Xen 
 
Home About Xen.org Xen Xen Summit Wiki Mailing List Bug Tracker Xen Downloads
 
   
 

xen-changelog

[Xen-changelog] [xen-unstable] merge with xen-unstable.hg

To: xen-changelog@xxxxxxxxxxxxxxxxxxx
Subject: [Xen-changelog] [xen-unstable] merge with xen-unstable.hg
From: Xen patchbot-unstable <patchbot-unstable@xxxxxxxxxxxxxxxxxxx>
Date: Thu, 26 Oct 2006 12:10:28 +0000
Delivery-date: Thu, 26 Oct 2006 05:12:22 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxx
List-help: <mailto:xen-changelog-request@lists.xensource.com?subject=help>
List-id: BK change log <xen-changelog.lists.xensource.com>
List-post: <mailto:xen-changelog@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-changelog>, <mailto:xen-changelog-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-changelog>, <mailto:xen-changelog-request@lists.xensource.com?subject=unsubscribe>
Reply-to: xen-devel@xxxxxxxxxxxxxxxxxxx
Sender: xen-changelog-bounces@xxxxxxxxxxxxxxxxxxx
# HG changeset patch
# User awilliam@xxxxxxxxxxx
# Node ID 2bfd19fc1b79c6a6712c99f875f1fbf883af3f35
# Parent  914c44d10c8d1dc0fd279f6aa1f9ab7d8a65cfcb
# Parent  02311d8aba867e2107cdc0c6448c55556def97ad
merge with xen-unstable.hg
---
 tools/debugger/pdb/Domain.ml                           |   61 
 tools/debugger/pdb/Domain.mli                          |   39 
 tools/debugger/pdb/Intel.ml                            |   66 
 tools/debugger/pdb/Makefile                            |   57 
 tools/debugger/pdb/OCamlMakefile                       | 1149 -----------------
 tools/debugger/pdb/PDB.ml                              |  342 -----
 tools/debugger/pdb/Process.ml                          |   79 -
 tools/debugger/pdb/Process.mli                         |   41 
 tools/debugger/pdb/Util.ml                             |  165 --
 tools/debugger/pdb/Xen_domain.ml                       |   43 
 tools/debugger/pdb/Xen_domain.mli                      |   25 
 tools/debugger/pdb/debugger.ml                         |  372 -----
 tools/debugger/pdb/evtchn.ml                           |   40 
 tools/debugger/pdb/evtchn.mli                          |   19 
 tools/debugger/pdb/linux-2.6-module/Makefile           |   21 
 tools/debugger/pdb/linux-2.6-module/debug.c            |  851 ------------
 tools/debugger/pdb/linux-2.6-module/module.c           |  337 ----
 tools/debugger/pdb/linux-2.6-module/pdb_debug.h        |   47 
 tools/debugger/pdb/linux-2.6-module/pdb_module.h       |  142 --
 tools/debugger/pdb/linux-2.6-patches/Makefile          |   11 
 tools/debugger/pdb/linux-2.6-patches/i386_ksyms.patch  |   18 
 tools/debugger/pdb/linux-2.6-patches/kdebug.patch      |   10 
 tools/debugger/pdb/linux-2.6-patches/makefile.patch    |   10 
 tools/debugger/pdb/linux-2.6-patches/ptrace.patch      |   10 
 tools/debugger/pdb/linux-2.6-patches/traps.patch       |   19 
 tools/debugger/pdb/pdb_caml_domain.c                   |  527 -------
 tools/debugger/pdb/pdb_caml_evtchn.c                   |  186 --
 tools/debugger/pdb/pdb_caml_process.c                  |  587 --------
 tools/debugger/pdb/pdb_caml_xc.c                       |  170 --
 tools/debugger/pdb/pdb_caml_xcs.c                      |  307 ----
 tools/debugger/pdb/pdb_caml_xen.h                      |   39 
 tools/debugger/pdb/pdb_xen.c                           |   75 -
 tools/debugger/pdb/readme                              |   96 -
 tools/debugger/pdb/server.ml                           |  241 ---
 tools/debugger/pdb/xcs.ml                              |   85 -
 tools/debugger/pdb/xcs.mli                             |   13 
 linux-2.6-xen-sparse/drivers/xen/blkfront/blkfront.c   |   10 
 linux-2.6-xen-sparse/drivers/xen/blktap/blktap.c       |  260 +--
 linux-2.6-xen-sparse/drivers/xen/blktap/xenbus.c       |    1 
 linux-2.6-xen-sparse/drivers/xen/evtchn/evtchn.c       |    3 
 linux-2.6-xen-sparse/drivers/xen/netback/loopback.c    |   64 
 linux-2.6-xen-sparse/drivers/xen/netback/netback.c     |    2 
 linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_probe.c |   14 
 linux-2.6-xen-sparse/include/xen/public/evtchn.h       |    3 
 tools/blktap/drivers/Makefile                          |    2 
 tools/blktap/drivers/blktapctrl.c                      |   22 
 tools/blktap/drivers/tapdisk.c                         |    9 
 tools/blktap/lib/blktaplib.h                           |    3 
 tools/examples/init.d/xendomains                       |    8 
 tools/examples/xen-backend.rules                       |    1 
 tools/firmware/vmxassist/vm86.c                        |   34 
 tools/ioemu/target-i386-dm/helper2.c                   |    4 
 tools/libxc/xc_linux.c                                 |   82 +
 tools/libxc/xenctrl.h                                  |   10 
 tools/pygrub/src/pygrub                                |   20 
 tools/python/xen/util/blkif.py                         |    2 
 tools/python/xen/xend/image.py                         |    3 
 tools/python/xen/xm/addlabel.py                        |   72 -
 tools/python/xen/xm/cfgbootpolicy.py                   |   73 -
 tools/python/xen/xm/create.py                          |    2 
 tools/python/xen/xm/dry-run.py                         |   41 
 tools/python/xen/xm/dumppolicy.py                      |   20 
 tools/python/xen/xm/getlabel.py                        |   29 
 tools/python/xen/xm/loadpolicy.py                      |   17 
 tools/python/xen/xm/main.py                            |   30 
 tools/python/xen/xm/makepolicy.py                      |   15 
 tools/python/xen/xm/resources.py                       |   21 
 tools/python/xen/xm/rmlabel.py                         |   31 
 tools/xm-test/tests/vtpm/vtpm_utils.py                 |    6 
 xen/arch/ia64/Makefile                                 |   15 
 xen/arch/powerpc/Makefile                              |    3 
 xen/arch/x86/Makefile                                  |   13 
 xen/arch/x86/domain.c                                  |   11 
 xen/arch/x86/hvm/hvm.c                                 |   88 -
 xen/arch/x86/hvm/i8259.c                               |   66 
 xen/arch/x86/hvm/instrlen.c                            |   72 -
 xen/arch/x86/hvm/intercept.c                           |   16 
 xen/arch/x86/hvm/io.c                                  |    7 
 xen/arch/x86/hvm/platform.c                            |   14 
 xen/arch/x86/hvm/svm/emulate.c                         |    6 
 xen/arch/x86/hvm/svm/intr.c                            |   21 
 xen/arch/x86/hvm/svm/svm.c                             |  198 +-
 xen/arch/x86/hvm/svm/x86_32/exits.S                    |    3 
 xen/arch/x86/hvm/svm/x86_64/exits.S                    |    1 
 xen/arch/x86/hvm/vioapic.c                             |   22 
 xen/arch/x86/hvm/vmx/io.c                              |   14 
 xen/arch/x86/hvm/vmx/vmx.c                             |  131 +
 xen/arch/x86/hvm/vmx/x86_32/exits.S                    |    3 
 xen/arch/x86/hvm/vmx/x86_64/exits.S                    |    1 
 xen/arch/x86/mm.c                                      |  206 +--
 xen/arch/x86/mm/shadow/common.c                        |  165 +-
 xen/arch/x86/mm/shadow/multi.c                         |  433 ++++--
 xen/arch/x86/mm/shadow/multi.h                         |    7 
 xen/arch/x86/mm/shadow/private.h                       |   49 
 xen/arch/x86/mm/shadow/types.h                         |   31 
 xen/arch/x86/smp.c                                     |    2 
 xen/arch/x86/traps.c                                   |    2 
 xen/arch/x86/x86_32/entry.S                            |   18 
 xen/arch/x86/x86_emulate.c                             |   37 
 xen/common/gdbstub.c                                   |   30 
 xen/common/symbols-dummy.c                             |   16 
 xen/common/symbols.c                                   |   13 
 xen/include/asm-x86/debugger.h                         |   43 
 xen/include/asm-x86/domain.h                           |    2 
 xen/include/asm-x86/guest_access.h                     |   20 
 xen/include/asm-x86/hvm/io.h                           |    1 
 xen/include/asm-x86/hvm/support.h                      |   22 
 xen/include/asm-x86/hvm/vioapic.h                      |    2 
 xen/include/asm-x86/hvm/vpic.h                         |    8 
 xen/include/asm-x86/mm.h                               |    2 
 xen/include/asm-x86/shadow.h                           |   87 +
 111 files changed, 1630 insertions(+), 7485 deletions(-)

diff -r 914c44d10c8d -r 2bfd19fc1b79 
linux-2.6-xen-sparse/drivers/xen/blkfront/blkfront.c
--- a/linux-2.6-xen-sparse/drivers/xen/blkfront/blkfront.c      Sun Oct 01 
11:39:41 2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/blkfront/blkfront.c      Sun Oct 01 
19:10:18 2006 -0600
@@ -273,7 +273,7 @@ static void backend_changed(struct xenbu
                        xenbus_dev_fatal(dev, -ENODEV, "bdget failed");
 
                down(&bd->bd_sem);
-               if (info->users > 0 && system_state == SYSTEM_RUNNING)
+               if (info->users > 0)
                        xenbus_dev_error(dev, -EBUSY,
                                         "Device in use; refusing to close");
                else
@@ -355,8 +355,10 @@ static void blkfront_closing(struct xenb
        blk_stop_queue(info->rq);
        /* No more gnttab callback work. */
        gnttab_cancel_free_callback(&info->callback);
+       spin_unlock_irqrestore(&blkif_io_lock, flags);
+
+       /* Flush gnttab callback work. Must be done with no locks held. */
        flush_scheduled_work();
-       spin_unlock_irqrestore(&blkif_io_lock, flags);
 
        xlvbd_del(info);
 
@@ -714,8 +716,10 @@ static void blkif_free(struct blkfront_i
                blk_stop_queue(info->rq);
        /* No more gnttab callback work. */
        gnttab_cancel_free_callback(&info->callback);
+       spin_unlock_irq(&blkif_io_lock);
+
+       /* Flush gnttab callback work. Must be done with no locks held. */
        flush_scheduled_work();
-       spin_unlock_irq(&blkif_io_lock);
 
        /* Free resources associated with old device channel. */
        if (info->ring_ref != GRANT_INVALID_REF) {
diff -r 914c44d10c8d -r 2bfd19fc1b79 
linux-2.6-xen-sparse/drivers/xen/blktap/blktap.c
--- a/linux-2.6-xen-sparse/drivers/xen/blktap/blktap.c  Sun Oct 01 11:39:41 
2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/blktap/blktap.c  Sun Oct 01 19:10:18 
2006 -0600
@@ -44,7 +44,6 @@
 #include <linux/kernel.h>
 #include <linux/fs.h>
 #include <linux/mm.h>
-#include <linux/miscdevice.h>
 #include <linux/errno.h>
 #include <linux/major.h>
 #include <linux/gfp.h>
@@ -54,6 +53,30 @@
 
 #define MAX_TAP_DEV 100     /*the maximum number of tapdisk ring devices    */
 #define MAX_DEV_NAME 100    /*the max tapdisk ring device name e.g. blktap0 */
+
+
+struct class *xen_class;
+EXPORT_SYMBOL_GPL(xen_class);
+
+/*
+ * Setup the xen class.  This should probably go in another file, but
+ * since blktap is the only user of it so far, it gets to keep it.
+ */
+int setup_xen_class(void)
+{
+       int ret;
+
+       if (xen_class)
+               return 0;
+
+       xen_class = class_create(THIS_MODULE, "xen");
+       if ((ret = IS_ERR(xen_class))) {
+               xen_class = NULL;
+               return ret;
+       }
+
+       return 0;
+}
 
 /*
  * The maximum number of requests that can be outstanding at any time
@@ -100,19 +123,14 @@ typedef struct tap_blkif {
        unsigned long *idx_map;       /*Record the user ring id to kern 
                                        [req id, idx] tuple                  */
        blkif_t *blkif;               /*Associate blkif with tapdev          */
+       int sysfs_set;                /*Set if it has a class device.        */
 } tap_blkif_t;
-
-/*Private data struct associated with the inode*/
-typedef struct private_info {
-       int idx;
-} private_info_t;
 
 /*Data struct handed back to userspace for tapdisk device to VBD mapping*/
 typedef struct domid_translate {
        unsigned short domid;
        unsigned short busid;
 } domid_translate_t ;
-
 
 static domid_translate_t  translate_domid[MAX_TAP_DEV];
 static tap_blkif_t *tapfds[MAX_TAP_DEV];
@@ -200,14 +218,12 @@ static struct grant_handle_pair
     + (_i)])
 
 
-static int blktap_read_ufe_ring(int idx); /*local prototypes*/
-
-#define BLKTAP_MINOR 0  /*/dev/xen/blktap resides at device number
-                         major=254, minor numbers begin at 0            */ 
-#define BLKTAP_DEV_MAJOR 254         /* TODO: Make major number dynamic  *
-                                      * and create devices in the kernel *
-                                     */
+static int blktap_read_ufe_ring(tap_blkif_t *info); /*local prototypes*/
+
+#define BLKTAP_MINOR 0  /*/dev/xen/blktap has a dynamic major */
 #define BLKTAP_DEV_DIR  "/dev/xen"
+
+static int blktap_major;
 
 /* blktap IOCTLs: */
 #define BLKTAP_IOCTL_KICK_FE         1
@@ -264,7 +280,8 @@ static inline int GET_NEXT_REQ(unsigned 
 {
        int i;
        for (i = 0; i < MAX_PENDING_REQS; i++)
-               if (idx_map[i] == INVALID_REQ) return i;
+               if (idx_map[i] == INVALID_REQ)
+                       return i;
 
        return INVALID_REQ;
 }
@@ -311,8 +328,6 @@ static int blktap_ioctl(struct inode *in
                         unsigned int cmd, unsigned long arg);
 static unsigned int blktap_poll(struct file *file, poll_table *wait);
 
-struct miscdevice *set_misc(int minor, char *name, int dev);
-
 static struct file_operations blktap_fops = {
        .owner   = THIS_MODULE,
        .poll    = blktap_poll,
@@ -344,6 +359,16 @@ static int get_next_free_dev(void)
        
 done:
        spin_unlock_irqrestore(&pending_free_lock, flags);
+
+       /*
+        * We are protected by having the dev_pending set.
+        */
+       if (!tapfds[i]->sysfs_set && xen_class) {
+               class_device_create(xen_class, NULL,
+                                   MKDEV(blktap_major, ret), NULL,
+                                   "blktap%d", ret);
+               tapfds[i]->sysfs_set = 1;
+       }
        return ret;
 }
 
@@ -369,9 +394,8 @@ void signal_tapdisk(int idx)
        info = tapfds[idx];
        if ( (idx > 0) && (idx < MAX_TAP_DEV) && (info->pid > 0) ) {
                ptask = find_task_by_pid(info->pid);
-               if (ptask) { 
+               if (ptask)
                        info->status = CLEANSHUTDOWN;
-               }
        }
        info->blkif = NULL;
        return;
@@ -382,7 +406,6 @@ static int blktap_open(struct inode *ino
        blkif_sring_t *sring;
        int idx = iminor(inode) - BLKTAP_MINOR;
        tap_blkif_t *info;
-       private_info_t *prv;
        int i;
        
        if (tapfds[idx] == NULL) {
@@ -410,9 +433,7 @@ static int blktap_open(struct inode *ino
        SHARED_RING_INIT(sring);
        FRONT_RING_INIT(&info->ufe_ring, sring, PAGE_SIZE);
        
-       prv = kzalloc(sizeof(private_info_t),GFP_KERNEL);
-       prv->idx = idx;
-       filp->private_data = prv;
+       filp->private_data = info;
        info->vma = NULL;
 
        info->idx_map = kmalloc(sizeof(unsigned long) * MAX_PENDING_REQS, 
@@ -433,17 +454,16 @@ static int blktap_open(struct inode *ino
 
 static int blktap_release(struct inode *inode, struct file *filp)
 {
-       int idx = iminor(inode) - BLKTAP_MINOR;
-       tap_blkif_t *info;
-       
-       if (tapfds[idx] == NULL) {
+       tap_blkif_t *info = filp->private_data;
+       
+       /* can this ever happen? - sdr */
+       if (!info) {
                WPRINTK("Trying to free device that doesn't exist "
-                      "[/dev/xen/blktap%d]\n",idx);
-               return -1;
-       }
-       info = tapfds[idx];
+                      "[/dev/xen/blktap%d]\n",iminor(inode) - BLKTAP_MINOR);
+               return -EBADF;
+       }
        info->dev_inuse = 0;
-       DPRINTK("Freeing device [/dev/xen/blktap%d]\n",idx);
+       DPRINTK("Freeing device [/dev/xen/blktap%d]\n",info->minor);
 
