Merge branch 'linus' into x86/x2apic

13 files changed, 1425 insertions, 343 deletions

diff --git a/arch/x86/xen/Kconfig b/arch/x86/xen/Kconfig
index c2cc99580871..3815e425f470 100644
--- a/arch/x86/xen/Kconfig
+++ b/arch/x86/xen/Kconfig
@@ -6,8 +6,8 @@ config XEN
         bool "Xen guest support"
         select PARAVIRT
         select PARAVIRT_CLOCK
-        depends on X86_32
-        depends on X86_CMPXCHG && X86_TSC && X86_PAE && !(X86_VISWS || X86_VOYAGER)
+        depends on X86_64 || (X86_32 && X86_PAE && !(X86_VISWS || X86_VOYAGER))
+        depends on X86_CMPXCHG && X86_TSC
         help
           This is the Linux Xen port.  Enabling this will allow the
           kernel to boot in a paravirtualized environment under the
@@ -15,10 +15,16 @@ config XEN
 
 config XEN_MAX_DOMAIN_MEMORY
        int "Maximum allowed size of a domain in gigabytes"
-       default 8
+       default 8 if X86_32
+       default 32 if X86_64
        depends on XEN
        help
          The pseudo-physical to machine address array is sized
          according to the maximum possible memory size of a Xen
          domain.  This array uses 1 page per gigabyte, so there's no
-         need to be too stingy here.
\ No newline at end of file
+         need to be too stingy here.
+
+config XEN_SAVE_RESTORE
+       bool
+       depends on PM
+       default y
\ No newline at end of file
diff --git a/arch/x86/xen/Makefile b/arch/x86/xen/Makefile
index 2ba2d1649131..59c1e539aed2 100644
--- a/arch/x86/xen/Makefile
+++ b/arch/x86/xen/Makefile
@@ -1,4 +1,4 @@
 obj-y           := enlighten.o setup.o multicalls.o mmu.o \
-                        time.o xen-asm.o grant-table.o suspend.o
+                        time.o xen-asm_$(BITS).o grant-table.o suspend.o
 
 obj-$(CONFIG_SMP)       += smp.o
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index e4d1459a63df..c910345860c3 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -33,6 +33,7 @@
 #include <xen/interface/sched.h>
 #include <xen/features.h>
 #include <xen/page.h>
+#include <xen/hvc-console.h>
 
 #include <asm/paravirt.h>
 #include <asm/apic.h>
@@ -41,12 +42,12 @@
 #include <asm/xen/hypervisor.h>
 #include <asm/fixmap.h>
 #include <asm/processor.h>
+#include <asm/msr-index.h>
 #include <asm/setup.h>
 #include <asm/desc.h>
 #include <asm/pgtable.h>
 #include <asm/tlbflush.h>
 #include <asm/reboot.h>
-#include <asm/pgalloc.h>
 
 #include "xen-ops.h"
 #include "mmu.h"
@@ -58,6 +59,18 @@ DEFINE_PER_CPU(struct vcpu_info *, xen_vcpu);
 DEFINE_PER_CPU(struct vcpu_info, xen_vcpu_info);
 
 /*
+ * Identity map, in addition to plain kernel map.  This needs to be
+ * large enough to allocate page table pages to allocate the rest.
+ * Each page can map 2MB.
+ */
+static pte_t level1_ident_pgt[PTRS_PER_PTE * 4] __page_aligned_bss;
+
+#ifdef CONFIG_X86_64
+/* l3 pud for userspace vsyscall mapping */
+static pud_t level3_user_vsyscall[PTRS_PER_PUD] __page_aligned_bss;
+#endif /* CONFIG_X86_64 */
+
+/*
  * Note about cr3 (pagetable base) values:
  *
  * xen_cr3 contains the current logical cr3 value; it contains the
@@ -168,10 +181,14 @@ void xen_vcpu_restore(void)
 
 static void __init xen_banner(void)
 {
+        unsigned version = HYPERVISOR_xen_version(XENVER_version, NULL);
+        struct xen_extraversion extra;
+        HYPERVISOR_xen_version(XENVER_extraversion, &extra);
+
         printk(KERN_INFO "Booting paravirtualized kernel on %s\n",
                pv_info.name);
-        printk(KERN_INFO "Hypervisor signature: %s%s\n",
-               xen_start_info->magic,
+        printk(KERN_INFO "Xen version: %d.%d%s%s\n",
+               version >> 16, version & 0xffff, extra.extraversion,
                xen_feature(XENFEAT_mmu_pt_update_preserve_ad) ? " (preserve-AD)" : "");
 }
 
@@ -364,14 +381,6 @@ static void load_TLS_descriptor(struct thread_struct *t,
 
 static void xen_load_tls(struct thread_struct *t, unsigned int cpu)
 {
-        xen_mc_batch();
-
-        load_TLS_descriptor(t, cpu, 0);
-        load_TLS_descriptor(t, cpu, 1);
-        load_TLS_descriptor(t, cpu, 2);
-
-        xen_mc_issue(PARAVIRT_LAZY_CPU);
-
         /*
          * XXX sleazy hack: If we're being called in a lazy-cpu zone,
          * it means we're in a context switch, and %gs has just been
@@ -380,10 +389,39 @@ static void xen_load_tls(struct thread_struct *t, unsigned int cpu)
          * Either way, it has been saved, and the new value will get
          * loaded properly.  This will go away as soon as Xen has been
          * modified to not save/restore %gs for normal hypercalls.
+         *
+         * On x86_64, this hack is not used for %gs, because gs points
+         * to KERNEL_GS_BASE (and uses it for PDA references), so we
+         * must not zero %gs on x86_64
+         *
+         * For x86_64, we need to zero %fs, otherwise we may get an
+         * exception between the new %fs descriptor being loaded and
+         * %fs being effectively cleared at __switch_to().
          */
-        if (paravirt_get_lazy_mode() == PARAVIRT_LAZY_CPU)
+        if (paravirt_get_lazy_mode() == PARAVIRT_LAZY_CPU) {
+#ifdef CONFIG_X86_32
                 loadsegment(gs, 0);
+#else
+                loadsegment(fs, 0);
+#endif
+        }
+
+        xen_mc_batch();
+
+        load_TLS_descriptor(t, cpu, 0);
+        load_TLS_descriptor(t, cpu, 1);
+        load_TLS_descriptor(t, cpu, 2);
+
+        xen_mc_issue(PARAVIRT_LAZY_CPU);
+}
+
+#ifdef CONFIG_X86_64
+static void xen_load_gs_index(unsigned int idx)
+{
+        if (HYPERVISOR_set_segment_base(SEGBASE_GS_USER_SEL, idx))
+                BUG();
 }
+#endif
 
 static void xen_write_ldt_entry(struct desc_struct *dt, int entrynum,
                                 const void *ptr)
@@ -401,23 +439,18 @@ static void xen_write_ldt_entry(struct desc_struct *dt, int entrynum,
         preempt_enable();
 }
 
-static int cvt_gate_to_trap(int vector, u32 low, u32 high,
+static int cvt_gate_to_trap(int vector, const gate_desc *val,
                             struct trap_info *info)
 {
-        u8 type, dpl;
-
-        type = (high >> 8) & 0x1f;
-        dpl = (high >> 13) & 3;
-
-        if (type != 0xf && type != 0xe)
+        if (val->type != 0xf && val->type != 0xe)
                 return 0;
 
         info->vector = vector;
-        info->address = (high & 0xffff0000) | (low & 0x0000ffff);
-        info->cs = low >> 16;
-        info->flags = dpl;
+        info->address = gate_offset(*val);
+        info->cs = gate_segment(*val);
+        info->flags = val->dpl;
         /* interrupt gates clear IF */
-        if (type == 0xe)
+        if (val->type == 0xe)
                 info->flags |= 4;
 
         return 1;
@@ -444,11 +477,10 @@ static void xen_write_idt_entry(gate_desc *dt, int entrynum, const gate_desc *g)
 
         if (p >= start && (p + 8) <= end) {
                 struct trap_info info[2];
-                u32 *desc = (u32 *)g;
 
                 info[1].address = 0;
 
-                if (cvt_gate_to_trap(entrynum, desc[0], desc[1], &info[0]))
+                if (cvt_gate_to_trap(entrynum, g, &info[0]))
                         if (HYPERVISOR_set_trap_table(info))
                                 BUG();
         }
@@ -461,13 +493,13 @@ static void xen_convert_trap_info(const struct desc_ptr *desc,
 {
         unsigned in, out, count;
 
-        count = (desc->size+1) / 8;
+        count = (desc->size+1) / sizeof(gate_desc);
         BUG_ON(count > 256);
 
         for (in = out = 0; in < count; in++) {
-                const u32 *entry = (u32 *)(desc->address + in * 8);
+                gate_desc *entry = (gate_desc*)(desc->address) + in;
 
-                if (cvt_gate_to_trap(in, entry[0], entry[1], &traps[out]))
+                if (cvt_gate_to_trap(in, entry, &traps[out]))
                         out++;
         }
         traps[out].address = 0;
@@ -727,33 +759,89 @@ static void set_current_cr3(void *v)
         x86_write_percpu(xen_current_cr3, (unsigned long)v);
 }
 
-static void xen_write_cr3(unsigned long cr3)
+static void __xen_write_cr3(bool kernel, unsigned long cr3)
 {
         struct mmuext_op *op;
         struct multicall_space mcs;
-        unsigned long mfn = pfn_to_mfn(PFN_DOWN(cr3));
+        unsigned long mfn;
 
-        BUG_ON(preemptible());
+        if (cr3)
+                mfn = pfn_to_mfn(PFN_DOWN(cr3));
+        else
+                mfn = 0;
 
-        mcs = xen_mc_entry(sizeof(*op));  /* disables interrupts */
+        WARN_ON(mfn == 0 && kernel);
 
-        /* Update while interrupts are disabled, so its atomic with
-           respect to ipis */
-        x86_write_percpu(xen_cr3, cr3);
+        mcs = __xen_mc_entry(sizeof(*op));
 
         op = mcs.args;
-        op->cmd = MMUEXT_NEW_BASEPTR;
+        op->cmd = kernel ? MMUEXT_NEW_BASEPTR : MMUEXT_NEW_USER_BASEPTR;
         op->arg1.mfn = mfn;
 
         MULTI_mmuext_op(mcs.mc, op, 1, NULL, DOMID_SELF);
 
-        /* Update xen_update_cr3 once the batch has actually
-           been submitted. */
-        xen_mc_callback(set_current_cr3, (void *)cr3);
+        if (kernel) {
+                x86_write_percpu(xen_cr3, cr3);
+
+                /* Update xen_current_cr3 once the batch has actually
+                   been submitted. */
+                xen_mc_callback(set_current_cr3, (void *)cr3);
+        }
+}
+
+static void xen_write_cr3(unsigned long cr3)
+{
+        BUG_ON(preemptible());
+
+        xen_mc_batch();  /* disables interrupts */
+
+        /* Update while interrupts are disabled, so its atomic with
+           respect to ipis */
+        x86_write_percpu(xen_cr3, cr3);
+
+        __xen_write_cr3(true, cr3);
+
+#ifdef CONFIG_X86_64
+        {
+                pgd_t *user_pgd = xen_get_user_pgd(__va(cr3));
+                if (user_pgd)
+                        __xen_write_cr3(false, __pa(user_pgd));
+                else
+                        __xen_write_cr3(false, 0);
+        }
+#endif
 
         xen_mc_issue(PARAVIRT_LAZY_CPU);  /* interrupts restored */
 }
 
+static int xen_write_msr_safe(unsigned int msr, unsigned low, unsigned high)
+{
+        int ret;
+
+        ret = 0;
+
+        switch(msr) {
+#ifdef CONFIG_X86_64
+                unsigned which;
+                u64 base;
+
+        case MSR_FS_BASE:               which = SEGBASE_FS; goto set;
+        case MSR_KERNEL_GS_BASE:        which = SEGBASE_GS_USER; goto set;
+        case MSR_GS_BASE:               which = SEGBASE_GS_KERNEL; goto set;
+
+        set:
+                base = ((u64)high << 32) | low;
+                if (HYPERVISOR_set_segment_base(which, base) != 0)
+                        ret = -EFAULT;
+                break;
+#endif
+        default:
+                ret = native_write_msr_safe(msr, low, high);
+        }
+
+        return ret;
+}
+
 /* Early in boot, while setting up the initial pagetable, assume
    everything is pinned. */
 static __init void xen_alloc_pte_init(struct mm_struct *mm, u32 pfn)
@@ -810,6 +898,48 @@ static void xen_alloc_pmd(struct mm_struct *mm, u32 pfn)
         xen_alloc_ptpage(mm, pfn, PT_PMD);
 }
 
