WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-ppc-devel

[XenPPC] [xenppc-unstable] [XEN][POWERPC] Merge: also includes support f

To: xen-ppc-devel@xxxxxxxxxxxxxxxxxxx
Subject: [XenPPC] [xenppc-unstable] [XEN][POWERPC] Merge: also includes support for recursive spinlocks
From: Xen patchbot-xenppc-unstable <patchbot-xenppc-unstable@xxxxxxxxxxxxxxxxxxx>
Date: Sat, 11 Nov 2006 17:19:28 +0000
Delivery-date: Sat, 11 Nov 2006 09:21:35 -0800
Envelope-to: www-data@xxxxxxxxxxxxxxxxxx
List-help: <mailto:xen-ppc-devel-request@lists.xensource.com?subject=help>
List-id: Xen PPC development <xen-ppc-devel.lists.xensource.com>
List-post: <mailto:xen-ppc-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-ppc-devel>, <mailto:xen-ppc-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-ppc-devel>, <mailto:xen-ppc-devel-request@lists.xensource.com?subject=unsubscribe>
Reply-to: xen-ppc-devel@xxxxxxxxxxxxxxxxxxx
Sender: xen-ppc-devel-bounces@xxxxxxxxxxxxxxxxxxx
# HG changeset patch
# User Jimi Xenidis <jimix@xxxxxxxxxxxxxx>
# Node ID 4d4f0d52c1934a50a67d3fe9bd30b4f7e23427fe
# Parent  b30cb72ed5e20d4957207145022e648b913c033b
# Parent  b8a2db59150a084e4e1a5a1cae660dbf7cc14c2d
[XEN][POWERPC] Merge: also includes support for recursive spinlocks

Signed-off-by: Jimi Xenidis <jimix@xxxxxxxxxxxxxx>
---
 tools/firmware/acpi/Makefile                                                   
       |   68 
 tools/firmware/acpi/README                                                     
       |   22 
 tools/firmware/acpi/acpi2_0.h                                                  
       |  331 
 tools/firmware/acpi/acpi_build.c                                               
       |  232 
 tools/firmware/acpi/acpi_dsdt.asl                                              
       |  521 
 tools/firmware/acpi/acpi_dsdt.c                                                
       |  300 
 tools/firmware/acpi/acpi_facs.c                                                
       |   72 
 tools/firmware/acpi/acpi_facs.h                                                
       |   32 
 tools/firmware/acpi/acpi_fadt.c                                                
       |  193 
 tools/firmware/acpi/acpi_fadt.h                                                
       |  165 
 tools/firmware/acpi/acpi_gen.c                                                 
       |   53 
 tools/firmware/acpi/acpi_madt.c                                                
       |   68 
 tools/firmware/acpi/acpi_madt.h                                                
       |   44 
 tools/firmware/acpi/acpi_rsdt.c                                                
       |   68 
 tools/security/example.txt                                                     
       |  376 
 tools/security/install.txt                                                     
       |   87 
 xen/arch/ia64/vmx/mm.c                                                         
       |  153 
 xen/include/asm-ia64/linux/asm/acpi.h                                          
       |  121 
 xen/include/asm-ia64/linux/asm/numa.h                                          
       |   74 
 xen/include/asm-ia64/vmx_uaccess.h                                             
       |  156 
 xen/include/asm-x86/hvm/vpit.h                                                 
       |  103 
 .hgignore                                                                      
       |    6 
 Config.mk                                                                      
       |   11 
 buildconfigs/Rules.mk                                                          
       |    4 
 buildconfigs/linux-defconfig_xen0_ia64                                         
       |   10 
 buildconfigs/linux-defconfig_xenU_ia64                                         
       |    8 
 buildconfigs/linux-defconfig_xen_ia64                                          
       |   10 
 config/Linux.mk                                                                
       |   35 
 config/OpenBSD.mk                                                              
       |    1 
 config/StdGNU.mk                                                               
       |   30 
 config/SunOS.mk                                                                
       |    8 
 config/x86_32.mk                                                               
       |    8 
 config/x86_64.mk                                                               
       |    8 
 docs/man/xm.pod.1                                                              
       |    4 
 docs/src/interface.tex                                                         
       |   42 
 docs/src/user.tex                                                              
       |   26 
 docs/xen-api/Makefile                                                          
       |   23 
 docs/xen-api/coversheet.tex                                                    
       |   50 
 docs/xen-api/fdl.tex                                                           
       |  488 
 docs/xen-api/presentation.tex                                                  
       |  149 
 docs/xen-api/todo.tex                                                          
       |  140 
 docs/xen-api/vm-lifecycle.tex                                                  
       |   24 
 docs/xen-api/vm_lifecycle.dot                                                  
       |   15 
 docs/xen-api/wire-protocol.tex                                                 
       |  287 
 docs/xen-api/xen.eps                                                           
       |   49 
 docs/xen-api/xenapi-coversheet.tex                                             
       |   40 
 docs/xen-api/xenapi-datamodel-graph.dot                                        
       |   17 
 docs/xen-api/xenapi-datamodel.tex                                              
       | 9648 ++++++++++
 docs/xen-api/xenapi.tex                                                        
       |   56 
 linux-2.6-xen-sparse/arch/i386/kernel/fixup.c                                  
       |    3 
 linux-2.6-xen-sparse/arch/i386/kernel/microcode-xen.c                          
       |   38 
 linux-2.6-xen-sparse/arch/i386/kernel/sysenter.c                               
       |    2 
 linux-2.6-xen-sparse/arch/i386/mm/hypervisor.c                                 
       |    4 
 linux-2.6-xen-sparse/arch/i386/mm/init-xen.c                                   
       |    4 
 linux-2.6-xen-sparse/arch/ia64/Kconfig                                         
       |   14 
 linux-2.6-xen-sparse/arch/ia64/kernel/Makefile                                 
       |   62 
 linux-2.6-xen-sparse/arch/ia64/kernel/gate.lds.S                               
       |    1 
 linux-2.6-xen-sparse/arch/ia64/kernel/setup.c                                  
       |    4 
 linux-2.6-xen-sparse/arch/ia64/xen/Makefile                                    
       |    3 
 linux-2.6-xen-sparse/arch/ia64/xen/hypervisor.c                                
       |  361 
 linux-2.6-xen-sparse/arch/ia64/xen/util.c                                      
       |    2 
 linux-2.6-xen-sparse/arch/ia64/xen/xcom_hcall.c                                
       |  273 
 linux-2.6-xen-sparse/arch/ia64/xen/xcom_mini.c                                 
       |  319 
 linux-2.6-xen-sparse/arch/ia64/xen/xcom_privcmd.c                              
       |  629 
 linux-2.6-xen-sparse/arch/ia64/xen/xencomm.c                                   
       |  263 
 linux-2.6-xen-sparse/arch/ia64/xen/xensetup.S                                  
       |   21 
 linux-2.6-xen-sparse/arch/x86_64/mm/init-xen.c                                 
       |    4 
 linux-2.6-xen-sparse/drivers/char/tpm/tpm_xen.c                                
       |   12 
 linux-2.6-xen-sparse/drivers/xen/balloon/Makefile                              
       |    2 
 linux-2.6-xen-sparse/drivers/xen/balloon/balloon.c                             
       |   91 
 linux-2.6-xen-sparse/drivers/xen/balloon/common.h                              
       |   58 
 linux-2.6-xen-sparse/drivers/xen/balloon/sysfs.c                               
       |  165 
 linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c                             
       |   26 
 linux-2.6-xen-sparse/drivers/xen/blkfront/blkfront.c                           
       |   25 
 linux-2.6-xen-sparse/drivers/xen/blkfront/vbd.c                                
       |   10 
 linux-2.6-xen-sparse/drivers/xen/blktap/blktap.c                               
       |  577 
 linux-2.6-xen-sparse/drivers/xen/blktap/xenbus.c                               
       |    6 
 linux-2.6-xen-sparse/drivers/xen/core/Makefile                                 
       |    2 
 linux-2.6-xen-sparse/drivers/xen/core/features.c                               
       |    4 
 linux-2.6-xen-sparse/drivers/xen/core/gnttab.c                                 
       |    4 
 linux-2.6-xen-sparse/drivers/xen/core/machine_reboot.c                         
       |  185 
 linux-2.6-xen-sparse/drivers/xen/core/reboot.c                                 
       |  212 
 linux-2.6-xen-sparse/drivers/xen/netback/common.h                              
       |    5 
 linux-2.6-xen-sparse/drivers/xen/netback/interface.c                           
       |   57 
 linux-2.6-xen-sparse/drivers/xen/netback/netback.c                             
       |   58 
 linux-2.6-xen-sparse/drivers/xen/netback/xenbus.c                              
       |   16 
 linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c                           
       |   47 
 linux-2.6-xen-sparse/drivers/xen/privcmd/privcmd.c                             
       |   31 
 linux-2.6-xen-sparse/drivers/xen/tpmback/xenbus.c                              
       |    8 
 linux-2.6-xen-sparse/drivers/xen/xenbus/Makefile                               
       |    1 
 linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_client.c                        
       |    4 
 linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_comms.c                         
       |   11 
 linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_dev.c                           
       |    5 
 linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_probe.c                         
       |  260 
 linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_probe.h                         
       |   77 
 linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_probe_backend.c                 
       |  271 
 linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_xs.c                            
       |    6 
 linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/fixmap.h                    
       |    1 
 linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/hypercall.h                 
       |   10 
 linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/hypervisor.h                
       |    8 
 linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/synch_bitops.h              
       |    4 
 linux-2.6-xen-sparse/include/asm-i386/mach-xen/setup_arch_post.h               
       |   15 
 linux-2.6-xen-sparse/include/asm-ia64/hypercall.h                              
       |  277 
 linux-2.6-xen-sparse/include/asm-ia64/hypervisor.h                             
       |   27 
 linux-2.6-xen-sparse/include/asm-ia64/maddr.h                                  
       |   15 
 linux-2.6-xen-sparse/include/asm-ia64/xen/privop.h                             
       |    3 
 linux-2.6-xen-sparse/include/asm-ia64/xen/xcom_hcall.h                         
       |   76 
 linux-2.6-xen-sparse/include/asm-ia64/xen/xencomm.h                            
       |   60 
 linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/asm/fixmap.h                  
       |    1 
 linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/asm/hypercall.h               
       |   10 
 linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/setup_arch_post.h             
       |   17 
 linux-2.6-xen-sparse/include/xen/gnttab.h                                      
       |    5 
 linux-2.6-xen-sparse/include/xen/xenbus.h                                      
       |    1 
 linux-2.6-xen-sparse/lib/Makefile                                              
       |    2 
 patches/linux-2.6.16.29/net-gso-5-rcv-mss.patch                                
       |   11 
 tools/blktap/drivers/blktapctrl.c                                              
       |  108 
 tools/blktap/drivers/tapdisk.c                                                 
       |   63 
 tools/blktap/drivers/tapdisk.h                                                 
       |    9 
 tools/blktap/lib/blktaplib.h                                                   
       |    7 
 tools/check/check_brctl                                                        
       |   31 
 tools/check/check_iproute                                                      
       |   29 
 tools/check/check_python                                                       
       |   17 
 tools/check/check_zlib_devel                                                   
       |   17 
 tools/check/check_zlib_lib                                                     
       |   17 
 tools/check/chk                                                                
       |   19 
 tools/console/Makefile                                                         
       |    2 
 tools/examples/blktap                                                          
       |    2 
 tools/examples/block                                                           
       |   30 
 tools/examples/external-device-migrate                                         
       |   56 
 tools/examples/vif-bridge                                                      
       |    2 
 tools/examples/vif-nat                                                         
       |    4 
 tools/examples/vif-route                                                       
       |    2 
 tools/examples/vtpm-common.sh                                                  
       |    6 
 tools/examples/xend-config.sxp                                                 
       |    6 
 tools/examples/xmexample.hvm                                                   
       |    8 
 tools/examples/xmexample.vti                                                   
       |    5 
 tools/firmware/Makefile                                                        
       |    1 
 tools/firmware/hvmloader/Makefile                                              
       |   21 
 tools/firmware/hvmloader/acpi/Makefile                                         
       |   63 
 tools/firmware/hvmloader/acpi/README                                           
       |   24 
 tools/firmware/hvmloader/acpi/acpi2_0.h                                        
       |  324 
 tools/firmware/hvmloader/acpi/build.c                                          
       |  241 
 tools/firmware/hvmloader/acpi/dsdt.asl                                         
       |  521 
 tools/firmware/hvmloader/acpi/dsdt.c                                           
       |  300 
 tools/firmware/hvmloader/acpi/gen.c                                            
       |   53 
 tools/firmware/hvmloader/acpi/static_tables.c                                  
       |  184 
 tools/firmware/hvmloader/acpi_madt.c                                           
       |  176 
 tools/firmware/hvmloader/acpi_ssdt_tpm.asl                                     
       |   29 
 tools/firmware/hvmloader/acpi_ssdt_tpm.h                                       
       |   25 
 tools/firmware/hvmloader/acpi_utils.c                                          
       |  207 
 tools/firmware/hvmloader/acpi_utils.h                                          
       |   36 
 tools/firmware/hvmloader/hvmloader.c                                           
       |   16 
 tools/firmware/hvmloader/util.c                                                
       |    5 
 tools/firmware/vmxassist/Makefile                                              
       |    9 
 tools/firmware/vmxassist/head.S                                                
       |    2 
 tools/firmware/vmxassist/setup.c                                               
       |    3 
 tools/firmware/vmxassist/trap.S                                                
       |    2 
 tools/firmware/vmxassist/util.c                                                
       |   25 
 tools/firmware/vmxassist/util.h                                                
       |    1 
 tools/firmware/vmxassist/vm86.c                                                
       |   48 
 tools/ioemu/Makefile.target                                                    
       |   15 
 tools/ioemu/d3des.c                                                            
       |  434 
 tools/ioemu/d3des.h                                                            
       |   51 
 tools/ioemu/hw/ide.c                                                           
       |    4 
 tools/ioemu/hw/ne2000.c                                                        
       |   35 
 tools/ioemu/hw/pc.c                                                            
       |    3 
 tools/ioemu/hw/serial.c                                                        
       |   44 
 tools/ioemu/hw/tpm_tis.c                                                       
       | 1114 +
 tools/ioemu/hw/xen_platform.c                                                  
       |    8 
 tools/ioemu/keymaps/ja                                                         
       |    3 
 tools/ioemu/patches/domain-timeoffset                                          
       |    8 
 tools/ioemu/patches/hypervisor-rtc                                             
       |   26 
 tools/ioemu/patches/ide-cd-dma                                                 
       |   18 
 tools/ioemu/patches/qemu-bootorder                                             
       |   22 
 tools/ioemu/patches/qemu-cleanup                                               
       |   33 
 tools/ioemu/patches/qemu-daemonize                                             
       |    4 
 tools/ioemu/patches/qemu-logging                                               
       |    3 
 tools/ioemu/patches/qemu-target-i386-dm                                        
       |   18 
 tools/ioemu/patches/serial-port-rate-limit                                     
       |   47 
 tools/ioemu/patches/series                                                     
       |    6 
 tools/ioemu/patches/vnc-access-monitor-vt                                      
       |    8 
 tools/ioemu/patches/vnc-backoff-screen-scan                                    
       |   42 
 tools/ioemu/patches/vnc-display-find-unused                                    
       |   15 
 tools/ioemu/patches/vnc-fixes                                                  
       |   17 
 tools/ioemu/patches/vnc-listen-specific-interface                              
       |  142 
 tools/ioemu/patches/vnc-password                                               
       |  119 
 tools/ioemu/patches/vnc-protocol-fixes                                         
       |   46 
 tools/ioemu/patches/vnc-start-vncviewer                                        
       |    8 
 tools/ioemu/patches/vnc-title-domain-name                                      
       |    8 
 tools/ioemu/patches/xen-build                                                  
       |   13 
 tools/ioemu/patches/xen-platform-device                                        
       |   12 
 tools/ioemu/patches/xen-support-buffered-ioreqs                                
       |    8 
 tools/ioemu/patches/xenstore-block-device-config                               
       |   47 
 tools/ioemu/patches/xenstore-write-vnc-port                                    
       |   12 
 tools/ioemu/target-i386-dm/exec-dm.c                                           
       |   50 
 tools/ioemu/target-i386-dm/helper2.c                                           
       |   86 
 tools/ioemu/target-i386-dm/i8259-dm.c                                          
       |   42 
 tools/ioemu/target-i386-dm/qemu-dm.debug                                       
       |    7 
 tools/ioemu/target-i386-dm/rtc-dm.c                                            
       |  107 
 tools/ioemu/vl.c                                                               
       |   29 
 tools/ioemu/vl.h                                                               
       |   27 
 tools/ioemu/vnc.c                                                              
       |  114 
 tools/ioemu/vnc_keysym.h                                                       
       |   10 
 tools/ioemu/xenstore.c                                                         
       |  188 
 tools/libxc/Makefile                                                           
       |    2 
 tools/libxc/ia64/xc_ia64_hvm_build.c                                           
       |   12 
 tools/libxc/ia64/xc_ia64_linux_restore.c                                       
       |    3 
 tools/libxc/ia64/xc_ia64_linux_save.c                                          
       |    3 
 tools/libxc/xc_acm.c                                                           
       |    6 
 tools/libxc/xc_core.c                                                          
       |    2 
 tools/libxc/xc_domain.c                                                        
       |   53 
 tools/libxc/xc_evtchn.c                                                        
       |    6 
 tools/libxc/xc_hvm_build.c                                                     
       |  295 
 tools/libxc/xc_linux_build.c                                                   
       |  205 
 tools/libxc/xc_linux_restore.c                                                 
       |   10 
 tools/libxc/xc_linux_save.c                                                    
       |   42 
 tools/libxc/xc_misc.c                                                          
       |   32 
 tools/libxc/xc_private.c                                                       
       |  154 
 tools/libxc/xc_private.h                                                       
       |   16 
 tools/libxc/xc_ptrace.c                                                        
       |   29 
 tools/libxc/xc_ptrace_core.c                                                   
       |   24 
 tools/libxc/xc_tbuf.c                                                          
       |    4 
 tools/libxc/xenctrl.h                                                          
       |   43 
 tools/libxc/xenguest.h                                                         
       |   34 
 tools/libxc/xg_private.c                                                       
       |   82 
 tools/libxc/xg_private.h                                                       
       |    2 
 tools/libxen/COPYING                                                           
       |  510 
 tools/libxen/Makefile                                                          
       |   37 
 tools/libxen/README                                                            
       |   54 
 tools/libxen/include/xen_boot_type.h                                           
       |   87 
 tools/libxen/include/xen_boot_type_internal.h                                  
       |   37 
 tools/libxen/include/xen_common.h                                              
       |  145 
 tools/libxen/include/xen_cpu_feature.h                                         
       |  387 
 tools/libxen/include/xen_cpu_feature_internal.h                                
       |   37 
 tools/libxen/include/xen_driver_type.h                                         
       |   77 
 tools/libxen/include/xen_driver_type_internal.h                                
       |   37 
 tools/libxen/include/xen_host.h                                                
       |  285 
 tools/libxen/include/xen_host_cpu.h                                            
       |  232 
 tools/libxen/include/xen_host_cpu_decl.h                                       
       |   30 
 tools/libxen/include/xen_host_decl.h                                           
       |   30 
 tools/libxen/include/xen_int_float_map.h                                       
       |   53 
 tools/libxen/include/xen_internal.h                                            
       |  192 
 tools/libxen/include/xen_network.h                                             
       |  266 
 tools/libxen/include/xen_network_decl.h                                        
       |   30 
 tools/libxen/include/xen_on_crash_behaviour.h                                  
       |   97 
 tools/libxen/include/xen_on_crash_behaviour_internal.h                         
       |   38 
 tools/libxen/include/xen_on_normal_exit.h                                      
       |   77 
 tools/libxen/include/xen_on_normal_exit_internal.h                             
       |   37 
 tools/libxen/include/xen_pif.h                                                 
       |  283 
 tools/libxen/include/xen_pif_decl.h                                            
       |   30 
 tools/libxen/include/xen_sr.h                                                  
       |  275 
 tools/libxen/include/xen_sr_decl.h                                             
       |   30 
 tools/libxen/include/xen_string_string_map.h                                   
       |   53 
 tools/libxen/include/xen_user.h                                                
       |  197 
 tools/libxen/include/xen_user_decl.h                                           
       |   30 
 tools/libxen/include/xen_vbd.h                                                 
       |  278 
 tools/libxen/include/xen_vbd_decl.h                                            
       |   30 
 tools/libxen/include/xen_vbd_mode.h                                            
       |   77 
 tools/libxen/include/xen_vbd_mode_internal.h                                   
       |   37 
 tools/libxen/include/xen_vdi.h                                                 
       |  337 
 tools/libxen/include/xen_vdi_decl.h                                            
       |   30 
 tools/libxen/include/xen_vdi_type.h                                            
       |   82 
 tools/libxen/include/xen_vdi_type_internal.h                                   
       |   37 
 tools/libxen/include/xen_vif.h                                                 
       |  298 
 tools/libxen/include/xen_vif_decl.h                                            
       |   30 
 tools/libxen/include/xen_vm.h                                                  
       |  810 
 tools/libxen/include/xen_vm_decl.h                                             
       |   30 
 tools/libxen/include/xen_vm_power_state.h                                      
       |   97 
 tools/libxen/include/xen_vm_power_state_internal.h                             
       |   37 
 tools/libxen/include/xen_vtpm.h                                                
       |  209 
 tools/libxen/include/xen_vtpm_decl.h                                           
       |   31 
 tools/libxen/src/xen_boot_type.c                                               
       |   83 
 tools/libxen/src/xen_common.c                                                  
       | 1363 +
 tools/libxen/src/xen_cpu_feature.c                                             
       |  143 
 tools/libxen/src/xen_driver_type.c                                             
       |   81 
 tools/libxen/src/xen_host.c                                                    
       |  376 
 tools/libxen/src/xen_host_cpu.c                                                
       |  273 
 tools/libxen/src/xen_int_float_map.c                                           
       |   37 
 tools/libxen/src/xen_network.c                                                 
       |  350 
 tools/libxen/src/xen_on_crash_behaviour.c                                      
       |   85 
 tools/libxen/src/xen_on_normal_exit.c                                          
       |   81 
 tools/libxen/src/xen_pif.c                                                     
       |  389 
 tools/libxen/src/xen_sr.c                                                      
       |  374 
 tools/libxen/src/xen_string_string_map.c                                       
       |   49 
 tools/libxen/src/xen_user.c                                                    
       |  187 
 tools/libxen/src/xen_vbd.c                                                     
       |  373 
 tools/libxen/src/xen_vbd_mode.c                                                
       |   81 
 tools/libxen/src/xen_vdi.c                                                     
       |  519 
 tools/libxen/src/xen_vdi_type.c                                                
       |   82 
 tools/libxen/src/xen_vif.c                                                     
       |  426 
 tools/libxen/src/xen_vm.c                                                      
       | 1596 +
 tools/libxen/src/xen_vm_power_state.c                                          
       |   85 
 tools/libxen/src/xen_vtpm.c                                                    
       |  213 
 tools/libxen/test/test_bindings.c                                              
       |  424 
 tools/misc/xenperf.c                                                           
       |   26 
 tools/pygrub/Makefile                                                          
       |    6 
 tools/pygrub/setup.py                                                          
       |    2 
 tools/python/Makefile                                                          
       |    6 
 tools/python/README.XendConfig                                                 
       |  159 
 tools/python/README.sxpcfg                                                     
       |  116 
 tools/python/scripts/README                                                    
       |   49 
 tools/python/scripts/README.lifecycle                                          
       |  136 
 tools/python/scripts/xapi.domcfg.py                                            
       |   39 
 tools/python/scripts/xapi.py                                                   
       |  492 
 tools/python/scripts/xapi.vbdcfg.py                                            
       |   12 
 tools/python/scripts/xapi.vdicfg.py                                            
       |    7 
 tools/python/scripts/xapi.vifcfg.py                                            
       |   10 
 tools/python/setup.py                                                          
       |    3 
 tools/python/xen/lowlevel/acm/acm.c                                            
       |   19 
 tools/python/xen/lowlevel/xc/xc.c                                              
       |   90 
 tools/python/xen/util/blkif.py                                                 
       |    3 
 tools/python/xen/util/security.py                                              
       |   30 
 tools/python/xen/util/xmlrpclib2.py                                            
       |   36 
 tools/python/xen/xend/Args.py                                                  
       |    2 
 tools/python/xen/xend/PrettyPrint.py                                           
       |    2 
 tools/python/xen/xend/XendAPI.py                                               
       | 1463 +
 tools/python/xen/xend/XendAPIConstants.py                                      
       |   75 
 tools/python/xen/xend/XendAuthSessions.py                                      
       |  137 
 tools/python/xen/xend/XendBootloader.py                                        
       |    6 
 tools/python/xen/xend/XendCheckpoint.py                                        
       |   28 
 tools/python/xen/xend/XendConfig.py                                            
       |  866 
 tools/python/xen/xend/XendConstants.py                                         
       |   96 
 tools/python/xen/xend/XendDevices.py                                           
       |   68 
 tools/python/xen/xend/XendDomain.py                                            
       | 1289 +
 tools/python/xen/xend/XendDomainInfo.py                                        
       | 2596 +-
 tools/python/xen/xend/XendError.py                                             
       |   16 
 tools/python/xen/xend/XendNode.py                                              
       |  125 
 tools/python/xen/xend/XendProtocol.py                                          
       |    2 
 tools/python/xen/xend/XendRoot.py                                              
       |   34 
 tools/python/xen/xend/XendStorageRepository.py                                 
       |  381 
 tools/python/xen/xend/XendVDI.py                                               
       |  155 
 tools/python/xen/xend/image.py                                                 
       |  245 
 tools/python/xen/xend/server/DevController.py                                  
       |   73 
 tools/python/xen/xend/server/SrvDaemon.py                                      
       |   17 
 tools/python/xen/xend/server/SrvDomainDir.py                                   
       |    2 
 tools/python/xen/xend/server/SrvServer.py                                      
       |   30 
 tools/python/xen/xend/server/XMLRPCServer.py                                   
       |  105 
 tools/python/xen/xend/server/blkif.py                                          
       |   57 
 tools/python/xen/xend/server/iopif.py                                          
       |    4 
 tools/python/xen/xend/server/irqif.py                                          
       |    2 
 tools/python/xen/xend/server/netif.py                                          
       |   38 
 tools/python/xen/xend/server/pciif.py                                          
       |   61 
 tools/python/xen/xend/server/tpmif.py                                          
       |   32 
 tools/python/xen/xend/sxp.py                                                   
       |   24 
 tools/python/xen/xend/uuid.py                                                  
       |   10 
 tools/python/xen/xm/addlabel.py                                                
       |    9 
 tools/python/xen/xm/cfgbootpolicy.py                                           
       |  134 
 tools/python/xen/xm/create.py                                                  
       |  105 
 tools/python/xen/xm/getlabel.py                                                
       |    3 
 tools/python/xen/xm/main.py                                                    
       |  111 
 tools/python/xen/xm/new.py                                                     
       |   68 
 tools/python/xen/xm/opts.py                                                    
       |    6 
 tools/python/xen/xm/rmlabel.py                                                 
       |    3 
 tools/security/policy.txt                                                      
       |  163 
 tools/security/policytools.txt                                                 
       |  148 
 tools/security/readme.txt                                                      
       |   31 
 tools/security/secpol_tool.c                                                   
       |   14 
 tools/security/secpol_xml2bin.c                                                
       |   10 
 tools/xcutils/Makefile                                                         
       |    2 
 tools/xenmon/Makefile                                                          
       |    2 
 tools/xenmon/xenmon.py                                                         
       |    4 
 tools/xenstat/libxenstat/src/xenstat.c                                         
       |   20 
 tools/xenstat/xentop/xentop.1                                                  
       |    3 
 tools/xenstat/xentop/xentop.c                                                  
       |    6 
 tools/xenstore/Makefile                                                        
       |   16 
 tools/xentrace/formats                                                         
       |   29 
 tools/xentrace/xenctx.c                                                        
       |  108 
 tools/xm-test/README                                                           
       |   36 
 tools/xm-test/configure.ac                                                     
       |   26 
 tools/xm-test/grouptest/default                                                
       |    1 
 tools/xm-test/grouptest/security                                               
       |    1 
 tools/xm-test/lib/XmTestLib/Console.py                                         
       |    5 
 tools/xm-test/lib/XmTestLib/XenDomain.py                                       
       |    8 
 tools/xm-test/lib/XmTestLib/acm.py                                             
       |   91 
 tools/xm-test/lib/XmTestLib/arch.py                                            
       |   24 
 tools/xm-test/lib/XmTestLib/block_utils.py                                     
       |    2 
 tools/xm-test/lib/XmTestReport/arch.py                                         
       |    4 
 tools/xm-test/ramdisk/Makefile.am                                              
       |   31 
 tools/xm-test/ramdisk/README-XenSource-initrd-1.0-img                          
       |   46 
 tools/xm-test/ramdisk/README-XenSource-initrd-1.1-img                          
       |   45 
 tools/xm-test/ramdisk/configs/buildroot-i386                                   
       |   24 
 tools/xm-test/ramdisk/configs/buildroot-powerpc                                
       |   12 
 tools/xm-test/ramdisk/make-release.sh                                          
       |   47 
 tools/xm-test/ramdisk/patches/buildroot/add_xvd_devices.patch                  
       |    5 
 tools/xm-test/runtest.sh                                                       
       |   19 
 tools/xm-test/tests/Makefile.am                                                
       |    1 
 tools/xm-test/tests/block-create/01_block_attach_device_pos.py                 
       |   10 
 tools/xm-test/tests/block-create/02_block_attach_file_device_pos.py            
       |    8 
 tools/xm-test/tests/block-create/04_block_attach_device_repeatedly_pos.py      
       |   16 
 
tools/xm-test/tests/block-create/05_block_attach_and_dettach_device_repeatedly_pos.py
 |   18 
 tools/xm-test/tests/block-create/06_block_attach_baddomain_neg.py              
       |    8 
 tools/xm-test/tests/block-create/07_block_attach_baddevice_neg.py              
       |   14 
 tools/xm-test/tests/block-create/08_block_attach_bad_filedevice_neg.py         
       |   16 
 
tools/xm-test/tests/block-create/09_block_attach_and_dettach_device_check_data_pos.py
 |   44 
 tools/xm-test/tests/block-create/10_block_attach_dettach_multiple_devices.py   
       |   30 
 tools/xm-test/tests/block-create/11_block_attach_shared_dom0.py                
       |    2 
 tools/xm-test/tests/block-create/12_block_attach_shared_domU.py                
       |    2 
 tools/xm-test/tests/block-destroy/01_block-destroy_btblock_pos.py              
       |    8 
 tools/xm-test/tests/block-destroy/02_block-destroy_rtblock_pos.py              
       |    8 
 tools/xm-test/tests/block-destroy/04_block-destroy_nonattached_neg.py          
       |    2 
 tools/xm-test/tests/block-destroy/05_block-destroy_byname_pos.py               
       |    8 
 tools/xm-test/tests/block-destroy/06_block-destroy_check_list_pos.py           
       |   10 
 tools/xm-test/tests/block-integrity/01_block_device_read_verify.py             
       |    4 
 tools/xm-test/tests/block-integrity/02_block_device_write_verify.py            
       |    4 
 tools/xm-test/tests/block-list/01_block-list_pos.py                            
       |    6 
 tools/xm-test/tests/block-list/02_block-list_attachbd_pos.py                   
       |    6 
 tools/xm-test/tests/block-list/03_block-list_anotherbd_pos.py                  
       |   10 
 tools/xm-test/tests/block-list/06_block-list_checkremove_pos.py                
       |   24 
 tools/xm-test/tests/create/11_create_concurrent_pos.py                         
       |    2 
 tools/xm-test/tests/create/12_create_concurrent_stress_pos.py                  
       |    9 
 tools/xm-test/tests/create/14_create_blockroot_pos.py                          
       |   11 
 tools/xm-test/tests/create/15_create_smallmem_pos.py                           
       |    4 
 tools/xm-test/tests/create/16_create_smallmem_neg.py                           
       |    8 
 tools/xm-test/tests/network-attach/04_network_attach_baddomain_neg.py          
       |    6 
 tools/xm-test/tests/security-acm/01_security-acm_basic.py                      
       |  121 
 tools/xm-test/tests/security-acm/02_security-acm_dom_start.py                  
       |   64 
 tools/xm-test/tests/security-acm/03_security-acm_dom_conflict.py               
       |   60 
 tools/xm-test/tests/security-acm/04_security-acm_dom_res.py                    
       |   69 
 tools/xm-test/tests/security-acm/05_security-acm_dom_res_conf.py               
       |   38 
 tools/xm-test/tests/security-acm/06_security-acm_dom_block_attach.py           
       |   82 
 tools/xm-test/tests/security-acm/Makefile.am                                   
       |   28 
 tools/xm-test/tests/security-acm/acm_utils.py                                  
       |   15 
 tools/xm-test/tests/security-acm/xm-test-security_policy.xml                   
       |  110 
 unmodified_drivers/linux-2.6/Makefile                                          
       |    1 
 unmodified_drivers/linux-2.6/blkfront/Makefile                                 
       |    3 
 unmodified_drivers/linux-2.6/compat-include/asm-generic/pgtable-nopmd.h        
       |   14 
 unmodified_drivers/linux-2.6/compat-include/asm-generic/pgtable-nopud.h        
       |   15 
 unmodified_drivers/linux-2.6/compat-include/linux/io.h                         
       |   10 
 unmodified_drivers/linux-2.6/compat-include/linux/mutex.h                      
       |   31 
 unmodified_drivers/linux-2.6/compat-include/xen/platform-compat.h              
       |   67 
 unmodified_drivers/linux-2.6/mkbuildtree                                       
       |   55 
 unmodified_drivers/linux-2.6/netfront/Makefile                                 
       |    3 
 unmodified_drivers/linux-2.6/overrides.mk                                      
       |    2 
 unmodified_drivers/linux-2.6/platform-pci/Kbuild                               
       |    7 
 unmodified_drivers/linux-2.6/platform-pci/Makefile                             
       |    3 
 unmodified_drivers/linux-2.6/platform-pci/evtchn.c                             
       |   12 
 unmodified_drivers/linux-2.6/platform-pci/platform-compat.c                    
       |  116 
 unmodified_drivers/linux-2.6/platform-pci/platform-pci.c                       
       |   12 
 unmodified_drivers/linux-2.6/platform-pci/xen_support.c                        
       |    4 
 unmodified_drivers/linux-2.6/util/Kbuild                                       
       |    3 
 unmodified_drivers/linux-2.6/util/Makefile                                     
       |    3 
 unmodified_drivers/linux-2.6/xenbus/Makefile                                   
       |    3 
 xen/COPYING                                                                    
       |   20 
 xen/Makefile                                                                   
       |    8 
 xen/Rules.mk                                                                   
       |   13 
 xen/acm/acm_chinesewall_hooks.c                                                
       |    2 
 xen/acm/acm_core.c                                                             
       |  107 
 xen/acm/acm_simple_type_enforcement_hooks.c                                    
       |    2 
 xen/arch/ia64/Rules.mk                                                         
       |   22 
 xen/arch/ia64/asm-offsets.c                                                    
       |    3 
 xen/arch/ia64/linux-xen/Makefile                                               
       |    2 
 xen/arch/ia64/linux-xen/README.origin                                          
       |    2 
 xen/arch/ia64/linux-xen/entry.S                                                
       |    8 
 xen/arch/ia64/linux-xen/mca.c                                                  
       |   13 
 xen/arch/ia64/linux-xen/mm_contig.c                                            
       |    2 
 xen/arch/ia64/linux-xen/mm_numa.c                                              
       |   75 
 xen/arch/ia64/linux-xen/numa.c                                                 
       |   67 
 xen/arch/ia64/linux-xen/sal.c                                                  
       |   75 
 xen/arch/ia64/linux-xen/setup.c                                                
       |    2 
 xen/arch/ia64/linux-xen/smpboot.c                                              
       |    3 
 xen/arch/ia64/linux-xen/tlb.c                                                  
       |    9 
 xen/arch/ia64/linux-xen/unaligned.c                                            
       |   20 
 xen/arch/ia64/tools/p2m_expose/Makefile                                        
       |   28 
 xen/arch/ia64/tools/p2m_expose/README.p2m_expose                               
       |   12 
 xen/arch/ia64/tools/p2m_expose/expose_p2m.c                                    
       |  185 
 xen/arch/ia64/vmx/Makefile                                                     
       |    1 
 xen/arch/ia64/vmx/mmio.c                                                       
       |  112 
 xen/arch/ia64/vmx/optvfault.S                                                  
       |  596 
 xen/arch/ia64/vmx/pal_emul.c                                                   
       |  515 
 xen/arch/ia64/vmx/vlsapic.c                                                    
       |  227 
 xen/arch/ia64/vmx/vmmu.c                                                       
       |  106 
 xen/arch/ia64/vmx/vmx_entry.S                                                  
       |    2 
 xen/arch/ia64/vmx/vmx_hypercall.c                                              
       |    2 
 xen/arch/ia64/vmx/vmx_init.c                                                   
       |   26 
 xen/arch/ia64/vmx/vmx_interrupt.c                                              
       |   19 
 xen/arch/ia64/vmx/vmx_ivt.S                                                    
       |   26 
 xen/arch/ia64/vmx/vmx_phy_mode.c                                               
       |   69 
 xen/arch/ia64/vmx/vmx_process.c                                                
       |  238 
 xen/arch/ia64/vmx/vmx_support.c                                                
       |   21 
 xen/arch/ia64/vmx/vmx_vcpu.c                                                   
       |   72 
 xen/arch/ia64/vmx/vmx_virt.c                                                   
       |   36 
 xen/arch/ia64/vmx/vtlb.c                                                       
       |   44 
 xen/arch/ia64/xen/Makefile                                                     
       |    4 
 xen/arch/ia64/xen/acpi.c                                                       
       |    2 
 xen/arch/ia64/xen/dom0_ops.c                                                   
       |   90 
 xen/arch/ia64/xen/dom_fw.c                                                     
       |   26 
 xen/arch/ia64/xen/domain.c                                                     
       |  254 
 xen/arch/ia64/xen/faults.c                                                     
       |   50 
 xen/arch/ia64/xen/flushtlb.c                                                   
       |  117 
 xen/arch/ia64/xen/fw_emul.c                                                    
       |  119 
 xen/arch/ia64/xen/hypercall.c                                                  
       |  105 
 xen/arch/ia64/xen/hyperprivop.S                                                
       |    2 
 xen/arch/ia64/xen/irq.c                                                        
       |   16 
 xen/arch/ia64/xen/mm.c                                                         
       |  322 
 xen/arch/ia64/xen/privop.c                                                     
       | 1054 -
 xen/arch/ia64/xen/regionreg.c                                                  
       |   12 
 xen/arch/ia64/xen/tlb_track.c                                                  
       |  507 
 xen/arch/ia64/xen/vcpu.c                                                       
       | 2254 +-
 xen/arch/ia64/xen/vhpt.c                                                       
       |  343 
 xen/arch/ia64/xen/xen.lds.S                                                    
       |    3 
 xen/arch/ia64/xen/xenasm.S                                                     
       |   32 
 xen/arch/ia64/xen/xencomm.c                                                    
       |  380 
 xen/arch/ia64/xen/xenmem.c                                                     
       |   95 
 xen/arch/ia64/xen/xenmisc.c                                                    
       |    8 
 xen/arch/ia64/xen/xenpatch.c                                                   
       |  122 
 xen/arch/ia64/xen/xensetup.c                                                   
       |   33 
 xen/arch/ia64/xen/xentime.c                                                    
       |   47 
 xen/arch/powerpc/Makefile                                                      
       |    5 
 xen/arch/powerpc/backtrace.c                                                   
       |   20 
 xen/arch/powerpc/domain.c                                                      
       |   39 
 xen/arch/powerpc/domain_build.c                                                
       |    2 
 xen/arch/powerpc/memory.c                                                      
       |    4 
 xen/arch/powerpc/mm.c                                                          
       |   11 
 xen/arch/powerpc/numa.c                                                        
       |    1 
 xen/arch/powerpc/of-devwalk.c                                                  
       |   18 
 xen/arch/powerpc/papr/xlate.c                                                  
       |    2 
 xen/arch/powerpc/powerpc64/domain.c                                            
       |    6 
 xen/arch/powerpc/setup.c                                                       
       |   28 
 xen/arch/powerpc/shadow.c                                                      
       |    4 
 xen/arch/powerpc/smpboot.c                                                     
       |   30 
 xen/arch/x86/Makefile                                                          
       |    7 
 xen/arch/x86/Rules.mk                                                          
       |   37 
 xen/arch/x86/boot/mkelf32.c                                                    
       |    5 
 xen/arch/x86/boot/x86_32.S                                                     
       |    2 
 xen/arch/x86/boot/x86_64.S                                                     
       |    2 
 xen/arch/x86/domain.c                                                          
       |  151 
 xen/arch/x86/domain_build.c                                                    
       |  101 
 xen/arch/x86/domctl.c                                                          
       |   57 
 xen/arch/x86/e820.c                                                            
       |    2 
 xen/arch/x86/extable.c                                                         
       |    2 
 xen/arch/x86/hvm/Makefile                                                      
       |    2 
 xen/arch/x86/hvm/hvm.c                                                         
       |  473 
 xen/arch/x86/hvm/i8254.c                                                       
       |   34 
 xen/arch/x86/hvm/i8259.c                                                       
       |  321 
 xen/arch/x86/hvm/instrlen.c                                                    
       |    5 
 xen/arch/x86/hvm/intercept.c                                                   
       |  154 
 xen/arch/x86/hvm/io.c                                                          
       |  141 
 xen/arch/x86/hvm/platform.c                                                    
       |  875 
 xen/arch/x86/hvm/pmtimer.c                                                     
       |   63 
 xen/arch/x86/hvm/rtc.c                                                         
       |  393 
 xen/arch/x86/hvm/svm/intr.c                                                    
       |  108 
 xen/arch/x86/hvm/svm/svm.c                                                     
       |  361 
 xen/arch/x86/hvm/svm/vmcb.c                                                    
       |  447 
 xen/arch/x86/hvm/svm/x86_32/exits.S                                            
       |   12 
 xen/arch/x86/hvm/svm/x86_64/exits.S                                            
       |   15 
 xen/arch/x86/hvm/vioapic.c                                                     
       |  985 -
 xen/arch/x86/hvm/vlapic.c                                                      
       |  639 
 xen/arch/x86/hvm/vmx/io.c                                                      
       |   50 
 xen/arch/x86/hvm/vmx/vmcs.c                                                    
       |  479 
 xen/arch/x86/hvm/vmx/vmx.c                                                     
       | 1064 -
 xen/arch/x86/hvm/vmx/x86_32/exits.S                                            
       |    6 
 xen/arch/x86/hvm/vmx/x86_64/exits.S                                            
       |    5 
 xen/arch/x86/io_apic.c                                                         
       |   14 
 xen/arch/x86/irq.c                                                             
       |   15 
 xen/arch/x86/mm.c                                                              
       |   33 
 xen/arch/x86/mm/shadow/common.c                                                
       |  324 
 xen/arch/x86/mm/shadow/multi.c                                                 
       | 1595 -
 xen/arch/x86/mm/shadow/multi.h                                                 
       |    4 
 xen/arch/x86/mm/shadow/private.h                                               
       |  192 
 xen/arch/x86/mm/shadow/types.h                                                 
       |  219 
 xen/arch/x86/numa.c                                                            
       |  308 
 xen/arch/x86/oprofile/op_model_athlon.c                                        
       |   28 
 xen/arch/x86/oprofile/op_model_p4.c                                            
       |   10 
 xen/arch/x86/oprofile/op_model_ppro.c                                          
       |   10 
 xen/arch/x86/oprofile/xenoprof.c                                               
       |   39 
 xen/arch/x86/platform_hypercall.c                                              
       |    2 
 xen/arch/x86/setup.c                                                           
       |   88 
 xen/arch/x86/smpboot.c                                                         
       |    3 
 xen/arch/x86/srat.c                                                            
       |  315 
 xen/arch/x86/time.c                                                            
       |    7 
 xen/arch/x86/traps.c                                                           
       |  114 
 xen/arch/x86/x86_32/asm-offsets.c                                              
       |    1 
 xen/arch/x86/x86_32/domain_page.c                                              
       |    2 
 xen/arch/x86/x86_32/entry.S                                                    
       |    2 
 xen/arch/x86/x86_32/seg_fixup.c                                                
       |   50 
 xen/arch/x86/x86_32/supervisor_mode_kernel.S                                   
       |    2 
 xen/arch/x86/x86_32/traps.c                                                    
       |   16 
 xen/arch/x86/x86_64/asm-offsets.c                                              
       |    1 
 xen/arch/x86/x86_64/entry.S                                                    
       |    2 
 xen/arch/x86/x86_64/traps.c                                                    
       |   24 
 xen/arch/x86/x86_emulate.c                                                     
       |   12 
 xen/common/Makefile                                                            
       |    3 
 xen/common/domain.c                                                            
       |  101 
 xen/common/domctl.c                                                            
       |   44 
 xen/common/event_channel.c                                                     
       |    3 
 xen/common/grant_table.c                                                       
       |   95 
 xen/common/keyhandler.c                                                        
       |    5 
 xen/common/lib.c                                                               
       |   17 
 xen/common/memory.c                                                            
       |   35 
 xen/common/multicall.c                                                         
       |    2 
 xen/common/page_alloc.c                                                        
       |  218 
 xen/common/perfc.c                                                             
       |   13 
 xen/common/sched_credit.c                                                      
       |  520 
 xen/common/sched_sedf.c                                                        
       |   50 
 xen/common/schedule.c                                                          
       |   29 
 xen/common/time.c                                                              
       |   77 
 xen/common/trace.c                                                             
       |    4 
 xen/common/vsprintf.c                                                          
       |    2 
 xen/common/xmalloc.c                                                           
       |   90 
 xen/drivers/acpi/Makefile                                                      
       |    1 
 xen/drivers/acpi/numa.c                                                        
       |  216 
 xen/drivers/char/console.c                                                     
       |  270 
 xen/drivers/char/serial.c                                                      
       |    4 
 xen/include/acm/acm_hooks.h                                                    
       |   14 
 xen/include/asm-ia64/config.h                                                  
       |   15 
 xen/include/asm-ia64/debugger.h                                                
       |    1 
 xen/include/asm-ia64/dom_fw.h                                                  
       |    9 
 xen/include/asm-ia64/domain.h                                                  
       |   58 
 xen/include/asm-ia64/flushtlb.h                                                
       |   89 
 xen/include/asm-ia64/guest_access.h                                            
       |  152 
 xen/include/asm-ia64/ia64_int.h                                                
       |    4 
 xen/include/asm-ia64/linux-null/asm/mmzone.h                                   
       |    1 
 xen/include/asm-ia64/linux-xen/asm/README.origin                               
       |    2 
 xen/include/asm-ia64/linux-xen/asm/acpi.h                                      
       |  123 
 xen/include/asm-ia64/linux-xen/asm/cache.h                                     
       |    2 
 xen/include/asm-ia64/linux-xen/asm/numa.h                                      
       |   80 
 xen/include/asm-ia64/linux-xen/asm/pgtable.h                                   
       |   34 
 xen/include/asm-ia64/linux-xen/asm/processor.h                                 
       |   18 
 xen/include/asm-ia64/linux-xen/asm/spinlock.h                                  
       |    8 
 xen/include/asm-ia64/linux-xen/asm/system.h                                    
       |    1 
 xen/include/asm-ia64/linux/README.origin                                       
       |    1 
 xen/include/asm-ia64/linux/asm/README.origin                                   
       |    3 
 xen/include/asm-ia64/linux/asm/nodedata.h                                      
       |   52 
 xen/include/asm-ia64/linux/asm/sal.h                                           
       |   10 
 xen/include/asm-ia64/linux/hash.h                                              
       |   58 
 xen/include/asm-ia64/mm.h                                                      
       |   26 
 xen/include/asm-ia64/p2m_entry.h                                               
       |   76 
 xen/include/asm-ia64/perfc_defn.h                                              
       |   65 
 xen/include/asm-ia64/privop.h                                                  
       |    4 
 xen/include/asm-ia64/tlb_track.h                                               
       |  155 
 xen/include/asm-ia64/tlbflush.h                                                
       |   10 
 xen/include/asm-ia64/uaccess.h                                                 
       |   18 
 xen/include/asm-ia64/vcpu.h                                                    
       |  321 
 xen/include/asm-ia64/vcpumask.h                                                
       |   60 
 xen/include/asm-ia64/vhpt.h                                                    
       |   43 
 xen/include/asm-ia64/vlsapic.h                                                 
       |    1 
 xen/include/asm-ia64/vmmu.h                                                    
       |    3 
 xen/include/asm-ia64/vmx.h                                                     
       |    3 
 xen/include/asm-ia64/vmx_pal_vsa.h                                             
       |    7 
 xen/include/asm-ia64/vmx_phy_mode.h                                            
       |    9 
 xen/include/asm-ia64/vmx_platform.h                                            
       |    6 
 xen/include/asm-ia64/vmx_vcpu.h                                                
       |  803 
 xen/include/asm-ia64/vmx_vpd.h                                                 
       |    1 
 xen/include/asm-ia64/xenkregs.h                                                
       |    3 
 xen/include/asm-ia64/xenpage.h                                                 
       |    4 
 xen/include/asm-ia64/xensystem.h                                               
       |    1 
 xen/include/asm-powerpc/acpi.h                                                 
       |    2 
 xen/include/asm-powerpc/config.h                                               
       |    1 
 xen/include/asm-powerpc/numa.h                                                 
       |    2 
 xen/include/asm-powerpc/smp.h                                                  
       |    7 
 xen/include/asm-powerpc/spinlock.h                                             
       |   43 
 xen/include/asm-x86/acpi.h                                                     
       |    4 
 xen/include/asm-x86/bitops.h                                                   
       |   58 
 xen/include/asm-x86/config.h                                                   
       |   12 
 xen/include/asm-x86/domain.h                                                   
       |   17 
 xen/include/asm-x86/grant_table.h                                              
       |    4 
 xen/include/asm-x86/hvm/domain.h                                               
       |   14 
 xen/include/asm-x86/hvm/hvm.h                                                  
       |   31 
 xen/include/asm-x86/hvm/io.h                                                   
       |   56 
 xen/include/asm-x86/hvm/support.h                                              
       |   23 
 xen/include/asm-x86/hvm/svm/vmcb.h                                             
       |   25 
 xen/include/asm-x86/hvm/vcpu.h                                                 
       |    9 
 xen/include/asm-x86/hvm/vioapic.h                                              
       |  113 
 xen/include/asm-x86/hvm/vlapic.h                                               
       |  110 
 xen/include/asm-x86/hvm/vmx/vmcs.h                                             
       |    6 
 xen/include/asm-x86/hvm/vmx/vmx.h                                              
       |  178 
 xen/include/asm-x86/hvm/vpic.h                                                 
       |   41 
 xen/include/asm-x86/hvm/vpt.h                                                  
       |  152 
 xen/include/asm-x86/mach-generic/mach_apic.h                                   
       |    6 
 xen/include/asm-x86/mm.h                                                       
       |   26 
 xen/include/asm-x86/numa.h                                                     
       |   78 
 xen/include/asm-x86/page.h                                                     
       |   12 
 xen/include/asm-x86/perfc_defn.h                                               
       |    5 
 xen/include/asm-x86/processor.h                                                
       |    2 
 xen/include/asm-x86/regs.h                                                     
       |    2 
 xen/include/asm-x86/shadow.h                                                   
       |   77 
 xen/include/asm-x86/spinlock.h                                                 
       |    8 
 xen/include/asm-x86/x86_32/page-2level.h                                       
       |    3 
 xen/include/asm-x86/x86_32/page-3level.h                                       
       |   11 
 xen/include/asm-x86/x86_64/page.h                                              
       |    3 
 xen/include/public/COPYING                                                     
       |   16 
 xen/include/public/acm.h                                                       
       |   18 
 xen/include/public/acm_ops.h                                                   
       |   18 
 xen/include/public/arch-ia64.h                                                 
       |  106 
 xen/include/public/arch-x86_32.h                                               
       |   21 
 xen/include/public/arch-x86_64.h                                               
       |   27 
 xen/include/public/callback.h                                                  
       |   18 
 xen/include/public/dom0_ops.h                                                  
       |   18 
 xen/include/public/domctl.h                                                    
       |   63 
 xen/include/public/elfnote.h                                                   
       |   18 
 xen/include/public/event_channel.h                                             
       |   18 
 xen/include/public/features.h                                                  
       |   18 
 xen/include/public/grant_table.h                                               
       |   18 
 xen/include/public/hvm/e820.h                                                  
       |   27 
 xen/include/public/hvm/hvm_info_table.h                                        
       |   18 
 xen/include/public/hvm/hvm_op.h                                                
       |   25 
 xen/include/public/hvm/ioreq.h                                                 
       |   50 
 xen/include/public/hvm/params.h                                                
       |   42 
 xen/include/public/hvm/vmx_assist.h                                            
       |   18 
 xen/include/public/io/blkif.h                                                  
       |   18 
 xen/include/public/io/console.h                                                
       |   18 
 xen/include/public/io/netif.h                                                  
       |   18 
 xen/include/public/io/pciif.h                                                  
       |   18 
 xen/include/public/io/ring.h                                                   
       |   18 
 xen/include/public/io/tpmif.h                                                  
       |   18 
 xen/include/public/io/xenbus.h                                                 
       |   18 
 xen/include/public/io/xs_wire.h                                                
       |   19 
 xen/include/public/memory.h                                                    
       |   18 
 xen/include/public/nmi.h                                                       
       |   18 
 xen/include/public/physdev.h                                                   
       |   20 
 xen/include/public/platform.h                                                  
       |   18 
 xen/include/public/sched.h                                                     
       |   18 
 xen/include/public/sysctl.h                                                    
       |   18 
 xen/include/public/trace.h                                                     
       |   31 
 xen/include/public/vcpu.h                                                      
       |   18 
 xen/include/public/version.h                                                   
       |   18 
 xen/include/public/xen-compat.h                                                
       |   18 
 xen/include/public/xen.h                                                       
       |   18 
 xen/include/public/xenoprof.h                                                  
       |   18 
 xen/include/xen/config.h                                                       
       |   76 
 xen/include/xen/console.h                                                      
       |    3 
 xen/include/xen/cpumask.h                                                      
       |    8 
 xen/include/xen/domain.h                                                       
       |   16 
 xen/include/xen/event.h                                                        
       |    7 
 xen/include/xen/lib.h                                                          
       |    9 
 xen/include/xen/mm.h                                                           
       |    7 
 xen/include/xen/nodemask.h                                                     
       |  338 
 xen/include/xen/numa.h                                                         
       |   13 
 xen/include/xen/sched-if.h                                                     
       |    6 
 xen/include/xen/sched.h                                                        
       |   61 
 xen/include/xen/softirq.h                                                      
       |    5 
 xen/include/xen/spinlock.h                                                     
       |    8 
 xen/include/xen/stdarg.h                                                       
       |    5 
 xen/include/xen/time.h                                                         
       |   14 
 734 files changed, 59683 insertions(+), 18343 deletions(-), 3 modifications(!)

