16 files changed, 2041 insertions, 598 deletions

diff --git a/arch/x86/xen/Kconfig b/arch/x86/xen/Kconfig
index 6c388e593bc8..3815e425f470 100644
--- a/arch/x86/xen/Kconfig
+++ b/arch/x86/xen/Kconfig
@@ -6,9 +6,25 @@ config XEN
         bool "Xen guest support"
         select PARAVIRT
         select PARAVIRT_CLOCK
-        depends on X86_32
-        depends on X86_CMPXCHG && X86_TSC && X86_PAE && !(X86_VISWS || X86_VOYAGER)
+        depends on X86_64 || (X86_32 && X86_PAE && !(X86_VISWS || X86_VOYAGER))
+        depends on X86_CMPXCHG && X86_TSC
         help
           This is the Linux Xen port.  Enabling this will allow the
           kernel to boot in a paravirtualized environment under the
           Xen hypervisor.
+
+config XEN_MAX_DOMAIN_MEMORY
+       int "Maximum allowed size of a domain in gigabytes"
+       default 8 if X86_32
+       default 32 if X86_64
+       depends on XEN
+       help
+         The pseudo-physical to machine address array is sized
+         according to the maximum possible memory size of a Xen
+         domain.  This array uses 1 page per gigabyte, so there's no
+         need to be too stingy here.
+
+config XEN_SAVE_RESTORE
+       bool
+       depends on PM
+       default y
\ No newline at end of file
diff --git a/arch/x86/xen/Makefile b/arch/x86/xen/Makefile
index 3d8df981d5fd..59c1e539aed2 100644
--- a/arch/x86/xen/Makefile
+++ b/arch/x86/xen/Makefile
@@ -1,4 +1,4 @@
 obj-y           := enlighten.o setup.o multicalls.o mmu.o \
-                        time.o manage.o xen-asm.o grant-table.o
+                        time.o xen-asm_$(BITS).o grant-table.o suspend.o
 
 obj-$(CONFIG_SMP)       += smp.o
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index f09c1c69c37a..8d28925ebed9 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -33,13 +33,16 @@
 #include <xen/interface/sched.h>
 #include <xen/features.h>
 #include <xen/page.h>
+#include <xen/hvc-console.h>
 
 #include <asm/paravirt.h>
+#include <asm/apic.h>
 #include <asm/page.h>
 #include <asm/xen/hypercall.h>
 #include <asm/xen/hypervisor.h>
 #include <asm/fixmap.h>
 #include <asm/processor.h>
+#include <asm/msr-index.h>
 #include <asm/setup.h>
 #include <asm/desc.h>
 #include <asm/pgtable.h>
@@ -56,6 +59,18 @@ DEFINE_PER_CPU(struct vcpu_info *, xen_vcpu);
 DEFINE_PER_CPU(struct vcpu_info, xen_vcpu_info);
 
 /*
+ * Identity map, in addition to plain kernel map.  This needs to be
+ * large enough to allocate page table pages to allocate the rest.
+ * Each page can map 2MB.
+ */
+static pte_t level1_ident_pgt[PTRS_PER_PTE * 4] __page_aligned_bss;
+
+#ifdef CONFIG_X86_64
+/* l3 pud for userspace vsyscall mapping */
+static pud_t level3_user_vsyscall[PTRS_PER_PUD] __page_aligned_bss;
+#endif /* CONFIG_X86_64 */
+
+/*
  * Note about cr3 (pagetable base) values:
  *
  * xen_cr3 contains the current logical cr3 value; it contains the
@@ -75,13 +90,13 @@ DEFINE_PER_CPU(unsigned long, xen_current_cr3);	 /* actual vcpu cr3 */
 struct start_info *xen_start_info;
 EXPORT_SYMBOL_GPL(xen_start_info);
 
-static /* __initdata */ struct shared_info dummy_shared_info;
+struct shared_info xen_dummy_shared_info;
 
 /*
  * Point at some empty memory to start with. We map the real shared_info
  * page as soon as fixmap is up and running.
  */
-struct shared_info *HYPERVISOR_shared_info = (void *)&dummy_shared_info;
+struct shared_info *HYPERVISOR_shared_info = (void *)&xen_dummy_shared_info;
 
 /*
  * Flag to determine whether vcpu info placement is available on all
@@ -98,13 +113,13 @@ struct shared_info *HYPERVISOR_shared_info = (void *)&dummy_shared_info;
  */
 static int have_vcpu_info_placement = 1;
 
-static void __init xen_vcpu_setup(int cpu)
+static void xen_vcpu_setup(int cpu)
 {
         struct vcpu_register_vcpu_info info;
         int err;
         struct vcpu_info *vcpup;
 
-        BUG_ON(HYPERVISOR_shared_info == &dummy_shared_info);
+        BUG_ON(HYPERVISOR_shared_info == &xen_dummy_shared_info);
         per_cpu(xen_vcpu, cpu) = &HYPERVISOR_shared_info->vcpu_info[cpu];
 
         if (!have_vcpu_info_placement)
@@ -136,11 +151,45 @@ static void __init xen_vcpu_setup(int cpu)
         }
 }
 
+/*
+ * On restore, set the vcpu placement up again.
+ * If it fails, then we're in a bad state, since
+ * we can't back out from using it...
+ */
+void xen_vcpu_restore(void)
+{
+        if (have_vcpu_info_placement) {
+                int cpu;
+
+                for_each_online_cpu(cpu) {
+                        bool other_cpu = (cpu != smp_processor_id());
+
+                        if (other_cpu &&
+                            HYPERVISOR_vcpu_op(VCPUOP_down, cpu, NULL))
+                                BUG();
+
+                        xen_vcpu_setup(cpu);
+
+                        if (other_cpu &&
+                            HYPERVISOR_vcpu_op(VCPUOP_up, cpu, NULL))
+                                BUG();
+                }
+
+                BUG_ON(!have_vcpu_info_placement);
+        }
+}
+
 static void __init xen_banner(void)
 {
+        unsigned version = HYPERVISOR_xen_version(XENVER_version, NULL);
+        struct xen_extraversion extra;
+        HYPERVISOR_xen_version(XENVER_extraversion, &extra);
+
         printk(KERN_INFO "Booting paravirtualized kernel on %s\n",
                pv_info.name);
-        printk(KERN_INFO "Hypervisor signature: %s\n", xen_start_info->magic);
+        printk(KERN_INFO "Xen version: %d.%d%s%s\n",
+               version >> 16, version & 0xffff, extra.extraversion,
+               xen_feature(XENFEAT_mmu_pt_update_preserve_ad) ? " (preserve-AD)" : "");
 }
 
 static void xen_cpuid(unsigned int *ax, unsigned int *bx,
@@ -235,13 +284,13 @@ static void xen_irq_enable(void)
 {
         struct vcpu_info *vcpu;
 
-        /* There's a one instruction preempt window here.  We need to
-           make sure we're don't switch CPUs between getting the vcpu
-           pointer and updating the mask. */
-        preempt_disable();
+        /* We don't need to worry about being preempted here, since
+           either a) interrupts are disabled, so no preemption, or b)
+           the caller is confused and is trying to re-enable interrupts
+           on an indeterminate processor. */
+
         vcpu = x86_read_percpu(xen_vcpu);
         vcpu->evtchn_upcall_mask = 0;
-        preempt_enable_no_resched();
 
         /* Doesn't matter if we get preempted here, because any
            pending event will get dealt with anyway. */
@@ -254,7 +303,7 @@ static void xen_irq_enable(void)
 static void xen_safe_halt(void)
 {
         /* Blocking includes an implicit local_irq_enable(). */
-        if (HYPERVISOR_sched_op(SCHEDOP_block, 0) != 0)
+        if (HYPERVISOR_sched_op(SCHEDOP_block, NULL) != 0)
                 BUG();
 }
 
@@ -332,14 +381,6 @@ static void load_TLS_descriptor(struct thread_struct *t,
 
 static void xen_load_tls(struct thread_struct *t, unsigned int cpu)
 {
-        xen_mc_batch();
-
-        load_TLS_descriptor(t, cpu, 0);
-        load_TLS_descriptor(t, cpu, 1);
-        load_TLS_descriptor(t, cpu, 2);
-
-        xen_mc_issue(PARAVIRT_LAZY_CPU);
-
         /*
          * XXX sleazy hack: If we're being called in a lazy-cpu zone,
          * it means we're in a context switch, and %gs has just been
@@ -348,11 +389,40 @@ static void xen_load_tls(struct thread_struct *t, unsigned int cpu)
          * Either way, it has been saved, and the new value will get
          * loaded properly.  This will go away as soon as Xen has been
          * modified to not save/restore %gs for normal hypercalls.
+         *
+         * On x86_64, this hack is not used for %gs, because gs points
+         * to KERNEL_GS_BASE (and uses it for PDA references), so we
+         * must not zero %gs on x86_64
+         *
+         * For x86_64, we need to zero %fs, otherwise we may get an
+         * exception between the new %fs descriptor being loaded and
+         * %fs being effectively cleared at __switch_to().
          */
-        if (paravirt_get_lazy_mode() == PARAVIRT_LAZY_CPU)
+        if (paravirt_get_lazy_mode() == PARAVIRT_LAZY_CPU) {
+#ifdef CONFIG_X86_32
                 loadsegment(gs, 0);
+#else
+                loadsegment(fs, 0);
+#endif
+        }
+
+        xen_mc_batch();
+
+        load_TLS_descriptor(t, cpu, 0);
+        load_TLS_descriptor(t, cpu, 1);
+        load_TLS_descriptor(t, cpu, 2);
+
+        xen_mc_issue(PARAVIRT_LAZY_CPU);
 }
 
+#ifdef CONFIG_X86_64
+static void xen_load_gs_index(unsigned int idx)
+{
+        if (HYPERVISOR_set_segment_base(SEGBASE_GS_USER_SEL, idx))
+                BUG();
+}
+#endif
+
 static void xen_write_ldt_entry(struct desc_struct *dt, int entrynum,
                                 const void *ptr)
 {
@@ -369,23 +439,18 @@ static void xen_write_ldt_entry(struct desc_struct *dt, int entrynum,
         preempt_enable();
 }
 
-static int cvt_gate_to_trap(int vector, u32 low, u32 high,
+static int cvt_gate_to_trap(int vector, const gate_desc *val,
                             struct trap_info *info)
 {
-        u8 type, dpl;
-
-        type = (high >> 8) & 0x1f;
-        dpl = (high >> 13) & 3;
-
-        if (type != 0xf && type != 0xe)
+        if (val->type != 0xf && val->type != 0xe)
                 return 0;
 
         info->vector = vector;
-        info->address = (high & 0xffff0000) | (low & 0x0000ffff);
-        info->cs = low >> 16;
-        info->flags = dpl;
+        info->address = gate_offset(*val);
+        info->cs = gate_segment(*val);
+        info->flags = val->dpl;
         /* interrupt gates clear IF */
-        if (type == 0xe)
+        if (val->type == 0xe)
                 info->flags |= 4;
 
         return 1;
@@ -412,11 +477,10 @@ static void xen_write_idt_entry(gate_desc *dt, int entrynum, const gate_desc *g)
 
         if (p >= start && (p + 8) <= end) {
                 struct trap_info info[2];
-                u32 *desc = (u32 *)g;
 
                 info[1].address = 0;
 
-                if (cvt_gate_to_trap(entrynum, desc[0], desc[1], &info[0]))
+                if (cvt_gate_to_trap(entrynum, g, &info[0]))
                         if (HYPERVISOR_set_trap_table(info))
                                 BUG();
         }
@@ -429,13 +493,13 @@ static void xen_convert_trap_info(const struct desc_ptr *desc,
 {
         unsigned in, out, count;
 
-        count = (desc->size+1) / 8;
+        count = (desc->size+1) / sizeof(gate_desc);
         BUG_ON(count > 256);
 
         for (in = out = 0; in < count; in++) {
-                const u32 *entry = (u32 *)(desc->address + in * 8);
+                gate_desc *entry = (gate_desc*)(desc->address) + in;
 
-                if (cvt_gate_to_trap(in, entry[0], entry[1], &traps[out]))
+                if (cvt_gate_to_trap(in, entry, &traps[out]))
                         out++;
         }
         traps[out].address = 0;
@@ -517,16 +581,47 @@ static void xen_io_delay(void)
 }
 
 #ifdef CONFIG_X86_LOCAL_APIC
-static u32 xen_apic_read(unsigned long reg)
+static u32 xen_apic_read(u32 reg)
 {
         return 0;
 }
 
-static void xen_apic_write(unsigned long reg, u32 val)
+static void xen_apic_write(u32 reg, u32 val)
 {
         /* Warn to see if there's any stray references */
         WARN_ON(1);
 }
+
+static u64 xen_apic_icr_read(void)
+{
+        return 0;
+}
+
+static void xen_apic_icr_write(u32 low, u32 id)
+{
+        /* Warn to see if there's any stray references */
+        WARN_ON(1);
+}
+
+static void xen_apic_wait_icr_idle(void)
+{
+        return;
+}
+
+static u32 xen_safe_apic_wait_icr_idle(void)
+{
+        return 0;
+}
+
+static struct apic_ops xen_basic_apic_ops = {
+        .read = xen_apic_read,
+        .write = xen_apic_write,
+        .icr_read = xen_apic_icr_read,
+        .icr_write = xen_apic_icr_write,
+        .wait_icr_idle = xen_apic_wait_icr_idle,
+        .safe_wait_icr_idle = xen_safe_apic_wait_icr_idle,
+};
+
 #endif
 
 static void xen_flush_tlb(void)
@@ -607,6 +702,30 @@ static void xen_flush_tlb_others(const cpumask_t *cpus, struct mm_struct *mm,
         xen_mc_issue(PARAVIRT_LAZY_MMU);
 }
 
+static void xen_clts(void)
+{
+        struct multicall_space mcs;
+
+        mcs = xen_mc_entry(0);
+
+        MULTI_fpu_taskswitch(mcs.mc, 0);
+
+        xen_mc_issue(PARAVIRT_LAZY_CPU);
+}
+
+static void xen_write_cr0(unsigned long cr0)
+{
+        struct multicall_space mcs;
+
+        /* Only pay attention to cr0.TS; everything else is
+           ignored. */
+        mcs = xen_mc_entry(0);
+
+        MULTI_fpu_taskswitch(mcs.mc, (cr0 & X86_CR0_TS) != 0);
+
+        xen_mc_issue(PARAVIRT_LAZY_CPU);
+}
+
 static void xen_write_cr2(unsigned long cr2)
 {
         x86_read_percpu(xen_vcpu)->arch.cr2 = cr2;
@@ -624,8 +743,10 @@ static unsigned long xen_read_cr2_direct(void)
 
 static void xen_write_cr4(unsigned long cr4)
 {
-        /* Just ignore cr4 changes; Xen doesn't allow us to do
-           anything anyway. */
+        cr4 &= ~X86_CR4_PGE;
+        cr4 &= ~X86_CR4_PSE;
+
+        native_write_cr4(cr4);
 }
 
 static unsigned long xen_read_cr3(void)
@@ -638,33 +759,89 @@ static void set_current_cr3(void *v)
         x86_write_percpu(xen_current_cr3, (unsigned long)v);
 }
 
-static void xen_write_cr3(unsigned long cr3)
+static void __xen_write_cr3(bool kernel, unsigned long cr3)
 {
         struct mmuext_op *op;
         struct multicall_space mcs;
-        unsigned long mfn = pfn_to_mfn(PFN_DOWN(cr3));
+        unsigned long mfn;
 
-        BUG_ON(preemptible());
+        if (cr3)
+                mfn = pfn_to_mfn(PFN_DOWN(cr3));
+        else
+                mfn = 0;
 
-        mcs = xen_mc_entry(sizeof(*op));  /* disables interrupts */
+        WARN_ON(mfn == 0 && kernel);
 
-        /* Update while interrupts are disabled, so its atomic with
-           respect to ipis */
-        x86_write_percpu(xen_cr3, cr3);
+        mcs = __xen_mc_entry(sizeof(*op));
 
         op = mcs.args;
-        op->cmd = MMUEXT_NEW_BASEPTR;
+        op->cmd = kernel ? MMUEXT_NEW_BASEPTR : MMUEXT_NEW_USER_BASEPTR;
         op->arg1.mfn = mfn;
 
         MULTI_mmuext_op(mcs.mc, op, 1, NULL, DOMID_SELF);
 