+static int xen_pgd_alloc(struct mm_struct *mm)
+{
+        pgd_t *pgd = mm->pgd;
+        int ret = 0;
+
+        BUG_ON(PagePinned(virt_to_page(pgd)));
+
+#ifdef CONFIG_X86_64
+        {
+                struct page *page = virt_to_page(pgd);
+                pgd_t *user_pgd;
+
+                BUG_ON(page->private != 0);
+
+                ret = -ENOMEM;
+
+                user_pgd = (pgd_t *)__get_free_page(GFP_KERNEL | __GFP_ZERO);
+                page->private = (unsigned long)user_pgd;
+
+                if (user_pgd != NULL) {
+                        user_pgd[pgd_index(VSYSCALL_START)] =
+                                __pgd(__pa(level3_user_vsyscall) | _PAGE_TABLE);
+                        ret = 0;
+                }
+
+                BUG_ON(PagePinned(virt_to_page(xen_get_user_pgd(pgd))));
+        }
+#endif
+
+        return ret;
+}
+
+static void xen_pgd_free(struct mm_struct *mm, pgd_t *pgd)
+{
+#ifdef CONFIG_X86_64
+        pgd_t *user_pgd = xen_get_user_pgd(pgd);
+
+        if (user_pgd)
+                free_page((unsigned long)user_pgd);
+#endif
+}
+
 /* This should never happen until we're OK to use struct page */
 static void xen_release_ptpage(u32 pfn, unsigned level)
 {
@@ -835,6 +965,18 @@ static void xen_release_pmd(u32 pfn)
         xen_release_ptpage(pfn, PT_PMD);
 }
 
+#if PAGETABLE_LEVELS == 4
+static void xen_alloc_pud(struct mm_struct *mm, u32 pfn)
+{
+        xen_alloc_ptpage(mm, pfn, PT_PUD);
+}
+
+static void xen_release_pud(u32 pfn)
+{
+        xen_release_ptpage(pfn, PT_PUD);
+}
+#endif
+
 #ifdef CONFIG_HIGHPTE
 static void *xen_kmap_atomic_pte(struct page *page, enum km_type type)
 {
@@ -873,68 +1015,16 @@ static __init void xen_set_pte_init(pte_t *ptep, pte_t pte)
 
 static __init void xen_pagetable_setup_start(pgd_t *base)
 {
-        pgd_t *xen_pgd = (pgd_t *)xen_start_info->pt_base;
-        int i;
-
-        /* special set_pte for pagetable initialization */
-        pv_mmu_ops.set_pte = xen_set_pte_init;
-
-        init_mm.pgd = base;
-        /*
-         * copy top-level of Xen-supplied pagetable into place.  This
-         * is a stand-in while we copy the pmd pages.
-         */
-        memcpy(base, xen_pgd, PTRS_PER_PGD * sizeof(pgd_t));
-
-        /*
-         * For PAE, need to allocate new pmds, rather than
-         * share Xen's, since Xen doesn't like pmd's being
-         * shared between address spaces.
-         */
-        for (i = 0; i < PTRS_PER_PGD; i++) {
-                if (pgd_val_ma(xen_pgd[i]) & _PAGE_PRESENT) {
-                        pmd_t *pmd = (pmd_t *)alloc_bootmem_low_pages(PAGE_SIZE);
-
-                        memcpy(pmd, (void *)pgd_page_vaddr(xen_pgd[i]),
-                               PAGE_SIZE);
-
-                        make_lowmem_page_readonly(pmd);
-
-                        set_pgd(&base[i], __pgd(1 + __pa(pmd)));
-                } else
-                        pgd_clear(&base[i]);
-        }
-
-        /* make sure zero_page is mapped RO so we can use it in pagetables */
-        make_lowmem_page_readonly(empty_zero_page);
-        make_lowmem_page_readonly(base);
-        /*
-         * Switch to new pagetable.  This is done before
-         * pagetable_init has done anything so that the new pages
-         * added to the table can be prepared properly for Xen.
-         */
-        xen_write_cr3(__pa(base));
-
-        /* Unpin initial Xen pagetable */
-        pin_pagetable_pfn(MMUEXT_UNPIN_TABLE,
-                          PFN_DOWN(__pa(xen_start_info->pt_base)));
 }
 
 void xen_setup_shared_info(void)
 {
         if (!xen_feature(XENFEAT_auto_translated_physmap)) {
-                unsigned long addr = fix_to_virt(FIX_PARAVIRT_BOOTMAP);
-
-                /*
-                 * Create a mapping for the shared info page.
-                 * Should be set_fixmap(), but shared_info is a machine
-                 * address with no corresponding pseudo-phys address.
-                 */
-                set_pte_mfn(addr,
-                            PFN_DOWN(xen_start_info->shared_info),
-                            PAGE_KERNEL);
-
-                HYPERVISOR_shared_info = (struct shared_info *)addr;
+                set_fixmap(FIX_PARAVIRT_BOOTMAP,
+                           xen_start_info->shared_info);
+
+                HYPERVISOR_shared_info =
+                        (struct shared_info *)fix_to_virt(FIX_PARAVIRT_BOOTMAP);
         } else
                 HYPERVISOR_shared_info =
                         (struct shared_info *)__va(xen_start_info->shared_info);
@@ -949,26 +1039,32 @@ void xen_setup_shared_info(void)
 
 static __init void xen_pagetable_setup_done(pgd_t *base)
 {
-        /* This will work as long as patching hasn't happened yet
-           (which it hasn't) */
-        pv_mmu_ops.alloc_pte = xen_alloc_pte;
-        pv_mmu_ops.alloc_pmd = xen_alloc_pmd;
-        pv_mmu_ops.release_pte = xen_release_pte;
-        pv_mmu_ops.release_pmd = xen_release_pmd;
-        pv_mmu_ops.set_pte = xen_set_pte;
-
         xen_setup_shared_info();
-
-        /* Actually pin the pagetable down, but we can't set PG_pinned
-           yet because the page structures don't exist yet. */
-        pin_pagetable_pfn(MMUEXT_PIN_L3_TABLE, PFN_DOWN(__pa(base)));
 }
 
 static __init void xen_post_allocator_init(void)
 {
+        pv_mmu_ops.set_pte = xen_set_pte;
         pv_mmu_ops.set_pmd = xen_set_pmd;
         pv_mmu_ops.set_pud = xen_set_pud;
+#if PAGETABLE_LEVELS == 4
+        pv_mmu_ops.set_pgd = xen_set_pgd;
+#endif
+
+        /* This will work as long as patching hasn't happened yet
+           (which it hasn't) */
+        pv_mmu_ops.alloc_pte = xen_alloc_pte;
+        pv_mmu_ops.alloc_pmd = xen_alloc_pmd;
+        pv_mmu_ops.release_pte = xen_release_pte;
+        pv_mmu_ops.release_pmd = xen_release_pmd;
+#if PAGETABLE_LEVELS == 4
+        pv_mmu_ops.alloc_pud = xen_alloc_pud;
+        pv_mmu_ops.release_pud = xen_release_pud;
+#endif
 
+#ifdef CONFIG_X86_64
+        SetPagePinned(virt_to_page(level3_user_vsyscall));
+#endif
         xen_mark_init_mm_pinned();
 }
 
@@ -982,6 +1078,7 @@ void xen_setup_vcpu_info_placement(void)
 
         /* xen_vcpu_setup managed to place the vcpu_info within the
            percpu area for all cpus, so make use of it */
+#ifdef CONFIG_X86_32
         if (have_vcpu_info_placement) {
                 printk(KERN_INFO "Xen: using vcpu_info placement\n");
 
@@ -991,6 +1088,7 @@ void xen_setup_vcpu_info_placement(void)
                 pv_irq_ops.irq_enable = xen_irq_enable_direct;
                 pv_mmu_ops.read_cr2 = xen_read_cr2_direct;
         }
+#endif
 }
 
 static unsigned xen_patch(u8 type, u16 clobbers, void *insnbuf,
@@ -1011,10 +1109,12 @@ static unsigned xen_patch(u8 type, u16 clobbers, void *insnbuf,
         goto patch_site
 
         switch (type) {
+#ifdef CONFIG_X86_32
                 SITE(pv_irq_ops, irq_enable);
                 SITE(pv_irq_ops, irq_disable);
                 SITE(pv_irq_ops, save_fl);
                 SITE(pv_irq_ops, restore_fl);
+#endif /* CONFIG_X86_32 */
 #undef SITE
 
         patch_site:
@@ -1057,8 +1157,15 @@ static void xen_set_fixmap(unsigned idx, unsigned long phys, pgprot_t prot)
 #ifdef CONFIG_X86_F00F_BUG
         case FIX_F00F_IDT:
 #endif
+#ifdef CONFIG_X86_32
         case FIX_WP_TEST:
         case FIX_VDSO:
+# ifdef CONFIG_HIGHMEM
+        case FIX_KMAP_BEGIN ... FIX_KMAP_END:
+# endif
+#else
+        case VSYSCALL_LAST_PAGE ... VSYSCALL_FIRST_PAGE:
+#endif
 #ifdef CONFIG_X86_LOCAL_APIC
         case FIX_APIC_BASE:     /* maps dummy local APIC */
 #endif
@@ -1071,6 +1178,15 @@ static void xen_set_fixmap(unsigned idx, unsigned long phys, pgprot_t prot)
         }
 
         __native_set_fixmap(idx, pte);
+
+#ifdef CONFIG_X86_64
+        /* Replicate changes to map the vsyscall page into the user
+           pagetable vsyscall mapping. */
+        if (idx >= VSYSCALL_LAST_PAGE && idx <= VSYSCALL_FIRST_PAGE) {
+                unsigned long vaddr = __fix_to_virt(idx);
+                set_pte_vaddr_pud(level3_user_vsyscall, vaddr, pte);
+        }
+#endif
 }
 
 static const struct pv_info xen_info __initdata = {
@@ -1116,18 +1232,25 @@ static const struct pv_cpu_ops xen_cpu_ops __initdata = {
         .wbinvd = native_wbinvd,
 
         .read_msr = native_read_msr_safe,
-        .write_msr = native_write_msr_safe,
+        .write_msr = xen_write_msr_safe,
         .read_tsc = native_read_tsc,
         .read_pmc = native_read_pmc,
 
         .iret = xen_iret,
         .irq_enable_sysexit = xen_sysexit,
+#ifdef CONFIG_X86_64
+        .usergs_sysret32 = xen_sysret32,
+        .usergs_sysret64 = xen_sysret64,
+#endif
 
         .load_tr_desc = paravirt_nop,
         .set_ldt = xen_set_ldt,
         .load_gdt = xen_load_gdt,
         .load_idt = xen_load_idt,
         .load_tls = xen_load_tls,
+#ifdef CONFIG_X86_64
+        .load_gs_index = xen_load_gs_index,
+#endif
 
         .store_gdt = native_store_gdt,
         .store_idt = native_store_idt,
@@ -1141,14 +1264,34 @@ static const struct pv_cpu_ops xen_cpu_ops __initdata = {
         .set_iopl_mask = xen_set_iopl_mask,
         .io_delay = xen_io_delay,
 
+        /* Xen takes care of %gs when switching to usermode for us */
+        .swapgs = paravirt_nop,
+
         .lazy_mode = {
                 .enter = paravirt_enter_lazy_cpu,
                 .leave = xen_leave_lazy,
         },
 };
 
+static void __init __xen_init_IRQ(void)
+{
+#ifdef CONFIG_X86_64
+        int i;
+
+        /* Create identity vector->irq map */
+        for(i = 0; i < NR_VECTORS; i++) {
+                int cpu;
+
+                for_each_possible_cpu(cpu)
+                        per_cpu(vector_irq, cpu)[i] = i;
+        }
+#endif  /* CONFIG_X86_64 */
+
+        xen_init_IRQ();
+}
+
 static const struct pv_irq_ops xen_irq_ops __initdata = {
-        .init_IRQ = xen_init_IRQ,
+        .init_IRQ = __xen_init_IRQ,
         .save_fl = xen_save_fl,
         .restore_fl = xen_restore_fl,
         .irq_disable = xen_irq_disable,
@@ -1156,7 +1299,7 @@ static const struct pv_irq_ops xen_irq_ops __initdata = {
         .safe_halt = xen_safe_halt,
         .halt = xen_halt,
 #ifdef CONFIG_X86_64
-        .adjust_exception_frame = paravirt_nop,
+        .adjust_exception_frame = xen_adjust_exception_frame,
 #endif
 };
 
@@ -1186,8 +1329,8 @@ static const struct pv_mmu_ops xen_mmu_ops __initdata = {
         .pte_update = paravirt_nop,
         .pte_update_defer = paravirt_nop,
 
-        .pgd_alloc = __paravirt_pgd_alloc,
-        .pgd_free = paravirt_nop,
+        .pgd_alloc = xen_pgd_alloc,
+        .pgd_free = xen_pgd_free,
 
