.c                                    |   12 
 xen/arch/ia64/xen/dom_fw.c                                  |   12 
 xen/arch/ia64/xen/domain.c                                  |  182 -
 xen/arch/ia64/xen/faults.c                                  |   20 
 xen/arch/ia64/xen/flushtlb.c                                |   42 
 xen/arch/ia64/xen/fw_emul.c                                 |   11 
 xen/arch/ia64/xen/hyperprivop.S                             |   39 
 xen/arch/ia64/xen/mm.c                                      |   27 
 xen/arch/ia64/xen/vcpu.c                                    |   46 
 xen/arch/ia64/xen/vhpt.c                                    |    8 
 xen/arch/ia64/xen/xensetup.c                                |   24 
 xen/arch/powerpc/machine_kexec.c                            |    5 
 xen/arch/x86/crash.c                                        |    1 
 xen/arch/x86/domain.c                                       |   52 
 xen/arch/x86/domain_build.c                                 |   10 
 xen/arch/x86/domctl.c                                       |   36 
 xen/arch/x86/hvm/Makefile                                   |    1 
 xen/arch/x86/hvm/hpet.c                                     |    2 
 xen/arch/x86/hvm/hvm.c                                      |   47 
 xen/arch/x86/hvm/i8254.c                                    |    2 
 xen/arch/x86/hvm/intercept.c                                |  176 -
 xen/arch/x86/hvm/io.c                                       |    2 
 xen/arch/x86/hvm/irq.c                                      |    9 
 xen/arch/x86/hvm/platform.c                                 |   65 
 xen/arch/x86/hvm/pmtimer.c                                  |   75 
 xen/arch/x86/hvm/rtc.c                                      |    2 
 xen/arch/x86/hvm/save.c                                     |  229 ++
 xen/arch/x86/hvm/svm/intr.c                                 |    2 
 xen/arch/x86/hvm/svm/svm.c                                  |   34 
 xen/arch/x86/hvm/svm/vmcb.c                                 |    7 
 xen/arch/x86/hvm/vioapic.c                                  |    2 
 xen/arch/x86/hvm/vlapic.c                                   |   24 
 xen/arch/x86/hvm/vmx/vmcs.c                                 |   18 
 xen/arch/x86/hvm/vmx/vmx.c                                  |   34 
 xen/arch/x86/hvm/vpic.c                                     |    2 
 xen/arch/x86/machine_kexec.c                                |   53 
 xen/arch/x86/mm.c                                           |  107 -
 xen/arch/x86/mm/Makefile                                    |    3 
 xen/arch/x86/mm/p2m.c                                       |  699 +++++++
 xen/arch/x86/mm/paging.c                                    |  143 +
 xen/arch/x86/mm/shadow/common.c                             | 1197 +++---------
 xen/arch/x86/mm/shadow/multi.c                              |  253 +-
 xen/arch/x86/mm/shadow/multi.h                              |    2 
 xen/arch/x86/mm/shadow/page-guest32.h                       |    5 
 xen/arch/x86/mm/shadow/private.h                            |  107 -
 xen/arch/x86/mm/shadow/types.h                              |   12 
 xen/arch/x86/setup.c                                        |    2 
 xen/arch/x86/sysctl.c                                       |    1 
 xen/arch/x86/traps.c                                        |   10 
 xen/arch/x86/x86_32/domain_page.c                           |    1 
 xen/arch/x86/x86_32/entry.S                                 |  107 -
 xen/arch/x86/x86_64/Makefile                                |    4 
 xen/arch/x86/x86_64/compat/Makefile                         |    2 
 xen/arch/x86/x86_64/compat/entry.S                          |   91 
 xen/arch/x86/x86_64/compat_kexec.S                          |  126 +
 xen/arch/x86/x86_64/entry.S                                 |   56 
 xen/arch/x86/x86_64/traps.c                                 |    1 
 xen/common/kexec.c                                          |    1 
 xen/common/libelf/libelf-dominfo.c                          |  557 ++---
 xen/common/libelf/libelf-loader.c                           |  127 -
 xen/common/libelf/libelf-private.h                          |   26 
 xen/common/libelf/libelf-relocate.c                         |  375 +--
 xen/common/libelf/libelf-tools.c                            |  153 -
 xen/common/memory.c                                         |   10 
 xen/drivers/char/console.c                                  |   14 
 xen/include/asm-ia64/config.h                               |    4 
 xen/include/asm-ia64/domain.h                               |    5 
 xen/include/asm-ia64/flushtlb.h                             |    1 
 xen/include/asm-ia64/linux-xen/asm/README.origin            |    1 
 xen/include/asm-ia64/linux-xen/asm/io.h                     |    2 
 xen/include/asm-ia64/linux-xen/asm/percpu.h                 |   77 
 xen/include/asm-ia64/linux-xen/linux/efi.h                  |    4 
 xen/include/asm-ia64/linux/asm/README.origin                |    1 
 xen/include/asm-ia64/vcpu.h                                 |    1 
 xen/include/asm-ia64/vmmu.h                                 |    3 
 xen/include/asm-ia64/vmx.h                                  |    2 
 xen/include/asm-ia64/vmx_mm_def.h                           |    4 
 xen/include/asm-ia64/vmx_vcpu.h                             |   21 
 xen/include/asm-ia64/vmx_vpd.h                              |    9 
 xen/include/asm-ia64/xenkregs.h                             |    4 
 xen/include/asm-x86/config.h                                |    4 
 xen/include/asm-x86/cpufeature.h                            |    1 
 xen/include/asm-x86/domain.h                                |   96 
 xen/include/asm-x86/hvm/hvm.h                               |    1 
 xen/include/asm-x86/hvm/support.h                           |   34 
 xen/include/asm-x86/hvm/vlapic.h                            |    2 
 xen/include/asm-x86/hvm/vpt.h                               |   14 
 xen/include/asm-x86/mm.h                                    |   63 
 xen/include/asm-x86/p2m.h                                   |  142 +
 xen/include/asm-x86/page.h                                  |    5 
 xen/include/asm-x86/paging.h                                |  376 +++
 xen/include/asm-x86/shadow.h                                |  380 ---
 xen/include/public/arch-ia64.h                              |   10 
 xen/include/public/domctl.h                                 |    3 
 xen/include/public/hvm/save.h                               |   12 
 xen/include/xen/kexec.h                                     |    1 
 176 files changed, 5986 insertions(+), 3874 deletions(-)

diff -r aea80dbf6d96 -r 9af0c7e4ff51 .hgignore
--- a/.hgignore Fri Feb 09 14:43:22 2007 -0600
+++ b/.hgignore Wed Feb 14 19:01:35 2007 +0000
@@ -107,6 +107,7 @@
 ^tools/firmware/rombios/BIOS-bochs-[^/]*$
 ^tools/firmware/rombios/_rombios[^/]*_\.c$
 ^tools/firmware/rombios/rombios[^/]*\.s$
+^tools/firmware/rombios/32bit/32bitbios_flat\.h$
 ^tools/firmware/vmxassist/gen$
 ^tools/firmware/vmxassist/offsets\.h$
 ^tools/firmware/vmxassist/vmxassist$
@@ -137,6 +138,7 @@
 ^tools/misc/miniterm/miniterm$
 ^tools/misc/xc_shadow$
 ^tools/misc/xen_cpuperf$
+^tools/misc/xen-detect$
 ^tools/misc/xenperf$
 ^tools/pygrub/build/.*$
 ^tools/python/build/.*$
diff -r aea80dbf6d96 -r 9af0c7e4ff51 buildconfigs/linux-defconfig_xen0_ia64
--- a/buildconfigs/linux-defconfig_xen0_ia64    Fri Feb 09 14:43:22 2007 -0600
+++ b/buildconfigs/linux-defconfig_xen0_ia64    Wed Feb 14 19:01:35 2007 +0000
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.16.29-xen0
-# Tue Nov 14 10:39:09 2006
+# Linux kernel version: 2.6.18-xen0
+# Mon Jan 29 10:16:18 2007
 #
 
 #
@@ -21,14 +21,16 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_POSIX_MQUEUE=y
 CONFIG_BSD_PROCESS_ACCT=y
 # CONFIG_BSD_PROCESS_ACCT_V3 is not set
-CONFIG_SYSCTL=y
+# CONFIG_TASKSTATS is not set
 # CONFIG_AUDIT is not set
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 # CONFIG_CPUSETS is not set
+# CONFIG_RELAY is not set
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 # CONFIG_EMBEDDED is not set
+CONFIG_SYSCTL=y
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
@@ -40,11 +42,9 @@ CONFIG_FUTEX=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
 CONFIG_SHMEM=y
-CONFIG_CC_ALIGN_FUNCTIONS=0
-CONFIG_CC_ALIGN_LABELS=0
-CONFIG_CC_ALIGN_LOOPS=0
-CONFIG_CC_ALIGN_JUMPS=0
 CONFIG_SLAB=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 # CONFIG_SLOB is not set
@@ -55,7 +55,6 @@ CONFIG_MODULES=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODULE_FORCE_UNLOAD is not set
-CONFIG_OBSOLETE_MODPARM=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
 CONFIG_KMOD=y
@@ -64,6 +63,7 @@ CONFIG_STOP_MACHINE=y
 #
 # Block layer
 #
+# CONFIG_BLK_DEV_IO_TRACE is not set
 
 #
 # IO Schedulers
@@ -86,8 +86,10 @@ CONFIG_MMU=y
 CONFIG_MMU=y
 CONFIG_SWIOTLB=y
 CONFIG_RWSEM_XCHGADD_ALGORITHM=y
+CONFIG_GENERIC_FIND_NEXT_BIT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_TIME_INTERPOLATION=y
+CONFIG_DMI=y
 CONFIG_EFI=y
 CONFIG_GENERIC_IOMAP=y
 CONFIG_XEN=y
@@ -96,6 +98,7 @@ CONFIG_XEN_IA64_EXPOSE_P2M_USE_DTR=y
 CONFIG_XEN_IA64_EXPOSE_P2M_USE_DTR=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_DMA_IS_DMA32=y
+CONFIG_AUDIT_ARCH=y
 # CONFIG_IA64_GENERIC is not set
 CONFIG_IA64_DIG=y
 # CONFIG_IA64_HP_ZX1 is not set
@@ -123,6 +126,7 @@ CONFIG_HOTPLUG_CPU=y
 CONFIG_HOTPLUG_CPU=y
 CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
 # CONFIG_SCHED_SMT is not set
+# CONFIG_PERMIT_BSP_REMOVE is not set
 # CONFIG_PREEMPT is not set
 CONFIG_SELECT_MEMORY_MODEL=y
 CONFIG_FLATMEM_MANUAL=y
@@ -132,6 +136,7 @@ CONFIG_FLAT_NODE_MEM_MAP=y
 CONFIG_FLAT_NODE_MEM_MAP=y
 # CONFIG_SPARSEMEM_STATIC is not set
 CONFIG_SPLIT_PTLOCK_CPUS=4
+CONFIG_RESOURCES_64BIT=y
 CONFIG_ARCH_SELECT_MEMORY_MODEL=y
 CONFIG_ARCH_DISCONTIGMEM_ENABLE=y
 CONFIG_ARCH_FLATMEM_ENABLE=y
@@ -163,6 +168,7 @@ CONFIG_ACPI=y
 CONFIG_ACPI=y
 CONFIG_ACPI_BUTTON=y
 CONFIG_ACPI_FAN=y
+# CONFIG_ACPI_DOCK is not set
 CONFIG_ACPI_PROCESSOR=y
 CONFIG_ACPI_HOTPLUG_CPU=y
 CONFIG_ACPI_THERMAL=y
@@ -185,7 +191,7 @@ CONFIG_PCI_DOMAINS=y
 CONFIG_PCI_DOMAINS=y
 CONFIG_XEN_PCIDEV_FRONTEND=y
 # CONFIG_XEN_PCIDEV_FE_DEBUG is not set
-CONFIG_PCI_LEGACY_PROC=y
+# CONFIG_PCIEPORTBUS is not set
 # CONFIG_PCI_DEBUG is not set
 
 #
@@ -215,6 +221,8 @@ CONFIG_PACKET=y
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
+CONFIG_XFRM=y
+# CONFIG_XFRM_USER is not set
 # CONFIG_NET_KEY is not set
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
@@ -229,7 +237,10 @@ CONFIG_SYN_COOKIES=y
 # CONFIG_INET_AH is not set
 # CONFIG_INET_ESP is not set
 # CONFIG_INET_IPCOMP is not set
+# CONFIG_INET_XFRM_TUNNEL is not set
 # CONFIG_INET_TUNNEL is not set
+CONFIG_INET_XFRM_MODE_TRANSPORT=y
+CONFIG_INET_XFRM_MODE_TUNNEL=y
 CONFIG_INET_DIAG=y
 CONFIG_INET_TCP_DIAG=y
 # CONFIG_TCP_CONG_ADVANCED is not set
@@ -240,6 +251,9 @@ CONFIG_TCP_CONG_BIC=y
 #
 # CONFIG_IP_VS is not set
 # CONFIG_IPV6 is not set
+# CONFIG_INET6_XFRM_TUNNEL is not set
+# CONFIG_INET6_TUNNEL is not set
+# CONFIG_NETWORK_SECMARK is not set
 CONFIG_NETFILTER=y
 # CONFIG_NETFILTER_DEBUG is not set
 CONFIG_BRIDGE_NETFILTER=y
@@ -280,12 +294,12 @@ CONFIG_BRIDGE=y
 CONFIG_BRIDGE=y
 # CONFIG_VLAN_8021Q is not set
 # CONFIG_DECNET is not set
+CONFIG_LLC=y
 # CONFIG_LLC2 is not set
 # CONFIG_IPX is not set
 # CONFIG_ATALK is not set
 # CONFIG_X25 is not set
 # CONFIG_LAPB is not set
-# CONFIG_NET_DIVERT is not set
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
 
@@ -314,6 +328,7 @@ CONFIG_PREVENT_FIRMWARE_BUILD=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
 CONFIG_FW_LOADER=y
 # CONFIG_DEBUG_DRIVER is not set
+# CONFIG_SYS_HYPERVISOR is not set
 
 #
 # Connector - unified userspace <-> kernelspace linker
@@ -352,6 +367,7 @@ CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=4096
+CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
@@ -463,6 +479,7 @@ CONFIG_SCSI_SAS_ATTRS=y
 # CONFIG_MEGARAID_LEGACY is not set
 # CONFIG_MEGARAID_SAS is not set
 # CONFIG_SCSI_SATA is not set
+# CONFIG_SCSI_HPTIOP is not set
 # CONFIG_SCSI_DMX3191D is not set
 # CONFIG_SCSI_FUTURE_DOMAIN is not set
 # CONFIG_SCSI_IPS is not set
@@ -472,10 +489,8 @@ CONFIG_SCSI_SYM53C8XX_DMA_ADDRESSING_MOD
 CONFIG_SCSI_SYM53C8XX_DMA_ADDRESSING_MODE=1
 CONFIG_SCSI_SYM53C8XX_DEFAULT_TAGS=16
 CONFIG_SCSI_SYM53C8XX_MAX_TAGS=64
-# CONFIG_SCSI_SYM53C8XX_IOMAPPED is not set
+CONFIG_SCSI_SYM53C8XX_MMIO=y
 # CONFIG_SCSI_IPR is not set
-CONFIG_SCSI_QLOGIC_FC=y
-# CONFIG_SCSI_QLOGIC_FC_FIRMWARE is not set
 CONFIG_SCSI_QLOGIC_1280=y
 # CONFIG_SCSI_QLA_FC is not set
 # CONFIG_SCSI_LPFC is not set
@@ -488,7 +503,13 @@ CONFIG_SCSI_QLOGIC_1280=y
 #
 CONFIG_MD=y
 # CONFIG_BLK_DEV_MD is not set
-# CONFIG_BLK_DEV_DM is not set
+CONFIG_BLK_DEV_DM=y
+CONFIG_DM_CRYPT=m
+CONFIG_DM_SNAPSHOT=m
+CONFIG_DM_MIRROR=m
+CONFIG_DM_ZERO=m
+CONFIG_DM_MULTIPATH=m
+CONFIG_DM_MULTIPATH_EMC=m
 
 #
 # Fusion MPT device support
@@ -607,6 +628,7 @@ CONFIG_TIGON3=y
 # CONFIG_CHELSIO_T1 is not set
 # CONFIG_IXGB is not set
 # CONFIG_S2IO is not set
+# CONFIG_MYRI10GE is not set
 
 #
 # Token Ring devices
@@ -709,6 +731,7 @@ CONFIG_VT=y
 CONFIG_VT=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
+# CONFIG_VT_HW_CONSOLE_BINDING is not set
 CONFIG_SERIAL_NONSTANDARD=y
 # CONFIG_COMPUTONE is not set
 # CONFIG_ROCKETPORT is not set
@@ -722,6 +745,7 @@ CONFIG_SERIAL_NONSTANDARD=y
 # CONFIG_N_HDLC is not set
 # CONFIG_SPECIALIX is not set
 # CONFIG_SX is not set
+# CONFIG_RIO is not set
 # CONFIG_STALDRV is not set
 
 #
@@ -755,6 +779,8 @@ CONFIG_EFI_RTC=y
 # Ftape, the floppy tape device driver
 #
 CONFIG_AGP=y
+# CONFIG_AGP_SIS is not set
+# CONFIG_AGP_VIA is not set
 CONFIG_AGP_I460=y
 CONFIG_DRM=y
 # CONFIG_DRM_TDFX is not set
@@ -799,10 +825,10 @@ CONFIG_I2C_ALGOPCF=y
 # CONFIG_I2C_I810 is not set
 # CONFIG_I2C_PIIX4 is not set
 # CONFIG_I2C_NFORCE2 is not set
+# CONFIG_I2C_OCORES is not set
 # CONFIG_I2C_PARPORT_LIGHT is not set
 # CONFIG_I2C_PROSAVAGE is not set
 # CONFIG_I2C_SAVAGE4 is not set
-# CONFIG_SCx200_ACB is not set
 # CONFIG_I2C_SIS5595 is not set
 # CONFIG_I2C_SIS630 is not set
 # CONFIG_I2C_SIS96X is not set
@@ -821,9 +847,7 @@ CONFIG_I2C_ALGOPCF=y
 # CONFIG_SENSORS_PCF8574 is not set
 # CONFIG_SENSORS_PCA9539 is not set
 # CONFIG_SENSORS_PCF8591 is not set
-# CONFIG_SENSORS_RTC8564 is not set
 # CONFIG_SENSORS_MAX6875 is not set
-# CONFIG_RTC_X1205_I2C is not set
 # CONFIG_I2C_DEBUG_CORE is not set
 # CONFIG_I2C_DEBUG_ALGO is not set
 # CONFIG_I2C_DEBUG_BUS is not set
@@ -838,13 +862,13 @@ CONFIG_I2C_ALGOPCF=y
 #
 # Dallas's 1-wire bus
 #
-# CONFIG_W1 is not set
 
 #
 # Hardware Monitoring support
 #
 CONFIG_HWMON=y
 # CONFIG_HWMON_VID is not set
+# CONFIG_SENSORS_ABITUGURU is not set
 # CONFIG_SENSORS_ADM1021 is not set
 # CONFIG_SENSORS_ADM1025 is not set
 # CONFIG_SENSORS_ADM1026 is not set
@@ -873,10 +897,12 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_PC87360 is not set
 # CONFIG_SENSORS_SIS5595 is not set
 # CONFIG_SENSORS_SMSC47M1 is not set
+# CONFIG_SENSORS_SMSC47M192 is not set
 # CONFIG_SENSORS_SMSC47B397 is not set
 # CONFIG_SENSORS_VIA686A is not set
 # CONFIG_SENSORS_VT8231 is not set
 # CONFIG_SENSORS_W83781D is not set
+# CONFIG_SENSORS_W83791D is not set
 # CONFIG_SENSORS_W83792D is not set
 # CONFIG_SENSORS_W83L785TS is not set
 # CONFIG_SENSORS_W83627HF is not set
@@ -888,24 +914,25 @@ CONFIG_HWMON=y
 #
 
 #
-# Multimedia Capabilities Port drivers
-#
-
-#
 # Multimedia devices
 #
 CONFIG_VIDEO_DEV=y
-
-#
-# Video For Linux
-#
-
-#
-# Video Adapters
+CONFIG_VIDEO_V4L1=y
+CONFIG_VIDEO_V4L1_COMPAT=y
+CONFIG_VIDEO_V4L2=y
+
+#
+# Video Capture Adapters
+#
+
+#
+# Video Capture Adapters
 #
 # CONFIG_VIDEO_ADV_DEBUG is not set
+# CONFIG_VIDEO_VIVI is not set
 # CONFIG_VIDEO_BT848 is not set
 # CONFIG_VIDEO_CPIA is not set
+# CONFIG_VIDEO_CPIA2 is not set
 # CONFIG_VIDEO_SAA5246A is not set
 # CONFIG_VIDEO_SAA5249 is not set
 # CONFIG_TUNER_3036 is not set
@@ -917,10 +944,40 @@ CONFIG_VIDEO_DEV=y
 # CONFIG_VIDEO_HEXIUM_ORION is not set
 # CONFIG_VIDEO_HEXIUM_GEMINI is not set
 # CONFIG_VIDEO_CX88 is not set
+
+#
+# Encoders and Decoders
+#
+# CONFIG_VIDEO_MSP3400 is not set
+# CONFIG_VIDEO_CS53L32A is not set
+# CONFIG_VIDEO_TLV320AIC23B is not set
+# CONFIG_VIDEO_WM8775 is not set
+# CONFIG_VIDEO_WM8739 is not set
+# CONFIG_VIDEO_CX2341X is not set
+# CONFIG_VIDEO_CX25840 is not set
+# CONFIG_VIDEO_SAA711X is not set
+# CONFIG_VIDEO_SAA7127 is not set
+# CONFIG_VIDEO_UPD64031A is not set
+# CONFIG_VIDEO_UPD64083 is not set
+
+#
+# V4L USB devices
+#
+# CONFIG_VIDEO_PVRUSB2 is not set
 # CONFIG_VIDEO_EM28XX is not set
+# CONFIG_USB_VICAM is not set
+# CONFIG_USB_IBMCAM is not set
+# CONFIG_USB_KONICAWC is not set
+# CONFIG_USB_QUICKCAM_MESSENGER is not set
+# CONFIG_USB_ET61X251 is not set
 # CONFIG_VIDEO_OVCAMCHIP is not set
-# CONFIG_VIDEO_AUDIO_DECODER is not set
-# CONFIG_VIDEO_DECODER is not set
+# CONFIG_USB_W9968CF is not set
+# CONFIG_USB_OV511 is not set
+# CONFIG_USB_SE401 is not set
+# CONFIG_USB_SN9C102 is not set
+# CONFIG_USB_STV680 is not set
+# CONFIG_USB_ZC0301 is not set
+# CONFIG_USB_PWC is not set
 
 #
 # Radio Adapters
@@ -928,20 +985,24 @@ CONFIG_VIDEO_DEV=y
 # CONFIG_RADIO_GEMTEK_PCI is not set
 # CONFIG_RADIO_MAXIRADIO is not set
 # CONFIG_RADIO_MAESTRO is not set
+# CONFIG_USB_DSBR is not set
 
 #
 # Digital Video Broadcasting Devices
 #
 # CONFIG_DVB is not set
+# CONFIG_USB_DABUSB is not set
 
 #
 # Graphics support
 #
+CONFIG_FIRMWARE_EDID=y
 CONFIG_FB=y
 CONFIG_FB_CFB_FILLRECT=y
 CONFIG_FB_CFB_COPYAREA=y
 CONFIG_FB_CFB_IMAGEBLIT=y
 # CONFIG_FB_MACMODES is not set
+# CONFIG_FB_BACKLIGHT is not set
 CONFIG_FB_MODE_HELPERS=y
 # CONFIG_FB_TILEBLITTING is not set
 # CONFIG_FB_CIRRUS is not set
@@ -953,7 +1014,6 @@ CONFIG_FB_MODE_HELPERS=y
 # CONFIG_FB_NVIDIA is not set
 # CONFIG_FB_RIVA is not set
 # CONFIG_FB_MATROX is not set
-# CONFIG_FB_RADEON_OLD is not set
 CONFIG_FB_RADEON=y
 CONFIG_FB_RADEON_I2C=y
 CONFIG_FB_RADEON_DEBUG=y
@@ -972,6 +1032,7 @@ CONFIG_FB_RADEON_DEBUG=y
 # Console display driver support
 #
 CONFIG_VGA_CONSOLE=y
+# CONFIG_VGACON_SOFT_SCROLLBACK is not set
 CONFIG_DUMMY_CONSOLE=y
 # CONFIG_FRAMEBUFFER_CONSOLE is not set
 
@@ -1002,9 +1063,11 @@ CONFIG_SND_OSSEMUL=y
 CONFIG_SND_OSSEMUL=y
 CONFIG_SND_MIXER_OSS=y
 CONFIG_SND_PCM_OSS=y
+CONFIG_SND_PCM_OSS_PLUGINS=y
 CONFIG_SND_SEQUENCER_OSS=y
 # CONFIG_SND_DYNAMIC_MINORS is not set
 CONFIG_SND_SUPPORT_OLD_API=y
+CONFIG_SND_VERBOSE_PROCFS=y
 # CONFIG_SND_VERBOSE_PRINTK is not set
 # CONFIG_SND_DEBUG is not set
 
@@ -1025,6 +1088,7 @@ CONFIG_SND_MPU401=y
 # PCI devices
 #
 # CONFIG_SND_AD1889 is not set
+# CONFIG_SND_ALS300 is not set
 # CONFIG_SND_ALI5451 is not set
 CONFIG_SND_ATIIXP=y
 # CONFIG_SND_ATIIXP_MODEM is not set
@@ -1037,6 +1101,18 @@ CONFIG_SND_ATIIXP=y
 # CONFIG_SND_CMIPCI is not set
 # CONFIG_SND_CS4281 is not set
 # CONFIG_SND_CS46XX is not set
+# CONFIG_SND_DARLA20 is not set
+# CONFIG_SND_GINA20 is not set
+# CONFIG_SND_LAYLA20 is not set
+# CONFIG_SND_DARLA24 is not set
+# CONFIG_SND_GINA24 is not set
+# CONFIG_SND_LAYLA24 is not set
+# CONFIG_SND_MONA is not set
+# CONFIG_SND_MIA is not set
+# CONFIG_SND_ECHO3G is not set
+# CONFIG_SND_INDIGO is not set
+# CONFIG_SND_INDIGOIO is not set
+# CONFIG_SND_INDIGODJ is not set
 # CONFIG_SND_EMU10K1 is not set
 # CONFIG_SND_EMU10K1X is not set
 # CONFIG_SND_ENS1370 is not set
@@ -1057,6 +1133,7 @@ CONFIG_SND_FM801=y
 # CONFIG_SND_MIXART is not set
 # CONFIG_SND_NM256 is not set
 # CONFIG_SND_PCXHR is not set
+# CONFIG_SND_RIPTIDE is not set
 # CONFIG_SND_RME32 is not set
 # CONFIG_SND_RME96 is not set
 # CONFIG_SND_RME9652 is not set
@@ -1076,12 +1153,14 @@ CONFIG_SND_FM801=y
 # Open Sound System
 #
 CONFIG_SOUND_PRIME=y
-# CONFIG_OBSOLETE_OSS_DRIVER is not set
-# CONFIG_SOUND_FUSION is not set
+# CONFIG_OSS_OBSOLETE_DRIVER is not set
+# CONFIG_SOUND_BT878 is not set
+# CONFIG_SOUND_ES1371 is not set
 # CONFIG_SOUND_ICH is not set
 # CONFIG_SOUND_TRIDENT is not set
 # CONFIG_SOUND_MSNDCLAS is not set
 # CONFIG_SOUND_MSNDPIN is not set
+# CONFIG_SOUND_VIA82CXXX is not set
 # CONFIG_SOUND_TVMIXER is not set
 
 #
@@ -1089,6 +1168,7 @@ CONFIG_SOUND_PRIME=y
 #
 CONFIG_USB_ARCH_HAS_HCD=y
 CONFIG_USB_ARCH_HAS_OHCI=y
+CONFIG_USB_ARCH_HAS_EHCI=y
 CONFIG_USB=y
 # CONFIG_USB_DEBUG is not set
 
@@ -1107,6 +1187,7 @@ CONFIG_USB_EHCI_HCD=y
 CONFIG_USB_EHCI_HCD=y
 # CONFIG_USB_EHCI_SPLIT_ISO is not set
 # CONFIG_USB_EHCI_ROOT_HUB_TT is not set
+# CONFIG_USB_EHCI_TT_NEWSCHED is not set
 # CONFIG_USB_ISP116X_HCD is not set
 CONFIG_USB_OHCI_HCD=y
 # CONFIG_USB_OHCI_BIG_ENDIAN is not set
@@ -1117,7 +1198,6 @@ CONFIG_USB_UHCI_HCD=y
 #
 # USB Device Class drivers
 #
-# CONFIG_OBSOLETE_OSS_USB_DRIVER is not set
 # CONFIG_USB_ACM is not set
 # CONFIG_USB_PRINTER is not set
 
@@ -1154,9 +1234,7 @@ CONFIG_USB_HIDDEV=y
 # CONFIG_USB_ACECAD is not set
 # CONFIG_USB_KBTAB is not set
 # CONFIG_USB_POWERMATE is not set
-# CONFIG_USB_MTOUCH is not set
-# CONFIG_USB_ITMTOUCH is not set
-# CONFIG_USB_EGALAX is not set
+# CONFIG_USB_TOUCHSCREEN is not set
 # CONFIG_USB_YEALINK is not set
 # CONFIG_USB_XPAD is not set
 # CONFIG_USB_ATI_REMOTE is not set
@@ -1169,21 +1247,6 @@ CONFIG_USB_HIDDEV=y
 #
 # CONFIG_USB_MDC800 is not set
 # CONFIG_USB_MICROTEK is not set
-
-#
-# USB Multimedia devices
-#
-# CONFIG_USB_DABUSB is not set
-# CONFIG_USB_VICAM is not set
-# CONFIG_USB_DSBR is not set
-# CONFIG_USB_ET61X251 is not set
-# CONFIG_USB_IBMCAM is not set
-# CONFIG_USB_KONICAWC is not set
-# CONFIG_USB_OV511 is not set
-# CONFIG_USB_SE401 is not set
-# CONFIG_USB_SN9C102 is not set
-# CONFIG_USB_STV680 is not set
-# CONFIG_USB_PWC is not set
 
 #
 # USB Network Adapters
@@ -1214,10 +1277,12 @@ CONFIG_USB_MON=y
 # CONFIG_USB_LEGOTOWER is not set
 # CONFIG_USB_LCD is not set
 # CONFIG_USB_LED is not set
+# CONFIG_USB_CYPRESS_CY7C63 is not set
 # CONFIG_USB_CYTHERM is not set
 # CONFIG_USB_PHIDGETKIT is not set
 # CONFIG_USB_PHIDGETSERVO is not set
 # CONFIG_USB_IDMOUSE is not set
+# CONFIG_USB_APPLEDISPLAY is not set
 # CONFIG_USB_SISUSBVGA is not set
 # CONFIG_USB_LD is not set
 # CONFIG_USB_TEST is not set
@@ -1237,12 +1302,43 @@ CONFIG_USB_MON=y
 # CONFIG_MMC is not set
 
 #
+# LED devices
+#
+# CONFIG_NEW_LEDS is not set
+
+#
+# LED drivers
+#
+
+#
+# LED Triggers
+#
+
+#
 # InfiniBand support
 #
 # CONFIG_INFINIBAND is not set
 
 #
 # EDAC - error detection and reporting (RAS) (EXPERIMENTAL)
+#
+
+#
+# Real Time Clock
+#
+# CONFIG_RTC_CLASS is not set
+
+#
+# DMA Engine support
+#
+# CONFIG_DMA_ENGINE is not set
+
+#
+# DMA Clients
+#
+
+#
+# DMA Devices
 #
 
 #
@@ -1269,7 +1365,6 @@ CONFIG_REISERFS_FS_SECURITY=y
 # CONFIG_JFS_FS is not set
 CONFIG_FS_POSIX_ACL=y
 CONFIG_XFS_FS=y
-CONFIG_XFS_EXPORT=y
 # CONFIG_XFS_QUOTA is not set
 # CONFIG_XFS_SECURITY is not set
 # CONFIG_XFS_POSIX_ACL is not set
@@ -1278,6 +1373,7 @@ CONFIG_XFS_EXPORT=y
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
+CONFIG_INOTIFY_USER=y
 # CONFIG_QUOTA is not set
 CONFIG_DNOTIFY=y
 CONFIG_AUTOFS_FS=y
@@ -1312,7 +1408,6 @@ CONFIG_TMPFS=y
 CONFIG_TMPFS=y
 # CONFIG_HUGETLB_PAGE is not set
 CONFIG_RAMFS=y
-# CONFIG_RELAYFS_FS is not set
 # CONFIG_CONFIGFS_FS is not set
 
 #
@@ -1358,7 +1453,9 @@ CONFIG_SMB_NLS_REMOTE="cp437"
 CONFIG_SMB_NLS_REMOTE="cp437"
 CONFIG_CIFS=y
 # CONFIG_CIFS_STATS is not set
+# CONFIG_CIFS_WEAK_PW_HASH is not set
 # CONFIG_CIFS_XATTR is not set
+# CONFIG_CIFS_DEBUG2 is not set
 # CONFIG_CIFS_EXPERIMENTAL is not set
 # CONFIG_NCP_FS is not set
 # CONFIG_CODA_FS is not set
@@ -1437,9 +1534,11 @@ CONFIG_NLS_UTF8=y
 # CONFIG_CRC16 is not set
 CONFIG_CRC32=y
 # CONFIG_LIBCRC32C is not set
+CONFIG_PLIST=y
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_GENERIC_IRQ_PROBE=y
 CONFIG_GENERIC_PENDING_IRQ=y
+CONFIG_IRQ_PER_CPU=y
 
 #
 # Instrumentation Support
@@ -1452,14 +1551,19 @@ CONFIG_GENERIC_PENDING_IRQ=y
 #
 # CONFIG_PRINTK_TIME is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_UNUSED_SYMBOLS=y
 CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=20
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
+# CONFIG_DEBUG_RT_MUTEXES is not set
+# CONFIG_RT_MUTEX_TESTER is not set
+# CONFIG_DEBUG_SPINLOCK is not set
 CONFIG_DEBUG_MUTEXES=y
-# CONFIG_DEBUG_SPINLOCK is not set
+# CONFIG_DEBUG_RWSEMS is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
+# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 # CONFIG_DEBUG_FS is not set
@@ -1513,7 +1617,6 @@ CONFIG_CRYPTO_DES=y
 #
 # CONFIG_XEN_UTIL is not set
 CONFIG_XEN_BALLOON=y
-# CONFIG_XEN_DEVMEM is not set
 CONFIG_XEN_REBOOT=y
 # CONFIG_XEN_SMPBOOT is not set
 CONFIG_XEN_INTERFACE_VERSION=0x00030203
@@ -1539,6 +1642,7 @@ CONFIG_XEN_TPMDEV_BACKEND=m
 CONFIG_XEN_TPMDEV_BACKEND=m
 CONFIG_XEN_BLKDEV_FRONTEND=y
 CONFIG_XEN_NETDEV_FRONTEND=y
+# CONFIG_XEN_FRAMEBUFFER is not set
 # CONFIG_XEN_SCRUB_PAGES is not set
 CONFIG_XEN_DISABLE_SERIAL=y
 CONFIG_XEN_SYSFS=y
@@ -1547,3 +1651,4 @@ CONFIG_XEN_COMPAT_030002=y
 CONFIG_XEN_COMPAT_030002=y
 CONFIG_HAVE_IRQ_IGNORE_UNHANDLED=y
 CONFIG_NO_IDLE_HZ=y
+CONFIG_XEN_DEVMEM=y
diff -r aea80dbf6d96 -r 9af0c7e4ff51 buildconfigs/linux-defconfig_xenU_ia64
--- a/buildconfigs/linux-defconfig_xenU_ia64    Fri Feb 09 14:43:22 2007 -0600
+++ b/buildconfigs/linux-defconfig_xenU_ia64    Wed Feb 14 19:01:35 2007 +0000
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.16.29-xenU
-# Wed Oct  4 12:54:26 2006
+# Linux kernel version: 2.6.18-xenU
+# Mon Jan 29 10:26:51 2007
 #
 
 #
@@ -21,13 +21,15 @@ CONFIG_SYSVIPC=y
 # CONFIG_POSIX_MQUEUE is not set
 CONFIG_BSD_PROCESS_ACCT=y
 # CONFIG_BSD_PROCESS_ACCT_V3 is not set
-CONFIG_SYSCTL=y
+# CONFIG_TASKSTATS is not set
 # CONFIG_AUDIT is not set
 # CONFIG_IKCONFIG is not set
 # CONFIG_CPUSETS is not set
+# CONFIG_RELAY is not set
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 # CONFIG_EMBEDDED is not set
+CONFIG_SYSCTL=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
@@ -39,11 +41,9 @@ CONFIG_FUTEX=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
 CONFIG_SHMEM=y
-CONFIG_CC_ALIGN_FUNCTIONS=0
-CONFIG_CC_ALIGN_LABELS=0
-CONFIG_CC_ALIGN_LOOPS=0
-CONFIG_CC_ALIGN_JUMPS=0
 CONFIG_SLAB=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 # CONFIG_SLOB is not set
@@ -53,7 +53,6 @@ CONFIG_BASE_SMALL=0
 #
 CONFIG_MODULES=y
 # CONFIG_MODULE_UNLOAD is not set
-CONFIG_OBSOLETE_MODPARM=y
 # CONFIG_MODVERSIONS is not set
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 # CONFIG_KMOD is not set
@@ -61,6 +60,7 @@ CONFIG_OBSOLETE_MODPARM=y
 #
 # Block layer
 #
+# CONFIG_BLK_DEV_IO_TRACE is not set
 
 #
 # IO Schedulers
@@ -83,8 +83,10 @@ CONFIG_MMU=y
 CONFIG_MMU=y
 CONFIG_SWIOTLB=y
 CONFIG_RWSEM_XCHGADD_ALGORITHM=y
+CONFIG_GENERIC_FIND_NEXT_BIT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_TIME_INTERPOLATION=y
+CONFIG_DMI=y
 CONFIG_EFI=y
 CONFIG_GENERIC_IOMAP=y
 CONFIG_XEN=y
@@ -93,6 +95,7 @@ CONFIG_XEN_IA64_EXPOSE_P2M_USE_DTR=y
 CONFIG_XEN_IA64_EXPOSE_P2M_USE_DTR=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_DMA_IS_DMA32=y
+CONFIG_AUDIT_ARCH=y
 # CONFIG_IA64_GENERIC is not set
 CONFIG_IA64_DIG=y
 # CONFIG_IA64_HP_ZX1 is not set
@@ -117,9 +120,10 @@ CONFIG_FORCE_MAX_ZONEORDER=11
 CONFIG_FORCE_MAX_ZONEORDER=11
 CONFIG_SMP=y
 CONFIG_NR_CPUS=16
-# CONFIG_HOTPLUG_CPU is not set
+CONFIG_HOTPLUG_CPU=y
 CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
 # CONFIG_SCHED_SMT is not set
+# CONFIG_PERMIT_BSP_REMOVE is not set
 # CONFIG_PREEMPT is not set
 CONFIG_SELECT_MEMORY_MODEL=y
 CONFIG_FLATMEM_MANUAL=y
@@ -129,6 +133,7 @@ CONFIG_FLAT_NODE_MEM_MAP=y
 CONFIG_FLAT_NODE_MEM_MAP=y
 # CONFIG_SPARSEMEM_STATIC is not set
 CONFIG_SPLIT_PTLOCK_CPUS=4
+CONFIG_RESOURCES_64BIT=y
 CONFIG_ARCH_SELECT_MEMORY_MODEL=y
 CONFIG_ARCH_DISCONTIGMEM_ENABLE=y
 CONFIG_ARCH_FLATMEM_ENABLE=y
@@ -161,7 +166,9 @@ CONFIG_ACPI=y
 CONFIG_ACPI=y
 CONFIG_ACPI_BUTTON=y
 CONFIG_ACPI_FAN=y
+# CONFIG_ACPI_DOCK is not set
 CONFIG_ACPI_PROCESSOR=y
+CONFIG_ACPI_HOTPLUG_CPU=y
 CONFIG_ACPI_THERMAL=y
 CONFIG_ACPI_BLACKLIST_YEAR=0
 # CONFIG_ACPI_DEBUG is not set
@@ -182,7 +189,7 @@ CONFIG_PCI_DOMAINS=y
 CONFIG_PCI_DOMAINS=y
 CONFIG_XEN_PCIDEV_FRONTEND=y
 # CONFIG_XEN_PCIDEV_FE_DEBUG is not set
-CONFIG_PCI_LEGACY_PROC=y
+# CONFIG_PCIEPORTBUS is not set
 # CONFIG_PCI_DEBUG is not set
 
 #
@@ -212,6 +219,8 @@ CONFIG_PACKET=y
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
+CONFIG_XFRM=y
+# CONFIG_XFRM_USER is not set
 # CONFIG_NET_KEY is not set
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
@@ -226,7 +235,10 @@ CONFIG_IP_FIB_HASH=y
 # CONFIG_INET_AH is not set
 # CONFIG_INET_ESP is not set
 # CONFIG_INET_IPCOMP is not set
+# CONFIG_INET_XFRM_TUNNEL is not set
 # CONFIG_INET_TUNNEL is not set
+CONFIG_INET_XFRM_MODE_TRANSPORT=y
+CONFIG_INET_XFRM_MODE_TUNNEL=y
 CONFIG_INET_DIAG=y
 CONFIG_INET_TCP_DIAG=y
 # CONFIG_TCP_CONG_ADVANCED is not set
@@ -237,6 +249,9 @@ CONFIG_TCP_CONG_BIC=y
 #
 # CONFIG_IP_VS is not set
 # CONFIG_IPV6 is not set
+# CONFIG_INET6_XFRM_TUNNEL is not set
+# CONFIG_INET6_TUNNEL is not set
+# CONFIG_NETWORK_SECMARK is not set
 CONFIG_NETFILTER=y
 # CONFIG_NETFILTER_DEBUG is not set
 
@@ -276,7 +291,6 @@ CONFIG_NETFILTER=y
 # CONFIG_ATALK is not set
 # CONFIG_X25 is not set
 # CONFIG_LAPB is not set
-# CONFIG_NET_DIVERT is not set
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
 
@@ -305,6 +319,7 @@ CONFIG_PREVENT_FIRMWARE_BUILD=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
 # CONFIG_FW_LOADER is not set
 # CONFIG_DEBUG_DRIVER is not set
+# CONFIG_SYS_HYPERVISOR is not set
 
 #
 # Connector - unified userspace <-> kernelspace linker
@@ -342,6 +357,7 @@ CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=4096
+CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
@@ -399,6 +415,7 @@ CONFIG_SCSI_SAS_ATTRS=y
 # CONFIG_MEGARAID_LEGACY is not set
 # CONFIG_MEGARAID_SAS is not set
 # CONFIG_SCSI_SATA is not set
+# CONFIG_SCSI_HPTIOP is not set
 # CONFIG_SCSI_DMX3191D is not set
 # CONFIG_SCSI_FUTURE_DOMAIN is not set
 # CONFIG_SCSI_IPS is not set
@@ -408,9 +425,8 @@ CONFIG_SCSI_SYM53C8XX_DMA_ADDRESSING_MOD
 CONFIG_SCSI_SYM53C8XX_DMA_ADDRESSING_MODE=1
 CONFIG_SCSI_SYM53C8XX_DEFAULT_TAGS=16
 CONFIG_SCSI_SYM53C8XX_MAX_TAGS=64
-# CONFIG_SCSI_SYM53C8XX_IOMAPPED is not set
+CONFIG_SCSI_SYM53C8XX_MMIO=y
 # CONFIG_SCSI_IPR is not set
-# CONFIG_SCSI_QLOGIC_FC is not set
 CONFIG_SCSI_QLOGIC_1280=y
 # CONFIG_SCSI_QLA_FC is not set
 # CONFIG_SCSI_LPFC is not set
@@ -532,6 +548,7 @@ CONFIG_TIGON3=y
 # CONFIG_CHELSIO_T1 is not set
 # CONFIG_IXGB is not set
 # CONFIG_S2IO is not set
+# CONFIG_MYRI10GE is not set
 
 #
 # Token Ring devices
@@ -609,6 +626,7 @@ CONFIG_VT=y
 CONFIG_VT=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
+# CONFIG_VT_HW_CONSOLE_BINDING is not set
 # CONFIG_SERIAL_NONSTANDARD is not set
 
 #
@@ -616,7 +634,7 @@ CONFIG_HW_CONSOLE=y
 #
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
-CONFIG_SERIAL_8250_ACPI=y
+CONFIG_SERIAL_8250_PCI=y
 CONFIG_SERIAL_8250_NR_UARTS=8
 CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 CONFIG_SERIAL_8250_EXTENDED=y
@@ -653,6 +671,8 @@ CONFIG_EFI_RTC=y
 # Ftape, the floppy tape device driver
 #
 CONFIG_AGP=y
+# CONFIG_AGP_SIS is not set
+# CONFIG_AGP_VIA is not set
 # CONFIG_AGP_I460 is not set
 CONFIG_DRM=y
 # CONFIG_DRM_TDFX is not set
@@ -697,10 +717,10 @@ CONFIG_I2C_ALGOPCF=y
 # CONFIG_I2C_I810 is not set
 # CONFIG_I2C_PIIX4 is not set
 # CONFIG_I2C_NFORCE2 is not set
+# CONFIG_I2C_OCORES is not set
 # CONFIG_I2C_PARPORT_LIGHT is not set
 # CONFIG_I2C_PROSAVAGE is not set
 # CONFIG_I2C_SAVAGE4 is not set
-# CONFIG_SCx200_ACB is not set
 # CONFIG_I2C_SIS5595 is not set
 # CONFIG_I2C_SIS630 is not set
 # CONFIG_I2C_SIS96X is not set
@@ -719,9 +739,7 @@ CONFIG_I2C_ALGOPCF=y
 # CONFIG_SENSORS_PCF8574 is not set
 # CONFIG_SENSORS_PCA9539 is not set
 # CONFIG_SENSORS_PCF8591 is not set
-# CONFIG_SENSORS_RTC8564 is not set
 # CONFIG_SENSORS_MAX6875 is not set
-# CONFIG_RTC_X1205_I2C is not set
 # CONFIG_I2C_DEBUG_CORE is not set
 # CONFIG_I2C_DEBUG_ALGO is not set
 # CONFIG_I2C_DEBUG_BUS is not set
@@ -736,13 +754,13 @@ CONFIG_I2C_ALGOPCF=y
 #
 # Dallas's 1-wire bus
 #
-# CONFIG_W1 is not set
 
 #
 # Hardware Monitoring support
 #
 CONFIG_HWMON=y
 # CONFIG_HWMON_VID is not set
+# CONFIG_SENSORS_ABITUGURU is not set
 # CONFIG_SENSORS_ADM1021 is not set
 # CONFIG_SENSORS_ADM1025 is not set
 # CONFIG_SENSORS_ADM1026 is not set
@@ -771,10 +789,12 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_PC87360 is not set
 # CONFIG_SENSORS_SIS5595 is not set
 # CONFIG_SENSORS_SMSC47M1 is not set
+# CONFIG_SENSORS_SMSC47M192 is not set
 # CONFIG_SENSORS_SMSC47B397 is not set
 # CONFIG_SENSORS_VIA686A is not set
 # CONFIG_SENSORS_VT8231 is not set
 # CONFIG_SENSORS_W83781D is not set
+# CONFIG_SENSORS_W83791D is not set
 # CONFIG_SENSORS_W83792D is not set
 # CONFIG_SENSORS_W83L785TS is not set
 # CONFIG_SENSORS_W83627HF is not set
@@ -786,24 +806,25 @@ CONFIG_HWMON=y
 #
 
 #
-# Multimedia Capabilities Port drivers
-#
-
-#
 # Multimedia devices
 #
 CONFIG_VIDEO_DEV=y
-
-#
-# Video For Linux
-#
-
-#
-# Video Adapters
+CONFIG_VIDEO_V4L1=y
+CONFIG_VIDEO_V4L1_COMPAT=y
+CONFIG_VIDEO_V4L2=y
+
+#
+# Video Capture Adapters
+#
+
+#
+# Video Capture Adapters
 #
 # CONFIG_VIDEO_ADV_DEBUG is not set
+# CONFIG_VIDEO_VIVI is not set
 # CONFIG_VIDEO_BT848 is not set
 # CONFIG_VIDEO_CPIA is not set
+# CONFIG_VIDEO_CPIA2 is not set
 # CONFIG_VIDEO_SAA5246A is not set
 # CONFIG_VIDEO_SAA5249 is not set
 # CONFIG_TUNER_3036 is not set
@@ -815,10 +836,40 @@ CONFIG_VIDEO_DEV=y
 # CONFIG_VIDEO_HEXIUM_ORION is not set
 # CONFIG_VIDEO_HEXIUM_GEMINI is not set
 # CONFIG_VIDEO_CX88 is not set
+
+#
+# Encoders and Decoders
+#
+# CONFIG_VIDEO_MSP3400 is not set
+# CONFIG_VIDEO_CS53L32A is not set
+# CONFIG_VIDEO_TLV320AIC23B is not set
+# CONFIG_VIDEO_WM8775 is not set
+# CONFIG_VIDEO_WM8739 is not set
+# CONFIG_VIDEO_CX2341X is not set
+# CONFIG_VIDEO_CX25840 is not set
+# CONFIG_VIDEO_SAA711X is not set
+# CONFIG_VIDEO_SAA7127 is not set
+# CONFIG_VIDEO_UPD64031A is not set
+# CONFIG_VIDEO_UPD64083 is not set
+
+#
+# V4L USB devices
+#
+# CONFIG_VIDEO_PVRUSB2 is not set
 # CONFIG_VIDEO_EM28XX is not set
+# CONFIG_USB_VICAM is not set
+# CONFIG_USB_IBMCAM is not set
+# CONFIG_USB_KONICAWC is not set
+# CONFIG_USB_QUICKCAM_MESSENGER is not set
+# CONFIG_USB_ET61X251 is not set
 # CONFIG_VIDEO_OVCAMCHIP is not set
-# CONFIG_VIDEO_AUDIO_DECODER is not set
-# CONFIG_VIDEO_DECODER is not set
+# CONFIG_USB_W9968CF is not set
+# CONFIG_USB_OV511 is not set
+# CONFIG_USB_SE401 is not set
+# CONFIG_USB_SN9C102 is not set
+# CONFIG_USB_STV680 is not set
+# CONFIG_USB_ZC0301 is not set
+# CONFIG_USB_PWC is not set
 
 #
 # Radio Adapters
@@ -826,20 +877,24 @@ CONFIG_VIDEO_DEV=y
 # CONFIG_RADIO_GEMTEK_PCI is not set
 # CONFIG_RADIO_MAXIRADIO is not set
 # CONFIG_RADIO_MAESTRO is not set
+# CONFIG_USB_DSBR is not set
 
 #
 # Digital Video Broadcasting Devices
 #
 # CONFIG_DVB is not set
+# CONFIG_USB_DABUSB is not set
 
 #
 # Graphics support
 #
+CONFIG_FIRMWARE_EDID=y
 CONFIG_FB=y
 CONFIG_FB_CFB_FILLRECT=y
 CONFIG_FB_CFB_COPYAREA=y
 CONFIG_FB_CFB_IMAGEBLIT=y
 # CONFIG_FB_MACMODES is not set
+# CONFIG_FB_BACKLIGHT is not set
 CONFIG_FB_MODE_HELPERS=y
 # CONFIG_FB_TILEBLITTING is not set
 # CONFIG_FB_CIRRUS is not set
@@ -851,7 +906,6 @@ CONFIG_FB_MODE_HELPERS=y
 # CONFIG_FB_NVIDIA is not set
 # CONFIG_FB_RIVA is not set
 # CONFIG_FB_MATROX is not set
-# CONFIG_FB_RADEON_OLD is not set
 CONFIG_FB_RADEON=y
 CONFIG_FB_RADEON_I2C=y
 CONFIG_FB_RADEON_DEBUG=y
@@ -870,6 +924,7 @@ CONFIG_FB_RADEON_DEBUG=y
 # Console display driver support
 #
 CONFIG_VGA_CONSOLE=y
+# CONFIG_VGACON_SOFT_SCROLLBACK is not set
 CONFIG_DUMMY_CONSOLE=y
 # CONFIG_FRAMEBUFFER_CONSOLE is not set
 
