1.1 --- a/linux-2.4.26-xen-sparse/arch/xen/mm/ioremap.c	Thu Aug 19 13:50:49 2004 +0000
     1.2 +++ b/linux-2.4.26-xen-sparse/arch/xen/mm/ioremap.c	Thu Aug 19 15:39:07 2004 +0000
     1.3 @@ -115,17 +115,10 @@ int direct_remap_area_pages(struct mm_st
     1.4  #define MAX_DIRECTMAP_MMU_QUEUE 130
     1.5      mmu_update_t u[MAX_DIRECTMAP_MMU_QUEUE], *w, *v;
     1.6  
     1.7 -    if ( domid != 0 )
     1.8 -    {
     1.9 -        u[0].ptr  = MMU_EXTENDED_COMMAND;
    1.10 -        u[0].val  = MMUEXT_SET_FOREIGNDOM;
    1.11 -        u[0].val |= (unsigned long)domid << 16;
    1.12 -        v = w = &u[1];
    1.13 -    }
    1.14 -    else
    1.15 -    {
    1.16 -        v = w = &u[0];
    1.17 -    }
    1.18 +    u[0].ptr  = MMU_EXTENDED_COMMAND;
    1.19 +    u[0].val  = MMUEXT_SET_FOREIGNDOM;
    1.20 +    u[0].val |= (unsigned long)domid << 16;
    1.21 +    v = w = &u[1];
    1.22  
    1.23      start_address = address;
    1.24  

     2.1 --- a/linux-2.4.26-xen-sparse/drivers/char/mem.c	Thu Aug 19 13:50:49 2004 +0000
     2.2 +++ b/linux-2.4.26-xen-sparse/drivers/char/mem.c	Thu Aug 19 15:39:07 2004 +0000
     2.3 @@ -237,6 +237,9 @@ static int mmap_mem(struct file * file, 
     2.4  	if (!(start_info.flags & SIF_PRIVILEGED))
     2.5  		return -ENXIO;
     2.6  
     2.7 +	if (file->private_data == NULL)
     2.8 +		file->private_data = (void *)(unsigned long)DOMID_IO;
     2.9 +
    2.10  	/* DONTCOPY is essential for Xen as copy_page_range is broken. */
    2.11  	vma->vm_flags |= VM_RESERVED | VM_IO | VM_DONTCOPY;
    2.12  	vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);

     3.1 --- a/linux-2.6.7-xen-sparse/arch/xen/i386/mm/ioremap.c	Thu Aug 19 13:50:49 2004 +0000
     3.2 +++ b/linux-2.6.7-xen-sparse/arch/xen/i386/mm/ioremap.c	Thu Aug 19 15:39:07 2004 +0000
     3.3 @@ -415,17 +415,10 @@ int direct_remap_area_pages(struct mm_st
     3.4  #define MAX_DIRECTMAP_MMU_QUEUE 130
     3.5      mmu_update_t u[MAX_DIRECTMAP_MMU_QUEUE], *w, *v;
     3.6  
     3.7 -    if ( domid != 0 )
     3.8 -    {
     3.9 -        u[0].ptr  = MMU_EXTENDED_COMMAND;
    3.10 -        u[0].val  = MMUEXT_SET_FOREIGNDOM;
    3.11 -        u[0].val |= (unsigned long)domid << 16;
    3.12 -        v = w = &u[1];
    3.13 -    }
    3.14 -    else
    3.15 -    {
    3.16 -        v = w = &u[0];
    3.17 -    }
    3.18 +    u[0].ptr  = MMU_EXTENDED_COMMAND;
    3.19 +    u[0].val  = MMUEXT_SET_FOREIGNDOM;
    3.20 +    u[0].val |= (unsigned long)domid << 16;
    3.21 +    v = w = &u[1];
    3.22  
    3.23      start_address = address;
    3.24  