         .alloc_pte = xen_alloc_pte_init,
         .release_pte = xen_release_pte_init,
@@ -1199,7 +1342,11 @@ static const struct pv_mmu_ops xen_mmu_ops __initdata = {
         .kmap_atomic_pte = xen_kmap_atomic_pte,
 #endif
 
-        .set_pte = NULL,        /* see xen_pagetable_setup_* */
+#ifdef CONFIG_X86_64
+        .set_pte = xen_set_pte,
+#else
+        .set_pte = xen_set_pte_init,
+#endif
         .set_pte_at = xen_set_pte_at,
         .set_pmd = xen_set_pmd_hyper,
 
@@ -1213,15 +1360,26 @@ static const struct pv_mmu_ops xen_mmu_ops __initdata = {
         .make_pte = xen_make_pte,
         .make_pgd = xen_make_pgd,
 
+#ifdef CONFIG_X86_PAE
         .set_pte_atomic = xen_set_pte_atomic,
         .set_pte_present = xen_set_pte_at,
-        .set_pud = xen_set_pud_hyper,
         .pte_clear = xen_pte_clear,
         .pmd_clear = xen_pmd_clear,
+#endif  /* CONFIG_X86_PAE */
+        .set_pud = xen_set_pud_hyper,
 
         .make_pmd = xen_make_pmd,
         .pmd_val = xen_pmd_val,
 
+#if PAGETABLE_LEVELS == 4
+        .pud_val = xen_pud_val,
+        .make_pud = xen_make_pud,
+        .set_pgd = xen_set_pgd_hyper,
+
+        .alloc_pud = xen_alloc_pte_init,
+        .release_pud = xen_release_pte_init,
+#endif  /* PAGETABLE_LEVELS == 4 */
+
         .activate_mm = xen_activate_mm,
         .dup_mmap = xen_dup_mmap,
         .exit_mmap = xen_exit_mmap,
@@ -1234,21 +1392,6 @@ static const struct pv_mmu_ops xen_mmu_ops __initdata = {
         .set_fixmap = xen_set_fixmap,
 };
 
-#ifdef CONFIG_SMP
-static const struct smp_ops xen_smp_ops __initdata = {
-        .smp_prepare_boot_cpu = xen_smp_prepare_boot_cpu,
-        .smp_prepare_cpus = xen_smp_prepare_cpus,
-        .cpu_up = xen_cpu_up,
-        .smp_cpus_done = xen_smp_cpus_done,
-
-        .smp_send_stop = xen_smp_send_stop,
-        .smp_send_reschedule = xen_smp_send_reschedule,
-
-        .send_call_func_ipi = xen_smp_send_call_function_ipi,
-        .send_call_func_single_ipi = xen_smp_send_call_function_single_ipi,
-};
-#endif  /* CONFIG_SMP */
-
 static void xen_reboot(int reason)
 {
         struct sched_shutdown r = { .reason = reason };
@@ -1293,6 +1436,7 @@ static const struct machine_ops __initdata xen_machine_ops = {
 
 static void __init xen_reserve_top(void)
 {
+#ifdef CONFIG_X86_32
         unsigned long top = HYPERVISOR_VIRT_START;
         struct xen_platform_parameters pp;
 
@@ -1300,8 +1444,248 @@ static void __init xen_reserve_top(void)
                 top = pp.virt_start;
 
         reserve_top_address(-top + 2 * PAGE_SIZE);
+#endif  /* CONFIG_X86_32 */
+}
+
+/*
+ * Like __va(), but returns address in the kernel mapping (which is
+ * all we have until the physical memory mapping has been set up.
+ */
+static void *__ka(phys_addr_t paddr)
+{
+#ifdef CONFIG_X86_64
+        return (void *)(paddr + __START_KERNEL_map);
+#else
+        return __va(paddr);
+#endif
 }
 
+/* Convert a machine address to physical address */
+static unsigned long m2p(phys_addr_t maddr)
+{
+        phys_addr_t paddr;
+
+        maddr &= PTE_MASK;
+        paddr = mfn_to_pfn(maddr >> PAGE_SHIFT) << PAGE_SHIFT;
+
+        return paddr;
+}
+
+/* Convert a machine address to kernel virtual */
+static void *m2v(phys_addr_t maddr)
+{
+        return __ka(m2p(maddr));
+}
+
+#ifdef CONFIG_X86_64
+static void walk(pgd_t *pgd, unsigned long addr)
+{
+        unsigned l4idx = pgd_index(addr);
+        unsigned l3idx = pud_index(addr);
+        unsigned l2idx = pmd_index(addr);
+        unsigned l1idx = pte_index(addr);
+        pgd_t l4;
+        pud_t l3;
+        pmd_t l2;
+        pte_t l1;
+
+        xen_raw_printk("walk %p, %lx -> %d %d %d %d\n",
+                       pgd, addr, l4idx, l3idx, l2idx, l1idx);
+
+        l4 = pgd[l4idx];
+        xen_raw_printk("  l4: %016lx\n", l4.pgd);
+        xen_raw_printk("      %016lx\n", pgd_val(l4));
+
+        l3 = ((pud_t *)(m2v(l4.pgd)))[l3idx];
+        xen_raw_printk("  l3: %016lx\n", l3.pud);
+        xen_raw_printk("      %016lx\n", pud_val(l3));
+
+        l2 = ((pmd_t *)(m2v(l3.pud)))[l2idx];
+        xen_raw_printk("  l2: %016lx\n", l2.pmd);
+        xen_raw_printk("      %016lx\n", pmd_val(l2));
+
+        l1 = ((pte_t *)(m2v(l2.pmd)))[l1idx];
+        xen_raw_printk("  l1: %016lx\n", l1.pte);
+        xen_raw_printk("      %016lx\n", pte_val(l1));
+}
+#endif
+
+static void set_page_prot(void *addr, pgprot_t prot)
+{
+        unsigned long pfn = __pa(addr) >> PAGE_SHIFT;
+        pte_t pte = pfn_pte(pfn, prot);
+
+        xen_raw_printk("addr=%p pfn=%lx mfn=%lx prot=%016llx pte=%016llx\n",
+                       addr, pfn, get_phys_to_machine(pfn),
+                       pgprot_val(prot), pte.pte);
+
+        if (HYPERVISOR_update_va_mapping((unsigned long)addr, pte, 0))
+                BUG();
+}
+
+static __init void xen_map_identity_early(pmd_t *pmd, unsigned long max_pfn)
+{
+        unsigned pmdidx, pteidx;
+        unsigned ident_pte;
+        unsigned long pfn;
+
+        ident_pte = 0;
+        pfn = 0;
+        for(pmdidx = 0; pmdidx < PTRS_PER_PMD && pfn < max_pfn; pmdidx++) {
+                pte_t *pte_page;
+
+                /* Reuse or allocate a page of ptes */
+                if (pmd_present(pmd[pmdidx]))
+                        pte_page = m2v(pmd[pmdidx].pmd);
+                else {
+                        /* Check for free pte pages */
+                        if (ident_pte == ARRAY_SIZE(level1_ident_pgt))
+                                break;
+
+                        pte_page = &level1_ident_pgt[ident_pte];
+                        ident_pte += PTRS_PER_PTE;
+
+                        pmd[pmdidx] = __pmd(__pa(pte_page) | _PAGE_TABLE);
+                }
+
+                /* Install mappings */
+                for(pteidx = 0; pteidx < PTRS_PER_PTE; pteidx++, pfn++) {
+                        pte_t pte;
+
+                        if (pfn > max_pfn_mapped)
+                                max_pfn_mapped = pfn;
+
+                        if (!pte_none(pte_page[pteidx]))
+                                continue;
+
+                        pte = pfn_pte(pfn, PAGE_KERNEL_EXEC);
+                        pte_page[pteidx] = pte;
+                }
+        }
+
+        for(pteidx = 0; pteidx < ident_pte; pteidx += PTRS_PER_PTE)
+                set_page_prot(&level1_ident_pgt[pteidx], PAGE_KERNEL_RO);
+
+        set_page_prot(pmd, PAGE_KERNEL_RO);
+}
+
+#ifdef CONFIG_X86_64
+static void convert_pfn_mfn(void *v)
+{
+        pte_t *pte = v;
+        int i;
+
+        /* All levels are converted the same way, so just treat them
+           as ptes. */
+        for(i = 0; i < PTRS_PER_PTE; i++)
+                pte[i] = xen_make_pte(pte[i].pte);
+}
+
+/*
+ * Set up the inital kernel pagetable.
+ *
+ * We can construct this by grafting the Xen provided pagetable into
+ * head_64.S's preconstructed pagetables.  We copy the Xen L2's into
+ * level2_ident_pgt, level2_kernel_pgt and level2_fixmap_pgt.  This
+ * means that only the kernel has a physical mapping to start with -
+ * but that's enough to get __va working.  We need to fill in the rest
+ * of the physical mapping once some sort of allocator has been set
+ * up.
+ */
+static __init pgd_t *xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn)
+{
+        pud_t *l3;
+        pmd_t *l2;
+
+        /* Zap identity mapping */
+        init_level4_pgt[0] = __pgd(0);
+
+        /* Pre-constructed entries are in pfn, so convert to mfn */
+        convert_pfn_mfn(init_level4_pgt);
+        convert_pfn_mfn(level3_ident_pgt);
+        convert_pfn_mfn(level3_kernel_pgt);
+
+        l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
+        l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
+
+        memcpy(level2_ident_pgt, l2, sizeof(pmd_t) * PTRS_PER_PMD);
+        memcpy(level2_kernel_pgt, l2, sizeof(pmd_t) * PTRS_PER_PMD);
+
+        l3 = m2v(pgd[pgd_index(__START_KERNEL_map + PMD_SIZE)].pgd);
+        l2 = m2v(l3[pud_index(__START_KERNEL_map + PMD_SIZE)].pud);
+        memcpy(level2_fixmap_pgt, l2, sizeof(pmd_t) * PTRS_PER_PMD);
+
+        /* Set up identity map */
+        xen_map_identity_early(level2_ident_pgt, max_pfn);
+
+        /* Make pagetable pieces RO */
+        set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
+        set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
+        set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
+        set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
+        set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
+        set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
+
+        /* Pin down new L4 */
+        pin_pagetable_pfn(MMUEXT_PIN_L4_TABLE,
+                          PFN_DOWN(__pa_symbol(init_level4_pgt)));
+
+        /* Unpin Xen-provided one */
+        pin_pagetable_pfn(MMUEXT_UNPIN_TABLE, PFN_DOWN(__pa(pgd)));
+
+        /* Switch over */
+        pgd = init_level4_pgt;
+
+        /*
+         * At this stage there can be no user pgd, and no page
+         * structure to attach it to, so make sure we just set kernel
+         * pgd.
+         */
+        xen_mc_batch();
+        __xen_write_cr3(true, __pa(pgd));
+        xen_mc_issue(PARAVIRT_LAZY_CPU);
+
+        reserve_early(__pa(xen_start_info->pt_base),
+                      __pa(xen_start_info->pt_base +
+                           xen_start_info->nr_pt_frames * PAGE_SIZE),
+                      "XEN PAGETABLES");
+
+        return pgd;
+}
+#else   /* !CONFIG_X86_64 */
+static pmd_t level2_kernel_pgt[PTRS_PER_PMD] __page_aligned_bss;
+
+static __init pgd_t *xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn)
+{
+        pmd_t *kernel_pmd;
+
+        init_pg_tables_start = __pa(pgd);
+        init_pg_tables_end = __pa(pgd) + xen_start_info->nr_pt_frames*PAGE_SIZE;
+        max_pfn_mapped = PFN_DOWN(init_pg_tables_end + 512*1024);
+
+        kernel_pmd = m2v(pgd[KERNEL_PGD_BOUNDARY].pgd);
+        memcpy(level2_kernel_pgt, kernel_pmd, sizeof(pmd_t) * PTRS_PER_PMD);
+
+        xen_map_identity_early(level2_kernel_pgt, max_pfn);
+
+        memcpy(swapper_pg_dir, pgd, sizeof(pgd_t) * PTRS_PER_PGD);
+        set_pgd(&swapper_pg_dir[KERNEL_PGD_BOUNDARY],
+                        __pgd(__pa(level2_kernel_pgt) | _PAGE_PRESENT));
+
+        set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
+        set_page_prot(swapper_pg_dir, PAGE_KERNEL_RO);
+        set_page_prot(empty_zero_page, PAGE_KERNEL_RO);
+
+        pin_pagetable_pfn(MMUEXT_UNPIN_TABLE, PFN_DOWN(__pa(pgd)));
+
+        xen_write_cr3(__pa(swapper_pg_dir));
+
+        pin_pagetable_pfn(MMUEXT_PIN_L3_TABLE, PFN_DOWN(__pa(swapper_pg_dir)));
+
+        return swapper_pg_dir;
+}
+#endif  /* CONFIG_X86_64 */
+
 /* First C function to be called on Xen boot */
 asmlinkage void __init xen_start_kernel(void)
 {
@@ -1337,53 +1721,56 @@ asmlinkage void __init xen_start_kernel(void)
 
         machine_ops = xen_machine_ops;
 