diff -r b30cb72ed5e2 -r 4d4f0d52c193 .hgignore
--- a/.hgignore Fri Nov 03 16:53:17 2006 -0500
+++ b/.hgignore Thu Nov 09 15:37:17 2006 -0500
@@ -98,7 +98,7 @@
 ^tools/firmware/.*\.bin$
 ^tools/firmware/.*\.sym$
 ^tools/firmware/.*bios/.*bios.*\.txt$
-^tools/firmware/acpi/acpigen$
+^tools/firmware/hvmloader/acpi/acpigen$
 ^tools/firmware/hvmloader/hvmloader$
 ^tools/firmware/hvmloader/roms\.h$
 ^tools/firmware/rombios/BIOS-bochs-[^/]*$
@@ -123,6 +123,7 @@
 ^tools/ioemu/qemu\.1$
 ^tools/ioemu/qemu\.pod$
 ^tools/libxc/xen/.*$
+^tools/libxen/test/test_bindings$
 ^tools/libaio/src/.*\.ol$
 ^tools/libaio/src/.*\.os$
 ^tools/misc/cpuperf/cpuperf-perfcntr$
@@ -189,8 +190,9 @@
 ^tools/xm-test/aclocal.m4$
 ^tools/xm-test/autom4te
 ^tools/xm-test/install-sh$
+^tools/xm-test/mkinstalldirs$
 ^tools/xm-test/missing$
-^tools/xm-test/config(ure|.log|.status)$
+^tools/xm-test/config(ure|.log|.status|.guess|.sub)$
 ^tools/xm-test/Makefile(.in)*$
 ^tools/xm-test/.*/Makefile(.in)*$
 ^tools/xm-test/lib/XmTestLib/config.py$
diff -r b30cb72ed5e2 -r 4d4f0d52c193 Config.mk
--- a/Config.mk Fri Nov 03 16:53:17 2006 -0500
+++ b/Config.mk Thu Nov 09 15:37:17 2006 -0500
@@ -26,7 +26,10 @@ EXTRA_LIB += $(EXTRA_PREFIX)/$(LIBDIR)
 EXTRA_LIB += $(EXTRA_PREFIX)/$(LIBDIR)
 endif
 
-test-gcc-flag = $(shell $(1) -v --help 2>&1 | $(GREP) -q " $(2) " && echo $(2))
+# cc-option
+# Usage: cflags-y += $(call cc-option,$(CC),-march=winchip-c6,-march=i586)
+cc-option = $(shell if test -z "`$(1) $(2) -S -o /dev/null -xc \
+              /dev/null 2>&1`"; then echo "$(2)"; else echo "$(3)"; fi ;)
 
 ifneq ($(debug),y)
 CFLAGS += -DNDEBUG
@@ -34,14 +37,16 @@ CFLAGS += -g
 CFLAGS += -g
 endif
 
+CFLAGS += -std=gnu99
+
 CFLAGS += -Wall -Wstrict-prototypes
 
 # -Wunused-value makes GCC 4.x too aggressive for my taste: ignoring the
 # result of any casted expression causes a warning.
 CFLAGS += -Wno-unused-value
 
-HOSTCFLAGS += $(call test-gcc-flag,$(HOSTCC),-Wdeclaration-after-statement)
-CFLAGS     += $(call test-gcc-flag,$(CC),-Wdeclaration-after-statement)
+HOSTCFLAGS += $(call cc-option,$(HOSTCC),-Wdeclaration-after-statement,)
+CFLAGS     += $(call cc-option,$(CC),-Wdeclaration-after-statement,)
 
 LDFLAGS += $(foreach i, $(EXTRA_LIB), -L$(i)) 
 CFLAGS += $(foreach i, $(EXTRA_INCLUDES), -I$(i))
diff -r b30cb72ed5e2 -r 4d4f0d52c193 buildconfigs/Rules.mk
--- a/buildconfigs/Rules.mk     Fri Nov 03 16:53:17 2006 -0500
+++ b/buildconfigs/Rules.mk     Thu Nov 09 15:37:17 2006 -0500
@@ -22,7 +22,7 @@ endif
 
 # Expand Linux series to Linux version
 LINUX_SERIES   ?= 2.6
-LINUX_VER      ?= $(shell $(GREP) "^LINUX_VER " buildconfigs/mk.linux-2.6-xen 
| sed -e 's/.*=[ ]*//')
+LINUX_VER      ?= $(shell grep "^LINUX_VER " buildconfigs/mk.linux-2.6-xen | 
sed -e 's/.*=[ ]*//')
 
 # Setup Linux search path
 LINUX_SRC_PATH ?= .:..
@@ -125,7 +125,7 @@ ifeq ($(XEN_TARGET_X86_PAE),y)
 ifeq ($(XEN_TARGET_X86_PAE),y)
        sed -e 's!^CONFIG_HIGHMEM4G=y$$!\# CONFIG_HIGHMEM4G is not set!;s!^\# 
CONFIG_HIGHMEM64G is not set$$!CONFIG_HIGHMEM64G=y!' $(CONFIG_FILE) > 
$(CONFIG_FILE)- && mv $(CONFIG_FILE)- $(CONFIG_FILE)
 else
-       $(GREP) '^CONFIG_HIGHMEM64G=y' $(CONFIG_FILE) >/dev/null && ( sed -e 
's!^CONFIG_HIGHMEM64G=y$$!\# CONFIG_HIGHMEM64G is not set!;s!^\# 
CONFIG_HIGHMEM4G is not set$$!CONFIG_HIGHMEM4G=y!' $(CONFIG_FILE) > 
$(CONFIG_FILE)- && mv $(CONFIG_FILE)- $(CONFIG_FILE) ) || true
+       grep '^CONFIG_HIGHMEM64G=y' $(CONFIG_FILE) >/dev/null && ( sed -e 
's!^CONFIG_HIGHMEM64G=y$$!\# CONFIG_HIGHMEM64G is not set!;s!^\# 
CONFIG_HIGHMEM4G is not set$$!CONFIG_HIGHMEM4G=y!' $(CONFIG_FILE) > 
$(CONFIG_FILE)- && mv $(CONFIG_FILE)- $(CONFIG_FILE) ) || true
 endif
 
 # never delete any intermediate files.
diff -r b30cb72ed5e2 -r 4d4f0d52c193 buildconfigs/linux-defconfig_xen0_ia64
--- a/buildconfigs/linux-defconfig_xen0_ia64    Fri Nov 03 16:53:17 2006 -0500
+++ b/buildconfigs/linux-defconfig_xen0_ia64    Thu Nov 09 15:37:17 2006 -0500
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.16.13-xen0
-# Fri Sep  1 11:03:26 2006
+# Linux kernel version: 2.6.16.29-xen0
+# Wed Oct  4 12:54:36 2006
 #
 
 #
@@ -92,6 +92,8 @@ CONFIG_GENERIC_IOMAP=y
 CONFIG_GENERIC_IOMAP=y
 CONFIG_XEN=y
 CONFIG_XEN_IA64_VDSO_PARAVIRT=y
+CONFIG_XEN_IA64_EXPOSE_P2M=y
+CONFIG_XEN_IA64_EXPOSE_P2M_USE_DTR=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_DMA_IS_DMA32=y
 # CONFIG_IA64_GENERIC is not set
@@ -119,6 +121,7 @@ CONFIG_SMP=y
 CONFIG_SMP=y
 CONFIG_NR_CPUS=16
 CONFIG_HOTPLUG_CPU=y
+CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
 # CONFIG_SCHED_SMT is not set
 # CONFIG_PREEMPT is not set
 CONFIG_SELECT_MEMORY_MODEL=y
@@ -1041,7 +1044,6 @@ CONFIG_SND_ATIIXP=y
 # CONFIG_SND_ES1968 is not set
 CONFIG_SND_FM801=y
 # CONFIG_SND_FM801_TEA575X_BOOL is not set
-CONFIG_SND_FM801_TEA575X=y
 # CONFIG_SND_HDA_INTEL is not set
 # CONFIG_SND_HDSP is not set
 # CONFIG_SND_HDSPM is not set
@@ -1527,7 +1529,7 @@ CONFIG_XEN_XENBUS_DEV=y
 CONFIG_XEN_XENBUS_DEV=y
 CONFIG_XEN_BACKEND=y
 CONFIG_XEN_BLKDEV_BACKEND=y
-# CONFIG_XEN_BLKDEV_TAP is not set
+CONFIG_XEN_BLKDEV_TAP=y
 CONFIG_XEN_NETDEV_BACKEND=y
 # CONFIG_XEN_NETDEV_PIPELINED_TRANSMITTER is not set
 CONFIG_XEN_NETDEV_LOOPBACK=y
diff -r b30cb72ed5e2 -r 4d4f0d52c193 buildconfigs/linux-defconfig_xenU_ia64
--- a/buildconfigs/linux-defconfig_xenU_ia64    Fri Nov 03 16:53:17 2006 -0500
+++ b/buildconfigs/linux-defconfig_xenU_ia64    Thu Nov 09 15:37:17 2006 -0500
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.16.13-xenU
-# Fri Sep  1 10:50:54 2006
+# Linux kernel version: 2.6.16.29-xenU
+# Wed Oct  4 12:54:26 2006
 #
 
 #
@@ -89,6 +89,8 @@ CONFIG_GENERIC_IOMAP=y
 CONFIG_GENERIC_IOMAP=y
 CONFIG_XEN=y
 CONFIG_XEN_IA64_VDSO_PARAVIRT=y
+CONFIG_XEN_IA64_EXPOSE_P2M=y
+CONFIG_XEN_IA64_EXPOSE_P2M_USE_DTR=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_DMA_IS_DMA32=y
 # CONFIG_IA64_GENERIC is not set
@@ -116,6 +118,7 @@ CONFIG_SMP=y
 CONFIG_SMP=y
 CONFIG_NR_CPUS=16
 # CONFIG_HOTPLUG_CPU is not set
+CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
 # CONFIG_SCHED_SMT is not set
 # CONFIG_PREEMPT is not set
 CONFIG_SELECT_MEMORY_MODEL=y
@@ -940,7 +943,6 @@ CONFIG_SND_AC97_BUS=y
 # CONFIG_SND_ES1968 is not set
 CONFIG_SND_FM801=y
 # CONFIG_SND_FM801_TEA575X_BOOL is not set
-CONFIG_SND_FM801_TEA575X=y
 # CONFIG_SND_HDA_INTEL is not set
 # CONFIG_SND_HDSP is not set
 # CONFIG_SND_HDSPM is not set
diff -r b30cb72ed5e2 -r 4d4f0d52c193 buildconfigs/linux-defconfig_xen_ia64
--- a/buildconfigs/linux-defconfig_xen_ia64     Fri Nov 03 16:53:17 2006 -0500
+++ b/buildconfigs/linux-defconfig_xen_ia64     Thu Nov 09 15:37:17 2006 -0500
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.16.13-xen
-# Fri Sep  1 10:58:55 2006
+# Linux kernel version: 2.6.16.29-xen
+# Wed Oct  4 12:31:45 2006
 #
 
 #
@@ -92,6 +92,8 @@ CONFIG_GENERIC_IOMAP=y
 CONFIG_GENERIC_IOMAP=y
 CONFIG_XEN=y
 CONFIG_XEN_IA64_VDSO_PARAVIRT=y
+CONFIG_XEN_IA64_EXPOSE_P2M=y
+CONFIG_XEN_IA64_EXPOSE_P2M_USE_DTR=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_DMA_IS_DMA32=y
 # CONFIG_IA64_GENERIC is not set
@@ -119,6 +121,7 @@ CONFIG_SMP=y
 CONFIG_SMP=y
 CONFIG_NR_CPUS=16
 CONFIG_HOTPLUG_CPU=y
+CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
 # CONFIG_SCHED_SMT is not set
 # CONFIG_PREEMPT is not set
 CONFIG_SELECT_MEMORY_MODEL=y
@@ -1047,7 +1050,6 @@ CONFIG_SND_ATIIXP=y
 # CONFIG_SND_ES1968 is not set
 CONFIG_SND_FM801=y
 # CONFIG_SND_FM801_TEA575X_BOOL is not set
-CONFIG_SND_FM801_TEA575X=y
 # CONFIG_SND_HDA_INTEL is not set
 # CONFIG_SND_HDSP is not set
 # CONFIG_SND_HDSPM is not set
@@ -1533,7 +1535,7 @@ CONFIG_XEN_XENBUS_DEV=y
 CONFIG_XEN_XENBUS_DEV=y
 CONFIG_XEN_BACKEND=y
 CONFIG_XEN_BLKDEV_BACKEND=y
-# CONFIG_XEN_BLKDEV_TAP is not set
+CONFIG_XEN_BLKDEV_TAP=y
 CONFIG_XEN_NETDEV_BACKEND=y
 # CONFIG_XEN_NETDEV_PIPELINED_TRANSMITTER is not set
 CONFIG_XEN_NETDEV_LOOPBACK=y
diff -r b30cb72ed5e2 -r 4d4f0d52c193 config/Linux.mk
--- a/config/Linux.mk   Fri Nov 03 16:53:17 2006 -0500
+++ b/config/Linux.mk   Thu Nov 09 15:37:17 2006 -0500
@@ -1,37 +1,4 @@
-# -*- mode: Makefile; -*-
-
-AS         = $(CROSS_COMPILE)as
-LD         = $(CROSS_COMPILE)ld
-CC         = $(CROSS_COMPILE)gcc
-CPP        = $(CROSS_COMPILE)gcc -E
-AR         = $(CROSS_COMPILE)ar
-RANLIB     = $(CROSS_COMPILE)ranlib
-NM         = $(CROSS_COMPILE)nm
-STRIP      = $(CROSS_COMPILE)strip
-OBJCOPY    = $(CROSS_COMPILE)objcopy
-OBJDUMP    = $(CROSS_COMPILE)objdump
-
-GREP       = grep
-
-INSTALL      = install
-INSTALL_DIR  = $(INSTALL) -d -m0755
-INSTALL_DATA = $(INSTALL) -m0644
-INSTALL_PROG = $(INSTALL) -m0755
-
-LIB64DIR = lib64
-
-SOCKET_LIBS =
-CURSES_LIBS = -lncurses
-SONAME_LDFLAG = -soname
-SHLIB_CFLAGS = -shared
-
-ifneq ($(debug),y)
-# Optimisation flags are overridable
-CFLAGS ?= -O2 -fomit-frame-pointer
-else
-# Less than -O1 produces bad code and large stack frames
-CFLAGS ?= -O1 -fno-omit-frame-pointer
-endif
+include $(XEN_ROOT)/config/StdGNU.mk
 
 # You may use wildcards, e.g. KERNELS=*2.6*
 KERNELS ?= linux-2.6-xen
diff -r b30cb72ed5e2 -r 4d4f0d52c193 config/SunOS.mk
--- a/config/SunOS.mk   Fri Nov 03 16:53:17 2006 -0500
+++ b/config/SunOS.mk   Thu Nov 09 15:37:17 2006 -0500
@@ -1,5 +1,3 @@
-# -*- mode: Makefile; -*-
-
 AS         = $(CROSS_COMPILE)gas
 LD         = $(CROSS_COMPILE)gld
 CC         = $(CROSS_COMPILE)gcc
@@ -11,7 +9,6 @@ OBJCOPY    = $(CROSS_COMPILE)gobjcopy
 OBJCOPY    = $(CROSS_COMPILE)gobjcopy
 OBJDUMP    = $(CROSS_COMPILE)gobjdump
 
-GREP       = ggrep
 SHELL      = bash
 
 INSTALL      = ginstall
@@ -24,7 +21,7 @@ SOCKET_LIBS = -lsocket
 SOCKET_LIBS = -lsocket
 CURSES_LIBS = -lcurses
 SONAME_LDFLAG = -h
-SHLIB_CFLAGS = -static-libgcc -shared
+SHLIB_CFLAGS = -R /usr/sfw/$(LIBDIR) -shared
 
 ifneq ($(debug),y)
 # Optimisation flags are overridable
@@ -34,4 +31,5 @@ CFLAGS ?= -O1 -fno-omit-frame-pointer
 CFLAGS ?= -O1 -fno-omit-frame-pointer
 endif
 
-CFLAGS += -Wa,--divide
+CFLAGS += -Wa,--divide -D_POSIX_C_SOURCE=200112L -D__EXTENSIONS__
+
diff -r b30cb72ed5e2 -r 4d4f0d52c193 config/x86_32.mk
--- a/config/x86_32.mk  Fri Nov 03 16:53:17 2006 -0500
+++ b/config/x86_32.mk  Thu Nov 09 15:37:17 2006 -0500
@@ -7,5 +7,11 @@ CONFIG_IOEMU := y
 CONFIG_IOEMU := y
 
 CFLAGS += -m32 -march=i686
-LDFLAGS += -m32
 LIBDIR := lib
+
+# Use only if calling $(LD) directly.
+ifeq ($(XEN_OS),OpenBSD)
+LDFLAGS_DIRECT += -melf_i386_obsd
+else
+LDFLAGS_DIRECT += -melf_i386
+endif
diff -r b30cb72ed5e2 -r 4d4f0d52c193 config/x86_64.mk
--- a/config/x86_64.mk  Fri Nov 03 16:53:17 2006 -0500
+++ b/config/x86_64.mk  Thu Nov 09 15:37:17 2006 -0500
@@ -7,5 +7,11 @@ CONFIG_IOEMU := y
 CONFIG_IOEMU := y
 
 CFLAGS += -m64
-LDFLAGS += -m64
 LIBDIR = $(LIB64DIR)
+
+# Use only if calling $(LD) directly.
+ifeq ($(XEN_OS),OpenBSD)
+LDFLAGS_DIRECT += -melf_x86_64_obsd
+else
+LDFLAGS_DIRECT += -melf_x86_64
+endif
diff -r b30cb72ed5e2 -r 4d4f0d52c193 docs/man/xm.pod.1
--- a/docs/man/xm.pod.1 Fri Nov 03 16:53:17 2006 -0500
+++ b/docs/man/xm.pod.1 Thu Nov 09 15:37:17 2006 -0500
@@ -810,13 +810,13 @@ Loads the binary representation of the I
 Loads the binary representation of the I<policy> into Xen. The binary
 representation can be created with the B<makepolicy> subcommand.
 
-=item B<cfgbootpolicy> I<policy> [I<kernelversion>]
+=item B<cfgbootpolicy> I<policy> [I<boot title>]
 
 Configures I<policy> as the boot policy for Xen. It copies the binary
 policy representation into the /boot directory and adds a module line
 specifying the binary policy to the /boot/grub/menu.lst file. If your
 boot configuration includes multiple Xen boot titles, then use the
-I<kernelversion> parameter to select the proper title.
+I<boot title> parameter to specify a unique part of the proper title.
 
 =item B<dumppolicy>
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 docs/src/interface.tex
--- a/docs/src/interface.tex    Fri Nov 03 16:53:17 2006 -0500
+++ b/docs/src/interface.tex    Thu Nov 09 15:37:17 2006 -0500
@@ -955,7 +955,6 @@ A {\bf /vm} entry contains the following
 A {\bf /vm} entry contains the following information:
 
 \begin{description}
-\item[ssidref] ssid reference for domain
 \item[uuid] uuid of the domain (somewhat redundant)
 \item[on\_reboot] the action to take on a domain reboot request (destroy or 
restart)
 \item[on\_poweroff] the action to take on a domain halt request (destroy or 
restart)
@@ -1125,6 +1124,16 @@ This path contains:
       \end{description}
     \end{description}
 
+  \item[security/] access control information for the domain
+    \begin{description}
+    \item[ssidref] security reference identifier used inside the hypervisor
+    \item[access\_control/] security label used by management tools
+      \begin{description}
+       \item[label] security label name
+       \item[policy] security policy name
+      \end{description}
+    \end{description}
+
   \item[store/] per-domain information for the store
     \begin{description}
     \item[port] the event channel used for the store ring queue 
@@ -2168,18 +2177,45 @@ implementing them (in {\tt xen/common/do
 implementing them (in {\tt xen/common/dom0\_ops.c}) and in 
 the user-space tools that use them (mostly in {\tt tools/libxc}). 
 
+\section{Access Control Module Hypercalls}
+\label{s:acmops}
+
 Hypercalls relating to the management of the Access Control Module are
-also restricted to domain 0 access for now:
+also restricted to domain 0 access for now. For more details on any or
+all of these, please see {\tt xen/include/public/acm\_ops.h}.  A
+complete list is given below:
 
 \begin{quote}
 
-\hypercall{acm\_op(struct acm\_op * u\_acm\_op)}
+\hypercall{acm\_op(int cmd, void *args)}
 
 This hypercall can be used to configure the state of the ACM, query
 that state, request access control decisions and dump additional
 information.
 
+\begin{description}
+
+\item [ACMOP\_SETPOLICY:] set the access control policy
+
+\item [ACMOP\_GETPOLICY:] get the current access control policy and
+  status
+
+\item [ACMOP\_DUMPSTATS:] get current access control hook invocation
+  statistics
+
+\item [ACMOP\_GETSSID:] get security access control information for a
+  domain
+
+\item [ACMOP\_GETDECISION:] get access decision based on the currently
+  enforced access control policy
+
+\end{description}
 \end{quote}
+
+Most of the above are best understood by looking at the code
+implementing them (in {\tt xen/common/acm\_ops.c}) and in the
+user-space tools that use them (mostly in {\tt tools/security} and
+{\tt tools/python/xen/lowlevel/acm}).
 
 
 \section{Debugging Hypercalls} 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 docs/src/user.tex
--- a/docs/src/user.tex Fri Nov 03 16:53:17 2006 -0500
+++ b/docs/src/user.tex Thu Nov 09 15:37:17 2006 -0500
@@ -3192,6 +3192,15 @@ editing \path{grub.conf}.
   input to DOM0 when it boots --- if it is `x' then auto-switching is
   disabled.  Any other value, or omitting the character, enables
   auto-switching.  [NB. Default switch-char is `a'.]
+\item [ loglvl=$<$level$>/<$level$>$ ]
+  Specify logging level. Messages of the specified severity level (and
+  higher) will be printed to the Xen console. Valid levels are `none',
+  `error', `warning', `info', `debug', and `all'. The second level
+  specifier is optional: it is used to specify message severities
+  which are to be rate limited. Default is `loglvl=warning'.
+\item [ guest\_loglvl=$<$level$>/<$level$>$ ] As for loglvl, but
+  applies to messages relating to guests. Default is
+  `guest\_loglvl=none/warning'. 
 \item [ nmi=xxx ]
   Specify what to do with an NMI parity or I/O error. \\
   `nmi=fatal':  Xen prints a diagnostic and then hangs. \\
@@ -3202,12 +3211,21 @@ editing \path{grub.conf}.
   ignored. This parameter may be specified with a B, K, M or G suffix,
   representing bytes, kilobytes, megabytes and gigabytes respectively.
   The default unit, if no suffix is specified, is kilobytes.
-\item [ dom0\_mem=xxx ] Set the amount of memory to be allocated to
-  domain0. In Xen 3.x the parameter may be specified with a B, K, M or
+\item [ dom0\_mem=$<$specifier list$>$ ] Set the amount of memory to
+  be allocated to domain 0. This is a comma-separated list containing
+  the following optional components:
+  \begin{description}
+  \item[ min:$<$min\_amt$>$ ] Minimum amount to allocate to domain 0
+  \item[ max:$<$min\_amt$>$ ] Maximum amount to allocate to domain 0
+  \item[ $<$amt$>$ ] Precise amount to allocate to domain 0
+  \end{description}
+  Each numeric parameter may be specified with a B, K, M or
   G suffix, representing bytes, kilobytes, megabytes and gigabytes
   respectively; if no suffix is specified, the parameter defaults to
-  kilobytes. In previous versions of Xen, suffixes were not supported
-  and the value is always interpreted as kilobytes.
+  kilobytes. Negative values are subtracted from total available
+  memory. If $<$amt$>$ is not specified, it defaults to all available
+  memory less a small amount (clamped to 128MB) for uses such as DMA
+  buffers.
 \item [ dom0\_vcpus\_pin ] Pins domain 0 VCPUs on their respective
   physical CPUS (default=false).
 \item [ tbuf\_size=xxx ] Set the size of the per-cpu trace buffers, in
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/arch/i386/kernel/fixup.c
--- a/linux-2.6-xen-sparse/arch/i386/kernel/fixup.c     Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/arch/i386/kernel/fixup.c     Thu Nov 09 15:37:17 
2006 -0500
@@ -46,6 +46,9 @@ fastcall void do_fixup_4gb_segment(struc
        if (test_and_set_bit(0, &printed))
                return;
 
+        if (current->tgid == 1) /* Ignore statically linked init */
+                return; 
+            
        HYPERVISOR_vm_assist(
                VMASST_CMD_disable, VMASST_TYPE_4gb_segments_notify);
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/arch/i386/kernel/microcode-xen.c
--- a/linux-2.6-xen-sparse/arch/i386/kernel/microcode-xen.c     Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/arch/i386/kernel/microcode-xen.c     Thu Nov 09 
15:37:17 2006 -0500
@@ -50,9 +50,6 @@ MODULE_LICENSE("GPL");
 
 /* no concurrent ->write()s are allowed on /dev/cpu/microcode */
 static DECLARE_MUTEX(microcode_sem);
-
-static void __user *user_buffer;       /* user area microcode data buffer */
-static unsigned int user_buffer_size;  /* it's size */
                                
 static int microcode_open (struct inode *unused1, struct file *unused2)
 {
@@ -60,21 +57,26 @@ static int microcode_open (struct inode 
 }
 
 
-static int do_microcode_update (void)
+static int do_microcode_update (const void __user *ubuf, size_t len)
 {
        int err;
-       dom0_op_t op;
+       void *kbuf;
 
-       err = sys_mlock((unsigned long)user_buffer, user_buffer_size);
-       if (err != 0)
-               return err;
+       kbuf = vmalloc(len);
+       if (!kbuf)
+               return -ENOMEM;
 
-       op.cmd = DOM0_MICROCODE;
-       set_xen_guest_handle(op.u.microcode.data, user_buffer);
-       op.u.microcode.length = user_buffer_size;
-       err = HYPERVISOR_dom0_op(&op);
+       if (copy_from_user(kbuf, ubuf, len) == 0) {
+               dom0_op_t op;
 
-       (void)sys_munlock((unsigned long)user_buffer, user_buffer_size);
+               op.cmd = DOM0_MICROCODE;
+               set_xen_guest_handle(op.u.microcode.data, kbuf);
+               op.u.microcode.length = len;
+               err = HYPERVISOR_dom0_op(&op);
+       } else
+               err = -EFAULT;
+
+       vfree(kbuf);
 
        return err;
 }
@@ -88,17 +90,9 @@ static ssize_t microcode_write (struct f
                return -EINVAL;
        }
 
-       if ((len >> PAGE_SHIFT) > num_physpages) {
-               printk(KERN_ERR "microcode: too much data (max %ld pages)\n", 
num_physpages);
-               return -EINVAL;
-       }
-
        down(&microcode_sem);
 
-       user_buffer = (void __user *) buf;
-       user_buffer_size = (int) len;
-
-       ret = do_microcode_update();
+       ret = do_microcode_update(buf, len);
        if (!ret)
                ret = (ssize_t)len;
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/arch/i386/kernel/sysenter.c
--- a/linux-2.6-xen-sparse/arch/i386/kernel/sysenter.c  Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/arch/i386/kernel/sysenter.c  Thu Nov 09 15:37:17 
2006 -0500
@@ -60,7 +60,7 @@ int __init sysenter_setup(void)
 
 #ifdef CONFIG_XEN
        if (boot_cpu_has(X86_FEATURE_SEP)) {
-               struct callback_register sysenter = {
+               static struct callback_register __initdata sysenter = {
                        .type = CALLBACKTYPE_sysenter,
                        .address = { __KERNEL_CS, (unsigned long)sysenter_entry 
},
                };
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/arch/i386/mm/hypervisor.c
--- a/linux-2.6-xen-sparse/arch/i386/mm/hypervisor.c    Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/arch/i386/mm/hypervisor.c    Thu Nov 09 15:37:17 
2006 -0500
@@ -325,6 +325,7 @@ int xen_create_contiguous_region(
        success = (exchange.nr_exchanged == (1UL << order));
        BUG_ON(!success && ((exchange.nr_exchanged != 0) || (rc == 0)));
        BUG_ON(success && (rc != 0));
+#ifdef CONFIG_XEN_COMPAT_030002
        if (unlikely(rc == -ENOSYS)) {
                /* Compatibility when XENMEM_exchange is unsupported. */
                if (HYPERVISOR_memory_op(XENMEM_decrease_reservation,
@@ -341,6 +342,7 @@ int xen_create_contiguous_region(
                                BUG();
                }
        }
+#endif
 
        /* 3. Map the new extent in place of old pages. */
        for (i = 0; i < (1UL<<order); i++) {
@@ -419,6 +421,7 @@ void xen_destroy_contiguous_region(unsig
        success = (exchange.nr_exchanged == 1);
        BUG_ON(!success && ((exchange.nr_exchanged != 0) || (rc == 0)));
        BUG_ON(success && (rc != 0));
+#ifdef CONFIG_XEN_COMPAT_030002
        if (unlikely(rc == -ENOSYS)) {
                /* Compatibility when XENMEM_exchange is unsupported. */
                if (HYPERVISOR_memory_op(XENMEM_decrease_reservation,
@@ -429,6 +432,7 @@ void xen_destroy_contiguous_region(unsig
                        BUG();
                success = 1;
        }
+#endif
 
        /* 4. Map new pages in place of old pages. */
        for (i = 0; i < (1UL<<order); i++) {
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/arch/i386/mm/init-xen.c
--- a/linux-2.6-xen-sparse/arch/i386/mm/init-xen.c      Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/arch/i386/mm/init-xen.c      Thu Nov 09 15:37:17 
2006 -0500
@@ -663,8 +663,8 @@ void __init mem_init(void)
        totalram_pages += free_all_bootmem();
        /* XEN: init and count low-mem pages outside initial allocation. */
        for (pfn = xen_start_info->nr_pages; pfn < max_low_pfn; pfn++) {
-               ClearPageReserved(&mem_map[pfn]);
-               set_page_count(&mem_map[pfn], 1);
+               ClearPageReserved(pfn_to_page(pfn));
+               set_page_count(pfn_to_page(pfn), 1);
                totalram_pages++;
        }
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 linux-2.6-xen-sparse/arch/ia64/Kconfig
--- a/linux-2.6-xen-sparse/arch/ia64/Kconfig    Fri Nov 03 16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/arch/ia64/Kconfig    Thu Nov 09 15:37:17 2006 -0500
@@ -63,6 +63,20 @@ config XEN_IA64_VDSO_PARAVIRT
        default y
        help
          vDSO paravirtualization
+
+config XEN_IA64_EXPOSE_P2M
+       bool "Xen/IA64 exposure p2m table"
+       depends on XEN
+       default y
+       help
+         expose p2m from xen
+
+config XEN_IA64_EXPOSE_P2M_USE_DTR
+       bool "Xen/IA64 map p2m table with dtr"
+       depends on XEN_IA64_EXPOSE_P2M
+       default y
+       help
+         use dtr to map the exposed p2m table
 
 config SCHED_NO_NO_OMIT_FRAME_POINTER
        bool
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/arch/ia64/kernel/gate.lds.S
--- a/linux-2.6-xen-sparse/arch/ia64/kernel/gate.lds.S  Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/arch/ia64/kernel/gate.lds.S  Thu Nov 09 15:37:17 
2006 -0500
@@ -13,6 +13,7 @@ SECTIONS
   . = GATE_ADDR + SIZEOF_HEADERS;
 
   .hash                                : { *(.hash) }                          
:readable
+  .gnu.hash                    : { *(.gnu.hash) }
   .dynsym                      : { *(.dynsym) }
   .dynstr                      : { *(.dynstr) }
   .gnu.version                 : { *(.gnu.version) }
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/arch/ia64/kernel/setup.c
--- a/linux-2.6-xen-sparse/arch/ia64/kernel/setup.c     Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/arch/ia64/kernel/setup.c     Thu Nov 09 15:37:17 
2006 -0500
@@ -63,6 +63,7 @@
 #include <asm/system.h>
 #ifdef CONFIG_XEN
 #include <asm/hypervisor.h>
+#include <asm/xen/xencomm.h>
 #endif
 #include <linux/dma-mapping.h>
 
@@ -433,6 +434,9 @@ setup_arch (char **cmdline_p)
 
 #ifdef CONFIG_XEN
        if (is_running_on_xen()) {
+               /* Must be done before any hypercall.  */
+               xencomm_init();
+
                setup_xen_features();
                /* Register a call for panic conditions. */
                notifier_chain_register(&panic_notifier_list, &xen_panic_block);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 linux-2.6-xen-sparse/arch/ia64/xen/Makefile
--- a/linux-2.6-xen-sparse/arch/ia64/xen/Makefile       Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/arch/ia64/xen/Makefile       Thu Nov 09 15:37:17 
2006 -0500
@@ -3,6 +3,7 @@
 #
 
 obj-y := hypercall.o xenivt.o xenentry.o xensetup.o xenpal.o xenhpski.o \
-        hypervisor.o pci-dma-xen.o util.o
+        hypervisor.o pci-dma-xen.o util.o xencomm.o xcom_hcall.o \
+        xcom_mini.o xcom_privcmd.o
 
 pci-dma-xen-y := ../../i386/kernel/pci-dma-xen.o
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/arch/ia64/xen/hypervisor.c
--- a/linux-2.6-xen-sparse/arch/ia64/xen/hypervisor.c   Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/arch/ia64/xen/hypervisor.c   Thu Nov 09 15:37:17 
2006 -0500
@@ -40,59 +40,11 @@ int running_on_xen;
 int running_on_xen;
 EXPORT_SYMBOL(running_on_xen);
 
-//XXX xen/ia64 copy_from_guest() is broken.
-//    This is a temporal work around until it is fixed.
-//    used by balloon.c netfront.c
-
-// get_xen_guest_handle is defined only when __XEN_TOOLS__ is defined
-// if the definition in arch-ia64.h is changed, this must be updated.
-#define get_xen_guest_handle(val, hnd)  do { val = (hnd).p; } while (0)
-
-int
-ia64_xenmem_reservation_op(unsigned long op,
-                          struct xen_memory_reservation* reservation__)
-{
-       struct xen_memory_reservation reservation = *reservation__;
-       unsigned long* frame_list;
-       unsigned long nr_extents = reservation__->nr_extents;
-       int ret = 0;
-       get_xen_guest_handle(frame_list, reservation__->extent_start);
-
-       BUG_ON(op != XENMEM_increase_reservation &&
-              op != XENMEM_decrease_reservation &&
-              op != XENMEM_populate_physmap);
-
-       while (nr_extents > 0) {
-               int tmp_ret;
-               volatile unsigned long dummy;
-
-               set_xen_guest_handle(reservation.extent_start, frame_list);
-               reservation.nr_extents = nr_extents;
-
-               dummy = frame_list[0];// re-install tlb entry before hypercall
-               tmp_ret = ____HYPERVISOR_memory_op(op, &reservation);
-               if (tmp_ret < 0) {
-                       if (ret == 0) {
-                               ret = tmp_ret;
-                       }
-                       break;
-               }
-               if (tmp_ret == 0) {
-                       //XXX dirty work around for skbuff_ctor()
-                       //    of a non-privileged domain, 
-                       if ((op == XENMEM_increase_reservation ||
-                            op == XENMEM_populate_physmap) &&
-                           !is_initial_xendomain() &&
-                           reservation.extent_order > 0)
-                               return ret;
-               }
-               frame_list += tmp_ret;
-               nr_extents -= tmp_ret;
-               ret += tmp_ret;
-       }
-       return ret;
-}
-EXPORT_SYMBOL(ia64_xenmem_reservation_op);
+#ifdef CONFIG_XEN_IA64_EXPOSE_P2M
+static int p2m_expose_init(void);
+#else
+#define p2m_expose_init() (-ENOSYS)
+#endif
 
 //XXX same as i386, x86_64 contiguous_bitmap_set(), contiguous_bitmap_clear()
 // move those to lib/contiguous_bitmap?
@@ -371,8 +323,6 @@ int
 int
 HYPERVISOR_grant_table_op(unsigned int cmd, void *uop, unsigned int count)
 {
-       __u64 va1, va2, pa1, pa2;
-
        if (cmd == GNTTABOP_map_grant_ref) {
                unsigned int i;
                for (i = 0; i < count; i++) {
@@ -380,29 +330,7 @@ HYPERVISOR_grant_table_op(unsigned int c
                                (struct gnttab_map_grant_ref*)uop + i);
                }
        }
-       va1 = (__u64)uop & PAGE_MASK;
-       pa1 = pa2 = 0;
-       if ((REGION_NUMBER(va1) == 5) &&
-           ((va1 - KERNEL_START) >= KERNEL_TR_PAGE_SIZE)) {
-               pa1 = ia64_tpa(va1);
-               if (cmd <= GNTTABOP_transfer) {
-                       static uint32_t uop_size[GNTTABOP_transfer + 1] = {
-                               sizeof(struct gnttab_map_grant_ref),
-                               sizeof(struct gnttab_unmap_grant_ref),
-                               sizeof(struct gnttab_setup_table),
-                               sizeof(struct gnttab_dump_table),
-                               sizeof(struct gnttab_transfer),
-                       };
-                       va2 = (__u64)uop + (uop_size[cmd] * count) - 1;
-                       va2 &= PAGE_MASK;
-                       if (va1 != va2) {
-                               /* maximum size of uop is 2pages */
-                               BUG_ON(va2 > va1 + PAGE_SIZE);
-                               pa2 = ia64_tpa(va2);
-                       }
-               }
-       }
-       return ____HYPERVISOR_grant_table_op(cmd, uop, count, pa1, pa2);
+       return xencomm_mini_hypercall_grant_table_op(cmd, uop, count);
 }
 EXPORT_SYMBOL(HYPERVISOR_grant_table_op);
 
@@ -526,6 +454,10 @@ out:
               privcmd_resource_min, privcmd_resource_max, 
               (privcmd_resource_max - privcmd_resource_min) >> 20);
        BUG_ON(privcmd_resource_min >= privcmd_resource_max);
+
+       // XXX this should be somewhere appropriate
+       (void)p2m_expose_init();
+
        return 0;
 }
 late_initcall(xen_ia64_privcmd_init);
@@ -845,3 +777,276 @@ time_resume(void)
        /* Just trigger a tick.  */
        ia64_cpu_local_tick();
 }
+
+///////////////////////////////////////////////////////////////////////////
+// expose p2m table
+#ifdef CONFIG_XEN_IA64_EXPOSE_P2M
+#include <linux/cpu.h>
+#include <asm/uaccess.h>
+
+int p2m_initialized __read_mostly = 0;
+
+unsigned long p2m_min_low_pfn __read_mostly;
+unsigned long p2m_max_low_pfn __read_mostly;
+unsigned long p2m_convert_min_pfn __read_mostly;
+unsigned long p2m_convert_max_pfn __read_mostly;
+
+static struct resource p2m_resource = {
+       .name    = "Xen p2m table",
+       .flags   = IORESOURCE_MEM,
+};
+static unsigned long p2m_assign_start_pfn __read_mostly;
+static unsigned long p2m_assign_end_pfn __read_mostly;
+volatile const pte_t* p2m_pte __read_mostly;
+
+#define GRNULE_PFN     PTRS_PER_PTE
+static unsigned long p2m_granule_pfn __read_mostly = GRNULE_PFN;
+
+#define ROUNDDOWN(x, y)  ((x) & ~((y) - 1))
+#define ROUNDUP(x, y)    (((x) + (y) - 1) & ~((y) - 1))
+
+#define P2M_PREFIX     "Xen p2m: "
+
+static int xen_ia64_p2m_expose __read_mostly = 1;
+module_param(xen_ia64_p2m_expose, int, 0);
+MODULE_PARM_DESC(xen_ia64_p2m_expose,
+                 "enable/disable xen/ia64 p2m exposure optimization\n");
+
+#ifdef CONFIG_XEN_IA64_EXPOSE_P2M_USE_DTR
+static int xen_ia64_p2m_expose_use_dtr __read_mostly = 1;
+module_param(xen_ia64_p2m_expose_use_dtr, int, 0);
+MODULE_PARM_DESC(xen_ia64_p2m_expose_use_dtr,
+                 "use/unuse dtr to map exposed p2m table\n");
+
+static const int p2m_page_shifts[] = {
+       _PAGE_SIZE_4K,
+       _PAGE_SIZE_8K,
+       _PAGE_SIZE_16K,
+       _PAGE_SIZE_64K,
+       _PAGE_SIZE_256K,
+       _PAGE_SIZE_1M,
+       _PAGE_SIZE_4M,
+       _PAGE_SIZE_16M,
+       _PAGE_SIZE_64M,
+       _PAGE_SIZE_256M,
+};
+
+struct p2m_itr_arg {
+       unsigned long vaddr;
+       unsigned long pteval;
+       unsigned long log_page_size;
+};
+static struct p2m_itr_arg p2m_itr_arg __read_mostly;
+
+// This should be in asm-ia64/kregs.h
+#define IA64_TR_P2M_TABLE      3
+
+static void
+p2m_itr(void* info)
+{
+       struct p2m_itr_arg* arg = (struct p2m_itr_arg*)info;
+       ia64_itr(0x2, IA64_TR_P2M_TABLE,
+                arg->vaddr, arg->pteval, arg->log_page_size);
+       ia64_srlz_d();
+}
+
+static int
+p2m_expose_dtr_call(struct notifier_block *self,
+                    unsigned long event, void* ptr)
+{
+       unsigned int cpu = (unsigned int)(long)ptr;
+       if (event != CPU_ONLINE)
+               return 0;
+       if (!(p2m_initialized && xen_ia64_p2m_expose_use_dtr))
+               smp_call_function_single(cpu, &p2m_itr, &p2m_itr_arg, 1, 1);
+       return 0;
+}
+
+static struct notifier_block p2m_expose_dtr_hotplug_notifier = {
+       .notifier_call = p2m_expose_dtr_call,
+       .next          = NULL,
+       .priority      = 0
+};
+#endif
+
+static int
+p2m_expose_init(void)
+{
+       unsigned long num_pfn;
+       unsigned long size = 0;
+       unsigned long p2m_size = 0;
+       unsigned long align = ~0UL;
+       int error = 0;
+#ifdef CONFIG_XEN_IA64_EXPOSE_P2M_USE_DTR
+       int i;
+       unsigned long page_size;
+       unsigned long log_page_size = 0;
+#endif
+
+       if (!xen_ia64_p2m_expose)
+               return -ENOSYS;
+       if (p2m_initialized)
+               return 0;
+
+#ifdef CONFIG_XEN_IA64_EXPOSE_P2M_USE_DTR
+       error = register_cpu_notifier(&p2m_expose_dtr_hotplug_notifier);
+       if (error < 0)
+               return error;
+#endif
+
+       lock_cpu_hotplug();
+       if (p2m_initialized)
+               goto out;
+
+#ifdef CONFIG_DISCONTIGMEM
+       p2m_min_low_pfn = min_low_pfn;
+       p2m_max_low_pfn = max_low_pfn;
+#else
+       p2m_min_low_pfn = 0;
+       p2m_max_low_pfn = max_pfn;
+#endif
+
+#ifdef CONFIG_XEN_IA64_EXPOSE_P2M_USE_DTR
+       if (xen_ia64_p2m_expose_use_dtr) {
+               unsigned long granule_pfn = 0;
+               p2m_size = p2m_max_low_pfn - p2m_min_low_pfn;
+               for (i = 0;
+                    i < sizeof(p2m_page_shifts)/sizeof(p2m_page_shifts[0]);
+                    i++) {
+                       log_page_size = p2m_page_shifts[i];
+                       page_size = 1UL << log_page_size;
+                       if (page_size < p2m_size)
+                               continue;
+
+                       granule_pfn = max(page_size >> PAGE_SHIFT,
+                                         p2m_granule_pfn);
+                       p2m_convert_min_pfn = ROUNDDOWN(p2m_min_low_pfn,
+                                                       granule_pfn);
+                       p2m_convert_max_pfn = ROUNDUP(p2m_max_low_pfn,
+                                                     granule_pfn);
+                       num_pfn = p2m_convert_max_pfn - p2m_convert_min_pfn;
+                       size = num_pfn << PAGE_SHIFT;
+                       p2m_size = num_pfn / PTRS_PER_PTE;
+                       p2m_size = ROUNDUP(p2m_size, granule_pfn << PAGE_SHIFT);
+                       if (p2m_size == page_size)
+                               break;
+               }
+               if (p2m_size != page_size) {
+                       printk(KERN_ERR "p2m_size != page_size\n");
+                       error = -EINVAL;
+                       goto out;
+               }
+               align = max(privcmd_resource_align, granule_pfn << PAGE_SHIFT);
+       } else
+#endif
+       {
+               BUG_ON(p2m_granule_pfn & (p2m_granule_pfn - 1));
+               p2m_convert_min_pfn = ROUNDDOWN(p2m_min_low_pfn,
+                                               p2m_granule_pfn);
+               p2m_convert_max_pfn = ROUNDUP(p2m_max_low_pfn, p2m_granule_pfn);
+               num_pfn = p2m_convert_max_pfn - p2m_convert_min_pfn;
+               size = num_pfn << PAGE_SHIFT;
+               p2m_size = num_pfn / PTRS_PER_PTE;
+               p2m_size = ROUNDUP(p2m_size, p2m_granule_pfn << PAGE_SHIFT);
+               align = max(privcmd_resource_align,
+                           p2m_granule_pfn << PAGE_SHIFT);
+       }
+       
+       // use privcmd region
+       error = allocate_resource(&iomem_resource, &p2m_resource, p2m_size,
+                                 privcmd_resource_min, privcmd_resource_max,
+                                 align, NULL, NULL);
+       if (error) {
+               printk(KERN_ERR P2M_PREFIX
+                      "can't allocate region for p2m exposure "
+                      "[0x%016lx, 0x%016lx) 0x%016lx\n",
+                      p2m_convert_min_pfn, p2m_convert_max_pfn, p2m_size);
+               goto out;
+       }
+
+       p2m_assign_start_pfn = p2m_resource.start >> PAGE_SHIFT;
+       p2m_assign_end_pfn = p2m_resource.end >> PAGE_SHIFT;
+       
+       error = HYPERVISOR_expose_p2m(p2m_convert_min_pfn,
+                                     p2m_assign_start_pfn,
+                                     size, p2m_granule_pfn);
+       if (error) {
+               printk(KERN_ERR P2M_PREFIX "failed expose p2m hypercall %d\n",
+                      error);
+               printk(KERN_ERR P2M_PREFIX "conv 0x%016lx assign 0x%016lx "
+                      "size 0x%016lx granule 0x%016lx\n",
+                      p2m_convert_min_pfn, p2m_assign_start_pfn,
+                      size, p2m_granule_pfn);;
+               release_resource(&p2m_resource);
+               goto out;
+       }
+       p2m_pte = (volatile const pte_t*)pfn_to_kaddr(p2m_assign_start_pfn);
+#ifdef CONFIG_XEN_IA64_EXPOSE_P2M_USE_DTR
+       if (xen_ia64_p2m_expose_use_dtr) {
+               p2m_itr_arg.vaddr = (unsigned long)__va(p2m_assign_start_pfn
+                                                       << PAGE_SHIFT);
+               p2m_itr_arg.pteval = pte_val(pfn_pte(p2m_assign_start_pfn,
+                                                    PAGE_KERNEL));
+               p2m_itr_arg.log_page_size = log_page_size;
+               smp_mb();
+               smp_call_function(&p2m_itr, &p2m_itr_arg, 1, 1);
+               p2m_itr(&p2m_itr_arg);
+       }
+#endif 
+       smp_mb();
+       p2m_initialized = 1;
+       printk(P2M_PREFIX "assign p2m table of [0x%016lx, 0x%016lx)\n",
+              p2m_convert_min_pfn << PAGE_SHIFT,
+              p2m_convert_max_pfn << PAGE_SHIFT);
+       printk(P2M_PREFIX "to [0x%016lx, 0x%016lx) (%ld KBytes)\n",
+              p2m_assign_start_pfn << PAGE_SHIFT,
+              p2m_assign_end_pfn << PAGE_SHIFT,
+              p2m_size / 1024);
+out:
+       unlock_cpu_hotplug();
+       return error;
+}
+
+#ifdef notyet
+void
+p2m_expose_cleanup(void)
+{
+       BUG_ON(!p2m_initialized);
+#ifdef CONFIG_XEN_IA64_EXPOSE_P2M_USE_DTR
+       unregister_cpu_notifier(&p2m_expose_dtr_hotplug_notifier);
+#endif
+       release_resource(&p2m_resource);
+}
+#endif
+
+//XXX inlinize?
+unsigned long
+p2m_phystomach(unsigned long gpfn)
+{
+       volatile const pte_t* pte;
+       unsigned long mfn;
+       unsigned long pteval;
+       
+       if (!p2m_initialized ||
+           gpfn < p2m_min_low_pfn || gpfn > p2m_max_low_pfn
+           /* || !pfn_valid(gpfn) */)
+               return INVALID_MFN;
+       pte = p2m_pte + (gpfn - p2m_convert_min_pfn);
+
+       mfn = INVALID_MFN;
+       if (likely(__get_user(pteval, (unsigned long __user *)pte) == 0 &&
+                  pte_present(__pte(pteval)) &&
+                  pte_pfn(__pte(pteval)) != (INVALID_MFN >> PAGE_SHIFT)))
+               mfn = (pteval & _PFN_MASK) >> PAGE_SHIFT;
+
+       return mfn;
+}
+
+EXPORT_SYMBOL_GPL(p2m_initialized);
+EXPORT_SYMBOL_GPL(p2m_min_low_pfn);
+EXPORT_SYMBOL_GPL(p2m_max_low_pfn);
+EXPORT_SYMBOL_GPL(p2m_convert_min_pfn);
+EXPORT_SYMBOL_GPL(p2m_convert_max_pfn);
+EXPORT_SYMBOL_GPL(p2m_pte);
+EXPORT_SYMBOL_GPL(p2m_phystomach);
+#endif
diff -r b30cb72ed5e2 -r 4d4f0d52c193 linux-2.6-xen-sparse/arch/ia64/xen/util.c
--- a/linux-2.6-xen-sparse/arch/ia64/xen/util.c Fri Nov 03 16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/arch/ia64/xen/util.c Thu Nov 09 15:37:17 2006 -0500
@@ -28,6 +28,8 @@
 #include <linux/vmalloc.h>
 #include <asm/uaccess.h>
 #include <xen/driver_util.h>
+#include <xen/interface/memory.h>
+#include <asm/hypercall.h>
 
 struct vm_struct *alloc_vm_area(unsigned long size)
 {
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/arch/ia64/xen/xensetup.S
--- a/linux-2.6-xen-sparse/arch/ia64/xen/xensetup.S     Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/arch/ia64/xen/xensetup.S     Thu Nov 09 15:37:17 
2006 -0500
@@ -23,12 +23,11 @@ GLOBAL_ENTRY(early_xen_setup)
        
        mov cr.iva=r10
 
-#if XSI_BASE != 0xf100000000000000UL
-       /* Backward compatibility.  */
-(isBP) mov r2=0x600
+       /* Set xsi base.  */
+#define FW_HYPERCALL_SET_SHARED_INFO_VA                        0x600
+(isBP) mov r2=FW_HYPERCALL_SET_SHARED_INFO_VA
 (isBP) movl r28=XSI_BASE;;
 (isBP) break 0x1000;;
-#endif
 
        br.ret.sptk.many rp
        ;;
@@ -38,18 +37,18 @@ END(early_xen_setup)
 