     4.1 --- a/linux-2.6.7-xen-sparse/drivers/char/mem.c	Thu Aug 19 13:50:49 2004 +0000
     4.2 +++ b/linux-2.6.7-xen-sparse/drivers/char/mem.c	Thu Aug 19 15:39:07 2004 +0000
     4.3 @@ -247,6 +247,9 @@ static int mmap_mem(struct file * file, 
     4.4  	if (!(start_info.flags & SIF_PRIVILEGED))
     4.5  		return -ENXIO;
     4.6  
     4.7 +	if (file->private_data == NULL)
     4.8 +		file->private_data = (void *)(unsigned long)DOMID_IO;
     4.9 +
    4.10  	/* DONTCOPY is essential for Xen as copy_page_range is broken. */
    4.11  	vma->vm_flags |= VM_RESERVED | VM_IO | VM_DONTCOPY;
    4.12  	vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);

     5.1 --- a/linux-2.6.7-xen-sparse/drivers/xen/privcmd/privcmd.c	Thu Aug 19 13:50:49 2004 +0000
     5.2 +++ b/linux-2.6.7-xen-sparse/drivers/xen/privcmd/privcmd.c	Thu Aug 19 15:39:07 2004 +0000
     5.3 @@ -138,17 +138,10 @@ static int privcmd_ioctl(struct inode *i
     5.4          if ( (m.addr + (m.num<<PAGE_SHIFT)) > vma->vm_end )
     5.5          { ret = -EFAULT; goto batch_err; }
     5.6  
     5.7 -        if ( m.dom != 0 )
     5.8 -        {
     5.9 -            u[0].ptr  = MMU_EXTENDED_COMMAND;
    5.10 -            u[0].val  = MMUEXT_SET_FOREIGNDOM;
    5.11 -            u[0].val |= (unsigned long)m.dom << 16;
    5.12 -            v = w = &u[1];
    5.13 -        }
    5.14 -        else
    5.15 -        {
    5.16 -            v = w = &u[0];
    5.17 -        }
    5.18 +        u[0].ptr  = MMU_EXTENDED_COMMAND;
    5.19 +        u[0].val  = MMUEXT_SET_FOREIGNDOM;
    5.20 +        u[0].val |= (unsigned long)m.dom << 16;
    5.21 +        v = w = &u[1];
    5.22  
    5.23          p = m.arr;
    5.24          addr = m.addr;

     6.1 --- a/tools/libxc/xc.h	Thu Aug 19 13:50:49 2004 +0000
     6.2 +++ b/tools/libxc/xc.h	Thu Aug 19 15:39:07 2004 +0000
     6.3 @@ -154,6 +154,8 @@ int xc_rrobin_global_set(int xc_handle, 
     6.4  int xc_rrobin_global_get(int xc_handle, u64 *slice);
     6.5  
     6.6  #define DOMID_SELF              (0x7FF0U)
     6.7 +#define DOMID_IO                (0x7FF1U)
     6.8 +#define DOMID_XEN               (0x7FF2U)
     6.9  
    6.10  typedef struct {
    6.11  #define EVTCHNSTAT_closed       0  /* Chennel is not in use.                 */

     7.1 --- a/tools/libxc/xc_linux_save.c	Thu Aug 19 13:50:49 2004 +0000
     7.2 +++ b/tools/libxc/xc_linux_save.c	Thu Aug 19 15:39:07 2004 +0000
     7.3 @@ -423,7 +423,7 @@ int xc_linux_save(int xc_handle, XcIOCon
     7.4      mfn_to_pfn_table_start_mfn = xc_get_m2p_start_mfn( xc_handle );
     7.5  
     7.6      live_mfn_to_pfn_table = 
     7.7 -	mfn_mapper_map_single(xc_handle, 0x7FFFU, 
     7.8 +	mfn_mapper_map_single(xc_handle, DOMID_XEN, 
     7.9  			      PAGE_SIZE*1024, PROT_READ, 
    7.10  			      mfn_to_pfn_table_start_mfn );
    7.11  