-#ifdef CONFIG_SMP
-        smp_ops = xen_smp_ops;
+#ifdef CONFIG_X86_64
+        /* Disable until direct per-cpu data access. */
+        have_vcpu_info_placement = 0;
+        x86_64_init_pda();
 #endif
 
+        xen_smp_init();
+
         /* Get mfn list */
         if (!xen_feature(XENFEAT_auto_translated_physmap))
                 xen_build_dynamic_phys_to_machine();
 
         pgd = (pgd_t *)xen_start_info->pt_base;
 
-        init_pg_tables_start = __pa(pgd);
-        init_pg_tables_end = __pa(pgd) + xen_start_info->nr_pt_frames*PAGE_SIZE;
-        max_pfn_mapped = (init_pg_tables_end + 512*1024) >> PAGE_SHIFT;
-
-        init_mm.pgd = pgd; /* use the Xen pagetables to start */
-
-        /* keep using Xen gdt for now; no urgent need to change it */
-
-        x86_write_percpu(xen_cr3, __pa(pgd));
-        x86_write_percpu(xen_current_cr3, __pa(pgd));
+        /* Prevent unwanted bits from being set in PTEs. */
+        __supported_pte_mask &= ~_PAGE_GLOBAL;
+        if (!is_initial_xendomain())
+                __supported_pte_mask &= ~(_PAGE_PWT | _PAGE_PCD);
 
         /* Don't do the full vcpu_info placement stuff until we have a
            possible map and a non-dummy shared_info. */
         per_cpu(xen_vcpu, 0) = &HYPERVISOR_shared_info->vcpu_info[0];
 
+        xen_raw_console_write("mapping kernel into physical memory\n");
+        pgd = xen_setup_kernel_pagetable(pgd, xen_start_info->nr_pages);
+
+        init_mm.pgd = pgd;
+
+        /* keep using Xen gdt for now; no urgent need to change it */
+
         pv_info.kernel_rpl = 1;
         if (xen_feature(XENFEAT_supervisor_mode_kernel))
                 pv_info.kernel_rpl = 0;
 
-        /* Prevent unwanted bits from being set in PTEs. */
-        __supported_pte_mask &= ~_PAGE_GLOBAL;
-        if (!is_initial_xendomain())
-                __supported_pte_mask &= ~(_PAGE_PWT | _PAGE_PCD);
-
         /* set the limit of our address space */
         xen_reserve_top();
 
+#ifdef CONFIG_X86_32
         /* set up basic CPUID stuff */
         cpu_detect(&new_cpu_data);
         new_cpu_data.hard_math = 1;
         new_cpu_data.x86_capability[0] = cpuid_edx(1);
+#endif
 
         /* Poke various useful things into boot_params */
         boot_params.hdr.type_of_loader = (9 << 4) | 0;
         boot_params.hdr.ramdisk_image = xen_start_info->mod_start
                 ? __pa(xen_start_info->mod_start) : 0;
         boot_params.hdr.ramdisk_size = xen_start_info->mod_len;
+        boot_params.hdr.cmd_line_ptr = __pa(xen_start_info->cmd_line);
 
         if (!is_initial_xendomain()) {
                 add_preferred_console("xenboot", 0, NULL);
@@ -1391,6 +1778,21 @@ asmlinkage void __init xen_start_kernel(void)
                 add_preferred_console("hvc", 0, NULL);
         }
 
+        xen_raw_console_write("about to get started...\n");
+
+#if 0
+        xen_raw_printk("&boot_params=%p __pa(&boot_params)=%lx __va(__pa(&boot_params))=%lx\n",
+                       &boot_params, __pa_symbol(&boot_params),
+                       __va(__pa_symbol(&boot_params)));
+
+        walk(pgd, &boot_params);
+        walk(pgd, __va(__pa(&boot_params)));
+#endif
+
         /* Start the world */
+#ifdef CONFIG_X86_32
         i386_start_kernel();
+#else
+        x86_64_start_reservations((char *)__pa_symbol(&boot_params));
+#endif
 }
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index ff0aa74afaa1..a44d56e38bd1 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -44,8 +44,10 @@
 
 #include <asm/pgtable.h>
 #include <asm/tlbflush.h>
+#include <asm/fixmap.h>
 #include <asm/mmu_context.h>
 #include <asm/paravirt.h>
+#include <asm/linkage.h>
 
 #include <asm/xen/hypercall.h>
 #include <asm/xen/hypervisor.h>
@@ -56,26 +58,29 @@
 #include "multicalls.h"
 #include "mmu.h"
 
+/*
+ * Just beyond the highest usermode address.  STACK_TOP_MAX has a
+ * redzone above it, so round it up to a PGD boundary.
+ */
+#define USER_LIMIT      ((STACK_TOP_MAX + PGDIR_SIZE - 1) & PGDIR_MASK)
+
+
 #define P2M_ENTRIES_PER_PAGE    (PAGE_SIZE / sizeof(unsigned long))
 #define TOP_ENTRIES             (MAX_DOMAIN_PAGES / P2M_ENTRIES_PER_PAGE)
 
 /* Placeholder for holes in the address space */
-static unsigned long p2m_missing[P2M_ENTRIES_PER_PAGE]
-        __attribute__((section(".data.page_aligned"))) =
+static unsigned long p2m_missing[P2M_ENTRIES_PER_PAGE] __page_aligned_data =
                 { [ 0 ... P2M_ENTRIES_PER_PAGE-1 ] = ~0UL };
 
  /* Array of pointers to pages containing p2m entries */
-static unsigned long *p2m_top[TOP_ENTRIES]
-        __attribute__((section(".data.page_aligned"))) =
+static unsigned long *p2m_top[TOP_ENTRIES] __page_aligned_data =
                 { [ 0 ... TOP_ENTRIES - 1] = &p2m_missing[0] };
 
 /* Arrays of p2m arrays expressed in mfns used for save/restore */
-static unsigned long p2m_top_mfn[TOP_ENTRIES]
-        __attribute__((section(".bss.page_aligned")));
+static unsigned long p2m_top_mfn[TOP_ENTRIES] __page_aligned_bss;
 
-static unsigned long p2m_top_mfn_list[
-                        PAGE_ALIGN(TOP_ENTRIES / P2M_ENTRIES_PER_PAGE)]
-        __attribute__((section(".bss.page_aligned")));
+static unsigned long p2m_top_mfn_list[TOP_ENTRIES / P2M_ENTRIES_PER_PAGE]
+        __page_aligned_bss;
 
 static inline unsigned p2m_top_index(unsigned long pfn)
 {
@@ -181,15 +186,16 @@ void set_phys_to_machine(unsigned long pfn, unsigned long mfn)
         p2m_top[topidx][idx] = mfn;
 }
 
-xmaddr_t arbitrary_virt_to_machine(unsigned long address)
+xmaddr_t arbitrary_virt_to_machine(void *vaddr)
 {
+        unsigned long address = (unsigned long)vaddr;
         unsigned int level;
         pte_t *pte = lookup_address(address, &level);
         unsigned offset = address & ~PAGE_MASK;
 
         BUG_ON(pte == NULL);
 
-        return XMADDR((pte_mfn(*pte) << PAGE_SHIFT) + offset);
+        return XMADDR(((phys_addr_t)pte_mfn(*pte) << PAGE_SHIFT) + offset);
 }
 
 void make_lowmem_page_readonly(void *vaddr)
@@ -256,7 +262,8 @@ void xen_set_pmd_hyper(pmd_t *ptr, pmd_t val)
 
         xen_mc_batch();
 
-        u.ptr = virt_to_machine(ptr).maddr;
+        /* ptr may be ioremapped for 64-bit pagetable setup */
+        u.ptr = arbitrary_virt_to_machine(ptr).maddr;
         u.val = pmd_val_ma(val);
         extend_mmu_update(&u);
 
@@ -283,35 +290,7 @@ void xen_set_pmd(pmd_t *ptr, pmd_t val)
  */
 void set_pte_mfn(unsigned long vaddr, unsigned long mfn, pgprot_t flags)
 {
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
-        pte_t *pte;
-
-        pgd = swapper_pg_dir + pgd_index(vaddr);
-        if (pgd_none(*pgd)) {
-                BUG();
-                return;
-        }
-        pud = pud_offset(pgd, vaddr);
-        if (pud_none(*pud)) {
-                BUG();
-                return;
-        }
-        pmd = pmd_offset(pud, vaddr);
-        if (pmd_none(*pmd)) {
-                BUG();
-                return;
-        }
-        pte = pte_offset_kernel(pmd, vaddr);
-        /* <mfn,flags> stored as-is, to permit clearing entries */
-        xen_set_pte(pte, mfn_pte(mfn, flags));
-
-        /*
-         * It's enough to flush this one mapping.
-         * (PGE mappings get flushed as well)
-         */
-        __flush_tlb_one(vaddr);
+        set_pte_vaddr(vaddr, mfn_pte(mfn, flags));
 }
 
 void xen_set_pte_at(struct mm_struct *mm, unsigned long addr,
@@ -418,7 +397,8 @@ void xen_set_pud_hyper(pud_t *ptr, pud_t val)
 
         xen_mc_batch();
 
-        u.ptr = virt_to_machine(ptr).maddr;
+        /* ptr may be ioremapped for 64-bit pagetable setup */
+        u.ptr = arbitrary_virt_to_machine(ptr).maddr;
         u.val = pud_val_ma(val);
         extend_mmu_update(&u);
 
@@ -441,14 +421,19 @@ void xen_set_pud(pud_t *ptr, pud_t val)
 
 void xen_set_pte(pte_t *ptep, pte_t pte)
 {
+#ifdef CONFIG_X86_PAE
         ptep->pte_high = pte.pte_high;
         smp_wmb();
         ptep->pte_low = pte.pte_low;
+#else
+        *ptep = pte;
+#endif
 }
 
+#ifdef CONFIG_X86_PAE
 void xen_set_pte_atomic(pte_t *ptep, pte_t pte)
 {
-        set_64bit((u64 *)ptep, pte_val_ma(pte));
+        set_64bit((u64 *)ptep, native_pte_val(pte));
 }
 
 void xen_pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
@@ -462,6 +447,7 @@ void xen_pmd_clear(pmd_t *pmdp)
 {
         set_pmd(pmdp, __pmd(0));
 }
+#endif  /* CONFIG_X86_PAE */
 
 pmd_t xen_make_pmd(pmdval_t pmd)
 {
@@ -469,78 +455,189 @@ pmd_t xen_make_pmd(pmdval_t pmd)
         return native_make_pmd(pmd);
 }
 