        /* Free the ring page. */
        ClearPageReserved(virt_to_page(info->ufe_ring.sring));
@@ -457,8 +477,6 @@ static int blktap_release(struct inode *
                info->vma = NULL;
        }
        
-       if (filp->private_data) kfree(filp->private_data);
-
        if ( (info->status != CLEANSHUTDOWN) && (info->blkif != NULL) ) {
                kthread_stop(info->blkif->xenblkd);
                info->blkif->xenblkd = NULL;
@@ -491,16 +509,12 @@ static int blktap_mmap(struct file *filp
        int size;
        struct page **map;
        int i;
-       private_info_t *prv;
-       tap_blkif_t *info;
-
-       /*Retrieve the dev info*/
-       prv = (private_info_t *)filp->private_data;
-       if (prv == NULL) {
+       tap_blkif_t *info = filp->private_data;
+
+       if (info == NULL) {
                WPRINTK("blktap: mmap, retrieving idx failed\n");
                return -ENOMEM;
        }
-       info = tapfds[prv->idx];
        
        vma->vm_flags |= VM_RESERVED;
        vma->vm_ops = &blktap_vm_ops;
@@ -556,20 +570,17 @@ static int blktap_ioctl(struct inode *in
 static int blktap_ioctl(struct inode *inode, struct file *filp,
                         unsigned int cmd, unsigned long arg)
 {
-       int idx = iminor(inode) - BLKTAP_MINOR;
+       tap_blkif_t *info = filp->private_data;
+
        switch(cmd) {
        case BLKTAP_IOCTL_KICK_FE: 
        {
                /* There are fe messages to process. */
-               return blktap_read_ufe_ring(idx);
+               return blktap_read_ufe_ring(info);
        }
        case BLKTAP_IOCTL_SETMODE:
        {
-               tap_blkif_t *info = tapfds[idx];
-               
-               if ( (idx > 0) && (idx < MAX_TAP_DEV) 
-                    && (tapfds[idx] != NULL) ) 
-               {
+               if (info) {
                        if (BLKTAP_MODE_VALID(arg)) {
                                info->mode = arg;
                                /* XXX: may need to flush rings here. */
@@ -582,11 +593,7 @@ static int blktap_ioctl(struct inode *in
        }
        case BLKTAP_IOCTL_PRINT_IDXS:
         {
-               tap_blkif_t *info = tapfds[idx];
-               
-               if ( (idx > 0) && (idx < MAX_TAP_DEV) 
-                    && (tapfds[idx] != NULL) ) 
-               {
+               if (info) {
                        printk("User Rings: \n-----------\n");
                        printk("UF: rsp_cons: %2d, req_prod_prv: %2d "
                                "| req_prod: %2d, rsp_prod: %2d\n",
@@ -599,11 +606,7 @@ static int blktap_ioctl(struct inode *in
         }
        case BLKTAP_IOCTL_SENDPID:
        {
-               tap_blkif_t *info = tapfds[idx];
-               
-               if ( (idx > 0) && (idx < MAX_TAP_DEV) 
-                    && (tapfds[idx] != NULL) ) 
-               {
+               if (info) {
                        info->pid = (pid_t)arg;
                        DPRINTK("blktap: pid received %d\n", 
                               info->pid);
@@ -631,26 +634,38 @@ static int blktap_ioctl(struct inode *in
        case BLKTAP_IOCTL_FREEINTF:
        {
                unsigned long dev = arg;
-               tap_blkif_t *info = NULL;
-
-               if ( (dev > 0) && (dev < MAX_TAP_DEV) ) info = tapfds[dev];
-
+               unsigned long flags;
+
+               /* Looking at another device */
+               info = NULL;
+
+               if ( (dev > 0) && (dev < MAX_TAP_DEV) )
+                       info = tapfds[dev];
+
+               spin_lock_irqsave(&pending_free_lock, flags);
                if ( (info != NULL) && (info->dev_pending) )
                        info->dev_pending = 0;
+               spin_unlock_irqrestore(&pending_free_lock, flags);
+
                return 0;
        }
        case BLKTAP_IOCTL_MINOR:
        {
                unsigned long dev = arg;
-               tap_blkif_t *info = NULL;
+
+               /* Looking at another device */
+               info = NULL;
                
-               if ( (dev > 0) && (dev < MAX_TAP_DEV) ) info = tapfds[dev];
+               if ( (dev > 0) && (dev < MAX_TAP_DEV) )
+                       info = tapfds[dev];
                
-               if (info != NULL) return info->minor;
-               else return -1;
+               if (info != NULL)
+                       return info->minor;
+               else
+                       return -1;
        }
        case BLKTAP_IOCTL_MAJOR:
-               return BLKTAP_DEV_MAJOR;
+               return blktap_major;
 
        case BLKTAP_QUERY_ALLOC_REQS:
        {
@@ -662,25 +677,21 @@ static int blktap_ioctl(struct inode *in
        return -ENOIOCTLCMD;
 }
 
-static unsigned int blktap_poll(struct file *file, poll_table *wait)
-{
-       private_info_t *prv;
-       tap_blkif_t *info;
-       
-       /*Retrieve the dev info*/
-       prv = (private_info_t *)file->private_data;
-       if (prv == NULL) {
+static unsigned int blktap_poll(struct file *filp, poll_table *wait)
+{
+       tap_blkif_t *info = filp->private_data;
+       
+       if (!info) {
                WPRINTK(" poll, retrieving idx failed\n");
                return 0;
        }
-       
-       if (prv->idx == 0) return 0;
-       
-       info = tapfds[prv->idx];
-       
-       poll_wait(file, &info->wait, wait);
+
+       /* do not work on the control device */
+       if (!info->minor)
+               return 0;
+
+       poll_wait(filp, &info->wait, wait);
        if (info->ufe_ring.req_prod_pvt != info->ufe_ring.sring->req_prod) {
-               flush_tlb_all();
                RING_PUSH_REQUESTS(&info->ufe_ring);
                return POLLIN | POLLRDNORM;
        }
@@ -691,11 +702,14 @@ void blktap_kick_user(int idx)
 {
        tap_blkif_t *info;
 
-       if (idx == 0) return;
+       if (idx == 0)
+               return;
        
        info = tapfds[idx];
        
-       if (info != NULL) wake_up_interruptible(&info->wait);
+       if (info != NULL)
+               wake_up_interruptible(&info->wait);
+
        return;
 }
 
@@ -713,10 +727,7 @@ static int req_increase(void)
 {
        int i, j;
        struct page *page;
-       unsigned long flags;
        int ret;
-
-       spin_lock_irqsave(&pending_free_lock, flags);
 
        ret = -EINVAL;
        if (mmap_alloc >= MAX_PENDING_REQS || mmap_lock) 
@@ -782,8 +793,7 @@ static int req_increase(void)
 
        mmap_alloc++;
        DPRINTK("# MMAPs increased to %d\n",mmap_alloc);
- done:
-       spin_unlock_irqrestore(&pending_free_lock, flags);
+done:
        return ret;
 }
 
@@ -811,36 +821,6 @@ static void mmap_req_del(int mmap)
        mmap_lock = 0;
        DPRINTK("# MMAPs decreased to %d\n",mmap_alloc);
        mmap_alloc--;
-}
-
-/*N.B. Currently unused - will be accessed via sysfs*/
-static void req_decrease(void)
-{
-       pending_req_t *req;
-       int i;
-       unsigned long flags;
-
-       spin_lock_irqsave(&pending_free_lock, flags);
-
-       DPRINTK("Req decrease called.\n");
-       if (mmap_lock || mmap_alloc == 1) 
-               goto done;
-
-       mmap_lock = 1;
-       mmap_inuse = MAX_PENDING_REQS;
-       
-        /*Go through reqs and remove any that aren't in use*/
-       for (i = 0; i < MAX_PENDING_REQS ; i++) {
-               req = &pending_reqs[mmap_alloc-1][i];
-               if (req->inuse == 0) {
-                       list_del(&req->free_list);
-                       mmap_inuse--;
-               }
-       }
-       if (mmap_inuse == 0) mmap_req_del(mmap_alloc-1);
- done:
-       spin_unlock_irqrestore(&pending_free_lock, flags);
-       return;
 }
 
 static pending_req_t* alloc_req(void)
@@ -1002,7 +982,7 @@ int tap_blkif_schedule(void *arg)
  * COMPLETION CALLBACK -- Called by user level ioctl()
  */
 
-static int blktap_read_ufe_ring(int idx)
+static int blktap_read_ufe_ring(tap_blkif_t *info)
 {
        /* This is called to read responses from the UFE ring. */
        RING_IDX i, j, rp;
@@ -1010,12 +990,9 @@ static int blktap_read_ufe_ring(int idx)
        blkif_t *blkif=NULL;
        int pending_idx, usr_idx, mmap_idx;
        pending_req_t *pending_req;
-       tap_blkif_t *info;
-       
-       info = tapfds[idx];
-       if (info == NULL) {
+       
+       if (!info)
                return 0;
-       }
 
        /* We currently only forward packets in INTERCEPT_FE mode. */
        if (!(info->mode & BLKTAP_MODE_INTERCEPT_FE))
@@ -1063,7 +1040,7 @@ static int blktap_read_ufe_ring(int idx)
                                >> PAGE_SHIFT;
                        map[offset] = NULL;
                }
-               fast_flush_area(pending_req, pending_idx, usr_idx, idx);
+               fast_flush_area(pending_req, pending_idx, usr_idx, info->minor);
                make_response(blkif, pending_req->id, resp->operation,
                              resp->status);
                info->idx_map[usr_idx] = INVALID_REQ;
@@ -1416,7 +1393,8 @@ static int __init blkif_init(void)
        /*Create the blktap devices, but do not map memory or waitqueue*/
        for(i = 0; i < MAX_TAP_DEV; i++) translate_domid[i].domid = 0xFFFF;
 
-       ret = register_chrdev(BLKTAP_DEV_MAJOR,"blktap",&blktap_fops);
+       /* Dynamically allocate a major for this device */
+       ret = register_chrdev(0, "blktap", &blktap_fops);
        blktap_dir = devfs_mk_dir(NULL, "xen", 0, NULL);
 
        if ( (ret < 0)||(blktap_dir < 0) ) {
@@ -1424,22 +1402,44 @@ static int __init blkif_init(void)
                return -ENOMEM;
        }       
        
+       blktap_major = ret;
+
        for(i = 0; i < MAX_TAP_DEV; i++ ) {
                info = tapfds[i] = kzalloc(sizeof(tap_blkif_t),GFP_KERNEL);
-               if(tapfds[i] == NULL) return -ENOMEM;
+               if(tapfds[i] == NULL)
+                       return -ENOMEM;
                info->minor = i;
                info->pid = 0;
                info->blkif = NULL;
 
-               ret = devfs_mk_cdev(MKDEV(BLKTAP_DEV_MAJOR, i),
+               ret = devfs_mk_cdev(MKDEV(blktap_major, i),
                        S_IFCHR|S_IRUGO|S_IWUSR, "xen/blktap%d", i);
 
-               if(ret != 0) return -ENOMEM;
+               if(ret != 0)
+                       return -ENOMEM;
                info->dev_pending = info->dev_inuse = 0;
 
                DPRINTK("Created misc_dev [/dev/xen/blktap%d]\n",i);
        }
        
+       /* Make sure the xen class exists */
+       if (!setup_xen_class()) {
+               /*
+                * This will allow udev to create the blktap ctrl device.
+                * We only want to create blktap0 first.  We don't want
+                * to flood the sysfs system with needless blktap devices.
+                * We only create the device when a request of a new device is
+                * made.
+                */
+               class_device_create(xen_class, NULL,
+                                   MKDEV(blktap_major, 0), NULL,
+                                   "blktap0");
+               tapfds[0]->sysfs_set = 1;
+       } else {
+               /* this is bad, but not fatal */
+               WPRINTK("blktap: sysfs xen_class not created\n");
+       }
+
        DPRINTK("Blktap device successfully created\n");
 
        return 0;
diff -r 914c44d10c8d -r 2bfd19fc1b79 
linux-2.6-xen-sparse/drivers/xen/blktap/xenbus.c
--- a/linux-2.6-xen-sparse/drivers/xen/blktap/xenbus.c  Sun Oct 01 11:39:41 
2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/blktap/xenbus.c  Sun Oct 01 19:10:18 
2006 -0600
@@ -273,7 +273,6 @@ static void tap_frontend_changed(struct 
                        kthread_stop(be->blkif->xenblkd);
                        be->blkif->xenblkd = NULL;
                }
-               tap_blkif_unmap(be->blkif);
                xenbus_switch_state(dev, XenbusStateClosing);
                break;
 
diff -r 914c44d10c8d -r 2bfd19fc1b79 
linux-2.6-xen-sparse/drivers/xen/evtchn/evtchn.c
--- a/linux-2.6-xen-sparse/drivers/xen/evtchn/evtchn.c  Sun Oct 01 11:39:41 
2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/evtchn/evtchn.c  Sun Oct 01 19:10:18 
2006 -0600
@@ -419,10 +419,9 @@ static struct file_operations evtchn_fop
 };
 
 static struct miscdevice evtchn_miscdev = {
-       .minor        = EVTCHN_MINOR,
+       .minor        = MISC_DYNAMIC_MINOR,
        .name         = "evtchn",
        .fops         = &evtchn_fops,
-       .devfs_name   = "misc/evtchn",
 };
 
 static int __init evtchn_init(void)
diff -r 914c44d10c8d -r 2bfd19fc1b79 
linux-2.6-xen-sparse/drivers/xen/netback/loopback.c
--- a/linux-2.6-xen-sparse/drivers/xen/netback/loopback.c       Sun Oct 01 
11:39:41 2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/netback/loopback.c       Sun Oct 01 
19:10:18 2006 -0600
@@ -53,8 +53,10 @@
 #include <linux/skbuff.h>
 #include <linux/ethtool.h>
 #include <net/dst.h>
-
-static int nloopbacks = 8;
+#include <net/xfrm.h>          /* secpath_reset() */
+#include <asm/hypervisor.h>    /* is_initial_xendomain() */
+
+static int nloopbacks = -1;
 module_param(nloopbacks, int, 0);
 MODULE_PARM_DESC(nloopbacks, "Number of netback-loopback devices to create");
 
@@ -77,9 +79,59 @@ static int loopback_close(struct net_dev
        return 0;
 }
 
+#ifdef CONFIG_X86
+static int is_foreign(unsigned long pfn)
+{
+       /* NB. Play it safe for auto-translation mode. */
+       return (xen_feature(XENFEAT_auto_translated_physmap) ||
+               (phys_to_machine_mapping[pfn] & FOREIGN_FRAME_BIT));
+}
+#else
+/* How to detect a foreign mapping? Play it safe. */
+#define is_foreign(pfn)        (1)
+#endif
+
+static int skb_remove_foreign_references(struct sk_buff *skb)
+{
+       struct page *page;
+       unsigned long pfn;
+       int i, off;
+       char *vaddr;
+
+       BUG_ON(skb_shinfo(skb)->frag_list);
+
+       for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+               pfn = page_to_pfn(skb_shinfo(skb)->frags[i].page);
+               if (!is_foreign(pfn))
+                       continue;
+               
+               page = alloc_page(GFP_ATOMIC | __GFP_NOWARN);
+               if (unlikely(!page))
+                       return 0;
+
+               vaddr = kmap_skb_frag(&skb_shinfo(skb)->frags[i]);
+               off = skb_shinfo(skb)->frags[i].page_offset;
+               memcpy(page_address(page) + off,
+                      vaddr + off,
+                      skb_shinfo(skb)->frags[i].size);
+               kunmap_skb_frag(vaddr);
+
+               put_page(skb_shinfo(skb)->frags[i].page);
+               skb_shinfo(skb)->frags[i].page = page;
+       }
+
+       return 1;
+}
+
 static int loopback_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        struct net_private *np = netdev_priv(dev);
+
+       if (!skb_remove_foreign_references(skb)) {
+               np->stats.tx_dropped++;
+               dev_kfree_skb(skb);
+               return 0;
+       }
 
        dst_release(skb->dst);
        skb->dst = NULL;
@@ -110,6 +162,11 @@ static int loopback_start_xmit(struct sk
        skb->protocol = eth_type_trans(skb, dev);
        skb->dev      = dev;
        dev->last_rx  = jiffies;
+
+       /* Flush netfilter context: rx'ed skbuffs not expected to have any. */
+       nf_reset(skb);
+       secpath_reset(skb);
+
        netif_rx(skb);
 
        return 0;
@@ -239,6 +296,9 @@ static int __init loopback_init(void)
 {
        int i, err = 0;
 
