1.1 --- a/linux-2.6-xen-sparse/drivers/xen/core/skbuff.c	Mon Oct 02 21:53:07 2006 -0600
     1.2 +++ b/linux-2.6-xen-sparse/drivers/xen/core/skbuff.c	Tue Oct 03 08:59:22 2006 -0600
     1.3 @@ -18,7 +18,12 @@
     1.4  /*static*/ kmem_cache_t *skbuff_cachep;
     1.5  EXPORT_SYMBOL(skbuff_cachep);
     1.6  
     1.7 -#define MAX_SKBUFF_ORDER 4
     1.8 +/* Allow up to 64kB or page-sized packets (whichever is greater). */
     1.9 +#if PAGE_SHIFT < 16
    1.10 +#define MAX_SKBUFF_ORDER (16 - PAGE_SHIFT)
    1.11 +#else
    1.12 +#define MAX_SKBUFF_ORDER 0
    1.13 +#endif
    1.14  static kmem_cache_t *skbuff_order_cachep[MAX_SKBUFF_ORDER + 1];
    1.15  
    1.16  static struct {

     2.1 --- a/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c	Mon Oct 02 21:53:07 2006 -0600
     2.2 +++ b/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c	Tue Oct 03 08:59:22 2006 -0600
     2.3 @@ -63,6 +63,25 @@
     2.4  #include <xen/interface/grant_table.h>
     2.5  #include <xen/gnttab.h>
     2.6  
     2.7 +/*
     2.8 + * Mutually-exclusive module options to select receive data path:
     2.9 + *  rx_copy : Packets are copied by network backend into local memory
    2.10 + *  rx_flip : Page containing packet data is transferred to our ownership
    2.11 + * For fully-virtualised guests there is no option - copying must be used.
    2.12 + * For paravirtualised guests, flipping is the default.
    2.13 + */
    2.14 +#ifdef CONFIG_XEN
    2.15 +static int MODPARM_rx_copy = 0;
    2.16 +module_param_named(rx_copy, MODPARM_rx_copy, bool, 0);
    2.17 +MODULE_PARM_DESC(rx_copy, "Copy packets from network card (rather than flip)");
    2.18 +static int MODPARM_rx_flip = 0;
    2.19 +module_param_named(rx_flip, MODPARM_rx_flip, bool, 0);
    2.20 +MODULE_PARM_DESC(rx_flip, "Flip packets from network card (rather than copy)");
    2.21 +#else
    2.22 +static const int MODPARM_rx_copy = 1;
    2.23 +static const int MODPARM_rx_flip = 0;
    2.24 +#endif
    2.25 +
    2.26  #define RX_COPY_THRESHOLD 256
    2.27  
    2.28  /* If we don't have GSO, fake things up so that we never try to use it. */
    2.29 @@ -229,8 +248,7 @@ static int __devinit netfront_probe(stru
    2.30  	int err;
    2.31  	struct net_device *netdev;
    2.32  	struct netfront_info *info;
    2.33 -	unsigned int handle;
    2.34 -	unsigned feature_rx_copy;
    2.35 +	unsigned int handle, feature_rx_copy, feature_rx_flip, use_copy;
    2.36  
    2.37  	err = xenbus_scanf(XBT_NIL, dev->nodename, "handle", "%u", &handle);
    2.38  	if (err != 1) {
    2.39 @@ -238,22 +256,24 @@ static int __devinit netfront_probe(stru
    2.40  		return err;
    2.41  	}
    2.42  
    2.43 -#ifndef CONFIG_XEN
    2.44  	err = xenbus_scanf(XBT_NIL, dev->otherend, "feature-rx-copy", "%u",
    2.45  			   &feature_rx_copy);
    2.46 -	if (err != 1) {
    2.47 -		xenbus_dev_fatal(dev, err, "reading feature-rx-copy");
    2.48 -		return err;
    2.49 -	}
    2.50 -	if (!feature_rx_copy) {
    2.51 -		xenbus_dev_fatal(dev, 0, "need a copy-capable backend");
    2.52 -		return -EINVAL;
    2.53 -	}
    2.54 -#else
    2.55 -	feature_rx_copy = 0;
    2.56 -#endif
    2.57 +	if (err != 1)
    2.58 +		feature_rx_copy = 0;
    2.59 +	err = xenbus_scanf(XBT_NIL, dev->otherend, "feature-rx-flip", "%u",
    2.60 +			   &feature_rx_flip);
    2.61 +	if (err != 1)
    2.62 +		feature_rx_flip = 1;
    2.63  
    2.64 -	netdev = create_netdev(handle, feature_rx_copy, dev);
    2.65 +	/*
    2.66 +	 * Copy packets on receive path if:
    2.67 +	 *  (a) This was requested by user, and the backend supports it; or
    2.68 +	 *  (b) Flipping was requested, but this is unsupported by the backend.