@@ -900,9 +955,11 @@ CONFIG_SND_OSSEMUL=y
 CONFIG_SND_OSSEMUL=y
 CONFIG_SND_MIXER_OSS=y
 CONFIG_SND_PCM_OSS=y
+CONFIG_SND_PCM_OSS_PLUGINS=y
 CONFIG_SND_SEQUENCER_OSS=y
 # CONFIG_SND_DYNAMIC_MINORS is not set
 CONFIG_SND_SUPPORT_OLD_API=y
+CONFIG_SND_VERBOSE_PROCFS=y
 # CONFIG_SND_VERBOSE_PRINTK is not set
 # CONFIG_SND_DEBUG is not set
 
@@ -923,6 +980,7 @@ CONFIG_SND_AC97_BUS=y
 # PCI devices
 #
 # CONFIG_SND_AD1889 is not set
+# CONFIG_SND_ALS300 is not set
 # CONFIG_SND_ALI5451 is not set
 # CONFIG_SND_ATIIXP is not set
 # CONFIG_SND_ATIIXP_MODEM is not set
@@ -980,6 +1038,7 @@ CONFIG_SND_FM801=y
 #
 CONFIG_USB_ARCH_HAS_HCD=y
 CONFIG_USB_ARCH_HAS_OHCI=y
+CONFIG_USB_ARCH_HAS_EHCI=y
 CONFIG_USB=y
 # CONFIG_USB_DEBUG is not set
 
@@ -998,6 +1057,7 @@ CONFIG_USB_EHCI_HCD=y
 CONFIG_USB_EHCI_HCD=y
 # CONFIG_USB_EHCI_SPLIT_ISO is not set
 # CONFIG_USB_EHCI_ROOT_HUB_TT is not set
+# CONFIG_USB_EHCI_TT_NEWSCHED is not set
 # CONFIG_USB_ISP116X_HCD is not set
 CONFIG_USB_OHCI_HCD=y
 # CONFIG_USB_OHCI_BIG_ENDIAN is not set
@@ -1008,7 +1068,6 @@ CONFIG_USB_UHCI_HCD=y
 #
 # USB Device Class drivers
 #
-# CONFIG_OBSOLETE_OSS_USB_DRIVER is not set
 # CONFIG_USB_ACM is not set
 # CONFIG_USB_PRINTER is not set
 
@@ -1044,9 +1103,7 @@ CONFIG_USB_HIDDEV=y
 # CONFIG_USB_ACECAD is not set
 # CONFIG_USB_KBTAB is not set
 # CONFIG_USB_POWERMATE is not set
-# CONFIG_USB_MTOUCH is not set
-# CONFIG_USB_ITMTOUCH is not set
-# CONFIG_USB_EGALAX is not set
+# CONFIG_USB_TOUCHSCREEN is not set
 # CONFIG_USB_YEALINK is not set
 # CONFIG_USB_XPAD is not set
 # CONFIG_USB_ATI_REMOTE is not set
@@ -1059,21 +1116,6 @@ CONFIG_USB_HIDDEV=y
 #
 # CONFIG_USB_MDC800 is not set
 # CONFIG_USB_MICROTEK is not set
-
-#
-# USB Multimedia devices
-#
-# CONFIG_USB_DABUSB is not set
-# CONFIG_USB_VICAM is not set
-# CONFIG_USB_DSBR is not set
-# CONFIG_USB_ET61X251 is not set
-# CONFIG_USB_IBMCAM is not set
-# CONFIG_USB_KONICAWC is not set
-# CONFIG_USB_OV511 is not set
-# CONFIG_USB_SE401 is not set
-# CONFIG_USB_SN9C102 is not set
-# CONFIG_USB_STV680 is not set
-# CONFIG_USB_PWC is not set
 
 #
 # USB Network Adapters
@@ -1104,10 +1146,12 @@ CONFIG_USB_MON=y
 # CONFIG_USB_LEGOTOWER is not set
 # CONFIG_USB_LCD is not set
 # CONFIG_USB_LED is not set
+# CONFIG_USB_CYPRESS_CY7C63 is not set
 # CONFIG_USB_CYTHERM is not set
 # CONFIG_USB_PHIDGETKIT is not set
 # CONFIG_USB_PHIDGETSERVO is not set
 # CONFIG_USB_IDMOUSE is not set
+# CONFIG_USB_APPLEDISPLAY is not set
 # CONFIG_USB_SISUSBVGA is not set
 # CONFIG_USB_LD is not set
 
@@ -1126,12 +1170,43 @@ CONFIG_USB_MON=y
 # CONFIG_MMC is not set
 
 #
+# LED devices
+#
+# CONFIG_NEW_LEDS is not set
+
+#
+# LED drivers
+#
+
+#
+# LED Triggers
+#
+
+#
 # InfiniBand support
 #
 # CONFIG_INFINIBAND is not set
 
 #
 # EDAC - error detection and reporting (RAS) (EXPERIMENTAL)
+#
+
+#
+# Real Time Clock
+#
+# CONFIG_RTC_CLASS is not set
+
+#
+# DMA Engine support
+#
+# CONFIG_DMA_ENGINE is not set
+
+#
+# DMA Clients
+#
+
+#
+# DMA Devices
 #
 
 #
@@ -1157,6 +1232,7 @@ CONFIG_FS_MBCACHE=y
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
+CONFIG_INOTIFY_USER=y
 # CONFIG_QUOTA is not set
 CONFIG_DNOTIFY=y
 CONFIG_AUTOFS_FS=y
@@ -1191,7 +1267,6 @@ CONFIG_TMPFS=y
 CONFIG_TMPFS=y
 # CONFIG_HUGETLB_PAGE is not set
 CONFIG_RAMFS=y
-# CONFIG_RELAYFS_FS is not set
 # CONFIG_CONFIGFS_FS is not set
 
 #
@@ -1311,9 +1386,11 @@ CONFIG_NLS_UTF8=y
 # CONFIG_CRC16 is not set
 CONFIG_CRC32=y
 # CONFIG_LIBCRC32C is not set
+CONFIG_PLIST=y
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_GENERIC_IRQ_PROBE=y
 CONFIG_GENERIC_PENDING_IRQ=y
+CONFIG_IRQ_PER_CPU=y
 
 #
 # Instrumentation Support
@@ -1326,14 +1403,19 @@ CONFIG_GENERIC_PENDING_IRQ=y
 #
 # CONFIG_PRINTK_TIME is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_UNUSED_SYMBOLS=y
 CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=17
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
+# CONFIG_DEBUG_RT_MUTEXES is not set
+# CONFIG_RT_MUTEX_TESTER is not set
+# CONFIG_DEBUG_SPINLOCK is not set
 CONFIG_DEBUG_MUTEXES=y
-# CONFIG_DEBUG_SPINLOCK is not set
+# CONFIG_DEBUG_RWSEMS is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
+# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 # CONFIG_DEBUG_FS is not set
@@ -1387,7 +1469,6 @@ CONFIG_CRYPTO_DES=y
 #
 # CONFIG_XEN_UTIL is not set
 CONFIG_XEN_BALLOON=y
-# CONFIG_XEN_DEVMEM is not set
 CONFIG_XEN_REBOOT=y
 # CONFIG_XEN_SMPBOOT is not set
 CONFIG_XEN_INTERFACE_VERSION=0x00030203
@@ -1402,6 +1483,8 @@ CONFIG_XEN_XENBUS_DEV=y
 # CONFIG_XEN_BACKEND is not set
 CONFIG_XEN_BLKDEV_FRONTEND=y
 CONFIG_XEN_NETDEV_FRONTEND=y
+CONFIG_XEN_FRAMEBUFFER=y
+CONFIG_XEN_KEYBOARD=y
 # CONFIG_XEN_SCRUB_PAGES is not set
 # CONFIG_XEN_DISABLE_SERIAL is not set
 CONFIG_XEN_SYSFS=y
@@ -1410,3 +1493,4 @@ CONFIG_XEN_COMPAT_030002=y
 CONFIG_XEN_COMPAT_030002=y
 CONFIG_HAVE_IRQ_IGNORE_UNHANDLED=y
 CONFIG_NO_IDLE_HZ=y
+CONFIG_XEN_DEVMEM=y
diff -r aea80dbf6d96 -r 9af0c7e4ff51 buildconfigs/linux-defconfig_xen_ia64
--- a/buildconfigs/linux-defconfig_xen_ia64     Fri Feb 09 14:43:22 2007 -0600
+++ b/buildconfigs/linux-defconfig_xen_ia64     Wed Feb 14 19:01:35 2007 +0000
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.16.29-xen
-# Tue Nov 14 10:38:50 2006
+# Linux kernel version: 2.6.18-xen
+# Mon Jan 29 10:01:13 2007
 #
 
 #
@@ -21,14 +21,16 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_POSIX_MQUEUE=y
 CONFIG_BSD_PROCESS_ACCT=y
 # CONFIG_BSD_PROCESS_ACCT_V3 is not set
-CONFIG_SYSCTL=y
+# CONFIG_TASKSTATS is not set
 # CONFIG_AUDIT is not set
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 # CONFIG_CPUSETS is not set
+# CONFIG_RELAY is not set
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 # CONFIG_EMBEDDED is not set
+CONFIG_SYSCTL=y
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
@@ -40,11 +42,9 @@ CONFIG_FUTEX=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
 CONFIG_SHMEM=y
-CONFIG_CC_ALIGN_FUNCTIONS=0
-CONFIG_CC_ALIGN_LABELS=0
-CONFIG_CC_ALIGN_LOOPS=0
-CONFIG_CC_ALIGN_JUMPS=0
 CONFIG_SLAB=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 # CONFIG_SLOB is not set
@@ -55,7 +55,6 @@ CONFIG_MODULES=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODULE_FORCE_UNLOAD is not set
-CONFIG_OBSOLETE_MODPARM=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
 CONFIG_KMOD=y
@@ -64,6 +63,7 @@ CONFIG_STOP_MACHINE=y
 #
 # Block layer
 #
+# CONFIG_BLK_DEV_IO_TRACE is not set
 
 #
 # IO Schedulers
@@ -86,8 +86,10 @@ CONFIG_MMU=y
 CONFIG_MMU=y
 CONFIG_SWIOTLB=y
 CONFIG_RWSEM_XCHGADD_ALGORITHM=y
+CONFIG_GENERIC_FIND_NEXT_BIT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_TIME_INTERPOLATION=y
+CONFIG_DMI=y
 CONFIG_EFI=y
 CONFIG_GENERIC_IOMAP=y
 CONFIG_XEN=y
@@ -96,6 +98,7 @@ CONFIG_XEN_IA64_EXPOSE_P2M_USE_DTR=y
 CONFIG_XEN_IA64_EXPOSE_P2M_USE_DTR=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_DMA_IS_DMA32=y
+CONFIG_AUDIT_ARCH=y
 # CONFIG_IA64_GENERIC is not set
 CONFIG_IA64_DIG=y
 # CONFIG_IA64_HP_ZX1 is not set
@@ -123,6 +126,7 @@ CONFIG_HOTPLUG_CPU=y
 CONFIG_HOTPLUG_CPU=y
 CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
 # CONFIG_SCHED_SMT is not set
+# CONFIG_PERMIT_BSP_REMOVE is not set
 # CONFIG_PREEMPT is not set
 CONFIG_SELECT_MEMORY_MODEL=y
 CONFIG_FLATMEM_MANUAL=y
@@ -132,6 +136,7 @@ CONFIG_FLAT_NODE_MEM_MAP=y
 CONFIG_FLAT_NODE_MEM_MAP=y
 # CONFIG_SPARSEMEM_STATIC is not set
 CONFIG_SPLIT_PTLOCK_CPUS=4
+CONFIG_RESOURCES_64BIT=y
 CONFIG_ARCH_SELECT_MEMORY_MODEL=y
 CONFIG_ARCH_DISCONTIGMEM_ENABLE=y
 CONFIG_ARCH_FLATMEM_ENABLE=y
@@ -163,6 +168,7 @@ CONFIG_ACPI=y
 CONFIG_ACPI=y
 CONFIG_ACPI_BUTTON=y
 CONFIG_ACPI_FAN=y
+# CONFIG_ACPI_DOCK is not set
 CONFIG_ACPI_PROCESSOR=y
 CONFIG_ACPI_HOTPLUG_CPU=y
 CONFIG_ACPI_THERMAL=y
@@ -185,7 +191,7 @@ CONFIG_PCI_DOMAINS=y
 CONFIG_PCI_DOMAINS=y
 CONFIG_XEN_PCIDEV_FRONTEND=y
 # CONFIG_XEN_PCIDEV_FE_DEBUG is not set
-CONFIG_PCI_LEGACY_PROC=y
+# CONFIG_PCIEPORTBUS is not set
 # CONFIG_PCI_DEBUG is not set
 
 #
@@ -215,6 +221,8 @@ CONFIG_PACKET=y
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
+CONFIG_XFRM=y
+# CONFIG_XFRM_USER is not set
 # CONFIG_NET_KEY is not set
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
@@ -229,7 +237,10 @@ CONFIG_SYN_COOKIES=y
 # CONFIG_INET_AH is not set
 # CONFIG_INET_ESP is not set
 # CONFIG_INET_IPCOMP is not set
+# CONFIG_INET_XFRM_TUNNEL is not set
 # CONFIG_INET_TUNNEL is not set
+CONFIG_INET_XFRM_MODE_TRANSPORT=y
+CONFIG_INET_XFRM_MODE_TUNNEL=y
 CONFIG_INET_DIAG=y
 CONFIG_INET_TCP_DIAG=y
 # CONFIG_TCP_CONG_ADVANCED is not set
@@ -240,6 +251,9 @@ CONFIG_TCP_CONG_BIC=y
 #
 # CONFIG_IP_VS is not set
 # CONFIG_IPV6 is not set
+# CONFIG_INET6_XFRM_TUNNEL is not set
+# CONFIG_INET6_TUNNEL is not set
+# CONFIG_NETWORK_SECMARK is not set
 CONFIG_NETFILTER=y
 # CONFIG_NETFILTER_DEBUG is not set
 CONFIG_BRIDGE_NETFILTER=y
@@ -280,12 +294,12 @@ CONFIG_BRIDGE=y
 CONFIG_BRIDGE=y
 # CONFIG_VLAN_8021Q is not set
 # CONFIG_DECNET is not set
+CONFIG_LLC=y
 # CONFIG_LLC2 is not set
 # CONFIG_IPX is not set
 # CONFIG_ATALK is not set
 # CONFIG_X25 is not set
 # CONFIG_LAPB is not set
-# CONFIG_NET_DIVERT is not set
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
 
@@ -314,6 +328,7 @@ CONFIG_PREVENT_FIRMWARE_BUILD=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
 CONFIG_FW_LOADER=y
 # CONFIG_DEBUG_DRIVER is not set
+# CONFIG_SYS_HYPERVISOR is not set
 
 #
 # Connector - unified userspace <-> kernelspace linker
@@ -352,6 +367,7 @@ CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=4096
+CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
@@ -463,6 +479,7 @@ CONFIG_SCSI_SAS_ATTRS=y
 # CONFIG_MEGARAID_LEGACY is not set
 # CONFIG_MEGARAID_SAS is not set
 # CONFIG_SCSI_SATA is not set
+# CONFIG_SCSI_HPTIOP is not set
 # CONFIG_SCSI_DMX3191D is not set
 # CONFIG_SCSI_FUTURE_DOMAIN is not set
 # CONFIG_SCSI_IPS is not set
@@ -472,10 +489,8 @@ CONFIG_SCSI_SYM53C8XX_DMA_ADDRESSING_MOD
 CONFIG_SCSI_SYM53C8XX_DMA_ADDRESSING_MODE=1
 CONFIG_SCSI_SYM53C8XX_DEFAULT_TAGS=16
 CONFIG_SCSI_SYM53C8XX_MAX_TAGS=64
-# CONFIG_SCSI_SYM53C8XX_IOMAPPED is not set
+CONFIG_SCSI_SYM53C8XX_MMIO=y
 # CONFIG_SCSI_IPR is not set
-CONFIG_SCSI_QLOGIC_FC=y
-# CONFIG_SCSI_QLOGIC_FC_FIRMWARE is not set
 CONFIG_SCSI_QLOGIC_1280=y
 # CONFIG_SCSI_QLA_FC is not set
 # CONFIG_SCSI_LPFC is not set
@@ -613,6 +628,7 @@ CONFIG_TIGON3=y
 # CONFIG_CHELSIO_T1 is not set
 # CONFIG_IXGB is not set
 # CONFIG_S2IO is not set
+# CONFIG_MYRI10GE is not set
 
 #
 # Token Ring devices
@@ -715,6 +731,7 @@ CONFIG_VT=y
 CONFIG_VT=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
+# CONFIG_VT_HW_CONSOLE_BINDING is not set
 CONFIG_SERIAL_NONSTANDARD=y
 # CONFIG_COMPUTONE is not set
 # CONFIG_ROCKETPORT is not set
@@ -728,6 +745,7 @@ CONFIG_SERIAL_NONSTANDARD=y
 # CONFIG_N_HDLC is not set
 # CONFIG_SPECIALIX is not set
 # CONFIG_SX is not set
+# CONFIG_RIO is not set
 # CONFIG_STALDRV is not set
 
 #
@@ -761,6 +779,8 @@ CONFIG_EFI_RTC=y
 # Ftape, the floppy tape device driver
 #
 CONFIG_AGP=y
+# CONFIG_AGP_SIS is not set
+# CONFIG_AGP_VIA is not set
 CONFIG_AGP_I460=y
 CONFIG_DRM=y
 # CONFIG_DRM_TDFX is not set
@@ -805,10 +825,10 @@ CONFIG_I2C_ALGOPCF=y
 # CONFIG_I2C_I810 is not set
 # CONFIG_I2C_PIIX4 is not set
 # CONFIG_I2C_NFORCE2 is not set
+# CONFIG_I2C_OCORES is not set
 # CONFIG_I2C_PARPORT_LIGHT is not set
 # CONFIG_I2C_PROSAVAGE is not set
 # CONFIG_I2C_SAVAGE4 is not set
-# CONFIG_SCx200_ACB is not set
 # CONFIG_I2C_SIS5595 is not set
 # CONFIG_I2C_SIS630 is not set
 # CONFIG_I2C_SIS96X is not set
@@ -827,9 +847,7 @@ CONFIG_I2C_ALGOPCF=y
 # CONFIG_SENSORS_PCF8574 is not set
 # CONFIG_SENSORS_PCA9539 is not set
 # CONFIG_SENSORS_PCF8591 is not set
-# CONFIG_SENSORS_RTC8564 is not set
 # CONFIG_SENSORS_MAX6875 is not set
-# CONFIG_RTC_X1205_I2C is not set
 # CONFIG_I2C_DEBUG_CORE is not set
 # CONFIG_I2C_DEBUG_ALGO is not set
 # CONFIG_I2C_DEBUG_BUS is not set
@@ -844,13 +862,13 @@ CONFIG_I2C_ALGOPCF=y
 #
 # Dallas's 1-wire bus
 #
-# CONFIG_W1 is not set
 
 #
 # Hardware Monitoring support
 #
 CONFIG_HWMON=y
 # CONFIG_HWMON_VID is not set
+# CONFIG_SENSORS_ABITUGURU is not set
 # CONFIG_SENSORS_ADM1021 is not set
 # CONFIG_SENSORS_ADM1025 is not set
 # CONFIG_SENSORS_ADM1026 is not set
@@ -879,10 +897,12 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_PC87360 is not set
 # CONFIG_SENSORS_SIS5595 is not set
 # CONFIG_SENSORS_SMSC47M1 is not set
+# CONFIG_SENSORS_SMSC47M192 is not set
 # CONFIG_SENSORS_SMSC47B397 is not set
 # CONFIG_SENSORS_VIA686A is not set
 # CONFIG_SENSORS_VT8231 is not set
 # CONFIG_SENSORS_W83781D is not set
+# CONFIG_SENSORS_W83791D is not set
 # CONFIG_SENSORS_W83792D is not set
 # CONFIG_SENSORS_W83L785TS is not set
 # CONFIG_SENSORS_W83627HF is not set
@@ -894,24 +914,25 @@ CONFIG_HWMON=y
 #
 
 #
-# Multimedia Capabilities Port drivers
-#
-
-#
 # Multimedia devices
 #
 CONFIG_VIDEO_DEV=y
-
-#
-# Video For Linux
-#
-
-#
-# Video Adapters
+CONFIG_VIDEO_V4L1=y
+CONFIG_VIDEO_V4L1_COMPAT=y
+CONFIG_VIDEO_V4L2=y
+
+#
+# Video Capture Adapters
+#
+
+#
+# Video Capture Adapters
 #
 # CONFIG_VIDEO_ADV_DEBUG is not set
+# CONFIG_VIDEO_VIVI is not set
 # CONFIG_VIDEO_BT848 is not set
 # CONFIG_VIDEO_CPIA is not set
+# CONFIG_VIDEO_CPIA2 is not set
 # CONFIG_VIDEO_SAA5246A is not set
 # CONFIG_VIDEO_SAA5249 is not set
 # CONFIG_TUNER_3036 is not set
@@ -923,10 +944,40 @@ CONFIG_VIDEO_DEV=y
 # CONFIG_VIDEO_HEXIUM_ORION is not set
 # CONFIG_VIDEO_HEXIUM_GEMINI is not set
 # CONFIG_VIDEO_CX88 is not set
+
+#
+# Encoders and Decoders
+#
+# CONFIG_VIDEO_MSP3400 is not set
+# CONFIG_VIDEO_CS53L32A is not set
+# CONFIG_VIDEO_TLV320AIC23B is not set
+# CONFIG_VIDEO_WM8775 is not set
+# CONFIG_VIDEO_WM8739 is not set
+# CONFIG_VIDEO_CX2341X is not set
+# CONFIG_VIDEO_CX25840 is not set
+# CONFIG_VIDEO_SAA711X is not set
+# CONFIG_VIDEO_SAA7127 is not set
+# CONFIG_VIDEO_UPD64031A is not set
+# CONFIG_VIDEO_UPD64083 is not set
+
+#
+# V4L USB devices
+#
+# CONFIG_VIDEO_PVRUSB2 is not set
 # CONFIG_VIDEO_EM28XX is not set
+# CONFIG_USB_VICAM is not set
+# CONFIG_USB_IBMCAM is not set
+# CONFIG_USB_KONICAWC is not set
+# CONFIG_USB_QUICKCAM_MESSENGER is not set
+# CONFIG_USB_ET61X251 is not set
 # CONFIG_VIDEO_OVCAMCHIP is not set
-# CONFIG_VIDEO_AUDIO_DECODER is not set
-# CONFIG_VIDEO_DECODER is not set
+# CONFIG_USB_W9968CF is not set
+# CONFIG_USB_OV511 is not set
+# CONFIG_USB_SE401 is not set
+# CONFIG_USB_SN9C102 is not set
+# CONFIG_USB_STV680 is not set
+# CONFIG_USB_ZC0301 is not set
+# CONFIG_USB_PWC is not set
 
 #
 # Radio Adapters
@@ -934,20 +985,24 @@ CONFIG_VIDEO_DEV=y
 # CONFIG_RADIO_GEMTEK_PCI is not set
 # CONFIG_RADIO_MAXIRADIO is not set
 # CONFIG_RADIO_MAESTRO is not set
+# CONFIG_USB_DSBR is not set
 
 #
 # Digital Video Broadcasting Devices
 #
 # CONFIG_DVB is not set
+# CONFIG_USB_DABUSB is not set
 
 #
 # Graphics support
 #
+CONFIG_FIRMWARE_EDID=y
 CONFIG_FB=y
 CONFIG_FB_CFB_FILLRECT=y
 CONFIG_FB_CFB_COPYAREA=y
 CONFIG_FB_CFB_IMAGEBLIT=y
 # CONFIG_FB_MACMODES is not set
+# CONFIG_FB_BACKLIGHT is not set
 CONFIG_FB_MODE_HELPERS=y
 # CONFIG_FB_TILEBLITTING is not set
 # CONFIG_FB_CIRRUS is not set
@@ -959,7 +1014,6 @@ CONFIG_FB_MODE_HELPERS=y
 # CONFIG_FB_NVIDIA is not set
 # CONFIG_FB_RIVA is not set
 # CONFIG_FB_MATROX is not set
-# CONFIG_FB_RADEON_OLD is not set
 CONFIG_FB_RADEON=y
 CONFIG_FB_RADEON_I2C=y
 CONFIG_FB_RADEON_DEBUG=y
@@ -978,6 +1032,7 @@ CONFIG_FB_RADEON_DEBUG=y
 # Console display driver support
 #
 CONFIG_VGA_CONSOLE=y
+# CONFIG_VGACON_SOFT_SCROLLBACK is not set
 CONFIG_DUMMY_CONSOLE=y
 # CONFIG_FRAMEBUFFER_CONSOLE is not set
 
@@ -1008,9 +1063,11 @@ CONFIG_SND_OSSEMUL=y
 CONFIG_SND_OSSEMUL=y
 CONFIG_SND_MIXER_OSS=y
 CONFIG_SND_PCM_OSS=y
+CONFIG_SND_PCM_OSS_PLUGINS=y
 CONFIG_SND_SEQUENCER_OSS=y
 # CONFIG_SND_DYNAMIC_MINORS is not set
 CONFIG_SND_SUPPORT_OLD_API=y
+CONFIG_SND_VERBOSE_PROCFS=y
 # CONFIG_SND_VERBOSE_PRINTK is not set
 # CONFIG_SND_DEBUG is not set
 
@@ -1031,6 +1088,7 @@ CONFIG_SND_MPU401=y
 # PCI devices
 #
 # CONFIG_SND_AD1889 is not set
+# CONFIG_SND_ALS300 is not set
 # CONFIG_SND_ALI5451 is not set
 CONFIG_SND_ATIIXP=y
 # CONFIG_SND_ATIIXP_MODEM is not set
@@ -1043,6 +1101,18 @@ CONFIG_SND_ATIIXP=y
 # CONFIG_SND_CMIPCI is not set
 # CONFIG_SND_CS4281 is not set
 # CONFIG_SND_CS46XX is not set
+# CONFIG_SND_DARLA20 is not set
+# CONFIG_SND_GINA20 is not set
+# CONFIG_SND_LAYLA20 is not set
+# CONFIG_SND_DARLA24 is not set
+# CONFIG_SND_GINA24 is not set
+# CONFIG_SND_LAYLA24 is not set
+# CONFIG_SND_MONA is not set
+# CONFIG_SND_MIA is not set
+# CONFIG_SND_ECHO3G is not set
+# CONFIG_SND_INDIGO is not set
+# CONFIG_SND_INDIGOIO is not set
+# CONFIG_SND_INDIGODJ is not set
 # CONFIG_SND_EMU10K1 is not set
 # CONFIG_SND_EMU10K1X is not set
 # CONFIG_SND_ENS1370 is not set
@@ -1063,6 +1133,7 @@ CONFIG_SND_FM801=y
 # CONFIG_SND_MIXART is not set
 # CONFIG_SND_NM256 is not set
 # CONFIG_SND_PCXHR is not set
+# CONFIG_SND_RIPTIDE is not set
 # CONFIG_SND_RME32 is not set
 # CONFIG_SND_RME96 is not set
 # CONFIG_SND_RME9652 is not set
@@ -1082,12 +1153,14 @@ CONFIG_SND_FM801=y
 # Open Sound System
 #
 CONFIG_SOUND_PRIME=y
-# CONFIG_OBSOLETE_OSS_DRIVER is not set
-# CONFIG_SOUND_FUSION is not set
+# CONFIG_OSS_OBSOLETE_DRIVER is not set
+# CONFIG_SOUND_BT878 is not set
+# CONFIG_SOUND_ES1371 is not set
 # CONFIG_SOUND_ICH is not set
 # CONFIG_SOUND_TRIDENT is not set
 # CONFIG_SOUND_MSNDCLAS is not set
 # CONFIG_SOUND_MSNDPIN is not set
+# CONFIG_SOUND_VIA82CXXX is not set
 # CONFIG_SOUND_TVMIXER is not set
 
 #
@@ -1095,6 +1168,7 @@ CONFIG_SOUND_PRIME=y
 #
 CONFIG_USB_ARCH_HAS_HCD=y
 CONFIG_USB_ARCH_HAS_OHCI=y
+CONFIG_USB_ARCH_HAS_EHCI=y
 CONFIG_USB=y
 # CONFIG_USB_DEBUG is not set
 
@@ -1113,6 +1187,7 @@ CONFIG_USB_EHCI_HCD=y
 CONFIG_USB_EHCI_HCD=y
 # CONFIG_USB_EHCI_SPLIT_ISO is not set
 # CONFIG_USB_EHCI_ROOT_HUB_TT is not set
+# CONFIG_USB_EHCI_TT_NEWSCHED is not set
 # CONFIG_USB_ISP116X_HCD is not set
 CONFIG_USB_OHCI_HCD=y
 # CONFIG_USB_OHCI_BIG_ENDIAN is not set
@@ -1123,7 +1198,6 @@ CONFIG_USB_UHCI_HCD=y
 #
 # USB Device Class drivers
 #
-# CONFIG_OBSOLETE_OSS_USB_DRIVER is not set
 # CONFIG_USB_ACM is not set
 # CONFIG_USB_PRINTER is not set
 
@@ -1160,9 +1234,7 @@ CONFIG_USB_HIDDEV=y
 # CONFIG_USB_ACECAD is not set
 # CONFIG_USB_KBTAB is not set
 # CONFIG_USB_POWERMATE is not set
-# CONFIG_USB_MTOUCH is not set
-# CONFIG_USB_ITMTOUCH is not set
-# CONFIG_USB_EGALAX is not set
+# CONFIG_USB_TOUCHSCREEN is not set
 # CONFIG_USB_YEALINK is not set
 # CONFIG_USB_XPAD is not set
 # CONFIG_USB_ATI_REMOTE is not set
@@ -1175,21 +1247,6 @@ CONFIG_USB_HIDDEV=y
 #
 # CONFIG_USB_MDC800 is not set
 # CONFIG_USB_MICROTEK is not set
-
-#
-# USB Multimedia devices
-#
-# CONFIG_USB_DABUSB is not set
-# CONFIG_USB_VICAM is not set
-# CONFIG_USB_DSBR is not set
-# CONFIG_USB_ET61X251 is not set
-# CONFIG_USB_IBMCAM is not set
-# CONFIG_USB_KONICAWC is not set
-# CONFIG_USB_OV511 is not set
-# CONFIG_USB_SE401 is not set
-# CONFIG_USB_SN9C102 is not set
-# CONFIG_USB_STV680 is not set
-# CONFIG_USB_PWC is not set
 
 #
 # USB Network Adapters
@@ -1220,10 +1277,12 @@ CONFIG_USB_MON=y
 # CONFIG_USB_LEGOTOWER is not set
 # CONFIG_USB_LCD is not set
 # CONFIG_USB_LED is not set
+# CONFIG_USB_CYPRESS_CY7C63 is not set
 # CONFIG_USB_CYTHERM is not set
 # CONFIG_USB_PHIDGETKIT is not set
 # CONFIG_USB_PHIDGETSERVO is not set
 # CONFIG_USB_IDMOUSE is not set
+# CONFIG_USB_APPLEDISPLAY is not set
 # CONFIG_USB_SISUSBVGA is not set
 # CONFIG_USB_LD is not set
 # CONFIG_USB_TEST is not set
@@ -1243,12 +1302,43 @@ CONFIG_USB_MON=y
 # CONFIG_MMC is not set
 
 #
+# LED devices
+#
+# CONFIG_NEW_LEDS is not set
+
+#
+# LED drivers
+#
+
+#
+# LED Triggers
+#
+
+#
 # InfiniBand support
 #
 # CONFIG_INFINIBAND is not set
 
 #
 # EDAC - error detection and reporting (RAS) (EXPERIMENTAL)
+#
+
+#
+# Real Time Clock
+#
+# CONFIG_RTC_CLASS is not set
+
+#
+# DMA Engine support
+#
+# CONFIG_DMA_ENGINE is not set
+
+#
+# DMA Clients
+#
+
+#
+# DMA Devices
 #
 
 #
@@ -1275,7 +1365,6 @@ CONFIG_REISERFS_FS_SECURITY=y
 # CONFIG_JFS_FS is not set
 CONFIG_FS_POSIX_ACL=y
 CONFIG_XFS_FS=y
-CONFIG_XFS_EXPORT=y
 # CONFIG_XFS_QUOTA is not set
 # CONFIG_XFS_SECURITY is not set
 # CONFIG_XFS_POSIX_ACL is not set
@@ -1284,6 +1373,7 @@ CONFIG_XFS_EXPORT=y
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
+CONFIG_INOTIFY_USER=y
 # CONFIG_QUOTA is not set
 CONFIG_DNOTIFY=y
 CONFIG_AUTOFS_FS=y
@@ -1318,7 +1408,6 @@ CONFIG_TMPFS=y
 CONFIG_TMPFS=y
 # CONFIG_HUGETLB_PAGE is not set
 CONFIG_RAMFS=y
-# CONFIG_RELAYFS_FS is not set
 # CONFIG_CONFIGFS_FS is not set
 
 #
@@ -1364,7 +1453,9 @@ CONFIG_SMB_NLS_REMOTE="cp437"
 CONFIG_SMB_NLS_REMOTE="cp437"
 CONFIG_CIFS=y
 # CONFIG_CIFS_STATS is not set
+# CONFIG_CIFS_WEAK_PW_HASH is not set
 # CONFIG_CIFS_XATTR is not set
+# CONFIG_CIFS_DEBUG2 is not set
 # CONFIG_CIFS_EXPERIMENTAL is not set
 # CONFIG_NCP_FS is not set
 # CONFIG_CODA_FS is not set
@@ -1443,9 +1534,11 @@ CONFIG_NLS_UTF8=y
 # CONFIG_CRC16 is not set
 CONFIG_CRC32=y
 # CONFIG_LIBCRC32C is not set
+CONFIG_PLIST=y
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_GENERIC_IRQ_PROBE=y
 CONFIG_GENERIC_PENDING_IRQ=y
+CONFIG_IRQ_PER_CPU=y
 
 #
 # Instrumentation Support
@@ -1458,14 +1551,19 @@ CONFIG_GENERIC_PENDING_IRQ=y
 #
 # CONFIG_PRINTK_TIME is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_UNUSED_SYMBOLS=y
 CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=20
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
+# CONFIG_DEBUG_RT_MUTEXES is not set
+# CONFIG_RT_MUTEX_TESTER is not set
+# CONFIG_DEBUG_SPINLOCK is not set
 CONFIG_DEBUG_MUTEXES=y
-# CONFIG_DEBUG_SPINLOCK is not set
+# CONFIG_DEBUG_RWSEMS is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
+# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 # CONFIG_DEBUG_FS is not set
@@ -1519,7 +1617,6 @@ CONFIG_CRYPTO_DES=y
 #
 # CONFIG_XEN_UTIL is not set
 CONFIG_XEN_BALLOON=y
-# CONFIG_XEN_DEVMEM is not set
 CONFIG_XEN_REBOOT=y
 # CONFIG_XEN_SMPBOOT is not set
 CONFIG_XEN_INTERFACE_VERSION=0x00030203
@@ -1555,3 +1652,4 @@ CONFIG_XEN_COMPAT_030002=y
 CONFIG_XEN_COMPAT_030002=y
 CONFIG_HAVE_IRQ_IGNORE_UNHANDLED=y
 CONFIG_NO_IDLE_HZ=y
+CONFIG_XEN_DEVMEM=y
diff -r aea80dbf6d96 -r 9af0c7e4ff51 extras/mini-os/gnttab.c
--- a/extras/mini-os/gnttab.c   Fri Feb 09 14:43:22 2007 -0600
+++ b/extras/mini-os/gnttab.c   Wed Feb 14 19:01:35 2007 +0000
@@ -21,7 +21,12 @@
 
 #define NR_RESERVED_ENTRIES 8
 
+/* NR_GRANT_FRAMES must be less than or equal to that configured in Xen */
+#ifdef __ia64__
+#define NR_GRANT_FRAMES 1
+#else
 #define NR_GRANT_FRAMES 4
+#endif
 #define NR_GRANT_ENTRIES (NR_GRANT_FRAMES * PAGE_SIZE / sizeof(grant_entry_t))
 
 static grant_entry_t *gnttab_table;
diff -r aea80dbf6d96 -r 9af0c7e4ff51 extras/mini-os/netfront.c
--- a/extras/mini-os/netfront.c Fri Feb 09 14:43:22 2007 -0600
+++ b/extras/mini-os/netfront.c Wed Feb 14 19:01:35 2007 +0000
@@ -349,7 +349,9 @@ done:
     init_rx_buffers();
 
     unsigned char rawmac[6];
-    sscanf(mac,"%x:%x:%x:%x:%x:%x",
+        /* Special conversion specifier 'hh' needed for __ia64__. Without
+           this mini-os panics with 'Unaligned reference'. */
+    sscanf(mac,"%hhx:%hhx:%hhx:%hhx:%hhx:%hhx",
             &rawmac[0],
             &rawmac[1],
             &rawmac[2],
diff -r aea80dbf6d96 -r 9af0c7e4ff51 
linux-2.6-xen-sparse/arch/i386/kernel/entry-xen.S
--- a/linux-2.6-xen-sparse/arch/i386/kernel/entry-xen.S Fri Feb 09 14:43:22 
2007 -0600
+++ b/linux-2.6-xen-sparse/arch/i386/kernel/entry-xen.S Wed Feb 14 19:01:35 
2007 +0000
@@ -747,7 +747,7 @@ ENTRY(hypervisor_callback)
        jb   11f
        cmpl $sysexit_ecrit,%eax
        ja   11f
-       addl $0x34,%esp                 # Remove cs...ebx from stack frame.
+       addl $OLDESP,%esp               # Remove eflags...ebx from stack frame.
 11:    push %esp
        call evtchn_do_upcall
        add  $4,%esp
@@ -777,18 +777,13 @@ ecrit:  /**** END OF CRITICAL REGION ***
 # provides the number of bytes which have already been popped from the
 # interrupted stack frame.
 critical_region_fixup:
-       addl $critical_fixup_table-scrit,%eax
-       movzbl (%eax),%eax              # %eax contains num bytes popped
-       cmpb $0xff,%al                  # 0xff => vcpu_info critical region
+       movzbl critical_fixup_table-scrit(%eax),%ecx # %eax contains num bytes 
popped
+       cmpb $0xff,%cl                  # 0xff => vcpu_info critical region
        jne  15f
-       GET_THREAD_INFO(%ebp)
-        xorl %eax,%eax
-15:    mov  %esp,%esi
-       add  %eax,%esi                  # %esi points at end of src region
-       mov  %esp,%edi
-       add  $0x34,%edi                 # %edi points at end of dst region
-       mov  %eax,%ecx
-       shr  $2,%ecx                    # convert words to bytes
+       xorl %ecx,%ecx
+15:    leal (%esp,%ecx),%esi           # %esi points at end of src region
+       leal OLDESP(%esp),%edi          # %edi points at end of dst region
+       shrl $2,%ecx                    # convert words to bytes
        je   17f                        # skip loop if nothing to copy
 16:    subl $4,%esi                    # pre-decrementing copy loop
        subl $4,%edi
@@ -798,6 +793,7 @@ 17: movl %edi,%esp                  # final %edi is top
 17:    movl %edi,%esp                  # final %edi is top of merged stack
        jmp  11b
 
+.section .rodata,"a"
 critical_fixup_table:
        .byte 0xff,0xff,0xff            # testb $0xff,(%esi) = __TEST_PENDING
        .byte 0xff,0xff                 # jnz  14f
@@ -814,6 +810,7 @@ critical_fixup_table:
        .byte 0x28                      # iret
        .byte 0xff,0xff,0xff,0xff       # movb $1,1(%esi)
        .byte 0x00,0x00                 # jmp  11b
+.previous
 
 # Hypervisor uses this for application faults while it executes.
 # We get here for two reasons:
@@ -1194,6 +1191,7 @@ ENTRY(fixup_4gb_segment)
        jmp error_code
 
 .section .rodata,"a"
+.align 4
 #include "syscall_table.S"
 
 syscall_table_size=(.-sys_call_table)
diff -r aea80dbf6d96 -r 9af0c7e4ff51 
linux-2.6-xen-sparse/arch/ia64/kernel/irq_ia64.c
--- a/linux-2.6-xen-sparse/arch/ia64/kernel/irq_ia64.c  Fri Feb 09 14:43:22 
2007 -0600
+++ b/linux-2.6-xen-sparse/arch/ia64/kernel/irq_ia64.c  Wed Feb 14 19:01:35 
2007 +0000
@@ -319,81 +319,85 @@ static struct irqaction resched_irqactio
  * required.
  */
 static void
-xen_register_percpu_irq (unsigned int irq, struct irqaction *action, int save)
+xen_register_percpu_irq (unsigned int vec, struct irqaction *action, int save)
 {
        unsigned int cpu = smp_processor_id();
-       int ret = 0;
+       irq_desc_t *desc;
+       int irq = 0;
 
        if (xen_slab_ready) {
-               switch (irq) {
+               switch (vec) {
                case IA64_TIMER_VECTOR:
                        sprintf(timer_name[cpu], "%s%d", action->name, cpu);
-                       ret = bind_virq_to_irqhandler(VIRQ_ITC, cpu,
+                       irq = bind_virq_to_irqhandler(VIRQ_ITC, cpu,
                                action->handler, action->flags,
                                timer_name[cpu], action->dev_id);
-                       per_cpu(timer_irq,cpu) = ret;
-                       printk(KERN_INFO "register VIRQ_ITC (%s) to xen irq 
(%d)\n", timer_name[cpu], ret);
+                       per_cpu(timer_irq,cpu) = irq;
                        break;
                case IA64_IPI_RESCHEDULE:
                        sprintf(resched_name[cpu], "%s%d", action->name, cpu);
-                       ret = bind_ipi_to_irqhandler(RESCHEDULE_VECTOR, cpu,
+                       irq = bind_ipi_to_irqhandler(RESCHEDULE_VECTOR, cpu,
                                action->handler, action->flags,
                                resched_name[cpu], action->dev_id);
-                       per_cpu(resched_irq,cpu) = ret;
-                       printk(KERN_INFO "register RESCHEDULE_VECTOR (%s) to 
xen irq (%d)\n", resched_name[cpu], ret);
+                       per_cpu(resched_irq,cpu) = irq;
                        break;
                case IA64_IPI_VECTOR:
                        sprintf(ipi_name[cpu], "%s%d", action->name, cpu);
-                       ret = bind_ipi_to_irqhandler(IPI_VECTOR, cpu,
+                       irq = bind_ipi_to_irqhandler(IPI_VECTOR, cpu,
                                action->handler, action->flags,
                                ipi_name[cpu], action->dev_id);
-                       per_cpu(ipi_irq,cpu) = ret;
-                       printk(KERN_INFO "register IPI_VECTOR (%s) to xen irq 
(%d)\n", ipi_name[cpu], ret);
-                       break;
-               case IA64_SPURIOUS_INT_VECTOR:
+                       per_cpu(ipi_irq,cpu) = irq;
                        break;
                case IA64_CMC_VECTOR:
                        sprintf(cmc_name[cpu], "%s%d", action->name, cpu);
-                       ret = bind_virq_to_irqhandler(VIRQ_MCA_CMC, cpu,
+                       irq = bind_virq_to_irqhandler(VIRQ_MCA_CMC, cpu,
                                                      action->handler,
                                                      action->flags,
                                                      cmc_name[cpu],
                                                      action->dev_id);
-                       per_cpu(cmc_irq,cpu) = ret;
-                       printk(KERN_INFO "register VIRQ_MCA_CMC (%s) to xen "
-                              "irq (%d)\n", cmc_name[cpu], ret);
+                       per_cpu(cmc_irq,cpu) = irq;
                        break;
                case IA64_CMCP_VECTOR:
                        sprintf(cmcp_name[cpu], "%s%d", action->name, cpu);
-                       ret = bind_ipi_to_irqhandler(CMCP_VECTOR, cpu,
+                       irq = bind_ipi_to_irqhandler(CMCP_VECTOR, cpu,
                                                     action->handler,
                                                     action->flags,
                                                     cmcp_name[cpu],
                                                     action->dev_id);
-                       per_cpu(cmcp_irq,cpu) = ret;
-                       printk(KERN_INFO "register CMCP_VECTOR (%s) to xen "
-                              "irq (%d)\n", cmcp_name[cpu], ret);
+                       per_cpu(cmcp_irq,cpu) = irq;
                        break;
                case IA64_CPEP_VECTOR:
                        sprintf(cpep_name[cpu], "%s%d", action->name, cpu);
-                       ret = bind_ipi_to_irqhandler(CPEP_VECTOR, cpu,
+                       irq = bind_ipi_to_irqhandler(CPEP_VECTOR, cpu,
                                                     action->handler,
                                                     action->flags,
                                                     cpep_name[cpu],
                                                     action->dev_id);
-                       per_cpu(cpep_irq,cpu) = ret;
-                       printk(KERN_INFO "register CPEP_VECTOR (%s) to xen "
-                              "irq (%d)\n", cpep_name[cpu], ret);
+                       per_cpu(cpep_irq,cpu) = irq;
                        break;
                case IA64_CPE_VECTOR:
-                       printk(KERN_WARNING "register IA64_CPE_VECTOR "
-                              "IGNORED\n");
+               case IA64_MCA_RENDEZ_VECTOR:
+               case IA64_PERFMON_VECTOR:
+               case IA64_MCA_WAKEUP_VECTOR:
+               case IA64_SPURIOUS_INT_VECTOR:
+                       /* No need to complain, these aren't supported. */
                        break;
                default:
-                       printk(KERN_WARNING "Percpu irq %d is unsupported by 
xen!\n", irq);
-                       break;
-               }
-               BUG_ON(ret < 0);
+                       printk(KERN_WARNING "Percpu irq %d is unsupported "
+                              "by xen!\n", vec);
+                       break;
+               }
+               BUG_ON(irq < 0);
+
+               if (irq > 0) {
+                       /*
+                        * Mark percpu.  Without this, migrate_irqs() will
+                        * mark the interrupt for migrations and trigger it
+                        * on cpu hotplug.
+                        */
+                       desc = irq_desc + irq;
+                       desc->status |= IRQ_PER_CPU;
+               }
        } 
 
        /* For BSP, we cache registered percpu irqs, and then re-walk
@@ -401,7 +405,7 @@ xen_register_percpu_irq (unsigned int ir
         */
        if (!cpu && save) {
                BUG_ON(saved_irq_cnt == MAX_LATE_IRQ);
-               saved_percpu_irqs[saved_irq_cnt].irq = irq;
+               saved_percpu_irqs[saved_irq_cnt].irq = vec;
                saved_percpu_irqs[saved_irq_cnt].action = action;
                saved_irq_cnt++;
                if (!xen_slab_ready)
@@ -588,7 +592,8 @@ ia64_send_ipi (int cpu, int vector, int 
                        irq = per_cpu(ipi_to_irq, cpu)[CPEP_VECTOR];
                        break;
                default:
-                       printk(KERN_WARNING"Unsupported IPI type 0x%x\n", 
vector);
+                       printk(KERN_WARNING "Unsupported IPI type 0x%x\n",
+                              vector);
                        irq = 0;
                        break;
                }               
diff -r aea80dbf6d96 -r 9af0c7e4ff51 
linux-2.6-xen-sparse/arch/ia64/kernel/setup.c
--- a/linux-2.6-xen-sparse/arch/ia64/kernel/setup.c     Fri Feb 09 14:43:22 
2007 -0600
+++ b/linux-2.6-xen-sparse/arch/ia64/kernel/setup.c     Wed Feb 14 19:01:35 
2007 +0000
@@ -63,6 +63,7 @@
 #ifdef CONFIG_XEN
 #include <asm/hypervisor.h>
 #include <asm/xen/xencomm.h>
+#include <xen/xencons.h>
 #endif
 #include <linux/dma-mapping.h>
 
@@ -95,6 +96,12 @@ static struct notifier_block xen_panic_b
 static struct notifier_block xen_panic_block = {
        xen_panic_event, NULL, 0 /* try to go last */
 };
+
+void xen_pm_power_off(void)
+{
+       local_irq_disable();
+       HYPERVISOR_shutdown(SHUTDOWN_poweroff);
+}
 #endif
 
 extern void ia64_setup_printk_clock(void);
@@ -454,7 +461,9 @@ setup_arch (char **cmdline_p)
 
                setup_xen_features();
                /* Register a call for panic conditions. */
-               notifier_chain_register(&panic_notifier_list, &xen_panic_block);
+               atomic_notifier_chain_register(&panic_notifier_list,
+                                              &xen_panic_block);
+               pm_power_off = xen_pm_power_off;
        }
 #endif
 
diff -r aea80dbf6d96 -r 9af0c7e4ff51 
linux-2.6-xen-sparse/arch/ia64/xen/hypervisor.c
--- a/linux-2.6-xen-sparse/arch/ia64/xen/hypervisor.c   Fri Feb 09 14:43:22 
2007 -0600
+++ b/linux-2.6-xen-sparse/arch/ia64/xen/hypervisor.c   Wed Feb 14 19:01:35 
2007 +0000
@@ -417,12 +417,6 @@ EXPORT_SYMBOL(HYPERVISOR_grant_table_op)
 EXPORT_SYMBOL(HYPERVISOR_grant_table_op);
 
 ///////////////////////////////////////////////////////////////////////////
-// PageForeign(), SetPageForeign(), ClearPageForeign()
-
-struct address_space xen_ia64_foreign_dummy_mapping;
-EXPORT_SYMBOL(xen_ia64_foreign_dummy_mapping);
-
-///////////////////////////////////////////////////////////////////////////
 // foreign mapping
 #include <linux/efi.h>
 #include <asm/meminit.h> // for IA64_GRANULE_SIZE, GRANULEROUND{UP,DOWN}()
diff -r aea80dbf6d96 -r 9af0c7e4ff51 
linux-2.6-xen-sparse/arch/ia64/xen/xenentry.S
--- a/linux-2.6-xen-sparse/arch/ia64/xen/xenentry.S     Fri Feb 09 14:43:22 
2007 -0600
+++ b/linux-2.6-xen-sparse/arch/ia64/xen/xenentry.S     Wed Feb 14 19:01:35 
2007 +0000
@@ -124,6 +124,8 @@ GLOBAL_ENTRY(ia64_switch_to)
        ;;
        itr.d dtr[r25]=r23              // wire in new mapping...
 #ifdef CONFIG_XEN
+       ;;
+       srlz.d
        mov r9=1
        movl r8=XSI_PSR_IC
        ;;
@@ -875,9 +877,6 @@ skip_rbs_switch:
        st8 [r2]=r8
        st8 [r3]=r10
 .work_pending:
-       tbit.nz p6,p0=r31,TIF_SIGDELAYED                // signal delayed from  
MCA/INIT/NMI/PMI context?
-(p6)   br.cond.sptk.few .sigdelayed
-       ;;
        tbit.z p6,p0=r31,TIF_NEED_RESCHED               // 
current_thread_info()->need_resched==0?
 (p6)   br.cond.sptk.few .notify
 #ifdef CONFIG_PREEMPT
@@ -913,17 +912,6 @@ skip_rbs_switch:
 (pLvSys)br.cond.sptk.few  .work_pending_syscall_end
        br.cond.sptk.many .work_processed_kernel        // don't re-check
 
-// There is a delayed signal that was detected in MCA/INIT/NMI/PMI context 
where
-// it could not be delivered.  Deliver it now.  The signal might be for us and
-// may set TIF_SIGPENDING, so redrive ia64_leave_* after processing the delayed
-// signal.
-
-.sigdelayed:
-       br.call.sptk.many rp=do_sigdelayed
-       cmp.eq p6,p0=r0,r0                              // p6 <- 1, always 
re-check
-(pLvSys)br.cond.sptk.few  .work_pending_syscall_end
-       br.cond.sptk.many .work_processed_kernel        // re-check
-
 .work_pending_syscall_end:
        adds r2=PT(R8)+16,r12
        adds r3=PT(R10)+16,r12
diff -r aea80dbf6d96 -r 9af0c7e4ff51 
linux-2.6-xen-sparse/drivers/xen/blkback/xenbus.c
--- a/linux-2.6-xen-sparse/drivers/xen/blkback/xenbus.c Fri Feb 09 14:43:22 
2007 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/blkback/xenbus.c Wed Feb 14 19:01:35 
2007 +0000
@@ -344,7 +344,7 @@ static void frontend_changed(struct xenb
        switch (frontend_state) {
        case XenbusStateInitialising:
                if (dev->state == XenbusStateClosed) {
-                       printk("%s: %s: prepare for reconnect\n",
+                       printk(KERN_INFO "%s: %s: prepare for reconnect\n",
                               __FUNCTION__, dev->nodename);
                        xenbus_switch_state(dev, XenbusStateInitWait);
                }
@@ -488,7 +488,8 @@ static int connect_ring(struct backend_i
                xenbus_dev_fatal(dev, err, "unknown fe protocol %s", protocol);
                return -1;
        }
-       printk("blkback: ring-ref %ld, event-channel %d, protocol %d (%s)\n",
+       printk(KERN_INFO
+              "blkback: ring-ref %ld, event-channel %d, protocol %d (%s)\n",
               ring_ref, evtchn, be->blkif->blk_protocol, protocol);
 
