[PATCH 00/21] Sweep through arm-for-4.3 branch + a bit extra

[PATCH 00/21] Sweep through arm-for-4.3 branch + a bit extra

[Ian Campbell]

The following consists of the ARM patches which were queued during the
4.2 freeze in 
git://xenbits.xen.org/people/ianc/xen-unstable.git arm-for-4.3
plus v4 of Stefano's "ARM hypercall ABI: 64 bit ready" rebased on
current xen-unstable. Plus a couple of extras.

Stefano's 64 bit interfaces patches needed a little bit of rebasing, due
to the dropping of x86_32, the changes s/int/long/ in hypercall returns
etc. Nothing major. I've tried to note in the changelog what I had to
do. Stefano, it might be worth double checking you are happy with my
rebase.

The patch "HACK: arm: initial XENMAPSPACE_gmfn_foreign" from my branch
and the patch "xen: improve changes to xen_add_to_physmap" from
Stefano's series are dropped in favour of the new, non-hack
implementation of foreign privileged mappings in "xen: arm: implement
XENMEM_add_to_physmap_range". I've rebased this in at the beginning of
the series (where HACK... was), which meant tweaking Stefano's old
"xen/arm: grant table" just a tad. Note that I've dropped support for
foreign mappings via XENMEM_add_to_physmap and therefore the union which
Stefano added is gone.

There is a bisectibility issue from "xen: introduce
XEN_GUEST_HANDLE_PARAM" onwards so those patches should be considered
RFC for now. (see <1349428386.20946.15.camel@zakaz.uk.xensource.com>
posted this morning). There is also an issue with compat param handle
handling exposed by tmem which I haven't looked at properly yet.

This stuff works with the kernel tree described in
<1349363496.866.49.camel@zakaz.uk.xensource.com> "arm: implement
ballooning and privcmd foreign mappings based on x86 PVH"

Keir, Jan, I've only CC'd you on those of the following which touch
common or x86 code (basically "xen: xen_ulong_t substitution" onwards).

N == New, or recently posted to the list
A == ACKED
B == Was in arm-for-4.3 branch
R == RFC only

01 N	xen: arm: implement XENMEM_add_to_physmap_range
02   B	libxc: add ARM support to xc_dom (PV domain building)
03  AB	arm: implement VGCF_online
04  AB	xen/arm: implement page reference and gnttab functions needed by grant_table.c
05  AB	xen/arm: implement get/put_page_type
06  AB	xen/arm: create_p2m_entries should not call free_domheap_page
07  AB	xen/arm: grant table
08   B	arm: kill a guest which uses hvc with an immediate operand != XEN_HYPERCALL_TAG
09  AB	libxc/arm: allocate xenstore and console pages
10  AB	arm: disable distributor delivery on boot CPU only
11  AB	xen/arm: protect LR registers and lr_mask changes with spin_lock_irq
12  AB	xen/arm: introduce __lshrdi3 and __aeabi_llsr
13  AB	arm: don't bother setting up vtimer, vgic etc on idle CPUs
14  AB	arm/vtimer: convert result to ticks when reading CNTPCT register
15  AB	arm: Use per-CPU irq_desc for PPIs and SGIs
16 N	arm: tools: add arm to foreign structs checking
17	xen: xen_ulong_t substitution
18	xen: change the limit of nr_extents to UINT_MAX >> MEMOP_EXTENT_SHIFT
19    R	xen: introduce XEN_GUEST_HANDLE_PARAM
20    R	xen: replace XEN_GUEST_HANDLE with XEN_GUEST_HANDLE_PARAM when appropriate
21    R	xen: more substitutions


Ian.

[PATCH 01/21] xen: arm: implement XENMEM_add_to_physmap_range

[Ian Campbell]

This allows for foreign mappings as well as batching, fitting all that
into XENMEM_add_to_physmap wasn't possible.

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
---
 xen/arch/arm/mm.c           |  120 ++++++++++++++++++++++++++++++++++++++-----
 xen/include/public/memory.h |   40 +++++++++++---
 xen/include/public/xen.h    |    1 +
 3 files changed, 139 insertions(+), 22 deletions(-)

diff --git a/xen/arch/arm/mm.c b/xen/arch/arm/mm.c
index 40ac176..dde304b 100644
--- a/xen/arch/arm/mm.c
+++ b/xen/arch/arm/mm.c
@@ -25,6 +25,8 @@
 #include <xen/mm.h>
 #include <xen/preempt.h>
 #include <xen/errno.h>
+#include <xen/softirq.h>
+#include <xen/event.h>
 #include <xen/guest_access.h>
 #include <xen/domain_page.h>
 #include <asm/page.h>
@@ -461,37 +463,96 @@ void share_xen_page_with_guest(struct page_info *page,
     spin_unlock(&d->page_alloc_lock);
 }
 
-static int xenmem_add_to_physmap_once(
+static int xenmem_add_to_physmap_one(
     struct domain *d,
-    const struct xen_add_to_physmap *xatp)
+    uint16_t space,
+    domid_t foreign_domid,
+    unsigned long idx,
+    xen_pfn_t gpfn)
 {
     unsigned long mfn = 0;
     int rc;
 
-    switch ( xatp->space )
+    switch ( space )
     {
-        case XENMAPSPACE_shared_info:
-            if ( xatp->idx == 0 )
-                mfn = virt_to_mfn(d->shared_info);
-            break;
-        default:
-            return -ENOSYS;
+    case XENMAPSPACE_shared_info:
+        if ( idx == 0 )
+            mfn = virt_to_mfn(d->shared_info);
+        break;
+    case XENMAPSPACE_gmfn_foreign:
+    {
+        paddr_t maddr;
+        struct domain *od;
+        rc = rcu_lock_target_domain_by_id(foreign_domid, &od);
+        if ( rc < 0 )
+            return rc;
+
+        maddr = p2m_lookup(od, idx << PAGE_SHIFT);
+        if ( maddr == INVALID_PADDR )
+        {
+            dump_p2m_lookup(od, idx << PAGE_SHIFT);
+            rcu_unlock_domain(od);
+            return -EINVAL;
+        }
+
+        mfn = maddr >> PAGE_SHIFT;
+
+        rcu_unlock_domain(od);
+        break;
+    }
+
+    default:
+        return -ENOSYS;
     }
 
     domain_lock(d);
 
     /* Map at new location. */
-    rc = guest_physmap_add_page(d, xatp->gpfn, mfn, 0);
+    rc = guest_physmap_add_page(d, gpfn, mfn, 0);
 
     domain_unlock(d);
 
     return rc;
 }
 
-static int xenmem_add_to_physmap(struct domain *d,
-                                 struct xen_add_to_physmap *xatp)
+static int xenmem_add_to_physmap_range(struct domain *d,
+                                       struct xen_add_to_physmap_range *xatpr)
 {
-    return xenmem_add_to_physmap_once(d, xatp);
+    int rc;
+
+    /* Process entries in reverse order to allow continuations */
+    while ( xatpr->size > 0 )
+    {
+        xen_ulong_t idx;
+        xen_pfn_t gpfn;
+
+        rc = copy_from_guest_offset(&idx, xatpr->idxs, xatpr->size-1, 1);
+        if ( rc < 0 )
+            goto out;
+
+        rc = copy_from_guest_offset(&gpfn, xatpr->gpfns, xatpr->size-1, 1);
+        if ( rc < 0 )
+            goto out;
+
+        rc = xenmem_add_to_physmap_one(d, xatpr->space,
+                                       xatpr->foreign_domid,
+                                       idx, gpfn);
+
+        xatpr->size--;
+
+        /* Check for continuation if it's not the last interation */
+        if ( xatpr->size > 0 && hypercall_preempt_check() )
+        {
+            rc = -EAGAIN;
+            goto out;
+        }
+    }
+
+    rc = 0;
+
+out:
+    return rc;
+
 }
 
 long arch_memory_op(int op, XEN_GUEST_HANDLE(void) arg)
@@ -508,14 +569,45 @@ long arch_memory_op(int op, XEN_GUEST_HANDLE(void) arg)
         if ( copy_from_guest(&xatp, arg, 1) )
             return -EFAULT;
 
+        /* This one is only supported by add_to_physmap_range */
+        if ( xatp.space == XENMAPSPACE_gmfn_foreign )
+            return -EINVAL;
+
         rc = rcu_lock_target_domain_by_id(xatp.domid, &d);
         if ( rc != 0 )
             return rc;
 
-        rc = xenmem_add_to_physmap(d, &xatp);
+        rc = xenmem_add_to_physmap_one(d, xatp.space, DOMID_INVALID,
+                                       xatp.idx, xatp.gpfn);
+
+        rcu_unlock_domain(d);
+
+        return rc;
+    }
+
+    case XENMEM_add_to_physmap_range:
+    {
+        struct xen_add_to_physmap_range xatpr;
+        struct domain *d;
+
+        if ( copy_from_guest(&xatpr, arg, 1) )
+            return -EFAULT;
+
+        rc = rcu_lock_target_domain_by_id(xatpr.domid, &d);
+        if ( rc != 0 )
+            return rc;
+
+        rc = xenmem_add_to_physmap_range(d, &xatpr);
 
         rcu_unlock_domain(d);
 
+        if ( rc && copy_to_guest(arg, &xatpr, 1) )
+            rc = -EFAULT;
+
+        if ( rc == -EAGAIN )
+            rc = hypercall_create_continuation(
+                __HYPERVISOR_memory_op, "ih", op, arg);
+
         return rc;
     }
 
diff --git a/xen/include/public/memory.h b/xen/include/public/memory.h
index 86d02c8..f1ddbc0 100644
--- a/xen/include/public/memory.h
+++ b/xen/include/public/memory.h
@@ -198,6 +198,15 @@ struct xen_machphys_mapping {
 typedef struct xen_machphys_mapping xen_machphys_mapping_t;
 DEFINE_XEN_GUEST_HANDLE(xen_machphys_mapping_t);
 
+/* Source mapping space. */
+/* ` enum phys_map_space { */
+#define XENMAPSPACE_shared_info  0 /* shared info page */
+#define XENMAPSPACE_grant_table  1 /* grant table page */
+#define XENMAPSPACE_gmfn         2 /* GMFN */
+#define XENMAPSPACE_gmfn_range   3 /* GMFN range */
+#define XENMAPSPACE_gmfn_foreign 4 /* GMFN from another dom */
+/* ` } */
+
 /*
  * Sets the GPFN at which a particular page appears in the specified guest's
  * pseudophysical address space.
@@ -211,24 +220,39 @@ struct xen_add_to_physmap {
     /* Number of pages to go through for gmfn_range */
     uint16_t    size;
 
-    /* Source mapping space. */
-#define XENMAPSPACE_shared_info 0 /* shared info page */
-#define XENMAPSPACE_grant_table 1 /* grant table page */
-#define XENMAPSPACE_gmfn        2 /* GMFN */
-#define XENMAPSPACE_gmfn_range  3 /* GMFN range */
-    unsigned int space;
+    unsigned int space; /* => enum phys_map_space */
 
 #define XENMAPIDX_grant_table_status 0x80000000
 
-    /* Index into source mapping space. */
+    /* Index into space being mapped. */
     xen_ulong_t idx;
 
-    /* GPFN where the source mapping page should appear. */
+    /* GPFN in domid where the source mapping page should appear. */
     xen_pfn_t     gpfn;
 };
 typedef struct xen_add_to_physmap xen_add_to_physmap_t;
 DEFINE_XEN_GUEST_HANDLE(xen_add_to_physmap_t);
 
+/* A batched version of add_to_physmap. */
+#define XENMEM_add_to_physmap_range 23
+struct xen_add_to_physmap_range {
+    /* Which domain to change the mapping for. */
+    domid_t domid;
+    uint16_t space; /* => enum phys_map_space */
+
+    /* Number of pages to go through */
+    uint16_t size;
+    domid_t foreign_domid; /* IFF gmfn_foreign */
+
+    /* Indexes into space being mapped. */
+    XEN_GUEST_HANDLE(xen_ulong_t) idxs;
+
+    /* GPFN in domdwhere the source mapping page should appear. */
+    XEN_GUEST_HANDLE(xen_pfn_t) gpfns;
+};
+typedef struct xen_add_to_physmap_range xen_add_to_physmap_range_t;
+DEFINE_XEN_GUEST_HANDLE(xen_add_to_physmap_range_t);
+
 /*
  * Unmaps the page appearing at a particular GPFN from the specified guest's
  * pseudophysical address space.
diff --git a/xen/include/public/xen.h b/xen/include/public/xen.h
index 361398b..e42d01f 100644
--- a/xen/include/public/xen.h
+++ b/xen/include/public/xen.h
@@ -49,6 +49,7 @@ DEFINE_XEN_GUEST_HANDLE(void);
 
 DEFINE_XEN_GUEST_HANDLE(uint64_t);
 DEFINE_XEN_GUEST_HANDLE(xen_pfn_t);
+DEFINE_XEN_GUEST_HANDLE(xen_ulong_t);
 #endif
 
 /*
-- 
1.7.9.1

[PATCH 02/21] libxc: add ARM support to xc_dom (PV domain building)

[Ian Campbell]

Includes ARM zImage support.

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
---
 tools/libxc/Makefile                 |    1 +
 tools/libxc/xc_dom.h                 |   20 ++++-
 tools/libxc/xc_dom_arm.c             |  140 ++++++++++++++++++++++++++-
 tools/libxc/xc_dom_armzimageloader.c |  174 ++++++++++++++++++++++++++++++++++
 tools/libxc/xc_dom_core.c            |   10 +-
 tools/libxc/xg_private.h             |    4 +
 6 files changed, 339 insertions(+), 10 deletions(-)
 create mode 100644 tools/libxc/xc_dom_armzimageloader.c

diff --git a/tools/libxc/Makefile b/tools/libxc/Makefile
index 441ba4d..d44abf9 100644
--- a/tools/libxc/Makefile
+++ b/tools/libxc/Makefile
@@ -58,6 +58,7 @@ GUEST_SRCS-y += libelf-dominfo.c libelf-relocate.c
 GUEST_SRCS-y                 += xc_dom_core.c xc_dom_boot.c
 GUEST_SRCS-y                 += xc_dom_elfloader.c
 GUEST_SRCS-$(CONFIG_X86)     += xc_dom_bzimageloader.c
+GUEST_SRCS-$(CONFIG_ARM)     += xc_dom_armzimageloader.c
 GUEST_SRCS-y                 += xc_dom_binloader.c
 GUEST_SRCS-y                 += xc_dom_compat_linux.c
 
diff --git a/tools/libxc/xc_dom.h b/tools/libxc/xc_dom.h
index 2aef64a..3cd6dae 100644
--- a/tools/libxc/xc_dom.h
+++ b/tools/libxc/xc_dom.h
@@ -89,10 +89,24 @@ struct xc_dom_image {
 
     /* other state info */
     uint32_t f_active[XENFEAT_NR_SUBMAPS];
+    /*
+     * p2m_host maps guest physical addresses an offset from
+     * rambase_pfn (see below) into gfns.
+     *
+     * For a pure PV guest this means that it maps GPFNs into MFNs for
+     * a hybrid guest this means that it maps GPFNs to GPFNS.
+     *
+     * Note that the input is offset by rambase.
+     */
     xen_pfn_t *p2m_host;
     void *p2m_guest;
 
-    /* physical memory */
+    /* physical memory
+     *
+     * A PV guest has a single contiguous block of physical RAM,
+     * consisting of total_pages starting at rambase_pfn.
+     */
+    xen_pfn_t rambase_pfn;
     xen_pfn_t total_pages;
     struct xc_dom_phys *phys_pages;
     int realmodearea_log;
@@ -286,7 +300,7 @@ static inline xen_pfn_t xc_dom_p2m_host(struct xc_dom_image *dom, xen_pfn_t pfn)
 {
     if (dom->shadow_enabled)
         return pfn;
-    return dom->p2m_host[pfn];
+    return dom->p2m_host[pfn - dom->rambase_pfn];
 }
 
 static inline xen_pfn_t xc_dom_p2m_guest(struct xc_dom_image *dom,
@@ -294,7 +308,7 @@ static inline xen_pfn_t xc_dom_p2m_guest(struct xc_dom_image *dom,
 {
     if (xc_dom_feature_translated(dom))
         return pfn;
-    return dom->p2m_host[pfn];
+    return dom->p2m_host[pfn - dom->rambase_pfn];
 }
 
 /* --- arch bits --------------------------------------------------- */
diff --git a/tools/libxc/xc_dom_arm.c b/tools/libxc/xc_dom_arm.c
index 122d0e8..3eef0d0 100644
--- a/tools/libxc/xc_dom_arm.c
+++ b/tools/libxc/xc_dom_arm.c
@@ -18,14 +18,143 @@
  * Copyright (c) 2011, Citrix Systems
  */
 #include <inttypes.h>
+
 #include <xen/xen.h>
+#include <xen/io/protocols.h>
+
 #include "xg_private.h"
 #include "xc_dom.h"
 
+/* ------------------------------------------------------------------------ */
+/*
+ * arm guests are hybrid and start off with paging disabled, therefore no
+ * pagetables and nothing to do here.
+ */
+static int count_pgtables_arm(struct xc_dom_image *dom)
+{
+    DOMPRINTF_CALLED(dom->xch);
+    return 0;
+}
+
+static int setup_pgtables_arm(struct xc_dom_image *dom)
+{
+    DOMPRINTF_CALLED(dom->xch);
+    return 0;
+}
+
+/* ------------------------------------------------------------------------ */
+
+static int alloc_magic_pages(struct xc_dom_image *dom)
+{
+    DOMPRINTF_CALLED(dom->xch);
+    /* XXX
+     *   dom->p2m_guest
+     *   dom->start_info_pfn
+     *   dom->xenstore_pfn
+     *   dom->console_pfn
+     */
+    return 0;
+}
+
+/* ------------------------------------------------------------------------ */
+
+static int start_info_arm(struct xc_dom_image *dom)
+{
+    DOMPRINTF_CALLED(dom->xch);
+    return 0;
+}
+
+static int shared_info_arm(struct xc_dom_image *dom, void *ptr)
+{
+    DOMPRINTF_CALLED(dom->xch);
+    return 0;
+}
+
+/* ------------------------------------------------------------------------ */
+
+static int vcpu_arm(struct xc_dom_image *dom, void *ptr)
+{
+    vcpu_guest_context_t *ctxt = ptr;
+
+    DOMPRINTF_CALLED(dom->xch);
+
+    /* clear everything */
+    memset(ctxt, 0, sizeof(*ctxt));
+
+    ctxt->user_regs.pc = dom->parms.virt_entry;
+
+    /* Linux boot protocol. See linux.Documentation/arm/Booting. */
+    ctxt->user_regs.r0 = 0; /* SBZ */
+    /* Machine ID: We use DTB therefore no machine id */
+    ctxt->user_regs.r1 = 0xffffffff;
+    /* ATAGS/DTB: We currently require that the guest kernel to be
+     * using CONFIG_ARM_APPENDED_DTB. Ensure that r2 does not look
+     * like a valid pointer to a set of ATAGS or a DTB.
+     */
+    ctxt->user_regs.r2 = 0xffffffff;
+
+    ctxt->sctlr = /* #define SCTLR_BASE */0x00c50078;
+
+    ctxt->ttbr0 = 0;
+    ctxt->ttbr1 = 0;
+    ctxt->ttbcr = 0; /* Defined Reset Value */
+
+    ctxt->user_regs.cpsr = PSR_ABT_MASK|PSR_FIQ_MASK|PSR_IRQ_MASK|PSR_MODE_SVC;
+
+    DOMPRINTF("Initial state CPSR %#"PRIx32" PC %#"PRIx32,
+           ctxt->user_regs.cpsr, ctxt->user_regs.pc);
+
+    return 0;
+}
+
+/* ------------------------------------------------------------------------ */
+
+static struct xc_dom_arch xc_dom_32 = {
+    .guest_type = "xen-3.0-armv7l",
+    .native_protocol = XEN_IO_PROTO_ABI_ARM,
+    .page_shift = PAGE_SHIFT_ARM,
+    .sizeof_pfn = 8,
+    .alloc_magic_pages = alloc_magic_pages,
+    .count_pgtables = count_pgtables_arm,
+    .setup_pgtables = setup_pgtables_arm,
+    .start_info = start_info_arm,
+    .shared_info = shared_info_arm,
+    .vcpu = vcpu_arm,
+};
+
+static void __init register_arch_hooks(void)
+{
+    xc_dom_register_arch_hooks(&xc_dom_32);
+}
+
 int arch_setup_meminit(struct xc_dom_image *dom)
 {
-    errno = ENOSYS;
-    return -1;
+    int rc;
+    xen_pfn_t pfn, allocsz, i;
+
+    dom->shadow_enabled = 1;
+
+    dom->p2m_host = xc_dom_malloc(dom, sizeof(xen_pfn_t) * dom->total_pages);
+
+    /* setup initial p2m */
+    for ( pfn = 0; pfn < dom->total_pages; pfn++ )
+        dom->p2m_host[pfn] = pfn + dom->rambase_pfn;
+
+    /* allocate guest memory */
+    for ( i = rc = allocsz = 0;
+          (i < dom->total_pages) && !rc;
+          i += allocsz )
+    {
+        allocsz = dom->total_pages - i;
+        if ( allocsz > 1024*1024 )
+            allocsz = 1024*1024;
+
+        rc = xc_domain_populate_physmap_exact(
+            dom->xch, dom->guest_domid, allocsz,
+            0, 0, &dom->p2m_host[i]);
+    }
+
+    return 0;
 }
 
 int arch_setup_bootearly(struct xc_dom_image *dom)
@@ -36,9 +165,14 @@ int arch_setup_bootearly(struct xc_dom_image *dom)
 
 int arch_setup_bootlate(struct xc_dom_image *dom)
 {
-    DOMPRINTF("%s: doing nothing", __FUNCTION__);
+    /* XXX
+     *   map shared info
+     *   map grant tables
+     *   setup shared info
+     */
     return 0;
 }
+
 /*
  * Local variables:
  * mode: C
diff --git a/tools/libxc/xc_dom_armzimageloader.c b/tools/libxc/xc_dom_armzimageloader.c
new file mode 100644
index 0000000..f316e87
--- /dev/null
+++ b/tools/libxc/xc_dom_armzimageloader.c
@@ -0,0 +1,174 @@
+/*
+ * Xen domain builder -- ARM zImage bits
+ *
+ * Parse and load ARM zImage kernel images.
+ *
+ * Copyright (C) 2012, Citrix Systems.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation;
+ * version 2.1 of the License.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <inttypes.h>
+
+#include "xg_private.h"
+#include "xc_dom.h"
+
+#include <arpa/inet.h> /* XXX ntohl is not the right function... */
+
+/*
+ * Guest virtual RAM starts here. This must be consistent with the DTB
+ * appended to the guest kernel.
+ */
+#define GUEST_RAM_BASE 0x80000000
+
+#define ZIMAGE_MAGIC_OFFSET 0x24
+#define ZIMAGE_START_OFFSET 0x28
+#define ZIMAGE_END_OFFSET   0x2c
+
+#define ZIMAGE_MAGIC 0x016f2818
+
+struct minimal_dtb_header {
+    uint32_t magic;
+    uint32_t total_size;
+    /* There are other fields but we don't use them yet. */
+};
+
+#define DTB_MAGIC 0xd00dfeed
+
+static int xc_dom_probe_zimage_kernel(struct xc_dom_image *dom)
+{
+    uint32_t *zimage;
+    uint32_t end;
+
+    if ( dom->kernel_blob == NULL )
+    {
+        xc_dom_panic(dom->xch, XC_INTERNAL_ERROR,
+                     "%s: no kernel image loaded", __FUNCTION__);
+        return -EINVAL;
+    }
+
+    if ( dom->kernel_size < 0x30 /*sizeof(struct setup_header)*/ )
+    {
+        xc_dom_printf(dom->xch, "%s: kernel image too small", __FUNCTION__);
+        return -EINVAL;
+    }
+
+    zimage = (uint32_t *)dom->kernel_blob;
+    if ( zimage[ZIMAGE_MAGIC_OFFSET/4] != ZIMAGE_MAGIC )
+    {
+        xc_dom_printf(dom->xch, "%s: kernel is not a bzImage", __FUNCTION__);
+        return -EINVAL;
+    }
+
+    end = zimage[ZIMAGE_END_OFFSET/4];
+
+    /*
+     * Check for an appended DTB.
+     */
+    if ( end + sizeof(struct minimal_dtb_header) < dom->kernel_size ) {
+        struct minimal_dtb_header *dtb_hdr;
+        dtb_hdr = (struct minimal_dtb_header *)(dom->kernel_blob + end);
+        if (ntohl/*be32_to_cpu*/(dtb_hdr->magic) == DTB_MAGIC) {
+            xc_dom_printf(dom->xch, "%s: found an appended DTB", __FUNCTION__);
+            end += ntohl/*be32_to_cpu*/(dtb_hdr->total_size);
+        }
+    }
+
+    dom->kernel_size = end;
+
+    return 0;
+}
+
+static int xc_dom_parse_zimage_kernel(struct xc_dom_image *dom)
+{
+    uint32_t *zimage;
+    uint32_t start, entry_addr;
+    uint64_t v_start, v_end;
+    uint64_t rambase = GUEST_RAM_BASE;
+
+    DOMPRINTF_CALLED(dom->xch);
+
+    zimage = (uint32_t *)dom->kernel_blob;
+
+    dom->rambase_pfn = rambase >> XC_PAGE_SHIFT;
+
+    /* Do not load kernel at the very first RAM address */
+    v_start = rambase + 0x8000;
+    v_end = v_start + dom->kernel_size;
+
+    start = zimage[ZIMAGE_START_OFFSET/4];
+
+    if (start == 0)
+        entry_addr = v_start;
+    else
+        entry_addr = start;
+
+    /* find kernel segment */
+    dom->kernel_seg.vstart = v_start;
+    dom->kernel_seg.vend   = v_end;
+
+    dom->parms.virt_entry = entry_addr;
+
+    dom->guest_type = "xen-3.0-armv7l";
+    DOMPRINTF("%s: %s: RAM starts at %"PRI_xen_pfn,
+              __FUNCTION__, dom->guest_type, dom->rambase_pfn);
+    DOMPRINTF("%s: %s: 0x%" PRIx64 " -> 0x%" PRIx64 "",
+              __FUNCTION__, dom->guest_type,
+              dom->kernel_seg.vstart, dom->kernel_seg.vend);
+    return 0;
+}
+
+static int xc_dom_load_zimage_kernel(struct xc_dom_image *dom)
+{
+    void *dst;
+
+    DOMPRINTF_CALLED(dom->xch);
+
+    dst = xc_dom_seg_to_ptr(dom, &dom->kernel_seg);
+
+    DOMPRINTF("%s: kernel sed %#"PRIx64"-%#"PRIx64,
+              __func__, dom->kernel_seg.vstart, dom->kernel_seg.vend);
+    DOMPRINTF("%s: copy %zd bytes from blob %p to dst %p",
+              __func__, dom->kernel_size, dom->kernel_blob, dst);
+
+    memcpy(dst, dom->kernel_blob, dom->kernel_size);
+
+    return 0;
+}
+
+static struct xc_dom_loader zimage_loader = {
+    .name = "Linux zImage (ARM)",
+    .probe = xc_dom_probe_zimage_kernel,
+    .parser = xc_dom_parse_zimage_kernel,
+    .loader = xc_dom_load_zimage_kernel,
+};
+
+static void __init register_loader(void)
+{
+    xc_dom_register_loader(&zimage_loader);
+}
+
+/*
+ * Local variables:
+ * mode: C
+ * c-set-style: "BSD"
+ * c-basic-offset: 4
+ * tab-width: 4
+ * indent-tabs-mode: nil
+ * End:
+ */
diff --git a/tools/libxc/xc_dom_core.c b/tools/libxc/xc_dom_core.c
index fea9de5..5244b04 100644
--- a/tools/libxc/xc_dom_core.c
+++ b/tools/libxc/xc_dom_core.c
@@ -307,15 +307,17 @@ void *xc_dom_pfn_to_ptr(struct xc_dom_image *dom, xen_pfn_t pfn,
                         xen_pfn_t count)
 {
     struct xc_dom_phys *phys;
+    xen_pfn_t offset;
     unsigned int page_shift = XC_DOM_PAGE_SHIFT(dom);
     char *mode = "unset";
 
-    if ( pfn > dom->total_pages ||    /* multiple checks to avoid overflows */
+    offset = pfn - dom->rambase_pfn;
+    if ( offset > dom->total_pages || /* multiple checks to avoid overflows */
          count > dom->total_pages ||
-         pfn > dom->total_pages - count )
+         offset > dom->total_pages - count )
     {
-        DOMPRINTF("%s: pfn out of range (0x%" PRIpfn " > 0x%" PRIpfn ")",
-                  __FUNCTION__, pfn, dom->total_pages);
+        DOMPRINTF("%s: pfn %"PRI_xen_pfn" out of range (0x%" PRIpfn " > 0x%" PRIpfn ")",
+                  __FUNCTION__, pfn, offset, dom->total_pages);
         return NULL;
     }
 
diff --git a/tools/libxc/xg_private.h b/tools/libxc/xg_private.h
index a29fa26..a271942 100644
--- a/tools/libxc/xg_private.h
+++ b/tools/libxc/xg_private.h
@@ -148,6 +148,10 @@ typedef l4_pgentry_64_t l4_pgentry_t;
 #define l4_table_offset(_a) l4_table_offset_x86_64(_a)
 #endif
 
+#define PAGE_SHIFT_ARM          12
+#define PAGE_SIZE_ARM           (1UL << PAGE_SHIFT_ARM)
+#define PAGE_MASK_ARM           (~(PAGE_SIZE_ARM-1))
+
 #define PAGE_SHIFT_X86          12
 #define PAGE_SIZE_X86           (1UL << PAGE_SHIFT_X86)
 #define PAGE_MASK_X86           (~(PAGE_SIZE_X86-1))
-- 
1.7.9.1

[PATCH 03/21] arm: implement VGCF_online

[Ian Campbell]

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Tim Deegan <tim@xen.org>
---
 tools/libxc/xc_dom_arm.c      |    2 ++
 xen/arch/arm/domain.c         |    5 ++++-
 xen/include/public/arch-arm.h |    4 ++++
 3 files changed, 10 insertions(+), 1 deletions(-)

diff --git a/tools/libxc/xc_dom_arm.c b/tools/libxc/xc_dom_arm.c
index 3eef0d0..65dafe8 100644
--- a/tools/libxc/xc_dom_arm.c
+++ b/tools/libxc/xc_dom_arm.c
@@ -101,6 +101,8 @@ static int vcpu_arm(struct xc_dom_image *dom, void *ptr)
 
     ctxt->user_regs.cpsr = PSR_ABT_MASK|PSR_FIQ_MASK|PSR_IRQ_MASK|PSR_MODE_SVC;
 
+    ctxt->flags = VGCF_online;
+
     DOMPRINTF("Initial state CPSR %#"PRIx32" PC %#"PRIx32,
            ctxt->user_regs.cpsr, ctxt->user_regs.pc);
 
diff --git a/xen/arch/arm/domain.c b/xen/arch/arm/domain.c
index 57d8746..ee58d68 100644
--- a/xen/arch/arm/domain.c
+++ b/xen/arch/arm/domain.c
@@ -503,7 +503,10 @@ int arch_set_info_guest(
     v->arch.ttbr1 = ctxt->ttbr1;
     v->arch.ttbcr = ctxt->ttbcr;
 
-    clear_bit(_VPF_down, &v->pause_flags);
+    if ( ctxt->flags & VGCF_online )
+        clear_bit(_VPF_down, &v->pause_flags);
+    else
+        set_bit(_VPF_down, &v->pause_flags);
 
     return 0;
 }
diff --git a/xen/include/public/arch-arm.h b/xen/include/public/arch-arm.h
index f18bafa..e3d4ad9 100644
--- a/xen/include/public/arch-arm.h
+++ b/xen/include/public/arch-arm.h
@@ -125,6 +125,10 @@ typedef uint64_t xen_pfn_t;
 typedef uint32_t xen_ulong_t;
 
 struct vcpu_guest_context {
+#define _VGCF_online                   0
+#define VGCF_online                    (1<<_VGCF_online)
+    uint32_t flags;                         /* VGCF_* */
+
     struct cpu_user_regs user_regs;         /* User-level CPU registers     */
 
     uint32_t sctlr;
-- 
1.7.9.1

[PATCH 04/21] xen/arm: implement page reference and gnttab functions needed by grant_table.c

[Ian Campbell]

From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

The implementation is strongly "inspired" by their x86 counterparts,
except that we assume paging_mode_external and paging_mode_translate.

TODO: read_only mappings and gnttab_mark_dirty.