    2.69 +	 */
    2.70 +	use_copy = (MODPARM_rx_copy && feature_rx_copy) ||
    2.71 +		(MODPARM_rx_flip && !feature_rx_flip);
    2.72 +
    2.73 +	netdev = create_netdev(handle, use_copy, dev);
    2.74  	if (IS_ERR(netdev)) {
    2.75  		err = PTR_ERR(netdev);
    2.76  		xenbus_dev_fatal(dev, err, "creating netdev");
    2.77 @@ -271,6 +291,9 @@ static int __devinit netfront_probe(stru
    2.78  	if (err)
    2.79  		goto fail_open;
    2.80  
    2.81 +	IPRINTK("Created netdev %s with %sing receive path.\n",
    2.82 +		netdev->name, info->copying_receiver ? "copy" : "flipp");
    2.83 +
    2.84  	return 0;
    2.85  
    2.86   fail_open:
    2.87 @@ -742,7 +765,7 @@ no_skb:
    2.88  		} else {
    2.89  			gnttab_grant_foreign_access_ref(ref,
    2.90  							np->xbdev->otherend_id,
    2.91 -							pfn,
    2.92 +							pfn_to_mfn(pfn),
    2.93  							0);
    2.94  		}
    2.95  
    2.96 @@ -1632,7 +1655,8 @@ static void network_connect(struct net_d
    2.97  		} else {
    2.98  			gnttab_grant_foreign_access_ref(
    2.99  				ref, np->xbdev->otherend_id,
   2.100 -				page_to_pfn(skb_shinfo(skb)->frags->page),
   2.101 +				pfn_to_mfn(page_to_pfn(skb_shinfo(skb)->
   2.102 +						       frags->page)),
   2.103  				0);
   2.104  		}
   2.105  		req->gref = ref;
   2.106 @@ -2053,6 +2077,16 @@ static int __init netif_init(void)
   2.107  	if (!is_running_on_xen())
   2.108  		return -ENODEV;
   2.109  
   2.110 +#ifdef CONFIG_XEN
   2.111 +	if (MODPARM_rx_flip && MODPARM_rx_copy) {
   2.112 +		WPRINTK("Cannot specify both rx_copy and rx_flip.\n");
   2.113 +		return -EINVAL;
   2.114 +	}
   2.115 +
   2.116 +	if (!MODPARM_rx_flip && !MODPARM_rx_copy)
   2.117 +		MODPARM_rx_flip = 1; /* Default is to flip. */
   2.118 +#endif
   2.119 +
   2.120  	if (is_initial_xendomain())
   2.121  		return 0;
   2.122  

     3.1 --- a/tools/firmware/hvmloader/hvmloader.c	Mon Oct 02 21:53:07 2006 -0600
     3.2 +++ b/tools/firmware/hvmloader/hvmloader.c	Tue Oct 03 08:59:22 2006 -0600
     3.3 @@ -170,6 +170,9 @@ main(void)
     3.4  
     3.5  	init_hypercalls();
     3.6  
     3.7 +	puts("Writing SMBIOS tables ...\n");
     3.8 +	hvm_write_smbios_tables();
     3.9 +
    3.10  	puts("Loading ROMBIOS ...\n");
    3.11  	memcpy((void *)ROMBIOS_PHYSICAL_ADDRESS, rombios, sizeof(rombios));
    3.12  
    3.13 @@ -201,9 +204,6 @@ main(void)
    3.14  		}
    3.15  	}
    3.16  
    3.17 -	puts("Writing SMBIOS tables ...\n");
    3.18 -	hvm_write_smbios_tables();
    3.19 -
    3.20  	if (check_amd()) {
    3.21  		/* AMD implies this is SVM */
    3.22                  puts("SVM go ...\n");

     4.1 --- a/tools/firmware/hvmloader/smbios.c	Mon Oct 02 21:53:07 2006 -0600
     4.2 +++ b/tools/firmware/hvmloader/smbios.c	Tue Oct 03 08:59:22 2006 -0600
     4.3 @@ -28,23 +28,15 @@
     4.4  #include "util.h"
     4.5  #include "hypercall.h"
     4.6  
     4.7 -/* write SMBIOS tables starting at 'start', without writing more
     4.8 -   than 'max_size' bytes.