-        /* Update xen_update_cr3 once the batch has actually
-           been submitted. */
-        xen_mc_callback(set_current_cr3, (void *)cr3);
+        if (kernel) {
+                x86_write_percpu(xen_cr3, cr3);
+
+                /* Update xen_current_cr3 once the batch has actually
+                   been submitted. */
+                xen_mc_callback(set_current_cr3, (void *)cr3);
+        }
+}
+
+static void xen_write_cr3(unsigned long cr3)
+{
+        BUG_ON(preemptible());
+
+        xen_mc_batch();  /* disables interrupts */
+
+        /* Update while interrupts are disabled, so its atomic with
+           respect to ipis */
+        x86_write_percpu(xen_cr3, cr3);
+
+        __xen_write_cr3(true, cr3);
+
+#ifdef CONFIG_X86_64
+        {
+                pgd_t *user_pgd = xen_get_user_pgd(__va(cr3));
+                if (user_pgd)
+                        __xen_write_cr3(false, __pa(user_pgd));
+                else
+                        __xen_write_cr3(false, 0);
+        }
+#endif
 
         xen_mc_issue(PARAVIRT_LAZY_CPU);  /* interrupts restored */
 }
 
+static int xen_write_msr_safe(unsigned int msr, unsigned low, unsigned high)
+{
+        int ret;
+
+        ret = 0;
+
+        switch(msr) {
+#ifdef CONFIG_X86_64
+                unsigned which;
+                u64 base;
+
+        case MSR_FS_BASE:               which = SEGBASE_FS; goto set;
+        case MSR_KERNEL_GS_BASE:        which = SEGBASE_GS_USER; goto set;
+        case MSR_GS_BASE:               which = SEGBASE_GS_KERNEL; goto set;
+
+        set:
+                base = ((u64)high << 32) | low;
+                if (HYPERVISOR_set_segment_base(which, base) != 0)
+                        ret = -EFAULT;
+                break;
+#endif
+        default:
+                ret = native_write_msr_safe(msr, low, high);
+        }
+
+        return ret;
+}
+
 /* Early in boot, while setting up the initial pagetable, assume
    everything is pinned. */
 static __init void xen_alloc_pte_init(struct mm_struct *mm, u32 pfn)
@@ -721,6 +898,48 @@ static void xen_alloc_pmd(struct mm_struct *mm, u32 pfn)
         xen_alloc_ptpage(mm, pfn, PT_PMD);
 }
 
+static int xen_pgd_alloc(struct mm_struct *mm)
+{
+        pgd_t *pgd = mm->pgd;
+        int ret = 0;
+
+        BUG_ON(PagePinned(virt_to_page(pgd)));
+
+#ifdef CONFIG_X86_64
+        {
+                struct page *page = virt_to_page(pgd);
+                pgd_t *user_pgd;
+
+                BUG_ON(page->private != 0);
+
+                ret = -ENOMEM;
+
+                user_pgd = (pgd_t *)__get_free_page(GFP_KERNEL | __GFP_ZERO);
+                page->private = (unsigned long)user_pgd;
+
+                if (user_pgd != NULL) {
+                        user_pgd[pgd_index(VSYSCALL_START)] =
+                                __pgd(__pa(level3_user_vsyscall) | _PAGE_TABLE);
+                        ret = 0;
+                }
+
+                BUG_ON(PagePinned(virt_to_page(xen_get_user_pgd(pgd))));
+        }
+#endif
+
+        return ret;
+}
+
+static void xen_pgd_free(struct mm_struct *mm, pgd_t *pgd)
+{
+#ifdef CONFIG_X86_64
+        pgd_t *user_pgd = xen_get_user_pgd(pgd);
+
+        if (user_pgd)
+                free_page((unsigned long)user_pgd);
+#endif
+}
+
 /* This should never happen until we're OK to use struct page */
 static void xen_release_ptpage(u32 pfn, unsigned level)
 {
@@ -746,6 +965,18 @@ static void xen_release_pmd(u32 pfn)
         xen_release_ptpage(pfn, PT_PMD);
 }
 
+#if PAGETABLE_LEVELS == 4
+static void xen_alloc_pud(struct mm_struct *mm, u32 pfn)
+{
+        xen_alloc_ptpage(mm, pfn, PT_PUD);
+}
+
+static void xen_release_pud(u32 pfn)
+{
+        xen_release_ptpage(pfn, PT_PUD);
+}
+#endif
+
 #ifdef CONFIG_HIGHPTE
 static void *xen_kmap_atomic_pte(struct page *page, enum km_type type)
 {
@@ -784,68 +1015,16 @@ static __init void xen_set_pte_init(pte_t *ptep, pte_t pte)
 
 static __init void xen_pagetable_setup_start(pgd_t *base)
 {
-        pgd_t *xen_pgd = (pgd_t *)xen_start_info->pt_base;
-        int i;
-
-        /* special set_pte for pagetable initialization */
-        pv_mmu_ops.set_pte = xen_set_pte_init;
-
-        init_mm.pgd = base;
-        /*
-         * copy top-level of Xen-supplied pagetable into place.  This
-         * is a stand-in while we copy the pmd pages.
-         */
-        memcpy(base, xen_pgd, PTRS_PER_PGD * sizeof(pgd_t));
-
-        /*
-         * For PAE, need to allocate new pmds, rather than
-         * share Xen's, since Xen doesn't like pmd's being
-         * shared between address spaces.
-         */
-        for (i = 0; i < PTRS_PER_PGD; i++) {
-                if (pgd_val_ma(xen_pgd[i]) & _PAGE_PRESENT) {
-                        pmd_t *pmd = (pmd_t *)alloc_bootmem_low_pages(PAGE_SIZE);
-
-                        memcpy(pmd, (void *)pgd_page_vaddr(xen_pgd[i]),
-                               PAGE_SIZE);
-
-                        make_lowmem_page_readonly(pmd);
-
-                        set_pgd(&base[i], __pgd(1 + __pa(pmd)));
-                } else
-                        pgd_clear(&base[i]);
-        }
-
-        /* make sure zero_page is mapped RO so we can use it in pagetables */
-        make_lowmem_page_readonly(empty_zero_page);
-        make_lowmem_page_readonly(base);
-        /*
-         * Switch to new pagetable.  This is done before
-         * pagetable_init has done anything so that the new pages
-         * added to the table can be prepared properly for Xen.
-         */
-        xen_write_cr3(__pa(base));
-
-        /* Unpin initial Xen pagetable */
-        pin_pagetable_pfn(MMUEXT_UNPIN_TABLE,
-                          PFN_DOWN(__pa(xen_start_info->pt_base)));
 }
 
-static __init void setup_shared_info(void)
+void xen_setup_shared_info(void)
 {
         if (!xen_feature(XENFEAT_auto_translated_physmap)) {
-                unsigned long addr = fix_to_virt(FIX_PARAVIRT_BOOTMAP);
-
-                /*
-                 * Create a mapping for the shared info page.
-                 * Should be set_fixmap(), but shared_info is a machine
-                 * address with no corresponding pseudo-phys address.
-                 */
-                set_pte_mfn(addr,
-                            PFN_DOWN(xen_start_info->shared_info),
-                            PAGE_KERNEL);
-
-                HYPERVISOR_shared_info = (struct shared_info *)addr;
+                set_fixmap(FIX_PARAVIRT_BOOTMAP,
+                           xen_start_info->shared_info);
+
+                HYPERVISOR_shared_info =
+                        (struct shared_info *)fix_to_virt(FIX_PARAVIRT_BOOTMAP);
         } else
                 HYPERVISOR_shared_info =
                         (struct shared_info *)__va(xen_start_info->shared_info);
@@ -854,27 +1033,43 @@ static __init void setup_shared_info(void)
         /* In UP this is as good a place as any to set up shared info */
         xen_setup_vcpu_info_placement();
 #endif
+
+        xen_setup_mfn_list_list();
 }
 
 static __init void xen_pagetable_setup_done(pgd_t *base)
 {
+        xen_setup_shared_info();
+}
+
+static __init void xen_post_allocator_init(void)
+{
+        pv_mmu_ops.set_pte = xen_set_pte;
+        pv_mmu_ops.set_pmd = xen_set_pmd;
+        pv_mmu_ops.set_pud = xen_set_pud;
+#if PAGETABLE_LEVELS == 4
+        pv_mmu_ops.set_pgd = xen_set_pgd;
+#endif
+
         /* This will work as long as patching hasn't happened yet
            (which it hasn't) */
         pv_mmu_ops.alloc_pte = xen_alloc_pte;
         pv_mmu_ops.alloc_pmd = xen_alloc_pmd;
         pv_mmu_ops.release_pte = xen_release_pte;
         pv_mmu_ops.release_pmd = xen_release_pmd;
-        pv_mmu_ops.set_pte = xen_set_pte;
-
-        setup_shared_info();
+#if PAGETABLE_LEVELS == 4
+        pv_mmu_ops.alloc_pud = xen_alloc_pud;
+        pv_mmu_ops.release_pud = xen_release_pud;
+#endif
 
-        /* Actually pin the pagetable down, but we can't set PG_pinned
-           yet because the page structures don't exist yet. */
-        pin_pagetable_pfn(MMUEXT_PIN_L3_TABLE, PFN_DOWN(__pa(base)));
+#ifdef CONFIG_X86_64
+        SetPagePinned(virt_to_page(level3_user_vsyscall));
+#endif
+        xen_mark_init_mm_pinned();
 }
 
 /* This is called once we have the cpu_possible_map */
-void __init xen_setup_vcpu_info_placement(void)
+void xen_setup_vcpu_info_placement(void)
 {
         int cpu;
 
@@ -883,6 +1078,7 @@ void __init xen_setup_vcpu_info_placement(void)
 
         /* xen_vcpu_setup managed to place the vcpu_info within the
            percpu area for all cpus, so make use of it */
+#ifdef CONFIG_X86_32
         if (have_vcpu_info_placement) {
                 printk(KERN_INFO "Xen: using vcpu_info placement\n");
 
@@ -892,6 +1088,7 @@ void __init xen_setup_vcpu_info_placement(void)
                 pv_irq_ops.irq_enable = xen_irq_enable_direct;
                 pv_mmu_ops.read_cr2 = xen_read_cr2_direct;
         }
+#endif
 }
 
 static unsigned xen_patch(u8 type, u16 clobbers, void *insnbuf,
@@ -912,10 +1109,12 @@ static unsigned xen_patch(u8 type, u16 clobbers, void *insnbuf,
         goto patch_site
 
         switch (type) {
+#ifdef CONFIG_X86_32
                 SITE(pv_irq_ops, irq_enable);
                 SITE(pv_irq_ops, irq_disable);
                 SITE(pv_irq_ops, save_fl);
                 SITE(pv_irq_ops, restore_fl);
+#endif /* CONFIG_X86_32 */
 #undef SITE
 
         patch_site:
@@ -947,6 +1146,49 @@ static unsigned xen_patch(u8 type, u16 clobbers, void *insnbuf,
         return ret;
 }
 
+static void xen_set_fixmap(unsigned idx, unsigned long phys, pgprot_t prot)
+{
+        pte_t pte;
+
+        phys >>= PAGE_SHIFT;
+
+        switch (idx) {
+        case FIX_BTMAP_END ... FIX_BTMAP_BEGIN:
+#ifdef CONFIG_X86_F00F_BUG
+        case FIX_F00F_IDT:
+#endif
+#ifdef CONFIG_X86_32
+        case FIX_WP_TEST:
+        case FIX_VDSO:
+# ifdef CONFIG_HIGHMEM
+        case FIX_KMAP_BEGIN ... FIX_KMAP_END:
+# endif
+#else
+        case VSYSCALL_LAST_PAGE ... VSYSCALL_FIRST_PAGE:
+#endif
+#ifdef CONFIG_X86_LOCAL_APIC
+        case FIX_APIC_BASE:     /* maps dummy local APIC */
+#endif
+                pte = pfn_pte(phys, prot);
+                break;
+
+        default:
+                pte = mfn_pte(phys, prot);
+                break;
+        }
+
+        __native_set_fixmap(idx, pte);
+
+#ifdef CONFIG_X86_64
+        /* Replicate changes to map the vsyscall page into the user
+           pagetable vsyscall mapping. */
+        if (idx >= VSYSCALL_LAST_PAGE && idx <= VSYSCALL_FIRST_PAGE) {
+                unsigned long vaddr = __fix_to_virt(idx);
+                set_pte_vaddr_pud(level3_user_vsyscall, vaddr, pte);
+        }
+#endif
+}
+
 static const struct pv_info xen_info __initdata = {
         .paravirt_enabled = 1,
         .shared_kernel_pmd = 0,
@@ -960,7 +1202,7 @@ static const struct pv_init_ops xen_init_ops __initdata = {
         .banner = xen_banner,
         .memory_setup = xen_memory_setup,
         .arch_setup = xen_arch_setup,
-        .post_allocator_init = xen_mark_init_mm_pinned,
+        .post_allocator_init = xen_post_allocator_init,
 };
 
 static const struct pv_time_ops xen_time_ops __initdata = {
@@ -968,7 +1210,7 @@ static const struct pv_time_ops xen_time_ops __initdata = {
 
         .set_wallclock = xen_set_wallclock,
         .get_wallclock = xen_get_wallclock,
-        .get_cpu_khz = xen_cpu_khz,
+        .get_tsc_khz = xen_tsc_khz,
         .sched_clock = xen_sched_clock,
 };
 
@@ -978,10 +1220,10 @@ static const struct pv_cpu_ops xen_cpu_ops __initdata = {
         .set_debugreg = xen_set_debugreg,
         .get_debugreg = xen_get_debugreg,
 
-        .clts = native_clts,
+        .clts = xen_clts,
 
         .read_cr0 = native_read_cr0,
-        .write_cr0 = native_write_cr0,
+        .write_cr0 = xen_write_cr0,
 
         .read_cr4 = native_read_cr4,
         .read_cr4_safe = native_read_cr4_safe,
@@ -990,18 +1232,25 @@ static const struct pv_cpu_ops xen_cpu_ops __initdata = {
         .wbinvd = native_wbinvd,
 
         .read_msr = native_read_msr_safe,
-        .write_msr = native_write_msr_safe,
+        .write_msr = xen_write_msr_safe,
         .read_tsc = native_read_tsc,
         .read_pmc = native_read_pmc,
 
         .iret = xen_iret,
-        .irq_enable_syscall_ret = xen_sysexit,
+        .irq_enable_sysexit = xen_sysexit,
+#ifdef CONFIG_X86_64
+        .usergs_sysret32 = xen_sysret32,
+        .usergs_sysret64 = xen_sysret64,
+#endif
 
         .load_tr_desc = paravirt_nop,
         .set_ldt = xen_set_ldt,
         .load_gdt = xen_load_gdt,
         .load_idt = xen_load_idt,
         .load_tls = xen_load_tls,
+#ifdef CONFIG_X86_64
+        .load_gs_index = xen_load_gs_index,
+#endif
 
         .store_gdt = native_store_gdt,
         .store_idt = native_store_idt,
@@ -1015,27 +1264,47 @@ static const struct pv_cpu_ops xen_cpu_ops __initdata = {
         .set_iopl_mask = xen_set_iopl_mask,
         .io_delay = xen_io_delay,
 
+        /* Xen takes care of %gs when switching to usermode for us */
+        .swapgs = paravirt_nop,
+
         .lazy_mode = {
                 .enter = paravirt_enter_lazy_cpu,
                 .leave = xen_leave_lazy,
         },
 };
 
+static void __init __xen_init_IRQ(void)
+{
+#ifdef CONFIG_X86_64
+        int i;
+
+        /* Create identity vector->irq map */
+        for(i = 0; i < NR_VECTORS; i++) {
+                int cpu;
+
+                for_each_possible_cpu(cpu)
+                        per_cpu(vector_irq, cpu)[i] = i;
+        }
+#endif  /* CONFIG_X86_64 */
+
+        xen_init_IRQ();
+}
+
 static const struct pv_irq_ops xen_irq_ops __initdata = {
-        .init_IRQ = xen_init_IRQ,
+        .init_IRQ = __xen_init_IRQ,
         .save_fl = xen_save_fl,
         .restore_fl = xen_restore_fl,
         .irq_disable = xen_irq_disable,
         .irq_enable = xen_irq_enable,
         .safe_halt = xen_safe_halt,
         .halt = xen_halt,
+#ifdef CONFIG_X86_64
+        .adjust_exception_frame = xen_adjust_exception_frame,
+#endif
 };
 
 static const struct pv_apic_ops xen_apic_ops __initdata = {
 #ifdef CONFIG_X86_LOCAL_APIC
-        .apic_write = xen_apic_write,
-        .apic_write_atomic = xen_apic_write,
-        .apic_read = xen_apic_read,
         .setup_boot_clock = paravirt_nop,
         .setup_secondary_clock = paravirt_nop,
         .startup_ipi_hook = paravirt_nop,
@@ -1060,6 +1329,9 @@ static const struct pv_mmu_ops xen_mmu_ops __initdata = {
         .pte_update = paravirt_nop,
         .pte_update_defer = paravirt_nop,
 
+        .pgd_alloc = xen_pgd_alloc,
+        .pgd_free = xen_pgd_free,
+
         .alloc_pte = xen_alloc_pte_init,
         .release_pte = xen_release_pte_init,
         .alloc_pmd = xen_alloc_pte_init,
@@ -1070,25 +1342,44 @@ static const struct pv_mmu_ops xen_mmu_ops __initdata = {
         .kmap_atomic_pte = xen_kmap_atomic_pte,
 #endif
 
-        .set_pte = NULL,        /* see xen_pagetable_setup_* */
+#ifdef CONFIG_X86_64
+        .set_pte = xen_set_pte,
+#else
+        .set_pte = xen_set_pte_init,
+#endif
         .set_pte_at = xen_set_pte_at,
-        .set_pmd = xen_set_pmd,
+        .set_pmd = xen_set_pmd_hyper,
+
+        .ptep_modify_prot_start = __ptep_modify_prot_start,
+        .ptep_modify_prot_commit = __ptep_modify_prot_commit,
 
         .pte_val = xen_pte_val,
+        .pte_flags = native_pte_val,
         .pgd_val = xen_pgd_val,
 
         .make_pte = xen_make_pte,
         .make_pgd = xen_make_pgd,
 
+#ifdef CONFIG_X86_PAE
         .set_pte_atomic = xen_set_pte_atomic,
         .set_pte_present = xen_set_pte_at,
-        .set_pud = xen_set_pud,
         .pte_clear = xen_pte_clear,
         .pmd_clear = xen_pmd_clear,
+#endif  /* CONFIG_X86_PAE */
+        .set_pud = xen_set_pud_hyper,
 