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
---
 xen/arch/arm/dummy.S |    9 ----
 xen/arch/arm/mm.c    |  115 ++++++++++++++++++++++++++++++++++++++++++++++++++
 xen/arch/arm/p2m.c   |   77 +++++++++++++++++++++++----------
 3 files changed, 168 insertions(+), 33 deletions(-)

diff --git a/xen/arch/arm/dummy.S b/xen/arch/arm/dummy.S
index 5406077..aaf1ff1 100644
--- a/xen/arch/arm/dummy.S
+++ b/xen/arch/arm/dummy.S
@@ -23,18 +23,10 @@ DUMMY(arch_vcpu_reset);
 NOP(update_vcpu_system_time);
 
 /* Page Reference & Type Maintenance */
-DUMMY(get_page);
 DUMMY(get_page_type);
-DUMMY(page_get_owner_and_reference);
-DUMMY(put_page);
 DUMMY(put_page_type);
 
 /* Grant Tables */
-DUMMY(create_grant_host_mapping);
-DUMMY(gnttab_clear_flag);
-DUMMY(gnttab_mark_dirty);
-DUMMY(is_iomem_page);
-DUMMY(replace_grant_host_mapping);
 DUMMY(steal_page);
 
 /* Page Offlining */
@@ -45,7 +37,6 @@ DUMMY(domain_get_maximum_gpfn);
 DUMMY(domain_relinquish_resources);
 DUMMY(domain_set_time_offset);
 DUMMY(dom_cow);
-DUMMY(gmfn_to_mfn);
 DUMMY(send_timer_event);
 DUMMY(share_xen_page_with_privileged_guests);
 DUMMY(wallclock_time);
diff --git a/xen/arch/arm/mm.c b/xen/arch/arm/mm.c
index dde304b..8191c90 100644
--- a/xen/arch/arm/mm.c
+++ b/xen/arch/arm/mm.c
@@ -617,6 +617,121 @@ long arch_memory_op(int op, XEN_GUEST_HANDLE(void) arg)
 
     return 0;
 }
+
+struct domain *page_get_owner_and_reference(struct page_info *page)
+{
+    unsigned long x, y = page->count_info;
+
+    do {
+        x = y;
+        /*
+         * Count ==  0: Page is not allocated, so we cannot take a reference.
+         * Count == -1: Reference count would wrap, which is invalid.
+         */
+        if ( unlikely(((x + 1) & PGC_count_mask) <= 1) )
+            return NULL;
+    }
+    while ( (y = cmpxchg(&page->count_info, x, x + 1)) != x );
+
+    return page_get_owner(page);
+}
+
+void put_page(struct page_info *page)
+{
+    unsigned long nx, x, y = page->count_info;
+
+    do {
+        ASSERT((y & PGC_count_mask) != 0);
+        x  = y;
+        nx = x - 1;
+    }
+    while ( unlikely((y = cmpxchg(&page->count_info, x, nx)) != x) );
+
+    if ( unlikely((nx & PGC_count_mask) == 0) )
+    {
+        free_domheap_page(page);
+    }
+}
+
+int get_page(struct page_info *page, struct domain *domain)
+{
+    struct domain *owner = page_get_owner_and_reference(page);
+
+    if ( likely(owner == domain) )
+        return 1;
+
+    if ( owner != NULL )
+        put_page(page);
+
+    return 0;
+}
+
+void gnttab_clear_flag(unsigned long nr, uint16_t *addr)
+{
+    /*
+     * Note that this cannot be clear_bit(), as the access must be
+     * confined to the specified 2 bytes.
+     */
+    uint16_t mask = ~(1 << nr), old;
+
+    do {
+        old = *addr;
+    } while (cmpxchg(addr, old, old & mask) != old);
+}
+
+void gnttab_mark_dirty(struct domain *d, unsigned long l)
+{
+    /* XXX: mark dirty */
+    static int warning;
+    if (!warning) {
+        gdprintk(XENLOG_WARNING, "gnttab_mark_dirty not implemented yet\n");
+        warning = 1;
+    }
+}
+
+int create_grant_host_mapping(unsigned long addr, unsigned long frame,
+                              unsigned int flags, unsigned int cache_flags)
+{
+    int rc;
+
+    if ( cache_flags  || (flags & ~GNTMAP_readonly) != GNTMAP_host_map )
+        return GNTST_general_error;
+
+    /* XXX: read only mappings */
+    if ( flags & GNTMAP_readonly )
+    {
+        gdprintk(XENLOG_WARNING, "read only mappings not implemented yet\n");
+        return GNTST_general_error;
+    }
+
+    rc = guest_physmap_add_page(current->domain,
+                                 addr >> PAGE_SHIFT, frame, 0);
+    if ( rc )
+        return GNTST_general_error;
+    else
+        return GNTST_okay;
+}
+
+int replace_grant_host_mapping(unsigned long addr, unsigned long mfn,
+        unsigned long new_addr, unsigned int flags)
+{
+    unsigned long gfn = (unsigned long)(addr >> PAGE_SHIFT);
+    struct domain *d = current->domain;
+
+    if ( new_addr != 0 || (flags & GNTMAP_contains_pte) )
+        return GNTST_general_error;
+
+    guest_physmap_remove_page(d, gfn, mfn, 0);
+
+    return GNTST_okay;
+}
+
+int is_iomem_page(unsigned long mfn)
+{
+    if ( !mfn_valid(mfn) )
+        return 1;
+    return 0;
+}
 /*
  * Local variables:
  * mode: C
diff --git a/xen/arch/arm/p2m.c b/xen/arch/arm/p2m.c
index 073216b..7c23b7d 100644
--- a/xen/arch/arm/p2m.c
+++ b/xen/arch/arm/p2m.c
@@ -120,8 +120,14 @@ static int p2m_create_table(struct domain *d,
     return 0;
 }
 
+enum p2m_operation {
+    INSERT,
+    ALLOCATE,
+    REMOVE
+};
+
 static int create_p2m_entries(struct domain *d,
-                     int alloc,
+                     enum p2m_operation op,
                      paddr_t start_gpaddr,
                      paddr_t end_gpaddr,
                      paddr_t maddr,
@@ -191,25 +197,39 @@ static int create_p2m_entries(struct domain *d,
         }
 
         /* Allocate a new RAM page and attach */
-        if (alloc)
-        {
-            struct page_info *page;
-            lpae_t pte;
-
-            rc = -ENOMEM;
-            page = alloc_domheap_page(d, 0);
-            if ( page == NULL ) {
-                printk("p2m_populate_ram: failed to allocate page\n");
-                goto out;
-            }
-
-            pte = mfn_to_p2m_entry(page_to_mfn(page), mattr);
-
-            write_pte(&third[third_table_offset(addr)], pte);
-        } else {
-            lpae_t pte = mfn_to_p2m_entry(maddr >> PAGE_SHIFT, mattr);
-            write_pte(&third[third_table_offset(addr)], pte);
-            maddr += PAGE_SIZE;
+        switch (op) {
+            case ALLOCATE:
+                {
+                    struct page_info *page;
+                    lpae_t pte;
+
+                    rc = -ENOMEM;
+                    page = alloc_domheap_page(d, 0);
+                    if ( page == NULL ) {
+                        printk("p2m_populate_ram: failed to allocate page\n");
+                        goto out;
+                    }
+
+                    pte = mfn_to_p2m_entry(page_to_mfn(page), mattr);
+
+                    write_pte(&third[third_table_offset(addr)], pte);
+                }
+                break;
+            case INSERT:
+                {
+                    lpae_t pte = mfn_to_p2m_entry(maddr >> PAGE_SHIFT, mattr);
+                    write_pte(&third[third_table_offset(addr)], pte);
+                    maddr += PAGE_SIZE;
+                }
+                break;
+            case REMOVE:
+                {
+                    lpae_t pte;
+                    memset(&pte, 0x00, sizeof(pte));
+                    write_pte(&third[third_table_offset(addr)], pte);
+                    maddr += PAGE_SIZE;
+                }
+                break;
         }
     }
 
@@ -229,7 +249,7 @@ int p2m_populate_ram(struct domain *d,
                      paddr_t start,
                      paddr_t end)
 {
-    return create_p2m_entries(d, 1, start, end, 0, MATTR_MEM);
+    return create_p2m_entries(d, ALLOCATE, start, end, 0, MATTR_MEM);
 }
 
 int map_mmio_regions(struct domain *d,
@@ -237,7 +257,7 @@ int map_mmio_regions(struct domain *d,
                      paddr_t end_gaddr,
                      paddr_t maddr)
 {
-    return create_p2m_entries(d, 0, start_gaddr, end_gaddr, maddr, MATTR_DEV);
+    return create_p2m_entries(d, INSERT, start_gaddr, end_gaddr, maddr, MATTR_DEV);
 }
 
 int guest_physmap_add_page(struct domain *d,
@@ -245,7 +265,7 @@ int guest_physmap_add_page(struct domain *d,
                            unsigned long mfn,
                            unsigned int page_order)
 {
-    return create_p2m_entries(d, 0, gpfn << PAGE_SHIFT,
+    return create_p2m_entries(d, INSERT, gpfn << PAGE_SHIFT,
                               (gpfn + (1<<page_order)) << PAGE_SHIFT,
                               mfn << PAGE_SHIFT, MATTR_MEM);
 }
@@ -254,7 +274,9 @@ void guest_physmap_remove_page(struct domain *d,
                                unsigned long gpfn,
                                unsigned long mfn, unsigned int page_order)
 {
-    ASSERT(0);
+    create_p2m_entries(d, REMOVE, gpfn << PAGE_SHIFT,
+                       (gpfn + (1<<page_order)) << PAGE_SHIFT,
+                       mfn << PAGE_SHIFT, MATTR_MEM);
 }
 
 int p2m_alloc_table(struct domain *d)
@@ -318,6 +340,13 @@ int p2m_init(struct domain *d)
 
     return 0;
 }
+
+unsigned long gmfn_to_mfn(struct domain *d, unsigned long gpfn)
+{
+    paddr_t p = p2m_lookup(d, gpfn << PAGE_SHIFT);
+    return p >> PAGE_SHIFT;
+}
+
 /*
  * Local variables:
  * mode: C
-- 
1.7.9.1

[PATCH 05/21] xen/arm: implement get/put_page_type

[Ian Campbell]

From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

Add a basic get_page_type and put_page_type implementation: we don't
care about typecounts so just return success.

Also remove PGT_shared_page, that is unused.

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
---
 xen/arch/arm/dummy.S     |    4 ----
 xen/arch/arm/mm.c        |   13 +++++++++++++
 xen/include/asm-arm/mm.h |    1 -
 3 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/xen/arch/arm/dummy.S b/xen/arch/arm/dummy.S
index aaf1ff1..022338a 100644
--- a/xen/arch/arm/dummy.S
+++ b/xen/arch/arm/dummy.S
@@ -22,10 +22,6 @@ DUMMY(arch_get_info_guest);
 DUMMY(arch_vcpu_reset);
 NOP(update_vcpu_system_time);
 
-/* Page Reference & Type Maintenance */
-DUMMY(get_page_type);
-DUMMY(put_page_type);
-
 /* Grant Tables */
 DUMMY(steal_page);
 
diff --git a/xen/arch/arm/mm.c b/xen/arch/arm/mm.c
index 8191c90..478984f 100644
--- a/xen/arch/arm/mm.c
+++ b/xen/arch/arm/mm.c
@@ -666,6 +666,19 @@ int get_page(struct page_info *page, struct domain *domain)
     return 0;
 }
 
+/* Common code requires get_page_type and put_page_type.
+ * We don't care about typecounts so we just do the minimum to make it
+ * happy. */
+int get_page_type(struct page_info *page, unsigned long type)
+{
+    return 1;
+}
+
+void put_page_type(struct page_info *page)
+{
+    return;
+}
+
 void gnttab_clear_flag(unsigned long nr, uint16_t *addr)
 {
     /*
diff --git a/xen/include/asm-arm/mm.h b/xen/include/asm-arm/mm.h
index 53801b0..b37bd35 100644
--- a/xen/include/asm-arm/mm.h
+++ b/xen/include/asm-arm/mm.h
@@ -71,7 +71,6 @@ struct page_info
 
 #define PGT_none          PG_mask(0, 4)  /* no special uses of this page   */
 #define PGT_writable_page PG_mask(7, 4)  /* has writable mappings?         */
-#define PGT_shared_page   PG_mask(8, 4)  /* CoW sharable page              */
 #define PGT_type_mask     PG_mask(15, 4) /* Bits 28-31 or 60-63.           */
 
  /* Owning guest has pinned this page to its current type? */
-- 
1.7.9.1

[PATCH 06/21] xen/arm: create_p2m_entries should not call free_domheap_page

[Ian Campbell]

From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

The guest is entitled to leak a page from its p2m (by overwriting it) if
it wants to. Since the memory is effectively lost to it (can't even be
recovered by XENMEM increase reservation etc).

In these cases we shouldn't call free_domheap_page to free the existing
page from create_p2m_entries, because it resets the reference counting
but the page is still allocated to the guest (even if not in the p2m
anymore) and common grant_table code is also going to call put_page on
it.

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
---
 xen/arch/arm/p2m.c |    5 -----
 1 files changed, 0 insertions(+), 5 deletions(-)

diff --git a/xen/arch/arm/p2m.c b/xen/arch/arm/p2m.c
index 7c23b7d..7ae4515 100644
--- a/xen/arch/arm/p2m.c
+++ b/xen/arch/arm/p2m.c
@@ -189,12 +189,7 @@ static int create_p2m_entries(struct domain *d,
         /* else: third already valid */
 
         if ( third[third_table_offset(addr)].p2m.valid )
-        {
-            /* p2m entry already present */
-            free_domheap_page(
-                    mfn_to_page(third[third_table_offset(addr)].p2m.base));
             flush_tlb_all_local();
-        }
 
         /* Allocate a new RAM page and attach */
         switch (op) {
-- 
1.7.9.1

[PATCH 07/21] xen/arm: grant table

[Ian Campbell]

From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

Implement XENMAPSPACE_grant_table and grant_table_op.

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Acked-by: Tim Deegan <tim@xen.org>
[ ijc -- fixed reject in traps.c, grant table op is a 3 argument
         hypercall, rebased over "xen: arm: implement
         XENMEM_add_to_physmap_range"
]
---
 xen/arch/arm/mm.c    |   26 ++++++++++++++++++++++++++
 xen/arch/arm/traps.c |    1 +
 2 files changed, 27 insertions(+), 0 deletions(-)

diff --git a/xen/arch/arm/mm.c b/xen/arch/arm/mm.c
index 478984f..bf9b6c5 100644
--- a/xen/arch/arm/mm.c
+++ b/xen/arch/arm/mm.c
@@ -25,6 +25,7 @@
 #include <xen/mm.h>
 #include <xen/preempt.h>
 #include <xen/errno.h>
+#include <xen/grant_table.h>
 #include <xen/softirq.h>
 #include <xen/event.h>
 #include <xen/guest_access.h>
@@ -475,6 +476,31 @@ static int xenmem_add_to_physmap_one(
 
     switch ( space )
     {
+    case XENMAPSPACE_grant_table:
+        spin_lock(&d->grant_table->lock);
+
+        if ( d->grant_table->gt_version == 0 )
+            d->grant_table->gt_version = 1;
+
+        if ( d->grant_table->gt_version == 2 &&
+                (idx & XENMAPIDX_grant_table_status) )
+        {
+            idx &= ~XENMAPIDX_grant_table_status;
+            if ( idx < nr_status_frames(d->grant_table) )
+                mfn = virt_to_mfn(d->grant_table->status[idx]);
+        }
+        else
+        {
+            if ( (idx >= nr_grant_frames(d->grant_table)) &&
+                    (idx < max_nr_grant_frames) )
+                gnttab_grow_table(d, idx + 1);
+
+            if ( idx < nr_grant_frames(d->grant_table) )
+                mfn = virt_to_mfn(d->grant_table->shared_raw[idx]);
+        }
+
+        spin_unlock(&d->grant_table->lock);
+        break;
     case XENMAPSPACE_shared_info:
         if ( idx == 0 )
             mfn = virt_to_mfn(d->shared_info);
diff --git a/xen/arch/arm/traps.c b/xen/arch/arm/traps.c
index e4bed69..8c818c2 100644
--- a/xen/arch/arm/traps.c
+++ b/xen/arch/arm/traps.c
@@ -438,6 +438,7 @@ static arm_hypercall_t arm_hypercall_table[] = {
     HYPERCALL(physdev_op, 2),
     HYPERCALL(sysctl, 2),
     HYPERCALL(hvm_op, 2),
+    HYPERCALL(grant_table_op, 3),
 };
 
 static void do_debug_trap(struct cpu_user_regs *regs, unsigned int code)
-- 
1.7.9.1

[PATCH 08/21] arm: kill a guest which uses hvc with an immediate operand != XEN_HYPERCALL_TAG

[Ian Campbell]

At best these guests are confused/broken and at worse they are malicious. In
any case we don't know that they are expecting to handle a -errno style error.

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
---
 xen/arch/arm/traps.c |    7 +------
 1 files changed, 1 insertions(+), 6 deletions(-)

diff --git a/xen/arch/arm/traps.c b/xen/arch/arm/traps.c
index 8c818c2..19e2081 100644
--- a/xen/arch/arm/traps.c
+++ b/xen/arch/arm/traps.c
@@ -476,12 +476,7 @@ static void do_trap_hypercall(struct cpu_user_regs *regs, unsigned long iss)
 #endif
 
     if ( iss != XEN_HYPERCALL_TAG )
-    {
-        printk("%s %d: received an alien hypercall iss=%lx\n", __func__ ,
-                __LINE__ , iss);
-        regs->r0 = -EINVAL;
-        return;
-    }
+        domain_crash_synchronous();
 
     if ( regs->r12 >= ARRAY_SIZE(arm_hypercall_table) )
     {
-- 
1.7.9.1

[PATCH 09/21] libxc/arm: allocate xenstore and console pages

[Ian Campbell]

From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

Allocate two additional pages at the end of the guest physical memory
for xenstore and console.
Set HVM_PARAM_STORE_PFN and HVM_PARAM_CONSOLE_PFN to the corresponding
values.

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
[ ijc -- pass correct p2m array to populate physmap in
         alloc_magic_pages
]
---
 tools/libxc/xc_dom_arm.c |   33 +++++++++++++++++++++++++++------
 1 files changed, 27 insertions(+), 6 deletions(-)

diff --git a/tools/libxc/xc_dom_arm.c b/tools/libxc/xc_dom_arm.c
index 65dafe8..b743a6c 100644
--- a/tools/libxc/xc_dom_arm.c
+++ b/tools/libxc/xc_dom_arm.c
@@ -25,6 +25,10 @@
 #include "xg_private.h"
 #include "xc_dom.h"
 
+#define NR_MAGIC_PAGES 2
+#define CONSOLE_PFN_OFFSET 0
+#define XENSTORE_PFN_OFFSET 1
+
 /* ------------------------------------------------------------------------ */
 /*
  * arm guests are hybrid and start off with paging disabled, therefore no
@@ -46,13 +50,30 @@ static int setup_pgtables_arm(struct xc_dom_image *dom)
 
 static int alloc_magic_pages(struct xc_dom_image *dom)
 {
+    int rc, i;
+    xen_pfn_t store_pfn, console_pfn, p2m[NR_MAGIC_PAGES];
+
     DOMPRINTF_CALLED(dom->xch);
-    /* XXX
-     *   dom->p2m_guest
-     *   dom->start_info_pfn
-     *   dom->xenstore_pfn
-     *   dom->console_pfn
-     */
+
+    for (i = 0; i < NR_MAGIC_PAGES; i++)
+        p2m[i] = dom->rambase_pfn + dom->total_pages + i;
+
+    rc = xc_domain_populate_physmap_exact(
+            dom->xch, dom->guest_domid, NR_MAGIC_PAGES,
+            0, 0, p2m);
+    if ( rc < 0 )
+        return rc;
+
+    console_pfn = dom->rambase_pfn + dom->total_pages + CONSOLE_PFN_OFFSET;
+    store_pfn = dom->rambase_pfn + dom->total_pages + XENSTORE_PFN_OFFSET;
+
+    xc_clear_domain_page(dom->xch, dom->guest_domid, console_pfn);
+    xc_clear_domain_page(dom->xch, dom->guest_domid, store_pfn);
+    xc_set_hvm_param(dom->xch, dom->guest_domid, HVM_PARAM_CONSOLE_PFN,
+            console_pfn);
+    xc_set_hvm_param(dom->xch, dom->guest_domid, HVM_PARAM_STORE_PFN,
+            store_pfn);
+
     return 0;
 }
 
-- 
1.7.9.1

[PATCH 10/21] arm: disable distributor delivery on boot CPU only

[Ian Campbell]

The secondary processors do not call enter_hyp_mode until the boot CPU
has brought most of the system up, including enabling delivery via the
distributor. This means that bringing up secondary CPUs unexpectedly
disables the GICD again, meaning we get no further interrupts on any
CPU.

For completeness also disable the GICC (CPU interface) on all CPUs
too.

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Tim Deegan <tim@xen.org>
---
 xen/arch/arm/mode_switch.S |   23 +++++++++++++++++------
 1 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/xen/arch/arm/mode_switch.S b/xen/arch/arm/mode_switch.S
index f5549d7..83a682b 100644
--- a/xen/arch/arm/mode_switch.S
+++ b/xen/arch/arm/mode_switch.S
@@ -23,6 +23,8 @@
 
 /* Get up a CPU into Hyp mode.  Clobbers r0-r3.
  *
+ * Expects r12 == CPU number
+ *
  * This code is specific to the VE model, and not intended to be used
  * on production systems.  As such it's a bit hackier than the main
  * boot code in head.S.  In future it will be replaced by better
@@ -46,19 +48,28 @@ enter_hyp_mode:
 	mcr   CP32(r0, CNTFRQ)
 	ldr   r0, =0x40c00           /* SMP, c11, c10 in non-secure mode */
 	mcr   CP32(r0, NSACR)
-	/* Continuing ugliness: Set up the GIC so NS state owns interrupts */
 	mov   r0, #GIC_BASE_ADDRESS
 	add   r0, r0, #GIC_DR_OFFSET
+	/* Disable the GIC distributor, on the boot CPU only */
 	mov   r1, #0
-	str   r1, [r0]               /* Disable delivery in the distributor */
+	teq   r12, #0                /* Is this the boot CPU? */
+	streq r1, [r0]
+	/* Continuing ugliness: Set up the GIC so NS state owns interrupts,
+	 * The first 32 interrupts (SGIs & PPIs) must be configured on all
+	 * CPUs while the remainder are SPIs and only need to be done one, on
+	 * the boot CPU. */
 	add   r0, r0, #0x80          /* GICD_IGROUP0 */
 	mov   r2, #0xffffffff        /* All interrupts to group 1 */
-	str   r2, [r0]
-	str   r2, [r0, #4]
-	str   r2, [r0, #8]
-	/* Must drop priority mask below 0x80 before entering NS state */
+	teq   r12, #0                /* Boot CPU? */
+	str   r2, [r0]               /* Interrupts  0-31 (SGI & PPI) */
+	streq r2, [r0, #4]           /* Interrupts 32-63 (SPI) */
+	streq r2, [r0, #8]           /* Interrupts 64-95 (SPI) */
+	/* Disable the GIC CPU interface on all processors */
 	mov   r0, #GIC_BASE_ADDRESS
 	add   r0, r0, #GIC_CR_OFFSET
+	mov   r1, #0
+	str   r1, [r0]
+	/* Must drop priority mask below 0x80 before entering NS state */
 	ldr   r1, =0xff
 	str   r1, [r0, #0x4]         /* -> GICC_PMR */
 	/* Reset a few config registers */
-- 
1.7.9.1

[PATCH 11/21] xen/arm: protect LR registers and lr_mask changes with spin_lock_irq

[Ian Campbell]

From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

GICH_LR registers and lr_mask need to be kept in sync: make sure that
their modifications are protected by spin_lock_irq(&gic.lock).

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
---
 xen/arch/arm/gic.c |    6 ++++++
 1 files changed, 6 insertions(+), 0 deletions(-)

diff --git a/xen/arch/arm/gic.c b/xen/arch/arm/gic.c
index 6f5b0e1..ab93404 100644
--- a/xen/arch/arm/gic.c
+++ b/xen/arch/arm/gic.c
@@ -57,9 +57,11 @@ void gic_save_state(struct vcpu *v)
 {
     int i;
 
+    spin_lock_irq(&gic.lock);
     for ( i=0; i<nr_lrs; i++)
         v->arch.gic_lr[i] = GICH[GICH_LR + i];
     v->arch.lr_mask = gic.lr_mask;
+    spin_unlock_irq(&gic.lock);
     /* Disable until next VCPU scheduled */
     GICH[GICH_HCR] = 0;
     isb();
@@ -72,9 +74,11 @@ void gic_restore_state(struct vcpu *v)
     if ( is_idle_vcpu(v) )
         return;
 
+    spin_lock_irq(&gic.lock);
     gic.lr_mask = v->arch.lr_mask;
     for ( i=0; i<nr_lrs; i++)
         GICH[GICH_LR + i] = v->arch.gic_lr[i];
+    spin_unlock_irq(&gic.lock);
     GICH[GICH_HCR] = GICH_HCR_EN;
     isb();
 
@@ -469,9 +473,11 @@ static void gic_restore_pending_irqs(struct vcpu *v)
         i = find_first_zero_bit(&gic.lr_mask, nr_lrs);
         if ( i >= nr_lrs ) return;
 
+        spin_lock_irq(&gic.lock);
         gic_set_lr(i, p->irq, GICH_LR_PENDING, p->priority);
         list_del_init(&p->lr_queue);
         set_bit(i, &gic.lr_mask);
+        spin_unlock_irq(&gic.lock);
     }
 
 }
-- 
1.7.9.1

[PATCH 12/21] xen/arm: introduce __lshrdi3 and __aeabi_llsr

[Ian Campbell]

From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

Taken from Linux.

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
---
 xen/arch/arm/lib/Makefile  |    2 +-
 xen/arch/arm/lib/lshrdi3.S |   54 ++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 55 insertions(+), 1 deletions(-)
 create mode 100644 xen/arch/arm/lib/lshrdi3.S

diff --git a/xen/arch/arm/lib/Makefile b/xen/arch/arm/lib/Makefile
index cbbed68..4cf41f4 100644
--- a/xen/arch/arm/lib/Makefile
+++ b/xen/arch/arm/lib/Makefile
@@ -2,4 +2,4 @@ obj-y += memcpy.o memmove.o memset.o memzero.o
 obj-y += findbit.o setbit.o
 obj-y += setbit.o clearbit.o changebit.o
 obj-y += testsetbit.o testclearbit.o testchangebit.o
-obj-y += lib1funcs.o div64.o
+obj-y += lib1funcs.o lshrdi3.o div64.o
diff --git a/xen/arch/arm/lib/lshrdi3.S b/xen/arch/arm/lib/lshrdi3.S
new file mode 100644
index 0000000..3e8887e
--- /dev/null
+++ b/xen/arch/arm/lib/lshrdi3.S
@@ -0,0 +1,54 @@
+/* Copyright 1995, 1996, 1998, 1999, 2000, 2003, 2004, 2005
+   Free Software Foundation, Inc.
+
+This file is free software; you can redistribute it and/or modify it
+under the terms of the GNU General Public License as published by the
+Free Software Foundation; either version 2, or (at your option) any
+later version.
+
+In addition to the permissions in the GNU General Public License, the
+Free Software Foundation gives you unlimited permission to link the
+compiled version of this file into combinations with other programs,
+and to distribute those combinations without any restriction coming
+from the use of this file.  (The General Public License restrictions
+do apply in other respects; for example, they cover modification of
+the file, and distribution when not linked into a combine
+executable.)
+
+This file is distributed in the hope that it will be useful, but
+WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program; see the file COPYING.  If not, write to
+the Free Software Foundation, 51 Franklin Street, Fifth Floor,
+Boston, MA 02110-1301, USA.  */
+
+
+#include <xen/config.h>
+#include "assembler.h"
+
+#ifdef __ARMEB__
+#define al r1
+#define ah r0
+#else
+#define al r0
+#define ah r1
+#endif
+
+ENTRY(__lshrdi3)
+ENTRY(__aeabi_llsr)
+
+	subs	r3, r2, #32
+	rsb	ip, r2, #32
+	movmi	al, al, lsr r2
+	movpl	al, ah, lsr r3
+ ARM(	orrmi	al, al, ah, lsl ip	)
+ THUMB(	lslmi	r3, ah, ip		)
+ THUMB(	orrmi	al, al, r3		)
+	mov	ah, ah, lsr r2
+	mov	pc, lr
+
+ENDPROC(__lshrdi3)
+ENDPROC(__aeabi_llsr)
-- 
1.7.9.1

[PATCH 13/21] arm: don't bother setting up vtimer, vgic etc on idle CPUs

[Ian Campbell]

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Tim Deegan <tim@xen.org>
---
 xen/arch/arm/domain.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/xen/arch/arm/domain.c b/xen/arch/arm/domain.c
index ee58d68..f47db4f 100644
--- a/xen/arch/arm/domain.c
+++ b/xen/arch/arm/domain.c
@@ -386,6 +386,10 @@ int vcpu_initialise(struct vcpu *v)
     v->arch.saved_context.sp = (uint32_t)v->arch.cpu_info;
     v->arch.saved_context.pc = (uint32_t)continue_new_vcpu;
 
+    /* Idle VCPUs don't need the rest of this setup */
+    if ( is_idle_vcpu(v) )
+        return rc;
+
     if ( (rc = vcpu_vgic_init(v)) != 0 )
         return rc;
 
-- 
1.7.9.1

[PATCH 14/21] arm/vtimer: convert result to ticks when reading CNTPCT register

[Ian Campbell]

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Tim Deegan <tim@xen.org>
---
 xen/arch/arm/vtimer.c |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/xen/arch/arm/vtimer.c b/xen/arch/arm/vtimer.c
index 6b1152e..490b021 100644
--- a/xen/arch/arm/vtimer.c
+++ b/xen/arch/arm/vtimer.c
@@ -103,6 +103,7 @@ static int vtimer_emulate_64(struct cpu_user_regs *regs, union hsr hsr)
     struct hsr_cp64 cp64 = hsr.cp64;
     uint32_t *r1 = &regs->r0 + cp64.reg1;
     uint32_t *r2 = &regs->r0 + cp64.reg2;
+    uint64_t ticks;
     s_time_t now;
 
     switch ( hsr.bits & HSR_CP64_REGS_MASK )
@@ -111,8 +112,9 @@ static int vtimer_emulate_64(struct cpu_user_regs *regs, union hsr hsr)
         if ( cp64.read )
         {
             now = NOW() - v->arch.vtimer.offset;
-            *r1 = (uint32_t)(now & 0xffffffff);
-            *r2 = (uint32_t)(now >> 32);
+            ticks = ns_to_ticks(now);
+            *r1 = (uint32_t)(ticks & 0xffffffff);
+            *r2 = (uint32_t)(ticks >> 32);
             return 1;
         }
         else
-- 
1.7.9.1

[PATCH 15/21] arm: Use per-CPU irq_desc for PPIs and SGIs

[Ian Campbell]

The first 32 interrupts on a GIC are the Peripheral Private Interrupts
and Software-Generated Interrupts and are local to each processor.

The irq_desc cannot be shared since we use irq_desc->status to track
whether the IRQ is in-progress etc. Therefore give each processor its
own local irq_desc for each of these interupts.

We must also route them on each CPU, so do so.