     4.9 -
    4.10 -   Return the number of bytes written
    4.11 -*/
    4.12  static size_t
    4.13 -write_smbios_tables(void *start, size_t max_size,
    4.14 +write_smbios_tables(void *start,
    4.15  		    uint32_t vcpus, uint64_t memsize,
    4.16  		    uint8_t uuid[16], char *xen_version,
    4.17  		    uint32_t xen_major_version, uint32_t xen_minor_version);
    4.18  
    4.19  static void
    4.20  get_cpu_manufacturer(char *buf, int len);
    4.21 -static size_t
    4.22 -smbios_table_size(uint32_t vcpus, const char *xen_version,
    4.23 -		  const char *processor_manufacturer);
    4.24 -static void *
    4.25 +static void
    4.26  smbios_entry_point_init(void *start,
    4.27  			uint16_t max_structure_size,
    4.28  			uint16_t structure_table_length,
    4.29 @@ -71,7 +63,7 @@ static void *
    4.30  smbios_type_20_init(void *start, uint32_t memory_size_mb);
    4.31  static void *
    4.32  smbios_type_32_init(void *start);
    4.33 -void *
    4.34 +static void *
    4.35  smbios_type_127_init(void *start);
    4.36  
    4.37  static void
    4.38 @@ -80,7 +72,8 @@ get_cpu_manufacturer(char *buf, int len)
    4.39  	char id[12];
    4.40  	uint32_t eax = 0;
    4.41  
    4.42 -	cpuid(0, &eax, (uint32_t *)&id[0], (uint32_t *)&id[8], (uint32_t *)&id[4]);
    4.43 +	cpuid(0, &eax, (uint32_t *)&id[0], (uint32_t *)&id[8],
    4.44 +	      (uint32_t *)&id[4]);
    4.45  
    4.46  	if (memcmp(id, "GenuineIntel", 12) == 0)
    4.47  		strncpy(buf, "Intel", len);
    4.48 @@ -90,90 +83,51 @@ get_cpu_manufacturer(char *buf, int len)
    4.49  		strncpy(buf, "unknown", len);
    4.50  }
    4.51  
    4.52 -
    4.53 -/* Calculate the size of the SMBIOS structure table.
