Merged.

35 files changed, 430 insertions, 727 deletions

diff --git a/linux-2.6-xen-sparse/arch/ia64/xen-mkbuildtree-pre b/linux-2.6-xen-sparse/arch/ia64/xen-mkbuildtree-pre
index b92bbc921f..6e63488616 100755
--- a/linux-2.6-xen-sparse/arch/ia64/xen-mkbuildtree-pre
+++ b/linux-2.6-xen-sparse/arch/ia64/xen-mkbuildtree-pre
@@ -40,13 +40,6 @@ cp arch/ia64/xen/drivers/coreMakefile drivers/xen/core/Makefile
 cp arch/ia64/xen/drivers/xenia64_init.c drivers/xen/core
 cp arch/ia64/xen/drivers/evtchn_ia64.c drivers/xen/core
 
-#this is a one-line change to avoid a nasty kernel crash resulting
-#from a use of the FADT entry in the ACPI tree.  The fake ACPI
-#tree that Xen sets up for guests has a NULL FADT.  This is a bug
-#that needs to be fixed, at which point this can go away.  In the
-#meantime, this file needs to be updated if the real motherboard.c is
-cp arch/ia64/xen/drivers/motherboard.c drivers/acpi/motherboard.c
-
 #still a few x86-ism's in various drivers/xen files, patch them
 #cd drivers/xen
 #if [ ! -e ia64.patch.semaphore ]
diff --git a/linux-2.6-xen-sparse/arch/ia64/xen/drivers/coreMakefile b/linux-2.6-xen-sparse/arch/ia64/xen/drivers/coreMakefile
index b5ae0acb6b..40c4f13df8 100644
--- a/linux-2.6-xen-sparse/arch/ia64/xen/drivers/coreMakefile
+++ b/linux-2.6-xen-sparse/arch/ia64/xen/drivers/coreMakefile
@@ -10,7 +10,7 @@ $(obj)/vmlinux.lds.S:
 	@ln -fsn $(srctree)/arch/$(XENARCH)/kernel/vmlinux.lds.S $@
 
 
-obj-y   := gnttab.o devmem.o
+obj-y   := gnttab.o
 obj-$(CONFIG_PROC_FS) += xen_proc.o
 