        /* Map the shared frame, irq etc. */
diff -r aea80dbf6d96 -r 9af0c7e4ff51 
linux-2.6-xen-sparse/drivers/xen/blktap/xenbus.c
--- a/linux-2.6-xen-sparse/drivers/xen/blktap/xenbus.c  Fri Feb 09 14:43:22 
2007 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/blktap/xenbus.c  Wed Feb 14 19:01:35 
2007 +0000
@@ -272,7 +272,7 @@ static void tap_frontend_changed(struct 
        switch (frontend_state) {
        case XenbusStateInitialising:
                if (dev->state == XenbusStateClosed) {
-                       printk("%s: %s: prepare for reconnect\n",
+                       printk(KERN_INFO "%s: %s: prepare for reconnect\n",
                               __FUNCTION__, dev->nodename);
                        xenbus_switch_state(dev, XenbusStateInitWait);
                }
@@ -369,7 +369,8 @@ static int connect_ring(struct backend_i
                xenbus_dev_fatal(dev, err, "unknown fe protocol %s", protocol);
                return -1;
        }
-       printk("blktap: ring-ref %ld, event-channel %d, protocol %d (%s)\n",
+       printk(KERN_INFO
+              "blktap: ring-ref %ld, event-channel %d, protocol %d (%s)\n",
               ring_ref, evtchn, be->blkif->blk_protocol, protocol);
 
        /* Map the shared frame, irq etc. */
diff -r aea80dbf6d96 -r 9af0c7e4ff51 
linux-2.6-xen-sparse/drivers/xen/core/evtchn.c
--- a/linux-2.6-xen-sparse/drivers/xen/core/evtchn.c    Fri Feb 09 14:43:22 
2007 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/core/evtchn.c    Wed Feb 14 19:01:35 
2007 +0000
@@ -424,7 +424,7 @@ static void unbind_from_irq(unsigned int
 static void unbind_from_irq(unsigned int irq)
 {
        struct evtchn_close close;
-       int evtchn = evtchn_from_irq(irq);
+       int cpu, evtchn = evtchn_from_irq(irq);
 
        spin_lock(&irq_mapping_update_lock);
 
@@ -452,6 +452,10 @@ static void unbind_from_irq(unsigned int
 
                evtchn_to_irq[evtchn] = -1;
                irq_info[irq] = IRQ_UNBOUND;
+
+               /* Zap stats across IRQ changes of use. */
+               for_each_possible_cpu(cpu)
+                       kstat_cpu(cpu).irqs[irq] = 0;
        }
 
        spin_unlock(&irq_mapping_update_lock);
diff -r aea80dbf6d96 -r 9af0c7e4ff51 
linux-2.6-xen-sparse/drivers/xen/core/reboot.c
--- a/linux-2.6-xen-sparse/drivers/xen/core/reboot.c    Fri Feb 09 14:43:22 
2007 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/core/reboot.c    Wed Feb 14 19:01:35 
2007 +0000
@@ -100,6 +100,7 @@ static void shutdown_handler(struct xenb
 static void shutdown_handler(struct xenbus_watch *watch,
                             const char **vec, unsigned int len)
 {
+       extern void ctrl_alt_del(void);
        char *str;
        struct xenbus_transaction xbt;
        int err;
@@ -129,7 +130,7 @@ static void shutdown_handler(struct xenb
        if (strcmp(str, "poweroff") == 0)
                shutting_down = SHUTDOWN_POWEROFF;
        else if (strcmp(str, "reboot") == 0)
-               kill_proc(1, SIGINT, 1); /* interrupt init */
+               ctrl_alt_del();
        else if (strcmp(str, "suspend") == 0)
                shutting_down = SHUTDOWN_SUSPEND;
        else if (strcmp(str, "halt") == 0)
diff -r aea80dbf6d96 -r 9af0c7e4ff51 
linux-2.6-xen-sparse/drivers/xen/fbfront/xenkbd.c
--- a/linux-2.6-xen-sparse/drivers/xen/fbfront/xenkbd.c Fri Feb 09 14:43:22 
2007 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/fbfront/xenkbd.c Wed Feb 14 19:01:35 
2007 +0000
@@ -29,10 +29,12 @@
 
 struct xenkbd_info
 {
-       struct input_dev *dev;
+       struct input_dev *kbd;
+       struct input_dev *ptr;
        struct xenkbd_page *page;
        int irq;
        struct xenbus_device *xbdev;
+       char phys[32];
 };
 
 static int xenkbd_remove(struct xenbus_device *);
@@ -56,23 +58,36 @@ static irqreturn_t input_handler(int rq,
        rmb();                  /* ensure we see ring contents up to prod */
        for (cons = page->in_cons; cons != prod; cons++) {
                union xenkbd_in_event *event;
+               struct input_dev *dev;
                event = &XENKBD_IN_RING_REF(page, cons);
 
+               dev = info->ptr;
                switch (event->type) {
                case XENKBD_TYPE_MOTION:
-                       input_report_rel(info->dev, REL_X, event->motion.rel_x);
-                       input_report_rel(info->dev, REL_Y, event->motion.rel_y);
+                       input_report_rel(dev, REL_X, event->motion.rel_x);
+                       input_report_rel(dev, REL_Y, event->motion.rel_y);
                        break;
                case XENKBD_TYPE_KEY:
-                       input_report_key(info->dev, event->key.keycode, 
event->key.pressed);
+                       dev = NULL;
+                       if (test_bit(event->key.keycode, info->kbd->keybit))
+                               dev = info->kbd;
+                       if (test_bit(event->key.keycode, info->ptr->keybit))
+                               dev = info->ptr;
+                       if (dev)
+                               input_report_key(dev, event->key.keycode,
+                                                event->key.pressed);
+                       else
+                               printk("xenkbd: unhandled keycode 0x%x\n",
+                                      event->key.keycode);
                        break;
                case XENKBD_TYPE_POS:
-                       input_report_abs(info->dev, ABS_X, event->pos.abs_x);
-                       input_report_abs(info->dev, ABS_Y, event->pos.abs_y);
+                       input_report_abs(dev, ABS_X, event->pos.abs_x);
+                       input_report_abs(dev, ABS_Y, event->pos.abs_y);
                        break;
                }
-       }
-       input_sync(info->dev);
+               if (dev)
+                       input_sync(dev);
+       }
        mb();                   /* ensure we got ring contents */
        page->in_cons = cons;
        notify_remote_via_irq(info->irq);
@@ -85,7 +100,7 @@ int __devinit xenkbd_probe(struct xenbus
 {
        int ret, i;
        struct xenkbd_info *info;
-       struct input_dev *input_dev;
+       struct input_dev *kbd, *ptr;
 
        info = kzalloc(sizeof(*info), GFP_KERNEL);
        if (!info) {
@@ -94,6 +109,7 @@ int __devinit xenkbd_probe(struct xenbus
        }
        dev->dev.driver_data = info;
        info->xbdev = dev;
+       snprintf(info->phys, sizeof(info->phys), "xenbus/%s", dev->nodename);
 
        info->page = (void *)__get_free_page(GFP_KERNEL);
        if (!info->page)
@@ -101,32 +117,52 @@ int __devinit xenkbd_probe(struct xenbus
        info->page->in_cons = info->page->in_prod = 0;
        info->page->out_cons = info->page->out_prod = 0;
 
-       input_dev = input_allocate_device();
-       if (!input_dev)
+       /* keyboard */
+       kbd = input_allocate_device();
+       if (!kbd)
                goto error_nomem;
-
-       input_dev->evbit[0] = BIT(EV_KEY) | BIT(EV_REL) | BIT(EV_ABS);
-       input_dev->keybit[LONG(BTN_MOUSE)]
-               = BIT(BTN_LEFT) | BIT(BTN_MIDDLE) | BIT(BTN_RIGHT);
-       /* TODO additional buttons */
-       input_dev->relbit[0] = BIT(REL_X) | BIT(REL_Y);
-
-       /* FIXME not sure this is quite right */
-       for (i = 0; i < 256; i++)
-               set_bit(i, input_dev->keybit);
-
-       input_dev->name = "Xen Virtual Keyboard/Mouse";
-
-       input_set_abs_params(input_dev, ABS_X, 0, XENFB_WIDTH, 0, 0);
-       input_set_abs_params(input_dev, ABS_Y, 0, XENFB_HEIGHT, 0, 0);
-
-       ret = input_register_device(input_dev);
-       if (ret) {
-               input_free_device(input_dev);
-               xenbus_dev_fatal(dev, ret, "input_register_device");
+       kbd->name = "Xen Virtual Keyboard";
+       kbd->phys = info->phys;
+       kbd->id.bustype = BUS_PCI;
+       kbd->id.vendor = 0x5853;
+       kbd->id.product = 0xffff;
+       kbd->evbit[0] = BIT(EV_KEY);
+       for (i = KEY_ESC; i < KEY_UNKNOWN; i++)
+               set_bit(i, kbd->keybit);
+       for (i = KEY_OK; i < KEY_MAX; i++)
+               set_bit(i, kbd->keybit);
+
+       ret = input_register_device(kbd);
+       if (ret) {
+               input_free_device(kbd);
+               xenbus_dev_fatal(dev, ret, "input_register_device(kbd)");
                goto error;
        }
-       info->dev = input_dev;
+       info->kbd = kbd;
+
+       /* pointing device */
+       ptr = input_allocate_device();
+       if (!ptr)
+               goto error_nomem;
+       ptr->name = "Xen Virtual Pointer";
+       ptr->phys = info->phys;
+       ptr->id.bustype = BUS_PCI;
+       ptr->id.vendor = 0x5853;
+       ptr->id.product = 0xfffe;
+       ptr->evbit[0] = BIT(EV_KEY) | BIT(EV_REL) | BIT(EV_ABS);
+       for (i = BTN_LEFT; i <= BTN_TASK; i++)
+               set_bit(i, ptr->keybit);
+       ptr->relbit[0] = BIT(REL_X) | BIT(REL_Y);
+       input_set_abs_params(ptr, ABS_X, 0, XENFB_WIDTH, 0, 0);
+       input_set_abs_params(ptr, ABS_Y, 0, XENFB_HEIGHT, 0, 0);
+
+       ret = input_register_device(ptr);
+       if (ret) {
+               input_free_device(ptr);
+               xenbus_dev_fatal(dev, ret, "input_register_device(ptr)");
+               goto error;
+       }
+       info->ptr = ptr;
 
        ret = xenkbd_connect_backend(dev, info);
        if (ret < 0)
@@ -155,7 +191,8 @@ static int xenkbd_remove(struct xenbus_d
        struct xenkbd_info *info = dev->dev.driver_data;
 
        xenkbd_disconnect_backend(info);
-       input_unregister_device(info->dev);
+       input_unregister_device(info->kbd);
+       input_unregister_device(info->ptr);
        free_page((unsigned long)info->page);
        kfree(info);
        return 0;
diff -r aea80dbf6d96 -r 9af0c7e4ff51 
linux-2.6-xen-sparse/drivers/xen/netback/xenbus.c
--- a/linux-2.6-xen-sparse/drivers/xen/netback/xenbus.c Fri Feb 09 14:43:22 
2007 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/netback/xenbus.c Wed Feb 14 19:01:35 
2007 +0000
@@ -217,7 +217,7 @@ static void frontend_changed(struct xenb
        switch (frontend_state) {
        case XenbusStateInitialising:
                if (dev->state == XenbusStateClosed) {
-                       printk("%s: %s: prepare for reconnect\n",
+                       printk(KERN_INFO "%s: %s: prepare for reconnect\n",
                               __FUNCTION__, dev->nodename);
                        if (be->netif) {
                                netif_disconnect(be->netif);
diff -r aea80dbf6d96 -r 9af0c7e4ff51 
linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c
--- a/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c      Fri Feb 09 
14:43:22 2007 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c      Wed Feb 14 
19:01:35 2007 +0000
@@ -1505,7 +1505,7 @@ static void netif_release_rx_bufs(struct
        int id, ref;
 
        if (np->copying_receiver) {
-               printk("%s: fix me for copying receiver.\n", __FUNCTION__);
+               WPRINTK("%s: fix me for copying receiver.\n", __FUNCTION__);
                return;
        }
 
@@ -1555,8 +1555,8 @@ static void netif_release_rx_bufs(struct
                xfer++;
        }
 
-       printk("%s: %d xfer, %d noxfer, %d unused\n",
-              __FUNCTION__, xfer, noxfer, unused);
+       IPRINTK("%s: %d xfer, %d noxfer, %d unused\n",
+               __FUNCTION__, xfer, noxfer, unused);
 
        if (xfer) {
                /* Some pages are no longer absent... */
diff -r aea80dbf6d96 -r 9af0c7e4ff51 
linux-2.6-xen-sparse/include/asm-i386/a.out.h
--- a/linux-2.6-xen-sparse/include/asm-i386/a.out.h     Fri Feb 09 14:43:22 
2007 -0600
+++ /dev/null   Thu Jan 01 00:00:00 1970 +0000
@@ -1,26 +0,0 @@
-#ifndef __I386_A_OUT_H__
-#define __I386_A_OUT_H__
-
-struct exec
-{
-  unsigned long a_info;                /* Use macros N_MAGIC, etc for access */
-  unsigned a_text;             /* length of text, in bytes */
-  unsigned a_data;             /* length of data, in bytes */
-  unsigned a_bss;              /* length of uninitialized data area for file, 
in bytes */
-  unsigned a_syms;             /* length of symbol table data in file, in 
bytes */
-  unsigned a_entry;            /* start address */
-  unsigned a_trsize;           /* length of relocation info for text, in bytes 
*/
-  unsigned a_drsize;           /* length of relocation info for data, in bytes 
*/
-};
-
-#define N_TRSIZE(a)    ((a).a_trsize)
-#define N_DRSIZE(a)    ((a).a_drsize)
-#define N_SYMSIZE(a)   ((a).a_syms)
-
-#ifdef __KERNEL__
-
-#define STACK_TOP      (TASK_SIZE - 3*PAGE_SIZE)
-
-#endif
-
-#endif /* __A_OUT_GNU_H__ */
diff -r aea80dbf6d96 -r 9af0c7e4ff51 
linux-2.6-xen-sparse/include/asm-ia64/hw_irq.h
--- a/linux-2.6-xen-sparse/include/asm-ia64/hw_irq.h    Fri Feb 09 14:43:22 
2007 -0600
+++ b/linux-2.6-xen-sparse/include/asm-ia64/hw_irq.h    Wed Feb 14 19:01:35 
2007 +0000
@@ -104,10 +104,9 @@ static inline void ia64_resend_irq(unsig
 static inline void ia64_resend_irq(unsigned int vector)
 {
 #ifdef CONFIG_XEN
-       extern void resend_irq_on_evtchn(struct hw_interrupt_type *h,
-                                        unsigned int i);
+       extern int resend_irq_on_evtchn(unsigned int i);
        if (is_running_on_xen())
-               resend_irq_on_evtchn(h, vector);
+               resend_irq_on_evtchn(vector);
        else
 #endif /* CONFIG_XEN */
        platform_send_ipi(smp_processor_id(), vector, IA64_IPI_DM_INT, 0);
diff -r aea80dbf6d96 -r 9af0c7e4ff51 
linux-2.6-xen-sparse/include/asm-ia64/maddr.h
--- a/linux-2.6-xen-sparse/include/asm-ia64/maddr.h     Fri Feb 09 14:43:22 
2007 -0600
+++ b/linux-2.6-xen-sparse/include/asm-ia64/maddr.h     Wed Feb 14 19:01:35 
2007 +0000
@@ -84,9 +84,6 @@ mfn_to_local_pfn(unsigned long mfn)
 
 #endif /* !CONFIG_XEN */
 
-/* XXX to compile set_phys_to_machine(vaddr, FOREIGN_FRAME(m)) */
-#define FOREIGN_FRAME(m)        (INVALID_P2M_ENTRY)
-
 #define mfn_to_pfn(mfn) (mfn)
 #define pfn_to_mfn(pfn) (pfn)
 
diff -r aea80dbf6d96 -r 9af0c7e4ff51 
linux-2.6-xen-sparse/include/asm-ia64/page.h
--- a/linux-2.6-xen-sparse/include/asm-ia64/page.h      Fri Feb 09 14:43:22 
2007 -0600
+++ b/linux-2.6-xen-sparse/include/asm-ia64/page.h      Wed Feb 14 19:01:35 
2007 +0000
@@ -236,46 +236,17 @@ get_order (unsigned long size)
 #include <linux/kernel.h>
 #include <asm/hypervisor.h>
 #include <xen/features.h>      // to compile netback, netfront
-
-/*
- * XXX hack!
- * Linux/IA64 uses PG_arch_1.
- * This hack will be removed once PG_foreign bit is taken.
- * #include <xen/foreign_page.h>
- */
-#ifdef __ASM_XEN_FOREIGN_PAGE_H__
-# error "don't include include/xen/foreign_page.h!"
-#endif
-
-extern struct address_space xen_ia64_foreign_dummy_mapping;
-#define PageForeign(page)      \
-       ((page)->mapping == &xen_ia64_foreign_dummy_mapping)
-
-#define SetPageForeign(page, dtor) do {                                \
-       set_page_private((page), (unsigned long)(dtor));        \
-       (page)->mapping = &xen_ia64_foreign_dummy_mapping;      \
-       smp_rmb();                                              \
-} while (0)
-
-#define ClearPageForeign(page) do {    \
-       (page)->mapping = NULL;         \
-       smp_rmb();                      \
-       set_page_private((page), 0);    \
-} while (0)
-
-#define PageForeignDestructor(page)    \
-       ( (void (*) (struct page *)) page_private(page) )
-
-#define arch_free_page(_page,_order)                   \
-({      int foreign = PageForeign(_page);               \
-       if (foreign)                                    \
-               (PageForeignDestructor(_page))(_page);  \
-       foreign;                                        \
+#include <asm/maddr.h>
+
+#define arch_free_page(_page, _order)          \
+({                                             \
+       int foreign = PageForeign(_page);       \
+       if (foreign)                            \
+               PageForeignDestructor(_page);   \
+       foreign;                                \
 })
 #define HAVE_ARCH_FREE_PAGE
 
-#include <asm/maddr.h>
-
 #endif /* CONFIG_XEN */
 #endif /* __ASSEMBLY__ */
 
diff -r aea80dbf6d96 -r 9af0c7e4ff51 linux-2.6-xen-sparse/net/core/skbuff.c
--- a/linux-2.6-xen-sparse/net/core/skbuff.c    Fri Feb 09 14:43:22 2007 -0600
+++ b/linux-2.6-xen-sparse/net/core/skbuff.c    Wed Feb 14 19:01:35 2007 +0000
@@ -1897,6 +1897,29 @@ int skb_append_datato_frags(struct sock 
 }
 
 /**
+ *     skb_pull_rcsum - pull skb and update receive checksum
+ *     @skb: buffer to update
+ *     @start: start of data before pull
+ *     @len: length of data pulled
+ *
+ *     This function performs an skb_pull on the packet and updates
+ *     update the CHECKSUM_HW checksum.  It should be used on receive
+ *     path processing instead of skb_pull unless you know that the
+ *     checksum difference is zero (e.g., a valid IP header) or you
+ *     are setting ip_summed to CHECKSUM_NONE.
+ */
+unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len)
+{
+       BUG_ON(len > skb->len);
+       skb->len -= len;
+       BUG_ON(skb->len < skb->data_len);
+       skb_postpull_rcsum(skb, skb->data, len);
+       return skb->data += len;
+}
+
+EXPORT_SYMBOL_GPL(skb_pull_rcsum);
+
+/**
  *     skb_segment - Perform protocol segmentation on skb.
  *     @skb: buffer to segment
  *     @features: features for the output path (see dev->features)
@@ -2021,29 +2044,6 @@ err:
 }
 
 EXPORT_SYMBOL_GPL(skb_segment);
-
-/**
- *     skb_pull_rcsum - pull skb and update receive checksum
- *     @skb: buffer to update
- *     @start: start of data before pull
- *     @len: length of data pulled
- *
- *     This function performs an skb_pull on the packet and updates
- *     update the CHECKSUM_HW checksum.  It should be used on receive
- *     path processing instead of skb_pull unless you know that the
- *     checksum difference is zero (e.g., a valid IP header) or you
- *     are setting ip_summed to CHECKSUM_NONE.
- */
-unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len)
-{
-       BUG_ON(len > skb->len);
-       skb->len -= len;
-       BUG_ON(skb->len < skb->data_len);
-       skb_postpull_rcsum(skb, skb->data, len);
-       return skb->data += len;
-}
-
-EXPORT_SYMBOL_GPL(skb_pull_rcsum);
 
 void __init skb_init(void)
 {
diff -r aea80dbf6d96 -r 9af0c7e4ff51 patches/linux-2.6.18/series
--- a/patches/linux-2.6.18/series       Fri Feb 09 14:43:22 2007 -0600
+++ b/patches/linux-2.6.18/series       Wed Feb 14 19:01:35 2007 +0000
@@ -18,3 +18,4 @@ x86-elfnote-as-preprocessor-macro.patch
 x86-elfnote-as-preprocessor-macro.patch
 fixaddr-top.patch
 git-c06cb8b1c4d25e5b4d7a2d7c2462619de1e0dbc4.patch
+softlockup-no-idle-hz.patch
diff -r aea80dbf6d96 -r 9af0c7e4ff51 
patches/linux-2.6.18/softlockup-no-idle-hz.patch
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/patches/linux-2.6.18/softlockup-no-idle-hz.patch  Wed Feb 14 19:01:35 
2007 +0000
@@ -0,0 +1,56 @@
+diff -pruN ../orig-linux-2.6.18/include/linux/sched.h ./include/linux/sched.h
+--- ../orig-linux-2.6.18/include/linux/sched.h 2006-09-20 04:42:06.000000000 
+0100
++++ ./include/linux/sched.h    2007-02-07 01:10:24.000000000 +0000
+@@ -211,10 +211,15 @@ extern void update_process_times(int use
+ extern void scheduler_tick(void);
+ 
+ #ifdef CONFIG_DETECT_SOFTLOCKUP
++extern unsigned long softlockup_get_next_event(void);
+ extern void softlockup_tick(void);
+ extern void spawn_softlockup_task(void);
+ extern void touch_softlockup_watchdog(void);
+ #else
++static inline unsigned long softlockup_get_next_event(void)
++{
++      return MAX_JIFFY_OFFSET;
++}
+ static inline void softlockup_tick(void)
+ {
+ }
+diff -pruN ../orig-linux-2.6.18/kernel/softlockup.c ./kernel/softlockup.c
+--- ../orig-linux-2.6.18/kernel/softlockup.c   2006-09-20 04:42:06.000000000 
+0100
++++ ./kernel/softlockup.c      2007-02-07 01:53:22.000000000 +0000
+@@ -40,6 +40,19 @@ void touch_softlockup_watchdog(void)
+ }
+ EXPORT_SYMBOL(touch_softlockup_watchdog);
+ 
++unsigned long softlockup_get_next_event(void)
++{
++      int this_cpu = smp_processor_id();
++      unsigned long touch_timestamp = per_cpu(touch_timestamp, this_cpu);
++
++      if (per_cpu(print_timestamp, this_cpu) == touch_timestamp ||
++              did_panic ||
++                      !per_cpu(watchdog_task, this_cpu))
++              return MAX_JIFFY_OFFSET;
++
++      return min_t(long, 0, touch_timestamp + HZ - jiffies);
++}
++
+ /*
+  * This callback runs from the timer interrupt, and checks
+  * whether the watchdog thread has hung or not:
+diff -pruN ../orig-linux-2.6.18/kernel/timer.c ./kernel/timer.c
+--- ../orig-linux-2.6.18/kernel/timer.c        2006-09-20 04:42:06.000000000 
+0100
++++ ./kernel/timer.c   2007-02-07 01:29:34.000000000 +0000
+@@ -485,7 +485,9 @@ unsigned long next_timer_interrupt(void)
+               if (hr_expires < 3)
+                       return hr_expires + jiffies;
+       }
+-      hr_expires += jiffies;
++      hr_expires = min_t(unsigned long,
++                         softlockup_get_next_event(),
++                         hr_expires) + jiffies;
+ 
+       base = __get_cpu_var(tvec_bases);
+       spin_lock(&base->lock);
diff -r aea80dbf6d96 -r 9af0c7e4ff51 tools/examples/block
--- a/tools/examples/block      Fri Feb 09 14:43:22 2007 -0600
+++ b/tools/examples/block      Wed Feb 14 19:01:35 2007 +0000
@@ -367,13 +367,7 @@ mount it read-write in a guest domain."
           fatal 'Failed to find an unused loop device'
         fi
 
-        cmode=`canonicalise_mode $mode`
-        if [ "$cmode" == 'r' ]
-        then
-          do_or_die losetup -r "$loopdev" "$file"
-        else
-          do_or_die losetup "$loopdev" "$file"
-        fi
+        do_or_die losetup "$loopdev" "$file"
         xenstore_write "$XENBUS_PATH/node" "$loopdev"
         write_dev "$loopdev"
         release_lock "block"
diff -r aea80dbf6d96 -r 9af0c7e4ff51 tools/examples/vif-bridge
--- a/tools/examples/vif-bridge Fri Feb 09 14:43:22 2007 -0600
+++ b/tools/examples/vif-bridge Wed Feb 14 19:01:35 2007 +0000
@@ -46,6 +46,13 @@ then
   fi
 fi
 
+RET=0
+ip link show $bridge 1>/dev/null 2>&1 || RET=1
+if [ "$RET" -eq 1 ]
+then
+    fatal "Could not find bridge device $bridge"
+fi
+
 case "$command" in
     online)
        setup_bridge_port "$vif"
diff -r aea80dbf6d96 -r 9af0c7e4ff51 tools/examples/xen-hotplug-common.sh
--- a/tools/examples/xen-hotplug-common.sh      Fri Feb 09 14:43:22 2007 -0600
+++ b/tools/examples/xen-hotplug-common.sh      Wed Feb 14 19:01:35 2007 +0000
@@ -28,14 +28,15 @@ unset $(set | grep ^LC_ | cut -d= -f1)
 unset $(set | grep ^LC_ | cut -d= -f1)
 
 fatal() {
-  xenstore_write "$XENBUS_PATH"/hotplug-status error
+  xenstore_write "$XENBUS_PATH/hotplug-error" "$*" \
+                 "$XENBUS_PATH/hotplug-status" error
   log err "$@"
   exit 1
 }
 
 success() {
   # Tell DevController that backend is "connected"
-  xenstore_write "$XENBUS_PATH"/hotplug-status connected
+  xenstore_write "$XENBUS_PATH/hotplug-status" connected
 }
 
 do_or_die() {
diff -r aea80dbf6d96 -r 9af0c7e4ff51 
tools/firmware/rombios/32bit/tcgbios/tcgbios.c
--- a/tools/firmware/rombios/32bit/tcgbios/tcgbios.c    Fri Feb 09 14:43:22 
2007 -0600
+++ b/tools/firmware/rombios/32bit/tcgbios/tcgbios.c    Wed Feb 14 19:01:35 
2007 +0000
@@ -146,7 +146,7 @@ static int tpm_driver_to_use = TPM_INVAL
 static int tpm_driver_to_use = TPM_INVALID_DRIVER;
 
 static
-uint32_t MA_IsTPMPresent()
+uint32_t MA_IsTPMPresent(void)
 {
        uint32_t rc = 0;
        unsigned int i;
@@ -263,11 +263,11 @@ void tcpa_acpi_init(void)
 {
        struct acpi_20_rsdt *rsdt;
        uint32_t length;
-       struct acpi_20_tcpa *tcpa;
+       struct acpi_20_tcpa *tcpa = (void *)0;
        uint16_t found = 0;
        uint16_t rsdp_off;
        uint16_t off;
-       struct acpi_20_rsdp *rsdp;
+       struct acpi_20_rsdp *rsdp = (void *)0;
 
        if (MA_IsTPMPresent() == 0) {
                return;
@@ -732,8 +732,8 @@ void tcpa_measure_post(Bit32u from, Bit3
 void tcpa_measure_post(Bit32u from, Bit32u to)
 {
        struct pcpes pcpes; /* PCClientPCREventStruc */
+       int len = to - from;
        memset(&pcpes, 0x0, sizeof(pcpes));
-       int len = to - from;
 
        if (len > 0) {
                sha1((unsigned char *)from,
@@ -986,7 +986,7 @@ uint32_t PassThroughToTPM32(struct pttti
 {
        uint32_t rc = 0;
        uint8_t *cmd32;
-       uint32_t resbuflen;
+       uint32_t resbuflen = 0;
 
        if (TCG_IsShutdownPreBootInterface() != 0) {
                rc = (TCG_PC_TPMERROR |
@@ -1277,9 +1277,7 @@ typedef struct _sha1_ctx {
 } sha1_ctx;
 
 
-static inline uint32_t rol(val, rol)
-  uint32_t val;
-  uint16_t rol;
+static inline uint32_t rol(uint32_t val, uint16_t rol)
 {
        return (val << rol) | (val >> (32 - rol));
 }
diff -r aea80dbf6d96 -r 9af0c7e4ff51 
tools/firmware/rombios/32bit/tcgbios/tpm_drivers.c
--- a/tools/firmware/rombios/32bit/tcgbios/tpm_drivers.c        Fri Feb 09 
14:43:22 2007 -0600
+++ b/tools/firmware/rombios/32bit/tcgbios/tpm_drivers.c        Wed Feb 14 
19:01:35 2007 +0000
@@ -27,12 +27,27 @@
 #include "tpm_drivers.h"
 #include "tcgbios.h"
 
+#define STS_VALID                    (1 << 7) /* 0x80 */
+#define STS_COMMAND_READY            (1 << 6) /* 0x40 */
+#define STS_TPM_GO                   (1 << 5) /* 0x20 */
+#define STS_DATA_AVAILABLE           (1 << 4) /* 0x10 */
+#define STS_EXPECT                   (1 << 3) /* 0x08 */
+#define STS_RESPONSE_RETRY           (1 << 1) /* 0x02 */
+
+#define ACCESS_TPM_REG_VALID_STS     (1 << 7) /* 0x80 */
+#define ACCESS_ACTIVE_LOCALITY       (1 << 5) /* 0x20 */
+#define ACCESS_BEEN_SEIZED           (1 << 4) /* 0x10 */
+#define ACCESS_SEIZE                 (1 << 3) /* 0x08 */
+#define ACCESS_PENDING_REQUEST       (1 << 2) /* 0x04 */
+#define ACCESS_REQUEST_USE           (1 << 1) /* 0x02 */
+#define ACCESS_TPM_ESTABLISHMENT     (1 << 0) /* 0x01 */
+
 static uint32_t tis_wait_sts(uint8_t *addr, uint32_t time,
                              uint8_t mask, uint8_t expect)
 {
        uint32_t rc = 0;
        while (time > 0) {
-               uint8_t sts = addr[TPM_STS];
+               uint8_t sts = mmio_readb(&addr[TPM_STS]);
                if ((sts & mask) == expect) {
                        rc = 1;
                        break;
@@ -45,16 +60,17 @@ static uint32_t tis_wait_sts(uint8_t *ad
 
 static uint32_t tis_activate(uint32_t baseaddr)
 {
-       uint32_t rc = 0;
+       uint32_t rc = 1;
        uint8_t *tis_addr = (uint8_t*)baseaddr;
        uint8_t acc;
        /* request access to locality */
-       tis_addr[TPM_ACCESS] = 0x2;
+       tis_addr[TPM_ACCESS] = ACCESS_REQUEST_USE;
 
-       acc = tis_addr[TPM_ACCESS];
-       if ((acc & 0x20) != 0) {
-               tis_addr[TPM_STS] = 0x40;
-               rc = tis_wait_sts(tis_addr, 100, 0x40, 0x40);
+       acc = mmio_readb(&tis_addr[TPM_ACCESS]);
+       if ((acc & ACCESS_ACTIVE_LOCALITY) != 0) {
+               tis_addr[TPM_STS] = STS_COMMAND_READY;
+               rc = tis_wait_sts(tis_addr, 100,
+                                 STS_COMMAND_READY, STS_COMMAND_READY);
        }
        return rc;
 }
@@ -64,8 +80,8 @@ uint32_t tis_ready(uint32_t baseaddr)
        uint32_t rc = 0;
        uint8_t *tis_addr = (uint8_t*)baseaddr;
 
-       tis_addr[TPM_STS] = 0x40;
-       rc = tis_wait_sts(tis_addr, 100, 0x40, 0x40);
+       tis_addr[TPM_STS] = STS_COMMAND_READY;
+       rc = tis_wait_sts(tis_addr, 100, STS_COMMAND_READY, STS_COMMAND_READY);
 
        return rc;
 }
@@ -81,8 +97,7 @@ uint32_t tis_senddata(uint32_t baseaddr,
                uint16_t burst = 0;
                uint32_t ctr = 0;
                while (burst == 0 && ctr < 2000) {
-                       burst = (((uint16_t)tis_addr[TPM_STS+1])     ) +
-                               (((uint16_t)tis_addr[TPM_STS+2]) << 8);
+                       burst = mmio_readw((uint16_t *)&tis_addr[TPM_STS+1]);
                        if (burst == 0) {
                                mssleep(1);
                                ctr++;
@@ -120,11 +135,11 @@ uint32_t tis_readresp(uint32_t baseaddr,
        uint32_t sts;
 
        while (offset < len) {
-               buffer[offset] = tis_addr[TPM_DATA_FIFO];
+               buffer[offset] = mmio_readb(&tis_addr[TPM_DATA_FIFO]);
                offset++;
-               sts = tis_addr[TPM_STS];
+               sts = mmio_readb(&tis_addr[TPM_STS]);
                /* data left ? */
-               if ((sts & 0x10) == 0) {
+               if ((sts & STS_DATA_AVAILABLE) == 0) {
                        break;
                }
        }
@@ -136,7 +151,7 @@ uint32_t tis_waitdatavalid(uint32_t base
 {
        uint8_t *tis_addr = (uint8_t*)baseaddr;
        uint32_t rc = 0;
-       if (tis_wait_sts(tis_addr, 1000, 0x80, 0x80) == 0) {
+       if (tis_wait_sts(tis_addr, 1000, STS_VALID, STS_VALID) == 0) {
                rc = TCG_NO_RESPONSE;
        }
        return rc;
@@ -146,8 +161,9 @@ uint32_t tis_waitrespready(uint32_t base
 {
        uint32_t rc = 0;
        uint8_t *tis_addr = (uint8_t*)baseaddr;
-       tis_addr[TPM_STS] = 0x20;
-       if (tis_wait_sts(tis_addr, timeout, 0x10, 0x10) == 0) {
+       tis_addr[TPM_STS] = STS_TPM_GO;
+       if (tis_wait_sts(tis_addr, timeout,
+                        STS_DATA_AVAILABLE, STS_DATA_AVAILABLE) == 0) {
                rc = TCG_NO_RESPONSE;
        }
        return rc;
@@ -158,7 +174,7 @@ uint32_t tis_probe(uint32_t baseaddr)
 {
        uint32_t rc = 0;
        uint8_t *tis_addr = (uint8_t*)baseaddr;
-       uint32_t didvid = *(uint32_t*)&tis_addr[TPM_DID_VID];
+       uint32_t didvid = mmio_readl((uint32_t *)&tis_addr[TPM_DID_VID]);
        if ((didvid != 0) && (didvid != 0xffffffff)) {
                rc = 1;
        }
diff -r aea80dbf6d96 -r 9af0c7e4ff51 tools/firmware/rombios/32bit/util.h
--- a/tools/firmware/rombios/32bit/util.h       Fri Feb 09 14:43:22 2007 -0600
+++ b/tools/firmware/rombios/32bit/util.h       Wed Feb 14 19:01:35 2007 +0000
@@ -24,5 +24,20 @@ void uuid_to_string(char *dest, uint8_t 
 void uuid_to_string(char *dest, uint8_t *uuid);
 int printf(const char *fmt, ...);
 
+static inline uint8_t mmio_readb(uint8_t *addr)
+{
+       return *(volatile uint8_t *)addr;
+}
+
+static inline uint16_t mmio_readw(uint16_t *addr)
+{
+       return *(volatile uint16_t *)addr;
+}
+
+static inline uint32_t mmio_readl(uint32_t *addr)
+{
+       return *(volatile uint32_t *)addr;
+}
+
 
 #endif
diff -r aea80dbf6d96 -r 9af0c7e4ff51 tools/firmware/rombios/rombios.c
--- a/tools/firmware/rombios/rombios.c  Fri Feb 09 14:43:22 2007 -0600
+++ b/tools/firmware/rombios/rombios.c  Wed Feb 14 19:01:35 2007 +0000
@@ -5722,9 +5722,6 @@ int13_cdemu(DS, ES, DI, SI, BP, SP, BX, 
     goto int13_fail;
     }
 
-#if BX_TCGBIOS
-  tcpa_ipl((Bit32u)bootseg);               /* specs: 8.2.3 steps 4 and 5 */
-#endif
   
   switch (GET_AH()) {
 
@@ -7741,6 +7738,10 @@ ASM_END
       }
     }
 
+#if BX_TCGBIOS
+    tcpa_add_bootdevice((Bit32u)0L, (Bit32u)bootdrv);
+#endif
+
     /* Canonicalize bootseg:bootip */
     bootip = (bootseg & 0x0fff) << 4;
     bootseg &= 0xf000;
@@ -7760,6 +7761,9 @@ ASM_END
     bootdrv = (Bit8u)(status>>8);
     bootseg = read_word(ebda_seg,&EbdaData->cdemu.load_segment);
     /* Canonicalize bootseg:bootip */
+#if BX_TCGBIOS
+    tcpa_add_bootdevice((Bit32u)1L, (Bit32u)0L);
+#endif
     bootip = (bootseg & 0x0fff) << 4;
     bootseg &= 0xf000;
     break;
@@ -7773,6 +7777,9 @@ ASM_END
   default: return;
   }
 
+#if BX_TCGBIOS
+  tcpa_ipl((Bit32u)bootseg);               /* specs: 8.2.3 steps 4 and 5 */
+#endif
   /* Debugging info */
   printf("Booting from %x:%x\n", bootseg, bootip);
   
diff -r aea80dbf6d96 -r 9af0c7e4ff51 tools/ioemu/hw/cirrus_vga.c
--- a/tools/ioemu/hw/cirrus_vga.c       Fri Feb 09 14:43:22 2007 -0600
+++ b/tools/ioemu/hw/cirrus_vga.c       Wed Feb 14 19:01:35 2007 +0000
@@ -3339,6 +3339,10 @@ void pci_cirrus_vga_init(PCIBus *bus, Di
     pci_conf[0x0a] = PCI_CLASS_SUB_VGA;
     pci_conf[0x0b] = PCI_CLASS_BASE_DISPLAY;
     pci_conf[0x0e] = PCI_CLASS_HEADERTYPE_00h;
+    pci_conf[0x2c] = 0x53; /* subsystem vendor: XenSource */
+    pci_conf[0x2d] = 0x58;
+    pci_conf[0x2e] = 0x01; /* subsystem device */
+    pci_conf[0x2f] = 0x00;
 
     /* setup VGA */
     s = &d->cirrus_vga;
diff -r aea80dbf6d96 -r 9af0c7e4ff51 tools/ioemu/hw/ide.c
--- a/tools/ioemu/hw/ide.c      Fri Feb 09 14:43:22 2007 -0600
+++ b/tools/ioemu/hw/ide.c      Wed Feb 14 19:01:35 2007 +0000
@@ -2502,6 +2502,10 @@ void pci_piix3_ide_init(PCIBus *bus, Blo
     pci_conf[0x0a] = 0x01; // class_sub = PCI_IDE
     pci_conf[0x0b] = 0x01; // class_base = PCI_mass_storage
     pci_conf[0x0e] = 0x00; // header_type
+    pci_conf[0x2c] = 0x53; /* subsystem vendor: XenSource */
+    pci_conf[0x2d] = 0x58;
+    pci_conf[0x2e] = 0x01; /* subsystem device */
+    pci_conf[0x2f] = 0x00;
 
     pci_register_io_region((PCIDevice *)d, 4, 0x10, 
                            PCI_ADDRESS_SPACE_IO, bmdma_map);
diff -r aea80dbf6d96 -r 9af0c7e4ff51 tools/ioemu/hw/rtl8139.c
--- a/tools/ioemu/hw/rtl8139.c  Fri Feb 09 14:43:22 2007 -0600
+++ b/tools/ioemu/hw/rtl8139.c  Wed Feb 14 19:01:35 2007 +0000
@@ -3423,8 +3423,10 @@ void pci_rtl8139_init(PCIBus *bus, NICIn
     pci_conf[0x0e] = 0x00; /* header_type */
     pci_conf[0x3d] = 1;    /* interrupt pin 0 */
     pci_conf[0x34] = 0xdc;
-    pci_conf[0x2c] = pci_conf[0x00]; // same as Vendor ID
-    pci_conf[0x2d] = pci_conf[0x01];
+    pci_conf[0x2c] = 0x53; /* subsystem vendor: XenSource */
+    pci_conf[0x2d] = 0x58;
+    pci_conf[0x2e] = 0x01; /* subsystem device */
+    pci_conf[0x2f] = 0x00;
 
     s = &d->rtl8139;
 
diff -r aea80dbf6d96 -r 9af0c7e4ff51 tools/ioemu/hw/tpm_tis.c
--- a/tools/ioemu/hw/tpm_tis.c  Fri Feb 09 14:43:22 2007 -0600
+++ b/tools/ioemu/hw/tpm_tis.c  Wed Feb 14 19:01:35 2007 +0000
@@ -517,7 +517,7 @@ static uint32_t tis_mem_readl(void *opaq
 
 #ifdef DEBUG_TPM
     fprintf(logfile," read(%08x) = %08x\n",
-            addr,
+            (int)addr,
             val);
 #endif
 
@@ -538,7 +538,7 @@ static void tis_mem_writel(void *opaque,
 
 #ifdef DEBUG_TPM
     fprintf(logfile,"write(%08x) = %08x\n",
-            addr,
+            (int)addr,
             val);
 #endif
 
@@ -757,10 +757,11 @@ static void tpm_save(QEMUFile* f,void* o
 static void tpm_save(QEMUFile* f,void* opaque)
 {
     tpmState* s=(tpmState*)opaque;
+    uint8_t locty = s->active_loc;
     int c;
 
     /* need to wait for outstanding requests to complete */
-    if (IS_COMM_WITH_VTPM(s)) {
+    if (s->loc[locty].state == STATE_EXECUTION) {
         int repeats = 30; /* 30 seconds; really should be infty */
         while (repeats > 0 &&
                !(s->loc[s->active_loc].sts & STS_DATA_AVAILABLE)) {
@@ -777,6 +778,10 @@ static void tpm_save(QEMUFile* f,void* o
         }
     }
 
+    if (IS_COMM_WITH_VTPM(s)) {
+        close_vtpm_channel(s, 1);
+    }
+
     qemu_put_be32s(f,&s->offset);
     qemu_put_buffer(f, s->buffer.buf, TPM_MAX_PKT);
     qemu_put_8s(f, &s->active_loc);
@@ -993,7 +998,7 @@ static int TPM_Receive(tpmState *s, tpmB
         uint32_t size = tpm_get_size_from_buffer(buffer->buf);
         if (size + sizeof(buffer->instance) != off) {
             fprintf(logfile,"TPM: Packet size is bad! %d != %d\n",
-                    size + sizeof(buffer->instance),
+                    (int)(size + sizeof(buffer->instance)),
                     off);
         } else {
             uint32_t ret;
diff -r aea80dbf6d96 -r 9af0c7e4ff51 tools/ioemu/xenstore.c
--- a/tools/ioemu/xenstore.c    Fri Feb 09 14:43:22 2007 -0600
+++ b/tools/ioemu/xenstore.c    Wed Feb 14 19:01:35 2007 +0000
@@ -10,6 +10,7 @@
 
 #include "vl.h"
 #include "block_int.h"
+#include <unistd.h>
 
 static struct xs_handle *xsh = NULL;
 static char *hd_filename[MAX_DISKS];
@@ -52,11 +53,40 @@ void xenstore_check_new_media_present(in
     qemu_mod_timer(insert_timer, qemu_get_clock(rt_clock) + timeout);
 }
 
+static int waitForDevice(char *path, char *field, char *desired)
+{ 
+    char *buf = NULL, *stat = NULL;
+    unsigned int len;
+    int val = 1;
+
+    /* loop until we find a value in xenstore, return 
+     * if it was what we wanted, or not
+     */
+    while (1) {
+        if (pasprintf(&buf, "%s/%s", path, field) == -1)
+            goto done;
+        free(stat);
+        stat = xs_read(xsh, XBT_NULL, buf, &len);
+        if (stat == NULL) {
+            usleep(100000); /* 1/10th second, no path found */
+        } else {
+            val = strcmp(stat, desired);
+            goto done;
+        }
+    }
+
+done:
+    free(stat);
+    free(buf);
+    return val;
+}
+
 void xenstore_parse_domain_config(int domid)
 {
     char **e = NULL;
     char *buf = NULL, *path;
-    char *bpath = NULL, *dev = NULL, *params = NULL, *type = NULL;
+    char *fpath = NULL, *bpath = NULL,
+         *dev = NULL, *params = NULL, *type = NULL;
     int i;
     unsigned int len, num, hd_index;
 
@@ -120,7 +150,35 @@ void xenstore_parse_domain_config(int do
            hd_filename[hd_index] = params;     /* strdup() */
            params = NULL;              /* don't free params on re-use */
        }
+        /* 
+         * check if device has a phantom vbd; the phantom is hooked
+         * to the frontend device (for ease of cleanup), so lookup 
+         * the frontend device, and see if there is a phantom_vbd
+         * if there is, we will use resolution as the filename
+         */
+       if (pasprintf(&buf, "%s/device/vbd/%s/phantom_vbd", path, e[i]) == -1)
+           continue;
+       free(fpath);
+        fpath = xs_read(xsh, XBT_NULL, buf, &len);
+       if (fpath != NULL) {
+
+            if (waitForDevice(fpath, "hotplug-status", "connected")) {
+               continue;
+            }
+
+           if (pasprintf(&buf, "%s/dev", fpath) == -1)
+               continue;
+            params = xs_read(xsh, XBT_NULL, buf , &len);
+           if (params != NULL) {
+                free(hd_filename[hd_index]);
+                hd_filename[hd_index] = params;
+                params = NULL;              /* don't free params on re-use */
+            }
+        }
        bs_table[hd_index] = bdrv_new(dev);
+        /* re-establish buf */
+       if (pasprintf(&buf, "%s/params", bpath) == -1)
+           continue;
        /* check if it is a cdrom */
        if (type && !strcmp(type, "cdrom")) {
            bdrv_set_type_hint(bs_table[hd_index], BDRV_TYPE_CDROM);
diff -r aea80dbf6d96 -r 9af0c7e4ff51 tools/libxc/xc_domain.c
--- a/tools/libxc/xc_domain.c   Fri Feb 09 14:43:22 2007 -0600
+++ b/tools/libxc/xc_domain.c   Wed Feb 14 19:01:35 2007 +0000
@@ -252,12 +252,14 @@ int xc_domain_hvm_getcontext(int xc_hand
     domctl.u.hvmcontext.size = size;
     set_xen_guest_handle(domctl.u.hvmcontext.buffer, ctxt_buf);
 
-    if ( (ret = lock_pages(ctxt_buf, size)) != 0 )
-        return ret;
+    if ( ctxt_buf ) 
+        if ( (ret = lock_pages(ctxt_buf, size)) != 0 )
+            return ret;
 
     ret = do_domctl(xc_handle, &domctl);
 
-    unlock_pages(ctxt_buf, size);
+    if ( ctxt_buf ) 
+        unlock_pages(ctxt_buf, size);
 
     return (ret < 0 ? -1 : domctl.u.hvmcontext.size);
 }
diff -r aea80dbf6d96 -r 9af0c7e4ff51 tools/libxc/xc_hvm_restore.c
--- a/tools/libxc/xc_hvm_restore.c      Fri Feb 09 14:43:22 2007 -0600
+++ b/tools/libxc/xc_hvm_restore.c      Wed Feb 14 19:01:35 2007 +0000
@@ -41,11 +41,8 @@ static unsigned long hvirt_start;
 /* #levels of page tables used by the currrent guest */
 static unsigned int pt_levels;
 
-/* total number of pages used by the current guest */
-static unsigned long max_pfn;
-
-/* A table mapping each PFN to its new MFN. */
-static xen_pfn_t *p2m = NULL;
+/* A list of PFNs that exist, used when allocating memory to the guest */
+static xen_pfn_t *pfns = NULL;
 
 static ssize_t
 read_exact(int fd, void *buf, size_t count)
@@ -67,9 +64,8 @@ read_exact(int fd, void *buf, size_t cou
 }
 
 int xc_hvm_restore(int xc_handle, int io_fd,
-                     uint32_t dom, unsigned long nr_pfns,
+                     uint32_t dom, unsigned long max_pfn,
                      unsigned int store_evtchn, unsigned long *store_mfn,
-                     unsigned int console_evtchn, unsigned long *console_mfn,
                      unsigned int pae, unsigned int apic)
 {
     DECLARE_DOMCTL;
@@ -91,7 +87,7 @@ int xc_hvm_restore(int xc_handle, int io
     unsigned long long v_end, memsize;
     unsigned long shared_page_nr;
 
-    unsigned long mfn, pfn;
+    unsigned long pfn;
     unsigned int prev_pc, this_pc;
     int verify = 0;
 
@@ -99,23 +95,27 @@ int xc_hvm_restore(int xc_handle, int io
     unsigned long region_pfn_type[MAX_BATCH_SIZE];
 
     struct xen_add_to_physmap xatp;
+
+    /* Number of pages of memory the guest has.  *Not* the same as max_pfn. */
+    unsigned long nr_pages;
 
     /* hvm guest mem size (Mb) */
     memsize = (unsigned long long)*store_mfn;
     v_end = memsize << 20;
-
-    DPRINTF("xc_hvm_restore:dom=%d, nr_pfns=0x%lx, store_evtchn=%d, 
*store_mfn=%ld, console_evtchn=%d, *console_mfn=%ld, pae=%u, apic=%u.\n", 
-            dom, nr_pfns, store_evtchn, *store_mfn, console_evtchn, 
*console_mfn, pae, apic);
-
-    max_pfn = nr_pfns;
-
+    nr_pages = (unsigned long) memsize << (20 - PAGE_SHIFT);
+
+    DPRINTF("xc_hvm_restore:dom=%d, nr_pages=0x%lx, store_evtchn=%d, 
*store_mfn=%ld, pae=%u, apic=%u.\n", 
+            dom, nr_pages, store_evtchn, *store_mfn, pae, apic);
+
+    
     if(!get_platform_info(xc_handle, dom,
                           &max_mfn, &hvirt_start, &pt_levels)) {
         ERROR("Unable to get platform info.");
         return 1;
     }
 
-    DPRINTF("xc_hvm_restore start: max_pfn = %lx, max_mfn = %lx, 
hvirt_start=%lx, pt_levels=%d\n",
+    DPRINTF("xc_hvm_restore start: nr_pages = %lx, max_pfn = %lx, max_mfn = 
%lx, hvirt_start=%lx, pt_levels=%d\n",
+            nr_pages,
             max_pfn,
             max_mfn,
             hvirt_start,
@@ -128,30 +128,30 @@ int xc_hvm_restore(int xc_handle, int io
     }
 
 
-    p2m = malloc(max_pfn * sizeof(xen_pfn_t));
-    if (p2m == NULL) {
+    pfns = malloc(max_pfn * sizeof(xen_pfn_t));
+    if (pfns == NULL) {
         ERROR("memory alloc failed");
         errno = ENOMEM;
         goto out;
     }
 
-    if(xc_domain_setmaxmem(xc_handle, dom, PFN_TO_KB(max_pfn)) != 0) {
+    if(xc_domain_setmaxmem(xc_handle, dom, PFN_TO_KB(nr_pages)) != 0) {
         errno = ENOMEM;
         goto out;
     }
 
     for ( i = 0; i < max_pfn; i++ )
-        p2m[i] = i;
+        pfns[i] = i;
     for ( i = HVM_BELOW_4G_RAM_END >> PAGE_SHIFT; i < max_pfn; i++ )
-        p2m[i] += HVM_BELOW_4G_MMIO_LENGTH >> PAGE_SHIFT;
+        pfns[i] += HVM_BELOW_4G_MMIO_LENGTH >> PAGE_SHIFT;
 