    4.54 -*/
    4.55  static size_t
    4.56 -smbios_table_size(uint32_t vcpus, const char *xen_version,
    4.57 -		  const char *processor_manufacturer)
    4.58 -{
    4.59 -	size_t size;
    4.60 -
    4.61 -	/* first compute size without strings or terminating 0 bytes */
    4.62 -	size =  sizeof(struct smbios_type_0) + sizeof(struct smbios_type_1) +
    4.63 -		sizeof(struct smbios_type_3) + sizeof(struct smbios_type_4)*vcpus +
    4.64 -		sizeof(struct smbios_type_16) + sizeof(struct smbios_type_17) +
    4.65 -		sizeof(struct smbios_type_19) + sizeof(struct smbios_type_20) +
    4.66 -		sizeof(struct smbios_type_32) + sizeof(struct smbios_type_127);
    4.67 -
    4.68 -	/* 5 structures with no strings, 2 null bytes each */
    4.69 -	size += 10;
    4.70 -
    4.71 -	/* Need to include 1 null byte per structure with strings (first
    4.72 -	   terminating null byte comes from the string terminator of the
    4.73 -	   last string). */
    4.74 -	size += 4 + vcpus;
    4.75 -
    4.76 -	/* type 0: "Xen", xen_version, and release_date */
    4.77 -	size += strlen("Xen") + strlen(xen_version) + 2;
    4.78 -	/* type 1: "Xen", xen_version, "HVM domU", UUID as string for 
    4.79 -                   serial number */
    4.80 -	size += strlen("Xen") + strlen("HVM domU") + strlen(xen_version) +
    4.81 -			36 + 4;
    4.82 -	/* type 3: "Xen" */
    4.83 -	size += strlen("Xen") + 1;
    4.84 -	/* type 4: socket designation ("CPU n"), processor_manufacturer */
    4.85 -	size += vcpus * (strlen("CPU n") + strlen(processor_manufacturer) + 2);
    4.86 -	/* Make room for two-digit CPU numbers if necessary -- doesn't handle
    4.87 -	   vcpus > 99 */
    4.88 -	if (vcpus > 9)
    4.89 -		size += vcpus - 9;
    4.90 -	/* type 17: device locator string ("DIMM 1") */
    4.91 -	size += strlen("DIMM 1") + 1;
    4.92 -
    4.93 -	return size;
    4.94 -}
    4.95 -
    4.96 -static size_t
    4.97 -write_smbios_tables(void *start, size_t max_size,
    4.98 +write_smbios_tables(void *start,
    4.99  		    uint32_t vcpus, uint64_t memsize,
   4.100  		    uint8_t uuid[16], char *xen_version,
   4.101  		    uint32_t xen_major_version, uint32_t xen_minor_version)
   4.102  {
   4.103 -	unsigned cpu_num;
   4.104 -	void *p = start;
   4.105 +	unsigned cpu_num, nr_structs = 0, max_struct_size = 0;
   4.106 +	char *p, *q;
   4.107  	char cpu_manufacturer[15];
   4.108  	size_t structure_table_length;
   4.109  
   4.110  	get_cpu_manufacturer(cpu_manufacturer, 15);
   4.111  
   4.112 -
   4.113 -	structure_table_length = smbios_table_size(vcpus, xen_version,
   4.114 -						   cpu_manufacturer);
   4.115 +	p = (char *)start + sizeof(struct smbios_entry_point);
   4.116  
   4.117 -	if (structure_table_length + sizeof(struct smbios_entry_point) > max_size)
   4.118 -		return 0;
   4.119 -
   4.120 -	p = smbios_entry_point_init(p, sizeof(struct smbios_type_4), 
   4.121 -				    structure_table_length,
   4.122 -				    (uint32_t)start + 
   4.123 -				    sizeof(struct smbios_entry_point),
   4.124 -				    9 + vcpus);
   4.125 +#define do_struct(fn) do {			\
   4.126 +	q = (fn);				\
   4.127 +	nr_structs++;				\
   4.128 +	if ((q - p) > max_struct_size)		\
   4.129 +		max_struct_size = q - p;	\
   4.130 +	p = q;					\
   4.131 +} while (0)
   4.132  