 ifeq ($(ARCH),ia64)
diff --git a/linux-2.6-xen-sparse/arch/ia64/xen/drivers/motherboard.c b/linux-2.6-xen-sparse/arch/ia64/xen/drivers/motherboard.c
deleted file mode 100644
index 41526b5a83..0000000000
--- a/linux-2.6-xen-sparse/arch/ia64/xen/drivers/motherboard.c
+++ /dev/null
@@ -1,178 +0,0 @@
-/* 
- * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or (at
- *  your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful, but
- *  WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
- *
- * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- */
-
-/* Purpose: Prevent PCMCIA cards from using motherboard resources. */
-
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/types.h>
-#include <linux/pci.h>
-#include <linux/ioport.h>
-#include <asm/io.h>
-
-#include <acpi/acpi_bus.h>
-#include <acpi/acpi_drivers.h>
-
-#define _COMPONENT		ACPI_SYSTEM_COMPONENT
-ACPI_MODULE_NAME		("acpi_motherboard")
-
-/* Dell use PNP0C01 instead of PNP0C02 */
-#define ACPI_MB_HID1			"PNP0C01"
-#define ACPI_MB_HID2			"PNP0C02"
-
-/**
- * Doesn't care about legacy IO ports, only IO ports beyond 0x1000 are reserved
- * Doesn't care about the failure of 'request_region', since other may reserve 
- * the io ports as well
- */
-#define IS_RESERVED_ADDR(base, len) \
-	(((len) > 0) && ((base) > 0) && ((base) + (len) < IO_SPACE_LIMIT) \
-	&& ((base) + (len) > PCIBIOS_MIN_IO))
-
-/*
- * Clearing the flag (IORESOURCE_BUSY) allows drivers to use
- * the io ports if they really know they can use it, while
- * still preventing hotplug PCI devices from using it. 
- */
-
-static acpi_status
-acpi_reserve_io_ranges (struct acpi_resource *res, void *data)
-{
-	struct resource *requested_res = NULL;
-
-	ACPI_FUNCTION_TRACE("acpi_reserve_io_ranges");
-
-	if (res->id == ACPI_RSTYPE_IO) {
-		struct acpi_resource_io *io_res = &res->data.io;
-
-		if (io_res->min_base_address != io_res->max_base_address)
-			return_VALUE(AE_OK);
-		if (IS_RESERVED_ADDR(io_res->min_base_address, io_res->range_length)) {
-			ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Motherboard resources 0x%08x - 0x%08x\n",
-				io_res->min_base_address, 
-				io_res->min_base_address + io_res->range_length));
-			requested_res = request_region(io_res->min_base_address, 
-				io_res->range_length, "motherboard");
-		}
-	} else if (res->id == ACPI_RSTYPE_FIXED_IO) {
-		struct acpi_resource_fixed_io *fixed_io_res = &res->data.fixed_io;
-
-		if (IS_RESERVED_ADDR(fixed_io_res->base_address, fixed_io_res->range_length)) {
-			ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Motherboard resources 0x%08x - 0x%08x\n",
-				fixed_io_res->base_address, 
-				fixed_io_res->base_address + fixed_io_res->range_length));
-			requested_res = request_region(fixed_io_res->base_address, 
-				fixed_io_res->range_length, "motherboard");
-		}
-	} else {
-		/* Memory mapped IO? */
-	}
-
-	if (requested_res)
-		requested_res->flags &= ~IORESOURCE_BUSY;
-	return_VALUE(AE_OK);
-}
-
-static int acpi_motherboard_add (struct acpi_device *device)
-{
-	if (!device)
-		return -EINVAL;
-	acpi_walk_resources(device->handle, METHOD_NAME__CRS, 
-		acpi_reserve_io_ranges, NULL);
-
-	return 0;
-}
-
-static struct acpi_driver acpi_motherboard_driver1 = {
-	.name =		"motherboard",
-	.class =	"",
-	.ids =		ACPI_MB_HID1,
-	.ops =	{
-		.add =		acpi_motherboard_add,
-	},
-};
-
-static struct acpi_driver acpi_motherboard_driver2 = {
-	.name =		"motherboard",
-	.class =	"",
-	.ids =		ACPI_MB_HID2,
-	.ops =	{
-		.add =		acpi_motherboard_add,
-	},
-};
-
-static void __init
-acpi_reserve_resources (void)
-{
-	if (!acpi_gbl_FADT) return;
-	if (acpi_gbl_FADT->xpm1a_evt_blk.address && acpi_gbl_FADT->pm1_evt_len)
-		request_region(acpi_gbl_FADT->xpm1a_evt_blk.address, 
-			acpi_gbl_FADT->pm1_evt_len, "PM1a_EVT_BLK");
-
-	if (acpi_gbl_FADT->xpm1b_evt_blk.address && acpi_gbl_FADT->pm1_evt_len)
-		request_region(acpi_gbl_FADT->xpm1b_evt_blk.address,
-			acpi_gbl_FADT->pm1_evt_len, "PM1b_EVT_BLK");
-
-	if (acpi_gbl_FADT->xpm1a_cnt_blk.address && acpi_gbl_FADT->pm1_cnt_len)
-		request_region(acpi_gbl_FADT->xpm1a_cnt_blk.address, 
-			acpi_gbl_FADT->pm1_cnt_len, "PM1a_CNT_BLK");
-
-	if (acpi_gbl_FADT->xpm1b_cnt_blk.address && acpi_gbl_FADT->pm1_cnt_len)
-		request_region(acpi_gbl_FADT->xpm1b_cnt_blk.address, 
-			acpi_gbl_FADT->pm1_cnt_len, "PM1b_CNT_BLK");
-
-	if (acpi_gbl_FADT->xpm_tmr_blk.address && acpi_gbl_FADT->pm_tm_len == 4)
-		request_region(acpi_gbl_FADT->xpm_tmr_blk.address,
-			4, "PM_TMR");
-
-	if (acpi_gbl_FADT->xpm2_cnt_blk.address && acpi_gbl_FADT->pm2_cnt_len)
-		request_region(acpi_gbl_FADT->xpm2_cnt_blk.address,
-			acpi_gbl_FADT->pm2_cnt_len, "PM2_CNT_BLK");
-
-	/* Length of GPE blocks must be a non-negative multiple of 2 */
-
-	if (acpi_gbl_FADT->xgpe0_blk.address && acpi_gbl_FADT->gpe0_blk_len &&
-			!(acpi_gbl_FADT->gpe0_blk_len & 0x1))
-		request_region(acpi_gbl_FADT->xgpe0_blk.address,
-			acpi_gbl_FADT->gpe0_blk_len, "GPE0_BLK");
-
-	if (acpi_gbl_FADT->xgpe1_blk.address && acpi_gbl_FADT->gpe1_blk_len &&
-			!(acpi_gbl_FADT->gpe1_blk_len & 0x1))
-		request_region(acpi_gbl_FADT->xgpe1_blk.address,
-			acpi_gbl_FADT->gpe1_blk_len, "GPE1_BLK");
-}
-
-static int __init acpi_motherboard_init(void)
-{
-	acpi_bus_register_driver(&acpi_motherboard_driver1);
-	acpi_bus_register_driver(&acpi_motherboard_driver2);
-	/* 
-	 * Guarantee motherboard IO reservation first
-	 * This module must run after scan.c
-	 */
-	if (!acpi_disabled)
-		acpi_reserve_resources ();
-	return 0;
-}
-
-/**
- * Reserve motherboard resources after PCI claim BARs,
- * but before PCI assign resources for uninitialized PCI devices
- */
-fs_initcall(acpi_motherboard_init);
diff --git a/linux-2.6-xen-sparse/arch/xen/i386/kernel/time.c b/linux-2.6-xen-sparse/arch/xen/i386/kernel/time.c
index 915f7f033a..88034beac3 100644
--- a/linux-2.6-xen-sparse/arch/xen/i386/kernel/time.c
+++ b/linux-2.6-xen-sparse/arch/xen/i386/kernel/time.c
@@ -560,7 +560,8 @@ irqreturn_t timer_interrupt(int irq, void *dev_id, struct pt_regs *regs)
 	}
 	while (!time_values_up_to_date(cpu));
 