+#if PAGETABLE_LEVELS == 4
+pudval_t xen_pud_val(pud_t pud)
+{
+        return pte_mfn_to_pfn(pud.pud);
+}
+
+pud_t xen_make_pud(pudval_t pud)
+{
+        pud = pte_pfn_to_mfn(pud);
+
+        return native_make_pud(pud);
+}
+
+pgd_t *xen_get_user_pgd(pgd_t *pgd)
+{
+        pgd_t *pgd_page = (pgd_t *)(((unsigned long)pgd) & PAGE_MASK);
+        unsigned offset = pgd - pgd_page;
+        pgd_t *user_ptr = NULL;
+
+        if (offset < pgd_index(USER_LIMIT)) {
+                struct page *page = virt_to_page(pgd_page);
+                user_ptr = (pgd_t *)page->private;
+                if (user_ptr)
+                        user_ptr += offset;
+        }
+
+        return user_ptr;
+}
+
+static void __xen_set_pgd_hyper(pgd_t *ptr, pgd_t val)
+{
+        struct mmu_update u;
+
+        u.ptr = virt_to_machine(ptr).maddr;
+        u.val = pgd_val_ma(val);
+        extend_mmu_update(&u);
+}
+
+/*
+ * Raw hypercall-based set_pgd, intended for in early boot before
+ * there's a page structure.  This implies:
+ *  1. The only existing pagetable is the kernel's
+ *  2. It is always pinned
+ *  3. It has no user pagetable attached to it
+ */
+void __init xen_set_pgd_hyper(pgd_t *ptr, pgd_t val)
+{
+        preempt_disable();
+
+        xen_mc_batch();
+
+        __xen_set_pgd_hyper(ptr, val);
+
+        xen_mc_issue(PARAVIRT_LAZY_MMU);
+
+        preempt_enable();
+}
+
+void xen_set_pgd(pgd_t *ptr, pgd_t val)
+{
+        pgd_t *user_ptr = xen_get_user_pgd(ptr);
+
+        /* If page is not pinned, we can just update the entry
+           directly */
+        if (!page_pinned(ptr)) {
+                *ptr = val;
+                if (user_ptr) {
+                        WARN_ON(page_pinned(user_ptr));
+                        *user_ptr = val;
+                }
+                return;
+        }
+
+        /* If it's pinned, then we can at least batch the kernel and
+           user updates together. */
+        xen_mc_batch();
+
+        __xen_set_pgd_hyper(ptr, val);
+        if (user_ptr)
+                __xen_set_pgd_hyper(user_ptr, val);
+
+        xen_mc_issue(PARAVIRT_LAZY_MMU);
+}
+#endif  /* PAGETABLE_LEVELS == 4 */
+
 /*
-  (Yet another) pagetable walker.  This one is intended for pinning a
-  pagetable.  This means that it walks a pagetable and calls the
-  callback function on each page it finds making up the page table,
-  at every level.  It walks the entire pagetable, but it only bothers
-  pinning pte pages which are below pte_limit.  In the normal case
-  this will be TASK_SIZE, but at boot we need to pin up to
-  FIXADDR_TOP.  But the important bit is that we don't pin beyond
-  there, because then we start getting into Xen's ptes.
-*/
-static int pgd_walk(pgd_t *pgd_base, int (*func)(struct page *, enum pt_level),
+ * (Yet another) pagetable walker.  This one is intended for pinning a
+ * pagetable.  This means that it walks a pagetable and calls the
+ * callback function on each page it finds making up the page table,
+ * at every level.  It walks the entire pagetable, but it only bothers
+ * pinning pte pages which are below limit.  In the normal case this
+ * will be STACK_TOP_MAX, but at boot we need to pin up to
+ * FIXADDR_TOP.
+ *
+ * For 32-bit the important bit is that we don't pin beyond there,
+ * because then we start getting into Xen's ptes.
+ *
+ * For 64-bit, we must skip the Xen hole in the middle of the address
+ * space, just after the big x86-64 virtual hole.
+ */
+static int pgd_walk(pgd_t *pgd, int (*func)(struct page *, enum pt_level),
                     unsigned long limit)
 {
-        pgd_t *pgd = pgd_base;
         int flush = 0;
-        unsigned long addr = 0;
-        unsigned long pgd_next;
+        unsigned hole_low, hole_high;
+        unsigned pgdidx_limit, pudidx_limit, pmdidx_limit;
+        unsigned pgdidx, pudidx, pmdidx;
 
-        BUG_ON(limit > FIXADDR_TOP);
+        /* The limit is the last byte to be touched */
+        limit--;
+        BUG_ON(limit >= FIXADDR_TOP);
 
         if (xen_feature(XENFEAT_auto_translated_physmap))
                 return 0;
 
-        for (; addr != FIXADDR_TOP; pgd++, addr = pgd_next) {
+        /*
+         * 64-bit has a great big hole in the middle of the address
+         * space, which contains the Xen mappings.  On 32-bit these
+         * will end up making a zero-sized hole and so is a no-op.
+         */
+        hole_low = pgd_index(USER_LIMIT);
+        hole_high = pgd_index(PAGE_OFFSET);
+
+        pgdidx_limit = pgd_index(limit);
+#if PTRS_PER_PUD > 1
+        pudidx_limit = pud_index(limit);
+#else
+        pudidx_limit = 0;
+#endif
+#if PTRS_PER_PMD > 1
+        pmdidx_limit = pmd_index(limit);
+#else
+        pmdidx_limit = 0;
+#endif
+
+        flush |= (*func)(virt_to_page(pgd), PT_PGD);
+
+        for (pgdidx = 0; pgdidx <= pgdidx_limit; pgdidx++) {
                 pud_t *pud;
-                unsigned long pud_limit, pud_next;
 
-                pgd_next = pud_limit = pgd_addr_end(addr, FIXADDR_TOP);
+                if (pgdidx >= hole_low && pgdidx < hole_high)
+                        continue;
 
-                if (!pgd_val(*pgd))
+                if (!pgd_val(pgd[pgdidx]))
                         continue;
 
-                pud = pud_offset(pgd, 0);
+                pud = pud_offset(&pgd[pgdidx], 0);
 
                 if (PTRS_PER_PUD > 1) /* not folded */
                         flush |= (*func)(virt_to_page(pud), PT_PUD);
 
-                for (; addr != pud_limit; pud++, addr = pud_next) {
+                for (pudidx = 0; pudidx < PTRS_PER_PUD; pudidx++) {
                         pmd_t *pmd;
-                        unsigned long pmd_limit;
 
-                        pud_next = pud_addr_end(addr, pud_limit);
-
-                        if (pud_next < limit)
-                                pmd_limit = pud_next;
-                        else
-                                pmd_limit = limit;
+                        if (pgdidx == pgdidx_limit &&
+                            pudidx > pudidx_limit)
+                                goto out;
 
-                        if (pud_none(*pud))
+                        if (pud_none(pud[pudidx]))
                                 continue;
 
-                        pmd = pmd_offset(pud, 0);
+                        pmd = pmd_offset(&pud[pudidx], 0);
 
                         if (PTRS_PER_PMD > 1) /* not folded */
                                 flush |= (*func)(virt_to_page(pmd), PT_PMD);
 
-                        for (; addr != pmd_limit; pmd++) {
-                                addr += (PAGE_SIZE * PTRS_PER_PTE);
-                                if ((pmd_limit-1) < (addr-1)) {
-                                        addr = pmd_limit;
-                                        break;
-                                }
+                        for (pmdidx = 0; pmdidx < PTRS_PER_PMD; pmdidx++) {
+                                struct page *pte;
+
+                                if (pgdidx == pgdidx_limit &&
+                                    pudidx == pudidx_limit &&
+                                    pmdidx > pmdidx_limit)
+                                        goto out;
 
-                                if (pmd_none(*pmd))
+                                if (pmd_none(pmd[pmdidx]))
                                         continue;
 
-                                flush |= (*func)(pmd_page(*pmd), PT_PTE);
+                                pte = pmd_page(pmd[pmdidx]);
+                                flush |= (*func)(pte, PT_PTE);
                         }
                 }
         }
-
-        flush |= (*func)(virt_to_page(pgd_base), PT_PGD);
+out:
 
         return flush;
 }
@@ -622,14 +719,31 @@ void xen_pgd_pin(pgd_t *pgd)
 {
         xen_mc_batch();
 
-        if (pgd_walk(pgd, pin_page, TASK_SIZE)) {
+        if (pgd_walk(pgd, pin_page, USER_LIMIT)) {
                 /* re-enable interrupts for kmap_flush_unused */
                 xen_mc_issue(0);
                 kmap_flush_unused();
                 xen_mc_batch();
         }
 
+#ifdef CONFIG_X86_64
+        {
+                pgd_t *user_pgd = xen_get_user_pgd(pgd);
+
+                xen_do_pin(MMUEXT_PIN_L4_TABLE, PFN_DOWN(__pa(pgd)));
+
+                if (user_pgd) {
+                        pin_page(virt_to_page(user_pgd), PT_PGD);
+                        xen_do_pin(MMUEXT_PIN_L4_TABLE, PFN_DOWN(__pa(user_pgd)));
+                }
+        }
+#else /* CONFIG_X86_32 */
+#ifdef CONFIG_X86_PAE
+        /* Need to make sure unshared kernel PMD is pinnable */
+        pin_page(virt_to_page(pgd_page(pgd[pgd_index(TASK_SIZE)])), PT_PMD);
+#endif
         xen_do_pin(MMUEXT_PIN_L3_TABLE, PFN_DOWN(__pa(pgd)));
+#endif /* CONFIG_X86_64 */
         xen_mc_issue(0);
 }
 
@@ -656,9 +770,11 @@ void xen_mm_pin_all(void)
         spin_unlock_irqrestore(&pgd_lock, flags);
 }
 
-/* The init_mm pagetable is really pinned as soon as its created, but
-   that's before we have page structures to store the bits.  So do all
-   the book-keeping now. */
+/*
+ * The init_mm pagetable is really pinned as soon as its created, but
+ * that's before we have page structures to store the bits.  So do all
+ * the book-keeping now.
+ */
 static __init int mark_pinned(struct page *page, enum pt_level level)
 {
         SetPagePinned(page);
@@ -708,7 +824,23 @@ static void xen_pgd_unpin(pgd_t *pgd)
 
         xen_do_pin(MMUEXT_UNPIN_TABLE, PFN_DOWN(__pa(pgd)));
 
-        pgd_walk(pgd, unpin_page, TASK_SIZE);
+#ifdef CONFIG_X86_64
+        {
+                pgd_t *user_pgd = xen_get_user_pgd(pgd);
+
+                if (user_pgd) {
+                        xen_do_pin(MMUEXT_UNPIN_TABLE, PFN_DOWN(__pa(user_pgd)));
+                        unpin_page(virt_to_page(user_pgd), PT_PGD);
+                }
+        }
+#endif
+
+#ifdef CONFIG_X86_PAE
+        /* Need to make sure unshared kernel PMD is unpinned */
+        pin_page(virt_to_page(pgd_page(pgd[pgd_index(TASK_SIZE)])), PT_PMD);
+#endif
+
+        pgd_walk(pgd, unpin_page, USER_LIMIT);
 
         xen_mc_issue(0);
 }
@@ -727,7 +859,6 @@ void xen_mm_unpin_all(void)
         list_for_each_entry(page, &pgd_list, lru) {
                 if (PageSavePinned(page)) {
                         BUG_ON(!PagePinned(page));
-                        printk("unpinning pinned %p\n", page_address(page));
                         xen_pgd_unpin((pgd_t *)page_address(page));
                         ClearPageSavePinned(page);
                 }
@@ -757,8 +888,15 @@ void xen_dup_mmap(struct mm_struct *oldmm, struct mm_struct *mm)
 static void drop_other_mm_ref(void *info)
 {
         struct mm_struct *mm = info;
+        struct mm_struct *active_mm;
+
+#ifdef CONFIG_X86_64
+        active_mm = read_pda(active_mm);
+#else
+        active_mm = __get_cpu_var(cpu_tlbstate).active_mm;
+#endif
 
-        if (__get_cpu_var(cpu_tlbstate).active_mm == mm)
+        if (active_mm == mm)
                 leave_mm(smp_processor_id());
 
         /* If this cpu still has a stale cr3 reference, then make sure
diff --git a/arch/x86/xen/mmu.h b/arch/x86/xen/mmu.h
index 297bf9f5b8bc..0f59bd03f9e3 100644
--- a/arch/x86/xen/mmu.h
+++ b/arch/x86/xen/mmu.h
@@ -10,18 +10,6 @@ enum pt_level {
         PT_PTE
 };
 
-/*
- * Page-directory addresses above 4GB do not fit into architectural %cr3.
- * When accessing %cr3, or equivalent field in vcpu_guest_context, guests
- * must use the following accessor macros to pack/unpack valid MFNs.
- *
- * Note that Xen is using the fact that the pagetable base is always
- * page-aligned, and putting the 12 MSB of the address into the 12 LSB
- * of cr3.
- */
-#define xen_pfn_to_cr3(pfn) (((unsigned)(pfn) << 12) | ((unsigned)(pfn) >> 20))
-#define xen_cr3_to_pfn(cr3) (((unsigned)(cr3) >> 12) | ((unsigned)(cr3) << 20))
-
 
 void set_pte_mfn(unsigned long vaddr, unsigned long pfn, pgprot_t flags);
 
@@ -44,13 +32,26 @@ pgd_t xen_make_pgd(pgdval_t);
 void xen_set_pte(pte_t *ptep, pte_t pteval);
 void xen_set_pte_at(struct mm_struct *mm, unsigned long addr,
                     pte_t *ptep, pte_t pteval);
+
+#ifdef CONFIG_X86_PAE
 void xen_set_pte_atomic(pte_t *ptep, pte_t pte);
+void xen_pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep);
+void xen_pmd_clear(pmd_t *pmdp);
+#endif  /* CONFIG_X86_PAE */
+
 void xen_set_pmd(pmd_t *pmdp, pmd_t pmdval);
 void xen_set_pud(pud_t *ptr, pud_t val);
 void xen_set_pmd_hyper(pmd_t *pmdp, pmd_t pmdval);
 void xen_set_pud_hyper(pud_t *ptr, pud_t val);
-void xen_pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep);
-void xen_pmd_clear(pmd_t *pmdp);
+
+#if PAGETABLE_LEVELS == 4
+pudval_t xen_pud_val(pud_t pud);
+pud_t xen_make_pud(pudval_t pudval);
+void xen_set_pgd(pgd_t *pgdp, pgd_t pgd);
+void xen_set_pgd_hyper(pgd_t *pgdp, pgd_t pgd);
+#endif
+
+pgd_t *xen_get_user_pgd(pgd_t *pgd);
 
 pte_t xen_ptep_modify_prot_start(struct mm_struct *mm, unsigned long addr, pte_t *ptep);
 void  xen_ptep_modify_prot_commit(struct mm_struct *mm, unsigned long addr,
diff --git a/arch/x86/xen/multicalls.c b/arch/x86/xen/multicalls.c
index 3c63c4da7ed1..9efd1c6c9776 100644
--- a/arch/x86/xen/multicalls.c
+++ b/arch/x86/xen/multicalls.c
@@ -76,6 +76,7 @@ void xen_mc_flush(void)
                 if (ret) {
                         printk(KERN_ERR "%d multicall(s) failed: cpu %d\n",
                                ret, smp_processor_id());
+                        dump_stack();
                         for (i = 0; i < b->mcidx; i++) {
                                 printk("  call %2d/%d: op=%lu arg=[%lx] result=%ld\n",
                                        i+1, b->mcidx,
diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
index e0a39595bde3..b6acc3a0af46 100644
--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -83,30 +83,72 @@ static void xen_idle(void)
 