   4.133 -	p = smbios_type_0_init(p, xen_version, xen_major_version,
   4.134 -			       xen_minor_version);
   4.135 -	p = smbios_type_1_init(p, xen_version, uuid);
   4.136 -	p = smbios_type_3_init(p);
   4.137 -	for (cpu_num = 1; cpu_num <= vcpus; ++cpu_num)
   4.138 -		p = smbios_type_4_init(p, cpu_num, cpu_manufacturer);
   4.139 -	p = smbios_type_16_init(p, memsize);
   4.140 -	p = smbios_type_17_init(p, memsize);
   4.141 -	p = smbios_type_19_init(p, memsize);
   4.142 -	p = smbios_type_20_init(p, memsize);
   4.143 -	p = smbios_type_32_init(p);
   4.144 -	p = smbios_type_127_init(p);
   4.145 +	do_struct(smbios_type_0_init(p, xen_version, xen_major_version,
   4.146 +				     xen_minor_version));
   4.147 +	do_struct(smbios_type_1_init(p, xen_version, uuid));
   4.148 +	do_struct(smbios_type_3_init(p));
   4.149 +	for (cpu_num = 1; cpu_num <= vcpus; cpu_num++)
   4.150 +		do_struct(smbios_type_4_init(p, cpu_num, cpu_manufacturer));
   4.151 +	do_struct(smbios_type_16_init(p, memsize));
   4.152 +	do_struct(smbios_type_17_init(p, memsize));
   4.153 +	do_struct(smbios_type_19_init(p, memsize));
   4.154 +	do_struct(smbios_type_20_init(p, memsize));
   4.155 +	do_struct(smbios_type_32_init(p));
   4.156 +	do_struct(smbios_type_127_init(p));
   4.157  
   4.158 -	return (size_t)((char*)p - (char*)start);
   4.159 +#undef do_struct
   4.160 +
   4.161 +	smbios_entry_point_init(
   4.162 +		start, max_struct_size,
   4.163 +		(p - (char *)start) - sizeof(struct smbios_entry_point),
   4.164 +		SMBIOS_PHYSICAL_ADDRESS + sizeof(struct smbios_entry_point),
   4.165 +		nr_structs);
   4.166 +
   4.167 +	return (size_t)((char *)p - (char *)start);
   4.168  }
   4.169  
   4.170  /* This tries to figure out how much pseudo-physical memory (in MB)
   4.171 @@ -278,10 +232,16 @@ hvm_write_smbios_tables(void)
   4.172  
   4.173  	xen_version_str[sizeof(xen_version_str)-1] = '\0';
   4.174  
   4.175 -	write_smbios_tables((void *) SMBIOS_PHYSICAL_ADDRESS,
   4.176 -			    SMBIOS_SIZE_LIMIT, get_vcpu_nr(), get_memsize(),
   4.177 -			    uuid, xen_version_str,
   4.178 -			    xen_major_version, xen_minor_version);
   4.179 +	/* NB. 0xC0000 is a safe large memory area for scratch. */
   4.180 +	len = write_smbios_tables((void *)0xC0000,
   4.181 +				  get_vcpu_nr(), get_memsize(),
   4.182 +				  uuid, xen_version_str,
   4.183 +				  xen_major_version, xen_minor_version);
   4.184 +	if (len > SMBIOS_SIZE_LIMIT)
   4.185 +		goto error_out;
   4.186 +	/* Okay, not too large: copy out of scratch to final location. */
   4.187 +	memcpy((void *)SMBIOS_PHYSICAL_ADDRESS, (void *)0xC0000, len);
   4.188 +
   4.189  	return;
   4.190  
   4.191   error_out:
   4.192 @@ -290,7 +250,7 @@ hvm_write_smbios_tables(void)
   4.193  }
   4.194  
   4.195  
   4.196 -static void *
   4.197 +static void
   4.198  smbios_entry_point_init(void *start,
   4.199  			uint16_t max_structure_size,
   4.200  			uint16_t structure_table_length,
   4.201 @@ -327,8 +287,6 @@ smbios_entry_point_init(void *start,
   4.202  	for (i = 0x10; i < ep->length; ++i)
   4.203  		sum += ((int8_t *)start)[i];
   4.204  	ep->intermediate_checksum = -sum;
   4.205 -
   4.206 -	return (char *)start + sizeof(struct smbios_entry_point);
   4.207  }
   4.208  
   4.209  /* Type 0 -- BIOS Information */
   4.210 @@ -597,7 +555,7 @@ smbios_type_32_init(void *start)