 /* Stub for suspend.
    Just force the stacked registers to be written in memory.  */       
-GLOBAL_ENTRY(HYPERVISOR_suspend)
+GLOBAL_ENTRY(xencomm_arch_hypercall_suspend)
+       mov r15=r32
+       ;; 
        alloc r20=ar.pfs,0,0,0,0
-       mov r14=2
-       mov r15=r12
-       ;;
+       mov r2=__HYPERVISOR_sched_op
+       ;; 
        /* We don't want to deal with RSE.  */
        flushrs
-       mov r2=__HYPERVISOR_sched_op
-       st4 [r12]=r14
+       mov r14=2 // SCHEDOP_shutdown
        ;;
        break 0x1000
        ;; 
        mov ar.pfs=r20
        br.ret.sptk.many b0
-END(HYPERVISOR_suspend)
+END(xencomm_arch_hypercall_suspend)
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/arch/x86_64/mm/init-xen.c
--- a/linux-2.6-xen-sparse/arch/x86_64/mm/init-xen.c    Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/arch/x86_64/mm/init-xen.c    Thu Nov 09 15:37:17 
2006 -0500
@@ -913,8 +913,8 @@ void __init mem_init(void)
 #endif
        /* XEN: init and count pages outside initial allocation. */
        for (pfn = xen_start_info->nr_pages; pfn < max_pfn; pfn++) {
-               ClearPageReserved(&mem_map[pfn]);
-               set_page_count(&mem_map[pfn], 1);
+               ClearPageReserved(pfn_to_page(pfn));
+               set_page_count(pfn_to_page(pfn), 1);
                totalram_pages++;
        }
        reservedpages = end_pfn - totalram_pages - e820_hole_size(0, end_pfn);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/char/tpm/tpm_xen.c
--- a/linux-2.6-xen-sparse/drivers/char/tpm/tpm_xen.c   Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/char/tpm/tpm_xen.c   Thu Nov 09 15:37:17 
2006 -0500
@@ -41,6 +41,7 @@
 #include <xen/evtchn.h>
 #include <xen/interface/grant_table.h>
 #include <xen/interface/io/tpmif.h>
+#include <xen/gnttab.h>
 #include <xen/xenbus.h>
 #include "tpm.h"
 #include "tpm_vtpm.h"
@@ -343,6 +344,7 @@ static void backend_changed(struct xenbu
        case XenbusStateInitialising:
        case XenbusStateInitWait:
        case XenbusStateInitialised:
+       case XenbusStateUnknown:
                break;
 
        case XenbusStateConnected:
@@ -351,13 +353,14 @@ static void backend_changed(struct xenbu
 
        case XenbusStateClosing:
                tpmif_set_connected_state(tp, 0);
+               xenbus_frontend_closed(dev);
                break;
 
-       case XenbusStateUnknown:
        case XenbusStateClosed:
+               tpmif_set_connected_state(tp, 0);
                if (tp->is_suspended == 0)
                        device_unregister(&dev->dev);
-               xenbus_switch_state(dev, XenbusStateClosed);
+               xenbus_frontend_closed(dev);
                break;
        }
 }
@@ -419,9 +422,10 @@ static int tpmfront_suspend(struct xenbu
        mutex_lock(&suspend_lock);
        tp->is_suspended = 1;
 
-       for (ctr = 0; atomic_read(&tp->tx_busy) && ctr <= 25; ctr++) {
+       for (ctr = 0; atomic_read(&tp->tx_busy) && ctr <= 300; ctr++) {
                if ((ctr % 10) == 0)
-                       printk("TPM-FE [INFO]: Waiting for outstanding 
request.\n");
+                       printk("TPM-FE [INFO]: Waiting for outstanding "
+                              "request.\n");
                /*
                 * Wait for a request to be responded to.
                 */
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/balloon/Makefile
--- a/linux-2.6-xen-sparse/drivers/xen/balloon/Makefile Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/balloon/Makefile Thu Nov 09 15:37:17 
2006 -0500
@@ -1,2 +1,2 @@
 
-obj-y += balloon.o
+obj-y := balloon.o sysfs.o
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/balloon/balloon.c
--- a/linux-2.6-xen-sparse/drivers/xen/balloon/balloon.c        Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/balloon/balloon.c        Thu Nov 09 
15:37:17 2006 -0500
@@ -53,10 +53,8 @@
 #include <asm/uaccess.h>
 #include <asm/tlb.h>
 #include <linux/list.h>
-
 #include <xen/xenbus.h>
-
-#define PAGES2KB(_p) ((_p)<<(PAGE_SHIFT-10))
+#include "common.h"
 
 #ifdef CONFIG_PROC_FS
 static struct proc_dir_entry *balloon_pde;
@@ -71,9 +69,7 @@ static DECLARE_MUTEX(balloon_mutex);
  */
 DEFINE_SPINLOCK(balloon_lock);
 
-/* We aim for 'current allocation' == 'target allocation'. */
-static unsigned long current_pages;
-static unsigned long target_pages;
+struct balloon_stats balloon_stats;
 
 /* We increase/decrease in batches which fit in a page */
 static unsigned long frame_list[PAGE_SIZE / sizeof(unsigned long)];
@@ -81,18 +77,8 @@ static unsigned long frame_list[PAGE_SIZ
 /* VM /proc information for memory */
 extern unsigned long totalram_pages;
 
-/* We may hit the hard limit in Xen. If we do then we remember it. */
-static unsigned long hard_limit;
-
-/*
- * Drivers may alter the memory reservation independently, but they must
- * inform the balloon driver so that we can avoid hitting the hard limit.
- */
-static unsigned long driver_pages;
-
 /* List of ballooned pages, threaded through the mem_map array. */
 static LIST_HEAD(ballooned_pages);
-static unsigned long balloon_low, balloon_high;
 
 /* Main work function, always executed in process context. */
 static void balloon_process(void *unused);
@@ -124,10 +110,10 @@ static void balloon_append(struct page *
        /* Lowmem is re-populated first, so highmem pages go at list tail. */
        if (PageHighMem(page)) {
                list_add_tail(PAGE_TO_LIST(page), &ballooned_pages);
-               balloon_high++;
+               bs.balloon_high++;
        } else {
                list_add(PAGE_TO_LIST(page), &ballooned_pages);
-               balloon_low++;
+               bs.balloon_low++;
        }
 }
 
@@ -143,9 +129,9 @@ static struct page *balloon_retrieve(voi
        UNLIST_PAGE(page);
 
        if (PageHighMem(page))
-               balloon_high--;
+               bs.balloon_high--;
        else
-               balloon_low--;
+               bs.balloon_low--;
 
        return page;
 }
@@ -172,9 +158,9 @@ static void balloon_alarm(unsigned long 
 
 static unsigned long current_target(void)
 {
-       unsigned long target = min(target_pages, hard_limit);
-       if (target > (current_pages + balloon_low + balloon_high))
-               target = current_pages + balloon_low + balloon_high;
+       unsigned long target = min(bs.target_pages, bs.hard_limit);
+       if (target > (bs.current_pages + bs.balloon_low + bs.balloon_high))
+               target = bs.current_pages + bs.balloon_low + bs.balloon_high;
        return target;
 }
 
@@ -216,7 +202,8 @@ static int increase_reservation(unsigned
                        BUG_ON(ret != rc);
                }
                if (rc >= 0)
-                       hard_limit = current_pages + rc - driver_pages;
+                       bs.hard_limit = (bs.current_pages + rc -
+                                        bs.driver_pages);
                goto out;
        }
 
@@ -248,8 +235,8 @@ static int increase_reservation(unsigned
                __free_page(page);
        }
 
-       current_pages += nr_pages;
-       totalram_pages = current_pages;
+       bs.current_pages += nr_pages;
+       totalram_pages = bs.current_pages;
 
  out:
        balloon_unlock(flags);
@@ -317,8 +304,8 @@ static int decrease_reservation(unsigned
        ret = HYPERVISOR_memory_op(XENMEM_decrease_reservation, &reservation);
        BUG_ON(ret != nr_pages);
 
-       current_pages -= nr_pages;
-       totalram_pages = current_pages;
+       bs.current_pages -= nr_pages;
+       totalram_pages = bs.current_pages;
 
        balloon_unlock(flags);
 
@@ -339,7 +326,7 @@ static void balloon_process(void *unused
        down(&balloon_mutex);
 
        do {
-               credit = current_target() - current_pages;
+               credit = current_target() - bs.current_pages;
                if (credit > 0)
                        need_sleep = (increase_reservation(credit) != 0);
                if (credit < 0)
@@ -352,18 +339,18 @@ static void balloon_process(void *unused
        } while ((credit != 0) && !need_sleep);
 
        /* Schedule more work if there is some still to be done. */
-       if (current_target() != current_pages)
+       if (current_target() != bs.current_pages)
                mod_timer(&balloon_timer, jiffies + HZ);
 
        up(&balloon_mutex);
 }
 
 /* Resets the Xen limit, sets new target, and kicks off processing. */
-static void set_new_target(unsigned long target)
+void balloon_set_new_target(unsigned long target)
 {
        /* No need for lock. Not read-modify-write updates. */
-       hard_limit   = ~0UL;
-       target_pages = target;
+       bs.hard_limit   = ~0UL;
+       bs.target_pages = target;
        schedule_work(&balloon_worker);
 }
 
@@ -388,7 +375,7 @@ static void watch_target(struct xenbus_w
        /* The given memory/target value is in KiB, so it needs converting to
         * pages. PAGE_SHIFT converts bytes to pages, hence PAGE_SHIFT - 10.
         */
-       set_new_target(new_target >> (PAGE_SHIFT - 10));
+       balloon_set_new_target(new_target >> (PAGE_SHIFT - 10));
 }
 
 static int balloon_init_watcher(struct notifier_block *notifier,
@@ -424,7 +411,7 @@ static int balloon_write(struct file *fi
        memstring[sizeof(memstring)-1] = '\0';
 
        target_bytes = memparse(memstring, &endchar);
-       set_new_target(target_bytes >> PAGE_SHIFT);
+       balloon_set_new_target(target_bytes >> PAGE_SHIFT);
 
        return count;
 }
@@ -442,12 +429,13 @@ static int balloon_read(char *page, char
                "High-mem balloon:   %8lu kB\n"
                "Driver pages:       %8lu kB\n"
                "Xen hard limit:     ",
-               PAGES2KB(current_pages), PAGES2KB(target_pages), 
-               PAGES2KB(balloon_low), PAGES2KB(balloon_high),
-               PAGES2KB(driver_pages));
-
-       if (hard_limit != ~0UL)
-               len += sprintf(page + len, "%8lu kB\n", PAGES2KB(hard_limit));
+               PAGES2KB(bs.current_pages), PAGES2KB(bs.target_pages), 
+               PAGES2KB(bs.balloon_low), PAGES2KB(bs.balloon_high),
+               PAGES2KB(bs.driver_pages));
+
+       if (bs.hard_limit != ~0UL)
+               len += sprintf(page + len, "%8lu kB\n",
+                              PAGES2KB(bs.hard_limit));
        else
                len += sprintf(page + len, "     ??? kB\n");
 
@@ -468,13 +456,13 @@ static int __init balloon_init(void)
 
        IPRINTK("Initialising balloon driver.\n");
 
-       current_pages = min(xen_start_info->nr_pages, max_pfn);
-       totalram_pages = current_pages;
-       target_pages  = current_pages;
-       balloon_low   = 0;
-       balloon_high  = 0;
-       driver_pages  = 0UL;
-       hard_limit    = ~0UL;
+       bs.current_pages = min(xen_start_info->nr_pages, max_pfn);
+       totalram_pages   = bs.current_pages;
+       bs.target_pages  = bs.current_pages;
+       bs.balloon_low   = 0;
+       bs.balloon_high  = 0;
+       bs.driver_pages  = 0UL;
+       bs.hard_limit    = ~0UL;
 
        init_timer(&balloon_timer);
        balloon_timer.data = 0;
@@ -489,6 +477,7 @@ static int __init balloon_init(void)
        balloon_pde->read_proc  = balloon_read;
        balloon_pde->write_proc = balloon_write;
 #endif
+       balloon_sysfs_init();
     
        /* Initialise the balloon with excess memory space. */
        for (pfn = xen_start_info->nr_pages; pfn < max_pfn; pfn++) {
@@ -512,7 +501,7 @@ void balloon_update_driver_allowance(lon
        unsigned long flags;
 
        balloon_lock(flags);
-       driver_pages += delta;
+       bs.driver_pages += delta;
        balloon_unlock(flags);
 }
 
@@ -578,7 +567,7 @@ struct page **alloc_empty_pages_and_page
                        goto err;
                }
 
-               totalram_pages = --current_pages;
+               totalram_pages = --bs.current_pages;
 
                balloon_unlock(flags);
        }
@@ -624,7 +613,7 @@ void balloon_release_driver_page(struct 
 
        balloon_lock(flags);
        balloon_append(page);
-       driver_pages--;
+       bs.driver_pages--;
        balloon_unlock(flags);
 
        schedule_work(&balloon_worker);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c
--- a/linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c        Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c        Thu Nov 09 
15:37:17 2006 -0500
@@ -293,7 +293,7 @@ static int do_block_io_op(blkif_t *blkif
 static int do_block_io_op(blkif_t *blkif)
 {
        blkif_back_ring_t *blk_ring = &blkif->blk_ring;
-       blkif_request_t *req;
+       blkif_request_t req;
        pending_req_t *pending_req;
        RING_IDX rc, rp;
        int more_to_do = 0;
@@ -311,22 +311,22 @@ static int do_block_io_op(blkif_t *blkif
                        break;
                }
 
-               req = RING_GET_REQUEST(blk_ring, rc);
+               memcpy(&req, RING_GET_REQUEST(blk_ring, rc), sizeof(req));
                blk_ring->req_cons = ++rc; /* before make_response() */
 
-               switch (req->operation) {
+               switch (req.operation) {
                case BLKIF_OP_READ:
                        blkif->st_rd_req++;
-                       dispatch_rw_block_io(blkif, req, pending_req);
+                       dispatch_rw_block_io(blkif, &req, pending_req);
                        break;
                case BLKIF_OP_WRITE:
                        blkif->st_wr_req++;
-                       dispatch_rw_block_io(blkif, req, pending_req);
+                       dispatch_rw_block_io(blkif, &req, pending_req);
                        break;
                default:
                        DPRINTK("error: unknown block io operation [%d]\n",
-                               req->operation);
-                       make_response(blkif, req->id, req->operation,
+                               req.operation);
+                       make_response(blkif, req.id, req.operation,
                                      BLKIF_RSP_ERROR);
                        free_req(pending_req);
                        break;
@@ -375,7 +375,7 @@ static void dispatch_rw_block_io(blkif_t
                        req->seg[i].first_sect + 1;
 
                if ((req->seg[i].last_sect >= (PAGE_SIZE >> 9)) ||
-                   (seg[i].nsec <= 0))
+                   (req->seg[i].last_sect < req->seg[i].first_sect))
                        goto fail_response;
                preq.nr_sects += seg[i].nsec;
 
@@ -392,16 +392,24 @@ static void dispatch_rw_block_io(blkif_t
        for (i = 0; i < nseg; i++) {
                if (unlikely(map[i].status != 0)) {
                        DPRINTK("invalid buffer -- could not remap it\n");
-                       goto fail_flush;
+                       map[i].handle = BLKBACK_INVALID_HANDLE;
+                       ret |= 1;
                }
 
                pending_handle(pending_req, i) = map[i].handle;
+
+               if (ret)
+                       continue;
+
                set_phys_to_machine(__pa(vaddr(
                        pending_req, i)) >> PAGE_SHIFT,
                        FOREIGN_FRAME(map[i].dev_bus_addr >> PAGE_SHIFT));
                seg[i].buf  = map[i].dev_bus_addr | 
                        (req->seg[i].first_sect << 9);
        }
+
+       if (ret)
+               goto fail_flush;
 
        if (vbd_translate(&preq, blkif, operation) != 0) {
                DPRINTK("access denied: %s of [%llu,%llu] on dev=%04x\n", 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/blkfront/blkfront.c
--- a/linux-2.6-xen-sparse/drivers/xen/blkfront/blkfront.c      Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/blkfront/blkfront.c      Thu Nov 09 
15:37:17 2006 -0500
@@ -48,6 +48,10 @@
 #include <asm/hypervisor.h>
 #include <asm/maddr.h>
 
+#ifdef HAVE_XEN_PLATFORM_COMPAT_H
+#include <xen/platform-compat.h>
+#endif
+
 #define BLKIF_STATE_DISCONNECTED 0
 #define BLKIF_STATE_CONNECTED    1
 #define BLKIF_STATE_SUSPENDED    2
@@ -468,6 +472,27 @@ int blkif_ioctl(struct inode *inode, str
                      command, (long)argument, inode->i_rdev);
 
        switch (command) {
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,16)
+       case HDIO_GETGEO: {
+               struct block_device *bd = inode->i_bdev;
+               struct hd_geometry geo;
+               int ret;
+
+                if (!argument)
+                        return -EINVAL;
+
+               geo.start = get_start_sect(bd);
+               ret = blkif_getgeo(bd, &geo);
+               if (ret)
+                       return ret;
+
+               if (copy_to_user((struct hd_geometry __user *)argument, &geo,
+                                sizeof(geo)))
+                        return -EFAULT;
+
+                return 0;
+       }
+#endif
        case CDROMMULTISESSION:
                DPRINTK("FIXME: support multisession CDs later\n");
                for (i = 0; i < sizeof(struct cdrom_multisession); i++)
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/blkfront/vbd.c
--- a/linux-2.6-xen-sparse/drivers/xen/blkfront/vbd.c   Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/blkfront/vbd.c   Thu Nov 09 15:37:17 
2006 -0500
@@ -36,6 +36,10 @@
 #include <linux/blkdev.h>
 #include <linux/list.h>
 
+#ifdef HAVE_XEN_PLATFORM_COMPAT_H
+#include <xen/platform-compat.h>
+#endif
+
 #define BLKIF_MAJOR(dev) ((dev)>>8)
 #define BLKIF_MINOR(dev) ((dev) & 0xff)
 
@@ -91,7 +95,9 @@ static struct block_device_operations xl
        .open = blkif_open,
        .release = blkif_release,
        .ioctl  = blkif_ioctl,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,16)
        .getgeo = blkif_getgeo
+#endif
 };
 
 DEFINE_SPINLOCK(blkif_io_lock);
@@ -186,7 +192,11 @@ xlvbd_init_blk_queue(struct gendisk *gd,
        if (rq == NULL)
                return -1;
 
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,10)
        elevator_init(rq, "noop");
+#else
+       elevator_init(rq, &elevator_noop);
+#endif
 
        /* Hard sector size and max sectors impersonate the equiv. hardware. */
        blk_queue_hardsect_size(rq, sector_size);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/blktap/blktap.c
--- a/linux-2.6-xen-sparse/drivers/xen/blktap/blktap.c  Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/blktap/blktap.c  Thu Nov 09 15:37:17 
2006 -0500
@@ -9,6 +9,9 @@
  * Based on the blkback driver code.
  * 
  * Copyright (c) 2004-2005, Andrew Warfield and Julian Chesterfield
+ *
+ * Clean ups and fix ups:
+ *    Copyright (c) 2006, Steven Rostedt - Red Hat, Inc.
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License version 2
@@ -51,7 +54,7 @@
 #include <asm/tlbflush.h>
 #include <linux/devfs_fs_kernel.h>
 
-#define MAX_TAP_DEV 100     /*the maximum number of tapdisk ring devices    */
+#define MAX_TAP_DEV 256     /*the maximum number of tapdisk ring devices    */
 #define MAX_DEV_NAME 100    /*the max tapdisk ring device name e.g. blktap0 */
 
 
@@ -90,8 +93,9 @@ int setup_xen_class(void)
  * mmap_alloc is initialised to 2 and should be adjustable on the fly via
  * sysfs.
  */
-#define MAX_DYNAMIC_MEM 64
-#define MAX_PENDING_REQS 64   
+#define BLK_RING_SIZE          __RING_SIZE((blkif_sring_t *)0, PAGE_SIZE)
+#define MAX_DYNAMIC_MEM                BLK_RING_SIZE
+#define MAX_PENDING_REQS       BLK_RING_SIZE
 #define MMAP_PAGES (MAX_PENDING_REQS * BLKIF_MAX_SEGMENTS_PER_REQUEST)
 #define MMAP_VADDR(_start, _req,_seg)                                   \
         (_start +                                                       \
@@ -104,6 +108,12 @@ static int mmap_pages = MMAP_PAGES;
                      * have a bunch of pages reserved for shared
                      * memory rings.
                      */
+
+/*Data struct handed back to userspace for tapdisk device to VBD mapping*/
+typedef struct domid_translate {
+       unsigned short domid;
+       unsigned short busid;
+} domid_translate_t ;
 
 /*Data struct associated with each of the tapdisk devices*/
 typedef struct tap_blkif {
@@ -123,17 +133,11 @@ typedef struct tap_blkif {
        unsigned long *idx_map;       /*Record the user ring id to kern 
                                        [req id, idx] tuple                  */
        blkif_t *blkif;               /*Associate blkif with tapdev          */
-       int sysfs_set;                /*Set if it has a class device.        */
+       struct domid_translate trans; /*Translation from domid to bus.       */
 } tap_blkif_t;
 
-/*Data struct handed back to userspace for tapdisk device to VBD mapping*/
-typedef struct domid_translate {
-       unsigned short domid;
-       unsigned short busid;
-} domid_translate_t ;
-
-static domid_translate_t  translate_domid[MAX_TAP_DEV];
-static tap_blkif_t *tapfds[MAX_TAP_DEV];
+static struct tap_blkif *tapfds[MAX_TAP_DEV];
+static int blktap_next_minor;
 
 static int __init set_blkif_reqs(char *str)
 {
@@ -212,6 +216,7 @@ struct grant_handle_pair
         grant_handle_t kernel;
         grant_handle_t user;
 };
+#define INVALID_GRANT_HANDLE   0xFFFF
 
 static struct grant_handle_pair 
     pending_grant_handles[MAX_DYNAMIC_MEM][MMAP_PAGES];
@@ -290,10 +295,11 @@ static inline int GET_NEXT_REQ(unsigned 
 
 
 #define BLKTAP_INVALID_HANDLE(_g) \
-    (((_g->kernel) == 0xFFFF) && ((_g->user) == 0xFFFF))
+    (((_g->kernel) == INVALID_GRANT_HANDLE) &&  \
+     ((_g->user) == INVALID_GRANT_HANDLE))
 
 #define BLKTAP_INVALIDATE_HANDLE(_g) do {       \
-    (_g)->kernel = 0xFFFF; (_g)->user = 0xFFFF; \
+    (_g)->kernel = INVALID_GRANT_HANDLE; (_g)->user = INVALID_GRANT_HANDLE; \
     } while(0)
 
 
@@ -322,7 +328,7 @@ struct vm_operations_struct blktap_vm_op
  */
  
 /*Function Declarations*/
-static int get_next_free_dev(void);
+static tap_blkif_t *get_next_free_dev(void);
 static int blktap_open(struct inode *inode, struct file *filp);
 static int blktap_release(struct inode *inode, struct file *filp);
 static int blktap_mmap(struct file *filp, struct vm_area_struct *vma);
@@ -340,51 +346,96 @@ static struct file_operations blktap_fop
 };
 
 
-static int get_next_free_dev(void)
+static tap_blkif_t *get_next_free_dev(void)
 {
        tap_blkif_t *info;
-       int i = 0, ret = -1;
-       unsigned long flags;
-
-       spin_lock_irqsave(&pending_free_lock, flags);
-       
-       while (i < MAX_TAP_DEV) {
+       int minor;
+
+       /*
+        * This is called only from the ioctl, which
+        * means we should always have interrupts enabled.
+        */
+       BUG_ON(irqs_disabled());
+
+       spin_lock_irq(&pending_free_lock);
+
+       /* tapfds[0] is always NULL */
+
+       for (minor = 1; minor < blktap_next_minor; minor++) {
+               info = tapfds[minor];
+               /* we could have failed a previous attempt. */
+               if (!info ||
+                   ((info->dev_inuse == 0) &&
+                    (info->dev_pending == 0)) ) {
+                       info->dev_pending = 1;
+                       goto found;
+               }
+       }
+       info = NULL;
+       minor = -1;
+
+       /*
+        * We didn't find free device. If we can still allocate
+        * more, then we grab the next device minor that is
+        * available.  This is done while we are still under
+        * the protection of the pending_free_lock.
+        */
+       if (blktap_next_minor < MAX_TAP_DEV)
+               minor = blktap_next_minor++;
+found:
+       spin_unlock_irq(&pending_free_lock);
+
+       if (!info && minor > 0) {
+               info = kzalloc(sizeof(*info), GFP_KERNEL);
+               if (unlikely(!info)) {
+                       /*
+                        * If we failed here, try to put back
+                        * the next minor number. But if one
+                        * was just taken, then we just lose this
+                        * minor.  We can try to allocate this
+                        * minor again later.
+                        */
+                       spin_lock_irq(&pending_free_lock);
+                       if (blktap_next_minor == minor+1)
+                               blktap_next_minor--;
+                       spin_unlock_irq(&pending_free_lock);
+                       goto out;
+               }
+
+               info->minor = minor;
+               /*
+                * Make sure that we have a minor before others can
+                * see us.
+                */
+               wmb();
+               tapfds[minor] = info;
+
+               class_device_create(xen_class, NULL,
+                                   MKDEV(blktap_major, minor), NULL,
+                                   "blktap%d", minor);
+               devfs_mk_cdev(MKDEV(blktap_major, minor),
+                       S_IFCHR|S_IRUGO|S_IWUSR, "xen/blktap%d", minor);
+       }
+
+out:
+       return info;
+}
+
+int dom_to_devid(domid_t domid, int xenbus_id, blkif_t *blkif) 
+{
+       tap_blkif_t *info;
+       int i;
+
+       for (i = 1; i < blktap_next_minor; i++) {
                info = tapfds[i];
-               if ( (tapfds[i] != NULL) && (info->dev_inuse == 0)
-                       && (info->dev_pending == 0) ) {
-                       info->dev_pending = 1;
-                       ret = i;
-                       goto done;
-               }
-               i++;
-       }
-       
-done:
-       spin_unlock_irqrestore(&pending_free_lock, flags);
-
-       /*
-        * We are protected by having the dev_pending set.
-        */
-       if (!tapfds[i]->sysfs_set && xen_class) {
-               class_device_create(xen_class, NULL,
-                                   MKDEV(blktap_major, ret), NULL,
-                                   "blktap%d", ret);
-               tapfds[i]->sysfs_set = 1;
-       }
-       return ret;
-}
-
-int dom_to_devid(domid_t domid, int xenbus_id, blkif_t *blkif) 
-{
-       int i;
-               
-       for (i = 0; i < MAX_TAP_DEV; i++)
-               if ( (translate_domid[i].domid == domid)
-                   && (translate_domid[i].busid == xenbus_id) ) {
-                       tapfds[i]->blkif = blkif;
-                       tapfds[i]->status = RUNNING;
+               if ( info &&
+                    (info->trans.domid == domid) &&
+                    (info->trans.busid == xenbus_id) ) {
+                       info->blkif = blkif;
+                       info->status = RUNNING;
                        return i;
                }
+       }
        return -1;
 }
 
@@ -394,12 +445,16 @@ void signal_tapdisk(int idx)
        struct task_struct *ptask;
 
        info = tapfds[idx];
-       if ( (idx > 0) && (idx < MAX_TAP_DEV) && (info->pid > 0) ) {
+       if ((idx < 0) || (idx > MAX_TAP_DEV) || !info)
+               return;
+
+       if (info->pid > 0) {
                ptask = find_task_by_pid(info->pid);
                if (ptask)
                        info->status = CLEANSHUTDOWN;
        }
        info->blkif = NULL;
+
        return;
 }
 
@@ -410,14 +465,19 @@ static int blktap_open(struct inode *ino
        tap_blkif_t *info;
        int i;
        
-       if (tapfds[idx] == NULL) {
+       /* ctrl device, treat differently */
+       if (!idx)
+               return 0;
+
+       info = tapfds[idx];
+
+       if ((idx < 0) || (idx > MAX_TAP_DEV) || !info) {
                WPRINTK("Unable to open device /dev/xen/blktap%d\n",
-                      idx);
-               return -ENOMEM;
-       }
+                       idx);
+               return -ENODEV;
+       }
+
        DPRINTK("Opening device /dev/xen/blktap%d\n",idx);
-       
-       info = tapfds[idx];
        
        /*Only one process can access device at a time*/
        if (test_and_set_bit(0, &info->dev_inuse))
@@ -458,12 +518,10 @@ static int blktap_release(struct inode *
 {
        tap_blkif_t *info = filp->private_data;
        
-       /* can this ever happen? - sdr */
-       if (!info) {
-               WPRINTK("Trying to free device that doesn't exist "
-                      "[/dev/xen/blktap%d]\n",iminor(inode) - BLKTAP_MINOR);
-               return -EBADF;
-       }
+       /* check for control device */
+       if (!info)
+               return 0;
+
        info->dev_inuse = 0;
        DPRINTK("Freeing device [/dev/xen/blktap%d]\n",info->minor);
 
@@ -480,8 +538,10 @@ static int blktap_release(struct inode *
        }
        
        if ( (info->status != CLEANSHUTDOWN) && (info->blkif != NULL) ) {
-               kthread_stop(info->blkif->xenblkd);
-               info->blkif->xenblkd = NULL;
+               if (info->blkif->xenblkd != NULL) {
+                       kthread_stop(info->blkif->xenblkd);
+                       info->blkif->xenblkd = NULL;
+               }
                info->status = CLEANSHUTDOWN;
        }       
        return 0;
@@ -533,8 +593,6 @@ static int blktap_mmap(struct file *filp
        info->user_vstart  = info->rings_vstart + (RING_PAGES << PAGE_SHIFT);
     
        /* Map the ring pages to the start of the region and reserve it. */
-       vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
-
        if (remap_pfn_range(vma, vma->vm_start, 
                            __pa(info->ufe_ring.sring) >> PAGE_SHIFT, 
                            PAGE_SIZE, vma->vm_page_prot)) {
@@ -619,33 +677,31 @@ static int blktap_ioctl(struct inode *in
        {               
                uint64_t val = (uint64_t)arg;
                domid_translate_t *tr = (domid_translate_t *)&val;
-               int newdev;
 
                DPRINTK("NEWINTF Req for domid %d and bus id %d\n", 
                       tr->domid, tr->busid);
-               newdev = get_next_free_dev();
-               if (newdev < 1) {
+               info = get_next_free_dev();
+               if (!info) {
                        WPRINTK("Error initialising /dev/xen/blktap - "
                                "No more devices\n");
                        return -1;
                }
-               translate_domid[newdev].domid = tr->domid;
-               translate_domid[newdev].busid = tr->busid;
-               return newdev;
+               info->trans.domid = tr->domid;
+               info->trans.busid = tr->busid;
+               return info->minor;
        }
        case BLKTAP_IOCTL_FREEINTF:
        {
                unsigned long dev = arg;
                unsigned long flags;
 
-               /* Looking at another device */
-               info = NULL;
-
-               if ( (dev > 0) && (dev < MAX_TAP_DEV) )
-                       info = tapfds[dev];
+               info = tapfds[dev];
+
+               if ((dev > MAX_TAP_DEV) || !info)
+                       return 0; /* should this be an error? */
 
                spin_lock_irqsave(&pending_free_lock, flags);
-               if ( (info != NULL) && (info->dev_pending) )
+               if (info->dev_pending)
                        info->dev_pending = 0;
                spin_unlock_irqrestore(&pending_free_lock, flags);
 
@@ -655,16 +711,12 @@ static int blktap_ioctl(struct inode *in
        {
                unsigned long dev = arg;
 
-               /* Looking at another device */
-               info = NULL;
-               
-               if ( (dev > 0) && (dev < MAX_TAP_DEV) )
-                       info = tapfds[dev];
-               
-               if (info != NULL)
-                       return info->minor;
-               else
-                       return -1;
+               info = tapfds[dev];
+
+               if ((dev > MAX_TAP_DEV) || !info)
+                       return -EINVAL;
+
+               return info->minor;
        }
        case BLKTAP_IOCTL_MAJOR:
                return blktap_major;
@@ -683,13 +735,8 @@ static unsigned int blktap_poll(struct f
 {
        tap_blkif_t *info = filp->private_data;
        
-       if (!info) {
-               WPRINTK(" poll, retrieving idx failed\n");
-               return 0;
-       }
-
        /* do not work on the control device */
-       if (!info->minor)
+       if (!info)
                return 0;
 
        poll_wait(filp, &info->wait, wait);
@@ -704,13 +751,12 @@ void blktap_kick_user(int idx)
 {
        tap_blkif_t *info;
 
-       if (idx == 0)
+       info = tapfds[idx];
+
+       if ((idx < 0) || (idx > MAX_TAP_DEV) || !info)
                return;
-       
-       info = tapfds[idx];
-       
-       if (info != NULL)
-               wake_up_interruptible(&info->wait);
+
+       wake_up_interruptible(&info->wait);
 
        return;
 }
@@ -822,8 +868,8 @@ static void free_req(pending_req_t *req)
                wake_up(&pending_free_wq);
 }
 
-static void fast_flush_area(pending_req_t *req, int k_idx, int u_idx, int 
-                           tapidx)
+static void fast_flush_area(pending_req_t *req, int k_idx, int u_idx,
+                           int tapidx)
 {
        struct gnttab_unmap_grant_ref unmap[BLKIF_MAX_SEGMENTS_PER_REQUEST*2];
        unsigned int i, invcount = 0;
@@ -831,13 +877,25 @@ static void fast_flush_area(pending_req_
        uint64_t ptep;
        int ret, mmap_idx;
        unsigned long kvaddr, uvaddr;
-
-       tap_blkif_t *info = tapfds[tapidx];
+       tap_blkif_t *info;
        
-       if (info == NULL) {
+
+       info = tapfds[tapidx];
+
+       if ((tapidx < 0) || (tapidx > MAX_TAP_DEV) || !info) {
                WPRINTK("fast_flush: Couldn't get info!\n");
                return;
        }
+
+       if (info->vma != NULL &&
+           xen_feature(XENFEAT_auto_translated_physmap)) {
+               down_write(&info->vma->vm_mm->mmap_sem);
+               zap_page_range(info->vma, 
+                              MMAP_VADDR(info->user_vstart, u_idx, 0), 
+                              req->nr_pages << PAGE_SHIFT, NULL);
+               up_write(&info->vma->vm_mm->mmap_sem);
+       }
+
        mmap_idx = req->mem_idx;
 
        for (i = 0; i < req->nr_pages; i++) {
@@ -845,35 +903,39 @@ static void fast_flush_area(pending_req_
                uvaddr = MMAP_VADDR(info->user_vstart, u_idx, i);
 
                khandle = &pending_handle(mmap_idx, k_idx, i);
-               if (BLKTAP_INVALID_HANDLE(khandle)) {
-                       WPRINTK("BLKTAP_INVALID_HANDLE\n");
-                       continue;
-               }
-               gnttab_set_unmap_op(&unmap[invcount], 
-                                   idx_to_kaddr(mmap_idx, k_idx, i), 
-                                   GNTMAP_host_map, khandle->kernel);
-               invcount++;
-
-               if (create_lookup_pte_addr(
-                   info->vma->vm_mm,
-                   MMAP_VADDR(info->user_vstart, u_idx, i), 
-                   &ptep) !=0) {
-                       WPRINTK("Couldn't get a pte addr!\n");
-                       return;
-               }
-
-               gnttab_set_unmap_op(&unmap[invcount], 
-                       ptep, GNTMAP_host_map,
-                       khandle->user);
-               invcount++;
-            
+
+               if (khandle->kernel != INVALID_GRANT_HANDLE) {
+                       gnttab_set_unmap_op(&unmap[invcount],
+                                           idx_to_kaddr(mmap_idx, k_idx, i),
+                                           GNTMAP_host_map, khandle->kernel);
+                       invcount++;
+               }
+
+               if (khandle->user != INVALID_GRANT_HANDLE) {
+                       BUG_ON(xen_feature(XENFEAT_auto_translated_physmap));
+                       if (create_lookup_pte_addr(
+                               info->vma->vm_mm,
+                               MMAP_VADDR(info->user_vstart, u_idx, i),
+                               &ptep) !=0) {
+                               WPRINTK("Couldn't get a pte addr!\n");
+                               return;
+                       }
+
+                       gnttab_set_unmap_op(&unmap[invcount], ptep,
+                                           GNTMAP_host_map
+                                           | GNTMAP_application_map
+                                           | GNTMAP_contains_pte,
+                                           khandle->user);
+                       invcount++;
+               }
+
                BLKTAP_INVALIDATE_HANDLE(khandle);
        }
        ret = HYPERVISOR_grant_table_op(
                GNTTABOP_unmap_grant_ref, unmap, invcount);
        BUG_ON(ret);
        
-       if (info->vma != NULL)
+       if (info->vma != NULL && !xen_feature(XENFEAT_auto_translated_physmap))
                zap_page_range(info->vma, 
                               MMAP_VADDR(info->user_vstart, u_idx, 0), 
                               req->nr_pages << PAGE_SHIFT, NULL);
@@ -957,11 +1019,14 @@ static int blktap_read_ufe_ring(tap_blki
        rmb();
         
        for (i = info->ufe_ring.rsp_cons; i != rp; i++) {
+               blkif_response_t res;
                resp = RING_GET_RESPONSE(&info->ufe_ring, i);
+               memcpy(&res, resp, sizeof(res));
+               mb(); /* rsp_cons read by RING_FULL() in do_block_io_op(). */
                ++info->ufe_ring.rsp_cons;
 
                /*retrieve [usr_idx] to [mmap_idx,pending_idx] mapping*/
-               usr_idx = (int)resp->id;
+               usr_idx = (int)res.id;
                pending_idx = MASK_PEND_IDX(ID_TO_IDX(info->idx_map[usr_idx]));
                mmap_idx = ID_TO_MIDX(info->idx_map[usr_idx]);
 
@@ -994,8 +1059,8 @@ static int blktap_read_ufe_ring(tap_blki
                        map[offset] = NULL;
                }
                fast_flush_area(pending_req, pending_idx, usr_idx, info->minor);
-               make_response(blkif, pending_req->id, resp->operation,
-                             resp->status);
+               make_response(blkif, pending_req->id, res.operation,
+                             res.status);
                info->idx_map[usr_idx] = INVALID_REQ;
                blkif_put(pending_req->blkif);
                free_req(pending_req);
@@ -1030,7 +1095,7 @@ static int do_block_io_op(blkif_t *blkif
 static int do_block_io_op(blkif_t *blkif)
 {
        blkif_back_ring_t *blk_ring = &blkif->blk_ring;
-       blkif_request_t *req;
+       blkif_request_t req;
        pending_req_t *pending_req;
        RING_IDX rc, rp;
        int more_to_do = 0;
@@ -1041,7 +1106,7 @@ static int do_block_io_op(blkif_t *blkif
        rmb(); /* Ensure we see queued requests up to 'rp'. */
 
        /*Check blkif has corresponding UE ring*/
-       if (blkif->dev_num == -1) {
+       if (blkif->dev_num < 0) {
                /*oops*/
                if (print_dbug) {
                        WPRINTK("Corresponding UE " 
@@ -1052,7 +1117,8 @@ static int do_block_io_op(blkif_t *blkif
        }
 
        info = tapfds[blkif->dev_num];
-       if (info == NULL || !info->dev_inuse) {
+
+       if (blkif->dev_num > MAX_TAP_DEV || !info || !info->dev_inuse) {
                if (print_dbug) {
                        WPRINTK("Can't get UE info!\n");
                        print_dbug = 0;
@@ -1082,24 +1148,24 @@ static int do_block_io_op(blkif_t *blkif
                        break;
                }
 
-               req = RING_GET_REQUEST(blk_ring, rc);
+               memcpy(&req, RING_GET_REQUEST(blk_ring, rc), sizeof(req));
                blk_ring->req_cons = ++rc; /* before make_response() */ 
 
-               switch (req->operation) {
+               switch (req.operation) {
                case BLKIF_OP_READ:
                        blkif->st_rd_req++;
-                       dispatch_rw_block_io(blkif, req, pending_req);
+                       dispatch_rw_block_io(blkif, &req, pending_req);
                        break;
 
                case BLKIF_OP_WRITE:
                        blkif->st_wr_req++;
-                       dispatch_rw_block_io(blkif, req, pending_req);
+                       dispatch_rw_block_io(blkif, &req, pending_req);
                        break;
 
                default:
                        WPRINTK("unknown operation [%d]\n",
-                               req->operation);
-                       make_response(blkif, req->id, req->operation,
+                               req.operation);
+                       make_response(blkif, req.id, req.operation,
                                      BLKIF_RSP_ERROR);
                        free_req(pending_req);
                        break;
@@ -1120,17 +1186,27 @@ static void dispatch_rw_block_io(blkif_t
        struct gnttab_map_grant_ref map[BLKIF_MAX_SEGMENTS_PER_REQUEST*2];
        unsigned int nseg;
        int ret, i;
-       tap_blkif_t *info = tapfds[blkif->dev_num];
+       tap_blkif_t *info;
        uint64_t sector;
-       
        blkif_request_t *target;
        int pending_idx = RTN_PEND_IDX(pending_req,pending_req->mem_idx);
-       int usr_idx = GET_NEXT_REQ(info->idx_map);
+       int usr_idx;
        uint16_t mmap_idx = pending_req->mem_idx;
 
-       /*Check we have space on user ring - should never fail*/
-       if(usr_idx == INVALID_REQ) goto fail_flush;
-       
+       if (blkif->dev_num < 0 || blkif->dev_num > MAX_TAP_DEV)
+               goto fail_response;
+
+       info = tapfds[blkif->dev_num];
+       if (info == NULL)
+               goto fail_response;
+
+       /* Check we have space on user ring - should never fail. */
+       usr_idx = GET_NEXT_REQ(info->idx_map);
+       if (usr_idx == INVALID_REQ) {
+               BUG();
+               goto fail_response;
+       }
+
        /* Check that number of segments is sane. */
        nseg = req->nr_segments;
        if ( unlikely(nseg == 0) || 
@@ -1163,14 +1239,12 @@ static void dispatch_rw_block_io(blkif_t
                unsigned long uvaddr;
                unsigned long kvaddr;
                uint64_t ptep;
-               struct page *page;
                uint32_t flags;
 
                uvaddr = MMAP_VADDR(info->user_vstart, usr_idx, i);
                kvaddr = idx_to_kaddr(mmap_idx, pending_idx, i);
-               page = virt_to_page(kvaddr);
-
-               sector = req->sector_number + (8*i);
+
+               sector = req->sector_number + ((PAGE_SIZE / 512) * i);
                if( (blkif->sectors > 0) && (sector >= blkif->sectors) ) {
                        WPRINTK("BLKTAP: Sector request greater" 
                               "than size\n");
@@ -1180,7 +1254,7 @@ static void dispatch_rw_block_io(blkif_t
                                BLKIF_OP_WRITE ? "WRITE" : "READ"),
                                (long long unsigned) sector,
                                (long long unsigned) sector>>9,
-                               blkif->sectors);
+                               (long long unsigned) blkif->sectors);
                }
 
                flags = GNTMAP_host_map;
@@ -1190,60 +1264,103 @@ static void dispatch_rw_block_io(blkif_t
                                  req->seg[i].gref, blkif->domid);
                op++;
 
-               /* Now map it to user. */
-               ret = create_lookup_pte_addr(info->vma->vm_mm, 
-                                            uvaddr, &ptep);
-               if (ret) {
-                       WPRINTK("Couldn't get a pte addr!\n");
-                       fast_flush_area(pending_req, pending_idx, usr_idx, 
-                                       blkif->dev_num);
-                       goto fail_flush;
-               }
-
-               flags = GNTMAP_host_map | GNTMAP_application_map
-                       | GNTMAP_contains_pte;
-               if (operation == WRITE)
-                       flags |= GNTMAP_readonly;
-               gnttab_set_map_op(&map[op], ptep, flags,
-                                 req->seg[i].gref, blkif->domid);
-               op++;
+               if (!xen_feature(XENFEAT_auto_translated_physmap)) {
+                       /* Now map it to user. */
+                       ret = create_lookup_pte_addr(info->vma->vm_mm, 
+                                                    uvaddr, &ptep);
+                       if (ret) {
+                               WPRINTK("Couldn't get a pte addr!\n");
+                               goto fail_flush;
+                       }
+
+                       flags = GNTMAP_host_map | GNTMAP_application_map
+                               | GNTMAP_contains_pte;
+                       if (operation == WRITE)
+                               flags |= GNTMAP_readonly;
+                       gnttab_set_map_op(&map[op], ptep, flags,
+                                         req->seg[i].gref, blkif->domid);
+                       op++;
+               }
        }
 
        ret = HYPERVISOR_grant_table_op(GNTTABOP_map_grant_ref, map, op);
        BUG_ON(ret);
 
-       for (i = 0; i < (nseg*2); i+=2) {
-               unsigned long uvaddr;
-               unsigned long kvaddr;
-               unsigned long offset;
-               struct page *pg;
-
-               uvaddr = MMAP_VADDR(info->user_vstart, usr_idx, i/2);
-               kvaddr = idx_to_kaddr(mmap_idx, pending_idx, i/2);
-
-               if (unlikely(map[i].status != 0)) {
-                       WPRINTK("invalid kernel buffer -- "
-                               "could not remap it\n");
-                       goto fail_flush;
-               }
-
-               if (unlikely(map[i+1].status != 0)) {
-                       WPRINTK("invalid user buffer -- "
-                               "could not remap it\n");
-                       goto fail_flush;
-               }
-
-               pending_handle(mmap_idx, pending_idx, i/2).kernel 
-                       = map[i].handle;
-               pending_handle(mmap_idx, pending_idx, i/2).user   
-                       = map[i+1].handle;
-               set_phys_to_machine(__pa(kvaddr) >> PAGE_SHIFT,
-                       FOREIGN_FRAME(map[i].dev_bus_addr >> PAGE_SHIFT));
-               offset = (uvaddr - info->vma->vm_start) >> PAGE_SHIFT;
-               pg = pfn_to_page(__pa(kvaddr) >> PAGE_SHIFT);
-               ((struct page **)info->vma->vm_private_data)[offset] =
-                       pg;
-       }
+       if (!xen_feature(XENFEAT_auto_translated_physmap)) {
+               for (i = 0; i < (nseg*2); i+=2) {
+                       unsigned long uvaddr;
+                       unsigned long kvaddr;
+                       unsigned long offset;
+                       struct page *pg;
+
+                       uvaddr = MMAP_VADDR(info->user_vstart, usr_idx, i/2);
+                       kvaddr = idx_to_kaddr(mmap_idx, pending_idx, i/2);
+
+                       if (unlikely(map[i].status != 0)) {
+                               WPRINTK("invalid kernel buffer -- "
+                                       "could not remap it\n");
+                               ret |= 1;
+                               map[i].handle = INVALID_GRANT_HANDLE;
+                       }
+
+                       if (unlikely(map[i+1].status != 0)) {
+                               WPRINTK("invalid user buffer -- "
+                                       "could not remap it\n");
+                               ret |= 1;
+                               map[i+1].handle = INVALID_GRANT_HANDLE;
+                       }
+
+                       pending_handle(mmap_idx, pending_idx, i/2).kernel 
+                               = map[i].handle;
+                       pending_handle(mmap_idx, pending_idx, i/2).user   
+                               = map[i+1].handle;
+
+                       if (ret)
+                               continue;
+
+                       set_phys_to_machine(__pa(kvaddr) >> PAGE_SHIFT,
+                                           FOREIGN_FRAME(map[i].dev_bus_addr
+                                                         >> PAGE_SHIFT));
+                       offset = (uvaddr - info->vma->vm_start) >> PAGE_SHIFT;
+                       pg = pfn_to_page(__pa(kvaddr) >> PAGE_SHIFT);
+                       ((struct page **)info->vma->vm_private_data)[offset] =
+                               pg;
+               }
+       } else {
+               for (i = 0; i < nseg; i++) {
+                       unsigned long uvaddr;
+                       unsigned long kvaddr;
+                       unsigned long offset;
+                       struct page *pg;
+
+                       uvaddr = MMAP_VADDR(info->user_vstart, usr_idx, i);
+                       kvaddr = idx_to_kaddr(mmap_idx, pending_idx, i);
+
+                       if (unlikely(map[i].status != 0)) {
+                               WPRINTK("invalid kernel buffer -- "
+                                       "could not remap it\n");
+                               ret |= 1;
+                               map[i].handle = INVALID_GRANT_HANDLE;
+                       }
+
+                       pending_handle(mmap_idx, pending_idx, i).kernel 
+                               = map[i].handle;
+
+                       if (ret)
+                               continue;
+
+                       offset = (uvaddr - info->vma->vm_start) >> PAGE_SHIFT;
+                       pg = pfn_to_page(__pa(kvaddr) >> PAGE_SHIFT);
+                       ((struct page **)info->vma->vm_private_data)[offset] =
+                               pg;
+               }
+       }
+
+       if (ret)
+               goto fail_flush;
+
+       if (xen_feature(XENFEAT_auto_translated_physmap))
+               down_write(&info->vma->vm_mm->mmap_sem);
        /* Mark mapped pages as reserved: */
        for (i = 0; i < req->nr_segments; i++) {
                unsigned long kvaddr;
@@ -1252,7 +1369,18 @@ static void dispatch_rw_block_io(blkif_t
                kvaddr = idx_to_kaddr(mmap_idx, pending_idx, i);
                pg = pfn_to_page(__pa(kvaddr) >> PAGE_SHIFT);
                SetPageReserved(pg);
-       }
+               if (xen_feature(XENFEAT_auto_translated_physmap)) {
+                       ret = vm_insert_page(info->vma,
+                                            MMAP_VADDR(info->user_vstart,
+                                                       usr_idx, i), pg);
+                       if (ret) {
+                               up_write(&info->vma->vm_mm->mmap_sem);
+                               goto fail_flush;
+                       }
+               }
+       }
+       if (xen_feature(XENFEAT_auto_translated_physmap))
+               up_write(&info->vma->vm_mm->mmap_sem);
        
        /*record [mmap_idx,pending_idx] to [usr_idx] mapping*/
        info->idx_map[usr_idx] = MAKE_ID(mmap_idx, pending_idx);
@@ -1263,6 +1391,7 @@ static void dispatch_rw_block_io(blkif_t
                                  info->ufe_ring.req_prod_pvt);
        memcpy(target, req, sizeof(*req));
        target->id = usr_idx;
+       wmb(); /* blktap_poll() reads req_prod_pvt asynchronously */
        info->ufe_ring.req_prod_pvt++;
        return;
 
@@ -1320,7 +1449,6 @@ static int __init blkif_init(void)
 static int __init blkif_init(void)
 {
        int i,ret,blktap_dir;
-       tap_blkif_t *info;
 
        if (!is_running_on_xen())
                return -ENODEV;
@@ -1339,9 +1467,6 @@ static int __init blkif_init(void)
        alloc_pending_reqs = 0;
 
        tap_blkif_xenbus_init();
-
-       /*Create the blktap devices, but do not map memory or waitqueue*/
-       for(i = 0; i < MAX_TAP_DEV; i++) translate_domid[i].domid = 0xFFFF;
 
        /* Dynamically allocate a major for this device */
        ret = register_chrdev(0, "blktap", &blktap_fops);
@@ -1354,24 +1479,17 @@ static int __init blkif_init(void)
        
        blktap_major = ret;
 
-       for(i = 0; i < MAX_TAP_DEV; i++ ) {
-               info = tapfds[i] = kzalloc(sizeof(tap_blkif_t),GFP_KERNEL);
-               if(tapfds[i] == NULL)
-                       return -ENOMEM;
-               info->minor = i;
-               info->pid = 0;
-               info->blkif = NULL;
-
-               ret = devfs_mk_cdev(MKDEV(blktap_major, i),
-                       S_IFCHR|S_IRUGO|S_IWUSR, "xen/blktap%d", i);
-
-               if(ret != 0)
-                       return -ENOMEM;
-               info->dev_pending = info->dev_inuse = 0;
-
-               DPRINTK("Created misc_dev [/dev/xen/blktap%d]\n",i);
-       }
-       
+       /* tapfds[0] is always NULL */
+       blktap_next_minor++;
+
+       ret = devfs_mk_cdev(MKDEV(blktap_major, i),
+                           S_IFCHR|S_IRUGO|S_IWUSR, "xen/blktap%d", i);
+
+       if(ret != 0)
+               return -ENOMEM;
+
+       DPRINTK("Created misc_dev [/dev/xen/blktap%d]\n",i);
+
        /* Make sure the xen class exists */
        if (!setup_xen_class()) {
                /*
@@ -1384,7 +1502,6 @@ static int __init blkif_init(void)
                class_device_create(xen_class, NULL,
                                    MKDEV(blktap_major, 0), NULL,
                                    "blktap0");
-               tapfds[0]->sysfs_set = 1;
        } else {
                /* this is bad, but not fatal */
                WPRINTK("blktap: sysfs xen_class not created\n");
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/blktap/xenbus.c
--- a/linux-2.6-xen-sparse/drivers/xen/blktap/xenbus.c  Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/blktap/xenbus.c  Thu Nov 09 15:37:17 
2006 -0500
@@ -189,7 +189,7 @@ static int blktap_probe(struct xenbus_de
        return 0;
 
 fail:
-       DPRINTK("blktap probe failed");
+       DPRINTK("blktap probe failed\n");
        blktap_remove(dev);
        return err;
 }
@@ -243,7 +243,7 @@ static void tap_frontend_changed(struct 
        struct backend_info *be = dev->dev.driver_data;
        int err;
 
-       DPRINTK("");
+       DPRINTK("\n");
 
        switch (frontend_state) {
        case XenbusStateInitialising:
@@ -318,7 +318,7 @@ static int connect_ring(struct backend_i
        unsigned int evtchn;
        int err;
 