     /* Allocate memory for HVM guest, skipping VGA hole 0xA0000-0xC0000. */
     rc = xc_domain_memory_populate_physmap(
-        xc_handle, dom, (max_pfn > 0xa0) ? 0xa0 : max_pfn,
-        0, 0, &p2m[0x00]);
-    if ( (rc == 0) && (max_pfn > 0xc0) )
+        xc_handle, dom, (nr_pages > 0xa0) ? 0xa0 : nr_pages,
+        0, 0, &pfns[0x00]);
+    if ( (rc == 0) && (nr_pages > 0xc0) )
         rc = xc_domain_memory_populate_physmap(
-            xc_handle, dom, max_pfn - 0xc0, 0, 0, &p2m[0xc0]);
+            xc_handle, dom, nr_pages - 0xc0, 0, 0, &pfns[0xc0]);
     if ( rc != 0 )
     {
         PERROR("Could not allocate memory for HVM guest.\n");
@@ -172,9 +172,6 @@ int xc_hvm_restore(int xc_handle, int io
         goto out;
     }
 
-    for ( i = 0; i < max_pfn; i++)
-        p2m[i] = i;
-
     prev_pc = 0;
 
     n = 0;
@@ -182,7 +179,7 @@ int xc_hvm_restore(int xc_handle, int io
 
         int j;
 
-        this_pc = (n * 100) / max_pfn;
+        this_pc = (n * 100) / nr_pages;
         if ( (this_pc - prev_pc) >= 5 )
         {
             PPRINTF("\b\b\b\b%3d%%", this_pc);
@@ -235,8 +232,6 @@ int xc_hvm_restore(int xc_handle, int io
             }
 
 
-            mfn = p2m[pfn];
-
             /* In verify mode, we use a copy; otherwise we work in place */
             page = verify ? (void *)buf : (region_base + i*PAGE_SIZE);
 
@@ -253,8 +248,8 @@ int xc_hvm_restore(int xc_handle, int io
 
                     int v;
 
-                    DPRINTF("************** pfn=%lx mfn=%lx gotcs=%08lx "
-                            "actualcs=%08lx\n", pfn, p2m[pfn],
+                    DPRINTF("************** pfn=%lx gotcs=%08lx "
+                            "actualcs=%08lx\n", pfn, 
                             csum_page(region_base + i*PAGE_SIZE),
                             csum_page(buf));
 
@@ -362,7 +357,7 @@ int xc_hvm_restore(int xc_handle, int io
  out:
     if ( (rc != 0) && (dom != 0) )
         xc_domain_destroy(xc_handle, dom);
-    free(p2m);
+    free(pfns);
     free(hvm_buf);
 
     DPRINTF("Restore exit with rc=%d\n", rc);
diff -r aea80dbf6d96 -r 9af0c7e4ff51 tools/libxc/xc_hvm_save.c
--- a/tools/libxc/xc_hvm_save.c Fri Feb 09 14:43:22 2007 -0600
+++ b/tools/libxc/xc_hvm_save.c Wed Feb 14 19:01:35 2007 +0000
@@ -27,16 +27,11 @@
 #include <stdlib.h>
 #include <unistd.h>
 #include <sys/time.h>
+#include <xen/hvm/e820.h>
 
 #include "xc_private.h"
 #include "xg_private.h"
 #include "xg_save_restore.h"
-
-/*
- * Size of a buffer big enough to take the HVM state of a domain.
- * Ought to calculate this a bit more carefully, or maybe ask Xen.
- */
-#define HVM_CTXT_SIZE 8192
 
 /*
 ** Default values for important tuning parameters. Can override by passing
@@ -281,11 +276,11 @@ int xc_hvm_save(int xc_handle, int io_fd
     /* A copy of the CPU context of the guest. */
     vcpu_guest_context_t ctxt;
 
-    /* A table containg the type of each PFN (/not/ MFN!). */
-    unsigned long *pfn_type = NULL;
-    unsigned long *pfn_batch = NULL;
+    /* A table containg the PFNs (/not/ MFN!) to map. */
+    xen_pfn_t *pfn_batch = NULL;
 
     /* A copy of hvm domain context buffer*/
+    uint32_t hvm_buf_size;
     uint8_t *hvm_buf = NULL;
 
     /* Live mapping of shared info structure */
@@ -295,7 +290,6 @@ int xc_hvm_save(int xc_handle, int io_fd
     unsigned char *region_base = NULL;
 
     uint32_t nr_pfns, rec_size, nr_vcpus;
-    unsigned long *page_array = NULL;
 
     /* power of 2 order of max_pfn */
     int order_nr;
@@ -366,18 +360,12 @@ int xc_hvm_save(int xc_handle, int io_fd
         goto out;
     }
 
-    max_pfn = live_shinfo->arch.max_pfn;
-
     DPRINTF("saved hvm domain info:max_memkb=0x%lx, max_mfn=0x%lx, 
nr_pages=0x%lx\n", info.max_memkb, max_mfn, info.nr_pages); 
 
-    /* nr_pfns: total pages excluding vga acc mem
-     * max_pfn: nr_pfns + 0x20 vga hole(0xa0~0xc0)
-     * getdomaininfo.tot_pages: all the allocated pages for this domain
-     */
     if (live) {
         ERROR("hvm domain doesn't support live migration now.\n");
         goto out;
-
+        
         if (xc_shadow_control(xc_handle, dom,
                               XEN_DOMCTL_SHADOW_OP_ENABLE_LOGDIRTY,
                               NULL, 0, NULL, 0, NULL) < 0) {
@@ -386,6 +374,7 @@ int xc_hvm_save(int xc_handle, int io_fd
         }
 
         /* excludes vga acc mem */
+        /* XXX will need to check whether acceleration is enabled here! */
         nr_pfns = info.nr_pages - 0x800;
 
         last_iter = 0;
@@ -401,8 +390,8 @@ int xc_hvm_save(int xc_handle, int io_fd
             ERROR("HVM Domain appears not to have suspended");
             goto out;
         }
-        nr_pfns = info.nr_pages;
-        DPRINTF("after suspend hvm domain nr_pages=0x%x.\n", nr_pfns);
+
+        nr_pfns = info.nr_pages; 
     }
 
     DPRINTF("after 1st handle hvm domain nr_pfns=0x%x, nr_pages=0x%lx, 
max_memkb=0x%lx, live=%d.\n",
@@ -411,10 +400,15 @@ int xc_hvm_save(int xc_handle, int io_fd
             info.max_memkb,
             live);
 
-    nr_pfns = info.nr_pages;
-
-    /*XXX: caculate the VGA hole*/
-    max_pfn = nr_pfns + 0x20;
+    /* Calculate the highest PFN of "normal" memory:
+     * HVM memory is sequential except for the VGA and MMIO holes, and
+     * we have nr_pfns of it (which now excludes the cirrus video RAM) */
+    max_pfn = nr_pfns; 
+    /* Skip the VGA hole from 0xa0000 to 0xc0000 */
+    max_pfn += 0x20;   
+    /* Skip the MMIO hole: 256MB just below 4GB */
+    if ( max_pfn >= (HVM_BELOW_4G_MMIO_START >> PAGE_SHIFT) )
+        max_pfn += (HVM_BELOW_4G_MMIO_LENGTH >> PAGE_SHIFT); 
 
     skip_this_iter = 0;/*XXX*/
     /* pretend we sent all the pages last iteration */
@@ -429,11 +423,16 @@ int xc_hvm_save(int xc_handle, int io_fd
     to_send = malloc(BITMAP_SIZE);
     to_skip = malloc(BITMAP_SIZE);
 
-    page_array = (unsigned long *) malloc( sizeof(unsigned long) * max_pfn);
-
-    hvm_buf = malloc(HVM_CTXT_SIZE);
-
-    if (!to_send ||!to_skip ||!page_array ||!hvm_buf ) {
+
+    hvm_buf_size = xc_domain_hvm_getcontext(xc_handle, dom, 0, 0);
+    if ( hvm_buf_size == -1 )
+    {
+        ERROR("Couldn't get HVM context size from Xen");
+        goto out;
+    }
+    hvm_buf = malloc(hvm_buf_size);
+
+    if (!to_send ||!to_skip ||!hvm_buf) {
         ERROR("Couldn't allocate memory");
         goto out;
     }
@@ -453,23 +452,13 @@ int xc_hvm_save(int xc_handle, int io_fd
 
     analysis_phase(xc_handle, dom, max_pfn, to_skip, 0);
 
-    /* get all the HVM domain pfns */
-    for ( i = 0; i < max_pfn; i++)
-        page_array[i] = i;
-
 
     /* We want zeroed memory so use calloc rather than malloc. */
-    pfn_type  = calloc(MAX_BATCH_SIZE, sizeof(*pfn_type));
     pfn_batch = calloc(MAX_BATCH_SIZE, sizeof(*pfn_batch));
 
-    if ((pfn_type == NULL) || (pfn_batch == NULL)) {
-        ERROR("failed to alloc memory for pfn_type and/or pfn_batch arrays");
+    if (pfn_batch == NULL) {
+        ERROR("failed to alloc memory for pfn_batch array");
         errno = ENOMEM;
-        goto out;
-    }
-
-    if (lock_pages(pfn_type, MAX_BATCH_SIZE * sizeof(*pfn_type))) {
-        ERROR("Unable to lock");
         goto out;
     }
 
@@ -510,16 +499,15 @@ int xc_hvm_save(int xc_handle, int io_fd
             }
 
 
-            /* load pfn_type[] with the mfn of all the pages we're doing in
+            /* load pfn_batch[] with the mfn of all the pages we're doing in
                this batch. */
             for (batch = 0; batch < MAX_BATCH_SIZE && N < max_pfn ; N++) {
 
                 int n = permute(N, max_pfn, order_nr);
 
                 if (debug) {
-                    DPRINTF("%d pfn= %08lx mfn= %08lx %d \n",
-                            iter, (unsigned long)n, page_array[n],
-                            test_bit(n, to_send));
+                    DPRINTF("%d pfn= %08lx %d \n",
+                            iter, (unsigned long)n, test_bit(n, to_send));
                 }
 
                 if (!last_iter && test_bit(n, to_send)&& test_bit(n, to_skip))
@@ -529,10 +517,12 @@ int xc_hvm_save(int xc_handle, int io_fd
                       (test_bit(n, to_send) && last_iter)))
                     continue;
 
-                if (n >= 0xa0 && n < 0xc0) {
-/*                    DPRINTF("get a vga hole pfn= %x.\n", n);*/
+                /* Skip PFNs that aren't really there */
+                if ((n >= 0xa0 && n < 0xc0) /* VGA hole */
+                    || (n >= (HVM_BELOW_4G_MMIO_START >> PAGE_SHIFT)
+                        && n < (1ULL << 32) >> PAGE_SHIFT)) /* 4G MMIO hole */
                     continue;
-                }
+
                 /*
                 ** we get here if:
                 **  1. page is marked to_send & hasn't already been re-dirtied
@@ -540,7 +530,6 @@ int xc_hvm_save(int xc_handle, int io_fd
                 */
 
                 pfn_batch[batch] = n;
-                pfn_type[batch]  = page_array[n];
 
                 batch++;
             }
@@ -572,7 +561,6 @@ int xc_hvm_save(int xc_handle, int io_fd
                 goto out;
             }
 
-
             sent_this_iter += batch;
 
             munmap(region_base, batch*PAGE_SIZE);
@@ -661,7 +649,7 @@ int xc_hvm_save(int xc_handle, int io_fd
     }
 
     if ( (rec_size = xc_domain_hvm_getcontext(xc_handle, dom, hvm_buf, 
-                                              HVM_CTXT_SIZE)) == -1) {
+                                              hvm_buf_size)) == -1) {
         ERROR("HVM:Could not get hvm buffer");
         goto out;
     }
@@ -722,9 +710,6 @@ int xc_hvm_save(int xc_handle, int io_fd
     }
 
     free(hvm_buf);
-    free(page_array);
-
-    free(pfn_type);
     free(pfn_batch);
     free(to_send);
     free(to_skip);
diff -r aea80dbf6d96 -r 9af0c7e4ff51 tools/libxc/xenguest.h
--- a/tools/libxc/xenguest.h    Fri Feb 09 14:43:22 2007 -0600
+++ b/tools/libxc/xenguest.h    Wed Feb 14 19:01:35 2007 +0000
@@ -57,9 +57,8 @@ int xc_linux_restore(int xc_handle, int 
  * @return 0 on success, -1 on failure
  */
 int xc_hvm_restore(int xc_handle, int io_fd, uint32_t dom,
-                      unsigned long nr_pfns, unsigned int store_evtchn,
-                      unsigned long *store_mfn, unsigned int console_evtchn,
-                      unsigned long *console_mfn,
+                      unsigned long max_pfn, unsigned int store_evtchn,
+                      unsigned long *store_mfn, 
                       unsigned int pae, unsigned int apic);
 
 /**
diff -r aea80dbf6d96 -r 9af0c7e4ff51 tools/libxc/xg_private.c
--- a/tools/libxc/xg_private.c  Fri Feb 09 14:43:22 2007 -0600
+++ b/tools/libxc/xg_private.c  Wed Feb 14 19:01:35 2007 +0000
@@ -209,9 +209,8 @@ int xc_hvm_save(int xc_handle, int io_fd
 
 __attribute__((weak)) 
 int xc_hvm_restore(int xc_handle, int io_fd, uint32_t dom,
-                   unsigned long nr_pfns, unsigned int store_evtchn,
-                   unsigned long *store_mfn, unsigned int console_evtchn,
-                   unsigned long *console_mfn,
+                   unsigned long max_pfn, unsigned int store_evtchn,
+                   unsigned long *store_mfn,
                    unsigned int pae, unsigned int apic)
 {
     errno = ENOSYS;
diff -r aea80dbf6d96 -r 9af0c7e4ff51 tools/misc/Makefile
--- a/tools/misc/Makefile       Fri Feb 09 14:43:22 2007 -0600
+++ b/tools/misc/Makefile       Wed Feb 14 19:01:35 2007 +0000
@@ -9,7 +9,9 @@ CFLAGS   += $(INCLUDES)
 
 HDRS     = $(wildcard *.h)
 
-TARGETS  = xenperf xc_shadow
+TARGETS-y := xenperf xc_shadow
+TARGETS-$(CONFIG_X86) += xen-detect
+TARGETS := $(TARGETS-y)
 
 INSTALL_BIN  = $(TARGETS) xencons
 INSTALL_SBIN = netfix xm xen-bugtool xen-python-path xend xenperf
@@ -41,5 +43,5 @@ clean:
 %.o: %.c $(HDRS) Makefile
        $(CC) -c $(CFLAGS) -o $@ $<
 
-$(TARGETS): %: %.o Makefile
+xenperf xc_shadow: %: %.o Makefile
        $(CC) $(CFLAGS) -o $@ $< -L$(XEN_LIBXC) -lxenctrl
diff -r aea80dbf6d96 -r 9af0c7e4ff51 tools/misc/xen-detect.c
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/tools/misc/xen-detect.c   Wed Feb 14 19:01:35 2007 +0000
@@ -0,0 +1,108 @@
+/******************************************************************************
+ * xen_detect.c
+ * 
+ * Simple GNU C / POSIX application to detect execution on Xen VMM platform.
+ * 
+ * Copyright (c) 2007, XenSource Inc.
+ * 
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to
+ * deal in the Software without restriction, including without limitation the
+ * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+ * sell copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+static int pv_context;
+
+static void cpuid(uint32_t idx,
+                  uint32_t *eax,
+                  uint32_t *ebx,
+                  uint32_t *ecx,
+                  uint32_t *edx)
+{
+    asm volatile (
+        "test %1,%1 ; jz 1f ; ud2a ; .ascii \"xen\" ; 1: cpuid"
+        : "=a" (*eax), "=b" (*ebx), "=c" (*ecx), "=d" (*edx)
+        : "0" (idx), "1" (pv_context) );
+}
+
+static int check_for_xen(void)
+{
+    uint32_t eax, ebx, ecx, edx;
+    char signature[13];
+
+    cpuid(0x40000000, &eax, &ebx, &ecx, &edx);
+    *(uint32_t *)(signature + 0) = ebx;
+    *(uint32_t *)(signature + 4) = ecx;
+    *(uint32_t *)(signature + 8) = edx;
+    signature[12] = '\0';
+
+    if ( strcmp("XenVMMXenVMM", signature) || (eax < 0x40000002) )
+        return 0;
+
+    cpuid(0x40000001, &eax, &ebx, &ecx, &edx);
+    printf("Running in %s context on Xen v%d.%d.\n",
+           pv_context ? "PV" : "HVM", (uint16_t)(eax >> 16), (uint16_t)eax);
+    return 1;
+}
+
+int main(void)
+{
+    pid_t pid;
+    int status;
+    uint32_t dummy;
+
+    /* Check for execution in HVM context. */
+    if ( check_for_xen() )
+        return 0;
+
+    /* Now we check for execution in PV context. */
+    pv_context = 1;
+
+    /*
+     * Fork a child to test the paravirtualised CPUID instruction.
+     * If executed outside Xen PV context, the extended opcode will fault.
+     */
+    pid = fork();
+    switch ( pid )
+    {
+    case 0:
+        /* Child: test paravirtualised CPUID opcode and then exit cleanly. */
+        cpuid(0x40000000, &dummy, &dummy, &dummy, &dummy);
+        exit(0);
+    case -1:
+        fprintf(stderr, "Fork failed.\n");
+        return 0;
+    }
+
+    /*
+     * Parent waits for child to terminate and checks for clean exit.
+     * Only if the exit is clean is it safe for us to try the extended CPUID.
+     */
+    waitpid(pid, &status, 0);
+    if ( WIFEXITED(status) && check_for_xen() )
+        return 0;
+
+    printf("Not running on Xen.\n");
+    return 0;
+}
diff -r aea80dbf6d96 -r 9af0c7e4ff51 tools/python/xen/xend/XendCheckpoint.py
--- a/tools/python/xen/xend/XendCheckpoint.py   Fri Feb 09 14:43:22 2007 -0600
+++ b/tools/python/xen/xend/XendCheckpoint.py   Wed Feb 14 19:01:35 2007 +0000
@@ -239,8 +239,11 @@ def restore(xd, fd, dominfo = None, paus
 
         forkHelper(cmd, fd, handler.handler, True)
 
-        if handler.store_mfn is None or handler.console_mfn is None:
-            raise XendError('Could not read store/console MFN')
+        if handler.store_mfn is None:
+            raise XendError('Could not read store MFN')
+
+        if not is_hvm and handler.console_mfn is None:
+            raise XendError('Could not read console MFN')        
 
         dominfo.waitForDevices() # Wait for backends to set up
         if not paused:
diff -r aea80dbf6d96 -r 9af0c7e4ff51 tools/python/xen/xend/XendConfig.py
--- a/tools/python/xen/xend/XendConfig.py       Fri Feb 09 14:43:22 2007 -0600
+++ b/tools/python/xen/xend/XendConfig.py       Wed Feb 14 19:01:35 2007 +0000
@@ -1148,6 +1148,47 @@ class XendConfig(dict):
         # no valid device to add
         return ''
 
+    def phantom_device_add(self, dev_type, cfg_xenapi = None,
+                   target = None):
+        """Add a phantom tap device configuration in XenAPI struct format.
+        """
+
+        if target == None:
+            target = self
+        
+        if dev_type not in XendDevices.valid_devices() and \
+           dev_type not in XendDevices.pseudo_devices():        
+            raise XendConfigError("XendConfig: %s not a valid device type" %
+                            dev_type)
+
+        if cfg_xenapi == None:
+            raise XendConfigError("XendConfig: device_add requires some "
+                                  "config.")
+
+        if cfg_xenapi:
+            log.debug("XendConfig.phantom_device_add: %s" % str(cfg_xenapi))
+ 
+        if cfg_xenapi:
+            dev_info = {}            
+            if dev_type in ('vbd', 'tap'):
+                if dev_type == 'vbd':
+                    dev_info['uname'] = cfg_xenapi.get('image', '')
+                    dev_info['dev'] = '%s:disk' % cfg_xenapi.get('device')
+                elif dev_type == 'tap':
+                    if cfg_xenapi.get('image').find('tap:') == -1:
+                        dev_info['uname'] = 'tap:qcow:%s' % 
cfg_xenapi.get('image')
+                    dev_info['dev'] =  '/dev/%s' % cfg_xenapi.get('device')
+                    dev_info['uname'] = cfg_xenapi.get('image')
+                dev_info['mode'] = cfg_xenapi.get('mode')
+                dev_info['backend'] = '0'
+                dev_uuid = cfg_xenapi.get('uuid', uuid.createString())
+                dev_info['uuid'] = dev_uuid
+                self['devices'][dev_uuid] = (dev_type, dev_info)
+                self['vbd_refs'].append(dev_uuid)
+                return dev_uuid
+
+        return ''
+
     def console_add(self, protocol, location, other_config = {}):
         dev_uuid = uuid.createString()
         if protocol == 'vt100':
diff -r aea80dbf6d96 -r 9af0c7e4ff51 tools/python/xen/xend/XendDomain.py
--- a/tools/python/xen/xend/XendDomain.py       Fri Feb 09 14:43:22 2007 -0600
+++ b/tools/python/xen/xend/XendDomain.py       Wed Feb 14 19:01:35 2007 +0000
@@ -800,7 +800,10 @@ class XendDomain:
                                 "support.")
 
             path = self._managed_check_point_path(dom_uuid)
-            fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC)
+            oflags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
+            if hasattr(os, "O_LARGEFILE"):
+                oflags |= os.O_LARGEFILE
+            fd = os.open(path, oflags)
             try:
                 # For now we don't support 'live checkpoint' 
                 XendCheckpoint.save(fd, dominfo, False, False, path)
@@ -840,8 +843,11 @@ class XendDomain:
                 # Restore that replaces the existing XendDomainInfo
                 try:
                     log.debug('Current DomainInfo state: %d' % dominfo.state)
+                    oflags = os.O_RDONLY
+                    if hasattr(os, "O_LARGEFILE"):
+                        oflags |= os.O_LARGEFILE
                     XendCheckpoint.restore(self,
-                                           os.open(chkpath, os.O_RDONLY),
+                                           os.open(chkpath, oflags),
                                            dominfo,
                                            paused = start_paused)
                     os.unlink(chkpath)
@@ -1009,7 +1015,10 @@ class XendDomain:
         @raise XendError: Failure to restore domain
         """
         try:
-            fd = os.open(src, os.O_RDONLY)
+            oflags = os.O_RDONLY
+            if hasattr(os, "O_LARGEFILE"):
+                oflags |= os.O_LARGEFILE
+            fd = os.open(src, oflags)
             try:
                 return self.domain_restore_fd(fd, paused=paused)
             finally:
@@ -1193,7 +1202,10 @@ class XendDomain:
             if dominfo.getDomid() == DOM0_ID:
                 raise XendError("Cannot save privileged domain %i" % domid)
 
-            fd = os.open(dst, os.O_WRONLY | os.O_CREAT | os.O_TRUNC)
+            oflags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
+            if hasattr(os, "O_LARGEFILE"):
+                oflags |= os.O_LARGEFILE
+            fd = os.open(dst, oflags)
             try:
                 # For now we don't support 'live checkpoint' 
                 XendCheckpoint.save(fd, dominfo, False, False, dst)
diff -r aea80dbf6d96 -r 9af0c7e4ff51 tools/python/xen/xend/XendDomainInfo.py
--- a/tools/python/xen/xend/XendDomainInfo.py   Fri Feb 09 14:43:22 2007 -0600
+++ b/tools/python/xen/xend/XendDomainInfo.py   Wed Feb 14 19:01:35 2007 +0000
@@ -1416,7 +1416,7 @@ class XendDomainInfo:
                                       self.info['image'],
                                       self.info['devices'])
 
-            localtime = self.info.get('localtime', False)
+            localtime = self.info.get('platform_localtime', False)
             if localtime:
                 xc.domain_set_time_offset(self.domid)
 
@@ -1565,18 +1565,53 @@ class XendDomainInfo:
     # VM Destroy
     # 
 
+    def _prepare_phantom_paths(self):
+        # get associated devices to destroy
+        # build list of phantom devices to be removed after normal devices
+        plist = []
+        from xen.xend.xenstore.xstransact import xstransact
+        t = xstransact("%s/device/vbd" % GetDomainPath(self.domid))
+        for dev in t.list():
+            backend_phantom_vbd = 
xstransact.Read("%s/device/vbd/%s/phantom_vbd" \
+                                  % (self.dompath, dev))
+            if backend_phantom_vbd is not None:
+                frontend_phantom_vbd =  xstransact.Read("%s/frontend" \
+                                  % backend_phantom_vbd)
+                plist.append(backend_phantom_vbd)
+                plist.append(frontend_phantom_vbd)
+        return plist
+
+    def _cleanup_phantom_devs(self, plist):
+        # remove phantom devices
+        if not plist == []:
+            time.sleep(2)
+        for paths in plist:
+            if paths.find('backend') != -1:
+                from xen.xend.server import DevController
+                # Modify online status /before/ updating state (latter is 
watched by
+                # drivers, so this ordering avoids a race).
+                xstransact.Write(paths, 'online', "0")
+                xstransact.Write(paths, 'state', 
str(DevController.xenbusState['Closing']))
+            # force
+            xstransact.Remove(paths)
+
     def destroy(self):
         """Cleanup VM and destroy domain.  Nothrow guarantee."""
 
         log.debug("XendDomainInfo.destroy: domid=%s", str(self.domid))
+
+        paths = self._prepare_phantom_paths()
 
         self._cleanupVm()
         if self.dompath is not None:
             self.destroyDomain()
 
+        self._cleanup_phantom_devs(paths)
 
     def destroyDomain(self):
         log.debug("XendDomainInfo.destroyDomain(%s)", str(self.domid))
+
+        paths = self._prepare_phantom_paths()
 
         try:
             if self.domid is not None:
@@ -1591,7 +1626,7 @@ class XendDomainInfo:
         XendDomain.instance().remove_domain(self)
 
         self.cleanupDomain()
-
+        self._cleanup_phantom_devs(paths)
 
     def resumeDomain(self):
         log.debug("XendDomainInfo.resumeDomain(%s)", str(self.domid))
@@ -2211,6 +2246,25 @@ class XendDomainInfo:
 
         return dev_uuid
 
+    def create_phantom_vbd_with_vdi(self, xenapi_vbd, vdi_image_path):
+        """Create a VBD using a VDI from XendStorageRepository.
+
+        @param xenapi_vbd: vbd struct from the Xen API
+        @param vdi_image_path: VDI UUID
+        @rtype: string
+        @return: uuid of the device
+        """
+        xenapi_vbd['image'] = vdi_image_path
+        dev_uuid = self.info.phantom_device_add('tap', cfg_xenapi = xenapi_vbd)
+        if not dev_uuid:
+            raise XendError('Failed to create device')
+
+        if self.state == XEN_API_VM_POWER_STATE_RUNNING:
+            _, config = self.info['devices'][dev_uuid]
+            config['devid'] = 
self.getDeviceController('tap').createDevice(config)
+
+        return config['devid']
+
     def create_vif(self, xenapi_vif):
         """Create VIF device from the passed struct in Xen API format.
 
diff -r aea80dbf6d96 -r 9af0c7e4ff51 
tools/python/xen/xend/server/BlktapController.py
--- a/tools/python/xen/xend/server/BlktapController.py  Fri Feb 09 14:43:22 
2007 -0600
+++ b/tools/python/xen/xend/server/BlktapController.py  Wed Feb 14 19:01:35 
2007 +0000
@@ -2,7 +2,10 @@
 
 
 from xen.xend.server.blkif import BlkifController
+from xen.xend.XendLogging import log
 
+phantomDev = 0;
+phantomId = 0;
 
 class BlktapController(BlkifController):
     def __init__(self, vm):
@@ -12,3 +15,62 @@ class BlktapController(BlkifController):
         """@see DevController#frontendRoot"""
         
         return "%s/device/vbd" % self.vm.getDomainPath()
+
+    def getDeviceDetails(self, config):
+        (devid, back, front) = BlkifController.getDeviceDetails(self, config)
+
+        phantomDevid = 0
+        wrapped = False
+
+        try:
+            imagetype = self.vm.info['image']['type']
+        except:
+            imagetype = ""
+
+        if imagetype == 'hvm':
+            tdevname = back['dev']
+            index = ['c', 'd', 'e', 'f', 'g', 'h', 'i', \
+                     'j', 'l', 'm', 'n', 'o', 'p']
+            while True:
+                global phantomDev
+                global phantomId
+                import os, stat
+
+                phantomId = phantomId + 1
+                if phantomId == 16:
+                    if index[phantomDev] == index[-1]:
+                        if wrapped:
+                            raise VmError(" No loopback block \
+                                       devices are available. ")
+                        wrapped = True
+                        phantomDev = 0
+                    else:
+                        phantomDev = phantomDev + 1
+                    phantomId = 1
+                devname = 'xvd%s%d' % (index[phantomDev], phantomId)
+                try:
+                    info = os.stat('/dev/%s' % devname)
+                except:
+                    break
+
+            vbd = { 'mode': 'w', 'device': devname }
+            fn = 'tap:%s' % back['params']
+
+            # recurse ... by creating the vbd, then fallthrough
+            # and finish creating the original device
+
+            from xen.xend import XendDomain
+            dom0 = XendDomain.instance().privilegedDomain()
+            phantomDevid = dom0.create_phantom_vbd_with_vdi(vbd, fn)
+            # we need to wait for this device at a higher level
+            # the vbd that gets created will have a link to us
+            # and will let them do it there
+
+        # add a hook to point to the phantom device,
+        # root path is always the same (dom0 tap)
+        if phantomDevid != 0:
+            front['phantom_vbd'] = '/local/domain/0/backend/tap/0/%s' \
+                                   % str(phantomDevid)
+
+        return (devid, back, front)
+
diff -r aea80dbf6d96 -r 9af0c7e4ff51 
tools/python/xen/xend/server/DevController.py
--- a/tools/python/xen/xend/server/DevController.py     Fri Feb 09 14:43:22 
2007 -0600
+++ b/tools/python/xen/xend/server/DevController.py     Wed Feb 14 19:01:35 
2007 +0000
@@ -153,9 +153,9 @@ class DevController:
         log.debug("Waiting for %s.", devid)
 
         if not self.hotplug:
-            return 
-        
-        status = self.waitForBackend(devid)
+            return
+
+        (status, err) = self.waitForBackend(devid)
 
         if status == Timeout:
             self.destroyDevice(devid, False)
@@ -165,25 +165,22 @@ class DevController:
 
         elif status == Error:
             self.destroyDevice(devid, False)
-            raise VmError("Device %s (%s) could not be connected. "
-                          "Backend device not found." %
-                          (devid, self.deviceClass))
-
+            if err is None:
+                raise VmError("Device %s (%s) could not be connected. "
+                              "Backend device not found." %
+                              (devid, self.deviceClass))
+            else:
+                raise VmError("Device %s (%s) could not be connected. "
+                              "%s" % (devid, self.deviceClass, err))
         elif status == Missing:
             # Don't try to destroy the device; it's already gone away.
             raise VmError("Device %s (%s) could not be connected. "
                           "Device not found." % (devid, self.deviceClass))
 
         elif status == Busy:
-            err = None
-            frontpath = self.frontendPath(devid)
-            backpath = xstransact.Read(frontpath, "backend")
-            if backpath:
-                err = xstransact.Read(backpath, HOTPLUG_ERROR_NODE)
-            if not err:
+            self.destroyDevice(devid, False)
+            if err is None:
                 err = "Busy."
-                
-            self.destroyDevice(devid, False)
             raise VmError("Device %s (%s) could not be connected.\n%s" %
                           (devid, self.deviceClass, err))
 
@@ -476,19 +473,36 @@ class DevController:
     def waitForBackend(self, devid):
 
         frontpath = self.frontendPath(devid)
+        # lookup a phantom 
+        phantomPath = xstransact.Read(frontpath, 'phantom_vbd')
+        if phantomPath is not None:
+            log.debug("Waiting for %s's phantom %s.", devid, phantomPath)
+            statusPath = phantomPath + '/' + HOTPLUG_STATUS_NODE
+            ev = Event()
+            result = { 'status': Timeout }
+            xswatch(statusPath, hotplugStatusCallback, ev, result)
+            ev.wait(DEVICE_CREATE_TIMEOUT)
+            err = xstransact.Read(statusPath, HOTPLUG_ERROR_NODE)
+            if result['status'] != 'Connected':
+                return (result['status'], err)
+            
         backpath = xstransact.Read(frontpath, "backend")
+
 
         if backpath:
             statusPath = backpath + '/' + HOTPLUG_STATUS_NODE
             ev = Event()
             result = { 'status': Timeout }
-            
+
             xswatch(statusPath, hotplugStatusCallback, ev, result)
 
             ev.wait(DEVICE_CREATE_TIMEOUT)
-            return result['status']
-        else:
-            return Missing
+
+            err = xstransact.Read(backpath, HOTPLUG_ERROR_NODE)
+
+            return (result['status'], err)
+        else:
+            return (Missing, None)
 
 
     def backendPath(self, backdom, devid):
diff -r aea80dbf6d96 -r 9af0c7e4ff51 tools/xcutils/xc_restore.c
--- a/tools/xcutils/xc_restore.c        Fri Feb 09 14:43:22 2007 -0600
+++ b/tools/xcutils/xc_restore.c        Wed Feb 14 19:01:35 2007 +0000
@@ -18,14 +18,14 @@ int
 int
 main(int argc, char **argv)
 {
-    unsigned int xc_fd, io_fd, domid, nr_pfns, store_evtchn, console_evtchn;
+    unsigned int xc_fd, io_fd, domid, max_pfn, store_evtchn, console_evtchn;
     unsigned int hvm, pae, apic;
     int ret;
     unsigned long store_mfn, console_mfn;
 
     if (argc != 9)
        errx(1,
-            "usage: %s iofd domid nr_pfns store_evtchn console_evtchn hvm pae 
apic",
+            "usage: %s iofd domid max_pfn store_evtchn console_evtchn hvm pae 
apic",
             argv[0]);
 
     xc_fd = xc_interface_open();
@@ -34,7 +34,7 @@ main(int argc, char **argv)
 
     io_fd = atoi(argv[1]);
     domid = atoi(argv[2]);
-    nr_pfns = atoi(argv[3]);
+    max_pfn = atoi(argv[3]);
     store_evtchn = atoi(argv[4]);
     console_evtchn = atoi(argv[5]);
     hvm  = atoi(argv[6]);
@@ -44,15 +44,16 @@ main(int argc, char **argv)
     if (hvm) {
          /* pass the memsize to xc_hvm_restore to find the store_mfn */
         store_mfn = hvm;
-        ret = xc_hvm_restore(xc_fd, io_fd, domid, nr_pfns, store_evtchn,
-                &store_mfn, console_evtchn, &console_mfn, pae, apic);
+        ret = xc_hvm_restore(xc_fd, io_fd, domid, max_pfn, store_evtchn,
+                &store_mfn, pae, apic);
     } else 
-        ret = xc_linux_restore(xc_fd, io_fd, domid, nr_pfns, store_evtchn,
+        ret = xc_linux_restore(xc_fd, io_fd, domid, max_pfn, store_evtchn,
                 &store_mfn, console_evtchn, &console_mfn);
 
     if (ret == 0) {
        printf("store-mfn %li\n", store_mfn);
-       printf("console-mfn %li\n", console_mfn);
+        if (!hvm)
+            printf("console-mfn %li\n", console_mfn);
        fflush(stdout);
     }
 
diff -r aea80dbf6d96 -r 9af0c7e4ff51 tools/xenfb/vncfb.c
--- a/tools/xenfb/vncfb.c       Fri Feb 09 14:43:22 2007 -0600
+++ b/tools/xenfb/vncfb.c       Wed Feb 14 19:01:35 2007 +0000
@@ -57,7 +57,8 @@ static void *kbd_layout;
 static void *kbd_layout;
 
 static int btnmap[] = {
-       BTN_LEFT, BTN_MIDDLE, BTN_RIGHT, BTN_FORWARD, BTN_BACK
+       BTN_LEFT, BTN_MIDDLE, BTN_RIGHT, BTN_SIDE,
+       BTN_EXTRA, BTN_FORWARD, BTN_BACK, BTN_TASK
 };
 
 static void on_kbd_event(rfbBool down, rfbKeySym keycode, rfbClientPtr cl)
@@ -73,11 +74,12 @@ static void on_kbd_event(rfbBool down, r
         */
        rfbScreenInfoPtr server = cl->screen;
        struct xenfb *xenfb = server->screenData;
-
-       if( keycode >= 'A' && keycode <= 'Z' )
+       int scancode;
+
+       if (keycode >= 'A' && keycode <= 'Z')
                keycode += 'a' - 'A';
 
-       int scancode = keycode_table[keysym2scancode(kbd_layout, keycode)];
+       scancode = keycode_table[keysym2scancode(kbd_layout, keycode)];
        if (scancode == 0)
                return;
        if (xenfb_send_key(xenfb, down, scancode) < 0)
diff -r aea80dbf6d96 -r 9af0c7e4ff51 tools/xentrace/xentrace_format
--- a/tools/xentrace/xentrace_format    Fri Feb 09 14:43:22 2007 -0600
+++ b/tools/xentrace/xentrace_format    Wed Feb 14 19:01:35 2007 +0000
@@ -107,6 +107,9 @@ while not interrupted:
 
         (tsc, event, d1, d2, d3, d4, d5) = struct.unpack(TRCREC, line)
 
+        # Event field is 'uint32_t', not 'long'.
+        event &= 0xffffffff
+
        #tsc = (tscH<<32) | tscL
 
        #print i, tsc
diff -r aea80dbf6d96 -r 9af0c7e4ff51 unmodified_drivers/linux-2.6/overrides.mk
--- a/unmodified_drivers/linux-2.6/overrides.mk Fri Feb 09 14:43:22 2007 -0600
+++ b/unmodified_drivers/linux-2.6/overrides.mk Wed Feb 14 19:01:35 2007 +0000
@@ -6,3 +6,6 @@
 # a Xen kernel to find the right headers)
 EXTRA_CFLAGS += -D__XEN_INTERFACE_VERSION__=0x00030202
 EXTRA_CFLAGS += -I$(M)/include -I$(M)/compat-include 
-DHAVE_XEN_PLATFORM_COMPAT_H
+ifeq ($(ARCH),ia64)
+  EXTRA_CFLAGS += -DCONFIG_VMX_GUEST
+endif
diff -r aea80dbf6d96 -r 9af0c7e4ff51 
unmodified_drivers/linux-2.6/platform-pci/platform-compat.c
--- a/unmodified_drivers/linux-2.6/platform-pci/platform-compat.c       Fri Feb 
09 14:43:22 2007 -0600
+++ b/unmodified_drivers/linux-2.6/platform-pci/platform-compat.c       Wed Feb 
14 19:01:35 2007 +0000
@@ -12,6 +12,12 @@ static int system_state = 1;
 static int system_state = 1;
 EXPORT_SYMBOL(system_state);
 #endif
+
+static inline void ctrl_alt_del(void)
+{
+       kill_proc(1, SIGINT, 1); /* interrupt init */
+}
+EXPORT_SYMBOL(ctrl_alt_del);
 
 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,8)
 size_t strcspn(const char *s, const char *reject)
diff -r aea80dbf6d96 -r 9af0c7e4ff51 
unmodified_drivers/linux-2.6/platform-pci/platform-pci.c
--- a/unmodified_drivers/linux-2.6/platform-pci/platform-pci.c  Fri Feb 09 
14:43:22 2007 -0600
+++ b/unmodified_drivers/linux-2.6/platform-pci/platform-pci.c  Wed Feb 14 
19:01:35 2007 +0000
@@ -118,14 +118,10 @@ unsigned long alloc_xen_mmio(unsigned lo
 {
        unsigned long addr;
 
-       addr = 0;
-       if (platform_mmio_alloc + len <= platform_mmiolen)
-       {
-               addr = platform_mmio + platform_mmio_alloc;
-               platform_mmio_alloc += len;
-       } else {
-               panic("ran out of xen mmio space");
-       }
+       addr = platform_mmio + platform_mmio_alloc;
+       platform_mmio_alloc += len;
+       BUG_ON(platform_mmio_alloc > platform_mmiolen);
+
        return addr;
 }
 
@@ -181,23 +177,19 @@ static int get_hypercall_stubs(void)
 
 static uint64_t get_callback_via(struct pci_dev *pdev)
 {
+       u8 pin;
+       int irq;
+
 #ifdef __ia64__
-       int irq, rid;
        for (irq = 0; irq < 16; irq++) {
                if (isa_irq_to_vector(irq) == pdev->irq)
-                       return irq;
-       }
-       /* use Requester-ID as callback_irq */
-       /* RID: '<#bus(8)><#dev(5)><#func(3)>' (cf. PCI-Express spec) */
-       rid = ((pdev->bus->number & 0xff) << 8) | pdev->devfn;
-       printk(KERN_INFO DRV_NAME ":use Requester-ID(%04x) as callback irq\n",
-              rid);
-       return rid | IA64_CALLBACK_IRQ_RID;
+                       return irq; /* ISA IRQ */
+       }
 #else /* !__ia64__ */
-       u8 pin;
-
-       if (pdev->irq < 16)
-               return pdev->irq; /* ISA IRQ */
+       irq = pdev->irq;
+       if (irq < 16)
+               return irq; /* ISA IRQ */
+#endif
 
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,16)
        pin = pdev->pin;
@@ -211,7 +203,6 @@ static uint64_t get_callback_via(struct 
                ((uint64_t)pdev->bus->number << 16) |
                ((uint64_t)(pdev->devfn & 0xff) << 8) |
                ((uint64_t)(pin - 1) & 3));
-#endif
 }
 
 /* Invalidate foreign mappings (e.g., in qemu-based device model). */
diff -r aea80dbf6d96 -r 9af0c7e4ff51 
unmodified_drivers/linux-2.6/platform-pci/xen_support.c
--- a/unmodified_drivers/linux-2.6/platform-pci/xen_support.c   Fri Feb 09 
14:43:22 2007 -0600
+++ b/unmodified_drivers/linux-2.6/platform-pci/xen_support.c   Wed Feb 14 
19:01:35 2007 +0000
@@ -30,6 +30,23 @@
 #include <xen/platform-compat.h>
 #endif
 
+#if defined (__ia64__)
+unsigned long __hypercall(unsigned long a1, unsigned long a2,
+                         unsigned long a3, unsigned long a4,
+                         unsigned long a5, unsigned long cmd)
+{
+       unsigned long __res;
+       __asm__ __volatile__ (";;\n"
+               "mov r2=%1\n"
+               "break 0x1000 ;;\n"
+               "mov %0=r8 ;;\n"
+               : "=r"(__res) : "r"(cmd) : "r2", "r8", "memory");
+
+       return __res;
+}
+EXPORT_SYMBOL(__hypercall);
+#endif
+
 void xen_machphys_update(unsigned long mfn, unsigned long pfn)
 {
        BUG();
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/ia64/Rules.mk
--- a/xen/arch/ia64/Rules.mk    Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/ia64/Rules.mk    Wed Feb 14 19:01:35 2007 +0000
@@ -4,7 +4,6 @@ HAS_ACPI := y
 HAS_ACPI := y
 HAS_VGA  := y
 xenoprof := y
-VALIDATE_VT    ?= n
 no_warns ?= n
 xen_ia64_expose_p2m    ?= y
 xen_ia64_pervcpu_vhpt  ?= y
@@ -37,9 +36,6 @@ CFLAGS        += -ffixed-r13 -mfixed-range=f2-f
 CFLAGS += -ffixed-r13 -mfixed-range=f2-f5,f12-f127
 CFLAGS += -g
 #CFLAGS  += -DVTI_DEBUG
-ifeq ($(VALIDATE_VT),y)
-CFLAGS  += -DVALIDATE_VT
-endif
 ifeq ($(xen_ia64_expose_p2m),y)
 CFLAGS += -DCONFIG_XEN_IA64_EXPOSE_P2M
 endif
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/ia64/asm-offsets.c
--- a/xen/arch/ia64/asm-offsets.c       Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/ia64/asm-offsets.c       Wed Feb 14 19:01:35 2007 +0000
@@ -57,6 +57,7 @@ void foo(void)
 
        DEFINE(IA64_VCPU_DOMAIN_OFFSET, offsetof (struct vcpu, domain));
        DEFINE(IA64_VCPU_HYPERCALL_CONTINUATION_OFS, offsetof (struct vcpu, 
arch.hypercall_continuation));
+       DEFINE(IA64_VCPU_FP_PSR_OFFSET, offsetof (struct vcpu, arch.fp_psr));
        DEFINE(IA64_VCPU_META_RR0_OFFSET, offsetof (struct vcpu, 
arch.metaphysical_rr0));
        DEFINE(IA64_VCPU_META_SAVED_RR0_OFFSET, offsetof (struct vcpu, 
arch.metaphysical_saved_rr0));
        DEFINE(IA64_VCPU_BREAKIMM_OFFSET, offsetof (struct vcpu, 
arch.breakimm));
@@ -199,6 +200,7 @@ void foo(void)
        DEFINE(IA64_VPD_BASE_OFFSET, offsetof (struct vcpu, arch.privregs));
        DEFINE(IA64_VPD_VIFS_OFFSET, offsetof (mapped_regs_t, ifs));
        DEFINE(IA64_VLSAPIC_INSVC_BASE_OFFSET, offsetof (struct vcpu, 
arch.insvc[0]));
+       DEFINE(IA64_VPD_VPTA_OFFSET, offsetof (struct mapped_regs, pta));
        DEFINE(IA64_VPD_CR_VPTA_OFFSET, offsetof (cr_t, pta));
        DEFINE(XXX_THASH_SIZE, sizeof (thash_data_t));
 
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/ia64/asm-xsi-offsets.c
--- a/xen/arch/ia64/asm-xsi-offsets.c   Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/ia64/asm-xsi-offsets.c   Wed Feb 14 19:01:35 2007 +0000
@@ -61,6 +61,8 @@ void foo(void)
        DEFINE_MAPPED_REG_OFS(XSI_ITIR_OFS, itir);
        DEFINE_MAPPED_REG_OFS(XSI_ITV_OFS, itv);
        DEFINE_MAPPED_REG_OFS(XSI_PTA_OFS, pta);
+       DEFINE_MAPPED_REG_OFS(XSI_VPSR_DFH_OFS, vpsr_dfh);
+       DEFINE_MAPPED_REG_OFS(XSI_HPSR_DFH_OFS, hpsr_dfh);
        DEFINE_MAPPED_REG_OFS(XSI_PSR_IC_OFS, interrupt_collection_enabled);
        DEFINE_MAPPED_REG_OFS(XSI_VPSR_PP_OFS, vpsr_pp);
        DEFINE_MAPPED_REG_OFS(XSI_METAPHYS_OFS, metaphysical_mode);
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/ia64/linux-xen/head.S
--- a/xen/arch/ia64/linux-xen/head.S    Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/ia64/linux-xen/head.S    Wed Feb 14 19:01:35 2007 +0000
@@ -267,13 +267,8 @@ start_ap:
        /*
         * Switch into virtual mode:
         */
-#if defined(XEN) && defined(VALIDATE_VT)
-       movl r16=(IA64_PSR_IT|IA64_PSR_IC|IA64_PSR_DT|IA64_PSR_RT|IA64_PSR_DFH\
-                 |IA64_PSR_DI)
-#else
        movl 
r16=(IA64_PSR_IT|IA64_PSR_IC|IA64_PSR_DT|IA64_PSR_RT|IA64_PSR_DFH|IA64_PSR_BN \
                  |IA64_PSR_DI)
-#endif
        ;;
        mov cr.ipsr=r16
        movl r17=1f
@@ -292,11 +287,7 @@ 1: // now we are in virtual mode
        ;;
 
        // set IVT entry point---can't access I/O ports without it
-#if defined(XEN) && defined(VALIDATE_VT)
-       movl r3=vmx_ia64_ivt
-#else
        movl r3=ia64_ivt
-#endif
        ;;
        mov cr.iva=r3
        movl r2=FPSR_DEFAULT
@@ -368,15 +359,8 @@ 1: // now we are in virtual mode
        
 .load_current:
        // load the "current" pointer (r13) and ar.k6 with the current task
-#if defined(XEN) && defined(VALIDATE_VT)
-       mov r21=r2
-       ;;
-       bsw.1
-       ;;
-#else
        mov IA64_KR(CURRENT)=r2         // virtual address
        mov IA64_KR(CURRENT_STACK)=r16
-#endif
        mov r13=r2
        /*
         * Reserve space at the top of the stack for "struct pt_regs".  Kernel
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/ia64/linux-xen/mca.c
--- a/xen/arch/ia64/linux-xen/mca.c     Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/ia64/linux-xen/mca.c     Wed Feb 14 19:01:35 2007 +0000
@@ -84,6 +84,7 @@
 #include <xen/event.h>
 #include <xen/softirq.h>
 #include <asm/xenmca.h>
+#include <linux/shutdown.h>
 #endif
 
 #if defined(IA64_MCA_DEBUG_INFO)
@@ -684,16 +685,8 @@ fetch_min_state (pal_min_state_area_t *m
 #ifdef XEN
 static spinlock_t init_dump_lock = SPIN_LOCK_UNLOCKED;
 static spinlock_t show_stack_lock = SPIN_LOCK_UNLOCKED;
-
-static void
-save_ksp (struct unw_frame_info *info, void *arg)
-{
-       current->arch._thread.ksp = (__u64)(info->sw) - 16;
-       wmb();
-}
-
-/* FIXME */
-int try_crashdump(struct pt_regs *a) { return 0; }
+static atomic_t num_stopped_cpus = ATOMIC_INIT(0);
+extern void show_stack (struct task_struct *, unsigned long *);
 
 #define CPU_FLUSH_RETRY_MAX 5
 static void
@@ -716,6 +709,35 @@ init_cache_flush (void)
        }
        printk("\nPAL cache flush failed. status=%ld\n",rval);
 }
+
+static void inline
+save_ksp (struct unw_frame_info *info)
+{
+       current->arch._thread.ksp = (__u64)(info->sw) - 16;
+       wmb();
+       init_cache_flush();
+}      
+
+static void
+freeze_cpu_osinit (struct unw_frame_info *info, void *arg)
+{
+       save_ksp(info);
+       atomic_inc(&num_stopped_cpus);
+       printk("%s: CPU%d init handler done\n",
+              __FUNCTION__, smp_processor_id());
+       for (;;)
+               local_irq_disable();
+}
+
+/* FIXME */
+static void
+try_crashdump(struct unw_frame_info *info, void *arg)
+{ 
+       save_ksp(info);
+       printk("\nINIT dump complete.  Please reboot now.\n");
+       for (;;)
+               local_irq_disable();
+}
 #endif /* XEN */
 
 static void
@@ -741,7 +763,8 @@ init_handler_platform (pal_min_state_are
        show_min_state(ms);
 
 #ifdef XEN
-       printk("Backtrace of current vcpu (vcpu_id %d)\n", current->vcpu_id);
+       printk("Backtrace of current vcpu (vcpu_id %d of domid %d)\n",
+              current->vcpu_id, current->domain->domain_id);
 #else
        printk("Backtrace of current task (pid %d, %s)\n", current->pid, 
current->comm);
        fetch_min_state(ms, pt, sw);
@@ -749,20 +772,35 @@ init_handler_platform (pal_min_state_are
        unw_init_from_interruption(&info, current, pt, sw);
        ia64_do_show_stack(&info, NULL);
 #ifdef XEN
-       unw_init_running(save_ksp, NULL);
        spin_unlock(&show_stack_lock);
-       wmb();
-       init_cache_flush();
 
        if (spin_trylock(&init_dump_lock)) {
+               struct domain *d;
+               struct vcpu *v;
 #ifdef CONFIG_SMP
-               udelay(5*1000000);
-#endif
-               if (try_crashdump(pt) == 0)
-                       printk("\nINIT dump complete.  Please reboot now.\n");
-       }
-       printk("%s: CPU%d init handler done\n",
-              __FUNCTION__, smp_processor_id());
+               int other_cpus = num_online_cpus() - 1;
+               int wait = 1000 * other_cpus;
+
+               while ((atomic_read(&num_stopped_cpus) != other_cpus) && wait--)
+                       udelay(1000);
+               if (other_cpus && wait < 0)
+                       printk("timeout %d\n", atomic_read(&num_stopped_cpus));
+#endif
+               if (opt_noreboot) {
+                       /* this route is for dump routine */
+                       unw_init_running(try_crashdump, pt);
+               } else {
+                       for_each_domain(d) {
+                               for_each_vcpu(d, v) {
+                                       printk("Backtrace of current vcpu "
+                                              "(vcpu_id %d of domid %d)\n",
+                                              v->vcpu_id, d->domain_id);
+                                       show_stack(v, NULL);
+                               }
+                       }
+               }
+       }
+       unw_init_running(freeze_cpu_osinit, NULL);
 #else /* XEN */
 #ifdef CONFIG_SMP
        /* read_trylock() would be handy... */
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/ia64/vmx/optvfault.S
--- a/xen/arch/ia64/vmx/optvfault.S     Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/ia64/vmx/optvfault.S     Wed Feb 14 19:01:35 2007 +0000
@@ -15,6 +15,7 @@
 #include <asm/vmx_vpd.h>
 #include <asm/vmx_pal_vsa.h>
 #include <asm/asm-offsets.h>
+#include <asm-ia64/vmx_mm_def.h>
 