This feels like a bit of a layering violation (since the core ARM
irq.c now knows about thinkgs wich are really gic.c business)

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Tim Deegan <tim@xen.org>
---
 xen/arch/arm/gic.c          |   23 ++++++++++++++++++-----
 xen/arch/arm/gic.h          |    3 ++-
 xen/arch/arm/irq.c          |   23 ++++++++++++++++++++++-
 xen/arch/arm/setup.c        |    3 ++-
 xen/arch/arm/smpboot.c      |    9 ++++++++-
 xen/include/asm-arm/irq.h   |   13 +++++++++++++
 xen/include/asm-arm/setup.h |    2 --
 xen/include/xen/irq.h       |   10 ++--------
 8 files changed, 67 insertions(+), 19 deletions(-)

diff --git a/xen/arch/arm/gic.c b/xen/arch/arm/gic.c
index ab93404..5f06e08 100644
--- a/xen/arch/arm/gic.c
+++ b/xen/arch/arm/gic.c
@@ -50,9 +50,17 @@ static struct {
     uint64_t lr_mask;
 } gic;
 
-irq_desc_t irq_desc[NR_IRQS];
+static irq_desc_t irq_desc[NR_IRQS];
+static DEFINE_PER_CPU(irq_desc_t[NR_LOCAL_IRQS], local_irq_desc);
+
 unsigned nr_lrs;
 
+irq_desc_t *__irq_to_desc(int irq)
+{
+    if (irq < NR_LOCAL_IRQS) return &this_cpu(local_irq_desc)[irq];
+    return &irq_desc[irq-NR_LOCAL_IRQS];
+}
+
 void gic_save_state(struct vcpu *v)
 {
     int i;
@@ -260,8 +268,8 @@ static void __cpuinit gic_cpu_init(void)
 {
     int i;
 
-    /* The first 32 interrupts (PPI and SGI) are banked per-cpu, so 
-     * even though they are controlled with GICD registers, they must 
+    /* The first 32 interrupts (PPI and SGI) are banked per-cpu, so
+     * even though they are controlled with GICD registers, they must
      * be set up here with the other per-cpu state. */
     GICD[GICD_ICENABLER] = 0xffff0000; /* Disable all PPI */
     GICD[GICD_ISENABLER] = 0x0000ffff; /* Enable all SGI */
@@ -342,7 +350,7 @@ void gic_disable_cpu(void)
     spin_unlock_irq(&gic.lock);
 }
 
-void gic_route_irqs(void)
+void gic_route_ppis(void)
 {
     /* XXX should get these from DT */
     /* GIC maintenance */
@@ -351,6 +359,11 @@ void gic_route_irqs(void)
     gic_route_irq(26, 1, 1u << smp_processor_id(), 0xa0);
     /* Timer */
     gic_route_irq(30, 1, 1u << smp_processor_id(), 0xa0);
+}
+
+void gic_route_spis(void)
+{
+    /* XXX should get these from DT */
     /* UART */
     gic_route_irq(37, 0, 1u << smp_processor_id(), 0xa0);
 }
@@ -408,7 +421,7 @@ int __init setup_irq(unsigned int irq, struct irqaction *new)
 
     rc = __setup_irq(desc, irq, new);
 
-    spin_unlock_irqrestore(&desc->lock,flags);
+    spin_unlock_irqrestore(&desc->lock, flags);
 
     return rc;
 }
diff --git a/xen/arch/arm/gic.h b/xen/arch/arm/gic.h
index fa2cf06..b8f9f201 100644
--- a/xen/arch/arm/gic.h
+++ b/xen/arch/arm/gic.h
@@ -132,7 +132,8 @@ extern int vcpu_vgic_init(struct vcpu *v);
 extern void vgic_vcpu_inject_irq(struct vcpu *v, unsigned int irq,int virtual);
 extern struct pending_irq *irq_to_pending(struct vcpu *v, unsigned int irq);
 
-extern void gic_route_irqs(void);
+extern void gic_route_ppis(void);
+extern void gic_route_spis(void);
 
 extern void gic_inject(void);
 
diff --git a/xen/arch/arm/irq.c b/xen/arch/arm/irq.c
index f9d663b..72e83e6 100644
--- a/xen/arch/arm/irq.c
+++ b/xen/arch/arm/irq.c
@@ -58,20 +58,41 @@ static int __init init_irq_data(void)
 {
     int irq;
 
-    for (irq = 0; irq < NR_IRQS; irq++) {
+    for (irq = NR_LOCAL_IRQS; irq < NR_IRQS; irq++) {
         struct irq_desc *desc = irq_to_desc(irq);
         init_one_irq_desc(desc);
         desc->irq = irq;
         desc->action  = NULL;
     }
+
+    return 0;
+}
+
+static int __cpuinit init_local_irq_data(void)
+{
+    int irq;
+
+    for (irq = 0; irq < NR_LOCAL_IRQS; irq++) {
+        struct irq_desc *desc = irq_to_desc(irq);
+        init_one_irq_desc(desc);
+        desc->irq = irq;
+        desc->action  = NULL;
+    }
+
     return 0;
 }
 
 void __init init_IRQ(void)
 {
+    BUG_ON(init_local_irq_data() < 0);
     BUG_ON(init_irq_data() < 0);
 }
 
+void __cpuinit init_secondary_IRQ(void)
+{
+    BUG_ON(init_local_irq_data() < 0);
+}
+
 int __init request_irq(unsigned int irq,
         void (*handler)(int, void *, struct cpu_user_regs *),
         unsigned long irqflags, const char * devname, void *dev_id)
diff --git a/xen/arch/arm/setup.c b/xen/arch/arm/setup.c
index dc0e215..db8fe6a 100644
--- a/xen/arch/arm/setup.c
+++ b/xen/arch/arm/setup.c
@@ -200,7 +200,8 @@ void __init start_xen(unsigned long boot_phys_offset,
 
     init_IRQ();
 
-    gic_route_irqs();
+    gic_route_ppis();
+    gic_route_spis();
 
     init_maintenance_interrupt();
     init_timer_interrupt();
diff --git a/xen/arch/arm/smpboot.c b/xen/arch/arm/smpboot.c
index 6463a8d..c0750c0 100644
--- a/xen/arch/arm/smpboot.c
+++ b/xen/arch/arm/smpboot.c
@@ -26,6 +26,8 @@
 #include <xen/sched.h>
 #include <xen/smp.h>
 #include <xen/softirq.h>
+#include <xen/timer.h>
+#include <xen/irq.h>
 #include <asm/vfp.h>
 #include "gic.h"
 
@@ -129,8 +131,13 @@ void __cpuinit start_secondary(unsigned long boot_phys_offset,
     enable_vfp();
 
     gic_init_secondary_cpu();
+
+    init_secondary_IRQ();
+
+    gic_route_ppis();
+
+    init_maintenance_interrupt();
     init_timer_interrupt();
-    gic_route_irqs();
 
     set_current(idle_vcpu[cpuid]);
 
diff --git a/xen/include/asm-arm/irq.h b/xen/include/asm-arm/irq.h
index 21e0b85..abde839 100644
--- a/xen/include/asm-arm/irq.h
+++ b/xen/include/asm-arm/irq.h
@@ -17,10 +17,23 @@ struct irq_cfg {
 #define arch_irq_desc irq_cfg
 };
 
+#define NR_LOCAL_IRQS	32
+#define NR_IRQS		1024
+#define nr_irqs NR_IRQS
+
+struct irq_desc;
+
+struct irq_desc *__irq_to_desc(int irq);
+
+#define irq_to_desc(irq)    __irq_to_desc(irq)
+
 void do_IRQ(struct cpu_user_regs *regs, unsigned int irq, int is_fiq);
 
 #define domain_pirq_to_irq(d, pirq) (pirq)
 
+void init_IRQ(void);
+void init_secondary_IRQ(void);
+
 #endif /* _ASM_HW_IRQ_H */
 /*
  * Local variables:
diff --git a/xen/include/asm-arm/setup.h b/xen/include/asm-arm/setup.h
index 6433b4e..8769f66 100644
--- a/xen/include/asm-arm/setup.h
+++ b/xen/include/asm-arm/setup.h
@@ -9,8 +9,6 @@ void arch_get_xen_caps(xen_capabilities_info_t *info);
 
 int construct_dom0(struct domain *d);
 
-void init_IRQ(void);
-
 #endif
 /*
  * Local variables:
diff --git a/xen/include/xen/irq.h b/xen/include/xen/irq.h
index cbe1dbc..5973cce 100644
--- a/xen/include/xen/irq.h
+++ b/xen/include/xen/irq.h
@@ -88,21 +88,15 @@ typedef struct irq_desc {
     struct list_head rl_link;
 } __cacheline_aligned irq_desc_t;
 
+#ifndef irq_to_desc
 #define irq_to_desc(irq)    (&irq_desc[irq])
+#endif
 
 int init_one_irq_desc(struct irq_desc *);
 int arch_init_one_irq_desc(struct irq_desc *);
 
 #define irq_desc_initialized(desc) ((desc)->handler != NULL)
 
-#if defined(__arm__)
-
-#define NR_IRQS		1024
-#define nr_irqs NR_IRQS
-extern irq_desc_t irq_desc[NR_IRQS];
-
-#endif
-
 extern int setup_irq(unsigned int irq, struct irqaction *);
 extern void release_irq(unsigned int irq);
 extern int request_irq(unsigned int irq,
-- 
1.7.9.1

[PATCH 16/21] arm: tools: add arm to foreign structs checking

[Ian Campbell]

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
---
 tools/include/xen-foreign/Makefile       |    5 ++++-
 tools/include/xen-foreign/mkheader.py    |    7 +++++++
 tools/include/xen-foreign/reference.size |   27 +++++++++++++++------------
 tools/include/xen-foreign/structs.py     |    7 ++++++-
 4 files changed, 32 insertions(+), 14 deletions(-)

diff --git a/tools/include/xen-foreign/Makefile b/tools/include/xen-foreign/Makefile
index 8b22b10..cfaf790 100644
--- a/tools/include/xen-foreign/Makefile
+++ b/tools/include/xen-foreign/Makefile
@@ -3,7 +3,7 @@ include $(XEN_ROOT)/tools/Rules.mk
 
 ROOT = $(XEN_ROOT)/xen/include/public
 
-architectures := x86_32 x86_64
+architectures := arm x86_32 x86_64
 headers := $(patsubst %, %.h, $(architectures))
 
 .PHONY: all clean check-headers
@@ -22,6 +22,9 @@ check-headers: checker
 	diff -u reference.size tmp.size
 	rm tmp.size
 
+arm.h: mkheader.py structs.py $(ROOT)/arch-arm.h
+	$(PYTHON) $< $* $@ $(filter %.h,$^)
+
 x86_32.h: mkheader.py structs.py $(ROOT)/arch-x86/xen-x86_32.h $(ROOT)/arch-x86/xen.h $(ROOT)/xen.h
 	$(PYTHON) $< $* $@ $(filter %.h,$^)
 
diff --git a/tools/include/xen-foreign/mkheader.py b/tools/include/xen-foreign/mkheader.py
index 797a880..d189b07 100644
--- a/tools/include/xen-foreign/mkheader.py
+++ b/tools/include/xen-foreign/mkheader.py
@@ -16,6 +16,13 @@ inttypes = {};
 header = {};
 footer = {};
 
+#arm
+inttypes["arm"] = {
+    "unsigned long" : "uint32_t",
+    "long"          : "uint32_t",
+    "xen_pfn_t"     : "uint64_t",
+};
+
 # x86_32
 inttypes["x86_32"] = {
     "unsigned long" : "uint32_t",
diff --git a/tools/include/xen-foreign/reference.size b/tools/include/xen-foreign/reference.size
index fac1b1d..3c67ad8 100644
--- a/tools/include/xen-foreign/reference.size
+++ b/tools/include/xen-foreign/reference.size
@@ -1,13 +1,16 @@
+structs                   |     arm  x86_32  x86_64
 
-structs                   |  x86_32  x86_64
-
-start_info                |    1112    1168
-trap_info                 |       8      16
-cpu_user_regs             |      68     200
-vcpu_guest_context        |    2800    5168
-arch_vcpu_info            |      24      16
-vcpu_time_info            |      32      32
-vcpu_info                 |      64      64
-arch_shared_info          |     268     280
-shared_info               |    2584    3368
-
+start_info                |       -    1112    1168
+trap_info                 |       -       8      16
+pt_fpreg                  |       -       -       -
+cpu_user_regs             |     160      68     200
+xen_ia64_boot_param       |       -       -       -
+ia64_tr_entry             |       -       -       -
+vcpu_tr_regs              |       -       -       -
+vcpu_guest_context_regs   |       -       -       -
+vcpu_guest_context        |     180    2800    5168
+arch_vcpu_info            |       -      24      16
+vcpu_time_info            |       -      32      32
+vcpu_info                 |       -      64      64
+arch_shared_info          |       -     268     280
+shared_info               |       -    2584    3368
diff --git a/tools/include/xen-foreign/structs.py b/tools/include/xen-foreign/structs.py
index 571f7bb..988bef2 100644
--- a/tools/include/xen-foreign/structs.py
+++ b/tools/include/xen-foreign/structs.py
@@ -13,9 +13,14 @@ structs = [ "start_info",
             "arch_shared_info",
             "shared_info" ];
 
-defines = [ "__i386__",
+defines = [ "__arm__",
+            "__i386__",
             "__x86_64__",
 
+            # arm
+            # None
+            
+            # x86_{32,64}
             "FLAT_RING1_CS",
             "FLAT_RING1_DS",
             "FLAT_RING1_SS",
-- 
1.7.9.1

[PATCH 17/21] xen: xen_ulong_t substitution

[Ian Campbell]

From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

There is still an unwanted unsigned long in the xen public interface:
replace it with xen_ulong_t.

Also typedef xen_ulong_t to uint64_t on ARM.

Changes in v2:

- do not replace the unsigned long in x86 specific calls;
- do not replace the unsigned long in multicall_entry;
- add missing include "xen.h" in version.h;
- use proper printf flag for xen_ulong_t.

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Cc: keir@xen.org
Cc: JBeulich@suse.com
---
 tools/python/xen/lowlevel/xc/xc.c |    2 +-
 xen/include/public/arch-arm.h     |    3 ++-
 xen/include/public/version.h      |    4 +++-
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/tools/python/xen/lowlevel/xc/xc.c b/tools/python/xen/lowlevel/xc/xc.c
index 7c89756..e220f68 100644
--- a/tools/python/xen/lowlevel/xc/xc.c
+++ b/tools/python/xen/lowlevel/xc/xc.c
@@ -1439,7 +1439,7 @@ static PyObject *pyxc_xeninfo(XcObject *self)
     if ( xc_version(self->xc_handle, XENVER_commandline, &xen_commandline) != 0 )
         return pyxc_error_to_exception(self->xc_handle);
 
-    snprintf(str, sizeof(str), "virt_start=0x%lx", p_parms.virt_start);
+    snprintf(str, sizeof(str), "virt_start=0x%"PRI_xen_ulong, p_parms.virt_start);
 
     xen_pagesize = xc_version(self->xc_handle, XENVER_pagesize, NULL);
     if (xen_pagesize < 0 )
diff --git a/xen/include/public/arch-arm.h b/xen/include/public/arch-arm.h
index e3d4ad9..2ae6548 100644
--- a/xen/include/public/arch-arm.h
+++ b/xen/include/public/arch-arm.h
@@ -122,7 +122,8 @@ typedef uint64_t xen_pfn_t;
 /* Only one. All other VCPUS must use VCPUOP_register_vcpu_info */
 #define XEN_LEGACY_MAX_VCPUS 1
 
-typedef uint32_t xen_ulong_t;
+typedef uint64_t xen_ulong_t;
+#define PRI_xen_ulong PRIx64
 
 struct vcpu_guest_context {
 #define _VGCF_online                   0
diff --git a/xen/include/public/version.h b/xen/include/public/version.h
index 8742c2b..c7e6f8c 100644
--- a/xen/include/public/version.h
+++ b/xen/include/public/version.h
@@ -28,6 +28,8 @@
 #ifndef __XEN_PUBLIC_VERSION_H__
 #define __XEN_PUBLIC_VERSION_H__
 
+#include "xen.h"
+
 /* NB. All ops return zero on success, except XENVER_{version,pagesize} */
 
 /* arg == NULL; returns major:minor (16:16). */
@@ -58,7 +60,7 @@ typedef char xen_changeset_info_t[64];
 
 #define XENVER_platform_parameters 5
 struct xen_platform_parameters {
-    unsigned long virt_start;
+    xen_ulong_t virt_start;
 };
 typedef struct xen_platform_parameters xen_platform_parameters_t;
 
-- 
1.7.9.1

[PATCH 18/21] xen: change the limit of nr_extents to UINT_MAX >> MEMOP_EXTENT_SHIFT

[Ian Campbell]

From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

Currently do_memory_op has a different maximum limit for nr_extents on
32 bit and 64 bit.
Change the limit to UINT_MAX >> MEMOP_EXTENT_SHIFT, so that it is the
same in both cases.

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Cc: keir@xen.org
Cc: JBeulich@suse.com
---
 xen/common/memory.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/xen/common/memory.c b/xen/common/memory.c
index 5bcb035..401d06c 100644
--- a/xen/common/memory.c
+++ b/xen/common/memory.c
@@ -540,7 +540,7 @@ long do_memory_op(unsigned long cmd, XEN_GUEST_HANDLE(void) arg)
             return start_extent;
 
         /* Is size too large for us to encode a continuation? */
-        if ( reservation.nr_extents > (ULONG_MAX >> MEMOP_EXTENT_SHIFT) )
+        if ( reservation.nr_extents > (UINT_MAX >> MEMOP_EXTENT_SHIFT) )
             return start_extent;
 
         if ( unlikely(start_extent >= reservation.nr_extents) )
-- 
1.7.9.1

[PATCH 19/21] xen: introduce XEN_GUEST_HANDLE_PARAM

[Ian Campbell]

From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

XEN_GUEST_HANDLE_PARAM is going to be used to distinguish guest pointers
stored in memory from guest pointers as hypercall parameters.

guest_handle_* macros default to XEN_GUEST_HANDLE_PARAM as return type.
Two new guest_handle_to_param and guest_handle_from_param macros are
introduced to do conversions.

Changes in v2:

- add 2 missing #define _XEN_GUEST_HANDLE_PARAM for the compilation of
the compat code.

Changes in v3:

- move the guest_handle_cast change into this patch;
- add a clear comment on top of guest_handle_cast;
- also s/XEN_GUEST_HANDLE/XEN_GUEST_HANDLE_PARAM in
  guest_handle_from_ptr and const_guest_handle_from_ptr;
- introduce guest_handle_from_param and guest_handle_to_param.

Changes in v4:

- make both XEN_GUEST_HANDLE and XEN_GUEST_HANDLE_PARAM unions on ARM;
- simplify set_xen_guest_handle_raw on ARM;
- add type checking in guest_handle_to_param and guest_handle_from_param
trivial.

Changes in v5 (ijc):

- Fix arm's set_xen_guest_handle_raw which mixed up t and _t. Use a
  more unique variable name for the benefit of -Wshadow.

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Cc: keir@xen.org
Cc: JBeulich@suse.com

---
This patch seems to cause issues with bisection, see
<1349428386.20946.15.camel@zakaz.uk.xensource.com>
  -- ijc
---
 xen/include/asm-arm/guest_access.h |   32 ++++++++++++++++++++++++++++----
 xen/include/asm-x86/guest_access.h |   29 +++++++++++++++++++++++++----
 xen/include/public/arch-arm.h      |   26 ++++++++++++++++++++++----
 xen/include/public/arch-x86/xen.h  |    9 +++++++++
 xen/include/xen/xencomm.h          |   22 +++++++++++++++++++++-
 5 files changed, 105 insertions(+), 13 deletions(-)

diff --git a/xen/include/asm-arm/guest_access.h b/xen/include/asm-arm/guest_access.h
index 0fceae6..5686217 100644
--- a/xen/include/asm-arm/guest_access.h
+++ b/xen/include/asm-arm/guest_access.h
@@ -27,16 +27,40 @@ unsigned long raw_clear_guest(void *to, unsigned len);
 #define guest_handle_add_offset(hnd, nr) ((hnd).p += (nr))
 #define guest_handle_subtract_offset(hnd, nr) ((hnd).p -= (nr))
 
-/* Cast a guest handle to the specified type of handle. */
+/* Cast a guest handle (either XEN_GUEST_HANDLE or XEN_GUEST_HANDLE_PARAM)
+ * to the specified type of XEN_GUEST_HANDLE_PARAM. */
 #define guest_handle_cast(hnd, type) ({         \
     type *_x = (hnd).p;                         \
-    (XEN_GUEST_HANDLE(type)) { _x };            \
+    (XEN_GUEST_HANDLE_PARAM(type)) { _x };            \
+})
+
+/* Cast a XEN_GUEST_HANDLE to XEN_GUEST_HANDLE_PARAM */
+#define guest_handle_to_param(hnd, type) ({                  \
+    typeof((hnd).p) _x = (hnd).p;                            \
+    XEN_GUEST_HANDLE_PARAM(type) _y = { _x };                \
+    /* type checking: make sure that the pointers inside     \
+     * XEN_GUEST_HANDLE and XEN_GUEST_HANDLE_PARAM are of    \
+     * the same type, then return hnd */                     \
+    (void)(&_x == &_y.p);                                    \
+    _y;                                                      \
+})
+
+
+/* Cast a XEN_GUEST_HANDLE_PARAM to XEN_GUEST_HANDLE */
+#define guest_handle_from_param(hnd, type) ({               \
+    typeof((hnd).p) _x = (hnd).p;                           \
+    XEN_GUEST_HANDLE(type) _y = { _x };                     \
+    /* type checking: make sure that the pointers inside    \
+     * XEN_GUEST_HANDLE and XEN_GUEST_HANDLE_PARAM are of   \
+     * the same type, then return hnd */                    \
+    (void)(&_x == &_y.p);                                   \
+    _y;                                                     \
 })
 
 #define guest_handle_from_ptr(ptr, type)        \
-    ((XEN_GUEST_HANDLE(type)) { (type *)ptr })
+    ((XEN_GUEST_HANDLE_PARAM(type)) { (type *)ptr })
 #define const_guest_handle_from_ptr(ptr, type)  \
-    ((XEN_GUEST_HANDLE(const_##type)) { (const type *)ptr })
+    ((XEN_GUEST_HANDLE_PARAM(const_##type)) { (const type *)ptr })
 
 /*
  * Copy an array of objects to guest context via a guest handle,
diff --git a/xen/include/asm-x86/guest_access.h b/xen/include/asm-x86/guest_access.h
index e3ac1d6..ca700c9 100644
--- a/xen/include/asm-x86/guest_access.h
+++ b/xen/include/asm-x86/guest_access.h
@@ -45,19 +45,40 @@
 #define guest_handle_add_offset(hnd, nr) ((hnd).p += (nr))
 #define guest_handle_subtract_offset(hnd, nr) ((hnd).p -= (nr))
 
-/* Cast a guest handle to the specified type of handle. */
+/* Cast a guest handle (either XEN_GUEST_HANDLE or XEN_GUEST_HANDLE_PARAM)
+ * to the specified type of XEN_GUEST_HANDLE_PARAM. */
 #define guest_handle_cast(hnd, type) ({         \
     type *_x = (hnd).p;                         \
-    (XEN_GUEST_HANDLE(type)) { _x };            \
+    (XEN_GUEST_HANDLE_PARAM(type)) { _x };            \
+})
+
+/* Cast a XEN_GUEST_HANDLE to XEN_GUEST_HANDLE_PARAM */
+#define guest_handle_to_param(hnd, type) ({                  \
+    /* type checking: make sure that the pointers inside     \
+     * XEN_GUEST_HANDLE and XEN_GUEST_HANDLE_PARAM are of    \
+     * the same type, then return hnd */                     \
+    (void)((typeof(&(hnd).p)) 0 ==                           \
+        (typeof(&((XEN_GUEST_HANDLE_PARAM(type)) {}).p)) 0); \
+    (hnd);                                                   \
+})
+
+/* Cast a XEN_GUEST_HANDLE_PARAM to XEN_GUEST_HANDLE */
+#define guest_handle_from_param(hnd, type) ({                \
+    /* type checking: make sure that the pointers inside     \
+     * XEN_GUEST_HANDLE and XEN_GUEST_HANDLE_PARAM are of    \
+     * the same type, then return hnd */                     \
+    (void)((typeof(&(hnd).p)) 0 ==                           \
+        (typeof(&((XEN_GUEST_HANDLE_PARAM(type)) {}).p)) 0); \
+    (hnd);                                                   \
 })
 
 #define guest_handle_for_field(hnd, type, fld)          \
     ((XEN_GUEST_HANDLE(type)) { &(hnd).p->fld })
 
 #define guest_handle_from_ptr(ptr, type)        \
-    ((XEN_GUEST_HANDLE(type)) { (type *)ptr })
+    ((XEN_GUEST_HANDLE_PARAM(type)) { (type *)ptr })
 #define const_guest_handle_from_ptr(ptr, type)  \
-    ((XEN_GUEST_HANDLE(const_##type)) { (const type *)ptr })
+    ((XEN_GUEST_HANDLE_PARAM(const_##type)) { (const type *)ptr })
 
 /*
  * Copy an array of objects to guest context via a guest handle,
diff --git a/xen/include/public/arch-arm.h b/xen/include/public/arch-arm.h
index 2ae6548..d5d8209 100644
--- a/xen/include/public/arch-arm.h
+++ b/xen/include/public/arch-arm.h
@@ -51,18 +51,36 @@
 
 #define XEN_HYPERCALL_TAG   0XEA1
 
+#define uint64_aligned_t uint64_t __attribute__((aligned(8)))
 
 #ifndef __ASSEMBLY__
-#define ___DEFINE_XEN_GUEST_HANDLE(name, type) \
-    typedef struct { type *p; } __guest_handle_ ## name
+#define ___DEFINE_XEN_GUEST_HANDLE(name, type)                  \
+    typedef union { type *p; unsigned long q; }                 \
+        __guest_handle_ ## name;                                \
+    typedef union { type *p; uint64_aligned_t q; }              \
+        __guest_handle_64_ ## name;
 
+/*
+ * XEN_GUEST_HANDLE represents a guest pointer, when passed as a field
+ * in a struct in memory. On ARM is always 8 bytes sizes and 8 bytes
+ * aligned.
+ * XEN_GUEST_HANDLE_PARAM represent a guest pointer, when passed as an
+ * hypercall argument. It is 4 bytes on aarch and 8 bytes on aarch64.
+ */
 #define __DEFINE_XEN_GUEST_HANDLE(name, type) \
     ___DEFINE_XEN_GUEST_HANDLE(name, type);   \
     ___DEFINE_XEN_GUEST_HANDLE(const_##name, const type)
 #define DEFINE_XEN_GUEST_HANDLE(name)   __DEFINE_XEN_GUEST_HANDLE(name, name)
-#define __XEN_GUEST_HANDLE(name)        __guest_handle_ ## name
+#define __XEN_GUEST_HANDLE(name)        __guest_handle_64_ ## name
 #define XEN_GUEST_HANDLE(name)          __XEN_GUEST_HANDLE(name)
-#define set_xen_guest_handle_raw(hnd, val)  do { (hnd).p = val; } while (0)
+/* this is going to be changes on 64 bit */
+#define XEN_GUEST_HANDLE_PARAM(name)    __guest_handle_ ## name
+#define set_xen_guest_handle_raw(hnd, val)                  \
+    do {                                                    \
+        typeof(&(hnd)) _sxghr_tmp = &(hnd);                 \
+        _sxghr_tmp->q = 0;                                  \
+        _sxghr_tmp->p = val;                                \
+    } while ( 0 )
 #ifdef __XEN_TOOLS__
 #define get_xen_guest_handle(val, hnd)  do { val = (hnd).p; } while (0)
 #endif
diff --git a/xen/include/public/arch-x86/xen.h b/xen/include/public/arch-x86/xen.h
index 1c186d7..0e10260 100644
--- a/xen/include/public/arch-x86/xen.h
+++ b/xen/include/public/arch-x86/xen.h
@@ -38,12 +38,21 @@
     typedef type * __guest_handle_ ## name
 #endif
 
+/*
+ * XEN_GUEST_HANDLE represents a guest pointer, when passed as a field
+ * in a struct in memory.
+ * XEN_GUEST_HANDLE_PARAM represent a guest pointer, when passed as an
+ * hypercall argument.
+ * XEN_GUEST_HANDLE_PARAM and XEN_GUEST_HANDLE are the same on X86 but
+ * they might not be on other architectures.
+ */
 #define __DEFINE_XEN_GUEST_HANDLE(name, type) \
     ___DEFINE_XEN_GUEST_HANDLE(name, type);   \
     ___DEFINE_XEN_GUEST_HANDLE(const_##name, const type)
 #define DEFINE_XEN_GUEST_HANDLE(name)   __DEFINE_XEN_GUEST_HANDLE(name, name)
 #define __XEN_GUEST_HANDLE(name)        __guest_handle_ ## name
 #define XEN_GUEST_HANDLE(name)          __XEN_GUEST_HANDLE(name)
+#define XEN_GUEST_HANDLE_PARAM(name)    XEN_GUEST_HANDLE(name)
 #define set_xen_guest_handle_raw(hnd, val)  do { (hnd).p = val; } while (0)
 #ifdef __XEN_TOOLS__
 #define get_xen_guest_handle(val, hnd)  do { val = (hnd).p; } while (0)
diff --git a/xen/include/xen/xencomm.h b/xen/include/xen/xencomm.h
index 730da7c..3426b8a 100644
--- a/xen/include/xen/xencomm.h
+++ b/xen/include/xen/xencomm.h
@@ -66,11 +66,31 @@ static inline unsigned long xencomm_inline_addr(const void *handle)
 /* Cast a guest handle to the specified type of handle. */
 #define guest_handle_cast(hnd, type) ({         \
     type *_x = (hnd).p;                         \
-    XEN_GUEST_HANDLE(type) _y;                  \
+    XEN_GUEST_HANDLE_PARAM(type) _y;            \
     set_xen_guest_handle(_y, _x);               \
     _y;                                         \
 })
 
+/* Cast a XEN_GUEST_HANDLE to XEN_GUEST_HANDLE_PARAM */
+#define guest_handle_to_param(hnd, type) ({                  \
+    /* type checking: make sure that the pointers inside     \
+     * XEN_GUEST_HANDLE and XEN_GUEST_HANDLE_PARAM are of    \
+     * the same type, then return hnd */                     \
+    (void)((typeof(&(hnd).p)) 0 ==                           \
+        (typeof(&((XEN_GUEST_HANDLE_PARAM(type)) {}).p)) 0); \
+    (hnd);                                                   \
+})
+
+/* Cast a XEN_GUEST_HANDLE_PARAM to XEN_GUEST_HANDLE */
+#define guest_handle_from_param(hnd, type) ({                \
+    /* type checking: make sure that the pointers inside     \
+     * XEN_GUEST_HANDLE and XEN_GUEST_HANDLE_PARAM are of    \
+     * the same type, then return hnd */                     \
+    (void)((typeof(&(hnd).p)) 0 ==                           \
+        (typeof(&((XEN_GUEST_HANDLE_PARAM(type)) {}).p)) 0); \
+    (hnd);                                                   \
+})
+
 /* Since we run in real mode, we can safely access all addresses. That also
  * means our __routines are identical to our "normal" routines. */
 #define guest_handle_okay(hnd, nr) 1
-- 
1.7.9.1

[PATCH 20/21] xen: replace XEN_GUEST_HANDLE with XEN_GUEST_HANDLE_PARAM when appropriate

[Ian Campbell]

From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

Note: these changes don't make any difference on x86 and ia64.

Replace XEN_GUEST_HANDLE with XEN_GUEST_HANDLE_PARAM when it is used as
an hypercall argument.