-       DPRINTK("%s", dev->otherend);
+       DPRINTK("%s\n", dev->otherend);
 
        err = xenbus_gather(XBT_NIL, dev->otherend, "ring-ref", "%lu", 
                            &ring_ref, "event-channel", "%u", &evtchn, NULL);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/core/Makefile
--- a/linux-2.6-xen-sparse/drivers/xen/core/Makefile    Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/core/Makefile    Thu Nov 09 15:37:17 
2006 -0500
@@ -9,5 +9,5 @@ obj-$(CONFIG_HOTPLUG_CPU)       += cpu_hotplug
 obj-$(CONFIG_HOTPLUG_CPU)      += cpu_hotplug.o
 obj-$(CONFIG_XEN_SYSFS)                += xen_sysfs.o
 obj-$(CONFIG_XEN_SKBUFF)       += skbuff.o
-obj-$(CONFIG_XEN_REBOOT)       += reboot.o
+obj-$(CONFIG_XEN_REBOOT)       += reboot.o machine_reboot.o
 obj-$(CONFIG_XEN_SMPBOOT)      += smpboot.o
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/core/features.c
--- a/linux-2.6-xen-sparse/drivers/xen/core/features.c  Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/core/features.c  Thu Nov 09 15:37:17 
2006 -0500
@@ -10,6 +10,10 @@
 #include <linux/module.h>
 #include <asm/hypervisor.h>
 #include <xen/features.h>
+
+#ifdef HAVE_XEN_PLATFORM_COMPAT_H
+#include <xen/platform-compat.h>
+#endif
 
 u8 xen_features[XENFEAT_NR_SUBMAPS * 32] __read_mostly;
 /* Not a GPL symbol: used in ubiquitous macros, so too restrictive. */
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/core/gnttab.c
--- a/linux-2.6-xen-sparse/drivers/xen/core/gnttab.c    Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/core/gnttab.c    Thu Nov 09 15:37:17 
2006 -0500
@@ -44,6 +44,10 @@
 #include <asm/io.h>
 #include <xen/interface/memory.h>
 
+#ifdef HAVE_XEN_PLATFORM_COMPAT_H
+#include <xen/platform-compat.h>
+#endif
+
 /* External tools reserve first few grant table entries. */
 #define NR_RESERVED_ENTRIES 8
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/core/reboot.c
--- a/linux-2.6-xen-sparse/drivers/xen/core/reboot.c    Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/core/reboot.c    Thu Nov 09 15:37:17 
2006 -0500
@@ -1,25 +1,15 @@
 #define __KERNEL_SYSCALLS__
 #include <linux/version.h>
 #include <linux/kernel.h>
-#include <linux/mm.h>
 #include <linux/unistd.h>
 #include <linux/module.h>
 #include <linux/reboot.h>
 #include <linux/sysrq.h>
-#include <linux/stringify.h>
-#include <asm/irq.h>
-#include <asm/mmu_context.h>
-#include <xen/evtchn.h>
 #include <asm/hypervisor.h>
-#include <xen/interface/dom0_ops.h>
 #include <xen/xenbus.h>
-#include <linux/cpu.h>
 #include <linux/kthread.h>
-#include <xen/gnttab.h>
-#include <xen/xencons.h>
-#include <xen/cpu_hotplug.h>
-
-extern void ctrl_alt_del(void);
+
+MODULE_LICENSE("Dual BSD/GPL");
 
 #define SHUTDOWN_INVALID  -1
 #define SHUTDOWN_POWEROFF  0
@@ -31,185 +21,17 @@ extern void ctrl_alt_del(void);
  */
 #define SHUTDOWN_HALT      4
 
-#if defined(__i386__) || defined(__x86_64__)
-
-/*
- * Power off function, if any
- */
-void (*pm_power_off)(void);
-EXPORT_SYMBOL(pm_power_off);
-
-void machine_emergency_restart(void)
-{
-       /* We really want to get pending console data out before we die. */
-       xencons_force_flush();
-       HYPERVISOR_shutdown(SHUTDOWN_reboot);
-}
-
-void machine_restart(char * __unused)
-{
-       machine_emergency_restart();
-}
-
-void machine_halt(void)
-{
-       machine_power_off();
-}
-
-void machine_power_off(void)
-{
-       /* We really want to get pending console data out before we die. */
-       xencons_force_flush();
-       if (pm_power_off)
-               pm_power_off();
-       HYPERVISOR_shutdown(SHUTDOWN_poweroff);
-}
-
-int reboot_thru_bios = 0;      /* for dmi_scan.c */
-EXPORT_SYMBOL(machine_restart);
-EXPORT_SYMBOL(machine_halt);
-EXPORT_SYMBOL(machine_power_off);
-
-#endif /* defined(__i386__) || defined(__x86_64__) */
-
-/******************************************************************************
- * Stop/pickle callback handling.
- */
-
 /* Ignore multiple shutdown requests. */
 static int shutting_down = SHUTDOWN_INVALID;
+
 static void __shutdown_handler(void *unused);
 static DECLARE_WORK(shutdown_work, __shutdown_handler, NULL);
 
-#if defined(__i386__) || defined(__x86_64__)
-
-/* Ensure we run on the idle task page tables so that we will
-   switch page tables before running user space. This is needed
-   on architectures with separate kernel and user page tables
-   because the user page table pointer is not saved/restored. */
-static void switch_idle_mm(void)
-{
-       struct mm_struct *mm = current->active_mm;
-
-       if (mm == &init_mm)
-               return;
-
-       atomic_inc(&init_mm.mm_count);
-       switch_mm(mm, &init_mm, current);
-       current->active_mm = &init_mm;
-       mmdrop(mm);
-}
-
-static void pre_suspend(void)
-{
-       HYPERVISOR_shared_info = (shared_info_t *)empty_zero_page;
-       clear_fixmap(FIX_SHARED_INFO);
-
-       xen_start_info->store_mfn = mfn_to_pfn(xen_start_info->store_mfn);
-       xen_start_info->console.domU.mfn =
-               mfn_to_pfn(xen_start_info->console.domU.mfn);
-}
-
-static void post_suspend(void)
-{
-       int i, j, k, fpp;
-       extern unsigned long max_pfn;
-       extern unsigned long *pfn_to_mfn_frame_list_list;
-       extern unsigned long *pfn_to_mfn_frame_list[];
-
-       set_fixmap(FIX_SHARED_INFO, xen_start_info->shared_info);
-
-       HYPERVISOR_shared_info = (shared_info_t *)fix_to_virt(FIX_SHARED_INFO);
-
-       memset(empty_zero_page, 0, PAGE_SIZE);
-
-       HYPERVISOR_shared_info->arch.pfn_to_mfn_frame_list_list =
-               virt_to_mfn(pfn_to_mfn_frame_list_list);
-
-       fpp = PAGE_SIZE/sizeof(unsigned long);
-       for (i = 0, j = 0, k = -1; i < max_pfn; i += fpp, j++) {
-               if ((j % fpp) == 0) {
-                       k++;
-                       pfn_to_mfn_frame_list_list[k] =
-                               virt_to_mfn(pfn_to_mfn_frame_list[k]);
-                       j = 0;
-               }
-               pfn_to_mfn_frame_list[k][j] =
-                       virt_to_mfn(&phys_to_machine_mapping[i]);
-       }
-       HYPERVISOR_shared_info->arch.max_pfn = max_pfn;
-}
-
-#else /* !(defined(__i386__) || defined(__x86_64__)) */
-
-#define switch_idle_mm()       ((void)0)
-#define mm_pin_all()           ((void)0)
-#define pre_suspend()          ((void)0)
-#define post_suspend()         ((void)0)
-
+#ifdef CONFIG_XEN
+int __xen_suspend(void);
+#else
+#define __xen_suspend() (void)0
 #endif
-
-static int __do_suspend(void *ignore)
-{
-       int err;
-
-       extern void time_resume(void);
-
-       BUG_ON(smp_processor_id() != 0);
-       BUG_ON(in_interrupt());
-
-#if defined(__i386__) || defined(__x86_64__)
-       if (xen_feature(XENFEAT_auto_translated_physmap)) {
-               printk(KERN_WARNING "Cannot suspend in "
-                      "auto_translated_physmap mode.\n");
-               return -EOPNOTSUPP;
-       }
-#endif
-
-       err = smp_suspend();
-       if (err)
-               return err;
-
-       xenbus_suspend();
-
-       preempt_disable();
-
-       mm_pin_all();
-       local_irq_disable();
-       preempt_enable();
-
-       gnttab_suspend();
-
-       pre_suspend();
-
-       /*
-        * We'll stop somewhere inside this hypercall. When it returns,
-        * we'll start resuming after the restore.
-        */
-       HYPERVISOR_suspend(virt_to_mfn(xen_start_info));
-
-       shutting_down = SHUTDOWN_INVALID;
-
-       post_suspend();
-
-       gnttab_resume();
-
-       irq_resume();
-
-       time_resume();
-
-       switch_idle_mm();
-
-       local_irq_enable();
-
-       xencons_resume();
-
-       xenbus_resume();
-
-       smp_resume();
-
-       return err;
-}
 
 static int shutdown_process(void *__unused)
 {
@@ -222,16 +44,25 @@ static int shutdown_process(void *__unus
 
        if ((shutting_down == SHUTDOWN_POWEROFF) ||
            (shutting_down == SHUTDOWN_HALT)) {
-               if (execve("/sbin/poweroff", poweroff_argv, envp) < 0) {
+               if (call_usermodehelper("/sbin/poweroff", poweroff_argv, envp, 
0) < 0) {
+#ifdef CONFIG_XEN
                        sys_reboot(LINUX_REBOOT_MAGIC1,
                                   LINUX_REBOOT_MAGIC2,
                                   LINUX_REBOOT_CMD_POWER_OFF,
                                   NULL);
+#endif /* CONFIG_XEN */
                }
        }
 
        shutting_down = SHUTDOWN_INVALID; /* could try again */
 
+       return 0;
+}
+
+static int xen_suspend(void *__unused)
+{
+       __xen_suspend();
+       shutting_down = SHUTDOWN_INVALID;
        return 0;
 }
 
@@ -257,7 +88,7 @@ static void __shutdown_handler(void *unu
                err = kernel_thread(shutdown_process, NULL,
                                    CLONE_FS | CLONE_FILES);
        else
-               err = kthread_create_on_cpu(__do_suspend, NULL, "suspend", 0);
+               err = kthread_create_on_cpu(xen_suspend, NULL, "suspend", 0);
 
        if (err < 0) {
                printk(KERN_WARNING "Error creating shutdown process (%d): "
@@ -298,7 +129,7 @@ static void shutdown_handler(struct xenb
        if (strcmp(str, "poweroff") == 0)
                shutting_down = SHUTDOWN_POWEROFF;
        else if (strcmp(str, "reboot") == 0)
-               ctrl_alt_del();
+               kill_proc(1, SIGINT, 1); /* interrupt init */
        else if (strcmp(str, "suspend") == 0)
                shutting_down = SHUTDOWN_SUSPEND;
        else if (strcmp(str, "halt") == 0)
@@ -364,10 +195,14 @@ static int setup_shutdown_watcher(struct
        err = register_xenbus_watch(&shutdown_watch);
        if (err)
                printk(KERN_ERR "Failed to set shutdown watcher\n");
+       else
+               xenbus_write(XBT_NIL, "control", "feature-reboot", "1");
 
        err = register_xenbus_watch(&sysrq_watch);
        if (err)
                printk(KERN_ERR "Failed to set sysrq watcher\n");
+       else
+               xenbus_write(XBT_NIL, "control", "feature-sysrq", "1");
 
        return NOTIFY_DONE;
 }
@@ -378,6 +213,7 @@ static int __init setup_shutdown_event(v
                .notifier_call = setup_shutdown_watcher
        };
        register_xenstore_notifier(&xenstore_notifier);
+
        return 0;
 }
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/netback/common.h
--- a/linux-2.6-xen-sparse/drivers/xen/netback/common.h Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/netback/common.h Thu Nov 09 15:37:17 
2006 -0500
@@ -92,6 +92,9 @@ typedef struct netif_st {
        unsigned long   remaining_credit;
        struct timer_list credit_timeout;
 
+       /* Enforce draining of the transmit queue. */
+       struct timer_list tx_queue_timeout;
+
        /* Miscellaneous private stuff. */
        struct list_head list;  /* scheduling list */
        atomic_t         refcnt;
@@ -119,6 +122,8 @@ int netif_map(netif_t *netif, unsigned l
 
 void netif_xenbus_init(void);
 
+#define netif_schedulable(dev) (netif_running(dev) && netif_carrier_ok(dev))
+
 void netif_schedule_work(netif_t *netif);
 void netif_deschedule_work(netif_t *netif);
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/netback/interface.c
--- a/linux-2.6-xen-sparse/drivers/xen/netback/interface.c      Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/netback/interface.c      Thu Nov 09 
15:37:17 2006 -0500
@@ -44,12 +44,11 @@
  * For example, consider a packet that holds onto resources belonging to the
  * guest for which it is queued (e.g., packet received on vif1.0, destined for
  * vif1.1 which is not activated in the guest): in this situation the guest
- * will never be destroyed, unless vif1.1 is taken down (which flushes the
- * 'tx_queue').
- * 
- * Only set this parameter to non-zero value if you know what you are doing!
+ * will never be destroyed, unless vif1.1 is taken down. To avoid this, we
+ * run a timer (tx_queue_timeout) to drain the queue when the interface is
+ * blocked.
  */
-static unsigned long netbk_queue_length = 0;
+static unsigned long netbk_queue_length = 32;
 module_param_named(queue_length, netbk_queue_length, ulong, 0);
 
 static void __netif_up(netif_t *netif)
@@ -62,7 +61,6 @@ static void __netif_down(netif_t *netif)
 {
        disable_irq(netif->irq);
        netif_deschedule_work(netif);
-       del_timer_sync(&netif->credit_timeout);
 }
 
 static int net_open(struct net_device *dev)
@@ -153,7 +151,10 @@ netif_t *netif_alloc(domid_t domid, unsi
        netif->credit_bytes = netif->remaining_credit = ~0UL;
        netif->credit_usec  = 0UL;
        init_timer(&netif->credit_timeout);
+       /* Initialize 'expires' now: it's used to track the credit window. */
        netif->credit_timeout.expires = jiffies;
+
+       init_timer(&netif->tx_queue_timeout);
 
        dev->hard_start_xmit = netif_be_start_xmit;
        dev->get_stats       = netif_be_get_stats;
@@ -165,9 +166,6 @@ netif_t *netif_alloc(domid_t domid, unsi
        SET_ETHTOOL_OPS(dev, &network_ethtool_ops);
 
        dev->tx_queue_len = netbk_queue_length;
-       if (dev->tx_queue_len != 0)
-               printk(KERN_WARNING "netbk: WARNING: device '%s' has non-zero "
-                      "queue length (%lu)!\n", dev->name, dev->tx_queue_len);
 
        /*
         * Initialise a dummy MAC address. We choose the numerically
@@ -319,25 +317,6 @@ err_rx:
        return err;
 }
 
-static void netif_free(netif_t *netif)
-{
-       atomic_dec(&netif->refcnt);
-       wait_event(netif->waiting_to_free, atomic_read(&netif->refcnt) == 0);
-
-       if (netif->irq)
-               unbind_from_irqhandler(netif->irq, netif);
-       
-       unregister_netdev(netif->dev);
-
-       if (netif->tx.sring) {
-               unmap_frontend_pages(netif);
-               free_vm_area(netif->tx_comms_area);
-               free_vm_area(netif->rx_comms_area);
-       }
-
-       free_netdev(netif->dev);
-}
-
 void netif_disconnect(netif_t *netif)
 {
        if (netif_carrier_ok(netif->dev)) {
@@ -348,5 +327,23 @@ void netif_disconnect(netif_t *netif)
                rtnl_unlock();
                netif_put(netif);
        }
-       netif_free(netif);
-}
+
+       atomic_dec(&netif->refcnt);
+       wait_event(netif->waiting_to_free, atomic_read(&netif->refcnt) == 0);
+
+       del_timer_sync(&netif->credit_timeout);
+       del_timer_sync(&netif->tx_queue_timeout);
+
+       if (netif->irq)
+               unbind_from_irqhandler(netif->irq, netif);
+       
+       unregister_netdev(netif->dev);
+
+       if (netif->tx.sring) {
+               unmap_frontend_pages(netif);
+               free_vm_area(netif->tx_comms_area);
+               free_vm_area(netif->rx_comms_area);
+       }
+
+       free_netdev(netif->dev);
+}
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/netback/netback.c
--- a/linux-2.6-xen-sparse/drivers/xen/netback/netback.c        Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/netback/netback.c        Thu Nov 09 
15:37:17 2006 -0500
@@ -187,7 +187,7 @@ static struct sk_buff *netbk_copy_skb(st
        if (unlikely(!nskb))
                goto err;
 
-       skb_reserve(nskb, 16);
+       skb_reserve(nskb, 16 + NET_IP_ALIGN);
        headlen = nskb->end - nskb->data;
        if (headlen > skb_headlen(skb))
                headlen = skb_headlen(skb);
@@ -264,6 +264,13 @@ static inline int netbk_queue_full(netif
               ((netif->rx.rsp_prod_pvt + NET_RX_RING_SIZE - peek) < needed);
 }
 
+static void tx_queue_callback(unsigned long data)
+{
+       netif_t *netif = (netif_t *)data;
+       if (netif_schedulable(netif->dev))
+               netif_wake_queue(netif->dev);
+}
+
 int netif_be_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        netif_t *netif = netdev_priv(dev);
@@ -271,20 +278,13 @@ int netif_be_start_xmit(struct sk_buff *
        BUG_ON(skb->dev != dev);
 
        /* Drop the packet if the target domain has no receive buffers. */
-       if (unlikely(!netif_running(dev) || !netif_carrier_ok(dev)))
+       if (unlikely(!netif_schedulable(dev) || netbk_queue_full(netif)))
                goto drop;
 
-       if (unlikely(netbk_queue_full(netif))) {
-               /* Not a BUG_ON() -- misbehaving netfront can trigger this. */
-               if (netbk_can_queue(dev))
-                       DPRINTK("Queue full but not stopped!\n");
-               goto drop;
-       }
-
-       /* Copy the packet here if it's destined for a flipping
-          interface but isn't flippable (e.g. extra references to
-          data)
-       */
+       /*
+        * Copy the packet here if it's destined for a flipping interface
+        * but isn't flippable (e.g. extra references to data).
+        */
        if (!netif->copying_receiver && !is_flippable_skb(skb)) {
                struct sk_buff *nskb = netbk_copy_skb(skb);
                if ( unlikely(nskb == NULL) )
@@ -305,8 +305,19 @@ int netif_be_start_xmit(struct sk_buff *
                netif->rx.sring->req_event = netif->rx_req_cons_peek +
                        netbk_max_required_rx_slots(netif);
                mb(); /* request notification /then/ check & stop the queue */
-               if (netbk_queue_full(netif))
+               if (netbk_queue_full(netif)) {
                        netif_stop_queue(dev);
+                       /*
+                        * Schedule 500ms timeout to restart the queue, thus
+                        * ensuring that an inactive queue will be drained.
+                        * Packets will be immediately be dropped until more
+                        * receive buffers become available (see
+                        * netbk_queue_full() check above).
+                        */
+                       netif->tx_queue_timeout.data = (unsigned long)netif;
+                       netif->tx_queue_timeout.function = tx_queue_callback;
+                       __mod_timer(&netif->tx_queue_timeout, jiffies + HZ/2);
+               }
        }
 
        skb_queue_tail(&rx_queue, skb);
@@ -706,6 +717,7 @@ static void net_rx_action(unsigned long 
                }
 
                if (netif_queue_stopped(netif->dev) &&
+                   netif_schedulable(netif->dev) &&
                    !netbk_queue_full(netif))
                        netif_wake_queue(netif->dev);
 
@@ -763,8 +775,7 @@ static void add_to_net_schedule_list_tai
 
        spin_lock_irq(&net_schedule_list_lock);
        if (!__on_net_schedule_list(netif) &&
-           likely(netif_running(netif->dev) &&
-                  netif_carrier_ok(netif->dev))) {
+           likely(netif_schedulable(netif->dev))) {
                list_add_tail(&netif->list, &net_schedule_list);
                netif_get(netif);
        }
@@ -803,7 +814,7 @@ void netif_deschedule_work(netif_t *neti
 
 static void tx_add_credit(netif_t *netif)
 {
-       unsigned long max_burst;
+       unsigned long max_burst, max_credit;
 
        /*
         * Allow a burst big enough to transmit a jumbo packet of up to 128kB.
@@ -813,9 +824,10 @@ static void tx_add_credit(netif_t *netif
        max_burst = min(max_burst, 131072UL);
        max_burst = max(max_burst, netif->credit_bytes);
 
-       netif->remaining_credit = min(netif->remaining_credit +
-                                     netif->credit_bytes,
-                                     max_burst);
+       /* Take care that adding a new chunk of credit doesn't wrap to zero. */
+       max_credit = max(netif->remaining_credit + netif->credit_bytes, ~0UL);
+
+       netif->remaining_credit = min(max_credit, max_burst);
 }
 
 static void tx_credit_callback(unsigned long data)
@@ -1210,7 +1222,7 @@ static void net_tx_action(unsigned long 
                            ret < MAX_SKB_FRAGS) ?
                        PKT_PROT_LEN : txreq.size;
 
-               skb = alloc_skb(data_len+16, GFP_ATOMIC);
+               skb = alloc_skb(data_len + 16 + NET_IP_ALIGN, GFP_ATOMIC);
                if (unlikely(skb == NULL)) {
                        DPRINTK("Can't allocate a skb in start_xmit.\n");
                        netbk_tx_err(netif, &txreq, i);
@@ -1218,7 +1230,7 @@ static void net_tx_action(unsigned long 
                }
 
                /* Packets passed to netif_rx() must have some headroom. */
-               skb_reserve(skb, 16);
+               skb_reserve(skb, 16 + NET_IP_ALIGN);
 
                if (extras[XEN_NETIF_EXTRA_TYPE_GSO - 1].type) {
                        struct netif_extra_info *gso;
@@ -1358,7 +1370,7 @@ irqreturn_t netif_be_int(int irq, void *
        add_to_net_schedule_list_tail(netif);
        maybe_schedule_tx_action();
 
-       if (netif_queue_stopped(netif->dev) && !netbk_queue_full(netif))
+       if (netif_schedulable(netif->dev) && !netbk_queue_full(netif))
                netif_wake_queue(netif->dev);
 
        return IRQ_HANDLED;
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/netback/xenbus.c
--- a/linux-2.6-xen-sparse/drivers/xen/netback/xenbus.c Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/netback/xenbus.c Thu Nov 09 15:37:17 
2006 -0500
@@ -93,10 +93,22 @@ static int netback_probe(struct xenbus_d
                        goto abort_transaction;
                }
 
+               /* We support rx-copy path. */
                err = xenbus_printf(xbt, dev->nodename,
                                    "feature-rx-copy", "%d", 1);
                if (err) {
-                       message = "writing feature-copying";
+                       message = "writing feature-rx-copy";
+                       goto abort_transaction;
+               }
+
+               /*
+                * We don't support rx-flip path (except old guests who don't
+                * grok this feature flag).
+                */
+               err = xenbus_printf(xbt, dev->nodename,
+                                   "feature-rx-flip", "%d", 0);
+               if (err) {
+                       message = "writing feature-rx-flip";
                        goto abort_transaction;
                }
 
@@ -328,7 +340,7 @@ static void connect(struct backend_info 
 
        /* May not get a kick from the frontend, so start the tx_queue now. */
        if (!netbk_can_queue(be->netif->dev))
-               netif_start_queue(be->netif->dev);
+               netif_wake_queue(be->netif->dev);
 }
 
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c
--- a/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c      Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c      Thu Nov 09 
15:37:17 2006 -0500
@@ -64,6 +64,10 @@
 #include <xen/interface/grant_table.h>
 #include <xen/gnttab.h>
 
+#ifdef HAVE_XEN_PLATFORM_COMPAT_H
+#include <xen/platform-compat.h>
+#endif
+
 /*
  * Mutually-exclusive module options to select receive data path:
  *  rx_copy : Packets are copied by network backend into local memory
@@ -97,6 +101,14 @@ static inline void dev_disable_gso_featu
 }
 #elif defined(NETIF_F_TSO)
 #define HAVE_TSO                       1
+
+/* Some older kernels cannot cope with incorrect checksums,
+ * particularly in netfilter. I'm not sure there is 100% correlation
+ * with the presence of NETIF_F_TSO but it appears to be a good first
+ * approximiation.
+ */
+#define HAVE_NO_CSUM_OFFLOAD           1
+
 #define gso_size tso_size
 #define gso_segs tso_segs
 static inline void dev_disable_gso_features(struct net_device *dev)
@@ -238,7 +250,6 @@ static void netif_disconnect_backend(str
 static void netif_disconnect_backend(struct netfront_info *);
 static int open_netdev(struct netfront_info *);
 static void close_netdev(struct netfront_info *);
-static void netif_free(struct netfront_info *);
 
 static int network_connect(struct net_device *);
 static void network_tx_buf_gc(struct net_device *);
@@ -391,6 +402,14 @@ again:
                goto abort_transaction;
        }
 
+#ifdef HAVE_NO_CSUM_OFFLOAD
+       err = xenbus_printf(xbt, dev->nodename, "feature-no-csum-offload", 
"%d", 1);
+       if (err) {
+               message = "writing feature-no-csum-offload";
+               goto abort_transaction;
+       }
+#endif
+
        err = xenbus_printf(xbt, dev->nodename, "feature-sg", "%d", 1);
        if (err) {
                message = "writing feature-sg";
@@ -423,7 +442,6 @@ again:
  out:
        return err;
 }
-
 
 static int setup_device(struct xenbus_device *dev, struct netfront_info *info)
 {
@@ -484,10 +502,8 @@ static int setup_device(struct xenbus_de
        return 0;
 
  fail:
-       netif_free(info);
        return err;
 }
-
 
 /**
  * Callback received when the backend's state changes.
@@ -509,10 +525,8 @@ static void backend_changed(struct xenbu
                break;
 
        case XenbusStateInitWait:
-               if (network_connect(netdev) != 0) {
-                       netif_free(np);
+               if (network_connect(netdev) != 0)
                        break;
-               }
                xenbus_switch_state(dev, XenbusStateConnected);
                (void)send_fake_arp(netdev);
                break;
@@ -522,7 +536,6 @@ static void backend_changed(struct xenbu
                break;
        }
 }
-
 
 /** Send a packet on a net device to encourage switches to learn the
  * MAC. We send a fake ARP request.
@@ -551,7 +564,6 @@ static int send_fake_arp(struct net_devi
 
        return dev_queue_xmit(skb);
 }
-
 
 static int network_open(struct net_device *dev)
 {
@@ -644,13 +656,11 @@ static void network_tx_buf_gc(struct net
        network_maybe_wake_tx(dev);
 }
 
-
 static void rx_refill_timeout(unsigned long data)
 {
        struct net_device *dev = (struct net_device *)data;
        netif_rx_schedule(dev);
 }
-
 
 static void network_alloc_rx_buffers(struct net_device *dev)
 {
@@ -684,7 +694,7 @@ static void network_alloc_rx_buffers(str
                 * necessary here.
                 * 16 bytes added as necessary headroom for netif_receive_skb.
                 */
-               skb = alloc_skb(RX_COPY_THRESHOLD + 16,
+               skb = alloc_skb(RX_COPY_THRESHOLD + 16 + NET_IP_ALIGN,
                                GFP_ATOMIC | __GFP_NOWARN);
                if (unlikely(!skb))
                        goto no_skb;
@@ -702,7 +712,7 @@ no_skb:
                        break;
                }
 
-               skb_reserve(skb, 16); /* mimic dev_alloc_skb() */
+               skb_reserve(skb, 16 + NET_IP_ALIGN); /* mimic dev_alloc_skb() */
                skb_shinfo(skb)->frags[0].page = page;
                skb_shinfo(skb)->nr_frags = 1;
                __skb_queue_tail(&np->rx_batch, skb);
@@ -2059,14 +2069,6 @@ static void netif_disconnect_backend(str
 }
 
 
-static void netif_free(struct netfront_info *info)
-{
-       close_netdev(info);
-       netif_disconnect_backend(info);
-       free_netdev(info->netdev);
-}
-
-
 static void end_access(int ref, void *page)
 {
        if (ref != GRANT_INVALID_REF)
@@ -2129,6 +2131,9 @@ module_init(netif_init);
 
 static void __exit netif_exit(void)
 {
+       if (is_initial_xendomain())
+               return;
+
        unregister_inetaddr_notifier(&notifier_inetdev);
 
        return xenbus_unregister_driver(&netfront);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/privcmd/privcmd.c
--- a/linux-2.6-xen-sparse/drivers/xen/privcmd/privcmd.c        Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/privcmd/privcmd.c        Thu Nov 09 
15:37:17 2006 -0500
@@ -53,6 +53,8 @@ static int privcmd_ioctl(struct inode *i
                        return -EFAULT;
 
 #if defined(__i386__)
+               if (hypercall.op >= (PAGE_SIZE >> 5))
+                       break;
                __asm__ __volatile__ (
                        "pushl %%ebx; pushl %%ecx; pushl %%edx; "
                        "pushl %%esi; pushl %%edi; "
@@ -69,36 +71,25 @@ static int privcmd_ioctl(struct inode *i
                        "popl %%ecx; popl %%ebx"
                        : "=a" (ret) : "0" (&hypercall) : "memory" );
 #elif defined (__x86_64__)
-               {
+               if (hypercall.op < (PAGE_SIZE >> 5)) {
                        long ign1, ign2, ign3;
                        __asm__ __volatile__ (
                                "movq %8,%%r10; movq %9,%%r8;"
-                               "shlq $5,%%rax ;"
+                               "shll $5,%%eax ;"
                                "addq $hypercall_page,%%rax ;"
                                "call *%%rax"
                                : "=a" (ret), "=D" (ign1),
                                  "=S" (ign2), "=d" (ign3)
-                               : "0" ((unsigned long)hypercall.op), 
-                               "1" ((unsigned long)hypercall.arg[0]), 
-                               "2" ((unsigned long)hypercall.arg[1]),
-                               "3" ((unsigned long)hypercall.arg[2]), 
-                               "g" ((unsigned long)hypercall.arg[3]),
-                               "g" ((unsigned long)hypercall.arg[4])
+                               : "0" ((unsigned int)hypercall.op),
+                               "1" (hypercall.arg[0]),
+                               "2" (hypercall.arg[1]),
+                               "3" (hypercall.arg[2]),
+                               "g" (hypercall.arg[3]),
+                               "g" (hypercall.arg[4])
                                : "r8", "r10", "memory" );
                }
 #elif defined (__ia64__)
-               __asm__ __volatile__ (
-                       ";; mov r14=%2; mov r15=%3; "
-                       "mov r16=%4; mov r17=%5; mov r18=%6;"
-                       "mov r2=%1; break 0x1000;; mov %0=r8 ;;"
-                       : "=r" (ret)
-                       : "r" (hypercall.op),
-                       "r" (hypercall.arg[0]),
-                       "r" (hypercall.arg[1]),
-                       "r" (hypercall.arg[2]),
-                       "r" (hypercall.arg[3]),
-                       "r" (hypercall.arg[4])
-                       : "r14","r15","r16","r17","r18","r2","r8","memory");
+               ret = privcmd_hypercall(&hypercall);
 #endif
        }
        break;
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/tpmback/xenbus.c
--- a/linux-2.6-xen-sparse/drivers/xen/tpmback/xenbus.c Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/tpmback/xenbus.c Thu Nov 09 15:37:17 
2006 -0500
@@ -157,10 +157,12 @@ static void frontend_changed(struct xenb
 
        case XenbusStateClosing:
                be->instance = -1;
-               break;
-
-       case XenbusStateUnknown:
+               xenbus_switch_state(dev, XenbusStateClosing);
+               break;
+
+       case XenbusStateUnknown: /* keep it here */
        case XenbusStateClosed:
+               xenbus_switch_state(dev, XenbusStateClosed);
                device_unregister(&be->dev->dev);
                tpmback_remove(dev);
                break;
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/xenbus/Makefile
--- a/linux-2.6-xen-sparse/drivers/xen/xenbus/Makefile  Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/xenbus/Makefile  Thu Nov 09 15:37:17 
2006 -0500
@@ -9,4 +9,5 @@ xenbus-objs += xenbus_comms.o
 xenbus-objs += xenbus_comms.o
 xenbus-objs += xenbus_xs.o
 xenbus-objs += xenbus_probe.o
+obj-$(CONFIG_XEN_BACKEND) += xenbus_probe_backend.o
 obj-$(CONFIG_XEN_XENBUS_DEV) += xenbus_dev.o
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_client.c
--- a/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_client.c   Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_client.c   Thu Nov 09 
15:37:17 2006 -0500
@@ -34,6 +34,10 @@
 #include <xen/gnttab.h>
 #include <xen/xenbus.h>
 #include <xen/driver_util.h>
+
+#ifdef HAVE_XEN_PLATFORM_COMPAT_H
+#include <xen/platform-compat.h>
+#endif
 
 /* xenbus_probe.c */
 extern char *kasprintf(const char *fmt, ...);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_comms.c
--- a/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_comms.c    Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_comms.c    Thu Nov 09 
15:37:17 2006 -0500
@@ -30,14 +30,21 @@
  * IN THE SOFTWARE.
  */
 
-#include <asm/hypervisor.h>
-#include <xen/evtchn.h>
 #include <linux/wait.h>
 #include <linux/interrupt.h>
 #include <linux/sched.h>
 #include <linux/err.h>
+#include <linux/ptrace.h>
+#include <xen/evtchn.h>
 #include <xen/xenbus.h>
+
+#include <asm/hypervisor.h>
+
 #include "xenbus_comms.h"
+
+#ifdef HAVE_XEN_PLATFORM_COMPAT_H
+#include <xen/platform-compat.h>
+#endif
 
 static int xenbus_irq;
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_dev.c
--- a/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_dev.c      Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_dev.c      Thu Nov 09 
15:37:17 2006 -0500
@@ -40,6 +40,7 @@
 #include <linux/wait.h>
 #include <linux/fs.h>
 #include <linux/poll.h>
+#include <linux/mutex.h>
 
 #include "xenbus_comms.h"
 
@@ -48,6 +49,10 @@
 #include <xen/xenbus.h>
 #include <xen/xen_proc.h>
 #include <asm/hypervisor.h>
+
+#ifdef HAVE_XEN_PLATFORM_COMPAT_H
+#include <xen/platform-compat.h>
+#endif
 
 struct xenbus_dev_transaction {
        struct list_head list;
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_probe.c
--- a/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_probe.c    Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_probe.c    Thu Nov 09 
15:37:17 2006 -0500
@@ -42,6 +42,7 @@
 #include <linux/mm.h>
 #include <linux/notifier.h>
 #include <linux/kthread.h>
+#include <linux/mutex.h>
 
 #include <asm/io.h>
 #include <asm/page.h>
@@ -55,6 +56,11 @@
 #include <xen/hvm.h>
 
 #include "xenbus_comms.h"
+#include "xenbus_probe.h"
+
+#ifdef HAVE_XEN_PLATFORM_COMPAT_H
+#include <xen/platform-compat.h>
+#endif
 
 int xen_store_evtchn;
 struct xenstore_domain_interface *xen_store_interface;
@@ -67,12 +73,7 @@ static void wait_for_devices(struct xenb
 static void wait_for_devices(struct xenbus_driver *xendrv);
 
 static int xenbus_probe_frontend(const char *type, const char *name);
-static int xenbus_uevent_backend(struct device *dev, char **envp,
-                                int num_envp, char *buffer, int buffer_size);
-static int xenbus_probe_backend(const char *type, const char *domid);
-
-static int xenbus_dev_probe(struct device *_dev);
-static int xenbus_dev_remove(struct device *_dev);
+
 static void xenbus_dev_shutdown(struct device *_dev);
 
 /* If something in array of ids matches this device, return it. */
@@ -86,7 +87,7 @@ match_device(const struct xenbus_device_
        return NULL;
 }
 
-static int xenbus_match(struct device *_dev, struct device_driver *_drv)
+int xenbus_match(struct device *_dev, struct device_driver *_drv)
 {
        struct xenbus_driver *drv = to_xenbus_driver(_drv);
 
@@ -95,17 +96,6 @@ static int xenbus_match(struct device *_
 
        return match_device(drv->ids, to_xenbus_device(_dev)) != NULL;
 }
-
-struct xen_bus_type
-{
-       char *root;
-       unsigned int levels;
-       int (*get_bus_id)(char bus_id[BUS_ID_SIZE], const char *nodename);
-       int (*probe)(const char *type, const char *dir);
-       struct bus_type bus;
-       struct device dev;
-};
-
 
 /* device/<type>/<id> => <type>-<id> */
 static int frontend_bus_id(char bus_id[BUS_ID_SIZE], const char *nodename)
@@ -143,7 +133,7 @@ static void free_otherend_watch(struct x
 }
 
 
-static int read_otherend_details(struct xenbus_device *xendev,
+int read_otherend_details(struct xenbus_device *xendev,
                                 char *id_node, char *path_node)
 {
        int err = xenbus_gather(XBT_NIL, xendev->nodename,
@@ -176,12 +166,6 @@ static int read_backend_details(struct x
 }
 
 
-static int read_frontend_details(struct xenbus_device *xendev)
-{
-       return read_otherend_details(xendev, "frontend-id", "frontend");
-}
-
-
 /* Bus type for frontend drivers. */
 static struct xen_bus_type xenbus_frontend = {
        .root = "device",
@@ -191,114 +175,16 @@ static struct xen_bus_type xenbus_fronte
        .bus = {
                .name     = "xen",
                .match    = xenbus_match,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,16)
                .probe    = xenbus_dev_probe,
                .remove   = xenbus_dev_remove,
                .shutdown = xenbus_dev_shutdown,
+#endif
        },
        .dev = {
                .bus_id = "xen",
        },
 };
-
-/* backend/<type>/<fe-uuid>/<id> => <type>-<fe-domid>-<id> */
-static int backend_bus_id(char bus_id[BUS_ID_SIZE], const char *nodename)
-{
-       int domid, err;
-       const char *devid, *type, *frontend;
-       unsigned int typelen;
-
-       type = strchr(nodename, '/');
-       if (!type)
-               return -EINVAL;
-       type++;
-       typelen = strcspn(type, "/");
-       if (!typelen || type[typelen] != '/')
-               return -EINVAL;
-
-       devid = strrchr(nodename, '/') + 1;
-
-       err = xenbus_gather(XBT_NIL, nodename, "frontend-id", "%i", &domid,
-                           "frontend", NULL, &frontend,
-                           NULL);
-       if (err)
-               return err;
-       if (strlen(frontend) == 0)
-               err = -ERANGE;
-       if (!err && !xenbus_exists(XBT_NIL, frontend, ""))
-               err = -ENOENT;
-
-       kfree(frontend);
-
-       if (err)
-               return err;
-
-       if (snprintf(bus_id, BUS_ID_SIZE,
-                    "%.*s-%i-%s", typelen, type, domid, devid) >= BUS_ID_SIZE)
-               return -ENOSPC;
-       return 0;
-}
-
-static struct xen_bus_type xenbus_backend = {
-       .root = "backend",
-       .levels = 3,            /* backend/type/<frontend>/<id> */
-       .get_bus_id = backend_bus_id,
-       .probe = xenbus_probe_backend,
-       .bus = {
-               .name     = "xen-backend",
-               .match    = xenbus_match,
-               .probe    = xenbus_dev_probe,
-               .remove   = xenbus_dev_remove,
-//             .shutdown = xenbus_dev_shutdown,
-               .uevent   = xenbus_uevent_backend,
-       },
-       .dev = {
-               .bus_id = "xen-backend",
-       },
-};
-
-static int xenbus_uevent_backend(struct device *dev, char **envp,
-                                int num_envp, char *buffer, int buffer_size)
-{
-       struct xenbus_device *xdev;
-       struct xenbus_driver *drv;
-       int i = 0;
-       int length = 0;
-
-       DPRINTK("");
-
-       if (dev == NULL)
-               return -ENODEV;
-
-       xdev = to_xenbus_device(dev);
-       if (xdev == NULL)
-               return -ENODEV;
-
-       /* stuff we want to pass to /sbin/hotplug */
-       add_uevent_var(envp, num_envp, &i, buffer, buffer_size, &length,
-                      "XENBUS_TYPE=%s", xdev->devicetype);
-
-       add_uevent_var(envp, num_envp, &i, buffer, buffer_size, &length,
-                      "XENBUS_PATH=%s", xdev->nodename);
-
-       add_uevent_var(envp, num_envp, &i, buffer, buffer_size, &length,
-                      "XENBUS_BASE_PATH=%s", xenbus_backend.root);
-
-       /* terminate, set to next free slot, shrink available space */
-       envp[i] = NULL;
-       envp = &envp[i];
-       num_envp -= i;
-       buffer = &buffer[length];
-       buffer_size -= length;
-
-       if (dev->driver) {
-               drv = to_xenbus_driver(dev->driver);
-               if (drv && drv->uevent)
-                       return drv->uevent(xdev, envp, num_envp, buffer,
-                                          buffer_size);
-       }
-
-       return 0;
-}
 
 static void otherend_changed(struct xenbus_watch *watch,
                             const char **vec, unsigned int len)
@@ -359,7 +245,7 @@ static int watch_otherend(struct xenbus_
 }
 
 
-static int xenbus_dev_probe(struct device *_dev)
+int xenbus_dev_probe(struct device *_dev)
 {
        struct xenbus_device *dev = to_xenbus_device(_dev);
        struct xenbus_driver *drv = to_xenbus_driver(_dev->driver);
@@ -406,7 +292,7 @@ fail:
        return -ENODEV;
 }
 
-static int xenbus_dev_remove(struct device *_dev)
+int xenbus_dev_remove(struct device *_dev)
 {
        struct xenbus_device *dev = to_xenbus_device(_dev);
        struct xenbus_driver *drv = to_xenbus_driver(_dev->driver);
@@ -444,14 +330,21 @@ static void xenbus_dev_shutdown(struct d
        put_device(&dev->dev);
 }
 
-static int xenbus_register_driver_common(struct xenbus_driver *drv,
-                                        struct xen_bus_type *bus)
+int xenbus_register_driver_common(struct xenbus_driver *drv,
+                                 struct xen_bus_type *bus)
 {
        int ret;
 
        drv->driver.name = drv->name;
        drv->driver.bus = &bus->bus;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,10)
        drv->driver.owner = drv->owner;
+#endif
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,16)
+       drv->driver.probe = xenbus_dev_probe;
+       drv->driver.remove = xenbus_dev_remove;
+       drv->driver.shutdown = xenbus_dev_shutdown;
+#endif
 
        mutex_lock(&xenwatch_mutex);
        ret = driver_register(&drv->driver);
@@ -475,14 +368,6 @@ int xenbus_register_frontend(struct xenb
        return 0;
 }
 EXPORT_SYMBOL_GPL(xenbus_register_frontend);
-
-int xenbus_register_backend(struct xenbus_driver *drv)
-{
-       drv->read_otherend_details = read_frontend_details;
-
-       return xenbus_register_driver_common(drv, &xenbus_backend);
-}
-EXPORT_SYMBOL_GPL(xenbus_register_backend);
 
 void xenbus_unregister_driver(struct xenbus_driver *drv)
 {
@@ -581,23 +466,29 @@ char *kasprintf(const char *fmt, ...)
 }
 
 static ssize_t xendev_show_nodename(struct device *dev,
-                                   struct device_attribute *attr, char *buf)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,13)
+                                   struct device_attribute *attr,
+#endif
+                                   char *buf)
 {
        return sprintf(buf, "%s\n", to_xenbus_device(dev)->nodename);
 }
 DEVICE_ATTR(nodename, S_IRUSR | S_IRGRP | S_IROTH, xendev_show_nodename, NULL);
 
 static ssize_t xendev_show_devtype(struct device *dev,
-                                  struct device_attribute *attr, char *buf)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,13)
+                                  struct device_attribute *attr,
+#endif
+                                  char *buf)
 {
        return sprintf(buf, "%s\n", to_xenbus_device(dev)->devicetype);
 }
 DEVICE_ATTR(devtype, S_IRUSR | S_IRGRP | S_IROTH, xendev_show_devtype, NULL);
 
 
-static int xenbus_probe_node(struct xen_bus_type *bus,
-                            const char *type,
-                            const char *nodename)
+int xenbus_probe_node(struct xen_bus_type *bus,
+                     const char *type,
+                     const char *nodename)
 {
        int err;
        struct xenbus_device *xendev;
@@ -667,55 +558,6 @@ static int xenbus_probe_frontend(const c
        return err;
 }
 
-/* backend/<typename>/<frontend-uuid>/<name> */
-static int xenbus_probe_backend_unit(const char *dir,
-                                    const char *type,
-                                    const char *name)
-{
-       char *nodename;
-       int err;
-
-       nodename = kasprintf("%s/%s", dir, name);
-       if (!nodename)
-               return -ENOMEM;
-
-       DPRINTK("%s\n", nodename);
-
-       err = xenbus_probe_node(&xenbus_backend, type, nodename);
-       kfree(nodename);
-       return err;
-}
-
-/* backend/<typename>/<frontend-domid> */
-static int xenbus_probe_backend(const char *type, const char *domid)
-{
-       char *nodename;
-       int err = 0;
-       char **dir;
-       unsigned int i, dir_n = 0;
-
-       DPRINTK("");
-
-       nodename = kasprintf("%s/%s/%s", xenbus_backend.root, type, domid);
-       if (!nodename)
-               return -ENOMEM;
-
-       dir = xenbus_directory(XBT_NIL, nodename, "", &dir_n);
-       if (IS_ERR(dir)) {
-               kfree(nodename);
-               return PTR_ERR(dir);
-       }
-
-       for (i = 0; i < dir_n; i++) {
-               err = xenbus_probe_backend_unit(nodename, type, dir[i]);
-               if (err)
-                       break;
-       }
-       kfree(dir);
-       kfree(nodename);
-       return err;
-}
-
 static int xenbus_probe_device_type(struct xen_bus_type *bus, const char *type)
 {
        int err = 0;
@@ -736,7 +578,7 @@ static int xenbus_probe_device_type(stru
        return err;
 }
 
-static int xenbus_probe_devices(struct xen_bus_type *bus)
+int xenbus_probe_devices(struct xen_bus_type *bus)
 {
        int err = 0;
        char **dir;
@@ -778,7 +620,7 @@ static int strsep_len(const char *str, c
        return (len == 0) ? i : -ERANGE;
 }
 
-static void dev_changed(const char *node, struct xen_bus_type *bus)
+void dev_changed(const char *node, struct xen_bus_type *bus)
 {
        int exists, rootlen;
        struct xenbus_device *dev;
@@ -823,23 +665,10 @@ static void frontend_changed(struct xenb
        dev_changed(vec[XS_WATCH_PATH], &xenbus_frontend);
 }
 
-static void backend_changed(struct xenbus_watch *watch,
-                           const char **vec, unsigned int len)
-{
-       DPRINTK("");
-
-       dev_changed(vec[XS_WATCH_PATH], &xenbus_backend);
-}
-
 /* We watch for devices appearing and vanishing. */
 static struct xenbus_watch fe_watch = {
        .node = "device",
        .callback = frontend_changed,
-};
-
-static struct xenbus_watch be_watch = {
-       .node = "backend",
-       .callback = backend_changed,
 };
 
 static int suspend_dev(struct device *dev, void *data)
@@ -912,7 +741,7 @@ void xenbus_suspend(void)
        DPRINTK("");
 
        bus_for_each_dev(&xenbus_frontend.bus, NULL, NULL, suspend_dev);
-       bus_for_each_dev(&xenbus_backend.bus, NULL, NULL, suspend_dev);
+       xenbus_backend_suspend(suspend_dev);
        xs_suspend();
 }
 EXPORT_SYMBOL_GPL(xenbus_suspend);
@@ -922,7 +751,7 @@ void xenbus_resume(void)
        xb_init_comms();
        xs_resume();
        bus_for_each_dev(&xenbus_frontend.bus, NULL, NULL, resume_dev);
-       bus_for_each_dev(&xenbus_backend.bus, NULL, NULL, resume_dev);
+       xenbus_backend_resume(resume_dev);
 }
 EXPORT_SYMBOL_GPL(xenbus_resume);
 
@@ -955,20 +784,17 @@ void xenbus_probe(void *unused)
 {
        BUG_ON((xenstored_ready <= 0));
 
-       /* Enumerate devices in xenstore. */
+       /* Enumerate devices in xenstore and watch for changes. */
        xenbus_probe_devices(&xenbus_frontend);
-       xenbus_probe_devices(&xenbus_backend);
-
-       /* Watch for changes. */
        register_xenbus_watch(&fe_watch);
-       register_xenbus_watch(&be_watch);
+       xenbus_backend_probe_and_watch();
 
        /* Notify others that xenstore is up */
        notifier_call_chain(&xenstore_chain, 0, NULL);
 }
 
 
-#ifdef CONFIG_PROC_FS
+#if defined(CONFIG_PROC_FS) && defined(CONFIG_XEN_PRIVILEGED_GUEST)
 static struct file_operations xsd_kva_fops;
 static struct proc_dir_entry *xsd_kva_intf;
 static struct proc_dir_entry *xsd_port_intf;
@@ -1020,7 +846,7 @@ static int __init xenbus_probe_init(void
 
        /* Register ourselves with the kernel bus subsystem */
        bus_register(&xenbus_frontend.bus);
-       bus_register(&xenbus_backend.bus);
+       xenbus_backend_bus_register();
 
        /*
         * Domain0 doesn't have a store_evtchn or store_mfn yet.
@@ -1049,7 +875,7 @@ static int __init xenbus_probe_init(void
                xen_store_evtchn = xen_start_info->store_evtchn =
                        alloc_unbound.port;
 
-#ifdef CONFIG_PROC_FS
+#if defined(CONFIG_PROC_FS) && defined(CONFIG_XEN_PRIVILEGED_GUEST)
                /* And finally publish the above info in /proc/xen */
                xsd_kva_intf = create_xen_proc_entry("xsd_kva", 0600);
                if (xsd_kva_intf) {
@@ -1091,7 +917,7 @@ static int __init xenbus_probe_init(void
 
        /* Register ourselves with the kernel device subsystem */
        device_register(&xenbus_frontend.dev);
-       device_register(&xenbus_backend.dev);
+       xenbus_backend_device_register();
 
        if (!is_initial_xendomain())
                xenbus_probe(NULL);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_xs.c
--- a/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_xs.c       Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_xs.c       Thu Nov 09 
15:37:17 2006 -0500
@@ -42,8 +42,14 @@
 #include <linux/fcntl.h>
 #include <linux/kthread.h>
 #include <linux/rwsem.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
 #include <xen/xenbus.h>
 #include "xenbus_comms.h"
+
+#ifdef HAVE_XEN_PLATFORM_COMPAT_H
+#include <xen/platform-compat.h>
+#endif
 
 /* xenbus_probe.c */
 extern char *kasprintf(const char *fmt, ...);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/fixmap.h
--- a/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/fixmap.h       Fri Nov 
03 16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/fixmap.h       Thu Nov 
09 15:37:17 2006 -0500
@@ -27,7 +27,6 @@ extern unsigned long __FIXADDR_TOP;
 #include <asm/acpi.h>
 #include <asm/apicdef.h>
 #include <asm/page.h>
-#include <xen/gnttab.h>
 #ifdef CONFIG_HIGHMEM
 #include <linux/threads.h>
 #include <asm/kmap_types.h>
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/hypercall.h
--- a/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/hypercall.h    Fri Nov 
03 16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/hypercall.h    Thu Nov 
09 15:37:17 2006 -0500
@@ -260,6 +260,8 @@ HYPERVISOR_event_channel_op(
        int cmd, void *arg)
 {
        int rc = _hypercall2(int, event_channel_op, cmd, arg);
+
+#ifdef CONFIG_XEN_COMPAT_030002
        if (unlikely(rc == -ENOSYS)) {
                struct evtchn_op op;
                op.cmd = cmd;
@@ -267,6 +269,8 @@ HYPERVISOR_event_channel_op(
                rc = _hypercall1(int, event_channel_op_compat, &op);
                memcpy(arg, &op.u, sizeof(op.u));
        }
+#endif
+
        return rc;
 }
 
@@ -296,6 +300,8 @@ HYPERVISOR_physdev_op(
        int cmd, void *arg)
 {
        int rc = _hypercall2(int, physdev_op, cmd, arg);
+
+#ifdef CONFIG_XEN_COMPAT_030002
        if (unlikely(rc == -ENOSYS)) {
                struct physdev_op op;
                op.cmd = cmd;
@@ -303,6 +309,8 @@ HYPERVISOR_physdev_op(
                rc = _hypercall1(int, physdev_op_compat, &op);
                memcpy(arg, &op.u, sizeof(op.u));
        }
+#endif
+
        return rc;
 }
 
@@ -350,9 +358,11 @@ HYPERVISOR_suspend(
        int rc = _hypercall3(int, sched_op, SCHEDOP_shutdown,
                             &sched_shutdown, srec);
 
+#ifdef CONFIG_XEN_COMPAT_030002
        if (rc == -ENOSYS)
                rc = _hypercall3(int, sched_op_compat, SCHEDOP_shutdown,
                                 SHUTDOWN_suspend, srec);
+#endif
 
        return rc;
 }
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/hypervisor.h
--- a/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/hypervisor.h   Fri Nov 
03 16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/hypervisor.h   Thu Nov 
09 15:37:17 2006 -0500
@@ -131,8 +131,10 @@ HYPERVISOR_yield(
 {
        int rc = HYPERVISOR_sched_op(SCHEDOP_yield, NULL);
 
+#ifdef CONFIG_XEN_COMPAT_030002
        if (rc == -ENOSYS)
                rc = HYPERVISOR_sched_op_compat(SCHEDOP_yield, 0);
+#endif
 
        return rc;
 }
@@ -143,8 +145,10 @@ HYPERVISOR_block(
 {
        int rc = HYPERVISOR_sched_op(SCHEDOP_block, NULL);
 
