From a80edc3e70660fefcd3ae154751a8af8525a5265 Mon Sep 17 00:00:00 2001
From: "gm281@boulderdash.cl.cam.ac.uk" <gm281@boulderdash.cl.cam.ac.uk>
Date: Tue, 10 Aug 2004 15:34:37 +0000
Subject: [PATCH 01/10] bitkeeper revision 1.1159.15.1
 (4118eb0dXk4yJUHKqaxLdR-bj_e6Zg)

The weight of domains created with xm created can be specified with "weight=x" command line option, or put into the config file. Specific scheduler is responsible for handling this additional information. RRobin and Atropos ignore the argument.
---
 tools/examples/xmdefaults               |  4 ++++
 tools/examples/xmexample                |  4 ++++
 tools/libxc/xc.h                        |  1 +
 tools/libxc/xc_domain.c                 |  3 +++
 tools/python/xen/lowlevel/xc/xc.c       | 13 ++++++++-----
 tools/python/xen/xend/XendDomainInfo.py |  5 ++++-
 tools/python/xen/xm/create.py           |  7 ++++++-
 xen/arch/x86/smpboot.c                  |  2 +-
 xen/common/dom0_ops.c                   |  4 ++--
 xen/common/domain.c                     |  6 +++---
 xen/common/kernel.c                     |  2 +-
 xen/common/sched_atropos.c              |  6 ++++--
 xen/common/sched_bvt.c                  |  9 ++++++---
 xen/common/sched_fair_bvt.c             |  9 ++++++---
 xen/common/sched_rrobin.c               |  7 ++++---
 xen/common/schedule.c                   |  4 ++--
 xen/include/hypervisor-ifs/dom0_ops.h   |  2 +-
 xen/include/xen/sched-if.h              |  2 +-
 xen/include/xen/sched.h                 |  4 ++--
 19 files changed, 63 insertions(+), 31 deletions(-)

diff --git a/tools/examples/xmdefaults b/tools/examples/xmdefaults
index 0b7c5b2230..0c1f52b69d 100644
--- a/tools/examples/xmdefaults
+++ b/tools/examples/xmdefaults
@@ -25,6 +25,10 @@ name = "ExampleDomain"
 
 # Which CPU to start domain on? 
 #cpu = -1   # leave to Xen to pick
+# The weight (CPU share) of the domain. Works with all
+# schedulers that have notion of weight (eg BVT). 
+# Default is 1. Float values can be used.
+#weight = 1.5
 
 #----------------------------------------------------------------------------
 # Define network interfaces.
diff --git a/tools/examples/xmexample b/tools/examples/xmexample
index d6df731c45..b8717fb29a 100644
--- a/tools/examples/xmexample
+++ b/tools/examples/xmexample
@@ -55,6 +55,10 @@ name = "VM%d" % vmid
 # Which CPU to start domain on? 
 #cpu = -1   # leave to Xen to pick
 cpu = vmid  # set based on vmid (mod number of CPUs)
+# The weight (CPU share) of the domain. Works with all
+# schedulers that have notion of weight (eg BVT). 
+# Default is 1. Float values can be used.
+#weight = 1.5
 
 #----------------------------------------------------------------------------
 # Define network interfaces.
diff --git a/tools/libxc/xc.h b/tools/libxc/xc.h
index b2cf0c67ba..d44c1942f5 100644
--- a/tools/libxc/xc.h
+++ b/tools/libxc/xc.h
@@ -48,6 +48,7 @@ int xc_domain_create(int xc_handle,
                      unsigned int mem_kb, 
                      const char *name,
                      int cpu,
+                     float weight,
                      u32 *pdomid);
 int xc_domain_pause(int xc_handle, 
                     u32 domid);
diff --git a/tools/libxc/xc_domain.c b/tools/libxc/xc_domain.c
index 10017c74fe..41bff1fe5f 100644
--- a/tools/libxc/xc_domain.c
+++ b/tools/libxc/xc_domain.c
@@ -12,6 +12,7 @@ int xc_domain_create(int xc_handle,
                      unsigned int mem_kb, 
                      const char *name,
                      int cpu,
+                     float weight,
                      u32 *pdomid)
 {
     int err;
@@ -20,6 +21,8 @@ int xc_domain_create(int xc_handle,
     op.cmd = DOM0_CREATEDOMAIN;
     op.u.createdomain.domain = (domid_t)*pdomid;
     op.u.createdomain.memory_kb = mem_kb;
+    /* The weight of a domain added to the domain creation code */
+    op.u.createdomain.weight = weight;
     strncpy(op.u.createdomain.name, name, MAX_DOMAIN_NAME);
     op.u.createdomain.name[MAX_DOMAIN_NAME-1] = '\0';
     op.u.createdomain.cpu = cpu;
diff --git a/tools/python/xen/lowlevel/xc/xc.c b/tools/python/xen/lowlevel/xc/xc.c
index 4b5a426b55..d2a12026ef 100644
--- a/tools/python/xen/lowlevel/xc/xc.c
+++ b/tools/python/xen/lowlevel/xc/xc.c
@@ -44,16 +44,19 @@ static PyObject *pyxc_domain_create(PyObject *self,
     unsigned int mem_kb = 0;
     char        *name   = "(anon)";
     int          cpu = -1;
+    float        weight;
     u32          dom = 0;
     int          ret;
 
-    static char *kwd_list[] = { "dom", "mem_kb", "name", "cpu", NULL };
+    static char *kwd_list[] = { "dom", "mem_kb", "name", "cpu", "weight",
+                                                                        NULL };
 
-    if ( !PyArg_ParseTupleAndKeywords(args, kwds, "|iisi", kwd_list, 
-                                      &dom, &mem_kb, &name, &cpu) )
+    if ( !PyArg_ParseTupleAndKeywords(args, kwds, "|iisif", kwd_list, 
+                                      &dom, &mem_kb, &name, &cpu, &weight) )
         return NULL;
-
-    if ( (ret = xc_domain_create(xc->xc_handle, mem_kb, name, cpu, &dom)) < 0 )
+        
+    if ( (ret = xc_domain_create(xc->xc_handle, mem_kb, name, cpu, 
+                                                     weight, &dom)) < 0 )
         return PyErr_SetFromErrno(xc_error);
 
     return PyInt_FromLong(dom);
diff --git a/tools/python/xen/xend/XendDomainInfo.py b/tools/python/xen/xend/XendDomainInfo.py
index dee5c1cdb2..d073909faf 100644
--- a/tools/python/xen/xend/XendDomainInfo.py
+++ b/tools/python/xen/xend/XendDomainInfo.py
@@ -477,6 +477,7 @@ class XendDomainInfo:
         self.config = config
         try:
             self.name = sxp.child_value(config, 'name')
+            self.weight = float(sxp.child_value(config, 'weight'))
             self.check_name(self.name)
             self.memory = int(sxp.child_value(config, 'memory'))
             if self.memory is None:
@@ -687,9 +688,10 @@ class XendDomainInfo:
         if self.recreate: return
         memory = self.memory
         name = self.name
+        weight = self.weight
         cpu = int(sxp.child_value(self.config, 'cpu', '-1'))
         dom = self.dom or 0
-        dom = xc.domain_create(dom= dom, mem_kb= memory * 1024, name= name, cpu= cpu)
+        dom = xc.domain_create(dom= dom, mem_kb= memory * 1024, name= name, cpu= cpu, weight= weight)
         if dom <= 0:
             raise VmError('Creating domain failed: name=%s memory=%d'
                           % (name, memory))
@@ -1125,6 +1127,7 @@ add_device_handler('pci',  vm_dev_pci)
 add_config_handler('name',    vm_field_ignore)
 add_config_handler('memory',  vm_field_ignore)
 add_config_handler('cpu',     vm_field_ignore)
+add_config_handler('weight',  vm_field_ignore)
 add_config_handler('console', vm_field_ignore)
 add_config_handler('image',   vm_field_ignore)
 add_config_handler('device',  vm_field_ignore)
diff --git a/tools/python/xen/xm/create.py b/tools/python/xen/xm/create.py
index 286e1d3478..f28f203849 100644
--- a/tools/python/xen/xm/create.py
+++ b/tools/python/xen/xm/create.py
@@ -97,6 +97,10 @@ gopts.var('memory', val='MEMORY',
           fn=set_value, default=128,
           use="Domain memory in MB.")
 
+gopts.var('weight', val='WEIGHT',
+          fn=set_value, default=1,
+          use="Domain cpu weight (default=1).")
+
 gopts.var('console', val='PORT',
           fn=set_int, default=None,
           use="Console port to use. Default is 9600 + domain id.")
@@ -295,7 +299,8 @@ def make_config(vals):
     
     config = ['vm',
               ['name', vals.name ],
-              ['memory', vals.memory ] ]
+              ['memory', vals.memory ],
+              ['weight', vals.weight] ]
     if vals.cpu:
         config.append(['cpu', vals.cpu])
     if vals.blkif:
diff --git a/xen/arch/x86/smpboot.c b/xen/arch/x86/smpboot.c
index bd9c0951ec..da4130f34e 100644
--- a/xen/arch/x86/smpboot.c
+++ b/xen/arch/x86/smpboot.c
@@ -650,7 +650,7 @@ static void __init do_boot_cpu (int apicid)
 
     cpu = ++cpucount;
 
-    if ( (idle = do_createdomain(IDLE_DOMAIN_ID, cpu)) == NULL )
+    if ( (idle = do_createdomain(IDLE_DOMAIN_ID, cpu, 0)) == NULL )
         panic("failed 'createdomain' for CPU %d", cpu);
 
     set_bit(DF_IDLETASK, &idle->flags);
diff --git a/xen/common/dom0_ops.c b/xen/common/dom0_ops.c
index 0a4086ef6e..e31d0a6025 100644
--- a/xen/common/dom0_ops.c
+++ b/xen/common/dom0_ops.c
@@ -182,9 +182,9 @@ long do_dom0_op(dom0_op_t *u_dom0_op)
             pro = op->u.createdomain.cpu % smp_num_cpus;
 
         ret = -ENOMEM;
-        if ( (d = do_createdomain(dom, pro)) == NULL )
+        if ( (d = do_createdomain(dom, pro, op->u.createdomain.weight))==NULL)
             break;
-
+        
         if ( op->u.createdomain.name[0] )
         {
             strncpy(d->name, op->u.createdomain.name, MAX_DOMAIN_NAME);
diff --git a/xen/common/domain.c b/xen/common/domain.c
index cac4c2edf0..3f3f876111 100644
--- a/xen/common/domain.c
+++ b/xen/common/domain.c
@@ -22,7 +22,7 @@ rwlock_t tasklist_lock __cacheline_aligned = RW_LOCK_UNLOCKED;
 struct domain *task_hash[TASK_HASH_SIZE];
 struct domain *task_list;
 
-struct domain *do_createdomain(domid_t dom_id, unsigned int cpu)
+struct domain *do_createdomain(domid_t dom_id, unsigned int cpu, float weight)
 {
     char buf[100];
     struct domain *d, **pd;
@@ -69,7 +69,7 @@ struct domain *do_createdomain(domid_t dom_id, unsigned int cpu)
         spin_lock_init(&d->pcidev_lock);
         INIT_LIST_HEAD(&d->pcidev_list);
 
-        sched_add_domain(d);
+        sched_add_domain(d, weight);
 
         write_lock_irqsave(&tasklist_lock, flags);
         pd = &task_list; /* NB. task_list is maintained in order of dom_id. */
@@ -85,7 +85,7 @@ struct domain *do_createdomain(domid_t dom_id, unsigned int cpu)
     else
     {
         sprintf(d->name, "Idle-%d", cpu);
-        sched_add_domain(d);
+        sched_add_domain(d, weight);
     }
 
     return d;
diff --git a/xen/common/kernel.c b/xen/common/kernel.c
index 6a39946d70..0e0b240b79 100644
--- a/xen/common/kernel.c
+++ b/xen/common/kernel.c
@@ -306,7 +306,7 @@ void cmain(multiboot_info_t *mbi)
     task_hash[TASK_HASH(IDLE_DOMAIN_ID)] = &idle0_task;
 
     /* Create initial domain 0. */
-    new_dom = do_createdomain(0, 0);
+    new_dom = do_createdomain(0, 0, 1);
     if ( new_dom == NULL )
         panic("Error creating domain 0\n");
 
diff --git a/xen/common/sched_atropos.c b/xen/common/sched_atropos.c
index 53e4519b9f..b93ea89dd9 100644
--- a/xen/common/sched_atropos.c
+++ b/xen/common/sched_atropos.c
@@ -167,8 +167,10 @@ static void requeue(struct domain *sdom)
      * - they shouldn't be on any queue */
 }
 
-/* prepare a task to be added to scheduling */
-static void at_add_task(struct domain *p)
+/* prepare a task to be added to scheduling 
+    TODO - can weight argument can be used to set up the 
+    scheduling parameters? */
+static void at_add_task(struct domain *p, float weight)
 {
     s_time_t now = NOW();
 
diff --git a/xen/common/sched_bvt.c b/xen/common/sched_bvt.c
index e4ee214b54..25e71f0e4d 100644
--- a/xen/common/sched_bvt.c
+++ b/xen/common/sched_bvt.c
@@ -180,13 +180,16 @@ int bvt_alloc_task(struct domain *p)
 /*
  * Add and remove a domain
  */
-void bvt_add_task(struct domain *p) 
+void bvt_add_task(struct domain *p, float weight) 
 {
     struct bvt_dom_info *inf = BVT_INFO(p);
     ASSERT(inf != NULL);
     ASSERT(p   != NULL);
 
-    inf->mcu_advance = MCU_ADVANCE;
+    if(weight > 0)
+        inf->mcu_advance = MCU_ADVANCE / weight;
+    else
+        inf->mcu_advance = MCU_ADVANCE;
     inf->domain = p;
     inf->warpback    = 0;
     /* Set some default values here. */
@@ -224,7 +227,7 @@ int bvt_init_idle_task(struct domain *p)
 
     if(bvt_alloc_task(p) < 0) return -1;
 