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Cc: keir@xen.org
Cc: JBeulich@suse.com
---
 xen/arch/arm/domain.c             |    2 +-
 xen/arch/arm/domctl.c             |    2 +-
 xen/arch/arm/hvm.c                |    2 +-
 xen/arch/arm/mm.c                 |    2 +-
 xen/arch/arm/physdev.c            |    2 +-
 xen/arch/arm/sysctl.c             |    2 +-
 xen/arch/x86/compat.c             |    2 +-
 xen/arch/x86/cpu/mcheck/mce.c     |    2 +-
 xen/arch/x86/domain.c             |    2 +-
 xen/arch/x86/domctl.c             |    2 +-
 xen/arch/x86/efi/runtime.c        |    2 +-
 xen/arch/x86/hvm/hvm.c            |   26 +++++++++---------
 xen/arch/x86/microcode.c          |    2 +-
 xen/arch/x86/mm.c                 |   14 +++++-----
 xen/arch/x86/mm/hap/hap.c         |    2 +-
 xen/arch/x86/mm/mem_event.c       |    2 +-
 xen/arch/x86/mm/paging.c          |    2 +-
 xen/arch/x86/mm/shadow/common.c   |    2 +-
 xen/arch/x86/oprofile/xenoprof.c  |    6 ++--
 xen/arch/x86/physdev.c            |    2 +-
 xen/arch/x86/platform_hypercall.c |    2 +-
 xen/arch/x86/sysctl.c             |    2 +-
 xen/arch/x86/traps.c              |    2 +-
 xen/arch/x86/x86_64/compat/mm.c   |   10 +++---
 xen/arch/x86/x86_64/domain.c      |    2 +-
 xen/arch/x86/x86_64/mm.c          |    2 +-
 xen/arch/x86/x86_64/traps.c       |    2 +-
 xen/common/compat/domain.c        |    2 +-
 xen/common/compat/grant_table.c   |    8 +++---
 xen/common/compat/memory.c        |    4 +-
 xen/common/domain.c               |    2 +-
 xen/common/domctl.c               |    2 +-
 xen/common/event_channel.c        |    2 +-
 xen/common/grant_table.c          |   36 +++++++++++++-------------
 xen/common/kernel.c               |    4 +-
 xen/common/kexec.c                |   17 ++++++-----
 xen/common/memory.c               |    4 +-
 xen/common/multicall.c            |    2 +-
 xen/common/schedule.c             |    2 +-
 xen/common/sysctl.c               |    2 +-
 xen/common/xenoprof.c             |    8 +++---
 xen/drivers/acpi/pmstat.c         |    2 +-
 xen/drivers/char/console.c        |    6 ++--
 xen/drivers/passthrough/iommu.c   |    2 +-
 xen/include/asm-arm/hypercall.h   |    2 +-
 xen/include/asm-arm/mm.h          |    2 +-
 xen/include/asm-x86/hap.h         |    2 +-
 xen/include/asm-x86/hypercall.h   |   22 ++++++++--------
 xen/include/asm-x86/mem_event.h   |    2 +-
 xen/include/asm-x86/mm.h          |    8 +++---
 xen/include/asm-x86/paging.h      |    2 +-
 xen/include/asm-x86/processor.h   |    2 +-
 xen/include/asm-x86/shadow.h      |    2 +-
 xen/include/asm-x86/xenoprof.h    |    6 ++--
 xen/include/public/tmem.h         |    2 +-
 xen/include/xen/acpi.h            |    4 +-
 xen/include/xen/hypercall.h       |   52 ++++++++++++++++++------------------
 xen/include/xen/iommu.h           |    2 +-
 xen/include/xen/tmem_xen.h        |    2 +-
 xen/include/xsm/xsm.h             |    4 +-
 xen/xsm/dummy.c                   |    2 +-
 xen/xsm/flask/flask_op.c          |    4 +-
 xen/xsm/flask/hooks.c             |    2 +-
 xen/xsm/xsm_core.c                |    2 +-
 64 files changed, 167 insertions(+), 166 deletions(-)

diff --git a/xen/arch/arm/domain.c b/xen/arch/arm/domain.c
index f47db4f..c5292c7 100644
--- a/xen/arch/arm/domain.c
+++ b/xen/arch/arm/domain.c
@@ -519,7 +519,7 @@ void arch_dump_domain_info(struct domain *d)
 {
 }
 
-long arch_do_vcpu_op(int cmd, struct vcpu *v, XEN_GUEST_HANDLE(void) arg)
+long arch_do_vcpu_op(int cmd, struct vcpu *v, XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     return -ENOSYS;
 }
diff --git a/xen/arch/arm/domctl.c b/xen/arch/arm/domctl.c
index 1a5f79f..cf16791 100644
--- a/xen/arch/arm/domctl.c
+++ b/xen/arch/arm/domctl.c
@@ -11,7 +11,7 @@
 #include <public/domctl.h>
 
 long arch_do_domctl(struct xen_domctl *domctl,
-                    XEN_GUEST_HANDLE(xen_domctl_t) u_domctl)
+                    XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl)
 {
     return -ENOSYS;
 }
diff --git a/xen/arch/arm/hvm.c b/xen/arch/arm/hvm.c
index c11378d..40f519e 100644
--- a/xen/arch/arm/hvm.c
+++ b/xen/arch/arm/hvm.c
@@ -11,7 +11,7 @@
 
 #include <asm/hypercall.h>
 
-long do_hvm_op(unsigned long op, XEN_GUEST_HANDLE(void) arg)
+long do_hvm_op(unsigned long op, XEN_GUEST_HANDLE_PARAM(void) arg)
 
 {
     long rc = 0;
diff --git a/xen/arch/arm/mm.c b/xen/arch/arm/mm.c
index bf9b6c5..49102db 100644
--- a/xen/arch/arm/mm.c
+++ b/xen/arch/arm/mm.c
@@ -581,7 +581,7 @@ out:
 
 }
 
-long arch_memory_op(int op, XEN_GUEST_HANDLE(void) arg)
+long arch_memory_op(int op, XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     int rc;
 
diff --git a/xen/arch/arm/physdev.c b/xen/arch/arm/physdev.c
index bcf4337..0801e8c 100644
--- a/xen/arch/arm/physdev.c
+++ b/xen/arch/arm/physdev.c
@@ -11,7 +11,7 @@
 #include <asm/hypercall.h>
 
 
-int do_physdev_op(int cmd, XEN_GUEST_HANDLE(void) arg)
+int do_physdev_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     printk("%s %d cmd=%d: not implemented yet\n", __func__, __LINE__, cmd);
     return -ENOSYS;
diff --git a/xen/arch/arm/sysctl.c b/xen/arch/arm/sysctl.c
index e8e1c0d..a286abe 100644
--- a/xen/arch/arm/sysctl.c
+++ b/xen/arch/arm/sysctl.c
@@ -13,7 +13,7 @@
 #include <public/sysctl.h>
 
 long arch_do_sysctl(struct xen_sysctl *sysctl,
-                    XEN_GUEST_HANDLE(xen_sysctl_t) u_sysctl)
+                    XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl)
 {
     return -ENOSYS;
 }
diff --git a/xen/arch/x86/compat.c b/xen/arch/x86/compat.c
index a4fda06..2d05867 100644
--- a/xen/arch/x86/compat.c
+++ b/xen/arch/x86/compat.c
@@ -27,7 +27,7 @@ ret_t do_physdev_op_compat(XEN_GUEST_HANDLE(physdev_op_t) uop)
 #ifndef COMPAT
 
 /* Legacy hypercall (as of 0x00030202). */
-long do_event_channel_op_compat(XEN_GUEST_HANDLE(evtchn_op_t) uop)
+long do_event_channel_op_compat(XEN_GUEST_HANDLE_PARAM(evtchn_op_t) uop)
 {
     struct evtchn_op op;
 
diff --git a/xen/arch/x86/cpu/mcheck/mce.c b/xen/arch/x86/cpu/mcheck/mce.c
index 5f03394..06dddee 100644
--- a/xen/arch/x86/cpu/mcheck/mce.c
+++ b/xen/arch/x86/cpu/mcheck/mce.c
@@ -1288,7 +1288,7 @@ CHECK_mcinfo_recovery;
 # undef xen_mcinfo_recovery
 
 /* Machine Check Architecture Hypercall */
-long do_mca(XEN_GUEST_HANDLE(xen_mc_t) u_xen_mc)
+long do_mca(XEN_GUEST_HANDLE_PARAM(xen_mc_t) u_xen_mc)
 {
     long ret = 0;
     struct xen_mc curop, *op = &curop;
diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c
index 58766ba..233c597 100644
--- a/xen/arch/x86/domain.c
+++ b/xen/arch/x86/domain.c
@@ -1077,7 +1077,7 @@ map_vcpu_info(struct vcpu *v, unsigned long gfn, unsigned offset)
 
 long
 arch_do_vcpu_op(
-    int cmd, struct vcpu *v, XEN_GUEST_HANDLE(void) arg)
+    int cmd, struct vcpu *v, XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     long rc = 0;
 
diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c
index 24b3178..c3d6093 100644
--- a/xen/arch/x86/domctl.c
+++ b/xen/arch/x86/domctl.c
@@ -48,7 +48,7 @@ static int gdbsx_guest_mem_io(
 
 long arch_do_domctl(
     struct xen_domctl *domctl,
-    XEN_GUEST_HANDLE(xen_domctl_t) u_domctl)
+    XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl)
 {
     long ret = 0;
 
diff --git a/xen/arch/x86/efi/runtime.c b/xen/arch/x86/efi/runtime.c
index 1dbe2db..b2ff495 100644
--- a/xen/arch/x86/efi/runtime.c
+++ b/xen/arch/x86/efi/runtime.c
@@ -184,7 +184,7 @@ int efi_get_info(uint32_t idx, union xenpf_efi_info *info)
     return 0;
 }
 
-static long gwstrlen(XEN_GUEST_HANDLE(CHAR16) str)
+static long gwstrlen(XEN_GUEST_HANDLE_PARAM(CHAR16) str)
 {
     unsigned long len;
 
diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index a5a1bcf..b83e336 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -3091,14 +3091,14 @@ static int grant_table_op_is_allowed(unsigned int cmd)
 }
 
 static long hvm_grant_table_op(
-    unsigned int cmd, XEN_GUEST_HANDLE(void) uop, unsigned int count)
+    unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) uop, unsigned int count)
 {
     if ( !grant_table_op_is_allowed(cmd) )
         return -ENOSYS; /* all other commands need auditing */
     return do_grant_table_op(cmd, uop, count);
 }
 
-static long hvm_memory_op(int cmd, XEN_GUEST_HANDLE(void) arg)
+static long hvm_memory_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     long rc;
 
@@ -3116,7 +3116,7 @@ static long hvm_memory_op(int cmd, XEN_GUEST_HANDLE(void) arg)
     return do_memory_op(cmd, arg);
 }
 
-static long hvm_physdev_op(int cmd, XEN_GUEST_HANDLE(void) arg)
+static long hvm_physdev_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     switch ( cmd )
     {
@@ -3132,7 +3132,7 @@ static long hvm_physdev_op(int cmd, XEN_GUEST_HANDLE(void) arg)
 }
 
 static long hvm_vcpu_op(
-    int cmd, int vcpuid, XEN_GUEST_HANDLE(void) arg)
+    int cmd, int vcpuid, XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     long rc;
 
@@ -3163,7 +3163,7 @@ typedef unsigned long hvm_hypercall_t(
     [ __HYPERVISOR_ ## x ] = (hvm_hypercall_t *) do_ ## x
 
 static long hvm_grant_table_op_compat32(unsigned int cmd,
-                                        XEN_GUEST_HANDLE(void) uop,
+                                        XEN_GUEST_HANDLE_PARAM(void) uop,
                                         unsigned int count)
 {
     if ( !grant_table_op_is_allowed(cmd) )
@@ -3171,7 +3171,7 @@ static long hvm_grant_table_op_compat32(unsigned int cmd,
     return compat_grant_table_op(cmd, uop, count);
 }
 
-static long hvm_memory_op_compat32(int cmd, XEN_GUEST_HANDLE(void) arg)
+static long hvm_memory_op_compat32(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     int rc;
 
@@ -3190,7 +3190,7 @@ static long hvm_memory_op_compat32(int cmd, XEN_GUEST_HANDLE(void) arg)
 }
 
 static long hvm_vcpu_op_compat32(
-    int cmd, int vcpuid, XEN_GUEST_HANDLE(void) arg)
+    int cmd, int vcpuid, XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     long rc;
 
@@ -3214,7 +3214,7 @@ static long hvm_vcpu_op_compat32(
 }
 
 static long hvm_physdev_op_compat32(
-    int cmd, XEN_GUEST_HANDLE(void) arg)
+    int cmd, XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     switch ( cmd )
     {
@@ -3380,7 +3380,7 @@ void hvm_hypercall_page_initialise(struct domain *d,
 }
 
 static int hvmop_set_pci_intx_level(
-    XEN_GUEST_HANDLE(xen_hvm_set_pci_intx_level_t) uop)
+    XEN_GUEST_HANDLE_PARAM(xen_hvm_set_pci_intx_level_t) uop)
 {
     struct xen_hvm_set_pci_intx_level op;
     struct domain *d;
@@ -3547,7 +3547,7 @@ static void hvm_s3_resume(struct domain *d)
 }
 
 static int hvmop_set_isa_irq_level(
-    XEN_GUEST_HANDLE(xen_hvm_set_isa_irq_level_t) uop)
+    XEN_GUEST_HANDLE_PARAM(xen_hvm_set_isa_irq_level_t) uop)
 {
     struct xen_hvm_set_isa_irq_level op;
     struct domain *d;
@@ -3591,7 +3591,7 @@ static int hvmop_set_isa_irq_level(
 }
 
 static int hvmop_set_pci_link_route(
-    XEN_GUEST_HANDLE(xen_hvm_set_pci_link_route_t) uop)
+    XEN_GUEST_HANDLE_PARAM(xen_hvm_set_pci_link_route_t) uop)
 {
     struct xen_hvm_set_pci_link_route op;
     struct domain *d;
@@ -3624,7 +3624,7 @@ static int hvmop_set_pci_link_route(
 }
 
 static int hvmop_inject_msi(
-    XEN_GUEST_HANDLE(xen_hvm_inject_msi_t) uop)
+    XEN_GUEST_HANDLE_PARAM(xen_hvm_inject_msi_t) uop)
 {
     struct xen_hvm_inject_msi op;
     struct domain *d;
@@ -3708,7 +3708,7 @@ static int hvm_replace_event_channel(struct vcpu *v, domid_t remote_domid,
     return 0;
 }
 
-long do_hvm_op(unsigned long op, XEN_GUEST_HANDLE(void) arg)
+long do_hvm_op(unsigned long op, XEN_GUEST_HANDLE_PARAM(void) arg)
 
 {
     struct domain *curr_d = current->domain;
diff --git a/xen/arch/x86/microcode.c b/xen/arch/x86/microcode.c
index fe51034..fbbf95b 100644
--- a/xen/arch/x86/microcode.c
+++ b/xen/arch/x86/microcode.c
@@ -195,7 +195,7 @@ static long do_microcode_update(void *_info)
     return error;
 }
 
-int microcode_update(XEN_GUEST_HANDLE(const_void) buf, unsigned long len)
+int microcode_update(XEN_GUEST_HANDLE_PARAM(const_void) buf, unsigned long len)
 {
     int ret;
     struct microcode_info *info;
diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
index 8ab92c9..9a828de 100644
--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -2652,7 +2652,7 @@ static void put_pg_owner(struct domain *pg_owner)
 }
 
 static inline int vcpumask_to_pcpumask(
-    struct domain *d, XEN_GUEST_HANDLE(const_void) bmap, cpumask_t *pmask)
+    struct domain *d, XEN_GUEST_HANDLE_PARAM(const_void) bmap, cpumask_t *pmask)
 {
     unsigned int vcpu_id, vcpu_bias, offs;
     unsigned long vmask;
@@ -2692,9 +2692,9 @@ static inline int vcpumask_to_pcpumask(
 #define fixunmap_domain_page(ptr) ((void)(ptr))
 
 long do_mmuext_op(
-    XEN_GUEST_HANDLE(mmuext_op_t) uops,
+    XEN_GUEST_HANDLE_PARAM(mmuext_op_t) uops,
     unsigned int count,
-    XEN_GUEST_HANDLE(uint) pdone,
+    XEN_GUEST_HANDLE_PARAM(uint) pdone,
     unsigned int foreigndom)
 {
     struct mmuext_op op;
@@ -3151,9 +3151,9 @@ long do_mmuext_op(
 }
 
 long do_mmu_update(
-    XEN_GUEST_HANDLE(mmu_update_t) ureqs,
+    XEN_GUEST_HANDLE_PARAM(mmu_update_t) ureqs,
     unsigned int count,
-    XEN_GUEST_HANDLE(uint) pdone,
+    XEN_GUEST_HANDLE_PARAM(uint) pdone,
     unsigned int foreigndom)
 {
     struct mmu_update req;
@@ -4098,7 +4098,7 @@ long set_gdt(struct vcpu *v,
 }
 
 
-long do_set_gdt(XEN_GUEST_HANDLE(ulong) frame_list, unsigned int entries)
+long do_set_gdt(XEN_GUEST_HANDLE_PARAM(ulong) frame_list, unsigned int entries)
 {
     int nr_pages = (entries + 511) / 512;
     unsigned long frames[16];
@@ -4370,7 +4370,7 @@ static int xenmem_add_to_physmap(struct domain *d,
     return xenmem_add_to_physmap_once(d, xatp);
 }
 
-long arch_memory_op(int op, XEN_GUEST_HANDLE(void) arg)
+long arch_memory_op(int op, XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     int rc;
 
diff --git a/xen/arch/x86/mm/hap/hap.c b/xen/arch/x86/mm/hap/hap.c
index d2637d3..fd99cde 100644
--- a/xen/arch/x86/mm/hap/hap.c
+++ b/xen/arch/x86/mm/hap/hap.c
@@ -571,7 +571,7 @@ void hap_teardown(struct domain *d)
 }
 
 int hap_domctl(struct domain *d, xen_domctl_shadow_op_t *sc,
-               XEN_GUEST_HANDLE(void) u_domctl)
+               XEN_GUEST_HANDLE_PARAM(void) u_domctl)
 {
     int rc, preempted = 0;
 
diff --git a/xen/arch/x86/mm/mem_event.c b/xen/arch/x86/mm/mem_event.c
index 942c19e..27d1cf4 100644
--- a/xen/arch/x86/mm/mem_event.c
+++ b/xen/arch/x86/mm/mem_event.c
@@ -512,7 +512,7 @@ void mem_event_cleanup(struct domain *d)
 }
 
 int mem_event_domctl(struct domain *d, xen_domctl_mem_event_op_t *mec,
-                     XEN_GUEST_HANDLE(void) u_domctl)
+                     XEN_GUEST_HANDLE_PARAM(void) u_domctl)
 {
     int rc;
 
diff --git a/xen/arch/x86/mm/paging.c b/xen/arch/x86/mm/paging.c
index ca879f9..ea44e39 100644
--- a/xen/arch/x86/mm/paging.c
+++ b/xen/arch/x86/mm/paging.c
@@ -654,7 +654,7 @@ void paging_vcpu_init(struct vcpu *v)
 
 
 int paging_domctl(struct domain *d, xen_domctl_shadow_op_t *sc,
-                  XEN_GUEST_HANDLE(void) u_domctl)
+                  XEN_GUEST_HANDLE_PARAM(void) u_domctl)
 {
     int rc;
 
diff --git a/xen/arch/x86/mm/shadow/common.c b/xen/arch/x86/mm/shadow/common.c
index 3f8ad88..ce79131 100644
--- a/xen/arch/x86/mm/shadow/common.c
+++ b/xen/arch/x86/mm/shadow/common.c
@@ -3641,7 +3641,7 @@ out:
 
 int shadow_domctl(struct domain *d, 
                   xen_domctl_shadow_op_t *sc,
-                  XEN_GUEST_HANDLE(void) u_domctl)
+                  XEN_GUEST_HANDLE_PARAM(void) u_domctl)
 {
     int rc, preempted = 0;
 
diff --git a/xen/arch/x86/oprofile/xenoprof.c b/xen/arch/x86/oprofile/xenoprof.c
index 160abac..90ef67d 100644
--- a/xen/arch/x86/oprofile/xenoprof.c
+++ b/xen/arch/x86/oprofile/xenoprof.c
@@ -17,7 +17,7 @@
 
 #include "op_counter.h"
 
-int xenoprof_arch_counter(XEN_GUEST_HANDLE(void) arg)
+int xenoprof_arch_counter(XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     struct xenoprof_counter counter;
 
@@ -37,7 +37,7 @@ int xenoprof_arch_counter(XEN_GUEST_HANDLE(void) arg)
     return 0;
 }
 
-int xenoprof_arch_ibs_counter(XEN_GUEST_HANDLE(void) arg)
+int xenoprof_arch_ibs_counter(XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     struct xenoprof_ibs_counter ibs_counter;
 
@@ -54,7 +54,7 @@ int xenoprof_arch_ibs_counter(XEN_GUEST_HANDLE(void) arg)
     return 0;
 }
 
-int compat_oprof_arch_counter(XEN_GUEST_HANDLE(void) arg)
+int compat_oprof_arch_counter(XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     struct compat_oprof_counter counter;
 
diff --git a/xen/arch/x86/physdev.c b/xen/arch/x86/physdev.c
index 984c813..751cbd4 100644
--- a/xen/arch/x86/physdev.c
+++ b/xen/arch/x86/physdev.c
@@ -258,7 +258,7 @@ int physdev_unmap_pirq(domid_t domid, int pirq)
 }
 #endif /* COMPAT */
 
-ret_t do_physdev_op(int cmd, XEN_GUEST_HANDLE(void) arg)
+ret_t do_physdev_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     int irq;
     ret_t ret;
diff --git a/xen/arch/x86/platform_hypercall.c b/xen/arch/x86/platform_hypercall.c
index 073a2ea..7a7325f 100644
--- a/xen/arch/x86/platform_hypercall.c
+++ b/xen/arch/x86/platform_hypercall.c
@@ -61,7 +61,7 @@ long cpu_down_helper(void *data);
 long core_parking_helper(void *data);
 uint32_t get_cur_idle_nums(void);
 
-ret_t do_platform_op(XEN_GUEST_HANDLE(xen_platform_op_t) u_xenpf_op)
+ret_t do_platform_op(XEN_GUEST_HANDLE_PARAM(xen_platform_op_t) u_xenpf_op)
 {
     ret_t ret = 0;
     struct xen_platform_op curop, *op = &curop;
diff --git a/xen/arch/x86/sysctl.c b/xen/arch/x86/sysctl.c
index 379f071..b84dd34 100644
--- a/xen/arch/x86/sysctl.c
+++ b/xen/arch/x86/sysctl.c
@@ -58,7 +58,7 @@ long cpu_down_helper(void *data)
 }
 
 long arch_do_sysctl(
-    struct xen_sysctl *sysctl, XEN_GUEST_HANDLE(xen_sysctl_t) u_sysctl)
+    struct xen_sysctl *sysctl, XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl)
 {
     long ret = 0;
 
diff --git a/xen/arch/x86/traps.c b/xen/arch/x86/traps.c
index de08e25..dfaf78e 100644
--- a/xen/arch/x86/traps.c
+++ b/xen/arch/x86/traps.c
@@ -3536,7 +3536,7 @@ int send_guest_trap(struct domain *d, uint16_t vcpuid, unsigned int trap_nr)
 }
 
 
-long do_set_trap_table(XEN_GUEST_HANDLE(const_trap_info_t) traps)
+long do_set_trap_table(XEN_GUEST_HANDLE_PARAM(const_trap_info_t) traps)
 {
     struct trap_info cur;
     struct vcpu *curr = current;
diff --git a/xen/arch/x86/x86_64/compat/mm.c b/xen/arch/x86/x86_64/compat/mm.c
index f497503..d1eb785 100644
--- a/xen/arch/x86/x86_64/compat/mm.c
+++ b/xen/arch/x86/x86_64/compat/mm.c
@@ -5,7 +5,7 @@
 #include <asm/mem_event.h>
 #include <asm/mem_sharing.h>
 
-int compat_set_gdt(XEN_GUEST_HANDLE(uint) frame_list, unsigned int entries)
+int compat_set_gdt(XEN_GUEST_HANDLE_PARAM(uint) frame_list, unsigned int entries)
 {
     unsigned int i, nr_pages = (entries + 511) / 512;
     unsigned long frames[16];
@@ -44,7 +44,7 @@ int compat_update_descriptor(u32 pa_lo, u32 pa_hi, u32 desc_lo, u32 desc_hi)
                                 desc_lo | ((u64)desc_hi << 32));
 }
 
-int compat_arch_memory_op(int op, XEN_GUEST_HANDLE(void) arg)
+int compat_arch_memory_op(int op, XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     struct compat_machphys_mfn_list xmml;
     l2_pgentry_t l2e;
@@ -260,14 +260,14 @@ int compat_update_va_mapping_otherdomain(unsigned long va, u32 lo, u32 hi,
 
 DEFINE_XEN_GUEST_HANDLE(mmuext_op_compat_t);
 
-int compat_mmuext_op(XEN_GUEST_HANDLE(mmuext_op_compat_t) cmp_uops,
+int compat_mmuext_op(XEN_GUEST_HANDLE_PARAM(mmuext_op_compat_t) cmp_uops,
                      unsigned int count,
-                     XEN_GUEST_HANDLE(uint) pdone,
+                     XEN_GUEST_HANDLE_PARAM(uint) pdone,
                      unsigned int foreigndom)
 {
     unsigned int i, preempt_mask;
     int rc = 0;
-    XEN_GUEST_HANDLE(mmuext_op_t) nat_ops;
+    XEN_GUEST_HANDLE_PARAM(mmuext_op_t) nat_ops;
 
     preempt_mask = count & MMU_UPDATE_PREEMPTED;
     count ^= preempt_mask;
diff --git a/xen/arch/x86/x86_64/domain.c b/xen/arch/x86/x86_64/domain.c
index e746c89..144ca2d 100644
--- a/xen/arch/x86/x86_64/domain.c
+++ b/xen/arch/x86/x86_64/domain.c
@@ -23,7 +23,7 @@ CHECK_vcpu_get_physid;
 
 int
 arch_compat_vcpu_op(
-    int cmd, struct vcpu *v, XEN_GUEST_HANDLE(void) arg)
+    int cmd, struct vcpu *v, XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     int rc = -ENOSYS;
 
diff --git a/xen/arch/x86/x86_64/mm.c b/xen/arch/x86/x86_64/mm.c
index 1e001ea..35653b7 100644
--- a/xen/arch/x86/x86_64/mm.c
+++ b/xen/arch/x86/x86_64/mm.c
@@ -1027,7 +1027,7 @@ void __init subarch_init_memory(void)
     }
 }
 
-long subarch_memory_op(int op, XEN_GUEST_HANDLE(void) arg)
+long subarch_memory_op(int op, XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     struct xen_machphys_mfn_list xmml;
     l3_pgentry_t l3e;
diff --git a/xen/arch/x86/x86_64/traps.c b/xen/arch/x86/x86_64/traps.c
index 3361d19..dfe0fac 100644
--- a/xen/arch/x86/x86_64/traps.c
+++ b/xen/arch/x86/x86_64/traps.c
@@ -519,7 +519,7 @@ static long unregister_guest_callback(struct callback_unregister *unreg)
 }
 
 
-long do_callback_op(int cmd, XEN_GUEST_HANDLE(const_void) arg)
+long do_callback_op(int cmd, XEN_GUEST_HANDLE_PARAM(const_void) arg)
 {
     long ret;
 
diff --git a/xen/common/compat/domain.c b/xen/common/compat/domain.c
index 40a0287..e4c8ceb 100644
--- a/xen/common/compat/domain.c
+++ b/xen/common/compat/domain.c
@@ -15,7 +15,7 @@
 CHECK_vcpu_set_periodic_timer;
 #undef xen_vcpu_set_periodic_timer
 
-int compat_vcpu_op(int cmd, int vcpuid, XEN_GUEST_HANDLE(void) arg)
+int compat_vcpu_op(int cmd, int vcpuid, XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     struct domain *d = current->domain;
     struct vcpu *v;
diff --git a/xen/common/compat/grant_table.c b/xen/common/compat/grant_table.c
index edd20c6..b524955 100644
--- a/xen/common/compat/grant_table.c
+++ b/xen/common/compat/grant_table.c
@@ -52,12 +52,12 @@ CHECK_gnttab_swap_grant_ref;
 #undef xen_gnttab_swap_grant_ref
 
 int compat_grant_table_op(unsigned int cmd,
-                          XEN_GUEST_HANDLE(void) cmp_uop,
+                          XEN_GUEST_HANDLE_PARAM(void) cmp_uop,
                           unsigned int count)
 {
     int rc = 0;
     unsigned int i;
-    XEN_GUEST_HANDLE(void) cnt_uop;
+    XEN_GUEST_HANDLE_PARAM(void) cnt_uop;
 
     set_xen_guest_handle(cnt_uop, NULL);
     switch ( cmd )
@@ -206,7 +206,7 @@ int compat_grant_table_op(unsigned int cmd,
             }
             if ( rc >= 0 )
             {
-                XEN_GUEST_HANDLE(gnttab_transfer_compat_t) xfer;
+                XEN_GUEST_HANDLE_PARAM(gnttab_transfer_compat_t) xfer;
 
                 xfer = guest_handle_cast(cmp_uop, gnttab_transfer_compat_t);
                 guest_handle_add_offset(xfer, i);
@@ -251,7 +251,7 @@ int compat_grant_table_op(unsigned int cmd,
             }
             if ( rc >= 0 )
             {
-                XEN_GUEST_HANDLE(gnttab_copy_compat_t) copy;
+                XEN_GUEST_HANDLE_PARAM(gnttab_copy_compat_t) copy;
 
                 copy = guest_handle_cast(cmp_uop, gnttab_copy_compat_t);
                 guest_handle_add_offset(copy, i);
diff --git a/xen/common/compat/memory.c b/xen/common/compat/memory.c
index e7257cc..996151c 100644
--- a/xen/common/compat/memory.c
+++ b/xen/common/compat/memory.c
@@ -13,7 +13,7 @@ CHECK_TYPE(domid);
 #undef compat_domid_t
 #undef xen_domid_t
 
-int compat_memory_op(unsigned int cmd, XEN_GUEST_HANDLE(void) compat)
+int compat_memory_op(unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) compat)
 {
     int rc, split, op = cmd & MEMOP_CMD_MASK;
     unsigned int start_extent = cmd >> MEMOP_EXTENT_SHIFT;
@@ -22,7 +22,7 @@ int compat_memory_op(unsigned int cmd, XEN_GUEST_HANDLE(void) compat)
     {
         unsigned int i, end_extent = 0;
         union {
-            XEN_GUEST_HANDLE(void) hnd;
+            XEN_GUEST_HANDLE_PARAM(void) hnd;
             struct xen_memory_reservation *rsrv;
             struct xen_memory_exchange *xchg;
             struct xen_remove_from_physmap *xrfp;
diff --git a/xen/common/domain.c b/xen/common/domain.c
index a1aa05e..6f98b54 100644
--- a/xen/common/domain.c
+++ b/xen/common/domain.c
@@ -806,7 +806,7 @@ void vcpu_reset(struct vcpu *v)
 }
 
 
-long do_vcpu_op(int cmd, int vcpuid, XEN_GUEST_HANDLE(void) arg)
+long do_vcpu_op(int cmd, int vcpuid, XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     struct domain *d = current->domain;
     struct vcpu *v;
diff --git a/xen/common/domctl.c b/xen/common/domctl.c
index 2b1f182..e153cb4 100644
--- a/xen/common/domctl.c
+++ b/xen/common/domctl.c
@@ -239,7 +239,7 @@ void domctl_lock_release(void)
     spin_unlock(&current->domain->hypercall_deadlock_mutex);
 }
 
-long do_domctl(XEN_GUEST_HANDLE(xen_domctl_t) u_domctl)
+long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl)
 {
     long ret = 0;
     struct xen_domctl curop, *op = &curop;
diff --git a/xen/common/event_channel.c b/xen/common/event_channel.c
index 53777f8..a80a0d1 100644
--- a/xen/common/event_channel.c
+++ b/xen/common/event_channel.c
@@ -970,7 +970,7 @@ out:
 }
 