         .make_pmd = xen_make_pmd,
         .pmd_val = xen_pmd_val,
 
+#if PAGETABLE_LEVELS == 4
+        .pud_val = xen_pud_val,
+        .make_pud = xen_make_pud,
+        .set_pgd = xen_set_pgd_hyper,
+
+        .alloc_pud = xen_alloc_pte_init,
+        .release_pud = xen_release_pte_init,
+#endif  /* PAGETABLE_LEVELS == 4 */
+
         .activate_mm = xen_activate_mm,
         .dup_mmap = xen_dup_mmap,
         .exit_mmap = xen_exit_mmap,
@@ -1097,28 +1388,19 @@ static const struct pv_mmu_ops xen_mmu_ops __initdata = {
                 .enter = paravirt_enter_lazy_mmu,
                 .leave = xen_leave_lazy,
         },
-};
 
-#ifdef CONFIG_SMP
-static const struct smp_ops xen_smp_ops __initdata = {
-        .smp_prepare_boot_cpu = xen_smp_prepare_boot_cpu,
-        .smp_prepare_cpus = xen_smp_prepare_cpus,
-        .cpu_up = xen_cpu_up,
-        .smp_cpus_done = xen_smp_cpus_done,
-
-        .smp_send_stop = xen_smp_send_stop,
-        .smp_send_reschedule = xen_smp_send_reschedule,
-        .smp_call_function_mask = xen_smp_call_function_mask,
+        .set_fixmap = xen_set_fixmap,
 };
-#endif  /* CONFIG_SMP */
 
 static void xen_reboot(int reason)
 {
+        struct sched_shutdown r = { .reason = reason };
+
 #ifdef CONFIG_SMP
         smp_send_stop();
 #endif
 
-        if (HYPERVISOR_sched_op(SCHEDOP_shutdown, reason))
+        if (HYPERVISOR_sched_op(SCHEDOP_shutdown, &r))
                 BUG();
 }
 
@@ -1154,6 +1436,7 @@ static const struct machine_ops __initdata xen_machine_ops = {
 
 static void __init xen_reserve_top(void)
 {
+#ifdef CONFIG_X86_32
         unsigned long top = HYPERVISOR_VIRT_START;
         struct xen_platform_parameters pp;
 
@@ -1161,7 +1444,247 @@ static void __init xen_reserve_top(void)
                 top = pp.virt_start;
 
         reserve_top_address(-top + 2 * PAGE_SIZE);
+#endif  /* CONFIG_X86_32 */
+}
+
+/*
+ * Like __va(), but returns address in the kernel mapping (which is
+ * all we have until the physical memory mapping has been set up.
+ */
+static void *__ka(phys_addr_t paddr)
+{
+#ifdef CONFIG_X86_64
+        return (void *)(paddr + __START_KERNEL_map);
+#else
+        return __va(paddr);
+#endif
+}
+
+/* Convert a machine address to physical address */
+static unsigned long m2p(phys_addr_t maddr)
+{
+        phys_addr_t paddr;
+
+        maddr &= PTE_PFN_MASK;
+        paddr = mfn_to_pfn(maddr >> PAGE_SHIFT) << PAGE_SHIFT;
+
+        return paddr;
+}
+
+/* Convert a machine address to kernel virtual */
+static void *m2v(phys_addr_t maddr)
+{
+        return __ka(m2p(maddr));
+}
+
+#ifdef CONFIG_X86_64
+static void walk(pgd_t *pgd, unsigned long addr)
+{
+        unsigned l4idx = pgd_index(addr);
+        unsigned l3idx = pud_index(addr);
+        unsigned l2idx = pmd_index(addr);
+        unsigned l1idx = pte_index(addr);
+        pgd_t l4;
+        pud_t l3;
+        pmd_t l2;
+        pte_t l1;
+
+        xen_raw_printk("walk %p, %lx -> %d %d %d %d\n",
+                       pgd, addr, l4idx, l3idx, l2idx, l1idx);
+
+        l4 = pgd[l4idx];
+        xen_raw_printk("  l4: %016lx\n", l4.pgd);
+        xen_raw_printk("      %016lx\n", pgd_val(l4));
+
+        l3 = ((pud_t *)(m2v(l4.pgd)))[l3idx];
+        xen_raw_printk("  l3: %016lx\n", l3.pud);
+        xen_raw_printk("      %016lx\n", pud_val(l3));
+
+        l2 = ((pmd_t *)(m2v(l3.pud)))[l2idx];
+        xen_raw_printk("  l2: %016lx\n", l2.pmd);
+        xen_raw_printk("      %016lx\n", pmd_val(l2));
+
+        l1 = ((pte_t *)(m2v(l2.pmd)))[l1idx];
+        xen_raw_printk("  l1: %016lx\n", l1.pte);
+        xen_raw_printk("      %016lx\n", pte_val(l1));
+}
+#endif
+
+static void set_page_prot(void *addr, pgprot_t prot)
+{
+        unsigned long pfn = __pa(addr) >> PAGE_SHIFT;
+        pte_t pte = pfn_pte(pfn, prot);
+
+        xen_raw_printk("addr=%p pfn=%lx mfn=%lx prot=%016llx pte=%016llx\n",
+                       addr, pfn, get_phys_to_machine(pfn),
+                       pgprot_val(prot), pte.pte);
+
+        if (HYPERVISOR_update_va_mapping((unsigned long)addr, pte, 0))
+                BUG();
+}
+
+static __init void xen_map_identity_early(pmd_t *pmd, unsigned long max_pfn)
+{
+        unsigned pmdidx, pteidx;
+        unsigned ident_pte;
+        unsigned long pfn;
+
+        ident_pte = 0;
+        pfn = 0;
+        for(pmdidx = 0; pmdidx < PTRS_PER_PMD && pfn < max_pfn; pmdidx++) {
+                pte_t *pte_page;
+
+                /* Reuse or allocate a page of ptes */
+                if (pmd_present(pmd[pmdidx]))
+                        pte_page = m2v(pmd[pmdidx].pmd);
+                else {
+                        /* Check for free pte pages */
+                        if (ident_pte == ARRAY_SIZE(level1_ident_pgt))
+                                break;
+
+                        pte_page = &level1_ident_pgt[ident_pte];
+                        ident_pte += PTRS_PER_PTE;
+
+                        pmd[pmdidx] = __pmd(__pa(pte_page) | _PAGE_TABLE);
+                }
+
+                /* Install mappings */
+                for(pteidx = 0; pteidx < PTRS_PER_PTE; pteidx++, pfn++) {
+                        pte_t pte;
+
+                        if (pfn > max_pfn_mapped)
+                                max_pfn_mapped = pfn;
+
+                        if (!pte_none(pte_page[pteidx]))
+                                continue;
+
+                        pte = pfn_pte(pfn, PAGE_KERNEL_EXEC);
+                        pte_page[pteidx] = pte;
+                }
+        }
+
+        for(pteidx = 0; pteidx < ident_pte; pteidx += PTRS_PER_PTE)
+                set_page_prot(&level1_ident_pgt[pteidx], PAGE_KERNEL_RO);
+
+        set_page_prot(pmd, PAGE_KERNEL_RO);
+}
+
+#ifdef CONFIG_X86_64
+static void convert_pfn_mfn(void *v)
+{
+        pte_t *pte = v;
+        int i;
+
+        /* All levels are converted the same way, so just treat them
+           as ptes. */
+        for(i = 0; i < PTRS_PER_PTE; i++)
+                pte[i] = xen_make_pte(pte[i].pte);
+}
+
+/*
+ * Set up the inital kernel pagetable.
+ *
+ * We can construct this by grafting the Xen provided pagetable into
+ * head_64.S's preconstructed pagetables.  We copy the Xen L2's into
+ * level2_ident_pgt, level2_kernel_pgt and level2_fixmap_pgt.  This
+ * means that only the kernel has a physical mapping to start with -
+ * but that's enough to get __va working.  We need to fill in the rest
+ * of the physical mapping once some sort of allocator has been set
+ * up.
+ */
+static __init pgd_t *xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn)
+{
+        pud_t *l3;
+        pmd_t *l2;
+
+        /* Zap identity mapping */
+        init_level4_pgt[0] = __pgd(0);
+
+        /* Pre-constructed entries are in pfn, so convert to mfn */
+        convert_pfn_mfn(init_level4_pgt);
+        convert_pfn_mfn(level3_ident_pgt);
+        convert_pfn_mfn(level3_kernel_pgt);
+
+        l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
+        l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
+
+        memcpy(level2_ident_pgt, l2, sizeof(pmd_t) * PTRS_PER_PMD);
+        memcpy(level2_kernel_pgt, l2, sizeof(pmd_t) * PTRS_PER_PMD);
+
+        l3 = m2v(pgd[pgd_index(__START_KERNEL_map + PMD_SIZE)].pgd);
+        l2 = m2v(l3[pud_index(__START_KERNEL_map + PMD_SIZE)].pud);
+        memcpy(level2_fixmap_pgt, l2, sizeof(pmd_t) * PTRS_PER_PMD);
+
+        /* Set up identity map */
+        xen_map_identity_early(level2_ident_pgt, max_pfn);
+
+        /* Make pagetable pieces RO */
+        set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
+        set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
+        set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
+        set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
+        set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
+        set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
+
+        /* Pin down new L4 */
+        pin_pagetable_pfn(MMUEXT_PIN_L4_TABLE,
+                          PFN_DOWN(__pa_symbol(init_level4_pgt)));
+
+        /* Unpin Xen-provided one */
+        pin_pagetable_pfn(MMUEXT_UNPIN_TABLE, PFN_DOWN(__pa(pgd)));
+
+        /* Switch over */
+        pgd = init_level4_pgt;
+
+        /*
+         * At this stage there can be no user pgd, and no page
+         * structure to attach it to, so make sure we just set kernel
+         * pgd.
+         */
+        xen_mc_batch();
+        __xen_write_cr3(true, __pa(pgd));
+        xen_mc_issue(PARAVIRT_LAZY_CPU);
+
+        reserve_early(__pa(xen_start_info->pt_base),
+                      __pa(xen_start_info->pt_base +
+                           xen_start_info->nr_pt_frames * PAGE_SIZE),
+                      "XEN PAGETABLES");
+
+        return pgd;
 }
+#else   /* !CONFIG_X86_64 */
+static pmd_t level2_kernel_pgt[PTRS_PER_PMD] __page_aligned_bss;
+
+static __init pgd_t *xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn)
+{
+        pmd_t *kernel_pmd;
+
+        init_pg_tables_start = __pa(pgd);
+        init_pg_tables_end = __pa(pgd) + xen_start_info->nr_pt_frames*PAGE_SIZE;
+        max_pfn_mapped = PFN_DOWN(init_pg_tables_end + 512*1024);
+
+        kernel_pmd = m2v(pgd[KERNEL_PGD_BOUNDARY].pgd);
+        memcpy(level2_kernel_pgt, kernel_pmd, sizeof(pmd_t) * PTRS_PER_PMD);
+
+        xen_map_identity_early(level2_kernel_pgt, max_pfn);
+
+        memcpy(swapper_pg_dir, pgd, sizeof(pgd_t) * PTRS_PER_PGD);
+        set_pgd(&swapper_pg_dir[KERNEL_PGD_BOUNDARY],
+                        __pgd(__pa(level2_kernel_pgt) | _PAGE_PRESENT));
+
+        set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
+        set_page_prot(swapper_pg_dir, PAGE_KERNEL_RO);
+        set_page_prot(empty_zero_page, PAGE_KERNEL_RO);
+
+        pin_pagetable_pfn(MMUEXT_UNPIN_TABLE, PFN_DOWN(__pa(pgd)));
+
+        xen_write_cr3(__pa(swapper_pg_dir));
+
+        pin_pagetable_pfn(MMUEXT_PIN_L3_TABLE, PFN_DOWN(__pa(swapper_pg_dir)));
+
+        return swapper_pg_dir;
+}
+#endif  /* CONFIG_X86_64 */
 
 /* First C function to be called on Xen boot */
 asmlinkage void __init xen_start_kernel(void)
@@ -1173,6 +1696,8 @@ asmlinkage void __init xen_start_kernel(void)
 
         BUG_ON(memcmp(xen_start_info->magic, "xen-3", 5) != 0);
 
+        xen_setup_features();
+
         /* Install Xen paravirt ops */
         pv_info = xen_info;
         pv_init_ops = xen_init_ops;
@@ -1182,59 +1707,92 @@ asmlinkage void __init xen_start_kernel(void)
         pv_apic_ops = xen_apic_ops;
         pv_mmu_ops = xen_mmu_ops;
 
+#ifdef CONFIG_X86_LOCAL_APIC
+        /*
+         * set up the basic apic ops.
+         */
+        apic_ops = &xen_basic_apic_ops;
+#endif
+
+        if (xen_feature(XENFEAT_mmu_pt_update_preserve_ad)) {
+                pv_mmu_ops.ptep_modify_prot_start = xen_ptep_modify_prot_start;
+                pv_mmu_ops.ptep_modify_prot_commit = xen_ptep_modify_prot_commit;
+        }
+
         machine_ops = xen_machine_ops;
 
-#ifdef CONFIG_SMP
-        smp_ops = xen_smp_ops;
+#ifdef CONFIG_X86_64
+        /* Disable until direct per-cpu data access. */
+        have_vcpu_info_placement = 0;
+        x86_64_init_pda();
 #endif
 
-        xen_setup_features();
+        xen_smp_init();
 
         /* Get mfn list */
         if (!xen_feature(XENFEAT_auto_translated_physmap))
-                phys_to_machine_mapping = (unsigned long *)xen_start_info->mfn_list;
+                xen_build_dynamic_phys_to_machine();
 
         pgd = (pgd_t *)xen_start_info->pt_base;
 
-        init_pg_tables_end = __pa(pgd) + xen_start_info->nr_pt_frames*PAGE_SIZE;
-
-        init_mm.pgd = pgd; /* use the Xen pagetables to start */
-
-        /* keep using Xen gdt for now; no urgent need to change it */
-
-        x86_write_percpu(xen_cr3, __pa(pgd));
-        x86_write_percpu(xen_current_cr3, __pa(pgd));
+        /* Prevent unwanted bits from being set in PTEs. */
+        __supported_pte_mask &= ~_PAGE_GLOBAL;
+        if (!is_initial_xendomain())
+                __supported_pte_mask &= ~(_PAGE_PWT | _PAGE_PCD);
 
         /* Don't do the full vcpu_info placement stuff until we have a
            possible map and a non-dummy shared_info. */
         per_cpu(xen_vcpu, 0) = &HYPERVISOR_shared_info->vcpu_info[0];
 
+        xen_raw_console_write("mapping kernel into physical memory\n");
+        pgd = xen_setup_kernel_pagetable(pgd, xen_start_info->nr_pages);
+
+        init_mm.pgd = pgd;
+
+        /* keep using Xen gdt for now; no urgent need to change it */
+
         pv_info.kernel_rpl = 1;
         if (xen_feature(XENFEAT_supervisor_mode_kernel))
                 pv_info.kernel_rpl = 0;
 
-        /* Prevent unwanted bits from being set in PTEs. */
-        __supported_pte_mask &= ~_PAGE_GLOBAL;
-        if (!is_initial_xendomain())
-                __supported_pte_mask &= ~(_PAGE_PWT | _PAGE_PCD);
-
         /* set the limit of our address space */
         xen_reserve_top();
 
+#ifdef CONFIG_X86_32
         /* set up basic CPUID stuff */
         cpu_detect(&new_cpu_data);
         new_cpu_data.hard_math = 1;
         new_cpu_data.x86_capability[0] = cpuid_edx(1);
+#endif
 
         /* Poke various useful things into boot_params */
         boot_params.hdr.type_of_loader = (9 << 4) | 0;
         boot_params.hdr.ramdisk_image = xen_start_info->mod_start
                 ? __pa(xen_start_info->mod_start) : 0;
         boot_params.hdr.ramdisk_size = xen_start_info->mod_len;
+        boot_params.hdr.cmd_line_ptr = __pa(xen_start_info->cmd_line);
 
-        if (!is_initial_xendomain())
+        if (!is_initial_xendomain()) {
+                add_preferred_console("xenboot", 0, NULL);
+                add_preferred_console("tty", 0, NULL);
                 add_preferred_console("hvc", 0, NULL);
+        }
+
+        xen_raw_console_write("about to get started...\n");
+
+#if 0
+        xen_raw_printk("&boot_params=%p __pa(&boot_params)=%lx __va(__pa(&boot_params))=%lx\n",
+                       &boot_params, __pa_symbol(&boot_params),
+                       __va(__pa_symbol(&boot_params)));
+
+        walk(pgd, &boot_params);
+        walk(pgd, __va(__pa(&boot_params)));
+#endif
 