+       if (nloopbacks == -1)
+               nloopbacks = is_initial_xendomain() ? 4 : 0;
+
        for (i = 0; i < nloopbacks; i++)
                if ((err = make_loopback(i)) != 0)
                        break;
diff -r 914c44d10c8d -r 2bfd19fc1b79 
linux-2.6-xen-sparse/drivers/xen/netback/netback.c
--- a/linux-2.6-xen-sparse/drivers/xen/netback/netback.c        Sun Oct 01 
11:39:41 2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/netback/netback.c        Sun Oct 01 
19:10:18 2006 -0600
@@ -217,7 +217,7 @@ static struct sk_buff *netbk_copy_skb(st
                copy = len >= PAGE_SIZE ? PAGE_SIZE : len;
                zero = len >= PAGE_SIZE ? 0 : __GFP_ZERO;
 
-               page = alloc_page(GFP_ATOMIC | zero);
+               page = alloc_page(GFP_ATOMIC | __GFP_NOWARN | zero);
                if (unlikely(!page))
                        goto err_free;
 
diff -r 914c44d10c8d -r 2bfd19fc1b79 
linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_probe.c
--- a/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_probe.c    Sun Oct 01 
11:39:41 2006 -0600
+++ b/linux-2.6-xen-sparse/drivers/xen/xenbus/xenbus_probe.c    Sun Oct 01 
19:10:18 2006 -0600
@@ -322,6 +322,20 @@ static void otherend_changed(struct xenb
        DPRINTK("state is %d (%s), %s, %s", state, xenbus_strstate(state),
                dev->otherend_watch.node, vec[XS_WATCH_PATH]);
 
+       /*
+        * Ignore xenbus transitions during shutdown. This prevents us doing
+        * work that can fail e.g., when the rootfs is gone.
+        */
+       if (system_state > SYSTEM_RUNNING) {
+               struct xen_bus_type *bus = bus;
+               bus = container_of(dev->dev.bus, struct xen_bus_type, bus);
+               /* If we're frontend, drive the state machine to Closed. */
+               /* This should cause the backend to release our resources. */
+               if ((bus == &xenbus_frontend) && (state == XenbusStateClosing))
+                       xenbus_frontend_closed(dev);
+               return;
+       }
+
        if (drv->otherend_changed)
                drv->otherend_changed(dev, state);
 }
diff -r 914c44d10c8d -r 2bfd19fc1b79 
linux-2.6-xen-sparse/include/xen/public/evtchn.h
--- a/linux-2.6-xen-sparse/include/xen/public/evtchn.h  Sun Oct 01 11:39:41 
2006 -0600
+++ b/linux-2.6-xen-sparse/include/xen/public/evtchn.h  Sun Oct 01 19:10:18 
2006 -0600
@@ -32,9 +32,6 @@
 
 #ifndef __LINUX_PUBLIC_EVTCHN_H__
 #define __LINUX_PUBLIC_EVTCHN_H__
-
-/* /dev/xen/evtchn resides at device number major=10, minor=201 */
-#define EVTCHN_MINOR 201
 
 /*
  * Bind a fresh port to VIRQ @virq.
diff -r 914c44d10c8d -r 2bfd19fc1b79 tools/blktap/drivers/Makefile
--- a/tools/blktap/drivers/Makefile     Sun Oct 01 11:39:41 2006 -0600
+++ b/tools/blktap/drivers/Makefile     Sun Oct 01 19:10:18 2006 -0600
@@ -28,7 +28,7 @@ THREADLIB := -lpthread -lz
 THREADLIB := -lpthread -lz
 LIBS      := -L. -L.. -L../lib
 LIBS      += -L$(XEN_LIBXC)
-LIBS      += -lblktap
+LIBS      += -lblktap -lxenctrl
 LIBS      += -lcrypto
 LIBS      += -lz
 LIBS      += -L$(XEN_XENSTORE) -lxenstore
diff -r 914c44d10c8d -r 2bfd19fc1b79 tools/blktap/drivers/blktapctrl.c
--- a/tools/blktap/drivers/blktapctrl.c Sun Oct 01 11:39:41 2006 -0600
+++ b/tools/blktap/drivers/blktapctrl.c Sun Oct 01 19:10:18 2006 -0600
@@ -67,6 +67,8 @@ int max_timeout = MAX_TIMEOUT;
 int max_timeout = MAX_TIMEOUT;
 int ctlfd = 0;
 
+int blktap_major;
+
 static int open_ctrl_socket(char *devname);
 static int write_msg(int fd, int msgtype, void *ptr, void *ptr2);
 static int read_msg(int fd, int msgtype, void *ptr);
@@ -108,7 +110,18 @@ static void make_blktap_dev(char *devnam
                if (mknod(devname, S_IFCHR|0600,
                        makedev(major, minor)) == 0)
                        DPRINTF("Created %s device\n",devname);
-       } else DPRINTF("%s device already exists\n",devname);
+       } else {
+               DPRINTF("%s device already exists\n",devname);
+               /* it already exists, but is it the same major number */
+               if (((st.st_rdev>>8) & 0xff) != major) {
+                       DPRINTF("%s has old major %d\n",
+                               devname,
+                               (unsigned int)((st.st_rdev >> 8) & 0xff));
+                       /* only try again if we succed in deleting it */
+                       if (!unlink(devname))
+                               make_blktap_dev(devname, major, minor);
+               }
+       }
 }
 
 static int get_new_dev(int *major, int *minor, blkif_t *blkif)
@@ -644,9 +657,12 @@ int main(int argc, char *argv[])
        register_new_devmap_hook(map_new_blktapctrl);
        register_new_unmap_hook(unmap_blktapctrl);
 
-       /*Attach to blktap0 */  
+       /* Attach to blktap0 */
        asprintf(&devname,"%s/%s0", BLKTAP_DEV_DIR, BLKTAP_DEV_NAME);
-       make_blktap_dev(devname,254,0);
+       if ((ret = xc_find_device_number("blktap0")) < 0)
+               goto open_failed;
+       blktap_major = major(ret);
+       make_blktap_dev(devname,blktap_major,0);
        ctlfd = open(devname, O_RDWR);
        if (ctlfd == -1) {
                DPRINTF("blktap0 open failed\n");
diff -r 914c44d10c8d -r 2bfd19fc1b79 tools/blktap/drivers/tapdisk.c
--- a/tools/blktap/drivers/tapdisk.c    Sun Oct 01 11:39:41 2006 -0600
+++ b/tools/blktap/drivers/tapdisk.c    Sun Oct 01 19:10:18 2006 -0600
@@ -271,7 +271,6 @@ static int read_msg(char *buf)
        int length, len, msglen, tap_fd, *io_fd;
        char *ptr, *path;
        image_t *img;
-       struct timeval timeout;
        msg_hdr_t *msg;
        msg_newdev_t *msg_dev;
        msg_pid_t *msg_pid;
@@ -579,8 +578,7 @@ int main(int argc, char *argv[])
 {
        int len, msglen, ret;
        char *p, *buf;
-       fd_set readfds, writefds;
-       struct timeval timeout;
+       fd_set readfds, writefds;       
        fd_list_entry_t *ptr;
        struct tap_disk *drv;
        struct td_state *s;
@@ -622,12 +620,9 @@ int main(int argc, char *argv[])
                /*Set all tap fds*/
                LOCAL_FD_SET(&readfds);
 
-               timeout.tv_sec = 0; 
-               timeout.tv_usec = 1000; 
-
                /*Wait for incoming messages*/
                ret = select(maxfds + 1, &readfds, (fd_set *) 0, 
-                            (fd_set *) 0, &timeout);
+                            (fd_set *) 0, NULL);
 
                if (ret > 0) 
                {
diff -r 914c44d10c8d -r 2bfd19fc1b79 tools/blktap/lib/blktaplib.h
--- a/tools/blktap/lib/blktaplib.h      Sun Oct 01 11:39:41 2006 -0600
+++ b/tools/blktap/lib/blktaplib.h      Sun Oct 01 19:10:18 2006 -0600
@@ -80,8 +80,9 @@ static inline int BLKTAP_MODE_VALID(unsi
 #define MAX_PENDING_REQS 64
 #define BLKTAP_DEV_DIR   "/dev/xen"
 #define BLKTAP_DEV_NAME  "blktap"
-#define BLKTAP_DEV_MAJOR 254
 #define BLKTAP_DEV_MINOR 0
+
+extern int blktap_major;
 
 #define BLKTAP_RING_PAGES       1 /* Front */
 #define BLKTAP_MMAP_REGION_SIZE (BLKTAP_RING_PAGES + MMAP_PAGES)
diff -r 914c44d10c8d -r 2bfd19fc1b79 tools/examples/init.d/xendomains
--- a/tools/examples/init.d/xendomains  Sun Oct 01 11:39:41 2006 -0600
+++ b/tools/examples/init.d/xendomains  Sun Oct 01 19:10:18 2006 -0600
@@ -352,9 +352,9 @@ stop()
            if test $? -ne 0; then
                rc_failed $?
                echo -n '!'
-               kill $WDOG_PIG >/dev/null 2>&1
-           else
-               kill $WDOG_PIG >/dev/null 2>&1
+               kill $WDOG_PID >/dev/null 2>&1
+           else
+               kill $WDOG_PID >/dev/null 2>&1
                continue
            fi
        fi
@@ -368,7 +368,7 @@ stop()
                rc_failed $?
                echo -n '!'
            fi
-           kill $WDOG_PIG >/dev/null 2>&1
+           kill $WDOG_PID >/dev/null 2>&1
        fi
     done < <(xm list | grep -v '^Name')
 
diff -r 914c44d10c8d -r 2bfd19fc1b79 tools/examples/xen-backend.rules
--- a/tools/examples/xen-backend.rules  Sun Oct 01 11:39:41 2006 -0600
+++ b/tools/examples/xen-backend.rules  Sun Oct 01 19:10:18 2006 -0600
@@ -5,3 +5,4 @@ SUBSYSTEM=="xen-backend", KERNEL=="vif*"
 SUBSYSTEM=="xen-backend", KERNEL=="vif*", ACTION=="offline", 
RUN+="$env{script} offline"
 SUBSYSTEM=="xen-backend", ACTION=="remove", 
RUN+="/etc/xen/scripts/xen-hotplug-cleanup"
 KERNEL=="evtchn", NAME="xen/%k"
+KERNEL=="blktap[0-9]*", NAME="xen/%k"
diff -r 914c44d10c8d -r 2bfd19fc1b79 tools/firmware/vmxassist/vm86.c
--- a/tools/firmware/vmxassist/vm86.c   Sun Oct 01 11:39:41 2006 -0600
+++ b/tools/firmware/vmxassist/vm86.c   Sun Oct 01 19:10:18 2006 -0600
@@ -68,7 +68,7 @@ guest_linear_to_real(uint32_t base)
                return base;
 
        if (!(oldctx.cr4 & CR4_PAE)) {
-               l1_mfn = ((uint32_t *)gcr3)[(base >> 22) & 0x3ff];
+               l1_mfn = ((uint32_t *)(long)gcr3)[(base >> 22) & 0x3ff];
                if (!(l1_mfn & PT_ENTRY_PRESENT))
                        panic("l2 entry not present\n");
 
@@ -79,19 +79,19 @@ guest_linear_to_real(uint32_t base)
 
                l1_mfn &= 0xfffff000;
 
-               l0_mfn = ((uint32_t *)l1_mfn)[(base >> 12) & 0x3ff];
+               l0_mfn = ((uint32_t *)(long)l1_mfn)[(base >> 12) & 0x3ff];
                if (!(l0_mfn & PT_ENTRY_PRESENT))
                        panic("l1 entry not present\n");
                l0_mfn &= 0xfffff000;
 
                return l0_mfn + (base & 0xfff);
        } else {
-               l2_mfn = ((uint64_t *)gcr3)[(base >> 30) & 0x3];
+               l2_mfn = ((uint64_t *)(long)gcr3)[(base >> 30) & 0x3];
                if (!(l2_mfn & PT_ENTRY_PRESENT))
                        panic("l3 entry not present\n");
                l2_mfn &= 0x3fffff000ULL;
 
-               l1_mfn = ((uint64_t *)l2_mfn)[(base >> 21) & 0x1ff];
+               l1_mfn = ((uint64_t *)(long)l2_mfn)[(base >> 21) & 0x1ff];
                if (!(l1_mfn & PT_ENTRY_PRESENT))
                        panic("l2 entry not present\n");
 
@@ -102,7 +102,7 @@ guest_linear_to_real(uint32_t base)
 
                l1_mfn &= 0x3fffff000ULL;
 
-               l0_mfn = ((uint64_t *)l1_mfn)[(base >> 12) & 0x1ff];
+               l0_mfn = ((uint64_t *)(long)l1_mfn)[(base >> 12) & 0x1ff];
                if (!(l0_mfn & PT_ENTRY_PRESENT))
                        panic("l1 entry not present\n");
                l0_mfn &= 0x3fffff000ULL;
@@ -1230,6 +1230,18 @@ pushrm(struct regs *regs, int prefix, un
 
 enum { OPC_INVALID, OPC_EMULATED };
 
+#define rdmsr(msr,val1,val2)                           \
+       __asm__ __volatile__(                           \
+               "rdmsr"                                 \
+               : "=a" (val1), "=d" (val2)              \
+               : "c" (msr))
+
+#define wrmsr(msr,val1,val2)                           \
+       __asm__ __volatile__(                           \
+               "wrmsr"                                 \
+               : /* no outputs */                      \
+               : "c" (msr), "a" (val1), "d" (val2))
+
 /*
  * Emulate a single instruction, including all its prefixes. We only implement
  * a small subset of the opcodes, and not all opcodes are implemented for each
@@ -1288,6 +1300,12 @@ opcode(struct regs *regs)
                                if (!movcr(regs, prefix, opc))
                                        goto invalid;
                                return OPC_EMULATED;
+                       case 0x30: /* WRMSR */
+                               wrmsr(regs->ecx, regs->eax, regs->edx);
+                               return OPC_EMULATED;
+                       case 0x32: /* RDMSR */
+                               rdmsr(regs->ecx, regs->eax, regs->edx);
+                               return OPC_EMULATED;
                        default:
                                goto invalid;
                        }
@@ -1412,12 +1430,14 @@ opcode(struct regs *regs)
                        {
                                int addr, data;
                                int seg = segment(prefix, regs, regs->vds);
+                               int offset = prefix & ADDR32? fetch32(regs) : 
fetch16(regs);
+
                                if (prefix & DATA32) {
-                                       addr = address(regs, seg, 
fetch32(regs));
+                                       addr = address(regs, seg, offset);
                                        data = read32(addr);
                                        setreg32(regs, 0, data);
                                } else {
-                                       addr = address(regs, seg, 
fetch16(regs));
+                                       addr = address(regs, seg, offset);
                                        data = read16(addr);
                                        setreg16(regs, 0, data);
                                }
diff -r 914c44d10c8d -r 2bfd19fc1b79 tools/ioemu/target-i386-dm/helper2.c
--- a/tools/ioemu/target-i386-dm/helper2.c      Sun Oct 01 11:39:41 2006 -0600
+++ b/tools/ioemu/target-i386-dm/helper2.c      Sun Oct 01 19:10:18 2006 -0600
@@ -520,8 +520,8 @@ int main_loop(void)
             }
         }
 
-        /* Wait up to 100 msec. */
-        main_loop_wait(100);
+        /* Wait up to 10 msec. */
+        main_loop_wait(10);
 
         if (env->send_event) {
             env->send_event = 0;
diff -r 914c44d10c8d -r 2bfd19fc1b79 tools/libxc/xc_linux.c
--- a/tools/libxc/xc_linux.c    Sun Oct 01 11:39:41 2006 -0600
+++ b/tools/libxc/xc_linux.c    Sun Oct 01 19:10:18 2006 -0600
@@ -133,27 +133,95 @@ int do_xen_hypercall(int xc_handle, priv
                       (unsigned long)hypercall);
 }
 