 #define ACCE_MOV_FROM_AR
 #define ACCE_MOV_FROM_RR
@@ -22,6 +23,7 @@
 #define ACCE_RSM
 #define ACCE_SSM
 #define ACCE_MOV_TO_PSR
+#define ACCE_THASH
 
 //mov r1=ar3
 GLOBAL_ENTRY(vmx_asm_mov_from_ar)
@@ -192,6 +194,13 @@ GLOBAL_ENTRY(vmx_asm_rsm)
     ;;   
     st8 [r17]=r19
     and r20=r20,r28
+    adds r27=IA64_VCPU_FP_PSR_OFFSET,r21
+    ;;
+    ld8 r27=[r27]
+    ;;
+    tbit.nz p8,p0= r27,IA64_PSR_DFH_BIT
+    ;;
+    (p8) dep r20=-1,r20,IA64_PSR_DFH_BIT,1
     ;;
     mov cr.ipsr=r20
     tbit.nz p6,p0=r23,0
@@ -360,6 +369,14 @@ vmx_asm_mov_to_psr_1:
     add r20=r19,r20
     mov b0=r24
     ;;
+    adds r27=IA64_VCPU_FP_PSR_OFFSET,r21
+    ;;
+    ld8 r27=[r27]
+    ;;
+    tbit.nz p8,p0=r27,IA64_PSR_DFH_BIT
+    ;;
+    (p8) dep r20=-1,r20,IA64_PSR_DFH_BIT,1
+    ;;
     mov cr.ipsr=r20
     cmp.ne p6,p0=r0,r0
     ;;
@@ -403,6 +420,64 @@ ENTRY(vmx_asm_dispatch_vexirq)
     br.many vmx_dispatch_vexirq
 END(vmx_asm_dispatch_vexirq)
 
+// thash
+// TODO: add support when pta.vf = 1
+GLOBAL_ENTRY(vmx_asm_thash)
+#ifndef ACCE_THASH
+    br.many vmx_virtualization_fault_back
+#endif
+    extr.u r17=r25,20,7                // get r3 from opcode in r25 
+    extr.u r18=r25,6,7         // get r1 from opcode in r25
+    movl r20=asm_mov_from_reg
+    ;;
+    adds r30=vmx_asm_thash_back1-asm_mov_from_reg,r20
+    shladd r17=r17,4,r20       // get addr of MOVE_FROM_REG(r17)
+    adds r16=IA64_VPD_BASE_OFFSET,r21  // get vcpu.arch.priveregs
+    ;;
+    mov r24=b0
+    ;;
+    ld8 r16=[r16]              // get VPD addr
+    mov b0=r17
+    br.many b0                 // r19 return value
+    ;;                                                     
+vmx_asm_thash_back1:
+    shr.u r23=r19,61           // get RR number
+    adds r25=VCPU_VRR0_OFS,r21 // get vcpu->arch.arch_vmx.vrr[0]'s addr
+    adds r16=IA64_VPD_VPTA_OFFSET,r16  // get vpta 
+    ;;
+    shladd r27=r23,3,r25       // get vcpu->arch.arch_vmx.vrr[r23]'s addr
+    ld8 r17=[r16]              // get PTA
+    mov r26=1
+    ;;
+    extr.u r29=r17,2,6         // get pta.size
+    ld8 r25=[r27]              // get vcpu->arch.arch_vmx.vrr[r23]'s value
+    ;;
+    extr.u r25=r25,2,6         // get rr.ps
+    shl r22=r26,r29            // 1UL << pta.size
+    ;;
+    shr.u r23=r19,r25          // vaddr >> rr.ps
+    adds r26=3,r29             // pta.size + 3 
+    shl r27=r17,3              // pta << 3 
+    ;;
+    shl r23=r23,3              // (vaddr >> rr.ps) << 3
+    shr.u r27=r27,r26          // (pta << 3) >> (pta.size+3)
+    movl r16=VRN_MASK
+    ;;
+    adds r22=-1,r22            // (1UL << pta.size) - 1
+    shl r27=r27,r29            // ((pta<<3)>>(pta.size+3))<<pta.size
+    and r19=r19,r16            // vaddr & VRN_MASK
+    ;;
+    and r22=r22,r23            // vhpt_offset 
+    or r19=r19,r27             // (vadr&VRN_MASK) |(((pta<<3)>>(pta.size + 
3))<<pta.size) 
+    adds r26=asm_mov_to_reg-asm_mov_from_reg,r20
+    ;;
+    or r19=r19,r22             // calc pval
+    shladd r17=r18,4,r26
+    adds r30=vmx_resume_to_guest-asm_mov_from_reg,r20
+    ;;
+    mov b0=r17
+    br.many b0
+END(vmx_asm_thash)
 
 #define MOV_TO_REG0    \
 {;                     \
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/ia64/vmx/vlsapic.c
--- a/xen/arch/ia64/vmx/vlsapic.c       Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/ia64/vmx/vlsapic.c       Wed Feb 14 19:01:35 2007 +0000
@@ -171,7 +171,12 @@ static void vtm_timer_fn(void *data)
     } else
         vtm->pending = 1;
 
-    update_last_itc(vtm, VCPU(vcpu, itm));  // update vITC
+    /*
+     * "+ 1" is for fixing oops message at timer_interrupt() on VTI guest. 
+     * If oops checking condition changed to timer_after_eq() on VTI guest,
+     * this parameter should be erased.
+     */
+    update_last_itc(vtm, VCPU(vcpu, itm) + 1);  // update vITC
 }
 
 void vtm_init(VCPU *vcpu)
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/ia64/vmx/vmmu.c
--- a/xen/arch/ia64/vmx/vmmu.c  Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/ia64/vmx/vmmu.c  Wed Feb 14 19:01:35 2007 +0000
@@ -129,13 +129,15 @@ purge_machine_tc_by_domid(domid_t domid)
 #endif
 }
 
-static void init_domain_vhpt(struct vcpu *v)
+static int init_domain_vhpt(struct vcpu *v)
 {
     struct page_info *page;
     void * vbase;
     page = alloc_domheap_pages (NULL, VCPU_VHPT_ORDER, 0);
     if ( page == NULL ) {
-        panic_domain(vcpu_regs(v),"No enough contiguous memory for 
init_domain_vhpt\n");
+        printk("No enough contiguous memory for init_domain_vhpt\n");
+
+        return -1;
     }
     vbase = page_to_virt(page);
     memset(vbase, 0, VCPU_VHPT_SIZE);
@@ -147,18 +149,36 @@ static void init_domain_vhpt(struct vcpu
     VHPT(v,cch_sz) = VCPU_VHPT_SIZE - VHPT(v,hash_sz);
     thash_init(&(v->arch.vhpt),VCPU_VHPT_SHIFT-1);
     v->arch.arch_vmx.mpta = v->arch.vhpt.pta.val;
-}
-
-
-
-void init_domain_tlb(struct vcpu *v)
+
+    return 0;
+}
+
+
+static void free_domain_vhpt(struct vcpu *v)
+{
+    struct page_info *page;
+
+    if (v->arch.vhpt.hash) {
+        page = virt_to_page(v->arch.vhpt.hash);
+        free_domheap_pages(page, VCPU_VHPT_ORDER);
+    }
+
+    return;
+}
+
+int init_domain_tlb(struct vcpu *v)
 {
     struct page_info *page;
     void * vbase;
-    init_domain_vhpt(v);
+
+    if (init_domain_vhpt(v) != 0)
+        return -1;
+
     page = alloc_domheap_pages (NULL, VCPU_VTLB_ORDER, 0);
     if ( page == NULL ) {
-        panic_domain(vcpu_regs(v),"No enough contiguous memory for 
init_domain_tlb\n");
+        printk("No enough contiguous memory for init_domain_tlb\n");
+        free_domain_vhpt(v);
+        return -1;
     }
     vbase = page_to_virt(page);
     memset(vbase, 0, VCPU_VTLB_SIZE);
@@ -169,7 +189,10 @@ void init_domain_tlb(struct vcpu *v)
     VTLB(v,cch_buf) = (void *)((u64)vbase + VTLB(v,hash_sz));
     VTLB(v,cch_sz) = VCPU_VTLB_SIZE - VTLB(v,hash_sz);
     thash_init(&(v->arch.vtlb),VCPU_VTLB_SHIFT-1);
-}
+    
+    return 0;
+}
+
 
 void free_domain_tlb(struct vcpu *v)
 {
@@ -179,10 +202,8 @@ void free_domain_tlb(struct vcpu *v)
         page = virt_to_page(v->arch.vtlb.hash);
         free_domheap_pages(page, VCPU_VTLB_ORDER);
     }
-    if ( v->arch.vhpt.hash) {
-        page = virt_to_page(v->arch.vhpt.hash);
-        free_domheap_pages(page, VCPU_VHPT_ORDER);
-    }
+
+    free_domain_vhpt(v);
 }
 
 /*
@@ -553,7 +574,8 @@ static void ptc_ga_remote_func (void *va
     mpta = ia64_get_pta();
     ia64_set_pta(v->arch.arch_vmx.mpta&(~1));
     ia64_srlz_d();
-    vmx_vcpu_ptc_l(v, REGION_OFFSET(vadr), args->ps);
+    vadr = PAGEALIGN(vadr, args->ps);
+    thash_purge_entries_remote(v, vadr, args->ps);
     VMX(v, vrr[0]) = oldrid; 
     VMX(v, psbits[0]) = oldpsbits;
     ia64_set_rr(0x0,moldrid);
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/ia64/vmx/vmx_entry.S
--- a/xen/arch/ia64/vmx/vmx_entry.S     Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/ia64/vmx/vmx_entry.S     Wed Feb 14 19:01:35 2007 +0000
@@ -190,12 +190,8 @@ GLOBAL_ENTRY(ia64_leave_hypervisor)
     PT_REGS_UNWIND_INFO(0)
     rsm psr.i
     ;;
-    alloc loc0=ar.pfs,0,1,1,0
-    ;;
-    adds out0=16,r12
     br.call.sptk.many b0=leave_hypervisor_tail
     ;;
-    mov ar.pfs=loc0
     adds r20=PT(PR)+16,r12
     adds r8=PT(EML_UNAT)+16,r12
     ;;
@@ -302,11 +298,9 @@ GLOBAL_ENTRY(ia64_leave_hypervisor)
     ;;
     mov ar.fpsr=r19
     mov ar.ccv=r18
-    ;;
-//rbs_switch
-    
     shr.u r18=r20,16
     ;;
+vmx_rbs_switch:    
     movl r19= THIS_CPU(ia64_phys_stacked_size_p8)
     ;;
     ld4 r19=[r19]
@@ -368,7 +362,7 @@ vmx_rse_clear_invalid:
     ;;
     mov cr.ipsr=r31
     mov cr.iip=r30
-    mov cr.ifs=r29
+(pNonSys) mov cr.ifs=r29
     mov ar.pfs=r27
     adds r18=IA64_VPD_BASE_OFFSET,r21
     ;;
@@ -425,148 +419,190 @@ END(ia64_vmm_entry)
 END(ia64_vmm_entry)
 
 
-#ifdef XEN_DBL_MAPPING  /* will be removed */
-
-#define VMX_PURGE_RR7  0
-#define VMX_INSERT_RR7 1
+
 /*
- * in0: old rr7
- * in1: virtual address of xen image
- * in2: virtual address of vhpt table
+ * ia64_leave_syscall(): Same as ia64_leave_kernel, except that it doesn't
+ *  need to switch to bank 0 and doesn't restore the scratch registers.
+ *  To avoid leaking kernel bits, the scratch registers are set to
+ *  the following known-to-be-safe values:
+ *
+ *        r1: restored (global pointer)
+ *        r2: cleared
+ *        r3: 1 (when returning to user-level)
+ *        r8-r11: restored (syscall return value(s))
+ *       r12: restored (user-level stack pointer)
+ *       r13: restored (user-level thread pointer)
+ *       r14: set to __kernel_syscall_via_epc
+ *       r15: restored (syscall #)
+ *       r16-r17: cleared
+ *       r18: user-level b6
+ *       r19: cleared
+ *       r20: user-level ar.fpsr
+ *       r21: user-level b0
+ *       r22: cleared
+ *       r23: user-level ar.bspstore
+ *       r24: user-level ar.rnat
+ *       r25: user-level ar.unat
+ *       r26: user-level ar.pfs
+ *       r27: user-level ar.rsc
+ *       r28: user-level ip
+ *       r29: user-level psr
+ *       r30: user-level cfm
+ *       r31: user-level pr
+ *        f6-f11: cleared
+ *        pr: restored (user-level pr)
+ *        b0: restored (user-level rp)
+ *        b6: restored
+ *        b7: set to __kernel_syscall_via_epc
+ *        ar.unat: restored (user-level ar.unat)
+ *        ar.pfs: restored (user-level ar.pfs)
+ *        ar.rsc: restored (user-level ar.rsc)
+ *        ar.rnat: restored (user-level ar.rnat)
+ *        ar.bspstore: restored (user-level ar.bspstore)
+ *        ar.fpsr: restored (user-level ar.fpsr)
+ *        ar.ccv: cleared
+ *        ar.csd: cleared
+ *        ar.ssd: cleared
  */
-GLOBAL_ENTRY(vmx_purge_double_mapping)
-    alloc loc1 = ar.pfs,5,9,0,0
-    mov loc0 = rp
-    movl r8 = 1f
-    ;;
-    movl loc4 = KERNEL_TR_PAGE_SHIFT
-    movl loc5 = VCPU_TLB_SHIFT
-    mov loc6 = psr
-    movl loc7 = XEN_RR7_SWITCH_STUB
-    mov loc8 = (1<<VMX_PURGE_RR7)
-    ;;
-    srlz.i
-    ;;
-    rsm psr.i | psr.ic
-    ;;
-    srlz.i
-    ;;
-    mov ar.rsc = 0
-    mov b6 = loc7
-    mov rp = r8
-    ;;
-    br.sptk b6
-1:
-    mov ar.rsc = 3
-    mov rp = loc0
-    ;;
-    mov psr.l = loc6
-    ;;
-    srlz.i
-    ;;
-    br.ret.sptk rp
-END(vmx_purge_double_mapping)
-
-/*
- * in0: new rr7
- * in1: virtual address of xen image
- * in2: virtual address of vhpt table
- * in3: pte entry of xen image
- * in4: pte entry of vhpt table
- */
-GLOBAL_ENTRY(vmx_insert_double_mapping)
-    alloc loc1 = ar.pfs,5,9,0,0
-    mov loc0 = rp
-    movl loc2 = IA64_TR_XEN_IN_DOM // TR number for xen image
-    ;;
-    movl loc3 = IA64_TR_VHPT_IN_DOM    // TR number for vhpt table
-    movl r8 = 1f
-    movl loc4 = KERNEL_TR_PAGE_SHIFT
-    ;;
-    movl loc5 = VCPU_TLB_SHIFT
-    mov loc6 = psr
-    movl loc7 = XEN_RR7_SWITCH_STUB
-    ;;
-    srlz.i
-    ;;
-    rsm psr.i | psr.ic
-    mov loc8 = (1<<VMX_INSERT_RR7)
-    ;;
-    srlz.i
-    ;;
-    mov ar.rsc = 0
-    mov b6 = loc7
-    mov rp = r8
-    ;;
-    br.sptk b6
-1:
-    mov ar.rsc = 3
-    mov rp = loc0
-    ;;
-    mov psr.l = loc6
-    ;;
-    srlz.i
-    ;;
-    br.ret.sptk rp
-END(vmx_insert_double_mapping)
-
-    .align PAGE_SIZE
-/*
- * Stub to add double mapping for new domain, which shouldn't
- * access any memory when active. Before reaching this point,
- * both psr.i/ic is cleared and rse is set in lazy mode.
- *
- * in0: new rr7
- * in1: virtual address of xen image
- * in2: virtual address of vhpt table
- * in3: pte entry of xen image
- * in4: pte entry of vhpt table
- * loc2: TR number for xen image
- * loc3: TR number for vhpt table
- * loc4: page size for xen image
- * loc5: page size of vhpt table
- * loc7: free to use
- * loc8: purge or insert
- * r8: will contain old rid value
- */
-GLOBAL_ENTRY(vmx_switch_rr7)
-    movl loc7 = (7<<61)
-    dep.z loc4 = loc4, 2, 6
-    dep.z loc5 = loc5, 2, 6
-    ;;
-    tbit.nz p6,p7=loc8, VMX_INSERT_RR7
-    mov r8 = rr[loc7]
-    ;;
-    mov rr[loc7] = in0
-(p6)mov cr.ifa = in1
-(p6)mov cr.itir = loc4
-    ;;
-    srlz.i
-    ;;
-(p6)itr.i itr[loc2] = in3
-(p7)ptr.i in1, loc4
-    ;;
-(p6)itr.d dtr[loc2] = in3
-(p7)ptr.d in1, loc4
-    ;;
-    srlz.i
-    ;;
-(p6)mov cr.ifa = in2
-(p6)mov cr.itir = loc5
-    ;;
-(p6)itr.d dtr[loc3] = in4
-(p7)ptr.d in2, loc5
-    ;;
-    srlz.i
-    ;;
-    mov rr[loc7] = r8
-    ;;
-    srlz.i
-    br.sptk rp
-END(vmx_switch_rr7)
-    .align PAGE_SIZE
-
+GLOBAL_ENTRY(ia64_leave_hypercall)
+    PT_REGS_UNWIND_INFO(0)
+    /*
+     * work.need_resched etc. mustn't get changed by this CPU before it 
returns to
+     * user- or fsys-mode, hence we disable interrupts early on.
+     *
+     * p6 controls whether current_thread_info()->flags needs to be check for
+     * extra work.  We always check for extra work when returning to 
user-level.
+     * With CONFIG_PREEMPT, we also check for extra work when the preempt_count
+     * is 0.  After extra work processing has been completed, execution
+     * resumes at .work_processed_syscall with p6 set to 1 if the 
extra-work-check
+     * needs to be redone.
+     */
+(pUStk) rsm psr.i
+    cmp.eq pLvSys,p0=r0,r0             // pLvSys=1: leave from syscall
+(pUStk) cmp.eq.unc p6,p0=r0,r0         // p6 <- pUStk
+    ;;
+    br.call.sptk.many b0=leave_hypervisor_tail
+.work_processed_syscall:
+    //clean up bank 1 registers
+    mov r16=r0
+    mov r17=r0
+    mov r18=r0
+    mov r19=r0
+    mov r20=r0
+    mov r21=r0
+    mov r22=r0
+    mov r23=r0
+    mov r24=r0
+    mov r25=r0
+    mov r26=r0
+    mov r27=r0
+    mov r28=r0
+    mov r29=r0
+    mov r30=r0
+    mov r31=r0
+    bsw.0
+    ;;
+    adds r2=PT(LOADRS)+16,r12
+    adds r3=PT(AR_BSPSTORE)+16,r12
+#ifndef XEN
+    adds r18=TI_FLAGS+IA64_TASK_SIZE,r13
+    ;;
+(p6) ld4 r31=[r18]                             // load 
current_thread_info()->flags
+#endif
+    ;;
+    ld8 r20=[r2],PT(B6)-PT(LOADRS)             // load ar.rsc value for 
"loadrs"
+    nop.i 0
+    ;;
+//  mov r16=ar.bsp                             // M2  get existing backing 
store pointer
+    ld8 r18=[r2],PT(R9)-PT(B6)         // load b6
+#ifndef XEN
+(p6)    and r15=TIF_WORK_MASK,r31              // any work other than 
TIF_SYSCALL_TRACE?
+#endif
+    ;;
+    ld8 r24=[r3],PT(R11)-PT(AR_BSPSTORE)       // load ar.bspstore (may be 
garbage)
+#ifndef XEN
+(p6)    cmp4.ne.unc p6,p0=r15, r0              // any special work pending?
+(p6)    br.cond.spnt .work_pending_syscall
+#endif
+    ;;
+    // start restoring the state saved on the kernel stack (struct pt_regs):
+    ld8 r9=[r2],PT(CR_IPSR)-PT(R9)
+    ld8 r11=[r3],PT(CR_IIP)-PT(R11)
+//(pNonSys) break 0            //      bug check: we shouldn't be here if 
pNonSys is TRUE!
+    ;;
+    invala                     // M0|1 invalidate ALAT
+    rsm psr.i | psr.ic // M2   turn off interrupts and interruption collection
+    cmp.eq p9,p0=r0,r0 // A    set p9 to indicate that we should restore cr.ifs
+
+    ld8 r31=[r2],32            // M0|1 load cr.ipsr
+    ld8 r30=[r3],16            // M0|1 load cr.iip
+    ;;
+//  ld8 r29=[r2],16            // M0|1 load cr.ifs
+    ld8 r28=[r3],16            // M0|1 load ar.unat
+//(pUStk) add r14=IA64_TASK_THREAD_ON_USTACK_OFFSET,r13
+    ;;
+    ld8 r27=[r2],PT(B0)-PT(AR_PFS)     // M0|1 load ar.pfs
+(pKStk) mov r22=psr                    // M2   read PSR now that interrupts 
are disabled
+    nop 0
+    ;;
+    ld8 r22=[r2],PT(AR_RNAT)-PT(B0) // M0|1 load b0
+    ld8 r26=[r3],PT(PR)-PT(AR_RSC)     // M0|1 load ar.rsc
+    mov f6=f0                  // F    clear f6
+    ;;
+    ld8 r25=[r2],PT(AR_FPSR)-PT(AR_RNAT)       // M0|1 load ar.rnat (may be 
garbage)
+    ld8 r23=[r3],PT(R1)-PT(PR)         // M0|1 load predicates
+    mov f7=f0                          // F    clear f7
+    ;;
+    ld8 r20=[r2],PT(R12)-PT(AR_FPSR)   // M0|1 load ar.fpsr
+    ld8.fill r1=[r3],16                        // M0|1 load r1
+//(pUStk) mov r17=1                            // A
+    ;;
+//(pUStk) st1 [r14]=r17                                // M2|3
+    ld8.fill r13=[r3],16                       // M0|1
+    mov f8=f0                          // F    clear f8
+    ;;
+    ld8.fill r12=[r2]                  // M0|1 restore r12 (sp)
+#ifdef XEN    
+    ld8.fill r2=[r3]                   // M0|1
+#else    
+    ld8.fill r15=[r3]                  // M0|1 restore r15
+#endif    
+    mov b6=r18                         // I0   restore b6
+    mov ar.fpsr=r20
+//  addl r17=THIS_CPU(ia64_phys_stacked_size_p8),r0 // A
+    mov f9=f0                                  // F    clear f9
+//(pKStk) br.cond.dpnt.many skip_rbs_switch            // B
+
+//  srlz.d                             // M0   ensure interruption collection 
is off (for cover)
+//  shr.u r18=r19,16           // I0|1 get byte size of existing "dirty" 
partition
+    mov r3=r21
+    cover                              // B    add current frame into dirty 
partition & set cr.ifs
+    ;;
+//(pUStk) ld4 r17=[r17]                        // M0|1 r17 = 
cpu_data->phys_stacked_size_p8
+    mov r19=ar.bsp                     // M2   get new backing store pointer
+    addl r18=IA64_RBS_OFFSET, r3
+    ;;
+    mov r3=r0
+    sub r18=r19,r18     // get byte size of existing "dirty" partition
+    ;;
+    shl r20=r18,16     // set rsc.load 
+    mov f10=f0                 // F    clear f10
+#ifdef XEN
+    mov r14=r0
 #else
+    movl r14=__kernel_syscall_via_epc // X
+#endif
+    ;;
+    mov.m ar.csd=r0                    // M2   clear ar.csd
+    mov.m ar.ccv=r0                    // M2   clear ar.ccv
+    mov b7=r14                 // I0   clear b7 (hint with 
__kernel_syscall_via_epc)
+
+    mov.m ar.ssd=r0                    // M2   clear ar.ssd
+    mov f11=f0                 // F    clear f11
+    br.cond.sptk.many vmx_rbs_switch   // B
+END(ia64_leave_hypercall)
+
+
 /*
  * in0: new rr7
  * in1: virtual address of shared_info
@@ -707,5 +743,3 @@ 1:
    srlz.d              // seralize restoration of psr.l
    br.ret.sptk.many rp
 END(vmx_switch_rr7)
-#endif
-
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/ia64/vmx/vmx_init.c
--- a/xen/arch/ia64/vmx/vmx_init.c      Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/ia64/vmx/vmx_init.c      Wed Feb 14 19:01:35 2007 +0000
@@ -290,7 +290,7 @@ static void vmx_release_assist_channel(s
  * Initialize VMX envirenment for guest. Only the 1st vp/vcpu
  * is registered here.
  */
-void
+int
 vmx_final_setup_guest(struct vcpu *v)
 {
        vpd_t *vpd;
@@ -305,7 +305,8 @@ vmx_final_setup_guest(struct vcpu *v)
         * to this solution. Maybe it can be deferred until we know created
         * one as vmx domain */
 #ifndef HASH_VHPT
-       init_domain_tlb(v);
+       if (init_domain_tlb(v) != 0)
+               return -1;
 #endif
        vmx_create_event_channels(v);
 
@@ -322,6 +323,8 @@ vmx_final_setup_guest(struct vcpu *v)
 
        /* Set up guest 's indicator for VTi domain*/
        set_bit(ARCH_VMX_DOMAIN, &v->arch.arch_vmx.flags);
+
+       return 0;
 }
 
 void
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/ia64/vmx/vmx_interrupt.c
--- a/xen/arch/ia64/vmx/vmx_interrupt.c Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/ia64/vmx/vmx_interrupt.c Wed Feb 14 19:01:35 2007 +0000
@@ -99,7 +99,7 @@ inject_guest_interruption(VCPU *vcpu, u6
     pt_isr.ir = 0;
     VMX(vcpu,cr_isr) = pt_isr.val;
     collect_interruption(vcpu);
-
+    vmx_ia64_set_dcr(vcpu);
     vmx_vcpu_get_iva(vcpu,&viva);
     regs->cr_iip = viva + vec;
 }
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/ia64/vmx/vmx_ivt.S
--- a/xen/arch/ia64/vmx/vmx_ivt.S       Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/ia64/vmx/vmx_ivt.S       Wed Feb 14 19:01:35 2007 +0000
@@ -59,6 +59,14 @@
 #include <asm/unistd.h>
 #include <asm/vhpt.h>
 #include <asm/virt_event.h>
+#include <xen/errno.h>
+
+#if 1
+# define PSR_DEFAULT_BITS   psr.ac
+#else
+# define PSR_DEFAULT_BITS   0
+#endif
+
 
 #ifdef VTI_DEBUG
   /*
@@ -431,17 +439,152 @@ ENTRY(vmx_break_fault)
     VMX_DBG_FAULT(11)
     mov r31=pr
     mov r19=11
-    mov r30=cr.iim
+    mov r17=cr.iim
     ;;
 #ifdef VTI_DEBUG
     // break 0 is already handled in vmx_ia64_handle_break.
-    cmp.eq p6,p7=r30,r0
+    cmp.eq p6,p7=r17,r0
     (p6) br.sptk vmx_fault_11
     ;;
 #endif
-    br.sptk.many vmx_dispatch_break_fault
-    ;;
-    VMX_FAULT(11);
+    mov r29=cr.ipsr
+    adds r22=IA64_VCPU_BREAKIMM_OFFSET, r21
+    ;;
+    ld4 r22=[r22]
+    extr.u r24=r29,IA64_PSR_CPL0_BIT,2
+    cmp.eq p0,p6=r0,r0
+    ;;
+    cmp.ne.or p6,p0=r22,r17
+    cmp.ne.or p6,p0=r0,r24
+(p6) br.sptk.many vmx_dispatch_break_fault
+    ;;
+   /*
+    * The streamlined system call entry/exit paths only save/restore the 
initial part
+    * of pt_regs.  This implies that the callers of system-calls must adhere 
to the
+    * normal procedure calling conventions.
+    *
+    *   Registers to be saved & restored:
+    *   CR registers: cr.ipsr, cr.iip, cr.ifs
+    *   AR registers: ar.unat, ar.pfs, ar.rsc, ar.rnat, ar.bspstore, ar.fpsr
+    *   others: pr, b0, b6, loadrs, r1, r11, r12, r13, r15
+    *   Registers to be restored only:
+    *   r8-r11: output value from the system call.
+    *
+    * During system call exit, scratch registers (including r15) are 
modified/cleared
+    * to prevent leaking bits from kernel to user level.
+    */
+   
+//  mov.m r16=IA64_KR(CURRENT)         // M2 r16 <- current task (12 cyc)
+    mov r14=r21
+    bsw.1                                      // B (6 cyc) regs are saved, 
switch to bank 1
+    ;;   
+    mov r29=cr.ipsr                            // M2 (12 cyc)
+    mov r31=pr                         // I0 (2 cyc)
+    mov r16=r14
+    mov r15=r2
+
+    mov r17=cr.iim                             // M2 (2 cyc)
+    mov.m r27=ar.rsc                   // M2 (12 cyc)
+//  mov r18=__IA64_BREAK_SYSCALL               // A
+
+    mov.m ar.rsc=0                             // M2
+    mov.m r21=ar.fpsr                  // M2 (12 cyc)
+    mov r19=b6                         // I0 (2 cyc)
+    ;;
+    mov.m r23=ar.bspstore                      // M2 (12 cyc)
+    mov.m r24=ar.rnat                  // M2 (5 cyc)
+    mov.i r26=ar.pfs                   // I0 (2 cyc)
+
+    invala                                     // M0|1
+    nop.m 0                                    // M
+    mov r20=r1                         // A                    save r1
+
+    nop.m 0
+//  movl r30=sys_call_table                    // X
+    movl r30=ia64_hypercall_table                      // X
+
+    mov r28=cr.iip                             // M2 (2 cyc)
+//  cmp.eq p0,p7=r18,r17                       // I0 is this a system call?
+//(p7)  br.cond.spnt non_syscall               // B  no ->
+   //
+   // From this point on, we are definitely on the syscall-path
+   // and we can use (non-banked) scratch registers.
+   //
+///////////////////////////////////////////////////////////////////////
+    mov r1=r16                         // A    move task-pointer to 
"addl"-addressable reg
+    mov r2=r16                         // A    setup r2 for ia64_syscall_setup
+//  add r9=TI_FLAGS+IA64_TASK_SIZE,r16 // A    r9 = 
&current_thread_info()->flags
+
+//  adds r16=IA64_TASK_THREAD_ON_USTACK_OFFSET,r16
+//  adds r15=-1024,r15                 // A    subtract 1024 from syscall 
number
+//  mov r3=NR_syscalls - 1
+    mov r3=NR_hypercalls - 1
+    ;;
+//  ld1.bias r17=[r16]                 // M0|1 r17 = current->thread.on_ustack 
flag
+//  ld4 r9=[r9]                                // M0|1 r9 = 
current_thread_info()->flags
+    mov r9=r0               // force flags = 0
+    extr.u r8=r29,41,2                 // I0   extract ei field from cr.ipsr
+
+    shladd r30=r15,3,r30                       // A    r30 = sys_call_table + 
8*(syscall-1024)
+    addl r22=IA64_RBS_OFFSET,r1                // A    compute base of RBS
+    cmp.leu p6,p7=r15,r3                       // A    syscall number in range?
+    ;;
+
+    lfetch.fault.excl.nt1 [r22]                // M0|1 prefetch RBS
+(p6) ld8 r30=[r30]                             // M0|1 load address of syscall 
entry point
+    tnat.nz.or p7,p0=r15                       // I0   is syscall nr a NaT?
+
+    mov.m ar.bspstore=r22                      // M2   switch to kernel RBS
+    cmp.eq p8,p9=2,r8                  // A    isr.ei==2?
+    ;;
+
+(p8) mov r8=0                          // A    clear ei to 0
+//(p7)  movl r30=sys_ni_syscall                        // X
+(p7) movl r30=do_ni_hypercall                  // X
+
+(p8) adds r28=16,r28                           // A    switch cr.iip to next 
bundle
+(p9) adds r8=1,r8                              // A    increment ei to next 
slot
+    nop.i 0
+    ;;
+
+    mov.m r25=ar.unat                  // M2 (5 cyc)
+    dep r29=r8,r29,41,2                        // I0   insert new ei into 
cr.ipsr
+//  adds r15=1024,r15                  // A    restore original syscall number
+   //
+   // If any of the above loads miss in L1D, we'll stall here until
+   // the data arrives.
+   //
+///////////////////////////////////////////////////////////////////////
+//    st1 [r16]=r0                             // M2|3 clear 
current->thread.on_ustack flag
+    mov b6=r30                         // I0   setup syscall handler branch 
reg early
+    cmp.ne pKStk,pUStk=r0,r0           // A    were we on kernel stacks 
already?
+
+//  and r9=_TIF_SYSCALL_TRACEAUDIT,r9  // A    mask trace or audit
+    mov r18=ar.bsp                             // M2 (12 cyc)
+   ;;
+(pUStk) addl r1=IA64_STK_OFFSET-IA64_PT_REGS_SIZE,r1 // A    compute base of 
memory stack
+//  cmp.eq p14,p0=r9,r0                        // A    are syscalls being 
traced/audited?
+//    br.call.sptk.many b7=ia64_syscall_setup  // B
+    br.call.sptk.many b7=ia64_hypercall_setup  // B
+1:
+    mov ar.rsc=0x3                             // M2   set eager mode, pl 0, 
LE, loadrs=0
+//    nop 0
+//    bsw.1                                    // B (6 cyc) regs are saved, 
switch to bank 1
+    ;;
+    ssm psr.ic | PSR_DEFAULT_BITS              // M2   now it's safe to 
re-enable intr.-collection
+//    movl r3=ia64_ret_from_syscall            // X
+    movl r3=ia64_leave_hypercall               // X
+    ;;
+
+    srlz.i                                     // M0   ensure interruption 
collection is on
+    mov rp=r3                          // I0   set the real return addr
+    //(p10) br.cond.spnt.many ia64_ret_from_syscall    // B    return if bad 
call-frame or r15 is a NaT
+    (p15)   ssm psr.i                          // M2   restore psr.i
+    //(p14) br.call.sptk.many b6=b6                    // B    invoke 
syscall-handker (ignore return addr)
+    br.call.sptk.many b6=b6                    // B    invoke syscall-handker 
(ignore return addr)
+//  br.cond.spnt.many ia64_trace_syscall       // B    do syscall-tracing 
thingamagic
+   ;;
+   VMX_FAULT(11)
 END(vmx_break_fault)
 
     .org vmx_ia64_ivt+0x3000
@@ -613,6 +756,146 @@ END(vmx_virtual_exirq)
 // 0x3800 Entry 14 (size 64 bundles) Reserved
     VMX_DBG_FAULT(14)
     VMX_FAULT(14)
+    // this code segment is from 2.6.16.13
+    
+    /*
+     * There is no particular reason for this code to be here, other than that
+     * there happens to be space here that would go unused otherwise.  If this
+     * fault ever gets "unreserved", simply moved the following code to a more
+     * suitable spot...
+     *
+     * ia64_syscall_setup() is a separate subroutine so that it can
+     * allocate stacked registers so it can safely demine any
+     * potential NaT values from the input registers.
+     *
+     * On entry:
+     * - executing on bank 0 or bank 1 register set (doesn't matter)
+     * -  r1: stack pointer
+     * -  r2: current task pointer
+     * -  r3: preserved
+     * - r11: original contents (saved ar.pfs to be saved)
+     * - r12: original contents (sp to be saved)
+     * - r13: original contents (tp to be saved)
+     * - r15: original contents (syscall # to be saved)
+     * - r18: saved bsp (after switching to kernel stack)
+     * - r19: saved b6
+     * - r20: saved r1 (gp)
+     * - r21: saved ar.fpsr
+     * - r22: kernel's register backing store base (krbs_base)
+     * - r23: saved ar.bspstore
+     * - r24: saved ar.rnat
+     * - r25: saved ar.unat
+     * - r26: saved ar.pfs
+     * - r27: saved ar.rsc
+     * - r28: saved cr.iip
+     * - r29: saved cr.ipsr
+     * - r31: saved pr
+     * -  b0: original contents (to be saved)
+     * On exit:
+     * -  p10: TRUE if syscall is invoked with more than 8 out
+     *         registers or r15's Nat is true
+     * -  r1: kernel's gp
+     * -  r3: preserved (same as on entry)
+     * -  r8: -EINVAL if p10 is true
+     * - r12: points to kernel stack
+     * - r13: points to current task
+     * - r14: preserved (same as on entry)
+     * - p13: preserved
+     * - p15: TRUE if interrupts need to be re-enabled
+     * - ar.fpsr: set to kernel settings
+     * -  b6: preserved (same as on entry)
+     */
+GLOBAL_ENTRY(ia64_hypercall_setup)
+#if PT(B6) != 0
+# error This code assumes that b6 is the first field in pt_regs.
+#endif
+    st8 [r1]=r19                               // save b6
+    add r16=PT(CR_IPSR),r1                     // initialize first base pointer
+    add r17=PT(R11),r1                 // initialize second base pointer
+    ;;
+    alloc r19=ar.pfs,8,0,0,0           // ensure in0-in7 are writable
+    st8 [r16]=r29,PT(AR_PFS)-PT(CR_IPSR)       // save cr.ipsr
+    tnat.nz p8,p0=in0
+
+    st8.spill [r17]=r11,PT(CR_IIP)-PT(R11)     // save r11
+    tnat.nz p9,p0=in1
+(pKStk) mov r18=r0                             // make sure r18 isn't NaT
+    ;;
+
+    st8 [r16]=r26,PT(CR_IFS)-PT(AR_PFS)        // save ar.pfs
+    st8 [r17]=r28,PT(AR_UNAT)-PT(CR_IIP)       // save cr.iip
+    mov r28=b0                         // save b0 (2 cyc)
+    ;;
+
+    st8 [r17]=r25,PT(AR_RSC)-PT(AR_UNAT)       // save ar.unat
+    dep r19=0,r19,38,26                        // clear all bits but 0..37 [I0]
+(p8)    mov in0=-1
+    ;;
+
+    st8 [r16]=r19,PT(AR_RNAT)-PT(CR_IFS)       // store ar.pfs.pfm in cr.ifs
+    extr.u r11=r19,7,7 // I0           // get sol of ar.pfs
+    and r8=0x7f,r19            // A            // get sof of ar.pfs
+
+    st8 [r17]=r27,PT(AR_BSPSTORE)-PT(AR_RSC)// save ar.rsc
+    tbit.nz p15,p0=r29,IA64_PSR_I_BIT // I0
+(p9)    mov in1=-1
+    ;;
+
+(pUStk) sub r18=r18,r22                                // r18=RSE.ndirty*8
+    tnat.nz p10,p0=in2
+    add r11=8,r11
+    ;;
+(pKStk) adds r16=PT(PR)-PT(AR_RNAT),r16                // skip over ar_rnat 
field
+(pKStk) adds r17=PT(B0)-PT(AR_BSPSTORE),r17    // skip over ar_bspstore field
+    tnat.nz p11,p0=in3
+    ;;
+(p10)   mov in2=-1
+    tnat.nz p12,p0=in4                         // [I0]
+(p11)   mov in3=-1
+    ;;
+(pUStk) st8 [r16]=r24,PT(PR)-PT(AR_RNAT)       // save ar.rnat
+(pUStk) st8 [r17]=r23,PT(B0)-PT(AR_BSPSTORE)   // save ar.bspstore
+    shl r18=r18,16                             // compute ar.rsc to be used 
for "loadrs"
+    ;;
+    st8 [r16]=r31,PT(LOADRS)-PT(PR)            // save predicates
+    st8 [r17]=r28,PT(R1)-PT(B0)                // save b0
+    tnat.nz p13,p0=in5                         // [I0]
+    ;;
+    st8 [r16]=r18,PT(R12)-PT(LOADRS)   // save ar.rsc value for "loadrs"
+    st8.spill [r17]=r20,PT(R13)-PT(R1) // save original r1
+(p12)   mov in4=-1
+    ;;
+
+.mem.offset 0,0; st8.spill [r16]=r12,PT(AR_FPSR)-PT(R12)       // save r12
+.mem.offset 8,0; st8.spill [r17]=r13,PT(R15)-PT(R13)           // save r13
+(p13)   mov in5=-1
+    ;;
+    st8 [r16]=r21,PT(R8)-PT(AR_FPSR)   // save ar.fpsr
+    tnat.nz p13,p0=in6
+    cmp.lt p10,p9=r11,r8       // frame size can't be more than local+8
+    ;;
+    mov r8=1
+(p9)    tnat.nz p10,p0=r15
+    adds r12=-16,r1            // switch to kernel memory stack (with 16 bytes 
of scratch)
+
+    st8.spill [r17]=r15                        // save r15
+    tnat.nz p8,p0=in7
+    nop.i 0
+
+    mov r13=r2                         // establish `current'
+    movl r1=__gp                               // establish kernel global 
pointer
+    ;;
+    st8 [r16]=r8               // ensure pt_regs.r8 != 0 (see 
handle_syscall_error)
+(p13)   mov in6=-1
+(p8)    mov in7=-1
+
+    cmp.eq pSys,pNonSys=r0,r0          // set pSys=1, pNonSys=0
+    movl r17=FPSR_DEFAULT
+    ;;
+    mov.m ar.fpsr=r17                  // set ar.fpsr to kernel default value
+(p10)   mov r8=-EINVAL
+    br.ret.sptk.many b7
+END(ia64_hypercall_setup)
 
 
     .org vmx_ia64_ivt+0x3c00
@@ -795,12 +1078,14 @@ ENTRY(vmx_virtualization_fault)
     cmp.eq p9,p0=EVENT_RSM,r24
     cmp.eq p10,p0=EVENT_SSM,r24
     cmp.eq p11,p0=EVENT_MOV_TO_PSR,r24
+    cmp.eq p12,p0=EVENT_THASH,r24 
     (p6) br.dptk.many vmx_asm_mov_from_ar
     (p7) br.dptk.many vmx_asm_mov_from_rr
     (p8) br.dptk.many vmx_asm_mov_to_rr
     (p9) br.dptk.many vmx_asm_rsm
     (p10) br.dptk.many vmx_asm_ssm
     (p11) br.dptk.many vmx_asm_mov_to_psr
+    (p12) br.dptk.many vmx_asm_thash
     ;;
 vmx_virtualization_fault_back:
     mov r19=37
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/ia64/vmx/vmx_minstate.h
--- a/xen/arch/ia64/vmx/vmx_minstate.h  Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/ia64/vmx/vmx_minstate.h  Wed Feb 14 19:01:35 2007 +0000
@@ -174,6 +174,7 @@
     ;;                                          \
     st8 [r16]=r29,16;   /* save b0 */                           \
     st8 [r17]=r18,16;   /* save ar.rsc value for "loadrs" */                \
+    cmp.eq pNonSys,pSys=r0,r0   /* initialize pSys=0, pNonSys=1 */          \
     ;;                                          \
 .mem.offset 0,0; st8.spill [r16]=r20,16;    /* save original r1 */             
 \
 .mem.offset 8,0; st8.spill [r17]=r12,16;                            \
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/ia64/vmx/vmx_phy_mode.c
--- a/xen/arch/ia64/vmx/vmx_phy_mode.c  Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/ia64/vmx/vmx_phy_mode.c  Wed Feb 14 19:01:35 2007 +0000
@@ -188,7 +188,7 @@ vmx_load_all_rr(VCPU *vcpu)
                        (void *)vcpu->arch.privregs,
                        (void *)vcpu->arch.vhpt.hash, pal_vaddr );
        ia64_set_pta(VMX(vcpu, mpta));
-       ia64_set_dcr(VMX(vcpu, mdcr));
+       vmx_ia64_set_dcr(vcpu);
 
        ia64_srlz_d();
        ia64_set_psr(psr);
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/ia64/vmx/vmx_process.c
--- a/xen/arch/ia64/vmx/vmx_process.c   Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/ia64/vmx/vmx_process.c   Wed Feb 14 19:01:35 2007 +0000
@@ -79,36 +79,56 @@ static u64 vec2off[68] = {0x0,0x400,0x80
 
 
 void vmx_reflect_interruption(u64 ifa, u64 isr, u64 iim,
-                              u64 vector, REGS *regs)
-{
-    u64 status;
+                              u64 vec, REGS *regs)
+{
+    u64 status, vector;
     VCPU *vcpu = current;
     u64 vpsr = VCPU(vcpu, vpsr);
-    vector=vec2off[vector];
+    
+    vector = vec2off[vec];
     if(!(vpsr&IA64_PSR_IC)&&(vector!=IA64_DATA_NESTED_TLB_VECTOR)){
         panic_domain(regs, "Guest nested fault vector=%lx!\n", vector);
     }
-    else{ // handle fpswa emulation
+
+    switch (vec) {
+
+    case 25:   // IA64_DISABLED_FPREG_VECTOR
+
+        if (FP_PSR(vcpu) & IA64_PSR_DFH) {
+            FP_PSR(vcpu) = IA64_PSR_MFH;
+            if (__ia64_per_cpu_var(fp_owner) != vcpu)
+                __ia64_load_fpu(vcpu->arch._thread.fph);
+        }
+        if (!(VCPU(vcpu, vpsr) & IA64_PSR_DFH)) {
+            regs->cr_ipsr &= ~IA64_PSR_DFH;
+            return;
+        }
+
+        break;       
+        
+    case 32:   // IA64_FP_FAULT_VECTOR
+        // handle fpswa emulation
         // fp fault
-        if (vector == IA64_FP_FAULT_VECTOR) {
-            status = handle_fpu_swa(1, regs, isr);
-            if (!status) {
-                vcpu_increment_iip(vcpu);
-                return;
-            } else if (IA64_RETRY == status)
-                return;
-        }
+        status = handle_fpu_swa(1, regs, isr);
+        if (!status) {
+            vcpu_increment_iip(vcpu);
+            return;
+        } else if (IA64_RETRY == status)
+            return;
+        break;
+
+    case 33:   // IA64_FP_TRAP_VECTOR
         //fp trap
-        else if (vector == IA64_FP_TRAP_VECTOR) {
-            status = handle_fpu_swa(0, regs, isr);
-            if (!status)
-                return;
-            else if (IA64_RETRY == status) {
-                vcpu_decrement_iip(vcpu);
-                return;
-            }
-        }
-    }
+        status = handle_fpu_swa(0, regs, isr);
+        if (!status)
+            return;
+        else if (IA64_RETRY == status) {
+            vcpu_decrement_iip(vcpu);
+            return;
+        }
+        break;
+    
+    } 
     VCPU(vcpu,isr)=isr;
     VCPU(vcpu,iipa) = regs->cr_iip;
     if (vector == IA64_BREAK_VECTOR || vector == IA64_SPECULATION_VECTOR)
@@ -194,7 +214,7 @@ void save_banked_regs_to_vpd(VCPU *v, RE
 // ONLY gets called from ia64_leave_kernel
 // ONLY call with interrupts disabled?? (else might miss one?)
 // NEVER successful if already reflecting a trap/fault because psr.i==0
-void leave_hypervisor_tail(struct pt_regs *regs)
+void leave_hypervisor_tail(void)
 {
     struct domain *d = current->domain;
     struct vcpu *v = current;
@@ -207,17 +227,23 @@ void leave_hypervisor_tail(struct pt_reg
         local_irq_disable();
 
         if (v->vcpu_id == 0) {
-            int callback_irq =
+            unsigned long callback_irq =
                 d->arch.hvm_domain.params[HVM_PARAM_CALLBACK_IRQ];
+            /*
+             * val[63:56] == 1: val[55:0] is a delivery PCI INTx line:
+             *                  Domain = val[47:32], Bus  = val[31:16],
+             *                  DevFn  = val[15: 8], IntX = val[ 1: 0]
+             * val[63:56] == 0: val[55:0] is a delivery as GSI
+             */
             if (callback_irq != 0 && local_events_need_delivery()) {
                 /* change level for para-device callback irq */
                 /* use level irq to send discrete event */
-                if (callback_irq & IA64_CALLBACK_IRQ_RID) {
-                    /* case of using Requester-ID as callback irq */
-                    /* RID: '<#bus(8)><#dev(5)><#func(3)>' */
-                    int dev = (callback_irq >> 3) & 0x1f;
-                    viosapic_set_pci_irq(d, dev, 0, 1);
-                    viosapic_set_pci_irq(d, dev, 0, 0);
+                if ((uint8_t)(callback_irq >> 56) == 1) {
+                    /* case of using PCI INTx line as callback irq */
+                    int pdev = (callback_irq >> 11) & 0x1f;
+                    int pintx = callback_irq & 3;
+                    viosapic_set_pci_irq(d, pdev, pintx, 1);
+                    viosapic_set_pci_irq(d, pdev, pintx, 0);
                 } else {
                     /* case of using GSI as callback irq */
                     viosapic_set_irq(d, callback_irq, 1);
@@ -367,7 +393,7 @@ vmx_hpw_miss(u64 vadr , u64 vec, REGS* r
     
         if (!vpsr.ic)
             misr.ni = 1;
-        if(!vhpt_enabled(v, vadr, misr.rs?RSE_REF:DATA_REF)){
+        if (!vhpt_enabled(v, vadr, INST_REF)) {
             vcpu_set_isr(v, misr.val);
             alt_itlb(v, vadr);
             return IA64_FAULT;
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/ia64/vmx/vmx_vcpu.c
--- a/xen/arch/ia64/vmx/vmx_vcpu.c      Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/ia64/vmx/vmx_vcpu.c      Wed Feb 14 19:01:35 2007 +0000
@@ -78,6 +78,22 @@ unsigned long guest_psr_index = 0;
 unsigned long guest_psr_index = 0;
 #endif
 
+
+void
+vmx_ia64_set_dcr(VCPU *v)   
+{
+    unsigned long dcr_bits = IA64_DEFAULT_DCR_BITS;
+
+    // if guest is runing on cpl > 0, set dcr.dm=1
+    // if geust is runing on cpl = 0, set dcr.dm=0
+    // because Guest OS may ld.s on tr mapped page.
+    if (!(VCPU(v, vpsr) & IA64_PSR_CPL))
+        dcr_bits &= ~IA64_DCR_DM;
+
+    ia64_set_dcr(dcr_bits);
+}
+
+
 void
 vmx_vcpu_set_psr(VCPU *vcpu, unsigned long value)
 {
@@ -140,6 +156,9 @@ vmx_vcpu_set_psr(VCPU *vcpu, unsigned lo
         IA64_PSR_VM;
 
     regs->cr_ipsr = (regs->cr_ipsr & mask ) | ( value & (~mask) );
+
+    if (FP_PSR(vcpu) & IA64_PSR_DFH)
+        regs->cr_ipsr |= IA64_PSR_DFH;
 
     check_mm_mode_switch(vcpu, old_psr, new_psr);
     return ;
@@ -258,6 +277,7 @@ IA64FAULT vmx_vcpu_rfi(VCPU *vcpu)
     else
         vcpu_bsw0(vcpu);
     vmx_vcpu_set_psr(vcpu,psr);
+    vmx_ia64_set_dcr(vcpu);
     ifs=VCPU(vcpu,ifs);
     if(ifs>>63)
         regs->cr_ifs = ifs;
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/ia64/vmx/vmx_virt.c
--- a/xen/arch/ia64/vmx/vmx_virt.c      Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/ia64/vmx/vmx_virt.c      Wed Feb 14 19:01:35 2007 +0000
@@ -1234,7 +1234,7 @@ IA64FAULT vmx_emul_mov_to_cr(VCPU *vcpu,
 #endif  //CHECK_FAULT
     r2 = cr_igfld_mask(inst.M32.cr3,r2);
     switch (inst.M32.cr3) {
-        case 0: return vmx_vcpu_set_dcr(vcpu,r2);
+        case 0: return vcpu_set_dcr(vcpu,r2);
         case 1: return vmx_vcpu_set_itm(vcpu,r2);
         case 2: return vmx_vcpu_set_iva(vcpu,r2);
         case 8: return vmx_vcpu_set_pta(vcpu,r2);
@@ -1299,7 +1299,7 @@ IA64FAULT vmx_emul_mov_from_cr(VCPU *vcp
 
 //    from_cr_cnt[inst.M33.cr3]++;
     switch (inst.M33.cr3) {
-        case 0: return vmx_cr_get(dcr);
+        case 0: return cr_get(dcr);
         case 1: return vmx_cr_get(itm);
         case 2: return vmx_cr_get(iva);
         case 8: return vmx_cr_get(pta);
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/ia64/vmx/vtlb.c
--- a/xen/arch/ia64/vmx/vtlb.c  Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/ia64/vmx/vtlb.c  Wed Feb 14 19:01:35 2007 +0000
@@ -248,6 +248,7 @@ u64 guest_vhpt_lookup(u64 iha, u64 *pte)
                   "tnat.nz p6,p7=r9;;"
                   "(p6) mov %0=1;"
                   "(p6) mov r9=r0;"
+                  "(p7) extr.u r9=r9,0,53;;"
                   "(p7) mov %0=r0;"
                   "(p7) st8 [%2]=r9;;"
                   "ssm psr.ic;;"
@@ -261,7 +262,7 @@ u64 guest_vhpt_lookup(u64 iha, u64 *pte)
  *  purge software guest tlb
  */
 