-	if (unlikely(delta < -1000000LL) || unlikely(delta_cpu < 0)) {
+	if ((unlikely(delta < -1000000LL) || unlikely(delta_cpu < 0))
+	    && printk_ratelimit()) {
 		printk("Timer ISR/%d: Time went backwards: "
 		       "delta=%lld cpu_delta=%lld shadow=%lld "
 		       "off=%lld processed=%lld cpu_processed=%lld\n",
diff --git a/linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c b/linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c
index 0e2c8105cc..f689dd0662 100644
--- a/linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c
+++ b/linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c
@@ -296,22 +296,23 @@ static int do_block_io_op(blkif_t *blkif, int max_to_do)
 {
 	blkif_back_ring_t *blk_ring = &blkif->blk_ring;
 	blkif_request_t *req;
-	RING_IDX i, rp;
+	RING_IDX rc, rp;
 	int more_to_do = 0;
 
+	rc = blk_ring->req_cons;
 	rp = blk_ring->sring->req_prod;
 	rmb(); /* Ensure we see queued requests up to 'rp'. */
 
-	for (i = blk_ring->req_cons; 
-	     (i != rp) && !RING_REQUEST_CONS_OVERFLOW(blk_ring, i);
-	     i++) {
+	while ((rc != rp) && !RING_REQUEST_CONS_OVERFLOW(blk_ring, rc)) {
 		if ((max_to_do-- == 0) ||
 		    (NR_PENDING_REQS == MAX_PENDING_REQS)) {
 			more_to_do = 1;
 			break;
 		}
-        
-		req = RING_GET_REQUEST(blk_ring, i);
+
+		req = RING_GET_REQUEST(blk_ring, rc);
+		blk_ring->req_cons = ++rc; /* before make_response() */
+
 		switch (req->operation) {
 		case BLKIF_OP_READ:
 		case BLKIF_OP_WRITE:
@@ -327,7 +328,6 @@ static int do_block_io_op(blkif_t *blkif, int max_to_do)
 		}
 	}
 
-	blk_ring->req_cons = i;
 	return more_to_do;
 }
 
diff --git a/xen/arch/ia64/Makefile b/xen/arch/ia64/Makefile
index 94ddb88a79..373b22f076 100644
--- a/xen/arch/ia64/Makefile
+++ b/xen/arch/ia64/Makefile
@@ -69,6 +69,8 @@ $(BASEDIR)/include/asm-ia64/.offsets.h.stamp:
 	[ -e $(BASEDIR)/include/asm-ia64/xen ] \
 	 || ln -s $(BASEDIR)/include/asm-ia64/linux $(BASEDIR)/include/asm-ia64/xen
 # Link to DM file in Xen for ia64/vti
+	[ -e $(BASEDIR)/include/asm-ia64/vmx_vpic.h ] \
+	 || ln -s ../../include/asm-x86/vmx_vpic.h $(BASEDIR)/include/asm-ia64/vmx_vpic.h
 	[ -e $(BASEDIR)/include/asm-ia64/vmx_vioapic.h ] \
 	 || ln -s ../../include/asm-x86/vmx_vioapic.h $(BASEDIR)/include/asm-ia64/vmx_vioapic.h
 	[ -e $(BASEDIR)/arch/ia64/vmx/vmx_vioapic.c ] \
diff --git a/xen/arch/ia64/linux-xen/smp.c b/xen/arch/ia64/linux-xen/smp.c
index 74f932137e..bc8efb0ce6 100644
--- a/xen/arch/ia64/linux-xen/smp.c
+++ b/xen/arch/ia64/linux-xen/smp.c
@@ -56,7 +56,10 @@
 //Huh? This seems to be used on ia64 even if !CONFIG_SMP
 void flush_tlb_mask(cpumask_t mask)
 {
+#ifdef CONFIG_SMP
+    printf("flush_tlb_mask called, not implemented for SMP\n");
 	dummy();
+#endif
 }
 //#if CONFIG_SMP || IA64
 #if CONFIG_SMP
diff --git a/xen/arch/ia64/linux-xen/unaligned.c b/xen/arch/ia64/linux-xen/unaligned.c
index 8b1cf71eec..e21437cd24 100644
--- a/xen/arch/ia64/linux-xen/unaligned.c
+++ b/xen/arch/ia64/linux-xen/unaligned.c
@@ -378,7 +378,7 @@ get_rse_reg (struct pt_regs *regs, unsigned long r1, unsigned long *val, unsigne
     if (ridx >= sof) {
         /* read of out-of-frame register returns an undefined value; 0 in our case.  */
         DPRINT("ignoring read from r%lu; only %lu registers are allocated!\n", r1, sof);
-        panic("wrong stack register number");
+        panic("wrong stack register number (iip=%p)\n", regs->cr_iip);
     }
 