         /* Start the world */
-        start_kernel();
+#ifdef CONFIG_X86_32
+        i386_start_kernel();
+#else
+        x86_64_start_reservations((char *)__pa_symbol(&boot_params));
+#endif
 }
diff --git a/arch/x86/xen/manage.c b/arch/x86/xen/manage.c
deleted file mode 100644
index aa7af9e6abc0..000000000000
--- a/arch/x86/xen/manage.c
+++ /dev/null
@@ -1,143 +0,0 @@
-/*
- * Handle extern requests for shutdown, reboot and sysrq
- */
-#include <linux/kernel.h>
-#include <linux/err.h>
-#include <linux/reboot.h>
-#include <linux/sysrq.h>
-
-#include <xen/xenbus.h>
-
-#define SHUTDOWN_INVALID  -1
-#define SHUTDOWN_POWEROFF  0
-#define SHUTDOWN_SUSPEND   2
-/* Code 3 is SHUTDOWN_CRASH, which we don't use because the domain can only
- * report a crash, not be instructed to crash!
- * HALT is the same as POWEROFF, as far as we're concerned.  The tools use
- * the distinction when we return the reason code to them.
- */
-#define SHUTDOWN_HALT      4
-
-/* Ignore multiple shutdown requests. */
-static int shutting_down = SHUTDOWN_INVALID;
-
-static void shutdown_handler(struct xenbus_watch *watch,
-                             const char **vec, unsigned int len)
-{
-        char *str;
-        struct xenbus_transaction xbt;
-        int err;
-
-        if (shutting_down != SHUTDOWN_INVALID)
-                return;
-
- again:
-        err = xenbus_transaction_start(&xbt);
-        if (err)
-                return;
-
-        str = (char *)xenbus_read(xbt, "control", "shutdown", NULL);
-        /* Ignore read errors and empty reads. */
-        if (XENBUS_IS_ERR_READ(str)) {
-                xenbus_transaction_end(xbt, 1);
-                return;
-        }
-
-        xenbus_write(xbt, "control", "shutdown", "");
-
-        err = xenbus_transaction_end(xbt, 0);
-        if (err == -EAGAIN) {
-                kfree(str);
-                goto again;
-        }
-
-        if (strcmp(str, "poweroff") == 0 ||
-            strcmp(str, "halt") == 0)
-                orderly_poweroff(false);
-        else if (strcmp(str, "reboot") == 0)
-                ctrl_alt_del();
-        else {
-                printk(KERN_INFO "Ignoring shutdown request: %s\n", str);
-                shutting_down = SHUTDOWN_INVALID;
-        }
-
-        kfree(str);
-}
-
-static void sysrq_handler(struct xenbus_watch *watch, const char **vec,
-                          unsigned int len)
-{
-        char sysrq_key = '\0';
-        struct xenbus_transaction xbt;
-        int err;
-
- again:
-        err = xenbus_transaction_start(&xbt);
-        if (err)
-                return;
-        if (!xenbus_scanf(xbt, "control", "sysrq", "%c", &sysrq_key)) {
-                printk(KERN_ERR "Unable to read sysrq code in "
-                       "control/sysrq\n");
-                xenbus_transaction_end(xbt, 1);
-                return;
-        }
-
-        if (sysrq_key != '\0')
-                xenbus_printf(xbt, "control", "sysrq", "%c", '\0');
-
-        err = xenbus_transaction_end(xbt, 0);
-        if (err == -EAGAIN)
-                goto again;
-
-        if (sysrq_key != '\0')
-                handle_sysrq(sysrq_key, NULL);
-}
-
-static struct xenbus_watch shutdown_watch = {
-        .node = "control/shutdown",
-        .callback = shutdown_handler
-};
-
-static struct xenbus_watch sysrq_watch = {
-        .node = "control/sysrq",
-        .callback = sysrq_handler
-};
-
-static int setup_shutdown_watcher(void)
-{
-        int err;
-
-        err = register_xenbus_watch(&shutdown_watch);
-        if (err) {
-                printk(KERN_ERR "Failed to set shutdown watcher\n");
-                return err;
-        }
-
-        err = register_xenbus_watch(&sysrq_watch);
-        if (err) {
-                printk(KERN_ERR "Failed to set sysrq watcher\n");
-                return err;
-        }
-
-        return 0;
-}
-
-static int shutdown_event(struct notifier_block *notifier,
-                          unsigned long event,
-                          void *data)
-{
-        setup_shutdown_watcher();
-        return NOTIFY_DONE;
-}
-
-static int __init setup_shutdown_event(void)
-{
-        static struct notifier_block xenstore_notifier = {
-                .notifier_call = shutdown_event
-        };
-        register_xenstore_notifier(&xenstore_notifier);
-
-        return 0;
-}
-
-subsys_initcall(setup_shutdown_event);
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index 4e527e7893a8..aa37469da696 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -44,8 +44,10 @@
 
 #include <asm/pgtable.h>
 #include <asm/tlbflush.h>
+#include <asm/fixmap.h>
 #include <asm/mmu_context.h>
 #include <asm/paravirt.h>
+#include <asm/linkage.h>
 
 #include <asm/xen/hypercall.h>
 #include <asm/xen/hypervisor.h>
@@ -56,15 +58,144 @@
 #include "multicalls.h"
 #include "mmu.h"
 
-xmaddr_t arbitrary_virt_to_machine(unsigned long address)
+/*
+ * Just beyond the highest usermode address.  STACK_TOP_MAX has a
+ * redzone above it, so round it up to a PGD boundary.
+ */
+#define USER_LIMIT      ((STACK_TOP_MAX + PGDIR_SIZE - 1) & PGDIR_MASK)
+
+
+#define P2M_ENTRIES_PER_PAGE    (PAGE_SIZE / sizeof(unsigned long))
+#define TOP_ENTRIES             (MAX_DOMAIN_PAGES / P2M_ENTRIES_PER_PAGE)
+
+/* Placeholder for holes in the address space */
+static unsigned long p2m_missing[P2M_ENTRIES_PER_PAGE] __page_aligned_data =
+                { [ 0 ... P2M_ENTRIES_PER_PAGE-1 ] = ~0UL };
+
+ /* Array of pointers to pages containing p2m entries */
+static unsigned long *p2m_top[TOP_ENTRIES] __page_aligned_data =
+                { [ 0 ... TOP_ENTRIES - 1] = &p2m_missing[0] };
+
+/* Arrays of p2m arrays expressed in mfns used for save/restore */
+static unsigned long p2m_top_mfn[TOP_ENTRIES] __page_aligned_bss;
+
+static unsigned long p2m_top_mfn_list[TOP_ENTRIES / P2M_ENTRIES_PER_PAGE]
+        __page_aligned_bss;
+
+static inline unsigned p2m_top_index(unsigned long pfn)
+{
+        BUG_ON(pfn >= MAX_DOMAIN_PAGES);
+        return pfn / P2M_ENTRIES_PER_PAGE;
+}
+
+static inline unsigned p2m_index(unsigned long pfn)
+{
+        return pfn % P2M_ENTRIES_PER_PAGE;
+}
+
+/* Build the parallel p2m_top_mfn structures */
+void xen_setup_mfn_list_list(void)
+{
+        unsigned pfn, idx;
+
+        for(pfn = 0; pfn < MAX_DOMAIN_PAGES; pfn += P2M_ENTRIES_PER_PAGE) {
+                unsigned topidx = p2m_top_index(pfn);
+
+                p2m_top_mfn[topidx] = virt_to_mfn(p2m_top[topidx]);
+        }
+
+        for(idx = 0; idx < ARRAY_SIZE(p2m_top_mfn_list); idx++) {
+                unsigned topidx = idx * P2M_ENTRIES_PER_PAGE;
+                p2m_top_mfn_list[idx] = virt_to_mfn(&p2m_top_mfn[topidx]);
+        }
+
+        BUG_ON(HYPERVISOR_shared_info == &xen_dummy_shared_info);
+
+        HYPERVISOR_shared_info->arch.pfn_to_mfn_frame_list_list =
+                virt_to_mfn(p2m_top_mfn_list);
+        HYPERVISOR_shared_info->arch.max_pfn = xen_start_info->nr_pages;
+}
+
+/* Set up p2m_top to point to the domain-builder provided p2m pages */
+void __init xen_build_dynamic_phys_to_machine(void)
+{
+        unsigned long *mfn_list = (unsigned long *)xen_start_info->mfn_list;
+        unsigned long max_pfn = min(MAX_DOMAIN_PAGES, xen_start_info->nr_pages);
+        unsigned pfn;
+
+        for(pfn = 0; pfn < max_pfn; pfn += P2M_ENTRIES_PER_PAGE) {
+                unsigned topidx = p2m_top_index(pfn);
+
+                p2m_top[topidx] = &mfn_list[pfn];
+        }
+}
+
+unsigned long get_phys_to_machine(unsigned long pfn)
+{
+        unsigned topidx, idx;
+
+        if (unlikely(pfn >= MAX_DOMAIN_PAGES))
+                return INVALID_P2M_ENTRY;
+
+        topidx = p2m_top_index(pfn);
+        idx = p2m_index(pfn);
+        return p2m_top[topidx][idx];
+}
+EXPORT_SYMBOL_GPL(get_phys_to_machine);
+
+static void alloc_p2m(unsigned long **pp, unsigned long *mfnp)
+{
+        unsigned long *p;
+        unsigned i;
+
+        p = (void *)__get_free_page(GFP_KERNEL | __GFP_NOFAIL);
+        BUG_ON(p == NULL);
+
+        for(i = 0; i < P2M_ENTRIES_PER_PAGE; i++)
+                p[i] = INVALID_P2M_ENTRY;
+
+        if (cmpxchg(pp, p2m_missing, p) != p2m_missing)
+                free_page((unsigned long)p);
+        else
+                *mfnp = virt_to_mfn(p);
+}
+
+void set_phys_to_machine(unsigned long pfn, unsigned long mfn)
+{
+        unsigned topidx, idx;
+
+        if (unlikely(xen_feature(XENFEAT_auto_translated_physmap))) {
+                BUG_ON(pfn != mfn && mfn != INVALID_P2M_ENTRY);
+                return;
+        }
+
+        if (unlikely(pfn >= MAX_DOMAIN_PAGES)) {
+                BUG_ON(mfn != INVALID_P2M_ENTRY);
+                return;
+        }
+
+        topidx = p2m_top_index(pfn);
+        if (p2m_top[topidx] == p2m_missing) {
+                /* no need to allocate a page to store an invalid entry */
+                if (mfn == INVALID_P2M_ENTRY)
+                        return;
+                alloc_p2m(&p2m_top[topidx], &p2m_top_mfn[topidx]);
+        }
+
+        idx = p2m_index(pfn);
+        p2m_top[topidx][idx] = mfn;
+}
+
+xmaddr_t arbitrary_virt_to_machine(void *vaddr)
 {
+        unsigned long address = (unsigned long)vaddr;
         unsigned int level;
         pte_t *pte = lookup_address(address, &level);
         unsigned offset = address & ~PAGE_MASK;
 
         BUG_ON(pte == NULL);
 
-        return XMADDR((pte_mfn(*pte) << PAGE_SHIFT) + offset);
+        return XMADDR(((phys_addr_t)pte_mfn(*pte) << PAGE_SHIFT) + offset);
 }
 
 void make_lowmem_page_readonly(void *vaddr)
@@ -98,59 +229,68 @@ void make_lowmem_page_readwrite(void *vaddr)
 }
 
 
-void xen_set_pmd(pmd_t *ptr, pmd_t val)
+static bool page_pinned(void *ptr)
+{
+        struct page *page = virt_to_page(ptr);
+
+        return PagePinned(page);
+}
+
+static void extend_mmu_update(const struct mmu_update *update)
 {
         struct multicall_space mcs;
         struct mmu_update *u;
 
-        preempt_disable();
+        mcs = xen_mc_extend_args(__HYPERVISOR_mmu_update, sizeof(*u));
+
+        if (mcs.mc != NULL)
+                mcs.mc->args[1]++;
+        else {
+                mcs = __xen_mc_entry(sizeof(*u));
+                MULTI_mmu_update(mcs.mc, mcs.args, 1, NULL, DOMID_SELF);
+        }
 
-        mcs = xen_mc_entry(sizeof(*u));
         u = mcs.args;
-        u->ptr = virt_to_machine(ptr).maddr;
-        u->val = pmd_val_ma(val);
-        MULTI_mmu_update(mcs.mc, u, 1, NULL, DOMID_SELF);
+        *u = *update;
+}
+
+void xen_set_pmd_hyper(pmd_t *ptr, pmd_t val)
+{
+        struct mmu_update u;
+
+        preempt_disable();
+
+        xen_mc_batch();
+
+        /* ptr may be ioremapped for 64-bit pagetable setup */
+        u.ptr = arbitrary_virt_to_machine(ptr).maddr;
+        u.val = pmd_val_ma(val);
+        extend_mmu_update(&u);
 
         xen_mc_issue(PARAVIRT_LAZY_MMU);
 
         preempt_enable();
 }
 
+void xen_set_pmd(pmd_t *ptr, pmd_t val)
+{
+        /* If page is not pinned, we can just update the entry
+           directly */
+        if (!page_pinned(ptr)) {
+                *ptr = val;
+                return;
+        }
+
+        xen_set_pmd_hyper(ptr, val);
+}
+
 /*
  * Associate a virtual page frame with a given physical page frame
  * and protection flags for that frame.
  */
 void set_pte_mfn(unsigned long vaddr, unsigned long mfn, pgprot_t flags)
 {
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
-        pte_t *pte;
-
-        pgd = swapper_pg_dir + pgd_index(vaddr);
-        if (pgd_none(*pgd)) {
-                BUG();
-                return;
-        }
-        pud = pud_offset(pgd, vaddr);
-        if (pud_none(*pud)) {
-                BUG();
-                return;
-        }
-        pmd = pmd_offset(pud, vaddr);
-        if (pmd_none(*pmd)) {
-                BUG();
-                return;
-        }
-        pte = pte_offset_kernel(pmd, vaddr);
-        /* <mfn,flags> stored as-is, to permit clearing entries */
-        xen_set_pte(pte, mfn_pte(mfn, flags));
-
-        /*
-         * It's enough to flush this one mapping.
-         * (PGE mappings get flushed as well)
-         */
-        __flush_tlb_one(vaddr);
+        set_pte_vaddr(vaddr, mfn_pte(mfn, flags));
 }
 
 void xen_set_pte_at(struct mm_struct *mm, unsigned long addr,
@@ -179,12 +319,32 @@ out:
                 preempt_enable();
 }
 
+pte_t xen_ptep_modify_prot_start(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+{
+        /* Just return the pte as-is.  We preserve the bits on commit */
+        return *ptep;
+}
+
+void xen_ptep_modify_prot_commit(struct mm_struct *mm, unsigned long addr,
+                                 pte_t *ptep, pte_t pte)
+{
+        struct mmu_update u;
+
+        xen_mc_batch();
+
+        u.ptr = virt_to_machine(ptep).maddr | MMU_PT_UPDATE_PRESERVE_AD;
+        u.val = pte_val_ma(pte);
+        extend_mmu_update(&u);
+
+        xen_mc_issue(PARAVIRT_LAZY_MMU);
+}
+
 /* Assume pteval_t is equivalent to all the other *val_t types. */
 static pteval_t pte_mfn_to_pfn(pteval_t val)
 {
         if (val & _PAGE_PRESENT) {
-                unsigned long mfn = (val & PTE_MASK) >> PAGE_SHIFT;
-                pteval_t flags = val & ~PTE_MASK;
+                unsigned long mfn = (val & PTE_PFN_MASK) >> PAGE_SHIFT;
+                pteval_t flags = val & PTE_FLAGS_MASK;
                 val = ((pteval_t)mfn_to_pfn(mfn) << PAGE_SHIFT) | flags;
         }
 
@@ -194,8 +354,8 @@ static pteval_t pte_mfn_to_pfn(pteval_t val)
 static pteval_t pte_pfn_to_mfn(pteval_t val)
 {
         if (val & _PAGE_PRESENT) {
-                unsigned long pfn = (val & PTE_MASK) >> PAGE_SHIFT;
-                pteval_t flags = val & ~PTE_MASK;
+                unsigned long pfn = (val & PTE_PFN_MASK) >> PAGE_SHIFT;
+                pteval_t flags = val & PTE_FLAGS_MASK;
                 val = ((pteval_t)pfn_to_mfn(pfn) << PAGE_SHIFT) | flags;
         }
 
@@ -229,34 +389,51 @@ pmdval_t xen_pmd_val(pmd_t pmd)
         return pte_mfn_to_pfn(pmd.pmd);
 }
 
-void xen_set_pud(pud_t *ptr, pud_t val)
+void xen_set_pud_hyper(pud_t *ptr, pud_t val)
 {
-        struct multicall_space mcs;
-        struct mmu_update *u;
+        struct mmu_update u;
 
         preempt_disable();
 
-        mcs = xen_mc_entry(sizeof(*u));
-        u = mcs.args;
-        u->ptr = virt_to_machine(ptr).maddr;
-        u->val = pud_val_ma(val);
-        MULTI_mmu_update(mcs.mc, u, 1, NULL, DOMID_SELF);
+        xen_mc_batch();
+
+        /* ptr may be ioremapped for 64-bit pagetable setup */
+        u.ptr = arbitrary_virt_to_machine(ptr).maddr;
+        u.val = pud_val_ma(val);
+        extend_mmu_update(&u);
 
         xen_mc_issue(PARAVIRT_LAZY_MMU);
 
         preempt_enable();
 }
 
+void xen_set_pud(pud_t *ptr, pud_t val)
+{
+        /* If page is not pinned, we can just update the entry
+           directly */
+        if (!page_pinned(ptr)) {
+                *ptr = val;
+                return;
+        }
+
+        xen_set_pud_hyper(ptr, val);
+}
+
 void xen_set_pte(pte_t *ptep, pte_t pte)
 {
+#ifdef CONFIG_X86_PAE
         ptep->pte_high = pte.pte_high;
         smp_wmb();
         ptep->pte_low = pte.pte_low;
+#else
+        *ptep = pte;
+#endif
 }
 