+#define MTAB "/proc/mounts"
+#define MAX_PATH 255
+#define _STR(x) #x
+#define STR(x) _STR(x)
+
+static int find_sysfsdir(char *sysfsdir)
+{
+    FILE *fp;
+    char type[MAX_PATH + 1];
+
+    if ( (fp = fopen(MTAB, "r")) == NULL )
+        return -1;
+
+    while ( fscanf(fp, "%*s %"
+                   STR(MAX_PATH)
+                   "s %"
+                   STR(MAX_PATH)
+                   "s %*s %*d %*d\n",
+                   sysfsdir, type) == 2 )
+    {
+        if ( strncmp(type, "sysfs", 5) == 0 )
+            break;
+    }
+
+    fclose(fp);
+
+    return ((strncmp(type, "sysfs", 5) == 0) ? 0 : -1);
+}
+
+int xc_find_device_number(const char *name)
+{
+    FILE *fp;
+    int i, major, minor;
+    char sysfsdir[MAX_PATH + 1];
+    static char *classlist[] = { "xen", "misc" };
+
+    for ( i = 0; i < (sizeof(classlist) / sizeof(classlist[0])); i++ )
+    {
+        if ( find_sysfsdir(sysfsdir) < 0 )
+            goto not_found;
+
+        /* <base>/class/<classname>/<devname>/dev */
+        strncat(sysfsdir, "/class/", MAX_PATH);
+        strncat(sysfsdir, classlist[i], MAX_PATH);
+        strncat(sysfsdir, "/", MAX_PATH);
+        strncat(sysfsdir, name, MAX_PATH);
+        strncat(sysfsdir, "/dev", MAX_PATH);
+
+        if ( (fp = fopen(sysfsdir, "r")) != NULL )
+            goto found;
+    }
+
+ not_found:
+    errno = -ENOENT;
+    return -1;
+
+ found:
+    if ( fscanf(fp, "%d:%d", &major, &minor) != 2 )
+    {
+        fclose(fp);
+        goto not_found;
+    }
+
+    fclose(fp);
+
+    return makedev(major, minor);
+}
+
 #define EVTCHN_DEV_NAME  "/dev/xen/evtchn"
-#define EVTCHN_DEV_MAJOR 10
-#define EVTCHN_DEV_MINOR 201
 
 int xc_evtchn_open(void)
 {
     struct stat st;
     int fd;
+    int devnum;
+
+    devnum = xc_find_device_number("evtchn");
 
     /* Make sure any existing device file links to correct device. */
-    if ((lstat(EVTCHN_DEV_NAME, &st) != 0) || !S_ISCHR(st.st_mode) ||
-        (st.st_rdev != makedev(EVTCHN_DEV_MAJOR, EVTCHN_DEV_MINOR)))
+    if ( (lstat(EVTCHN_DEV_NAME, &st) != 0) || !S_ISCHR(st.st_mode) ||
+         (st.st_rdev != devnum) )
         (void)unlink(EVTCHN_DEV_NAME);
 
-reopen:
+ reopen:
     if ( (fd = open(EVTCHN_DEV_NAME, O_RDWR)) == -1 )
     {
         if ( (errno == ENOENT) &&
             ((mkdir("/dev/xen", 0755) == 0) || (errno == EEXIST)) &&
-            (mknod(EVTCHN_DEV_NAME, S_IFCHR|0600,
-            makedev(EVTCHN_DEV_MAJOR, EVTCHN_DEV_MINOR)) == 0) )
+             (mknod(EVTCHN_DEV_NAME, S_IFCHR|0600, devnum) == 0) )
             goto reopen;
 
         PERROR("Could not open event channel interface");
diff -r 914c44d10c8d -r 2bfd19fc1b79 tools/libxc/xenctrl.h
--- a/tools/libxc/xenctrl.h     Sun Oct 01 11:39:41 2006 -0600
+++ b/tools/libxc/xenctrl.h     Sun Oct 01 19:10:18 2006 -0600
@@ -92,6 +92,16 @@ int xc_interface_close(int xc_handle);
 int xc_interface_close(int xc_handle);
 
 /*
+ * KERNEL INTERFACES
+ */
+
+/*
+ * Resolve a kernel device name (e.g., "evtchn", "blktap0") into a kernel
+ * device number. Returns -1 on error (and sets errno).
+ */
+int xc_find_device_number(const char *name);
+
+/*
  * DOMAIN DEBUGGING FUNCTIONS
  */
 
diff -r 914c44d10c8d -r 2bfd19fc1b79 tools/pygrub/src/pygrub
--- a/tools/pygrub/src/pygrub   Sun Oct 01 11:39:41 2006 -0600
+++ b/tools/pygrub/src/pygrub   Sun Oct 01 19:10:18 2006 -0600
@@ -25,7 +25,18 @@ import grub.GrubConf
 import grub.GrubConf
 import grub.fsys
 
-PYGRUB_VER = 0.4
+PYGRUB_VER = 0.5
+
+def enable_cursor(ison):
+    if ison:
+        val = 2
+    else:
+        val = 0
+        
+    try:
+        curses.curs_set(val)
+    except _curses.error:
+        pass
 
 def is_disk_image(file):
     fd = os.open(file, os.O_RDONLY)
@@ -141,10 +152,7 @@ class Grub:
             self.screen.timeout(1000)
             if hasattr(curses, 'use_default_colors'):
                 curses.use_default_colors()
-            try:
-                curses.curs_set(0)
-            except _curses.error:
-                pass
+            enable_cursor(False)
             self.entry_win = curses.newwin(10, 74, 2, 1)
             self.text_win = curses.newwin(10, 70, 12, 5)
             
@@ -247,6 +255,7 @@ class Grub:
         self.screen.refresh()
 
         t = GrubLineEditor(self.screen, 5, 2, line)
+        enable_cursor(True)
         ret = t.edit()
         if ret:
             return ret
@@ -262,6 +271,7 @@ class Grub:
         lines = []
         while 1:
             t = GrubLineEditor(self.screen, y, 2)
+            enable_cursor(True)            
             ret = t.edit()
             if ret:
                 if ret in ("quit", "return"):
diff -r 914c44d10c8d -r 2bfd19fc1b79 tools/python/xen/util/blkif.py
--- a/tools/python/xen/util/blkif.py    Sun Oct 01 11:39:41 2006 -0600
+++ b/tools/python/xen/util/blkif.py    Sun Oct 01 19:10:18 2006 -0600
@@ -67,6 +67,8 @@ def blkdev_uname_to_file(uname):
         (typ, fn) = uname.split(":")
         if typ == "phy" and not fn.startswith("/"):
             fn = "/dev/%s" %(fn,)
+        if typ == "tap":
+            (typ, fn) = fn.split(":", 1)
     return fn
 
 def mount_mode(name):
diff -r 914c44d10c8d -r 2bfd19fc1b79 tools/python/xen/xend/image.py
--- a/tools/python/xen/xend/image.py    Sun Oct 01 11:39:41 2006 -0600
+++ b/tools/python/xen/xend/image.py    Sun Oct 01 19:10:18 2006 -0600
@@ -244,7 +244,8 @@ class HVMImageHandler(ImageHandler):
 
         info = xc.xeninfo()
         if not 'hvm' in info['xen_caps']:
-            raise VmError("Not an HVM capable platform, we stop creating!")
+            raise VmError("HVM guest support is unavailable: is VT/AMD-V "
+                          "supported by your CPU and enabled in your BIOS?")
 
         self.dmargs = self.parseDeviceModelArgs(imageConfig, deviceConfig)
         self.device_model = sxp.child_value(imageConfig, 'device_model')
diff -r 914c44d10c8d -r 2bfd19fc1b79 tools/python/xen/xm/addlabel.py
--- a/tools/python/xen/xm/addlabel.py   Sun Oct 01 11:39:41 2006 -0600
+++ b/tools/python/xen/xm/addlabel.py   Sun Oct 01 19:10:18 2006 -0600
@@ -115,43 +115,45 @@ def add_domain_label(label, configfile, 
     config_fd.close()
 
 
-def main (argv):
+def main(argv):
+    policyref = None
+    if len(argv) not in (4, 5):
+        raise OptionError('Needs either 2 or 3 arguments')
+    
+    label = argv[1]
+    
+    if len(argv) == 5:
+        policyref = argv[4]
+    elif security.on():
+        policyref = security.active_policy
+    else:
+        raise OptionError("No active policy. Must specify policy on the "
+                          "command line.")
+
+    if argv[2].lower() == "dom":
+        configfile = argv[3]
+        if configfile[0] != '/':
+            for prefix in [".", "/etc/xen"]:
+                configfile = prefix + "/" + configfile
+                if os.path.isfile(configfile):
+                    break
+        if not validate_config_file(configfile):
+            raise OptionError('Invalid config file')
+        else:
+            add_domain_label(label, configfile, policyref)
+    elif argv[2].lower() == "res":
+        resource = argv[3]
+        add_resource_label(label, resource, policyref)
+    else:
+        raise OptionError('Need to specify either "dom" or "res" as '
+                          'object to add label to.')
+            
+if __name__ == '__main__':
     try:
-        policyref = None
-        if len(argv) not in (4, 5):
-            raise OptionError('Needs either 2 or 3 arguments')
-
-        label = argv[1]
-
-        if len(argv) == 5:
-            policyref = argv[4]
-        elif security.on():
-            policyref = security.active_policy
-        else:
-            security.err("No active policy. Policy must be specified in 
command line.")
-
-        if argv[2].lower() == "dom":
-            configfile = argv[3]
-            if configfile[0] != '/':
-                for prefix in [".", "/etc/xen"]:
-                    configfile = prefix + "/" + configfile
-                    if os.path.isfile(configfile):
-                        break
-            if not validate_config_file(configfile):
-                raise OptionError('Invalid config file')
-            else:
-                add_domain_label(label, configfile, policyref)
-        elif argv[2].lower() == "res":
-            resource = argv[3]
-            add_resource_label(label, resource, policyref)
-        else:
-            raise OptionError('Need to specify either "dom" or "res" as object 
to add label to.')
-            
-    except security.ACMError:
+        main(sys.argv)
+    except Exception, e:
+        sys.stderr.write('Error: %s\n' % str(e))
         sys.exit(-1)
-
-if __name__ == '__main__':
-    main(sys.argv)
     
 
 
diff -r 914c44d10c8d -r 2bfd19fc1b79 tools/python/xen/xm/cfgbootpolicy.py
--- a/tools/python/xen/xm/cfgbootpolicy.py      Sun Oct 01 11:39:41 2006 -0600
+++ b/tools/python/xen/xm/cfgbootpolicy.py      Sun Oct 01 19:10:18 2006 -0600
@@ -140,44 +140,41 @@ def insert_policy(boot_file, kernel_vers
 
 
 def main(argv):
-    try:
-        user_kver = None
-        policy = None
-        if len(argv) == 2:
-            policy = argv[1]
-        elif len(argv) == 3:
-            policy = argv[1]
-            user_kver = argv[2]
+    user_kver = None
+    policy = None
+    if len(argv) == 2:
+        policy = argv[1]
+    elif len(argv) == 3:
+        policy = argv[1]
+        user_kver = argv[2]
+    else:
+        raise OptionError('Invalid number of arguments')
+    
+    if not policy_name_re.match(policy):
+        raise OptionError("Illegal policy name: '%s'" % policy)
+
+    policy_file = '/'.join([policy_dir_prefix] + policy.split('.'))
+    src_binary_policy_file = policy_file + ".bin"
+    #check if .bin exists or if policy file exists
+    if not os.path.isfile(src_binary_policy_file):
+        if not os.path.isfile(policy_file + "-security_policy.xml"):
+            raise OptionError("Unknown policy '%s'" % policy)
         else:
-            raise OptionError('Invalid number of arguments')
-
-        if not policy_name_re.match(policy):
-            err("Illegal policy name \'" + policy + "\'")
-
-        policy_file = policy_dir_prefix + "/" + 
string.join(string.split(policy, "."), "/")
-        src_binary_policy_file = policy_file + ".bin"
-        #check if .bin exists or if policy file exists
-        if not os.path.isfile(src_binary_policy_file):
-            if not os.path.isfile(policy_file + "-security_policy.xml"):
-                err("Unknown policy \'" + policy +"\'")
-            else:
-                err("Cannot find binary file for policy \'" + policy +
-                    "\'. Please use makepolicy to create binary file.")
-        dst_binary_policy_file = "/boot/" + policy + ".bin"
-        shutil.copyfile(src_binary_policy_file, dst_binary_policy_file)
-
-        kernel_version = determine_kernelversion(user_kver)
-        insert_policy(boot_filename, kernel_version, policy)
-        print "Boot entry created and \'%s\' copied to /boot" % (policy + 
".bin")
-
-    except ACMError:
-        sys.exit(-1)
-    except:
-        traceback.print_exc(limit=1)
-        sys.exit(-1)
-
-
+            err_msg = "Cannot find binary file for policy '%s'." % policy
+            err_msg += " Please use makepolicy to create binary file."
+            raise OptionError(err_msg)
+    
+    dst_binary_policy_file = "/boot/" + policy + ".bin"
+    shutil.copyfile(src_binary_policy_file, dst_binary_policy_file)
+    
+    kernel_version = determine_kernelversion(user_kver)
+    insert_policy(boot_filename, kernel_version, policy)
+    print "Boot entry created and \'%s\' copied to /boot" % (policy + ".bin")
 
 if __name__ == '__main__':
-    main(sys.argv)
-
+    try:
+        main(sys.argv)
+    except Exception, e:
+        sys.stderr.write('Error: ' + str(e) + '\n')    
+        sys.exit(-1)
+        
diff -r 914c44d10c8d -r 2bfd19fc1b79 tools/python/xen/xm/create.py
--- a/tools/python/xen/xm/create.py     Sun Oct 01 11:39:41 2006 -0600
+++ b/tools/python/xen/xm/create.py     Sun Oct 01 19:10:18 2006 -0600
@@ -693,7 +693,7 @@ def make_config(vals):
         config_image = run_bootloader(vals, config_image)
         config.append(['bootloader', vals.bootloader])
         if vals.bootargs:
-            config.append(['bootloader_args'], vals.bootargs)
+            config.append(['bootloader_args', vals.bootargs])
     config.append(['image', config_image])
 
     config_devs = []
diff -r 914c44d10c8d -r 2bfd19fc1b79 tools/python/xen/xm/dry-run.py
--- a/tools/python/xen/xm/dry-run.py    Sun Oct 01 11:39:41 2006 -0600
+++ b/tools/python/xen/xm/dry-run.py    Sun Oct 01 19:10:18 2006 -0600
@@ -32,27 +32,26 @@ def help():
     individually along with the final security decision."""
 
 def main (argv):
-    try:
-        if len(argv) != 2:
-            raise OptionError('Invalid number of arguments')
-
-        passed = 0
-        (opts, config) = create.parseCommandLine(argv)
-        if create.check_domain_label(config, verbose=1):
-            if create.config_security_check(config, verbose=1):
-                passed = 1
-        else:
-            print "Checking resources: (skipped)"
-                
-        if passed:
-            print "Dry Run: PASSED"
-        else:
-            print "Dry Run: FAILED"
-            sys.exit(-1)
-
-    except security.ACMError:
+    if len(argv) != 2:
+        raise OptionError('Invalid number of arguments')
+    
+    passed = 0
+    (opts, config) = create.parseCommandLine(argv)
+    if create.check_domain_label(config, verbose=1):
+        if create.config_security_check(config, verbose=1):
+            passed = 1
+    else:
+        print "Checking resources: (skipped)"
+        
+    if passed:
+        print "Dry Run: PASSED"
+    else:
+        print "Dry Run: FAILED"
         sys.exit(-1)
 
-
 if __name__ == '__main__':
-    main(sys.argv)
+    try:
+        main(sys.argv)
+    except Exception, e:
+        sys.stderr.write('Error: %s\n' % str(e))
+        sys.exit(-1)
diff -r 914c44d10c8d -r 2bfd19fc1b79 tools/python/xen/xm/dumppolicy.py
--- a/tools/python/xen/xm/dumppolicy.py Sun Oct 01 11:39:41 2006 -0600
+++ b/tools/python/xen/xm/dumppolicy.py Sun Oct 01 19:10:18 2006 -0600
@@ -19,7 +19,7 @@
 """
 import sys
 from xen.util.security import ACMError, err, dump_policy
-
+from xen.xm.opts import OptionError
 
 def help():
     return """
@@ -27,16 +27,16 @@ def help():
     (low-level)."""
 
 def main(argv):
+    if len(argv) != 1:
+        raise OptionError("No arguments expected.")
+
+    dump_policy()
+
+if __name__ == '__main__':
     try:
-        if len(argv) != 1:
-            usage()
-
-        dump_policy()
-    except ACMError:
+        main(sys.argv)
+    except Exception, e:
+        sys.stderr.write('Error: %s\n' % str(e))    
         sys.exit(-1)
 
 
-if __name__ == '__main__':
-    main(sys.argv)
-
-
diff -r 914c44d10c8d -r 2bfd19fc1b79 tools/python/xen/xm/getlabel.py
--- a/tools/python/xen/xm/getlabel.py   Sun Oct 01 11:39:41 2006 -0600
+++ b/tools/python/xen/xm/getlabel.py   Sun Oct 01 19:10:18 2006 -0600
@@ -25,8 +25,9 @@ from xen.xm.opts import OptionError
 
 def help():
     return """
-    Usage: xm getlabel dom <configfile>"
-           xm getlabel res <resource>\n"
+    Usage: xm getlabel dom <configfile>
+           xm getlabel res <resource>
+           
     This program shows the label for a domain or resource."""
 
 def get_resource_label(resource):
@@ -37,7 +38,7 @@ def get_resource_label(resource):
     try:
         access_control = dictio.dict_read("resources", file)
     except:
-        security.err("Resource label file not found")
+        raise OptionError("Resource label file not found")
 