     if (ridx < sor)
diff --git a/xen/arch/ia64/tools/xelilo/elilo-3.4.11.xen.patch b/xen/arch/ia64/tools/xelilo/elilo-3.4.11.xen.patch
deleted file mode 100755
index 725469b1f8..0000000000
--- a/xen/arch/ia64/tools/xelilo/elilo-3.4.11.xen.patch
+++ /dev/null
@@ -1,402 +0,0 @@
-<Sign-off: fred.yang@intel.com>
-diff -Naur base/bootparams.c elilo/bootparams.c
---- base/bootparams.c	2005-09-20 19:51:07.000000000 -0700
-+++ elilo/bootparams.c	2005-09-20 19:33:00.000000000 -0700
-@@ -38,7 +38,7 @@
-  * 	bp  : the address of the bootparams otherwise (opaque type)
-  */
- VOID *
--create_boot_params(CHAR16 *args, memdesc_t *initrd, UINTN *cookie)
-+create_boot_params(CHAR16 *args, memdesc_t *initrd, memdesc_t *vmcode, UINTN *cookie)
- {
- /* 
-  * XXX: need cleanup
-@@ -95,7 +95,7 @@
- 	 */
- 	Memset(bp, 0, BOOT_PARAM_MEMSIZE);
- 
--	if (sysdeps_create_boot_params(bp, cp, initrd, cookie) == -1) return 0;
-+	if (sysdeps_create_boot_params(bp, cp, initrd, vmcode, cookie) == -1) return 0;
- 
- 	/*
- 	 * Convert kernel command line args from UNICODE to ASCII and put them where
-diff -Naur base/choosers/simple.c elilo/choosers/simple.c
---- base/choosers/simple.c	2005-09-20 19:51:07.000000000 -0700
-+++ elilo/choosers/simple.c	2005-09-20 19:28:15.000000000 -0700
-@@ -37,6 +37,7 @@
- {
- 	CHAR16 *desc;
- 	CHAR16 initrd_name[CMDLINE_MAXLEN];
-+	CHAR16 vmcode_name[CMDLINE_MAXLEN];
- 	CHAR16 options_tmp[CMDLINE_MAXLEN];
- 	CHAR16 options[CMDLINE_MAXLEN];
- 	CHAR16 kname[FILENAME_MAXLEN];
-@@ -46,9 +47,9 @@
- 		Print(L"desc   : %s\n", desc);
- 	}
- 
--	initrd_name[0] = options_tmp[0] = kname[0] = CHAR_NULL;
-+	initrd_name[0] = vmcode_name[0] = options_tmp[0] = kname[0] = CHAR_NULL;
- 
--	if (find_label(name, kname, options_tmp, initrd_name) == -1) {
-+	if (find_label(name, kname, options_tmp, initrd_name, vmcode_name) == -1) {
- 		StrCpy(kname, name);
- 		Print(L"\n");
- 	}
-@@ -56,6 +57,7 @@
- 
- 	Print(L"cmdline: %s %s\n", kname, options);
- 	if (initrd_name[0]) Print(L"initrd : %s\n", initrd_name);
-+	if (vmcode_name[0]) Print(L"vmcode : %s\n", vmcode_name);
- }
- 
- static VOID
-@@ -247,6 +249,7 @@
- 	CHAR16 buffer[CMDLINE_MAXLEN];
- 	CHAR16 alt_buffer[CMDLINE_MAXLEN];
- 	CHAR16 initrd_name[CMDLINE_MAXLEN];
-+	CHAR16 vmcode_name[CMDLINE_MAXLEN];
- 	CHAR16 args[CMDLINE_MAXLEN];
- 	CHAR16 devname[CMDLINE_MAXLEN];
- 	CHAR16 dpath[FILENAME_MAXLEN];
-@@ -259,7 +262,7 @@
- 	display_message();
- 
- restart:
--	initrd_name[0] = kname[0] = cmdline[0] = args[0] = CHAR_NULL;
-+	initrd_name[0] = vmcode_name[0] = kname[0] = cmdline[0] = args[0] = CHAR_NULL;
- 
- 	/* reset per image loader options */
- 	Memset(&elilo_opt.img_opt, 0, sizeof(elilo_opt.img_opt));
-@@ -303,7 +306,7 @@
- 	 * if no match is found, the args and initrd arguments may
- 	 * still be modified by global options in the config file.
- 	 */
--	ret = find_label((index < argc) ? argv[index] : NULL, kname, args, initrd_name);
-+	ret = find_label((index < argc) ? argv[index] : NULL, kname, args, initrd_name, vmcode_name);
- 
- 	/*
- 	 * not found, so assume first argument is kernel name and
-@@ -335,6 +338,10 @@
- 		StrCpy(elilo_opt.initrd, initrd_name);