-void vtlb_purge(VCPU *v, u64 va, u64 ps)
+static void vtlb_purge(VCPU *v, u64 va, u64 ps)
 {
     thash_data_t *cur;
     u64 start, curadr, size, psbits, tag, rr_ps, num;
@@ -442,6 +443,15 @@ void thash_purge_entries(VCPU *v, u64 va
     vhpt_purge(v, va, ps);
 }
 
+void thash_purge_entries_remote(VCPU *v, u64 va, u64 ps)
+{
+    u64 old_va = va;
+    va = REGION_OFFSET(va);
+    if (vcpu_quick_region_check(v->arch.tc_regions, old_va))
+        vtlb_purge(v, va, ps);
+    vhpt_purge(v, va, ps);
+}
+
 u64 translate_phy_pte(VCPU *v, u64 *pte, u64 itir, u64 va)
 {
     u64 ps, ps_mask, paddr, maddr;
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/ia64/xen/dom_fw.c
--- a/xen/arch/ia64/xen/dom_fw.c        Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/ia64/xen/dom_fw.c        Wed Feb 14 19:01:35 2007 +0000
@@ -599,7 +599,17 @@ complete_dom0_memmap(struct domain *d,
 
                case EFI_UNUSABLE_MEMORY:
                case EFI_PAL_CODE:
-                       /* Discard.  */
+                       /*
+                        * We don't really need these, but holes in the
+                        * memory map may cause Linux to assume there are
+                        * uncacheable ranges within a granule.
+                        */
+                       dom_md->type = EFI_UNUSABLE_MEMORY;
+                       dom_md->phys_addr = start;
+                       dom_md->virt_addr = 0;
+                       dom_md->num_pages = (end - start) >> EFI_PAGE_SHIFT;
+                       dom_md->attribute = EFI_MEMORY_WB;
+                       num_mds++;
                        break;
 
                default:
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/ia64/xen/domain.c
--- a/xen/arch/ia64/xen/domain.c        Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/ia64/xen/domain.c        Wed Feb 14 19:01:35 2007 +0000
@@ -42,6 +42,7 @@
 #include <asm/vmx_vpd.h>
 #include <asm/vmx_phy_mode.h>
 #include <asm/vhpt.h>
+#include <asm/vcpu.h>
 #include <asm/tlbflush.h>
 #include <asm/regionreg.h>
 #include <asm/dom_fw.h>
@@ -67,6 +68,8 @@ static void init_switch_stack(struct vcp
    This is a Xen virtual address.  */
 DEFINE_PER_CPU(uint8_t *, current_psr_i_addr);
 DEFINE_PER_CPU(int *, current_psr_ic_addr);
+
+DEFINE_PER_CPU(struct vcpu *, fp_owner);
 
 #include <xen/sched-if.h>
 
@@ -135,12 +138,44 @@ static void flush_vtlb_for_context_switc
        }
 }
 
+static void lazy_fp_switch(struct vcpu *prev, struct vcpu *next)
+{
+       /*
+        * Implement eager save, lazy restore
+        */
+       if (!is_idle_vcpu(prev)) {
+               if (VMX_DOMAIN(prev)) {
+                       if (FP_PSR(prev) & IA64_PSR_MFH) {
+                               __ia64_save_fpu(prev->arch._thread.fph);
+                               __ia64_per_cpu_var(fp_owner) = prev;
+                       }
+               } else {
+                       if (PSCB(prev, hpsr_mfh)) {
+                               __ia64_save_fpu(prev->arch._thread.fph);
+                               __ia64_per_cpu_var(fp_owner) = prev;
+                       }
+               }
+       }
+
+       if (!is_idle_vcpu(next)) {
+               if (VMX_DOMAIN(next)) {
+                       FP_PSR(next) = IA64_PSR_DFH;
+                       vcpu_regs(next)->cr_ipsr |= IA64_PSR_DFH;
+               } else {
+                       PSCB(next, hpsr_dfh) = 1;
+                       PSCB(next, hpsr_mfh) = 0;
+                       vcpu_regs(next)->cr_ipsr |= IA64_PSR_DFH;
+               }
+       }
+}
+
 void schedule_tail(struct vcpu *prev)
 {
        extern char ia64_ivt;
+
        context_saved(prev);
-
        ia64_disable_vhpt_walker();
+
        if (VMX_DOMAIN(current)) {
                vmx_do_launch(current);
                migrate_timer(&current->arch.arch_vmx.vtm.vtm_timer,
@@ -148,7 +183,7 @@ void schedule_tail(struct vcpu *prev)
        } else {
                ia64_set_iva(&ia64_ivt);
                load_region_regs(current);
-               ia64_set_pta(vcpu_pta(current));
+               ia64_set_pta(vcpu_pta(current));
                vcpu_load_kernel_regs(current);
                __ia64_per_cpu_var(current_psr_i_addr) = &current->domain->
                  shared_info->vcpu_info[current->vcpu_id].evtchn_upcall_mask;
@@ -165,64 +200,65 @@ void context_switch(struct vcpu *prev, s
 
     local_irq_save(spsr);
 
-    if (!is_idle_domain(prev->domain)) 
-        __ia64_save_fpu(prev->arch._thread.fph);
-    if (!is_idle_domain(next->domain)) 
-        __ia64_load_fpu(next->arch._thread.fph);
-
     if (VMX_DOMAIN(prev)) {
-       vmx_save_state(prev);
-       if (!VMX_DOMAIN(next)) {
-           /* VMX domains can change the physical cr.dcr.
-            * Restore default to prevent leakage. */
-           ia64_setreg(_IA64_REG_CR_DCR, (IA64_DCR_DP | IA64_DCR_DK
-                          | IA64_DCR_DX | IA64_DCR_DR | IA64_DCR_PP
-                          | IA64_DCR_DA | IA64_DCR_DD | IA64_DCR_LC));
-       }
+        vmx_save_state(prev);
+        if (!VMX_DOMAIN(next)) {
+            /* VMX domains can change the physical cr.dcr.
+             * Restore default to prevent leakage. */
+            ia64_setreg(_IA64_REG_CR_DCR, IA64_DEFAULT_DCR_BITS);
+        }
     }
     if (VMX_DOMAIN(next))
-       vmx_load_state(next);
+        vmx_load_state(next);
 
     ia64_disable_vhpt_walker();
-    /*ia64_psr(ia64_task_regs(next))->dfh = !ia64_is_local_fpu_owner(next);*/
+    lazy_fp_switch(prev, current);
+
     prev = ia64_switch_to(next);
 
     /* Note: ia64_switch_to does not return here at vcpu initialization.  */
 
-    //cpu_set(smp_processor_id(), current->domain->domain_dirty_cpumask);
- 
-    if (VMX_DOMAIN(current)){
-       vmx_load_all_rr(current);
-       migrate_timer(&current->arch.arch_vmx.vtm.vtm_timer,
-                     current->processor);
+    if (VMX_DOMAIN(current)) {
+        vmx_load_all_rr(current);
+        migrate_timer(&current->arch.arch_vmx.vtm.vtm_timer,
+                      current->processor);
     } else {
-       struct domain *nd;
-       extern char ia64_ivt;
-
-       ia64_set_iva(&ia64_ivt);
-
-       nd = current->domain;
-       if (!is_idle_domain(nd)) {
-               load_region_regs(current);
-               ia64_set_pta(vcpu_pta(current));
-               vcpu_load_kernel_regs(current);
-               vcpu_set_next_timer(current);
-               if (vcpu_timer_expired(current))
-                       vcpu_pend_timer(current);
-               __ia64_per_cpu_var(current_psr_i_addr) = &nd->shared_info->
-                 vcpu_info[current->vcpu_id].evtchn_upcall_mask;
-               __ia64_per_cpu_var(current_psr_ic_addr) =
-                 (int *)(nd->arch.shared_info_va + XSI_PSR_IC_OFS);
-       } else {
-               /* When switching to idle domain, only need to disable vhpt
-                * walker. Then all accesses happen within idle context will
-                * be handled by TR mapping and identity mapping.
-                */
-               __ia64_per_cpu_var(current_psr_i_addr) = NULL;
-               __ia64_per_cpu_var(current_psr_ic_addr) = NULL;
+        struct domain *nd;
+        extern char ia64_ivt;
+
+        ia64_set_iva(&ia64_ivt);
+
+        nd = current->domain;
+        if (!is_idle_domain(nd)) {
+            load_region_regs(current);
+            ia64_set_pta(vcpu_pta(current));
+            vcpu_load_kernel_regs(current);
+            vcpu_set_next_timer(current);
+            if (vcpu_timer_expired(current))
+                vcpu_pend_timer(current);
+            __ia64_per_cpu_var(current_psr_i_addr) = &nd->shared_info->
+                vcpu_info[current->vcpu_id].evtchn_upcall_mask;
+            __ia64_per_cpu_var(current_psr_ic_addr) =
+                (int *)(nd->arch.shared_info_va + XSI_PSR_IC_OFS);
+        } else {
+            /* When switching to idle domain, only need to disable vhpt
+             * walker. Then all accesses happen within idle context will
+             * be handled by TR mapping and identity mapping.
+             */
+            __ia64_per_cpu_var(current_psr_i_addr) = NULL;
+            __ia64_per_cpu_var(current_psr_ic_addr) = NULL;
         }
     }
     local_irq_restore(spsr);
+
+    /* lazy fp */
+    if (current->processor != current->arch.last_processor) {
+        unsigned long *addr;
+        addr = (unsigned long *)per_cpu_addr(fp_owner,
+                                             current->arch.last_processor);
+        ia64_cmpxchg(acq, addr, current, 0, 8);
+    }
+   
     flush_vtlb_for_context_switch(prev, current);
     context_saved(prev);
 }
@@ -411,9 +447,6 @@ int vcpu_late_initialise(struct vcpu *v)
                assign_domain_page(d, IA64_XMAPPEDREGS_PADDR(v->vcpu_id) + i,
                                   virt_to_maddr(v->arch.privregs + i));
 
-       tlbflush_update_time(&v->arch.tlbflush_timestamp,
-                            tlbflush_current_time());
-
        return 0;
 }
 
@@ -519,6 +552,12 @@ void arch_domain_destroy(struct domain *
        deallocate_rid_range(d);
 }
 
+int arch_vcpu_reset(struct vcpu *v)
+{
+       /* FIXME: Stub for now */
+       return 0;
+}
+
 void arch_get_info_guest(struct vcpu *v, vcpu_guest_context_u c)
 {
        int i;
@@ -542,7 +581,7 @@ void arch_get_info_guest(struct vcpu *v,
                er->dtrs[i].rid = v->arch.dtrs[i].rid;
        }
        er->event_callback_ip = v->arch.event_callback_ip;
-       er->dcr = v->arch.dcr;
+       er->dcr = PSCB(v,dcr);
        er->iva = v->arch.iva;
 }
 
@@ -578,16 +617,18 @@ int arch_set_info_guest(struct vcpu *v, 
                                     er->dtrs[i].rid);
                }
                v->arch.event_callback_ip = er->event_callback_ip;
-               v->arch.dcr = er->dcr;
+               PSCB(v,dcr) = er->dcr;
                v->arch.iva = er->iva;
        }
 
        if (test_bit(_VCPUF_initialised, &v->vcpu_flags))
                return 0;
 
-       if (d->arch.is_vti)
-               vmx_final_setup_guest(v);
-       else {
+       if (d->arch.is_vti) {
+               rc = vmx_final_setup_guest(v);
+               if (rc != 0)
+                       return rc;
+       } else {
                rc = vcpu_late_initialise(v);
                if (rc != 0)
                        return rc;
@@ -982,12 +1023,6 @@ int construct_dom0(struct domain *d,
        unsigned long bp_mpa;
        struct ia64_boot_param *bp;
 
-#ifdef VALIDATE_VT
-       unsigned int vmx_dom0 = 0;
-       unsigned long mfn;
-       struct page_info *page = NULL;
-#endif
-
 //printk("construct_dom0: starting\n");
 
        /* Sanity! */
@@ -1020,23 +1055,6 @@ int construct_dom0(struct domain *d,
                printk("Incompatible kernel binary\n");
                return -1;
        }
-
-#ifdef VALIDATE_VT
-       /* Temp workaround */
-       if (running_on_sim)
-           dsi.xen_section_string = (char *)1;
-
-       /* Check whether dom0 is vti domain */
-       if ((!vmx_enabled) && !dsi.xen_section_string) {
-           printk("Lack of hardware support for unmodified vmx dom0\n");
-           panic("");
-       }
-
-       if (vmx_enabled && !dsi.xen_section_string) {
-           printk("Dom0 is vmx domain!\n");
-           vmx_dom0 = 1;
-       }
-#endif
 
        p_start = parms.virt_base;
        pkern_start = parms.virt_kstart;
@@ -1131,14 +1149,6 @@ int construct_dom0(struct domain *d,
 
        printk("Dom0: 0x%lx\n", (u64)dom0);
 
-#ifdef VALIDATE_VT
-       /* VMX specific construction for Dom0, if hardware supports VMX
-        * and Dom0 is unmodified image
-        */
-       if (vmx_dom0)
-           vmx_final_setup_guest(v);
-#endif
-
        set_bit(_VCPUF_initialised, &v->vcpu_flags);
 
        /* Build firmware.
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/ia64/xen/faults.c
--- a/xen/arch/ia64/xen/faults.c        Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/ia64/xen/faults.c        Wed Feb 14 19:01:35 2007 +0000
@@ -92,6 +92,9 @@ void reflect_interruption(unsigned long 
        regs->cr_iip = ((unsigned long)PSCBX(v, iva) + vector) & ~0xffUL;
        regs->cr_ipsr = (regs->cr_ipsr & ~DELIVER_PSR_CLR) | DELIVER_PSR_SET;
 
+       if (PSCB(v, hpsr_dfh))
+               regs->cr_ipsr |= IA64_PSR_DFH;  
+       PSCB(v, vpsr_dfh) = 0;
        v->vcpu_info->evtchn_upcall_mask = 1;
        PSCB(v, interrupt_collection_enabled) = 0;
 
@@ -152,6 +155,9 @@ void reflect_event(void)
        regs->cr_iip = v->arch.event_callback_ip;
        regs->cr_ipsr = (regs->cr_ipsr & ~DELIVER_PSR_CLR) | DELIVER_PSR_SET;
 
+       if (PSCB(v, hpsr_dfh))
+               regs->cr_ipsr |= IA64_PSR_DFH;
+       PSCB(v, vpsr_dfh) = 0;
        v->vcpu_info->evtchn_upcall_mask = 1;
        PSCB(v, interrupt_collection_enabled) = 0;
 }
@@ -261,6 +267,10 @@ void ia64_do_page_fault(unsigned long ad
                    ((unsigned long)PSCBX(current, iva) + fault) & ~0xffUL;
                regs->cr_ipsr =
                    (regs->cr_ipsr & ~DELIVER_PSR_CLR) | DELIVER_PSR_SET;
+
+               if (PSCB(current, hpsr_dfh))
+                       regs->cr_ipsr |= IA64_PSR_DFH;  
+               PSCB(current, vpsr_dfh) = 0;
                perfc_incra(slow_reflect, fault >> 8);
                return;
        }
@@ -608,6 +618,16 @@ ia64_handle_reflection(unsigned long ifa
                vector = IA64_GENEX_VECTOR;
                break;
        case 25:
+               if (PSCB(v, hpsr_dfh)) {
+                       PSCB(v, hpsr_dfh) = 0;
+                       PSCB(v, hpsr_mfh) = 1;
+                       if (__ia64_per_cpu_var(fp_owner) != v)
+                               __ia64_load_fpu(v->arch._thread.fph);
+               }
+               if (!PSCB(v, vpsr_dfh)) {
+                       regs->cr_ipsr &= ~IA64_PSR_DFH;
+                       return;
+               }
                vector = IA64_DISABLED_FPREG_VECTOR;
                break;
        case 26:
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/ia64/xen/flushtlb.c
--- a/xen/arch/ia64/xen/flushtlb.c      Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/ia64/xen/flushtlb.c      Wed Feb 14 19:01:35 2007 +0000
@@ -59,44 +59,18 @@ tlbflush_clock_inc_and_return(void)
     return t2;
 }
 
+static void
+tlbflush_clock_local_flush(void *unused)
+{
+    local_vhpt_flush();
+    local_flush_tlb_all();
+}
+
 void
 new_tlbflush_clock_period(void)
 {
-    /*
-     *XXX TODO
-     * If flushing all vcpu's vhpt takes too long, it can be done backgroundly.
-     * In such case tlbflush time comparison is done using only 31bit
-     * similar to linux jiffies comparison.
-     * vhpt should be flushed gradually before wraping 31bits.
-     *
-     * Sample calculation.
-     * Currently Xen/IA64 can create up to 64 domains at the same time.
-     * Vhpt size is currently 64KB. (This might be changed later though)
-     * Suppose each domains have 4 vcpus (or 16 vcpus).
-     * then the memory size which must be flushed is 16MB (64MB).
-     */    
-    struct domain* d;
-    struct vcpu* v;
-    /* flush all vhpt of vcpu of all existing domain. */
-    read_lock(&domlist_lock);
-    for_each_domain(d) {
-        for_each_vcpu(d, v) {
-            vcpu_purge_tr_entry(&PSCBX(v,dtlb));
-            vcpu_purge_tr_entry(&PSCBX(v,itlb));
-        }
-    }
-    smp_mb();
-    for_each_domain(d) {
-        for_each_vcpu(d, v) {
-            if (HAS_PERVCPU_VHPT(v->domain))
-                vcpu_vhpt_flush(v);
-        }
-    }
-    read_unlock(&domlist_lock);
-    /* unlock has release semantics */
-
     /* flush all vhpt of physical cpu and mTLB */
-    on_each_cpu((void (*)(void *))local_flush_tlb_all, NULL, 1, 1);
+    on_each_cpu(tlbflush_clock_local_flush, NULL, 1, 1);
 
     /*
      * if global TLB shootdown is finished, increment tlbflush_time
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/ia64/xen/fw_emul.c
--- a/xen/arch/ia64/xen/fw_emul.c       Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/ia64/xen/fw_emul.c       Wed Feb 14 19:01:35 2007 +0000
@@ -605,9 +605,11 @@ xen_pal_emulator(unsigned long index, u6
                        printk ("Domain0 halts the machine\n");
                        console_start_sync();
                        (*efi.reset_system)(EFI_RESET_SHUTDOWN,0,0,NULL);
-               }
-               else
-                       domain_shutdown(current->domain, SHUTDOWN_poweroff);
+               } else {
+                       set_bit(_VCPUF_down, &current->vcpu_flags);
+                       vcpu_sleep_nosync(current);
+                       status = PAL_STATUS_SUCCESS;
+               }
                break;
            case PAL_HALT_LIGHT:
                if (VMX_DOMAIN(current)) {
@@ -622,6 +624,9 @@ xen_pal_emulator(unsigned long index, u6
            case PAL_PLATFORM_ADDR:
                if (VMX_DOMAIN(current))
                        status = PAL_STATUS_SUCCESS;
+               break;
+           case PAL_LOGICAL_TO_PHYSICAL:
+               /* Optional, no need to complain about being unimplemented */
                break;
            default:
                printk("xen_pal_emulator: UNIMPLEMENTED PAL CALL %lu!!!!\n",
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/ia64/xen/hyperprivop.S
--- a/xen/arch/ia64/xen/hyperprivop.S   Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/ia64/xen/hyperprivop.S   Wed Feb 14 19:01:35 2007 +0000
@@ -252,6 +252,10 @@ ENTRY(hyper_ssm_i)
        movl r27=~DELIVER_PSR_CLR;;
        or r29=r29,r28;;
        and r29=r29,r27;;
+       // set hpsr_dfh to ipsr
+       adds r28=XSI_HPSR_DFH_OFS-XSI_PSR_IC_OFS,r18;;
+       ld1 r28=[r28];;
+       dep r29=r28,r29,IA64_PSR_DFH_BIT,1;;
        mov cr.ipsr=r29;;
        // set shared_mem ipsr (from ipsr in r30 with ipsr.ri already set)
        extr.u r29=r30,IA64_PSR_CPL0_BIT,2;;
@@ -269,6 +273,12 @@ ENTRY(hyper_ssm_i)
        movl r22=THIS_CPU(current_psr_i_addr)
        adds r21=XSI_IPSR_OFS-XSI_PSR_IC_OFS,r18 ;;
        ld8 r22=[r22]
+       ;;
+       adds r27=XSI_VPSR_DFH_OFS-XSI_PSR_IC_OFS,r18;;
+       ld1 r28=[r27];;
+       st1 [r27]=r0
+       dep r30=r28,r30,IA64_PSR_DFH_BIT,1
+       ;;
        st8 [r21]=r30;;
        // set shared_mem interrupt_delivery_enabled to 0
        // set shared_mem interrupt_collection_enabled to 0
@@ -607,6 +617,10 @@ ENTRY(fast_reflect)
        movl r27=~(DELIVER_PSR_CLR|IA64_PSR_CPL0);;
        or r29=r29,r28;;
        and r29=r29,r27;;
+       // set hpsr_dfh to ipsr
+       adds r28=XSI_HPSR_DFH_OFS-XSI_PSR_IC_OFS,r18;;
+       ld1 r28=[r28];;
+       dep r29=r28,r29,IA64_PSR_DFH_BIT,1;;
        mov cr.ipsr=r29;;
        // set shared_mem ipsr (from ipsr in r30 with ipsr.ri already set)
        extr.u r29=r30,IA64_PSR_CPL0_BIT,2;;
@@ -629,7 +643,13 @@ ENTRY(fast_reflect)
 (p6)   dep r30=0,r30,IA64_PSR_I_BIT,1
 (p7)   dep r30=-1,r30,IA64_PSR_I_BIT,1 ;;
        mov r22=1
-       adds r21=XSI_IPSR_OFS-XSI_PSR_IC_OFS,r18 ;;
+       adds r21=XSI_IPSR_OFS-XSI_PSR_IC_OFS,r18 
+       ;;
+       adds r27=XSI_VPSR_DFH_OFS-XSI_PSR_IC_OFS,r18;;
+       ld1 r28=[r27];;
+       st1 [r27]=r0
+       dep r30=r28,r30,IA64_PSR_DFH_BIT,1
+       ;;
        st8 [r21]=r30 ;;
        // set shared_mem interrupt_delivery_enabled to 0
        // set shared_mem interrupt_collection_enabled to 0
@@ -1103,6 +1123,18 @@ just_do_rfi:
                  IA64_PSR_IT|IA64_PSR_BN)
        ;;
        or r21=r21,r20
+       ;;
+       adds r20=XSI_VPSR_DFH_OFS-XSI_PSR_IC_OFS,r18;;
+       tbit.z p8,p9 = r21, IA64_PSR_DFH_BIT
+       ;;
+       (p9) mov r27=1;;
+       (p9) st1 [r20]=r27
+       ;;
+       (p8) st1 [r20]=r0
+       (p8) adds r20=XSI_HPSR_DFH_OFS-XSI_PSR_IC_OFS,r18;;
+       (p8) ld1 r27=[r20]
+       ;;
+       (p8) dep r21=r27,r21, IA64_PSR_DFH_BIT, 1
        ;;
        mov cr.ipsr=r21
        adds r20=XSI_BANKNUM_OFS-XSI_PSR_IC_OFS,r18 ;;
@@ -1488,6 +1520,11 @@ ENTRY(hyper_get_psr)
        ld8 r20=[r20];;
        ld1 r21=[r20];;
        dep r8=r21,r8,IA64_PSR_I_BIT,1
+       ;;
+       // set vpsr.dfh
+       adds r20=XSI_VPSR_DFH_OFS-XSI_PSR_IC_OFS,r18;;
+       ld1 r21=[r20];;
+       dep r8=r21,r8,IA64_PSR_DFH_BIT,1
        ;;
        mov r25=cr.iip
        extr.u r26=r24,41,2 ;;
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/ia64/xen/mm.c
--- a/xen/arch/ia64/xen/mm.c    Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/ia64/xen/mm.c    Wed Feb 14 19:01:35 2007 +0000
@@ -525,7 +525,9 @@ u64 translate_domain_pte(u64 pteval, u64
                           This can happen when domU tries to touch i/o
                           port space.  Also prevents possible address
                           aliasing issues.  */
-                       printk("Warning: UC to WB for mpaddr=%lx\n", mpaddr);
+                       if (!(mpaddr - IO_PORTS_PADDR < IO_PORTS_SIZE))
+                               gdprintk(XENLOG_WARNING, "Warning: UC to WB "
+                                        "for mpaddr=%lx\n", mpaddr);
                        pteval = (pteval & ~_PAGE_MA_MASK) | _PAGE_MA_WB;
                }
                break;
@@ -690,7 +692,6 @@ unsigned long lookup_domain_mpa(struct d
     if (pte != NULL) {
         pte_t tmp_pte = *pte;// pte is volatile. copy the value.
         if (pte_present(tmp_pte)) {
-//printk("lookup_domain_page: found mapping for %lx, 
pte=%lx\n",mpaddr,pte_val(*pte));
             if (entry != NULL)
                 p2m_entry_set(entry, pte, tmp_pte);
             return pte_val(tmp_pte);
@@ -698,14 +699,20 @@ unsigned long lookup_domain_mpa(struct d
             return GPFN_INV_MASK;
     }
 
-    printk("%s: d 0x%p id %d current 0x%p id %d\n",
-           __func__, d, d->domain_id, current, current->vcpu_id);
-    if (mpaddr < d->arch.convmem_end)
-        printk("%s: non-allocated mpa 0x%lx (< 0x%lx)\n", __func__,
-               mpaddr, d->arch.convmem_end);
-    else
-        printk("%s: bad mpa 0x%lx (=> 0x%lx)\n", __func__,
-               mpaddr, d->arch.convmem_end);
+    if (mpaddr < d->arch.convmem_end) {
+        gdprintk(XENLOG_WARNING, "vcpu %d iip 0x%016lx: non-allocated mpa "
+                 "0x%lx (< 0x%lx)\n", current->vcpu_id, PSCB(current, iip),
+                 mpaddr, d->arch.convmem_end);
+    } else if (mpaddr - IO_PORTS_PADDR < IO_PORTS_SIZE) {
+        /* Log I/O port probing, but complain less loudly about it */
+        gdprintk(XENLOG_INFO, "vcpu %d iip 0x%016lx: bad I/O port access "
+                 "0x%lx\n ", current->vcpu_id, PSCB(current, iip),
+                 IO_SPACE_SPARSE_DECODING(mpaddr - IO_PORTS_PADDR));
+    } else {
+        gdprintk(XENLOG_WARNING, "vcpu %d iip 0x%016lx: bad mpa 0x%lx "
+                 "(=> 0x%lx)\n", current->vcpu_id, PSCB(current, iip),
+                 mpaddr, d->arch.convmem_end);
+    }
 
     if (entry != NULL)
         p2m_entry_set(entry, NULL, __pte(0));
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/ia64/xen/vcpu.c
--- a/xen/arch/ia64/xen/vcpu.c  Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/ia64/xen/vcpu.c  Wed Feb 14 19:01:35 2007 +0000
@@ -141,6 +141,9 @@ void vcpu_init_regs(struct vcpu *v)
                /* dt/rt/it:1;i/ic:1, si:1, vm/bn:1, ac:1 */
                /* Need to be expanded as macro */
                regs->cr_ipsr = 0x501008826008;
+               /* lazy fp */
+               FP_PSR(v) = IA64_PSR_DFH;
+               regs->cr_ipsr |= IA64_PSR_DFH;
        } else {
                regs->cr_ipsr = ia64_getreg(_IA64_REG_PSR)
                    | IA64_PSR_BITS_TO_SET | IA64_PSR_BN;
@@ -148,6 +151,10 @@ void vcpu_init_regs(struct vcpu *v)
                                   | IA64_PSR_RI | IA64_PSR_IS);
                // domain runs at PL2
                regs->cr_ipsr |= 2UL << IA64_PSR_CPL0_BIT;
+               // lazy fp 
+               PSCB(v, hpsr_dfh) = 1;
+               PSCB(v, hpsr_mfh) = 0;
+               regs->cr_ipsr |= IA64_PSR_DFH;
        }
        regs->cr_ifs = 1UL << 63;       /* or clear? */
        regs->ar_fpsr = FPSR_DEFAULT;
@@ -265,8 +272,10 @@ IA64FAULT vcpu_reset_psr_sm(VCPU * vcpu,
                      IA64_PSR_I | IA64_PSR_IC | IA64_PSR_DT |
                      IA64_PSR_DFL | IA64_PSR_DFH))
                return IA64_ILLOP_FAULT;
-       if (imm.dfh)
-               ipsr->dfh = 0;
+       if (imm.dfh) {
+               ipsr->dfh = PSCB(vcpu, hpsr_dfh);
+               PSCB(vcpu, vpsr_dfh) = 0;
+       }
        if (imm.dfl)
                ipsr->dfl = 0;
        if (imm.pp) {
@@ -320,8 +329,10 @@ IA64FAULT vcpu_set_psr_sm(VCPU * vcpu, u
            IA64_PSR_DT | IA64_PSR_DFL | IA64_PSR_DFH;
        if (imm24 & ~mask)
                return IA64_ILLOP_FAULT;
-       if (imm.dfh)
+       if (imm.dfh) {
+               PSCB(vcpu, vpsr_dfh) = 1;
                ipsr->dfh = 1;
+       } 
        if (imm.dfl)
                ipsr->dfl = 1;
        if (imm.pp) {
@@ -386,8 +397,13 @@ IA64FAULT vcpu_set_psr_l(VCPU * vcpu, u6
        //if (val & ~(IA64_PSR_PP | IA64_PSR_UP | IA64_PSR_SP))
        //      return IA64_ILLOP_FAULT;
        // however trying to set other bits can't be an error as it is in ssm
-       if (newpsr.dfh)
+       if (newpsr.dfh) {
                ipsr->dfh = 1;
+               PSCB(vcpu, vpsr_dfh) = 1;
+       } else {
+               ipsr->dfh = PSCB(vcpu, hpsr_dfh);
+               PSCB(vcpu, vpsr_dfh) = 0;
+       }       
        if (newpsr.dfl)
                ipsr->dfl = 1;
        if (newpsr.pp) {
@@ -466,6 +482,8 @@ IA64FAULT vcpu_get_psr(VCPU * vcpu, u64 
                newpsr.pp = 1;
        else
                newpsr.pp = 0;
+       newpsr.dfh = PSCB(vcpu, vpsr_dfh);
+
        *pval = *(unsigned long *)&newpsr;
        *pval &= (MASK(0, 32) | MASK(35, 2));
        return IA64_NO_FAULT;
@@ -483,7 +501,7 @@ BOOLEAN vcpu_get_psr_i(VCPU * vcpu)
 
 u64 vcpu_get_ipsr_int_state(VCPU * vcpu, u64 prevpsr)
 {
-       u64 dcr = PSCBX(vcpu, dcr);
+       u64 dcr = PSCB(vcpu, dcr);
        PSR psr;
 
        //printk("*** vcpu_get_ipsr_int_state (0x%016lx)...\n",prevpsr);
@@ -497,6 +515,7 @@ u64 vcpu_get_ipsr_int_state(VCPU * vcpu,
        psr.ia64_psr.ic = PSCB(vcpu, interrupt_collection_enabled);
        psr.ia64_psr.i = !vcpu->vcpu_info->evtchn_upcall_mask;
        psr.ia64_psr.bn = PSCB(vcpu, banknum);
+       psr.ia64_psr.dfh = PSCB(vcpu, vpsr_dfh);
        psr.ia64_psr.dt = 1;
        psr.ia64_psr.it = 1;
        psr.ia64_psr.rt = 1;
@@ -513,10 +532,7 @@ u64 vcpu_get_ipsr_int_state(VCPU * vcpu,
 
 IA64FAULT vcpu_get_dcr(VCPU * vcpu, u64 * pval)
 {
-//verbose("vcpu_get_dcr: called @%p\n",PSCB(vcpu,iip));
-       // Reads of cr.dcr on Xen always have the sign bit set, so
-       // a domain can differentiate whether it is running on SP or not
-       *pval = PSCBX(vcpu, dcr) | 0x8000000000000000L;
+       *pval = PSCB(vcpu, dcr);
        return IA64_NO_FAULT;
 }
 
@@ -632,11 +648,7 @@ IA64FAULT vcpu_get_iha(VCPU * vcpu, u64 
 
 IA64FAULT vcpu_set_dcr(VCPU * vcpu, u64 val)
 {
-       // Reads of cr.dcr on SP always have the sign bit set, so
-       // a domain can differentiate whether it is running on SP or not
-       // Thus, writes of DCR should ignore the sign bit
-//verbose("vcpu_set_dcr: called\n");
-       PSCBX(vcpu, dcr) = val & ~0x8000000000000000L;
+       PSCB(vcpu, dcr) = val;
        return IA64_NO_FAULT;
 }
 
@@ -1343,6 +1355,12 @@ IA64FAULT vcpu_rfi(VCPU * vcpu)
        if (psr.ia64_psr.cpl < 3)
                psr.ia64_psr.cpl = 2;
        int_enable = psr.ia64_psr.i;
+       if (psr.ia64_psr.dfh) {
+               PSCB(vcpu, vpsr_dfh) = 1;
+       } else {
+               psr.ia64_psr.dfh = PSCB(vcpu, hpsr_dfh);
+               PSCB(vcpu, vpsr_dfh) = 0;
+       }
        if (psr.ia64_psr.ic)
                PSCB(vcpu, interrupt_collection_enabled) = 1;
        if (psr.ia64_psr.dt && psr.ia64_psr.rt && psr.ia64_psr.it)
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/ia64/xen/vhpt.c
--- a/xen/arch/ia64/xen/vhpt.c  Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/ia64/xen/vhpt.c  Wed Feb 14 19:01:35 2007 +0000
@@ -54,11 +54,7 @@ void
 void
 vcpu_vhpt_flush(struct vcpu* v)
 {
-       /* increment flush clock before flush */
-       u32 flush_time = tlbflush_clock_inc_and_return();
        __vhpt_flush(vcpu_vhpt_maddr(v));
-       /* this must be after flush */
-       tlbflush_update_time(&v->arch.tlbflush_timestamp, flush_time);
        perfc_incrc(vcpu_vhpt_flush);
 }
 
@@ -177,7 +173,9 @@ void
 void
 pervcpu_vhpt_free(struct vcpu *v)
 {
-       free_domheap_pages(v->arch.vhpt_page, VHPT_SIZE_LOG2 - PAGE_SHIFT);
+       if (likely(v->arch.vhpt_page != NULL))
+               free_domheap_pages(v->arch.vhpt_page,
+                                  VHPT_SIZE_LOG2 - PAGE_SHIFT);
 }
 #endif
 
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/ia64/xen/xensetup.c
--- a/xen/arch/ia64/xen/xensetup.c      Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/ia64/xen/xensetup.c      Wed Feb 14 19:01:35 2007 +0000
@@ -26,6 +26,8 @@
 #include <asm/vmx.h>
 #include <linux/efi.h>
 #include <asm/iosapic.h>
+#include <xen/softirq.h>
+#include <xen/rcupdate.h>
 
 unsigned long xenheap_phys_end, total_pages;
 
@@ -265,13 +267,16 @@ void start_kernel(void)
     early_setup_arch(&cmdline);
 
     /* We initialise the serial devices very early so we can get debugging. */
-    if (running_on_sim) hpsim_serial_init();
+    if (running_on_sim)
+        hpsim_serial_init();
     else {
-       ns16550_init(0, &ns16550_com1);
-       /* Also init com2 for Tiger4. */
-       ns16550_com2.io_base = 0x2f8;
-       ns16550_com2.irq     = 3;
-       ns16550_init(1, &ns16550_com2);
+        ns16550_init(0, &ns16550_com1);
+        if (ns16550_com1.io_base == 0x3f8) {
+            /* Also init com2 for Tiger4. */
+            ns16550_com2.io_base = 0x2f8;
+            ns16550_com2.irq     = 3;
+            ns16550_init(1, &ns16550_com2);
+        }
     }
     serial_init_preirq();
 
@@ -436,6 +441,12 @@ void start_kernel(void)
     init_xen_time(); /* initialise the time */
     timer_init();
 
+    rcu_init();
+
+#ifdef CONFIG_XEN_IA64_TLBFLUSH_CLOCK
+    open_softirq(NEW_TLBFLUSH_CLOCK_PERIOD_SOFTIRQ, new_tlbflush_clock_period);
+#endif
+
 #ifdef CONFIG_SMP
     if ( opt_nosmp )
     {
@@ -464,6 +475,7 @@ printk("num_online_cpus=%d, max_cpus=%d\
         if ( num_online_cpus() >= max_cpus )
             break;
         if ( !cpu_online(i) ) {
+            rcu_online_cpu(i);
             __cpu_up(i);
        }
     }
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/powerpc/machine_kexec.c
--- a/xen/arch/powerpc/machine_kexec.c  Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/powerpc/machine_kexec.c  Wed Feb 14 19:01:35 2007 +0000
@@ -19,6 +19,11 @@ void machine_reboot_kexec(xen_kexec_imag
     printk("STUB: " __FILE__ ": %s: not implemented\n", __FUNCTION__);
 }
 
+void machine_kexec(xen_kexec_image_t *image)
+{
+    printk("STUB: " __FILE__ ": %s: not implemented\n", __FUNCTION__);
+}
+
 /*
  * Local variables:
  * mode: C
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/crash.c
--- a/xen/arch/x86/crash.c      Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/x86/crash.c      Wed Feb 14 19:01:35 2007 +0000
@@ -11,7 +11,6 @@
 #include <asm/atomic.h>
 #include <asm/elf.h>
 #include <asm/percpu.h>
-#include <asm/kexec.h>
 #include <xen/types.h>
 #include <xen/irq.h>
 #include <asm/ipi.h>
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/domain.c
--- a/xen/arch/x86/domain.c     Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/x86/domain.c     Wed Feb 14 19:01:35 2007 +0000
@@ -37,7 +37,7 @@
 #include <asm/i387.h>
 #include <asm/mpspec.h>
 #include <asm/ldt.h>
-#include <asm/shadow.h>
+#include <asm/paging.h>
 #include <asm/hvm/hvm.h>
 #include <asm/hvm/support.h>
 #include <asm/msr.h>
@@ -331,6 +331,7 @@ int vcpu_initialise(struct vcpu *v)
 
     pae_l3_cache_init(&v->arch.pae_l3_cache);
 
+    paging_vcpu_init(v);
 
     if ( is_hvm_domain(d) )
     {
@@ -424,7 +425,7 @@ int arch_domain_create(struct domain *d)
     HYPERVISOR_COMPAT_VIRT_START(d) = __HYPERVISOR_COMPAT_VIRT_START;
 #endif
 
-    shadow_domain_init(d);
+    paging_domain_init(d);
 
     if ( !is_idle_domain(d) )
     {
@@ -464,7 +465,7 @@ void arch_domain_destroy(struct domain *
         hvm_domain_destroy(d);
     }
 
-    shadow_final_teardown(d);
+    paging_final_teardown(d);
 
     free_xenheap_pages(
         d->arch.mm_perdomain_pt,
@@ -613,7 +614,7 @@ int arch_set_info_guest(
         {
             cr3_pfn = gmfn_to_mfn(d, xen_cr3_to_pfn(c.nat->ctrlreg[3]));
 
-            if ( shadow_mode_refcounts(d)
+            if ( paging_mode_refcounts(d)
                  ? !get_page(mfn_to_page(cr3_pfn), d)
                  : !get_page_and_type(mfn_to_page(cr3_pfn), d,
                                       PGT_base_page_table) )
@@ -631,7 +632,7 @@ int arch_set_info_guest(
 
             cr3_pfn = gmfn_to_mfn(d, compat_cr3_to_pfn(c.cmp->ctrlreg[3]));
 
-            if ( shadow_mode_refcounts(d)
+            if ( paging_mode_refcounts(d)
                  ? !get_page(mfn_to_page(cr3_pfn), d)
                  : !get_page_and_type(mfn_to_page(cr3_pfn), d,
                                     PGT_l3_page_table) )
@@ -652,8 +653,8 @@ int arch_set_info_guest(
     /* Don't redo final setup */
     set_bit(_VCPUF_initialised, &v->vcpu_flags);
 
-    if ( shadow_mode_enabled(d) )
-        shadow_update_paging_modes(v);
+    if ( paging_mode_enabled(d) )
+        paging_update_paging_modes(v);
 
     update_cr3(v);
 
@@ -1406,7 +1407,7 @@ static void vcpu_destroy_pagetables(stru
 
         if ( pfn != 0 )
         {
-            if ( shadow_mode_refcounts(d) )
+            if ( paging_mode_refcounts(d) )
                 put_page(mfn_to_page(pfn));
             else
                 put_page_and_type(mfn_to_page(pfn));
@@ -1427,7 +1428,7 @@ static void vcpu_destroy_pagetables(stru
     pfn = pagetable_get_pfn(v->arch.guest_table);
     if ( pfn != 0 )
     {
-        if ( shadow_mode_refcounts(d) )
+        if ( paging_mode_refcounts(d) )
             put_page(mfn_to_page(pfn));
         else
             put_page_and_type(mfn_to_page(pfn));
@@ -1443,7 +1444,7 @@ static void vcpu_destroy_pagetables(stru
     pfn = pagetable_get_pfn(v->arch.guest_table_user);
     if ( pfn != 0 )
     {
-        if ( shadow_mode_refcounts(d) )
+        if ( paging_mode_refcounts(d) )
             put_page(mfn_to_page(pfn));
         else
             put_page_and_type(mfn_to_page(pfn));
@@ -1464,8 +1465,8 @@ void domain_relinquish_resources(struct 
     for_each_vcpu ( d, v )
         vcpu_destroy_pagetables(v);
 
-    /* Tear down shadow mode stuff. */
-    shadow_teardown(d);
+    /* Tear down paging-assistance stuff. */
+    paging_teardown(d);
 
     /*
      * Relinquish GDT mappings. No need for explicit unmapping of the LDT as
@@ -1484,35 +1485,12 @@ void domain_relinquish_resources(struct 
 
 void arch_dump_domain_info(struct domain *d)
 {
-    if ( shadow_mode_enabled(d) )
-    {
-        printk("    shadow mode: ");
-        if ( d->arch.shadow.mode & SHM2_enable )
-            printk("enabled ");
-        if ( shadow_mode_refcounts(d) )
-            printk("refcounts ");
-        if ( shadow_mode_log_dirty(d) )
-            printk("log_dirty ");
-        if ( shadow_mode_translate(d) )
-            printk("translate ");
-        if ( shadow_mode_external(d) )
-            printk("external ");
-        printk("\n");
-    }
+    paging_dump_domain_info(d);
 }
 
 void arch_dump_vcpu_info(struct vcpu *v)
 {
-    if ( shadow_mode_enabled(v->domain) )
-    {
-        if ( v->arch.shadow.mode )
-            printk("    shadowed %u-on-%u, %stranslated\n",
-                   v->arch.shadow.mode->guest_levels,
-                   v->arch.shadow.mode->shadow_levels,
-                   shadow_vcpu_mode_translate(v) ? "" : "not ");
-        else
-            printk("    not shadowed\n");
-    }
+    paging_dump_vcpu_info(v);
 }
 
 /*
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/domain_build.c
--- a/xen/arch/x86/domain_build.c       Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/x86/domain_build.c       Wed Feb 14 19:01:35 2007 +0000
@@ -25,7 +25,7 @@
 #include <asm/processor.h>
 #include <asm/desc.h>
 #include <asm/i387.h>
-#include <asm/shadow.h>
+#include <asm/paging.h>
 
 #include <public/version.h>
 #include <public/libelf.h>
@@ -777,8 +777,8 @@ int construct_dom0(struct domain *d,
         (void)alloc_vcpu(d, i, i);
 
     /* Set up CR3 value for write_ptbase */
-    if ( shadow_mode_enabled(v->domain) )
-        shadow_update_paging_modes(v);
+    if ( paging_mode_enabled(v->domain) )
+        paging_update_paging_modes(v);
     else
         update_cr3(v);
 
@@ -918,8 +918,8 @@ int construct_dom0(struct domain *d,
     regs->eflags = X86_EFLAGS_IF;
 
     if ( opt_dom0_shadow )
-        if ( shadow_enable(d, SHM2_enable) == 0 ) 
-            shadow_update_paging_modes(v);
+        if ( paging_enable(d, PG_SH_enable) == 0 ) 
+            paging_update_paging_modes(v);
 
     if ( supervisor_mode_kernel )
     {
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/domctl.c
--- a/xen/arch/x86/domctl.c     Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/x86/domctl.c     Wed Feb 14 19:01:35 2007 +0000
@@ -19,7 +19,7 @@
 #include <xen/trace.h>
 #include <xen/console.h>
 #include <xen/iocap.h>
-#include <asm/shadow.h>
+#include <asm/paging.h>
 #include <asm/irq.h>
 #include <asm/hvm/hvm.h>
 #include <asm/hvm/support.h>
@@ -42,7 +42,7 @@ long arch_do_domctl(
         d = get_domain_by_id(domctl->domain);
         if ( d != NULL )
         {
-            ret = shadow_domctl(d,
+            ret = paging_domctl(d,
                                 &domctl->u.shadow_op,
                                 guest_handle_cast(u_domctl, void));
             put_domain(d);
@@ -326,10 +326,6 @@ long arch_do_domctl(
         struct hvm_domain_context c;
         struct domain             *d;
 
-        c.cur = 0;
-        c.size = domctl->u.hvmcontext.size;
-        c.data = NULL;
-
         ret = -ESRCH;
         if ( (d = get_domain_by_id(domctl->domain)) == NULL )
             break;
@@ -338,19 +334,38 @@ long arch_do_domctl(
         if ( !is_hvm_domain(d) ) 
             goto gethvmcontext_out;
 
+        c.cur = 0;
+        c.size = hvm_save_size(d);
+        c.data = NULL;
+
+        if ( guest_handle_is_null(domctl->u.hvmcontext.buffer) )
+        {
+            /* Client is querying for the correct buffer size */
+            domctl->u.hvmcontext.size = c.size;
+            ret = 0;
+            goto gethvmcontext_out;            
+        }
+
+        /* Check that the client has a big enough buffer */
+        ret = -ENOSPC;
+        if ( domctl->u.hvmcontext.size < c.size ) 
+            goto gethvmcontext_out;
+
+        /* Allocate our own marshalling buffer */
         ret = -ENOMEM;
         if ( (c.data = xmalloc_bytes(c.size)) == NULL )
             goto gethvmcontext_out;
 
         ret = hvm_save(d, &c);
 
+        domctl->u.hvmcontext.size = c.cur;
         if ( copy_to_guest(domctl->u.hvmcontext.buffer, c.data, c.size) != 0 )
             ret = -EFAULT;
 
+    gethvmcontext_out:
         if ( copy_to_guest(u_domctl, domctl, 1) )
             ret = -EFAULT;
 
-    gethvmcontext_out:
         if ( c.data != NULL )
             xfree(c.data);
 
@@ -383,6 +398,7 @@ long arch_do_domctl(
 
         put_domain(d);
     }
+    break;
 
     case XEN_DOMCTL_get_address_size:
     {
@@ -396,7 +412,11 @@ long arch_do_domctl(
 
         ret = 0;
         put_domain(d);
-    }
+
+        if ( copy_to_guest(u_domctl, domctl, 1) )
+            ret = -EFAULT;
+    }
+    break;
 
     default:
         ret = -ENOSYS;
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/hvm/Makefile
--- a/xen/arch/x86/hvm/Makefile Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/x86/hvm/Makefile Wed Feb 14 19:01:35 2007 +0000
@@ -15,3 +15,4 @@ obj-y += vioapic.o
 obj-y += vioapic.o
 obj-y += vlapic.o
 obj-y += vpic.o
+obj-y += save.o
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/hvm/hpet.c
--- a/xen/arch/x86/hvm/hpet.c   Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/x86/hvm/hpet.c   Wed Feb 14 19:01:35 2007 +0000
@@ -409,7 +409,7 @@ static int hpet_load(struct domain *d, h
     return 0;
 }
 
-HVM_REGISTER_SAVE_RESTORE(HPET, hpet_save, hpet_load);
+HVM_REGISTER_SAVE_RESTORE(HPET, hpet_save, hpet_load, 1, HVMSR_PER_DOM);
 
 void hpet_init(struct vcpu *v)
 {
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/hvm/hvm.c
--- a/xen/arch/x86/hvm/hvm.c    Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/x86/hvm/hvm.c    Wed Feb 14 19:01:35 2007 +0000
@@ -30,11 +30,10 @@
 #include <xen/hypercall.h>
 #include <xen/guest_access.h>
 #include <xen/event.h>
-#include <xen/shadow.h>
 #include <asm/current.h>
 #include <asm/e820.h>
 #include <asm/io.h>
-#include <asm/shadow.h>
+#include <asm/paging.h>
 #include <asm/regs.h>
 #include <asm/cpufeature.h>
 #include <asm/processor.h>
@@ -106,7 +105,6 @@ void hvm_migrate_timers(struct vcpu *v)
     pit_migrate_timers(v);
     rtc_migrate_timers(v);
     hpet_migrate_timers(v);
-    pmtimer_migrate_timers(v);
     if ( vcpu_vlapic(v)->pt.enabled )
         migrate_timer(&vcpu_vlapic(v)->pt.timer, v->processor);
 }
@@ -156,7 +154,7 @@ int hvm_domain_initialise(struct domain 
     spin_lock_init(&d->arch.hvm_domain.buffered_io_lock);
     spin_lock_init(&d->arch.hvm_domain.irq_lock);
 
-    rc = shadow_enable(d, SHM2_refcounts|SHM2_translate|SHM2_external);
+    rc = paging_enable(d, PG_SH_enable|PG_refcounts|PG_translate|PG_external);
     if ( rc != 0 )
         return rc;
 
@@ -170,7 +168,6 @@ void hvm_domain_destroy(struct domain *d
 {
     pit_deinit(d);
     rtc_deinit(d);
-    pmtimer_deinit(d);
     hpet_deinit(d);
 
     if ( d->arch.hvm_domain.shared_page_va )
@@ -227,7 +224,8 @@ static int hvm_load_cpu_ctxt(struct doma
     return 0;
 }
 
-HVM_REGISTER_SAVE_RESTORE(CPU, hvm_save_cpu_ctxt, hvm_load_cpu_ctxt);
+HVM_REGISTER_SAVE_RESTORE(CPU, hvm_save_cpu_ctxt, hvm_load_cpu_ctxt,
+                          1, HVMSR_PER_VCPU);
 
 int hvm_vcpu_initialise(struct vcpu *v)
 {
@@ -271,6 +269,24 @@ void hvm_vcpu_destroy(struct vcpu *v)
 
     /* Event channel is already freed by evtchn_destroy(). */
     /*free_xen_event_channel(v, v->arch.hvm_vcpu.xen_port);*/
+}
+
+
+void hvm_vcpu_reset(struct vcpu *v)
+{
+    vcpu_pause(v);
+
+    vlapic_reset(vcpu_vlapic(v));
+
+    hvm_funcs.vcpu_initialise(v);
+
+    set_bit(_VCPUF_down, &v->vcpu_flags);
+    clear_bit(_VCPUF_initialised, &v->vcpu_flags);
+    clear_bit(_VCPUF_fpu_initialised, &v->vcpu_flags);
+    clear_bit(_VCPUF_fpu_dirtied, &v->vcpu_flags);
+    clear_bit(_VCPUF_blocked, &v->vcpu_flags);
+
+    vcpu_unpause(v);
 }
 
 static void hvm_vcpu_down(void)
@@ -366,7 +382,7 @@ static int __hvm_copy(void *buf, paddr_t
         count = min_t(int, PAGE_SIZE - (addr & ~PAGE_MASK), todo);
 
         if ( virt )
-            mfn = get_mfn_from_gpfn(shadow_gva_to_gfn(current, addr));
+            mfn = get_mfn_from_gpfn(paging_gva_to_gfn(current, addr));
         else
             mfn = get_mfn_from_gpfn(addr >> PAGE_SHIFT);
 
@@ -583,7 +599,7 @@ void hvm_do_hypercall(struct cpu_user_re
         return;
     }
 
-    if ( current->arch.shadow.mode->guest_levels == 4 )
+    if ( current->arch.paging.mode->guest_levels == 4 )
     {
         pregs->rax = hvm_hypercall64_table[pregs->rax](pregs->rdi,
                                                        pregs->rsi,
@@ -624,19 +640,12 @@ void hvm_hypercall_page_initialise(struc
  */
 int hvm_bringup_ap(int vcpuid, int trampoline_vector)
 {
-    struct vcpu *bsp = current, *v;
-    struct domain *d = bsp->domain;
+    struct vcpu *v;
+    struct domain *d = current->domain;
     struct vcpu_guest_context *ctxt;
     int rc = 0;
 