+#ifdef CONFIG_XEN_COMPAT_030002
        if (rc == -ENOSYS)
                rc = HYPERVISOR_sched_op_compat(SCHEDOP_block, 0);
+#endif
 
        return rc;
 }
@@ -159,8 +163,10 @@ HYPERVISOR_shutdown(
 
        int rc = HYPERVISOR_sched_op(SCHEDOP_shutdown, &sched_shutdown);
 
+#ifdef CONFIG_XEN_COMPAT_030002
        if (rc == -ENOSYS)
                rc = HYPERVISOR_sched_op_compat(SCHEDOP_shutdown, reason);
+#endif
 
        return rc;
 }
@@ -177,8 +183,10 @@ HYPERVISOR_poll(
        set_xen_guest_handle(sched_poll.ports, ports);
 
        rc = HYPERVISOR_sched_op(SCHEDOP_poll, &sched_poll);
+#ifdef CONFIG_XEN_COMPAT_030002
        if (rc == -ENOSYS)
                rc = HYPERVISOR_sched_op_compat(SCHEDOP_yield, 0);
+#endif
 
        return rc;
 }
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/synch_bitops.h
--- a/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/synch_bitops.h Fri Nov 
03 16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/include/asm-i386/mach-xen/asm/synch_bitops.h Thu Nov 
09 15:37:17 2006 -0500
@@ -8,6 +8,10 @@
  */
 
 #include <linux/config.h>
+
+#ifdef HAVE_XEN_PLATFORM_COMPAT_H
+#include <xen/platform-compat.h>
+#endif
 
 #define ADDR (*(volatile long *) addr)
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/include/asm-i386/mach-xen/setup_arch_post.h
--- a/linux-2.6-xen-sparse/include/asm-i386/mach-xen/setup_arch_post.h  Fri Nov 
03 16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/include/asm-i386/mach-xen/setup_arch_post.h  Thu Nov 
09 15:37:17 2006 -0500
@@ -56,15 +56,15 @@ static void __init machine_specific_arch
        struct xen_machphys_mapping mapping;
        unsigned long machine_to_phys_nr_ents;
        struct xen_platform_parameters pp;
-       struct callback_register event = {
+       static struct callback_register __initdata event = {
                .type = CALLBACKTYPE_event,
                .address = { __KERNEL_CS, (unsigned long)hypervisor_callback },
        };
-       struct callback_register failsafe = {
+       static struct callback_register __initdata failsafe = {
                .type = CALLBACKTYPE_failsafe,
                .address = { __KERNEL_CS, (unsigned long)failsafe_callback },
        };
-       struct callback_register nmi_cb = {
+       static struct callback_register __initdata nmi_cb = {
                .type = CALLBACKTYPE_nmi,
                .address = { __KERNEL_CS, (unsigned long)nmi },
        };
@@ -72,19 +72,24 @@ static void __init machine_specific_arch
        ret = HYPERVISOR_callback_op(CALLBACKOP_register, &event);
        if (ret == 0)
                ret = HYPERVISOR_callback_op(CALLBACKOP_register, &failsafe);
+#ifdef CONFIG_XEN_COMPAT_030002
        if (ret == -ENOSYS)
                ret = HYPERVISOR_set_callbacks(
                        event.address.cs, event.address.eip,
                        failsafe.address.cs, failsafe.address.eip);
+#endif
        BUG_ON(ret);
 
        ret = HYPERVISOR_callback_op(CALLBACKOP_register, &nmi_cb);
+#ifdef CONFIG_XEN_COMPAT_030002
        if (ret == -ENOSYS) {
-               struct xennmi_callback cb;
+               static struct xennmi_callback __initdata cb = {
+                       .handler_address = (unsigned long)nmi
+               };
 
-               cb.handler_address = nmi_cb.address.eip;
                HYPERVISOR_nmi_op(XENNMI_register_callback, &cb);
        }
+#endif
 
        if (HYPERVISOR_xen_version(XENVER_platform_parameters,
                                   &pp) == 0)
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/include/asm-ia64/hypercall.h
--- a/linux-2.6-xen-sparse/include/asm-ia64/hypercall.h Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/include/asm-ia64/hypercall.h Thu Nov 09 15:37:17 
2006 -0500
@@ -33,11 +33,12 @@
 #ifndef __HYPERCALL_H__
 #define __HYPERCALL_H__
 
-#include <linux/string.h> /* memcpy() */
-
 #ifndef __HYPERVISOR_H__
 # error "please don't include this file directly"
 #endif
+
+#include <asm/xen/xcom_hcall.h>
+struct xencomm_handle;
 
 /*
  * Assembler stubs for hyper-calls.
@@ -157,157 +158,117 @@
        (type)__res;                                            \
 })
 
-static inline int
-HYPERVISOR_sched_op_compat(
-    int cmd, unsigned long arg)
-{
-       return _hypercall2(int, sched_op_compat, cmd, arg);
-}
-
-static inline int
-HYPERVISOR_sched_op(
-       int cmd, void *arg)
+
+static inline int
+xencomm_arch_hypercall_sched_op(int cmd, struct xencomm_handle *arg)
 {
        return _hypercall2(int, sched_op, cmd, arg);
 }
 
 static inline long
-HYPERVISOR_set_timer_op(
-    u64 timeout)
-{
-    unsigned long timeout_hi = (unsigned long)(timeout>>32);
-    unsigned long timeout_lo = (unsigned long)timeout;
-    return _hypercall2(long, set_timer_op, timeout_lo, timeout_hi);
-}
-
-static inline int
-HYPERVISOR_dom0_op(
-    dom0_op_t *dom0_op)
-{
-    dom0_op->interface_version = DOM0_INTERFACE_VERSION;
-    return _hypercall1(int, dom0_op, dom0_op);
-}
-
-static inline int
-HYPERVISOR_multicall(
-    void *call_list, int nr_calls)
-{
-    return _hypercall2(int, multicall, call_list, nr_calls);
-}
-
-//XXX xen/ia64 copy_from_guest() is broken.
-//    This is a temporal work around until it is fixed.
-static inline int
-____HYPERVISOR_memory_op(
-    unsigned int cmd, void *arg)
-{
-    return _hypercall2(int, memory_op, cmd, arg);
-}
-
-#include <xen/interface/memory.h>
-#ifdef CONFIG_VMX_GUEST
-# define ia64_xenmem_reservation_op(op, xmr) (0)
-#else
-int ia64_xenmem_reservation_op(unsigned long op,
-                  struct xen_memory_reservation* reservation__);
-#endif
-static inline int
-HYPERVISOR_memory_op(
-    unsigned int cmd, void *arg)
-{
-    switch (cmd) {
-    case XENMEM_increase_reservation:
-    case XENMEM_decrease_reservation:
-    case XENMEM_populate_physmap:
-        return ia64_xenmem_reservation_op(cmd, 
-                                          (struct xen_memory_reservation*)arg);
-    default:
-        return ____HYPERVISOR_memory_op(cmd, arg);
-    }
-    /* NOTREACHED */
-}
-
-static inline int
-HYPERVISOR_event_channel_op(
-    int cmd, void *arg)
-{
-    int rc = _hypercall2(int, event_channel_op, cmd, arg);
-    if (unlikely(rc == -ENOSYS)) {
-        struct evtchn_op op;
-        op.cmd = cmd;
-        memcpy(&op.u, arg, sizeof(op.u));
-        rc = _hypercall1(int, event_channel_op_compat, &op);
-    }
-    return rc;
-}
-
-static inline int
-HYPERVISOR_acm_op(
-       unsigned int cmd, void *arg)
-{
-    return _hypercall2(int, acm_op, cmd, arg);
-}
-
-static inline int
-HYPERVISOR_xen_version(
-    int cmd, void *arg)
-{
-    return _hypercall2(int, xen_version, cmd, arg);
-}
-
-static inline int
-HYPERVISOR_console_io(
-    int cmd, int count, char *str)
-{
-    return _hypercall3(int, console_io, cmd, count, str);
-}
-
-static inline int
-HYPERVISOR_physdev_op(
-    int cmd, void *arg)
-{
-    int rc = _hypercall2(int, physdev_op, cmd, arg);
-    if (unlikely(rc == -ENOSYS)) {
-        struct physdev_op op;
-        op.cmd = cmd;
-        memcpy(&op.u, arg, sizeof(op.u));
-        rc = _hypercall1(int, physdev_op_compat, &op);
-    }
-    return rc;
-}
-
-//XXX __HYPERVISOR_grant_table_op is used for this hypercall constant.
-static inline int
-____HYPERVISOR_grant_table_op(
-    unsigned int cmd, void *uop, unsigned int count,
-    unsigned long pa1, unsigned long pa2)
-{
-    return _hypercall5(int, grant_table_op, cmd, uop, count, pa1, pa2);
+HYPERVISOR_set_timer_op(u64 timeout)
+{
+       unsigned long timeout_hi = (unsigned long)(timeout >> 32);
+       unsigned long timeout_lo = (unsigned long)timeout;
+       return _hypercall2(long, set_timer_op, timeout_lo, timeout_hi);
+}
+
+static inline int
+xencomm_arch_hypercall_dom0_op(struct xencomm_handle *op)
+{
+       return _hypercall1(int, dom0_op, op);
+}
+
+static inline int
+xencomm_arch_hypercall_sysctl(struct xencomm_handle *op)
+{
+       return _hypercall1(int, sysctl, op);
+}
+
+static inline int
+xencomm_arch_hypercall_domctl(struct xencomm_handle *op)
+{
+       return _hypercall1(int, domctl, op);
+}
+
+static inline int
+xencomm_arch_hypercall_multicall(struct xencomm_handle *call_list,
+                                int nr_calls)
+{
+       return _hypercall2(int, multicall, call_list, nr_calls);
+}
+
+static inline int
+xencomm_arch_hypercall_memory_op(unsigned int cmd, struct xencomm_handle *arg)
+{
+       return _hypercall2(int, memory_op, cmd, arg);
+}
+
+static inline int
+xencomm_arch_hypercall_event_channel_op(int cmd, struct xencomm_handle *arg)
+{
+       return _hypercall2(int, event_channel_op, cmd, arg);
+}
+
+static inline int
+xencomm_arch_hypercall_acm_op(unsigned int cmd, struct xencomm_handle *arg)
+{
+       return _hypercall2(int, acm_op, cmd, arg);
+}
+
+static inline int
+xencomm_arch_hypercall_xen_version(int cmd, struct xencomm_handle *arg)
+{
+       return _hypercall2(int, xen_version, cmd, arg);
+}
+
+static inline int
+xencomm_arch_hypercall_console_io(int cmd, int count,
+                                  struct xencomm_handle *str)
+{
+       return _hypercall3(int, console_io, cmd, count, str);
+}
+
+static inline int
+xencomm_arch_hypercall_physdev_op(int cmd, struct xencomm_handle *arg)
+{
+       return _hypercall2(int, physdev_op, cmd, arg);
+}
+
+static inline int
+xencomm_arch_hypercall_grant_table_op(unsigned int cmd,
+                                      struct xencomm_handle *uop,
+                                      unsigned int count)
+{
+       return _hypercall3(int, grant_table_op, cmd, uop, count);
 }
 
 int HYPERVISOR_grant_table_op(unsigned int cmd, void *uop, unsigned int count);
 
-static inline int
-HYPERVISOR_vcpu_op(
-       int cmd, int vcpuid, void *extra_args)
-{
-    return _hypercall3(int, vcpu_op, cmd, vcpuid, extra_args);
-}
-
-extern int HYPERVISOR_suspend(unsigned long srec);
-
-static inline unsigned long
-HYPERVISOR_hvm_op(
-       int cmd, void *arg)
+extern int xencomm_arch_hypercall_suspend(struct xencomm_handle *arg);
+
+static inline int
+xencomm_arch_hypercall_callback_op(int cmd, struct xencomm_handle *arg)
+{
+       return _hypercall2(int, callback_op, cmd, arg);
+}
+
+static inline unsigned long
+xencomm_arch_hypercall_hvm_op(int cmd, void *arg)
 {
        return _hypercall2(unsigned long, hvm_op, cmd, arg);
 }
 
 static inline int
-HYPERVISOR_callback_op(
-       int cmd, void *arg)
-{
-       return _hypercall2(int, callback_op, cmd, arg);
+HYPERVISOR_physdev_op(int cmd, void *arg)
+{
+       switch (cmd) {
+       case PHYSDEVOP_eoi:
+               return _hypercall1(int, ia64_fast_eoi,
+                                  ((struct physdev_eoi *)arg)->irq);
+       default:
+               return xencomm_hypercall_physdev_op(cmd, arg);
+       }
 }
 
 extern fastcall unsigned int __do_IRQ(unsigned int irq, struct pt_regs *regs);
@@ -322,6 +283,9 @@ static inline void exit_idle(void) {}
 #ifdef CONFIG_XEN
 #include <asm/xen/privop.h>
 #endif /* CONFIG_XEN */
+#ifdef HAVE_XEN_PLATFORM_COMPAT_H
+#include <xen/platform-compat.h>
+#endif
 
 static inline unsigned long
 __HYPERVISOR_ioremap(unsigned long ioaddr, unsigned long size)
@@ -417,7 +381,42 @@ HYPERVISOR_add_physmap(unsigned long gpf
        return ret;
 }
 
+#ifdef CONFIG_XEN_IA64_EXPOSE_P2M
+static inline unsigned long
+HYPERVISOR_expose_p2m(unsigned long conv_start_gpfn,
+                      unsigned long assign_start_gpfn,
+                      unsigned long expose_size, unsigned long granule_pfn)
+{
+       return _hypercall5(unsigned long, ia64_dom0vp_op,
+                          IA64_DOM0VP_expose_p2m, conv_start_gpfn,
+                          assign_start_gpfn, expose_size, granule_pfn);
+}
+#endif
+
 // for balloon driver
 #define HYPERVISOR_update_va_mapping(va, new_val, flags) (0)
 
+/* Use xencomm to do hypercalls.  */
+#ifdef MODULE
+#define HYPERVISOR_sched_op xencomm_mini_hypercall_sched_op
+#define HYPERVISOR_event_channel_op xencomm_mini_hypercall_event_channel_op
+#define HYPERVISOR_callback_op xencomm_mini_hypercall_callback_op
+#define HYPERVISOR_multicall xencomm_mini_hypercall_multicall
+#define HYPERVISOR_xen_version xencomm_mini_hypercall_xen_version
+#define HYPERVISOR_console_io xencomm_mini_hypercall_console_io
+#define HYPERVISOR_hvm_op xencomm_mini_hypercall_hvm_op
+#define HYPERVISOR_memory_op xencomm_mini_hypercall_memory_op
+#else
+#define HYPERVISOR_sched_op xencomm_hypercall_sched_op
+#define HYPERVISOR_event_channel_op xencomm_hypercall_event_channel_op
+#define HYPERVISOR_callback_op xencomm_hypercall_callback_op
+#define HYPERVISOR_multicall xencomm_hypercall_multicall
+#define HYPERVISOR_xen_version xencomm_hypercall_xen_version
+#define HYPERVISOR_console_io xencomm_hypercall_console_io
+#define HYPERVISOR_hvm_op xencomm_hypercall_hvm_op
+#define HYPERVISOR_memory_op xencomm_hypercall_memory_op
+#endif
+
+#define HYPERVISOR_suspend xencomm_hypercall_suspend
+
 #endif /* __HYPERCALL_H__ */
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/include/asm-ia64/hypervisor.h
--- a/linux-2.6-xen-sparse/include/asm-ia64/hypervisor.h        Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/include/asm-ia64/hypervisor.h        Thu Nov 09 
15:37:17 2006 -0500
@@ -75,9 +75,6 @@ HYPERVISOR_yield(
 {
        int rc = HYPERVISOR_sched_op(SCHEDOP_yield, NULL);
 
-       if (rc == -ENOSYS)
-               rc = HYPERVISOR_sched_op_compat(SCHEDOP_yield, 0);
-
        return rc;
 }
 
@@ -86,9 +83,6 @@ HYPERVISOR_block(
        void)
 {
        int rc = HYPERVISOR_sched_op(SCHEDOP_block, NULL);
-
-       if (rc == -ENOSYS)
-               rc = HYPERVISOR_sched_op_compat(SCHEDOP_block, 0);
 
        return rc;
 }
@@ -102,9 +96,6 @@ HYPERVISOR_shutdown(
        };
 
        int rc = HYPERVISOR_sched_op(SCHEDOP_shutdown, &sched_shutdown);
-
-       if (rc == -ENOSYS)
-               rc = HYPERVISOR_sched_op_compat(SCHEDOP_shutdown, reason);
 
        return rc;
 }
@@ -122,8 +113,6 @@ HYPERVISOR_poll(
 
        set_xen_guest_handle(sched_poll.ports, ports);
        rc = HYPERVISOR_sched_op(SCHEDOP_poll, &sched_poll);
-       if (rc == -ENOSYS)
-               rc = HYPERVISOR_sched_op_compat(SCHEDOP_yield, 0);
 
        return rc;
 }
@@ -202,6 +191,22 @@ MULTI_grant_table_op(multicall_entry_t *
        mcl->args[2] = count;
 }
 
+/*
+ * for blktap.c
+ * int create_lookup_pte_addr(struct mm_struct *mm, 
+ *                            unsigned long address,
+ *                            uint64_t *ptep);
+ */
+#define create_lookup_pte_addr(mm, address, ptep)                      \
+       ({                                                              \
+               printk(KERN_EMERG                                       \
+                      "%s:%d "                                         \
+                      "create_lookup_pte_addr() isn't supported.\n",   \
+                      __func__, __LINE__);                             \
+               BUG();                                                  \
+               (-ENOSYS);                                              \
+       })
+
 // for debug
 asmlinkage int xprintk(const char *fmt, ...);
 #define xprintd(fmt, ...)      xprintk("%s:%d " fmt, __func__, __LINE__, \
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/include/asm-ia64/maddr.h
--- a/linux-2.6-xen-sparse/include/asm-ia64/maddr.h     Fri Nov 03 16:53:17 
2006 -0500
+++ b/linux-2.6-xen-sparse/include/asm-ia64/maddr.h     Thu Nov 09 15:37:17 
2006 -0500
@@ -10,11 +10,26 @@
 
 #define INVALID_P2M_ENTRY       (~0UL)
 
+#ifdef CONFIG_XEN_IA64_EXPOSE_P2M
+extern int p2m_initialized;
+extern unsigned long p2m_min_low_pfn;
+extern unsigned long p2m_max_low_pfn;
+extern unsigned long p2m_convert_min_pfn;
+extern unsigned long p2m_convert_max_pfn;
+extern volatile const pte_t* p2m_pte;
+unsigned long p2m_phystomach(unsigned long gpfn);
+#else
+#define p2m_initialized                (0)
+#define p2m_phystomach(gpfn)   INVALID_MFN
+#endif
+
 /* XXX xen page size != page size */
 static inline unsigned long
 pfn_to_mfn_for_dma(unsigned long pfn)
 {
        unsigned long mfn;
+       if (p2m_initialized)
+               return p2m_phystomach(pfn);
        mfn = HYPERVISOR_phystomach(pfn);
        BUG_ON(mfn == 0); // XXX
        BUG_ON(mfn == INVALID_P2M_ENTRY); // XXX
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/include/asm-ia64/xen/privop.h
--- a/linux-2.6-xen-sparse/include/asm-ia64/xen/privop.h        Fri Nov 03 
16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/include/asm-ia64/xen/privop.h        Thu Nov 09 
15:37:17 2006 -0500
@@ -14,12 +14,9 @@
 
 #define IA64_PARAVIRTUALIZED
 
-#if 0
-#undef XSI_BASE
 /* At 1 MB, before per-cpu space but still addressable using addl instead
    of movl. */
 #define XSI_BASE                               0xfffffffffff00000
-#endif
 
 /* Address of mapped regs.  */
 #define XMAPPEDREGS_BASE               (XSI_BASE + XSI_SIZE)
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/asm/fixmap.h
--- a/linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/asm/fixmap.h     Fri Nov 
03 16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/asm/fixmap.h     Thu Nov 
09 15:37:17 2006 -0500
@@ -14,7 +14,6 @@
 #include <linux/config.h>
 #include <linux/kernel.h>
 #include <asm/apicdef.h>
-#include <xen/gnttab.h>
 #include <asm/page.h>
 #include <asm/vsyscall.h>
 #include <asm/vsyscall32.h>
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/asm/hypercall.h
--- a/linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/asm/hypercall.h  Fri Nov 
03 16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/asm/hypercall.h  Thu Nov 
09 15:37:17 2006 -0500
@@ -258,6 +258,8 @@ HYPERVISOR_event_channel_op(
        int cmd, void *arg)
 {
        int rc = _hypercall2(int, event_channel_op, cmd, arg);
+
+#ifdef CONFIG_XEN_COMPAT_030002
        if (unlikely(rc == -ENOSYS)) {
                struct evtchn_op op;
                op.cmd = cmd;
@@ -265,6 +267,8 @@ HYPERVISOR_event_channel_op(
                rc = _hypercall1(int, event_channel_op_compat, &op);
                memcpy(arg, &op.u, sizeof(op.u));
        }
+#endif
+
        return rc;
 }
 
@@ -294,6 +298,8 @@ HYPERVISOR_physdev_op(
        int cmd, void *arg)
 {
        int rc = _hypercall2(int, physdev_op, cmd, arg);
+
+#ifdef CONFIG_XEN_COMPAT_030002
        if (unlikely(rc == -ENOSYS)) {
                struct physdev_op op;
                op.cmd = cmd;
@@ -301,6 +307,8 @@ HYPERVISOR_physdev_op(
                rc = _hypercall1(int, physdev_op_compat, &op);
                memcpy(arg, &op.u, sizeof(op.u));
        }
+#endif
+
        return rc;
 }
 
@@ -351,9 +359,11 @@ HYPERVISOR_suspend(
        int rc = _hypercall3(int, sched_op, SCHEDOP_shutdown,
                             &sched_shutdown, srec);
 
+#ifdef CONFIG_XEN_COMPAT_030002
        if (rc == -ENOSYS)
                rc = _hypercall3(int, sched_op_compat, SCHEDOP_shutdown,
                                 SHUTDOWN_suspend, srec);
+#endif
 
        return rc;
 }
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/setup_arch_post.h
--- a/linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/setup_arch_post.h        
Fri Nov 03 16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/include/asm-x86_64/mach-xen/setup_arch_post.h        
Thu Nov 09 15:37:17 2006 -0500
@@ -15,20 +15,20 @@ static void __init machine_specific_arch
 static void __init machine_specific_arch_setup(void)
 {
        int ret;
-       struct callback_register event = {
+       static struct callback_register __initdata event = {
                .type = CALLBACKTYPE_event,
                .address = (unsigned long) hypervisor_callback,
        };
-       struct callback_register failsafe = {
+       static struct callback_register __initdata failsafe = {
                .type = CALLBACKTYPE_failsafe,
                .address = (unsigned long)failsafe_callback,
        };
-       struct callback_register syscall = {
+       static struct callback_register __initdata syscall = {
                .type = CALLBACKTYPE_syscall,
                .address = (unsigned long)system_call,
        };
 #ifdef CONFIG_X86_LOCAL_APIC
-       struct callback_register nmi_cb = {
+       static struct callback_register __initdata nmi_cb = {
                .type = CALLBACKTYPE_nmi,
                .address = (unsigned long)nmi,
        };
@@ -39,20 +39,25 @@ static void __init machine_specific_arch
                ret = HYPERVISOR_callback_op(CALLBACKOP_register, &failsafe);
        if (ret == 0)
                ret = HYPERVISOR_callback_op(CALLBACKOP_register, &syscall);
+#ifdef CONFIG_XEN_COMPAT_030002
        if (ret == -ENOSYS)
                ret = HYPERVISOR_set_callbacks(
                        event.address,
                        failsafe.address,
                        syscall.address);
+#endif
        BUG_ON(ret);
 
 #ifdef CONFIG_X86_LOCAL_APIC
        ret = HYPERVISOR_callback_op(CALLBACKOP_register, &nmi_cb);
+#ifdef CONFIG_XEN_COMPAT_030002
        if (ret == -ENOSYS) {
-               struct xennmi_callback cb;
+               static struct xennmi_callback __initdata cb = {
+                       .handler_address = (unsigned long)nmi
+               };
 
-               cb.handler_address = nmi_cb.address;
                HYPERVISOR_nmi_op(XENNMI_register_callback, &cb);
        }
 #endif
+#endif
 }
diff -r b30cb72ed5e2 -r 4d4f0d52c193 linux-2.6-xen-sparse/include/xen/gnttab.h
--- a/linux-2.6-xen-sparse/include/xen/gnttab.h Fri Nov 03 16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/include/xen/gnttab.h Thu Nov 09 15:37:17 2006 -0500
@@ -39,6 +39,7 @@
 
 #include <linux/config.h>
 #include <asm/hypervisor.h>
+#include <asm/maddr.h> /* maddr_t */
 #include <xen/interface/grant_table.h>
 #include <xen/features.h>
 
@@ -118,7 +119,7 @@ int gnttab_resume(void);
 int gnttab_resume(void);
 
 static inline void
-gnttab_set_map_op(struct gnttab_map_grant_ref *map, unsigned long addr,
+gnttab_set_map_op(struct gnttab_map_grant_ref *map, maddr_t addr,
                  uint32_t flags, grant_ref_t ref, domid_t domid)
 {
        if (flags & GNTMAP_contains_pte)
@@ -134,7 +135,7 @@ gnttab_set_map_op(struct gnttab_map_gran
 }
 
 static inline void
-gnttab_set_unmap_op(struct gnttab_unmap_grant_ref *unmap, unsigned long addr,
+gnttab_set_unmap_op(struct gnttab_unmap_grant_ref *unmap, maddr_t addr,
                    uint32_t flags, grant_handle_t handle)
 {
        if (flags & GNTMAP_contains_pte)
diff -r b30cb72ed5e2 -r 4d4f0d52c193 linux-2.6-xen-sparse/include/xen/xenbus.h
--- a/linux-2.6-xen-sparse/include/xen/xenbus.h Fri Nov 03 16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/include/xen/xenbus.h Thu Nov 09 15:37:17 2006 -0500
@@ -38,6 +38,7 @@
 #include <linux/notifier.h>
 #include <linux/mutex.h>
 #include <linux/completion.h>
+#include <linux/init.h>
 #include <xen/interface/xen.h>
 #include <xen/interface/grant_table.h>
 #include <xen/interface/io/xenbus.h>
diff -r b30cb72ed5e2 -r 4d4f0d52c193 linux-2.6-xen-sparse/lib/Makefile
--- a/linux-2.6-xen-sparse/lib/Makefile Fri Nov 03 16:53:17 2006 -0500
+++ b/linux-2.6-xen-sparse/lib/Makefile Thu Nov 09 15:37:17 2006 -0500
@@ -45,9 +45,7 @@ obj-$(CONFIG_TEXTSEARCH_FSM) += ts_fsm.o
 obj-$(CONFIG_TEXTSEARCH_FSM) += ts_fsm.o
 
 obj-$(CONFIG_SWIOTLB) += swiotlb.o
-ifneq ($(CONFIG_XEN_IA64_DOM0_NON_VP),y)
 swiotlb-$(CONFIG_XEN) := ../arch/i386/kernel/swiotlb.o
-endif
 
 hostprogs-y    := gen_crc32table
 clean-files    := crc32table.h
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/blktap/drivers/blktapctrl.c
--- a/tools/blktap/drivers/blktapctrl.c Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/blktap/drivers/blktapctrl.c Thu Nov 09 15:37:17 2006 -0500
@@ -204,81 +204,49 @@ static blkif_t *test_path(char *path, ch
 
 static void add_disktype(blkif_t *blkif, int type)
 {
-       driver_list_entry_t *entry, *ptr, *last;
-
-       if (type > MAX_DISK_TYPES) return;
+       driver_list_entry_t *entry, **pprev;
+
+       if (type > MAX_DISK_TYPES)
+               return;
 
        entry = malloc(sizeof(driver_list_entry_t));
        entry->blkif = blkif;
-       entry->next = NULL;
-       ptr = active_disks[type];
-
-       if (ptr == NULL) {
-               active_disks[type] = entry;
-               entry->prev = NULL;
-               return;
-       }
-
-       while (ptr != NULL) {
-               last = ptr;
-               ptr = ptr->next;
-       }
-
-       /*We've found the end of the list*/
-        last->next = entry;
-       entry->prev = last;
-       
-       return;
+       entry->next  = NULL;
+
+       pprev = &active_disks[type];
+       while (*pprev != NULL)
+               pprev = &(*pprev)->next;
+
+       *pprev = entry;
+       entry->pprev = pprev;
 }
 
 static int del_disktype(blkif_t *blkif)
 {
-       driver_list_entry_t *ptr, *cur, *last;
+       driver_list_entry_t *entry, **pprev;
        int type = blkif->drivertype, count = 0, close = 0;
 
-       if (type > MAX_DISK_TYPES) return 1;
-
-       ptr = active_disks[type];
-       last = NULL;
-       while (ptr != NULL) {
-               count++;
-               if (blkif == ptr->blkif) {
-                       cur = ptr;
-                       if (ptr->next != NULL) {
-                               /*There's more later in the chain*/
-                               if (!last) {
-                                       /*We're first in the list*/
-                                       active_disks[type] = ptr->next;
-                                       ptr = ptr->next;
-                                       ptr->prev = NULL;
-                               }
-                               else {
-                                       /*We're sandwiched*/
-                                       last->next = ptr->next;
-                                       ptr = ptr->next;
-                                       ptr->prev = last;
-                               }
-                               
-                       } else if (last) {
-                               /*There's more earlier in the chain*/
-                               last->next = NULL;
-                       } else {
-                               /*We're the only entry*/
-                               active_disks[type] = NULL;
-                               if(dtypes[type]->single_handler == 1) 
-                                       close = 1;
-                       }
-                       DPRINTF("DEL_DISKTYPE: Freeing entry\n");
-                       free(cur);
-                       if (dtypes[type]->single_handler == 0) close = 1;
-
-                       return close;
-               }
-               last = ptr;
-               ptr = ptr->next;
-       }
-       DPRINTF("DEL_DISKTYPE: No match\n");
-       return 1;
+       if (type > MAX_DISK_TYPES)
+               return 1;
+
+       pprev = &active_disks[type];
+       while ((*pprev != NULL) && ((*pprev)->blkif != blkif))
+               pprev = &(*pprev)->next;
+
+       if ((entry = *pprev) == NULL) {
+               DPRINTF("DEL_DISKTYPE: No match\n");
+               return 1;
+       }
+
+       *pprev = entry->next;
+       if (entry->next)
+               entry->next->pprev = pprev;
+
+       DPRINTF("DEL_DISKTYPE: Freeing entry\n");
+       free(entry);
+
+       /* Caller should close() if no single controller, or list is empty. */
+       return (!dtypes[type]->single_handler || (active_disks[type] == NULL));
 }
 
 static int write_msg(int fd, int msgtype, void *ptr, void *ptr2)
@@ -592,8 +560,8 @@ int unmap_blktapctrl(blkif_t *blkif)
        if (del_disktype(blkif)) {
                close(blkif->fds[WRITE]);
                close(blkif->fds[READ]);
-
-       }
+       }
+
        return 0;
 }
 
@@ -639,9 +607,11 @@ int main(int argc, char *argv[])
        struct xs_handle *h;
        struct pollfd  pfd[NUM_POLL_FDS];
        pid_t process;
+       char buf[128];
 
        __init_blkif();
-       openlog("BLKTAPCTRL", LOG_CONS|LOG_ODELAY, LOG_DAEMON);
+       snprintf(buf, sizeof(buf), "BLKTAPCTRL[%d]", getpid());
+       openlog(buf, LOG_CONS|LOG_ODELAY, LOG_DAEMON);
        daemon(0,0);
 
        print_drivers();
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/blktap/drivers/tapdisk.c
--- a/tools/blktap/drivers/tapdisk.c    Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/blktap/drivers/tapdisk.c    Thu Nov 09 15:37:17 2006 -0500
@@ -79,31 +79,17 @@ static void unmap_disk(struct td_state *
 {
        tapdev_info_t *info = s->ring_info;
        struct tap_disk *drv = s->drv;
-       fd_list_entry_t *ptr, *prev;
+       fd_list_entry_t *entry;
 
        drv->td_close(s);
 
        if (info != NULL && info->mem > 0)
                munmap(info->mem, getpagesize() * BLKTAP_MMAP_REGION_SIZE);
 
-       ptr = s->fd_entry;
-       prev = ptr->prev;
-
-       if (prev) {
-               /*There are entries earlier in the list*/
-               prev->next = ptr->next;
-               if (ptr->next) {
-                       ptr = ptr->next;
-                       ptr->prev = prev;
-               }
-       } else {
-               /*We are the first entry in list*/
-               if (ptr->next) {
-                       ptr = ptr->next;
-                       fd_start = ptr;
-                       ptr->prev = NULL;
-               } else fd_start = NULL;
-       }
+       entry = s->fd_entry;
+       *entry->pprev = entry->next;
+       if (entry->next)
+               entry->next->pprev = entry->pprev;
 
        close(info->fd);
 
@@ -144,35 +130,29 @@ static inline int LOCAL_FD_SET(fd_set *r
        return 0;
 }
 
-static inline fd_list_entry_t *add_fd_entry(int tap_fd, int io_fd[MAX_IOFD], 
struct td_state *s)
-{
-       fd_list_entry_t *ptr, *last, *entry;
+static inline fd_list_entry_t *add_fd_entry(
+       int tap_fd, int io_fd[MAX_IOFD], struct td_state *s)
+{
+       fd_list_entry_t **pprev, *entry;
        int i;
+
        DPRINTF("Adding fd_list_entry\n");
 
        /*Add to linked list*/
        s->fd_entry = entry = malloc(sizeof(fd_list_entry_t));
        entry->tap_fd = tap_fd;
-       for (i = 0; i < MAX_IOFD; i++) entry->io_fd[i] = io_fd[i];
+       for (i = 0; i < MAX_IOFD; i++)
+               entry->io_fd[i] = io_fd[i];
        entry->s = s;
        entry->next = NULL;
 
-       ptr = fd_start;
-       if (ptr == NULL) {
-               /*We are the first entry*/
-               fd_start = entry;
-               entry->prev = NULL;
-               goto finish;
-       }
-
-       while (ptr != NULL) {
-               last = ptr;
-               ptr = ptr->next;
-       }
-       last->next = entry;
-       entry->prev = last;
-
- finish:
+       pprev = &fd_start;
+       while (*pprev != NULL)
+               pprev = &(*pprev)->next;
+
+       *pprev = entry;
+       entry->pprev = pprev;
+
        return entry;
 }
 
@@ -401,7 +381,6 @@ static inline int write_rsp_to_ring(stru
        
        rsp_d = RING_GET_RESPONSE(&info->fe_ring, info->fe_ring.rsp_prod_pvt);
        memcpy(rsp_d, rsp, sizeof(blkif_response_t));
-       wmb();
        info->fe_ring.rsp_prod_pvt++;
        
        return 0;
@@ -582,12 +561,14 @@ int main(int argc, char *argv[])
        fd_list_entry_t *ptr;
        struct tap_disk *drv;
        struct td_state *s;
+       char openlogbuf[128];
        
        if (argc != 3) usage();
 
        daemonize();
 
-       openlog("TAPDISK", LOG_CONS|LOG_ODELAY, LOG_DAEMON);
+       snprintf(openlogbuf, sizeof(openlogbuf), "TAPDISK[%d]", getpid());
+       openlog(openlogbuf, LOG_CONS|LOG_ODELAY, LOG_DAEMON);
        /*Setup signal handlers*/
        signal (SIGBUS, sig_handler);
        signal (SIGINT, sig_handler);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/blktap/drivers/tapdisk.h
--- a/tools/blktap/drivers/tapdisk.h    Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/blktap/drivers/tapdisk.h    Thu Nov 09 15:37:17 2006 -0500
@@ -61,7 +61,6 @@
 
 /* Things disks need to know about, these should probably be in a higher-level
  * header. */
-#define MAX_REQUESTS            64
 #define MAX_SEGMENTS_PER_REQ    11
 #define SECTOR_SHIFT             9
 #define DEFAULT_SECTOR_SIZE    512
@@ -191,9 +190,8 @@ static disk_info_t *dtypes[] = {
 };
 
 typedef struct driver_list_entry {
-       void *blkif;
-       void *prev;
-       void *next;
+       struct blkif *blkif;
+       struct driver_list_entry **pprev, *next;
 } driver_list_entry_t;
 
 typedef struct fd_list_entry {
@@ -201,8 +199,7 @@ typedef struct fd_list_entry {
        int  tap_fd;
        int  io_fd[MAX_IOFD];
        struct td_state *s;
-       void *prev;
-       void *next;
+       struct fd_list_entry **pprev, *next;
 } fd_list_entry_t;
 
 int qcow_create(const char *filename, uint64_t total_size,
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/blktap/lib/blktaplib.h
--- a/tools/blktap/lib/blktaplib.h      Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/blktap/lib/blktaplib.h      Thu Nov 09 15:37:17 2006 -0500
@@ -41,7 +41,7 @@
 #include <sys/types.h>
 #include <unistd.h>
 
-#define BLK_RING_SIZE __RING_SIZE((blkif_sring_t *)0, getpagesize())
+#define BLK_RING_SIZE __RING_SIZE((blkif_sring_t *)0, XC_PAGE_SIZE)
 
 /* size of the extra VMA area to map in attached pages. */
 #define BLKTAP_VMA_PAGES BLK_RING_SIZE
@@ -74,10 +74,10 @@ static inline int BLKTAP_MODE_VALID(unsi
                ( arg == BLKTAP_MODE_INTERPOSE    ) );
 }
 
-#define MAX_REQUESTS            64
+#define MAX_REQUESTS            BLK_RING_SIZE
 
 #define BLKTAP_IOCTL_KICK 1
-#define MAX_PENDING_REQS 64
+#define MAX_PENDING_REQS       BLK_RING_SIZE
 #define BLKTAP_DEV_DIR   "/dev/xen"
 #define BLKTAP_DEV_NAME  "blktap"
 #define BLKTAP_DEV_MINOR 0
@@ -199,7 +199,6 @@ int xs_fire_next_watch(struct xs_handle 
 
 
 /* Abitrary values, must match the underlying driver... */
-#define MAX_PENDING_REQS 64
 #define MAX_TAP_DEV 100
 
 /* Accessing attached data page mappings */
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/check/check_brctl
--- a/tools/check/check_brctl   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/check/check_brctl   Thu Nov 09 15:37:17 2006 -0500
@@ -1,10 +1,27 @@
-#!/bin/bash
+#!/bin/sh
 # CHECK-INSTALL
 
-function error {
-   echo
-   echo '  *** Check for the bridge control utils (brctl) FAILED'
-   exit 1
-}
+RC=0
 
-which brctl 1>/dev/null 2>&1 || error
+case ${OS} in
+OpenBSD|NetBSD|FreeBSD)
+       # These systems have a bridge builtin
+       TOOL="brconfig"
+       which ${TOOL} 1>/dev/null 2>&1 || RC=1 
+       ;;
+Linux)
+       TOOL="brctl"
+       which ${TOOL} 1>/dev/null 2>&1 || RC=1
+       ;;
+*)
+       TOOL=""
+       echo "Unknown OS" && RC=1
+       ;;
+esac
+
+if test ${RC} -ne 0; then
+       echo
+       echo " *** Check for the bridge control utils (${TOOL}) FAILED"
+fi
+
+exit ${RC} 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/check/check_iproute
--- a/tools/check/check_iproute Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/check/check_iproute Thu Nov 09 15:37:17 2006 -0500
@@ -1,11 +1,26 @@
-#!/bin/bash
+#!/bin/sh
 # CHECK-INSTALL
 
-function error {
-   echo
-   echo '  *** Check for iproute (ip addr) FAILED'
-   exit 1
-}
+RC=0
 
-ip addr list 1>/dev/null 2>&1 || error
+case ${OS} in
+OpenBSD|NetBSD|FreeBSD)
+       TOOL="ifconfig"
+       eval ${TOOL} -a 1>/dev/null 2>&1 || RC=1 
+       ;;
+Linux)
+       TOOL="ip addr"
+       eval ${TOOL} list 1>/dev/null 2>&1 || RC=1 
+       ;;
+*)
+       TOOL=""
+       echo "Unknown OS" && RC=1 
+       ;;
+esac
 
+if test ${RC} -ne 0; then
+       echo
+       echo " *** Check for iproute (${TOOL}) FAILED"
+fi
+
+exit ${RC} 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/check/check_python
--- a/tools/check/check_python  Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/check/check_python  Thu Nov 09 15:37:17 2006 -0500
@@ -1,10 +1,13 @@
-#!/bin/bash
+#!/bin/sh
 # CHECK-BUILD CHECK-INSTALL
 
-function error {
-    echo
-    echo "  *** Check for Python version >= 2.2 FAILED"
-    exit 1
-}
+RC=0
 
-python -V 2>&1 | cut -d ' ' -f 2 | grep -q '^2.[2345]' || error
+python -V 2>&1 | cut -d ' ' -f 2 | grep -q '^2.[2345]' || RC=1
+
+if test ${RC} -ne 0; then
+       echo
+       echo " *** Check for Python version >= 2.2 FAILED"
+fi
+
+exit ${RC} 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/check/check_zlib_devel
--- a/tools/check/check_zlib_devel      Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/check/check_zlib_devel      Thu Nov 09 15:37:17 2006 -0500
@@ -1,11 +1,14 @@
-#!/bin/bash
+#!/bin/sh
 # CHECK-BUILD
 
-function error {
-    echo
-    echo "  *** Check for zlib headers FAILED"
-    exit 1
-}
+RC=0
 
 set -e
-[ -e /usr/include/zlib.h ] || error
+test -r /usr/include/zlib.h || RC=1
+
+if test ${RC} -ne 0; then
+       echo
+       echo " *** Check for zlib headers FAILED"
+fi 
+
+exit ${RC}
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/check/check_zlib_lib
--- a/tools/check/check_zlib_lib        Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/check/check_zlib_lib        Thu Nov 09 15:37:17 2006 -0500
@@ -1,11 +1,14 @@
-#!/bin/bash
+#!/bin/sh
 # CHECK-BUILD CHECK-INSTALL
 
-function error {
-    echo
-    echo "  *** Check for zlib library FAILED"
-    exit 1
-}
+RC=0
 
 set -e
-ldconfig -p | grep -q libz.so || error
+ldconfig -v 2>&1 | grep -q libz.so || RC=1
+
+if test ${RC} -ne 0; then
+       echo
+       echo " *** Check for zlib library FAILED"
+fi
+
+exit ${RC} 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/check/chk
--- a/tools/check/chk   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/check/chk   Thu Nov 09 15:37:17 2006 -0500
@@ -1,8 +1,9 @@
-#!/bin/bash
+#!/bin/sh
 
-function usage {
+func_usage ()
+{
     echo "Usage:"
-    echo "\t$0 [build|install|clean]"
+    echo "     $0 [build|install|clean]"
     echo
     echo "Check suitability for Xen build or install."
     echo "Exit with 0 if OK, 1 if not."
@@ -12,9 +13,13 @@ function usage {
     exit 1
 }
 
-export PATH=${PATH}:/sbin:/usr/sbin
+PATH=${PATH}:/sbin:/usr/sbin
+OS=`uname -s`
+export PATH OS
 
-[ `uname -s` = SunOS ] && exit 0
+if test "${OS}" = "SunOS"; then
+       exit 0
+fi
 
 case $1 in
     build)
@@ -27,7 +32,7 @@ case $1 in
         exit 0
         ;;
     *)
-        usage
+        func_usage
         ;;
 esac
 
@@ -56,4 +61,4 @@ for f in check_* ; do
     fi
 done
 
-exit $failed
+exit ${failed}
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/console/Makefile
--- a/tools/console/Makefile    Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/console/Makefile    Thu Nov 09 15:37:17 2006 -0500
@@ -5,7 +5,7 @@ DAEMON_INSTALL_DIR = /usr/sbin
 DAEMON_INSTALL_DIR = /usr/sbin
 CLIENT_INSTALL_DIR = /usr/$(LIBDIR)/xen/bin
 
-CFLAGS  += -Werror -g
+CFLAGS  += -Werror
 
 CFLAGS  += -I $(XEN_LIBXC)
 CFLAGS  += -I $(XEN_XENSTORE)
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/examples/blktap
--- a/tools/examples/blktap     Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/examples/blktap     Thu Nov 09 15:37:17 2006 -0500
@@ -7,7 +7,7 @@ dir=$(dirname "$0")
 
 findCommand "$@"
 
-if [ "$command" == 'add' ]
+if [ "$command" = 'add' ]
 then
   success
 fi
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/examples/block
--- a/tools/examples/block      Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/examples/block      Thu Nov 09 15:37:17 2006 -0500
@@ -68,7 +68,7 @@ check_sharing()
   local devmm=$(device_major_minor "$dev")
   local file
 
-  if [ "$mode" == 'w' ]
+  if [ "$mode" = 'w' ]
   then
     toskip="^$"
   else
@@ -81,7 +81,7 @@ check_sharing()
     then
       local d=$(device_major_minor "$file")
 
-      if [ "$d" == "$devmm" ]
+      if [ "$d" = "$devmm" ]
       then
         echo 'local'
         return
@@ -96,9 +96,9 @@ check_sharing()
     do
       d=$(xenstore_read_default "$base_path/$dom/$dev/physical-device" "")
 
-      if [ "$d" == "$devmm" ]
+      if [ "$d" = "$devmm" ]
       then
-        if [ "$mode" == 'w' ]
+        if [ "$mode" = 'w' ]
         then
           if ! same_vm $dom
           then
@@ -109,7 +109,7 @@ check_sharing()
           local m=$(xenstore_read "$base_path/$dom/$dev/mode")
           m=$(canonicalise_mode "$m")
 
-          if [ "$m" == 'w' ]
+          if [ "$m" = 'w' ]
           then
             if ! same_vm $dom
             then
@@ -138,7 +138,7 @@ same_vm()
   local othervm=$(xenstore_read_default "/local/domain/$otherdom/vm"         \
                   "$FRONTEND_UUID")
 
-  [ "$FRONTEND_UUID" == "$othervm" ]
+  [ "$FRONTEND_UUID" = "$othervm" ]
 }
 
 
@@ -153,7 +153,7 @@ check_device_sharing()
   local mode=$(canonicalise_mode "$2")
   local result
 
-  if [ "$mode" == '!' ]
+  if [ "x$mode" = 'x!' ]
   then
     return 0
   fi
@@ -202,7 +202,7 @@ do_ebusy()
   local mode="$2"
   local result="$3"
 
-  if [ "$result" == 'guest' ]
+  if [ "$result" = 'guest' ]
   then
     dom='a guest '
     when='now'
@@ -211,7 +211,7 @@ do_ebusy()
     when='by a guest'
   fi
 
-  if [ "$mode" == 'w' ]
+  if [ "$mode" = 'w' ]
   then
     m1=''
     m2=''
@@ -266,7 +266,7 @@ case "$command" in
 
         claim_lock "block"
 
-        if [ "$mode" == 'w' ] && ! stat "$file" -c %A | grep -q w
+        if [ "$mode" = 'w' ] && ! stat "$file" -c %A | grep -q w
         then
           release_lock "block"
           ebusy \
@@ -287,7 +287,7 @@ mount it read-write in a guest domain."
           if [ "$f" ]
           then
             # $dev is in use.  Check sharing.
-            if [ "$mode" == '!' ]
+            if [ "x$mode" = 'x!' ]
             then
               continue
             fi
@@ -307,7 +307,7 @@ mount it read-write in a guest domain."
                 do
                   d=$(xenstore_read_default \
                         "$XENBUS_BASE_PATH/$dom/$domdev/node" "")
-                  if [ "$d" == "$dev" ]
+                  if [ "$d" = "$dev" ]
                   then
                     f=$(xenstore_read "$XENBUS_BASE_PATH/$dom/$domdev/params")
                     found=1
@@ -347,7 +347,7 @@ mount it read-write in a guest domain."
             f=$(readlink -f "$f" || echo $(dirname "$file")/$(basename "$f"))
 
 
-            if [ "$f" == "$file" ]
+            if [ "$f" = "$file" ]
             then
               check_file_sharing "$file" "$dev" "$mode"
             fi
@@ -355,14 +355,14 @@ mount it read-write in a guest domain."
             # $dev is not in use, so we'll remember it for use later; we want
             # to finish the sharing check first.
 