- 	}
- 
-+	if (elilo_opt.vmcode[0] == CHAR_NULL && vmcode_name[0] != CHAR_NULL) {
-+		StrCpy(elilo_opt.vmcode, vmcode_name);
-+	}
-+
- 	VERB_PRT(1,  { Print(L"kernel     is  '%s'\n", kname);
- 		       Print(L"arguments  are '%s'\n", args);
- 			if (elilo_opt.initrd[0]) Print(L"initrd      is '%s'\n", elilo_opt.initrd);
-diff -Naur base/choosers/textmenu.c elilo/choosers/textmenu.c
---- base/choosers/textmenu.c	2005-09-20 19:51:07.000000000 -0700
-+++ elilo/choosers/textmenu.c	2005-09-20 19:28:29.000000000 -0700
-@@ -358,6 +358,7 @@
- #	define BOOT_IMG_STR	L"BOOT_IMAGE="
- 	CHAR16 label[CMDLINE_MAXLEN];
- 	CHAR16 initrd_name[CMDLINE_MAXLEN];
-+	CHAR16 vmcode_name[CMDLINE_MAXLEN];
- 	CHAR16 args[CMDLINE_MAXLEN];
- 	CHAR16 devname[CMDLINE_MAXLEN];
- 	CHAR16 dpath[FILENAME_MAXLEN];
-@@ -412,9 +413,9 @@
- 	 * still be modified by global options in the config file.
- 	 */
- 	if (label[0])
--		ret = find_label(label, kname, args, initrd_name);
-+		ret = find_label(label, kname, args, initrd_name, vmcode_name);
- 	else
--		ret = find_label(argv[index], kname, args, initrd_name);
-+		ret = find_label(argv[index], kname, args, initrd_name, vmcode_name);
- 
- 	/*
- 	 * not found, so assume first argument is kernel name and
-@@ -448,6 +449,10 @@
- 		StrCpy(elilo_opt.initrd, initrd_name);
- 	}
- 
-+	if (elilo_opt.vmcode[0] == CHAR_NULL && vmcode_name[0] != CHAR_NULL) {
-+		StrCpy(elilo_opt.vmcode, vmcode_name);
-+	}
-+
- 	VERB_PRT(1,  { Print(L"kernel     is  '%s'\n", kname);
- 		       Print(L"arguments  are '%s'\n", args);
- 			if (elilo_opt.initrd[0]) Print(L"initrd      is '%s'\n", elilo_opt.initrd);
-diff -Naur base/config.c elilo/config.c
---- base/config.c	2005-09-20 19:51:07.000000000 -0700
-+++ elilo/config.c	2005-09-20 19:33:26.000000000 -0700
-@@ -68,6 +68,7 @@
- 	CHAR16	kname[FILENAME_MAXLEN];
- 	CHAR16  options[MAX_STRING];
- 	CHAR16	initrd[FILENAME_MAXLEN];
-+	CHAR16	vmcode[FILENAME_MAXLEN];
- 	CHAR16	root[FILENAME_MAXLEN];
- 	CHAR16	fallback[MAX_STRING];
- 	CHAR16	description[MAX_STRING];
-@@ -93,6 +94,7 @@
- typedef struct {
- 	CHAR16		root[FILENAME_MAXLEN];	/* globally defined root fs */
- 	CHAR16		initrd[FILENAME_MAXLEN];/* globally defined initrd  */
-+	CHAR16		vmcode[FILENAME_MAXLEN];/* globally defined boot-time module  */
- 	CHAR16		options[MAX_STRING];
- 	CHAR16		default_image_name[MAX_STRING];
- 	CHAR16		message_file[MAX_MESSAGES][FILENAME_MAXLEN]; 
-@@ -144,6 +146,7 @@
- {OPT_BOOL,	OPT_GLOBAL,	L"noedd30",	NULL,		NULL,			&global_config.edd30_no_force},
- {OPT_CMD,	OPT_GLOBAL,	L"append",	NULL,		NULL,			global_config.options},
- {OPT_FILE,	OPT_GLOBAL,	L"initrd",	NULL,		NULL,			global_config.initrd},
-+{OPT_FILE,	OPT_GLOBAL,	L"vmm",		NULL,		NULL,			global_config.vmcode},
- {OPT_FILE,	OPT_GLOBAL,	L"image",	do_image,	NULL,			opt_offsetof(kname)},
- {OPT_BOOL,	OPT_GLOBAL,	L"checkalt",	NULL,		NULL,			&global_config.alt_check},
- {OPT_STR,	OPT_GLOBAL,	L"chooser",	NULL,		check_chooser,		global_config.chooser},
-@@ -168,6 +171,7 @@
-     {OPT_CMD,	OPT_IMAGE,	L"append",	do_options,	NULL,	opt_offsetof(options)},
-     {OPT_CMD,	OPT_IMAGE,	L"literal",	do_literal,	NULL,	NULL},