     # get the entry and print label
     if access_control.has_key(resource):
@@ -45,23 +46,22 @@ def get_resource_label(resource):
         label = access_control[resource][1]
         print "policy="+policy+",label="+label
     else:
-        security.err("Resource not labeled")
+        raise security.ACMError("Resource not labeled")
 
 
 def get_domain_label(configfile):
     # open the domain config file
     fd = None
-    file = None
     if configfile[0] == '/':
         fd = open(configfile, "rb")
     else:
         for prefix in [".", "/etc/xen"]:
-            file = prefix + "/" + configfile
-            if os.path.isfile(file):
-                fd = open(file, "rb")
+            abs_file = prefix + "/" + configfile
+            if os.path.isfile(abs_file):
+                fd = open(abs_file, "rb")
                 break
     if not fd:
-        security.err("Configuration file '"+configfile+"' not found.")
+        raise OptionError("Configuration file '%s' not found." % configfile)
 
     # read in the domain config file, finding the label line
     ac_entry_re = re.compile("^access_control\s*=.*", re.IGNORECASE)
@@ -79,7 +79,7 @@ def get_domain_label(configfile):
 
     # send error message if we didn't find anything
     if acline == "":
-        security.err("Domain not labeled")
+        raise security.ACMError("Domain not labeled")
 
     # print out the label
     (title, data) = acline.split("=", 1)
@@ -89,7 +89,7 @@ def get_domain_label(configfile):
     print data
 
 
-def main (argv):
+def main(argv):
     if len(argv) != 3:
         raise OptionError('Requires 2 arguments')
 
@@ -103,6 +103,11 @@ def main (argv):
         raise OptionError('First subcommand argument must be "dom" or "res"')
 
 if __name__ == '__main__':
-    main(sys.argv)
+    try:
+        main(sys.argv)
+    except Exception, e:
+        sys.stderr.write('Error: %s\n' % str(e))
+        sys.exit(-1)
+        
 
 
diff -r 914c44d10c8d -r 2bfd19fc1b79 tools/python/xen/xm/loadpolicy.py
--- a/tools/python/xen/xm/loadpolicy.py Sun Oct 01 11:39:41 2006 -0600
+++ b/tools/python/xen/xm/loadpolicy.py Sun Oct 01 19:10:18 2006 -0600
@@ -31,15 +31,12 @@ def main(argv):
     if len(argv) != 2:
         raise OptionError('No policy defined')
     
-    try:
-        load_policy(argv[1])
-
-    except ACMError:
-        sys.exit(-1)
-    except:
-        traceback.print_exc(limit = 1)
+    load_policy(argv[1])
 
 if __name__ == '__main__':
-    main(sys.argv)
-
-
+    try:
+        main(sys.argv)
+    except Exception, e:
+        sys.stderr.write('Error: %s\n' % str(e))
+        sys.exit(-1)
+        
diff -r 914c44d10c8d -r 2bfd19fc1b79 tools/python/xen/xm/main.py
--- a/tools/python/xen/xm/main.py       Sun Oct 01 11:39:41 2006 -0600
+++ b/tools/python/xen/xm/main.py       Sun Oct 01 19:10:18 2006 -0600
@@ -526,7 +526,7 @@ def parse_sedf_info(info):
         return t(sxp.child_value(info, n, d))
 
     return {
-        'domid'    : get_info('domid',         int,   -1),
+        'domid'    : get_info('domain',        int,   -1),
         'period'   : get_info('period',        int,   -1),
         'slice'    : get_info('slice',         int,   -1),
         'latency'  : get_info('latency',       int,   -1),
@@ -979,7 +979,7 @@ def xm_uptime(args):
 
     for dom in doms:
         d = parse_doms_info(dom)
-        if d['dom'] > 0:
+        if d['domid'] > 0:
             uptime = int(round(d['up_time']))
         else:
             f=open('/proc/uptime', 'r')
@@ -1006,10 +1006,10 @@ def xm_uptime(args):
         if short_mode:
             now = datetime.datetime.now()
             upstring = now.strftime(" %H:%M:%S") + " up " + upstring
-            upstring += ", " + d['name'] + " (" + str(d['dom']) + ")"
+            upstring += ", " + d['name'] + " (" + str(d['domid']) + ")"
         else:
             upstring += ':%(seconds)02d' % vars()
-            upstring = ("%(name)-32s %(dom)3d " % d) + upstring
+            upstring = ("%(name)-32s %(domid)3d " % d) + upstring
 
         print upstring
 
@@ -1374,7 +1374,7 @@ IMPORTED_COMMANDS = [
     'cfgbootpolicy',
     'makepolicy',
     'loadpolicy',
-    'dumppolicy'
+    'dumppolicy',
     'rmlabel',
     'getlabel',
     'dry-run',
@@ -1423,13 +1423,14 @@ def main(argv=sys.argv):
     if len(argv) < 2:
         usage()
 
-    # intercept --help and output our own help
-    if '--help' in argv[1:]:
-        if '--help' == argv[1]:
-            longHelp()
-        else:
-            usage(argv[1])
-        sys.exit(0)
+    # intercept --help(-h) and output our own help
+    for help in ['--help', '-h']:
+        if help in argv[1:]:
+            if help == argv[1]:
+                longHelp()
+            else:
+                usage(argv[1])
+            sys.exit(0)
 
     cmd = xm_lookup_cmd(argv[1])
 
@@ -1477,10 +1478,15 @@ def main(argv=sys.argv):
         except (ValueError, OverflowError):
             err("Invalid argument.")
             usage(argv[1])
+            sys.exit(1)
         except OptionError, e:
             err(str(e))
             usage(argv[1])
             print e.usage()
+            sys.exit(1)
+        except security.ACMError, e:
+            err(str(e))
+            sys.exit(1)
         except:
             print "Unexpected error:", sys.exc_info()[0]
             print
diff -r 914c44d10c8d -r 2bfd19fc1b79 tools/python/xen/xm/makepolicy.py
--- a/tools/python/xen/xm/makepolicy.py Sun Oct 01 11:39:41 2006 -0600
+++ b/tools/python/xen/xm/makepolicy.py Sun Oct 01 19:10:18 2006 -0600
@@ -33,16 +33,13 @@ def main(argv):
     if len(argv) != 2:
         raise OptionError('No XML policy file specified')
 
+    make_policy(argv[1])
+
+if __name__ == '__main__':
     try:
-        make_policy(argv[1])
-    except ACMError:
-        sys.exit(-1)
-    except:
-        traceback.print_exc(limit=1)
+        main(sys.argv)
+    except Exception, e:
+        sys.stderr.write('Error: %s\n' % str(e))
         sys.exit(-1)
 
 
-if __name__ == '__main__':
-    main(sys.argv)
-
-
diff -r 914c44d10c8d -r 2bfd19fc1b79 tools/python/xen/xm/resources.py
--- a/tools/python/xen/xm/resources.py  Sun Oct 01 11:39:41 2006 -0600
+++ b/tools/python/xen/xm/resources.py  Sun Oct 01 19:10:18 2006 -0600
@@ -24,7 +24,7 @@ from xen.xm.opts import OptionError
 from xen.xm.opts import OptionError
 
 def help():
-    return """Usage: xm resource
+    return """
     This program lists information for each resource in the
     global resource label file."""
 
@@ -45,18 +45,13 @@ def main (argv):
         filename = security.res_label_filename
         access_control = dictio.dict_read("resources", filename)
     except:
-        print "Resource file not found."
-        return
+        raise OptionError("Resource file not found")
 
-        try:
-            file = security.res_label_filename
-            access_control = dictio.dict_read("resources", file)
-        except:
-            security.err("Error reading resource file.")
-
-        print_resource_data(access_control)
+    print_resource_data(access_control)
 
 if __name__ == '__main__':
-    main(sys.argv)
-
-
+    try:
+        main(sys.argv)
+    except Exception, e:
+        sys.stderr.write('Error: %s\n' % str(e))
+        sys.exit(-1)    
diff -r 914c44d10c8d -r 2bfd19fc1b79 tools/python/xen/xm/rmlabel.py
--- a/tools/python/xen/xm/rmlabel.py    Sun Oct 01 11:39:41 2006 -0600
+++ b/tools/python/xen/xm/rmlabel.py    Sun Oct 01 19:10:18 2006 -0600
@@ -42,14 +42,14 @@ def rm_resource_label(resource):
     try:
         access_control = dictio.dict_read("resources", file)
     except:
-        security.err("Resource file not found, cannot remove label!")
+        raise security.ACMError("Resource file not found, cannot remove 
label!")
 
     # remove the entry and update file
     if access_control.has_key(resource):
         del access_control[resource]
         dictio.dict_write(access_control, "resources", file)
     else:
-        security.err("Resource not labeled.")
+        raise security.ACMError("Resource not labeled")
 
 
 def rm_domain_label(configfile):
@@ -65,8 +65,8 @@ def rm_domain_label(configfile):
                 fd = open(file, "rb")
                 break
     if not fd:
-        security.err("Configuration file '"+configfile+"' not found.")
-
+        raise OptionError("Configuration file '%s' not found." % configfile)
+        
     # read in the domain config file, removing label
     ac_entry_re = re.compile("^access_control\s*=.*", re.IGNORECASE)
     ac_exit_re = re.compile(".*'\].*")
@@ -86,7 +86,7 @@ def rm_domain_label(configfile):
 
     # send error message if we didn't find anything to remove
     if not removed:
-        security.err("Domain not labeled.")
+        raise security.ACMError('Domain not labeled')
 
     # write the data back out to the file
     fd = open(file, "wb")
@@ -102,17 +102,18 @@ def main (argv):
     if argv[1].lower() not in ('dom', 'res'):
         raise OptionError('Unrecognised type argument: %s' % argv[1])
 
-    try:
-        if argv[1].lower() == "dom":
-            configfile = argv[2]
-            rm_domain_label(configfile)
-        elif argv[1].lower() == "res":
-            resource = argv[2]
-            rm_resource_label(resource)
-    except security.ACMError:
-        sys.exit(-1)
+    if argv[1].lower() == "dom":
+        configfile = argv[2]
+        rm_domain_label(configfile)
+    elif argv[1].lower() == "res":
+        resource = argv[2]
+        rm_resource_label(resource)
 
 if __name__ == '__main__':
-    main(sys.argv)
+    try:
+        main(sys.argv)
+    except Exception, e:
+        sys.stderr.write('Error: %s\n' % str(e))
+        sys.exit(-1)    
 
 
diff -r 914c44d10c8d -r 2bfd19fc1b79 tools/xm-test/tests/vtpm/vtpm_utils.py
--- a/tools/xm-test/tests/vtpm/vtpm_utils.py    Sun Oct 01 11:39:41 2006 -0600
+++ b/tools/xm-test/tests/vtpm/vtpm_utils.py    Sun Oct 01 19:10:18 2006 -0600
@@ -8,12 +8,10 @@ if ENABLE_HVM_SUPPORT:
 if ENABLE_HVM_SUPPORT:
     SKIP("vtpm tests not supported for HVM domains")
 
-if not os.path.exists("/dev/tpm0"):
-    SKIP("This machine has no hardware TPM; cannot run this test")
-
 status, output = traceCommand("ps aux | grep vtpm_manager | grep -v grep")
 if output == "":
-    FAIL("virtual TPM manager must be started to run this test")
+    SKIP("virtual TPM manager must be started to run this test; might "
+         "need /dev/tpm0")
 
 def vtpm_cleanup(domName):
     traceCommand("/etc/xen/scripts/vtpm-delete %s" % domName)
diff -r 914c44d10c8d -r 2bfd19fc1b79 xen/arch/ia64/Makefile
--- a/xen/arch/ia64/Makefile    Sun Oct 01 11:39:41 2006 -0600
+++ b/xen/arch/ia64/Makefile    Sun Oct 01 19:10:18 2006 -0600
@@ -4,22 +4,27 @@ subdir-y += linux-xen
 subdir-y += linux-xen
 
 $(TARGET)-syms: linux-xen/head.o $(ALL_OBJS) xen.lds.s
+       $(MAKE) -f $(BASEDIR)/Rules.mk $(BASEDIR)/common/symbols-dummy.o
        $(LD) $(LDFLAGS) -T xen.lds.s -N \
-               -Map map.out linux-xen/head.o $(ALL_OBJS) -o $@
+               -Map map.out linux-xen/head.o $(ALL_OBJS) \
+               $(BASEDIR)/common/symbols-dummy.o -o $@
        $(NM) -n $@ | $(BASEDIR)/tools/symbols > $(BASEDIR)/xen-syms.S
        $(MAKE) -f $(BASEDIR)/Rules.mk $(BASEDIR)/xen-syms.o
        $(LD) $(LDFLAGS) -T xen.lds.s -N \
-               -Map map.out linux-xen/head.o $(ALL_OBJS) $(BASEDIR)/xen-syms.o 
-o $@
+               -Map map.out linux-xen/head.o $(ALL_OBJS) \
+               $(BASEDIR)/xen-syms.o -o $@
        $(NM) -n $@ | $(BASEDIR)/tools/symbols >$(BASEDIR)/xen-syms.S
        $(MAKE) -f $(BASEDIR)/Rules.mk $(BASEDIR)/xen-syms.o
        $(LD) $(LDFLAGS) -T xen.lds.s -N \
-               -Map map.out linux-xen/head.o $(ALL_OBJS) $(BASEDIR)/xen-syms.o 
-o $@
+               -Map map.out linux-xen/head.o $(ALL_OBJS) \
+               $(BASEDIR)/xen-syms.o -o $@
        rm -f $(BASEDIR)/xen-syms.S $(BASEDIR)/xen-syms.o
 
 $(TARGET): $(TARGET)-syms
        $(OBJCOPY) -R .note -R .comment -S $(TARGET)-syms $@
-       $(NM) -n $(TARGET)-syms | grep -v '\( [aUw] \)\|\(__crc_\)\|\( 
\$[adt]\)'\
-                > $(BASEDIR)/System.map
+       $(NM) -n $(TARGET)-syms | \
+               grep -v '\( [aUw] \)\|\(__crc_\)\|\( \$[adt]\)' \
+               > $(BASEDIR)/System.map
 
 # Headers do not depend on auto-generated header, but object files do.
 HDRS    := $(subst $(BASEDIR)/include/asm-ia64/asm-xsi-offsets.h,,$(HDRS))
diff -r 914c44d10c8d -r 2bfd19fc1b79 xen/arch/powerpc/Makefile
--- a/xen/arch/powerpc/Makefile Sun Oct 01 11:39:41 2006 -0600
+++ b/xen/arch/powerpc/Makefile Sun Oct 01 19:10:18 2006 -0600
@@ -101,7 +101,8 @@ TARGET_OPTS += start.o $(ALL_OBJS)
 TARGET_OPTS += start.o $(ALL_OBJS)
 
 .xen-syms: start.o $(ALL_OBJS) xen.lds
-       $(CC) $(CFLAGS) $(TARGET_OPTS) -o $@
+       $(MAKE) -f $(BASEDIR)/Rules.mk $(BASEDIR)/common/symbols-dummy.o
+       $(CC) $(CFLAGS) $(TARGET_OPTS) $(BASEDIR)/common/symbols-dummy.o -o $@
 
 NM=$(CROSS_COMPILE)nm
 new_nm := $(shell if $(NM) --help 2>&1 | grep -- '--synthetic' > /dev/null; 
then echo y; else echo n; fi)
diff -r 914c44d10c8d -r 2bfd19fc1b79 xen/arch/x86/Makefile
--- a/xen/arch/x86/Makefile     Sun Oct 01 11:39:41 2006 -0600
+++ b/xen/arch/x86/Makefile     Sun Oct 01 19:10:18 2006 -0600
@@ -46,19 +46,24 @@ obj-$(crash_debug) += gdbstub.o
 
 $(TARGET): $(TARGET)-syms boot/mkelf32
        ./boot/mkelf32 $(TARGET)-syms $(TARGET) 0x100000 \
-       `$(NM) $(TARGET)-syms | sort | tail -n 1 | sed -e 's/^\([^ 
]*\).*/0x\1/'`
+       `$(NM) $(TARGET)-syms | sort | tail -n 1 | \
+        sed -e 's/^\([^ ]*\).*/0x\1/'`
 