     8.1 --- a/xen/arch/x86/memory.c	Thu Aug 19 13:50:49 2004 +0000
     8.2 +++ b/xen/arch/x86/memory.c	Thu Aug 19 15:39:07 2004 +0000
     8.3 @@ -137,14 +137,49 @@ static struct {
     8.4   */
     8.5  #define FOREIGNDOM (percpu_info[smp_processor_id()].foreign ? : current)
     8.6  
     8.7 -void ptwr_init_backpointers(void);
     8.8 +/* Private domain structs for DOMID_XEN and DOMID_IO. */
     8.9 +static struct domain *dom_xen, *dom_io;
    8.10  
    8.11  void arch_init_memory(void)
    8.12  {
    8.13 +    static void ptwr_init_backpointers(void);
    8.14 +    unsigned long mfn;
    8.15 +
    8.16      memset(percpu_info, 0, sizeof(percpu_info));
    8.17  
    8.18      vm_assist_info[VMASST_TYPE_writeable_pagetables].enable =
    8.19          ptwr_init_backpointers;
    8.20 +
    8.21 +    /* Initialise to a magic of 0x55555555 so easier to spot bugs later. */
    8.22 +    memset(machine_to_phys_mapping, 0x55, 4<<20);
    8.23 +
    8.24 +    /*
    8.25 +     * Initialise our DOMID_XEN domain.
    8.26 +     * Any Xen-heap pages that we will allow to be mapped will have
    8.27 +     * their domain field set to dom_xen.
    8.28 +     */
    8.29 +    dom_xen = alloc_domain_struct();
    8.30 +    atomic_set(&dom_xen->refcnt, 1);
    8.31 +    dom_xen->domain = DOMID_XEN;
    8.32 +
    8.33 +    /*
    8.34 +     * Initialise our DOMID_IO domain.
    8.35 +     * This domain owns no pages but is considered a special case when
    8.36 +     * mapping I/O pages, as the mappings occur at the priv of the caller.
    8.37 +     */
    8.38 +    dom_io = alloc_domain_struct();
    8.39 +    atomic_set(&dom_io->refcnt, 1);
    8.40 +    dom_io->domain = DOMID_IO;
    8.41 +
    8.42 +    /* M2P table is mappable read-only by privileged domains. */
    8.43 +    for ( mfn = virt_to_phys(&machine_to_phys_mapping[0<<20])>>PAGE_SHIFT;
    8.44 +          mfn < virt_to_phys(&machine_to_phys_mapping[1<<20])>>PAGE_SHIFT;
    8.45 +          mfn++ )
    8.46 +    {
    8.47 +        frame_table[mfn].u.inuse.count_info = 1 | PGC_allocated;
    8.48 +        frame_table[mfn].u.inuse.type_info  = 1 | PGT_gdt_page; /* non-RW */
    8.49 +        frame_table[mfn].u.inuse.domain     = dom_xen;
    8.50 +    }
    8.51  }
    8.52  
    8.53  static void __invalidate_shadow_ldt(struct domain *d)
    8.54 @@ -178,7 +213,7 @@ static inline void invalidate_shadow_ldt
    8.55  }
    8.56  
    8.57  
    8.58 -int alloc_segdesc_page(struct pfn_info *page)
    8.59 +static int alloc_segdesc_page(struct pfn_info *page)
    8.60  {
    8.61      unsigned long *descs = map_domain_mem((page-frame_table) << PAGE_SHIFT);
    8.62      int i;
    8.63 @@ -345,11 +380,15 @@ get_page_from_l1e(
    8.64  
    8.65      if ( unlikely(!pfn_is_ram(pfn)) )
    8.66      {
    8.67 -        if ( IS_PRIV(current) )
    8.68 +        /* Revert to caller privileges if FD == DOMID_IO. */
    8.69 +        if ( d == dom_io )
    8.70 +            d = current;
    8.71 +
    8.72 +        if ( IS_PRIV(d) )
    8.73              return 1;
    8.74  
    8.75 -        if ( IS_CAPABLE_PHYSDEV(current) )
    8.76 -            return domain_iomem_in_pfn(current, pfn);
    8.77 +        if ( IS_CAPABLE_PHYSDEV(d) )
    8.78 +            return domain_iomem_in_pfn(d, pfn);
    8.79  
    8.80          MEM_LOG("Non-privileged attempt to map I/O space %08lx", pfn);
    8.81          return 0;
    8.82 @@ -827,9 +866,16 @@ static int do_extended_command(unsigned 
    8.83  
    8.84          if ( !IS_PRIV(d) )
    8.85          {
    8.86 -            MEM_LOG("Dom %u has no privilege to set subject domain",
    8.87 -                    d->domain);
    8.88 -            okay = 0;
    8.89 +            switch ( domid )
    8.90 +            {
    8.91 +            case DOMID_IO:
    8.92 +                get_knownalive_domain(e = dom_io);
    8.93 +                break;
    8.94 +            default:
    8.95 +                MEM_LOG("Dom %u cannot set foreign dom\n", d->domain);
    8.96 +                okay = 0;
    8.97 +                break;
    8.98 +            }
    8.99          }
   8.100          else
   8.101          {
   8.102 @@ -839,8 +885,19 @@ static int do_extended_command(unsigned 
   8.103              percpu_info[cpu].foreign = e = find_domain_by_id(domid);
   8.104              if ( e == NULL )
   8.105              {
   8.106 -                MEM_LOG("Unknown domain '%u'", domid);
   8.107 -                okay = 0;
   8.108 +                switch ( domid )
   8.109 +                {
   8.110 +                case DOMID_XEN:
   8.111 +                    get_knownalive_domain(e = dom_xen);
   8.112 +                    break;
   8.113 +                case DOMID_IO:
   8.114 +                    get_knownalive_domain(e = dom_io);
   8.115 +                    break;
   8.116 +                default:
   8.117 +                    MEM_LOG("Unknown domain '%u'", domid);
   8.118 +                    okay = 0;
   8.119 +                    break;
   8.120 +                }
   8.121              }
   8.122          }
   8.123          break;
   8.124 @@ -926,7 +983,7 @@ static int do_extended_command(unsigned 
   8.125           * the lock so they'll spin waiting for us.
   8.126           */
   8.127          if ( unlikely(e->tot_pages++ == 0) )
   8.128 -            get_domain(e);
   8.129 +            get_knownalive_domain(e);
   8.130          list_add_tail(&page->list, &e->page_list);
   8.131  
   8.132      reassign_fail:        
   8.133 @@ -1493,7 +1550,7 @@ int ptwr_do_page_fault(unsigned long add
   8.134      return 0;
   8.135  }
   8.136  
   8.137 -void ptwr_init_backpointers(void)
   8.138 +static void ptwr_init_backpointers(void)
   8.139  {
   8.140      struct pfn_info *page;
   8.141      unsigned long pde;