+#ifdef CONFIG_X86_PAE
 void xen_set_pte_atomic(pte_t *ptep, pte_t pte)
 {
-        set_64bit((u64 *)ptep, pte_val_ma(pte));
+        set_64bit((u64 *)ptep, native_pte_val(pte));
 }
 
 void xen_pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
@@ -268,8 +445,9 @@ void xen_pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
 
 void xen_pmd_clear(pmd_t *pmdp)
 {
-        xen_set_pmd(pmdp, __pmd(0));
+        set_pmd(pmdp, __pmd(0));
 }
+#endif  /* CONFIG_X86_PAE */
 
 pmd_t xen_make_pmd(pmdval_t pmd)
 {
@@ -277,78 +455,189 @@ pmd_t xen_make_pmd(pmdval_t pmd)
         return native_make_pmd(pmd);
 }
 
+#if PAGETABLE_LEVELS == 4
+pudval_t xen_pud_val(pud_t pud)
+{
+        return pte_mfn_to_pfn(pud.pud);
+}
+
+pud_t xen_make_pud(pudval_t pud)
+{
+        pud = pte_pfn_to_mfn(pud);
+
+        return native_make_pud(pud);
+}
+
+pgd_t *xen_get_user_pgd(pgd_t *pgd)
+{
+        pgd_t *pgd_page = (pgd_t *)(((unsigned long)pgd) & PAGE_MASK);
+        unsigned offset = pgd - pgd_page;
+        pgd_t *user_ptr = NULL;
+
+        if (offset < pgd_index(USER_LIMIT)) {
+                struct page *page = virt_to_page(pgd_page);
+                user_ptr = (pgd_t *)page->private;
+                if (user_ptr)
+                        user_ptr += offset;
+        }
+
+        return user_ptr;
+}
+
+static void __xen_set_pgd_hyper(pgd_t *ptr, pgd_t val)
+{
+        struct mmu_update u;
+
+        u.ptr = virt_to_machine(ptr).maddr;
+        u.val = pgd_val_ma(val);
+        extend_mmu_update(&u);
+}
+
 /*
-  (Yet another) pagetable walker.  This one is intended for pinning a
-  pagetable.  This means that it walks a pagetable and calls the
-  callback function on each page it finds making up the page table,
-  at every level.  It walks the entire pagetable, but it only bothers
-  pinning pte pages which are below pte_limit.  In the normal case
-  this will be TASK_SIZE, but at boot we need to pin up to
-  FIXADDR_TOP.  But the important bit is that we don't pin beyond
-  there, because then we start getting into Xen's ptes.
-*/
-static int pgd_walk(pgd_t *pgd_base, int (*func)(struct page *, enum pt_level),
+ * Raw hypercall-based set_pgd, intended for in early boot before
+ * there's a page structure.  This implies:
+ *  1. The only existing pagetable is the kernel's
+ *  2. It is always pinned
+ *  3. It has no user pagetable attached to it
+ */
+void __init xen_set_pgd_hyper(pgd_t *ptr, pgd_t val)
+{
+        preempt_disable();
+
+        xen_mc_batch();
+
+        __xen_set_pgd_hyper(ptr, val);
+
+        xen_mc_issue(PARAVIRT_LAZY_MMU);
+
+        preempt_enable();
+}
+
+void xen_set_pgd(pgd_t *ptr, pgd_t val)
+{
+        pgd_t *user_ptr = xen_get_user_pgd(ptr);
+
+        /* If page is not pinned, we can just update the entry
+           directly */
+        if (!page_pinned(ptr)) {
+                *ptr = val;
+                if (user_ptr) {
+                        WARN_ON(page_pinned(user_ptr));
+                        *user_ptr = val;
+                }
+                return;
+        }
+
+        /* If it's pinned, then we can at least batch the kernel and
+           user updates together. */
+        xen_mc_batch();
+
+        __xen_set_pgd_hyper(ptr, val);
+        if (user_ptr)
+                __xen_set_pgd_hyper(user_ptr, val);
+
+        xen_mc_issue(PARAVIRT_LAZY_MMU);
+}
+#endif  /* PAGETABLE_LEVELS == 4 */
+
+/*
+ * (Yet another) pagetable walker.  This one is intended for pinning a
+ * pagetable.  This means that it walks a pagetable and calls the
+ * callback function on each page it finds making up the page table,
+ * at every level.  It walks the entire pagetable, but it only bothers
+ * pinning pte pages which are below limit.  In the normal case this
+ * will be STACK_TOP_MAX, but at boot we need to pin up to
+ * FIXADDR_TOP.
+ *
+ * For 32-bit the important bit is that we don't pin beyond there,
+ * because then we start getting into Xen's ptes.
+ *
+ * For 64-bit, we must skip the Xen hole in the middle of the address
+ * space, just after the big x86-64 virtual hole.
+ */
+static int pgd_walk(pgd_t *pgd, int (*func)(struct page *, enum pt_level),
                     unsigned long limit)
 {
-        pgd_t *pgd = pgd_base;
         int flush = 0;
-        unsigned long addr = 0;
-        unsigned long pgd_next;
+        unsigned hole_low, hole_high;
+        unsigned pgdidx_limit, pudidx_limit, pmdidx_limit;
+        unsigned pgdidx, pudidx, pmdidx;
 
-        BUG_ON(limit > FIXADDR_TOP);
+        /* The limit is the last byte to be touched */
+        limit--;
+        BUG_ON(limit >= FIXADDR_TOP);
 
         if (xen_feature(XENFEAT_auto_translated_physmap))
                 return 0;
 
-        for (; addr != FIXADDR_TOP; pgd++, addr = pgd_next) {
+        /*
+         * 64-bit has a great big hole in the middle of the address
+         * space, which contains the Xen mappings.  On 32-bit these
+         * will end up making a zero-sized hole and so is a no-op.
+         */
+        hole_low = pgd_index(USER_LIMIT);
+        hole_high = pgd_index(PAGE_OFFSET);
+
+        pgdidx_limit = pgd_index(limit);
+#if PTRS_PER_PUD > 1
+        pudidx_limit = pud_index(limit);
+#else
+        pudidx_limit = 0;
+#endif
+#if PTRS_PER_PMD > 1
+        pmdidx_limit = pmd_index(limit);
+#else
+        pmdidx_limit = 0;
+#endif
+
+        flush |= (*func)(virt_to_page(pgd), PT_PGD);
+
+        for (pgdidx = 0; pgdidx <= pgdidx_limit; pgdidx++) {
                 pud_t *pud;
-                unsigned long pud_limit, pud_next;
 
-                pgd_next = pud_limit = pgd_addr_end(addr, FIXADDR_TOP);
+                if (pgdidx >= hole_low && pgdidx < hole_high)
+                        continue;
 
-                if (!pgd_val(*pgd))
+                if (!pgd_val(pgd[pgdidx]))
                         continue;
 
-                pud = pud_offset(pgd, 0);
+                pud = pud_offset(&pgd[pgdidx], 0);
 
                 if (PTRS_PER_PUD > 1) /* not folded */
                         flush |= (*func)(virt_to_page(pud), PT_PUD);
 
-                for (; addr != pud_limit; pud++, addr = pud_next) {
+                for (pudidx = 0; pudidx < PTRS_PER_PUD; pudidx++) {
                         pmd_t *pmd;
-                        unsigned long pmd_limit;
 
-                        pud_next = pud_addr_end(addr, pud_limit);
-
-                        if (pud_next < limit)
-                                pmd_limit = pud_next;
-                        else
-                                pmd_limit = limit;
+                        if (pgdidx == pgdidx_limit &&
+                            pudidx > pudidx_limit)
+                                goto out;
 
-                        if (pud_none(*pud))
+                        if (pud_none(pud[pudidx]))
                                 continue;
 
-                        pmd = pmd_offset(pud, 0);
+                        pmd = pmd_offset(&pud[pudidx], 0);
 
                         if (PTRS_PER_PMD > 1) /* not folded */
                                 flush |= (*func)(virt_to_page(pmd), PT_PMD);
 
-                        for (; addr != pmd_limit; pmd++) {
-                                addr += (PAGE_SIZE * PTRS_PER_PTE);
-                                if ((pmd_limit-1) < (addr-1)) {
-                                        addr = pmd_limit;
-                                        break;
-                                }
+                        for (pmdidx = 0; pmdidx < PTRS_PER_PMD; pmdidx++) {
+                                struct page *pte;
+
+                                if (pgdidx == pgdidx_limit &&
+                                    pudidx == pudidx_limit &&
+                                    pmdidx > pmdidx_limit)
+                                        goto out;
 
-                                if (pmd_none(*pmd))
+                                if (pmd_none(pmd[pmdidx]))
                                         continue;
 
-                                flush |= (*func)(pmd_page(*pmd), PT_PTE);
+                                pte = pmd_page(pmd[pmdidx]);
+                                flush |= (*func)(pte, PT_PTE);
                         }
                 }
         }
-
-        flush |= (*func)(virt_to_page(pgd_base), PT_PGD);
+out:
 
         return flush;
 }
@@ -430,20 +719,62 @@ void xen_pgd_pin(pgd_t *pgd)
 {
         xen_mc_batch();
 
-        if (pgd_walk(pgd, pin_page, TASK_SIZE)) {
+        if (pgd_walk(pgd, pin_page, USER_LIMIT)) {
                 /* re-enable interrupts for kmap_flush_unused */
                 xen_mc_issue(0);
                 kmap_flush_unused();
                 xen_mc_batch();
         }
 
+#ifdef CONFIG_X86_64
+        {
+                pgd_t *user_pgd = xen_get_user_pgd(pgd);
+
+                xen_do_pin(MMUEXT_PIN_L4_TABLE, PFN_DOWN(__pa(pgd)));
+
+                if (user_pgd) {
+                        pin_page(virt_to_page(user_pgd), PT_PGD);
+                        xen_do_pin(MMUEXT_PIN_L4_TABLE, PFN_DOWN(__pa(user_pgd)));
+                }
+        }
+#else /* CONFIG_X86_32 */
+#ifdef CONFIG_X86_PAE
+        /* Need to make sure unshared kernel PMD is pinnable */
+        pin_page(virt_to_page(pgd_page(pgd[pgd_index(TASK_SIZE)])), PT_PMD);
+#endif
         xen_do_pin(MMUEXT_PIN_L3_TABLE, PFN_DOWN(__pa(pgd)));
+#endif /* CONFIG_X86_64 */
         xen_mc_issue(0);
 }
 
-/* The init_mm pagetable is really pinned as soon as its created, but
-   that's before we have page structures to store the bits.  So do all
-   the book-keeping now. */
+/*
+ * On save, we need to pin all pagetables to make sure they get their
+ * mfns turned into pfns.  Search the list for any unpinned pgds and pin
+ * them (unpinned pgds are not currently in use, probably because the
+ * process is under construction or destruction).
+ */
+void xen_mm_pin_all(void)
+{
+        unsigned long flags;
+        struct page *page;
+
+        spin_lock_irqsave(&pgd_lock, flags);
+
+        list_for_each_entry(page, &pgd_list, lru) {
+                if (!PagePinned(page)) {
+                        xen_pgd_pin((pgd_t *)page_address(page));
+                        SetPageSavePinned(page);
+                }
+        }
+
+        spin_unlock_irqrestore(&pgd_lock, flags);
+}
+
+/*
+ * The init_mm pagetable is really pinned as soon as its created, but
+ * that's before we have page structures to store the bits.  So do all
+ * the book-keeping now.
+ */
 static __init int mark_pinned(struct page *page, enum pt_level level)
 {
         SetPagePinned(page);
@@ -493,11 +824,49 @@ static void xen_pgd_unpin(pgd_t *pgd)
 
         xen_do_pin(MMUEXT_UNPIN_TABLE, PFN_DOWN(__pa(pgd)));
 
-        pgd_walk(pgd, unpin_page, TASK_SIZE);
+#ifdef CONFIG_X86_64
+        {
+                pgd_t *user_pgd = xen_get_user_pgd(pgd);
+
+                if (user_pgd) {
+                        xen_do_pin(MMUEXT_UNPIN_TABLE, PFN_DOWN(__pa(user_pgd)));
+                        unpin_page(virt_to_page(user_pgd), PT_PGD);
+                }
+        }
+#endif
+
+#ifdef CONFIG_X86_PAE
+        /* Need to make sure unshared kernel PMD is unpinned */
+        pin_page(virt_to_page(pgd_page(pgd[pgd_index(TASK_SIZE)])), PT_PMD);
+#endif
+
+        pgd_walk(pgd, unpin_page, USER_LIMIT);
 
         xen_mc_issue(0);
 }
 
+/*
+ * On resume, undo any pinning done at save, so that the rest of the
+ * kernel doesn't see any unexpected pinned pagetables.
+ */
+void xen_mm_unpin_all(void)
+{
+        unsigned long flags;
+        struct page *page;
+
+        spin_lock_irqsave(&pgd_lock, flags);
+
+        list_for_each_entry(page, &pgd_list, lru) {
+                if (PageSavePinned(page)) {
+                        BUG_ON(!PagePinned(page));
+                        xen_pgd_unpin((pgd_t *)page_address(page));
+                        ClearPageSavePinned(page);
+                }
+        }
+
+        spin_unlock_irqrestore(&pgd_lock, flags);
+}
+
 void xen_activate_mm(struct mm_struct *prev, struct mm_struct *next)
 {
         spin_lock(&next->page_table_lock);
@@ -519,8 +888,15 @@ void xen_dup_mmap(struct mm_struct *oldmm, struct mm_struct *mm)
 static void drop_other_mm_ref(void *info)
 {
         struct mm_struct *mm = info;
+        struct mm_struct *active_mm;
+
+#ifdef CONFIG_X86_64
+        active_mm = read_pda(active_mm);
+#else
+        active_mm = __get_cpu_var(cpu_tlbstate).active_mm;
+#endif
 
-        if (__get_cpu_var(cpu_tlbstate).active_mm == mm)
+        if (active_mm == mm)
                 leave_mm(smp_processor_id());
 
         /* If this cpu still has a stale cr3 reference, then make sure
@@ -558,7 +934,7 @@ static void drop_mm_ref(struct mm_struct *mm)
         }
 
         if (!cpus_empty(mask))
-                xen_smp_call_function_mask(mask, drop_other_mm_ref, mm, 1);
+                smp_call_function_mask(mask, drop_other_mm_ref, mm, 1);
 }
 #else
 static void drop_mm_ref(struct mm_struct *mm)
@@ -591,7 +967,7 @@ void xen_exit_mmap(struct mm_struct *mm)
         spin_lock(&mm->page_table_lock);
 
         /* pgd may not be pinned in the error exit path of execve */
-        if (PagePinned(virt_to_page(mm->pgd)))
+        if (page_pinned(mm->pgd))
                 xen_pgd_unpin(mm->pgd);
 
         spin_unlock(&mm->page_table_lock);
diff --git a/arch/x86/xen/mmu.h b/arch/x86/xen/mmu.h
index 5fe961caffd4..0f59bd03f9e3 100644
--- a/arch/x86/xen/mmu.h
+++ b/arch/x86/xen/mmu.h
@@ -10,25 +10,9 @@ enum pt_level {
         PT_PTE
 };
 
-/*
- * Page-directory addresses above 4GB do not fit into architectural %cr3.
- * When accessing %cr3, or equivalent field in vcpu_guest_context, guests
- * must use the following accessor macros to pack/unpack valid MFNs.
- *
- * Note that Xen is using the fact that the pagetable base is always
- * page-aligned, and putting the 12 MSB of the address into the 12 LSB
- * of cr3.
- */
-#define xen_pfn_to_cr3(pfn) (((unsigned)(pfn) << 12) | ((unsigned)(pfn) >> 20))
-#define xen_cr3_to_pfn(cr3) (((unsigned)(cr3) >> 12) | ((unsigned)(cr3) << 20))
-
 
 void set_pte_mfn(unsigned long vaddr, unsigned long pfn, pgprot_t flags);
 
-void xen_set_pte(pte_t *ptep, pte_t pteval);
-void xen_set_pte_at(struct mm_struct *mm, unsigned long addr,
-                    pte_t *ptep, pte_t pteval);
-void xen_set_pmd(pmd_t *pmdp, pmd_t pmdval);
 
 void xen_activate_mm(struct mm_struct *prev, struct mm_struct *next);
 void xen_dup_mmap(struct mm_struct *oldmm, struct mm_struct *mm);
@@ -45,11 +29,32 @@ pte_t xen_make_pte(pteval_t);
 pmd_t xen_make_pmd(pmdval_t);
 pgd_t xen_make_pgd(pgdval_t);
 