 
-long do_event_channel_op(int cmd, XEN_GUEST_HANDLE(void) arg)
+long do_event_channel_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     long rc;
 
diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
index c8e342b..f4ae9ee 100644
--- a/xen/common/grant_table.c
+++ b/xen/common/grant_table.c
@@ -833,7 +833,7 @@ __gnttab_map_grant_ref(
 
 static long
 gnttab_map_grant_ref(
-    XEN_GUEST_HANDLE(gnttab_map_grant_ref_t) uop, unsigned int count)
+    XEN_GUEST_HANDLE_PARAM(gnttab_map_grant_ref_t) uop, unsigned int count)
 {
     int i;
     struct gnttab_map_grant_ref op;
@@ -1102,7 +1102,7 @@ __gnttab_unmap_grant_ref(
 
 static long
 gnttab_unmap_grant_ref(
-    XEN_GUEST_HANDLE(gnttab_unmap_grant_ref_t) uop, unsigned int count)
+    XEN_GUEST_HANDLE_PARAM(gnttab_unmap_grant_ref_t) uop, unsigned int count)
 {
     int i, c, partial_done, done = 0;
     struct gnttab_unmap_grant_ref op;
@@ -1164,7 +1164,7 @@ __gnttab_unmap_and_replace(
 
 static long
 gnttab_unmap_and_replace(
-    XEN_GUEST_HANDLE(gnttab_unmap_and_replace_t) uop, unsigned int count)
+    XEN_GUEST_HANDLE_PARAM(gnttab_unmap_and_replace_t) uop, unsigned int count)
 {
     int i, c, partial_done, done = 0;
     struct gnttab_unmap_and_replace op;
@@ -1316,7 +1316,7 @@ active_alloc_failed:
 
 static long 
 gnttab_setup_table(
-    XEN_GUEST_HANDLE(gnttab_setup_table_t) uop, unsigned int count)
+    XEN_GUEST_HANDLE_PARAM(gnttab_setup_table_t) uop, unsigned int count)
 {
     struct gnttab_setup_table op;
     struct domain *d;
@@ -1395,7 +1395,7 @@ gnttab_setup_table(
 
 static long 
 gnttab_query_size(
-    XEN_GUEST_HANDLE(gnttab_query_size_t) uop, unsigned int count)
+    XEN_GUEST_HANDLE_PARAM(gnttab_query_size_t) uop, unsigned int count)
 {
     struct gnttab_query_size op;
     struct domain *d;
@@ -1517,7 +1517,7 @@ gnttab_prepare_for_transfer(
 
 static long
 gnttab_transfer(
-    XEN_GUEST_HANDLE(gnttab_transfer_t) uop, unsigned int count)
+    XEN_GUEST_HANDLE_PARAM(gnttab_transfer_t) uop, unsigned int count)
 {
     struct domain *d = current->domain;
     struct domain *e;
@@ -2125,7 +2125,7 @@ __gnttab_copy(
 
 static long
 gnttab_copy(
-    XEN_GUEST_HANDLE(gnttab_copy_t) uop, unsigned int count)
+    XEN_GUEST_HANDLE_PARAM(gnttab_copy_t) uop, unsigned int count)
 {
     int i;
     struct gnttab_copy op;
@@ -2144,7 +2144,7 @@ gnttab_copy(
 }
 
 static long
-gnttab_set_version(XEN_GUEST_HANDLE(gnttab_set_version_t uop))
+gnttab_set_version(XEN_GUEST_HANDLE_PARAM(gnttab_set_version_t uop))
 {
     gnttab_set_version_t op;
     struct domain *d = current->domain;
@@ -2263,7 +2263,7 @@ out:
 }
 
 static long
-gnttab_get_status_frames(XEN_GUEST_HANDLE(gnttab_get_status_frames_t) uop,
+gnttab_get_status_frames(XEN_GUEST_HANDLE_PARAM(gnttab_get_status_frames_t) uop,
                          int count)
 {
     gnttab_get_status_frames_t op;
@@ -2327,7 +2327,7 @@ out1:
 }
 
 static long
-gnttab_get_version(XEN_GUEST_HANDLE(gnttab_get_version_t uop))
+gnttab_get_version(XEN_GUEST_HANDLE_PARAM(gnttab_get_version_t uop))
 {
     gnttab_get_version_t op;
     struct domain *d;
@@ -2412,7 +2412,7 @@ out:
 }
 
 static long
-gnttab_swap_grant_ref(XEN_GUEST_HANDLE(gnttab_swap_grant_ref_t uop),
+gnttab_swap_grant_ref(XEN_GUEST_HANDLE_PARAM(gnttab_swap_grant_ref_t uop),
                       unsigned int count)
 {
     int i;
@@ -2433,7 +2433,7 @@ gnttab_swap_grant_ref(XEN_GUEST_HANDLE(gnttab_swap_grant_ref_t uop),
 
 long
 do_grant_table_op(
-    unsigned int cmd, XEN_GUEST_HANDLE(void) uop, unsigned int count)
+    unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) uop, unsigned int count)
 {
     long rc;
     
@@ -2445,7 +2445,7 @@ do_grant_table_op(
     {
     case GNTTABOP_map_grant_ref:
     {
-        XEN_GUEST_HANDLE(gnttab_map_grant_ref_t) map =
+        XEN_GUEST_HANDLE_PARAM(gnttab_map_grant_ref_t) map =
             guest_handle_cast(uop, gnttab_map_grant_ref_t);
         if ( unlikely(!guest_handle_okay(map, count)) )
             goto out;
@@ -2459,7 +2459,7 @@ do_grant_table_op(
     }
     case GNTTABOP_unmap_grant_ref:
     {
-        XEN_GUEST_HANDLE(gnttab_unmap_grant_ref_t) unmap =
+        XEN_GUEST_HANDLE_PARAM(gnttab_unmap_grant_ref_t) unmap =
             guest_handle_cast(uop, gnttab_unmap_grant_ref_t);
         if ( unlikely(!guest_handle_okay(unmap, count)) )
             goto out;
@@ -2473,7 +2473,7 @@ do_grant_table_op(
     }
     case GNTTABOP_unmap_and_replace:
     {
-        XEN_GUEST_HANDLE(gnttab_unmap_and_replace_t) unmap =
+        XEN_GUEST_HANDLE_PARAM(gnttab_unmap_and_replace_t) unmap =
             guest_handle_cast(uop, gnttab_unmap_and_replace_t);
         if ( unlikely(!guest_handle_okay(unmap, count)) )
             goto out;
@@ -2497,7 +2497,7 @@ do_grant_table_op(
     }
     case GNTTABOP_transfer:
     {
-        XEN_GUEST_HANDLE(gnttab_transfer_t) transfer =
+        XEN_GUEST_HANDLE_PARAM(gnttab_transfer_t) transfer =
             guest_handle_cast(uop, gnttab_transfer_t);
         if ( unlikely(!guest_handle_okay(transfer, count)) )
             goto out;
@@ -2511,7 +2511,7 @@ do_grant_table_op(
     }
     case GNTTABOP_copy:
     {
-        XEN_GUEST_HANDLE(gnttab_copy_t) copy =
+        XEN_GUEST_HANDLE_PARAM(gnttab_copy_t) copy =
             guest_handle_cast(uop, gnttab_copy_t);
         if ( unlikely(!guest_handle_okay(copy, count)) )
             goto out;
@@ -2548,7 +2548,7 @@ do_grant_table_op(
     }
     case GNTTABOP_swap_grant_ref:
     {
-        XEN_GUEST_HANDLE(gnttab_swap_grant_ref_t) swap =
+        XEN_GUEST_HANDLE_PARAM(gnttab_swap_grant_ref_t) swap =
             guest_handle_cast(uop, gnttab_swap_grant_ref_t);
         if ( unlikely(!guest_handle_okay(swap, count)) )
             goto out;
diff --git a/xen/common/kernel.c b/xen/common/kernel.c
index c915bbc..55caff6 100644
--- a/xen/common/kernel.c
+++ b/xen/common/kernel.c
@@ -204,7 +204,7 @@ void __init do_initcalls(void)
  * Simple hypercalls.
  */
 
-DO(xen_version)(int cmd, XEN_GUEST_HANDLE(void) arg)
+DO(xen_version)(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     switch ( cmd )
     {
@@ -332,7 +332,7 @@ DO(xen_version)(int cmd, XEN_GUEST_HANDLE(void) arg)
     return -ENOSYS;
 }
 
-DO(nmi_op)(unsigned int cmd, XEN_GUEST_HANDLE(void) arg)
+DO(nmi_op)(unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     struct xennmi_callback cb;
     long rc = 0;
diff --git a/xen/common/kexec.c b/xen/common/kexec.c
index 2bc3e33..25ebd6a 100644
--- a/xen/common/kexec.c
+++ b/xen/common/kexec.c
@@ -613,7 +613,7 @@ static int kexec_get_range_internal(xen_kexec_range_t *range)
     return ret;
 }
 
-static int kexec_get_range(XEN_GUEST_HANDLE(void) uarg)
+static int kexec_get_range(XEN_GUEST_HANDLE_PARAM(void) uarg)
 {
     xen_kexec_range_t range;
     int ret = -EINVAL;
@@ -629,7 +629,7 @@ static int kexec_get_range(XEN_GUEST_HANDLE(void) uarg)
     return ret;
 }
 
-static int kexec_get_range_compat(XEN_GUEST_HANDLE(void) uarg)
+static int kexec_get_range_compat(XEN_GUEST_HANDLE_PARAM(void) uarg)
 {
 #ifdef CONFIG_COMPAT
     xen_kexec_range_t range;
@@ -777,7 +777,7 @@ static int kexec_load_unload_internal(unsigned long op, xen_kexec_load_t *load)
     return ret;
 }
 
-static int kexec_load_unload(unsigned long op, XEN_GUEST_HANDLE(void) uarg)
+static int kexec_load_unload(unsigned long op, XEN_GUEST_HANDLE_PARAM(void) uarg)
 {
     xen_kexec_load_t load;
 
@@ -788,7 +788,7 @@ static int kexec_load_unload(unsigned long op, XEN_GUEST_HANDLE(void) uarg)
 }
 
 static int kexec_load_unload_compat(unsigned long op,
-                                    XEN_GUEST_HANDLE(void) uarg)
+                                    XEN_GUEST_HANDLE_PARAM(void) uarg)
 {
 #ifdef CONFIG_COMPAT
     compat_kexec_load_t compat_load;
@@ -813,7 +813,7 @@ static int kexec_load_unload_compat(unsigned long op,
 #endif /* CONFIG_COMPAT */
 }
 
-static int kexec_exec(XEN_GUEST_HANDLE(void) uarg)
+static int kexec_exec(XEN_GUEST_HANDLE_PARAM(void) uarg)
 {
     xen_kexec_exec_t exec;
     xen_kexec_image_t *image;
@@ -845,7 +845,8 @@ static int kexec_exec(XEN_GUEST_HANDLE(void) uarg)
     return -EINVAL; /* never reached */
 }
 
-static int do_kexec_op_internal(unsigned long op, XEN_GUEST_HANDLE(void) uarg,
+static int do_kexec_op_internal(unsigned long op,
+                                XEN_GUEST_HANDLE_PARAM(void) uarg,
                                 bool_t compat)
 {
     unsigned long flags;
@@ -886,13 +887,13 @@ static int do_kexec_op_internal(unsigned long op, XEN_GUEST_HANDLE(void) uarg,
     return ret;
 }
 
-long do_kexec_op(unsigned long op, XEN_GUEST_HANDLE(void) uarg)
+long do_kexec_op(unsigned long op, XEN_GUEST_HANDLE_PARAM(void) uarg)
 {
     return do_kexec_op_internal(op, uarg, 0);
 }
 
 #ifdef CONFIG_COMPAT
-int compat_kexec_op(unsigned long op, XEN_GUEST_HANDLE(void) uarg)
+int compat_kexec_op(unsigned long op, XEN_GUEST_HANDLE_PARAM(void) uarg)
 {
     return do_kexec_op_internal(op, uarg, 1);
 }
diff --git a/xen/common/memory.c b/xen/common/memory.c
index 401d06c..83e2666 100644
--- a/xen/common/memory.c
+++ b/xen/common/memory.c
@@ -277,7 +277,7 @@ static void decrease_reservation(struct memop_args *a)
     a->nr_done = i;
 }
 
-static long memory_exchange(XEN_GUEST_HANDLE(xen_memory_exchange_t) arg)
+static long memory_exchange(XEN_GUEST_HANDLE_PARAM(xen_memory_exchange_t) arg)
 {
     struct xen_memory_exchange exch;
     PAGE_LIST_HEAD(in_chunk_list);
@@ -517,7 +517,7 @@ static long memory_exchange(XEN_GUEST_HANDLE(xen_memory_exchange_t) arg)
     return rc;
 }
 
-long do_memory_op(unsigned long cmd, XEN_GUEST_HANDLE(void) arg)
+long do_memory_op(unsigned long cmd, XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     struct domain *d;
     int rc, op;
diff --git a/xen/common/multicall.c b/xen/common/multicall.c
index ca1839d..7e557e5 100644
--- a/xen/common/multicall.c
+++ b/xen/common/multicall.c
@@ -35,7 +35,7 @@ static void trace_multicall_call(multicall_entry_t *call)
 
 ret_t
 do_multicall(
-    XEN_GUEST_HANDLE(multicall_entry_t) call_list, unsigned int nr_calls)
+    XEN_GUEST_HANDLE_PARAM(multicall_entry_t) call_list, unsigned int nr_calls)
 {
     struct mc_state *mcs = &current->mc_state;
     unsigned int     i;
diff --git a/xen/common/schedule.c b/xen/common/schedule.c
index eee74be..00812ac 100644
--- a/xen/common/schedule.c
+++ b/xen/common/schedule.c
@@ -836,7 +836,7 @@ typedef long ret_t;
 
 #endif /* !COMPAT */
 
-ret_t do_sched_op(int cmd, XEN_GUEST_HANDLE(void) arg)
+ret_t do_sched_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     ret_t ret = 0;
 
diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c
index ea68278..47142f4 100644
--- a/xen/common/sysctl.c
+++ b/xen/common/sysctl.c
@@ -27,7 +27,7 @@
 #include <xsm/xsm.h>
 #include <xen/pmstat.h>
 
-long do_sysctl(XEN_GUEST_HANDLE(xen_sysctl_t) u_sysctl)
+long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl)
 {
     long ret = 0;
     struct xen_sysctl curop, *op = &curop;
diff --git a/xen/common/xenoprof.c b/xen/common/xenoprof.c
index 44a1fae..ae0435b 100644
--- a/xen/common/xenoprof.c
+++ b/xen/common/xenoprof.c
@@ -404,7 +404,7 @@ static int add_active_list(domid_t domid)
     return 0;
 }
 
-static int add_passive_list(XEN_GUEST_HANDLE(void) arg)
+static int add_passive_list(XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     struct xenoprof_passive passive;
     struct domain *d;
@@ -585,7 +585,7 @@ void xenoprof_log_event(struct vcpu *vcpu, const struct cpu_user_regs *regs,
 
 
 
-static int xenoprof_op_init(XEN_GUEST_HANDLE(void) arg)
+static int xenoprof_op_init(XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     struct domain *d = current->domain;
     struct xenoprof_init xenoprof_init;
@@ -611,7 +611,7 @@ static int xenoprof_op_init(XEN_GUEST_HANDLE(void) arg)
 
 #endif /* !COMPAT */
 
-static int xenoprof_op_get_buffer(XEN_GUEST_HANDLE(void) arg)
+static int xenoprof_op_get_buffer(XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     struct xenoprof_get_buffer xenoprof_get_buffer;
     struct domain *d = current->domain;
@@ -662,7 +662,7 @@ static int xenoprof_op_get_buffer(XEN_GUEST_HANDLE(void) arg)
                       || (op == XENOPROF_disable_virq)  \
                       || (op == XENOPROF_get_buffer))
  
-ret_t do_xenoprof_op(int op, XEN_GUEST_HANDLE(void) arg)
+ret_t do_xenoprof_op(int op, XEN_GUEST_HANDLE_PARAM(void) arg)
 {
     int ret = 0;
     
diff --git a/xen/drivers/acpi/pmstat.c b/xen/drivers/acpi/pmstat.c
index 6f266ef..bf30cc7 100644
--- a/xen/drivers/acpi/pmstat.c
+++ b/xen/drivers/acpi/pmstat.c
@@ -496,7 +496,7 @@ int do_pm_op(struct xen_sysctl_pm_op *op)
     return ret;
 }
 
-int acpi_set_pdc_bits(u32 acpi_id, XEN_GUEST_HANDLE(uint32) pdc)
+int acpi_set_pdc_bits(u32 acpi_id, XEN_GUEST_HANDLE_PARAM(uint32) pdc)
 {
     u32 bits[3];
     int ret;
diff --git a/xen/drivers/char/console.c b/xen/drivers/char/console.c
index 9e1adb5..ff360fe 100644
--- a/xen/drivers/char/console.c
+++ b/xen/drivers/char/console.c
@@ -182,7 +182,7 @@ static void putchar_console_ring(int c)
 
 long read_console_ring(struct xen_sysctl_readconsole *op)
 {
-    XEN_GUEST_HANDLE(char) str;
+    XEN_GUEST_HANDLE_PARAM(char) str;
     uint32_t idx, len, max, sofar, c;
 
     str   = guest_handle_cast(op->buffer, char),
@@ -363,7 +363,7 @@ static void notify_dom0_con_ring(unsigned long unused)
 static DECLARE_SOFTIRQ_TASKLET(notify_dom0_con_ring_tasklet,
                                notify_dom0_con_ring, 0);
 
-static long guest_console_write(XEN_GUEST_HANDLE(char) buffer, int count)
+static long guest_console_write(XEN_GUEST_HANDLE_PARAM(char) buffer, int count)
 {
     char kbuf[128], *kptr;
     int kcount;
@@ -401,7 +401,7 @@ static long guest_console_write(XEN_GUEST_HANDLE(char) buffer, int count)
     return 0;
 }
 
-long do_console_io(int cmd, int count, XEN_GUEST_HANDLE(char) buffer)
+long do_console_io(int cmd, int count, XEN_GUEST_HANDLE_PARAM(char) buffer)
 {
     long rc;
     unsigned int idx, len;
diff --git a/xen/drivers/passthrough/iommu.c b/xen/drivers/passthrough/iommu.c
index b4cf16c..4b5f8b7 100644
--- a/xen/drivers/passthrough/iommu.c
+++ b/xen/drivers/passthrough/iommu.c
@@ -527,7 +527,7 @@ void iommu_crash_shutdown(void)
 
 int iommu_do_domctl(
     struct xen_domctl *domctl,
-    XEN_GUEST_HANDLE(xen_domctl_t) u_domctl)
+    XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl)
 {
     struct domain *d;
     u16 seg;
diff --git a/xen/include/asm-arm/hypercall.h b/xen/include/asm-arm/hypercall.h
index 454f02e..090e620 100644
--- a/xen/include/asm-arm/hypercall.h
+++ b/xen/include/asm-arm/hypercall.h
@@ -2,7 +2,7 @@
 #define __ASM_ARM_HYPERCALL_H__
 
 #include <public/domctl.h> /* for arch_do_domctl */
-int do_physdev_op(int cmd, XEN_GUEST_HANDLE(void) arg);
+int do_physdev_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg);
 
 #endif /* __ASM_ARM_HYPERCALL_H__ */
 /*
diff --git a/xen/include/asm-arm/mm.h b/xen/include/asm-arm/mm.h
index b37bd35..8bf45ba 100644
--- a/xen/include/asm-arm/mm.h
+++ b/xen/include/asm-arm/mm.h
@@ -267,7 +267,7 @@ static inline int relinquish_shared_pages(struct domain *d)
 
 
 /* Arch-specific portion of memory_op hypercall. */
-long arch_memory_op(int op, XEN_GUEST_HANDLE(void) arg);
+long arch_memory_op(int op, XEN_GUEST_HANDLE_PARAM(void) arg);
 
 int steal_page(
     struct domain *d, struct page_info *page, unsigned int memflags);
diff --git a/xen/include/asm-x86/hap.h b/xen/include/asm-x86/hap.h
index a2532a4..916a35b 100644
--- a/xen/include/asm-x86/hap.h
+++ b/xen/include/asm-x86/hap.h
@@ -51,7 +51,7 @@ hap_unmap_domain_page(void *p)
 /************************************************/
 void  hap_domain_init(struct domain *d);
 int   hap_domctl(struct domain *d, xen_domctl_shadow_op_t *sc,
-                 XEN_GUEST_HANDLE(void) u_domctl);
+                 XEN_GUEST_HANDLE_PARAM(void) u_domctl);
 int   hap_enable(struct domain *d, u32 mode);
 void  hap_final_teardown(struct domain *d);
 void  hap_teardown(struct domain *d);
diff --git a/xen/include/asm-x86/hypercall.h b/xen/include/asm-x86/hypercall.h
index a9af426..bd14220 100644
--- a/xen/include/asm-x86/hypercall.h
+++ b/xen/include/asm-x86/hypercall.h
@@ -18,22 +18,22 @@
 
 extern long
 do_event_channel_op_compat(
-    XEN_GUEST_HANDLE(evtchn_op_t) uop);
+    XEN_GUEST_HANDLE_PARAM(evtchn_op_t) uop);
 
 extern long
 do_set_trap_table(
-    XEN_GUEST_HANDLE(const_trap_info_t) traps);
+    XEN_GUEST_HANDLE_PARAM(const_trap_info_t) traps);
 
 extern long
 do_mmu_update(
-    XEN_GUEST_HANDLE(mmu_update_t) ureqs,
+    XEN_GUEST_HANDLE_PARAM(mmu_update_t) ureqs,
     unsigned int count,
-    XEN_GUEST_HANDLE(uint) pdone,
+    XEN_GUEST_HANDLE_PARAM(uint) pdone,
     unsigned int foreigndom);
 
 extern long
 do_set_gdt(
-    XEN_GUEST_HANDLE(ulong) frame_list,
+    XEN_GUEST_HANDLE_PARAM(ulong) frame_list,
     unsigned int entries);
 
 extern long
@@ -60,7 +60,7 @@ do_update_descriptor(
     u64 desc);
 
 extern long
-do_mca(XEN_GUEST_HANDLE(xen_mc_t) u_xen_mc);
+do_mca(XEN_GUEST_HANDLE_PARAM(xen_mc_t) u_xen_mc);
 
 extern long
 do_update_va_mapping(
@@ -70,7 +70,7 @@ do_update_va_mapping(
 
 extern long
 do_physdev_op(
-    int cmd, XEN_GUEST_HANDLE(void) arg);
+    int cmd, XEN_GUEST_HANDLE_PARAM(void) arg);
 
 extern long
 do_update_va_mapping_otherdomain(
@@ -81,9 +81,9 @@ do_update_va_mapping_otherdomain(
 
 extern long
 do_mmuext_op(
-    XEN_GUEST_HANDLE(mmuext_op_t) uops,
+    XEN_GUEST_HANDLE_PARAM(mmuext_op_t) uops,
     unsigned int count,
-    XEN_GUEST_HANDLE(uint) pdone,
+    XEN_GUEST_HANDLE_PARAM(uint) pdone,
     unsigned int foreigndom);
 
 extern unsigned long
@@ -104,10 +104,10 @@ do_set_segment_base(
 extern int
 compat_physdev_op(
     int cmd,
-    XEN_GUEST_HANDLE(void) arg);
+    XEN_GUEST_HANDLE_PARAM(void) arg);
 
 extern int
 arch_compat_vcpu_op(
-    int cmd, struct vcpu *v, XEN_GUEST_HANDLE(void) arg);
+    int cmd, struct vcpu *v, XEN_GUEST_HANDLE_PARAM(void) arg);
 
 #endif /* __ASM_X86_HYPERCALL_H__ */
diff --git a/xen/include/asm-x86/mem_event.h b/xen/include/asm-x86/mem_event.h
index 23d71c1..e17f36b 100644
--- a/xen/include/asm-x86/mem_event.h
+++ b/xen/include/asm-x86/mem_event.h
@@ -65,7 +65,7 @@ int mem_event_get_response(struct domain *d, struct mem_event_domain *med,
 struct domain *get_mem_event_op_target(uint32_t domain, int *rc);
 int do_mem_event_op(int op, uint32_t domain, void *arg);
 int mem_event_domctl(struct domain *d, xen_domctl_mem_event_op_t *mec,
-                     XEN_GUEST_HANDLE(void) u_domctl);
+                     XEN_GUEST_HANDLE_PARAM(void) u_domctl);
 
 #endif /* __MEM_EVENT_H__ */
 
diff --git a/xen/include/asm-x86/mm.h b/xen/include/asm-x86/mm.h
index 6e1e57c..494dad8 100644
--- a/xen/include/asm-x86/mm.h
+++ b/xen/include/asm-x86/mm.h
@@ -555,10 +555,10 @@ void *do_page_walk(struct vcpu *v, unsigned long addr);
 int __sync_local_execstate(void);
 
 /* Arch-specific portion of memory_op hypercall. */
-long arch_memory_op(int op, XEN_GUEST_HANDLE(void) arg);
-long subarch_memory_op(int op, XEN_GUEST_HANDLE(void) arg);
-int compat_arch_memory_op(int op, XEN_GUEST_HANDLE(void));
-int compat_subarch_memory_op(int op, XEN_GUEST_HANDLE(void));
+long arch_memory_op(int op, XEN_GUEST_HANDLE_PARAM(void) arg);
+long subarch_memory_op(int op, XEN_GUEST_HANDLE_PARAM(void) arg);
+int compat_arch_memory_op(int op, XEN_GUEST_HANDLE_PARAM(void));
+int compat_subarch_memory_op(int op, XEN_GUEST_HANDLE_PARAM(void));
 
 int steal_page(
     struct domain *d, struct page_info *page, unsigned int memflags);
diff --git a/xen/include/asm-x86/paging.h b/xen/include/asm-x86/paging.h
index d9b6950..9a40f2c 100644
--- a/xen/include/asm-x86/paging.h
+++ b/xen/include/asm-x86/paging.h
@@ -207,7 +207,7 @@ int paging_domain_init(struct domain *d, unsigned int domcr_flags);
  * and disable ephemeral shadow modes (test mode and log-dirty mode) and
  * manipulate the log-dirty bitmap. */
 int paging_domctl(struct domain *d, xen_domctl_shadow_op_t *sc,
-                  XEN_GUEST_HANDLE(void) u_domctl);
+                  XEN_GUEST_HANDLE_PARAM(void) u_domctl);
 
 /* Call when destroying a domain */
 void paging_teardown(struct domain *d);
diff --git a/xen/include/asm-x86/processor.h b/xen/include/asm-x86/processor.h
index c969b11..637cea3 100644
--- a/xen/include/asm-x86/processor.h
+++ b/xen/include/asm-x86/processor.h
@@ -549,7 +549,7 @@ int rdmsr_hypervisor_regs(uint32_t idx, uint64_t *val);
 int wrmsr_hypervisor_regs(uint32_t idx, uint64_t val);
 
 void microcode_set_module(unsigned int);
-int microcode_update(XEN_GUEST_HANDLE(const_void), unsigned long len);
+int microcode_update(XEN_GUEST_HANDLE_PARAM(const_void), unsigned long len);
 int microcode_resume_cpu(int cpu);
 
 #endif /* !__ASSEMBLY__ */
diff --git a/xen/include/asm-x86/shadow.h b/xen/include/asm-x86/shadow.h
index 88a8cd2..2eb6efc 100644
--- a/xen/include/asm-x86/shadow.h
+++ b/xen/include/asm-x86/shadow.h
@@ -73,7 +73,7 @@ int shadow_track_dirty_vram(struct domain *d,
  * manipulate the log-dirty bitmap. */
 int shadow_domctl(struct domain *d, 
                   xen_domctl_shadow_op_t *sc,
-                  XEN_GUEST_HANDLE(void) u_domctl);
+                  XEN_GUEST_HANDLE_PARAM(void) u_domctl);
 
 /* Call when destroying a domain */
 void shadow_teardown(struct domain *d);
diff --git a/xen/include/asm-x86/xenoprof.h b/xen/include/asm-x86/xenoprof.h
index a71f020..52a6881 100644
--- a/xen/include/asm-x86/xenoprof.h
+++ b/xen/include/asm-x86/xenoprof.h
@@ -40,9 +40,9 @@ int xenoprof_arch_init(int *num_events, char *cpu_type);
 #define xenoprof_arch_disable_virq()            nmi_disable_virq()
 #define xenoprof_arch_release_counters()        nmi_release_counters()
 
-int xenoprof_arch_counter(XEN_GUEST_HANDLE(void) arg);
-int compat_oprof_arch_counter(XEN_GUEST_HANDLE(void) arg);
-int xenoprof_arch_ibs_counter(XEN_GUEST_HANDLE(void) arg);
+int xenoprof_arch_counter(XEN_GUEST_HANDLE_PARAM(void) arg);
+int compat_oprof_arch_counter(XEN_GUEST_HANDLE_PARAM(void) arg);
+int xenoprof_arch_ibs_counter(XEN_GUEST_HANDLE_PARAM(void) arg);
 
 struct vcpu;
 struct cpu_user_regs;
diff --git a/xen/include/public/tmem.h b/xen/include/public/tmem.h
index 74bd1c6..7bd29ba 100644
--- a/xen/include/public/tmem.h
+++ b/xen/include/public/tmem.h
@@ -96,7 +96,7 @@
 
 #ifndef __ASSEMBLY__
 typedef xen_pfn_t tmem_cli_mfn_t;
-typedef XEN_GUEST_HANDLE(char) tmem_cli_va_t;
+typedef XEN_GUEST_HANDLE_PARAM(char) tmem_cli_va_t;
 struct tmem_op {
     uint32_t cmd;
     int32_t pool_id;
diff --git a/xen/include/xen/acpi.h b/xen/include/xen/acpi.h
index d7e2f94..8f3cdca 100644
--- a/xen/include/xen/acpi.h
+++ b/xen/include/xen/acpi.h
@@ -145,8 +145,8 @@ static inline unsigned int acpi_get_cstate_limit(void) { return 0; }
 static inline void acpi_set_cstate_limit(unsigned int new_limit) { return; }
 #endif
 
-#ifdef XEN_GUEST_HANDLE
-int acpi_set_pdc_bits(u32 acpi_id, XEN_GUEST_HANDLE(uint32));
+#ifdef XEN_GUEST_HANDLE_PARAM
+int acpi_set_pdc_bits(u32 acpi_id, XEN_GUEST_HANDLE_PARAM(uint32));
 #endif
 int arch_acpi_set_pdc_bits(u32 acpi_id, u32 *, u32 mask);
 
diff --git a/xen/include/xen/hypercall.h b/xen/include/xen/hypercall.h
index 1b71071..e315523 100644
--- a/xen/include/xen/hypercall.h
+++ b/xen/include/xen/hypercall.h
@@ -29,29 +29,29 @@ do_sched_op_compat(
 extern long
 do_sched_op(
     int cmd,
-    XEN_GUEST_HANDLE(void) arg);
+    XEN_GUEST_HANDLE_PARAM(void) arg);
 
 extern long
 do_domctl(
-    XEN_GUEST_HANDLE(xen_domctl_t) u_domctl);
+    XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl);
 
 extern long
 arch_do_domctl(
     struct xen_domctl *domctl,
-    XEN_GUEST_HANDLE(xen_domctl_t) u_domctl);
+    XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl);
 
 extern long
 do_sysctl(
-    XEN_GUEST_HANDLE(xen_sysctl_t) u_sysctl);
+    XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl);
 
 extern long
 arch_do_sysctl(
     struct xen_sysctl *sysctl,
-    XEN_GUEST_HANDLE(xen_sysctl_t) u_sysctl);
+    XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl);
 
 extern long
 do_platform_op(
-    XEN_GUEST_HANDLE(xen_platform_op_t) u_xenpf_op);
+    XEN_GUEST_HANDLE_PARAM(xen_platform_op_t) u_xenpf_op);
 
 /*
  * To allow safe resume of do_memory_op() after preemption, we need to know
@@ -64,11 +64,11 @@ do_platform_op(
 extern long
 do_memory_op(
     unsigned long cmd,
-    XEN_GUEST_HANDLE(void) arg);
+    XEN_GUEST_HANDLE_PARAM(void) arg);
 
 extern long
 do_multicall(
-    XEN_GUEST_HANDLE(multicall_entry_t) call_list,
+    XEN_GUEST_HANDLE_PARAM(multicall_entry_t) call_list,
     unsigned int nr_calls);
 
 extern long
@@ -77,23 +77,23 @@ do_set_timer_op(
 
 extern long
 do_event_channel_op(
-    int cmd, XEN_GUEST_HANDLE(void) arg);
+    int cmd, XEN_GUEST_HANDLE_PARAM(void) arg);
 
 extern long
 do_xen_version(
     int cmd,
-    XEN_GUEST_HANDLE(void) arg);
+    XEN_GUEST_HANDLE_PARAM(void) arg);
 
 extern long
 do_console_io(
     int cmd,
     int count,
-    XEN_GUEST_HANDLE(char) buffer);
+    XEN_GUEST_HANDLE_PARAM(char) buffer);
 
 extern long
 do_grant_table_op(
     unsigned int cmd,
-    XEN_GUEST_HANDLE(void) uop,
+    XEN_GUEST_HANDLE_PARAM(void) uop,
     unsigned int count);
 
 extern long
@@ -105,72 +105,72 @@ extern long
 do_vcpu_op(
     int cmd,
     int vcpuid,
-    XEN_GUEST_HANDLE(void) arg);
+    XEN_GUEST_HANDLE_PARAM(void) arg);
 
 struct vcpu;
 extern long
 arch_do_vcpu_op(int cmd,
     struct vcpu *v,
-    XEN_GUEST_HANDLE(void) arg);
+    XEN_GUEST_HANDLE_PARAM(void) arg);
 
 extern long
 do_nmi_op(
     unsigned int cmd,
-    XEN_GUEST_HANDLE(void) arg);
+    XEN_GUEST_HANDLE_PARAM(void) arg);
 
 extern long
 do_hvm_op(
     unsigned long op,
-    XEN_GUEST_HANDLE(void) arg);
+    XEN_GUEST_HANDLE_PARAM(void) arg);
 
 extern long
 do_kexec_op(
     unsigned long op,
     int arg1,
-    XEN_GUEST_HANDLE(void) arg);
+    XEN_GUEST_HANDLE_PARAM(void) arg);
 
 extern long
 do_xsm_op(
-    XEN_GUEST_HANDLE(xsm_op_t) u_xsm_op);
+    XEN_GUEST_HANDLE_PARAM(xsm_op_t) u_xsm_op);
 
 extern long
 do_tmem_op(
-    XEN_GUEST_HANDLE(tmem_op_t) uops);
+    XEN_GUEST_HANDLE_PARAM(tmem_op_t) uops);
 
 extern long
-do_xenoprof_op(int op, XEN_GUEST_HANDLE(void) arg);
+do_xenoprof_op(int op, XEN_GUEST_HANDLE_PARAM(void) arg);
 