-            if [ "$loopdev" == '' ]
+            if [ "$loopdev" = '' ]
             then
               loopdev="$dev"
             fi
           fi
         done
 
-        if [ "$loopdev" == '' ]
+        if [ "$loopdev" = '' ]
         then
           fatal 'Failed to find an unused loop device'
         fi
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/examples/external-device-migrate
--- a/tools/examples/external-device-migrate    Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/examples/external-device-migrate    Thu Nov 09 15:37:17 2006 -0500
@@ -55,41 +55,27 @@ function evaluate_params()
 {
        local step host domname typ recover filename func stype
        stype=""
-       while [ 1 ]; do
-               if [ "$1" == "-step" ]; then
-                       shift
-                       step=$1
-               elif [ "$1" == "-host" ]; then
-                       shift
-                       host=$1
-               elif [ "$1" == "-domname" ]; then
-                       shift
-                       domname=$1
-               elif [ "$1" == "-type" ]; then
-                       shift
-                       typ=$1
-               elif [ "$1" == "-subtype" ]; then
-                       shift
-                       stype="_$1"
-               elif [ "$1" == "-recover" ]; then
-                       recover=1
-               elif [ "$1" == "-help" ]; then
-                       ext_dev_migrate_usage
-                       exit
-               else
-                       break
-               fi
-               shift
+       while [ $# -ge 1 ]; do
+               case "$1" in
+               -step)          step=$2; shift 2;;
+               -host)          host=$2; shift 2;;
+               -domname)       domname=$2; shift 2;;
+               -type)          type=$2; shift 2;;
+               -subtype)       subtype=$2; shift 2;;
+               -recover)       recover=1; shift;;
+               -help)          ext_dev_migrate_usage; exit 0;;
+               *)              break;;
+               esac
        done
 
-       if [ "$step"    == "" -o \
-            "$host"    == "" -o \
-            "$typ"     == "" -o \
-            "$domname" == "" ]; then
-               echo "Error: Parameter(s) missing (-step/-host/-type/-domname)"
-               echo ""
-               echo "$0 -help for usage."
-               exit
+       if [ "$step"    = "" -o \
+            "$host"    = "" -o \
+            "$typ"     = "" -o \
+            "$domname" = "" ]; then
+               echo "Error: Parameter(s) missing (-step/-host/-type/-domname)" 
1>&2
+               echo "" 1>&2
+               echo "$0 -help for usage." 1>&2
+               exit 1
        fi
 
        filename="$dir/$typ$stype-migration.sh"
@@ -99,7 +85,7 @@ function evaluate_params()
        fi
        . "$filename"
 
-       if [ "$recover" == "1" ]; then
+       if [ "$recover" = "1" ]; then
                func="$typ"_recover
                eval $func $host $domname $step $*
        else
@@ -108,4 +94,4 @@ function evaluate_params()
        fi
 }
 
-evaluate_params $*
+evaluate_params "$@"
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/examples/vif-bridge
--- a/tools/examples/vif-bridge Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/examples/vif-bridge Thu Nov 09 15:37:17 2006 -0500
@@ -61,7 +61,7 @@ handle_iptable
 handle_iptable
 
 log debug "Successful vif-bridge $command for $vif, bridge $bridge."
-if [ "$command" == "online" ]
+if [ "$command" = "online" ]
 then
   success
 fi
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/examples/vif-nat
--- a/tools/examples/vif-nat    Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/examples/vif-nat    Thu Nov 09 15:37:17 2006 -0500
@@ -72,7 +72,7 @@ dotted_quad()
 }
 
 
-if [ "$ip" == "" ]
+if [ "$ip" = "" ]
 then
   ip=$(ip_from_dom)
 fi
@@ -152,7 +152,7 @@ handle_iptable
 handle_iptable
 
 log debug "Successful vif-nat $command for $vif."
-if [ "$command" == "online" ]
+if [ "$command" = "online" ]
 then
   success
 fi
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/examples/vif-route
--- a/tools/examples/vif-route  Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/examples/vif-route  Thu Nov 09 15:37:17 2006 -0500
@@ -50,7 +50,7 @@ handle_iptable
 handle_iptable
 
 log debug "Successful vif-route $command for $vif."
-if [ "$command" == "online" ]
+if [ "$command" = "online" ]
 then
   success
 fi
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/examples/vtpm-common.sh
--- a/tools/examples/vtpm-common.sh     Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/examples/vtpm-common.sh     Thu Nov 09 15:37:17 2006 -0500
@@ -226,7 +226,7 @@ function vtpmdb_remove_entry () {
 # Returns 'resume' or 'create'
 function vtpm_get_create_reason () {
        local resume
-       resume=$(xenstore-read $XENBUS_PATH/resume)
+       resume=$(xenstore_read $XENBUS_PATH/resume)
        if [ "$resume" == "True" ]; then
                echo "resume"
        else
@@ -287,6 +287,8 @@ function vtpm_create_instance () {
 #entry is kept in the VTPMDB file.
 function vtpm_remove_instance () {
        local instance reason domname
+       #Stop script execution quietly if path does not exist (anymore)
+       xenstore-exists "$XENBUS_PATH"/domain
        domname=$(xenstore_read "$XENBUS_PATH"/domain)
 
        if [ "$domname" != "" ]; then
@@ -383,7 +385,7 @@ function vtpm_domid_from_name () {
        local id name ids
        ids=$(xenstore-list /local/domain)
        for id in $ids; do
-               name=$(xenstore-read /local/domain/$id/name)
+               name=$(xenstore_read /local/domain/$id/name)
                if [ "$name" == "$1" ]; then
                        echo "$id"
                        return
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/examples/xend-config.sxp
--- a/tools/examples/xend-config.sxp    Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/examples/xend-config.sxp    Thu Nov 09 15:37:17 2006 -0500
@@ -51,7 +51,7 @@
 # regular expressions will be accepted.
 #
 # For example:
-#  (xend-relocation-hosts-allow '^localhost$ ^.*\.example\.org$')
+#  (xend-relocation-hosts-allow '^localhost$ ^.*\\.example\\.org$')
 #
 #(xend-relocation-hosts-allow '')
 (xend-relocation-hosts-allow '^localhost$ ^localhost\\.localdomain$')
@@ -135,3 +135,7 @@
 # to 127.0.0.1  To restore old 'listen everywhere' behaviour
 # set this to 0.0.0.0
 #(vnc-listen '127.0.0.1')
+
+# The default password for VNC console on HVM domain.
+# Empty string is no authentication.
+(vncpasswd '')
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/examples/xmexample.hvm
--- a/tools/examples/xmexample.hvm      Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/examples/xmexample.hvm      Thu Nov 09 15:37:17 2006 -0500
@@ -47,9 +47,6 @@ name = "ExampleHVMDomain"
 
 # enable/disable HVM guest ACPI, default=0 (disabled)
 #acpi=0
-
-# enable/disable HVM guest APIC, default=0 (disabled)
-#apic=0
 
 # List of which CPUS this domain is allowed to use, default Xen picks
 #cpus = ""         # leave to Xen to pick
@@ -150,6 +147,11 @@ vnc=1
 #vncconsole=0
 
 #----------------------------------------------------------------------------
+# set password for domain's VNC console
+# default is depents on vncpasswd in xend-config.sxp
+vncpasswd=''
+
+#----------------------------------------------------------------------------
 # no graphics, use serial port
 #nographic=0
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/examples/xmexample.vti
--- a/tools/examples/xmexample.vti      Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/examples/xmexample.vti      Thu Nov 09 15:37:17 2006 -0500
@@ -95,6 +95,11 @@ vnc=0
 #vncconsole=0
 
 #----------------------------------------------------------------------------
+# set password for domain's VNC console
+# default is depents on vncpasswd in xend-config.sxp
+vncpasswd=''
+
+#----------------------------------------------------------------------------
 # no graphics, use serial port
 #nographic=0
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/firmware/Makefile
--- a/tools/firmware/Makefile   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/firmware/Makefile   Thu Nov 09 15:37:17 2006 -0500
@@ -9,7 +9,6 @@ SUBDIRS :=
 SUBDIRS :=
 SUBDIRS += rombios
 SUBDIRS += vgabios
-SUBDIRS += acpi
 SUBDIRS += vmxassist
 SUBDIRS += hvmloader
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/firmware/hvmloader/Makefile
--- a/tools/firmware/hvmloader/Makefile Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/firmware/hvmloader/Makefile Thu Nov 09 15:37:17 2006 -0500
@@ -32,35 +32,38 @@ XENINC   =-I$(XEN_ROOT)/tools/libxc
 XENINC   =-I$(XEN_ROOT)/tools/libxc
 
 # Disable PIE/SSP if GCC supports them. They can break us.
-CFLAGS  += $(call test-gcc-flag,$(CC),-nopie)
-CFLAGS  += $(call test-gcc-flag,$(CC),-fno-stack-protector)
-CFLAGS  += $(call test-gcc-flag,$(CC),-fno-stack-protector-all)
+CFLAGS  += $(call cc-option,$(CC),-nopie,)
+CFLAGS  += $(call cc-option,$(CC),-fno-stack-protector,)
+CFLAGS  += $(call cc-option,$(CC),-fno-stack-protector-all,)
 
 OBJCOPY  = objcopy
 CFLAGS  += $(DEFINES) -I. $(XENINC) -fno-builtin -O2 -msoft-float
-LDFLAGS  = -m32 -nostdlib -Wl,-N -Wl,-Ttext -Wl,$(LOADADDR)
+LDFLAGS  = -nostdlib -Wl,-N -Wl,-Ttext -Wl,$(LOADADDR)
 
-SRCS = hvmloader.c acpi_madt.c mp_tables.c util.c smbios.c
+SRCS = hvmloader.c acpi_madt.c mp_tables.c util.c smbios.c acpi_utils.c
 OBJS = $(patsubst %.c,%.o,$(SRCS))
 
 .PHONY: all
 all: hvmloader
 
+acpi/acpi.bin:
+       $(MAKE) -C acpi
+
 hvmloader: roms.h $(SRCS)
        $(CC) $(CFLAGS) -c $(SRCS)
-       $(CC) $(LDFLAGS) -o hvmloader.tmp $(OBJS)
+       $(CC) $(CFLAGS) $(LDFLAGS) -o hvmloader.tmp $(OBJS)
        $(OBJCOPY) hvmloader.tmp hvmloader
        rm -f hvmloader.tmp
 
-roms.h:        ../rombios/BIOS-bochs-latest ../vgabios/VGABIOS-lgpl-latest.bin 
../vgabios/VGABIOS-lgpl-latest.cirrus.bin ../vmxassist/vmxassist.bin 
../acpi/acpi.bin
+roms.h:        ../rombios/BIOS-bochs-latest ../vgabios/VGABIOS-lgpl-latest.bin 
../vgabios/VGABIOS-lgpl-latest.cirrus.bin ../vmxassist/vmxassist.bin 
acpi/acpi.bin
        sh ./mkhex rombios ../rombios/BIOS-bochs-latest > roms.h
        sh ./mkhex vgabios_stdvga ../vgabios/VGABIOS-lgpl-latest.bin >> roms.h
        sh ./mkhex vgabios_cirrusvga ../vgabios/VGABIOS-lgpl-latest.cirrus.bin 
>> roms.h
        sh ./mkhex vmxassist ../vmxassist/vmxassist.bin >> roms.h
-       sh ./mkhex acpi ../acpi/acpi.bin >> roms.h
+       sh ./mkhex acpi acpi/acpi.bin >> roms.h
 
 .PHONY: clean
 clean:
        rm -f roms.h acpi.h
        rm -f hvmloader hvmloader.tmp hvmloader.o $(OBJS)
-
+       $(MAKE) -C acpi clean
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/firmware/hvmloader/acpi_madt.c
--- a/tools/firmware/hvmloader/acpi_madt.c      Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/firmware/hvmloader/acpi_madt.c      Thu Nov 09 15:37:17 2006 -0500
@@ -18,9 +18,9 @@
  * Place - Suite 330, Boston, MA 02111-1307 USA.
  */
 
-#include "../acpi/acpi2_0.h"
-#include "../acpi/acpi_madt.h"
+#include "acpi/acpi2_0.h"
 #include "util.h"
+#include "acpi_utils.h"
 #include <xen/hvm/hvm_info_table.h>
 
 #define NULL ((void*)0)
@@ -29,160 +29,134 @@ static struct hvm_info_table *table = NU
 
 static int validate_hvm_info(struct hvm_info_table *t)
 {
-       char signature[] = "HVM INFO";
-       uint8_t *ptr = (uint8_t *)t;
-       uint8_t sum = 0;
-       int i;
+    char signature[] = "HVM INFO";
+    uint8_t *ptr = (uint8_t *)t;
+    uint8_t sum = 0;
+    int i;
 
-       /* strncmp(t->signature, "HVM INFO", 8) */
-       for (i = 0; i < 8; i++) {
-               if (signature[i] != t->signature[i]) {
-                       puts("Bad hvm info signature\n");
-                       return 0;
-               }
-       }
+    /* strncmp(t->signature, "HVM INFO", 8) */
+    for (i = 0; i < 8; i++) {
+        if (signature[i] != t->signature[i]) {
+            puts("Bad hvm info signature\n");
+            return 0;
+        }
+    }
 
-       for (i = 0; i < t->length; i++)
-               sum += ptr[i];
+    for (i = 0; i < t->length; i++)
+        sum += ptr[i];
 
-       return (sum == 0);
+    return (sum == 0);
 }
 
 /* xc_vmx_builder wrote hvm info at 0x9F800. Return it. */
 struct hvm_info_table *
 get_hvm_info_table(void)
 {
-       struct hvm_info_table *t;
+    struct hvm_info_table *t;
 
-       if (table != NULL)
-               return table;
+    if (table != NULL)
+        return table;
 
-       t = (struct hvm_info_table *)HVM_INFO_PADDR;
+    t = (struct hvm_info_table *)HVM_INFO_PADDR;
 
-       if (!validate_hvm_info(t)) {
-               puts("Bad hvm info table\n");
-               return NULL;
-       }
+    if (!validate_hvm_info(t)) {
+        puts("Bad hvm info table\n");
+        return NULL;
+    }
 
-       table = t;
+    table = t;
 
-       return table;
+    return table;
 }
 
 int
 get_vcpu_nr(void)
 {
-       struct hvm_info_table *t = get_hvm_info_table();
-       return (t ? t->nr_vcpus : 1); /* default 1 vcpu */
+    struct hvm_info_table *t = get_hvm_info_table();
+    return (t ? t->nr_vcpus : 1); /* default 1 vcpu */
 }
 
 int
 get_acpi_enabled(void)
 {
-       struct hvm_info_table *t = get_hvm_info_table();
-       return (t ? t->acpi_enabled : 0); /* default no acpi */
+    struct hvm_info_table *t = get_hvm_info_table();
+    return (t ? t->acpi_enabled : 0); /* default no acpi */
 }
 
 
 static void *
 acpi_madt_get_madt(unsigned char *acpi_start)
 {
-       ACPI_2_0_RSDP *rsdp=NULL;
-       ACPI_2_0_RSDT *rsdt=NULL;
-       ACPI_MULTIPLE_APIC_DESCRIPTION_TABLE *madt;
+    struct acpi_20_rsdt *rsdt;
+    struct acpi_20_madt *madt;
 
-       rsdp = (ACPI_2_0_RSDP *)(acpi_start + sizeof(ACPI_2_0_FACS));
-       if (rsdp->Signature != ACPI_2_0_RSDP_SIGNATURE) {
-               puts("Bad RSDP signature\n");
-               return NULL;
-       }
+    rsdt = acpi_rsdt_get(acpi_start);
+    if (rsdt == NULL)
+        return NULL;
 
-       rsdt= (ACPI_2_0_RSDT *)
-               (acpi_start + rsdp->RsdtAddress - ACPI_PHYSICAL_ADDRESS);
-       if (rsdt->Header.Signature != ACPI_2_0_RSDT_SIGNATURE) {
-               puts("Bad RSDT signature\n");
-               return NULL;
-       }
+    madt = (struct acpi_20_madt *)(acpi_start + rsdt->entry[1] -
+                                   ACPI_PHYSICAL_ADDRESS);
+    if (madt->header.header.signature != ACPI_2_0_MADT_SIGNATURE) {
+        puts("Bad MADT signature \n");
+        return NULL;
+    }
 
-       madt = (ACPI_MULTIPLE_APIC_DESCRIPTION_TABLE *)
-               ( acpi_start+ rsdt->Entry[1] - ACPI_PHYSICAL_ADDRESS);
-       if (madt->Header.Header.Signature !=
-           ACPI_MULTIPLE_APIC_DESCRIPTION_TABLE_SIGNATURE) {
-               puts("Bad MADT signature \n");
-               return NULL;
-       }
-
-       return madt;
-}
-
-static void
-set_checksum(void *start, int checksum_offset, int len)
-{
-       unsigned char sum = 0;
-       unsigned char *ptr;
-
-       ptr = start;
-       ptr[checksum_offset] = 0;
-       while (len--)
-               sum += *ptr++;
-
-       ptr = start;
-       ptr[checksum_offset] = -sum;
+    return madt;
 }
 
 static int
 acpi_madt_set_local_apics(
-       int nr_vcpu,
-       ACPI_MULTIPLE_APIC_DESCRIPTION_TABLE *madt)
+    int nr_vcpu,
+    struct acpi_20_madt *madt)
 {
-       int i;
+    int i;
 
-       if ((nr_vcpu > MAX_VIRT_CPUS) || (nr_vcpu < 0) || !madt)
-               return -1;
+    if ((nr_vcpu > MAX_VIRT_CPUS) || (nr_vcpu < 0) || !madt)
+        return -1;
 
-       for (i = 0; i < nr_vcpu; i++) {
-               madt->LocalApic[i].Type            = ACPI_PROCESSOR_LOCAL_APIC;
-               madt->LocalApic[i].Length          = sizeof 
(ACPI_LOCAL_APIC_STRUCTURE);
-               madt->LocalApic[i].AcpiProcessorId = i;
-               madt->LocalApic[i].ApicId          = i;
-               madt->LocalApic[i].Flags           = 1;
-       }
+    for (i = 0; i < nr_vcpu; i++) {
+        madt->lapic[i].type    = ACPI_PROCESSOR_LOCAL_APIC;
+        madt->lapic[i].length  = sizeof(struct acpi_20_madt_lapic);
+        madt->lapic[i].acpi_processor_id = i;
+        madt->lapic[i].apic_id = i;
+        madt->lapic[i].flags   = 1;
+    }
 
-       madt->Header.Header.Length =
-               sizeof(ACPI_MULTIPLE_APIC_DESCRIPTION_TABLE) -
-               (MAX_VIRT_CPUS - nr_vcpu)* sizeof(ACPI_LOCAL_APIC_STRUCTURE);
+    madt->header.header.length =
+        sizeof(struct acpi_20_madt) -
+        (MAX_VIRT_CPUS - nr_vcpu) * sizeof(struct acpi_20_madt_lapic);
 
-       return 0;
+    return 0;
 }
 
 #define FIELD_OFFSET(TYPE,Field) ((unsigned int)(&(((TYPE *) 0)->Field)))
 
 int acpi_madt_update(unsigned char *acpi_start)
 {
-       int rc;
-       ACPI_MULTIPLE_APIC_DESCRIPTION_TABLE *madt;
+    int rc;
+    struct acpi_20_madt *madt;
 
-       madt = acpi_madt_get_madt(acpi_start);
-       if (!madt)
-               return -1;
+    madt = acpi_madt_get_madt(acpi_start);
+    if (!madt)
+        return -1;
 
-       rc = acpi_madt_set_local_apics(get_vcpu_nr(), madt);
-       if (rc != 0)
-               return rc;
+    rc = acpi_madt_set_local_apics(get_vcpu_nr(), madt);
+    if (rc != 0)
+        return rc;
 
-       set_checksum(
-               madt, FIELD_OFFSET(ACPI_TABLE_HEADER, Checksum),
-               madt->Header.Header.Length);
+    set_checksum(
+        madt, FIELD_OFFSET(struct acpi_header, checksum),
+        madt->header.header.length);
 
-       return 0;
+    return 0;
 }
 
 /*
  * Local variables:
- *  c-file-style: "linux"
- *  indent-tabs-mode: t
- *  c-indent-level: 8
- *  c-basic-offset: 8
- *  tab-width: 8
+ * mode: C
+ * c-set-style: "BSD"
+ * c-basic-offset: 4
+ * tab-width: 4
+ * indent-tabs-mode: nil
  * End:
  */
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/firmware/hvmloader/hvmloader.c
--- a/tools/firmware/hvmloader/hvmloader.c      Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/firmware/hvmloader/hvmloader.c      Thu Nov 09 15:37:17 2006 -0500
@@ -22,9 +22,10 @@
  * Place - Suite 330, Boston, MA 02111-1307 USA.
  */
 #include "roms.h"
-#include "../acpi/acpi2_0.h"  /* for ACPI_PHYSICAL_ADDRESS */
+#include "acpi/acpi2_0.h"  /* for ACPI_PHYSICAL_ADDRESS */
 #include "hypercall.h"
 #include "util.h"
+#include "acpi_utils.h"
 #include "smbios.h"
 #include <xen/version.h>
 #include <xen/hvm/params.h>
@@ -164,8 +165,6 @@ int
 int
 main(void)
 {
-       struct xen_hvm_param hvm_param;
-
        puts("HVM Loader\n");
 
        init_hypercalls();
@@ -176,10 +175,7 @@ main(void)
        puts("Loading ROMBIOS ...\n");
        memcpy((void *)ROMBIOS_PHYSICAL_ADDRESS, rombios, sizeof(rombios));
 
-       hvm_param.domid = DOMID_SELF;
-       hvm_param.index = HVM_PARAM_APIC_ENABLED;
-       if (!hypercall_hvm_op(HVMOP_get_param, &hvm_param) && hvm_param.value)
-               create_mp_tables();
+        create_mp_tables();
        
        if (cirrus_check()) {
                puts("Loading Cirrus VGABIOS ...\n");
@@ -195,12 +191,18 @@ main(void)
                puts("Loading ACPI ...\n");
                acpi_madt_update((unsigned char *) acpi);
                if (ACPI_PHYSICAL_ADDRESS+sizeof(acpi) <= 0xF0000) {
+                       unsigned char *freemem = (unsigned char *)
+                                (ACPI_PHYSICAL_ADDRESS + sizeof(acpi));
                        /*
                         * Make sure acpi table does not overlap rombios
                         * currently acpi less than 8K will be OK.
                         */
                         memcpy((void *)ACPI_PHYSICAL_ADDRESS, acpi,
                                                                sizeof(acpi));
+                       acpi_update((unsigned char *)ACPI_PHYSICAL_ADDRESS,
+                                   sizeof(acpi),
+                                   (unsigned char *)0xF0000,
+                                   &freemem);
                }
        }
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/firmware/hvmloader/util.c
--- a/tools/firmware/hvmloader/util.c   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/firmware/hvmloader/util.c   Thu Nov 09 15:37:17 2006 -0500
@@ -18,7 +18,7 @@
  * Place - Suite 330, Boston, MA 02111-1307 USA.
  */
 
-#include "../acpi/acpi2_0.h"  /* for ACPI_PHYSICAL_ADDRESS */
+#include "acpi/acpi2_0.h"  /* for ACPI_PHYSICAL_ADDRESS */
 #include "util.h"
 #include <stdint.h>
 
@@ -227,4 +227,5 @@ uuid_to_string(char *dest, uint8_t *uuid
                byte_to_hex(p, uuid[i]);
                p += 2;
        }
-}
+       *p = 0;
+}
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/firmware/vmxassist/Makefile
--- a/tools/firmware/vmxassist/Makefile Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/firmware/vmxassist/Makefile Thu Nov 09 15:37:17 2006 -0500
@@ -32,14 +32,13 @@ XENINC=-I$(XEN_ROOT)/tools/libxc
 XENINC=-I$(XEN_ROOT)/tools/libxc
 
 # Disable PIE/SSP if GCC supports them. They can break us.
-CFLAGS  += $(call test-gcc-flag,$(CC),-nopie)
-CFLAGS  += $(call test-gcc-flag,$(CC),-fno-stack-protector)
-CFLAGS  += $(call test-gcc-flag,$(CC),-fno-stack-protector-all)
+CFLAGS  += $(call cc-option,$(CC),-nopie,)
+CFLAGS  += $(call cc-option,$(CC),-fno-stack-protector,)
+CFLAGS  += $(call cc-option,$(CC),-fno-stack-protector-all,)
 
 CPP      = cpp -P
 OBJCOPY  = objcopy -p -O binary -R .note -R .comment -R .bss -S --gap-fill=0
 CFLAGS  += $(DEFINES) -I. $(XENINC) -fno-builtin -O2 -msoft-float
-LDFLAGS  = -m elf_i386
 
 OBJECTS = head.o trap.o vm86.o setup.o util.o
 
@@ -48,7 +47,7 @@ all: vmxassist.bin
 
 vmxassist.bin: vmxassist.ld $(OBJECTS)
        $(CPP) $(DEFINES) vmxassist.ld > vmxassist.tmp
-       $(LD) -o vmxassist $(LDFLAGS) -nostdlib --fatal-warnings -N -T 
vmxassist.tmp $(OBJECTS)
+       $(LD) -o vmxassist $(LDFLAGS_DIRECT) -nostdlib --fatal-warnings -N -T 
vmxassist.tmp $(OBJECTS)
        nm -n vmxassist > vmxassist.sym
        $(OBJCOPY) vmxassist vmxassist.tmp
        dd if=vmxassist.tmp of=vmxassist.bin ibs=512 conv=sync
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/firmware/vmxassist/head.S
--- a/tools/firmware/vmxassist/head.S   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/firmware/vmxassist/head.S   Thu Nov 09 15:37:17 2006 -0500
@@ -59,7 +59,7 @@ _start16:
 
         /* go to protected mode */
         movl    %cr0, %eax
-        orl     $CR0_PE, %eax
+        orl     $(CR0_PE), %eax
         movl    %eax, %cr0
         data32  ljmp $0x08, $1f
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/firmware/vmxassist/setup.c
--- a/tools/firmware/vmxassist/setup.c  Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/firmware/vmxassist/setup.c  Thu Nov 09 15:37:17 2006 -0500
@@ -53,13 +53,10 @@ struct e820entry e820map[] = {
 struct e820entry e820map[] = {
        { 0x0000000000000000ULL, 0x000000000009F800ULL, E820_RAM },
        { 0x000000000009F800ULL, 0x0000000000000800ULL, E820_RESERVED },
-       { 0x00000000000A0000ULL, 0x0000000000020000ULL, E820_IO },
        { 0x00000000000C0000ULL, 0x0000000000040000ULL, E820_RESERVED },
        { 0x0000000000100000ULL, 0x0000000000000000ULL, E820_RAM },
-       { 0x0000000000000000ULL, 0x0000000000001000ULL, E820_SHARED_PAGE },
        { 0x0000000000000000ULL, 0x0000000000003000ULL, E820_NVS },
        { 0x0000000000003000ULL, 0x000000000000A000ULL, E820_ACPI },
-       { 0x00000000FEC00000ULL, 0x0000000001400000ULL, E820_IO },
 };
 #endif /* TEST */
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/firmware/vmxassist/trap.S
--- a/tools/firmware/vmxassist/trap.S   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/firmware/vmxassist/trap.S   Thu Nov 09 15:37:17 2006 -0500
@@ -106,7 +106,7 @@ common_trap:                                /* common trap 
handler *
        pushl   %es
        pushal
 
-       movl    $DATA_SELECTOR, %eax    /* make sure these are sane */
+       movl    $(DATA_SELECTOR), %eax  /* make sure these are sane */
        movl    %eax, %ds
        movl    %eax, %es
        movl    %eax, %fs
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/firmware/vmxassist/util.c
--- a/tools/firmware/vmxassist/util.c   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/firmware/vmxassist/util.c   Thu Nov 09 15:37:17 2006 -0500
@@ -29,6 +29,31 @@ static char *printnum(char *, unsigned l
 static char *printnum(char *, unsigned long, int);
 static void _doprint(void (*)(int), char const *, va_list);
 
+void
+cpuid_addr_value(uint64_t addr, uint64_t *value)
+{
+       uint32_t addr_low   = (uint32_t)addr;
+       uint32_t addr_high  = (uint32_t)(addr >> 32);
+       uint32_t value_low, value_high;
+       static unsigned int addr_leaf;
+
+       if (!addr_leaf) {
+               unsigned int eax, ebx, ecx, edx;
+               __asm__ __volatile__(
+                       "cpuid"
+                       : "=a" (eax), "=b" (ebx), "=c" (ecx), "=d" (edx)
+                       : "0" (0x40000000));
+               addr_leaf = eax + 1;
+       }
+
+       __asm__ __volatile__(
+               "cpuid"
+               : "=c" (value_low), "=d" (value_high)
+               : "a" (addr_leaf), "0" (addr_low), "1" (addr_high)
+               : "ebx");
+
+       *value = (uint64_t)value_high << 32 | value_low;
+}
 
 void
 dump_regs(struct regs *regs)
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/firmware/vmxassist/util.h
--- a/tools/firmware/vmxassist/util.h   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/firmware/vmxassist/util.h   Thu Nov 09 15:37:17 2006 -0500
@@ -31,6 +31,7 @@
 
 struct vmx_assist_context;
 
+extern void cpuid_addr_value(uint64_t addr, uint64_t *value);
 extern void hexdump(unsigned char *, int);
 extern void dump_regs(struct regs *);
 extern void dump_vmx_context(struct vmx_assist_context *);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/firmware/vmxassist/vm86.c
--- a/tools/firmware/vmxassist/vm86.c   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/firmware/vmxassist/vm86.c   Thu Nov 09 15:37:17 2006 -0500
@@ -56,8 +56,8 @@ static char *rnames[] = { "ax", "cx", "d
 #define PT_ENTRY_PRESENT 0x1
 
 /* We only support access to <=4G physical memory due to 1:1 mapping */
-static unsigned
-guest_linear_to_real(uint32_t base)
+static uint64_t
+guest_linear_to_phys(uint32_t base)
 {
        uint32_t gcr3 = oldctx.cr3;
        uint64_t l2_mfn;
@@ -89,23 +89,32 @@ guest_linear_to_real(uint32_t base)
                l2_mfn = ((uint64_t *)(long)gcr3)[(base >> 30) & 0x3];
                if (!(l2_mfn & PT_ENTRY_PRESENT))
                        panic("l3 entry not present\n");
-               l2_mfn &= 0x3fffff000ULL;
-
-               l1_mfn = ((uint64_t *)(long)l2_mfn)[(base >> 21) & 0x1ff];
+               l2_mfn &= 0xffffff000ULL;
+
+               if (l2_mfn & 0xf00000000ULL) {
+                       printf("l2 page above 4G\n");
+                       cpuid_addr_value(l2_mfn + 8 * ((base >> 21) & 0x1ff), 
&l1_mfn);
+               } else
+                       l1_mfn = ((uint64_t *)(long)l2_mfn)[(base >> 21) & 
0x1ff];
                if (!(l1_mfn & PT_ENTRY_PRESENT))
                        panic("l2 entry not present\n");
 
                if (l1_mfn & PDE_PS) { /* CR4.PSE is ignored in PAE mode */
-                       l0_mfn = l1_mfn & 0x3ffe00000ULL;
+                       l0_mfn = l1_mfn & 0xfffe00000ULL;
                        return l0_mfn + (base & 0x1fffff);
                }
 
-               l1_mfn &= 0x3fffff000ULL;
-
-               l0_mfn = ((uint64_t *)(long)l1_mfn)[(base >> 12) & 0x1ff];
+               l1_mfn &= 0xffffff000ULL;
+
+               if (l1_mfn & 0xf00000000ULL) {
+                       printf("l1 page above 4G\n");
+                       cpuid_addr_value(l1_mfn + 8 * ((base >> 12) & 0x1ff), 
&l0_mfn);
+               } else
+                       l0_mfn = ((uint64_t *)(long)l1_mfn)[(base >> 12) & 
0x1ff];
                if (!(l0_mfn & PT_ENTRY_PRESENT))
                        panic("l1 entry not present\n");
-               l0_mfn &= 0x3fffff000ULL;
+
+               l0_mfn &= 0xffffff000ULL;
 
                return l0_mfn + (base & 0xfff);
        }
@@ -114,6 +123,7 @@ static unsigned
 static unsigned
 address(struct regs *regs, unsigned seg, unsigned off)
 {
+       uint64_t gdt_phys_base;
        unsigned long long entry;
        unsigned seg_base, seg_limit;
        unsigned entry_low, entry_high;
@@ -129,8 +139,13 @@ address(struct regs *regs, unsigned seg,
            (mode == VM86_REAL_TO_PROTECTED && regs->cs == seg))
                return ((seg & 0xFFFF) << 4) + off;
 
-       entry = ((unsigned long long *)
-                 guest_linear_to_real(oldctx.gdtr_base))[seg >> 3];
+       gdt_phys_base = guest_linear_to_phys(oldctx.gdtr_base);
+       if (gdt_phys_base != (uint32_t)gdt_phys_base) {
+               printf("gdt base address above 4G\n");
+               cpuid_addr_value(gdt_phys_base + 8 * (seg >> 3), &entry);
+       } else
+               entry = ((unsigned long long *)(long)gdt_phys_base)[seg >> 3];
+
        entry_high = entry >> 32;
        entry_low = entry & 0xFFFFFFFF;
 
@@ -804,6 +819,7 @@ static int
 static int
 load_seg(unsigned long sel, uint32_t *base, uint32_t *limit, union 
vmcs_arbytes *arbytes)
 {
+       uint64_t gdt_phys_base;
        unsigned long long entry;
 
        /* protected mode: use seg as index into gdt */
@@ -815,8 +831,12 @@ load_seg(unsigned long sel, uint32_t *ba
                return 1;
        }
 
-       entry = ((unsigned long long *)
-                 guest_linear_to_real(oldctx.gdtr_base))[sel >> 3];
+       gdt_phys_base = guest_linear_to_phys(oldctx.gdtr_base);
+       if (gdt_phys_base != (uint32_t)gdt_phys_base) {
+               printf("gdt base address above 4G\n");
+               cpuid_addr_value(gdt_phys_base + 8 * (sel >> 3), &entry);
+       } else
+               entry = ((unsigned long long *)(long)gdt_phys_base)[sel >> 3];
 
        /* Check the P bit first */
        if (!((entry >> (15+32)) & 0x1) && sel != 0)
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/Makefile.target
--- a/tools/ioemu/Makefile.target       Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/Makefile.target       Thu Nov 09 15:37:17 2006 -0500
@@ -23,7 +23,7 @@ DEFINES+=-I$(SRC_PATH)/linux-user -I$(SR
 DEFINES+=-I$(SRC_PATH)/linux-user -I$(SRC_PATH)/linux-user/$(TARGET_ARCH)
 endif
 CFLAGS+=-Wall -O2 -g -fno-strict-aliasing
-SSE2 := $(call test-gcc-flag,$(CC),-msse2)
+SSE2 := $(call cc-option,$(CC),-msse2,)
 ifeq ($(SSE2),-msse2)
 CFLAGS += -DUSE_SSE2=1 -msse2
 endif
@@ -294,7 +294,11 @@ endif
 endif
 
 # qemu-dm objects
+ifeq ($(ARCH),ia64)
 LIBOBJS=helper2.o exec-dm.o i8259-dm.o
+else
+LIBOBJS=helper2.o exec-dm.o i8259-dm.o rtc-dm.o
+endif
 
 all: $(PROGS)
 
@@ -354,12 +358,17 @@ ifeq ($(TARGET_BASE_ARCH), i386)
 ifeq ($(TARGET_BASE_ARCH), i386)
 # Hardware support
 VL_OBJS+= ide.o pckbd.o ps2.o vga.o $(SOUND_HW) dma.o $(AUDIODRV)
+ifeq ($(ARCH),ia64)
 VL_OBJS+= fdc.o mc146818rtc.o serial.o pc.o
+else
+VL_OBJS+= fdc.o serial.o pc.o
+endif
 VL_OBJS+= cirrus_vga.o mixeng.o parallel.o acpi.o piix_pci.o
 VL_OBJS+= usb-uhci.o
 VL_OBJS+= piix4acpi.o
 VL_OBJS+= xenstore.o
 VL_OBJS+= xen_platform.o
+VL_OBJS+= tpm_tis.o
 DEFINES += -DHAS_AUDIO
 endif
 ifeq ($(TARGET_BASE_ARCH), ppc)
@@ -398,6 +407,7 @@ VL_OBJS+=sdl.o
 VL_OBJS+=sdl.o
 endif
 VL_OBJS+=vnc.o
+VL_OBJS+=d3des.o
 ifdef CONFIG_COCOA
 VL_OBJS+=cocoa.o
 COCOA_LIBS=-F/System/Library/Frameworks -framework Cocoa -framework IOKit
@@ -456,6 +466,9 @@ sdl.o: sdl.c keymaps.c sdl_keysym.h
        $(CC) $(CFLAGS) $(DEFINES) $(SDL_CFLAGS) -c -o $@ $<
 
 vnc.o: vnc.c keymaps.c sdl_keysym.h vnchextile.h
+       $(CC) $(CFLAGS) $(DEFINES) -c -o $@ $<
+
+d3des.o: d3des.c d3des.h
        $(CC) $(CFLAGS) $(DEFINES) -c -o $@ $<
 
 sdlaudio.o: sdlaudio.c
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/hw/ide.c
--- a/tools/ioemu/hw/ide.c      Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/hw/ide.c      Thu Nov 09 15:37:17 2006 -0500
@@ -557,9 +557,9 @@ static void ide_atapi_identify(IDEState 
     padstr((uint8_t *)(p + 23), QEMU_VERSION, 8); /* firmware version */
     padstr((uint8_t *)(p + 27), "QEMU CD-ROM", 40); /* model */
     put_le16(p + 48, 1); /* dword I/O (XXX: should not be set on CDROM) */
-    put_le16(p + 49, 1 << 9); /* LBA supported, no DMA */
+    put_le16(p + 49, (1 << 11) | (1 << 9) | (1 << 8)); /* DMA and LBA 
supported */
     put_le16(p + 53, 3); /* words 64-70, 54-58 valid */
-    put_le16(p + 63, 0x103); /* DMA modes XXX: may be incorrect */
+    put_le16(p + 63, 0x07); /* mdma0-2 supported */
     put_le16(p + 64, 1); /* PIO modes */
     put_le16(p + 65, 0xb4); /* minimum DMA multiword tx cycle time */
     put_le16(p + 66, 0xb4); /* recommended DMA multiword tx cycle time */
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/hw/ne2000.c
--- a/tools/ioemu/hw/ne2000.c   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/hw/ne2000.c   Thu Nov 09 15:37:17 2006 -0500
@@ -137,6 +137,7 @@ typedef struct NE2000State {
     uint8_t curpag;
     uint8_t mult[8]; /* multicast mask array */
     int irq;
+    int tainted;
     PCIDevice *pci_dev;
     VLANClientState *vc;
     uint8_t macaddr[6];
@@ -226,6 +227,27 @@ static int ne2000_can_receive(void *opaq
 
 #define MIN_BUF_SIZE 60
 
+static inline int ne2000_valid_ring_addr(NE2000State *s, unsigned int addr)
+{
+    addr <<= 8;
+    return addr < s->stop && addr >= s->start;
+}
+
+static inline int ne2000_check_state(NE2000State *s)
+{
+    if (!s->tainted)
+        return 0;
+
+    if (s->start >= s->stop || s->stop > NE2000_MEM_SIZE)
+        return -EINVAL;
+
+    if (!ne2000_valid_ring_addr(s, s->curpag))
+        return -EINVAL;
+
+    s->tainted = 0;
+    return 0;
+}
+
 static void ne2000_receive(void *opaque, const uint8_t *buf, int size)
 {
     NE2000State *s = opaque;
@@ -238,6 +260,12 @@ static void ne2000_receive(void *opaque,
 #if defined(DEBUG_NE2000)
     printf("NE2000: received len=%d\n", size);
 #endif
+
+    if (ne2000_check_state(s))
+        return;
+
+    if (!ne2000_valid_ring_addr(s, s->boundary))
+        return;
 
     if (s->cmd & E8390_STOP || ne2000_buffer_full(s))
         return;
@@ -359,9 +387,11 @@ static void ne2000_ioport_write(void *op
         switch(offset) {
         case EN0_STARTPG:
             s->start = val << 8;
+            s->tainted = 1;
             break;
         case EN0_STOPPG:
             s->stop = val << 8;
+            s->tainted = 1;
             break;
         case EN0_BOUNDARY:
             s->boundary = val;
@@ -406,6 +436,7 @@ static void ne2000_ioport_write(void *op
             break;
         case EN1_CURPAG:
             s->curpag = val;
+            s->tainted = 1;
             break;
         case EN1_MULT ... EN1_MULT + 7:
             s->mult[offset - EN1_MULT] = val;
@@ -509,7 +540,7 @@ static inline void ne2000_mem_writel(NE2
 {
     addr &= ~1; /* XXX: check exact behaviour if not even */
     if (addr < 32 || 
-        (addr >= NE2000_PMEM_START && addr < NE2000_MEM_SIZE)) {
+        (addr >= NE2000_PMEM_START && addr < NE2000_MEM_SIZE - 2)) {
         cpu_to_le32wu((uint32_t *)(s->mem + addr), val);
     }
 }
@@ -539,7 +570,7 @@ static inline uint32_t ne2000_mem_readl(
 {
     addr &= ~1; /* XXX: check exact behaviour if not even */
     if (addr < 32 || 
-        (addr >= NE2000_PMEM_START && addr < NE2000_MEM_SIZE)) {
+        (addr >= NE2000_PMEM_START && addr < NE2000_MEM_SIZE - 2)) {
         return le32_to_cpupu((uint32_t *)(s->mem + addr));
     } else {
         return 0xffffffff;
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/hw/pc.c
--- a/tools/ioemu/hw/pc.c       Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/hw/pc.c       Thu Nov 09 15:37:17 2006 -0500
@@ -875,6 +875,9 @@ static void pc_init1(uint64_t ram_size, 
         }
     }
 
+    if (has_tpm_device())
+        tpm_tis_init(&pic_set_irq_new, isa_pic, 11);
+
     kbd_init();
     DMA_init(0);
 #ifdef HAS_AUDIO
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/hw/serial.c
--- a/tools/ioemu/hw/serial.c   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/hw/serial.c   Thu Nov 09 15:37:17 2006 -0500
@@ -93,6 +93,15 @@ struct SerialState {
     int last_break_enable;
     target_ulong base;
     int it_shift;
+
+    /*
+     * If a character transmitted via UART cannot be written to its
+     * destination immediately we remember it here and retry a few times via
+     * a polling timer.
+     */
+    int write_retries;
+    char write_chr;
+    QEMUTimer *write_retry_timer;
 };
 
 static void serial_update_irq(SerialState *s)
@@ -204,10 +213,32 @@ static void serial_get_token(void)
     tokens_avail--;
 }
 
+static void serial_chr_write(void *opaque)
+{
+    SerialState *s = opaque;
+
+    qemu_del_timer(s->write_retry_timer);
+
+    /* Retry every 100ms for 300ms total. */
+    if (qemu_chr_write(s->chr, &s->write_chr, 1) == -1) {
+        if (s->write_retries++ >= 3)
+            printf("serial: write error\n");
+        else
+            qemu_mod_timer(s->write_retry_timer,
+                           qemu_get_clock(vm_clock) + ticks_per_sec / 10);
+        return;
+    }
+
+    /* Success: Notify guest that THR is empty. */
+    s->thr_ipending = 1;
+    s->lsr |= UART_LSR_THRE;
+    s->lsr |= UART_LSR_TEMT;
+    serial_update_irq(s);
+}
+
 static void serial_ioport_write(void *opaque, uint32_t addr, uint32_t val)
 {
     SerialState *s = opaque;
-    unsigned char ch;
     
     addr &= 7;
 #ifdef DEBUG_SERIAL
@@ -223,12 +254,9 @@ static void serial_ioport_write(void *op
             s->thr_ipending = 0;
             s->lsr &= ~UART_LSR_THRE;
             serial_update_irq(s);
-            ch = val;
-            qemu_chr_write(s->chr, &ch, 1);
-            s->thr_ipending = 1;
-            s->lsr |= UART_LSR_THRE;
-            s->lsr |= UART_LSR_TEMT;
-            serial_update_irq(s);
+            s->write_chr = val;
+            s->write_retries = 0;
+            serial_chr_write(s);
         }
         break;
     case 1:
@@ -424,6 +452,7 @@ SerialState *serial_init(SetIRQFunc *set
     s->lsr = UART_LSR_TEMT | UART_LSR_THRE;
     s->iir = UART_IIR_NO_INT;
     s->msr = UART_MSR_DCD | UART_MSR_DSR | UART_MSR_CTS;
+    s->write_retry_timer = qemu_new_timer(vm_clock, serial_chr_write, s);
 
     register_savevm("serial", base, 1, serial_save, serial_load, s);
 
@@ -511,6 +540,7 @@ SerialState *serial_mm_init (SetIRQFunc 
     s->msr = UART_MSR_DCD | UART_MSR_DSR | UART_MSR_CTS;
     s->base = base;
     s->it_shift = it_shift;
+    s->write_retry_timer = qemu_new_timer(vm_clock, serial_chr_write, s);
 
     register_savevm("serial", base, 1, serial_save, serial_load, s);
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/hw/xen_platform.c
--- a/tools/ioemu/hw/xen_platform.c     Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/hw/xen_platform.c     Thu Nov 09 15:37:17 2006 -0500
@@ -97,7 +97,8 @@ struct pci_config_header {
     uint8_t  bist; /* Built in self test */
     uint32_t base_address_regs[6];
     uint32_t reserved1;
-    uint32_t reserved2;
+    uint16_t subsystem_vendor_id;
+    uint16_t subsystem_id;
     uint32_t rom_addr;
     uint32_t reserved3;
     uint32_t reserved4;
@@ -126,6 +127,11 @@ void pci_xen_platform_init(PCIBus *bus)
     pch->header_type = 0;
     pch->interrupt_pin = 1;
 
+    /* Microsoft WHQL requires non-zero subsystem IDs. */
+    /* http://www.pcisig.com/reflector/msg02205.html.  */
+    pch->subsystem_vendor_id = pch->vendor_id; /* Duplicate vendor id.  */
+    pch->subsystem_id        = 0x0001;         /* Hardcode sub-id as 1. */
+
     pci_register_io_region(d, 0, 0x100, PCI_ADDRESS_SPACE_IO,
                            platform_ioport_map);
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/keymaps/ja
--- a/tools/ioemu/keymaps/ja    Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/keymaps/ja    Thu Nov 09 15:37:17 2006 -0500
@@ -102,3 +102,6 @@ Henkan_Mode 0x79
 Henkan_Mode 0x79
 Katakana 0x70
 Muhenkan 0x7b
+Henkan_Mode_Real 0x79
+Henkan_Mode_Ultra 0x79
+backslash_ja 0x73
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/domain-timeoffset
--- a/tools/ioemu/patches/domain-timeoffset     Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/patches/domain-timeoffset     Thu Nov 09 15:37:17 2006 -0500
@@ -1,7 +1,7 @@ Index: ioemu/hw/mc146818rtc.c
 Index: ioemu/hw/mc146818rtc.c
 ===================================================================
---- ioemu.orig/hw/mc146818rtc.c        2006-09-21 19:33:25.000000000 +0100
-+++ ioemu/hw/mc146818rtc.c     2006-09-21 19:33:30.000000000 +0100
+--- ioemu.orig/hw/mc146818rtc.c        2006-10-24 14:45:21.000000000 +0100
++++ ioemu/hw/mc146818rtc.c     2006-10-24 14:45:39.000000000 +0100
 @@ -178,10 +178,27 @@
      }
  }
@@ -46,8 +46,8 @@ Index: ioemu/hw/mc146818rtc.c
  static void rtc_copy_date(RTCState *s)
 Index: ioemu/hw/pc.c
 ===================================================================
---- ioemu.orig/hw/pc.c 2006-09-21 19:33:30.000000000 +0100
-+++ ioemu/hw/pc.c      2006-09-21 19:33:30.000000000 +0100
+--- ioemu.orig/hw/pc.c 2006-10-24 14:45:38.000000000 +0100
++++ ioemu/hw/pc.c      2006-10-24 14:45:39.000000000 +0100
 @@ -159,7 +159,7 @@
  }
  
@@ -117,8 +117,8 @@ Index: ioemu/hw/pc.c
  QEMUMachine pc_machine = {
 Index: ioemu/vl.c
 ===================================================================
---- ioemu.orig/vl.c    2006-09-21 19:33:30.000000000 +0100
-+++ ioemu/vl.c 2006-09-21 19:33:30.000000000 +0100
+--- ioemu.orig/vl.c    2006-10-24 14:45:38.000000000 +0100
++++ ioemu/vl.c 2006-10-24 14:45:39.000000000 +0100
 @@ -163,6 +163,8 @@
  
  int xc_handle;
@@ -174,8 +174,8 @@ Index: ioemu/vl.c
      if (usb_enabled) {
 Index: ioemu/vl.h
 ===================================================================
---- ioemu.orig/vl.h    2006-09-21 19:33:30.000000000 +0100
-+++ ioemu/vl.h 2006-09-21 19:33:30.000000000 +0100
+--- ioemu.orig/vl.h    2006-10-24 14:45:38.000000000 +0100
++++ ioemu/vl.h 2006-10-24 14:45:39.000000000 +0100
 @@ -576,7 +576,7 @@
                                   int boot_device,
               DisplayState *ds, const char **fd_filename, int snapshot,
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/qemu-bootorder
--- a/tools/ioemu/patches/qemu-bootorder        Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/patches/qemu-bootorder        Thu Nov 09 15:37:17 2006 -0500
@@ -1,9 +1,9 @@ Index: ioemu/vl.c
 Index: ioemu/vl.c
 ===================================================================
---- ioemu.orig/vl.c    2006-09-21 19:33:32.000000000 +0100
-+++ ioemu/vl.c 2006-09-21 19:33:32.000000000 +0100
-@@ -124,7 +124,7 @@
- int vncunused;
+--- ioemu.orig/vl.c    2006-10-24 14:33:47.000000000 +0100
++++ ioemu/vl.c 2006-10-24 14:33:47.000000000 +0100
+@@ -125,7 +125,7 @@
+ struct sockaddr_in vnclisten_addr;
  const char* keyboard_layout = NULL;
  int64_t ticks_per_sec;
 -int boot_device = 'c';
@@ -11,7 +11,7 @@ Index: ioemu/vl.c
  uint64_t ram_size;
  int pit_min_timer_count = 0;
  int nb_nics;
-@@ -6063,14 +6063,14 @@
+@@ -6075,14 +6075,14 @@
                  break;
  #endif /* !CONFIG_DM */
              case QEMU_OPTION_boot:
@@ -32,7 +32,7 @@ Index: ioemu/vl.c
                      exit(1);
                  }
                  break;
-@@ -6334,6 +6334,7 @@
+@@ -6349,6 +6349,7 @@
          fd_filename[0] == '\0')
          help();
      
@@ -40,7 +40,7 @@ Index: ioemu/vl.c
      /* boot to cd by default if no hard disk */
      if (hd_filename[0] == '\0' && boot_device == 'c') {
          if (fd_filename[0] != '\0')
-@@ -6341,6 +6342,7 @@
+@@ -6356,6 +6357,7 @@
          else
              boot_device = 'd';
      }
@@ -48,7 +48,7 @@ Index: ioemu/vl.c
  #endif /* !CONFIG_DM */
  
      setvbuf(stdout, NULL, _IOLBF, 0);
-@@ -6599,6 +6601,7 @@
+@@ -6614,6 +6616,7 @@
                    ds, fd_filename, snapshot,
                    kernel_filename, kernel_cmdline, initrd_filename,
                    timeoffset);
@@ -58,9 +58,9 @@ Index: ioemu/vl.c
      if (usb_enabled) {
 Index: ioemu/vl.h
 ===================================================================
---- ioemu.orig/vl.h    2006-09-21 19:33:32.000000000 +0100
-+++ ioemu/vl.h 2006-09-21 19:33:32.000000000 +0100
-@@ -576,7 +576,7 @@
+--- ioemu.orig/vl.h    2006-10-24 14:33:47.000000000 +0100
++++ ioemu/vl.h 2006-10-24 14:33:47.000000000 +0100
+@@ -578,7 +578,7 @@
  #ifndef QEMU_TOOL
  
  typedef void QEMUMachineInitFunc(uint64_t ram_size, int vga_ram_size, 
@@ -69,7 +69,7 @@ Index: ioemu/vl.h
               DisplayState *ds, const char **fd_filename, int snapshot,
               const char *kernel_filename, const char *kernel_cmdline,
               const char *initrd_filename, time_t timeoffset);
-@@ -1021,7 +1021,7 @@
+@@ -1023,7 +1023,7 @@
                      uint32_t start, uint32_t count);
  int PPC_NVRAM_set_params (m48t59_t *nvram, uint16_t NVRAM_size,
                            const unsigned char *arch,
@@ -80,8 +80,8 @@ Index: ioemu/vl.h
                            uint32_t initrd_image, uint32_t initrd_size,
 Index: ioemu/hw/pc.c
 ===================================================================
---- ioemu.orig/hw/pc.c 2006-09-21 19:33:32.000000000 +0100
-+++ ioemu/hw/pc.c      2006-09-21 19:33:32.000000000 +0100
+--- ioemu.orig/hw/pc.c 2006-10-24 14:33:47.000000000 +0100
++++ ioemu/hw/pc.c      2006-10-24 14:33:47.000000000 +0100
 @@ -158,8 +158,23 @@
      rtc_set_memory(s, info_ofs + 8, sectors);
  }
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/qemu-cleanup
--- a/tools/ioemu/patches/qemu-cleanup  Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/patches/qemu-cleanup  Thu Nov 09 15:37:17 2006 -0500
@@ -1,7 +1,7 @@ Index: ioemu/hw/vga.c
 Index: ioemu/hw/vga.c
 ===================================================================
---- ioemu.orig/hw/vga.c        2006-08-06 02:03:51.906765409 +0100
-+++ ioemu/hw/vga.c     2006-08-06 02:15:10.364150665 +0100
+--- ioemu.orig/hw/vga.c        2006-10-24 14:44:03.000000000 +0100
++++ ioemu/hw/vga.c     2006-10-24 14:45:22.000000000 +0100
 @@ -1622,7 +1622,9 @@
  static void vga_save(QEMUFile *f, void *opaque)
  {
@@ -26,8 +26,8 @@ Index: ioemu/hw/vga.c
          return -EINVAL;
 Index: ioemu/vl.c
 ===================================================================
---- ioemu.orig/vl.c    2006-08-06 02:15:01.774108287 +0100
-+++ ioemu/vl.c 2006-08-06 02:15:31.040845624 +0100
+--- ioemu.orig/vl.c    2006-10-24 14:44:08.000000000 +0100
++++ ioemu/vl.c 2006-10-24 14:45:29.000000000 +0100
 @@ -39,6 +39,7 @@
  #include <sys/ioctl.h>
  #include <sys/socket.h>
@@ -36,6 +36,24 @@ Index: ioemu/vl.c
  #include <dirent.h>
  #include <netdb.h>
  #ifdef _BSD
+@@ -2932,7 +2933,7 @@
+     }
+ 
+     /* XXX: better tmp dir construction */
+-    snprintf(smb_dir, sizeof(smb_dir), "/tmp/qemu-smb.%d", getpid());
++    snprintf(smb_dir, sizeof(smb_dir), "/tmp/qemu-smb.%ld", (long)getpid());
+     if (mkdir(smb_dir, 0700) < 0) {
+         fprintf(stderr, "qemu: could not create samba server dir '%s'\n", 
smb_dir);
+         exit(1);
+@@ -3893,7 +3894,7 @@
+                 perror("Opening pidfile");
+                 exit(1);
+             }
+-            fprintf(f, "%d\n", getpid());
++            fprintf(f, "%ld\n", (long)getpid());
+             fclose(f);
+             pid_filename = qemu_strdup(filename);
+             if (!pid_filename) {
 @@ -5308,7 +5309,9 @@
      QEMU_OPTION_d,
      QEMU_OPTION_hdachs,
@@ -70,8 +88,8 @@ Index: ioemu/vl.c
                      fprintf(stderr, "qemu: too many network clients\n");
 Index: ioemu/vl.h
 ===================================================================
---- ioemu.orig/vl.h    2006-08-06 02:15:01.775108175 +0100
-+++ ioemu/vl.h 2006-08-06 02:15:10.368150219 +0100
+--- ioemu.orig/vl.h    2006-10-24 14:44:08.000000000 +0100
++++ ioemu/vl.h 2006-10-24 14:45:22.000000000 +0100
 @@ -957,7 +957,7 @@
               unsigned long vram_offset, int vram_size, int width, int height);
  
@@ -81,3 +99,18 @@ Index: ioemu/vl.h
  void slavio_intctl_set_cpu(void *opaque, unsigned int cpu, CPUState *env);
  void slavio_pic_info(void *opaque);
  void slavio_irq_info(void *opaque);
+Index: ioemu/usb-linux.c
+===================================================================
+--- ioemu.orig/usb-linux.c     2006-10-24 14:44:03.000000000 +0100
++++ ioemu/usb-linux.c  2006-10-24 14:44:08.000000000 +0100
+@@ -26,7 +26,9 @@
+ #if defined(__linux__)
+ #include <dirent.h>
+ #include <sys/ioctl.h>
+-#include <linux/compiler.h>
++/* Some versions of usbdevice_fs.h need __user to be defined for them.   */
++/* This may (harmlessly) conflict with a definition in linux/compiler.h. */
++#define __user
+ #include <linux/usbdevice_fs.h>
+ #include <linux/version.h>
+ 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/qemu-daemonize
--- a/tools/ioemu/patches/qemu-daemonize        Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/patches/qemu-daemonize        Thu Nov 09 15:37:17 2006 -0500
@@ -2,9 +2,9 @@ Changes required because qemu-dm runs da
 
 Index: ioemu/vl.c
 ===================================================================
---- ioemu.orig/vl.c    2006-09-21 19:33:32.000000000 +0100
-+++ ioemu/vl.c 2006-09-21 19:33:32.000000000 +0100
-@@ -6042,10 +6042,11 @@
+--- ioemu.orig/vl.c    2006-10-24 14:33:47.000000000 +0100
++++ ioemu/vl.c 2006-10-24 14:33:47.000000000 +0100
+@@ -6054,10 +6054,11 @@
                  }
                  break;
              case QEMU_OPTION_nographic:
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/qemu-logging
--- a/tools/ioemu/patches/qemu-logging  Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/patches/qemu-logging  Thu Nov 09 15:37:17 2006 -0500
@@ -1,7 +1,7 @@ Index: ioemu/vl.c
 Index: ioemu/vl.c
 ===================================================================
---- ioemu.orig/vl.c    2006-08-06 02:15:48.550893605 +0100
-+++ ioemu/vl.c 2006-08-06 02:16:31.246133963 +0100
+--- ioemu.orig/vl.c    2006-10-24 14:36:58.000000000 +0100
++++ ioemu/vl.c 2006-10-24 14:37:03.000000000 +0100
 @@ -5234,7 +5234,7 @@
             "-S              freeze CPU at startup (use 'c' to start 
execution)\n"
             "-s              wait gdb connection to port %d\n"
@@ -43,7 +43,7 @@ Index: ioemu/vl.c
      /* default mac address of the first network interface */
      