 /*
  * Set the bit indicating "nosegneg" library variants should be used.
+ * We only need to bother in pure 32-bit mode; compat 32-bit processes
+ * can have un-truncated segments, so wrapping around is allowed.
  */
 static void __init fiddle_vdso(void)
 {
-        extern const char vdso32_default_start;
-        u32 *mask = VDSO32_SYMBOL(&vdso32_default_start, NOTE_MASK);
+#ifdef CONFIG_X86_32
+        u32 *mask;
+        mask = VDSO32_SYMBOL(&vdso32_int80_start, NOTE_MASK);
         *mask |= 1 << VDSO_NOTE_NONEGSEG_BIT;
+        mask = VDSO32_SYMBOL(&vdso32_sysenter_start, NOTE_MASK);
+        *mask |= 1 << VDSO_NOTE_NONEGSEG_BIT;
+#endif
 }
 
-void xen_enable_sysenter(void)
+static __cpuinit int register_callback(unsigned type, const void *func)
 {
-        int cpu = smp_processor_id();
-        extern void xen_sysenter_target(void);
-        /* Mask events on entry, even though they get enabled immediately */
-        static struct callback_register sysenter = {
-                .type = CALLBACKTYPE_sysenter,
-                .address = { __KERNEL_CS, (unsigned long)xen_sysenter_target },
+        struct callback_register callback = {
+                .type = type,
+                .address = XEN_CALLBACK(__KERNEL_CS, func),
                 .flags = CALLBACKF_mask_events,
         };
 
-        if (!boot_cpu_has(X86_FEATURE_SEP) ||
-            HYPERVISOR_callback_op(CALLBACKOP_register, &sysenter) != 0) {
-                clear_cpu_cap(&cpu_data(cpu), X86_FEATURE_SEP);
-                clear_cpu_cap(&boot_cpu_data, X86_FEATURE_SEP);
+        return HYPERVISOR_callback_op(CALLBACKOP_register, &callback);
+}
+
+void __cpuinit xen_enable_sysenter(void)
+{
+        extern void xen_sysenter_target(void);
+        int ret;
+        unsigned sysenter_feature;
+
+#ifdef CONFIG_X86_32
+        sysenter_feature = X86_FEATURE_SEP;
+#else
+        sysenter_feature = X86_FEATURE_SYSENTER32;
+#endif
+
+        if (!boot_cpu_has(sysenter_feature))
+                return;
+
+        ret = register_callback(CALLBACKTYPE_sysenter, xen_sysenter_target);
+        if(ret != 0)
+                setup_clear_cpu_cap(sysenter_feature);
+}
+
+void __cpuinit xen_enable_syscall(void)
+{
+#ifdef CONFIG_X86_64
+        int ret;
+        extern void xen_syscall_target(void);
+        extern void xen_syscall32_target(void);
+
+        ret = register_callback(CALLBACKTYPE_syscall, xen_syscall_target);
+        if (ret != 0) {
+                printk(KERN_ERR "Failed to set syscall callback: %d\n", ret);
+                /* Pretty fatal; 64-bit userspace has no other
+                   mechanism for syscalls. */
         }
+
+        if (boot_cpu_has(X86_FEATURE_SYSCALL32)) {
+                ret = register_callback(CALLBACKTYPE_syscall32,
+                                        xen_syscall32_target);
+                if (ret != 0)
+                        setup_clear_cpu_cap(X86_FEATURE_SYSCALL32);
+        }
+#endif /* CONFIG_X86_64 */
 }
 
 void __init xen_arch_setup(void)
@@ -120,10 +162,12 @@ void __init xen_arch_setup(void)
         if (!xen_feature(XENFEAT_auto_translated_physmap))
                 HYPERVISOR_vm_assist(VMASST_CMD_enable, VMASST_TYPE_pae_extended_cr3);
 
-        HYPERVISOR_set_callbacks(__KERNEL_CS, (unsigned long)xen_hypervisor_callback,
-                                 __KERNEL_CS, (unsigned long)xen_failsafe_callback);
+        if (register_callback(CALLBACKTYPE_event, xen_hypervisor_callback) ||
+            register_callback(CALLBACKTYPE_failsafe, xen_failsafe_callback))
+                BUG();
 
         xen_enable_sysenter();
+        xen_enable_syscall();
 
         set_iopl.iopl = 1;
         rc = HYPERVISOR_physdev_op(PHYSDEVOP_set_iopl, &set_iopl);
@@ -143,11 +187,6 @@ void __init xen_arch_setup(void)
 
         pm_idle = xen_idle;
 
-#ifdef CONFIG_SMP
-        /* fill cpus_possible with all available cpus */
-        xen_fill_possible_map();
-#endif
-
         paravirt_disable_iospace();
 
         fiddle_vdso();
diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
index 233156f39b7f..e693812ac59a 100644
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -15,6 +15,7 @@
  * This does not handle HOTPLUG_CPU yet.
  */
 #include <linux/sched.h>
+#include <linux/kernel_stat.h>
 #include <linux/err.h>
 #include <linux/smp.h>
 
@@ -35,6 +36,8 @@
 #include "xen-ops.h"
 #include "mmu.h"
 
+static void __cpuinit xen_init_lock_cpu(int cpu);
+
 cpumask_t xen_cpu_initialized_map;
 
 static DEFINE_PER_CPU(int, resched_irq);
@@ -66,13 +69,22 @@ static __cpuinit void cpu_bringup_and_idle(void)
         int cpu = smp_processor_id();
 
         cpu_init();
+        preempt_disable();
+
         xen_enable_sysenter();
+        xen_enable_syscall();
 
-        preempt_disable();
-        per_cpu(cpu_state, cpu) = CPU_ONLINE;
+        cpu = smp_processor_id();
+        smp_store_cpu_info(cpu);
+        cpu_data(cpu).x86_max_cores = 1;
+        set_cpu_sibling_map(cpu);
 
         xen_setup_cpu_clockevents();
 
+        cpu_set(cpu, cpu_online_map);
+        x86_write_percpu(cpu_state, CPU_ONLINE);
+        wmb();
+
         /* We can take interrupts now: we're officially "up". */
         local_irq_enable();
 
@@ -141,56 +153,39 @@ static int xen_smp_intr_init(unsigned int cpu)
         return rc;
 }
 
-void __init xen_fill_possible_map(void)
+static void __init xen_fill_possible_map(void)
 {
         int i, rc;
 
         for (i = 0; i < NR_CPUS; i++) {
                 rc = HYPERVISOR_vcpu_op(VCPUOP_is_up, i, NULL);
-                if (rc >= 0)
+                if (rc >= 0) {
+                        num_processors++;
                         cpu_set(i, cpu_possible_map);
+                }
         }
 }
 
-void __init xen_smp_prepare_boot_cpu(void)
+static void __init xen_smp_prepare_boot_cpu(void)
 {
-        int cpu;
-
         BUG_ON(smp_processor_id() != 0);
         native_smp_prepare_boot_cpu();
 
         /* We've switched to the "real" per-cpu gdt, so make sure the
            old memory can be recycled */
-        make_lowmem_page_readwrite(&per_cpu__gdt_page);
-
-        for_each_possible_cpu(cpu) {
-                cpus_clear(per_cpu(cpu_sibling_map, cpu));
-                /*
-                 * cpu_core_map lives in a per cpu area that is cleared
-                 * when the per cpu array is allocated.
-                 *
-                 * cpus_clear(per_cpu(cpu_core_map, cpu));
-                 */
-        }
+        make_lowmem_page_readwrite(&per_cpu_var(gdt_page));
 
         xen_setup_vcpu_info_placement();
 }
 
-void __init xen_smp_prepare_cpus(unsigned int max_cpus)
+static void __init xen_smp_prepare_cpus(unsigned int max_cpus)
 {
         unsigned cpu;
 
-        for_each_possible_cpu(cpu) {
-                cpus_clear(per_cpu(cpu_sibling_map, cpu));
-                /*
-                 * cpu_core_ map will be zeroed when the per
-                 * cpu area is allocated.
-                 *
-                 * cpus_clear(per_cpu(cpu_core_map, cpu));
-                 */
-        }
+        xen_init_lock_cpu(0);
 
         smp_store_cpu_info(0);
+        cpu_data(0).x86_max_cores = 1;
         set_cpu_sibling_map(0);
 
         if (xen_smp_intr_init(0))
@@ -225,7 +220,7 @@ static __cpuinit int
 cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
 {
         struct vcpu_guest_context *ctxt;
-        struct gdt_page *gdt = &per_cpu(gdt_page, cpu);
+        struct desc_struct *gdt;
 
         if (cpu_test_and_set(cpu, xen_cpu_initialized_map))
                 return 0;
@@ -234,12 +229,15 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
         if (ctxt == NULL)
                 return -ENOMEM;
 
+        gdt = get_cpu_gdt_table(cpu);
+
         ctxt->flags = VGCF_IN_KERNEL;
         ctxt->user_regs.ds = __USER_DS;
         ctxt->user_regs.es = __USER_DS;
-        ctxt->user_regs.fs = __KERNEL_PERCPU;
-        ctxt->user_regs.gs = 0;
         ctxt->user_regs.ss = __KERNEL_DS;
+#ifdef CONFIG_X86_32
+        ctxt->user_regs.fs = __KERNEL_PERCPU;
+#endif
         ctxt->user_regs.eip = (unsigned long)cpu_bringup_and_idle;
         ctxt->user_regs.eflags = 0x1000; /* IOPL_RING1 */
 
@@ -249,11 +247,11 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
 
         ctxt->ldt_ents = 0;
 
-        BUG_ON((unsigned long)gdt->gdt & ~PAGE_MASK);
-        make_lowmem_page_readonly(gdt->gdt);
+        BUG_ON((unsigned long)gdt & ~PAGE_MASK);
+        make_lowmem_page_readonly(gdt);
 
-        ctxt->gdt_frames[0] = virt_to_mfn(gdt->gdt);
-        ctxt->gdt_ents      = ARRAY_SIZE(gdt->gdt);
+        ctxt->gdt_frames[0] = virt_to_mfn(gdt);
+        ctxt->gdt_ents      = GDT_ENTRIES;
 
         ctxt->user_regs.cs = __KERNEL_CS;
         ctxt->user_regs.esp = idle->thread.sp0 - sizeof(struct pt_regs);
@@ -261,9 +259,11 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
         ctxt->kernel_ss = __KERNEL_DS;
         ctxt->kernel_sp = idle->thread.sp0;
 
+#ifdef CONFIG_X86_32
         ctxt->event_callback_cs     = __KERNEL_CS;
-        ctxt->event_callback_eip    = (unsigned long)xen_hypervisor_callback;
         ctxt->failsafe_callback_cs  = __KERNEL_CS;
+#endif
+        ctxt->event_callback_eip    = (unsigned long)xen_hypervisor_callback;
         ctxt->failsafe_callback_eip = (unsigned long)xen_failsafe_callback;
 
         per_cpu(xen_cr3, cpu) = __pa(swapper_pg_dir);
@@ -276,7 +276,7 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
         return 0;
 }
 
-int __cpuinit xen_cpu_up(unsigned int cpu)
+static int __cpuinit xen_cpu_up(unsigned int cpu)
 {
         struct task_struct *idle = idle_task(cpu);
         int rc;
@@ -287,10 +287,28 @@ int __cpuinit xen_cpu_up(unsigned int cpu)
                 return rc;
 #endif
 
+#ifdef CONFIG_X86_64
+        /* Allocate node local memory for AP pdas */
+        WARN_ON(cpu == 0);
+        if (cpu > 0) {
+                rc = get_local_pda(cpu);
+                if (rc)
+                        return rc;
+        }
+#endif
+
+#ifdef CONFIG_X86_32
         init_gdt(cpu);
         per_cpu(current_task, cpu) = idle;
         irq_ctx_init(cpu);
+#else
+        cpu_pda(cpu)->pcurrent = idle;
+        clear_tsk_thread_flag(idle, TIF_FORK);
+#endif
         xen_setup_timer(cpu);
+        xen_init_lock_cpu(cpu);
+
+        per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
 