 $(TARGET)-syms: boot/$(TARGET_SUBARCH).o $(ALL_OBJS) xen.lds
+       $(MAKE) -f $(BASEDIR)/Rules.mk $(BASEDIR)/common/symbols-dummy.o
        $(LD) $(LDFLAGS) -T xen.lds -N \
-           boot/$(TARGET_SUBARCH).o $(ALL_OBJS) -o $@
+           boot/$(TARGET_SUBARCH).o $(ALL_OBJS) \
+           $(BASEDIR)/common/symbols-dummy.o -o $@
        $(NM) -n $@ | $(BASEDIR)/tools/symbols >$(BASEDIR)/xen-syms.S
        $(MAKE) -f $(BASEDIR)/Rules.mk $(BASEDIR)/xen-syms.o
        $(LD) $(LDFLAGS) -T xen.lds -N \
-           boot/$(TARGET_SUBARCH).o $(ALL_OBJS) $(BASEDIR)/xen-syms.o -o $@
+           boot/$(TARGET_SUBARCH).o $(ALL_OBJS) \
+           $(BASEDIR)/xen-syms.o -o $@
        $(NM) -n $@ | $(BASEDIR)/tools/symbols >$(BASEDIR)/xen-syms.S
        $(MAKE) -f $(BASEDIR)/Rules.mk $(BASEDIR)/xen-syms.o
        $(LD) $(LDFLAGS) -T xen.lds -N \
-           boot/$(TARGET_SUBARCH).o $(ALL_OBJS) $(BASEDIR)/xen-syms.o -o $@
+           boot/$(TARGET_SUBARCH).o $(ALL_OBJS) \
+           $(BASEDIR)/xen-syms.o -o $@
        rm -f $(BASEDIR)/xen-syms.S $(BASEDIR)/xen-syms.o
 
 asm-offsets.s: $(TARGET_SUBARCH)/asm-offsets.c $(HDRS)
diff -r 914c44d10c8d -r 2bfd19fc1b79 xen/arch/x86/domain.c
--- a/xen/arch/x86/domain.c     Sun Oct 01 11:39:41 2006 -0600
+++ b/xen/arch/x86/domain.c     Sun Oct 01 19:10:18 2006 -0600
@@ -334,8 +334,10 @@ int arch_set_info_guest(
     }
     else
     {
-        if ( !get_page_and_type(mfn_to_page(cr3_pfn), d,
-                                PGT_base_page_table) )
+        if ( shadow_mode_refcounts(d)
+             ? !get_page(mfn_to_page(cr3_pfn), d)
+             : !get_page_and_type(mfn_to_page(cr3_pfn), d,
+                                  PGT_base_page_table) )
         {
             destroy_gdt(v);
             return -EINVAL;
@@ -952,7 +954,10 @@ void domain_relinquish_resources(struct 
         pfn = pagetable_get_pfn(v->arch.guest_table_user);
         if ( pfn != 0 )
         {
-            put_page_and_type(mfn_to_page(pfn));
+            if ( shadow_mode_refcounts(d) )
+                put_page(mfn_to_page(pfn));
+            else
+                put_page_and_type(mfn_to_page(pfn));
             v->arch.guest_table_user = pagetable_null();
         }
 #endif
diff -r 914c44d10c8d -r 2bfd19fc1b79 xen/arch/x86/hvm/hvm.c
--- a/xen/arch/x86/hvm/hvm.c    Sun Oct 01 11:39:41 2006 -0600
+++ b/xen/arch/x86/hvm/hvm.c    Sun Oct 01 19:10:18 2006 -0600
@@ -389,42 +389,68 @@ void hvm_hlt(unsigned long rflags)
 }
 
 /*
- * Copy from/to guest virtual.
+ * __hvm_copy():
+ *  @buf  = hypervisor buffer
+ *  @addr = guest virtual or physical address to copy to/from
+ *  @size = number of bytes to copy
+ *  @dir  = copy *to* guest (TRUE) or *from* guest (FALSE)?
+ *  @phy  = interpret addr as physical (TRUE) or virtual (FALSE) address?
+ * Returns number of bytes failed to copy (0 == complete success).
  */
-int hvm_copy(void *buf, unsigned long vaddr, int size, int dir)
+static int __hvm_copy(
+    void *buf, unsigned long addr, int size, int dir, int phy)
 {
     struct vcpu *v = current;
-    unsigned long gfn;
     unsigned long mfn;
-    char *addr;
-    int count;
-
-    while (size > 0) {
-        count = PAGE_SIZE - (vaddr & ~PAGE_MASK);
-        if (count > size)
-            count = size;
-
-        gfn = shadow_gva_to_gfn(v, vaddr);
-        mfn = mfn_x(sh_vcpu_gfn_to_mfn(v, gfn));
-
-        if (mfn == INVALID_MFN)
-            return 0;
-
-        addr = (char *)map_domain_page(mfn) + (vaddr & ~PAGE_MASK);
-
-        if (dir == HVM_COPY_IN)
-            memcpy(buf, addr, count);
+    char *p;
+    int count, todo;
+
+    todo = size;
+    while ( todo > 0 )
+    {
+        count = min_t(int, PAGE_SIZE - (addr & ~PAGE_MASK), todo);
+
+        mfn = phy ? 
+            get_mfn_from_gpfn(addr >> PAGE_SHIFT) :
+            mfn_x(sh_vcpu_gfn_to_mfn(v, shadow_gva_to_gfn(v, addr)));
+        if ( mfn == INVALID_MFN )
+            return todo;
+
+        p = (char *)map_domain_page(mfn) + (addr & ~PAGE_MASK);
+
+        if ( dir )
+            memcpy(p, buf, count); /* dir == TRUE:  *to* guest */
         else
-            memcpy(addr, buf, count);
-
-        unmap_domain_page(addr);
-
-        vaddr += count;
-        buf += count;
-        size -= count;
-    }
-
-    return 1;
+            memcpy(buf, p, count); /* dir == FALSE: *from guest */
+
+        unmap_domain_page(p);
+
+        addr += count;
+        buf  += count;
+        todo -= count;
+    }
+
+    return 0;
+}
+
+int hvm_copy_to_guest_phys(unsigned long paddr, void *buf, int size)
+{
+    return __hvm_copy(buf, paddr, size, 1, 1);
+}
+
+int hvm_copy_from_guest_phys(void *buf, unsigned long paddr, int size)
+{
+    return __hvm_copy(buf, paddr, size, 0, 1);
+}
+
+int hvm_copy_to_guest_virt(unsigned long vaddr, void *buf, int size)
+{
+    return __hvm_copy(buf, vaddr, size, 1, 0);
+}
+
+int hvm_copy_from_guest_virt(void *buf, unsigned long vaddr, int size)
+{
+    return __hvm_copy(buf, vaddr, size, 0, 0);
 }
 
 /*
diff -r 914c44d10c8d -r 2bfd19fc1b79 xen/arch/x86/hvm/i8259.c
--- a/xen/arch/x86/hvm/i8259.c  Sun Oct 01 11:39:41 2006 -0600
+++ b/xen/arch/x86/hvm/i8259.c  Sun Oct 01 19:10:18 2006 -0600
@@ -86,7 +86,7 @@ static int pic_get_irq(PicState *s)
 
     ASSERT(spin_is_locked(&s->pics_state->lock));
 
-    mask = s->irr & ~s->imr;
+    mask = (s->irr|s->irr_xen) & ~s->imr;
     priority = get_priority(s, mask);
     if (priority == 8)
         return -1;
@@ -128,6 +128,32 @@ void pic_update_irq(struct hvm_virpic *s
     }
 }
 
+void pic_set_xen_irq(void *opaque, int irq, int level)
+{
+    struct hvm_virpic *s = opaque;
+    unsigned long flags;
+    PicState *ps;
+
+    spin_lock_irqsave(&s->lock, flags);
+
+    hvm_vioapic_set_xen_irq(current->domain, irq, level);
+
+    /* Set it on the 8259s */
+    ps = &s->pics[irq >> 3];
+    if (!(ps->elcr & (1 << (irq & 7)))) {
+       DPRINTK("edge-triggered override IRQ?\n");
+       domain_crash(current->domain);
+    }
+    if (level) {
+       ps->irr_xen |= 1 << (irq & 7);
+    } else {
+       ps->irr_xen &= ~(1 << (irq & 7));
+    }
+
+    pic_update_irq(s);
+    spin_unlock_irqrestore(&s->lock, flags);
+}
+
 void pic_set_irq_new(void *opaque, int irq, int level)
 {
     struct hvm_virpic *s = opaque;
@@ -136,9 +162,6 @@ void pic_set_irq_new(void *opaque, int i
     spin_lock_irqsave(&s->lock, flags);
     hvm_vioapic_set_irq(current->domain, irq, level);
     pic_set_irq1(&s->pics[irq >> 3], irq & 7, level);
-    /* used for IOAPIC irqs */
-    if (s->alt_irq_func)
-        s->alt_irq_func(s->alt_irq_opaque, irq, level);
     pic_update_irq(s);
     spin_unlock_irqrestore(&s->lock, flags);
 }
@@ -371,6 +394,7 @@ static uint32_t pic_poll_read (PicState 
             s->pics_state->pics[0].irr &= ~(1 << 2);
         }
         s->irr &= ~(1 << ret);
+        s->irr_xen &= ~(1 << ret);
         s->isr &= ~(1 << ret);
         if (addr1 >> 7 || ret != 2)
             pic_update_irq(s->pics_state);
@@ -400,7 +424,7 @@ static uint32_t pic_ioport_read(void *op
             if (s->read_reg_select)
                 ret = s->isr;
             else
-                ret = s->irr;
+                ret = s->irr | s->irr_xen;
         } else {
             ret = s->imr;
         }
@@ -472,18 +496,6 @@ void pic_init(struct hvm_virpic *s, void
     s->irq_request_opaque = irq_request_opaque;
 }
 
-void pic_set_alt_irq_func(struct hvm_virpic *s,
-                          void (*alt_irq_func)(void *, int, int),
-                          void *alt_irq_opaque)
-{
-    unsigned long flags;
-
-    spin_lock_irqsave(&s->lock, flags);
-    s->alt_irq_func = alt_irq_func;
-    s->alt_irq_opaque = alt_irq_opaque;
-    spin_unlock_irqrestore(&s->lock, flags);
-}
-
 static int intercept_pic_io(ioreq_t *p)
 {
     struct hvm_virpic  *pic;
@@ -497,8 +509,9 @@ static int intercept_pic_io(ioreq_t *p)
     }
     pic = &v->domain->arch.hvm_domain.vpic;
     if ( p->dir == 0 ) {
-        if(p->pdata_valid) 
-            hvm_copy(&data, (unsigned long)p->u.pdata, p->size, HVM_COPY_IN);
+        if (p->pdata_valid) 
+            (void)hvm_copy_from_guest_virt(
+                &data, (unsigned long)p->u.pdata, p->size);
         else
             data = p->u.data;
         spin_lock_irqsave(&pic->lock, flags);
@@ -511,8 +524,9 @@ static int intercept_pic_io(ioreq_t *p)
         data = pic_ioport_read(
             (void*)&pic->pics[p->addr>>7], (uint32_t) p->addr);
         spin_unlock_irqrestore(&pic->lock, flags);
-        if(p->pdata_valid) 
-            hvm_copy(&data, (unsigned long)p->u.pdata, p->size, HVM_COPY_OUT);
+        if (p->pdata_valid) 
+            (void)hvm_copy_to_guest_virt(
+                (unsigned long)p->u.pdata, &data, p->size);
         else 
             p->u.data = (u64)data;
     }
@@ -533,8 +547,9 @@ static int intercept_elcr_io(ioreq_t *p)
 
     s = &v->domain->arch.hvm_domain.vpic;
     if ( p->dir == 0 ) {
-        if(p->pdata_valid) 
-            hvm_copy(&data, (unsigned long)p->u.pdata, p->size, HVM_COPY_IN);
+        if (p->pdata_valid) 
+            (void)hvm_copy_from_guest_virt(
+                &data, (unsigned long)p->u.pdata, p->size);
         else
             data = p->u.data;
         spin_lock_irqsave(&s->lock, flags);
@@ -547,8 +562,9 @@ static int intercept_elcr_io(ioreq_t *p)
     else {
         data = (u64) elcr_ioport_read(
                 (void*)&s->pics[p->addr&1], (uint32_t) p->addr);
-        if(p->pdata_valid) 
-            hvm_copy(&data, (unsigned long)p->u.pdata, p->size, HVM_COPY_OUT);
+        if (p->pdata_valid) 
+            (void)hvm_copy_to_guest_virt(
+                (unsigned long)p->u.pdata, &data, p->size);
         else 
             p->u.data = (u64)data;
 
diff -r 914c44d10c8d -r 2bfd19fc1b79 xen/arch/x86/hvm/instrlen.c
--- a/xen/arch/x86/hvm/instrlen.c       Sun Oct 01 11:39:41 2006 -0600
+++ b/xen/arch/x86/hvm/instrlen.c       Sun Oct 01 19:10:18 2006 -0600
@@ -196,26 +196,17 @@ static uint8_t twobyte_table[256] = {
 
 /* 
  * insn_fetch - fetch the next 1 to 4 bytes from instruction stream 
- * 
  * @_type:   u8, u16, u32, s8, s16, or s32
  * @_size:   1, 2, or 4 bytes
- * @_eip:    address to fetch from guest memory
- * @_length: increments the current instruction length counter by _size
- *
- * This is used internally by hvm_instruction_length to fetch the next byte,
- * word, or dword from guest memory at location _eip.  we currently use a local
- * unsigned long as the storage buffer since the most bytes we're gonna get
- * is limited to 4.
- */
-#define insn_fetch(_type, _size, _eip, _length)                         \
-({  unsigned long _x;                                                   \
-        if ((rc = inst_copy_from_guest((unsigned char *)(&(_x)),        \
-                (unsigned long)(_eip), _size))                          \
-                    != _size)                                           \
-        goto done;                                                      \
-    (_eip) += (_size);                                                  \
-    (_length) += (_size);                                               \
-    (_type)_x;                                                          \
+ */
+#define insn_fetch(_type, _size)                                        \
+({ unsigned long _x, _ptr = _regs.eip;                                  \
+   if ( mode == X86EMUL_MODE_REAL ) _ptr += _regs.cs << 4;              \
+   rc = inst_copy_from_guest((unsigned char *)(&(_x)), _ptr, _size);    \
+   if ( rc != _size ) goto done;                                        \
+   _regs.eip += (_size);                                                \
+   length += (_size);                                                   \
+   (_type)_x;                                                           \
 })
 
 /**
@@ -231,17 +222,13 @@ int hvm_instruction_length(struct cpu_us
 {
     uint8_t b, d, twobyte = 0, rex_prefix = 0;
     uint8_t modrm, modrm_mod = 0, modrm_reg = 0, modrm_rm = 0;
-    unsigned int op_bytes, ad_bytes, lock_prefix = 0, rep_prefix = 0, i;
+    unsigned int op_bytes, ad_bytes, i;
     int rc = 0;
     int length = 0;
     unsigned int tmp;
 
     /* Shadow copy of register state. Committed on successful emulation. */
     struct cpu_user_regs _regs = *regs;
-
-    /* include CS for 16-bit modes */
-    if (mode == X86EMUL_MODE_REAL || mode == X86EMUL_MODE_PROT16)
-        _regs.eip += (_regs.cs << 4);
 
     switch ( mode )
     {
@@ -265,7 +252,7 @@ int hvm_instruction_length(struct cpu_us
     /* Legacy prefixes. */
     for ( i = 0; i < 8; i++ )
     {
-        switch ( b = insn_fetch(uint8_t, 1, _regs.eip, length) )
+        switch ( b = insn_fetch(uint8_t, 1) )
         {
         case 0x66: /* operand-size override */
             op_bytes ^= 6;      /* switch between 2/4 bytes */
@@ -282,13 +269,8 @@ int hvm_instruction_length(struct cpu_us
         case 0x64: /* FS override */
         case 0x65: /* GS override */
         case 0x36: /* SS override */
-            break;
         case 0xf0: /* LOCK */
-            lock_prefix = 1;
-            break;
         case 0xf3: /* REP/REPE/REPZ */
-            rep_prefix = 1;
-            break;
         case 0xf2: /* REPNE/REPNZ */
             break;
         default:
@@ -296,12 +278,6 @@ int hvm_instruction_length(struct cpu_us
         }
     }
 done_prefixes:
-
-    /* Note quite the same as 80386 real mode, but hopefully good enough. */
-    if ( (mode == X86EMUL_MODE_REAL) && (ad_bytes != 2) ) {
-        printf("sonofabitch!! we don't support 32-bit addresses in 
realmode\n");
-        goto cannot_emulate;
-    }
 
     /* REX prefix. */
     if ( (mode == X86EMUL_MODE_PROT64) && ((b & 0xf0) == 0x40) )
@@ -311,7 +287,7 @@ done_prefixes:
             op_bytes = 8;          /* REX.W */
         modrm_reg = (b & 4) << 1;  /* REX.R */
         /* REX.B and REX.X do not need to be decoded. */
-        b = insn_fetch(uint8_t, 1, _regs.eip, length);
+        b = insn_fetch(uint8_t, 1);
     }
 
     /* Opcode byte(s). */
@@ -322,7 +298,7 @@ done_prefixes:
         if ( b == 0x0f )
         {
             twobyte = 1;
-            b = insn_fetch(uint8_t, 1, _regs.eip, length);
+            b = insn_fetch(uint8_t, 1);
             d = twobyte_table[b];
         }
 