-     {OPT_FILE,	OPT_IMAGE,	L"initrd",	NULL,		NULL,	opt_offsetof(initrd)},
-+    {OPT_FILE,	OPT_IMAGE,	L"vmm",		NULL,		NULL,	opt_offsetof(vmcode)},
-     {OPT_STR,	OPT_IMAGE,	L"label",	NULL,		NULL,	opt_offsetof(label)},
-     {OPT_FILE,	OPT_IMAGE,	L"image",	do_image,	NULL,	opt_offsetof(kname)},
-     {OPT_STR,	OPT_IMAGE,	L"description",	NULL,		NULL,	opt_offsetof(description)},
-@@ -974,7 +978,7 @@
- }
- 
- INTN
--find_label(CHAR16 *label, CHAR16 *kname, CHAR16 *options, CHAR16 *initrd)
-+find_label(CHAR16 *label, CHAR16 *kname, CHAR16 *options, CHAR16 *initrd, CHAR16 *vmcode)
- {
- 	boot_image_t *img;
- 
-@@ -1007,6 +1011,7 @@
- 	if (global_config.readonly) StrCat(options, L" ro");
- 
- 	if (global_config.initrd[0]) StrCpy(initrd, global_config.initrd);
-+	if (global_config.vmcode[0]) StrCpy(vmcode, global_config.vmcode);
- 
- 	/* make sure we don't get garbage here */
- 	elilo_opt.sys_img_opts = NULL;
-@@ -1044,12 +1049,17 @@
- 	else if (global_config.initrd[0])
- 		StrCpy(initrd, global_config.initrd);
- 
-+	if (img->vmcode[0]) 
-+		StrCpy(vmcode, img->vmcode);
-+	else if (global_config.vmcode[0])
-+		StrCpy(vmcode, global_config.vmcode);
-+
- 	/*
- 	 * point to architecture dependent options for this image
- 	 */
- 	elilo_opt.sys_img_opts = &img->sys_img_opts;
- 
--	DBG_PRT((L"label %s: kname=%s options=%s initrd=%s", img->label, kname, options, initrd));
-+	DBG_PRT((L"label %s: kname=%s options=%s initrd=%s vmcode=%s", img->label, kname, options, initrd, vmcode));
- 
- 	return 0;
- }
-diff -Naur base/elilo.c elilo/elilo.c
---- base/elilo.c	2005-09-20 19:51:07.000000000 -0700
-+++ elilo/elilo.c	2005-09-20 19:33:41.000000000 -0700
-@@ -84,10 +84,23 @@
- }
- 
- INTN
--kernel_load(EFI_HANDLE image, CHAR16 *kname, kdesc_t *kd, memdesc_t *imem)
-+kernel_load(EFI_HANDLE image, CHAR16 *kname, kdesc_t *kd, memdesc_t *imem, memdesc_t *mmem)
- {
- 
- 	/*
-+	 * Do the vm image switch here
-+	 * if there is "vmm=" then elilo should load image specified
-+	 *    in "vmm=" and then give the "image" to vmm as target kernel image
-+	 */
-+	if (elilo_opt.vmcode[0]) {
-+		CHAR16 buffer[CMDLINE_MAXLEN];
-+	VERB_PRT(1,Print(L"swapping vmm=%s with image=%s\n", elilo_opt.vmcode,
-+			kname));
-+		StrCpy(buffer, kname);
-+		StrCpy(kname, elilo_opt.vmcode);
-+		StrCpy(elilo_opt.vmcode, buffer);
-+	}
-+	/*
- 	 * Now let's try to load the kernel !
- 	 */
- 	switch(do_kernel_load(kname, kd)) {
-@@ -134,10 +147,32 @@
- 				return ELILO_LOAD_RETRY;
- 		}
- 	}
-+
-+	if (elilo_opt.vmcode[0]) {
-+
-+		mmem->start_addr = 0; /* let the allocator decide */
-+
-+		switch(load_initrd(elilo_opt.vmcode, mmem)) {
-+			case ELILO_LOAD_SUCCESS:
-+				break;
-+			case ELILO_LOAD_ERROR:
-+				goto exit_error;
-+			case ELILO_LOAD_ABORTED:
-+				free_kmem();
-+				/* we drop initrd in case we aborted the load */
-+				elilo_opt.vmcode[0] = CHAR_NULL;
-+				elilo_opt.prompt    = 1; 
-+				elilo_opt.timeout   = ELILO_DEFAULT_TIMEOUT;
-+				elilo_opt.delay     = 0;
-+
-+				return ELILO_LOAD_RETRY;
-+		}
-+	}
- 	return ELILO_LOAD_SUCCESS;
- exit_error:
- 	free_kmem();
- 	if (imem->start_addr) free(imem->start_addr);
