So it would appear that given the mfn of the xen_start_info
structure
of a domain, then the pfn_to_mfn_frame_list_list could be tracked down.
Even easier -- just getting the mfn of the "shared_info" page would be
even less painful. Take the xen_start_info page right out of the
picture...
Dave