     9.1 --- a/xen/arch/x86/setup.c	Thu Aug 19 13:50:49 2004 +0000
     9.2 +++ b/xen/arch/x86/setup.c	Thu Aug 19 15:39:07 2004 +0000
     9.3 @@ -16,6 +16,7 @@
     9.4  #include <asm/domain_page.h>
     9.5  #include <asm/pdb.h>
     9.6  
     9.7 +extern void arch_init_memory(void);
     9.8  extern void init_IRQ(void);
     9.9  extern void trap_init(void);
    9.10  extern void time_init(void);
    9.11 @@ -360,6 +361,8 @@ void __init start_of_day(void)
    9.12      time_init(); /* installs software handler for HZ clock. */
    9.13      init_apic_mappings(); /* make APICs addressable in our pagetables. */
    9.14  
    9.15 +    arch_init_memory();
    9.16 +
    9.17  #ifndef CONFIG_SMP    
    9.18      APIC_init_uniprocessor();
    9.19  #else

    10.1 --- a/xen/common/dom0_ops.c	Thu Aug 19 13:50:49 2004 +0000
    10.2 +++ b/xen/common/dom0_ops.c	Thu Aug 19 15:39:07 2004 +0000
    10.3 @@ -25,13 +25,14 @@
    10.4  
    10.5  extern unsigned int alloc_new_dom_mem(struct domain *, unsigned int);
    10.6  extern long arch_do_dom0_op(dom0_op_t *op, dom0_op_t *u_dom0_op);
    10.7 -extern void arch_getdomaininfo_ctxt(struct domain *, full_execution_context_t *);
    10.8 +extern void arch_getdomaininfo_ctxt(
    10.9 +    struct domain *, full_execution_context_t *);
   10.10  
   10.11  static inline int is_free_domid(domid_t dom)
   10.12  {
   10.13      struct domain *d;
   10.14  
   10.15 -    if ( dom >= DOMID_SELF )
   10.16 +    if ( dom >= DOMID_FIRST_RESERVED )
   10.17          return 0;
   10.18  
   10.19      if ( (d = find_domain_by_id(dom)) == NULL )
   10.20 @@ -66,7 +67,7 @@ static int allocate_domid(domid_t *pdom)
   10.21      }
   10.22  
   10.23      /* Couldn't find a free domain id in 0..topdom, try higher. */
   10.24 -    for ( dom = topdom; dom < DOMID_SELF; dom++ )
   10.25 +    for ( dom = topdom; dom < DOMID_FIRST_RESERVED; dom++ )
   10.26      {
   10.27          if ( is_free_domid(dom) )
   10.28          {
   10.29 @@ -167,7 +168,7 @@ long do_dom0_op(dom0_op_t *u_dom0_op)
   10.30          domid_t           dom;
   10.31  
   10.32          dom = op->u.createdomain.domain;
   10.33 -        if ( (dom > 0) && (dom < DOMID_SELF) )
   10.34 +        if ( (dom > 0) && (dom < DOMID_FIRST_RESERVED) )
   10.35          {
   10.36              ret = -EINVAL;
   10.37              if ( !is_free_domid(dom) )