-    bvt_add_task(p);
+    bvt_add_task(p, 0);
 
     spin_lock_irqsave(&CPU_INFO(p->processor)->run_lock, flags);
     
diff --git a/xen/common/sched_fair_bvt.c b/xen/common/sched_fair_bvt.c
index 165c128753..3e027f8706 100644
--- a/xen/common/sched_fair_bvt.c
+++ b/xen/common/sched_fair_bvt.c
@@ -152,14 +152,17 @@ int fbvt_alloc_task(struct domain *p)
 /*
  * Add and remove a domain
  */
-void fbvt_add_task(struct domain *p) 
+void fbvt_add_task(struct domain *p, float weight) 
 {
     struct fbvt_dom_info *inf = FBVT_INFO(p);
 
     ASSERT(inf != NULL);
     ASSERT(p   != NULL);
 
-    inf->mcu_advance = MCU_ADVANCE;
+    if(weight > 0)
+        inf->mcu_advance = MCU_ADVANCE / weight;
+    else
+        inf->mcu_advance = MCU_ADVANCE;
     inf->domain = p;
     if ( p->domain == IDLE_DOMAIN_ID )
     {
@@ -187,7 +190,7 @@ int fbvt_init_idle_task(struct domain *p)
 
     if(fbvt_alloc_task(p) < 0) return -1;
 
-    fbvt_add_task(p);
+    fbvt_add_task(p, 0);
     spin_lock_irqsave(&CPU_INFO(p->processor)->run_lock, flags);
     set_bit(DF_RUNNING, &p->flags);
     if ( !__task_on_runqueue(p) )
diff --git a/xen/common/sched_rrobin.c b/xen/common/sched_rrobin.c
index 2ab5604fb5..28b0f73fa8 100644
--- a/xen/common/sched_rrobin.c
+++ b/xen/common/sched_rrobin.c
@@ -101,8 +101,9 @@ static int rr_alloc_task(struct domain *d)
    return 0;
 }
 
-/* Setup the rr_dom_info */
-static void rr_add_task(struct domain *p)
+/* Setup the rr_dom_info 
+   The weight argument is ignored as RRobin does not use weights */
+static void rr_add_task(struct domain *p, float weight)
 {
     struct rrobin_dom_info *inf;
     RR_INFO(p)->domain = p;
@@ -121,7 +122,7 @@ static int rr_init_idle_task(struct domain *p)
 {
     unsigned long flags;
     if(rr_alloc_task(p) < 0) return -1;
-    rr_add_task(p);
+    rr_add_task(p, 0);
 
     spin_lock_irqsave(&run_locks[p->processor], flags);
     set_bit(DF_RUNNING, &p->flags);
diff --git a/xen/common/schedule.c b/xen/common/schedule.c
index d2778e09ed..b37635324b 100644
--- a/xen/common/schedule.c
+++ b/xen/common/schedule.c
@@ -123,7 +123,7 @@ struct domain *alloc_domain_struct(void)
 /*
  * Add and remove a domain
  */
-void sched_add_domain(struct domain *d) 
+void sched_add_domain(struct domain *d, float weight) 
 {
     /* Must be unpaused by control software to start execution. */
     set_bit(DF_CTRLPAUSE, &d->flags);
@@ -141,7 +141,7 @@ void sched_add_domain(struct domain *d)
         schedule_data[d->processor].idle = d;
     }
 
-    SCHED_OP(add_task, d);
+    SCHED_OP(add_task, d, weight);
 
     TRACE_2D(TRC_SCHED_DOM_ADD, d->domain, d);
 }
diff --git a/xen/include/hypervisor-ifs/dom0_ops.h b/xen/include/hypervisor-ifs/dom0_ops.h
index 8cea03fac2..cef857f5e5 100644
--- a/xen/include/hypervisor-ifs/dom0_ops.h
+++ b/xen/include/hypervisor-ifs/dom0_ops.h
@@ -55,7 +55,7 @@ typedef struct {
     MEMORY_PADDING;
     u8           name[MAX_DOMAIN_NAME]; /*  8 */
     u32          cpu;                 /* 24 */
-    u32          __pad0;              /* 28 */
+    float        weight;              /* 28 */
     /* IN/OUT parameters. */
     /* If 0, domain is allocated. If non-zero use it unless in use. */
     domid_t      domain;              /* 32 */
diff --git a/xen/include/xen/sched-if.h b/xen/include/xen/sched-if.h
index 15f992614a..9088e61733 100644
--- a/xen/include/xen/sched-if.h
+++ b/xen/include/xen/sched-if.h
@@ -38,7 +38,7 @@ struct scheduler
     int          (*init_scheduler) ();
     int          (*init_idle_task) (struct domain *);
     int          (*alloc_task)     (struct domain *);
-    void         (*add_task)       (struct domain *);
+    void         (*add_task)       (struct domain *, float weight);
     void         (*free_task)      (struct domain *);
     void         (*rem_task)       (struct domain *);
     void         (*sleep)          (struct domain *);
diff --git a/xen/include/xen/sched.h b/xen/include/xen/sched.h
index 06b6faf6cc..3b8ad6c58b 100644
--- a/xen/include/xen/sched.h
+++ b/xen/include/xen/sched.h
@@ -171,7 +171,7 @@ static inline int get_domain(struct domain *d)
 }
   
 extern struct domain *do_createdomain(
-    domid_t dom_id, unsigned int cpu);
+    domid_t dom_id, unsigned int cpu, float weight);
 extern int construct_dom0(struct domain *d, 
                           unsigned long alloc_start,
                           unsigned long alloc_end,
@@ -198,7 +198,7 @@ extern unsigned long wait_init_idle;
 #define set_current_state(_s) do { current->state = (_s); } while (0)
 void scheduler_init(void);
 void schedulers_start(void);
-void sched_add_domain(struct domain *d);
+void sched_add_domain(struct domain *d, float weight);
 void sched_rem_domain(struct domain *d);
 long sched_ctl(struct sched_ctl_cmd *);
 long sched_adjdom(struct sched_adjdom_cmd *);

From 92080adc564f9ed06fc3ab0788802b04651411ef Mon Sep 17 00:00:00 2001
From: "gm281@boulderdash.cl.cam.ac.uk" <gm281@boulderdash.cl.cam.ac.uk>
Date: Tue, 10 Aug 2004 15:43:28 +0000
Subject: [PATCH 02/10] bitkeeper revision 1.1159.16.2
 (4118ed20n9s8eU8-4zEBAN9uVi9YWQ)

Fix to a broken build (previously not picked up by make). Prorer fix will follow soon.
---
 tools/libxc/xc_linux_restore.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/libxc/xc_linux_restore.c b/tools/libxc/xc_linux_restore.c
index 304413b485..1ce1837e35 100644
--- a/tools/libxc/xc_linux_restore.c
+++ b/tools/libxc/xc_linux_restore.c
@@ -225,7 +225,7 @@ int xc_linux_restore(int xc_handle, XcIOContext *ioctxt)
     /* XXX create domain on CPU=-1 so that in future it auto load ballances by default */
     if ( xc_domain_create( xc_handle,  nr_pfns * (PAGE_SIZE / 1024),
 			   name,
-			   -1, &dom ) )
+			   -1, 1, &dom ) )
     {
 	xcio_error(ioctxt, "Could not create domain. pfns=%d, %dKB",
 		   nr_pfns,nr_pfns * (PAGE_SIZE / 1024));

From 7c075bd78016659c453b8cd2b5d74e78793eea22 Mon Sep 17 00:00:00 2001
From: "kaf24@scramble.cl.cam.ac.uk" <kaf24@scramble.cl.cam.ac.uk>
Date: Tue, 10 Aug 2004 16:43:47 +0000
Subject: [PATCH 03/10] bitkeeper revision 1.1159.18.1
 (4118fb43PWr3pgwsfCncpKPp8Ek0Yg)

Little cleanup.
---
 .../arch/xen/kernel/ctrl_if.c                 | 24 ++++++-------------
 1 file changed, 7 insertions(+), 17 deletions(-)

diff --git a/linux-2.6.7-xen-sparse/arch/xen/kernel/ctrl_if.c b/linux-2.6.7-xen-sparse/arch/xen/kernel/ctrl_if.c
index c5d12db779..c4ace2b6f9 100644
--- a/linux-2.6.7-xen-sparse/arch/xen/kernel/ctrl_if.c
+++ b/linux-2.6.7-xen-sparse/arch/xen/kernel/ctrl_if.c
@@ -383,21 +383,10 @@ void ctrl_if_suspend(void)
     unbind_evtchn_from_irq(ctrl_if_evtchn);
 }
 
-/** Reset the control interface progress pointers.
- * Marks the queues empty if 'clear' non-zero.
- */
-void ctrl_if_reset(int clear){
-    control_if_t *ctrl_if = get_ctrl_if();
-
-    if(clear){
-        *ctrl_if = (control_if_t){};
-    }
-    ctrl_if_tx_resp_cons = ctrl_if->tx_resp_prod;
-    ctrl_if_rx_req_cons  = ctrl_if->rx_resp_prod;
-}
-
 void ctrl_if_resume(void)
 {
+    control_if_t *ctrl_if = get_ctrl_if();
+
     if ( start_info.flags & SIF_INITDOMAIN )
     {
         /*
@@ -415,7 +404,9 @@ void ctrl_if_resume(void)
         initdom_ctrlif_domcontroller_port   = op.u.bind_interdomain.port2;
     }
 
-    ctrl_if_reset(0);
+    /* Sync up with shared indexes. */
+    ctrl_if_tx_resp_cons = ctrl_if->tx_resp_prod;
+    ctrl_if_rx_req_cons  = ctrl_if->rx_resp_prod;
 
     ctrl_if_evtchn = start_info.domain_controller_evtchn;
     ctrl_if_irq    = bind_evtchn_to_irq(ctrl_if_evtchn);
@@ -444,7 +435,6 @@ void __init ctrl_if_init(void)
 
     spin_lock_init(&ctrl_if_lock);
 
-    ctrl_if_reset(1);
     ctrl_if_resume();
 }
 
@@ -455,8 +445,8 @@ static int __init ctrl_if_late_setup(void)
     safe_to_schedule_task = 1;
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
     ctrl_if_tx_wq = create_workqueue("ctrl_if_tx");
-    if (ctrl_if_tx_wq == NULL)
-        return 1;                 /* XXX */
+    if ( ctrl_if_tx_wq == NULL )
+        return 1;
 #endif
     return 0;
 }

From 8e553531464013c561dd276ef014309a1e732760 Mon Sep 17 00:00:00 2001
From: "cl349@freefall.cl.cam.ac.uk" <cl349@freefall.cl.cam.ac.uk>
Date: Tue, 10 Aug 2004 17:22:40 +0000
Subject: [PATCH 04/10] bitkeeper revision 1.1159.11.2
 (41190460g_46PGXC611SAS9fnIgORA)

Fix CONFIG_HIGHMEM.
---
 .rootkeys                                     |   2 +
 linux-2.6.7-xen-sparse/arch/xen/i386/Kconfig  |  16 +-
 .../arch/xen/i386/mm/Makefile                 |   2 +-
 .../arch/xen/i386/mm/highmem.c                | 137 ++++++++++++++++++
 .../arch/xen/i386/mm/pgtable.c                |  10 +-
 .../include/asm-xen/asm-i386/highmem.h        |  72 +++++++++
 .../include/asm-xen/asm-i386/pgtable.h        |   6 +-
 7 files changed, 233 insertions(+), 12 deletions(-)
 create mode 100644 linux-2.6.7-xen-sparse/arch/xen/i386/mm/highmem.c
 create mode 100644 linux-2.6.7-xen-sparse/include/asm-xen/asm-i386/highmem.h

diff --git a/.rootkeys b/.rootkeys
index bdeeb555d1..0de7d92f81 100644
--- a/.rootkeys
+++ b/.rootkeys
@@ -153,6 +153,7 @@
 40f56238wi6AdNQjm0RT57bSkwb6hg linux-2.6.7-xen-sparse/arch/xen/i386/kernel/vsyscall.lds
 40f56238a3w6-byOzexIlMgni76Lcg linux-2.6.7-xen-sparse/arch/xen/i386/mm/Makefile
 40f56238ILx8xlbywNbzTdv5Zr4xXQ linux-2.6.7-xen-sparse/arch/xen/i386/mm/fault.c
+4118cc35CbY8rfGVspF5O-7EkXBEAA linux-2.6.7-xen-sparse/arch/xen/i386/mm/highmem.c
 40f562383SKvDStdtrvzr5fyCbW4rw linux-2.6.7-xen-sparse/arch/xen/i386/mm/hypervisor.c
 40f56239xcNylAxuGsQHwi1AyMLV8w linux-2.6.7-xen-sparse/arch/xen/i386/mm/init.c
 41062ab7CjxC1UBaFhOMWWdhHkIUyg linux-2.6.7-xen-sparse/arch/xen/i386/mm/ioremap.c
@@ -200,6 +201,7 @@
 4107adf1E5O4ztGHNGMzCCNhcvqNow linux-2.6.7-xen-sparse/include/asm-xen/asm-i386/dma-mapping.h
 40f5623anSzpuEHgiNmQ56fIRfCoaQ linux-2.6.7-xen-sparse/include/asm-xen/asm-i386/e820.h
 40f5623akIoBsQ3KxSB2kufkbgONXQ linux-2.6.7-xen-sparse/include/asm-xen/asm-i386/fixmap.h
+4118b6a418gnL6AZsTdglC92YGqYTg linux-2.6.7-xen-sparse/include/asm-xen/asm-i386/highmem.h
 40f5623aJVXQwpJMOLE99XgvGsfQ8Q linux-2.6.7-xen-sparse/include/asm-xen/asm-i386/io.h
 40f5623am9BzluYFuV6EQfTd-so3dA linux-2.6.7-xen-sparse/include/asm-xen/asm-i386/mach-xen/do_timer.h
 40f5623adZQ1IZGPxbDXONjyZGYuTA linux-2.6.7-xen-sparse/include/asm-xen/asm-i386/mach-xen/io_ports.h
diff --git a/linux-2.6.7-xen-sparse/arch/xen/i386/Kconfig b/linux-2.6.7-xen-sparse/arch/xen/i386/Kconfig
index 0cfb2d40a6..1a051d436d 100644
--- a/linux-2.6.7-xen-sparse/arch/xen/i386/Kconfig
+++ b/linux-2.6.7-xen-sparse/arch/xen/i386/Kconfig
@@ -555,14 +555,14 @@ config HAVE_ARCH_BOOTMEM_NODE
 	depends on NUMA
 	default y
 
-config HIGHPTE
-	bool "Allocate 3rd-level pagetables from highmem"
-	depends on HIGHMEM4G || HIGHMEM64G
-	help
-	  The VM uses one page table entry for each page of physical memory.
-	  For systems with a lot of RAM, this can be wasteful of precious
-	  low memory.  Setting this option will put user-space page table
-	  entries in high memory.
+#config HIGHPTE
+#	bool "Allocate 3rd-level pagetables from highmem"
+#	depends on HIGHMEM4G || HIGHMEM64G
+#	help
+#	  The VM uses one page table entry for each page of physical memory.
+#	  For systems with a lot of RAM, this can be wasteful of precious
+#	  low memory.  Setting this option will put user-space page table
+#	  entries in high memory.
 