@@ -334,7 +310,7 @@ done_prefixes:
     /* ModRM and SIB bytes. */
     if ( d & ModRM )
     {
-        modrm = insn_fetch(uint8_t, 1, _regs.eip, length);
+        modrm = insn_fetch(uint8_t, 1);
         modrm_mod |= (modrm & 0xc0) >> 6;
         modrm_reg |= (modrm & 0x38) >> 3;
         modrm_rm  |= (modrm & 0x07);
@@ -374,7 +350,7 @@ done_prefixes:
             {
             case 0:
                 if ( (modrm_rm == 4) && 
-                     (((insn_fetch(uint8_t, 1, _regs.eip, length)) & 7) 
+                     (((insn_fetch(uint8_t, 1)) & 7) 
                         == 5) )
                 {
                     length += 4;
@@ -389,7 +365,7 @@ done_prefixes:
             case 1:
                 if ( modrm_rm == 4 )
                 {
-                    insn_fetch(uint8_t, 1, _regs.eip, length);
+                    insn_fetch(uint8_t, 1);
                 }
                 length += 1;
                 _regs.eip += 1; /* skip disp8 */
@@ -397,7 +373,7 @@ done_prefixes:
             case 2:
                 if ( modrm_rm == 4 )
                 {
-                    insn_fetch(uint8_t, 1, _regs.eip, length);
+                    insn_fetch(uint8_t, 1);
                 }
                 length += 4;
                 _regs.eip += 4; /* skip disp32 */
@@ -423,13 +399,13 @@ done_prefixes:
         /* NB. Immediates are sign-extended as necessary. */
         switch ( tmp )
         {
-        case 1: insn_fetch(int8_t,  1, _regs.eip, length); break;
-        case 2: insn_fetch(int16_t, 2, _regs.eip, length); break;
-        case 4: insn_fetch(int32_t, 4, _regs.eip, length); break;
+        case 1: insn_fetch(int8_t,  1); break;
+        case 2: insn_fetch(int16_t, 2); break;
+        case 4: insn_fetch(int32_t, 4); break;
         }
         break;
     case SrcImmByte:
-        insn_fetch(int8_t,  1, _regs.eip, length);
+        insn_fetch(int8_t,  1);
         break;
     }
 
@@ -455,9 +431,9 @@ done_prefixes:
             if ( tmp == 8 ) tmp = 4;
             switch ( tmp )
             {
-            case 1: insn_fetch(int8_t,  1, _regs.eip, length); break;
-            case 2: insn_fetch(int16_t, 2, _regs.eip, length); break;
-            case 4: insn_fetch(int32_t, 4, _regs.eip, length); break;
+            case 1: insn_fetch(int8_t,  1); break;
+            case 2: insn_fetch(int16_t, 2); break;
+            case 4: insn_fetch(int32_t, 4); break;
             }
             goto done;
         }
diff -r 914c44d10c8d -r 2bfd19fc1b79 xen/arch/x86/hvm/intercept.c
--- a/xen/arch/x86/hvm/intercept.c      Sun Oct 01 11:39:41 2006 -0600
+++ b/xen/arch/x86/hvm/intercept.c      Sun Oct 01 19:10:18 2006 -0600
@@ -90,17 +90,17 @@ static inline void hvm_mmio_access(struc
                     data = read_handler(v,
                       req->addr + (sign * i * req->size),
                       req->size);
-                    hvm_copy(&data,
-                      (unsigned long)p->u.pdata + (sign * i * req->size),
-                      p->size,
-                      HVM_COPY_OUT);
+                    (void)hvm_copy_to_guest_virt(
+                        (unsigned long)p->u.pdata + (sign * i * req->size),
+                        &data,
+                        p->size);
                 }
             } else {                  /* !req->dir == IOREQ_READ */
                 for (i = 0; i < req->count; i++) {
-                    hvm_copy(&data,
-                      (unsigned long)p->u.pdata + (sign * i * req->size),
-                      p->size,
-                      HVM_COPY_IN);
+                    (void)hvm_copy_from_guest_virt(
+                        &data,
+                        (unsigned long)p->u.pdata + (sign * i * req->size),
+                        p->size);
                     write_handler(v,
                       req->addr + (sign * i * req->size),
                       req->size, data);
diff -r 914c44d10c8d -r 2bfd19fc1b79 xen/arch/x86/hvm/io.c
--- a/xen/arch/x86/hvm/io.c     Sun Oct 01 11:39:41 2006 -0600
+++ b/xen/arch/x86/hvm/io.c     Sun Oct 01 19:10:18 2006 -0600
@@ -379,7 +379,7 @@ static void hvm_pio_assist(struct cpu_us
                     addr += regs->es << 4;
                 if (sign > 0)
                     addr -= p->size;
-                hvm_copy(&p->u.data, addr, p->size, HVM_COPY_OUT);
+                (void)hvm_copy_to_guest_virt(addr, &p->u.data, p->size);
             }
         }
         else /* p->dir == IOREQ_WRITE */
@@ -493,7 +493,7 @@ static void hvm_mmio_assist(struct cpu_u
 
             if (sign > 0)
                 addr -= p->size;
-            hvm_copy(&p->u.data, addr, p->size, HVM_COPY_OUT);
+            (void)hvm_copy_to_guest_virt(addr, &p->u.data, p->size);
         }
 
         if (mmio_opp->flags & REPZ)
@@ -596,6 +596,7 @@ static void hvm_mmio_assist(struct cpu_u
         break;
 
     case INSTR_CMP:
+    case INSTR_SUB:
         if (src & REGISTER) {
             index = operand_index(src);
             value = get_reg_value(size, index, 0, regs);
@@ -607,6 +608,8 @@ static void hvm_mmio_assist(struct cpu_u
             index = operand_index(dst);
             value = get_reg_value(size, index, 0, regs);
             diff = value - (unsigned long) p->u.data;
+            if ( mmio_opp->instr == INSTR_SUB )
+                set_reg_value(size, index, 0, regs, diff);
         }
 
         /*
diff -r 914c44d10c8d -r 2bfd19fc1b79 xen/arch/x86/hvm/platform.c
--- a/xen/arch/x86/hvm/platform.c       Sun Oct 01 11:39:41 2006 -0600
+++ b/xen/arch/x86/hvm/platform.c       Sun Oct 01 19:10:18 2006 -0600
@@ -394,6 +394,11 @@ static int hvm_decode(int realmode, unsi
         GET_OP_SIZE_FOR_NONEBYTE(instr->op_size);
         return mem_reg(instr->op_size, opcode, instr, rex);
 
+    case 0x2B: /* sub m32/16, r32/16 */
+        instr->instr = INSTR_SUB;
+        GET_OP_SIZE_FOR_NONEBYTE(instr->op_size);
+        return mem_reg(instr->op_size, opcode, instr, rex);
+
     case 0x30: /* xor r8, m8 */
         instr->instr = INSTR_XOR;
         instr->op_size = BYTE;
@@ -689,7 +694,7 @@ int inst_copy_from_guest(unsigned char *
 {
     if (inst_len > MAX_INST_LEN || inst_len <= 0)
         return 0;
-    if (!hvm_copy(buf, guest_eip, inst_len, HVM_COPY_IN))
+    if (hvm_copy_from_guest_virt(buf, guest_eip, inst_len))
         return 0;
     return inst_len;
 }
@@ -953,7 +958,7 @@ void handle_mmio(unsigned long va, unsig
             regs->eip -= inst_len; /* do not advance %eip */
 
             if (dir == IOREQ_WRITE)
-                hvm_copy(&value, addr, size, HVM_COPY_IN);
+                (void)hvm_copy_from_guest_virt(&value, addr, size);
             send_mmio_req(IOREQ_TYPE_COPY, gpa, 1, size, value, dir, 0);
         } else {
             if ((addr & PAGE_MASK) != ((addr + sign * (count * size - 1)) & 
PAGE_MASK)) {
@@ -1011,6 +1016,7 @@ void handle_mmio(unsigned long va, unsig
 
     case INSTR_CMP:        /* Pass through */
     case INSTR_TEST:
+    case INSTR_SUB:
         mmio_opp->flags = mmio_inst.flags;
         mmio_opp->instr = mmio_inst.instr;
         mmio_opp->operand[0] = mmio_inst.operand[0]; /* source */
@@ -1094,7 +1100,7 @@ unsigned long copy_to_user_hvm(void *to,
         return 0;
     }
 
-    return !hvm_copy((void *)from, (unsigned long)to, len, HVM_COPY_OUT);
+    return hvm_copy_to_guest_virt((unsigned long)to, (void *)from, len);
 }
 
 unsigned long copy_from_user_hvm(void *to, const void *from, unsigned len)
@@ -1105,7 +1111,7 @@ unsigned long copy_from_user_hvm(void *t
         return 0;
     }
 
-    return !hvm_copy(to, (unsigned long)from, len, HVM_COPY_IN);
+    return hvm_copy_from_guest_virt(to, (unsigned long)from, len);
 }
 
 /*
diff -r 914c44d10c8d -r 2bfd19fc1b79 xen/arch/x86/hvm/svm/emulate.c
--- a/xen/arch/x86/hvm/svm/emulate.c    Sun Oct 01 11:39:41 2006 -0600
+++ b/xen/arch/x86/hvm/svm/emulate.c    Sun Oct 01 19:10:18 2006 -0600
@@ -341,7 +341,11 @@ unsigned long svm_rip2pointer(struct vmc
      * %cs is update, but fortunately, base contain the valid base address
      * no matter what kind of addressing is used.
      */
-    return vmcb->cs.base + vmcb->rip;
+    unsigned long p = vmcb->cs.base + vmcb->rip;
+    if (!(vmcb->cs.attributes.fields.l && vmcb->efer & EFER_LMA))
+        return (u32)p; /* mask to 32 bits */
+    /* NB. Should mask to 16 bits if in real mode or 16-bit protected mode. */
+    return p;
 }
 
 
diff -r 914c44d10c8d -r 2bfd19fc1b79 xen/arch/x86/hvm/svm/intr.c
--- a/xen/arch/x86/hvm/svm/intr.c       Sun Oct 01 11:39:41 2006 -0600
+++ b/xen/arch/x86/hvm/svm/intr.c       Sun Oct 01 19:10:18 2006 -0600
@@ -74,7 +74,6 @@ asmlinkage void svm_intr_assist(void)
     int intr_type = APIC_DM_EXTINT;
     int intr_vector = -1;
     int re_injecting = 0;
-    unsigned long rflags;
 
     ASSERT(vmcb);
 
@@ -87,14 +86,6 @@ asmlinkage void svm_intr_assist(void)
         re_injecting = 1;
     }
 
-    /* Guest's interrputs masked? */
-    rflags = vmcb->rflags;
-    if (irq_masked(rflags)) {
-        HVM_DBG_LOG(DBG_LEVEL_1, "Guest IRQs masked: rflags: %lx", rflags);
-        /* bail out, we won't be injecting an interrupt this time */
-        return;
-    }
-    
     /* Previous interrupt still pending? */
     if (vmcb->vintr.fields.irq) {
 //        printk("Re-injecting IRQ from Vintr\n");
@@ -121,13 +112,11 @@ asmlinkage void svm_intr_assist(void)
           pic_set_irq(pic, pt->irq, 1);
       }
 
-      callback_irq = v->domain->arch.hvm_domain.params[HVM_PARAM_CALLBACK_IRQ];
-      if ( callback_irq != 0 &&
-           local_events_need_delivery() ) {
-          /*inject para-device call back irq*/
-          v->vcpu_info->evtchn_upcall_mask = 1;
-          pic_set_irq(pic, callback_irq, 0);
-          pic_set_irq(pic, callback_irq, 1);
+      if (v->vcpu_id == 0) {
+          callback_irq =
+              v->domain->arch.hvm_domain.params[HVM_PARAM_CALLBACK_IRQ];
+          if ( callback_irq != 0)
+              pic_set_xen_irq(pic, callback_irq, local_events_need_delivery());
       }
 
       if ( cpu_has_pending_irq(v) )
diff -r 914c44d10c8d -r 2bfd19fc1b79 xen/arch/x86/hvm/svm/svm.c
--- a/xen/arch/x86/hvm/svm/svm.c        Sun Oct 01 11:39:41 2006 -0600
+++ b/xen/arch/x86/hvm/svm/svm.c        Sun Oct 01 19:10:18 2006 -0600
@@ -57,7 +57,7 @@ extern void do_nmi(struct cpu_user_regs 
 extern void do_nmi(struct cpu_user_regs *, unsigned long);
 extern int inst_copy_from_guest(unsigned char *buf, unsigned long guest_eip,
                                 int inst_len);
- extern uint32_t vlapic_update_ppr(struct vlapic *vlapic);
+extern uint32_t vlapic_update_ppr(struct vlapic *vlapic);
 extern asmlinkage void do_IRQ(struct cpu_user_regs *);
 extern void send_pio_req(struct cpu_user_regs *regs, unsigned long port,
                          unsigned long count, int size, long value, int dir, 
int pvalid);
@@ -282,7 +282,7 @@ static inline int long_mode_do_msr_read(
     switch (regs->ecx)
     {
     case MSR_EFER:
-        msr_content = vmcb->efer;      
+        msr_content = vmcb->efer;
         msr_content &= ~EFER_SVME;
         break;
 
@@ -320,14 +320,14 @@ static inline int long_mode_do_msr_read(
     HVM_DBG_LOG(DBG_LEVEL_2, "mode_do_msr_read: msr_content: %"PRIx64"\n", 
                 msr_content);
 
-    regs->eax = msr_content & 0xffffffff;
-    regs->edx = msr_content >> 32;
+    regs->eax = (u32)(msr_content >>  0);
+    regs->edx = (u32)(msr_content >> 32);
     return 1;
 }
 
 static inline int long_mode_do_msr_write(struct cpu_user_regs *regs)
 {
-    u64 msr_content = regs->eax | ((u64)regs->edx << 32);
+    u64 msr_content = (u32)regs->eax | ((u64)regs->edx << 32);
     struct vcpu *vc = current;
     struct vmcb_struct *vmcb = vc->arch.hvm_svm.vmcb;
 
@@ -342,7 +342,8 @@ static inline int long_mode_do_msr_write
         /* offending reserved bit will cause #GP */
         if ( msr_content & ~(EFER_LME | EFER_LMA | EFER_NX | EFER_SCE) )
         {
-            printk("trying to set reserved bit in EFER\n");
+            printk("Trying to set reserved bit in EFER: %"PRIx64"\n",
+                   msr_content);
             svm_inject_exception(vc, TRAP_gp_fault, 1, 0);
             return 0;
         }
@@ -355,7 +356,7 @@ static inline int long_mode_do_msr_write
                  !test_bit(SVM_CPU_STATE_PAE_ENABLED,
                            &vc->arch.hvm_svm.cpu_state) )
             {
-                printk("trying to set LME bit when "
+                printk("Trying to set LME bit when "
                        "in paging mode or PAE bit is not set\n");
                 svm_inject_exception(vc, TRAP_gp_fault, 1, 0);
                 return 0;
@@ -903,9 +904,9 @@ static void svm_relinquish_guest_resourc
 
         destroy_vmcb(&v->arch.hvm_svm);
         kill_timer(&v->arch.hvm_vcpu.hlt_timer);
-        if ( hvm_apic_support(v->domain) && (VLAPIC(v) != NULL) ) 
-        {
-            kill_timer( &(VLAPIC(v)->vlapic_timer) );
+        if ( VLAPIC(v) != NULL )
+        {
+            kill_timer(&VLAPIC(v)->vlapic_timer);
             unmap_domain_page_global(VLAPIC(v)->regs);
             free_domheap_page(VLAPIC(v)->regs_page);
             xfree(VLAPIC(v));
@@ -929,12 +930,13 @@ static void svm_migrate_timers(struct vc
     struct periodic_time *pt = 
         &(v->domain->arch.hvm_domain.pl_time.periodic_tm);
 
-    if ( pt->enabled ) {
-        migrate_timer( &pt->timer, v->processor );
-        migrate_timer( &v->arch.hvm_vcpu.hlt_timer, v->processor );
-    }
-    if ( hvm_apic_support(v->domain) && VLAPIC( v ))
-        migrate_timer( &(VLAPIC(v)->vlapic_timer ), v->processor );
+    if ( pt->enabled )
+    {
+        migrate_timer(&pt->timer, v->processor);
+        migrate_timer(&v->arch.hvm_vcpu.hlt_timer, v->processor);
+    }
+    if ( VLAPIC(v) != NULL )
+        migrate_timer(&VLAPIC(v)->vlapic_timer, v->processor);
 }
 