    11.1 --- a/xen/common/domain.c	Thu Aug 19 13:50:49 2004 +0000
    11.2 +++ b/xen/common/domain.c	Thu Aug 19 15:39:07 2004 +0000
    11.3 @@ -39,11 +39,18 @@ struct domain *do_createdomain(domid_t d
    11.4      d->domain    = dom_id;
    11.5      d->processor = cpu;
    11.6      d->create_time = NOW();
    11.7 -    /* Initialise the sleep_lock */
    11.8      spin_lock_init(&d->sleep_lock);
    11.9   
   11.10      memcpy(&d->thread, &idle0_task.thread, sizeof(d->thread));
   11.11  
   11.12 +    spin_lock_init(&d->page_alloc_lock);
   11.13 +    INIT_LIST_HEAD(&d->page_list);
   11.14 +    d->max_pages = d->tot_pages = 0;
   11.15 +
   11.16 +    /* Per-domain PCI-device list. */
   11.17 +    spin_lock_init(&d->pcidev_lock);
   11.18 +    INIT_LIST_HEAD(&d->pcidev_list);
   11.19 +
   11.20      if ( d->domain != IDLE_DOMAIN_ID )
   11.21      {
   11.22          if ( init_event_channels(d) != 0 )
   11.23 @@ -59,16 +66,8 @@ struct domain *do_createdomain(domid_t d
   11.24  
   11.25          d->addr_limit = USER_DS;
   11.26          
   11.27 -        spin_lock_init(&d->page_alloc_lock);
   11.28 -        INIT_LIST_HEAD(&d->page_list);
   11.29 -        d->max_pages = d->tot_pages = 0;
   11.30 -
   11.31  	arch_do_createdomain(d);
   11.32  
   11.33 -        /* Per-domain PCI-device list. */
   11.34 -        spin_lock_init(&d->pcidev_lock);
   11.35 -        INIT_LIST_HEAD(&d->pcidev_list);
   11.36 -
   11.37          sched_add_domain(d);
   11.38  
   11.39          write_lock_irqsave(&tasklist_lock, flags);

    12.1 --- a/xen/common/kernel.c	Thu Aug 19 13:50:49 2004 +0000
    12.2 +++ b/xen/common/kernel.c	Thu Aug 19 15:39:07 2004 +0000
    12.3 @@ -304,9 +304,6 @@ void cmain(multiboot_info_t *mbi)
    12.4  
    12.5      start_of_day();
    12.6  
    12.7 -    /* Add CPU0 idle task to the task hash list */
    12.8 -    task_hash[TASK_HASH(IDLE_DOMAIN_ID)] = &idle0_task;
    12.9 -
   12.10      /* Create initial domain 0. */
   12.11      new_dom = do_createdomain(0, 0);
   12.12      if ( new_dom == NULL )