 #config MTRR
 #	 bool "MTRR (Memory Type Range Register) support"
diff --git a/linux-2.6.7-xen-sparse/arch/xen/i386/mm/Makefile b/linux-2.6.7-xen-sparse/arch/xen/i386/mm/Makefile
index a0f3470825..55063591f0 100644
--- a/linux-2.6.7-xen-sparse/arch/xen/i386/mm/Makefile
+++ b/linux-2.6.7-xen-sparse/arch/xen/i386/mm/Makefile
@@ -11,7 +11,7 @@ c-obj-y	:= extable.o pageattr.o
 
 c-obj-$(CONFIG_DISCONTIGMEM)	+= discontig.o
 c-obj-$(CONFIG_HUGETLB_PAGE) += hugetlbpage.o
-c-obj-$(CONFIG_HIGHMEM) += highmem.o
+obj-$(CONFIG_HIGHMEM) += highmem.o
 c-obj-$(CONFIG_BOOT_IOREMAP) += boot_ioremap.o
 
 c-link	:=
diff --git a/linux-2.6.7-xen-sparse/arch/xen/i386/mm/highmem.c b/linux-2.6.7-xen-sparse/arch/xen/i386/mm/highmem.c
new file mode 100644
index 0000000000..6b6fd16514
--- /dev/null
+++ b/linux-2.6.7-xen-sparse/arch/xen/i386/mm/highmem.c
@@ -0,0 +1,137 @@
+#include <linux/highmem.h>
+
+void *kmap(struct page *page)
+{
+	might_sleep();
+	if (page < highmem_start_page)
+		return page_address(page);
+	return kmap_high(page);
+}
+
+void kunmap(struct page *page)
+{
+	if (in_interrupt())
+		BUG();
+	if (page < highmem_start_page)
+		return;
+	kunmap_high(page);
+}
+
+/*
+ * kmap_atomic/kunmap_atomic is significantly faster than kmap/kunmap because
+ * no global lock is needed and because the kmap code must perform a global TLB
+ * invalidation when the kmap pool wraps.
+ *
+ * However when holding an atomic kmap is is not legal to sleep, so atomic
+ * kmaps are appropriate for short, tight code paths only.
+ */
+void *kmap_atomic(struct page *page, enum km_type type)
+{
+	enum fixed_addresses idx;
+	unsigned long vaddr;
+
+	/* even !CONFIG_PREEMPT needs this, for in_atomic in do_page_fault */
+	inc_preempt_count();
+	if (page < highmem_start_page)
+		return page_address(page);
+
+	idx = type + KM_TYPE_NR*smp_processor_id();
+	vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
+#ifdef CONFIG_DEBUG_HIGHMEM
+	if (!pte_none(*(kmap_pte-idx)))
+		BUG();
+#endif
+	set_pte(kmap_pte-idx, mk_pte(page, kmap_prot));
+	__flush_tlb_one(vaddr);
+
+	return (void*) vaddr;
+}
+
+/* Same as kmap_atomic but with PAGE_KERNEL_RO page protection */
+void *kmap_atomic_pte(struct page *page, enum km_type type)
+{
+	enum fixed_addresses idx;
+	unsigned long vaddr;
+
+	/* even !CONFIG_PREEMPT needs this, for in_atomic in do_page_fault */
+	inc_preempt_count();
+	if (page < highmem_start_page)
+		return page_address(page);
+
+	idx = type + KM_TYPE_NR*smp_processor_id();
+	vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
+#ifdef CONFIG_DEBUG_HIGHMEM
+	if (!pte_none(*(kmap_pte-idx)))
+		BUG();
+#endif
+	set_pte(kmap_pte-idx, mk_pte(page, PAGE_KERNEL_RO));
+	__flush_tlb_one(vaddr);
+
+	return (void*) vaddr;
+}
+
+void kunmap_atomic(void *kvaddr, enum km_type type)
+{
+#ifdef CONFIG_DEBUG_HIGHMEM
+	unsigned long vaddr = (unsigned long) kvaddr & PAGE_MASK;
+	enum fixed_addresses idx = type + KM_TYPE_NR*smp_processor_id();
+
+	if (vaddr < FIXADDR_START) { // FIXME
+		dec_preempt_count();
+		preempt_check_resched();
+		return;
+	}
+
+	if (vaddr != __fix_to_virt(FIX_KMAP_BEGIN+idx))
+		BUG();
+
+	/*
+	 * force other mappings to Oops if they'll try to access
+	 * this pte without first remap it
+	 */
+	pte_clear(kmap_pte-idx);
+	__flush_tlb_one(vaddr);
+#endif
+
+	dec_preempt_count();
+	preempt_check_resched();
+}
+
+void kunmap_atomic_force(void *kvaddr, enum km_type type)
+{
+	unsigned long vaddr = (unsigned long) kvaddr & PAGE_MASK;
+	enum fixed_addresses idx = type + KM_TYPE_NR*smp_processor_id();
+
+	if (vaddr < FIXADDR_START) { // FIXME
+		dec_preempt_count();
+		preempt_check_resched();
+		return;
+	}
+
+	if (vaddr != __fix_to_virt(FIX_KMAP_BEGIN+idx))
+		BUG();
+
+	/*
+	 * force other mappings to Oops if they'll try to access
+	 * this pte without first remap it
+	 */
+	pte_clear(kmap_pte-idx);
+	__flush_tlb_one(vaddr);
+
+	dec_preempt_count();
+	preempt_check_resched();
+}
+
+struct page *kmap_atomic_to_page(void *ptr)
+{
+	unsigned long idx, vaddr = (unsigned long)ptr;
+	pte_t *pte;
+
+	if (vaddr < FIXADDR_START)
+		return virt_to_page(ptr);
+
+	idx = virt_to_fix(vaddr);
+	pte = kmap_pte - (idx - FIX_KMAP_BEGIN);
+	return pte_page(*pte);
+}
+
diff --git a/linux-2.6.7-xen-sparse/arch/xen/i386/mm/pgtable.c b/linux-2.6.7-xen-sparse/arch/xen/i386/mm/pgtable.c
index cbab491f2e..e9e70e61b0 100644
--- a/linux-2.6.7-xen-sparse/arch/xen/i386/mm/pgtable.c
+++ b/linux-2.6.7-xen-sparse/arch/xen/i386/mm/pgtable.c
@@ -194,9 +194,17 @@ struct page *pte_alloc_one(struct mm_struct *mm, unsigned long address)
 	pte = alloc_pages(GFP_KERNEL|__GFP_REPEAT, 0);
 #endif
 	if (pte) {
+#ifdef CONFIG_HIGHPTE
+		void *kaddr = kmap_atomic(pte, KM_USER0);
+		clear_page(kaddr);
+		kunmap_atomic_force(kaddr, KM_USER0);
+#else
 		clear_highpage(pte);
+#endif
+#ifdef CONFIG_HIGHPTE
+		if (pte < highmem_start_page)
+#endif
 		__make_page_readonly(phys_to_virt(page_to_pseudophys(pte)));
-				/* XXXcl highmem */
 	}
 	return pte;
 }
diff --git a/linux-2.6.7-xen-sparse/include/asm-xen/asm-i386/highmem.h b/linux-2.6.7-xen-sparse/include/asm-xen/asm-i386/highmem.h
new file mode 100644
index 0000000000..f608a13755
--- /dev/null
+++ b/linux-2.6.7-xen-sparse/include/asm-xen/asm-i386/highmem.h
@@ -0,0 +1,72 @@
+/*
+ * highmem.h: virtual kernel memory mappings for high memory
+ *
+ * Used in CONFIG_HIGHMEM systems for memory pages which
+ * are not addressable by direct kernel virtual addresses.
+ *
+ * Copyright (C) 1999 Gerhard Wichert, Siemens AG
+ *		      Gerhard.Wichert@pdb.siemens.de
+ *
+ *
+ * Redesigned the x86 32-bit VM architecture to deal with 
+ * up to 16 Terabyte physical memory. With current x86 CPUs
+ * we now support up to 64 Gigabytes physical RAM.
+ *
+ * Copyright (C) 1999 Ingo Molnar <mingo@redhat.com>
+ */
+
+#ifndef _ASM_HIGHMEM_H
+#define _ASM_HIGHMEM_H
+
+#ifdef __KERNEL__
+
+#include <linux/config.h>
+#include <linux/interrupt.h>
+#include <linux/threads.h>
+#include <asm/kmap_types.h>
+#include <asm/tlbflush.h>
+
+/* declarations for highmem.c */
+extern unsigned long highstart_pfn, highend_pfn;
+
+extern pte_t *kmap_pte;
+extern pgprot_t kmap_prot;
+extern pte_t *pkmap_page_table;
+
+extern void kmap_init(void);
+
+/*
+ * Right now we initialize only a single pte table. It can be extended
+ * easily, subsequent pte tables have to be allocated in one physical
+ * chunk of RAM.
+ */
+#if NR_CPUS <= 32
+#define PKMAP_BASE (HYPERVISOR_VIRT_START - (1<<23))
+#else
+#define PKMAP_BASE (HYPERVISOR_VIRT_START - (1<<23) - 0x200000UL)
+#endif
+#ifdef CONFIG_X86_PAE
+#define LAST_PKMAP 512
+#else
+#define LAST_PKMAP 1024
+#endif
+#define LAST_PKMAP_MASK (LAST_PKMAP-1)
+#define PKMAP_NR(virt)  ((virt-PKMAP_BASE) >> PAGE_SHIFT)
+#define PKMAP_ADDR(nr)  (PKMAP_BASE + ((nr) << PAGE_SHIFT))
+
+extern void * FASTCALL(kmap_high(struct page *page));
+extern void FASTCALL(kunmap_high(struct page *page));
+
+void *kmap(struct page *page);
+void kunmap(struct page *page);
+void *kmap_atomic(struct page *page, enum km_type type);
+void *kmap_atomic_pte(struct page *page, enum km_type type);
+void kunmap_atomic(void *kvaddr, enum km_type type);
+void kunmap_atomic_force(void *kvaddr, enum km_type type);
+struct page *kmap_atomic_to_page(void *ptr);
+
+#define flush_cache_kmaps()	do { } while (0)
+
+#endif /* __KERNEL__ */
+
+#endif /* _ASM_HIGHMEM_H */
diff --git a/linux-2.6.7-xen-sparse/include/asm-xen/asm-i386/pgtable.h b/linux-2.6.7-xen-sparse/include/asm-xen/asm-i386/pgtable.h
index be31d10f30..8c8dfaa3df 100644
--- a/linux-2.6.7-xen-sparse/include/asm-xen/asm-i386/pgtable.h
+++ b/linux-2.6.7-xen-sparse/include/asm-xen/asm-i386/pgtable.h
@@ -333,9 +333,11 @@ static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
 
 #if defined(CONFIG_HIGHPTE)
 #define pte_offset_map(dir, address) \
-	((pte_t *)kmap_atomic(pmd_page(*(dir)),KM_PTE0) + pte_index(address))
+	((pte_t *)kmap_atomic_pte(pmd_page(*(dir)),KM_PTE0) + \
+	 pte_index(address))
 #define pte_offset_map_nested(dir, address) \
-	((pte_t *)kmap_atomic(pmd_page(*(dir)),KM_PTE1) + pte_index(address))
+	((pte_t *)kmap_atomic_pte(pmd_page(*(dir)),KM_PTE1) + \
+	 pte_index(address))
 #define pte_unmap(pte) kunmap_atomic(pte, KM_PTE0)
 #define pte_unmap_nested(pte) kunmap_atomic(pte, KM_PTE1)
 #else