         /* make sure interrupts start blocked */
         per_cpu(xen_vcpu, cpu)->evtchn_upcall_mask = 1;
@@ -306,20 +324,18 @@ int __cpuinit xen_cpu_up(unsigned int cpu)
         if (rc)
                 return rc;
 
-        smp_store_cpu_info(cpu);
-        set_cpu_sibling_map(cpu);
-        /* This must be done before setting cpu_online_map */
-        wmb();
-
-        cpu_set(cpu, cpu_online_map);
-
         rc = HYPERVISOR_vcpu_op(VCPUOP_up, cpu, NULL);
         BUG_ON(rc);
 
+        while(per_cpu(cpu_state, cpu) != CPU_ONLINE) {
+                HYPERVISOR_sched_op(SCHEDOP_yield, 0);
+                barrier();
+        }
+
         return 0;
 }
 
-void xen_smp_cpus_done(unsigned int max_cpus)
+static void xen_smp_cpus_done(unsigned int max_cpus)
 {
 }
 
@@ -335,12 +351,12 @@ static void stop_self(void *v)
         BUG();
 }
 
-void xen_smp_send_stop(void)
+static void xen_smp_send_stop(void)
 {
         smp_call_function(stop_self, NULL, 0);
 }
 
-void xen_smp_send_reschedule(int cpu)
+static void xen_smp_send_reschedule(int cpu)
 {
         xen_send_IPI_one(cpu, XEN_RESCHEDULE_VECTOR);
 }
@@ -355,7 +371,7 @@ static void xen_send_IPI_mask(cpumask_t mask, enum ipi_vector vector)
                 xen_send_IPI_one(cpu, vector);
 }
 
-void xen_smp_send_call_function_ipi(cpumask_t mask)
+static void xen_smp_send_call_function_ipi(cpumask_t mask)
 {
         int cpu;
 
@@ -370,7 +386,7 @@ void xen_smp_send_call_function_ipi(cpumask_t mask)
         }
 }
 
-void xen_smp_send_call_function_single_ipi(int cpu)
+static void xen_smp_send_call_function_single_ipi(int cpu)
 {
         xen_send_IPI_mask(cpumask_of_cpu(cpu), XEN_CALL_FUNCTION_SINGLE_VECTOR);
 }
@@ -379,7 +395,11 @@ static irqreturn_t xen_call_function_interrupt(int irq, void *dev_id)
 {
         irq_enter();
         generic_smp_call_function_interrupt();
+#ifdef CONFIG_X86_32
         __get_cpu_var(irq_stat).irq_call_count++;
+#else
+        add_pda(irq_call_count, 1);
+#endif
         irq_exit();
 
         return IRQ_HANDLED;
@@ -389,8 +409,196 @@ static irqreturn_t xen_call_function_single_interrupt(int irq, void *dev_id)
 {
         irq_enter();
         generic_smp_call_function_single_interrupt();
+#ifdef CONFIG_X86_32
         __get_cpu_var(irq_stat).irq_call_count++;
+#else
+        add_pda(irq_call_count, 1);
+#endif
         irq_exit();
 
         return IRQ_HANDLED;
 }
+
+struct xen_spinlock {
+        unsigned char lock;             /* 0 -> free; 1 -> locked */
+        unsigned short spinners;        /* count of waiting cpus */
+};
+
+static int xen_spin_is_locked(struct raw_spinlock *lock)
+{
+        struct xen_spinlock *xl = (struct xen_spinlock *)lock;
+
+        return xl->lock != 0;
+}
+
+static int xen_spin_is_contended(struct raw_spinlock *lock)
+{
+        struct xen_spinlock *xl = (struct xen_spinlock *)lock;
+
+        /* Not strictly true; this is only the count of contended
+           lock-takers entering the slow path. */
+        return xl->spinners != 0;
+}
+
+static int xen_spin_trylock(struct raw_spinlock *lock)
+{
+        struct xen_spinlock *xl = (struct xen_spinlock *)lock;
+        u8 old = 1;
+
+        asm("xchgb %b0,%1"
+            : "+q" (old), "+m" (xl->lock) : : "memory");
+
+        return old == 0;
+}
+
+static DEFINE_PER_CPU(int, lock_kicker_irq) = -1;
+static DEFINE_PER_CPU(struct xen_spinlock *, lock_spinners);
+
+static inline void spinning_lock(struct xen_spinlock *xl)
+{
+        __get_cpu_var(lock_spinners) = xl;
+        wmb();                  /* set lock of interest before count */
+        asm(LOCK_PREFIX " incw %0"
+            : "+m" (xl->spinners) : : "memory");
+}
+
+static inline void unspinning_lock(struct xen_spinlock *xl)
+{
+        asm(LOCK_PREFIX " decw %0"
+            : "+m" (xl->spinners) : : "memory");
+        wmb();                  /* decrement count before clearing lock */
+        __get_cpu_var(lock_spinners) = NULL;
+}
+
+static noinline int xen_spin_lock_slow(struct raw_spinlock *lock)
+{
+        struct xen_spinlock *xl = (struct xen_spinlock *)lock;
+        int irq = __get_cpu_var(lock_kicker_irq);
+        int ret;
+
+        /* If kicker interrupts not initialized yet, just spin */
+        if (irq == -1)
+                return 0;
+
+        /* announce we're spinning */
+        spinning_lock(xl);
+
+        /* clear pending */
+        xen_clear_irq_pending(irq);
+
+        /* check again make sure it didn't become free while
+           we weren't looking  */
+        ret = xen_spin_trylock(lock);
+        if (ret)
+                goto out;
+
+        /* block until irq becomes pending */
+        xen_poll_irq(irq);
+        kstat_this_cpu.irqs[irq]++;
+
+out:
+        unspinning_lock(xl);
+        return ret;
+}
+
+static void xen_spin_lock(struct raw_spinlock *lock)
+{
+        struct xen_spinlock *xl = (struct xen_spinlock *)lock;
+        int timeout;
+        u8 oldval;
+
+        do {
+                timeout = 1 << 10;
+
+                asm("1: xchgb %1,%0\n"
+                    "   testb %1,%1\n"
+                    "   jz 3f\n"
+                    "2: rep;nop\n"
+                    "   cmpb $0,%0\n"
+                    "   je 1b\n"
+                    "   dec %2\n"
+                    "   jnz 2b\n"
+                    "3:\n"
+                    : "+m" (xl->lock), "=q" (oldval), "+r" (timeout)
+                    : "1" (1)
+                    : "memory");
+
+        } while (unlikely(oldval != 0 && !xen_spin_lock_slow(lock)));
+}
+
+static noinline void xen_spin_unlock_slow(struct xen_spinlock *xl)
+{
+        int cpu;
+
+        for_each_online_cpu(cpu) {
+                /* XXX should mix up next cpu selection */
+                if (per_cpu(lock_spinners, cpu) == xl) {
+                        xen_send_IPI_one(cpu, XEN_SPIN_UNLOCK_VECTOR);
+                        break;
+                }
+        }
+}
+
+static void xen_spin_unlock(struct raw_spinlock *lock)
+{
+        struct xen_spinlock *xl = (struct xen_spinlock *)lock;
+
+        smp_wmb();              /* make sure no writes get moved after unlock */
+        xl->lock = 0;           /* release lock */
+
+        /* make sure unlock happens before kick */
+        barrier();
+
+        if (unlikely(xl->spinners))
+                xen_spin_unlock_slow(xl);
+}
+
+static __cpuinit void xen_init_lock_cpu(int cpu)
+{
+        int irq;
+        const char *name;
+
+        name = kasprintf(GFP_KERNEL, "spinlock%d", cpu);
+        irq = bind_ipi_to_irqhandler(XEN_SPIN_UNLOCK_VECTOR,
+                                     cpu,
+                                     xen_reschedule_interrupt,
+                                     IRQF_DISABLED|IRQF_PERCPU|IRQF_NOBALANCING,
+                                     name,
+                                     NULL);
+
+        if (irq >= 0) {
+                disable_irq(irq); /* make sure it's never delivered */
+                per_cpu(lock_kicker_irq, cpu) = irq;
+        }
+
+        printk("cpu %d spinlock event irq %d\n", cpu, irq);
+}
+
+static void __init xen_init_spinlocks(void)
+{
+        pv_lock_ops.spin_is_locked = xen_spin_is_locked;
+        pv_lock_ops.spin_is_contended = xen_spin_is_contended;
+        pv_lock_ops.spin_lock = xen_spin_lock;
+        pv_lock_ops.spin_trylock = xen_spin_trylock;
+        pv_lock_ops.spin_unlock = xen_spin_unlock;
+}
+
+static const struct smp_ops xen_smp_ops __initdata = {
+        .smp_prepare_boot_cpu = xen_smp_prepare_boot_cpu,
+        .smp_prepare_cpus = xen_smp_prepare_cpus,
+        .cpu_up = xen_cpu_up,
+        .smp_cpus_done = xen_smp_cpus_done,
+
+        .smp_send_stop = xen_smp_send_stop,
+        .smp_send_reschedule = xen_smp_send_reschedule,
+
+        .send_call_func_ipi = xen_smp_send_call_function_ipi,
+        .send_call_func_single_ipi = xen_smp_send_call_function_single_ipi,
+};
+
+void __init xen_smp_init(void)
+{
+        smp_ops = xen_smp_ops;
+        xen_fill_possible_map();
+        xen_init_spinlocks();
+}
diff --git a/arch/x86/xen/suspend.c b/arch/x86/xen/suspend.c
index 251669a932d4..2a234db5949b 100644
--- a/arch/x86/xen/suspend.c
+++ b/arch/x86/xen/suspend.c
@@ -38,8 +38,11 @@ void xen_post_suspend(int suspend_cancelled)
                 xen_cpu_initialized_map = cpu_online_map;
 #endif
                 xen_vcpu_restore();
-                xen_timer_resume();
         }
 