-+	if (mmem->start_addr) free(mmem->start_addr);
- 
- 	return ELILO_LOAD_ERROR;
- }
-@@ -152,7 +187,7 @@
- 	UINTN cookie;
- 	EFI_STATUS status = EFI_SUCCESS;
- 	kdesc_t kd;
--	memdesc_t imem;
-+	memdesc_t imem, mmem;
- 	INTN r;
- 
- 	/*
-@@ -169,7 +204,7 @@
- 
- 		if (kernel_chooser(argv, argc, index, kname, cmdline_tmp) == -1) goto exit_error;
- 
--		switch (kernel_load(image, kname, &kd, &imem)) {
-+		switch (kernel_load(image, kname, &kd, &imem, &mmem)) {
- 			case ELILO_LOAD_SUCCESS: 
- 				goto do_launch;
- 			case ELILO_LOAD_ERROR:
-@@ -187,7 +222,7 @@
- 	close_devices();
- 
- 	/* No console output permitted after create_boot_params()! */
--	if ((bp=create_boot_params(cmdline, &imem, &cookie)) == 0) goto error;
-+	if ((bp=create_boot_params(cmdline, &imem, &mmem, &cookie)) == 0) goto error;
- 
- 	/* terminate bootservices */
- 	status = BS->ExitBootServices(image, cookie);
-@@ -221,6 +256,7 @@
- 	Print(L"-v        verbose level(can appear multiple times)\n");
- 	Print(L"-a        always check for alternate kernel image\n");
- 	Print(L"-i file   load file as the initial ramdisk\n");
-+	Print(L"-m file   load file as additional boot time vmm module\n");
- 	Print(L"-C file   indicate the config file to use\n");
- 	Print(L"-P        parse config file only (verify syntax)\n");
- 	Print(L"-D        enable debug prints\n");
-@@ -491,6 +527,13 @@
- 				}
- 				StrCpy(elilo_opt.initrd, Optarg);
- 				break;
-+			case 'm':
-+				if (StrLen(Optarg) >= FILENAME_MAXLEN-1) {
-+					Print(L"vmm module filename is limited to %d characters\n", FILENAME_MAXLEN);
-+					goto do_exit;
-+				}
-+				StrCpy(elilo_opt.vmcode, Optarg);
-+				break;
- 			case 'C':
- 				if (StrLen(Optarg) >= FILENAME_MAXLEN-1) {
- 					Print(L"config filename is limited to %d characters\n", FILENAME_MAXLEN);
-diff -Naur base/elilo.h elilo/elilo.h
---- base/elilo.h	2005-09-20 19:51:07.000000000 -0700
-+++ elilo/elilo.h	2005-09-20 19:32:19.000000000 -0700
-@@ -75,6 +75,7 @@
- 	UINTN delay;		/* delay before booting the image */
- 	UINTN verbose;		/* verbosity level [1-5] */
- 	CHAR16 initrd[FILENAME_MAXLEN];		/* name of file for initial ramdisk */
-+	CHAR16 vmcode[FILENAME_MAXLEN];	/* name of file for boot time module*/
- 	UINT8 delay_set;	/* mark whether or not delay was specified on cmdline */
- 	UINT8 edd30_on;		/* true is EDD30 variable is TRUE */
- 	UINT8 edd30_no_force;	/* don't force EDD30 variable to true */
-@@ -131,7 +132,7 @@
- #endif
- 
- #define VERB_PRT(n,cmd) \
--	{ if (elilo_opt.verbose >= (n)) { cmd; } }
-+  { if (elilo_opt.verbose >= (n)) { cmd; } }
- 
- 
- /* from alloc.c */
-@@ -163,7 +164,7 @@
- /* from config.c (more in config.h) */
- extern EFI_STATUS read_config(CHAR16 *, INTN retry);
- extern VOID print_config_options(VOID);
--extern INTN find_label(CHAR16 *, CHAR16 *, CHAR16 *, CHAR16 *);
-+extern INTN find_label(CHAR16 *, CHAR16 *, CHAR16 *, CHAR16 *, CHAR16 *);
- extern VOID print_label_list(VOID);
- extern INTN config_init(VOID);
- extern CHAR16 *get_message_filename(INTN which);
-@@ -178,7 +179,7 @@
- extern INTN alternate_kernel(CHAR16 *, INTN);
- 
- /* from bootparams.c */