+void xen_set_pte(pte_t *ptep, pte_t pteval);
 void xen_set_pte_at(struct mm_struct *mm, unsigned long addr,
                     pte_t *ptep, pte_t pteval);
+
+#ifdef CONFIG_X86_PAE
 void xen_set_pte_atomic(pte_t *ptep, pte_t pte);
-void xen_set_pud(pud_t *ptr, pud_t val);
 void xen_pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep);
 void xen_pmd_clear(pmd_t *pmdp);
+#endif  /* CONFIG_X86_PAE */
+
+void xen_set_pmd(pmd_t *pmdp, pmd_t pmdval);
+void xen_set_pud(pud_t *ptr, pud_t val);
+void xen_set_pmd_hyper(pmd_t *pmdp, pmd_t pmdval);
+void xen_set_pud_hyper(pud_t *ptr, pud_t val);
+
+#if PAGETABLE_LEVELS == 4
+pudval_t xen_pud_val(pud_t pud);
+pud_t xen_make_pud(pudval_t pudval);
+void xen_set_pgd(pgd_t *pgdp, pgd_t pgd);
+void xen_set_pgd_hyper(pgd_t *pgdp, pgd_t pgd);
+#endif
+
+pgd_t *xen_get_user_pgd(pgd_t *pgd);
+
+pte_t xen_ptep_modify_prot_start(struct mm_struct *mm, unsigned long addr, pte_t *ptep);
+void  xen_ptep_modify_prot_commit(struct mm_struct *mm, unsigned long addr,
+                                  pte_t *ptep, pte_t pte);
 
 #endif  /* _XEN_MMU_H */
diff --git a/arch/x86/xen/multicalls.c b/arch/x86/xen/multicalls.c
index 5791eb2e3750..9efd1c6c9776 100644
--- a/arch/x86/xen/multicalls.c
+++ b/arch/x86/xen/multicalls.c
@@ -29,14 +29,14 @@
 #define MC_DEBUG        1
 
 #define MC_BATCH        32
-#define MC_ARGS         (MC_BATCH * 16 / sizeof(u64))
+#define MC_ARGS         (MC_BATCH * 16)
 
 struct mc_buffer {
         struct multicall_entry entries[MC_BATCH];
 #if MC_DEBUG
         struct multicall_entry debug[MC_BATCH];
 #endif
-        u64 args[MC_ARGS];
+        unsigned char args[MC_ARGS];
         struct callback {
                 void (*fn)(void *);
                 void *data;
@@ -76,6 +76,7 @@ void xen_mc_flush(void)
                 if (ret) {
                         printk(KERN_ERR "%d multicall(s) failed: cpu %d\n",
                                ret, smp_processor_id());
+                        dump_stack();
                         for (i = 0; i < b->mcidx; i++) {
                                 printk("  call %2d/%d: op=%lu arg=[%lx] result=%ld\n",
                                        i+1, b->mcidx,
@@ -107,20 +108,48 @@ struct multicall_space __xen_mc_entry(size_t args)
 {
         struct mc_buffer *b = &__get_cpu_var(mc_buffer);
         struct multicall_space ret;
-        unsigned argspace = (args + sizeof(u64) - 1) / sizeof(u64);
+        unsigned argidx = roundup(b->argidx, sizeof(u64));
 
         BUG_ON(preemptible());
-        BUG_ON(argspace > MC_ARGS);
+        BUG_ON(b->argidx > MC_ARGS);
 
         if (b->mcidx == MC_BATCH ||
-            (b->argidx + argspace) > MC_ARGS)
+            (argidx + args) > MC_ARGS) {
                 xen_mc_flush();
+                argidx = roundup(b->argidx, sizeof(u64));
+        }
 
         ret.mc = &b->entries[b->mcidx];
         b->mcidx++;
+        ret.args = &b->args[argidx];
+        b->argidx = argidx + args;
+
+        BUG_ON(b->argidx > MC_ARGS);
+        return ret;
+}
+
+struct multicall_space xen_mc_extend_args(unsigned long op, size_t size)
+{
+        struct mc_buffer *b = &__get_cpu_var(mc_buffer);
+        struct multicall_space ret = { NULL, NULL };
+
+        BUG_ON(preemptible());
+        BUG_ON(b->argidx > MC_ARGS);
+
+        if (b->mcidx == 0)
+                return ret;
+
+        if (b->entries[b->mcidx - 1].op != op)
+                return ret;
+
+        if ((b->argidx + size) > MC_ARGS)
+                return ret;
+
+        ret.mc = &b->entries[b->mcidx - 1];
         ret.args = &b->args[b->argidx];
-        b->argidx += argspace;
+        b->argidx += size;
 
+        BUG_ON(b->argidx > MC_ARGS);
         return ret;
 }
 
diff --git a/arch/x86/xen/multicalls.h b/arch/x86/xen/multicalls.h
index 8bae996d99a3..858938241616 100644
--- a/arch/x86/xen/multicalls.h
+++ b/arch/x86/xen/multicalls.h
@@ -45,4 +45,16 @@ static inline void xen_mc_issue(unsigned mode)
 /* Set up a callback to be called when the current batch is flushed */
 void xen_mc_callback(void (*fn)(void *), void *data);
 
+/*
+ * Try to extend the arguments of the previous multicall command.  The
+ * previous command's op must match.  If it does, then it attempts to
+ * extend the argument space allocated to the multicall entry by
+ * arg_size bytes.
+ *
+ * The returned multicall_space will return with mc pointing to the
+ * command on success, or NULL on failure, and args pointing to the
+ * newly allocated space.
+ */
+struct multicall_space xen_mc_extend_args(unsigned long op, size_t arg_size);
+
 #endif /* _XEN_MULTICALLS_H */
diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
index 82517e4a752a..b6acc3a0af46 100644
--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -13,9 +13,11 @@
 #include <asm/vdso.h>
 #include <asm/e820.h>
 #include <asm/setup.h>
+#include <asm/acpi.h>
 #include <asm/xen/hypervisor.h>
 #include <asm/xen/hypercall.h>
 
+#include <xen/page.h>
 #include <xen/interface/callback.h>
 #include <xen/interface/physdev.h>
 #include <xen/features.h>
@@ -27,8 +29,6 @@
 extern const char xen_hypervisor_callback[];
 extern const char xen_failsafe_callback[];
 
-unsigned long *phys_to_machine_mapping;
-EXPORT_SYMBOL(phys_to_machine_mapping);
 
 /**
  * machine_specific_memory_setup - Hook for machine specific memory setup.
@@ -38,9 +38,31 @@ char * __init xen_memory_setup(void)
 {
         unsigned long max_pfn = xen_start_info->nr_pages;
 
+        max_pfn = min(MAX_DOMAIN_PAGES, max_pfn);
+
         e820.nr_map = 0;
-        add_memory_region(0, LOWMEMSIZE(), E820_RAM);
-        add_memory_region(HIGH_MEMORY, PFN_PHYS(max_pfn)-HIGH_MEMORY, E820_RAM);
+
+        e820_add_region(0, PFN_PHYS(max_pfn), E820_RAM);
+
+        /*
+         * Even though this is normal, usable memory under Xen, reserve
+         * ISA memory anyway because too many things think they can poke
+         * about in there.
+         */
+        e820_add_region(ISA_START_ADDRESS, ISA_END_ADDRESS - ISA_START_ADDRESS,
+                        E820_RESERVED);
+
+        /*
+         * Reserve Xen bits:
+         *  - mfn_list
+         *  - xen_start_info
+         * See comment above "struct start_info" in <xen/interface/xen.h>
+         */
+        e820_add_region(__pa(xen_start_info->mfn_list),
+                        xen_start_info->pt_base - xen_start_info->mfn_list,
+                        E820_RESERVED);
+
+        sanitize_e820_map(e820.map, ARRAY_SIZE(e820.map), &e820.nr_map);
 
         return "Xen";
 }
@@ -61,30 +83,72 @@ static void xen_idle(void)
 
 /*
  * Set the bit indicating "nosegneg" library variants should be used.
+ * We only need to bother in pure 32-bit mode; compat 32-bit processes
+ * can have un-truncated segments, so wrapping around is allowed.
  */
 static void __init fiddle_vdso(void)
 {
-        extern const char vdso32_default_start;
-        u32 *mask = VDSO32_SYMBOL(&vdso32_default_start, NOTE_MASK);
+#ifdef CONFIG_X86_32
+        u32 *mask;
+        mask = VDSO32_SYMBOL(&vdso32_int80_start, NOTE_MASK);
+        *mask |= 1 << VDSO_NOTE_NONEGSEG_BIT;
+        mask = VDSO32_SYMBOL(&vdso32_sysenter_start, NOTE_MASK);
         *mask |= 1 << VDSO_NOTE_NONEGSEG_BIT;
+#endif
 }
 
-void xen_enable_sysenter(void)
+static __cpuinit int register_callback(unsigned type, const void *func)
 {
-        int cpu = smp_processor_id();
-        extern void xen_sysenter_target(void);
-        /* Mask events on entry, even though they get enabled immediately */
-        static struct callback_register sysenter = {
-                .type = CALLBACKTYPE_sysenter,
-                .address = { __KERNEL_CS, (unsigned long)xen_sysenter_target },
+        struct callback_register callback = {
+                .type = type,
+                .address = XEN_CALLBACK(__KERNEL_CS, func),
                 .flags = CALLBACKF_mask_events,
         };
 
-        if (!boot_cpu_has(X86_FEATURE_SEP) ||
-            HYPERVISOR_callback_op(CALLBACKOP_register, &sysenter) != 0) {
-                clear_cpu_cap(&cpu_data(cpu), X86_FEATURE_SEP);
-                clear_cpu_cap(&boot_cpu_data, X86_FEATURE_SEP);
+        return HYPERVISOR_callback_op(CALLBACKOP_register, &callback);
+}
+
+void __cpuinit xen_enable_sysenter(void)
+{
+        extern void xen_sysenter_target(void);
+        int ret;
+        unsigned sysenter_feature;
+
+#ifdef CONFIG_X86_32
+        sysenter_feature = X86_FEATURE_SEP;
+#else
+        sysenter_feature = X86_FEATURE_SYSENTER32;
+#endif
+
+        if (!boot_cpu_has(sysenter_feature))
+                return;
+
+        ret = register_callback(CALLBACKTYPE_sysenter, xen_sysenter_target);
+        if(ret != 0)
+                setup_clear_cpu_cap(sysenter_feature);
+}
+
+void __cpuinit xen_enable_syscall(void)
+{
+#ifdef CONFIG_X86_64
+        int ret;
+        extern void xen_syscall_target(void);
+        extern void xen_syscall32_target(void);
+
+        ret = register_callback(CALLBACKTYPE_syscall, xen_syscall_target);
+        if (ret != 0) {
+                printk(KERN_ERR "Failed to set syscall callback: %d\n", ret);
+                /* Pretty fatal; 64-bit userspace has no other
+                   mechanism for syscalls. */
+        }
+
+        if (boot_cpu_has(X86_FEATURE_SYSCALL32)) {
+                ret = register_callback(CALLBACKTYPE_syscall32,
+                                        xen_syscall32_target);
+                if (ret != 0)
+                        setup_clear_cpu_cap(X86_FEATURE_SYSCALL32);
         }
+#endif /* CONFIG_X86_64 */
 }
 
 void __init xen_arch_setup(void)
@@ -98,10 +162,12 @@ void __init xen_arch_setup(void)
         if (!xen_feature(XENFEAT_auto_translated_physmap))
                 HYPERVISOR_vm_assist(VMASST_CMD_enable, VMASST_TYPE_pae_extended_cr3);
 
-        HYPERVISOR_set_callbacks(__KERNEL_CS, (unsigned long)xen_hypervisor_callback,
-                                 __KERNEL_CS, (unsigned long)xen_failsafe_callback);
+        if (register_callback(CALLBACKTYPE_event, xen_hypervisor_callback) ||
+            register_callback(CALLBACKTYPE_failsafe, xen_failsafe_callback))
+                BUG();
 
         xen_enable_sysenter();
+        xen_enable_syscall();
 
         set_iopl.iopl = 1;
         rc = HYPERVISOR_physdev_op(PHYSDEVOP_set_iopl, &set_iopl);
@@ -121,11 +187,6 @@ void __init xen_arch_setup(void)
 
         pm_idle = xen_idle;
 
-#ifdef CONFIG_SMP
-        /* fill cpus_possible with all available cpus */
-        xen_fill_possible_map();
-#endif
-
         paravirt_disable_iospace();
 
         fiddle_vdso();
diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
index 94e69000f982..d8faf79a0a1d 100644
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -15,6 +15,7 @@
  * This does not handle HOTPLUG_CPU yet.
  */
 #include <linux/sched.h>
+#include <linux/kernel_stat.h>
 #include <linux/err.h>
 #include <linux/smp.h>
 
@@ -35,28 +36,17 @@
 #include "xen-ops.h"
 #include "mmu.h"
 
-static cpumask_t xen_cpu_initialized_map;
-static DEFINE_PER_CPU(int, resched_irq) = -1;
-static DEFINE_PER_CPU(int, callfunc_irq) = -1;
-static DEFINE_PER_CPU(int, debug_irq) = -1;
+static void __cpuinit xen_init_lock_cpu(int cpu);
 
-/*
- * Structure and data for smp_call_function(). This is designed to minimise
- * static memory requirements. It also looks cleaner.
- */
-static DEFINE_SPINLOCK(call_lock);
-
-struct call_data_struct {
-        void (*func) (void *info);
-        void *info;
-        atomic_t started;
-        atomic_t finished;
-        int wait;
-};
+cpumask_t xen_cpu_initialized_map;
 
-static irqreturn_t xen_call_function_interrupt(int irq, void *dev_id);
+static DEFINE_PER_CPU(int, resched_irq);
+static DEFINE_PER_CPU(int, callfunc_irq);
+static DEFINE_PER_CPU(int, callfuncsingle_irq);
+static DEFINE_PER_CPU(int, debug_irq) = -1;
 
-static struct call_data_struct *call_data;
+static irqreturn_t xen_call_function_interrupt(int irq, void *dev_id);
+static irqreturn_t xen_call_function_single_interrupt(int irq, void *dev_id);
 
 /*
  * Reschedule call back. Nothing to do,
@@ -65,6 +55,12 @@ static struct call_data_struct *call_data;
  */
 static irqreturn_t xen_reschedule_interrupt(int irq, void *dev_id)
 {
+#ifdef CONFIG_X86_32
+        __get_cpu_var(irq_stat).irq_resched_count++;
+#else
+        add_pda(irq_resched_count, 1);
+#endif
+
         return IRQ_HANDLED;
 }
 
@@ -73,13 +69,22 @@ static __cpuinit void cpu_bringup_and_idle(void)
         int cpu = smp_processor_id();
 
         cpu_init();
+        preempt_disable();
+
         xen_enable_sysenter();
+        xen_enable_syscall();
 
-        preempt_disable();
-        per_cpu(cpu_state, cpu) = CPU_ONLINE;
+        cpu = smp_processor_id();
+        smp_store_cpu_info(cpu);
+        cpu_data(cpu).x86_max_cores = 1;
+        set_cpu_sibling_map(cpu);
 
         xen_setup_cpu_clockevents();
 
+        cpu_set(cpu, cpu_online_map);
+        x86_write_percpu(cpu_state, CPU_ONLINE);
+        wmb();
+
         /* We can take interrupts now: we're officially "up". */
         local_irq_enable();
 
@@ -122,6 +127,17 @@ static int xen_smp_intr_init(unsigned int cpu)
                 goto fail;
         per_cpu(debug_irq, cpu) = rc;
 
+        callfunc_name = kasprintf(GFP_KERNEL, "callfuncsingle%d", cpu);
+        rc = bind_ipi_to_irqhandler(XEN_CALL_FUNCTION_SINGLE_VECTOR,
+                                    cpu,
+                                    xen_call_function_single_interrupt,
+                                    IRQF_DISABLED|IRQF_PERCPU|IRQF_NOBALANCING,
+                                    callfunc_name,
+                                    NULL);
+        if (rc < 0)
+                goto fail;
+        per_cpu(callfuncsingle_irq, cpu) = rc;
+
         return 0;
 
  fail:
@@ -131,59 +147,45 @@ static int xen_smp_intr_init(unsigned int cpu)
                 unbind_from_irqhandler(per_cpu(callfunc_irq, cpu), NULL);
         if (per_cpu(debug_irq, cpu) >= 0)
                 unbind_from_irqhandler(per_cpu(debug_irq, cpu), NULL);
+        if (per_cpu(callfuncsingle_irq, cpu) >= 0)
+                unbind_from_irqhandler(per_cpu(callfuncsingle_irq, cpu), NULL);
+
         return rc;
 }
 
-void __init xen_fill_possible_map(void)
+static void __init xen_fill_possible_map(void)
 {
         int i, rc;
 
         for (i = 0; i < NR_CPUS; i++) {
                 rc = HYPERVISOR_vcpu_op(VCPUOP_is_up, i, NULL);
-                if (rc >= 0)
+                if (rc >= 0) {
+                        num_processors++;
                         cpu_set(i, cpu_possible_map);
+                }
         }
 }
 
-void __init xen_smp_prepare_boot_cpu(void)
+static void __init xen_smp_prepare_boot_cpu(void)
 {
-        int cpu;
-
         BUG_ON(smp_processor_id() != 0);
         native_smp_prepare_boot_cpu();
 
         /* We've switched to the "real" per-cpu gdt, so make sure the
            old memory can be recycled */
-        make_lowmem_page_readwrite(&per_cpu__gdt_page);
-
-        for_each_possible_cpu(cpu) {
-                cpus_clear(per_cpu(cpu_sibling_map, cpu));
-                /*
-                 * cpu_core_map lives in a per cpu area that is cleared
-                 * when the per cpu array is allocated.
-                 *
-                 * cpus_clear(per_cpu(cpu_core_map, cpu));
-                 */
-        }
+        make_lowmem_page_readwrite(&per_cpu_var(gdt_page));
 
         xen_setup_vcpu_info_placement();
 }
 
-void __init xen_smp_prepare_cpus(unsigned int max_cpus)
+static void __init xen_smp_prepare_cpus(unsigned int max_cpus)
 {
         unsigned cpu;
 