 +    /* init debug */
-+    sprintf(qemu_dm_logfilename, "/var/log/xen/qemu-dm.%d.log", getpid());
++    sprintf(qemu_dm_logfilename, "/var/log/xen/qemu-dm.%ld.log", 
(long)getpid());
 +    cpu_set_log_filename(qemu_dm_logfilename);
 +    cpu_set_log(0);
 +    
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/qemu-target-i386-dm
--- a/tools/ioemu/patches/qemu-target-i386-dm   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/patches/qemu-target-i386-dm   Thu Nov 09 15:37:17 2006 -0500
@@ -1,7 +1,7 @@ Index: ioemu/Makefile.target
 Index: ioemu/Makefile.target
 ===================================================================
---- ioemu.orig/Makefile.target 2006-09-21 11:30:11.000000000 +0100
-+++ ioemu/Makefile.target      2006-09-21 18:54:22.000000000 +0100
+--- ioemu.orig/Makefile.target 2006-10-24 13:47:23.000000000 +0100
++++ ioemu/Makefile.target      2006-10-24 14:30:56.000000000 +0100
 @@ -62,6 +62,8 @@
  QEMU_SYSTEM=qemu-fast
  endif
@@ -32,8 +32,8 @@ Index: ioemu/Makefile.target
  DEFINES += -DHAS_AUDIO
 Index: ioemu/configure
 ===================================================================
---- ioemu.orig/configure       2006-09-21 11:30:11.000000000 +0100
-+++ ioemu/configure    2006-09-21 18:54:21.000000000 +0100
+--- ioemu.orig/configure       2006-10-24 13:47:23.000000000 +0100
++++ ioemu/configure    2006-10-24 14:29:34.000000000 +0100
 @@ -373,6 +373,8 @@
      if [ "$user" = "yes" ] ; then
          target_list="i386-user arm-user armeb-user sparc-user ppc-user 
mips-user mipsel-user $target_list"
@@ -45,8 +45,8 @@ Index: ioemu/configure
  fi
 Index: ioemu/monitor.c
 ===================================================================
---- ioemu.orig/monitor.c       2006-09-21 11:30:11.000000000 +0100
-+++ ioemu/monitor.c    2006-09-21 18:54:23.000000000 +0100
+--- ioemu.orig/monitor.c       2006-10-24 13:47:23.000000000 +0100
++++ ioemu/monitor.c    2006-10-24 14:30:56.000000000 +0100
 @@ -1262,6 +1262,10 @@
        "", "show profiling information", },
      { "capture", "", do_info_capture,
@@ -60,8 +60,8 @@ Index: ioemu/monitor.c
  
 Index: ioemu/vl.c
 ===================================================================
---- ioemu.orig/vl.c    2006-09-21 11:30:11.000000000 +0100
-+++ ioemu/vl.c 2006-09-21 18:54:23.000000000 +0100
+--- ioemu.orig/vl.c    2006-10-24 13:47:23.000000000 +0100
++++ ioemu/vl.c 2006-10-24 14:30:56.000000000 +0100
 @@ -87,7 +87,7 @@
  
  #include "exec-all.h"
@@ -98,8 +98,8 @@ Index: ioemu/vl.c
  {
 Index: ioemu/vl.h
 ===================================================================
---- ioemu.orig/vl.h    2006-09-21 11:30:11.000000000 +0100
-+++ ioemu/vl.h 2006-09-21 18:54:23.000000000 +0100
+--- ioemu.orig/vl.h    2006-10-24 13:47:23.000000000 +0100
++++ ioemu/vl.h 2006-10-24 14:30:56.000000000 +0100
 @@ -37,6 +37,8 @@
  #include <unistd.h>
  #include <fcntl.h>
@@ -132,7 +132,7 @@ Index: ioemu/target-i386-dm/cpu.h
 Index: ioemu/target-i386-dm/cpu.h
 ===================================================================
 --- /dev/null  1970-01-01 00:00:00.000000000 +0000
-+++ ioemu/target-i386-dm/cpu.h 2006-09-21 18:54:22.000000000 +0100
++++ ioemu/target-i386-dm/cpu.h 2006-10-24 14:30:56.000000000 +0100
 @@ -0,0 +1,86 @@
 +/*
 + * i386 virtual CPU header
@@ -223,7 +223,7 @@ Index: ioemu/target-i386-dm/exec-dm.c
 Index: ioemu/target-i386-dm/exec-dm.c
 ===================================================================
 --- /dev/null  1970-01-01 00:00:00.000000000 +0000
-+++ ioemu/target-i386-dm/exec-dm.c     2006-09-21 18:54:22.000000000 +0100
++++ ioemu/target-i386-dm/exec-dm.c     2006-10-24 14:30:56.000000000 +0100
 @@ -0,0 +1,516 @@
 +/*
 + *  virtual page mapping and translated block handling
@@ -744,7 +744,7 @@ Index: ioemu/target-i386-dm/helper2.c
 Index: ioemu/target-i386-dm/helper2.c
 ===================================================================
 --- /dev/null  1970-01-01 00:00:00.000000000 +0000
-+++ ioemu/target-i386-dm/helper2.c     2006-09-21 18:55:31.000000000 +0100
++++ ioemu/target-i386-dm/helper2.c     2006-10-24 14:31:01.000000000 +0100
 @@ -0,0 +1,469 @@
 +/*
 + *  i386 helpers (without register variable usage)
@@ -1205,8 +1205,8 @@ Index: ioemu/target-i386-dm/helper2.c
 +                break;
 +        }
 +
-+        /* Wait up to 100 msec. */
-+        main_loop_wait(100);
++        /* Wait up to 10 msec. */
++        main_loop_wait(10);
 +
 +        if (env->send_event) {
 +            env->send_event = 0;
@@ -1218,7 +1218,7 @@ Index: ioemu/target-i386-dm/i8259-dm.c
 Index: ioemu/target-i386-dm/i8259-dm.c
 ===================================================================
 --- /dev/null  1970-01-01 00:00:00.000000000 +0000
-+++ ioemu/target-i386-dm/i8259-dm.c    2006-09-21 11:30:11.000000000 +0100
++++ ioemu/target-i386-dm/i8259-dm.c    2006-10-24 13:47:23.000000000 +0100
 @@ -0,0 +1,107 @@
 +/* Xen 8259 stub for interrupt controller emulation
 + * 
@@ -1330,7 +1330,7 @@ Index: ioemu/target-i386-dm/qemu-dm.debu
 Index: ioemu/target-i386-dm/qemu-dm.debug
 ===================================================================
 --- /dev/null  1970-01-01 00:00:00.000000000 +0000
-+++ ioemu/target-i386-dm/qemu-dm.debug 2006-09-21 11:30:11.000000000 +0100
++++ ioemu/target-i386-dm/qemu-dm.debug 2006-10-24 13:47:23.000000000 +0100
 @@ -0,0 +1,5 @@
 +#!/bin/sh
 +
@@ -1340,7 +1340,7 @@ Index: ioemu/target-i386-dm/qemu-ifup
 Index: ioemu/target-i386-dm/qemu-ifup
 ===================================================================
 --- /dev/null  1970-01-01 00:00:00.000000000 +0000
-+++ ioemu/target-i386-dm/qemu-ifup     2006-09-21 11:30:11.000000000 +0100
++++ ioemu/target-i386-dm/qemu-ifup     2006-10-24 13:47:23.000000000 +0100
 @@ -0,0 +1,10 @@
 +#!/bin/sh
 +
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/series
--- a/tools/ioemu/patches/series        Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/patches/series        Thu Nov 09 15:37:17 2006 -0500
@@ -32,10 +32,12 @@ fix-vga-scanning-code-overflow
 fix-vga-scanning-code-overflow
 vnc-cleanup
 vnc-fixes
+vnc-protocol-fixes
 vnc-start-vncviewer
 vnc-title-domain-name
 vnc-access-monitor-vt
 vnc-display-find-unused
+vnc-listen-specific-interface
 vnc-backoff-screen-scan
 xenstore-block-device-config
 xenstore-write-vnc-port
@@ -47,3 +49,7 @@ qemu-bootorder
 qemu-bootorder
 qemu-tunable-ide-write-cache
 qemu-pci 
+serial-port-rate-limit
+hypervisor-rtc
+ide-cd-dma
+vnc-password
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/vnc-access-monitor-vt
--- a/tools/ioemu/patches/vnc-access-monitor-vt Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/patches/vnc-access-monitor-vt Thu Nov 09 15:37:17 2006 -0500
@@ -1,8 +1,8 @@ Index: ioemu/vnc.c
 Index: ioemu/vnc.c
 ===================================================================
---- ioemu.orig/vnc.c   2006-09-21 19:33:31.000000000 +0100
-+++ ioemu/vnc.c        2006-09-21 19:33:31.000000000 +0100
-@@ -32,6 +32,10 @@
+--- ioemu.orig/vnc.c   2006-10-24 14:33:46.000000000 +0100
++++ ioemu/vnc.c        2006-10-24 14:33:46.000000000 +0100
+@@ -33,6 +33,10 @@
  #include "vnc_keysym.h"
  #include "keymaps.c"
  
@@ -13,7 +13,7 @@ Index: ioemu/vnc.c
  typedef struct Buffer
  {
      size_t capacity;
-@@ -95,6 +99,8 @@
+@@ -96,6 +100,8 @@
      int visible_h;
  
      int slow_client;
@@ -22,7 +22,7 @@ Index: ioemu/vnc.c
  };
  
  #define DIRTY_PIXEL_BITS 64
-@@ -791,16 +797,80 @@
+@@ -794,16 +800,80 @@
  
  static void do_key_event(VncState *vs, int down, uint32_t sym)
  {
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/vnc-backoff-screen-scan
--- a/tools/ioemu/patches/vnc-backoff-screen-scan       Fri Nov 03 16:53:17 
2006 -0500
+++ b/tools/ioemu/patches/vnc-backoff-screen-scan       Thu Nov 09 15:37:17 
2006 -0500
@@ -1,10 +1,10 @@ Index: ioemu/vnc.c
 Index: ioemu/vnc.c
 ===================================================================
---- ioemu.orig/vnc.c   2006-09-21 19:31:03.000000000 +0100
-+++ ioemu/vnc.c        2006-09-21 19:32:23.000000000 +0100
-@@ -27,7 +27,19 @@
- #include "vl.h"
+--- ioemu.orig/vnc.c   2006-10-24 14:33:17.000000000 +0100
++++ ioemu/vnc.c        2006-10-24 14:33:24.000000000 +0100
+@@ -28,7 +28,19 @@
  #include "qemu_socket.h"
+ #include <assert.h>
  
 -#define VNC_REFRESH_INTERVAL (1000 / 30)
 +/* The refresh interval starts at BASE.  If we scan the buffer and
@@ -23,7 +23,7 @@ Index: ioemu/vnc.c
  
  #include "vnc_keysym.h"
  #include "keymaps.c"
-@@ -64,10 +76,11 @@
+@@ -65,10 +77,11 @@
  struct VncState
  {
      QEMUTimer *timer;
@@ -36,7 +36,7 @@ Index: ioemu/vnc.c
      int width;
      int height;
      uint64_t *dirty_row;      /* screen regions which are possibly dirty */
-@@ -98,8 +111,6 @@
+@@ -99,8 +112,6 @@
      int visible_w;
      int visible_h;
  
@@ -45,7 +45,7 @@ Index: ioemu/vnc.c
      int ctl_keys;               /* Ctrl+Alt starts calibration */
  };
  
-@@ -380,7 +391,7 @@
+@@ -381,7 +392,7 @@
      int y = 0;
      int pitch = ds->linesize;
      VncState *vs = ds->opaque;
@@ -54,19 +54,19 @@ Index: ioemu/vnc.c
  
      if (src_x < vs->visible_x || src_y < vs->visible_y ||
        dst_x < vs->visible_x || dst_y < vs->visible_y ||
-@@ -390,11 +401,6 @@
+@@ -391,10 +402,8 @@
        (dst_y + h) > (vs->visible_y + vs->visible_h))
        updating_client = 0;
  
 -    if (updating_client) {
 -      vs->need_update = 1;
--      _vnc_update_client(vs);
++    if (updating_client)
+       _vnc_update_client(vs);
 -    }
--
+ 
      if (dst_y > src_y) {
        y = h - 1;
-       pitch = -pitch;
-@@ -445,110 +451,145 @@
+@@ -446,110 +455,149 @@
  static void _vnc_update_client(void *opaque)
  {
      VncState *vs = opaque;
@@ -279,12 +279,16 @@ Index: ioemu/vnc.c
 +             interested (e.g. minimised) it'll ignore this, and we
 +             can stop scanning the buffer until it sends another
 +             update request. */
-+          /* Note that there are bugs in xvncviewer which prevent
-+             this from actually working.  Leave the code in place
-+             for correct clients. */
++          /* It turns out that there's a bug in realvncviewer 4.1.2
++             which means that if you send a proper null update (with
++             no update rectangles), it gets a bit out of sync and
++             never sends any further requests, regardless of whether
++             it needs one or not.  Fix this by sending a single 1x1
++             update rectangle instead. */
 +          vnc_write_u8(vs, 0);
 +          vnc_write_u8(vs, 0);
-+          vnc_write_u16(vs, 0);
++          vnc_write_u16(vs, 1);
++          send_framebuffer_update(vs, 0, 0, 1, 1);
 +          vnc_flush(vs);
 +          vs->last_update_time = now;
 +          return;
@@ -295,7 +299,7 @@ Index: ioemu/vnc.c
  }
  
  static void vnc_update_client(void *opaque)
-@@ -561,8 +602,10 @@
+@@ -562,8 +610,10 @@
  
  static void vnc_timer_init(VncState *vs)
  {
@@ -307,7 +311,7 @@ Index: ioemu/vnc.c
  }
  
  static void vnc_dpy_refresh(DisplayState *ds)
-@@ -622,7 +665,6 @@
+@@ -623,7 +673,6 @@
        vs->csock = -1;
        buffer_reset(&vs->input);
        buffer_reset(&vs->output);
@@ -315,7 +319,7 @@ Index: ioemu/vnc.c
        return 0;
      }
      return ret;
-@@ -892,7 +934,6 @@
+@@ -895,7 +944,6 @@
                                       int x_position, int y_position,
                                       int w, int h)
  {
@@ -323,7 +327,7 @@ Index: ioemu/vnc.c
      if (!incremental)
        framebuffer_set_updated(vs, x_position, y_position, w, h);
      vs->visible_x = x_position;
-@@ -1015,6 +1056,7 @@
+@@ -1018,6 +1066,7 @@
  {
      int i;
      uint16_t limit;
@@ -331,7 +335,7 @@ Index: ioemu/vnc.c
  
      switch (data[0]) {
      case 0:
-@@ -1054,12 +1096,18 @@
+@@ -1061,12 +1110,18 @@
        if (len == 1)
            return 8;
  
@@ -352,15 +356,15 @@ Index: ioemu/vnc.c
      case 6:
 Index: ioemu/vl.c
 ===================================================================
---- ioemu.orig/vl.c    2006-09-21 19:31:03.000000000 +0100
-+++ ioemu/vl.c 2006-09-21 19:32:23.000000000 +0100
-@@ -725,6 +725,12 @@
+--- ioemu.orig/vl.c    2006-10-24 14:33:17.000000000 +0100
++++ ioemu/vl.c 2006-10-24 14:33:24.000000000 +0100
+@@ -726,6 +726,12 @@
      }
  }
  
 +void qemu_advance_timer(QEMUTimer *ts, int64_t expire_time)
 +{
-+    if (ts->expire_time > expire_time)
++    if (ts->expire_time > expire_time || !qemu_timer_pending(ts))
 +      qemu_mod_timer(ts, expire_time);
 +}
 +
@@ -369,9 +373,9 @@ Index: ioemu/vl.c
  void qemu_mod_timer(QEMUTimer *ts, int64_t expire_time)
 Index: ioemu/vl.h
 ===================================================================
---- ioemu.orig/vl.h    2006-09-21 19:31:03.000000000 +0100
-+++ ioemu/vl.h 2006-09-21 19:32:23.000000000 +0100
-@@ -405,6 +405,7 @@
+--- ioemu.orig/vl.h    2006-10-24 14:33:17.000000000 +0100
++++ ioemu/vl.h 2006-10-24 14:33:24.000000000 +0100
+@@ -407,6 +407,7 @@
  void qemu_free_timer(QEMUTimer *ts);
  void qemu_del_timer(QEMUTimer *ts);
  void qemu_mod_timer(QEMUTimer *ts, int64_t expire_time);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/vnc-display-find-unused
--- a/tools/ioemu/patches/vnc-display-find-unused       Fri Nov 03 16:53:17 
2006 -0500
+++ b/tools/ioemu/patches/vnc-display-find-unused       Thu Nov 09 15:37:17 
2006 -0500
@@ -1,8 +1,8 @@ Index: ioemu/vnc.c
 Index: ioemu/vnc.c
 ===================================================================
---- ioemu.orig/vnc.c   2006-09-21 19:33:31.000000000 +0100
-+++ ioemu/vnc.c        2006-09-21 19:33:31.000000000 +0100
-@@ -1182,7 +1182,7 @@
+--- ioemu.orig/vnc.c   2006-10-24 14:31:09.000000000 +0100
++++ ioemu/vnc.c        2006-10-24 14:31:36.000000000 +0100
+@@ -1195,7 +1195,7 @@
      }
  }
  
@@ -11,7 +11,7 @@ Index: ioemu/vnc.c
  {
      struct sockaddr_in addr;
      int reuse_addr, ret;
-@@ -1213,10 +1213,6 @@
+@@ -1226,10 +1226,6 @@
        exit(1);
      }
  
@@ -22,7 +22,7 @@ Index: ioemu/vnc.c
      reuse_addr = 1;
      ret = setsockopt(vs->lsock, SOL_SOCKET, SO_REUSEADDR,
                     (const char *)&reuse_addr, sizeof(reuse_addr));
-@@ -1225,7 +1221,16 @@
+@@ -1238,7 +1234,16 @@
        exit(1);
      }
  
@@ -39,7 +39,7 @@ Index: ioemu/vnc.c
        fprintf(stderr, "bind() failed\n");
        exit(1);
      }
-@@ -1246,6 +1251,8 @@
+@@ -1259,6 +1264,8 @@
      vs->ds->dpy_refresh = vnc_dpy_refresh;
  
      vnc_dpy_resize(vs->ds, 640, 400);
@@ -50,8 +50,8 @@ Index: ioemu/vnc.c
  int vnc_start_viewer(int port)
 Index: ioemu/vl.c
 ===================================================================
---- ioemu.orig/vl.c    2006-09-21 19:33:31.000000000 +0100
-+++ ioemu/vl.c 2006-09-21 19:33:31.000000000 +0100
+--- ioemu.orig/vl.c    2006-10-24 14:31:09.000000000 +0100
++++ ioemu/vl.c 2006-10-24 14:31:41.000000000 +0100
 @@ -121,6 +121,7 @@
  static DisplayState display_state;
  int nographic;
@@ -99,7 +99,7 @@ Index: ioemu/vl.c
 +            case QEMU_OPTION_vncunused:
 +                vncunused++;
 +                if (vnc_display == -1)
-+                    vnc_display = -2;
++                    vnc_display = 0;
 +                break;
              }
          }
@@ -115,8 +115,8 @@ Index: ioemu/vl.c
      } else {
 Index: ioemu/vl.h
 ===================================================================
---- ioemu.orig/vl.h    2006-09-21 19:33:31.000000000 +0100
-+++ ioemu/vl.h 2006-09-21 19:33:31.000000000 +0100
+--- ioemu.orig/vl.h    2006-10-24 14:31:09.000000000 +0100
++++ ioemu/vl.h 2006-10-24 14:31:36.000000000 +0100
 @@ -785,7 +785,7 @@
  void cocoa_display_init(DisplayState *ds, int full_screen);
  
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/vnc-fixes
--- a/tools/ioemu/patches/vnc-fixes     Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/patches/vnc-fixes     Thu Nov 09 15:37:17 2006 -0500
@@ -1,7 +1,7 @@ Index: ioemu/vl.c
 Index: ioemu/vl.c
 ===================================================================
---- ioemu.orig/vl.c    2006-09-21 19:08:18.000000000 +0100
-+++ ioemu/vl.c 2006-09-21 19:26:24.000000000 +0100
+--- ioemu.orig/vl.c    2006-10-24 13:47:23.000000000 +0100
++++ ioemu/vl.c 2006-10-24 14:19:36.000000000 +0100
 @@ -6534,8 +6534,10 @@
          }
      }
@@ -17,8 +17,8 @@ Index: ioemu/vl.c
      if (use_gdbstub) {
 Index: ioemu/vnc.c
 ===================================================================
---- ioemu.orig/vnc.c   2006-09-21 19:08:18.000000000 +0100
-+++ ioemu/vnc.c        2006-09-21 19:26:38.000000000 +0100
+--- ioemu.orig/vnc.c   2006-10-24 13:47:23.000000000 +0100
++++ ioemu/vnc.c        2006-10-24 14:20:00.000000000 +0100
 @@ -3,6 +3,7 @@
   * 
   * Copyright (C) 2006 Anthony Liguori <anthony@xxxxxxxxxxxxx>
@@ -483,7 +483,16 @@ Index: ioemu/vnc.c
  
      vga_hw_invalidate();
      vga_hw_update();
-@@ -1010,11 +1101,11 @@
+@@ -924,6 +1015,8 @@
+ {
+     char pad[3] = { 0, 0, 0 };
+ 
++    vga_hw_update();
++
+     vs->width = vs->ds->width;
+     vs->height = vs->ds->height;
+     vnc_write_u16(vs, vs->ds->width);
+@@ -1010,11 +1103,11 @@
        vnc_write(vs, "RFB 003.003\n", 12);
        vnc_flush(vs);
        vnc_read_when(vs, protocol_version, 12);
@@ -497,7 +506,7 @@ Index: ioemu/vnc.c
      }
  }
  
-@@ -1071,17 +1162,15 @@
+@@ -1071,17 +1164,15 @@
        exit(1);
      }
  
@@ -520,8 +529,8 @@ Index: ioemu/vnc.c
  }
 Index: ioemu/vl.h
 ===================================================================
---- ioemu.orig/vl.h    2006-09-21 19:00:48.000000000 +0100
-+++ ioemu/vl.h 2006-09-21 19:26:24.000000000 +0100
+--- ioemu.orig/vl.h    2006-10-24 13:47:23.000000000 +0100
++++ ioemu/vl.h 2006-10-24 14:19:36.000000000 +0100
 @@ -319,6 +319,7 @@
  int is_graphic_console(void);
  CharDriverState *text_console_init(DisplayState *ds);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/vnc-start-vncviewer
--- a/tools/ioemu/patches/vnc-start-vncviewer   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/patches/vnc-start-vncviewer   Thu Nov 09 15:37:17 2006 -0500
@@ -1,8 +1,8 @@ Index: ioemu/vnc.c
 Index: ioemu/vnc.c
 ===================================================================
---- ioemu.orig/vnc.c   2006-09-21 19:26:38.000000000 +0100
-+++ ioemu/vnc.c        2006-09-21 19:29:58.000000000 +0100
-@@ -1174,3 +1174,25 @@
+--- ioemu.orig/vnc.c   2006-10-24 14:33:46.000000000 +0100
++++ ioemu/vnc.c        2006-10-24 14:33:46.000000000 +0100
+@@ -1187,3 +1187,25 @@
  
      vnc_dpy_resize(vs->ds, 640, 400);
  }
@@ -30,8 +30,8 @@ Index: ioemu/vnc.c
 +}
 Index: ioemu/vl.c
 ===================================================================
---- ioemu.orig/vl.c    2006-09-21 19:26:24.000000000 +0100
-+++ ioemu/vl.c 2006-09-21 19:29:50.000000000 +0100
+--- ioemu.orig/vl.c    2006-10-24 14:33:46.000000000 +0100
++++ ioemu/vl.c 2006-10-24 14:33:46.000000000 +0100
 @@ -120,6 +120,7 @@
  int bios_size;
  static DisplayState display_state;
@@ -93,8 +93,8 @@ Index: ioemu/vl.c
          sdl_display_init(ds, full_screen);
 Index: ioemu/vl.h
 ===================================================================
---- ioemu.orig/vl.h    2006-09-21 19:26:24.000000000 +0100
-+++ ioemu/vl.h 2006-09-21 19:29:50.000000000 +0100
+--- ioemu.orig/vl.h    2006-10-24 14:33:46.000000000 +0100
++++ ioemu/vl.h 2006-10-24 14:33:46.000000000 +0100
 @@ -786,6 +786,7 @@
  
  /* vnc.c */
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/vnc-title-domain-name
--- a/tools/ioemu/patches/vnc-title-domain-name Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/patches/vnc-title-domain-name Thu Nov 09 15:37:17 2006 -0500
@@ -1,16 +1,16 @@ Index: ioemu/vnc.c
 Index: ioemu/vnc.c
 ===================================================================
---- ioemu.orig/vnc.c   2006-09-21 19:33:31.000000000 +0100
-+++ ioemu/vnc.c        2006-09-21 19:33:31.000000000 +0100
-@@ -1013,6 +1013,7 @@
+--- ioemu.orig/vnc.c   2006-10-24 14:33:46.000000000 +0100
++++ ioemu/vnc.c        2006-10-24 14:33:46.000000000 +0100
+@@ -1024,6 +1024,7 @@
  
  static int protocol_client_init(VncState *vs, char *data, size_t len)
  {
 +    size_t l;
      char pad[3] = { 0, 0, 0 };
  
-     vs->width = vs->ds->width;
-@@ -1058,8 +1059,10 @@
+     vga_hw_update();
+@@ -1071,8 +1072,10 @@
        
      vnc_write(vs, pad, 3);           /* padding */
  
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/xen-build
--- a/tools/ioemu/patches/xen-build     Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/patches/xen-build     Thu Nov 09 15:37:17 2006 -0500
@@ -1,7 +1,7 @@ Index: ioemu/Makefile
 Index: ioemu/Makefile
 ===================================================================
---- ioemu.orig/Makefile        2006-08-28 20:19:23.000000000 +0100
-+++ ioemu/Makefile     2006-08-28 20:20:08.000000000 +0100
+--- ioemu.orig/Makefile        2006-10-24 14:37:25.000000000 +0100
++++ ioemu/Makefile     2006-10-24 14:37:28.000000000 +0100
 @@ -1,11 +1,14 @@
  # Makefile for QEMU.
  
@@ -85,8 +85,8 @@ Index: ioemu/Makefile
  info: qemu-doc.info qemu-tech.info
 Index: ioemu/Makefile.target
 ===================================================================
---- ioemu.orig/Makefile.target 2006-08-28 20:19:23.000000000 +0100
-+++ ioemu/Makefile.target      2006-08-28 20:19:47.000000000 +0100
+--- ioemu.orig/Makefile.target 2006-10-24 14:37:25.000000000 +0100
++++ ioemu/Makefile.target      2006-10-24 14:40:25.000000000 +0100
 @@ -1,5 +1,8 @@
  include config.mak
  
@@ -112,7 +112,7 @@ Index: ioemu/Makefile.target
  endif
 -CFLAGS=-Wall -O2 -g -fno-strict-aliasing
 +CFLAGS+=-Wall -O2 -g -fno-strict-aliasing
-+SSE2 := $(call test-gcc-flag,$(CC),-msse2)
++SSE2 := $(call cc-option,$(CC),-msse2,)
 +ifeq ($(SSE2),-msse2)
 +CFLAGS += -DUSE_SSE2=1 -msse2
 +endif
@@ -149,17 +149,18 @@ Index: ioemu/Makefile.target
  install: all 
 +      mkdir -p "$(DESTDIR)$(bindir)" "$(DESTDIR)$(configdir)"
  ifneq ($(PROGS),)
-       $(INSTALL) -m 755 -s $(PROGS) "$(DESTDIR)$(bindir)"
- endif
-+      install -m 755 $(TARGET_PATH)/qemu-dm.debug "$(DESTDIR)$(bindir)"
-+      install -m 755 $(TARGET_PATH)/qemu-ifup "$(DESTDIR)$(configdir)"
+-      $(INSTALL) -m 755 -s $(PROGS) "$(DESTDIR)$(bindir)"
++      $(INSTALL_PROG) $(PROGS) "$(DESTDIR)$(bindir)"
+ endif
++      $(INSTALL_PROG) $(TARGET_PATH)/qemu-dm.debug "$(DESTDIR)$(bindir)"
++      $(INSTALL_PROG) $(TARGET_PATH)/qemu-ifup "$(DESTDIR)$(configdir)"
  
  ifneq ($(wildcard .depend),)
  include .depend
 Index: ioemu/configure
 ===================================================================
---- ioemu.orig/configure       2006-08-28 20:19:23.000000000 +0100
-+++ ioemu/configure    2006-08-28 20:19:47.000000000 +0100
+--- ioemu.orig/configure       2006-10-24 14:37:25.000000000 +0100
++++ ioemu/configure    2006-10-24 14:40:20.000000000 +0100
 @@ -18,8 +18,8 @@
  
  # default parameters
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/xen-platform-device
--- a/tools/ioemu/patches/xen-platform-device   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/patches/xen-platform-device   Thu Nov 09 15:37:17 2006 -0500
@@ -3,8 +3,8 @@ will come later.
 
 Index: ioemu/Makefile.target
 ===================================================================
---- ioemu.orig/Makefile.target 2006-09-21 19:33:31.000000000 +0100
-+++ ioemu/Makefile.target      2006-09-21 19:33:32.000000000 +0100
+--- ioemu.orig/Makefile.target 2006-10-24 14:41:01.000000000 +0100
++++ ioemu/Makefile.target      2006-10-24 14:41:01.000000000 +0100
 @@ -359,6 +359,7 @@
  VL_OBJS+= usb-uhci.o
  VL_OBJS+= piix4acpi.o
@@ -15,8 +15,8 @@ Index: ioemu/Makefile.target
  ifeq ($(TARGET_BASE_ARCH), ppc)
 Index: ioemu/hw/pc.c
 ===================================================================
---- ioemu.orig/hw/pc.c 2006-09-21 19:33:31.000000000 +0100
-+++ ioemu/hw/pc.c      2006-09-21 19:33:32.000000000 +0100
+--- ioemu.orig/hw/pc.c 2006-10-24 14:41:00.000000000 +0100
++++ ioemu/hw/pc.c      2006-10-24 14:41:01.000000000 +0100
 @@ -823,6 +823,9 @@
      }
  #endif /* !CONFIG_DM */
@@ -30,8 +30,8 @@ Index: ioemu/hw/xen_platform.c
 Index: ioemu/hw/xen_platform.c
 ===================================================================
 --- /dev/null  1970-01-01 00:00:00.000000000 +0000
-+++ ioemu/hw/xen_platform.c    2006-09-21 19:33:32.000000000 +0100
-@@ -0,0 +1,138 @@
++++ ioemu/hw/xen_platform.c    2006-10-24 14:41:04.000000000 +0100
+@@ -0,0 +1,144 @@
 +/*
 + * XEN platform fake pci device, formerly known as the event channel device
 + * 
@@ -131,7 +131,8 @@ Index: ioemu/hw/xen_platform.c
 +    uint8_t  bist; /* Built in self test */
 +    uint32_t base_address_regs[6];
 +    uint32_t reserved1;
-+    uint32_t reserved2;
++    uint16_t subsystem_vendor_id;
++    uint16_t subsystem_id;
 +    uint32_t rom_addr;
 +    uint32_t reserved3;
 +    uint32_t reserved4;
@@ -160,6 +161,11 @@ Index: ioemu/hw/xen_platform.c
 +    pch->header_type = 0;
 +    pch->interrupt_pin = 1;
 +
++    /* Microsoft WHQL requires non-zero subsystem IDs. */
++    /* http://www.pcisig.com/reflector/msg02205.html.  */
++    pch->subsystem_vendor_id = pch->vendor_id; /* Duplicate vendor id.  */
++    pch->subsystem_id        = 0x0001;         /* Hardcode sub-id as 1. */
++
 +    pci_register_io_region(d, 0, 0x100, PCI_ADDRESS_SPACE_IO,
 +                           platform_ioport_map);
 +
@@ -172,9 +178,9 @@ Index: ioemu/hw/xen_platform.c
 +}
 Index: ioemu/vl.h
 ===================================================================
---- ioemu.orig/vl.h    2006-09-21 19:33:32.000000000 +0100
-+++ ioemu/vl.h 2006-09-21 19:33:32.000000000 +0100
-@@ -1210,6 +1210,9 @@
+--- ioemu.orig/vl.h    2006-10-24 14:41:01.000000000 +0100
++++ ioemu/vl.h 2006-10-24 14:41:01.000000000 +0100
+@@ -1212,6 +1212,9 @@
  void xenstore_check_new_media_present(int timeout);
  void xenstore_write_vncport(int vnc_display);
  
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
tools/ioemu/patches/xen-support-buffered-ioreqs
--- a/tools/ioemu/patches/xen-support-buffered-ioreqs   Fri Nov 03 16:53:17 
2006 -0500
+++ b/tools/ioemu/patches/xen-support-buffered-ioreqs   Thu Nov 09 15:37:17 
2006 -0500
@@ -1,8 +1,8 @@ Index: ioemu/vl.c
 Index: ioemu/vl.c
 ===================================================================
---- ioemu.orig/vl.c    2006-09-21 19:33:32.000000000 +0100
-+++ ioemu/vl.c 2006-09-21 19:33:32.000000000 +0100
-@@ -5844,6 +5844,7 @@
+--- ioemu.orig/vl.c    2006-10-24 14:33:47.000000000 +0100
++++ ioemu/vl.c 2006-10-24 14:33:47.000000000 +0100
+@@ -5854,6 +5854,7 @@
      unsigned long nr_pages, tmp_nr_pages, shared_page_nr;
      xen_pfn_t *page_array;
      extern void *shared_page;
@@ -10,7 +10,7 @@ Index: ioemu/vl.c
  
      char qemu_dm_logfilename[64];
  
-@@ -6425,6 +6426,18 @@
+@@ -6440,6 +6441,18 @@
      fprintf(logfile, "shared page at pfn:%lx, mfn: %"PRIx64"\n",
              shared_page_nr, (uint64_t)(page_array[shared_page_nr]));
  
@@ -31,8 +31,8 @@ Index: ioemu/vl.c
  #elif defined(__ia64__)
 Index: ioemu/target-i386-dm/helper2.c
 ===================================================================
---- ioemu.orig/target-i386-dm/helper2.c        2006-09-21 19:33:30.000000000 
+0100
-+++ ioemu/target-i386-dm/helper2.c     2006-09-21 19:33:32.000000000 +0100
+--- ioemu.orig/target-i386-dm/helper2.c        2006-10-24 14:33:45.000000000 
+0100
++++ ioemu/target-i386-dm/helper2.c     2006-10-24 14:33:47.000000000 +0100
 @@ -76,6 +76,10 @@
  
  shared_iopage_t *shared_page = NULL;
diff -r b30cb72ed5e2 -r 4d4f0d52c193 
tools/ioemu/patches/xenstore-block-device-config
--- a/tools/ioemu/patches/xenstore-block-device-config  Fri Nov 03 16:53:17 
2006 -0500
+++ b/tools/ioemu/patches/xenstore-block-device-config  Thu Nov 09 15:37:17 
2006 -0500
@@ -1,7 +1,7 @@ Index: ioemu/Makefile.target
 Index: ioemu/Makefile.target
 ===================================================================
---- ioemu.orig/Makefile.target 2006-09-21 19:33:31.000000000 +0100
-+++ ioemu/Makefile.target      2006-09-21 19:33:31.000000000 +0100
+--- ioemu.orig/Makefile.target 2006-10-24 14:31:36.000000000 +0100
++++ ioemu/Makefile.target      2006-10-24 14:33:28.000000000 +0100
 @@ -358,6 +358,7 @@
  VL_OBJS+= cirrus_vga.o mixeng.o parallel.o acpi.o piix_pci.o
  VL_OBJS+= usb-uhci.o
@@ -13,7 +13,7 @@ Index: ioemu/xenstore.c
 Index: ioemu/xenstore.c
 ===================================================================
 --- /dev/null  1970-01-01 00:00:00.000000000 +0000
-+++ ioemu/xenstore.c   2006-09-21 19:33:31.000000000 +0100
++++ ioemu/xenstore.c   2006-10-24 14:33:28.000000000 +0100
 @@ -0,0 +1,187 @@
 +/*
 + * This file is subject to the terms and conditions of the GNU General
@@ -204,9 +204,9 @@ Index: ioemu/xenstore.c
 +}
 Index: ioemu/vl.c
 ===================================================================
---- ioemu.orig/vl.c    2006-09-21 19:33:31.000000000 +0100
-+++ ioemu/vl.c 2006-09-21 19:33:31.000000000 +0100
-@@ -5249,9 +5249,11 @@
+--- ioemu.orig/vl.c    2006-10-24 14:33:24.000000000 +0100
++++ ioemu/vl.c 2006-10-24 14:33:28.000000000 +0100
+@@ -5256,9 +5256,11 @@
             "Standard options:\n"
             "-M machine      select emulated machine (-M ? for list)\n"
             "-fda/-fdb file  use 'file' as floppy disk 0/1 image\n"
@@ -218,7 +218,7 @@ Index: ioemu/vl.c
             "-boot [a|c|d]   boot on floppy (a), hard disk (c) or CD-ROM (d)\n"
           "-snapshot       write to temporary files instead of disk image 
files\n"
  #ifdef TARGET_I386
-@@ -5378,11 +5380,13 @@
+@@ -5386,11 +5388,13 @@
      QEMU_OPTION_M,
      QEMU_OPTION_fda,
      QEMU_OPTION_fdb,
@@ -232,7 +232,7 @@ Index: ioemu/vl.c
      QEMU_OPTION_boot,
      QEMU_OPTION_snapshot,
  #ifdef TARGET_I386
-@@ -5454,11 +5458,13 @@
+@@ -5463,11 +5467,13 @@
      { "M", HAS_ARG, QEMU_OPTION_M },
      { "fda", HAS_ARG, QEMU_OPTION_fda },
      { "fdb", HAS_ARG, QEMU_OPTION_fdb },
@@ -246,7 +246,7 @@ Index: ioemu/vl.c
      { "boot", HAS_ARG, QEMU_OPTION_boot },
      { "snapshot", 0, QEMU_OPTION_snapshot },
  #ifdef TARGET_I386
-@@ -5807,10 +5813,16 @@
+@@ -5817,10 +5823,16 @@
  #ifdef CONFIG_GDBSTUB
      int use_gdbstub, gdbstub_port;
  #endif
@@ -265,7 +265,7 @@ Index: ioemu/vl.c
      const char *kernel_filename, *kernel_cmdline;
      DisplayState *ds = &display_state;
      int cyls, heads, secs, translation;
-@@ -5871,8 +5883,10 @@
+@@ -5881,8 +5893,10 @@
      initrd_filename = NULL;
      for(i = 0; i < MAX_FD; i++)
          fd_filename[i] = NULL;
@@ -276,7 +276,7 @@ Index: ioemu/vl.c
      ram_size = DEFAULT_RAM_SIZE * 1024 * 1024;
      vga_ram_size = VGA_RAM_SIZE;
      bios_size = BIOS_SIZE;
-@@ -5886,11 +5900,13 @@
+@@ -5896,11 +5910,13 @@
      vncunused = 0;
      kernel_filename = NULL;
      kernel_cmdline = "";
@@ -290,7 +290,7 @@ Index: ioemu/vl.c
      cyls = heads = secs = 0;
      translation = BIOS_ATA_TRANSLATION_AUTO;
      pstrcpy(monitor_device, sizeof(monitor_device), "vc");
-@@ -5923,7 +5939,11 @@
+@@ -5935,7 +5951,11 @@
              break;
          r = argv[optind];
          if (r[0] != '-') {
@@ -302,7 +302,7 @@ Index: ioemu/vl.c
          } else {
              const QEMUOption *popt;
  
-@@ -5967,6 +5987,7 @@
+@@ -5979,6 +5999,7 @@
              case QEMU_OPTION_initrd:
                  initrd_filename = optarg;
                  break;
@@ -310,7 +310,7 @@ Index: ioemu/vl.c
              case QEMU_OPTION_hda:
              case QEMU_OPTION_hdb:
              case QEMU_OPTION_hdc:
-@@ -5979,6 +6000,7 @@
+@@ -5991,6 +6012,7 @@
                          cdrom_index = -1;
                  }
                  break;
@@ -318,7 +318,7 @@ Index: ioemu/vl.c
              case QEMU_OPTION_snapshot:
                  snapshot = 1;
                  break;
-@@ -6031,11 +6053,13 @@
+@@ -6043,11 +6065,13 @@
              case QEMU_OPTION_append:
                  kernel_cmdline = optarg;
                  break;
@@ -332,7 +332,7 @@ Index: ioemu/vl.c
              case QEMU_OPTION_boot:
                  boot_device = optarg[0];
                  if (boot_device != 'a' && 
-@@ -6290,12 +6314,18 @@
+@@ -6305,12 +6329,18 @@
          }
      }
  
@@ -351,7 +351,7 @@ Index: ioemu/vl.c
      if (!linux_boot && 
          hd_filename[0] == '\0' && 
          (cdrom_index >= 0 && hd_filename[cdrom_index] == '\0') &&
-@@ -6309,6 +6339,7 @@
+@@ -6324,6 +6354,7 @@
          else
              boot_device = 'd';
      }
@@ -359,7 +359,7 @@ Index: ioemu/vl.c
  
      setvbuf(stdout, NULL, _IOLBF, 0);
      
-@@ -6441,6 +6472,7 @@
+@@ -6456,6 +6487,7 @@
  
  #endif /* !CONFIG_DM */
  
@@ -367,7 +367,7 @@ Index: ioemu/vl.c
      /* we always create the cdrom drive, even if no disk is there */
      bdrv_init();
      if (cdrom_index >= 0) {
-@@ -6467,6 +6499,7 @@
+@@ -6482,6 +6514,7 @@
              }
          }
      }
@@ -375,7 +375,7 @@ Index: ioemu/vl.c
  
      /* we always create at least one floppy disk */
      fd_table[0] = bdrv_new("fda");
-@@ -6545,6 +6578,8 @@
+@@ -6560,6 +6593,8 @@
          }
      }
  
@@ -386,8 +386,8 @@ Index: ioemu/vl.c
                    kernel_filename, kernel_cmdline, initrd_filename,
 Index: ioemu/monitor.c
 ===================================================================
---- ioemu.orig/monitor.c       2006-09-21 19:33:30.000000000 +0100
-+++ ioemu/monitor.c    2006-09-21 19:33:31.000000000 +0100
+--- ioemu.orig/monitor.c       2006-10-24 14:31:36.000000000 +0100
++++ ioemu/monitor.c    2006-10-24 14:33:28.000000000 +0100
 @@ -24,6 +24,7 @@
  #include "vl.h"
  #include "disas.h"
@@ -416,8 +416,8 @@ Index: ioemu/monitor.c
      int i;
 Index: ioemu/block.c
 ===================================================================
---- ioemu.orig/block.c 2006-09-21 19:33:25.000000000 +0100
-+++ ioemu/block.c      2006-09-21 19:33:31.000000000 +0100
+--- ioemu.orig/block.c 2006-10-24 14:31:36.000000000 +0100
++++ ioemu/block.c      2006-10-24 14:33:28.000000000 +0100
 @@ -758,6 +758,7 @@
  static void raw_close(BlockDriverState *bs)
  {
@@ -428,9 +428,9 @@ Index: ioemu/block.c
  
 Index: ioemu/vl.h
 ===================================================================
---- ioemu.orig/vl.h    2006-09-21 19:33:31.000000000 +0100
-+++ ioemu/vl.h 2006-09-21 19:33:31.000000000 +0100
-@@ -1189,6 +1189,8 @@
+--- ioemu.orig/vl.h    2006-10-24 14:33:24.000000000 +0100
++++ ioemu/vl.h 2006-10-24 14:33:28.000000000 +0100
+@@ -1191,6 +1191,8 @@
  void term_print_help(void);
  void monitor_readline(const char *prompt, int is_password,
                        char *buf, int buf_size);
@@ -439,7 +439,7 @@ Index: ioemu/vl.h
  
  /* readline.c */
  typedef void ReadLineFunc(void *opaque, const char *str);
-@@ -1201,6 +1203,13 @@
+@@ -1203,6 +1205,13 @@
  void readline_start(const char *prompt, int is_password,
                      ReadLineFunc *readline_func, void *opaque);
  
@@ -455,8 +455,8 @@ Index: ioemu/vl.h
  extern char domain_name[];
 Index: ioemu/hw/ide.c
 ===================================================================
---- ioemu.orig/hw/ide.c        2006-09-21 19:33:30.000000000 +0100
-+++ ioemu/hw/ide.c     2006-09-21 19:33:31.000000000 +0100
+--- ioemu.orig/hw/ide.c        2006-10-24 14:31:36.000000000 +0100
++++ ioemu/hw/ide.c     2006-10-24 14:33:28.000000000 +0100
 @@ -1158,6 +1158,7 @@
          } else {
              ide_atapi_cmd_error(s, SENSE_NOT_READY, 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/patches/xenstore-write-vnc-port
--- a/tools/ioemu/patches/xenstore-write-vnc-port       Fri Nov 03 16:53:17 
2006 -0500
+++ b/tools/ioemu/patches/xenstore-write-vnc-port       Thu Nov 09 15:37:17 
2006 -0500
@@ -1,7 +1,7 @@ Index: ioemu/xenstore.c
 Index: ioemu/xenstore.c
 ===================================================================
---- ioemu.orig/xenstore.c      2006-09-21 19:33:31.000000000 +0100
-+++ ioemu/xenstore.c   2006-09-21 19:33:32.000000000 +0100
+--- ioemu.orig/xenstore.c      2006-10-24 14:33:47.000000000 +0100
++++ ioemu/xenstore.c   2006-10-24 14:33:47.000000000 +0100
 @@ -185,3 +185,31 @@
      free(image);
      free(vec);
@@ -36,10 +36,10 @@ Index: ioemu/xenstore.c
 +}
 Index: ioemu/vl.c
 ===================================================================
---- ioemu.orig/vl.c    2006-09-21 19:33:31.000000000 +0100
-+++ ioemu/vl.c 2006-09-21 19:33:32.000000000 +0100
-@@ -6535,6 +6535,7 @@
-       vnc_display = vnc_display_init(ds, vnc_display, vncunused);
+--- ioemu.orig/vl.c    2006-10-24 14:33:47.000000000 +0100
++++ ioemu/vl.c 2006-10-24 14:33:47.000000000 +0100
+@@ -6550,6 +6550,7 @@
+       vnc_display = vnc_display_init(ds, vnc_display, vncunused, 
&vnclisten_addr);
        if (vncviewer)
            vnc_start_viewer(vnc_display);
 +      xenstore_write_vncport(vnc_display);
@@ -48,9 +48,9 @@ Index: ioemu/vl.c
          sdl_display_init(ds, full_screen);
 Index: ioemu/vl.h
 ===================================================================
---- ioemu.orig/vl.h    2006-09-21 19:33:31.000000000 +0100
-+++ ioemu/vl.h 2006-09-21 19:33:32.000000000 +0100
-@@ -1208,6 +1208,7 @@
+--- ioemu.orig/vl.h    2006-10-24 14:33:47.000000000 +0100
++++ ioemu/vl.h 2006-10-24 14:33:47.000000000 +0100
+@@ -1210,6 +1210,7 @@
  int xenstore_fd(void);
  void xenstore_process_event(void *opaque);
  void xenstore_check_new_media_present(int timeout);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/target-i386-dm/exec-dm.c
--- a/tools/ioemu/target-i386-dm/exec-dm.c      Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/target-i386-dm/exec-dm.c      Thu Nov 09 15:37:17 2006 -0500
@@ -32,6 +32,8 @@
 #include <unistd.h>
 #include <inttypes.h>
 
+#include <xen/hvm/e820.h>
+
 #include "cpu.h"
 #include "exec-all.h"
 
@@ -407,22 +409,36 @@ int iomem_index(target_phys_addr_t addr)
         return 0;
 }
 
+static inline int paddr_is_ram(target_phys_addr_t addr)
+{
+    /* Is this guest physical address RAM-backed? */
+#if defined(CONFIG_DM) && (defined(__i386__) || defined(__x86_64__))
+    if (ram_size <= HVM_BELOW_4G_RAM_END)
+        /* RAM is contiguous */
+        return (addr < ram_size);
+    else
+        /* There is RAM below and above the MMIO hole */
+        return ((addr < HVM_BELOW_4G_MMIO_START) ||
+                ((addr >= HVM_BELOW_4G_MMIO_START + HVM_BELOW_4G_MMIO_LENGTH)
+                 && (addr < ram_size + HVM_BELOW_4G_MMIO_LENGTH)));
+#else
+    return (addr < ram_size);
+#endif
+}
+
 void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf, 
                             int len, int is_write)
 {
     int l, io_index;
     uint8_t *ptr;
     uint32_t val;
-    target_phys_addr_t page;
-    unsigned long pd;
     
     while (len > 0) {
-        page = addr & TARGET_PAGE_MASK;
-        l = (page + TARGET_PAGE_SIZE) - addr;
+        /* How much can we copy before the next page boundary? */
+        l = TARGET_PAGE_SIZE - (addr & ~TARGET_PAGE_MASK); 
         if (l > len)
             l = len;
        
-        pd = page;
         io_index = iomem_index(addr);
         if (is_write) {
             if (io_index) {
@@ -442,15 +458,11 @@ void cpu_physical_memory_rw(target_phys_
                     io_mem_write[io_index][0](io_mem_opaque[io_index], addr, 
val);
                     l = 1;
                 }
-            } else {
-                unsigned long addr1;
-
-                addr1 = (pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK);
-                /* RAM case */
-                ptr = phys_ram_base + addr1;
-                memcpy(ptr, buf, l);
+            } else if (paddr_is_ram(addr)) {
+                /* Reading from RAM */
+                memcpy(phys_ram_base + addr, buf, l);
 #ifdef __ia64__
-                sync_icache((unsigned long)ptr, l);
+                sync_icache((unsigned long)(phys_ram_base + addr), l);
 #endif 
             }
         } else {
@@ -471,14 +483,12 @@ void cpu_physical_memory_rw(target_phys_
                     stb_raw(buf, val);
                     l = 1;
                 }
-            } else if (addr < ram_size) {
-                /* RAM case */
-                ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) + 
-                    (addr & ~TARGET_PAGE_MASK);
-                memcpy(buf, ptr, l);
+            } else if (paddr_is_ram(addr)) {
+                /* Reading from RAM */
+                memcpy(buf, phys_ram_base + addr, l);
             } else {
-                /* unreported MMIO space */
-                memset(buf, 0xff, len);
+                /* Neither RAM nor known MMIO space */
+                memset(buf, 0xff, len); 
             }
         }
         len -= l;
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/target-i386-dm/helper2.c
--- a/tools/ioemu/target-i386-dm/helper2.c      Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/target-i386-dm/helper2.c      Thu Nov 09 15:37:17 2006 -0500
@@ -193,10 +193,10 @@ void sp_info()
     for (i = 0; i < vcpus; i++) {
         req = &(shared_page->vcpu_iodata[i].vp_ioreq);
         term_printf("vcpu %d: event port %d\n", i, ioreq_local_port[i]);
-        term_printf("  req state: %x, pvalid: %x, addr: %"PRIx64", "
+        term_printf("  req state: %x, ptr: %x, addr: %"PRIx64", "
                     "data: %"PRIx64", count: %"PRIx64", size: %"PRIx64"\n",
-                    req->state, req->pdata_valid, req->addr,
-                    req->u.data, req->count, req->size);
+                    req->state, req->data_is_ptr, req->addr,
+                    req->data, req->count, req->size);
         term_printf("  IO totally occurred on this vcpu: %"PRIx64"\n",
                     req->io_count);
     }
@@ -216,10 +216,10 @@ static ioreq_t *__cpu_get_ioreq(int vcpu
     }
 
     fprintf(logfile, "False I/O request ... in-service already: "
-            "%x, pvalid: %x, port: %"PRIx64", "
+            "%x, ptr: %x, port: %"PRIx64", "
             "data: %"PRIx64", count: %"PRIx64", size: %"PRIx64"\n",
-            req->state, req->pdata_valid, req->addr,
-            req->u.data, req->count, req->size);
+            req->state, req->data_is_ptr, req->addr,
+            req->data, req->count, req->size);
     return NULL;
 }
 
@@ -305,26 +305,26 @@ void cpu_ioreq_pio(CPUState *env, ioreq_
     sign = req->df ? -1 : 1;
 
     if (req->dir == IOREQ_READ) {
-        if (!req->pdata_valid) {
-            req->u.data = do_inp(env, req->addr, req->size);
+        if (!req->data_is_ptr) {
+            req->data = do_inp(env, req->addr, req->size);
         } else {
             unsigned long tmp;
 
             for (i = 0; i < req->count; i++) {
                 tmp = do_inp(env, req->addr, req->size);
-                write_physical((target_phys_addr_t) req->u.pdata
+                write_physical((target_phys_addr_t) req->data
                   + (sign * i * req->size),
                   req->size, &tmp);
             }
         }
     } else if (req->dir == IOREQ_WRITE) {
-        if (!req->pdata_valid) {
-            do_outp(env, req->addr, req->size, req->u.data);
+        if (!req->data_is_ptr) {
+            do_outp(env, req->addr, req->size, req->data);
         } else {
             for (i = 0; i < req->count; i++) {
                 unsigned long tmp;
 