From 3cdfd04b47860811ff2012a7b28964e7499b0bca Mon Sep 17 00:00:00 2001
From: "iap10@labyrinth.cl.cam.ac.uk" <iap10@labyrinth.cl.cam.ac.uk>
Date: Tue, 10 Aug 2004 20:51:11 +0000
Subject: [PATCH 05/10] bitkeeper revision 1.1159.20.1
 (4119353fK0fKs_SYKxrgvHgZ7WbE4Q)

migration blkdev and netdev resume fixes
---
 .../arch/xen/drivers/blkif/frontend/main.c      | 12 ++++++++++++
 linux-2.4.26-xen-sparse/arch/xen/kernel/setup.c |  5 +++--
 .../drivers/xen/netfront/netfront.c             | 17 +++++++++++++++++
 3 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/linux-2.4.26-xen-sparse/arch/xen/drivers/blkif/frontend/main.c b/linux-2.4.26-xen-sparse/arch/xen/drivers/blkif/frontend/main.c
index 015d62c624..0d5fd96968 100644
--- a/linux-2.4.26-xen-sparse/arch/xen/drivers/blkif/frontend/main.c
+++ b/linux-2.4.26-xen-sparse/arch/xen/drivers/blkif/frontend/main.c
@@ -805,4 +805,16 @@ void blkdev_suspend(void)
 
 void blkdev_resume(void)
 {
+    ctrl_msg_t                       cmsg;
+    blkif_fe_driver_status_changed_t st;
+    
+
+    /* Send a driver-UP notification to the domain controller. */
+    cmsg.type      = CMSG_BLKIF_FE;
+    cmsg.subtype   = CMSG_BLKIF_FE_DRIVER_STATUS_CHANGED;
+    cmsg.length    = sizeof(blkif_fe_driver_status_changed_t);
+    st.status      = BLKIF_DRIVER_STATUS_UP;
+    memcpy(cmsg.msg, &st, sizeof(st));
+    ctrl_if_send_message_block(&cmsg, NULL, 0, TASK_UNINTERRUPTIBLE);
 }
+
diff --git a/linux-2.4.26-xen-sparse/arch/xen/kernel/setup.c b/linux-2.4.26-xen-sparse/arch/xen/kernel/setup.c
index c218d199d1..6acd49bc06 100644
--- a/linux-2.4.26-xen-sparse/arch/xen/kernel/setup.c
+++ b/linux-2.4.26-xen-sparse/arch/xen/kernel/setup.c
@@ -1200,6 +1200,7 @@ static void __do_suspend(void)
     /* Hmmm... a cleaner interface to suspend/resume blkdevs would be nice. */
     extern void blkdev_suspend(void);
     extern void blkdev_resume(void);
+    extern void netif_resume(void);
     
     extern void time_suspend(void);
     extern void time_resume(void);
@@ -1248,8 +1249,8 @@ static void __do_suspend(void)
 
     __sti();
 
-    //blkdev_resume();
-    //netdev_resume();
+    blkdev_resume();
+    netif_resume();
 
  out:
     if ( suspend_record != NULL )
diff --git a/linux-2.6.7-xen-sparse/drivers/xen/netfront/netfront.c b/linux-2.6.7-xen-sparse/drivers/xen/netfront/netfront.c
index c85e30610e..368feadc55 100644
--- a/linux-2.6.7-xen-sparse/drivers/xen/netfront/netfront.c
+++ b/linux-2.6.7-xen-sparse/drivers/xen/netfront/netfront.c
@@ -874,4 +874,21 @@ static int __init netif_init(void)
     return err;
 }
 
+void netif_resume(void)
+{
+    ctrl_msg_t                       cmsg;
+    netif_fe_driver_status_changed_t st;
+
+    /* Send a driver-UP notification to the domain controller. */
+    cmsg.type      = CMSG_NETIF_FE;
+    cmsg.subtype   = CMSG_NETIF_FE_DRIVER_STATUS_CHANGED;
+    cmsg.length    = sizeof(netif_fe_driver_status_changed_t);
+    st.status      = NETIF_DRIVER_STATUS_UP;
+    st.nr_interfaces = 0;
+    memcpy(cmsg.msg, &st, sizeof(st));
+    ctrl_if_send_message_block(&cmsg, NULL, 0, TASK_UNINTERRUPTIBLE);
+
+}
+
+
 __initcall(netif_init);

From 19d852948654c15d9865ffa337d17332d0793893 Mon Sep 17 00:00:00 2001
From: "kaf24@scramble.cl.cam.ac.uk" <kaf24@scramble.cl.cam.ac.uk>
Date: Tue, 10 Aug 2004 21:04:26 +0000
Subject: [PATCH 06/10] bitkeeper revision 1.1159.17.5
 (4119385aTLA7Shj5_vrBcoAQ3-zimg)

Cset exclude: gm281@boulderdash.cl.cam.ac.uk|ChangeSet|20040810153437|54233
---
 tools/examples/xmdefaults               |  4 ----
 tools/examples/xmexample                |  4 ----
 tools/libxc/xc.h                        |  1 -
 tools/libxc/xc_domain.c                 |  3 ---
 tools/python/xen/lowlevel/xc/xc.c       | 13 +++++--------
 tools/python/xen/xend/XendDomainInfo.py |  5 +----
 tools/python/xen/xm/create.py           |  7 +------
 xen/arch/x86/smpboot.c                  |  2 +-
 xen/common/dom0_ops.c                   |  4 ++--
 xen/common/domain.c                     |  6 +++---
 xen/common/kernel.c                     |  2 +-
 xen/common/sched_atropos.c              |  6 ++----
 xen/common/sched_bvt.c                  |  9 +++------
 xen/common/sched_fair_bvt.c             |  9 +++------
 xen/common/sched_rrobin.c               |  7 +++----
 xen/common/schedule.c                   |  4 ++--
 xen/include/hypervisor-ifs/dom0_ops.h   |  2 +-
 xen/include/xen/sched-if.h              |  2 +-
 xen/include/xen/sched.h                 |  4 ++--
 19 files changed, 31 insertions(+), 63 deletions(-)

diff --git a/tools/examples/xmdefaults b/tools/examples/xmdefaults
index 0c1f52b69d..0b7c5b2230 100644
--- a/tools/examples/xmdefaults
+++ b/tools/examples/xmdefaults
@@ -25,10 +25,6 @@ name = "ExampleDomain"
 
 # Which CPU to start domain on? 
 #cpu = -1   # leave to Xen to pick
-# The weight (CPU share) of the domain. Works with all
-# schedulers that have notion of weight (eg BVT). 
-# Default is 1. Float values can be used.
-#weight = 1.5
 
 #----------------------------------------------------------------------------
 # Define network interfaces.
diff --git a/tools/examples/xmexample b/tools/examples/xmexample
index b8717fb29a..d6df731c45 100644
--- a/tools/examples/xmexample
+++ b/tools/examples/xmexample
@@ -55,10 +55,6 @@ name = "VM%d" % vmid
 # Which CPU to start domain on? 
 #cpu = -1   # leave to Xen to pick
 cpu = vmid  # set based on vmid (mod number of CPUs)
-# The weight (CPU share) of the domain. Works with all
-# schedulers that have notion of weight (eg BVT). 
-# Default is 1. Float values can be used.
-#weight = 1.5
 
 #----------------------------------------------------------------------------
 # Define network interfaces.
diff --git a/tools/libxc/xc.h b/tools/libxc/xc.h
index d44c1942f5..b2cf0c67ba 100644
--- a/tools/libxc/xc.h
+++ b/tools/libxc/xc.h
@@ -48,7 +48,6 @@ int xc_domain_create(int xc_handle,
                      unsigned int mem_kb, 
                      const char *name,
                      int cpu,
-                     float weight,
                      u32 *pdomid);
 int xc_domain_pause(int xc_handle, 
                     u32 domid);
diff --git a/tools/libxc/xc_domain.c b/tools/libxc/xc_domain.c
index 41bff1fe5f..10017c74fe 100644
--- a/tools/libxc/xc_domain.c
+++ b/tools/libxc/xc_domain.c
@@ -12,7 +12,6 @@ int xc_domain_create(int xc_handle,
                      unsigned int mem_kb, 
                      const char *name,
                      int cpu,
-                     float weight,
                      u32 *pdomid)
 {
     int err;
@@ -21,8 +20,6 @@ int xc_domain_create(int xc_handle,
     op.cmd = DOM0_CREATEDOMAIN;
     op.u.createdomain.domain = (domid_t)*pdomid;
     op.u.createdomain.memory_kb = mem_kb;
-    /* The weight of a domain added to the domain creation code */
-    op.u.createdomain.weight = weight;
     strncpy(op.u.createdomain.name, name, MAX_DOMAIN_NAME);
     op.u.createdomain.name[MAX_DOMAIN_NAME-1] = '\0';
     op.u.createdomain.cpu = cpu;
diff --git a/tools/python/xen/lowlevel/xc/xc.c b/tools/python/xen/lowlevel/xc/xc.c
index d2a12026ef..4b5a426b55 100644
--- a/tools/python/xen/lowlevel/xc/xc.c
+++ b/tools/python/xen/lowlevel/xc/xc.c
@@ -44,19 +44,16 @@ static PyObject *pyxc_domain_create(PyObject *self,
     unsigned int mem_kb = 0;
     char        *name   = "(anon)";
     int          cpu = -1;
-    float        weight;
     u32          dom = 0;
     int          ret;
 
-    static char *kwd_list[] = { "dom", "mem_kb", "name", "cpu", "weight",
-                                                                        NULL };
+    static char *kwd_list[] = { "dom", "mem_kb", "name", "cpu", NULL };
 
-    if ( !PyArg_ParseTupleAndKeywords(args, kwds, "|iisif", kwd_list, 
-                                      &dom, &mem_kb, &name, &cpu, &weight) )
+    if ( !PyArg_ParseTupleAndKeywords(args, kwds, "|iisi", kwd_list, 
+                                      &dom, &mem_kb, &name, &cpu) )
         return NULL;
-        
-    if ( (ret = xc_domain_create(xc->xc_handle, mem_kb, name, cpu, 
-                                                     weight, &dom)) < 0 )
+
+    if ( (ret = xc_domain_create(xc->xc_handle, mem_kb, name, cpu, &dom)) < 0 )
         return PyErr_SetFromErrno(xc_error);
 
     return PyInt_FromLong(dom);
diff --git a/tools/python/xen/xend/XendDomainInfo.py b/tools/python/xen/xend/XendDomainInfo.py
index 6032f6919d..0df3c2208a 100644
--- a/tools/python/xen/xend/XendDomainInfo.py
+++ b/tools/python/xen/xend/XendDomainInfo.py
@@ -486,7 +486,6 @@ class XendDomainInfo:
         self.config = config
         try:
             self.name = sxp.child_value(config, 'name')
-            self.weight = float(sxp.child_value(config, 'weight'))
             self.check_name(self.name)
             self.memory = int(sxp.child_value(config, 'memory'))
             if self.memory is None:
@@ -706,10 +705,9 @@ class XendDomainInfo:
             return
         memory = self.memory
         name = self.name
-        weight = self.weight
         cpu = int(sxp.child_value(self.config, 'cpu', '-1'))
         dom = self.dom or 0
-        dom = xc.domain_create(dom= dom, mem_kb= memory * 1024, name= name, cpu= cpu, weight= weight)
+        dom = xc.domain_create(dom= dom, mem_kb= memory * 1024, name= name, cpu= cpu)
         if dom <= 0:
             raise VmError('Creating domain failed: name=%s memory=%d'
                           % (name, memory))
@@ -1139,7 +1137,6 @@ add_device_handler('pci',  vm_dev_pci)
 add_config_handler('name',    vm_field_ignore)
 add_config_handler('memory',  vm_field_ignore)
 add_config_handler('cpu',     vm_field_ignore)
-add_config_handler('weight',  vm_field_ignore)
 add_config_handler('console', vm_field_ignore)
 add_config_handler('image',   vm_field_ignore)
 add_config_handler('device',  vm_field_ignore)
diff --git a/tools/python/xen/xm/create.py b/tools/python/xen/xm/create.py
index f28f203849..286e1d3478 100644
--- a/tools/python/xen/xm/create.py
+++ b/tools/python/xen/xm/create.py
@@ -97,10 +97,6 @@ gopts.var('memory', val='MEMORY',
           fn=set_value, default=128,
           use="Domain memory in MB.")
 
-gopts.var('weight', val='WEIGHT',
-          fn=set_value, default=1,
-          use="Domain cpu weight (default=1).")
-
 gopts.var('console', val='PORT',
           fn=set_int, default=None,
           use="Console port to use. Default is 9600 + domain id.")
@@ -299,8 +295,7 @@ def make_config(vals):
     
     config = ['vm',
               ['name', vals.name ],
-              ['memory', vals.memory ],
-              ['weight', vals.weight] ]
+              ['memory', vals.memory ] ]
     if vals.cpu:
         config.append(['cpu', vals.cpu])
     if vals.blkif:
diff --git a/xen/arch/x86/smpboot.c b/xen/arch/x86/smpboot.c
index da4130f34e..bd9c0951ec 100644
--- a/xen/arch/x86/smpboot.c
+++ b/xen/arch/x86/smpboot.c
@@ -650,7 +650,7 @@ static void __init do_boot_cpu (int apicid)
 
     cpu = ++cpucount;
 
-    if ( (idle = do_createdomain(IDLE_DOMAIN_ID, cpu, 0)) == NULL )
+    if ( (idle = do_createdomain(IDLE_DOMAIN_ID, cpu)) == NULL )
         panic("failed 'createdomain' for CPU %d", cpu);
 
     set_bit(DF_IDLETASK, &idle->flags);
diff --git a/xen/common/dom0_ops.c b/xen/common/dom0_ops.c
index e31d0a6025..0a4086ef6e 100644
--- a/xen/common/dom0_ops.c
+++ b/xen/common/dom0_ops.c
@@ -182,9 +182,9 @@ long do_dom0_op(dom0_op_t *u_dom0_op)
             pro = op->u.createdomain.cpu % smp_num_cpus;
 
         ret = -ENOMEM;
-        if ( (d = do_createdomain(dom, pro, op->u.createdomain.weight))==NULL)
+        if ( (d = do_createdomain(dom, pro)) == NULL )
             break;
-        
+
         if ( op->u.createdomain.name[0] )
         {
             strncpy(d->name, op->u.createdomain.name, MAX_DOMAIN_NAME);
diff --git a/xen/common/domain.c b/xen/common/domain.c
index 3f3f876111..cac4c2edf0 100644
--- a/xen/common/domain.c
+++ b/xen/common/domain.c
@@ -22,7 +22,7 @@ rwlock_t tasklist_lock __cacheline_aligned = RW_LOCK_UNLOCKED;
 struct domain *task_hash[TASK_HASH_SIZE];
 struct domain *task_list;
 