 #ifdef CONFIG_COMPAT
 
 extern int
 compat_memory_op(
     unsigned int cmd,
-    XEN_GUEST_HANDLE(void) arg);
+    XEN_GUEST_HANDLE_PARAM(void) arg);
 
 extern int
 compat_grant_table_op(
     unsigned int cmd,
-    XEN_GUEST_HANDLE(void) uop,
+    XEN_GUEST_HANDLE_PARAM(void) uop,
     unsigned int count);
 
 extern int
 compat_vcpu_op(
     int cmd,
     int vcpuid,
-    XEN_GUEST_HANDLE(void) arg);
+    XEN_GUEST_HANDLE_PARAM(void) arg);
 
 extern int
-compat_xenoprof_op(int op, XEN_GUEST_HANDLE(void) arg);
+compat_xenoprof_op(int op, XEN_GUEST_HANDLE_PARAM(void) arg);
 
 extern int
 compat_xen_version(
     int cmd,
-    XEN_GUEST_HANDLE(void) arg);
+    XEN_GUEST_HANDLE_PARAM(void) arg);
 
 extern int
 compat_sched_op(
     int cmd,
-    XEN_GUEST_HANDLE(void) arg);
+    XEN_GUEST_HANDLE_PARAM(void) arg);
 
 extern int
 compat_set_timer_op(
diff --git a/xen/include/xen/iommu.h b/xen/include/xen/iommu.h
index 605c7b3..773a6d7 100644
--- a/xen/include/xen/iommu.h
+++ b/xen/include/xen/iommu.h
@@ -156,7 +156,7 @@ void iommu_crash_shutdown(void);
 void iommu_set_dom0_mapping(struct domain *d);
 void iommu_share_p2m_table(struct domain *d);
 
-int iommu_do_domctl(struct xen_domctl *, XEN_GUEST_HANDLE(xen_domctl_t));
+int iommu_do_domctl(struct xen_domctl *, XEN_GUEST_HANDLE_PARAM(xen_domctl_t));
 
 void iommu_iotlb_flush(struct domain *d, unsigned long gfn, unsigned int page_count);
 void iommu_iotlb_flush_all(struct domain *d);
diff --git a/xen/include/xen/tmem_xen.h b/xen/include/xen/tmem_xen.h
index 9492810..c31220a 100644
--- a/xen/include/xen/tmem_xen.h
+++ b/xen/include/xen/tmem_xen.h
@@ -430,7 +430,7 @@ static inline void tmh_tze_copy_from_pfp(void *tva, pfp_t *pfp, pagesize_t len)
 typedef XEN_GUEST_HANDLE(void) cli_mfn_t;
 typedef XEN_GUEST_HANDLE(char) cli_va_t;
 */
-typedef XEN_GUEST_HANDLE(tmem_op_t) tmem_cli_op_t;
+typedef XEN_GUEST_HANDLE_PARAM(tmem_op_t) tmem_cli_op_t;
 
 static inline int tmh_get_tmemop_from_client(tmem_op_t *op, tmem_cli_op_t uops)
 {
diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h
index 593cdbd..a949c1e 100644
--- a/xen/include/xsm/xsm.h
+++ b/xen/include/xsm/xsm.h
@@ -139,7 +139,7 @@ struct xsm_operations {
     int (*cpupool_op)(void);
     int (*sched_op)(void);
 
-    long (*__do_xsm_op) (XEN_GUEST_HANDLE(xsm_op_t) op);
+    long (*__do_xsm_op) (XEN_GUEST_HANDLE_PARAM(xsm_op_t) op);
 
 #ifdef CONFIG_X86
     int (*shadow_control) (struct domain *d, uint32_t op);
@@ -585,7 +585,7 @@ static inline int xsm_sched_op(void)
     return xsm_call(sched_op());
 }
 
-static inline long __do_xsm_op (XEN_GUEST_HANDLE(xsm_op_t) op)
+static inline long __do_xsm_op (XEN_GUEST_HANDLE_PARAM(xsm_op_t) op)
 {
 #ifdef XSM_ENABLE
     return xsm_ops->__do_xsm_op(op);
diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c
index 4836fc0..b726eaf6 100644
--- a/xen/xsm/dummy.c
+++ b/xen/xsm/dummy.c
@@ -380,7 +380,7 @@ static int dummy_sched_op (void)
     return 0;
 }
 
-static long dummy___do_xsm_op(XEN_GUEST_HANDLE(xsm_op_t) op)
+static long dummy___do_xsm_op(XEN_GUEST_HANDLE_PARAM(xsm_op_t) op)
 {
     return -ENOSYS;
 }
diff --git a/xen/xsm/flask/flask_op.c b/xen/xsm/flask/flask_op.c
index 9c8dfe7..a5d7748 100644
--- a/xen/xsm/flask/flask_op.c
+++ b/xen/xsm/flask/flask_op.c
@@ -71,7 +71,7 @@ static int domain_has_security(struct domain *d, u32 perms)
                         perms, NULL);
 }
 
-static int flask_copyin_string(XEN_GUEST_HANDLE(char) u_buf, char **buf, uint32_t size)
+static int flask_copyin_string(XEN_GUEST_HANDLE_PARAM(char) u_buf, char **buf, uint32_t size)
 {
     char *tmp = xmalloc_bytes(size + 1);
     if ( !tmp )
@@ -618,7 +618,7 @@ static int flask_relabel_domain(struct xen_flask_relabel *arg)
     return rc;
 }
 
-long do_flask_op(XEN_GUEST_HANDLE(xsm_op_t) u_flask_op)
+long do_flask_op(XEN_GUEST_HANDLE_PARAM(xsm_op_t) u_flask_op)
 {
     xen_flask_op_t op;
     int rv;
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index 88fef9c..0ca10d0 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -1462,7 +1462,7 @@ static int flask_vcpuextstate (struct domain *d, uint32_t cmd)
 }
 #endif
 
-long do_flask_op(XEN_GUEST_HANDLE(xsm_op_t) u_flask_op);
+long do_flask_op(XEN_GUEST_HANDLE_PARAM(xsm_op_t) u_flask_op);
 
 static struct xsm_operations flask_ops = {
     .security_domaininfo = flask_security_domaininfo,
diff --git a/xen/xsm/xsm_core.c b/xen/xsm/xsm_core.c
index 96c8669..46287cb 100644
--- a/xen/xsm/xsm_core.c
+++ b/xen/xsm/xsm_core.c
@@ -111,7 +111,7 @@ int unregister_xsm(struct xsm_operations *ops)
 
 #endif
 
-long do_xsm_op (XEN_GUEST_HANDLE(xsm_op_t) op)
+long do_xsm_op (XEN_GUEST_HANDLE_PARAM(xsm_op_t) op)
 {
     return __do_xsm_op(op);
 }
-- 
1.7.9.1

[PATCH 21/21] xen: more substitutions

[Ian Campbell]

From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

More substitutions in this patch, not as obvious as the ones in the
previous patch.

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Cc: keir@xen.org
Cc: JBeulich@suse.com
---
 xen/arch/x86/mm.c                        |   12 +++++++++---
 xen/arch/x86/oprofile/backtrace.c        |    4 +++-
 xen/arch/x86/platform_hypercall.c        |    8 ++++++--
 xen/arch/x86/x86_64/cpu_idle.c           |    4 +++-
 xen/arch/x86/x86_64/cpufreq.c            |    4 +++-
 xen/arch/x86/x86_64/platform_hypercall.c |    1 +
 xen/common/compat/multicall.c            |    1 +
 7 files changed, 26 insertions(+), 8 deletions(-)

diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
index 9a828de..f9a41fd 100644
--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -2913,7 +2913,9 @@ long do_mmuext_op(
         {
             cpumask_t pmask;
 
-            if ( unlikely(vcpumask_to_pcpumask(d, op.arg2.vcpumask, &pmask)) )
+            if ( unlikely(vcpumask_to_pcpumask(d,
+                            guest_handle_to_param(op.arg2.vcpumask, const_void),
+                            &pmask)) )
             {
                 okay = 0;
                 break;
@@ -4195,6 +4197,7 @@ static int handle_iomem_range(unsigned long s, unsigned long e, void *p)
     if ( s > ctxt->s )
     {
         e820entry_t ent;
+        XEN_GUEST_HANDLE_PARAM(e820entry_t) buffer_t;
         XEN_GUEST_HANDLE(e820entry_t) buffer;
 
         if ( ctxt->n + 1 >= ctxt->map.nr_entries )
@@ -4202,7 +4205,8 @@ static int handle_iomem_range(unsigned long s, unsigned long e, void *p)
         ent.addr = (uint64_t)ctxt->s << PAGE_SHIFT;
         ent.size = (uint64_t)(s - ctxt->s) << PAGE_SHIFT;
         ent.type = E820_RESERVED;
-        buffer = guest_handle_cast(ctxt->map.buffer, e820entry_t);
+        buffer_t = guest_handle_cast(ctxt->map.buffer, e820entry_t);
+        buffer = guest_handle_from_param(buffer_t, e820entry_t);
         if ( __copy_to_guest_offset(buffer, ctxt->n, &ent, 1) )
             return -EFAULT;
         ctxt->n++;
@@ -4499,6 +4503,7 @@ long arch_memory_op(int op, XEN_GUEST_HANDLE_PARAM(void) arg)
     {
         struct memory_map_context ctxt;
         XEN_GUEST_HANDLE(e820entry_t) buffer;
+        XEN_GUEST_HANDLE_PARAM(e820entry_t) buffer_t;
         unsigned int i;
 
         if ( !IS_PRIV(current->domain) )
@@ -4513,7 +4518,8 @@ long arch_memory_op(int op, XEN_GUEST_HANDLE_PARAM(void) arg)
         if ( ctxt.map.nr_entries < e820.nr_map + 1 )
             return -EINVAL;
 
-        buffer = guest_handle_cast(ctxt.map.buffer, e820entry_t);
+        buffer_t = guest_handle_cast(ctxt.map.buffer, e820entry_t);
+        buffer = guest_handle_from_param(buffer_t, e820entry_t);
         if ( !guest_handle_okay(buffer, ctxt.map.nr_entries) )
             return -EFAULT;
 
diff --git a/xen/arch/x86/oprofile/backtrace.c b/xen/arch/x86/oprofile/backtrace.c
index 433f881..6924385 100644
--- a/xen/arch/x86/oprofile/backtrace.c
+++ b/xen/arch/x86/oprofile/backtrace.c
@@ -74,8 +74,10 @@ dump_guest_backtrace(struct vcpu *vcpu, const struct frame_head *head,
     }
     else
     {
-        XEN_GUEST_HANDLE(const_frame_head_t) guest_head =
+        XEN_GUEST_HANDLE(const_frame_head_t) guest_head;
+        XEN_GUEST_HANDLE_PARAM(const_frame_head_t) guest_head_t =
             const_guest_handle_from_ptr(head, frame_head_t);
+        guest_head = guest_handle_from_param(guest_head_t, const_frame_head_t);
 
         /* Also check accessibility of one struct frame_head beyond */
         if (!guest_handle_okay(guest_head, 2))
diff --git a/xen/arch/x86/platform_hypercall.c b/xen/arch/x86/platform_hypercall.c
index 7a7325f..a3b5a6b 100644
--- a/xen/arch/x86/platform_hypercall.c
+++ b/xen/arch/x86/platform_hypercall.c
@@ -186,7 +186,9 @@ ret_t do_platform_op(XEN_GUEST_HANDLE_PARAM(xen_platform_op_t) u_xenpf_op)
             }
         }
 
-        ret = microcode_update(data, op->u.microcode.length);
+        ret = microcode_update(
+                guest_handle_to_param(data, const_void),
+                op->u.microcode.length);
         spin_unlock(&vcpu_alloc_lock);
     }
     break;
@@ -454,7 +456,9 @@ ret_t do_platform_op(XEN_GUEST_HANDLE_PARAM(xen_platform_op_t) u_xenpf_op)
             XEN_GUEST_HANDLE(uint32) pdc;
 
             guest_from_compat_handle(pdc, op->u.set_pminfo.u.pdc);
-            ret = acpi_set_pdc_bits(op->u.set_pminfo.id, pdc);
+            ret = acpi_set_pdc_bits(
+                    op->u.set_pminfo.id,
+                    guest_handle_to_param(pdc, uint32));
         }
         break;
 
diff --git a/xen/arch/x86/x86_64/cpu_idle.c b/xen/arch/x86/x86_64/cpu_idle.c
index 3e7422f..1cdaf96 100644
--- a/xen/arch/x86/x86_64/cpu_idle.c
+++ b/xen/arch/x86/x86_64/cpu_idle.c
@@ -57,10 +57,12 @@ static int copy_from_compat_state(xen_processor_cx_t *xen_state,
 {
 #define XLAT_processor_cx_HNDL_dp(_d_, _s_) do { \
     XEN_GUEST_HANDLE(compat_processor_csd_t) dps; \
+    XEN_GUEST_HANDLE_PARAM(xen_processor_csd_t) dps_t; \
     if ( unlikely(!compat_handle_okay((_s_)->dp, (_s_)->dpcnt)) ) \
             return -EFAULT; \
     guest_from_compat_handle(dps, (_s_)->dp); \
-    (_d_)->dp = guest_handle_cast(dps, xen_processor_csd_t); \
+    dps_t = guest_handle_cast(dps, xen_processor_csd_t); \
+    (_d_)->dp = guest_handle_from_param(dps_t, xen_processor_csd_t); \
 } while (0)
     XLAT_processor_cx(xen_state, state);
 #undef XLAT_processor_cx_HNDL_dp
diff --git a/xen/arch/x86/x86_64/cpufreq.c b/xen/arch/x86/x86_64/cpufreq.c
index ce9864e..1956777 100644
--- a/xen/arch/x86/x86_64/cpufreq.c
+++ b/xen/arch/x86/x86_64/cpufreq.c
@@ -45,10 +45,12 @@ compat_set_px_pminfo(uint32_t cpu, struct compat_processor_performance *perf)
 
 #define XLAT_processor_performance_HNDL_states(_d_, _s_) do { \
     XEN_GUEST_HANDLE(compat_processor_px_t) states; \
+    XEN_GUEST_HANDLE_PARAM(xen_processor_px_t) states_t; \
     if ( unlikely(!compat_handle_okay((_s_)->states, (_s_)->state_count)) ) \
         return -EFAULT; \
     guest_from_compat_handle(states, (_s_)->states); \
-    (_d_)->states = guest_handle_cast(states, xen_processor_px_t); \
+    states_t = guest_handle_cast(states, xen_processor_px_t); \
+    (_d_)->states = guest_handle_from_param(states_t, xen_processor_px_t); \
 } while (0)
 
     XLAT_processor_performance(xen_perf, perf);
diff --git a/xen/arch/x86/x86_64/platform_hypercall.c b/xen/arch/x86/x86_64/platform_hypercall.c
index 188aa37..f577761 100644
--- a/xen/arch/x86/x86_64/platform_hypercall.c
+++ b/xen/arch/x86/x86_64/platform_hypercall.c
@@ -38,6 +38,7 @@ CHECK_pf_pcpu_version;
 
 #define COMPAT
 #define _XEN_GUEST_HANDLE(t) XEN_GUEST_HANDLE(t)
+#define _XEN_GUEST_HANDLE_PARAM(t) XEN_GUEST_HANDLE(t)
 typedef int ret_t;
 
 #include "../platform_hypercall.c"
diff --git a/xen/common/compat/multicall.c b/xen/common/compat/multicall.c
index e7e2a40..3219d3c 100644
--- a/xen/common/compat/multicall.c
+++ b/xen/common/compat/multicall.c
@@ -25,6 +25,7 @@ DEFINE_XEN_GUEST_HANDLE(multicall_entry_compat_t);
 #define call                 compat_call
 #define do_multicall(l, n)   compat_multicall(_##l, n)
 #define _XEN_GUEST_HANDLE(t) XEN_GUEST_HANDLE(t)
+#define _XEN_GUEST_HANDLE_PARAM(t) XEN_GUEST_HANDLE(t)
 
 static void __trace_multicall_call(multicall_entry_t *call)
 {
-- 
1.7.9.1

Re: [PATCH 17/21] xen: xen_ulong_t substitution

[Jan Beulich]

>>> On 05.10.12 at 12:38, Ian Campbell <ian.campbell@citrix.com> wrote:
> --- a/tools/python/xen/lowlevel/xc/xc.c
> +++ b/tools/python/xen/lowlevel/xc/xc.c
> @@ -1439,7 +1439,7 @@ static PyObject *pyxc_xeninfo(XcObject *self)
>      if ( xc_version(self->xc_handle, XENVER_commandline, &xen_commandline) != 0 )
>          return pyxc_error_to_exception(self->xc_handle);
>  
> -    snprintf(str, sizeof(str), "virt_start=0x%lx", p_parms.virt_start);
> +    snprintf(str, sizeof(str), "virt_start=0x%"PRI_xen_ulong, p_parms.virt_start);

Does that build on x86? I ask because ...

>  
>      xen_pagesize = xc_version(self->xc_handle, XENVER_pagesize, NULL);
>      if (xen_pagesize < 0 )
> diff --git a/xen/include/public/arch-arm.h b/xen/include/public/arch-arm.h
> index e3d4ad9..2ae6548 100644
> --- a/xen/include/public/arch-arm.h
> +++ b/xen/include/public/arch-arm.h
> @@ -122,7 +122,8 @@ typedef uint64_t xen_pfn_t;
>  /* Only one. All other VCPUS must use VCPUOP_register_vcpu_info */
>  #define XEN_LEGACY_MAX_VCPUS 1
>  
> -typedef uint32_t xen_ulong_t;
> +typedef uint64_t xen_ulong_t;
> +#define PRI_xen_ulong PRIx64

... this doesn't seem to have an x86 counterpart.

Jan

>  
>  struct vcpu_guest_context {
>  #define _VGCF_online                   0
> diff --git a/xen/include/public/version.h b/xen/include/public/version.h
> index 8742c2b..c7e6f8c 100644
> --- a/xen/include/public/version.h
> +++ b/xen/include/public/version.h
> @@ -28,6 +28,8 @@
>  #ifndef __XEN_PUBLIC_VERSION_H__
>  #define __XEN_PUBLIC_VERSION_H__
>  
> +#include "xen.h"
> +
>  /* NB. All ops return zero on success, except XENVER_{version,pagesize} */
>  
>  /* arg == NULL; returns major:minor (16:16). */
> @@ -58,7 +60,7 @@ typedef char xen_changeset_info_t[64];
>  
>  #define XENVER_platform_parameters 5
>  struct xen_platform_parameters {
> -    unsigned long virt_start;
> +    xen_ulong_t virt_start;
>  };
>  typedef struct xen_platform_parameters xen_platform_parameters_t;
>  
> -- 
> 1.7.9.1

Re: [PATCH 18/21] xen: change the limit of nr_extents to UINT_MAX >> MEMOP_EXTENT_SHIFT

[Jan Beulich]

>>> On 05.10.12 at 12:38, Ian Campbell <ian.campbell@citrix.com> wrote:
> From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
> 
> Currently do_memory_op has a different maximum limit for nr_extents on
> 32 bit and 64 bit.
> Change the limit to UINT_MAX >> MEMOP_EXTENT_SHIFT, so that it is the
> same in both cases.

As said before, this looks fine to me, but will need Keir's ack
anyway for you to apply it (but feel free to stick my ack onto
it anyway if you like). Plus it really is entirely independent of
the rest of the series, so doesn't need to wait for any other
eventual issues to be resolved.

Jan

> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
> Cc: keir@xen.org 
> Cc: JBeulich@suse.com 
> ---
>  xen/common/memory.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/xen/common/memory.c b/xen/common/memory.c
> index 5bcb035..401d06c 100644
> --- a/xen/common/memory.c
> +++ b/xen/common/memory.c
> @@ -540,7 +540,7 @@ long do_memory_op(unsigned long cmd, 
> XEN_GUEST_HANDLE(void) arg)
>              return start_extent;
>  
>          /* Is size too large for us to encode a continuation? */
> -        if ( reservation.nr_extents > (ULONG_MAX >> MEMOP_EXTENT_SHIFT) )
> +        if ( reservation.nr_extents > (UINT_MAX >> MEMOP_EXTENT_SHIFT) )
>              return start_extent;
>  
>          if ( unlikely(start_extent >= reservation.nr_extents) )
> -- 
> 1.7.9.1

Re: [PATCH 17/21] xen: xen_ulong_t substitution

[Ian Campbell]

On Fri, 2012-10-05 at 12:00 +0100, Jan Beulich wrote:
> >>> On 05.10.12 at 12:38, Ian Campbell <ian.campbell@citrix.com> wrote:
> > --- a/tools/python/xen/lowlevel/xc/xc.c
> > +++ b/tools/python/xen/lowlevel/xc/xc.c
> > @@ -1439,7 +1439,7 @@ static PyObject *pyxc_xeninfo(XcObject *self)
> >      if ( xc_version(self->xc_handle, XENVER_commandline, &xen_commandline) != 0 )
> >          return pyxc_error_to_exception(self->xc_handle);
> >  
> > -    snprintf(str, sizeof(str), "virt_start=0x%lx", p_parms.virt_start);
> > +    snprintf(str, sizeof(str), "virt_start=0x%"PRI_xen_ulong, p_parms.virt_start);
> 
> Does that build on x86? I ask because ...

I appear to have forgotten to build test the tools side on x86, which
was remiss of me.

> >  
> >      xen_pagesize = xc_version(self->xc_handle, XENVER_pagesize, NULL);
> >      if (xen_pagesize < 0 )
> > diff --git a/xen/include/public/arch-arm.h b/xen/include/public/arch-arm.h
> > index e3d4ad9..2ae6548 100644
> > --- a/xen/include/public/arch-arm.h
> > +++ b/xen/include/public/arch-arm.h
> > @@ -122,7 +122,8 @@ typedef uint64_t xen_pfn_t;
> >  /* Only one. All other VCPUS must use VCPUOP_register_vcpu_info */
> >  #define XEN_LEGACY_MAX_VCPUS 1
> >  
> > -typedef uint32_t xen_ulong_t;
> > +typedef uint64_t xen_ulong_t;
> > +#define PRI_xen_ulong PRIx64
> 
> ... this doesn't seem to have an x86 counterpart.

Indeed, I haven't tried but I'm sure it must be broken on x86.

Ian.

Re: [PATCH 18/21] xen: change the limit of nr_extents to UINT_MAX >> MEMOP_EXTENT_SHIFT

[Ian Campbell]

On Fri, 2012-10-05 at 12:02 +0100, Jan Beulich wrote:
> >>> On 05.10.12 at 12:38, Ian Campbell <ian.campbell@citrix.com> wrote:
> > From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
> > 
> > Currently do_memory_op has a different maximum limit for nr_extents on
> > 32 bit and 64 bit.
> > Change the limit to UINT_MAX >> MEMOP_EXTENT_SHIFT, so that it is the
> > same in both cases.
> 
> As said before, this looks fine to me,

sorry, I seem to have missed your previous reply.
> but will need Keir's ack
> anyway for you to apply it (but feel free to stick my ack onto
> it anyway if you like). Plus it really is entirely independent of
> the rest of the series, so doesn't need to wait for any other
> eventual issues to be resolved.

OK, thanks.

Ian.

Re: [PATCH 19/21] xen: introduce XEN_GUEST_HANDLE_PARAM

[Jan Beulich]

>>> On 05.10.12 at 12:38, Ian Campbell <ian.campbell@citrix.com> wrote:
> From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
> 
> XEN_GUEST_HANDLE_PARAM is going to be used to distinguish guest pointers
> stored in memory from guest pointers as hypercall parameters.
> 
> guest_handle_* macros default to XEN_GUEST_HANDLE_PARAM as return type.
> Two new guest_handle_to_param and guest_handle_from_param macros are
> introduced to do conversions.
> 
> Changes in v2:
> 
> - add 2 missing #define _XEN_GUEST_HANDLE_PARAM for the compilation of
> the compat code.
> 
> Changes in v3:
> 
> - move the guest_handle_cast change into this patch;
> - add a clear comment on top of guest_handle_cast;
> - also s/XEN_GUEST_HANDLE/XEN_GUEST_HANDLE_PARAM in
>   guest_handle_from_ptr and const_guest_handle_from_ptr;
> - introduce guest_handle_from_param and guest_handle_to_param.

I may have asked this before, but don't recall the answer: Is there
really a use case for conversions in both directions? I would think
that only the "to" version is really useful...

Jan

Re: [PATCH 20/21] xen: replace XEN_GUEST_HANDLE with XEN_GUEST_HANDLE_PARAM when appropriate

[Jan Beulich]

>>> On 05.10.12 at 12:38, Ian Campbell <ian.campbell@citrix.com> wrote:
> From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
> 
> Note: these changes don't make any difference on x86 and ia64.

ia64?

Re: [PATCH 21/21] xen: more substitutions

[Jan Beulich]

>>> On 05.10.12 at 12:38, Ian Campbell <ian.campbell@citrix.com> wrote:
> @@ -4195,6 +4197,7 @@ static int handle_iomem_range(unsigned long s, unsigned long e, void *p)
>      if ( s > ctxt->s )
>      {
>          e820entry_t ent;
> +        XEN_GUEST_HANDLE_PARAM(e820entry_t) buffer_t;

I'm not really in favor fo the _t suffix chosen here and below, as
that's generally used for typedef-s. Could this be replaced with
e.g. _p, _h, or _hp?

Jan

Re: [PATCH 19/21] xen: introduce XEN_GUEST_HANDLE_PARAM

[Ian Campbell]

On Fri, 2012-10-05 at 12:05 +0100, Jan Beulich wrote:
> >>> On 05.10.12 at 12:38, Ian Campbell <ian.campbell@citrix.com> wrote:
> > From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
> > 
> > XEN_GUEST_HANDLE_PARAM is going to be used to distinguish guest pointers
> > stored in memory from guest pointers as hypercall parameters.
> > 
> > guest_handle_* macros default to XEN_GUEST_HANDLE_PARAM as return type.
> > Two new guest_handle_to_param and guest_handle_from_param macros are
> > introduced to do conversions.
> > 
> > Changes in v2:
> > 
> > - add 2 missing #define _XEN_GUEST_HANDLE_PARAM for the compilation of
> > the compat code.
> > 
> > Changes in v3:
> > 
> > - move the guest_handle_cast change into this patch;
> > - add a clear comment on top of guest_handle_cast;
> > - also s/XEN_GUEST_HANDLE/XEN_GUEST_HANDLE_PARAM in
> >   guest_handle_from_ptr and const_guest_handle_from_ptr;
> > - introduce guest_handle_from_param and guest_handle_to_param.
> 
> I may have asked this before, but don't recall the answer: Is there
> really a use case for conversions in both directions? I would think
> that only the "to" version is really useful...

I can see uses of both in the patched tree. e.g. the from case is used
in handle_iomem_range on x86.

Ian.

Re: [PATCH 21/21] xen: more substitutions

[Ian Campbell]

On Fri, 2012-10-05 at 12:09 +0100, Jan Beulich wrote:
> >>> On 05.10.12 at 12:38, Ian Campbell <ian.campbell@citrix.com> wrote:
> > @@ -4195,6 +4197,7 @@ static int handle_iomem_range(unsigned long s, unsigned long e, void *p)
> >      if ( s > ctxt->s )
> >      {
> >          e820entry_t ent;
> > +        XEN_GUEST_HANDLE_PARAM(e820entry_t) buffer_t;
> 
> I'm not really in favor fo the _t suffix chosen here and below, as
> that's generally used for typedef-s. Could this be replaced with
> e.g. _p, _h, or _hp?

The use is 
        buffer_t = guest_handle_cast(ctxt->map.buffer, e820entry_t);
        buffer = guest_handle_from_param(buffer_t, e820entry_t);
which seems a bit strange to me -- we launder through buffer_t solely to
use guest_handle_from_param. Is there no macro which does that in one
step?

That would avoid the whole problem of the suffix choice.

Also buffer is then passed to __copy_to_guest_offset, and I'm not sure
why that can't be passed ctxt->map.buffer directly rather than
laundering it through those two macros...

Stefano?

Ian.

Re: [PATCH 19/21] xen: introduce XEN_GUEST_HANDLE_PARAM

[Jan Beulich]

>>> On 05.10.12 at 13:09, Ian Campbell <Ian.Campbell@citrix.com> wrote:
> On Fri, 2012-10-05 at 12:05 +0100, Jan Beulich wrote:
>> >>> On 05.10.12 at 12:38, Ian Campbell <ian.campbell@citrix.com> wrote:
>> > From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
>> > 
>> > XEN_GUEST_HANDLE_PARAM is going to be used to distinguish guest pointers
>> > stored in memory from guest pointers as hypercall parameters.
>> > 
>> > guest_handle_* macros default to XEN_GUEST_HANDLE_PARAM as return type.
>> > Two new guest_handle_to_param and guest_handle_from_param macros are
>> > introduced to do conversions.
>> > 
>> > Changes in v2:
>> > 
>> > - add 2 missing #define _XEN_GUEST_HANDLE_PARAM for the compilation of
>> > the compat code.
>> > 
>> > Changes in v3:
>> > 
>> > - move the guest_handle_cast change into this patch;
>> > - add a clear comment on top of guest_handle_cast;
>> > - also s/XEN_GUEST_HANDLE/XEN_GUEST_HANDLE_PARAM in
>> >   guest_handle_from_ptr and const_guest_handle_from_ptr;
>> > - introduce guest_handle_from_param and guest_handle_to_param.
>> 
>> I may have asked this before, but don't recall the answer: Is there
>> really a use case for conversions in both directions? I would think
>> that only the "to" version is really useful...
> 
> I can see uses of both in the patched tree. e.g. the from case is used
> in handle_iomem_range on x86.

Hmm, indeed. But I don't see why, so let me comment there instead.

Jan

Re: [PATCH 19/21] xen: introduce XEN_GUEST_HANDLE_PARAM

[Ian Campbell]

On Fri, 2012-10-05 at 12:20 +0100, Jan Beulich wrote:
> >>> On 05.10.12 at 13:09, Ian Campbell <Ian.Campbell@citrix.com> wrote:
> > I can see uses of both in the patched tree. e.g. the from case is used
> > in handle_iomem_range on x86.
> 
> Hmm, indeed. But I don't see why, so let me comment there instead.

I suspect I just made the same observation in the subthread about the
"buffer_t" variable that you are about to make.

Ian.

Re: [PATCH 21/21] xen: more substitutions

[Jan Beulich]

>>> On 05.10.12 at 12:38, Ian Campbell <ian.campbell@citrix.com> wrote:
> @@ -4202,7 +4205,8 @@ static int handle_iomem_range(unsigned long s, unsigned long e, void *p)
>          ent.addr = (uint64_t)ctxt->s << PAGE_SHIFT;
>          ent.size = (uint64_t)(s - ctxt->s) << PAGE_SHIFT;
>          ent.type = E820_RESERVED;
> -        buffer = guest_handle_cast(ctxt->map.buffer, e820entry_t);
> +        buffer_t = guest_handle_cast(ctxt->map.buffer, e820entry_t);
> +        buffer = guest_handle_from_param(buffer_t, e820entry_t);

So why is this needed in the first place? I suppose it's related
to guest_handle_cast() returning a _HANDLE_PARAM(), but
what's the reason for that?

Nor would I expect __copy_to_guest_offset() to by unable to
deal with one? I.e., can't the infrastructure be made capable
of dealing with both, so pointless conversions can be avoided?

Or if not, is there really a point in making these changes on the
x86 side (they're benign there, and hence only reduce
readability)?

Jan

Re: [PATCH 20/21] xen: replace XEN_GUEST_HANDLE with XEN_GUEST_HANDLE_PARAM when appropriate

[Ian Campbell]

On Fri, 2012-10-05 at 11:38 +0100, Ian Campbell wrote:
> diff --git a/xen/include/public/tmem.h b/xen/include/public/tmem.h
> index 74bd1c6..7bd29ba 100644
> --- a/xen/include/public/tmem.h
> +++ b/xen/include/public/tmem.h
> @@ -96,7 +96,7 @@
> 
>  #ifndef __ASSEMBLY__
>  typedef xen_pfn_t tmem_cli_mfn_t;
> -typedef XEN_GUEST_HANDLE(char) tmem_cli_va_t;
> +typedef XEN_GUEST_HANDLE_PARAM(char) tmem_cli_va_t;
>  struct tmem_op {
>      uint32_t cmd;
>      int32_t pool_id; 

This worked on ARM but not on x86_64 (or rather, not with the compat
layer), and looking at the below was rather optimistic ;-)

This probably ought to be folded into the original patch rather than
kept separate.

Reviewers, opinions on xen/include/xen/compat.h would be particularly
appreciated.