     BUG_ON(!is_hvm_domain(d));
-
-    if ( bsp->vcpu_id != 0 )
-    {
-        gdprintk(XENLOG_ERR, "Not calling hvm_bringup_ap from BSP context.\n");
-        domain_crash(bsp->domain);
-        return -EINVAL;
-    }
 
     if ( (v = d->vcpu[vcpuid]) == NULL )
         return -ENOENT;
@@ -668,8 +677,8 @@ int hvm_bringup_ap(int vcpuid, int tramp
         goto out;
     }
 
-    if ( test_and_clear_bit(_VCPUF_down, &d->vcpu[vcpuid]->vcpu_flags) )
-        vcpu_wake(d->vcpu[vcpuid]);
+    if ( test_and_clear_bit(_VCPUF_down, &v->vcpu_flags) )
+        vcpu_wake(v);
     gdprintk(XENLOG_INFO, "AP %d bringup suceeded.\n", vcpuid);
 
  out:
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/hvm/i8254.c
--- a/xen/arch/x86/hvm/i8254.c  Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/x86/hvm/i8254.c  Wed Feb 14 19:01:35 2007 +0000
@@ -445,7 +445,7 @@ static int pit_load(struct domain *d, hv
     return 0;
 }
 
-HVM_REGISTER_SAVE_RESTORE(PIT, pit_save, pit_load);
+HVM_REGISTER_SAVE_RESTORE(PIT, pit_save, pit_load, 1, HVMSR_PER_DOM);
 
 static void pit_reset(void *opaque)
 {
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/hvm/intercept.c
--- a/xen/arch/x86/hvm/intercept.c      Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/x86/hvm/intercept.c      Wed Feb 14 19:01:35 2007 +0000
@@ -29,8 +29,6 @@
 #include <asm/current.h>
 #include <io_ports.h>
 #include <xen/event.h>
-#include <xen/compile.h>
-#include <public/version.h>
 
 
 extern struct hvm_mmio_handler hpet_mmio_handler;
@@ -157,180 +155,6 @@ static inline void hvm_mmio_access(struc
     }
 }
 
-/* List of handlers for various HVM save and restore types */
-static struct { 
-    hvm_save_handler save;
-    hvm_load_handler load; 
-    const char *name;
-} hvm_sr_handlers [HVM_SAVE_CODE_MAX + 1] = {{NULL, NULL, "<?>"},};
-
-/* Init-time function to add entries to that list */
-void hvm_register_savevm(uint16_t typecode, 
-                         const char *name,
-                         hvm_save_handler save_state,
-                         hvm_load_handler load_state)
-{
-    ASSERT(typecode <= HVM_SAVE_CODE_MAX);
-    ASSERT(hvm_sr_handlers[typecode].save == NULL);
-    ASSERT(hvm_sr_handlers[typecode].load == NULL);
-    hvm_sr_handlers[typecode].save = save_state;
-    hvm_sr_handlers[typecode].load = load_state;
-    hvm_sr_handlers[typecode].name = name;
-}
-
-
-int hvm_save(struct domain *d, hvm_domain_context_t *h)
-{
-    uint32_t eax, ebx, ecx, edx;
-    char *c;
-    struct hvm_save_header hdr;
-    struct hvm_save_end end;
-    hvm_save_handler handler;
-    uint16_t i;
-
-    hdr.magic = HVM_FILE_MAGIC;
-    hdr.version = HVM_FILE_VERSION;
-
-    /* Save some CPUID bits */
-    cpuid(1, &eax, &ebx, &ecx, &edx);
-    hdr.cpuid = eax;
-
-    /* Save xen changeset */
-    c = strrchr(XEN_CHANGESET, ':');
-    if ( c )
-        hdr.changeset = simple_strtoll(c, NULL, 16);
-    else 
-        hdr.changeset = -1ULL; /* Unknown */
-
-    if ( hvm_save_entry(HEADER, 0, h, &hdr) != 0 )
-    {
-        gdprintk(XENLOG_ERR, "HVM save: failed to write header\n");
-        return -EFAULT;
-    } 
-
-    /* Save all available kinds of state */
-    for ( i = 0; i <= HVM_SAVE_CODE_MAX; i++ ) 
-    {
-        handler = hvm_sr_handlers[i].save;
-        if ( handler != NULL ) 
-        {
-            gdprintk(XENLOG_INFO, "HVM save: %s\n",  hvm_sr_handlers[i].name);
-            if ( handler(d, h) != 0 ) 
-            {
-                gdprintk(XENLOG_ERR, 
-                         "HVM save: failed to save type %"PRIu16"\n", i);
-                return -EFAULT;
-            } 
-        }
-    }
-
-    /* Save an end-of-file marker */
-    if ( hvm_save_entry(END, 0, h, &end) != 0 )
-    {
-        /* Run out of data */
-        gdprintk(XENLOG_ERR, "HVM save: no room for end marker.\n");
-        return -EFAULT;
-    }
-
-    /* Save macros should not have let us overrun */
-    ASSERT(h->cur <= h->size);
-    return 0;
-}
-
-int hvm_load(struct domain *d, hvm_domain_context_t *h)
-{
-    uint32_t eax, ebx, ecx, edx;
-    char *c;
-    uint64_t cset;
-    struct hvm_save_header hdr;
-    struct hvm_save_descriptor *desc;
-    hvm_load_handler handler;
-    struct vcpu *v;
-    
-    /* Read the save header, which must be first */
-    if ( hvm_load_entry(HEADER, h, &hdr) != 0 ) 
-        return -1;
-
-    if (hdr.magic != HVM_FILE_MAGIC) {
-        gdprintk(XENLOG_ERR, 
-                 "HVM restore: bad magic number %#"PRIx32"\n", hdr.magic);
-        return -1;
-    }
-
-    if (hdr.version != HVM_FILE_VERSION) {
-        gdprintk(XENLOG_ERR, 
-                 "HVM restore: unsupported version %u\n", hdr.version);
-        return -1;
-    }
-
-    cpuid(1, &eax, &ebx, &ecx, &edx);
-    /*TODO: need to define how big a difference is acceptable */
-    if (hdr.cpuid != eax)
-        gdprintk(XENLOG_WARNING, "HVM restore: saved CPUID (%#"PRIx32") "
-               "does not match host (%#"PRIx32").\n", hdr.cpuid, eax);
-
-
-    c = strrchr(XEN_CHANGESET, ':');
-    if ( hdr.changeset == -1ULL )
-        gdprintk(XENLOG_WARNING, 
-                 "HVM restore: Xen changeset was not saved.\n");
-    else if ( c == NULL )
-        gdprintk(XENLOG_WARNING, 
-                 "HVM restore: Xen changeset is not available.\n");
-    else
-    {
-        cset = simple_strtoll(c, NULL, 16);
-        if ( hdr.changeset != cset )
-        gdprintk(XENLOG_WARNING, "HVM restore: saved Xen changeset (%#"PRIx64
-                 ") does not match host (%#"PRIx64").\n", hdr.changeset, cset);
-    }
-
-    /* Down all the vcpus: we only re-enable the ones that had state saved. */
-    for_each_vcpu(d, v) 
-        if ( test_and_set_bit(_VCPUF_down, &v->vcpu_flags) )
-            vcpu_sleep_nosync(v);
-
-    while(1) {
-
-        if ( h->size - h->cur < sizeof(struct hvm_save_descriptor) )
-        {
-            /* Run out of data */
-            gdprintk(XENLOG_ERR, 
-                     "HVM restore: save did not end with a null entry\n");
-            return -1;
-        }
-        
-        /* Read the typecode of the next entry  and check for the end-marker */
-        desc = (struct hvm_save_descriptor *)(&h->data[h->cur]);
-        if ( desc->typecode == 0 )
-            return 0; 
-        
-        /* Find the handler for this entry */
-        if ( desc->typecode > HVM_SAVE_CODE_MAX 
-             || (handler = hvm_sr_handlers[desc->typecode].load) == NULL ) 
-        {
-            gdprintk(XENLOG_ERR, 
-                     "HVM restore: unknown entry typecode %u\n", 
-                     desc->typecode);
-            return -1;
-        }
-
-        /* Load the entry */
-        gdprintk(XENLOG_INFO, "HVM restore: %s %"PRIu16"\n",  
-                 hvm_sr_handlers[desc->typecode].name, desc->instance);
-        if ( handler(d, h) != 0 ) 
-        {
-            gdprintk(XENLOG_ERR, 
-                     "HVM restore: failed to load entry %u/%u\n", 
-                     desc->typecode, desc->instance);
-            return -1;
-        }
-    }
-
-    /* Not reached */
-}
-
-
 int hvm_buffered_io_intercept(ioreq_t *p)
 {
     struct vcpu *v = current;
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/hvm/io.c
--- a/xen/arch/x86/hvm/io.c     Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/x86/hvm/io.c     Wed Feb 14 19:01:35 2007 +0000
@@ -32,7 +32,7 @@
 #include <asm/processor.h>
 #include <asm/msr.h>
 #include <asm/apic.h>
-#include <asm/shadow.h>
+#include <asm/paging.h>
 #include <asm/hvm/hvm.h>
 #include <asm/hvm/support.h>
 #include <asm/hvm/vpt.h>
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/hvm/irq.c
--- a/xen/arch/x86/hvm/irq.c    Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/x86/hvm/irq.c    Wed Feb 14 19:01:35 2007 +0000
@@ -480,6 +480,9 @@ static int irq_load_link(struct domain *
     return 0;
 }
 
-HVM_REGISTER_SAVE_RESTORE(PCI_IRQ, irq_save_pci, irq_load_pci);
-HVM_REGISTER_SAVE_RESTORE(ISA_IRQ, irq_save_isa, irq_load_isa);
-HVM_REGISTER_SAVE_RESTORE(PCI_LINK, irq_save_link, irq_load_link);
+HVM_REGISTER_SAVE_RESTORE(PCI_IRQ, irq_save_pci, irq_load_pci,
+                          1, HVMSR_PER_DOM);
+HVM_REGISTER_SAVE_RESTORE(ISA_IRQ, irq_save_isa, irq_load_isa, 
+                          1, HVMSR_PER_DOM);
+HVM_REGISTER_SAVE_RESTORE(PCI_LINK, irq_save_link, irq_load_link,
+                          1, HVMSR_PER_DOM);
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/hvm/platform.c
--- a/xen/arch/x86/hvm/platform.c       Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/x86/hvm/platform.c       Wed Feb 14 19:01:35 2007 +0000
@@ -21,7 +21,6 @@
 #include <xen/config.h>
 #include <xen/types.h>
 #include <xen/mm.h>
-#include <xen/shadow.h>
 #include <xen/domain_page.h>
 #include <asm/page.h>
 #include <xen/event.h>
@@ -29,6 +28,7 @@
 #include <xen/sched.h>
 #include <asm/regs.h>
 #include <asm/x86_emulate.h>
+#include <asm/paging.h>
 #include <asm/hvm/hvm.h>
 #include <asm/hvm/support.h>
 #include <asm/hvm/io.h>
@@ -513,12 +513,28 @@ static int mmio_decode(int address_bytes
         mmio_op->operand[1] = mk_operand(size_reg, 0, 0, MEMORY);
 
         switch ( ins_subtype ) {
+        case 0: /* add $imm, m32/16 */
+            mmio_op->instr = INSTR_ADD;
+            return DECODE_success;
+
+        case 1: /* or $imm, m32/16 */
+            mmio_op->instr = INSTR_OR;
+            return DECODE_success;
+
+        case 4: /* and $imm, m32/16 */
+            mmio_op->instr = INSTR_AND;
+            return DECODE_success;
+
+        case 5: /* sub $imm, m32/16 */
+            mmio_op->instr = INSTR_SUB;
+            return DECODE_success;
+
+        case 6: /* xor $imm, m32/16 */
+            mmio_op->instr = INSTR_XOR;
+            return DECODE_success;
+
         case 7: /* cmp $imm, m32/16 */
             mmio_op->instr = INSTR_CMP;
-            return DECODE_success;
-
-        case 1: /* or $imm, m32/16 */
-            mmio_op->instr = INSTR_OR;
             return DECODE_success;
 
         default:
@@ -673,6 +689,39 @@ static int mmio_decode(int address_bytes
             return DECODE_success;
         } else
             return DECODE_failure;
+
+    case 0xFE:
+    case 0xFF:
+    {
+        unsigned char ins_subtype = (opcode[1] >> 3) & 7;
+
+        if ( opcode[0] == 0xFE ) {
+            *op_size = BYTE;
+            GET_OP_SIZE_FOR_BYTE(size_reg);
+        } else {
+            GET_OP_SIZE_FOR_NONEBYTE(*op_size);
+            size_reg = *op_size;
+        }
+
+        mmio_op->immediate = 1;
+        mmio_op->operand[0] = mk_operand(size_reg, 0, 0, IMMEDIATE);
+        mmio_op->operand[1] = mk_operand(size_reg, 0, 0, MEMORY);
+
+        switch ( ins_subtype ) {
+        case 0: /* inc */
+            mmio_op->instr = INSTR_ADD;
+            return DECODE_success;
+
+        case 1: /* dec */
+            mmio_op->instr = INSTR_SUB;
+            return DECODE_success;
+
+        default:
+            printk("%x/%x, This opcode isn't handled yet!\n",
+                   *opcode, ins_subtype);
+            return DECODE_failure;
+        }
+    }
 
     case 0x0F:
         break;
@@ -793,7 +842,7 @@ void send_pio_req(unsigned long port, un
     if ( value_is_ptr )   /* get physical address of data */
     {
         if ( hvm_paging_enabled(current) )
-            p->data = shadow_gva_to_gpa(current, value);
+            p->data = paging_gva_to_gpa(current, value);
         else
             p->data = value; /* guest VA == guest PA */
     }
@@ -849,7 +898,7 @@ static void send_mmio_req(unsigned char 
     if ( value_is_ptr )
     {
         if ( hvm_paging_enabled(v) )
-            p->data = shadow_gva_to_gpa(v, value);
+            p->data = paging_gva_to_gpa(v, value);
         else
             p->data = value; /* guest VA == guest PA */
     }
@@ -965,7 +1014,7 @@ void handle_mmio(unsigned long gpa)
         if ( ad_size == WORD )
             addr &= 0xFFFF;
         addr += hvm_get_segment_base(v, x86_seg_es);
-        if ( shadow_gva_to_gpa(v, addr) == gpa )
+        if ( paging_gva_to_gpa(v, addr) == gpa )
         {
             enum x86_segment seg;
 
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/hvm/pmtimer.c
--- a/xen/arch/x86/hvm/pmtimer.c        Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/x86/hvm/pmtimer.c        Wed Feb 14 19:01:35 2007 +0000
@@ -1,17 +1,6 @@
 #include <asm/hvm/vpt.h>
 #include <asm/hvm/io.h>
 #include <asm/hvm/support.h>
-
-#define TMR_STS (1 << 0)
-static void pmt_update_status(void *opaque)
-{
-   PMTState *s = opaque;
-   s->pm1_status |= TMR_STS;
-
-   /* TODO: When TMR_EN == 1, generate a SCI event */
-
-   set_timer(&s->timer, NOW() + (1000000000ULL << 31) / FREQUENCE_PMTIMER);
-}
 
 static int handle_pmt_io(ioreq_t *p)
 {
@@ -30,42 +19,62 @@ static int handle_pmt_io(ioreq_t *p)
         /* PM_TMR_BLK is read-only */
         return 1;
     } else if (p->dir == 1) { /* read */
+        /* Set the correct value in the timer, accounting for time
+         * elapsed since the last time we did that. */
         curr_gtime = hvm_get_guest_time(s->vcpu);
-        s->pm1_timer += ((curr_gtime - s->last_gtime) * s->scale) >> 32;
-        p->data = s->pm1_timer;
+        s->pm.timer += ((curr_gtime - s->last_gtime) * s->scale) >> 32;
+        p->data = s->pm.timer;
         s->last_gtime = curr_gtime;
         return 1;
     }
     return 0;
 }
 
+static int pmtimer_save(struct domain *d, hvm_domain_context_t *h)
+{
+    PMTState *s = &d->arch.hvm_domain.pl_time.vpmt;
+    uint32_t x;
+
+    /* Update the counter to the guest's current time.  We always save
+     * with the domain paused, so the saved time should be after the
+     * last_gtime, but just in case, make sure we only go forwards */
+    x = ((s->vcpu->arch.hvm_vcpu.guest_time - s->last_gtime) * s->scale) >> 32;
+    if ( x < 1UL<<31 )
+        s->pm.timer += x;
+    return hvm_save_entry(PMTIMER, 0, h, &s->pm);
+}
+
+static int pmtimer_load(struct domain *d, hvm_domain_context_t *h)
+{
+    PMTState *s = &d->arch.hvm_domain.pl_time.vpmt;
+
+    /* Reload the counter */
+    if ( hvm_load_entry(PMTIMER, h, &s->pm) )
+        return -EINVAL;
+
+    /* Calculate future counter values from now. */
+    s->last_gtime = hvm_get_guest_time(s->vcpu);
+    
+    return 0;
+}
+
+HVM_REGISTER_SAVE_RESTORE(PMTIMER, pmtimer_save, pmtimer_load, 
+                          1, HVMSR_PER_DOM);
+
+
 void pmtimer_init(struct vcpu *v, int base)
 {
     PMTState *s = &v->domain->arch.hvm_domain.pl_time.vpmt;
 
-    s->pm1_timer = 0;
-    s->pm1_status = 0;
+    s->pm.timer = 0;
     s->scale = ((uint64_t)FREQUENCE_PMTIMER << 32) / ticks_per_sec(v);
     s->vcpu = v;
 
-    init_timer(&s->timer, pmt_update_status, s, v->processor);
-    /* ACPI supports a 32-bit power management timer */
-    set_timer(&s->timer, NOW() + (1000000000ULL << 31) / FREQUENCE_PMTIMER);
-    
+    /* Not implemented: we should set TMR_STS (bit 0 of PM1a_STS) every
+     * time the timer's top bit flips, and generate an SCI if TMR_EN
+     * (bit 0 of PM1a_EN) is set.  For now, those registers are in
+     * qemu-dm, and we just calculate the timer's value on demand. */  
+
     register_portio_handler(v->domain, base, 4, handle_pmt_io);
 }
 
-void pmtimer_migrate_timers(struct vcpu *v)
-{
-    struct PMTState *vpmt = &v->domain->arch.hvm_domain.pl_time.vpmt;
-
-    if (vpmt->vcpu == v)
-        migrate_timer(&vpmt->timer, v->processor);
-}
-
-void pmtimer_deinit(struct domain *d)
-{
-    PMTState *s = &d->arch.hvm_domain.pl_time.vpmt;
-
-    kill_timer(&s->timer);
-}
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/hvm/rtc.c
--- a/xen/arch/x86/hvm/rtc.c    Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/x86/hvm/rtc.c    Wed Feb 14 19:01:35 2007 +0000
@@ -417,7 +417,7 @@ static int rtc_load(struct domain *d, hv
     return 0;
 }
 
-HVM_REGISTER_SAVE_RESTORE(RTC, rtc_save, rtc_load);
+HVM_REGISTER_SAVE_RESTORE(RTC, rtc_save, rtc_load, 1, HVMSR_PER_DOM);
 
 
 void rtc_init(struct vcpu *v, int base)
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/hvm/save.c
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/xen/arch/x86/hvm/save.c   Wed Feb 14 19:01:35 2007 +0000
@@ -0,0 +1,229 @@
+/*
+ * hvm/save.c: Save and restore HVM guest's emulated hardware state.
+ *
+ * Copyright (c) 2004, Intel Corporation.
+ * Copyright (c) 2007, XenSource Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307 USA.
+ */
+
+#include <xen/config.h>
+#include <xen/compile.h>
+#include <xen/lib.h>
+#include <public/version.h>
+#include <xen/sched.h>
+
+#include <asm/hvm/hvm.h>
+#include <asm/hvm/support.h>
+#include <asm/hvm/domain.h>
+#include <asm/current.h>
+
+
+/* List of handlers for various HVM save and restore types */
+static struct { 
+    hvm_save_handler save;
+    hvm_load_handler load; 
+    const char *name;
+    size_t size;
+    int kind;
+} hvm_sr_handlers [HVM_SAVE_CODE_MAX + 1] = {{NULL, NULL, "<?>"},};
+
+/* Init-time function to add entries to that list */
+void hvm_register_savevm(uint16_t typecode, 
+                         const char *name,
+                         hvm_save_handler save_state,
+                         hvm_load_handler load_state,
+                         size_t size, int kind)
+{
+    ASSERT(typecode <= HVM_SAVE_CODE_MAX);
+    ASSERT(hvm_sr_handlers[typecode].save == NULL);
+    ASSERT(hvm_sr_handlers[typecode].load == NULL);
+    hvm_sr_handlers[typecode].save = save_state;
+    hvm_sr_handlers[typecode].load = load_state;
+    hvm_sr_handlers[typecode].name = name;
+    hvm_sr_handlers[typecode].size = size;
+    hvm_sr_handlers[typecode].kind = kind;
+}
+
+size_t hvm_save_size(struct domain *d) 
+{
+    struct vcpu *v;
+    size_t sz;
+    int i;
+    
+    /* Basic overhead for header and footer */
+    sz = (2 * sizeof (struct hvm_save_descriptor)) + HVM_SAVE_LENGTH(HEADER);
+
+    /* Plus space for each thing we will be saving */
+    for ( i = 0; i <= HVM_SAVE_CODE_MAX; i++ ) 
+        if ( hvm_sr_handlers[i].kind == HVMSR_PER_VCPU )
+            for_each_vcpu(d, v)
+                sz += hvm_sr_handlers[i].size;
+        else 
+            sz += hvm_sr_handlers[i].size;
+
+    return sz;
+}
+
+
+int hvm_save(struct domain *d, hvm_domain_context_t *h)
+{
+    uint32_t eax, ebx, ecx, edx;
+    char *c;
+    struct hvm_save_header hdr;
+    struct hvm_save_end end;
+    hvm_save_handler handler;
+    uint16_t i;
+
+    hdr.magic = HVM_FILE_MAGIC;
+    hdr.version = HVM_FILE_VERSION;
+
+    /* Save some CPUID bits */
+    cpuid(1, &eax, &ebx, &ecx, &edx);
+    hdr.cpuid = eax;
+
+    /* Save xen changeset */
+    c = strrchr(XEN_CHANGESET, ':');
+    if ( c )
+        hdr.changeset = simple_strtoll(c, NULL, 16);
+    else 
+        hdr.changeset = -1ULL; /* Unknown */
+
+    if ( hvm_save_entry(HEADER, 0, h, &hdr) != 0 )
+    {
+        gdprintk(XENLOG_ERR, "HVM save: failed to write header\n");
+        return -EFAULT;
+    } 
+
+    /* Save all available kinds of state */
+    for ( i = 0; i <= HVM_SAVE_CODE_MAX; i++ ) 
+    {
+        handler = hvm_sr_handlers[i].save;
+        if ( handler != NULL ) 
+        {
+            gdprintk(XENLOG_INFO, "HVM save: %s\n",  hvm_sr_handlers[i].name);
+            if ( handler(d, h) != 0 ) 
+            {
+                gdprintk(XENLOG_ERR, 
+                         "HVM save: failed to save type %"PRIu16"\n", i);
+                return -EFAULT;
+            } 
+        }
+    }
+
+    /* Save an end-of-file marker */
+    if ( hvm_save_entry(END, 0, h, &end) != 0 )
+    {
+        /* Run out of data */
+        gdprintk(XENLOG_ERR, "HVM save: no room for end marker.\n");
+        return -EFAULT;
+    }
+
+    /* Save macros should not have let us overrun */
+    ASSERT(h->cur <= h->size);
+    return 0;
+}
+
+int hvm_load(struct domain *d, hvm_domain_context_t *h)
+{
+    uint32_t eax, ebx, ecx, edx;
+    char *c;
+    uint64_t cset;
+    struct hvm_save_header hdr;
+    struct hvm_save_descriptor *desc;
+    hvm_load_handler handler;
+    struct vcpu *v;
+    
+    /* Read the save header, which must be first */
+    if ( hvm_load_entry(HEADER, h, &hdr) != 0 ) 
+        return -1;
+
+    if (hdr.magic != HVM_FILE_MAGIC) {
+        gdprintk(XENLOG_ERR, 
+                 "HVM restore: bad magic number %#"PRIx32"\n", hdr.magic);
+        return -1;
+    }
+
+    if (hdr.version != HVM_FILE_VERSION) {
+        gdprintk(XENLOG_ERR, 
+                 "HVM restore: unsupported version %u\n", hdr.version);
+        return -1;
+    }
+
+    cpuid(1, &eax, &ebx, &ecx, &edx);
+    /*TODO: need to define how big a difference is acceptable */
+    if (hdr.cpuid != eax)
+        gdprintk(XENLOG_WARNING, "HVM restore: saved CPUID (%#"PRIx32") "
+               "does not match host (%#"PRIx32").\n", hdr.cpuid, eax);
+
+
+    c = strrchr(XEN_CHANGESET, ':');
+    if ( hdr.changeset == -1ULL )
+        gdprintk(XENLOG_WARNING, 
+                 "HVM restore: Xen changeset was not saved.\n");
+    else if ( c == NULL )
+        gdprintk(XENLOG_WARNING, 
+                 "HVM restore: Xen changeset is not available.\n");
+    else
+    {
+        cset = simple_strtoll(c, NULL, 16);
+        if ( hdr.changeset != cset )
+        gdprintk(XENLOG_WARNING, "HVM restore: saved Xen changeset (%#"PRIx64
+                 ") does not match host (%#"PRIx64").\n", hdr.changeset, cset);
+    }
+
+    /* Down all the vcpus: we only re-enable the ones that had state saved. */
+    for_each_vcpu(d, v) 
+        if ( test_and_set_bit(_VCPUF_down, &v->vcpu_flags) )
+            vcpu_sleep_nosync(v);
+
+    while(1) {
+
+        if ( h->size - h->cur < sizeof(struct hvm_save_descriptor) )
+        {
+            /* Run out of data */
+            gdprintk(XENLOG_ERR, 
+                     "HVM restore: save did not end with a null entry\n");
+            return -1;
+        }
+        
+        /* Read the typecode of the next entry  and check for the end-marker */
+        desc = (struct hvm_save_descriptor *)(&h->data[h->cur]);
+        if ( desc->typecode == 0 )
+            return 0; 
+        
+        /* Find the handler for this entry */
+        if ( desc->typecode > HVM_SAVE_CODE_MAX 
+             || (handler = hvm_sr_handlers[desc->typecode].load) == NULL ) 
+        {
+            gdprintk(XENLOG_ERR, 
+                     "HVM restore: unknown entry typecode %u\n", 
+                     desc->typecode);
+            return -1;
+        }
+
+        /* Load the entry */
+        gdprintk(XENLOG_INFO, "HVM restore: %s %"PRIu16"\n",  
+                 hvm_sr_handlers[desc->typecode].name, desc->instance);
+        if ( handler(d, h) != 0 ) 
+        {
+            gdprintk(XENLOG_ERR, 
+                     "HVM restore: failed to load entry %u/%u\n", 
+                     desc->typecode, desc->instance);
+            return -1;
+        }
+    }
+
+    /* Not reached */
+}
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/hvm/svm/intr.c
--- a/xen/arch/x86/hvm/svm/intr.c       Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/x86/hvm/svm/intr.c       Wed Feb 14 19:01:35 2007 +0000
@@ -24,10 +24,10 @@
 #include <xen/lib.h>
 #include <xen/trace.h>
 #include <xen/errno.h>
-#include <xen/shadow.h>
 #include <asm/cpufeature.h>
 #include <asm/processor.h>
 #include <asm/msr.h>
+#include <asm/paging.h>
 #include <asm/hvm/hvm.h>
 #include <asm/hvm/io.h>
 #include <asm/hvm/support.h>
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/hvm/svm/svm.c
--- a/xen/arch/x86/hvm/svm/svm.c        Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/x86/hvm/svm/svm.c        Wed Feb 14 19:01:35 2007 +0000
@@ -29,7 +29,8 @@
 #include <xen/domain_page.h>
 #include <asm/current.h>
 #include <asm/io.h>
-#include <asm/shadow.h>
+#include <asm/paging.h>
+#include <asm/p2m.h>
 #include <asm/regs.h>
 #include <asm/cpufeature.h>
 #include <asm/processor.h>
@@ -491,9 +492,6 @@ int svm_vmcb_restore(struct vcpu *v, str
         v->arch.guest_table = pagetable_from_pfn(mfn);
         if (old_base_mfn)
              put_page(mfn_to_page(old_base_mfn));
-        /*
-         * arch.shadow_table should now hold the next CR3 for shadow
-         */
         v->arch.hvm_svm.cpu_cr3 = c->cr3;
     }
 
@@ -560,7 +558,7 @@ int svm_vmcb_restore(struct vcpu *v, str
     vmcb->sysenter_esp = c->sysenter_esp;
     vmcb->sysenter_eip = c->sysenter_eip;
 
-    shadow_update_paging_modes(v);
+    paging_update_paging_modes(v);
     return 0;
  
  bad_cr3:
@@ -1095,7 +1093,7 @@ static int svm_do_page_fault(unsigned lo
                 "svm_do_page_fault = 0x%lx, eip = %lx, error_code = %lx",
                 va, (unsigned long)current->arch.hvm_svm.vmcb->rip,
                 (unsigned long)regs->error_code);
-    return shadow_fault(va, regs); 
+    return paging_fault(va, regs); 
 }
 
 
@@ -1199,6 +1197,8 @@ static void svm_vmexit_do_cpuid(struct v
         /* So far, we do not support 3DNow for the guest. */
         clear_bit(X86_FEATURE_3DNOW & 31, &edx);
         clear_bit(X86_FEATURE_3DNOWEXT & 31, &edx);
+        /* no FFXSR instructions feature. */
+        clear_bit(X86_FEATURE_FFXSR & 31, &edx);
     }
     else if ( input == 0x80000007 || input == 0x8000000A )
     {
@@ -1728,7 +1728,7 @@ static int svm_set_cr0(unsigned long val
         v->arch.guest_table = pagetable_from_pfn(mfn);
         if ( old_base_mfn )
             put_page(mfn_to_page(old_base_mfn));
-        shadow_update_paging_modes(v);
+        paging_update_paging_modes(v);
 
         HVM_DBG_LOG(DBG_LEVEL_VMMU, "New arch.guest_table = %lx", 
                     (unsigned long) (mfn << PAGE_SHIFT));
@@ -1751,7 +1751,7 @@ static int svm_set_cr0(unsigned long val
             svm_inject_exception(v, TRAP_gp_fault, 1, 0);
             return 0;
         }
-        shadow_update_paging_modes(v);
+        paging_update_paging_modes(v);
     }
     else if ( (value & (X86_CR0_PE | X86_CR0_PG)) == X86_CR0_PE )
     {
@@ -1761,7 +1761,7 @@ static int svm_set_cr0(unsigned long val
             clear_bit(SVM_CPU_STATE_LMA_ENABLED, &v->arch.hvm_svm.cpu_state);
         }
         /* we should take care of this kind of situation */
-        shadow_update_paging_modes(v);
+        paging_update_paging_modes(v);
     }
 
     return 1;
@@ -1864,7 +1864,7 @@ static int mov_to_cr(int gpreg, int cr, 
             mfn = get_mfn_from_gpfn(value >> PAGE_SHIFT);
             if (mfn != pagetable_get_pfn(v->arch.guest_table))
                 goto bad_cr3;
-            shadow_update_cr3(v);
+            paging_update_cr3(v);
         }
         else 
         {
@@ -1915,7 +1915,7 @@ static int mov_to_cr(int gpreg, int cr, 
                 v->arch.guest_table = pagetable_from_pfn(mfn);
                 if ( old_base_mfn )
                     put_page(mfn_to_page(old_base_mfn));
-                shadow_update_paging_modes(v);
+                paging_update_paging_modes(v);
 
                 HVM_DBG_LOG(DBG_LEVEL_VMMU, "New arch.guest_table = %lx",
                             (unsigned long) (mfn << PAGE_SHIFT));
@@ -1944,7 +1944,7 @@ static int mov_to_cr(int gpreg, int cr, 
          * all TLB entries except global entries.
          */
         if ((old_cr ^ value) & (X86_CR4_PSE | X86_CR4_PGE | X86_CR4_PAE))
-            shadow_update_paging_modes(v);
+            paging_update_paging_modes(v);
         break;
 
     case 8:
@@ -2287,7 +2287,7 @@ void svm_handle_invlpg(const short invlp
         __update_guest_eip (vmcb, inst_len);
     }
 
-    shadow_invlpg(v, g_vaddr);
+    paging_invlpg(v, g_vaddr);
 }
 
 
@@ -2658,7 +2658,7 @@ void walk_shadow_and_guest_pt(unsigned l
     struct vmcb_struct *vmcb = v->arch.hvm_svm.vmcb;
     paddr_t gpa;
 
-    gpa = shadow_gva_to_gpa(current, gva);
+    gpa = paging_gva_to_gpa(current, gva);
     printk("gva = %lx, gpa=%"PRIpaddr", gCR3=%x\n", gva, gpa, (u32)vmcb->cr3);
     if( !svm_paging_enabled(v) || mmio_space(gpa) )
         return;
@@ -2679,7 +2679,7 @@ void walk_shadow_and_guest_pt(unsigned l
     shadow_sync_va(v, gva);
 
     gpte.l1 = 0;
-    __copy_from_user(&gpte, &linear_pg_table[ l1_linear_offset(gva) ],
+    __copy_from_user(&gpte, &__linear_l1_table[ l1_linear_offset(gva) ],
                      sizeof(gpte) );
     printk( "G-PTE = %x, flags=%x\n", gpte.l1, l1e_get_flags(gpte) );
 
@@ -2724,7 +2724,7 @@ asmlinkage void svm_vmexit_handler(struc
         if (svm_dbg_on && exit_reason == VMEXIT_EXCEPTION_PF) 
         {
             if (svm_paging_enabled(v) && 
-                !mmio_space(shadow_gva_to_gpa(current, vmcb->exitinfo2)))
+                !mmio_space(paging_gva_to_gpa(current, vmcb->exitinfo2)))
             {
                 printk("I%08ld,ExC=%s(%d),IP=%x:%"PRIx64","
                        "I1=%"PRIx64",I2=%"PRIx64",INT=%"PRIx64", "
@@ -2734,7 +2734,7 @@ asmlinkage void svm_vmexit_handler(struc
                        (u64)vmcb->exitinfo1,
                        (u64)vmcb->exitinfo2,
                        (u64)vmcb->exitintinfo.bytes,
-                       (u64)shadow_gva_to_gpa(current, vmcb->exitinfo2));
+                       (u64)paging_gva_to_gpa(current, vmcb->exitinfo2));
             }
             else 
             {
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/hvm/svm/vmcb.c
--- a/xen/arch/x86/hvm/svm/vmcb.c       Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/x86/hvm/svm/vmcb.c       Wed Feb 14 19:01:35 2007 +0000
@@ -23,10 +23,10 @@
 #include <xen/mm.h>
 #include <xen/lib.h>
 #include <xen/errno.h>
-#include <xen/shadow.h>
 #include <asm/cpufeature.h>
 #include <asm/processor.h>
 #include <asm/msr.h>
+#include <asm/paging.h>
 #include <asm/hvm/hvm.h>
 #include <asm/hvm/io.h>
 #include <asm/hvm/support.h>
@@ -196,7 +196,7 @@ static int construct_vmcb(struct vcpu *v
         read_cr4() & ~(X86_CR4_PGE | X86_CR4_PSE | X86_CR4_PAE);
     vmcb->cr4 = arch_svm->cpu_shadow_cr4 | SVM_CR4_HOST_MASK;
 
-    shadow_update_paging_modes(v);
+    paging_update_paging_modes(v);
     vmcb->cr3 = v->arch.hvm_vcpu.hw_cr3; 
 
     arch_svm->vmcb->exception_intercepts = MONITOR_DEFAULT_EXCEPTION_BITMAP;
@@ -209,7 +209,8 @@ int svm_create_vmcb(struct vcpu *v)
     struct arch_svm_struct *arch_svm = &v->arch.hvm_svm;
     int rc;
 
-    if ( (arch_svm->vmcb = alloc_vmcb()) == NULL )
+    if ( (arch_svm->vmcb == NULL) &&
+         (arch_svm->vmcb = alloc_vmcb()) == NULL )
     {
         printk("Failed to create a new VMCB\n");
         return -ENOMEM;
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/hvm/vioapic.c
--- a/xen/arch/x86/hvm/vioapic.c        Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/x86/hvm/vioapic.c        Wed Feb 14 19:01:35 2007 +0000
@@ -514,7 +514,7 @@ static int ioapic_load(struct domain *d,
     return 0;
 }
 
-HVM_REGISTER_SAVE_RESTORE(IOAPIC, ioapic_save, ioapic_load);
+HVM_REGISTER_SAVE_RESTORE(IOAPIC, ioapic_save, ioapic_load, 1, HVMSR_PER_DOM);
 
 void vioapic_init(struct domain *d)
 {
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/hvm/vlapic.c
--- a/xen/arch/x86/hvm/vlapic.c Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/x86/hvm/vlapic.c Wed Feb 14 19:01:35 2007 +0000
@@ -22,7 +22,6 @@
 #include <xen/types.h>
 #include <xen/mm.h>
 #include <xen/xmalloc.h>
-#include <xen/shadow.h>
 #include <xen/domain_page.h>
 #include <asm/page.h>
 #include <xen/event.h>
@@ -83,8 +82,6 @@ static unsigned int vlapic_lvt_mask[VLAP
 #define vlapic_base_address(vlapic)                             \
     (vlapic->hw.apic_base_msr & MSR_IA32_APICBASE_BASE)
 
-static int vlapic_reset(struct vlapic *vlapic);
-
 /*
  * Generic APIC bitmap vector update & search routines.
  */
@@ -293,8 +290,11 @@ static int vlapic_accept_irq(struct vcpu
         break;
 
     case APIC_DM_SMI:
+        gdprintk(XENLOG_WARNING, "Ignoring guest SMI\n");
+        break;
+
     case APIC_DM_NMI:
-        gdprintk(XENLOG_WARNING, "Ignoring guest SMI/NMI\n");
+        gdprintk(XENLOG_WARNING, "Ignoring guest NMI\n");
         break;
 
     case APIC_DM_INIT:
@@ -303,10 +303,7 @@ static int vlapic_accept_irq(struct vcpu
             break;
         /* FIXME How to check the situation after vcpu reset? */
         if ( test_bit(_VCPUF_initialised, &v->vcpu_flags) )
-        {
-            gdprintk(XENLOG_ERR, "Reset hvm vcpu not supported yet\n");
-            goto exit_and_crash;
-        }
+            hvm_vcpu_reset(v);
         v->arch.hvm_vcpu.init_sipi_sipi_state =
             HVM_VCPU_INIT_SIPI_SIPI_STATE_WAIT_SIPI;
         result = 1;
@@ -764,7 +761,7 @@ int cpu_get_apic_interrupt(struct vcpu *
 }
 
 /* Reset the VLPAIC back to its power-on/reset state. */
-static int vlapic_reset(struct vlapic *vlapic)
+void vlapic_reset(struct vlapic *vlapic)
 {
     struct vcpu *v = vlapic_vcpu(vlapic);
     int i;
@@ -793,8 +790,6 @@ static int vlapic_reset(struct vlapic *v
 
     vlapic_set_reg(vlapic, APIC_SPIV, 0xff);
     vlapic->hw.disabled |= VLAPIC_SW_DISABLED;
-
-    return 1;
 }
 
 #ifdef HVM_DEBUG_SUSPEND
@@ -908,8 +903,10 @@ static int lapic_load_regs(struct domain
     return 0;
 }
 
-HVM_REGISTER_SAVE_RESTORE(LAPIC, lapic_save_hidden, lapic_load_hidden);
-HVM_REGISTER_SAVE_RESTORE(LAPIC_REGS, lapic_save_regs, lapic_load_regs);
+HVM_REGISTER_SAVE_RESTORE(LAPIC, lapic_save_hidden, lapic_load_hidden,
+                          1, HVMSR_PER_VCPU);
+HVM_REGISTER_SAVE_RESTORE(LAPIC_REGS, lapic_save_regs, lapic_load_regs,
+                          1, HVMSR_PER_VCPU);
 
 int vlapic_init(struct vcpu *v)
 {
@@ -922,7 +919,6 @@ int vlapic_init(struct vcpu *v)
     {
         dprintk(XENLOG_ERR, "malloc vlapic regs error for vcpu %x\n",
                 v->vcpu_id);
-        xfree(vlapic);
         return -ENOMEM;
     }
 
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/hvm/vmx/vmcs.c
--- a/xen/arch/x86/hvm/vmx/vmcs.c       Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/x86/hvm/vmx/vmcs.c       Wed Feb 14 19:01:35 2007 +0000
@@ -295,6 +295,11 @@ static void construct_vmcs(struct vcpu *
 
     vmx_vmcs_enter(v);
 
+    v->arch.hvm_vmx.cpu_cr2 = 0;
+    v->arch.hvm_vmx.cpu_cr3 = 0;
+    memset(&v->arch.hvm_vmx.msr_state, 0, sizeof(v->arch.hvm_vmx.msr_state));
+    v->arch.hvm_vmx.vmxassist_enabled = 0;
+
     /* VMCS controls. */
     __vmwrite(PIN_BASED_VM_EXEC_CONTROL, vmx_pin_based_exec_control);
     __vmwrite(VM_EXIT_CONTROLS, vmx_vmexit_control);
@@ -443,15 +448,18 @@ static void construct_vmcs(struct vcpu *
 
     vmx_vmcs_exit(v);
 
-    shadow_update_paging_modes(v); /* will update HOST & GUEST_CR3 as reqd */
+    paging_update_paging_modes(v); /* will update HOST & GUEST_CR3 as reqd */
 }
 
 int vmx_create_vmcs(struct vcpu *v)
 {
-    if ( (v->arch.hvm_vmx.vmcs = vmx_alloc_vmcs()) == NULL )
-        return -ENOMEM;
- 
-    __vmx_clear_vmcs(v);
+    if ( v->arch.hvm_vmx.vmcs == NULL )
+    {
+        if ( (v->arch.hvm_vmx.vmcs = vmx_alloc_vmcs()) == NULL )
+            return -ENOMEM;
+
+        __vmx_clear_vmcs(v);
+    }
 
     construct_vmcs(v);
 
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/hvm/vmx/vmx.c
--- a/xen/arch/x86/hvm/vmx/vmx.c        Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/x86/hvm/vmx/vmx.c        Wed Feb 14 19:01:35 2007 +0000
@@ -35,12 +35,13 @@
 #include <asm/types.h>
 #include <asm/msr.h>
 #include <asm/spinlock.h>
+#include <asm/paging.h>
+#include <asm/p2m.h>
 #include <asm/hvm/hvm.h>
 #include <asm/hvm/support.h>
 #include <asm/hvm/vmx/vmx.h>
 #include <asm/hvm/vmx/vmcs.h>
 #include <asm/hvm/vmx/cpu.h>
-#include <asm/shadow.h>
 #include <public/sched.h>
 #include <public/hvm/ioreq.h>
 #include <asm/hvm/vpic.h>
@@ -484,9 +485,6 @@ int vmx_vmcs_restore(struct vcpu *v, str
         v->arch.guest_table = pagetable_from_pfn(mfn);
         if (old_base_mfn)
              put_page(mfn_to_page(old_base_mfn));
-        /*
-         * arch.shadow_table should now hold the next CR3 for shadow
-         */
         v->arch.hvm_vmx.cpu_cr3 = c->cr3;
     }
 
@@ -556,7 +554,7 @@ int vmx_vmcs_restore(struct vcpu *v, str
 
     vmx_vmcs_exit(v);
 
-    shadow_update_paging_modes(v);
+    paging_update_paging_modes(v);
     return 0;
 
  bad_cr3:
@@ -1126,7 +1124,7 @@ static int vmx_do_page_fault(unsigned lo
     }
 #endif
 
-    result = shadow_fault(va, regs);
+    result = paging_fault(va, regs);
 
     TRACE_VMEXIT(2, result);
 #if 0
@@ -1277,7 +1275,7 @@ static void vmx_do_invlpg(unsigned long 
      * We do the safest things first, then try to update the shadow
      * copying from guest
      */
-    shadow_invlpg(v, va);
+    paging_invlpg(v, va);
 }
 
 
@@ -1691,9 +1689,6 @@ static int vmx_world_restore(struct vcpu
         v->arch.guest_table = pagetable_from_pfn(mfn);
         if (old_base_mfn)
              put_page(mfn_to_page(old_base_mfn));
-        /*
-         * arch.shadow_table should now hold the next CR3 for shadow
-         */
         v->arch.hvm_vmx.cpu_cr3 = c->cr3;
     }
 
@@ -1753,7 +1748,7 @@ static int vmx_world_restore(struct vcpu
     __vmwrite(GUEST_LDTR_BASE, c->ldtr_base);
     __vmwrite(GUEST_LDTR_AR_BYTES, c->ldtr_arbytes.bytes);
 
-    shadow_update_paging_modes(v);
+    paging_update_paging_modes(v);
     return 0;
 
  bad_cr3:
@@ -1906,14 +1901,11 @@ static int vmx_set_cr0(unsigned long val
         v->arch.guest_table = pagetable_from_pfn(mfn);
         if (old_base_mfn)
             put_page(mfn_to_page(old_base_mfn));
-        shadow_update_paging_modes(v);
+        paging_update_paging_modes(v);
 
         HVM_DBG_LOG(DBG_LEVEL_VMMU, "New arch.guest_table = %lx",
                     (unsigned long) (mfn << PAGE_SHIFT));
 
-        /*
-         * arch->shadow_table should hold the next CR3 for shadow
-         */
         HVM_DBG_LOG(DBG_LEVEL_VMMU, "Update CR3 value = %lx, mfn = %lx",
                     v->arch.hvm_vmx.cpu_cr3, mfn);
     }
@@ -1981,7 +1973,7 @@ static int vmx_set_cr0(unsigned long val
             vm_entry_value &= ~VM_ENTRY_IA32E_MODE;
             __vmwrite(VM_ENTRY_CONTROLS, vm_entry_value);
         }
-        shadow_update_paging_modes(v);
+        paging_update_paging_modes(v);
     }
 
     return 1;
@@ -2070,7 +2062,7 @@ static int mov_to_cr(int gp, int cr, str
             mfn = get_mfn_from_gpfn(value >> PAGE_SHIFT);
             if (mfn != pagetable_get_pfn(v->arch.guest_table))
                 goto bad_cr3;
-            shadow_update_cr3(v);
+            paging_update_cr3(v);
         } else {
             /*
              * If different, make a shadow. Check if the PDBR is valid
@@ -2084,9 +2076,6 @@ static int mov_to_cr(int gp, int cr, str
             v->arch.guest_table = pagetable_from_pfn(mfn);
             if (old_base_mfn)
                 put_page(mfn_to_page(old_base_mfn));
-            /*
-             * arch.shadow_table should now hold the next CR3 for shadow
-             */
             v->arch.hvm_vmx.cpu_cr3 = value;
             update_cr3(v);
             HVM_DBG_LOG(DBG_LEVEL_VMMU, "Update CR3 value = %lx", value);
@@ -2120,9 +2109,6 @@ static int mov_to_cr(int gp, int cr, str
                 HVM_DBG_LOG(DBG_LEVEL_VMMU, "New arch.guest_table = %lx",
                             (unsigned long) (mfn << PAGE_SHIFT));
 
-                /*
-                 * arch->shadow_table should hold the next CR3 for shadow
-                 */
                 HVM_DBG_LOG(DBG_LEVEL_VMMU, 
                             "Update CR3 value = %lx, mfn = %lx",
                             v->arch.hvm_vmx.cpu_cr3, mfn);
@@ -2148,7 +2134,7 @@ static int mov_to_cr(int gp, int cr, str
          * all TLB entries except global entries.
          */
         if ( (old_cr ^ value) & (X86_CR4_PSE | X86_CR4_PGE | X86_CR4_PAE) )
-            shadow_update_paging_modes(v);
+            paging_update_paging_modes(v);
         break;
 
     case 8:
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/hvm/vpic.c
--- a/xen/arch/x86/hvm/vpic.c   Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/x86/hvm/vpic.c   Wed Feb 14 19:01:35 2007 +0000
@@ -440,7 +440,7 @@ static int vpic_load(struct domain *d, h
     return 0;
 }
 
-HVM_REGISTER_SAVE_RESTORE(PIC, vpic_save, vpic_load);
+HVM_REGISTER_SAVE_RESTORE(PIC, vpic_save, vpic_load, 2, HVMSR_PER_DOM);
 
 void vpic_init(struct domain *d)
 {
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/machine_kexec.c
--- a/xen/arch/x86/machine_kexec.c      Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/x86/machine_kexec.c      Wed Feb 14 19:01:35 2007 +0000
@@ -15,10 +15,14 @@
 #include <xen/types.h>
 #include <xen/console.h>
 #include <xen/kexec.h>
-#include <asm/kexec.h>
 #include <xen/domain_page.h>
 #include <asm/fixmap.h>
 #include <asm/hvm/hvm.h>
+
+typedef void (*relocate_new_kernel_t)(
+                unsigned long indirection_page,
+                unsigned long *page_list,
+                unsigned long start_address);
 
 int machine_kexec_load(int type, int slot, xen_kexec_image_t *image)
 {
@@ -40,8 +44,26 @@ int machine_kexec_load(int type, int slo
         else
         {
             /* Odd pages: va for previous ma. */
-            set_fixmap(fix_base + (k >> 1), prev_ma);
-            image->page_list[k] = fix_to_virt(fix_base + (k >> 1));
+            if ( IS_COMPAT(dom0) )
+            {
+
+                /*
+                 * The compatability bounce code sets up a page table
+                 * with a 1-1 mapping of the first 1G of memory so
+                 * VA==PA here.
+                 *
+                 * This Linux purgatory code still sets up separate
+                 * high and low mappings on the control page (entries
+                 * 0 and 1) but it is harmless if they are equal since
+                 * that PT is not live at the time.
+                 */
+                image->page_list[k] = prev_ma;
+            }
+            else
+            {
+                set_fixmap(fix_base + (k >> 1), prev_ma);
+                image->page_list[k] = fix_to_virt(fix_base + (k >> 1));
+            }
         }
     }
 
@@ -94,6 +116,31 @@ void machine_reboot_kexec(xen_kexec_imag
     BUG();
 }
 
+void machine_kexec(xen_kexec_image_t *image)
+{
+#ifdef CONFIG_COMPAT
+    if ( IS_COMPAT(dom0) )
+    {
+        extern void compat_machine_kexec(unsigned long rnk,
+                                         unsigned long indirection_page,
+                                         unsigned long *page_list,
+                                         unsigned long start_address);
+        compat_machine_kexec(image->page_list[1],
+                             image->indirection_page,
+                             image->page_list,
+                             image->start_address);
+    }
+    else
+#endif
+    {
+        relocate_new_kernel_t rnk;
+
+        rnk = (relocate_new_kernel_t) image->page_list[1];
+        (*rnk)(image->indirection_page, image->page_list,
+               image->start_address);
+    }
+}
+
 /*
  * Local variables:
  * mode: C
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/mm.c
--- a/xen/arch/x86/mm.c Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/x86/mm.c Wed Feb 14 19:01:35 2007 +0000
@@ -99,6 +99,7 @@
 #include <xen/event.h>
 #include <xen/iocap.h>
 #include <xen/guest_access.h>
+#include <asm/paging.h>
 #include <asm/shadow.h>
 #include <asm/page.h>
 #include <asm/flushtlb.h>
@@ -373,9 +374,6 @@ void write_ptbase(struct vcpu *v)
 /* Should be called after CR3 is updated.
  * Updates vcpu->arch.cr3 and, for HVM guests, vcpu->arch.hvm_vcpu.cpu_cr3.
  * 
- * Also updates other state derived from CR3 (vcpu->arch.guest_vtable,
- * shadow_vtable, etc).
- *
  * Uses values found in vcpu->arch.(guest_table and guest_table_user), and
  * for HVM guests, arch.monitor_table and hvm's guest CR3.
  *
@@ -385,9 +383,9 @@ void update_cr3(struct vcpu *v)
 {
     unsigned long cr3_mfn=0;
 
-    if ( shadow_mode_enabled(v->domain) )
-    {
-        shadow_update_cr3(v);
+    if ( paging_mode_enabled(v->domain) )
+    {
+        paging_update_cr3(v);
         return;
     }
 