-struct domain *do_createdomain(domid_t dom_id, unsigned int cpu, float weight)
+struct domain *do_createdomain(domid_t dom_id, unsigned int cpu)
 {
     char buf[100];
     struct domain *d, **pd;
@@ -69,7 +69,7 @@ struct domain *do_createdomain(domid_t dom_id, unsigned int cpu, float weight)
         spin_lock_init(&d->pcidev_lock);
         INIT_LIST_HEAD(&d->pcidev_list);
 
-        sched_add_domain(d, weight);
+        sched_add_domain(d);
 
         write_lock_irqsave(&tasklist_lock, flags);
         pd = &task_list; /* NB. task_list is maintained in order of dom_id. */
@@ -85,7 +85,7 @@ struct domain *do_createdomain(domid_t dom_id, unsigned int cpu, float weight)
     else
     {
         sprintf(d->name, "Idle-%d", cpu);
-        sched_add_domain(d, weight);
+        sched_add_domain(d);
     }
 
     return d;
diff --git a/xen/common/kernel.c b/xen/common/kernel.c
index 0e0b240b79..6a39946d70 100644
--- a/xen/common/kernel.c
+++ b/xen/common/kernel.c
@@ -306,7 +306,7 @@ void cmain(multiboot_info_t *mbi)
     task_hash[TASK_HASH(IDLE_DOMAIN_ID)] = &idle0_task;
 
     /* Create initial domain 0. */
-    new_dom = do_createdomain(0, 0, 1);
+    new_dom = do_createdomain(0, 0);
     if ( new_dom == NULL )
         panic("Error creating domain 0\n");
 
diff --git a/xen/common/sched_atropos.c b/xen/common/sched_atropos.c
index b93ea89dd9..53e4519b9f 100644
--- a/xen/common/sched_atropos.c
+++ b/xen/common/sched_atropos.c
@@ -167,10 +167,8 @@ static void requeue(struct domain *sdom)
      * - they shouldn't be on any queue */
 }
 
-/* prepare a task to be added to scheduling 
-    TODO - can weight argument can be used to set up the 
-    scheduling parameters? */
-static void at_add_task(struct domain *p, float weight)
+/* prepare a task to be added to scheduling */
+static void at_add_task(struct domain *p)
 {
     s_time_t now = NOW();
 
diff --git a/xen/common/sched_bvt.c b/xen/common/sched_bvt.c
index 25e71f0e4d..e4ee214b54 100644
--- a/xen/common/sched_bvt.c
+++ b/xen/common/sched_bvt.c
@@ -180,16 +180,13 @@ int bvt_alloc_task(struct domain *p)
 /*
  * Add and remove a domain
  */
-void bvt_add_task(struct domain *p, float weight) 
+void bvt_add_task(struct domain *p) 
 {
     struct bvt_dom_info *inf = BVT_INFO(p);
     ASSERT(inf != NULL);
     ASSERT(p   != NULL);
 
-    if(weight > 0)
-        inf->mcu_advance = MCU_ADVANCE / weight;
-    else
-        inf->mcu_advance = MCU_ADVANCE;
+    inf->mcu_advance = MCU_ADVANCE;
     inf->domain = p;
     inf->warpback    = 0;
     /* Set some default values here. */
@@ -227,7 +224,7 @@ int bvt_init_idle_task(struct domain *p)
 
     if(bvt_alloc_task(p) < 0) return -1;
 
-    bvt_add_task(p, 0);
+    bvt_add_task(p);
 
     spin_lock_irqsave(&CPU_INFO(p->processor)->run_lock, flags);
     
diff --git a/xen/common/sched_fair_bvt.c b/xen/common/sched_fair_bvt.c
index 3e027f8706..165c128753 100644
--- a/xen/common/sched_fair_bvt.c
+++ b/xen/common/sched_fair_bvt.c
@@ -152,17 +152,14 @@ int fbvt_alloc_task(struct domain *p)
 /*
  * Add and remove a domain
  */
-void fbvt_add_task(struct domain *p, float weight) 
+void fbvt_add_task(struct domain *p) 
 {
     struct fbvt_dom_info *inf = FBVT_INFO(p);
 
     ASSERT(inf != NULL);
     ASSERT(p   != NULL);
 
-    if(weight > 0)
-        inf->mcu_advance = MCU_ADVANCE / weight;
-    else
-        inf->mcu_advance = MCU_ADVANCE;
+    inf->mcu_advance = MCU_ADVANCE;
     inf->domain = p;
     if ( p->domain == IDLE_DOMAIN_ID )
     {
@@ -190,7 +187,7 @@ int fbvt_init_idle_task(struct domain *p)
 
     if(fbvt_alloc_task(p) < 0) return -1;
 
-    fbvt_add_task(p, 0);
+    fbvt_add_task(p);
     spin_lock_irqsave(&CPU_INFO(p->processor)->run_lock, flags);
     set_bit(DF_RUNNING, &p->flags);
     if ( !__task_on_runqueue(p) )
diff --git a/xen/common/sched_rrobin.c b/xen/common/sched_rrobin.c
index 28b0f73fa8..2ab5604fb5 100644
--- a/xen/common/sched_rrobin.c
+++ b/xen/common/sched_rrobin.c
@@ -101,9 +101,8 @@ static int rr_alloc_task(struct domain *d)
    return 0;
 }
 
-/* Setup the rr_dom_info 
-   The weight argument is ignored as RRobin does not use weights */
-static void rr_add_task(struct domain *p, float weight)
+/* Setup the rr_dom_info */
+static void rr_add_task(struct domain *p)
 {
     struct rrobin_dom_info *inf;
     RR_INFO(p)->domain = p;
@@ -122,7 +121,7 @@ static int rr_init_idle_task(struct domain *p)
 {
     unsigned long flags;
     if(rr_alloc_task(p) < 0) return -1;
-    rr_add_task(p, 0);
+    rr_add_task(p);
 
     spin_lock_irqsave(&run_locks[p->processor], flags);
     set_bit(DF_RUNNING, &p->flags);
diff --git a/xen/common/schedule.c b/xen/common/schedule.c
index b37635324b..d2778e09ed 100644
--- a/xen/common/schedule.c
+++ b/xen/common/schedule.c
@@ -123,7 +123,7 @@ struct domain *alloc_domain_struct(void)
 /*
  * Add and remove a domain
  */
-void sched_add_domain(struct domain *d, float weight) 
+void sched_add_domain(struct domain *d) 
 {
     /* Must be unpaused by control software to start execution. */
     set_bit(DF_CTRLPAUSE, &d->flags);
@@ -141,7 +141,7 @@ void sched_add_domain(struct domain *d, float weight)
         schedule_data[d->processor].idle = d;
     }
 
-    SCHED_OP(add_task, d, weight);
+    SCHED_OP(add_task, d);
 
     TRACE_2D(TRC_SCHED_DOM_ADD, d->domain, d);
 }
diff --git a/xen/include/hypervisor-ifs/dom0_ops.h b/xen/include/hypervisor-ifs/dom0_ops.h
index cef857f5e5..8cea03fac2 100644
--- a/xen/include/hypervisor-ifs/dom0_ops.h
+++ b/xen/include/hypervisor-ifs/dom0_ops.h
@@ -55,7 +55,7 @@ typedef struct {
     MEMORY_PADDING;
     u8           name[MAX_DOMAIN_NAME]; /*  8 */
     u32          cpu;                 /* 24 */
-    float        weight;              /* 28 */
+    u32          __pad0;              /* 28 */
     /* IN/OUT parameters. */
     /* If 0, domain is allocated. If non-zero use it unless in use. */
     domid_t      domain;              /* 32 */
diff --git a/xen/include/xen/sched-if.h b/xen/include/xen/sched-if.h
index 9088e61733..15f992614a 100644
--- a/xen/include/xen/sched-if.h
+++ b/xen/include/xen/sched-if.h
@@ -38,7 +38,7 @@ struct scheduler
     int          (*init_scheduler) ();
     int          (*init_idle_task) (struct domain *);
     int          (*alloc_task)     (struct domain *);
-    void         (*add_task)       (struct domain *, float weight);
+    void         (*add_task)       (struct domain *);
     void         (*free_task)      (struct domain *);
     void         (*rem_task)       (struct domain *);
     void         (*sleep)          (struct domain *);
diff --git a/xen/include/xen/sched.h b/xen/include/xen/sched.h
index 3b8ad6c58b..06b6faf6cc 100644
--- a/xen/include/xen/sched.h
+++ b/xen/include/xen/sched.h
@@ -171,7 +171,7 @@ static inline int get_domain(struct domain *d)
 }
   
 extern struct domain *do_createdomain(
-    domid_t dom_id, unsigned int cpu, float weight);
+    domid_t dom_id, unsigned int cpu);
 extern int construct_dom0(struct domain *d, 
                           unsigned long alloc_start,
                           unsigned long alloc_end,
@@ -198,7 +198,7 @@ extern unsigned long wait_init_idle;
 #define set_current_state(_s) do { current->state = (_s); } while (0)
 void scheduler_init(void);
 void schedulers_start(void);
-void sched_add_domain(struct domain *d, float weight);
+void sched_add_domain(struct domain *d);
 void sched_rem_domain(struct domain *d);
 long sched_ctl(struct sched_ctl_cmd *);
 long sched_adjdom(struct sched_adjdom_cmd *);

From d985fae1b44067b47f06175b26b3c9d8db382dcc Mon Sep 17 00:00:00 2001
From: "kaf24@scramble.cl.cam.ac.uk" <kaf24@scramble.cl.cam.ac.uk>
Date: Tue, 10 Aug 2004 21:12:00 +0000
Subject: [PATCH 07/10] bitkeeper revision 1.1159.17.6
 (41193a207z6kESTDa2SXhULAPY-Bmw)

Fix the broken build. Also avoid floating-point code in Xen.
---
 tools/libxc/xc_linux_restore.c | 3 +--
 xen/arch/x86/Rules.mk          | 3 +++
 xen/common/sched_fair_bvt.c    | 4 ++--
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/tools/libxc/xc_linux_restore.c b/tools/libxc/xc_linux_restore.c
index 1ce1837e35..62050c83eb 100644
--- a/tools/libxc/xc_linux_restore.c
+++ b/tools/libxc/xc_linux_restore.c
@@ -224,8 +224,7 @@ int xc_linux_restore(int xc_handle, XcIOContext *ioctxt)
 
     /* XXX create domain on CPU=-1 so that in future it auto load ballances by default */
     if ( xc_domain_create( xc_handle,  nr_pfns * (PAGE_SIZE / 1024),
-			   name,
-			   -1, 1, &dom ) )
+			   name, -1, &dom ) )
     {
 	xcio_error(ioctxt, "Could not create domain. pfns=%d, %dKB",
 		   nr_pfns,nr_pfns * (PAGE_SIZE / 1024));
diff --git a/xen/arch/x86/Rules.mk b/xen/arch/x86/Rules.mk
index 2ecca1fffe..e419bba514 100644
--- a/xen/arch/x86/Rules.mk
+++ b/xen/arch/x86/Rules.mk
@@ -8,6 +8,9 @@ CFLAGS  := -nostdinc -fno-builtin -fno-common -fno-strict-aliasing -O3
 CFLAGS  += -iwithprefix include -Wall -Werror -fomit-frame-pointer -pipe
 CFLAGS  += -I$(BASEDIR)/include -Wno-pointer-arith -Wredundant-decls
 
+# Prevent floating-point variables from creeping into Xen.
+CFLAGS  += -msoft-float
+
 ifeq ($(TARGET_SUBARCH),x86_32)
 CFLAGS  += -m32 -march=i686
 LDFLAGS := --oformat elf32-i386 
diff --git a/xen/common/sched_fair_bvt.c b/xen/common/sched_fair_bvt.c
index 165c128753..ac37c582eb 100644
--- a/xen/common/sched_fair_bvt.c
+++ b/xen/common/sched_fair_bvt.c
@@ -252,7 +252,7 @@ static void fbvt_wake(struct domain *d)
          * values, the virtual time can be determined as:
          * SVT - const * TIME_SLEPT
          */
-        io_warp = (int)(0.5 * inf->time_slept);
+        io_warp = inf->time_slept/2;
         if ( io_warp > 1000 )
             io_warp = 1000;
 
@@ -551,7 +551,7 @@ static task_slice_t fbvt_do_schedule(s_time_t now)
      * domains earlier in virtual time). Together this should give quite
      * good control both for CPU and IO-bound domains.
      */
-    LAST_VTB(cpu) = (int)(0.2 * next_inf->time_slept);
+    LAST_VTB(cpu) = next_inf->time_slept/5;
     if(LAST_VTB(cpu) / next_inf->mcu_advance > max_vtb / MCU) 
         LAST_VTB(cpu) = max_vtb * next_inf->mcu_advance / MCU;
 

From 81e8a9dce6211e9632aa321ef4b915dde096df71 Mon Sep 17 00:00:00 2001
From: "kaf24@scramble.cl.cam.ac.uk" <kaf24@scramble.cl.cam.ac.uk>
Date: Tue, 10 Aug 2004 21:21:41 +0000
Subject: [PATCH 08/10] bitkeeper revision 1.1159.21.1
 (41193c65K9NbWw4E7FhhvSPwFS3svQ)