   4.211  }
   4.212  
   4.213  /* Type 127 -- End of Table */
   4.214 -void *
   4.215 +static void *
   4.216  smbios_type_127_init(void *start)
   4.217  {
   4.218  	struct smbios_type_127 *p = (struct smbios_type_127 *)start;

     5.1 --- a/tools/python/xen/xm/main.py	Mon Oct 02 21:53:07 2006 -0600
     5.2 +++ b/tools/python/xen/xm/main.py	Tue Oct 03 08:59:22 2006 -0600
     5.3 @@ -1222,7 +1222,7 @@ def parse_block_configuration(args):
     5.4          label = security.get_security_printlabel(dominfo)
     5.5      else:
     5.6          label = None
     5.7 -        security.res_security_check(args[1], label)
     5.8 +    security.res_security_check(args[1], label)
     5.9  
    5.10      return (dom, vbd)
    5.11  

     6.1 --- a/tools/python/xen/xm/rmlabel.py	Mon Oct 02 21:53:07 2006 -0600
     6.2 +++ b/tools/python/xen/xm/rmlabel.py	Tue Oct 03 08:59:22 2006 -0600
     6.3 @@ -57,7 +57,8 @@ def rm_domain_label(configfile):
     6.4      fd = None
     6.5      file = None
     6.6      if configfile[0] == '/':
     6.7 -        fd = open(configfile, "rb")
     6.8 +        file = configfile
     6.9 +        fd = open(file, "rb")
    6.10      else:
    6.11          for prefix in [".", "/etc/xen"]:
    6.12              file = prefix + "/" + configfile

     7.1 --- a/xen/arch/ia64/xen/xensetup.c	Mon Oct 02 21:53:07 2006 -0600
     7.2 +++ b/xen/arch/ia64/xen/xensetup.c	Tue Oct 03 08:59:22 2006 -0600
     7.3 @@ -18,6 +18,7 @@
     7.4  #include <xen/domain.h>
     7.5  #include <xen/serial.h>
     7.6  #include <xen/trace.h>
     7.7 +#include <xen/keyhandler.h>
     7.8  #include <asm/meminit.h>
     7.9  #include <asm/page.h>
    7.10  #include <asm/setup.h>
    7.11 @@ -25,7 +26,6 @@
    7.12  #include <asm/vmx.h>
    7.13  #include <linux/efi.h>
    7.14  #include <asm/iosapic.h>
    7.15 -#include <xen/keyhandler.h>
    7.16  
    7.17  unsigned long xenheap_phys_end, total_pages;
    7.18  

     8.1 --- a/xen/arch/x86/hvm/platform.c	Mon Oct 02 21:53:07 2006 -0600
     8.2 +++ b/xen/arch/x86/hvm/platform.c	Tue Oct 03 08:59:22 2006 -0600
     8.3 @@ -730,6 +730,11 @@ void send_pio_req(struct cpu_user_regs *
     8.4      vcpu_iodata_t *vio;
     8.5      ioreq_t *p;
     8.6  
     8.7 +    if (size == 0 || count == 0) {
     8.8 +        printf("null pio request? port %lx, count %lx, size %d, value %lx, dir %d, pvalid %d.\n",
     8.9 +               port, count, size, value, dir, pvalid);
    8.10 +    }
    8.11 +
    8.12      vio = get_vio(v->domain, v->vcpu_id);
    8.13      if (vio == NULL) {
    8.14          printk("bad shared page: %lx\n", (unsigned long) vio);
    8.15 @@ -768,7 +773,7 @@ void send_pio_req(struct cpu_user_regs *
    8.16      hvm_send_assist_req(v);
    8.17  }
    8.18  
    8.19 -void send_mmio_req(
    8.20 +static void send_mmio_req(
    8.21      unsigned char type, unsigned long gpa,
    8.22      unsigned long count, int size, long value, int dir, int pvalid)
    8.23  {
    8.24 @@ -777,6 +782,11 @@ void send_mmio_req(
    8.25      ioreq_t *p;
    8.26      struct cpu_user_regs *regs;
    8.27  
    8.28 +    if (size == 0 || count == 0) {
    8.29 +        printf("null mmio request? type %d, gpa %lx, count %lx, size %d, value %lx, dir %d, pvalid %d.\n",