    13.1 --- a/xen/common/memory.c	Thu Aug 19 13:50:49 2004 +0000
    13.2 +++ b/xen/common/memory.c	Thu Aug 19 15:39:07 2004 +0000
    13.3 @@ -37,14 +37,8 @@ struct pfn_info *frame_table;
    13.4  unsigned long frame_table_size;
    13.5  unsigned long max_page;
    13.6  
    13.7 -extern void arch_init_memory(void);
    13.8 -
    13.9  void __init init_frametable(void *frametable_vstart, unsigned long nr_pages)
   13.10  {
   13.11 -    unsigned long mfn;
   13.12 -
   13.13 -    arch_init_memory();
   13.14 -
   13.15      max_page = nr_pages;
   13.16      frame_table_size = nr_pages * sizeof(struct pfn_info);
   13.17      frame_table_size = (frame_table_size + PAGE_SIZE - 1) & PAGE_MASK;
   13.18 @@ -54,17 +48,4 @@ void __init init_frametable(void *framet
   13.19          panic("Not enough memory for frame table - reduce Xen heap size?\n");
   13.20  
   13.21      memset(frame_table, 0, frame_table_size);
   13.22 -
   13.23 -    /* Initialise to a magic of 0x55555555 so easier to spot bugs later. */
   13.24 -    memset(machine_to_phys_mapping, 0x55, 4<<20);
   13.25 -
   13.26 -    /* Pin the ownership of the MP table so that DOM0 can map it later. */
   13.27 -    for ( mfn = virt_to_phys(&machine_to_phys_mapping[0<<20])>>PAGE_SHIFT;
   13.28 -          mfn < virt_to_phys(&machine_to_phys_mapping[1<<20])>>PAGE_SHIFT;
   13.29 -          mfn++ )
   13.30 -    {
   13.31 -        frame_table[mfn].u.inuse.count_info = 1 | PGC_allocated;
   13.32 -        frame_table[mfn].u.inuse.type_info = 1 | PGT_gdt_page; /* non-RW */
   13.33 -        frame_table[mfn].u.inuse.domain = &idle0_task;
   13.34 -    }
   13.35  }

    14.1 --- a/xen/common/page_alloc.c	Thu Aug 19 13:50:49 2004 +0000
    14.2 +++ b/xen/common/page_alloc.c	Thu Aug 19 15:39:07 2004 +0000
    14.3 @@ -393,7 +393,7 @@ struct pfn_info *alloc_domheap_pages(str
    14.4      }
    14.5  
    14.6      if ( unlikely(d->tot_pages == 0) )
    14.7 -        get_domain(d);
    14.8 +        get_knownalive_domain(d);
    14.9  
   14.10      d->tot_pages += 1 << order;
   14.11  

    15.1 --- a/xen/include/asm-x86/mm.h	Thu Aug 19 13:50:49 2004 +0000
    15.2 +++ b/xen/include/asm-x86/mm.h	Thu Aug 19 15:39:07 2004 +0000
    15.3 @@ -108,7 +108,7 @@ struct pfn_info
    15.4          /* _dom holds an allocation reference */                            \
    15.5          (_pfn)->u.inuse.count_info = PGC_allocated | 1;                     \
    15.6          if ( unlikely((_dom)->xenheap_pages++ == 0) )                       \
    15.7 -            get_domain(_dom);                                               \
    15.8 +            get_knownalive_domain(_dom);                                    \
    15.9          spin_unlock(&(_dom)->page_alloc_lock);                              \
   15.10      } while ( 0 )
   15.11  