More binary-rewrite patches.
---
 .../arch/xen/i386/mm/fault.c                  |   3 +-
 .../arch/xen/i386/mm/pgtable.c                |  13 +-
 .../arch/xen/kernel/fixup.c                   | 348 ++++++++++--------
 .../include/asm-xen/asm-i386/fixmap.h         |   6 +-
 .../include/asm-xen/asm-i386/pgtable.h        |   7 +-
 5 files changed, 212 insertions(+), 165 deletions(-)

diff --git a/linux-2.6.7-xen-sparse/arch/xen/i386/mm/fault.c b/linux-2.6.7-xen-sparse/arch/xen/i386/mm/fault.c
index d850d279d5..f508ccd8c3 100644
--- a/linux-2.6.7-xen-sparse/arch/xen/i386/mm/fault.c
+++ b/linux-2.6.7-xen-sparse/arch/xen/i386/mm/fault.c
@@ -248,7 +248,8 @@ asmlinkage void do_page_fault(struct pt_regs *regs, unsigned long error_code,
 	 * (error_code & 4) == 0, and that the fault was not a
 	 * protection error (error_code & 1) == 0.
 	 */
-	if (unlikely(address >= TASK_SIZE)) { 
+	if (unlikely(address >= TASK_SIZE) ||
+	    unlikely(address < (FIRST_USER_PGD_NR<<PGDIR_SHIFT))) { 
 		if (!(error_code & 5))
 			goto vmalloc_fault;
 		/* 
diff --git a/linux-2.6.7-xen-sparse/arch/xen/i386/mm/pgtable.c b/linux-2.6.7-xen-sparse/arch/xen/i386/mm/pgtable.c
index cbab491f2e..b5fdd533a8 100644
--- a/linux-2.6.7-xen-sparse/arch/xen/i386/mm/pgtable.c
+++ b/linux-2.6.7-xen-sparse/arch/xen/i386/mm/pgtable.c
@@ -250,16 +250,21 @@ void pgd_ctor(void *pgd, kmem_cache_t *cache, unsigned long unused)
 	if (PTRS_PER_PMD == 1)
 		spin_lock_irqsave(&pgd_lock, flags);
 
-	memcpy((pgd_t *)pgd + USER_PTRS_PER_PGD,
-			swapper_pg_dir + USER_PTRS_PER_PGD,
-			(PTRS_PER_PGD - USER_PTRS_PER_PGD) * sizeof(pgd_t));
+	memcpy((pgd_t *)pgd,
+			swapper_pg_dir,
+			FIRST_USER_PGD_NR * sizeof(pgd_t));
+	memcpy((pgd_t *)pgd + FIRST_USER_PGD_NR + USER_PTRS_PER_PGD,
+			swapper_pg_dir + FIRST_USER_PGD_NR + USER_PTRS_PER_PGD,
+			(PTRS_PER_PGD - USER_PTRS_PER_PGD -
+			 FIRST_USER_PGD_NR) * sizeof(pgd_t));
 
 	if (PTRS_PER_PMD > 1)
 		goto out;
 
 	pgd_list_add(pgd);
 	spin_unlock_irqrestore(&pgd_lock, flags);
-	memset(pgd, 0, USER_PTRS_PER_PGD*sizeof(pgd_t));
+	memset((pgd_t *)pgd + FIRST_USER_PGD_NR,
+			0, USER_PTRS_PER_PGD*sizeof(pgd_t));
  out:
 	__make_page_readonly(pgd);
 	queue_pgd_pin(__pa(pgd));
diff --git a/linux-2.6.7-xen-sparse/arch/xen/kernel/fixup.c b/linux-2.6.7-xen-sparse/arch/xen/kernel/fixup.c
index 61c5497f40..e20be71808 100644
--- a/linux-2.6.7-xen-sparse/arch/xen/kernel/fixup.c
+++ b/linux-2.6.7-xen-sparse/arch/xen/kernel/fixup.c
@@ -27,11 +27,12 @@
 #include <linux/sched.h>
 #include <linux/kernel.h>
 #include <linux/highmem.h>
+#include <linux/vmalloc.h>
 #include <asm/fixmap.h>
 #include <asm/pgtable.h>
 #include <asm/uaccess.h>
 
-#if 0
+#if 1
 #define ASSERT(_p) \
     if ( !(_p) ) { printk("Assertion '%s' failed, line %d, file %s", #_p , \
     __LINE__, __FILE__); *(int*)0=0; }
@@ -43,35 +44,57 @@
 #define DPRINTK(_f, _a...) ((void)0)
 #endif
 
+static char            *fixup_buf;
+#define FIXUP_BUF_USER  PAGE_SIZE
+#define FIXUP_BUF_ORDER 1
+#define FIXUP_BUF_SIZE  (PAGE_SIZE<<FIXUP_BUF_ORDER)
+#define PATCH_LEN       5
+
 struct fixup_entry {
-    unsigned long  patch_addr;
+    unsigned long  patch_addr; /* XXX */
     unsigned char  patched_code[20];
     unsigned short patched_code_len;
     unsigned short fixup_idx;
+    unsigned short return_idx;
     struct fixup_entry *next;
 };
 
 #define FIXUP_HASHSZ 128
 static struct fixup_entry *fixup_hash[FIXUP_HASHSZ];
-#define FIXUP_HASH(_a) ((unsigned int)(_a) & (FIXUP_HASHSZ-1))
+static inline int FIXUP_HASH(char *b)
+{
+    int i, j = 0;
+    for ( i = 0; i < PATCH_LEN; i++ )
+        j ^= b[i];
+    return j & (FIXUP_HASHSZ-1);
+}
 
+/* General instruction properties. */
 #define INSN_SUFFIX_BYTES (7)
 #define PREFIX_BYTE       (1<<3)
 #define OPCODE_BYTE       (1<<4)  
 #define HAS_MODRM         (1<<5)
 
-#define X  0 /* invalid */
+/* Helpful codes for the main decode routine. */
+#define CODE_MASK         (3<<6)
+#define PUSH              (0<<6) /* PUSH onto stack */
+#define POP               (1<<6) /* POP from stack */
+#define JMP               (2<<6) /* 8-bit relative JMP */
+
+/* Short forms for the table. */
+#define X  0 /* invalid for some random reason */
+#define S  0 /* invalid because it munges the stack */
 #define P  PREFIX_BYTE
 #define O  OPCODE_BYTE
 #define M  HAS_MODRM
 
 static unsigned char insn_decode[256] = {
     /* 0x00 - 0x0F */
-    O|M, O|M, O|M, O|M, O|1, O|4, O, O,
-    O|M, O|M, O|M, O|M, O|1, O|4, O, X,
+    O|M, O|M, O|M, O|M, O|1, O|4, S, S,
+    O|M, O|M, O|M, O|M, O|1, O|4, S, X,
     /* 0x10 - 0x1F */
-    O|M, O|M, O|M, O|M, O|1, O|4, O, O,
-    O|M, O|M, O|M, O|M, O|1, O|4, O, O,
+    O|M, O|M, O|M, O|M, O|1, O|4, S, S,
+    O|M, O|M, O|M, O|M, O|1, O|4, S, S,
     /* 0x20 - 0x2F */
     O|M, O|M, O|M, O|M, O|1, O|4, P, O,
     O|M, O|M, O|M, O|M, O|1, O|4, P, O,
@@ -79,20 +102,20 @@ static unsigned char insn_decode[256] = {
     O|M, O|M, O|M, O|M, O|1, O|4, P, O,
     O|M, O|M, O|M, O|M, O|1, O|4, P, O,
     /* 0x40 - 0x4F */
-    O, O, O, O, O, O, O, O,
-    O, O, O, O, O, O, O, O,
+    O, O, O, O, S, O, O, O,
+    O, O, O, O, S, O, O, O,
     /* 0x50 - 0x5F */
-    O, O, O, O, O, O, O, O,
-    O, O, O, O, O, O, O, O,
+    O|PUSH, O|PUSH, O|PUSH, O|PUSH, S, O|PUSH, O|PUSH, O|PUSH,
+    O|POP, O|POP, O|POP, O|POP, S, O|POP, O|POP, O|POP,
     /* 0x60 - 0x6F */
-    O, O, O|M, O|M, P, P, X, X,
-    O|4, O|M|4, O|1, O|M|1, O, O, O, O,
+    S, S, O|M, O|M, P, P, X, X,
+    O|4|PUSH, O|M|4, O|1|PUSH, O|M|1, O, O, O, O,
     /* 0x70 - 0x7F */
-    O|1, O|1, O|1, O|1, O|1, O|1, O|1, O|1,
-    O|1, O|1, O|1, O|1, O|1, O|1, O|1, O|1,
+    O|1|JMP, O|1|JMP, O|1|JMP, O|1|JMP, O|1|JMP, O|1|JMP, O|1|JMP, O|1|JMP,
+    O|1|JMP, O|1|JMP, O|1|JMP, O|1|JMP, O|1|JMP, O|1|JMP, O|1|JMP, O|1|JMP,
     /* 0x80 - 0x8F */
     O|M|1, O|M|4, O|M|1, O|M|1, O|M, O|M, O|M, O|M,
-    O|M, O|M, O|M, O|M, O|M, O|M, O|M, O|M, 
+    O|M, O|M, O|M, O|M, O|M, O|M, O|M, O|M|POP, 
     /* 0x90 - 0x9F */
     O, O, O, O, O, O, O, O,
     O, O, X, O, O, O, O, O,
@@ -110,13 +133,15 @@ static unsigned char insn_decode[256] = {
     X, X, X, X, X, X, X, X,
     /* 0xE0 - 0xEF */
     X, X, X, X, X, X, X, X,
-    X, O|4, X, O|1, X, X, X, X,
+    X, O|4, X, O|1|JMP, X, X, X, X,
     /* 0xF0 - 0xFF */
     P, X, P, P, O, O, O|M|1, O|M|4, 
-    O, O, O, O, O, O, O|M, O|M
+    O, O, O, O, O, O, O|M, X
 };
 
-static unsigned int get_insn_len(unsigned char *insn, unsigned char *p_opcode)
+static unsigned int get_insn_len(unsigned char *insn, 
+                                 unsigned char *p_opcode,
+                                 unsigned char *p_decode)
 {
     unsigned char b, d, *pb, mod, rm;
 
@@ -130,10 +155,14 @@ static unsigned int get_insn_len(unsigned char *insn, unsigned char *p_opcode)
     }
 
     *p_opcode = b;
+    *p_decode = d;
 
     /* 2. Ensure we have a valid opcode byte. */
     if ( !(d & OPCODE_BYTE) )
+    {
+        printk(KERN_ALERT " *** %02x %02x %02x\n", pb[0], pb[1], pb[2]);
         return 0;
+    }
 
     /* 3. Process Mod/RM if there is one. */
     if ( d & HAS_MODRM )
@@ -175,13 +204,10 @@ static unsigned char handleable_code[32] = {
 asmlinkage void do_fixup_4gb_segment(struct pt_regs *regs, long error_code)
 {
     static unsigned int fixup_idx = 0;
-    int relbyte_idx = -1, relword_idx = -1, save_indirect_reg;
+    unsigned int fi;
+    int save_indirect_reg, hash, rel_idx;
     unsigned int insn_len = (unsigned int)error_code, new_insn_len;
-    unsigned char b[20], modrm, mod, reg, rm, patch[5], opcode;
-    unsigned char *fixup_buf = 
-        (unsigned char *)fix_to_virt(FIX_4GB_SEGMENT_FIXUP_RW);
-    unsigned long fixup_buf_user = 
-        fix_to_virt(FIX_4GB_SEGMENT_FIXUP_RO);
+    unsigned char b[20], modrm, mod, reg, rm, patch[PATCH_LEN], opcode, decode;
     unsigned long eip = regs->eip - insn_len;
     struct fixup_entry *fe;
     pte_t *pte;
@@ -198,28 +224,50 @@ asmlinkage void do_fixup_4gb_segment(struct pt_regs *regs, long error_code)
 
     if ( unlikely(eip >= (PAGE_OFFSET-32)) )
     {
-        if ( (eip < fixup_buf_user) || (eip >= (fixup_buf_user+PAGE_SIZE-32)) )
-        {
-            DPRINTK("User executing out of kernel space?!");
-            return;
-        }
-        /* We know it's safe to directly copy teh bytes into our buffer. */
-        memcpy(b, (void *)eip, sizeof(b));
-    }
-    else if ( unlikely(copy_from_user(b, (void *)eip, sizeof(b)) != 0) )
-    {
-        DPRINTK("Could not read instruction bytes from user space.");
+        DPRINTK("User executing out of kernel space?!");
         return;
     }
-
-    if ( unlikely(((eip ^ (eip+5)) & PAGE_MASK) != 0) )
+    
+    if ( unlikely(((eip ^ (eip+PATCH_LEN)) & PAGE_MASK) != 0) )
     {
         DPRINTK("Patch instruction would straddle a page boundary.");
         return;
     }
 
+    /*
+     * Check that the page to be patched is part of a read-only VMA. This 
+     * means that our patch will never erroneously get flushed to disc.
+     */
+    if ( eip > (FIXUP_BUF_USER + FIXUP_BUF_SIZE) ) /* don't check fixup area */
+    {
+        /* [SMP] Need to the mmap_sem semaphore. */
+        struct vm_area_struct *vma = find_vma(current->mm, eip);
+        if ( (vma == NULL) || (vma->vm_flags & VM_MAYSHARE) )
+        {
+            DPRINTK("Cannot patch a shareable VMA.");
+            return;
+        }
+    }
+
+    if ( unlikely(copy_from_user(b, (void *)eip, sizeof(b)) != 0) )
+    {
+        DPRINTK("Could not read instruction bytes from user space.");
+        return;
+    }
+
+    /* Already created a fixup for this address and code sequence? */
+    hash = FIXUP_HASH(b);
+    for ( fe = fixup_hash[hash];
+          fe != NULL; fe = fe->next )
+    {
+        if ( eip != fe->patch_addr )
+            continue; /* XXX */
+        if ( memcmp(fe->patched_code, b, fe->patched_code_len) == 0 )
+            goto do_the_patch;
+    }
+
     /* Guaranteed enough room to patch? */
-    if ( unlikely(fixup_idx > (PAGE_SIZE-32)) )
+    if ( unlikely((fi = fixup_idx) > (FIXUP_BUF_SIZE-32)) )
     {
         static int printed = 0;
         if ( !printed )
@@ -268,40 +316,77 @@ asmlinkage void do_fixup_4gb_segment(struct pt_regs *regs, long error_code)
         return;
     }
 