8<--------------------------------------------------

>From b095a4414f146ec6ec7eff6c990bef49deac776b Mon Sep 17 00:00:00 2001
From: Ian Campbell <ian.campbell@citrix.com>
Date: Fri, 5 Oct 2012 11:28:34 +0000
Subject: [PATCH] xen: correct usage of guest handle paramters in tmem

Broken by "xen: replace XEN_GUEST_HANDLE with XEN_GUEST_HANDLE_PARAM
when appropriate".

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
---
 xen/common/tmem.c          |   45 ++++++++++++++++++++++++-------------------
 xen/common/tmem_xen.c      |    8 +++---
 xen/include/public/tmem.h  |    3 +-
 xen/include/xen/compat.h   |    4 ++-
 xen/include/xen/tmem_xen.h |   15 ++++++++-----
 5 files changed, 43 insertions(+), 32 deletions(-)

diff --git a/xen/common/tmem.c b/xen/common/tmem.c
index ed322b6..1280537 100644
--- a/xen/common/tmem.c
+++ b/xen/common/tmem.c
@@ -1444,7 +1444,7 @@ static inline void tmem_ensure_avail_pages(void)
 /************ TMEM CORE OPERATIONS ************************************/
 
 static NOINLINE int do_tmem_put_compress(pgp_t *pgp, tmem_cli_mfn_t cmfn,
-                                         tmem_cli_va_t clibuf)
+                                         tmem_cli_va_param_t clibuf)
 {
     void *dst, *p;
     size_t size;
@@ -1488,7 +1488,7 @@ out:
 
 static NOINLINE int do_tmem_dup_put(pgp_t *pgp, tmem_cli_mfn_t cmfn,
        pagesize_t tmem_offset, pagesize_t pfn_offset, pagesize_t len,
-       tmem_cli_va_t clibuf)
+       tmem_cli_va_param_t clibuf)
 {
     pool_t *pool;
     obj_t *obj;
@@ -1579,7 +1579,7 @@ cleanup:
 static NOINLINE int do_tmem_put(pool_t *pool,
               OID *oidp, uint32_t index,
               tmem_cli_mfn_t cmfn, pagesize_t tmem_offset,
-              pagesize_t pfn_offset, pagesize_t len, tmem_cli_va_t clibuf)
+              pagesize_t pfn_offset, pagesize_t len, tmem_cli_va_param_t clibuf)
 {
     obj_t *obj = NULL, *objfound = NULL, *objnew = NULL;
     pgp_t *pgp = NULL, *pgpdel = NULL;
@@ -1722,7 +1722,7 @@ free:
 
 static NOINLINE int do_tmem_get(pool_t *pool, OID *oidp, uint32_t index,
               tmem_cli_mfn_t cmfn, pagesize_t tmem_offset,
-              pagesize_t pfn_offset, pagesize_t len, tmem_cli_va_t clibuf)
+              pagesize_t pfn_offset, pagesize_t len, tmem_cli_va_param_t clibuf)
 {
     obj_t *obj;
     pgp_t *pgp;
@@ -2066,8 +2066,8 @@ static int tmemc_flush_mem(cli_id_t cli_id, uint32_t kb)
  */
 #define BSIZE 1024
 
-static int tmemc_list_client(client_t *c, tmem_cli_va_t buf, int off, 
-                             uint32_t len, bool_t use_long)
+static int tmemc_list_client(client_t *c, tmem_cli_va_param_t buf,
+                             int off, uint32_t len, bool_t use_long)
 {
     char info[BSIZE];
     int i, n = 0, sum = 0;
@@ -2119,7 +2119,7 @@ static int tmemc_list_client(client_t *c, tmem_cli_va_t buf, int off,
     return sum;
 }
 
-static int tmemc_list_shared(tmem_cli_va_t buf, int off, uint32_t len,
+static int tmemc_list_shared(tmem_cli_va_param_t buf, int off, uint32_t len,
                               bool_t use_long)
 {
     char info[BSIZE];
@@ -2159,8 +2159,8 @@ static int tmemc_list_shared(tmem_cli_va_t buf, int off, uint32_t len,
 }
 
 #ifdef TMEM_PERF
-static int tmemc_list_global_perf(tmem_cli_va_t buf, int off, uint32_t len,
-                              bool_t use_long)
+static int tmemc_list_global_perf(tmem_cli_va_param_t buf, int off,
+                                  uint32_t len, bool_t use_long)
 {
     char info[BSIZE];
     int n = 0, sum = 0;
@@ -2194,7 +2194,7 @@ static int tmemc_list_global_perf(tmem_cli_va_t buf, int off, uint32_t len,
 #define tmemc_list_global_perf(_buf,_off,_len,_use) (0)
 #endif
 
-static int tmemc_list_global(tmem_cli_va_t buf, int off, uint32_t len,
+static int tmemc_list_global(tmem_cli_va_param_t buf, int off, uint32_t len,
                               bool_t use_long)
 {
     char info[BSIZE];
@@ -2226,7 +2226,7 @@ static int tmemc_list_global(tmem_cli_va_t buf, int off, uint32_t len,
     return sum;
 }
 
-static int tmemc_list(cli_id_t cli_id, tmem_cli_va_t buf, uint32_t len,
+static int tmemc_list(cli_id_t cli_id, tmem_cli_va_param_t buf, uint32_t len,
                                bool_t use_long)
 {
     client_t *client;
@@ -2338,7 +2338,7 @@ static NOINLINE int tmemc_shared_pool_auth(cli_id_t cli_id, uint64_t uuid_lo,
 }
 
 static NOINLINE int tmemc_save_subop(int cli_id, uint32_t pool_id,
-                        uint32_t subop, tmem_cli_va_t buf, uint32_t arg1)
+                        uint32_t subop, tmem_cli_va_param_t buf, uint32_t arg1)
 {
     client_t *client = tmh_client_from_cli_id(cli_id);
     pool_t *pool = (client == NULL || pool_id >= MAX_POOLS_PER_DOMAIN)
@@ -2427,7 +2427,7 @@ static NOINLINE int tmemc_save_subop(int cli_id, uint32_t pool_id,
 }
 
 static NOINLINE int tmemc_save_get_next_page(int cli_id, uint32_t pool_id,
-                        tmem_cli_va_t buf, uint32_t bufsize)
+                        tmem_cli_va_param_t buf, uint32_t bufsize)
 {
     client_t *client = tmh_client_from_cli_id(cli_id);
     pool_t *pool = (client == NULL || pool_id >= MAX_POOLS_PER_DOMAIN)
@@ -2479,7 +2479,7 @@ out:
     return ret;
 }
 
-static NOINLINE int tmemc_save_get_next_inv(int cli_id, tmem_cli_va_t buf,
+static NOINLINE int tmemc_save_get_next_inv(int cli_id, tmem_cli_va_param_t buf,
                         uint32_t bufsize)
 {
     client_t *client = tmh_client_from_cli_id(cli_id);
@@ -2522,7 +2522,7 @@ out:
 }
 
 static int tmemc_restore_put_page(int cli_id, uint32_t pool_id, OID *oidp,
-                      uint32_t index, tmem_cli_va_t buf, uint32_t bufsize)
+                      uint32_t index, tmem_cli_va_param_t buf, uint32_t bufsize)
 {
     client_t *client = tmh_client_from_cli_id(cli_id);
     pool_t *pool = (client == NULL || pool_id >= MAX_POOLS_PER_DOMAIN)
@@ -2566,7 +2566,8 @@ static NOINLINE int do_tmem_control(struct tmem_op *op)
         ret = tmemc_flush_mem(op->u.ctrl.cli_id,op->u.ctrl.arg1);
         break;
     case TMEMC_LIST:
-        ret = tmemc_list(op->u.ctrl.cli_id,op->u.ctrl.buf,
+        ret = tmemc_list(op->u.ctrl.cli_id,
+                         guest_handle_cast(op->u.ctrl.buf, char),
                          op->u.ctrl.arg1,op->u.ctrl.arg2);
         break;
     case TMEMC_SET_WEIGHT:
@@ -2589,20 +2590,24 @@ static NOINLINE int do_tmem_control(struct tmem_op *op)
     case TMEMC_SAVE_GET_POOL_UUID:
     case TMEMC_SAVE_END:
         ret = tmemc_save_subop(op->u.ctrl.cli_id,pool_id,subop,
-                        op->u.ctrl.buf,op->u.ctrl.arg1);
+                               guest_handle_cast(op->u.ctrl.buf, char),
+                               op->u.ctrl.arg1);
         break;
     case TMEMC_SAVE_GET_NEXT_PAGE:
         ret = tmemc_save_get_next_page(op->u.ctrl.cli_id, pool_id,
-                                       op->u.ctrl.buf, op->u.ctrl.arg1);
+                                       guest_handle_cast(op->u.ctrl.buf, char),
+                                       op->u.ctrl.arg1);
         break;
     case TMEMC_SAVE_GET_NEXT_INV:
-        ret = tmemc_save_get_next_inv(op->u.ctrl.cli_id, op->u.ctrl.buf,
+        ret = tmemc_save_get_next_inv(op->u.ctrl.cli_id,
+                                      guest_handle_cast(op->u.ctrl.buf, char),
                                       op->u.ctrl.arg1);
         break;
     case TMEMC_RESTORE_PUT_PAGE:
         ret = tmemc_restore_put_page(op->u.ctrl.cli_id,pool_id,
                                      oidp, op->u.ctrl.arg2,
-                                     op->u.ctrl.buf, op->u.ctrl.arg1);
+                                     guest_handle_cast(op->u.ctrl.buf, char),
+                                     op->u.ctrl.arg1);
         break;
     case TMEMC_RESTORE_FLUSH_PAGE:
         ret = tmemc_restore_flush_page(op->u.ctrl.cli_id,pool_id,
diff --git a/xen/common/tmem_xen.c b/xen/common/tmem_xen.c
index 9dc2a1d..25fbd6c 100644
--- a/xen/common/tmem_xen.c
+++ b/xen/common/tmem_xen.c
@@ -146,7 +146,7 @@ static inline void cli_put_page(void *cli_va, pfp_t *cli_pfp,
 
 EXPORT int tmh_copy_from_client(pfp_t *pfp,
     tmem_cli_mfn_t cmfn, pagesize_t tmem_offset,
-    pagesize_t pfn_offset, pagesize_t len, tmem_cli_va_t clibuf)
+    pagesize_t pfn_offset, pagesize_t len, tmem_cli_va_param_t clibuf)
 {
     unsigned long tmem_mfn, cli_mfn = 0;
     char *tmem_va, *cli_va = NULL;
@@ -194,7 +194,7 @@ EXPORT int tmh_copy_from_client(pfp_t *pfp,
 }
 
 EXPORT int tmh_compress_from_client(tmem_cli_mfn_t cmfn,
-    void **out_va, size_t *out_len, tmem_cli_va_t clibuf)
+    void **out_va, size_t *out_len, tmem_cli_va_param_t clibuf)
 {
     int ret = 0;
     unsigned char *dmem = this_cpu(dstmem);
@@ -227,7 +227,7 @@ EXPORT int tmh_compress_from_client(tmem_cli_mfn_t cmfn,
 
 EXPORT int tmh_copy_to_client(tmem_cli_mfn_t cmfn, pfp_t *pfp,
     pagesize_t tmem_offset, pagesize_t pfn_offset, pagesize_t len,
-    tmem_cli_va_t clibuf)
+    tmem_cli_va_param_t clibuf)
 {
     unsigned long tmem_mfn, cli_mfn = 0;
     char *tmem_va, *cli_va = NULL;
@@ -265,7 +265,7 @@ EXPORT int tmh_copy_to_client(tmem_cli_mfn_t cmfn, pfp_t *pfp,
 }
 
 EXPORT int tmh_decompress_to_client(tmem_cli_mfn_t cmfn, void *tmem_va,
-                                    size_t size, tmem_cli_va_t clibuf)
+                                    size_t size, tmem_cli_va_param_t clibuf)
 {
     unsigned long cli_mfn = 0;
     pfp_t *cli_pfp = NULL;
diff --git a/xen/include/public/tmem.h b/xen/include/public/tmem.h
index 7bd29ba..91f3a7d 100644
--- a/xen/include/public/tmem.h
+++ b/xen/include/public/tmem.h
@@ -96,7 +96,8 @@
 
 #ifndef __ASSEMBLY__
 typedef xen_pfn_t tmem_cli_mfn_t;
-typedef XEN_GUEST_HANDLE_PARAM(char) tmem_cli_va_t;
+typedef XEN_GUEST_HANDLE(char) tmem_cli_va_t;
+typedef XEN_GUEST_HANDLE_PARAM(char) tmem_cli_va_param_t;
 struct tmem_op {
     uint32_t cmd;
     int32_t pool_id;
diff --git a/xen/include/xen/compat.h b/xen/include/xen/compat.h
index 857cbc7..5a51ce0 100644
--- a/xen/include/xen/compat.h
+++ b/xen/include/xen/compat.h
@@ -21,7 +21,9 @@
     __DEFINE_COMPAT_HANDLE(name, name); \
     __DEFINE_COMPAT_HANDLE(const_ ## name, const name)
 #define COMPAT_HANDLE(name)          __compat_handle_ ## name
-
+/* NB: it is assumed that if an arch uses the compat layer it does not
+ * distinguish handles from parameter handles. */
+#define COMPAT_HANDLE_PARAM(name)    __compat_handle_ ## name
 /* Is the compat handle a NULL reference? */
 #define compat_handle_is_null(hnd)        ((hnd).c == 0)
 
diff --git a/xen/include/xen/tmem_xen.h b/xen/include/xen/tmem_xen.h
index c31220a..ef720ed 100644
--- a/xen/include/xen/tmem_xen.h
+++ b/xen/include/xen/tmem_xen.h
@@ -466,8 +466,9 @@ static inline int tmh_get_tmemop_from_client(tmem_op_t *op, tmem_cli_op_t uops)
 
 #define tmh_cli_buf_null guest_handle_from_ptr(NULL, char)
 
-static inline void tmh_copy_to_client_buf_offset(tmem_cli_va_t clibuf, int off,
-                                           char *tmembuf, int len)
+static inline void tmh_copy_to_client_buf_offset(tmem_cli_va_param_t clibuf,
+						 int off,
+						 char *tmembuf, int len)
 {
     copy_to_guest_offset(clibuf,off,tmembuf,len);
 }
@@ -482,15 +483,17 @@ static inline void tmh_copy_to_client_buf_offset(tmem_cli_va_t clibuf, int off,
 #define tmh_cli_id_str "domid"
 #define tmh_client_str "domain"
 
-int tmh_decompress_to_client(tmem_cli_mfn_t, void *, size_t, tmem_cli_va_t);
+int tmh_decompress_to_client(tmem_cli_mfn_t, void *, size_t,
+			     tmem_cli_va_param_t);
 
-int tmh_compress_from_client(tmem_cli_mfn_t, void **, size_t *, tmem_cli_va_t);
+int tmh_compress_from_client(tmem_cli_mfn_t, void **, size_t *,
+			     tmem_cli_va_param_t);
 
 int tmh_copy_from_client(pfp_t *, tmem_cli_mfn_t, pagesize_t tmem_offset,
-    pagesize_t pfn_offset, pagesize_t len, tmem_cli_va_t);
+    pagesize_t pfn_offset, pagesize_t len, tmem_cli_va_param_t);
 
 int tmh_copy_to_client(tmem_cli_mfn_t, pfp_t *, pagesize_t tmem_offset,
-    pagesize_t pfn_offset, pagesize_t len, tmem_cli_va_t);
+    pagesize_t pfn_offset, pagesize_t len, tmem_cli_va_param_t);
 
 extern int tmh_copy_tze_to_client(tmem_cli_mfn_t cmfn, void *tmem_va, pagesize_t len);
 
-- 
1.7.9.1

Re: [PATCH 21/21] xen: more substitutions

[Jan Beulich]

>>> On 05.10.12 at 13:14, Ian Campbell <Ian.Campbell@citrix.com> wrote:
> On Fri, 2012-10-05 at 12:09 +0100, Jan Beulich wrote:
>> >>> On 05.10.12 at 12:38, Ian Campbell <ian.campbell@citrix.com> wrote:
>> > @@ -4195,6 +4197,7 @@ static int handle_iomem_range(unsigned long s, 
> unsigned long e, void *p)
>> >      if ( s > ctxt->s )
>> >      {
>> >          e820entry_t ent;
>> > +        XEN_GUEST_HANDLE_PARAM(e820entry_t) buffer_t;
>> 
>> I'm not really in favor fo the _t suffix chosen here and below, as
>> that's generally used for typedef-s. Could this be replaced with
>> e.g. _p, _h, or _hp?
> 
> The use is 
>         buffer_t = guest_handle_cast(ctxt->map.buffer, e820entry_t);
>         buffer = guest_handle_from_param(buffer_t, e820entry_t);
> which seems a bit strange to me -- we launder through buffer_t solely to
> use guest_handle_from_param. Is there no macro which does that in one
> step?
> 
> That would avoid the whole problem of the suffix choice.
> 
> Also buffer is then passed to __copy_to_guest_offset, and I'm not sure
> why that can't be passed ctxt->map.buffer directly rather than
> laundering it through those two macros...

Passing directly is not possible, as the type referred to be the
handle is relevant for the macro's operation (and it's "void" in
struct xen_memory_map).

Jan

Re: [PATCH 21/21] xen: more substitutions

[Ian Campbell]

On Fri, 2012-10-05 at 12:33 +0100, Jan Beulich wrote:
> >>> On 05.10.12 at 13:14, Ian Campbell <Ian.Campbell@citrix.com> wrote:
> > On Fri, 2012-10-05 at 12:09 +0100, Jan Beulich wrote:
> >> >>> On 05.10.12 at 12:38, Ian Campbell <ian.campbell@citrix.com> wrote:
> >> > @@ -4195,6 +4197,7 @@ static int handle_iomem_range(unsigned long s, 
> > unsigned long e, void *p)
> >> >      if ( s > ctxt->s )
> >> >      {
> >> >          e820entry_t ent;
> >> > +        XEN_GUEST_HANDLE_PARAM(e820entry_t) buffer_t;
> >> 
> >> I'm not really in favor fo the _t suffix chosen here and below, as
> >> that's generally used for typedef-s. Could this be replaced with
> >> e.g. _p, _h, or _hp?
> > 
> > The use is 
> >         buffer_t = guest_handle_cast(ctxt->map.buffer, e820entry_t);
> >         buffer = guest_handle_from_param(buffer_t, e820entry_t);
> > which seems a bit strange to me -- we launder through buffer_t solely to
> > use guest_handle_from_param. Is there no macro which does that in one
> > step?
> > 
> > That would avoid the whole problem of the suffix choice.
> > 
> > Also buffer is then passed to __copy_to_guest_offset, and I'm not sure
> > why that can't be passed ctxt->map.buffer directly rather than
> > laundering it through those two macros...
> 
> Passing directly is not possible, as the type referred to be the
> handle is relevant for the macro's operation (and it's "void" in
> struct xen_memory_map).

That's the bit I missed.

Although the question is then why not type the buffer correctly...

Ian/

Re: [PATCH 20/21] xen: replace XEN_GUEST_HANDLE with XEN_GUEST_HANDLE_PARAM when appropriate

[Jan Beulich]

>>> On 05.10.12 at 13:30, Ian Campbell <Ian.Campbell@citrix.com> wrote:
> This probably ought to be folded into the original patch rather than
> kept separate.

Think so, yes.

> --- a/xen/include/public/tmem.h
> +++ b/xen/include/public/tmem.h
> @@ -96,7 +96,8 @@
>  
>  #ifndef __ASSEMBLY__
>  typedef xen_pfn_t tmem_cli_mfn_t;
> -typedef XEN_GUEST_HANDLE_PARAM(char) tmem_cli_va_t;
> +typedef XEN_GUEST_HANDLE(char) tmem_cli_va_t;
> +typedef XEN_GUEST_HANDLE_PARAM(char) tmem_cli_va_param_t;

This doesn't belong here - there's no use of tmem_cli_va_param_t
anywhere in the public interface afaict. I didn't check, but if there
are other uses of XEN_GUEST_HANDLE_PARAM() in the public
headers, I would suspect them to be wrong too - at the interface
layer, there shouldn't be any need for them.

> --- a/xen/include/xen/compat.h
> +++ b/xen/include/xen/compat.h
> @@ -21,7 +21,9 @@
>      __DEFINE_COMPAT_HANDLE(name, name); \
>      __DEFINE_COMPAT_HANDLE(const_ ## name, const name)
>  #define COMPAT_HANDLE(name)          __compat_handle_ ## name
> -
> +/* NB: it is assumed that if an arch uses the compat layer it does not
> + * distinguish handles from parameter handles. */
> +#define COMPAT_HANDLE_PARAM(name)    __compat_handle_ ## name
>  /* Is the compat handle a NULL reference? */
>  #define compat_handle_is_null(hnd)        ((hnd).c == 0)
 
This seems acceptable to me (minus the dropped newline).

Jan

Re: [PATCH 21/21] xen: more substitutions

[Jan Beulich]

>>> On 05.10.12 at 13:40, Ian Campbell <Ian.Campbell@citrix.com> wrote:
> On Fri, 2012-10-05 at 12:33 +0100, Jan Beulich wrote:
>> >>> On 05.10.12 at 13:14, Ian Campbell <Ian.Campbell@citrix.com> wrote:
>> > On Fri, 2012-10-05 at 12:09 +0100, Jan Beulich wrote:
>> >> >>> On 05.10.12 at 12:38, Ian Campbell <ian.campbell@citrix.com> wrote:
>> >> > @@ -4195,6 +4197,7 @@ static int handle_iomem_range(unsigned long s, 
>> > unsigned long e, void *p)
>> >> >      if ( s > ctxt->s )
>> >> >      {
>> >> >          e820entry_t ent;
>> >> > +        XEN_GUEST_HANDLE_PARAM(e820entry_t) buffer_t;
>> >> 
>> >> I'm not really in favor fo the _t suffix chosen here and below, as
>> >> that's generally used for typedef-s. Could this be replaced with
>> >> e.g. _p, _h, or _hp?
>> > 
>> > The use is 
>> >         buffer_t = guest_handle_cast(ctxt->map.buffer, e820entry_t);
>> >         buffer = guest_handle_from_param(buffer_t, e820entry_t);
>> > which seems a bit strange to me -- we launder through buffer_t solely to
>> > use guest_handle_from_param. Is there no macro which does that in one
>> > step?
>> > 
>> > That would avoid the whole problem of the suffix choice.
>> > 
>> > Also buffer is then passed to __copy_to_guest_offset, and I'm not sure
>> > why that can't be passed ctxt->map.buffer directly rather than
>> > laundering it through those two macros...
>> 
>> Passing directly is not possible, as the type referred to be the
>> handle is relevant for the macro's operation (and it's "void" in
>> struct xen_memory_map).
> 
> That's the bit I missed.
> 
> Although the question is then why not type the buffer correctly...

Because the type itself isn't Xen-defined and hence also not
exposed in Xen's public interface (which in particular allows
guests to use their own type without any need of casting).

Jan

Jan

Re: [PATCH 20/21] xen: replace XEN_GUEST_HANDLE with XEN_GUEST_HANDLE_PARAM when appropriate

[Ian Campbell]

On Fri, 2012-10-05 at 12:43 +0100, Jan Beulich wrote:
> >>> On 05.10.12 at 13:30, Ian Campbell <Ian.Campbell@citrix.com> wrote:
> > This probably ought to be folded into the original patch rather than
> > kept separate.
> 
> Think so, yes.
> 
> > --- a/xen/include/public/tmem.h
> > +++ b/xen/include/public/tmem.h
> > @@ -96,7 +96,8 @@
> >  
> >  #ifndef __ASSEMBLY__
> >  typedef xen_pfn_t tmem_cli_mfn_t;
> > -typedef XEN_GUEST_HANDLE_PARAM(char) tmem_cli_va_t;
> > +typedef XEN_GUEST_HANDLE(char) tmem_cli_va_t;
> > +typedef XEN_GUEST_HANDLE_PARAM(char) tmem_cli_va_param_t;
> 
> This doesn't belong here - there's no use of tmem_cli_va_param_t
> anywhere in the public interface afaict.

Right. I'll throw it in xen/include/xen/tmem_xen.h instead.

>  I didn't check, but if there
> are other uses of XEN_GUEST_HANDLE_PARAM() in the public
> headers, I would suspect them to be wrong too - at the interface
> layer, there shouldn't be any need for them.

Only the #define itself.

> 
> > --- a/xen/include/xen/compat.h
> > +++ b/xen/include/xen/compat.h
> > @@ -21,7 +21,9 @@
> >      __DEFINE_COMPAT_HANDLE(name, name); \
> >      __DEFINE_COMPAT_HANDLE(const_ ## name, const name)
> >  #define COMPAT_HANDLE(name)          __compat_handle_ ## name
> > -
> > +/* NB: it is assumed that if an arch uses the compat layer it does not
> > + * distinguish handles from parameter handles. */
> > +#define COMPAT_HANDLE_PARAM(name)    __compat_handle_ ## name
> >  /* Is the compat handle a NULL reference? */
> >  #define compat_handle_is_null(hnd)        ((hnd).c == 0)
>  
> This seems acceptable to me (minus the dropped newline).

Thanks.

Ian.

Re: [PATCH 20/21] xen: replace XEN_GUEST_HANDLE with XEN_GUEST_HANDLE_PARAM when appropriate

[Jan Beulich]

>>> On 05.10.12 at 14:12, Ian Campbell <Ian.Campbell@citrix.com> wrote:
> On Fri, 2012-10-05 at 12:43 +0100, Jan Beulich wrote:
>>  I didn't check, but if there
>> are other uses of XEN_GUEST_HANDLE_PARAM() in the public
>> headers, I would suspect them to be wrong too - at the interface
>> layer, there shouldn't be any need for them.
> 
> Only the #define itself.

That's acceptable, albeit perhaps not really correct/necessary either.

Jan

Re: [PATCH 17/21] xen: xen_ulong_t substitution

[Stefano Stabellini]

On Fri, 5 Oct 2012, Jan Beulich wrote:
> >>> On 05.10.12 at 12:38, Ian Campbell <ian.campbell@citrix.com> wrote:
> > --- a/tools/python/xen/lowlevel/xc/xc.c
> > +++ b/tools/python/xen/lowlevel/xc/xc.c
> > @@ -1439,7 +1439,7 @@ static PyObject *pyxc_xeninfo(XcObject *self)
> >      if ( xc_version(self->xc_handle, XENVER_commandline, &xen_commandline) != 0 )
> >          return pyxc_error_to_exception(self->xc_handle);
> >  
> > -    snprintf(str, sizeof(str), "virt_start=0x%lx", p_parms.virt_start);
> > +    snprintf(str, sizeof(str), "virt_start=0x%"PRI_xen_ulong, p_parms.virt_start);
> 
> Does that build on x86? I ask because ...
> 
> >  
> >      xen_pagesize = xc_version(self->xc_handle, XENVER_pagesize, NULL);
> >      if (xen_pagesize < 0 )
> > diff --git a/xen/include/public/arch-arm.h b/xen/include/public/arch-arm.h
> > index e3d4ad9..2ae6548 100644
> > --- a/xen/include/public/arch-arm.h
> > +++ b/xen/include/public/arch-arm.h
> > @@ -122,7 +122,8 @@ typedef uint64_t xen_pfn_t;
> >  /* Only one. All other VCPUS must use VCPUOP_register_vcpu_info */
> >  #define XEN_LEGACY_MAX_VCPUS 1
> >  
> > -typedef uint32_t xen_ulong_t;
> > +typedef uint64_t xen_ulong_t;
> > +#define PRI_xen_ulong PRIx64
> 
> ... this doesn't seem to have an x86 counterpart.
> 

xen/include/public/arch-x86/xen.h defines xen_ulong_t but it looks like
that  it is missing PRI_xen_ulong

> 
> >  
> >  struct vcpu_guest_context {
> >  #define _VGCF_online                   0
> > diff --git a/xen/include/public/version.h b/xen/include/public/version.h
> > index 8742c2b..c7e6f8c 100644
> > --- a/xen/include/public/version.h
> > +++ b/xen/include/public/version.h
> > @@ -28,6 +28,8 @@
> >  #ifndef __XEN_PUBLIC_VERSION_H__
> >  #define __XEN_PUBLIC_VERSION_H__
> >  
> > +#include "xen.h"
> > +
> >  /* NB. All ops return zero on success, except XENVER_{version,pagesize} */
> >  
> >  /* arg == NULL; returns major:minor (16:16). */
> > @@ -58,7 +60,7 @@ typedef char xen_changeset_info_t[64];
> >  
> >  #define XENVER_platform_parameters 5
> >  struct xen_platform_parameters {
> > -    unsigned long virt_start;
> > +    xen_ulong_t virt_start;
> >  };
> >  typedef struct xen_platform_parameters xen_platform_parameters_t;
> >  
> > -- 
> > 1.7.9.1
> 
> 
> 

Re: [PATCH 20/21] xen: replace XEN_GUEST_HANDLE with XEN_GUEST_HANDLE_PARAM when appropriate

[Stefano Stabellini]

On Fri, 5 Oct 2012, Jan Beulich wrote:
> >>> On 05.10.12 at 12:38, Ian Campbell <ian.campbell@citrix.com> wrote:
> > From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
> > 
> > Note: these changes don't make any difference on x86 and ia64.
> 
> ia64?
> 

it was still around when I started working on the patch

Re: [PATCH 21/21] xen: more substitutions

[Stefano Stabellini]

On Fri, 5 Oct 2012, Jan Beulich wrote:
> >>> On 05.10.12 at 12:38, Ian Campbell <ian.campbell@citrix.com> wrote:
> > @@ -4202,7 +4205,8 @@ static int handle_iomem_range(unsigned long s, unsigned long e, void *p)
> >          ent.addr = (uint64_t)ctxt->s << PAGE_SHIFT;
> >          ent.size = (uint64_t)(s - ctxt->s) << PAGE_SHIFT;
> >          ent.type = E820_RESERVED;
> > -        buffer = guest_handle_cast(ctxt->map.buffer, e820entry_t);
> > +        buffer_t = guest_handle_cast(ctxt->map.buffer, e820entry_t);
> > +        buffer = guest_handle_from_param(buffer_t, e820entry_t);
> 
> So why is this needed in the first place? I suppose it's related
> to guest_handle_cast() returning a _HANDLE_PARAM(), but
> what's the reason for that?
 
Because almost everywhere is useful to get an _HANDLE_PARAM from
guest_handle_cast, except two cases, and this is one of them


> Nor would I expect __copy_to_guest_offset() to by unable to
> deal with one? I.e., can't the infrastructure be made capable
> of dealing with both, so pointless conversions can be avoided?

I would rather have one more line of code but being very obvious about
what I am doing: guest_handle_cast returns a XEN_GUEST_HANDLE_PARAM so
we need to cast that to XEN_GUEST_HANDLE. We do that in the traditional
way: calling guest_handle_from_param.


> Or if not, is there really a point in making these changes on the
> x86 side (they're benign there, and hence only reduce
> readability)?

It makes the code more coherent. I like the principle of least
surprise.
Also I would like that changing the type of XEN_GUEST_HANDLE_PARAM on
x86 would actually work.

Re: [PATCH 17/21] xen: xen_ulong_t substitution

[Ian Campbell]

On Fri, 2012-10-05 at 11:38 +0100, Ian Campbell wrote:
> From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
> 
> There is still an unwanted unsigned long in the xen public interface:
> replace it with xen_ulong_t.
> 
> Also typedef xen_ulong_t to uint64_t on ARM.

Should this change be applied to the uses of XEN_GUEST_HANDLE(ulong)
too? My main concern is the one in struct gnttab_setup_table but there
are a few others.

I suspect XEN_GUEST_HANDLE(ulong) needs to be removed entirely,
everywhere it is used should be XEN_GUEST_HANDLE(xen_ulong_t) instead?

Ian.