    16.1 --- a/xen/include/hypervisor-ifs/hypervisor-if.h	Thu Aug 19 13:50:49 2004 +0000
    16.2 +++ b/xen/include/hypervisor-ifs/hypervisor-if.h	Thu Aug 19 15:39:07 2004 +0000
    16.3 @@ -87,8 +87,10 @@
    16.4   * ptr[1:0] == MMU_NORMAL_PT_UPDATE:
    16.5   * Updates an entry in a page table. If updating an L1 table, and the new
    16.6   * table entry is valid/present, the mapped frame must belong to the FD, if
    16.7 - * an FD has been specified. If attempting to map an I/O page, then the FD
    16.8 - * is ignored, but the calling domain must have sufficient privilege.
    16.9 + * an FD has been specified. If attempting to map an I/O page then the
   16.10 + * caller assumes the privilege of the FD.
   16.11 + * FD == DOMID_IO: Permit /only/ I/O mappings, at the priv level of the caller.
   16.12 + * FD == DOMID_XEN: Map restricted areas of Xen's heap space.
   16.13   * ptr[:2]  -- Machine address of the page-table entry to modify.
   16.14   * val      -- Value to write.
   16.15   * 
   16.16 @@ -121,6 +123,7 @@
   16.17   *   val[7:0] == MMUEXT_SET_FOREIGNDOM:
   16.18   *   val[31:15] -- Domain to set as the Foreign Domain (FD).
   16.19   *                 (NB. DOMID_SELF is not recognised)
   16.20 + *                 If FD != DOMID_IO then the caller must be privileged.
   16.21   * 
   16.22   *   val[7:0] == MMUEXT_REASSIGN_PAGE:
   16.23   *   ptr[:2]  -- A machine address within the page to be reassigned to the FD.
   16.24 @@ -186,9 +189,31 @@
   16.25  #ifndef __ASSEMBLY__
   16.26  
   16.27  typedef u16 domid_t;
   16.28 +
   16.29 +/* Domain ids >= DOMID_FIRST_RESERVED cannot be used for ordinary domains. */
   16.30 +#define DOMID_FIRST_RESERVED (0x7FF0U)
   16.31 +
   16.32  /* DOMID_SELF is used in certain contexts to refer to oneself. */
   16.33 -#define DOMID_SELF  (0x7FF0U)
   16.34 -/* NB. IDs >= 0x7FF1 are reserved for future use. */
   16.35 +#define DOMID_SELF (0x7FF0U)
   16.36 +
   16.37 +/*
   16.38 + * DOMID_IO is used to restrict page-table updates to mapping I/O memory.
   16.39 + * Although no Foreign Domain need be specified to map I/O pages, DOMID_IO
   16.40 + * is useful to ensure that no mappings to the OS's own heap are accidentally
   16.41 + * installed. (e.g., in Linux this could cause havoc as reference counts
   16.42 + * aren't adjusted on the I/O-mapping code path).
   16.43 + * This only makes sense in MMUEXT_SET_FOREIGNDOM, but in that context can
   16.44 + * be specified by any calling domain.
   16.45 + */
   16.46 +#define DOMID_IO   (0x7FF1U)
   16.47 +
   16.48 +/*
   16.49 + * DOMID_XEN is used to allow privileged domains to map restricted parts of
   16.50 + * Xen's heap space (e.g., the machine_to_phys table).
   16.51 + * This only makes sense in MMUEXT_SET_FOREIGNDOM, and is only permitted if
   16.52 + * the caller is privileged.
   16.53 + */
   16.54 +#define DOMID_XEN  (0x7FF2U)
   16.55  
   16.56  /*
   16.57   * Send an array of these to HYPERVISOR_mmu_update().

    17.1 --- a/xen/include/xen/sched.h	Thu Aug 19 13:50:49 2004 +0000
    17.2 +++ b/xen/include/xen/sched.h	Thu Aug 19 15:39:07 2004 +0000
    17.3 @@ -164,11 +164,26 @@ struct domain *alloc_domain_struct();
    17.4  #define DOMAIN_DESTRUCTED (1<<31) /* assumes atomic_t is >= 32 bits */
    17.5  #define put_domain(_d) \
    17.6    if ( atomic_dec_and_test(&(_d)->refcnt) ) domain_destruct(_d)
    17.7 +
    17.8 +/*
    17.9 + * Use this when you don't have an existing reference to @d. It returns
   17.10 + * FALSE if @d is being destructed.
   17.11 + */
   17.12  static inline int get_domain(struct domain *d)
   17.13  {
   17.14      atomic_inc(&d->refcnt);
   17.15      return !(atomic_read(&d->refcnt) & DOMAIN_DESTRUCTED);
   17.16  }
   17.17 +
   17.18 +/*
   17.19 + * Use this when you already have, or are borrowing, a reference to @d.
   17.20 + * In this case we know that @d cannot be destructed under our feet.
   17.21 + */
   17.22 +static inline void get_knownalive_domain(struct domain *d)
   17.23 +{
   17.24 +    atomic_inc(&d->refcnt);
   17.25 +    ASSERT(!(atomic_read(&d->refcnt) & DOMAIN_DESTRUCTED));
   17.26 +}
   17.27    
   17.28  extern struct domain *do_createdomain(
   17.29      domid_t dom_id, unsigned int cpu);