@@ -615,7 +613,7 @@ get_page_from_l1e(
      * qemu-dm helper process in dom0 to map the domain's memory without
      * messing up the count of "real" writable mappings.) */
     okay = (((l1e_get_flags(l1e) & _PAGE_RW) && 
-             !(unlikely(shadow_mode_external(d) && (d != current->domain))))
+             !(unlikely(paging_mode_external(d) && (d != current->domain))))
             ? get_page_and_type(page, d, PGT_writable_page)
             : get_page(page, d));
     if ( !okay )
@@ -804,9 +802,9 @@ void put_page_from_l1e(l1_pgentry_t l1e,
     }
 
     /* Remember we didn't take a type-count of foreign writable mappings
-     * to shadow external domains */
+     * to paging-external domains */
     if ( (l1e_get_flags(l1e) & _PAGE_RW) && 
-         !(unlikely((e != d) && shadow_mode_external(e))) )
+         !(unlikely((e != d) && paging_mode_external(e))) )
     {
         put_page_and_type(page);
     }
@@ -976,6 +974,19 @@ static void pae_flush_pgd(
     l3_pgentry_t  *l3tab_ptr;
     struct pae_l3_cache *cache;
 
+    if ( unlikely(shadow_mode_enabled(d)) )
+    {
+        cpumask_t m = CPU_MASK_NONE;
+        /* Re-shadow this l3 table on any vcpus that are using it */
+        for_each_vcpu ( d, v )
+            if ( pagetable_get_pfn(v->arch.guest_table) == mfn )
+            {
+                paging_update_cr3(v);
+                cpus_or(m, m, v->vcpu_dirty_cpumask);
+            }
+        flush_tlb_mask(m);
+    }
+
     /* If below 4GB then the pgdir is not shadowed in low memory. */
     if ( !l3tab_needs_shadow(mfn) )
         return;
@@ -1259,20 +1270,13 @@ static inline int update_intpte(intpte_t
 {
     int rv = 1;
 #ifndef PTE_UPDATE_WITH_CMPXCHG
-    if ( unlikely(shadow_mode_enabled(v->domain)) )
-        rv = shadow_write_guest_entry(v, p, new, _mfn(mfn));
-    else
-        rv = (!__copy_to_user(p, &new, sizeof(new)));
+    rv = paging_write_guest_entry(v, p, new, _mfn(mfn));
 #else
     {
         intpte_t t = old;
         for ( ; ; )
         {
-            if ( unlikely(shadow_mode_enabled(v->domain)) )
-                rv = shadow_cmpxchg_guest_entry(v, p, &t, new, _mfn(mfn));
-            else
-                rv = (!cmpxchg_user(p, t, new));
-
+            rv = paging_cmpxchg_guest_entry(v, p, &t, new, _mfn(mfn));
             if ( unlikely(rv == 0) )
             {
                 MEM_LOG("Failed to update %" PRIpte " -> %" PRIpte
@@ -1310,7 +1314,7 @@ static int mod_l1_entry(l1_pgentry_t *pl
     if ( unlikely(__copy_from_user(&ol1e, pl1e, sizeof(ol1e)) != 0) )
         return 0;
 
-    if ( unlikely(shadow_mode_refcounts(d)) )
+    if ( unlikely(paging_mode_refcounts(d)) )
         return UPDATE_ENTRY(l1, pl1e, ol1e, nl1e, gl1mfn, current);
 
     if ( l1e_get_flags(nl1e) & _PAGE_PRESENT )
@@ -1572,7 +1576,7 @@ void free_page_type(struct page_info *pa
          */
         queue_deferred_ops(owner, DOP_FLUSH_ALL_TLBS);
 
-        if ( unlikely(shadow_mode_enabled(owner)) )
+        if ( unlikely(paging_mode_enabled(owner)) )
         {
             /* A page table is dirtied when its type count becomes zero. */
             mark_dirty(owner, page_to_mfn(page));
@@ -1771,7 +1775,7 @@ int new_guest_cr3(unsigned long mfn)
 #ifdef CONFIG_COMPAT
     if ( IS_COMPAT(d) )
     {
-        okay = shadow_mode_refcounts(d)
+        okay = paging_mode_refcounts(d)
             ? 0 /* Old code was broken, but what should it be? */
             : mod_l4_entry(__va(pagetable_get_paddr(v->arch.guest_table)),
                            l4e_from_pfn(mfn, (_PAGE_PRESENT|_PAGE_RW|
@@ -1788,7 +1792,7 @@ int new_guest_cr3(unsigned long mfn)
         return 1;
     }
 #endif
-    okay = shadow_mode_refcounts(d)
+    okay = paging_mode_refcounts(d)
         ? get_page_from_pagenr(mfn, d)
         : get_page_and_type_from_pagenr(mfn, PGT_root_page_table, d);
     if ( unlikely(!okay) )
@@ -1808,7 +1812,7 @@ int new_guest_cr3(unsigned long mfn)
 
     if ( likely(old_base_mfn != 0) )
     {
-        if ( shadow_mode_refcounts(d) )
+        if ( paging_mode_refcounts(d) )
             put_page(mfn_to_page(old_base_mfn));
         else
             put_page_and_type(mfn_to_page(old_base_mfn));
@@ -1861,7 +1865,7 @@ static int set_foreigndom(domid_t domid)
                 d->domain_id);
         okay = 0;
     }
-    else if ( unlikely(shadow_mode_translate(d)) )
+    else if ( unlikely(paging_mode_translate(d)) )
     {
         MEM_LOG("Cannot mix foreign mappings with translated domains");
         okay = 0;
@@ -2007,7 +2011,7 @@ int do_mmuext_op(
             if ( (op.cmd - MMUEXT_PIN_L1_TABLE) > (CONFIG_PAGING_LEVELS - 1) )
                 break;
 
-            if ( shadow_mode_refcounts(FOREIGNDOM) )
+            if ( paging_mode_refcounts(FOREIGNDOM) )
                 break;
 
             okay = get_page_and_type_from_pagenr(mfn, type, FOREIGNDOM);
@@ -2032,7 +2036,7 @@ int do_mmuext_op(
             break;
 
         case MMUEXT_UNPIN_TABLE:
-            if ( shadow_mode_refcounts(d) )
+            if ( paging_mode_refcounts(d) )
                 break;
 
             if ( unlikely(!(okay = get_page_from_pagenr(mfn, d))) )
@@ -2070,7 +2074,7 @@ int do_mmuext_op(
             }
             if (likely(mfn != 0))
             {
-                if ( shadow_mode_refcounts(d) )
+                if ( paging_mode_refcounts(d) )
                     okay = get_page_from_pagenr(mfn, d);
                 else
                     okay = get_page_and_type_from_pagenr(
@@ -2087,7 +2091,7 @@ int do_mmuext_op(
                 v->arch.guest_table_user = pagetable_from_pfn(mfn);
                 if ( old_mfn != 0 )
                 {
-                    if ( shadow_mode_refcounts(d) )
+                    if ( paging_mode_refcounts(d) )
                         put_page(mfn_to_page(old_mfn));
                     else
                         put_page_and_type(mfn_to_page(old_mfn));
@@ -2101,8 +2105,8 @@ int do_mmuext_op(
             break;
     
         case MMUEXT_INVLPG_LOCAL:
-            if ( !shadow_mode_enabled(d) 
-                 || shadow_invlpg(v, op.arg1.linear_addr) != 0 )
+            if ( !paging_mode_enabled(d) 
+                 || paging_invlpg(v, op.arg1.linear_addr) != 0 )
                 local_flush_tlb_one(op.arg1.linear_addr);
             break;
 
@@ -2149,7 +2153,7 @@ int do_mmuext_op(
             unsigned long ptr  = op.arg1.linear_addr;
             unsigned long ents = op.arg2.nr_ents;
 
-            if ( shadow_mode_external(d) )
+            if ( paging_mode_external(d) )
             {
                 MEM_LOG("ignoring SET_LDT hypercall from external "
                         "domain %u", d->domain_id);
@@ -2298,9 +2302,9 @@ int do_mmu_update(
             case PGT_l3_page_table:
             case PGT_l4_page_table:
             {
-                if ( shadow_mode_refcounts(d) )
+                if ( paging_mode_refcounts(d) )
                 {
-                    MEM_LOG("mmu update on shadow-refcounted domain!");
+                    MEM_LOG("mmu update on auto-refcounted domain!");
                     break;
                 }
 
@@ -2351,13 +2355,7 @@ int do_mmu_update(
                 if ( unlikely(!get_page_type(page, PGT_writable_page)) )
                     break;
 
-                if ( unlikely(shadow_mode_enabled(d)) )
-                    okay = shadow_write_guest_entry(v, va, req.val, _mfn(mfn));
-                else
-                {
-                    *(intpte_t *)va = req.val;
-                    okay = 1;
-                }
+                okay = paging_write_guest_entry(v, va, req.val, _mfn(mfn));
 
                 put_page_type(page);
             }
@@ -2380,9 +2378,9 @@ int do_mmu_update(
                 break;
             }
 
-            if ( unlikely(shadow_mode_translate(FOREIGNDOM)) )
+            if ( unlikely(paging_mode_translate(FOREIGNDOM)) )
             {
-                MEM_LOG("Mach-phys update on shadow-translate guest");
+                MEM_LOG("Mach-phys update on auto-translate guest");
                 break;
             }
 
@@ -2472,7 +2470,7 @@ static int create_grant_pte_mapping(
         goto failed;
     } 
 
-    if ( !shadow_mode_refcounts(d) )
+    if ( !paging_mode_refcounts(d) )
         put_page_from_l1e(ol1e, d);
 
     put_page_type(page);
@@ -2578,7 +2576,7 @@ static int create_grant_va_mapping(
     if ( !okay )
             return GNTST_general_error;
 
-    if ( !shadow_mode_refcounts(d) )
+    if ( !paging_mode_refcounts(d) )
         put_page_from_l1e(ol1e, d);
 
     return GNTST_okay;
@@ -2704,7 +2702,7 @@ int do_update_va_mapping(unsigned long v
 
     perfc_incrc(calls_to_update_va);
 
-    if ( unlikely(!__addr_ok(va) && !shadow_mode_external(d)) )
+    if ( unlikely(!__addr_ok(va) && !paging_mode_external(d)) )
         return -EINVAL;
 
     LOCK_BIGLOCK(d);
@@ -2744,8 +2742,8 @@ int do_update_va_mapping(unsigned long v
         switch ( (bmap_ptr = flags & ~UVMF_FLUSHTYPE_MASK) )
         {
         case UVMF_LOCAL:
-            if ( !shadow_mode_enabled(d) 
-                 || (shadow_invlpg(current, va) != 0) ) 
+            if ( !paging_mode_enabled(d) 
+                 || (paging_invlpg(current, va) != 0) ) 
                 local_flush_tlb_one(va);
             break;
         case UVMF_ALL:
@@ -2980,7 +2978,7 @@ long arch_memory_op(int op, XEN_GUEST_HA
             break;
         }
 
-        if ( !shadow_mode_translate(d) || (mfn == 0) )
+        if ( !paging_mode_translate(d) || (mfn == 0) )
         {
             put_domain(d);
             return -EINVAL;
@@ -3235,17 +3233,12 @@ static int ptwr_emulated_update(
     if ( do_cmpxchg )
     {
         int okay;
+        intpte_t t = old;
         ol1e = l1e_from_intpte(old);
 
-        if ( shadow_mode_enabled(d) )
-        {
-            intpte_t t = old;
-            okay = shadow_cmpxchg_guest_entry(v, (intpte_t *) pl1e, 
-                                              &t, val, _mfn(mfn));
-            okay = (okay && t == old);
-        }
-        else 
-            okay = (cmpxchg((intpte_t *)pl1e, old, val) == old);
+        okay = paging_cmpxchg_guest_entry(v, (intpte_t *) pl1e, 
+                                          &t, val, _mfn(mfn));
+        okay = (okay && t == old);
 
         if ( !okay )
         {
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/mm/Makefile
--- a/xen/arch/x86/mm/Makefile  Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/x86/mm/Makefile  Wed Feb 14 19:01:35 2007 +0000
@@ -1,1 +1,4 @@ subdir-y += shadow
 subdir-y += shadow
+
+obj-y += paging.o
+obj-y += p2m.o
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/mm/p2m.c
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/xen/arch/x86/mm/p2m.c     Wed Feb 14 19:01:35 2007 +0000
@@ -0,0 +1,699 @@
+/******************************************************************************
+ * arch/x86/mm/p2m.c
+ *
+ * physical-to-machine mappings for automatically-translated domains.
+ * 
+ * Parts of this code are Copyright (c) 2007 by Advanced Micro Devices.
+ * Parts of this code are Copyright (c) 2006 by XenSource Inc.
+ * Parts of this code are Copyright (c) 2006 by Michael A Fetterman
+ * Parts based on earlier work by Michael A Fetterman, Ian Pratt et al.
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#include <asm/domain.h>
+#include <asm/page.h>
+#include <asm/paging.h>
+#include <asm/p2m.h>
+
+/* Debugging and auditing of the P2M code? */
+#define P2M_AUDIT     0
+#define P2M_DEBUGGING 1
+
+/* The P2M lock.  This protects all updates to the p2m table.
+ * Updates are expected to be safe against concurrent reads, 
+ * which do *not* require the lock */
+
+#define p2m_lock_init(_d)                            \
+    do {                                             \
+        spin_lock_init(&(_d)->arch.p2m.lock);        \
+        (_d)->arch.p2m.locker = -1;                  \
+        (_d)->arch.p2m.locker_function = "nobody";   \
+    } while (0)
+
+#define p2m_lock(_d)                                                \
+    do {                                                            \
+        if ( unlikely((_d)->arch.p2m.locker == current->processor) )\
+        {                                                           \
+            printk("Error: p2m lock held by %s\n",                  \
+                   (_d)->arch.p2m.locker_function);                 \
+            BUG();                                                  \
+        }                                                           \
+        spin_lock(&(_d)->arch.p2m.lock);                            \
+        ASSERT((_d)->arch.p2m.locker == -1);                        \
+        (_d)->arch.p2m.locker = current->processor;                 \
+        (_d)->arch.p2m.locker_function = __func__;                  \
+    } while (0)
+
+#define p2m_unlock(_d)                                              \
+    do {                                                            \
+        ASSERT((_d)->arch.p2m.locker == current->processor); \
+        (_d)->arch.p2m.locker = -1;                          \
+        (_d)->arch.p2m.locker_function = "nobody";           \
+        spin_unlock(&(_d)->arch.p2m.lock);                   \
+    } while (0)
+
+
+
+/* Printouts */
+#define P2M_PRINTK(_f, _a...)                                \
+    debugtrace_printk("p2m: %s(): " _f, __func__, ##_a)
+#define P2M_ERROR(_f, _a...)                                 \
+    printk("pg error: %s(): " _f, __func__, ##_a)
+#if P2M_DEBUGGING
+#define P2M_DEBUG(_f, _a...)                                 \
+    debugtrace_printk("p2mdebug: %s(): " _f, __func__, ##_a)
+#else
+#define P2M_DEBUG(_f, _a...) do { (void)(_f); } while(0) 
+#endif
+
+
+/* Override macros from asm/page.h to make them work with mfn_t */
+#undef mfn_to_page
+#define mfn_to_page(_m) (frame_table + mfn_x(_m))
+#undef mfn_valid
+#define mfn_valid(_mfn) (mfn_x(_mfn) < max_page)
+#undef page_to_mfn
+#define page_to_mfn(_pg) (_mfn((_pg) - frame_table))
+
+
+
+// Find the next level's P2M entry, checking for out-of-range gfn's...
+// Returns NULL on error.
+//
+static l1_pgentry_t *
+p2m_find_entry(void *table, unsigned long *gfn_remainder,
+                   unsigned long gfn, u32 shift, u32 max)
+{
+    u32 index;
+
+    index = *gfn_remainder >> shift;
+    if ( index >= max )
+    {
+        P2M_DEBUG("gfn=0x%lx out of range "
+                  "(gfn_remainder=0x%lx shift=%d index=0x%x max=0x%x)\n",
+                  gfn, *gfn_remainder, shift, index, max);
+        return NULL;
+    }
+    *gfn_remainder &= (1 << shift) - 1;
+    return (l1_pgentry_t *)table + index;
+}
+
+// Walk one level of the P2M table, allocating a new table if required.
+// Returns 0 on error.
+//
+static int
+p2m_next_level(struct domain *d, mfn_t *table_mfn, void **table, 
+               unsigned long *gfn_remainder, unsigned long gfn, u32 shift, 
+               u32 max, unsigned long type)
+{
+    l1_pgentry_t *p2m_entry;
+    l1_pgentry_t new_entry;
+    void *next;
+    ASSERT(d->arch.p2m.alloc_page);
+
+    if ( !(p2m_entry = p2m_find_entry(*table, gfn_remainder, gfn,
+                                      shift, max)) )
+        return 0;
+
+    if ( !(l1e_get_flags(*p2m_entry) & _PAGE_PRESENT) )
+    {
+        struct page_info *pg = d->arch.p2m.alloc_page(d);
+        if ( pg == NULL )
+            return 0;
+        list_add_tail(&pg->list, &d->arch.p2m.pages);
+        pg->u.inuse.type_info = type | 1 | PGT_validated;
+        pg->count_info = 1;
+
+        new_entry = l1e_from_pfn(mfn_x(page_to_mfn(pg)),
+                                 __PAGE_HYPERVISOR|_PAGE_USER);
+
+        switch ( type ) {
+        case PGT_l3_page_table:
+            paging_write_p2m_entry(d, gfn, p2m_entry, new_entry, 4);
+            break;
+        case PGT_l2_page_table:
+            paging_write_p2m_entry(d, gfn, p2m_entry, new_entry, 3);
+            break;
+        case PGT_l1_page_table:
+            paging_write_p2m_entry(d, gfn, p2m_entry, new_entry, 2);
+            break;
+        default:
+            BUG();
+            break;
+        }
+    }
+    *table_mfn = _mfn(l1e_get_pfn(*p2m_entry));
+    next = map_domain_page(mfn_x(*table_mfn));
+    unmap_domain_page(*table);
+    *table = next;
+
+    return 1;
+}
+
+// Returns 0 on error (out of memory)
+static int
+set_p2m_entry(struct domain *d, unsigned long gfn, mfn_t mfn)
+{
+    // XXX -- this might be able to be faster iff current->domain == d
+    mfn_t table_mfn = pagetable_get_mfn(d->arch.phys_table);
+    void *table =map_domain_page(mfn_x(table_mfn));
+    unsigned long gfn_remainder = gfn;
+    l1_pgentry_t *p2m_entry;
+    l1_pgentry_t entry_content;
+    int rv=0;
+
+#if CONFIG_PAGING_LEVELS >= 4
+    if ( !p2m_next_level(d, &table_mfn, &table, &gfn_remainder, gfn,
+                         L4_PAGETABLE_SHIFT - PAGE_SHIFT,
+                         L4_PAGETABLE_ENTRIES, PGT_l3_page_table) )
+        goto out;
+#endif
+#if CONFIG_PAGING_LEVELS >= 3
+    // When using PAE Xen, we only allow 33 bits of pseudo-physical
+    // address in translated guests (i.e. 8 GBytes).  This restriction
+    // comes from wanting to map the P2M table into the 16MB RO_MPT hole
+    // in Xen's address space for translated PV guests.
+    //
+    if ( !p2m_next_level(d, &table_mfn, &table, &gfn_remainder, gfn,
+                         L3_PAGETABLE_SHIFT - PAGE_SHIFT,
+                         (CONFIG_PAGING_LEVELS == 3
+                          ? 8
+                          : L3_PAGETABLE_ENTRIES),
+                         PGT_l2_page_table) )
+        goto out;
+#endif
+    if ( !p2m_next_level(d, &table_mfn, &table, &gfn_remainder, gfn,
+                         L2_PAGETABLE_SHIFT - PAGE_SHIFT,
+                         L2_PAGETABLE_ENTRIES, PGT_l1_page_table) )
+        goto out;
+
+    p2m_entry = p2m_find_entry(table, &gfn_remainder, gfn,
+                               0, L1_PAGETABLE_ENTRIES);
+    ASSERT(p2m_entry);
+
+    /* Track the highest gfn for which we have ever had a valid mapping */
+    if ( mfn_valid(mfn) && (gfn > d->arch.p2m.max_mapped_pfn) ) 
+        d->arch.p2m.max_mapped_pfn = gfn;
+
+    if ( mfn_valid(mfn) )
+        entry_content = l1e_from_pfn(mfn_x(mfn), __PAGE_HYPERVISOR|_PAGE_USER);
+    else
+        entry_content = l1e_empty();
+
+    /* level 1 entry */
+    paging_write_p2m_entry(d, gfn, p2m_entry, entry_content, 1);
+
+    /* Success */
+    rv = 1;
+ 
+ out:
+    unmap_domain_page(table);
+    return rv;
+}
+
+
+/* Init the datastructures for later use by the p2m code */
+void p2m_init(struct domain *d)
+{
+    p2m_lock_init(d);
+    INIT_LIST_HEAD(&d->arch.p2m.pages);
+}
+
+
+// Allocate a new p2m table for a domain.
+//
+// The structure of the p2m table is that of a pagetable for xen (i.e. it is
+// controlled by CONFIG_PAGING_LEVELS).
+//
+// The alloc_page and free_page functions will be used to get memory to
+// build the p2m, and to release it again at the end of day. 
+//
+// Returns 0 for success or -errno.
+//
+int p2m_alloc_table(struct domain *d,
+                    struct page_info * (*alloc_page)(struct domain *d),
+                    void (*free_page)(struct domain *d, struct page_info *pg))
+
+{
+    mfn_t mfn;
+    struct list_head *entry;
+    struct page_info *page, *p2m_top;
+    unsigned int page_count = 0;
+    unsigned long gfn;
+    
+    p2m_lock(d);
+
+    if ( pagetable_get_pfn(d->arch.phys_table) != 0 )
+    {
+        P2M_ERROR("p2m already allocated for this domain\n");
+        p2m_unlock(d);
+        return -EINVAL;
+    }
+
+    P2M_PRINTK("allocating p2m table\n");
+
+    d->arch.p2m.alloc_page = alloc_page;
+    d->arch.p2m.free_page = free_page;
+
+    p2m_top = d->arch.p2m.alloc_page(d);
+    if ( p2m_top == NULL )
+    {
+        p2m_unlock(d);
+        return -ENOMEM;
+    }
+list_add_tail(&p2m_top->list, &d->arch.p2m.pages);
+
+    p2m_top->count_info = 1;
+    p2m_top->u.inuse.type_info = 
+#if CONFIG_PAGING_LEVELS == 4
+        PGT_l4_page_table
+#elif CONFIG_PAGING_LEVELS == 3
+        PGT_l3_page_table
+#elif CONFIG_PAGING_LEVELS == 2
+        PGT_l2_page_table
+#endif
+        | 1 | PGT_validated;
+
+    d->arch.phys_table = pagetable_from_mfn(page_to_mfn(p2m_top));
+
+    P2M_PRINTK("populating p2m table\n");
+ 
+    /* Initialise physmap tables for slot zero. Other code assumes this. */
+    gfn = 0;
+mfn = _mfn(INVALID_MFN);
+    if ( !set_p2m_entry(d, gfn, mfn) )
+        goto error;
+
+    for ( entry = d->page_list.next;
+          entry != &d->page_list;
+          entry = entry->next )
+    {
+        page = list_entry(entry, struct page_info, list);
+        mfn = page_to_mfn(page);
+        gfn = get_gpfn_from_mfn(mfn_x(mfn));
+        page_count++;
+        if (
+#ifdef __x86_64__
+            (gfn != 0x5555555555555555L)
+#else
+            (gfn != 0x55555555L)
+#endif
+             && gfn != INVALID_M2P_ENTRY
+             && !set_p2m_entry(d, gfn, mfn) )
+            goto error;
+    }
+
+    P2M_PRINTK("p2m table initialised (%u pages)\n", page_count);
+    p2m_unlock(d);
+    return 0;
+
+ error:
+    P2M_PRINTK("failed to initialize p2m table, gfn=%05lx, mfn=%"
+               PRI_mfn "\n", gfn, mfn_x(mfn));
+    p2m_unlock(d);
+    return -ENOMEM;
+}
+
+void p2m_teardown(struct domain *d)
+/* Return all the p2m pages to Xen.
+ * We know we don't have any extra mappings to these pages */
+{
+    struct list_head *entry, *n;
+    struct page_info *pg;
+
+    p2m_lock(d);
+    d->arch.phys_table = pagetable_null();
+
+    list_for_each_safe(entry, n, &d->arch.p2m.pages)
+    {
+        pg = list_entry(entry, struct page_info, list);
+        list_del(entry);
+        d->arch.p2m.free_page(d, pg);
+    }
+    p2m_unlock(d);
+}
+
+mfn_t
+gfn_to_mfn_foreign(struct domain *d, unsigned long gpfn)
+/* Read another domain's p2m entries */
+{
+    mfn_t mfn;
+    paddr_t addr = ((paddr_t)gpfn) << PAGE_SHIFT;
+    l2_pgentry_t *l2e;
+    l1_pgentry_t *l1e;
+    
+    ASSERT(paging_mode_translate(d));
+    mfn = pagetable_get_mfn(d->arch.phys_table);
+
+
+    if ( gpfn > d->arch.p2m.max_mapped_pfn ) 
+        /* This pfn is higher than the highest the p2m map currently holds */
+        return _mfn(INVALID_MFN);
+
+#if CONFIG_PAGING_LEVELS >= 4
+    { 
+        l4_pgentry_t *l4e = map_domain_page(mfn_x(mfn));
+        l4e += l4_table_offset(addr);
+        if ( (l4e_get_flags(*l4e) & _PAGE_PRESENT) == 0 )
+        {
+            unmap_domain_page(l4e);
+            return _mfn(INVALID_MFN);
+        }
+        mfn = _mfn(l4e_get_pfn(*l4e));
+        unmap_domain_page(l4e);
+    }
+#endif
+#if CONFIG_PAGING_LEVELS >= 3
+    {
+        l3_pgentry_t *l3e = map_domain_page(mfn_x(mfn));
+#if CONFIG_PAGING_LEVELS == 3
+        /* On PAE hosts the p2m has eight l3 entries, not four (see
+         * shadow_set_p2m_entry()) so we can't use l3_table_offset.
+         * Instead, just count the number of l3es from zero.  It's safe
+         * to do this because we already checked that the gfn is within
+         * the bounds of the p2m. */
+        l3e += (addr >> L3_PAGETABLE_SHIFT);
+#else
+        l3e += l3_table_offset(addr);        
+#endif
+        if ( (l3e_get_flags(*l3e) & _PAGE_PRESENT) == 0 )
+        {
+            unmap_domain_page(l3e);
+            return _mfn(INVALID_MFN);
+        }
+        mfn = _mfn(l3e_get_pfn(*l3e));
+        unmap_domain_page(l3e);
+    }
+#endif
+
+    l2e = map_domain_page(mfn_x(mfn));
+    l2e += l2_table_offset(addr);
+    if ( (l2e_get_flags(*l2e) & _PAGE_PRESENT) == 0 )
+    {
+        unmap_domain_page(l2e);
+        return _mfn(INVALID_MFN);
+    }
+    mfn = _mfn(l2e_get_pfn(*l2e));
+    unmap_domain_page(l2e);
+
+    l1e = map_domain_page(mfn_x(mfn));
+    l1e += l1_table_offset(addr);
+    if ( (l1e_get_flags(*l1e) & _PAGE_PRESENT) == 0 )
+    {
+        unmap_domain_page(l1e);
+        return _mfn(INVALID_MFN);
+    }
+    mfn = _mfn(l1e_get_pfn(*l1e));
+    unmap_domain_page(l1e);
+
+    return mfn;
+}
+
+#if P2M_AUDIT
+static void audit_p2m(struct domain *d)
+{
+    struct list_head *entry;
+    struct page_info *page;
+    struct domain *od;
+    unsigned long mfn, gfn, m2pfn, lp2mfn = 0;
+    mfn_t p2mfn;
+    unsigned long orphans_d = 0, orphans_i = 0, mpbad = 0, pmbad = 0;
+    int test_linear;
+    
+    if ( !paging_mode_translate(d) )
+        return;
+
+    //P2M_PRINTK("p2m audit starts\n");
+
+    test_linear = ( (d == current->domain) 
+                    && !pagetable_is_null(current->arch.monitor_table) );
+    if ( test_linear )
+        local_flush_tlb(); 
+
+    /* Audit part one: walk the domain's page allocation list, checking 
+     * the m2p entries. */
+    for ( entry = d->page_list.next;
+          entry != &d->page_list;
+          entry = entry->next )
+    {
+        page = list_entry(entry, struct page_info, list);
+        mfn = mfn_x(page_to_mfn(page));
+
+        // P2M_PRINTK("auditing guest page, mfn=%#lx\n", mfn); 
+
+        od = page_get_owner(page);
+
+        if ( od != d ) 
+        {
+            P2M_PRINTK("wrong owner %#lx -> %p(%u) != %p(%u)\n",
+                       mfn, od, (od?od->domain_id:-1), d, d->domain_id);
+            continue;
+        }
+
+        gfn = get_gpfn_from_mfn(mfn);
+        if ( gfn == INVALID_M2P_ENTRY ) 
+        {
+            orphans_i++;
+            //P2M_PRINTK("orphaned guest page: mfn=%#lx has invalid gfn\n",
+            //               mfn); 
+            continue;
+        }
+
+        if ( gfn == 0x55555555 ) 
+        {
+            orphans_d++;
+            //P2M_PRINTK("orphaned guest page: mfn=%#lx has debug gfn\n", 
+            //               mfn); 
+            continue;
+        }
+
+        p2mfn = gfn_to_mfn_foreign(d, gfn);
+        if ( mfn_x(p2mfn) != mfn )
+        {
+            mpbad++;
+            P2M_PRINTK("map mismatch mfn %#lx -> gfn %#lx -> mfn %#lx"
+                       " (-> gfn %#lx)\n",
+                       mfn, gfn, mfn_x(p2mfn),
+                       (mfn_valid(p2mfn)
+                        ? get_gpfn_from_mfn(mfn_x(p2mfn))
+                        : -1u));
+            /* This m2p entry is stale: the domain has another frame in
+             * this physical slot.  No great disaster, but for neatness,
+             * blow away the m2p entry. */ 
+            set_gpfn_from_mfn(mfn, INVALID_M2P_ENTRY);
+        }
+
+        if ( test_linear && (gfn <= d->arch.p2m.max_mapped_pfn) )
+        {
+            lp2mfn = mfn_x(gfn_to_mfn_current(gfn));
+            if ( lp2mfn != mfn_x(p2mfn) )
+            {
+                P2M_PRINTK("linear mismatch gfn %#lx -> mfn %#lx "
+                           "(!= mfn %#lx)\n", gfn, lp2mfn, mfn_x(p2mfn));
+            }
+        }
+
+        // P2M_PRINTK("OK: mfn=%#lx, gfn=%#lx, p2mfn=%#lx, lp2mfn=%#lx\n", 
+        //                mfn, gfn, p2mfn, lp2mfn); 
+    }   
+
+    /* Audit part two: walk the domain's p2m table, checking the entries. */
+    if ( pagetable_get_pfn(d->arch.phys_table) != 0 )
+    {
+        l2_pgentry_t *l2e;
+        l1_pgentry_t *l1e;
+        int i1, i2;
+        
+#if CONFIG_PAGING_LEVELS == 4
+        l4_pgentry_t *l4e;
+        l3_pgentry_t *l3e;
+        int i3, i4;
+        l4e = map_domain_page(mfn_x(pagetable_get_mfn(d->arch.phys_table)));
+#elif CONFIG_PAGING_LEVELS == 3
+        l3_pgentry_t *l3e;
+        int i3;
+        l3e = map_domain_page(mfn_x(pagetable_get_mfn(d->arch.phys_table)));
+#else /* CONFIG_PAGING_LEVELS == 2 */
+        l2e = map_domain_page(mfn_x(pagetable_get_mfn(d->arch.phys_table)));
+#endif
+
+        gfn = 0;
+#if CONFIG_PAGING_LEVELS >= 3
+#if CONFIG_PAGING_LEVELS >= 4
+        for ( i4 = 0; i4 < L4_PAGETABLE_ENTRIES; i4++ )
+        {
+            if ( !(l4e_get_flags(l4e[i4]) & _PAGE_PRESENT) )
+            {
+                gfn += 1 << (L4_PAGETABLE_SHIFT - PAGE_SHIFT);
+                continue;
+            }
+            l3e = map_domain_page(mfn_x(_mfn(l4e_get_pfn(l4e[i4]))));
+#endif /* now at levels 3 or 4... */
+            for ( i3 = 0; 
+                  i3 < ((CONFIG_PAGING_LEVELS==4) ? L3_PAGETABLE_ENTRIES : 8); 
+                  i3++ )
+            {
+                if ( !(l3e_get_flags(l3e[i3]) & _PAGE_PRESENT) )
+                {
+                    gfn += 1 << (L3_PAGETABLE_SHIFT - PAGE_SHIFT);
+                    continue;
+                }
+                l2e = map_domain_page(mfn_x(_mfn(l3e_get_pfn(l3e[i3]))));
+#endif /* all levels... */
+                for ( i2 = 0; i2 < L2_PAGETABLE_ENTRIES; i2++ )
+                {
+                    if ( !(l2e_get_flags(l2e[i2]) & _PAGE_PRESENT) )
+                    {
+                        gfn += 1 << (L2_PAGETABLE_SHIFT - PAGE_SHIFT);
+                        continue;
+                    }
+                    l1e = map_domain_page(mfn_x(_mfn(l2e_get_pfn(l2e[i2]))));
+                    
+                    for ( i1 = 0; i1 < L1_PAGETABLE_ENTRIES; i1++, gfn++ )
+                    {
+                        if ( !(l1e_get_flags(l1e[i1]) & _PAGE_PRESENT) )
+                            continue;
+                        mfn = l1e_get_pfn(l1e[i1]);
+                        ASSERT(mfn_valid(_mfn(mfn)));
+                        m2pfn = get_gpfn_from_mfn(mfn);
+                        if ( m2pfn != gfn )
+                        {
+                            pmbad++;
+                            P2M_PRINTK("mismatch: gfn %#lx -> mfn %#lx"
+                                       " -> gfn %#lx\n", gfn, mfn, m2pfn);
+                            BUG();
+                        }
+                    }
+                    unmap_domain_page(l1e);
+                }
+#if CONFIG_PAGING_LEVELS >= 3
+                unmap_domain_page(l2e);
+            }
+#if CONFIG_PAGING_LEVELS >= 4
+            unmap_domain_page(l3e);
+        }
+#endif
+#endif
+
+#if CONFIG_PAGING_LEVELS == 4
+        unmap_domain_page(l4e);
+#elif CONFIG_PAGING_LEVELS == 3
+        unmap_domain_page(l3e);
+#else /* CONFIG_PAGING_LEVELS == 2 */
+        unmap_domain_page(l2e);
+#endif
+
+    }
+
+    //P2M_PRINTK("p2m audit complete\n");
+    //if ( orphans_i | orphans_d | mpbad | pmbad ) 
+    //    P2M_PRINTK("p2m audit found %lu orphans (%lu inval %lu debug)\n",
+    //                   orphans_i + orphans_d, orphans_i, orphans_d,
+    if ( mpbad | pmbad ) 
+        P2M_PRINTK("p2m audit found %lu odd p2m, %lu bad m2p entries\n",
+                   pmbad, mpbad);
+}
+#else 
+#define audit_p2m(_d) do { (void)(_d); } while(0)
+#endif /* P2M_AUDIT */
+
+
+
+static void
+p2m_remove_page(struct domain *d, unsigned long gfn, unsigned long mfn)
+{
+    if ( !paging_mode_translate(d) )
+        return;
+    P2M_DEBUG("removing gfn=%#lx mfn=%#lx\n", gfn, mfn);
+
+    ASSERT(mfn_x(gfn_to_mfn(d, gfn)) == mfn);
+    //ASSERT(mfn_to_gfn(d, mfn) == gfn);
+
+    set_p2m_entry(d, gfn, _mfn(INVALID_MFN));
+    set_gpfn_from_mfn(mfn, INVALID_M2P_ENTRY);
+}
+
+void
+guest_physmap_remove_page(struct domain *d, unsigned long gfn,
+                          unsigned long mfn)
+{
+    p2m_lock(d);
+    audit_p2m(d);
+    p2m_remove_page(d, gfn, mfn);
+    audit_p2m(d);
+    p2m_unlock(d);    
+}
+
+void
+guest_physmap_add_page(struct domain *d, unsigned long gfn,
+                       unsigned long mfn)
+{
+    unsigned long ogfn;
+    mfn_t omfn;
+
+    if ( !paging_mode_translate(d) )
+        return;
+
+    p2m_lock(d);
+    audit_p2m(d);
+
+    P2M_DEBUG("adding gfn=%#lx mfn=%#lx\n", gfn, mfn);
+
+    omfn = gfn_to_mfn(d, gfn);
+    if ( mfn_valid(omfn) )
+    {
+        set_p2m_entry(d, gfn, _mfn(INVALID_MFN));
+        set_gpfn_from_mfn(mfn_x(omfn), INVALID_M2P_ENTRY);
+    }
+
+    ogfn = mfn_to_gfn(d, _mfn(mfn));
+    if (
+#ifdef __x86_64__
+        (ogfn != 0x5555555555555555L)
+#else
+        (ogfn != 0x55555555L)
+#endif
+        && (ogfn != INVALID_M2P_ENTRY)
+        && (ogfn != gfn) )
+    {
+        /* This machine frame is already mapped at another physical address */
+        P2M_DEBUG("aliased! mfn=%#lx, old gfn=%#lx, new gfn=%#lx\n",
+                  mfn, ogfn, gfn);
+        if ( mfn_valid(omfn = gfn_to_mfn(d, ogfn)) ) 
+        {
+            P2M_DEBUG("old gfn=%#lx -> mfn %#lx\n", 
+                      ogfn , mfn_x(omfn));
+            if ( mfn_x(omfn) == mfn ) 
+                p2m_remove_page(d, ogfn, mfn);
+        }
+    }
+
+    set_p2m_entry(d, gfn, _mfn(mfn));
+    set_gpfn_from_mfn(mfn, gfn);
+
+    audit_p2m(d);
+    p2m_unlock(d);
+}
+
+
+/*
+ * Local variables:
+ * mode: C
+ * c-set-style: "BSD"
+ * c-basic-offset: 4
+ * indent-tabs-mode: nil
+ * End:
+ */
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/mm/paging.c
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/xen/arch/x86/mm/paging.c  Wed Feb 14 19:01:35 2007 +0000
@@ -0,0 +1,143 @@
+/******************************************************************************
+ * arch/x86/paging.c
+ *
+ * x86 specific paging support
+ * Copyright (c) 2007 Advanced Micro Devices (Wei Huang)
+ * Copyright (c) 2007 XenSource Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#include <xen/init.h>
+#include <asm/paging.h>
+#include <asm/shadow.h>
+#include <asm/p2m.h>
+
+/* Xen command-line option to enable hardware-assisted paging */
+int opt_hap_enabled = 0; 
+boolean_param("hap", opt_hap_enabled);
+
+/* Printouts */
+#define PAGING_PRINTK(_f, _a...)                                     \
+    debugtrace_printk("pg: %s(): " _f, __func__, ##_a)
+#define PAGING_ERROR(_f, _a...)                                      \
+    printk("pg error: %s(): " _f, __func__, ##_a)
+#define PAGING_DEBUG(flag, _f, _a...)                                \
+    do {                                                             \
+        if (PAGING_DEBUG_ ## flag)                                   \
+            debugtrace_printk("pgdebug: %s(): " _f, __func__, ##_a); \
+    } while (0)
+
+
+/* Domain paging struct initialization. */
+void paging_domain_init(struct domain *d)
+{
+    p2m_init(d);
+    shadow_domain_init(d);
+}
+
+/* vcpu paging struct initialization goes here */
+void paging_vcpu_init(struct vcpu *v)
+{
+    shadow_vcpu_init(v);
+}
+
+
+int paging_domctl(struct domain *d, xen_domctl_shadow_op_t *sc,
+                  XEN_GUEST_HANDLE(void) u_domctl)
+{
+    /* Here, dispatch domctl to the appropriate paging code */
+    return shadow_domctl(d, sc, u_domctl);
+}
+
+/* Call when destroying a domain */
+void paging_teardown(struct domain *d)
+{
+    shadow_teardown(d);
+    /* Call other modes' teardown code here */    
+}
+
+/* Call once all of the references to the domain have gone away */
+void paging_final_teardown(struct domain *d)
+{
+    shadow_teardown(d);
+    /* Call other modes' final teardown code here */
+}
+
+/* Enable an arbitrary paging-assistance mode.  Call once at domain
+ * creation. */
+int paging_enable(struct domain *d, u32 mode)
+{
+    if ( mode & PG_SH_enable ) 
+        return shadow_enable(d, mode);
+    else
+        /* No other modes supported yet */
+        return -EINVAL; 
+}
+
+/* Print paging-assistance info to the console */
+void paging_dump_domain_info(struct domain *d)
+{
+    if ( paging_mode_enabled(d) )
+    {
+        printk("    paging assistance: ");
+        if ( paging_mode_shadow(d) )
+            printk("shadow ");
+        if ( paging_mode_hap(d) )
+            printk("hap ");
+        if ( paging_mode_refcounts(d) )
+            printk("refcounts ");
+        if ( paging_mode_log_dirty(d) )
+            printk("log_dirty ");
+        if ( paging_mode_translate(d) )
+            printk("translate ");
+        if ( paging_mode_external(d) )
+            printk("external ");
+        printk("\n");
+    }
+}
+
+void paging_dump_vcpu_info(struct vcpu *v)
+{
+    if ( paging_mode_enabled(v->domain) )
+    {
+        printk("    paging assistance: ");        
+        if ( paging_mode_shadow(v->domain) )
+        {
+            if ( v->arch.paging.mode )
+                printk("shadowed %u-on-%u, %stranslated\n",
+                       v->arch.paging.mode->guest_levels,
+                       v->arch.paging.mode->shadow.shadow_levels,
+                       paging_vcpu_mode_translate(v) ? "" : "not ");
+            else
+                printk("not shadowed\n");
+        }
+        else if ( paging_mode_hap(v->domain) && v->arch.paging.mode )
+            printk("hap, %u levels\n", 
+                   v->arch.paging.mode->guest_levels);
+        else
+            printk("none\n");
+    }
+}
+
+
+/*
+ * Local variables:
+ * mode: C
+ * c-set-style: "BSD"
+ * c-basic-offset: 4
+ * indent-tabs-mode: nil
+ * End:
+ */
diff -r aea80dbf6d96 -r 9af0c7e4ff51 xen/arch/x86/mm/shadow/common.c
--- a/xen/arch/x86/mm/shadow/common.c   Fri Feb 09 14:43:22 2007 -0600
+++ b/xen/arch/x86/mm/shadow/common.c   Wed Feb 14 19:01:35 2007 +0000
@@ -47,12 +47,27 @@ void shadow_domain_init(struct domain *d
     int i;
     shadow_lock_init(d);
     for ( i = 0; i <= SHADOW_MAX_ORDER; i++ )
-        INIT_LIST_HEAD(&d->arch.shadow.freelists[i]);
-    INIT_LIST_HEAD(&d->arch.shadow.p2m_freelist);
-    INIT_LIST_HEAD(&d->arch.shadow.p2m_inuse);
-    INIT_LIST_HEAD(&d->arch.shadow.pinned_shadows);
-}
-
+        INIT_LIST_HEAD(&d->arch.paging.shadow.freelists[i]);
+    INIT_LIST_HEAD(&d->arch.paging.shadow.p2m_freelist);
+    INIT_LIST_HEAD(&d->arch.paging.shadow.pinned_shadows);
+}
+
+/* Setup the shadow-specfic parts of a vcpu struct. Note: The most important
+ * job is to initialize the update_paging_modes() function pointer, which is
+ * used to initialized the rest of resources. Therefore, it really does not
+ * matter to have v->arch.paging.mode pointing to any mode, as long as it can
+ * be compiled.
+ */
+void shadow_vcpu_init(struct vcpu *v)
+{
+#if CONFIG_PAGING_LEVELS == 4
+    v->arch.paging.mode = &SHADOW_INTERNAL_NAME(sh_paging_mode,3,3);
+#elif CONFIG_PAGING_LEVELS == 3
+    v->arch.paging.mode = &SHADOW_INTERNAL_NAME(sh_paging_mode,3,3);
+#elif CONFIG_PAGING_LEVELS == 2
+    v->arch.paging.mode = &SHADOW_INTERNAL_NAME(sh_paging_mode,2,2);
+#endif
+}
 
 #if SHADOW_AUDIT
 int shadow_audit_enable = 0;
@@ -265,7 +280,7 @@ hvm_emulate_write(enum x86_segment seg,
     if ( rc )
         return rc;
 
-    return v->arch.shadow.mode->x86_emulate_write(
+    return v->arch.paging.mode->shadow.x86_emulate_write(
         v, addr, &val, bytes, sh_ctxt);
 }
 
@@ -288,7 +303,7 @@ hvm_emulate_cmpxchg(enum x86_segment seg
     if ( rc )
         return rc;
 
-    return v->arch.shadow.mode->x86_emulate_cmpxchg(
+    return v->arch.paging.mode->shadow.x86_emulate_cmpxchg(
         v, addr, old, new, bytes, sh_ctxt);
 }
 
@@ -312,7 +327,7 @@ hvm_emulate_cmpxchg8b(enum x86_segment s
     if ( rc )
         return rc;
 
-    return v->arch.shadow.mode->x86_emulate_cmpxchg8b(
+    return v->arch.paging.mode->shadow.x86_emulate_cmpxchg8b(
         v, addr, old_lo, old_hi, new_lo, new_hi, sh_ctxt);
 }
 
@@ -353,7 +368,7 @@ pv_emulate_write(enum x86_segment seg,
     struct sh_emulate_ctxt *sh_ctxt =
         container_of(ctxt, struct sh_emulate_ctxt, ctxt);
     struct vcpu *v = current;
-    return v->arch.shadow.mode->x86_emulate_write(
+    return v->arch.paging.mode->shadow.x86_emulate_write(
         v, offset, &val, bytes, sh_ctxt);
 }
 
@@ -368,7 +383,7 @@ pv_emulate_cmpxchg(enum x86_segment seg,
     struct sh_emulate_ctxt *sh_ctxt =
         container_of(ctxt, struct sh_emulate_ctxt, ctxt);
     struct vcpu *v = current;
-    return v->arch.shadow.mode->x86_emulate_cmpxchg(
+    return v->arch.paging.mode->shadow.x86_emulate_cmpxchg(
         v, offset, old, new, bytes, sh_ctxt);
 }
 
@@ -384,7 +399,7 @@ pv_emulate_cmpxchg8b(enum x86_segment se
     struct sh_emulate_ctxt *sh_ctxt =
         container_of(ctxt, struct sh_emulate_ctxt, ctxt);
     struct vcpu *v = current;
-    return v->arch.shadow.mode->x86_emulate_cmpxchg8b(
+    return v->arch.paging.mode->shadow.x86_emulate_cmpxchg8b(
         v, offset, old_lo, old_hi, new_lo, new_hi, sh_ctxt);
 }
 
@@ -721,7 +736,7 @@ static inline int chunk_is_available(str
     int i;
     
     for ( i = order; i <= SHADOW_MAX_ORDER; i++ )
-        if ( !list_empty(&d->arch.shadow.freelists[i]) )
+        if ( !list_empty(&d->arch.paging.shadow.freelists[i]) )
             return 1;
     return 0;
 }
@@ -783,7 +798,7 @@ void shadow_prealloc(struct domain *d, u
 
     /* Stage one: walk the list of pinned pages, unpinning them */
     perfc_incrc(shadow_prealloc_1);
-    list_for_each_backwards_safe(l, t, &d->arch.shadow.pinned_shadows)
+    list_for_each_backwards_safe(l, t, &d->arch.paging.shadow.pinned_shadows)
     {
         sp = list_entry(l, struct shadow_page_info, list);
         smfn = shadow_page_to_mfn(sp);
@@ -823,9 +838,9 @@ void shadow_prealloc(struct domain *d, u
     SHADOW_PRINTK("Can't pre-allocate %i shadow pages!\n"
                    "  shadow pages total = %u, free = %u, p2m=%u\n",
                    1 << order, 
-                   d->arch.shadow.total_pages, 
-                   d->arch.shadow.free_pages, 
-                   d->arch.shadow.p2m_pages);
+                   d->arch.paging.shadow.total_pages, 
+                   d->arch.paging.shadow.free_pages, 
+                   d->arch.paging.shadow.p2m_pages);
     BUG();
 }
 
@@ -840,7 +855,7 @@ static void shadow_blow_tables(struct do
     int i;
     
     /* Pass one: unpin all pinned pages */
-    list_for_each_backwards_safe(l,t, &d->arch.shadow.pinned_shadows)
+    list_for_each_backwards_safe(l,t, &d->arch.paging.shadow.pinned_shadows)
     {
         sp = list_entry(l, struct shadow_page_info, list);
         smfn = shadow_page_to_mfn(sp);
@@ -905,9 +920,9 @@ mfn_t shadow_alloc(struct domain *d,
 
     /* Find smallest order which can satisfy the request. */
     for ( i = order; i <= SHADOW_MAX_ORDER; i++ )
-        if ( !list_empty(&d->arch.shadow.freelists[i]) )
+        if ( !list_empty(&d->arch.paging.shadow.freelists[i]) )
         {
-            sp = list_entry(d->arch.shadow.freelists[i].next, 
+            sp = list_entry(d->arch.paging.shadow.freelists[i].next, 
                             struct shadow_page_info, list);
             list_del(&sp->list);
             
@@ -916,10 +931,10 @@ mfn_t shadow_alloc(struct domain *d,
             {
                 i--;
                 sp->order = i;
-                list_add_tail(&sp->list, &d->arch.shadow.freelists[i]);
+                list_add_tail(&sp->list, &d->arch.paging.shadow.freelists[i]);
                 sp += 1 << i;
             }
-            d->arch.shadow.free_pages -= 1 << order;
+            d->arch.paging.shadow.free_pages -= 1 << order;
 
             /* Init page info fields and clear the pages */
             for ( i = 0; i < 1<<order ; i++ ) 
@@ -976,7 +991,7 @@ void shadow_free(struct domain *d, mfn_t
     ASSERT(shadow_type != SH_type_p2m_table);
     order = shadow_order(shadow_type);
 
-    d->arch.shadow.free_pages += 1 << order;
+    d->arch.paging.shadow.free_pages += 1 << order;
 
     for ( i = 0; i < 1<<order; i++ ) 
     {
@@ -985,8 +1000,8 @@ void shadow_free(struct domain *d, mfn_t
         for_each_vcpu(d, v) 
         {
             /* No longer safe to look for a writeable mapping in this shadow */
-            if ( v->arch.shadow.last_writeable_pte_smfn == mfn_x(smfn) + i ) 
-                v->arch.shadow.last_writeable_pte_smfn = 0;
+            if ( v->arch.paging.shadow.last_writeable_pte_smfn == mfn_x(smfn) 
+ i ) 
+                v->arch.paging.shadow.last_writeable_pte_smfn = 0;
         }
 #endif
         /* Strip out the type: this is now a free shadow page */
@@ -1019,7 +1034,7 @@ void shadow_free(struct domain *d, mfn_t
     }
 
     sp->order = order;
-    list_add_tail(&sp->list, &d->arch.shadow.freelists[order]);
+    list_add_tail(&sp->list, &d->arch.paging.shadow.freelists[order]);
 }
 
 /* Divert some memory from the pool to be used by the p2m mapping.
@@ -1033,19 +1048,19 @@ void shadow_free(struct domain *d, mfn_t
  * returns non-zero on success.
  */
 static int
-shadow_alloc_p2m_pages(struct domain *d)
+sh_alloc_p2m_pages(struct domain *d)
 {
     struct page_info *pg;
     u32 i;
     ASSERT(shadow_locked_by_me(d));
     
-    if ( d->arch.shadow.total_pages 
+    if ( d->arch.paging.shadow.total_pages 
          < (shadow_min_acceptable_pages(d) + (1<<SHADOW_MAX_ORDER)) )
         return 0; /* Not enough shadow memory: need to increase it first */
     
     pg = mfn_to_page(shadow_alloc(d, SH_type_p2m_table, 0));
-    d->arch.shadow.p2m_pages += (1<<SHADOW_MAX_ORDER);
-    d->arch.shadow.total_pages -= (1<<SHADOW_MAX_ORDER);
+    d->arch.paging.shadow.p2m_pages += (1<<SHADOW_MAX_ORDER);
+    d->arch.paging.shadow.total_pages -= (1<<SHADOW_MAX_ORDER);
     for (i = 0; i < (1<<SHADOW_MAX_ORDER); i++)
     {
         /* Unlike shadow pages, mark p2m pages as owned by the domain.

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog

<Prev in Thread] Current Thread [Next in Thread>
  • [Xen-changelog] [xen-unstable] Merge with xenppc-unstable.hg, Xen patchbot-unstable <=