-    while ( insn_len < 5 )
+    /* Indirect jump pointer. */
+    *(u32 *)&fixup_buf[fi] = FIXUP_BUF_USER + fi + 4;
+    fi += 4;
+
+    /* push <r32> */
+    if ( save_indirect_reg )
+        fixup_buf[fi++] = 0x50 + rm;
+
+    /* add %gs:0,<r32> */
+    fixup_buf[fi++] = 0x65;
+    fixup_buf[fi++] = 0x03;
+    fixup_buf[fi++] = 0x05 | (rm << 3);
+    *(unsigned long *)&fixup_buf[fi] = 0;
+    fi += 4;
+
+    /* Relocate the faulting instruction, minus the GS override. */
+    memcpy(&fixup_buf[fi], &b[1], error_code - 1);
+    fi += error_code - 1;
+
+    /* pop <r32> */
+    if ( save_indirect_reg )
+        fixup_buf[fi++] = 0x58 + rm;
+
+    while ( insn_len < PATCH_LEN )
     {
         /* Bail if can't decode the following instruction. */
         if ( unlikely((new_insn_len =
-                       get_insn_len(&b[insn_len], &opcode)) == 0) )
+                       get_insn_len(&b[insn_len], &opcode, &decode)) == 0) )
         {
             DPRINTK("Could not decode following instruction.");
             return;
         }
 
         /* We track one 8-bit relative offset for patching later. */
-        if ( ((opcode >= 0x70) && (opcode <= 0x7f)) || (opcode == 0xeb) )
+        if ( (decode & CODE_MASK) == JMP )
         {
-            if ( relbyte_idx != -1 )
-            {
-                DPRINTK("Multiple relative offsets in patch seq!");
-                return;
-            }
-            relbyte_idx = insn_len;
-            while ( b[relbyte_idx] != opcode )
-                relbyte_idx++;
-            relbyte_idx++;
+            rel_idx = insn_len;
+            while ( (fixup_buf[fi++] = b[rel_idx++]) != opcode )
+                continue;
+            
+            /* Patch the 8-bit relative offset. */
+            int idx = fe->fixup_idx + relbyte_idx + 6 + 4/**/;
+            if ( save_indirect_reg )
+                idx += 2;
+            fixup_buf[idx] = fi - (idx + 1);
+        
+            /* jmp <rel32> */
+            fixup_buf[fi++] = 0xe9;
+            fi += 4;
+            *(unsigned long *)&fixup_buf[fi-4] = 
+                (eip + relbyte_idx + 1 + (long)(char)b[relbyte_idx]) - 
+                (FIXUP_BUF_USER + fi);
         }
         else if ( opcode == 0xe9 )
         {
-            if ( relword_idx != -1 )
-            {
-                DPRINTK("Multiple relative offsets in patch seq!");
-                return;
-            }
-            relword_idx = insn_len;
-            while ( b[relword_idx] != opcode )
-                relword_idx++;
-            relword_idx++;
+            rel_idx = insn_len;
+            while ( (fixup_buf[fi++] = b[rel_idx++]) != opcode )
+                continue;
+            
+            /* Patch the 32-bit relative offset. */
+            int idx = fe->fixup_idx + relword_idx + 6 + 4/**/;
+            if ( save_indirect_reg )
+                idx += 2;
+            *(unsigned long *)&fixup_buf[idx] +=
+                (eip + relword_idx) - (FIXUP_BUF_USER + idx);
+        }
+        else
+        {
+            /* Relocate the instruction verbatim. */
+            memcpy(&fixup_buf[fi], &b[insn_len], new_insn_len);
+            fi += new_insn_len;
         }
 
         if ( (insn_len += new_insn_len) > 20 )
@@ -311,7 +396,7 @@ asmlinkage void do_fixup_4gb_segment(struct pt_regs *regs, long error_code)
         }
 
         /* The instructions together must be no smaller than 'jmp <disp32>'. */
-        if ( insn_len >= 5 )
+        if ( insn_len >= PATCH_LEN )
             break;
 
         /* Can't have a RET in the middle of a patch sequence. */
@@ -322,120 +407,70 @@ asmlinkage void do_fixup_4gb_segment(struct pt_regs *regs, long error_code)
         }
     }
 
-    /* Already created a fixup for this address and code sequence? */
-    for ( fe = fixup_hash[FIXUP_HASH(eip)];
-          fe != NULL; fe = fe->next )
-    {
-        if ( (fe->patch_addr == eip) &&
-             (fe->patched_code_len == insn_len) &&
-             (memcmp(fe->patched_code, b, insn_len) == 0) )
-            goto do_the_patch;
-    }
-
-    /* No existing patch -- create an entry for one. */
+    /* Create an entry for a new fixup patch. */
     fe = kmalloc(sizeof(struct fixup_entry), GFP_KERNEL);
     if ( unlikely(fe == NULL) )
     {
         DPRINTK("Not enough memory to allocate a fixup_entry.");
         return;
     }
-    fe->patch_addr = eip;
+    fe->patch_addr = eip; /* XXX */
     fe->patched_code_len = insn_len;
     memcpy(fe->patched_code, b, insn_len);
     fe->fixup_idx = fixup_idx;
-    fe->next = fixup_hash[FIXUP_HASH(eip)];
-    fixup_hash[FIXUP_HASH(eip)] = fe;
-    
-    /* push <r32> */
-    if ( save_indirect_reg )
-        fixup_buf[fixup_idx++] = 0x50 + rm;
+    fe->return_idx = 
+        fixup_idx + error_code + 6 + 4/**/ + (save_indirect_reg ? 2 : 0);
+    fe->next = fixup_hash[hash];
+    fixup_hash[hash] = fe;
 
-    /* add %gs:0,<r32> */
-    fixup_buf[fixup_idx++] = 0x65;
-    fixup_buf[fixup_idx++] = 0x03;
-    fixup_buf[fixup_idx++] = 0x05 | (rm << 3);
-    *(unsigned long *)&fixup_buf[fixup_idx] = 0;
-    fixup_idx += 4;
-
-    /* First relocated instruction, minus the GS override. */
-    memcpy(&fixup_buf[fixup_idx], &b[1], error_code - 1);
-    fixup_idx += error_code - 1;
-
-    /* pop <r32> */
-    if ( save_indirect_reg )
-        fixup_buf[fixup_idx++] = 0x58 + rm;
-
-    if ( insn_len != error_code )
-    {
-        /* Relocated instructions. */
-        memcpy(&fixup_buf[fixup_idx], &b[error_code], insn_len - error_code);
-        fixup_idx += insn_len - error_code;
-    }
 
     /* jmp <rel32> */
-    fixup_buf[fixup_idx++] = 0xe9;
-    fixup_idx += 4;
-    *(unsigned long *)&fixup_buf[fixup_idx-4] = 
-        (eip + insn_len) - (fixup_buf_user + fixup_idx);
+    fixup_buf[fi++] = 0xe9;
+    fi += 4;
+    *(unsigned long *)&fixup_buf[fi-4] = 
+        (eip + insn_len) - (FIXUP_BUF_USER + fi);
 
-    if ( relbyte_idx != -1 )
+    /* Commit the patch. */
+    fixup_idx = fi;
+
+#if 0
+    if ( fe->fixup_idx == 4122 )
     {
-        /* Patch the 8-bit relative offset. */
-        int idx = fe->fixup_idx + relbyte_idx + 6;
-        if ( save_indirect_reg )
-            idx += 2;
-        fixup_buf[idx] = fixup_idx - (idx + 1);
-        
-        /* jmp <rel32> */
-        fixup_buf[fixup_idx++] = 0xe9;
-        fixup_idx += 4;
-        *(unsigned long *)&fixup_buf[fixup_idx-4] = 
-            (eip + relbyte_idx + 1 + (long)(char)b[relbyte_idx]) - 
-            (fixup_buf_user + fixup_idx);
-    }
-    else if ( relword_idx != -1 )
-    {
-        /* Patch the 32-bit relative offset by subtracting the code disp. */
-        int idx = fe->fixup_idx + relword_idx + 6;
-        if ( save_indirect_reg )
-            idx += 2;
-        *(unsigned long *)&fixup_buf[idx] +=
-            (eip + relword_idx) - (fixup_buf_user + idx);
+        int iii;
+        printk(KERN_ALERT "EIP == %08lx; USER_EIP == %08lx\n",
+               eip, FIXUP_BUF_USER + fe->fixup_idx);
+        printk(KERN_ALERT " .byte ");
+        for ( iii = 0; iii < insn_len; iii++ )
+            printk("0x%02x,", b[iii]);
+        printk("\n");
+        printk(KERN_ALERT " .byte ");
+        for ( iii = fe->fixup_idx; iii < fi; iii++ )
+            printk("0x%02x,", fixup_buf[iii]);
+        printk("\n");
+        printk(KERN_ALERT " .byte ");
+        for ( iii = fe->fixup_idx; iii < fi; iii++ )
+            printk("0x%02x,", ((char *)FIXUP_BUF_USER)[iii]);
+        printk("\n");
     }
+#endif
 
  do_the_patch:
     /* Create the patching instruction in a temporary buffer. */
-    patch[0] = 0xe9;
-    *(unsigned long *)&patch[1] = 
-        (fixup_buf_user + fe->fixup_idx) - (eip + 5);
-
-    /*
-     * Check that the page to be patched is part of a read-only VMA. This 
-     * means that our patch will never erroneously get flushed to disc.
-     */
-    if ( eip < PAGE_OFFSET ) /* don't need to check the fixmap area */
-    {
-        /* [SMP] Need to the mmap_sem semaphore. */
-        struct vm_area_struct *vma = find_vma(current->mm, eip);
-        if ( (vma == NULL) || (vma->vm_flags & VM_MAYSHARE) )
-        {
-            DPRINTK("Cannot patch a shareable VMA.");
-            return;
-        }
-    }
+    patch[0] = 0x67;
+    patch[1] = 0xff;
+    patch[2] = 0x26; /* call <r/m16> */
+    *(u16 *)&patch[3] = FIXUP_BUF_USER + fe->fixup_idx;
 
     /* [SMP] Need to pause other threads while patching. */
     pgd = pgd_offset(current->mm, eip);
     pmd = pmd_offset(pgd, eip);
     pte = pte_offset_kernel(pmd, eip);
     veip = kmap(pte_page(*pte));
-    memcpy((char *)veip + (eip & ~PAGE_MASK), patch, 5);
+    memcpy((char *)veip + (eip & ~PAGE_MASK), patch, PATCH_LEN);
     kunmap(pte_page(*pte));
 
     /* Success! Return to user land to execute 2nd insn of the pair. */
-    regs->eip = fixup_buf_user + fe->fixup_idx + error_code + 6;
-    if ( save_indirect_reg )
-        regs->eip += 2;
+    regs->eip = FIXUP_BUF_USER + fe->return_idx;
     return;
 }
 
@@ -443,7 +478,9 @@ static int nosegfixup = 0;
 
 static int __init fixup_init(void)
 {
-    unsigned long page;
+    struct vm_struct vma;
+    struct page *_pages[1<<FIXUP_BUF_ORDER], **pages=_pages;
+    int i;
 
     if ( nosegfixup )
         return 0;
@@ -451,9 +488,14 @@ static int __init fixup_init(void)
     HYPERVISOR_vm_assist(VMASST_CMD_enable,
                          VMASST_TYPE_4gb_segments_notify);
 
-    page = get_zeroed_page(GFP_ATOMIC);
-    __set_fixmap(FIX_4GB_SEGMENT_FIXUP_RO, __pa(page), PAGE_READONLY);
-    __set_fixmap(FIX_4GB_SEGMENT_FIXUP_RW, __pa(page), PAGE_KERNEL);
+    fixup_buf = (char *)__get_free_pages(GFP_ATOMIC, FIXUP_BUF_ORDER);
+    for ( i = 0; i < (1<<FIXUP_BUF_ORDER); i++ )
+        _pages[i] = virt_to_page(fixup_buf) + i;
+
+    vma.addr = (void *)FIXUP_BUF_USER;
+    vma.size = FIXUP_BUF_SIZE + PAGE_SIZE; /* fucking stupid interface */
+    if ( map_vm_area(&vma, PAGE_READONLY, &pages) != 0 )
+        BUG();
 
     memset(fixup_hash, 0, sizeof(fixup_hash));
 
diff --git a/linux-2.6.7-xen-sparse/include/asm-xen/asm-i386/fixmap.h b/linux-2.6.7-xen-sparse/include/asm-xen/asm-i386/fixmap.h
index d4c105ea93..0bfb839f20 100644
--- a/linux-2.6.7-xen-sparse/include/asm-xen/asm-i386/fixmap.h
+++ b/linux-2.6.7-xen-sparse/include/asm-xen/asm-i386/fixmap.h
@@ -44,8 +44,6 @@
 enum fixed_addresses {
 	FIX_HOLE,
 	FIX_VSYSCALL,
-	FIX_4GB_SEGMENT_FIXUP_RO,
-	FIX_4GB_SEGMENT_FIXUP_RW,
 #ifdef CONFIG_X86_LOCAL_APIC
 	FIX_APIC_BASE,	/* local (CPU) APIC) -- required for SMP or not */
 #endif
@@ -128,8 +126,8 @@ extern void __set_fixmap_ma (enum fixed_addresses idx,
  * This is the range that is readable by user mode, and things
  * acting like user mode such as get_user_pages.
  */
-#define FIXADDR_USER_START	(__fix_to_virt(FIX_4GB_SEGMENT_FIXUP_RO))
-#define FIXADDR_USER_END	(FIXADDR_USER_START + (2*PAGE_SIZE))
+#define FIXADDR_USER_START	(__fix_to_virt(FIX_VSYSCALL))
+#define FIXADDR_USER_END	(FIXADDR_USER_START + PAGE_SIZE)
 
 
 extern void __this_fixmap_does_not_exist(void);
diff --git a/linux-2.6.7-xen-sparse/include/asm-xen/asm-i386/pgtable.h b/linux-2.6.7-xen-sparse/include/asm-xen/asm-i386/pgtable.h
index be31d10f30..8fd64dfae2 100644
--- a/linux-2.6.7-xen-sparse/include/asm-xen/asm-i386/pgtable.h
+++ b/linux-2.6.7-xen-sparse/include/asm-xen/asm-i386/pgtable.h
@@ -64,16 +64,17 @@ void paging_init(void);
 #define PGDIR_SIZE	(1UL << PGDIR_SHIFT)
 #define PGDIR_MASK	(~(PGDIR_SIZE-1))
 