> 
> Changes in v2:
> 
> - do not replace the unsigned long in x86 specific calls;
> - do not replace the unsigned long in multicall_entry;
> - add missing include "xen.h" in version.h;
> - use proper printf flag for xen_ulong_t.
> 
> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
> Cc: keir@xen.org
> Cc: JBeulich@suse.com
> ---
>  tools/python/xen/lowlevel/xc/xc.c |    2 +-
>  xen/include/public/arch-arm.h     |    3 ++-
>  xen/include/public/version.h      |    4 +++-
>  3 files changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/tools/python/xen/lowlevel/xc/xc.c b/tools/python/xen/lowlevel/xc/xc.c
> index 7c89756..e220f68 100644
> --- a/tools/python/xen/lowlevel/xc/xc.c
> +++ b/tools/python/xen/lowlevel/xc/xc.c
> @@ -1439,7 +1439,7 @@ static PyObject *pyxc_xeninfo(XcObject *self)
>      if ( xc_version(self->xc_handle, XENVER_commandline, &xen_commandline) != 0 )
>          return pyxc_error_to_exception(self->xc_handle);
>  
> -    snprintf(str, sizeof(str), "virt_start=0x%lx", p_parms.virt_start);
> +    snprintf(str, sizeof(str), "virt_start=0x%"PRI_xen_ulong, p_parms.virt_start);
>  
>      xen_pagesize = xc_version(self->xc_handle, XENVER_pagesize, NULL);
>      if (xen_pagesize < 0 )
> diff --git a/xen/include/public/arch-arm.h b/xen/include/public/arch-arm.h
> index e3d4ad9..2ae6548 100644
> --- a/xen/include/public/arch-arm.h
> +++ b/xen/include/public/arch-arm.h
> @@ -122,7 +122,8 @@ typedef uint64_t xen_pfn_t;
>  /* Only one. All other VCPUS must use VCPUOP_register_vcpu_info */
>  #define XEN_LEGACY_MAX_VCPUS 1
>  
> -typedef uint32_t xen_ulong_t;
> +typedef uint64_t xen_ulong_t;
> +#define PRI_xen_ulong PRIx64
>  
>  struct vcpu_guest_context {
>  #define _VGCF_online                   0
> diff --git a/xen/include/public/version.h b/xen/include/public/version.h
> index 8742c2b..c7e6f8c 100644
> --- a/xen/include/public/version.h
> +++ b/xen/include/public/version.h
> @@ -28,6 +28,8 @@
>  #ifndef __XEN_PUBLIC_VERSION_H__
>  #define __XEN_PUBLIC_VERSION_H__
>  
> +#include "xen.h"
> +
>  /* NB. All ops return zero on success, except XENVER_{version,pagesize} */
>  
>  /* arg == NULL; returns major:minor (16:16). */
> @@ -58,7 +60,7 @@ typedef char xen_changeset_info_t[64];
>  
>  #define XENVER_platform_parameters 5
>  struct xen_platform_parameters {
> -    unsigned long virt_start;
> +    xen_ulong_t virt_start;
>  };
>  typedef struct xen_platform_parameters xen_platform_parameters_t;
>  

Re: [PATCH 01/21] xen: arm: implement XENMEM_add_to_physmap_range

[Ian Campbell]

I should have CC'd Keir, Jan and Mukesh on this one and forgot. Done
now.

On Fri, 2012-10-05 at 11:38 +0100, Ian Campbell wrote:
> This allows for foreign mappings as well as batching, fitting all that
> into XENMEM_add_to_physmap wasn't possible.
> 
> Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
> ---
>  xen/arch/arm/mm.c           |  120 ++++++++++++++++++++++++++++++++++++++-----
>  xen/include/public/memory.h |   40 +++++++++++---
>  xen/include/public/xen.h    |    1 +
>  3 files changed, 139 insertions(+), 22 deletions(-)
> 
> diff --git a/xen/arch/arm/mm.c b/xen/arch/arm/mm.c
> index 40ac176..dde304b 100644
> --- a/xen/arch/arm/mm.c
> +++ b/xen/arch/arm/mm.c
> @@ -25,6 +25,8 @@
>  #include <xen/mm.h>
>  #include <xen/preempt.h>
>  #include <xen/errno.h>
> +#include <xen/softirq.h>
> +#include <xen/event.h>
>  #include <xen/guest_access.h>
>  #include <xen/domain_page.h>
>  #include <asm/page.h>
> @@ -461,37 +463,96 @@ void share_xen_page_with_guest(struct page_info *page,
>      spin_unlock(&d->page_alloc_lock);
>  }
>  
> -static int xenmem_add_to_physmap_once(
> +static int xenmem_add_to_physmap_one(
>      struct domain *d,
> -    const struct xen_add_to_physmap *xatp)
> +    uint16_t space,
> +    domid_t foreign_domid,
> +    unsigned long idx,
> +    xen_pfn_t gpfn)
>  {
>      unsigned long mfn = 0;
>      int rc;
>  
> -    switch ( xatp->space )
> +    switch ( space )
>      {
> -        case XENMAPSPACE_shared_info:
> -            if ( xatp->idx == 0 )
> -                mfn = virt_to_mfn(d->shared_info);
> -            break;
> -        default:
> -            return -ENOSYS;
> +    case XENMAPSPACE_shared_info:
> +        if ( idx == 0 )
> +            mfn = virt_to_mfn(d->shared_info);
> +        break;
> +    case XENMAPSPACE_gmfn_foreign:
> +    {
> +        paddr_t maddr;
> +        struct domain *od;
> +        rc = rcu_lock_target_domain_by_id(foreign_domid, &od);
> +        if ( rc < 0 )
> +            return rc;
> +
> +        maddr = p2m_lookup(od, idx << PAGE_SHIFT);
> +        if ( maddr == INVALID_PADDR )
> +        {
> +            dump_p2m_lookup(od, idx << PAGE_SHIFT);
> +            rcu_unlock_domain(od);
> +            return -EINVAL;
> +        }
> +
> +        mfn = maddr >> PAGE_SHIFT;
> +
> +        rcu_unlock_domain(od);
> +        break;
> +    }
> +
> +    default:
> +        return -ENOSYS;
>      }
>  
>      domain_lock(d);
>  
>      /* Map at new location. */
> -    rc = guest_physmap_add_page(d, xatp->gpfn, mfn, 0);
> +    rc = guest_physmap_add_page(d, gpfn, mfn, 0);
>  
>      domain_unlock(d);
>  
>      return rc;
>  }
>  
> -static int xenmem_add_to_physmap(struct domain *d,
> -                                 struct xen_add_to_physmap *xatp)
> +static int xenmem_add_to_physmap_range(struct domain *d,
> +                                       struct xen_add_to_physmap_range *xatpr)
>  {
> -    return xenmem_add_to_physmap_once(d, xatp);
> +    int rc;
> +
> +    /* Process entries in reverse order to allow continuations */
> +    while ( xatpr->size > 0 )
> +    {
> +        xen_ulong_t idx;
> +        xen_pfn_t gpfn;
> +
> +        rc = copy_from_guest_offset(&idx, xatpr->idxs, xatpr->size-1, 1);
> +        if ( rc < 0 )
> +            goto out;
> +
> +        rc = copy_from_guest_offset(&gpfn, xatpr->gpfns, xatpr->size-1, 1);
> +        if ( rc < 0 )
> +            goto out;
> +
> +        rc = xenmem_add_to_physmap_one(d, xatpr->space,
> +                                       xatpr->foreign_domid,
> +                                       idx, gpfn);
> +
> +        xatpr->size--;
> +
> +        /* Check for continuation if it's not the last interation */
> +        if ( xatpr->size > 0 && hypercall_preempt_check() )
> +        {
> +            rc = -EAGAIN;
> +            goto out;
> +        }
> +    }
> +
> +    rc = 0;
> +
> +out:
> +    return rc;
> +
>  }
>  
>  long arch_memory_op(int op, XEN_GUEST_HANDLE(void) arg)
> @@ -508,14 +569,45 @@ long arch_memory_op(int op, XEN_GUEST_HANDLE(void) arg)
>          if ( copy_from_guest(&xatp, arg, 1) )
>              return -EFAULT;
>  
> +        /* This one is only supported by add_to_physmap_range */
> +        if ( xatp.space == XENMAPSPACE_gmfn_foreign )
> +            return -EINVAL;
> +
>          rc = rcu_lock_target_domain_by_id(xatp.domid, &d);
>          if ( rc != 0 )
>              return rc;
>  
> -        rc = xenmem_add_to_physmap(d, &xatp);
> +        rc = xenmem_add_to_physmap_one(d, xatp.space, DOMID_INVALID,
> +                                       xatp.idx, xatp.gpfn);
> +
> +        rcu_unlock_domain(d);
> +
> +        return rc;
> +    }
> +
> +    case XENMEM_add_to_physmap_range:
> +    {
> +        struct xen_add_to_physmap_range xatpr;
> +        struct domain *d;
> +
> +        if ( copy_from_guest(&xatpr, arg, 1) )
> +            return -EFAULT;
> +
> +        rc = rcu_lock_target_domain_by_id(xatpr.domid, &d);
> +        if ( rc != 0 )
> +            return rc;
> +
> +        rc = xenmem_add_to_physmap_range(d, &xatpr);
>  
>          rcu_unlock_domain(d);
>  
> +        if ( rc && copy_to_guest(arg, &xatpr, 1) )
> +            rc = -EFAULT;
> +
> +        if ( rc == -EAGAIN )
> +            rc = hypercall_create_continuation(
> +                __HYPERVISOR_memory_op, "ih", op, arg);
> +
>          return rc;
>      }
>  
> diff --git a/xen/include/public/memory.h b/xen/include/public/memory.h
> index 86d02c8..f1ddbc0 100644
> --- a/xen/include/public/memory.h
> +++ b/xen/include/public/memory.h
> @@ -198,6 +198,15 @@ struct xen_machphys_mapping {
>  typedef struct xen_machphys_mapping xen_machphys_mapping_t;
>  DEFINE_XEN_GUEST_HANDLE(xen_machphys_mapping_t);
>  
> +/* Source mapping space. */
> +/* ` enum phys_map_space { */
> +#define XENMAPSPACE_shared_info  0 /* shared info page */
> +#define XENMAPSPACE_grant_table  1 /* grant table page */
> +#define XENMAPSPACE_gmfn         2 /* GMFN */
> +#define XENMAPSPACE_gmfn_range   3 /* GMFN range */
> +#define XENMAPSPACE_gmfn_foreign 4 /* GMFN from another dom */
> +/* ` } */
> +
>  /*
>   * Sets the GPFN at which a particular page appears in the specified guest's
>   * pseudophysical address space.
> @@ -211,24 +220,39 @@ struct xen_add_to_physmap {
>      /* Number of pages to go through for gmfn_range */
>      uint16_t    size;
>  
> -    /* Source mapping space. */
> -#define XENMAPSPACE_shared_info 0 /* shared info page */
> -#define XENMAPSPACE_grant_table 1 /* grant table page */
> -#define XENMAPSPACE_gmfn        2 /* GMFN */
> -#define XENMAPSPACE_gmfn_range  3 /* GMFN range */
> -    unsigned int space;
> +    unsigned int space; /* => enum phys_map_space */
>  
>  #define XENMAPIDX_grant_table_status 0x80000000
>  
> -    /* Index into source mapping space. */
> +    /* Index into space being mapped. */
>      xen_ulong_t idx;
>  
> -    /* GPFN where the source mapping page should appear. */
> +    /* GPFN in domid where the source mapping page should appear. */
>      xen_pfn_t     gpfn;
>  };
>  typedef struct xen_add_to_physmap xen_add_to_physmap_t;
>  DEFINE_XEN_GUEST_HANDLE(xen_add_to_physmap_t);
>  
> +/* A batched version of add_to_physmap. */
> +#define XENMEM_add_to_physmap_range 23
> +struct xen_add_to_physmap_range {
> +    /* Which domain to change the mapping for. */
> +    domid_t domid;
> +    uint16_t space; /* => enum phys_map_space */
> +
> +    /* Number of pages to go through */
> +    uint16_t size;
> +    domid_t foreign_domid; /* IFF gmfn_foreign */
> +
> +    /* Indexes into space being mapped. */
> +    XEN_GUEST_HANDLE(xen_ulong_t) idxs;
> +
> +    /* GPFN in domdwhere the source mapping page should appear. */
> +    XEN_GUEST_HANDLE(xen_pfn_t) gpfns;
> +};
> +typedef struct xen_add_to_physmap_range xen_add_to_physmap_range_t;
> +DEFINE_XEN_GUEST_HANDLE(xen_add_to_physmap_range_t);
> +
>  /*
>   * Unmaps the page appearing at a particular GPFN from the specified guest's
>   * pseudophysical address space.
> diff --git a/xen/include/public/xen.h b/xen/include/public/xen.h
> index 361398b..e42d01f 100644
> --- a/xen/include/public/xen.h
> +++ b/xen/include/public/xen.h
> @@ -49,6 +49,7 @@ DEFINE_XEN_GUEST_HANDLE(void);
>  
>  DEFINE_XEN_GUEST_HANDLE(uint64_t);
>  DEFINE_XEN_GUEST_HANDLE(xen_pfn_t);
> +DEFINE_XEN_GUEST_HANDLE(xen_ulong_t);
>  #endif
>  
>  /*

Re: [PATCH 17/21] xen: xen_ulong_t substitution

[Ian Campbell]

On Fri, 2012-10-05 at 15:13 +0100, Stefano Stabellini wrote:
> xen/include/public/arch-x86/xen.h defines xen_ulong_t but it looks like
> that  it is missing PRI_xen_ulong

I've added:
#define PRI_xen_ulong lx

Ian.

Re: [PATCH 17/21] xen: xen_ulong_t substitution

[Stefano Stabellini]

On Fri, 5 Oct 2012, Ian Campbell wrote:
> On Fri, 2012-10-05 at 11:38 +0100, Ian Campbell wrote:
> > From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
> > 
> > There is still an unwanted unsigned long in the xen public interface:
> > replace it with xen_ulong_t.
> > 
> > Also typedef xen_ulong_t to uint64_t on ARM.
> 
> Should this change be applied to the uses of XEN_GUEST_HANDLE(ulong)
> too? My main concern is the one in struct gnttab_setup_table but there
> are a few others.
> 
> I suspect XEN_GUEST_HANDLE(ulong) needs to be removed entirely,
> everywhere it is used should be XEN_GUEST_HANDLE(xen_ulong_t) instead?

It is not necessary, because all the XEN_GUEST_HANDLE(ulong) are already
64 bit on ARM. A 32 bit guest is going to pass a 32 bit unsigned long in a
64 bit field, while a 64 bit guest is going to pass a 64 bit unsigned
long in a 64 bit field. Either way it will work.

Re: [PATCH 17/21] xen: xen_ulong_t substitution

[Ian Campbell]

On Tue, 2012-10-09 at 13:39 +0100, Stefano Stabellini wrote:
> On Fri, 5 Oct 2012, Ian Campbell wrote:
> > On Fri, 2012-10-05 at 11:38 +0100, Ian Campbell wrote:
> > > From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
> > > 
> > > There is still an unwanted unsigned long in the xen public interface:
> > > replace it with xen_ulong_t.
> > > 
> > > Also typedef xen_ulong_t to uint64_t on ARM.
> > 
> > Should this change be applied to the uses of XEN_GUEST_HANDLE(ulong)
> > too? My main concern is the one in struct gnttab_setup_table but there
> > are a few others.
> > 
> > I suspect XEN_GUEST_HANDLE(ulong) needs to be removed entirely,
> > everywhere it is used should be XEN_GUEST_HANDLE(xen_ulong_t) instead?
> 
> It is not necessary, because all the XEN_GUEST_HANDLE(ulong) are already
> 64 bit on ARM. A 32 bit guest is going to pass a 32 bit unsigned long in a
> 64 bit field, while a 64 bit guest is going to pass a 64 bit unsigned
> long in a 64 bit field. Either way it will work.

XEN_GUEST_HANDLE(ulong) is unsigned long on all platforms, see
xen/include/public/xen.h:
        __DEFINE_XEN_GUEST_HANDLE(ulong, unsigned long);

The existence of this handle is dangerous since it contains a type which
varies in size but it is (slightly) opaque so you might not notice.

The ulong handle is only really usable/desirable on x86 where retaining
the ABI requires us to use unsigned long for some fields, but we have
already defined xen_ulong_t which has the correct semantics on both ARM
and x86.

I propose the following.

8<---------------------------------------------------

>From 9090354c816216d6b9cc462e3e8c380e0001c554 Mon Sep 17 00:00:00 2001
From: Ian Campbell <ian.campbell@citrix.com>
Date: Fri, 5 Oct 2012 16:32:56 +0000
Subject: [PATCH] xen: remove XEN_GUEST_HANDLE(ulong)

Having both this and XEN_GUEST_HANDLE(xen_ulong_t) is confusing and
error prone.

Replace the two remaining uses of the ulong handle, in grant set and
x86 set_gdt hypercalls, with xen_ulong_t.

This correctly sizes the grant frame entry as 64 bit on ARM but
leaves it as unsigned long on x86 (therefore no intended change on
x86). Likewise in set_gdt there is no actual change.

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
---
 xen/arch/x86/mm.c                |    3 ++-
 xen/common/grant_table.c         |    2 +-
 xen/include/asm-x86/hypercall.h  |    2 +-
 xen/include/public/grant_table.h |    2 +-
 xen/include/public/xen.h         |    2 --
 5 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
index f9a41fd..3a11af0 100644
--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -4100,7 +4100,8 @@ long set_gdt(struct vcpu *v,
 }
 
 
-long do_set_gdt(XEN_GUEST_HANDLE_PARAM(ulong) frame_list, unsigned int entries)
+long do_set_gdt(XEN_GUEST_HANDLE_PARAM(xen_ulong_t) frame_list,
+                unsigned int entries)
 {
     int nr_pages = (entries + 511) / 512;
     unsigned long frames[16];
diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
index f4ae9ee..7912769 100644
--- a/xen/common/grant_table.c
+++ b/xen/common/grant_table.c
@@ -1322,7 +1322,7 @@ gnttab_setup_table(
     struct domain *d;
     struct grant_table *gt;
     int            i;
-    unsigned long  gmfn;
+    xen_pfn_t  gmfn;
 
     if ( count != 1 )
         return -EINVAL;
diff --git a/xen/include/asm-x86/hypercall.h b/xen/include/asm-x86/hypercall.h
index bd14220..afa8ba9 100644
--- a/xen/include/asm-x86/hypercall.h
+++ b/xen/include/asm-x86/hypercall.h
@@ -33,7 +33,7 @@ do_mmu_update(
 
 extern long
 do_set_gdt(
-    XEN_GUEST_HANDLE_PARAM(ulong) frame_list,
+    XEN_GUEST_HANDLE_PARAM(xen_ulong_t) frame_list,
     unsigned int entries);
 
 extern long
diff --git a/xen/include/public/grant_table.h b/xen/include/public/grant_table.h
index 28d9476..13cc559 100644
--- a/xen/include/public/grant_table.h
+++ b/xen/include/public/grant_table.h
@@ -385,7 +385,7 @@ struct gnttab_setup_table {
     uint32_t nr_frames;
     /* OUT parameters. */
     int16_t  status;              /* => enum grant_status */
-    XEN_GUEST_HANDLE(ulong) frame_list;
+    XEN_GUEST_HANDLE(xen_pfn_t) frame_list;
 };
 typedef struct gnttab_setup_table gnttab_setup_table_t;
 DEFINE_XEN_GUEST_HANDLE(gnttab_setup_table_t);
diff --git a/xen/include/public/xen.h b/xen/include/public/xen.h
index e42d01f..9a5b394 100644
--- a/xen/include/public/xen.h
+++ b/xen/include/public/xen.h
@@ -43,8 +43,6 @@ DEFINE_XEN_GUEST_HANDLE(char);
 __DEFINE_XEN_GUEST_HANDLE(uchar, unsigned char);
 DEFINE_XEN_GUEST_HANDLE(int);
 __DEFINE_XEN_GUEST_HANDLE(uint,  unsigned int);
-DEFINE_XEN_GUEST_HANDLE(long);
-__DEFINE_XEN_GUEST_HANDLE(ulong, unsigned long);
 DEFINE_XEN_GUEST_HANDLE(void);
 
 DEFINE_XEN_GUEST_HANDLE(uint64_t);
-- 
1.7.9.1

Re: [PATCH 17/21] xen: xen_ulong_t substitution

[Stefano Stabellini]

On Tue, 9 Oct 2012, Ian Campbell wrote:
> On Tue, 2012-10-09 at 13:39 +0100, Stefano Stabellini wrote:
> > On Fri, 5 Oct 2012, Ian Campbell wrote:
> > > On Fri, 2012-10-05 at 11:38 +0100, Ian Campbell wrote:
> > > > From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
> > > > 
> > > > There is still an unwanted unsigned long in the xen public interface:
> > > > replace it with xen_ulong_t.
> > > > 
> > > > Also typedef xen_ulong_t to uint64_t on ARM.
> > > 
> > > Should this change be applied to the uses of XEN_GUEST_HANDLE(ulong)
> > > too? My main concern is the one in struct gnttab_setup_table but there
> > > are a few others.
> > > 
> > > I suspect XEN_GUEST_HANDLE(ulong) needs to be removed entirely,
> > > everywhere it is used should be XEN_GUEST_HANDLE(xen_ulong_t) instead?
> > 
> > It is not necessary, because all the XEN_GUEST_HANDLE(ulong) are already
> > 64 bit on ARM. A 32 bit guest is going to pass a 32 bit unsigned long in a
> > 64 bit field, while a 64 bit guest is going to pass a 64 bit unsigned
> > long in a 64 bit field. Either way it will work.
> 
> XEN_GUEST_HANDLE(ulong) is unsigned long on all platforms, see
> xen/include/public/xen.h:
>         __DEFINE_XEN_GUEST_HANDLE(ulong, unsigned long);
> 
> The existence of this handle is dangerous since it contains a type which
> varies in size but it is (slightly) opaque so you might not notice.
> 
> The ulong handle is only really usable/desirable on x86 where retaining
> the ABI requires us to use unsigned long for some fields, but we have
> already defined xen_ulong_t which has the correct semantics on both ARM
> and x86.
> 
> I propose the following.

It is certainly an improvement. Also I didn't notice the
XEN_GUEST_HANDLE_PARAM(ulong): that is actually an error.
We also need a corresponding patch for Linux.


> 8<---------------------------------------------------
> 
> From 9090354c816216d6b9cc462e3e8c380e0001c554 Mon Sep 17 00:00:00 2001
> From: Ian Campbell <ian.campbell@citrix.com>
> Date: Fri, 5 Oct 2012 16:32:56 +0000
> Subject: [PATCH] xen: remove XEN_GUEST_HANDLE(ulong)
> 
> Having both this and XEN_GUEST_HANDLE(xen_ulong_t) is confusing and
> error prone.
> 
> Replace the two remaining uses of the ulong handle, in grant set and
> x86 set_gdt hypercalls, with xen_ulong_t.
> 
> This correctly sizes the grant frame entry as 64 bit on ARM but
> leaves it as unsigned long on x86 (therefore no intended change on
> x86). Likewise in set_gdt there is no actual change.
> 
> Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
> ---
>  xen/arch/x86/mm.c                |    3 ++-
>  xen/common/grant_table.c         |    2 +-
>  xen/include/asm-x86/hypercall.h  |    2 +-
>  xen/include/public/grant_table.h |    2 +-
>  xen/include/public/xen.h         |    2 --
>  5 files changed, 5 insertions(+), 6 deletions(-)
> 
> diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
> index f9a41fd..3a11af0 100644
> --- a/xen/arch/x86/mm.c
> +++ b/xen/arch/x86/mm.c
> @@ -4100,7 +4100,8 @@ long set_gdt(struct vcpu *v,
>  }
>  
>  
> -long do_set_gdt(XEN_GUEST_HANDLE_PARAM(ulong) frame_list, unsigned int entries)
> +long do_set_gdt(XEN_GUEST_HANDLE_PARAM(xen_ulong_t) frame_list,
> +                unsigned int entries)
>  {
>      int nr_pages = (entries + 511) / 512;
>      unsigned long frames[16];
> diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
> index f4ae9ee..7912769 100644
> --- a/xen/common/grant_table.c
> +++ b/xen/common/grant_table.c
> @@ -1322,7 +1322,7 @@ gnttab_setup_table(
>      struct domain *d;
>      struct grant_table *gt;
>      int            i;
> -    unsigned long  gmfn;
> +    xen_pfn_t  gmfn;
>  
>      if ( count != 1 )
>          return -EINVAL;
> diff --git a/xen/include/asm-x86/hypercall.h b/xen/include/asm-x86/hypercall.h
> index bd14220..afa8ba9 100644
> --- a/xen/include/asm-x86/hypercall.h
> +++ b/xen/include/asm-x86/hypercall.h
> @@ -33,7 +33,7 @@ do_mmu_update(
>  
>  extern long
>  do_set_gdt(
> -    XEN_GUEST_HANDLE_PARAM(ulong) frame_list,
> +    XEN_GUEST_HANDLE_PARAM(xen_ulong_t) frame_list,
>      unsigned int entries);
>  
>  extern long
> diff --git a/xen/include/public/grant_table.h b/xen/include/public/grant_table.h
> index 28d9476..13cc559 100644
> --- a/xen/include/public/grant_table.h
> +++ b/xen/include/public/grant_table.h
> @@ -385,7 +385,7 @@ struct gnttab_setup_table {
>      uint32_t nr_frames;
>      /* OUT parameters. */
>      int16_t  status;              /* => enum grant_status */
> -    XEN_GUEST_HANDLE(ulong) frame_list;
> +    XEN_GUEST_HANDLE(xen_pfn_t) frame_list;
>  };
>  typedef struct gnttab_setup_table gnttab_setup_table_t;
>  DEFINE_XEN_GUEST_HANDLE(gnttab_setup_table_t);
> diff --git a/xen/include/public/xen.h b/xen/include/public/xen.h
> index e42d01f..9a5b394 100644
> --- a/xen/include/public/xen.h
> +++ b/xen/include/public/xen.h
> @@ -43,8 +43,6 @@ DEFINE_XEN_GUEST_HANDLE(char);
>  __DEFINE_XEN_GUEST_HANDLE(uchar, unsigned char);
>  DEFINE_XEN_GUEST_HANDLE(int);
>  __DEFINE_XEN_GUEST_HANDLE(uint,  unsigned int);
> -DEFINE_XEN_GUEST_HANDLE(long);
> -__DEFINE_XEN_GUEST_HANDLE(ulong, unsigned long);
>  DEFINE_XEN_GUEST_HANDLE(void);
>  
>  DEFINE_XEN_GUEST_HANDLE(uint64_t);
> -- 
> 1.7.9.1
> 
> 
> 
> 

Re: [PATCH 17/21] xen: xen_ulong_t substitution

[Ian Campbell]

On Tue, 2012-10-09 at 13:51 +0100, Stefano Stabellini wrote:
> On Tue, 9 Oct 2012, Ian Campbell wrote:
> > On Tue, 2012-10-09 at 13:39 +0100, Stefano Stabellini wrote:
> > > On Fri, 5 Oct 2012, Ian Campbell wrote:
> > > > On Fri, 2012-10-05 at 11:38 +0100, Ian Campbell wrote:
> > > > > From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
> > > > > 
> > > > > There is still an unwanted unsigned long in the xen public interface:
> > > > > replace it with xen_ulong_t.
> > > > > 
> > > > > Also typedef xen_ulong_t to uint64_t on ARM.
> > > > 
> > > > Should this change be applied to the uses of XEN_GUEST_HANDLE(ulong)
> > > > too? My main concern is the one in struct gnttab_setup_table but there
> > > > are a few others.
> > > > 
> > > > I suspect XEN_GUEST_HANDLE(ulong) needs to be removed entirely,
> > > > everywhere it is used should be XEN_GUEST_HANDLE(xen_ulong_t) instead?
> > > 
> > > It is not necessary, because all the XEN_GUEST_HANDLE(ulong) are already
> > > 64 bit on ARM. A 32 bit guest is going to pass a 32 bit unsigned long in a
> > > 64 bit field, while a 64 bit guest is going to pass a 64 bit unsigned
> > > long in a 64 bit field. Either way it will work.
> > 
> > XEN_GUEST_HANDLE(ulong) is unsigned long on all platforms, see
> > xen/include/public/xen.h:
> >         __DEFINE_XEN_GUEST_HANDLE(ulong, unsigned long);
> > 
> > The existence of this handle is dangerous since it contains a type which
> > varies in size but it is (slightly) opaque so you might not notice.
> > 
> > The ulong handle is only really usable/desirable on x86 where retaining
> > the ABI requires us to use unsigned long for some fields, but we have
> > already defined xen_ulong_t which has the correct semantics on both ARM
> > and x86.
> > 
> > I propose the following.
> 
> It is certainly an improvement. Also I didn't notice the
> XEN_GUEST_HANDLE_PARAM(ulong): that is actually an error.
> We also need a corresponding patch for Linux.

I need to tesdt both this and the h/v side a bit more but here it is.

8<---------------------------

>From c55591bbe3b1d5164641075b95f3c95418bcdf79 Mon Sep 17 00:00:00 2001
From: Ian Campbell <ian.campbell@citrix.com>
Date: Fri, 5 Oct 2012 17:39:19 +0100
Subject: [PATCH] xen: grant: use xen_pfn_t type for frame_list.

This correctly sizes it as 64 bit on ARM but leaves it as unsigned
long on x86 (therefore no intended change on x86).

The long and ulong guest handles are now unused (and a bit dangerous)
so remove them.

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
---
 arch/arm/include/asm/xen/interface.h |    2 --
 arch/x86/include/asm/xen/interface.h |    2 --
 include/xen/interface/grant_table.h  |    2 +-
 3 files changed, 1 insertions(+), 5 deletions(-)

diff --git a/arch/arm/include/asm/xen/interface.h b/arch/arm/include/asm/xen/interface.h
index ad87917..9ac9f4e 100644
--- a/arch/arm/include/asm/xen/interface.h
+++ b/arch/arm/include/asm/xen/interface.h
@@ -35,10 +35,8 @@ typedef uint64_t xen_ulong_t;
 /* Guest handles for primitive C types. */
 __DEFINE_GUEST_HANDLE(uchar, unsigned char);
 __DEFINE_GUEST_HANDLE(uint,  unsigned int);
-__DEFINE_GUEST_HANDLE(ulong, unsigned long);
 DEFINE_GUEST_HANDLE(char);
 DEFINE_GUEST_HANDLE(int);
-DEFINE_GUEST_HANDLE(long);
 DEFINE_GUEST_HANDLE(void);
 DEFINE_GUEST_HANDLE(uint64_t);
 DEFINE_GUEST_HANDLE(uint32_t);
diff --git a/arch/x86/include/asm/xen/interface.h b/arch/x86/include/asm/xen/interface.h
index d67f3c6..ed602f8 100644
--- a/arch/x86/include/asm/xen/interface.h
+++ b/arch/x86/include/asm/xen/interface.h
@@ -55,10 +55,8 @@ typedef unsigned long xen_ulong_t;
 /* Guest handles for primitive C types. */
 __DEFINE_GUEST_HANDLE(uchar, unsigned char);
 __DEFINE_GUEST_HANDLE(uint,  unsigned int);
-__DEFINE_GUEST_HANDLE(ulong, unsigned long);
 DEFINE_GUEST_HANDLE(char);
 DEFINE_GUEST_HANDLE(int);
-DEFINE_GUEST_HANDLE(long);
 DEFINE_GUEST_HANDLE(void);
 DEFINE_GUEST_HANDLE(uint64_t);
 DEFINE_GUEST_HANDLE(uint32_t);
diff --git a/include/xen/interface/grant_table.h b/include/xen/interface/grant_table.h
index f9f8b97..e40fae9 100644
--- a/include/xen/interface/grant_table.h
+++ b/include/xen/interface/grant_table.h
@@ -310,7 +310,7 @@ struct gnttab_setup_table {
     uint32_t nr_frames;
     /* OUT parameters. */
     int16_t  status;              /* GNTST_* */
-    GUEST_HANDLE(ulong) frame_list;
+    GUEST_HANDLE(xen_pfn_t) frame_list;
 };
 DEFINE_GUEST_HANDLE_STRUCT(gnttab_setup_table);
 
-- 
1.7.2.5

Re: [PATCH 00/21] Sweep through arm-for-4.3 branch + a bit extra

[Ian Campbell]

On Fri, 2012-10-05 at 11:36 +0100, Ian Campbell wrote:

[...]
> 02   B	libxc: add ARM support to xc_dom (PV domain building)
> 03  AB	arm: implement VGCF_online
> 04  AB	xen/arm: implement page reference and gnttab functions needed by grant_table.c
> 05  AB	xen/arm: implement get/put_page_type
> 06  AB	xen/arm: create_p2m_entries should not call free_domheap_page
[...]
> 08   B	arm: kill a guest which uses hvc with an immediate operand != XEN_HYPERCALL_TAG
> 09  AB	libxc/arm: allocate xenstore and console pages
> 10  AB	arm: disable distributor delivery on boot CPU only
> 11  AB	xen/arm: protect LR registers and lr_mask changes with spin_lock_irq
> 12  AB	xen/arm: introduce __lshrdi3 and __aeabi_llsr
> 13  AB	arm: don't bother setting up vtimer, vgic etc on idle CPUs
> 14  AB	arm/vtimer: convert result to ticks when reading CNTPCT register
> 15  AB	arm: Use per-CPU irq_desc for PPIs and SGIs

Stefano acked #2 so I've applied this subset of the series.

I skipped #1 (add_to_physmap_range) which is not yet acked and #7
because it depends on #1 and #16 onwards.

Ian.