 }
 
+void xen_arch_resume(void)
+{
+        /* nothing */
+}
diff --git a/arch/x86/xen/xen-asm.S b/arch/x86/xen/xen-asm_32.S
index 2497a30f41de..2497a30f41de 100644
--- a/arch/x86/xen/xen-asm.S
+++ b/arch/x86/xen/xen-asm_32.S
diff --git a/arch/x86/xen/xen-asm_64.S b/arch/x86/xen/xen-asm_64.S
new file mode 100644
index 000000000000..4038cbfe3331
--- /dev/null
+++ b/arch/x86/xen/xen-asm_64.S
@@ -0,0 +1,271 @@
+/*
+        Asm versions of Xen pv-ops, suitable for either direct use or inlining.
+        The inline versions are the same as the direct-use versions, with the
+        pre- and post-amble chopped off.
+
+        This code is encoded for size rather than absolute efficiency,
+        with a view to being able to inline as much as possible.
+
+        We only bother with direct forms (ie, vcpu in pda) of the operations
+        here; the indirect forms are better handled in C, since they're
+        generally too large to inline anyway.
+ */
+
+#include <linux/linkage.h>
+
+#include <asm/asm-offsets.h>
+#include <asm/processor-flags.h>
+#include <asm/errno.h>
+#include <asm/segment.h>
+
+#include <xen/interface/xen.h>
+
+#define RELOC(x, v)     .globl x##_reloc; x##_reloc=v
+#define ENDPATCH(x)     .globl x##_end; x##_end=.
+
+/* Pseudo-flag used for virtual NMI, which we don't implement yet */
+#define XEN_EFLAGS_NMI  0x80000000
+
+#if 0
+#include <asm/percpu.h>
+
+/*
+        Enable events.  This clears the event mask and tests the pending
+        event status with one and operation.  If there are pending
+        events, then enter the hypervisor to get them handled.
+ */
+ENTRY(xen_irq_enable_direct)
+        /* Unmask events */
+        movb $0, PER_CPU_VAR(xen_vcpu_info, XEN_vcpu_info_mask)
+
+        /* Preempt here doesn't matter because that will deal with
+           any pending interrupts.  The pending check may end up being
+           run on the wrong CPU, but that doesn't hurt. */
+
+        /* Test for pending */
+        testb $0xff, PER_CPU_VAR(xen_vcpu_info, XEN_vcpu_info_pending)
+        jz 1f
+
+2:      call check_events
+1:
+ENDPATCH(xen_irq_enable_direct)
+        ret
+        ENDPROC(xen_irq_enable_direct)
+        RELOC(xen_irq_enable_direct, 2b+1)
+
+/*
+        Disabling events is simply a matter of making the event mask
+        non-zero.
+ */
+ENTRY(xen_irq_disable_direct)
+        movb $1, PER_CPU_VAR(xen_vcpu_info, XEN_vcpu_info_mask)
+ENDPATCH(xen_irq_disable_direct)
+        ret
+        ENDPROC(xen_irq_disable_direct)
+        RELOC(xen_irq_disable_direct, 0)
+
+/*
+        (xen_)save_fl is used to get the current interrupt enable status.
+        Callers expect the status to be in X86_EFLAGS_IF, and other bits
+        may be set in the return value.  We take advantage of this by
+        making sure that X86_EFLAGS_IF has the right value (and other bits
+        in that byte are 0), but other bits in the return value are
+        undefined.  We need to toggle the state of the bit, because
+        Xen and x86 use opposite senses (mask vs enable).
+ */
+ENTRY(xen_save_fl_direct)
+        testb $0xff, PER_CPU_VAR(xen_vcpu_info, XEN_vcpu_info_mask)
+        setz %ah
+        addb %ah,%ah
+ENDPATCH(xen_save_fl_direct)
+        ret
+        ENDPROC(xen_save_fl_direct)
+        RELOC(xen_save_fl_direct, 0)
+
+/*
+        In principle the caller should be passing us a value return
+        from xen_save_fl_direct, but for robustness sake we test only
+        the X86_EFLAGS_IF flag rather than the whole byte. After
+        setting the interrupt mask state, it checks for unmasked
+        pending events and enters the hypervisor to get them delivered
+        if so.
+ */
+ENTRY(xen_restore_fl_direct)
+        testb $X86_EFLAGS_IF>>8, %ah
+        setz PER_CPU_VAR(xen_vcpu_info, XEN_vcpu_info_mask)
+        /* Preempt here doesn't matter because that will deal with
+           any pending interrupts.  The pending check may end up being
+           run on the wrong CPU, but that doesn't hurt. */
+
+        /* check for unmasked and pending */
+        cmpw $0x0001, PER_CPU_VAR(xen_vcpu_info, XEN_vcpu_info_pending)
+        jz 1f
+2:      call check_events
+1:
+ENDPATCH(xen_restore_fl_direct)
+        ret
+        ENDPROC(xen_restore_fl_direct)
+        RELOC(xen_restore_fl_direct, 2b+1)
+
+
+/*
+        Force an event check by making a hypercall,
+        but preserve regs before making the call.
+ */
+check_events:
+        push %rax
+        push %rcx
+        push %rdx
+        push %rsi
+        push %rdi
+        push %r8
+        push %r9
+        push %r10
+        push %r11
+        call force_evtchn_callback
+        pop %r11
+        pop %r10
+        pop %r9
+        pop %r8
+        pop %rdi
+        pop %rsi
+        pop %rdx
+        pop %rcx
+        pop %rax
+        ret
+#endif
+
+ENTRY(xen_adjust_exception_frame)
+        mov 8+0(%rsp),%rcx
+        mov 8+8(%rsp),%r11
+        ret $16
+
+hypercall_iret = hypercall_page + __HYPERVISOR_iret * 32
+/*
+        Xen64 iret frame:
+
+        ss
+        rsp
+        rflags
+        cs
+        rip             <-- standard iret frame
+
+        flags
+
+        rcx             }
+        r11             }<-- pushed by hypercall page
+rsp ->  rax             }
+ */
+ENTRY(xen_iret)
+        pushq $0
+1:      jmp hypercall_iret
+ENDPATCH(xen_iret)
+RELOC(xen_iret, 1b+1)
+
+/*
+        sysexit is not used for 64-bit processes, so it's
+        only ever used to return to 32-bit compat userspace.
+ */
+ENTRY(xen_sysexit)
+        pushq $__USER32_DS
+        pushq %rcx
+        pushq $X86_EFLAGS_IF
+        pushq $__USER32_CS
+        pushq %rdx
+
+        pushq $VGCF_in_syscall
+1:      jmp hypercall_iret
+ENDPATCH(xen_sysexit)
+RELOC(xen_sysexit, 1b+1)
+
+ENTRY(xen_sysret64)
+        /* We're already on the usermode stack at this point, but still
+           with the kernel gs, so we can easily switch back */
+        movq %rsp, %gs:pda_oldrsp
+        movq %gs:pda_kernelstack,%rsp
+
+        pushq $__USER_DS
+        pushq %gs:pda_oldrsp
+        pushq %r11
+        pushq $__USER_CS
+        pushq %rcx
+
+        pushq $VGCF_in_syscall
+1:      jmp hypercall_iret
+ENDPATCH(xen_sysret64)
+RELOC(xen_sysret64, 1b+1)
+
+ENTRY(xen_sysret32)
+        /* We're already on the usermode stack at this point, but still
+           with the kernel gs, so we can easily switch back */
+        movq %rsp, %gs:pda_oldrsp
+        movq %gs:pda_kernelstack, %rsp
+
+        pushq $__USER32_DS
+        pushq %gs:pda_oldrsp
+        pushq %r11
+        pushq $__USER32_CS
+        pushq %rcx
+
+        pushq $VGCF_in_syscall
+1:      jmp hypercall_iret
+ENDPATCH(xen_sysret32)
+RELOC(xen_sysret32, 1b+1)
+
+/*
+        Xen handles syscall callbacks much like ordinary exceptions,
+        which means we have:
+         - kernel gs
+         - kernel rsp
+         - an iret-like stack frame on the stack (including rcx and r11):
+                ss
+                rsp
+                rflags
+                cs
+                rip
+                r11
+        rsp->   rcx
+
+        In all the entrypoints, we undo all that to make it look
+        like a CPU-generated syscall/sysenter and jump to the normal
+        entrypoint.
+ */
+
+.macro undo_xen_syscall
+        mov 0*8(%rsp),%rcx
+        mov 1*8(%rsp),%r11
+        mov 5*8(%rsp),%rsp
+.endm
+
+/* Normal 64-bit system call target */
+ENTRY(xen_syscall_target)
+        undo_xen_syscall
+        jmp system_call_after_swapgs
+ENDPROC(xen_syscall_target)
+
+#ifdef CONFIG_IA32_EMULATION
+
+/* 32-bit compat syscall target */
+ENTRY(xen_syscall32_target)
+        undo_xen_syscall
+        jmp ia32_cstar_target
+ENDPROC(xen_syscall32_target)
+
+/* 32-bit compat sysenter target */
+ENTRY(xen_sysenter_target)
+        undo_xen_syscall
+        jmp ia32_sysenter_target
+ENDPROC(xen_sysenter_target)
+
+#else /* !CONFIG_IA32_EMULATION */
+
+ENTRY(xen_syscall32_target)
+ENTRY(xen_sysenter_target)
+        lea 16(%rsp), %rsp      /* strip %rcx,%r11 */
+        mov $-ENOSYS, %rax
+        pushq $VGCF_in_syscall
+        jmp hypercall_iret
+ENDPROC(xen_syscall32_target)
+ENDPROC(xen_sysenter_target)
+
+#endif  /* CONFIG_IA32_EMULATION */
diff --git a/arch/x86/xen/xen-head.S b/arch/x86/xen/xen-head.S
index 7c0cf6320a0a..63d49a523ed3 100644
--- a/arch/x86/xen/xen-head.S
+++ b/arch/x86/xen/xen-head.S
@@ -5,15 +5,24 @@
 
 #include <linux/elfnote.h>
 #include <linux/init.h>
+
 #include <asm/boot.h>
+#include <asm/asm.h>
+#include <asm/page.h>
+
 #include <xen/interface/elfnote.h>
 #include <asm/xen/interface.h>
 
         __INIT
 ENTRY(startup_xen)
-        movl %esi,xen_start_info
         cld
-        movl $(init_thread_union+THREAD_SIZE),%esp
+#ifdef CONFIG_X86_32
+        mov %esi,xen_start_info
+        mov $init_thread_union+THREAD_SIZE,%esp
+#else
+        mov %rsi,xen_start_info
+        mov $init_thread_union+THREAD_SIZE,%rsp
+#endif
         jmp xen_start_kernel
 
         __FINIT
@@ -21,21 +30,26 @@ ENTRY(startup_xen)
 .pushsection .text
         .align PAGE_SIZE_asm
 ENTRY(hypercall_page)
-        .skip 0x1000
+        .skip PAGE_SIZE_asm
 .popsection
 
         ELFNOTE(Xen, XEN_ELFNOTE_GUEST_OS,       .asciz "linux")
         ELFNOTE(Xen, XEN_ELFNOTE_GUEST_VERSION,  .asciz "2.6")
         ELFNOTE(Xen, XEN_ELFNOTE_XEN_VERSION,    .asciz "xen-3.0")
-        ELFNOTE(Xen, XEN_ELFNOTE_VIRT_BASE,      .long  __PAGE_OFFSET)
-        ELFNOTE(Xen, XEN_ELFNOTE_ENTRY,          .long  startup_xen)
-        ELFNOTE(Xen, XEN_ELFNOTE_HYPERCALL_PAGE, .long  hypercall_page)
+#ifdef CONFIG_X86_32
+        ELFNOTE(Xen, XEN_ELFNOTE_VIRT_BASE,      _ASM_PTR __PAGE_OFFSET)
+#else
+        ELFNOTE(Xen, XEN_ELFNOTE_VIRT_BASE,      _ASM_PTR __START_KERNEL_map)
+#endif
+        ELFNOTE(Xen, XEN_ELFNOTE_ENTRY,          _ASM_PTR startup_xen)
+        ELFNOTE(Xen, XEN_ELFNOTE_HYPERCALL_PAGE, _ASM_PTR hypercall_page)
         ELFNOTE(Xen, XEN_ELFNOTE_FEATURES,       .asciz "!writable_page_tables|pae_pgdir_above_4gb")
         ELFNOTE(Xen, XEN_ELFNOTE_PAE_MODE,       .asciz "yes")
         ELFNOTE(Xen, XEN_ELFNOTE_LOADER,         .asciz "generic")
         ELFNOTE(Xen, XEN_ELFNOTE_L1_MFN_VALID,
                 .quad _PAGE_PRESENT; .quad _PAGE_PRESENT)
         ELFNOTE(Xen, XEN_ELFNOTE_SUSPEND_CANCEL, .long 1)
-        ELFNOTE(Xen, XEN_ELFNOTE_HV_START_LOW,   .long __HYPERVISOR_VIRT_START)
+        ELFNOTE(Xen, XEN_ELFNOTE_HV_START_LOW,   _ASM_PTR __HYPERVISOR_VIRT_START)
+        ELFNOTE(Xen, XEN_ELFNOTE_PADDR_OFFSET,   _ASM_PTR 0)
 
 #endif /*CONFIG_XEN */
diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h
index 6f4b1045c1c2..dd3c23152a2e 100644
--- a/arch/x86/xen/xen-ops.h
+++ b/arch/x86/xen/xen-ops.h
@@ -26,6 +26,7 @@ char * __init xen_memory_setup(void);
 void __init xen_arch_setup(void);
 void __init xen_init_IRQ(void);
 void xen_enable_sysenter(void);
+void xen_enable_syscall(void);
 void xen_vcpu_restore(void);
 
 void __init xen_build_dynamic_phys_to_machine(void);
@@ -37,7 +38,6 @@ void __init xen_time_init(void);
 unsigned long xen_get_wallclock(void);
 int xen_set_wallclock(unsigned long time);
 unsigned long long xen_sched_clock(void);
-void xen_timer_resume(void);
 
 irqreturn_t xen_debug_interrupt(int irq, void *dev_id);
 
@@ -45,20 +45,15 @@ bool xen_vcpu_stolen(int vcpu);
 
 void xen_mark_init_mm_pinned(void);
 
-void __init xen_fill_possible_map(void);
-
 void __init xen_setup_vcpu_info_placement(void);
-void xen_smp_prepare_boot_cpu(void);
-void xen_smp_prepare_cpus(unsigned int max_cpus);
-int xen_cpu_up(unsigned int cpu);
-void xen_smp_cpus_done(unsigned int max_cpus);
 
-void xen_smp_send_stop(void);
-void xen_smp_send_reschedule(int cpu);
-void xen_smp_send_call_function_ipi(cpumask_t mask);
-void xen_smp_send_call_function_single_ipi(int cpu);
+#ifdef CONFIG_SMP
+void xen_smp_init(void);
 
 extern cpumask_t xen_cpu_initialized_map;
+#else
+static inline void xen_smp_init(void) {}
+#endif
 
 
 /* Declare an asm function, along with symbols needed to make it
@@ -73,7 +68,11 @@ DECL_ASM(void, xen_irq_disable_direct, void);
 DECL_ASM(unsigned long, xen_save_fl_direct, void);
 DECL_ASM(void, xen_restore_fl_direct, unsigned long);
 
+/* These are not functions, and cannot be called normally */
 void xen_iret(void);
 void xen_sysexit(void);
+void xen_sysret32(void);
+void xen_sysret64(void);
+void xen_adjust_exception_frame(void);
 
 #endif /* XEN_OPS_H */