    8.30 +               type, gpa, count, size, value, dir, pvalid);
    8.31 +    }
    8.32 +
    8.33      regs = &current->arch.hvm_vcpu.io_op.io_context;
    8.34  
    8.35      vio = get_vio(v->domain, v->vcpu_id);
    8.36 @@ -918,6 +928,8 @@ void handle_mmio(unsigned long va, unsig
    8.37          unsigned long addr = 0;
    8.38          int dir;
    8.39  
    8.40 +        ASSERT(count);
    8.41 +
    8.42          /* determine non-MMIO address */
    8.43          if (realmode) {
    8.44              if (((regs->es << 4) + (regs->edi & 0xFFFF)) == va) {
    8.45 @@ -940,6 +952,9 @@ void handle_mmio(unsigned long va, unsig
    8.46          mmio_opp->flags = mmio_inst.flags;
    8.47          mmio_opp->instr = mmio_inst.instr;
    8.48  
    8.49 +        if (addr & (size - 1))
    8.50 +            DPRINTK("Unaligned ioport access: %lx, %ld\n", addr, size);
    8.51 +
    8.52          /*
    8.53           * In case of a movs spanning multiple pages, we break the accesses
    8.54           * up into multiple pages (the device model works with non-continguous
    8.55 @@ -953,6 +968,7 @@ void handle_mmio(unsigned long va, unsig
    8.56          if ((addr & PAGE_MASK) != ((addr + sign * (size - 1)) & PAGE_MASK)) {
    8.57              unsigned long value = 0;
    8.58  
    8.59 +            DPRINTK("Single io request in a movs crossing page boundary.\n");
    8.60              mmio_opp->flags |= OVERLAP;
    8.61  
    8.62              regs->eip -= inst_len; /* do not advance %eip */
    8.63 @@ -964,12 +980,19 @@ void handle_mmio(unsigned long va, unsig
    8.64              if ((addr & PAGE_MASK) != ((addr + sign * (count * size - 1)) & PAGE_MASK)) {
    8.65                  regs->eip -= inst_len; /* do not advance %eip */
    8.66  
    8.67 -                if (sign > 0)
    8.68 +                if (sign > 0) {
    8.69                      count = (PAGE_SIZE - (addr & ~PAGE_MASK)) / size;
    8.70 -                else
    8.71 -                    count = (addr & ~PAGE_MASK) / size;
    8.72 +                } else {
    8.73 +                    /* We need to make sure we advance to the point
    8.74 +                       where the next request will be on a different
    8.75 +                       page.  If we're going down, that means
    8.76 +                       advancing until one byte before the start of
    8.77 +                       the page, hence +1. */
    8.78 +                    count = ((addr + 1) & ~PAGE_MASK) / size;
    8.79 +                }
    8.80              }
    8.81  
    8.82 +            ASSERT(count);
    8.83              send_mmio_req(IOREQ_TYPE_COPY, gpa, count, size, addr, dir, 1);
    8.84          }
    8.85          break;

     9.1 --- a/xen/common/grant_table.c	Mon Oct 02 21:53:07 2006 -0600
     9.2 +++ b/xen/common/grant_table.c	Tue Oct 03 08:59:22 2006 -0600
     9.3 @@ -903,7 +903,7 @@ static void
     9.4      }
     9.5      if ( !get_page_and_type(mfn_to_page(d_frame), dd, PGT_writable_page) )
     9.6          PIN_FAIL(error_out, GNTST_general_error,
     9.7 -                 "could not get source frame %lx.\n", d_frame);
     9.8 +                 "could not get destination frame %lx.\n", d_frame);
     9.9  
    9.10      sp = map_domain_page(s_frame);
    9.11      dp = map_domain_page(d_frame);