-#define USER_PTRS_PER_PGD	(TASK_SIZE/PGDIR_SIZE)
-#define FIRST_USER_PGD_NR	0
+#define FIRST_USER_PGD_NR	1
+#define USER_PTRS_PER_PGD	((TASK_SIZE/PGDIR_SIZE) - FIRST_USER_PGD_NR)
 
+#if 0 /* XEN */
 #define USER_PGD_PTRS (PAGE_OFFSET >> PGDIR_SHIFT)
 #define KERNEL_PGD_PTRS (PTRS_PER_PGD-USER_PGD_PTRS)
 
 #define TWOLEVEL_PGDIR_SHIFT	22
 #define BOOT_USER_PGD_PTRS (__PAGE_OFFSET >> TWOLEVEL_PGDIR_SHIFT)
 #define BOOT_KERNEL_PGD_PTRS (1024-BOOT_USER_PGD_PTRS)
-
+#endif
 
 #ifndef __ASSEMBLY__
 /* Just any arbitrary offset to the start of the vmalloc VM area: the

From e6db132e033883695d826d4cf3574372adb95123 Mon Sep 17 00:00:00 2001
From: "kaf24@scramble.cl.cam.ac.uk" <kaf24@scramble.cl.cam.ac.uk>
Date: Wed, 11 Aug 2004 07:28:29 +0000
Subject: [PATCH 09/10] bitkeeper revision 1.1159.17.8
 (4119ca9d45NUd2jZUoii5FZ0sUjBKg)

Missing EXPORT_SYMBOL.
---
 linux-2.4.26-xen-sparse/arch/xen/kernel/i386_ksyms.c | 1 +
 linux-2.6.7-xen-sparse/arch/xen/kernel/evtchn.c      | 8 +++++---
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/linux-2.4.26-xen-sparse/arch/xen/kernel/i386_ksyms.c b/linux-2.4.26-xen-sparse/arch/xen/kernel/i386_ksyms.c
index 8b72e44f12..0938a64f65 100644
--- a/linux-2.4.26-xen-sparse/arch/xen/kernel/i386_ksyms.c
+++ b/linux-2.4.26-xen-sparse/arch/xen/kernel/i386_ksyms.c
@@ -176,4 +176,5 @@ EXPORT_SYMBOL(create_xen_proc_entry);
 EXPORT_SYMBOL(remove_xen_proc_entry);
 
 EXPORT_SYMBOL(evtchn_do_upcall);
+EXPORT_SYMBOL(force_evtchn_callback);
 EXPORT_SYMBOL(HYPERVISOR_shared_info);
diff --git a/linux-2.6.7-xen-sparse/arch/xen/kernel/evtchn.c b/linux-2.6.7-xen-sparse/arch/xen/kernel/evtchn.c
index 06d6ae948e..87eda48725 100644
--- a/linux-2.6.7-xen-sparse/arch/xen/kernel/evtchn.c
+++ b/linux-2.6.7-xen-sparse/arch/xen/kernel/evtchn.c
@@ -22,6 +22,11 @@
 #include <asm-xen/ctrl_if.h>
 #include <asm-xen/hypervisor.h>
 
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
+EXPORT_SYMBOL(force_evtchn_callback);
+EXPORT_SYMBOL(evtchn_do_upcall);
+#endif
+
 /*
  * This lock protects updates to the following mapping and reference-count
  * arrays. The lock does not need to be acquired to read the mapping tables.
@@ -93,9 +98,6 @@ void evtchn_do_upcall(struct pt_regs *regs)
 
     local_irq_restore(flags);
 }
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
-EXPORT_SYMBOL(evtchn_do_upcall);
-#endif
 
 static int find_unbound_irq(void)
 {

From 8892b94a8df72e090628adec123e9f3252b242ca Mon Sep 17 00:00:00 2001
From: "kaf24@scramble.cl.cam.ac.uk" <kaf24@scramble.cl.cam.ac.uk>
Date: Wed, 11 Aug 2004 07:33:29 +0000
Subject: [PATCH 10/10] bitkeeper revision 1.1159.17.9
 (4119cbc9Y38CPLUDM54OzSqxL0xnfw)

Disable binary-rewriting while fixing it for FC2.
---
 .../arch/xen/kernel/fixup.c                   | 126 +++++++++++-------
 1 file changed, 78 insertions(+), 48 deletions(-)

diff --git a/linux-2.6.7-xen-sparse/arch/xen/kernel/fixup.c b/linux-2.6.7-xen-sparse/arch/xen/kernel/fixup.c
index e20be71808..f35b491876 100644
--- a/linux-2.6.7-xen-sparse/arch/xen/kernel/fixup.c
+++ b/linux-2.6.7-xen-sparse/arch/xen/kernel/fixup.c
@@ -205,7 +205,7 @@ asmlinkage void do_fixup_4gb_segment(struct pt_regs *regs, long error_code)
 {
     static unsigned int fixup_idx = 0;
     unsigned int fi;
-    int save_indirect_reg, hash, rel_idx;
+    int save_indirect_reg, hash;
     unsigned int insn_len = (unsigned int)error_code, new_insn_len;
     unsigned char b[20], modrm, mod, reg, rm, patch[PATCH_LEN], opcode, decode;
     unsigned long eip = regs->eip - insn_len;
@@ -339,8 +339,15 @@ asmlinkage void do_fixup_4gb_segment(struct pt_regs *regs, long error_code)
     if ( save_indirect_reg )
         fixup_buf[fi++] = 0x58 + rm;
 
-    while ( insn_len < PATCH_LEN )
+    for ( ; ; )
     {
+        if ( insn_len >= PATCH_LEN )
+        {
+            /* ret */
+            fixup_buf[fi++] = 0xc3;
+            break;
+        }
+
         /* Bail if can't decode the following instruction. */
         if ( unlikely((new_insn_len =
                        get_insn_len(&b[insn_len], &opcode, &decode)) == 0) )
@@ -349,38 +356,59 @@ asmlinkage void do_fixup_4gb_segment(struct pt_regs *regs, long error_code)
             return;
         }
 
-        /* We track one 8-bit relative offset for patching later. */
         if ( (decode & CODE_MASK) == JMP )
         {
-            rel_idx = insn_len;
-            while ( (fixup_buf[fi++] = b[rel_idx++]) != opcode )
-                continue;
+            return;
+
+            memcpy(&fixup_buf[fi], &b[insn_len], new_insn_len - 1);
+            fi += new_insn_len - 1;
             
             /* Patch the 8-bit relative offset. */
-            int idx = fe->fixup_idx + relbyte_idx + 6 + 4/**/;
-            if ( save_indirect_reg )
-                idx += 2;
-            fixup_buf[idx] = fi - (idx + 1);
+            fixup_buf[fi++] = 1;
+
+            insn_len += new_insn_len;
+            ASSERT(insn_len >= PATCH_LEN);
         
+            /* ret */
+            fixup_buf[fi++] = 0xc3;
+
             /* jmp <rel32> */
             fixup_buf[fi++] = 0xe9;
             fi += 4;
             *(unsigned long *)&fixup_buf[fi-4] = 
-                (eip + relbyte_idx + 1 + (long)(char)b[relbyte_idx]) - 
+                (eip + insn_len + (long)(char)b[insn_len-1]) - 
                 (FIXUP_BUF_USER + fi);
+            
+            break;
         }
         else if ( opcode == 0xe9 )
         {
-            rel_idx = insn_len;
-            while ( (fixup_buf[fi++] = b[rel_idx++]) != opcode )
-                continue;
+            return;
+
+            memcpy(&fixup_buf[fi], &b[insn_len], new_insn_len - 4);
+            fi += new_insn_len - 4;
             
+            insn_len += new_insn_len;
+            ASSERT(insn_len >= PATCH_LEN);
+        
             /* Patch the 32-bit relative offset. */
-            int idx = fe->fixup_idx + relword_idx + 6 + 4/**/;
-            if ( save_indirect_reg )
-                idx += 2;
-            *(unsigned long *)&fixup_buf[idx] +=
-                (eip + relword_idx) - (FIXUP_BUF_USER + idx);
+            fi += 4;
+            *(unsigned long *)&fixup_buf[fi-4] = 
+                (eip + insn_len + *(long *)&b[insn_len-4]) - 
+                (FIXUP_BUF_USER + fi);
+
+            /* ret */
+            fixup_buf[fi++] = 0xc3;
+
+            break;
+        }
+        else if ( (decode & CODE_MASK) == PUSH )
+        {
+            return;
+        }
+        else if ( (decode & CODE_MASK) == POP )
+        {
+            return;
         }
         else
         {
@@ -395,12 +423,8 @@ asmlinkage void do_fixup_4gb_segment(struct pt_regs *regs, long error_code)
             return;
         }
 
-        /* The instructions together must be no smaller than 'jmp <disp32>'. */
-        if ( insn_len >= PATCH_LEN )
-            break;
-
         /* Can't have a RET in the middle of a patch sequence. */
-        if ( opcode == 0xc4 )
+        if ( (opcode == 0xc4) && (insn_len < PATCH_LEN) )
         {
             DPRINTK("RET in middle of patch seq!\n");
             return;
@@ -423,18 +447,23 @@ asmlinkage void do_fixup_4gb_segment(struct pt_regs *regs, long error_code)
     fe->next = fixup_hash[hash];
     fixup_hash[hash] = fe;
 
-
-    /* jmp <rel32> */
-    fixup_buf[fi++] = 0xe9;
-    fi += 4;
-    *(unsigned long *)&fixup_buf[fi-4] = 
-        (eip + insn_len) - (FIXUP_BUF_USER + fi);
-
     /* Commit the patch. */
     fixup_idx = fi;
 
-#if 0
-    if ( fe->fixup_idx == 4122 )
+ do_the_patch:
+#if 1
+    /* Create the patching instruction in a temporary buffer. */
+    patch[0] = 0x67;
+    patch[1] = 0xff;
+    patch[2] = 0x16; /* call <r/m16> */
+    *(u16 *)&patch[3] = FIXUP_BUF_USER + fe->fixup_idx;
+#else
+    patch[0] = 0x9a;
+    *(u32 *)&patch[1] = FIXUP_BUF_USER + fe->fixup_idx + 4;
+    *(u16 *)&patch[5] = __USER_CS;
+#endif
+
+#if 1
     {
         int iii;
         printk(KERN_ALERT "EIP == %08lx; USER_EIP == %08lx\n",
@@ -442,24 +471,27 @@ asmlinkage void do_fixup_4gb_segment(struct pt_regs *regs, long error_code)
         printk(KERN_ALERT " .byte ");
         for ( iii = 0; iii < insn_len; iii++ )
             printk("0x%02x,", b[iii]);
-        printk("\n");
+        printk("!!\n");
         printk(KERN_ALERT " .byte ");
         for ( iii = fe->fixup_idx; iii < fi; iii++ )
-            printk("0x%02x,", fixup_buf[iii]);
-        printk("\n");
+            printk("0x%02x,", (unsigned char)fixup_buf[iii]);
+        printk("!!\n");
         printk(KERN_ALERT " .byte ");
-        for ( iii = fe->fixup_idx; iii < fi; iii++ )
-            printk("0x%02x,", ((char *)FIXUP_BUF_USER)[iii]);
-        printk("\n");
+        for ( iii = 0; iii < 7; iii++ )
+            printk("0x%02x,", (unsigned char)patch[iii]);
+        printk("!!\n");
     }
 #endif
 
- do_the_patch:
-    /* Create the patching instruction in a temporary buffer. */
-    patch[0] = 0x67;
-    patch[1] = 0xff;
-    patch[2] = 0x26; /* call <r/m16> */
-    *(u16 *)&patch[3] = FIXUP_BUF_USER + fe->fixup_idx;
+    if ( put_user(eip + insn_len, (unsigned long *)regs->esp - 1) != 0 )
+    {
+        DPRINTK("Failed to place return address on user stack.");
+        return;
+    }
+
+    /* Success! Return to user land to execute 2nd insn of the pair. */
+    regs->esp -= 4;
+    regs->eip = FIXUP_BUF_USER + fe->return_idx;
 
     /* [SMP] Need to pause other threads while patching. */
     pgd = pgd_offset(current->mm, eip);
@@ -469,8 +501,6 @@ asmlinkage void do_fixup_4gb_segment(struct pt_regs *regs, long error_code)
     memcpy((char *)veip + (eip & ~PAGE_MASK), patch, PATCH_LEN);
     kunmap(pte_page(*pte));
 
-    /* Success! Return to user land to execute 2nd insn of the pair. */
-    regs->eip = FIXUP_BUF_USER + fe->return_idx;
     return;
 }
 
@@ -482,7 +512,7 @@ static int __init fixup_init(void)
     struct page *_pages[1<<FIXUP_BUF_ORDER], **pages=_pages;
     int i;
 
-    if ( nosegfixup )
+    /*if ( nosegfixup )*/
         return 0;
 
     HYPERVISOR_vm_assist(VMASST_CMD_enable,