-                read_physical((target_phys_addr_t) req->u.pdata
+                read_physical((target_phys_addr_t) req->data
                   + (sign * i * req->size),
                   req->size, &tmp);
                 do_outp(env, req->addr, req->size, tmp);
@@ -339,18 +339,18 @@ void cpu_ioreq_move(CPUState *env, ioreq
 
     sign = req->df ? -1 : 1;
 
-    if (!req->pdata_valid) {
+    if (!req->data_is_ptr) {
         if (req->dir == IOREQ_READ) {
             for (i = 0; i < req->count; i++) {
                 read_physical(req->addr
                   + (sign * i * req->size),
-                  req->size, &req->u.data);
+                  req->size, &req->data);
             }
         } else if (req->dir == IOREQ_WRITE) {
             for (i = 0; i < req->count; i++) {
                 write_physical(req->addr
                   + (sign * i * req->size),
-                  req->size, &req->u.data);
+                  req->size, &req->data);
             }
         }
     } else {
@@ -361,13 +361,13 @@ void cpu_ioreq_move(CPUState *env, ioreq
                 read_physical(req->addr
                   + (sign * i * req->size),
                   req->size, &tmp);
-                write_physical((target_phys_addr_t )req->u.pdata
+                write_physical((target_phys_addr_t )req->data
                   + (sign * i * req->size),
                   req->size, &tmp);
             }
         } else if (req->dir == IOREQ_WRITE) {
             for (i = 0; i < req->count; i++) {
-                read_physical((target_phys_addr_t) req->u.pdata
+                read_physical((target_phys_addr_t) req->data
                   + (sign * i * req->size),
                   req->size, &tmp);
                 write_physical(req->addr
@@ -382,51 +382,66 @@ void cpu_ioreq_and(CPUState *env, ioreq_
 {
     unsigned long tmp1, tmp2;
 
-    if (req->pdata_valid != 0)
+    if (req->data_is_ptr != 0)
         hw_error("expected scalar value");
 
     read_physical(req->addr, req->size, &tmp1);
     if (req->dir == IOREQ_WRITE) {
-        tmp2 = tmp1 & (unsigned long) req->u.data;
+        tmp2 = tmp1 & (unsigned long) req->data;
         write_physical(req->addr, req->size, &tmp2);
     }
-    req->u.data = tmp1;
-}
-
-void cpu_ioreq_or(CPUState *env, ioreq_t *req)
+    req->data = tmp1;
+}
+
+void cpu_ioreq_add(CPUState *env, ioreq_t *req)
 {
     unsigned long tmp1, tmp2;
 
-    if (req->pdata_valid != 0)
+    if (req->data_is_ptr != 0)
         hw_error("expected scalar value");
 
     read_physical(req->addr, req->size, &tmp1);
     if (req->dir == IOREQ_WRITE) {
-        tmp2 = tmp1 | (unsigned long) req->u.data;
+        tmp2 = tmp1 + (unsigned long) req->data;
         write_physical(req->addr, req->size, &tmp2);
     }
-    req->u.data = tmp1;
-}
-
-void cpu_ioreq_xor(CPUState *env, ioreq_t *req)
+    req->data = tmp1;
+}
+
+void cpu_ioreq_or(CPUState *env, ioreq_t *req)
 {
     unsigned long tmp1, tmp2;
 
-    if (req->pdata_valid != 0)
+    if (req->data_is_ptr != 0)
         hw_error("expected scalar value");
 
     read_physical(req->addr, req->size, &tmp1);
     if (req->dir == IOREQ_WRITE) {
-        tmp2 = tmp1 ^ (unsigned long) req->u.data;
+        tmp2 = tmp1 | (unsigned long) req->data;
         write_physical(req->addr, req->size, &tmp2);
     }
-    req->u.data = tmp1;
+    req->data = tmp1;
+}
+
+void cpu_ioreq_xor(CPUState *env, ioreq_t *req)
+{
+    unsigned long tmp1, tmp2;
+
+    if (req->data_is_ptr != 0)
+        hw_error("expected scalar value");
+
+    read_physical(req->addr, req->size, &tmp1);
+    if (req->dir == IOREQ_WRITE) {
+        tmp2 = tmp1 ^ (unsigned long) req->data;
+        write_physical(req->addr, req->size, &tmp2);
+    }
+    req->data = tmp1;
 }
 
 void __handle_ioreq(CPUState *env, ioreq_t *req)
 {
-    if (!req->pdata_valid && req->dir == IOREQ_WRITE && req->size != 4)
-       req->u.data &= (1UL << (8 * req->size)) - 1;
+    if (!req->data_is_ptr && req->dir == IOREQ_WRITE && req->size != 4)
+       req->data &= (1UL << (8 * req->size)) - 1;
 
     switch (req->type) {
     case IOREQ_TYPE_PIO:
@@ -437,6 +452,9 @@ void __handle_ioreq(CPUState *env, ioreq
         break;
     case IOREQ_TYPE_AND:
         cpu_ioreq_and(env, req);
+        break;
+    case IOREQ_TYPE_ADD:
+        cpu_ioreq_add(env, req);
         break;
     case IOREQ_TYPE_OR:
         cpu_ioreq_or(env, req);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/target-i386-dm/i8259-dm.c
--- a/tools/ioemu/target-i386-dm/i8259-dm.c     Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/target-i386-dm/i8259-dm.c     Thu Nov 09 15:37:17 2006 -0500
@@ -22,58 +22,18 @@
  * THE SOFTWARE.
  */
 #include "vl.h"
-
-/* debug PIC */
-//#define DEBUG_PIC
-
-//#define DEBUG_IRQ_LATENCY
-//#define DEBUG_IRQ_COUNT
-
 #include "xenctrl.h"
 #include <xen/hvm/ioreq.h>
 #include <stdio.h>
 #include "cpu.h"
 #include "cpu-all.h"
 
-extern shared_iopage_t *shared_page;
-
 struct PicState2 {
 };
 
 void pic_set_irq_new(void *opaque, int irq, int level)
 {
-    /* PicState2 *s = opaque; */
-    global_iodata_t  *gio;
-    int  mask;
-
-    gio = &shared_page->sp_global;
-    mask = 1 << irq;
-    if ( gio->pic_elcr & mask ) {
-        /* level */
-       if ( level ) {
-           atomic_clear_bit(irq, &gio->pic_clear_irr);
-           atomic_set_bit(irq, &gio->pic_irr);
-           cpu_single_env->send_event = 1;
-       }
-       else {
-           atomic_clear_bit(irq, &gio->pic_irr);
-           atomic_set_bit(irq, &gio->pic_clear_irr);
-           cpu_single_env->send_event = 1;
-       }
-    }
-    else {
-       /* edge */
-       if ( level ) {
-           if ( (mask & gio->pic_last_irr) == 0 ) { 
-               atomic_set_bit(irq, &gio->pic_irr);
-               atomic_set_bit(irq, &gio->pic_last_irr);
-               cpu_single_env->send_event = 1;
-           }
-       }
-       else {
-           atomic_clear_bit(irq, &gio->pic_last_irr);
-       }
-    }
+    xc_hvm_set_irq_level(xc_handle, domid, irq, level);
 }
 
 /* obsolete function */
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/target-i386-dm/qemu-dm.debug
--- a/tools/ioemu/target-i386-dm/qemu-dm.debug  Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/target-i386-dm/qemu-dm.debug  Thu Nov 09 15:37:17 2006 -0500
@@ -1,5 +1,10 @@
 #!/bin/sh
 
+if [ "`arch`" = "x86_64" ]; then
+    LIBDIR="lib64"
+else
+    LIBDIR="lib"
+fi
 echo $* > /tmp/args
 echo $DISPLAY >> /tmp/args
-exec /usr/lib/xen/bin/qemu-dm $*
+exec /usr/$LIBDIR/xen/bin/qemu-dm $*
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/vl.c
--- a/tools/ioemu/vl.c  Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/vl.c  Thu Nov 09 15:37:17 2006 -0500
@@ -170,6 +170,9 @@ time_t timeoffset = 0;
 
 char domain_name[1024] = { 'H','V', 'M', 'X', 'E', 'N', '-'};
 extern int domid;
+
+char vncpasswd[64];
+unsigned char challenge[AUTHCHALLENGESIZE];
 
 /***********************************************************/
 /* x86 ISA bus support */
@@ -1681,7 +1684,7 @@ static void tty_serial_init(int fd, int 
 
     tty.c_iflag &= ~(IGNBRK|BRKINT|PARMRK|ISTRIP
                           |INLCR|IGNCR|ICRNL|IXON);
-    tty.c_oflag |= OPOST;
+    tty.c_oflag &= ~OPOST; /* no output mangling of raw serial stream */
     tty.c_lflag &= ~(ECHO|ECHONL|ICANON|IEXTEN|ISIG);
     tty.c_cflag &= ~(CSIZE|PARENB|PARODD|CRTSCTS);
     switch(data_bits) {
@@ -5911,6 +5914,7 @@ int main(int argc, char **argv)
     vncunused = 0;
     kernel_filename = NULL;
     kernel_cmdline = "";
+    *vncpasswd = '\0';
 #ifndef CONFIG_DM
 #ifdef TARGET_PPC
     cdrom_index = 1;
@@ -6416,14 +6420,13 @@ int main(int argc, char **argv)
     }
 
 #if defined(__i386__) || defined(__x86_64__)
-    if (xc_get_pfn_list(xc_handle, domid, page_array, nr_pages) != nr_pages) {
+    for ( i = 0; i < tmp_nr_pages; i++)
+        page_array[i] = i;
+    if (xc_domain_translate_gpfn_list(xc_handle, domid, tmp_nr_pages,
+                                      page_array, page_array)) {
         fprintf(logfile, "xc_get_pfn_list returned error %d\n", errno);
         exit(-1);
     }
-
-    if (ram_size > HVM_BELOW_4G_RAM_END)
-        for (i = 0; i < nr_pages - (HVM_BELOW_4G_RAM_END >> PAGE_SHIFT); i++)
-            page_array[tmp_nr_pages - 1 - i] = page_array[nr_pages - 1 - i];
 
     phys_ram_base = xc_map_foreign_batch(xc_handle, domid,
                                          PROT_READ|PROT_WRITE, page_array,
@@ -6444,7 +6447,6 @@ int main(int argc, char **argv)
     fprintf(logfile, "shared page at pfn:%lx, mfn: %"PRIx64"\n",
             shared_page_nr, (uint64_t)(page_array[shared_page_nr]));
 
-    /* not yet add for IA64 */
     buffered_io_page = xc_map_foreign_range(xc_handle, domid, PAGE_SIZE,
                                             PROT_READ|PROT_WRITE,
                                             page_array[shared_page_nr - 2]);
@@ -6461,7 +6463,7 @@ int main(int argc, char **argv)
 #elif defined(__ia64__)
   
     if (xc_ia64_get_pfn_list(xc_handle, domid, page_array,
-                             IO_PAGE_START >> PAGE_SHIFT, 1) != 1) {
+                             IO_PAGE_START >> PAGE_SHIFT, 3) != 3) {
         fprintf(logfile, "xc_ia64_get_pfn_list returned error %d\n", errno);
         exit(-1);
     }
@@ -6472,6 +6474,12 @@ int main(int argc, char **argv)
 
     fprintf(logfile, "shared page at pfn:%lx, mfn: %016lx\n",
             IO_PAGE_START >> PAGE_SHIFT, page_array[0]);
+
+    buffered_io_page =xc_map_foreign_range(xc_handle, domid, PAGE_SIZE,
+                                       PROT_READ|PROT_WRITE,
+                                       page_array[2]);
+    fprintf(logfile, "Buffered IO page at pfn:%lx, mfn: %016lx\n",
+            BUFFER_IO_PAGE_START >> PAGE_SHIFT, page_array[2]);
 
     if (xc_ia64_get_pfn_list(xc_handle, domid,
                              page_array, 0, nr_pages) != nr_pages) {
@@ -6492,6 +6500,7 @@ int main(int argc, char **argv)
         fprintf(logfile, "xc_map_foreign_batch returned error %d\n", errno);
         exit(-1);
     }
+    free(page_array);
 #endif
 #else  /* !CONFIG_DM */
 
@@ -6559,6 +6568,10 @@ int main(int argc, char **argv)
 
     init_ioports();
 
+    /* read vncpasswd from xenstore */
+    if (0 > xenstore_read_vncpasswd(domid))
+        exit(1);
+
     /* terminal init */
     if (nographic) {
         dumb_display_init(ds);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/vl.h
--- a/tools/ioemu/vl.h  Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/vl.h  Thu Nov 09 15:37:17 2006 -0500
@@ -929,6 +929,10 @@ void piix4_pm_init(PCIBus *bus, int devf
 void piix4_pm_init(PCIBus *bus, int devfn);
 void acpi_bios_init(void);
 
+/* tpm_tis.c */
+int has_tpm_device(void);
+void tpm_tis_init(SetIRQFunc *set_irq, void *irq_opaque, int irq);
+
 /* piix4acpi.c */
 extern void pci_piix4_acpi_init(PCIBus *bus, int devfn);
 
@@ -1211,6 +1215,26 @@ void xenstore_process_event(void *opaque
 void xenstore_process_event(void *opaque);
 void xenstore_check_new_media_present(int timeout);
 void xenstore_write_vncport(int vnc_display);
+int xenstore_read_vncpasswd(int domid);
+
+int xenstore_domain_has_devtype(struct xs_handle *handle,
+                                const char *devtype);
+char **xenstore_domain_get_devices(struct xs_handle *handle,
+                                   const char *devtype, unsigned int *num);
+char *xenstore_read_hotplug_status(struct xs_handle *handle,
+                                   const char *devtype, const char *inst);
+char *xenstore_backend_read_variable(struct xs_handle *,
+                                     const char *devtype, const char *inst,
+                                     const char *var);
+int xenstore_subscribe_to_hotplug_status(struct xs_handle *handle,
+                                         const char *devtype,
+                                         const char *inst,
+                                         const char *token);
+int xenstore_unsubscribe_from_hotplug_status(struct xs_handle *handle,
+                                             const char *devtype,
+                                             const char *inst,
+                                             const char *token);
+
 
 /* xen_platform.c */
 void pci_xen_platform_init(PCIBus *bus);
@@ -1222,4 +1246,7 @@ extern char domain_name[];
 
 void destroy_hvm_domain(void);
 
+/* VNC Authentication */
+#define AUTHCHALLENGESIZE 16
+
 #endif /* VL_H */
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/vnc.c
--- a/tools/ioemu/vnc.c Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/vnc.c Thu Nov 09 15:37:17 2006 -0500
@@ -44,6 +44,7 @@
 
 #include "vnc_keysym.h"
 #include "keymaps.c"
+#include "d3des.h"
 
 #define XK_MISCELLANY
 #define XK_LATIN1
@@ -137,6 +138,9 @@ static void vnc_update_client(void *opaq
 static void vnc_update_client(void *opaque);
 static void vnc_client_read(void *opaque);
 static void framebuffer_set_updated(VncState *vs, int x, int y, int w, int h);
+static int make_challenge(char *random, int size);
+static void set_seed(unsigned int *seedp);
+static void get_random(int len, unsigned char *buf);
 
 #if 0
 static inline void vnc_set_bit(uint32_t *d, int k)
@@ -199,6 +203,8 @@ static void set_bits_in_row(VncState *vs
        mask = ~(0ULL);
 
     h += y;
+    if (h > vs->ds->height)
+        h = vs->ds->height;
     for (; y < h; y++)
        row[y] |= mask;
 }
@@ -1208,23 +1214,92 @@ static int protocol_client_init(VncState
     return 0;
 }
 
+static int protocol_response(VncState *vs, char *client_response, size_t len)
+{
+    extern char vncpasswd[64];
+    extern unsigned char challenge[AUTHCHALLENGESIZE];
+    unsigned char cryptchallenge[AUTHCHALLENGESIZE];
+    unsigned char key[8];
+    int passwdlen, i, j;
+
+    memcpy(cryptchallenge, challenge, AUTHCHALLENGESIZE);
+
+    /* Calculate the sent challenge */
+    passwdlen = strlen(vncpasswd);
+    for (i=0; i<8; i++)
+       key[i] = i<passwdlen ? vncpasswd[i] : 0;
+    deskey(key, EN0);
+    for (j = 0; j < AUTHCHALLENGESIZE; j += 8)
+       des(cryptchallenge+j, cryptchallenge+j);
+
+    /* Check the actual response */
+    if (memcmp(cryptchallenge, client_response, AUTHCHALLENGESIZE) != 0) {
+       /* password error */
+       vnc_write_u32(vs, 1);
+       vnc_write_u32(vs, 22);
+       vnc_write(vs, "Authentication failure", 22);
+       vnc_flush(vs);
+       fprintf(stderr, "VNC Password error.\n");
+       vnc_client_error(vs);
+       return 0;
+    }
+
+    vnc_write_u32(vs, 0);
+    vnc_flush(vs);
+
+    vnc_read_when(vs, protocol_client_init, 1);
+
+    return 0;
+}
+
 static int protocol_version(VncState *vs, char *version, size_t len)
 {
+    extern char vncpasswd[64];
+    extern unsigned char challenge[AUTHCHALLENGESIZE];
     char local[13];
-    int maj, min;
+    int  support, maj, min;
 
     memcpy(local, version, 12);
     local[12] = 0;
 
+    /* protocol version check */
     if (sscanf(local, "RFB %03d.%03d\n", &maj, &min) != 2) {
+       fprintf(stderr, "Protocol version error.\n");
        vnc_client_error(vs);
        return 0;
     }
 
-    vnc_write_u32(vs, 1); /* None */
-    vnc_flush(vs);
-
-    vnc_read_when(vs, protocol_client_init, 1);
+
+    support = 0;
+    if (maj = 3) {
+       if (min == 3 || min ==4) {
+           support = 1;
+       }
+    }
+
+    if (! support) {
+       fprintf(stderr, "Client uses unsupported protocol version %d.%d.\n",
+               maj, min);
+       vnc_client_error(vs);
+       return 0;
+    }
+
+    if (*vncpasswd == '\0') {
+       /* AuthType is None */
+       vnc_write_u32(vs, 1);
+       vnc_flush(vs);
+       vnc_read_when(vs, protocol_client_init, 1);
+    } else {
+       /* AuthType is VncAuth */
+       vnc_write_u32(vs, 2);
+
+       /* Challenge-Responce authentication */
+       /* Send Challenge */
+       make_challenge(challenge, AUTHCHALLENGESIZE);
+       vnc_write(vs, challenge, AUTHCHALLENGESIZE);
+       vnc_flush(vs);
+       vnc_read_when(vs, protocol_response, AUTHCHALLENGESIZE);
+    }
 
     return 0;
 }
@@ -1342,3 +1417,32 @@ int vnc_start_viewer(int port)
        return pid;
     }
 }
+
+unsigned int seed;
+
+static int make_challenge(char *random, int size)
+{
+ 
+    set_seed(&seed);
+    get_random(size, random);
+
+    return 0;
+}
+
+static void set_seed(unsigned int *seedp)
+{
+    *seedp += (unsigned int)(time(NULL)+getpid()+getpid()*987654+rand());
+    srand(*seedp);
+
+    return;
+}
+
+static void get_random(int len, unsigned char *buf)
+{
+    int i;
+
+    for (i=0; i<len; i++)
+       buf[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
+
+    return;
+}
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/vnc_keysym.h
--- a/tools/ioemu/vnc_keysym.h  Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/vnc_keysym.h  Thu Nov 09 15:37:17 2006 -0500
@@ -271,5 +271,15 @@ static name2keysym_t name2keysym[]={
 {"Num_Lock", 0xff7f},    /* XK_Num_Lock */
 {"Pause", 0xff13},       /* XK_Pause */
 {"Escape", 0xff1b},      /* XK_Escape */
+
+    /* localized keys */
+{"BackApostrophe", 0xff21},
+{"Muhenkan", 0xff22},
+{"Katakana", 0xff25},
+{"Zenkaku_Hankaku", 0xff29},
+{"Henkan_Mode_Real", 0xff23},
+{"Henkan_Mode_Ultra", 0xff3e},
+{"backslash_ja", 0xffa5},
+
 {0,0},
 };
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/ioemu/xenstore.c
--- a/tools/ioemu/xenstore.c    Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/ioemu/xenstore.c    Thu Nov 09 15:37:17 2006 -0500
@@ -213,3 +213,191 @@ void xenstore_write_vncport(int display)
     free(portstr);
     free(buf);
 }
+
+int xenstore_read_vncpasswd(int domid)
+{
+    extern char vncpasswd[64];
+    char *buf = NULL, *path, *uuid = NULL, *passwd = NULL;
+    unsigned int i, len, rc = 0;
+
+    if (xsh == NULL) {
+       return -1;
+    }
+
+    path = xs_get_domain_path(xsh, domid);
+    if (path == NULL) {
+       fprintf(logfile, "xs_get_domain_path() error. domid %d.\n", domid);
+       return -1;
+    }
+
+    pasprintf(&buf, "%s/vm", path);
+    uuid = xs_read(xsh, XBT_NULL, buf, &len);
+    if (uuid == NULL) {
+       fprintf(logfile, "xs_read(): uuid get error. %s.\n", buf);
+       free(path);
+       return -1;
+    }
+
+    pasprintf(&buf, "%s/vncpasswd", uuid);
+    passwd = xs_read(xsh, XBT_NULL, buf, &len);
+    if (passwd == NULL) {
+       fprintf(logfile, "xs_read(): vncpasswd get error. %s.\n", buf);
+       free(uuid);
+       free(path);
+       return rc;
+    }
+
+    for (i=0; i<len && i<63; i++) {
+       vncpasswd[i] = passwd[i];
+       passwd[i] = '\0';
+    }
+    vncpasswd[len] = '\0';
+    pasprintf(&buf, "%s/vncpasswd", uuid);
+    if (xs_write(xsh, XBT_NULL, buf, passwd, len) == 0) {
+       fprintf(logfile, "xs_write() vncpasswd failed.\n");
+       rc = -1;
+    }
+
+    free(passwd);
+    free(uuid);
+    free(path);
+
+    return rc;
+}
+
+
+/*
+ * get all device instances of a certain type
+ */
+char **xenstore_domain_get_devices(struct xs_handle *handle,
+                                   const char *devtype, unsigned int *num)
+{
+    char *path;
+    char *buf = NULL;
+    char **e  = NULL;
+
+    path = xs_get_domain_path(handle, domid);
+    if (path == NULL)
+        goto out;
+
+    if (pasprintf(&buf, "%s/device/%s", path,devtype) == -1)
+       goto out;
+
+    e = xs_directory(handle, XBT_NULL, buf, num);
+
+ out:
+    free(path);
+    free(buf);
+    return e;
+}
+
+/*
+ * Check whether a domain has devices of the given type
+ */
+int xenstore_domain_has_devtype(struct xs_handle *handle, const char *devtype)
+{
+    int rc = 0;
+    unsigned int num;
+    char **e = xenstore_domain_get_devices(handle, devtype, &num);
+    if (e)
+        rc = 1;
+    free(e);
+    return rc;
+}
+
+/*
+ * Function that creates a path to a variable of an instance of a
+ * certain device
+ */
+static char *get_device_variable_path(const char *devtype, const char *inst,
+                                      const char *var)
+{
+    char *buf = NULL;
+    if (pasprintf(&buf, "/local/domain/0/backend/%s/%d/%s/%s",
+                  devtype,
+                  domid,
+                  inst,
+                  var) == -1) {
+        free(buf);
+        buf = NULL;
+    }
+    return buf;
+}
+
+char *xenstore_backend_read_variable(struct xs_handle *handle,
+                                     const char *devtype, const char *inst,
+                                     const char *var)
+{
+    char *value = NULL;
+    char *buf = NULL;
+    unsigned int len;
+
+    buf = get_device_variable_path(devtype, inst, var);
+    if (NULL == buf)
+       goto out;
+
+    value = xs_read(handle, XBT_NULL, buf, &len);
+
+    free(buf);
+
+out:
+    return value;
+}
+
+/*
+  Read the hotplug status variable from the backend given the type
+  of device and its instance.
+*/
+char *xenstore_read_hotplug_status(struct xs_handle *handle,
+                                   const char *devtype, const char *inst)
+{
+    return xenstore_backend_read_variable(handle, devtype, inst,
+                                          "hotplug-status");
+}
+
+/*
+   Subscribe to the hotplug status of a device given the type of device and
+   its instance.
+   In case an error occurrs, a negative number is returned.
+ */
+int xenstore_subscribe_to_hotplug_status(struct xs_handle *handle,
+                                         const char *devtype,
+                                         const char *inst,
+                                         const char *token)
+{
+    int rc = 0;
+    char *path = get_device_variable_path(devtype, inst, "hotplug-status");
+
+    if (path == NULL)
+        return -1;
+
+    if (0 == xs_watch(handle, path, token))
+        rc = -2;
+
+    free(path);
+
+    return rc;
+}
+
+/*
+ * Unsubscribe from a subscription to the status of a hotplug variable of
+ * a device.
+ */
+int xenstore_unsubscribe_from_hotplug_status(struct xs_handle *handle,
+                                             const char *devtype,
+                                             const char *inst,
+                                             const char *token)
+{
+    int rc = 0;
+    char *path;
+    path = get_device_variable_path(devtype, inst, "hotplug-status");
+    if (path == NULL)
+        return -1;
+
+    if (0 == xs_unwatch(handle, path, token))
+        rc = -2;
+
+    free(path);
+
+    return rc;
+}
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/libxc/Makefile
--- a/tools/libxc/Makefile      Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/libxc/Makefile      Thu Nov 09 15:37:17 2006 -0500
@@ -31,7 +31,7 @@ GUEST_SRCS-$(CONFIG_HVM) += xc_hvm_build
 
 -include $(XEN_TARGET_ARCH)/Makefile
 
-CFLAGS   += -Werror
+CFLAGS   += -Werror -Wmissing-prototypes
 CFLAGS   += -fno-strict-aliasing
 CFLAGS   += $(INCLUDES) -I.
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/libxc/ia64/xc_ia64_hvm_build.c
--- a/tools/libxc/ia64/xc_ia64_hvm_build.c      Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/libxc/ia64/xc_ia64_hvm_build.c      Thu Nov 09 15:37:17 2006 -0500
@@ -551,8 +551,9 @@ setup_guest(int xc_handle, uint32_t dom,
             char *image, unsigned long image_size, uint32_t vcpus,
             unsigned int store_evtchn, unsigned long *store_mfn)
 {
-    unsigned long page_array[2];
+    unsigned long page_array[3];
     shared_iopage_t *sp;
+    void *ioreq_buffer_page;
     unsigned long dom_memsize = (memsize << 20);
     DECLARE_DOMCTL;
 
@@ -587,7 +588,7 @@ setup_guest(int xc_handle, uint32_t dom,
 
     /* Retrieve special pages like io, xenstore, etc. */
     if (xc_ia64_get_pfn_list(xc_handle, dom, page_array,
-                             IO_PAGE_START>>PAGE_SHIFT, 2) != 2) {
+                             IO_PAGE_START>>PAGE_SHIFT, 3) != 3) {
         PERROR("Could not get the page frame list");
         goto error_out;
     }
@@ -604,7 +605,10 @@ setup_guest(int xc_handle, uint32_t dom,
 
     memset(sp, 0, PAGE_SIZE);
     munmap(sp, PAGE_SIZE);
-
+    ioreq_buffer_page = xc_map_foreign_range(xc_handle, dom,
+                               PAGE_SIZE, PROT_READ|PROT_WRITE, 
page_array[2]); 
+    memset(ioreq_buffer_page,0,PAGE_SIZE);
+    munmap(ioreq_buffer_page, PAGE_SIZE);
     return 0;
 
 error_out:
@@ -614,7 +618,7 @@ int
 int
 xc_hvm_build(int xc_handle, uint32_t domid, int memsize,
              const char *image_name, unsigned int vcpus, unsigned int pae,
-             unsigned int acpi, unsigned int apic, unsigned int store_evtchn,
+             unsigned int acpi, unsigned int store_evtchn,
              unsigned long *store_mfn)
 {
     struct xen_domctl launch_domctl, domctl;
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/libxc/ia64/xc_ia64_linux_restore.c
--- a/tools/libxc/ia64/xc_ia64_linux_restore.c  Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/libxc/ia64/xc_ia64_linux_restore.c  Thu Nov 09 15:37:17 2006 -0500
@@ -224,6 +224,9 @@ xc_linux_restore(int xc_handle, int io_f
         ERROR("Error when reading ctxt");
         goto out;
     }
+
+    fprintf(stderr, "ip=%016lx, b0=%016lx\n", ctxt.user_regs.cr_iip,
+            ctxt.user_regs.b0);
 
     /* First to initialize.  */
     domctl.cmd = XEN_DOMCTL_setvcpucontext;
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/libxc/ia64/xc_ia64_linux_save.c
--- a/tools/libxc/ia64/xc_ia64_linux_save.c     Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/libxc/ia64/xc_ia64_linux_save.c     Thu Nov 09 15:37:17 2006 -0500
@@ -458,6 +458,9 @@ xc_linux_save(int xc_handle, int io_fd, 
         goto out;
     }
 
+    fprintf(stderr, "ip=%016lx, b0=%016lx\n", ctxt.user_regs.cr_iip,
+            ctxt.user_regs.b0);
+
     mem = xc_map_foreign_range(xc_handle, dom, PAGE_SIZE,
                                PROT_READ|PROT_WRITE, ctxt.privregs_pfn);
     if (mem == NULL) {
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/libxc/xc_acm.c
--- a/tools/libxc/xc_acm.c      Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/libxc/xc_acm.c      Thu Nov 09 15:37:17 2006 -0500
@@ -24,12 +24,12 @@ int xc_acm_op(int xc_handle, int cmd, vo
     hypercall.arg[0] = cmd;
     hypercall.arg[1] = (unsigned long) arg;
 
-    if (mlock(arg, arg_size) != 0) {
-        PERROR("xc_acm_op: arg mlock failed");
+    if (lock_pages(arg, arg_size) != 0) {
+        PERROR("xc_acm_op: arg lock failed");
         goto out;
     }
     ret = do_xen_hypercall(xc_handle, &hypercall);
-    safe_munlock(arg, arg_size);
+    unlock_pages(arg, arg_size);
  out:
     return ret;
 }
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/libxc/xc_core.c
--- a/tools/libxc/xc_core.c     Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/libxc/xc_core.c     Thu Nov 09 15:37:17 2006 -0500
@@ -62,7 +62,7 @@ xc_domain_dumpcore_via_callback(int xc_h
 
     nr_pages = info.nr_pages;
 
-    header.xch_magic = XC_CORE_MAGIC;
+    header.xch_magic = info.hvm ? XC_CORE_MAGIC_HVM : XC_CORE_MAGIC;
     header.xch_nr_vcpus = nr_vcpus;
     header.xch_nr_pages = nr_pages;
     header.xch_ctxt_offset = sizeof(struct xc_core_header);
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/libxc/xc_domain.c
--- a/tools/libxc/xc_domain.c   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/libxc/xc_domain.c   Thu Nov 09 15:37:17 2006 -0500
@@ -12,6 +12,7 @@ int xc_domain_create(int xc_handle,
 int xc_domain_create(int xc_handle,
                      uint32_t ssidref,
                      xen_domain_handle_t handle,
+                     uint32_t flags,
                      uint32_t *pdomid)
 {
     int err;
@@ -20,6 +21,7 @@ int xc_domain_create(int xc_handle,
     domctl.cmd = XEN_DOMCTL_createdomain;
     domctl.domain = (domid_t)*pdomid;
     domctl.u.createdomain.ssidref = ssidref;
+    domctl.u.createdomain.flags   = flags;
     memcpy(domctl.u.createdomain.handle, handle, sizeof(xen_domain_handle_t));
     if ( (err = do_domctl(xc_handle, &domctl)) != 0 )
         return err;
@@ -72,7 +74,7 @@ int xc_domain_shutdown(int xc_handle,
     arg.domain_id = domid;
     arg.reason = reason;
 
-    if ( mlock(&arg, sizeof(arg)) != 0 )
+    if ( lock_pages(&arg, sizeof(arg)) != 0 )
     {
         PERROR("Could not lock memory for Xen hypercall");
         goto out1;
@@ -80,7 +82,7 @@ int xc_domain_shutdown(int xc_handle,
 
     ret = do_xen_hypercall(xc_handle, &hypercall);
 
-    safe_munlock(&arg, sizeof(arg));
+    unlock_pages(&arg, sizeof(arg));
 
  out1:
     return ret;
@@ -103,7 +105,7 @@ int xc_vcpu_setaffinity(int xc_handle,
                          (uint8_t *)&cpumap);
     domctl.u.vcpuaffinity.cpumap.nr_cpus = sizeof(cpumap) * 8;
     
-    if ( mlock(&cpumap, sizeof(cpumap)) != 0 )
+    if ( lock_pages(&cpumap, sizeof(cpumap)) != 0 )
     {
         PERROR("Could not lock memory for Xen hypercall");
         goto out;
@@ -111,7 +113,7 @@ int xc_vcpu_setaffinity(int xc_handle,
 
     ret = do_domctl(xc_handle, &domctl);
 
-    safe_munlock(&cpumap, sizeof(cpumap));
+    unlock_pages(&cpumap, sizeof(cpumap));
 
  out:
     return ret;
@@ -134,7 +136,7 @@ int xc_vcpu_getaffinity(int xc_handle,
                          (uint8_t *)cpumap);
     domctl.u.vcpuaffinity.cpumap.nr_cpus = sizeof(*cpumap) * 8;
     
-    if ( mlock(cpumap, sizeof(*cpumap)) != 0 )
+    if ( lock_pages(cpumap, sizeof(*cpumap)) != 0 )
     {
         PERROR("Could not lock memory for Xen hypercall");
         goto out;
@@ -142,7 +144,7 @@ int xc_vcpu_getaffinity(int xc_handle,
 
     ret = do_domctl(xc_handle, &domctl);
 
-    safe_munlock(cpumap, sizeof(*cpumap));
+    unlock_pages(cpumap, sizeof(*cpumap));
 
  out:
     return ret;
@@ -169,15 +171,16 @@ int xc_domain_getinfo(int xc_handle,
             break;
         info->domid      = (uint16_t)domctl.domain;
 
-        info->dying    = !!(domctl.u.getdomaininfo.flags & DOMFLAGS_DYING);
-        info->shutdown = !!(domctl.u.getdomaininfo.flags & DOMFLAGS_SHUTDOWN);
-        info->paused   = !!(domctl.u.getdomaininfo.flags & DOMFLAGS_PAUSED);
-        info->blocked  = !!(domctl.u.getdomaininfo.flags & DOMFLAGS_BLOCKED);
-        info->running  = !!(domctl.u.getdomaininfo.flags & DOMFLAGS_RUNNING);
+        info->dying    = !!(domctl.u.getdomaininfo.flags&XEN_DOMINF_dying);
+        info->shutdown = !!(domctl.u.getdomaininfo.flags&XEN_DOMINF_shutdown);
+        info->paused   = !!(domctl.u.getdomaininfo.flags&XEN_DOMINF_paused);
+        info->blocked  = !!(domctl.u.getdomaininfo.flags&XEN_DOMINF_blocked);
+        info->running  = !!(domctl.u.getdomaininfo.flags&XEN_DOMINF_running);
+        info->hvm      = !!(domctl.u.getdomaininfo.flags&XEN_DOMINF_hvm_guest);
 
         info->shutdown_reason =
-            (domctl.u.getdomaininfo.flags>>DOMFLAGS_SHUTDOWNSHIFT) &
-            DOMFLAGS_SHUTDOWNMASK;
+            (domctl.u.getdomaininfo.flags>>XEN_DOMINF_shutdownshift) &
+            XEN_DOMINF_shutdownmask;
 
         if ( info->shutdown && (info->shutdown_reason == SHUTDOWN_crash) )
         {
@@ -200,7 +203,8 @@ int xc_domain_getinfo(int xc_handle,
         info++;
     }
 
-    if( !nr_doms ) return rc;
+    if ( nr_doms == 0 )
+        return rc;
 
     return nr_doms;
 }
@@ -213,7 +217,7 @@ int xc_domain_getinfolist(int xc_handle,
     int ret = 0;
     DECLARE_SYSCTL;
 
-    if ( mlock(info, max_domains*sizeof(xc_domaininfo_t)) != 0 )
+    if ( lock_pages(info, max_domains*sizeof(xc_domaininfo_t)) != 0 )
         return -1;
 
     sysctl.cmd = XEN_SYSCTL_getdomaininfolist;
@@ -226,8 +230,7 @@ int xc_domain_getinfolist(int xc_handle,
     else
         ret = sysctl.u.getdomaininfolist.num_domains;
 
-    if ( munlock(info, max_domains*sizeof(xc_domaininfo_t)) != 0 )
-        ret = -1;
+    unlock_pages(info, max_domains*sizeof(xc_domaininfo_t));
 
     return ret;
 }
@@ -245,12 +248,12 @@ int xc_vcpu_getcontext(int xc_handle,
     domctl.u.vcpucontext.vcpu   = (uint16_t)vcpu;
     set_xen_guest_handle(domctl.u.vcpucontext.ctxt, ctxt);
 
-    if ( (rc = mlock(ctxt, sizeof(*ctxt))) != 0 )
+    if ( (rc = lock_pages(ctxt, sizeof(*ctxt))) != 0 )
         return rc;
 
     rc = do_domctl(xc_handle, &domctl);
 
-    safe_munlock(ctxt, sizeof(*ctxt));
+    unlock_pages(ctxt, sizeof(*ctxt));
 
     return rc;
 }
@@ -346,7 +349,7 @@ int xc_domain_memory_increase_reservatio
     if ( err == nr_extents )
         return 0;
 
-    if ( err > 0 )
+    if ( err >= 0 )
     {
         DPRINTF("Failed allocation for dom %d: "
                 "%ld pages order %d addr_bits %d\n",
@@ -385,11 +388,11 @@ int xc_domain_memory_decrease_reservatio
     if ( err == nr_extents )
         return 0;
 
-    if ( err > 0 )
+    if ( err >= 0 )
     {
         DPRINTF("Failed deallocation for dom %d: %ld pages order %d\n",
                 domid, nr_extents, extent_order);
-        errno = EBUSY;
+        errno = EINVAL;
         err = -1;
     }
 
@@ -416,7 +419,7 @@ int xc_domain_memory_populate_physmap(in
     if ( err == nr_extents )
         return 0;
 
-    if ( err > 0 )
+    if ( err >= 0 )
     {
         DPRINTF("Failed allocation for dom %d: %ld pages order %d\n",
                 domid, nr_extents, extent_order);
@@ -512,12 +515,12 @@ int xc_vcpu_setcontext(int xc_handle,
     domctl.u.vcpucontext.vcpu = vcpu;
     set_xen_guest_handle(domctl.u.vcpucontext.ctxt, ctxt);
 
-    if ( (rc = mlock(ctxt, sizeof(*ctxt))) != 0 )
+    if ( (rc = lock_pages(ctxt, sizeof(*ctxt))) != 0 )
         return rc;
 
     rc = do_domctl(xc_handle, &domctl);
 
-    safe_munlock(ctxt, sizeof(*ctxt));
+    unlock_pages(ctxt, sizeof(*ctxt));
 
     return rc;
 
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/libxc/xc_evtchn.c
--- a/tools/libxc/xc_evtchn.c   Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/libxc/xc_evtchn.c   Thu Nov 09 15:37:17 2006 -0500
@@ -18,16 +18,16 @@ static int do_evtchn_op(int xc_handle, i
     hypercall.arg[0] = cmd;
     hypercall.arg[1] = (unsigned long)arg;
 
-    if ( mlock(arg, arg_size) != 0 )
+    if ( lock_pages(arg, arg_size) != 0 )
     {
-        PERROR("do_evtchn_op: arg mlock failed");
+        PERROR("do_evtchn_op: arg lock failed");
         goto out;
     }
 
     if ((ret = do_xen_hypercall(xc_handle, &hypercall)) < 0)
         ERROR("do_evtchn_op: HYPERVISOR_event_channel_op failed: %d", ret);
 
-    safe_munlock(arg, arg_size);
+    unlock_pages(arg, arg_size);
  out:
     return ret;
 }
diff -r b30cb72ed5e2 -r 4d4f0d52c193 tools/libxc/xc_hvm_build.c
--- a/tools/libxc/xc_hvm_build.c        Fri Nov 03 16:53:17 2006 -0500
+++ b/tools/libxc/xc_hvm_build.c        Thu Nov 09 15:37:17 2006 -0500
@@ -12,12 +12,10 @@
 #include <unistd.h>
 #include <zlib.h>
 #include <xen/hvm/hvm_info_table.h>
-#include <xen/hvm/ioreq.h>
 #include <xen/hvm/params.h>
 #include <xen/hvm/e820.h>
 
 #define HVM_LOADER_ENTR_ADDR  0x00100000
-
 static int
 parseelfimage(
     char *elfbase, unsigned long elfsize, struct domain_setup_info *dsi);
@@ -39,13 +37,13 @@ static void xc_set_hvm_param(int handle,
     arg.domid = dom;
     arg.index = param;
     arg.value = value;
-    if ( mlock(&arg, sizeof(arg)) != 0 )
+    if ( lock_pages(&arg, sizeof(arg)) != 0 )
     {
         PERROR("Could not lock memory for set parameter");
         return;
     }
     rc = do_xen_hypercall(handle, &hypercall);
-    safe_munlock(&arg, sizeof(arg));
+    unlock_pages(&arg, sizeof(arg));
     if (rc < 0)
         PERROR("set HVM parameter failed (%d)", rc);
 }
@@ -58,11 +56,12 @@ static void build_e820map(void *e820_pag
     unsigned char nr_map = 0;
 
     /*
-     * physical address space from HVM_BELOW_4G_RAM_END to 4G is reserved
+     * Physical address space from HVM_BELOW_4G_RAM_END to 4G is reserved
      * for PCI devices MMIO. So if HVM has more than HVM_BELOW_4G_RAM_END
      * RAM, memory beyond HVM_BELOW_4G_RAM_END will go to 4G above.
      */
-    if ( mem_size > HVM_BELOW_4G_RAM_END ) {
+    if ( mem_size > HVM_BELOW_4G_RAM_END )
+    {
         extra_mem_size = mem_size - HVM_BELOW_4G_RAM_END;
         mem_size = HVM_BELOW_4G_RAM_END;
     }
@@ -77,9 +76,9 @@ static void build_e820map(void *e820_pag
     e820entry[nr_map].type = E820_RESERVED;
     nr_map++;
 
-    e820entry[nr_map].addr = 0xA0000;
-    e820entry[nr_map].size = 0x20000;
-    e820entry[nr_map].type = E820_IO;
+    e820entry[nr_map].addr = 0xEA000;
+    e820entry[nr_map].size = 0x02000;
+    e820entry[nr_map].type = E820_ACPI;
     nr_map++;
 
     e820entry[nr_map].addr = 0xF0000;
@@ -87,81 +86,14 @@ static void build_e820map(void *e820_pag
     e820entry[nr_map].type = E820_RESERVED;
     nr_map++;
 
-/* ACPI data: 10 pages. */
-#define ACPI_DATA_PAGES     10
-/* ACPI NVS: 3 pages.   */
-#define ACPI_NVS_PAGES      3
-/* buffered io page.    */
-#define BUFFERED_IO_PAGES   1
-/* xenstore page.       */
-#define XENSTORE_PAGES      1
-/* shared io page.      */
-#define SHARED_IO_PAGES     1
-/* totally 16 static pages are reserved in E820 table */
-
-    /* Most of the ram goes here */
+    /* Low RAM goes here. Remove 3 pages for ioreq, bufioreq, and xenstore. */
     e820entry[nr_map].addr = 0x100000;
-    e820entry[nr_map].size = mem_size - 0x100000 - PAGE_SIZE *
-                                                (ACPI_DATA_PAGES +
-                                                 ACPI_NVS_PAGES +
-                                                 BUFFERED_IO_PAGES +
-                                                 XENSTORE_PAGES +
-                                                 SHARED_IO_PAGES);
+    e820entry[nr_map].size = mem_size - 0x100000 - PAGE_SIZE * 3;
     e820entry[nr_map].type = E820_RAM;
     nr_map++;
 
-    /* Statically allocated special pages */
-
-    /* For ACPI data */
-    e820entry[nr_map].addr = mem_size - PAGE_SIZE *
-                                        (ACPI_DATA_PAGES +
-                                         ACPI_NVS_PAGES +
-                                         BUFFERED_IO_PAGES +
-                                         XENSTORE_PAGES +
-                                         SHARED_IO_PAGES);
-    e820entry[nr_map].size = PAGE_SIZE * ACPI_DATA_PAGES;
-    e820entry[nr_map].type = E820_ACPI;
-    nr_map++;
-
-    /* For ACPI NVS */
-    e820entry[nr_map].addr = mem_size - PAGE_SIZE *
-                                        (ACPI_NVS_PAGES +
-                                         BUFFERED_IO_PAGES +
-                                         XENSTORE_PAGES +
-                                         SHARED_IO_PAGES);
-    e820entry[nr_map].size = PAGE_SIZE * ACPI_NVS_PAGES;
-    e820entry[nr_map].type = E820_NVS;
-    nr_map++;
-
-    /* For buffered IO requests */
-    e820entry[nr_map].addr = mem_size - PAGE_SIZE *
-                                        (BUFFERED_IO_PAGES +
-                                         XENSTORE_PAGES +
-                                         SHARED_IO_PAGES);
-    e820entry[nr_map].size = PAGE_SIZE * BUFFERED_IO_PAGES;
-    e820entry[nr_map].type = E820_BUFFERED_IO;
-    nr_map++;
-
-    /* For xenstore */
-    e820entry[nr_map].addr = mem_size - PAGE_SIZE *
-                                        (XENSTORE_PAGES +
-                                         SHARED_IO_PAGES);
-    e820entry[nr_map].size = PAGE_SIZE * XENSTORE_PAGES;
-    e820entry[nr_map].type = E820_XENSTORE;
-    nr_map++;
-
-    /* Shared ioreq_t page */
-    e820entry[nr_map].addr = mem_size - PAGE_SIZE * SHARED_IO_PAGES;
-    e820entry[nr_map].size = PAGE_SIZE * SHARED_IO_PAGES;
-    e820entry[nr_map].type = E820_SHARED_PAGE;
-    nr_map++;
-
-    e820entry[nr_map].addr = 0xFEC00000;
-    e820entry[nr_map].size = 0x1400000;
-    e820entry[nr_map].type = E820_IO;
-    nr_map++;
-
-    if ( extra_mem_size ) {
+    if ( extra_mem_size )
+    {
         e820entry[nr_map].addr = (1ULL << 32);
         e820entry[nr_map].size = extra_mem_size;
         e820entry[nr_map].type = E820_RAM;
@@ -220,28 +152,22 @@ static int setup_guest(int xc_handle,
 static int setup_guest(int xc_handle,
                        uint32_t dom, int memsize,
                        char *image, unsigned long image_size,
-                       unsigned long nr_pages,
                        vcpu_guest_context_t *ctxt,
                        unsigned long shared_info_frame,
                        unsigned int vcpus,
                        unsigned int pae,
                        unsigned int acpi,
-                       unsigned int apic,
                        unsigned int store_evtchn,
                        unsigned long *store_mfn)
 {
     xen_pfn_t *page_array = NULL;
-    unsigned long count, i;
-    unsigned long long ptr;
-    xc_mmu_t *mmu = NULL;
-
+    unsigned long i, nr_pages = (unsigned long)memsize << (20 - PAGE_SHIFT);
+    unsigned long shared_page_nr;
     shared_info_t *shared_info;
     void *e820_page;
-
     struct domain_setup_info dsi;
     uint64_t v_end;
-
-    unsigned long shared_page_nr;
+    int rc;
 
     memset(&dsi, 0, sizeof(struct domain_setup_info));
 
@@ -254,7 +180,6 @@ static int setup_guest(int xc_handle,
         goto error_out;
     }
 
-    /* memsize is in megabytes */
     v_end = (unsigned long long)memsize << 20;
 
     IPRINTF("VIRTUAL MEMORY ARRANGEMENT:\n"
@@ -279,40 +204,33 @@ static int setup_guest(int xc_handle,
         goto error_out;
     }
 
-    if ( xc_get_pfn_list(xc_handle, dom, page_array, nr_pages) != nr_pages )
-    {
-        PERROR("Could not get the page frame list.\n");
+    for ( i = 0; i < nr_pages; i++ )
+        page_array[i] = i;
+    for ( i = HVM_BELOW_4G_RAM_END >> PAGE_SHIFT; i < nr_pages; i++ )
+        page_array[i] += HVM_BELOW_4G_MMIO_LENGTH >> PAGE_SHIFT;
+
+    /* Allocate memory for HVM guest, skipping VGA hole 0xA0000-0xC0000. */
+    rc = xc_domain_memory_populate_physmap(
+        xc_handle, dom, (nr_pages > 0xa0) ? 0xa0 : nr_pages,
+        0, 0, &page_array[0x00]);
+    if ( (rc == 0) && (nr_pages > 0xc0) )
+        rc = xc_domain_memory_populate_physmap(
+            xc_handle, dom, nr_pages - 0xc0, 0, 0, &page_array[0xc0]);
+    if ( rc != 0 )
+    {
+        PERROR("Could not allocate memory for HVM guest.\n");
+        goto error_out;
+    }
+
+    if ( xc_domain_translate_gpfn_list(xc_handle, dom, nr_pages,
+                                       page_array, page_array) )
+    {
+        PERROR("Could not translate addresses of HVM guest.\n");
         goto error_out;
     }
 
     loadelfimage(image, xc_handle, dom, page_array, &dsi);
 
-    if ( (mmu = xc_init_mmu_updates(xc_handle, dom)) == NULL )
-        goto error_out;
-
-    /* Write the machine->phys table entries. */
-    for ( count = 0; count < nr_pages; count++ )
-    {
-        unsigned long gpfn_count_skip;
-
-        ptr = (unsigned long long)page_array[count] << PAGE_SHIFT;
-
-        gpfn_count_skip = 0;
-
-        /*
-         * physical address space from HVM_BELOW_4G_RAM_END to 4G is reserved
-         * for PCI devices MMIO. So if HVM has more than HVM_BELOW_4G_RAM_END
-         * RAM, memory beyond HVM_BELOW_4G_RAM_END will go to 4G above.
-         */
-        if ( count >= (HVM_BELOW_4G_RAM_END >> PAGE_SHIFT) )
-            gpfn_count_skip = HVM_BELOW_4G_MMIO_LENGTH >> PAGE_SHIFT;
-
-        if ( xc_add_mmu_update(xc_handle, mmu,
-                               ptr | MMU_MACHPHYS_UPDATE,
-                               count + gpfn_count_skip) )
-            goto error_out;
-    }
-
     if ( set_hvm_info(xc_handle, dom, page_array, vcpus, acpi) )
     {
         ERROR("Couldn't set hvm info for HVM guest.\n");
@@ -320,7 +238,6 @@ static int setup_guest(int xc_handle,
     }
 
     xc_set_hvm_param(xc_handle, dom, HVM_PARAM_PAE_ENABLED, pae);
-    xc_set_hvm_param(xc_handle, dom, HVM_PARAM_APIC_ENABLED, apic);
 
     if ( (e820_page = xc_map_foreign_range(
               xc_handle, dom, PAGE_SIZE, PROT_READ | PROT_WRITE,
@@ -339,6 +256,8 @@ static int setup_guest(int xc_handle,
     /* Mask all upcalls... */
     for ( i = 0; i < MAX_VIRT_CPUS; i++ )
         shared_info->vcpu_info[i].evtchn_upcall_mask = 1;
+    memset(&shared_info->evtchn_mask[0], 0xff,
+           sizeof(shared_info->evtchn_mask));
     munmap(shared_info, PAGE_SIZE);
 
     if ( v_end > HVM_BELOW_4G_RAM_END )
@@ -346,39 +265,25 @@ static int setup_guest(int xc_handle,
     else
         shared_page_nr = (v_end >> PAGE_SHIFT) - 1;
 
+    /* Paranoia: clean pages. */
+    if ( xc_clear_domain_page(xc_handle, dom, page_array[shared_page_nr]) ||
+         xc_clear_domain_page(xc_handle, dom, page_array[shared_page_nr-1]) ||
+         xc_clear_domain_page(xc_handle, dom, page_array[shared_page_nr-2]) )
+        goto error_out;
+
     *store_mfn = page_array[shared_page_nr - 1];
-
-    xc_set_hvm_param(xc_handle, dom, HVM_PARAM_STORE_PFN, shared_page_nr - 1);
+    xc_set_hvm_param(xc_handle, dom, HVM_PARAM_STORE_PFN, shared_page_nr-1);
     xc_set_hvm_param(xc_handle, dom, HVM_PARAM_STORE_EVTCHN, store_evtchn);
-
-    /* Paranoia */
-    /* clean the shared IO requests page */
-    if ( xc_clear_domain_page(xc_handle, dom, page_array[shared_page_nr]) )
-        goto error_out;
-
-    /* clean the buffered IO requests page */
-    if ( xc_clear_domain_page(xc_handle, dom, page_array[shared_page_nr - 2]) )
-        goto error_out;
-
-    if ( xc_clear_domain_page(xc_handle, dom, *store_mfn) )
-        goto error_out;
-
-    /* Send the page update requests down to the hypervisor. */
-    if ( xc_finish_mmu_updates(xc_handle, mmu) )
-        goto error_out;
-
-    free(mmu);
+    xc_set_hvm_param(xc_handle, dom, HVM_PARAM_BUFIOREQ_PFN, shared_page_nr-2);
+    xc_set_hvm_param(xc_handle, dom, HVM_PARAM_IOREQ_PFN, shared_page_nr);

_______________________________________________
Xen-ppc-devel mailing list
Xen-ppc-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-ppc-devel

<Prev in Thread] Current Thread [Next in Thread>
  • [XenPPC] [xenppc-unstable] [XEN][POWERPC] Merge: also includes support for recursive spinlocks, Xen patchbot-xenppc-unstable <=