 
@@ -1075,9 +1077,6 @@ static void svm_vmexit_do_cpuid(struct v
                    clear_bit(X86_FEATURE_NX & 31, &edx);
             }
             clear_bit(X86_FEATURE_PSE36, &edx);
-            /* Disable machine check architecture */
-            clear_bit(X86_FEATURE_MCA, &edx);
-            clear_bit(X86_FEATURE_MCE, &edx);
             if (input == 0x00000001 )
             {
                 /* Clear out reserved bits. */
@@ -1470,7 +1469,7 @@ static void svm_io_instruction(struct vc
             pio_opp->flags |= OVERLAP;
 
             if (dir == IOREQ_WRITE)
-                hvm_copy(&value, addr, size, HVM_COPY_IN);
+                (void)hvm_copy_from_guest_virt(&value, addr, size);
 
             send_pio_req(regs, port, 1, size, value, dir, 0);
         } 
@@ -1636,9 +1635,11 @@ static void mov_from_cr(int cr, int gp, 
     case 4:
         value = (unsigned long) v->arch.hvm_svm.cpu_shadow_cr4;
         if (svm_dbg_on)
-            printk( "CR4 read=%lx\n", value );
+            printk("CR4 read=%lx\n", value);
         break;
     case 8:
+        if ( vlapic == NULL )
+            break;
         value = (unsigned long)vlapic_get_reg(vlapic, APIC_TASKPRI);
         value = (value & 0xF0) >> 4;
         break;
@@ -1816,6 +1817,8 @@ static int mov_to_cr(int gpreg, int cr, 
 
     case 8:
     {
+        if ( vlapic == NULL )
+            break;
         vlapic_set_reg(vlapic, APIC_TASKPRI, ((value & 0x0F) << 4));
         vlapic_update_ppr(vlapic);
         break;
@@ -1997,7 +2000,7 @@ static inline void svm_do_msr_access(
     else
     {
         inst_len = __get_instruction_length(vmcb, INSTR_WRMSR, NULL);
-        msr_content = (regs->eax & 0xFFFFFFFF) | ((u64)regs->edx << 32);
+        msr_content = (u32)regs->eax | ((u64)regs->edx << 32);
 
         switch (regs->ecx)
         {
@@ -2324,7 +2327,7 @@ void svm_dump_inst(unsigned long eip)
     ptr = eip & ~0xff;
     len = 0;
 
-    if (hvm_copy(opcode, ptr, sizeof(opcode), HVM_COPY_IN))
+    if (hvm_copy_from_guest_virt(opcode, ptr, sizeof(opcode)) == 0)
         len = sizeof(opcode);
 
     printf("Code bytes around(len=%d) %lx:", len, eip);
@@ -2563,9 +2566,7 @@ void walk_shadow_and_guest_pt(unsigned l
 #endif /* SVM_WALK_GUEST_PAGES */
 
 
-
-
-asmlinkage void svm_vmexit_handler(struct cpu_user_regs regs)
+asmlinkage void svm_vmexit_handler(struct cpu_user_regs *regs)
 {
     unsigned int exit_reason;
     unsigned long eip;
@@ -2577,7 +2578,7 @@ asmlinkage void svm_vmexit_handler(struc
     ASSERT(vmcb);
 
     exit_reason = vmcb->exitcode;
-    save_svm_cpu_user_regs(v, &regs);
+    save_svm_cpu_user_regs(v, regs);
 
     vmcb->tlb_control = 1;
 
@@ -2601,26 +2602,26 @@ asmlinkage void svm_vmexit_handler(struc
             if (svm_paging_enabled(v) && 
                 !mmio_space(shadow_gva_to_gpa(current, vmcb->exitinfo2)))
             {
-                printk("I%08ld,ExC=%s(%d),IP=%x:%llx,"
-                       "I1=%llx,I2=%llx,INT=%llx, "
-                       "gpa=%llx\n", intercepts_counter,
-                       exit_reasons[exit_reason], exit_reason, regs.cs,
-                       (unsigned long long) regs.rip,
-                       (unsigned long long) vmcb->exitinfo1,
-                       (unsigned long long) vmcb->exitinfo2,
-                       (unsigned long long) vmcb->exitintinfo.bytes,
-                       (unsigned long long) shadow_gva_to_gpa(current, 
vmcb->exitinfo2));
+                printk("I%08ld,ExC=%s(%d),IP=%x:%"PRIx64","
+                       "I1=%"PRIx64",I2=%"PRIx64",INT=%"PRIx64", "
+                       "gpa=%"PRIx64"\n", intercepts_counter,
+                       exit_reasons[exit_reason], exit_reason, regs->cs,
+                       (u64)regs->rip,
+                       (u64)vmcb->exitinfo1,
+                       (u64)vmcb->exitinfo2,
+                       (u64)vmcb->exitintinfo.bytes,
+                       (u64)shadow_gva_to_gpa(current, vmcb->exitinfo2));
             }
             else 
             {
-                printk("I%08ld,ExC=%s(%d),IP=%x:%llx,"
-                       "I1=%llx,I2=%llx,INT=%llx\n", 
+                printk("I%08ld,ExC=%s(%d),IP=%x:%"PRIx64","
+                       "I1=%"PRIx64",I2=%"PRIx64",INT=%"PRIx64"\n", 
                        intercepts_counter,
-                       exit_reasons[exit_reason], exit_reason, regs.cs,
-                       (unsigned long long) regs.rip,
-                       (unsigned long long) vmcb->exitinfo1,
-                       (unsigned long long) vmcb->exitinfo2,
-                       (unsigned long long) vmcb->exitintinfo.bytes );
+                       exit_reasons[exit_reason], exit_reason, regs->cs,
+                       (u64)regs->rip,
+                       (u64)vmcb->exitinfo1,
+                       (u64)vmcb->exitinfo2,
+                       (u64)vmcb->exitintinfo.bytes );
             }
         } 
         else if ( svm_dbg_on 
@@ -2630,24 +2631,24 @@ asmlinkage void svm_vmexit_handler(struc
 
             if (exit_reasons[exit_reason])
             {
-                printk("I%08ld,ExC=%s(%d),IP=%x:%llx,"
-                       "I1=%llx,I2=%llx,INT=%llx\n", 
+                printk("I%08ld,ExC=%s(%d),IP=%x:%"PRIx64","
+                       "I1=%"PRIx64",I2=%"PRIx64",INT=%"PRIx64"\n", 
                        intercepts_counter,
-                       exit_reasons[exit_reason], exit_reason, regs.cs,
-                       (unsigned long long) regs.rip,
-                       (unsigned long long) vmcb->exitinfo1,
-                       (unsigned long long) vmcb->exitinfo2,
-                       (unsigned long long) vmcb->exitintinfo.bytes);
+                       exit_reasons[exit_reason], exit_reason, regs->cs,
+                       (u64)regs->rip,
+                       (u64)vmcb->exitinfo1,
+                       (u64)vmcb->exitinfo2,
+                       (u64)vmcb->exitintinfo.bytes);
             } 
             else 
             {
-                printk("I%08ld,ExC=%d(0x%x),IP=%x:%llx,"
-                       "I1=%llx,I2=%llx,INT=%llx\n", 
-                       intercepts_counter, exit_reason, exit_reason, regs.cs, 
-                       (unsigned long long) regs.rip,
-                       (unsigned long long) vmcb->exitinfo1,
-                       (unsigned long long) vmcb->exitinfo2,
-                       (unsigned long long) vmcb->exitintinfo.bytes);
+                printk("I%08ld,ExC=%d(0x%x),IP=%x:%"PRIx64","
+                       "I1=%"PRIx64",I2=%"PRIx64",INT=%"PRIx64"\n", 
+                       intercepts_counter, exit_reason, exit_reason, regs->cs, 
+                       (u64)regs->rip,
+                       (u64)vmcb->exitinfo1,
+                       (u64)vmcb->exitinfo2,
+                       (u64)vmcb->exitintinfo.bytes);
             }
         }
 
@@ -2679,7 +2680,7 @@ asmlinkage void svm_vmexit_handler(struc
                    (int) v->arch.shadow_table.pfn);
 
             svm_dump_vmcb(__func__, vmcb);
-            svm_dump_regs(__func__, &regs);
+            svm_dump_regs(__func__, regs);
             svm_dump_inst(svm_rip2pointer(vmcb));
         }
 
@@ -2709,18 +2710,18 @@ asmlinkage void svm_vmexit_handler(struc
     case VMEXIT_EXCEPTION_DB:
     {
 #ifdef XEN_DEBUGGER
-        svm_debug_save_cpu_user_regs(&regs);
-        pdb_handle_exception(1, &regs, 1);
-        svm_debug_restore_cpu_user_regs(&regs);
+        svm_debug_save_cpu_user_regs(regs);
+        pdb_handle_exception(1, regs, 1);
+        svm_debug_restore_cpu_user_regs(regs);
 #else
-        svm_store_cpu_user_regs(&regs, v);
+        svm_store_cpu_user_regs(regs, v);
         domain_pause_for_debugger();  
 #endif
     }
     break;
 
     case VMEXIT_NMI:
-        do_nmi(&regs, 0);
+        do_nmi(regs, 0);
         break;
 
     case VMEXIT_SMI:
@@ -2740,9 +2741,9 @@ asmlinkage void svm_vmexit_handler(struc
 
     case VMEXIT_EXCEPTION_BP:
 #ifdef XEN_DEBUGGER
-        svm_debug_save_cpu_user_regs(&regs);
-        pdb_handle_exception(3, &regs, 1);
-        svm_debug_restore_cpu_user_regs(&regs);
+        svm_debug_save_cpu_user_regs(regs);
+        pdb_handle_exception(3, regs, 1);
+        svm_debug_restore_cpu_user_regs(regs);
 #else
         if ( test_bit(_DOMF_debugging, &v->domain->domain_flags) )
             domain_pause_for_debugger();
@@ -2757,25 +2758,25 @@ asmlinkage void svm_vmexit_handler(struc
 
     case VMEXIT_EXCEPTION_GP:
         /* This should probably not be trapped in the future */
-        regs.error_code = vmcb->exitinfo1;
-        svm_do_general_protection_fault(v, &regs);
+        regs->error_code = vmcb->exitinfo1;
+        svm_do_general_protection_fault(v, regs);
         break;  
 
     case VMEXIT_EXCEPTION_PF:
     {
         unsigned long va;
         va = vmcb->exitinfo2;
-        regs.error_code = vmcb->exitinfo1;
+        regs->error_code = vmcb->exitinfo1;
         HVM_DBG_LOG(DBG_LEVEL_VMMU, 
                     "eax=%lx, ebx=%lx, ecx=%lx, edx=%lx, esi=%lx, edi=%lx",
-                    (unsigned long)regs.eax, (unsigned long)regs.ebx,
-                    (unsigned long)regs.ecx, (unsigned long)regs.edx,
-                    (unsigned long)regs.esi, (unsigned long)regs.edi);
-
-        if (!(error = svm_do_page_fault(va, &regs))) 
+                    (unsigned long)regs->eax, (unsigned long)regs->ebx,
+                    (unsigned long)regs->ecx, (unsigned long)regs->edx,
+                    (unsigned long)regs->esi, (unsigned long)regs->edi);
+
+        if (!(error = svm_do_page_fault(va, regs))) 
         {
             /* Inject #PG using Interruption-Information Fields */
-            svm_inject_exception(v, TRAP_page_fault, 1, regs.error_code);
+            svm_inject_exception(v, TRAP_page_fault, 1, regs->error_code);
 
             v->arch.hvm_svm.cpu_cr2 = va;
             vmcb->cr2 = va;
@@ -2788,7 +2789,7 @@ asmlinkage void svm_vmexit_handler(struc
     case VMEXIT_EXCEPTION_DF:
         /* Debug info to hopefully help debug WHY the guest double-faulted. */
         svm_dump_vmcb(__func__, vmcb);
-        svm_dump_regs(__func__, &regs);
+        svm_dump_regs(__func__, regs);
         svm_dump_inst(svm_rip2pointer(vmcb));
         svm_inject_exception(v, TRAP_double_fault, 1, 0);
         break;
@@ -2805,11 +2806,11 @@ asmlinkage void svm_vmexit_handler(struc
         break;
 
     case VMEXIT_TASK_SWITCH:
-        __hvm_bug(&regs);
+        __hvm_bug(regs);
         break;
 
     case VMEXIT_CPUID:
-        svm_vmexit_do_cpuid(vmcb, regs.eax, &regs);
+        svm_vmexit_do_cpuid(vmcb, regs->eax, regs);
         break;
 
     case VMEXIT_HLT:
@@ -2817,60 +2818,60 @@ asmlinkage void svm_vmexit_handler(struc
         break;
 
     case VMEXIT_INVLPG:
-        svm_handle_invlpg(0, &regs);
+        svm_handle_invlpg(0, regs);
         break;
 
     case VMEXIT_INVLPGA:
-        svm_handle_invlpg(1, &regs);
+        svm_handle_invlpg(1, regs);
         break;
 
     case VMEXIT_VMMCALL:
-        svm_do_vmmcall(v, &regs);
+        svm_do_vmmcall(v, regs);
         break;
 
     case VMEXIT_CR0_READ:
-        svm_cr_access(v, 0, TYPE_MOV_FROM_CR, &regs);
+        svm_cr_access(v, 0, TYPE_MOV_FROM_CR, regs);
         break;
 
     case VMEXIT_CR2_READ:
-        svm_cr_access(v, 2, TYPE_MOV_FROM_CR, &regs);
+        svm_cr_access(v, 2, TYPE_MOV_FROM_CR, regs);
         break;
 
     case VMEXIT_CR3_READ:
-        svm_cr_access(v, 3, TYPE_MOV_FROM_CR, &regs);
+        svm_cr_access(v, 3, TYPE_MOV_FROM_CR, regs);
         break;
 
     case VMEXIT_CR4_READ:
-        svm_cr_access(v, 4, TYPE_MOV_FROM_CR, &regs);
+        svm_cr_access(v, 4, TYPE_MOV_FROM_CR, regs);
         break;
 
     case VMEXIT_CR8_READ:
-        svm_cr_access(v, 8, TYPE_MOV_FROM_CR, &regs);
+        svm_cr_access(v, 8, TYPE_MOV_FROM_CR, regs);
         break;
 
     case VMEXIT_CR0_WRITE:
-        svm_cr_access(v, 0, TYPE_MOV_TO_CR, &regs);
+        svm_cr_access(v, 0, TYPE_MOV_TO_CR, regs);
         break;
 
     case VMEXIT_CR2_WRITE:
-        svm_cr_access(v, 2, TYPE_MOV_TO_CR, &regs);
+        svm_cr_access(v, 2, TYPE_MOV_TO_CR, regs);
         break;
 
     case VMEXIT_CR3_WRITE:
-        svm_cr_access(v, 3, TYPE_MOV_TO_CR, &regs);
+        svm_cr_access(v, 3, TYPE_MOV_TO_CR, regs);
         local_flush_tlb();
         break;
 
     case VMEXIT_CR4_WRITE:
-        svm_cr_access(v, 4, TYPE_MOV_TO_CR, &regs);
+        svm_cr_access(v, 4, TYPE_MOV_TO_CR, regs);
         break;
 
     case VMEXIT_CR8_WRITE:
-        svm_cr_access(v, 8, TYPE_MOV_TO_CR, &regs);
+        svm_cr_access(v, 8, TYPE_MOV_TO_CR, regs);
         break;
        
     case VMEXIT_DR0_WRITE ... VMEXIT_DR7_WRITE:
-        svm_dr_access(v, &regs);
+        svm_dr_access(v, regs);
         break;
 
     case VMEXIT_IOIO:
@@ -2878,7 +2879,7 @@ asmlinkage void svm_vmexit_handler(struc
         break;
 
     case VMEXIT_MSR:
-        svm_do_msr_access(v, &regs);
+        svm_do_msr_access(v, regs);
         break;
 
     case VMEXIT_SHUTDOWN:
@@ -2887,11 +2888,10 @@ asmlinkage void svm_vmexit_handler(struc
         break;
 
     default:
-        printk("unexpected VMEXIT: exit reason = 0x%x, exitinfo1 = %llx, "
-               "exitinfo2 = %llx\n", exit_reason, 
-               (unsigned long long)vmcb->exitinfo1, 
-               (unsigned long long)vmcb->exitinfo2);
-        __hvm_bug(&regs);       /* should not happen */
+        printk("unexpected VMEXIT: exit reason = 0x%x, exitinfo1 = %"PRIx64", "
+               "exitinfo2 = %"PRIx64"\n", exit_reason, 
+               (u64)vmcb->exitinfo1, (u64)vmcb->exitinfo2);
+        __hvm_bug(regs);       /* should not happen */
         break;
     }
 
@@ -2899,7 +2899,7 @@ asmlinkage void svm_vmexit_handler(struc
     if (do_debug) 
     {
         printk("%s: Done switch on vmexit_code\n", __func__);
-        svm_dump_regs(__func__, &regs);
+        svm_dump_regs(__func__, regs);
     }
 
     if (do_debug) 
diff -r 914c44d10c8d -r 2bfd19fc1b79 xen/arch/x86/hvm/svm/x86_32/exits.S
--- a/xen/arch/x86/hvm/svm/x86_32/exits.S       Sun Oct 01 11:39:41 2006 -0600
+++ b/xen/arch/x86/hvm/svm/x86_32/exits.S       Sun Oct 01 19:10:18 2006 -0600
@@ -126,7 +126,10 @@ ENTRY(svm_asm_do_launch)
 
         HVM_SAVE_ALL_NOSEGREGS
         STGI
+        movl %esp