-        for_each_possible_cpu(cpu) {
-                cpus_clear(per_cpu(cpu_sibling_map, cpu));
-                /*
-                 * cpu_core_ map will be zeroed when the per
-                 * cpu area is allocated.
-                 *
-                 * cpus_clear(per_cpu(cpu_core_map, cpu));
-                 */
-        }
+        xen_init_lock_cpu(0);
 
         smp_store_cpu_info(0);
+        cpu_data(0).x86_max_cores = 1;
         set_cpu_sibling_map(0);
 
         if (xen_smp_intr_init(0))
@@ -218,7 +220,7 @@ static __cpuinit int
 cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
 {
         struct vcpu_guest_context *ctxt;
-        struct gdt_page *gdt = &per_cpu(gdt_page, cpu);
+        struct desc_struct *gdt;
 
         if (cpu_test_and_set(cpu, xen_cpu_initialized_map))
                 return 0;
@@ -227,12 +229,15 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
         if (ctxt == NULL)
                 return -ENOMEM;
 
+        gdt = get_cpu_gdt_table(cpu);
+
         ctxt->flags = VGCF_IN_KERNEL;
         ctxt->user_regs.ds = __USER_DS;
         ctxt->user_regs.es = __USER_DS;
-        ctxt->user_regs.fs = __KERNEL_PERCPU;
-        ctxt->user_regs.gs = 0;
         ctxt->user_regs.ss = __KERNEL_DS;
+#ifdef CONFIG_X86_32
+        ctxt->user_regs.fs = __KERNEL_PERCPU;
+#endif
         ctxt->user_regs.eip = (unsigned long)cpu_bringup_and_idle;
         ctxt->user_regs.eflags = 0x1000; /* IOPL_RING1 */
 
@@ -242,11 +247,11 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
 
         ctxt->ldt_ents = 0;
 
-        BUG_ON((unsigned long)gdt->gdt & ~PAGE_MASK);
-        make_lowmem_page_readonly(gdt->gdt);
+        BUG_ON((unsigned long)gdt & ~PAGE_MASK);
+        make_lowmem_page_readonly(gdt);
 
-        ctxt->gdt_frames[0] = virt_to_mfn(gdt->gdt);
-        ctxt->gdt_ents      = ARRAY_SIZE(gdt->gdt);
+        ctxt->gdt_frames[0] = virt_to_mfn(gdt);
+        ctxt->gdt_ents      = GDT_ENTRIES;
 
         ctxt->user_regs.cs = __KERNEL_CS;
         ctxt->user_regs.esp = idle->thread.sp0 - sizeof(struct pt_regs);
@@ -254,9 +259,11 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
         ctxt->kernel_ss = __KERNEL_DS;
         ctxt->kernel_sp = idle->thread.sp0;
 
+#ifdef CONFIG_X86_32
         ctxt->event_callback_cs     = __KERNEL_CS;
-        ctxt->event_callback_eip    = (unsigned long)xen_hypervisor_callback;
         ctxt->failsafe_callback_cs  = __KERNEL_CS;
+#endif
+        ctxt->event_callback_eip    = (unsigned long)xen_hypervisor_callback;
         ctxt->failsafe_callback_eip = (unsigned long)xen_failsafe_callback;
 
         per_cpu(xen_cr3, cpu) = __pa(swapper_pg_dir);
@@ -269,7 +276,7 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
         return 0;
 }
 
-int __cpuinit xen_cpu_up(unsigned int cpu)
+static int __cpuinit xen_cpu_up(unsigned int cpu)
 {
         struct task_struct *idle = idle_task(cpu);
         int rc;
@@ -280,10 +287,28 @@ int __cpuinit xen_cpu_up(unsigned int cpu)
                 return rc;
 #endif
 
+#ifdef CONFIG_X86_64
+        /* Allocate node local memory for AP pdas */
+        WARN_ON(cpu == 0);
+        if (cpu > 0) {
+                rc = get_local_pda(cpu);
+                if (rc)
+                        return rc;
+        }
+#endif
+
+#ifdef CONFIG_X86_32
         init_gdt(cpu);
         per_cpu(current_task, cpu) = idle;
         irq_ctx_init(cpu);
+#else
+        cpu_pda(cpu)->pcurrent = idle;
+        clear_tsk_thread_flag(idle, TIF_FORK);
+#endif
         xen_setup_timer(cpu);
+        xen_init_lock_cpu(cpu);
+
+        per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
 
         /* make sure interrupts start blocked */
         per_cpu(xen_vcpu, cpu)->evtchn_upcall_mask = 1;
@@ -299,20 +324,18 @@ int __cpuinit xen_cpu_up(unsigned int cpu)
         if (rc)
                 return rc;
 
-        smp_store_cpu_info(cpu);
-        set_cpu_sibling_map(cpu);
-        /* This must be done before setting cpu_online_map */
-        wmb();
-
-        cpu_set(cpu, cpu_online_map);
-
         rc = HYPERVISOR_vcpu_op(VCPUOP_up, cpu, NULL);
         BUG_ON(rc);
 
+        while(per_cpu(cpu_state, cpu) != CPU_ONLINE) {
+                HYPERVISOR_sched_op(SCHEDOP_yield, 0);
+                barrier();
+        }
+
         return 0;
 }
 
-void xen_smp_cpus_done(unsigned int max_cpus)
+static void xen_smp_cpus_done(unsigned int max_cpus)
 {
 }
 
@@ -328,104 +351,254 @@ static void stop_self(void *v)
         BUG();
 }
 
-void xen_smp_send_stop(void)
+static void xen_smp_send_stop(void)
 {
-        smp_call_function(stop_self, NULL, 0, 0);
+        smp_call_function(stop_self, NULL, 0);
 }
 
-void xen_smp_send_reschedule(int cpu)
+static void xen_smp_send_reschedule(int cpu)
 {
         xen_send_IPI_one(cpu, XEN_RESCHEDULE_VECTOR);
 }
 
-
 static void xen_send_IPI_mask(cpumask_t mask, enum ipi_vector vector)
 {
         unsigned cpu;
 
         cpus_and(mask, mask, cpu_online_map);
 
-        for_each_cpu_mask(cpu, mask)
+        for_each_cpu_mask_nr(cpu, mask)
                 xen_send_IPI_one(cpu, vector);
 }
 
+static void xen_smp_send_call_function_ipi(cpumask_t mask)
+{
+        int cpu;
+
+        xen_send_IPI_mask(mask, XEN_CALL_FUNCTION_VECTOR);
+
+        /* Make sure other vcpus get a chance to run if they need to. */
+        for_each_cpu_mask_nr(cpu, mask) {
+                if (xen_vcpu_stolen(cpu)) {
+                        HYPERVISOR_sched_op(SCHEDOP_yield, 0);
+                        break;
+                }
+        }
+}
+
+static void xen_smp_send_call_function_single_ipi(int cpu)
+{
+        xen_send_IPI_mask(cpumask_of_cpu(cpu), XEN_CALL_FUNCTION_SINGLE_VECTOR);
+}
+
 static irqreturn_t xen_call_function_interrupt(int irq, void *dev_id)
 {
-        void (*func) (void *info) = call_data->func;
-        void *info = call_data->info;
-        int wait = call_data->wait;
-
-        /*
-         * Notify initiating CPU that I've grabbed the data and am
-         * about to execute the function
-         */
-        mb();
-        atomic_inc(&call_data->started);
-        /*
-         * At this point the info structure may be out of scope unless wait==1
-         */
         irq_enter();
-        (*func)(info);
+        generic_smp_call_function_interrupt();
+#ifdef CONFIG_X86_32
         __get_cpu_var(irq_stat).irq_call_count++;
+#else
+        add_pda(irq_call_count, 1);
+#endif
         irq_exit();
 
-        if (wait) {
-                mb();           /* commit everything before setting finished */
-                atomic_inc(&call_data->finished);
-        }
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t xen_call_function_single_interrupt(int irq, void *dev_id)
+{
+        irq_enter();
+        generic_smp_call_function_single_interrupt();
+#ifdef CONFIG_X86_32
+        __get_cpu_var(irq_stat).irq_call_count++;
+#else
+        add_pda(irq_call_count, 1);
+#endif
+        irq_exit();
 
         return IRQ_HANDLED;
 }
 
-int xen_smp_call_function_mask(cpumask_t mask, void (*func)(void *),
-                               void *info, int wait)
+struct xen_spinlock {
+        unsigned char lock;             /* 0 -> free; 1 -> locked */
+        unsigned short spinners;        /* count of waiting cpus */
+};
+
+static int xen_spin_is_locked(struct raw_spinlock *lock)
 {
-        struct call_data_struct data;
-        int cpus, cpu;
-        bool yield;
+        struct xen_spinlock *xl = (struct xen_spinlock *)lock;
 
-        /* Holding any lock stops cpus from going down. */
-        spin_lock(&call_lock);
+        return xl->lock != 0;
+}
 
-        cpu_clear(smp_processor_id(), mask);
+static int xen_spin_is_contended(struct raw_spinlock *lock)
+{
+        struct xen_spinlock *xl = (struct xen_spinlock *)lock;
 
-        cpus = cpus_weight(mask);
-        if (!cpus) {
-                spin_unlock(&call_lock);
+        /* Not strictly true; this is only the count of contended
+           lock-takers entering the slow path. */
+        return xl->spinners != 0;
+}
+
+static int xen_spin_trylock(struct raw_spinlock *lock)
+{
+        struct xen_spinlock *xl = (struct xen_spinlock *)lock;
+        u8 old = 1;
+
+        asm("xchgb %b0,%1"
+            : "+q" (old), "+m" (xl->lock) : : "memory");
+
+        return old == 0;
+}
+
+static DEFINE_PER_CPU(int, lock_kicker_irq) = -1;
+static DEFINE_PER_CPU(struct xen_spinlock *, lock_spinners);
+
+static inline void spinning_lock(struct xen_spinlock *xl)
+{
+        __get_cpu_var(lock_spinners) = xl;
+        wmb();                  /* set lock of interest before count */
+        asm(LOCK_PREFIX " incw %0"
+            : "+m" (xl->spinners) : : "memory");
+}
+
+static inline void unspinning_lock(struct xen_spinlock *xl)
+{
+        asm(LOCK_PREFIX " decw %0"
+            : "+m" (xl->spinners) : : "memory");
+        wmb();                  /* decrement count before clearing lock */
+        __get_cpu_var(lock_spinners) = NULL;
+}
+
+static noinline int xen_spin_lock_slow(struct raw_spinlock *lock)
+{
+        struct xen_spinlock *xl = (struct xen_spinlock *)lock;
+        int irq = __get_cpu_var(lock_kicker_irq);
+        int ret;
+
+        /* If kicker interrupts not initialized yet, just spin */
+        if (irq == -1)
                 return 0;
+
+        /* announce we're spinning */
+        spinning_lock(xl);
+
+        /* clear pending */
+        xen_clear_irq_pending(irq);
+
+        /* check again make sure it didn't become free while
+           we weren't looking  */
+        ret = xen_spin_trylock(lock);
+        if (ret)
+                goto out;
+
+        /* block until irq becomes pending */
+        xen_poll_irq(irq);
+        kstat_this_cpu.irqs[irq]++;
+
+out:
+        unspinning_lock(xl);
+        return ret;
+}
+
+static void xen_spin_lock(struct raw_spinlock *lock)
+{
+        struct xen_spinlock *xl = (struct xen_spinlock *)lock;
+        int timeout;
+        u8 oldval;
+
+        do {
+                timeout = 1 << 10;
+
+                asm("1: xchgb %1,%0\n"
+                    "   testb %1,%1\n"
+                    "   jz 3f\n"
+                    "2: rep;nop\n"
+                    "   cmpb $0,%0\n"
+                    "   je 1b\n"
+                    "   dec %2\n"
+                    "   jnz 2b\n"
+                    "3:\n"
+                    : "+m" (xl->lock), "=q" (oldval), "+r" (timeout)
+                    : "1" (1)
+                    : "memory");
+
+        } while (unlikely(oldval != 0 && !xen_spin_lock_slow(lock)));
+}
+
+static noinline void xen_spin_unlock_slow(struct xen_spinlock *xl)
+{
+        int cpu;
+
+        for_each_online_cpu(cpu) {
+                /* XXX should mix up next cpu selection */
+                if (per_cpu(lock_spinners, cpu) == xl) {
+                        xen_send_IPI_one(cpu, XEN_SPIN_UNLOCK_VECTOR);
+                        break;
+                }
         }
+}
 
-        /* Can deadlock when called with interrupts disabled */
-        WARN_ON(irqs_disabled());
+static void xen_spin_unlock(struct raw_spinlock *lock)
+{
+        struct xen_spinlock *xl = (struct xen_spinlock *)lock;
 
-        data.func = func;
-        data.info = info;
-        atomic_set(&data.started, 0);
-        data.wait = wait;
-        if (wait)
-                atomic_set(&data.finished, 0);
+        smp_wmb();              /* make sure no writes get moved after unlock */
+        xl->lock = 0;           /* release lock */
 
-        call_data = &data;
-        mb();                   /* write everything before IPI */
+        /* make sure unlock happens before kick */
+        barrier();
 
-        /* Send a message to other CPUs and wait for them to respond */
-        xen_send_IPI_mask(mask, XEN_CALL_FUNCTION_VECTOR);
+        if (unlikely(xl->spinners))
+                xen_spin_unlock_slow(xl);
+}
 
-        /* Make sure other vcpus get a chance to run if they need to. */
-        yield = false;
-        for_each_cpu_mask(cpu, mask)
-                if (xen_vcpu_stolen(cpu))
-                        yield = true;
+static __cpuinit void xen_init_lock_cpu(int cpu)
+{
+        int irq;
+        const char *name;
+
+        name = kasprintf(GFP_KERNEL, "spinlock%d", cpu);
+        irq = bind_ipi_to_irqhandler(XEN_SPIN_UNLOCK_VECTOR,
+                                     cpu,
+                                     xen_reschedule_interrupt,
+                                     IRQF_DISABLED|IRQF_PERCPU|IRQF_NOBALANCING,
+                                     name,
+                                     NULL);
+
+        if (irq >= 0) {
+                disable_irq(irq); /* make sure it's never delivered */
+                per_cpu(lock_kicker_irq, cpu) = irq;
+        }
 
-        if (yield)
-                HYPERVISOR_sched_op(SCHEDOP_yield, 0);
+        printk("cpu %d spinlock event irq %d\n", cpu, irq);
+}
 
-        /* Wait for response */
-        while (atomic_read(&data.started) != cpus ||
-               (wait && atomic_read(&data.finished) != cpus))
-                cpu_relax();
+static void __init xen_init_spinlocks(void)
+{
+        pv_lock_ops.spin_is_locked = xen_spin_is_locked;
+        pv_lock_ops.spin_is_contended = xen_spin_is_contended;
+        pv_lock_ops.spin_lock = xen_spin_lock;
+        pv_lock_ops.spin_trylock = xen_spin_trylock;
+        pv_lock_ops.spin_unlock = xen_spin_unlock;
+}
 
-        spin_unlock(&call_lock);
+static const struct smp_ops xen_smp_ops __initdata = {
+        .smp_prepare_boot_cpu = xen_smp_prepare_boot_cpu,
+        .smp_prepare_cpus = xen_smp_prepare_cpus,
+        .cpu_up = xen_cpu_up,
+        .smp_cpus_done = xen_smp_cpus_done,
 
-        return 0;
+        .smp_send_stop = xen_smp_send_stop,
+        .smp_send_reschedule = xen_smp_send_reschedule,
+
+        .send_call_func_ipi = xen_smp_send_call_function_ipi,
+        .send_call_func_single_ipi = xen_smp_send_call_function_single_ipi,
+};
+
+void __init xen_smp_init(void)
+{
+        smp_ops = xen_smp_ops;
+        xen_fill_possible_map();
+        xen_init_spinlocks();
 }
diff --git a/arch/x86/xen/suspend.c b/arch/x86/xen/suspend.c
new file mode 100644
index 000000000000..2a234db5949b
--- /dev/null
+++ b/arch/x86/xen/suspend.c
@@ -0,0 +1,48 @@
+#include <linux/types.h>
+
+#include <xen/interface/xen.h>
+#include <xen/grant_table.h>
+#include <xen/events.h>
+
+#include <asm/xen/hypercall.h>
+#include <asm/xen/page.h>
+
+#include "xen-ops.h"
+#include "mmu.h"
+
+void xen_pre_suspend(void)
+{
+        xen_start_info->store_mfn = mfn_to_pfn(xen_start_info->store_mfn);
+        xen_start_info->console.domU.mfn =
+                mfn_to_pfn(xen_start_info->console.domU.mfn);
+
+        BUG_ON(!irqs_disabled());
+
+        HYPERVISOR_shared_info = &xen_dummy_shared_info;
+        if (HYPERVISOR_update_va_mapping(fix_to_virt(FIX_PARAVIRT_BOOTMAP),
+                                         __pte_ma(0), 0))
+                BUG();
+}
+
+void xen_post_suspend(int suspend_cancelled)
+{
+        xen_setup_shared_info();
+
+        if (suspend_cancelled) {
+                xen_start_info->store_mfn =
+                        pfn_to_mfn(xen_start_info->store_mfn);
+                xen_start_info->console.domU.mfn =
+                        pfn_to_mfn(xen_start_info->console.domU.mfn);
+        } else {
+#ifdef CONFIG_SMP
+                xen_cpu_initialized_map = cpu_online_map;
+#endif
+                xen_vcpu_restore();
+        }
+
+}
+
+void xen_arch_resume(void)
+{
+        /* nothing */
+}
diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
index 41e217503c96..685b77470fc3 100644
--- a/arch/x86/xen/time.c
+++ b/arch/x86/xen/time.c
@@ -197,8 +197,8 @@ unsigned long long xen_sched_clock(void)
 }
 
 
-/* Get the CPU speed from Xen */
-unsigned long xen_cpu_khz(void)
+/* Get the TSC speed from Xen */
+unsigned long xen_tsc_khz(void)
 {
         u64 xen_khz = 1000000ULL << 32;
         const struct pvclock_vcpu_time_info *info =
@@ -459,6 +459,19 @@ void xen_setup_cpu_clockevents(void)
         clockevents_register_device(&__get_cpu_var(xen_clock_events));
 }
 
+void xen_timer_resume(void)
+{
+        int cpu;
+
+        if (xen_clockevent != &xen_vcpuop_clockevent)
+                return;
+
+        for_each_online_cpu(cpu) {
+                if (HYPERVISOR_vcpu_op(VCPUOP_stop_periodic_timer, cpu, NULL))
+                        BUG();
+        }
+}
+
 __init void xen_time_init(void)
 {
         int cpu = smp_processor_id();
diff --git a/arch/x86/xen/xen-asm.S b/arch/x86/xen/xen-asm_32.S
index 2497a30f41de..2497a30f41de 100644
--- a/arch/x86/xen/xen-asm.S
+++ b/arch/x86/xen/xen-asm_32.S
diff --git a/arch/x86/xen/xen-asm_64.S b/arch/x86/xen/xen-asm_64.S
new file mode 100644
index 000000000000..7f58304fafb3
--- /dev/null
+++ b/arch/x86/xen/xen-asm_64.S
@@ -0,0 +1,271 @@
+/*
+        Asm versions of Xen pv-ops, suitable for either direct use or inlining.
+        The inline versions are the same as the direct-use versions, with the
+        pre- and post-amble chopped off.
+
+        This code is encoded for size rather than absolute efficiency,
+        with a view to being able to inline as much as possible.
+
+        We only bother with direct forms (ie, vcpu in pda) of the operations
+        here; the indirect forms are better handled in C, since they're
+        generally too large to inline anyway.
+ */
+
+#include <linux/linkage.h>
+
+#include <asm/asm-offsets.h>
+#include <asm/processor-flags.h>
+#include <asm/errno.h>
+#include <asm/segment.h>
+
+#include <xen/interface/xen.h>
+
+#define RELOC(x, v)     .globl x##_reloc; x##_reloc=v
+#define ENDPATCH(x)     .globl x##_end; x##_end=.
+
+/* Pseudo-flag used for virtual NMI, which we don't implement yet */
+#define XEN_EFLAGS_NMI  0x80000000
+
+#if 0
+#include <asm/percpu.h>
+
+/*
+        Enable events.  This clears the event mask and tests the pending
+        event status with one and operation.  If there are pending
+        events, then enter the hypervisor to get them handled.
+ */
+ENTRY(xen_irq_enable_direct)
+        /* Unmask events */
+        movb $0, PER_CPU_VAR(xen_vcpu_info, XEN_vcpu_info_mask)
+
+        /* Preempt here doesn't matter because that will deal with
+           any pending interrupts.  The pending check may end up being
+           run on the wrong CPU, but that doesn't hurt. */
+
+        /* Test for pending */
+        testb $0xff, PER_CPU_VAR(xen_vcpu_info, XEN_vcpu_info_pending)
+        jz 1f
+
+2:      call check_events
+1:
+ENDPATCH(xen_irq_enable_direct)
+        ret
+        ENDPROC(xen_irq_enable_direct)
+        RELOC(xen_irq_enable_direct, 2b+1)
+
+/*
+        Disabling events is simply a matter of making the event mask
+        non-zero.
+ */
+ENTRY(xen_irq_disable_direct)
+        movb $1, PER_CPU_VAR(xen_vcpu_info, XEN_vcpu_info_mask)
+ENDPATCH(xen_irq_disable_direct)
+        ret
+        ENDPROC(xen_irq_disable_direct)
+        RELOC(xen_irq_disable_direct, 0)
+
+/*
+        (xen_)save_fl is used to get the current interrupt enable status.
+        Callers expect the status to be in X86_EFLAGS_IF, and other bits
+        may be set in the return value.  We take advantage of this by
+        making sure that X86_EFLAGS_IF has the right value (and other bits
+        in that byte are 0), but other bits in the return value are
+        undefined.  We need to toggle the state of the bit, because
+        Xen and x86 use opposite senses (mask vs enable).
+ */
+ENTRY(xen_save_fl_direct)
+        testb $0xff, PER_CPU_VAR(xen_vcpu_info, XEN_vcpu_info_mask)
+        setz %ah
+        addb %ah,%ah
+ENDPATCH(xen_save_fl_direct)
+        ret
+        ENDPROC(xen_save_fl_direct)
+        RELOC(xen_save_fl_direct, 0)
+
+/*
+        In principle the caller should be passing us a value return
+        from xen_save_fl_direct, but for robustness sake we test only
+        the X86_EFLAGS_IF flag rather than the whole byte. After
+        setting the interrupt mask state, it checks for unmasked
+        pending events and enters the hypervisor to get them delivered
+        if so.
+ */
+ENTRY(xen_restore_fl_direct)
+        testb $X86_EFLAGS_IF>>8, %ah
+        setz PER_CPU_VAR(xen_vcpu_info, XEN_vcpu_info_mask)
+        /* Preempt here doesn't matter because that will deal with
+           any pending interrupts.  The pending check may end up being
+           run on the wrong CPU, but that doesn't hurt. */
+
+        /* check for unmasked and pending */
+        cmpw $0x0001, PER_CPU_VAR(xen_vcpu_info, XEN_vcpu_info_pending)
+        jz 1f
+2:      call check_events
+1:
+ENDPATCH(xen_restore_fl_direct)
+        ret
+        ENDPROC(xen_restore_fl_direct)
+        RELOC(xen_restore_fl_direct, 2b+1)
+
+
+/*
+        Force an event check by making a hypercall,
+        but preserve regs before making the call.
+ */
+check_events:
+        push %rax
+        push %rcx
+        push %rdx
+        push %rsi
+        push %rdi
+        push %r8
+        push %r9
+        push %r10
+        push %r11
+        call force_evtchn_callback
+        pop %r11
+        pop %r10
+        pop %r9
+        pop %r8
+        pop %rdi
+        pop %rsi
+        pop %rdx
+        pop %rcx
+        pop %rax
+        ret
+#endif
+
+ENTRY(xen_adjust_exception_frame)
+        mov 8+0(%rsp),%rcx
+        mov 8+8(%rsp),%r11
+        ret $16
+
+hypercall_iret = hypercall_page + __HYPERVISOR_iret * 32
+/*
+        Xen64 iret frame:
+
+        ss
+        rsp
+        rflags
+        cs
+        rip             <-- standard iret frame
+
+        flags
+
+        rcx             }
+        r11             }<-- pushed by hypercall page
+rsp ->  rax             }
+ */
+ENTRY(xen_iret)
+        pushq $0
+1:      jmp hypercall_iret
+ENDPATCH(xen_iret)
+RELOC(xen_iret, 1b+1)
+
+/*
+        sysexit is not used for 64-bit processes, so it's
+        only ever used to return to 32-bit compat userspace.
+ */
+ENTRY(xen_sysexit)
+        pushq $__USER32_DS
+        pushq %rcx
+        pushq $X86_EFLAGS_IF
+        pushq $__USER32_CS
+        pushq %rdx
+
+        pushq $0
+1:      jmp hypercall_iret
+ENDPATCH(xen_sysexit)
+RELOC(xen_sysexit, 1b+1)
+
+ENTRY(xen_sysret64)
+        /* We're already on the usermode stack at this point, but still
+           with the kernel gs, so we can easily switch back */
+        movq %rsp, %gs:pda_oldrsp
+        movq %gs:pda_kernelstack,%rsp
+
+        pushq $__USER_DS
+        pushq %gs:pda_oldrsp
+        pushq %r11
+        pushq $__USER_CS
+        pushq %rcx
+
+        pushq $VGCF_in_syscall
+1:      jmp hypercall_iret
+ENDPATCH(xen_sysret64)
+RELOC(xen_sysret64, 1b+1)
+
+ENTRY(xen_sysret32)
+        /* We're already on the usermode stack at this point, but still
+           with the kernel gs, so we can easily switch back */
+        movq %rsp, %gs:pda_oldrsp
+        movq %gs:pda_kernelstack, %rsp
+
+        pushq $__USER32_DS
+        pushq %gs:pda_oldrsp
+        pushq %r11
+        pushq $__USER32_CS
+        pushq %rcx
+
+        pushq $VGCF_in_syscall
+1:      jmp hypercall_iret
+ENDPATCH(xen_sysret32)
+RELOC(xen_sysret32, 1b+1)
+
+/*
+        Xen handles syscall callbacks much like ordinary exceptions,
+        which means we have:
+         - kernel gs
+         - kernel rsp
+         - an iret-like stack frame on the stack (including rcx and r11):
+                ss
+                rsp
+                rflags
+                cs
+                rip
+                r11
+        rsp->   rcx
+
+        In all the entrypoints, we undo all that to make it look
+        like a CPU-generated syscall/sysenter and jump to the normal
+        entrypoint.
+ */
+
+.macro undo_xen_syscall
+        mov 0*8(%rsp),%rcx
+        mov 1*8(%rsp),%r11
+        mov 5*8(%rsp),%rsp
+.endm
+
+/* Normal 64-bit system call target */
+ENTRY(xen_syscall_target)
+        undo_xen_syscall
+        jmp system_call_after_swapgs
+ENDPROC(xen_syscall_target)
+
+#ifdef CONFIG_IA32_EMULATION
+
+/* 32-bit compat syscall target */
+ENTRY(xen_syscall32_target)
+        undo_xen_syscall
+        jmp ia32_cstar_target
+ENDPROC(xen_syscall32_target)
+
+/* 32-bit compat sysenter target */
+ENTRY(xen_sysenter_target)
+        undo_xen_syscall
+        jmp ia32_sysenter_target
+ENDPROC(xen_sysenter_target)
+
+#else /* !CONFIG_IA32_EMULATION */
+
+ENTRY(xen_syscall32_target)
+ENTRY(xen_sysenter_target)
+        lea 16(%rsp), %rsp      /* strip %rcx,%r11 */
+        mov $-ENOSYS, %rax
+        pushq $VGCF_in_syscall
+        jmp hypercall_iret
+ENDPROC(xen_syscall32_target)
+ENDPROC(xen_sysenter_target)
+
+#endif  /* CONFIG_IA32_EMULATION */
diff --git a/arch/x86/xen/xen-head.S b/arch/x86/xen/xen-head.S
index 6ec3b4f7719b..63d49a523ed3 100644
--- a/arch/x86/xen/xen-head.S
+++ b/arch/x86/xen/xen-head.S
@@ -5,14 +5,24 @@
 
 #include <linux/elfnote.h>
 #include <linux/init.h>
+
 #include <asm/boot.h>
+#include <asm/asm.h>
+#include <asm/page.h>
+
 #include <xen/interface/elfnote.h>
+#include <asm/xen/interface.h>
 
         __INIT
 ENTRY(startup_xen)
-        movl %esi,xen_start_info
         cld
-        movl $(init_thread_union+THREAD_SIZE),%esp
+#ifdef CONFIG_X86_32
+        mov %esi,xen_start_info
+        mov $init_thread_union+THREAD_SIZE,%esp
+#else
+        mov %rsi,xen_start_info
+        mov $init_thread_union+THREAD_SIZE,%rsp
+#endif
         jmp xen_start_kernel
 
         __FINIT
@@ -20,17 +30,26 @@ ENTRY(startup_xen)
 .pushsection .text
         .align PAGE_SIZE_asm
 ENTRY(hypercall_page)
-        .skip 0x1000
+        .skip PAGE_SIZE_asm
 .popsection
 
         ELFNOTE(Xen, XEN_ELFNOTE_GUEST_OS,       .asciz "linux")
         ELFNOTE(Xen, XEN_ELFNOTE_GUEST_VERSION,  .asciz "2.6")
         ELFNOTE(Xen, XEN_ELFNOTE_XEN_VERSION,    .asciz "xen-3.0")
-        ELFNOTE(Xen, XEN_ELFNOTE_VIRT_BASE,      .long  __PAGE_OFFSET)
-        ELFNOTE(Xen, XEN_ELFNOTE_ENTRY,          .long  startup_xen)
-        ELFNOTE(Xen, XEN_ELFNOTE_HYPERCALL_PAGE, .long  hypercall_page)
+#ifdef CONFIG_X86_32
+        ELFNOTE(Xen, XEN_ELFNOTE_VIRT_BASE,      _ASM_PTR __PAGE_OFFSET)
+#else
+        ELFNOTE(Xen, XEN_ELFNOTE_VIRT_BASE,      _ASM_PTR __START_KERNEL_map)
+#endif
+        ELFNOTE(Xen, XEN_ELFNOTE_ENTRY,          _ASM_PTR startup_xen)
+        ELFNOTE(Xen, XEN_ELFNOTE_HYPERCALL_PAGE, _ASM_PTR hypercall_page)
         ELFNOTE(Xen, XEN_ELFNOTE_FEATURES,       .asciz "!writable_page_tables|pae_pgdir_above_4gb")
         ELFNOTE(Xen, XEN_ELFNOTE_PAE_MODE,       .asciz "yes")
         ELFNOTE(Xen, XEN_ELFNOTE_LOADER,         .asciz "generic")
+        ELFNOTE(Xen, XEN_ELFNOTE_L1_MFN_VALID,
+                .quad _PAGE_PRESENT; .quad _PAGE_PRESENT)
+        ELFNOTE(Xen, XEN_ELFNOTE_SUSPEND_CANCEL, .long 1)
+        ELFNOTE(Xen, XEN_ELFNOTE_HV_START_LOW,   _ASM_PTR __HYPERVISOR_VIRT_START)
+        ELFNOTE(Xen, XEN_ELFNOTE_PADDR_OFFSET,   _ASM_PTR 0)
 
 #endif /*CONFIG_XEN */
diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h
index f1063ae08037..dd3c23152a2e 100644
--- a/arch/x86/xen/xen-ops.h
+++ b/arch/x86/xen/xen-ops.h
@@ -9,22 +9,31 @@
 extern const char xen_hypervisor_callback[];
 extern const char xen_failsafe_callback[];
 
+struct trap_info;
 void xen_copy_trap_info(struct trap_info *traps);
 
 DECLARE_PER_CPU(unsigned long, xen_cr3);
 DECLARE_PER_CPU(unsigned long, xen_current_cr3);
 
 extern struct start_info *xen_start_info;
+extern struct shared_info xen_dummy_shared_info;
 extern struct shared_info *HYPERVISOR_shared_info;
 
+void xen_setup_mfn_list_list(void);
+void xen_setup_shared_info(void);
+
 char * __init xen_memory_setup(void);
 void __init xen_arch_setup(void);
 void __init xen_init_IRQ(void);
 void xen_enable_sysenter(void);
+void xen_enable_syscall(void);
+void xen_vcpu_restore(void);
+
+void __init xen_build_dynamic_phys_to_machine(void);
 
 void xen_setup_timer(int cpu);
 void xen_setup_cpu_clockevents(void);
-unsigned long xen_cpu_khz(void);
+unsigned long xen_tsc_khz(void);
 void __init xen_time_init(void);
 unsigned long xen_get_wallclock(void);
 int xen_set_wallclock(unsigned long time);
@@ -36,23 +45,15 @@ bool xen_vcpu_stolen(int vcpu);
 
 void xen_mark_init_mm_pinned(void);
 
-void __init xen_fill_possible_map(void);
-
 void __init xen_setup_vcpu_info_placement(void);
-void xen_smp_prepare_boot_cpu(void);
-void xen_smp_prepare_cpus(unsigned int max_cpus);
-int xen_cpu_up(unsigned int cpu);
-void xen_smp_cpus_done(unsigned int max_cpus);
 
-void xen_smp_send_stop(void);
-void xen_smp_send_reschedule(int cpu);
-int xen_smp_call_function (void (*func) (void *info), void *info, int nonatomic,
-                           int wait);
-int xen_smp_call_function_single(int cpu, void (*func) (void *info), void *info,
-                                 int nonatomic, int wait);
+#ifdef CONFIG_SMP
+void xen_smp_init(void);
 
-int xen_smp_call_function_mask(cpumask_t mask, void (*func)(void *),
-                               void *info, int wait);
+extern cpumask_t xen_cpu_initialized_map;
+#else
+static inline void xen_smp_init(void) {}
+#endif
 
 
 /* Declare an asm function, along with symbols needed to make it
@@ -67,7 +68,11 @@ DECL_ASM(void, xen_irq_disable_direct, void);
 DECL_ASM(unsigned long, xen_save_fl_direct, void);
 DECL_ASM(void, xen_restore_fl_direct, unsigned long);
 
+/* These are not functions, and cannot be called normally */
 void xen_iret(void);
 void xen_sysexit(void);
+void xen_sysret32(void);
+void xen_sysret64(void);
+void xen_adjust_exception_frame(void);
 
 #endif /* XEN_OPS_H */