--extern VOID *create_boot_params (CHAR16 *, memdesc_t *, UINTN *);
-+extern VOID *create_boot_params (CHAR16 *, memdesc_t *, memdesc_t *, UINTN *);
- extern VOID free_boot_params(VOID *bp);
- 
- /*
-@@ -186,7 +187,7 @@
-  */
- 
- 
--extern INTN sysdeps_create_boot_params(boot_params_t *, CHAR8 *, memdesc_t *, UINTN *);
-+extern INTN sysdeps_create_boot_params(boot_params_t *, CHAR8 *, memdesc_t *, memdesc_t *, UINTN *);
- extern VOID sysdeps_free_boot_params(boot_params_t *);
- extern INTN sysdeps_init(EFI_HANDLE dev);
- extern INTN sysdeps_initrd_get_addr(kdesc_t *, memdesc_t *);
-diff -Naur base/ia32/system.c elilo/ia32/system.c
---- base/ia32/system.c	2005-09-20 19:51:07.000000000 -0700
-+++ elilo/ia32/system.c	2005-09-20 19:30:10.000000000 -0700
-@@ -408,6 +408,7 @@
- 	boot_params_t *bp,
- 	CHAR8 *cmdline,
- 	memdesc_t *initrd,
-+	memdesc_t *vmcode, /* no use for ia32 now*/
- 	UINTN *cookie)
- {
- 	mmap_desc_t mdesc;
-diff -Naur base/ia64/sysdeps.h elilo/ia64/sysdeps.h
---- base/ia64/sysdeps.h	2005-09-20 19:51:07.000000000 -0700
-+++ elilo/ia64/sysdeps.h	2005-09-20 19:29:07.000000000 -0700
-@@ -65,8 +65,11 @@
- 	UINTN initrd_start;		/* virtual address where the initial ramdisk begins */
- 	UINTN initrd_size;		/* how big is the initial ramdisk */
- 
-+	UINTN vmcode_start;		/* virtual address where the boot time vmcode begins */
-+	UINTN vmcode_size;		/* how big is the boot module */
- 	UINTN loader_addr;		/* start address of boot loader */
- 	UINTN loader_size;		/* size of loader code & data */
-+
- } boot_params_t;
- 
- typedef struct sys_img_options {
-diff -Naur base/ia64/system.c elilo/ia64/system.c
---- base/ia64/system.c	2005-09-20 19:51:07.000000000 -0700
-+++ elilo/ia64/system.c	2005-09-20 19:29:28.000000000 -0700
-@@ -39,7 +39,7 @@
-  * IA-64 specific boot paramters initialization routine
-  */
- INTN
--sysdeps_create_boot_params(boot_params_t *bp, CHAR8 *cmdline, memdesc_t *initrd, UINTN *cookie)
-+sysdeps_create_boot_params(boot_params_t *bp, CHAR8 *cmdline, memdesc_t *initrd, memdesc_t *vmcode, UINTN *cookie)
- {
- 	UINTN cols, rows;
- 	SIMPLE_TEXT_OUTPUT_INTERFACE *conout;
-@@ -65,6 +65,11 @@
- 	bp->command_line	= (UINTN)cmdline;
- 	bp->initrd_start	= (UINTN) initrd->start_addr;
- 	bp->initrd_size		= initrd->size;
-+	DBG_PRT((L"Got initrd @ 0x%lx (%d bytes)", initrd->start_addr, initrd->size));
-+
-+	bp->vmcode_start	= (UINTN) vmcode->start_addr;
-+	bp->vmcode_size		= vmcode->size;
-+	DBG_PRT((L"Got vmcode @ 0x%lx (%d bytes)", vmcode->start_addr, vmcode->size));
- 
- 	/* fetch console parameters: */
- 	conout = systab->ConOut;
diff --git a/xen/arch/ia64/tools/xelilo/elilo.README b/xen/arch/ia64/tools/xelilo/elilo.README
index 64400e91ec..3347aac2bf 100755
--- a/xen/arch/ia64/tools/xelilo/elilo.README
+++ b/xen/arch/ia64/tools/xelilo/elilo.README
@@ -1,35 +1,20 @@
-Elilo update for Xen/ia64 HowTo   9/20/2005

+Elilo update for Xen/ia64 HowTo   2005/12/01

 

-1. Build the new elilo

-	a. Get the elilo RPM

-	http://fedora.mirrors.pair.com/linux/core/development/SRPMS/elilo-3.4-11.src.rpm

-

-	b. Get the elilo-3.4.11.xen.patch

+   Xen support is committed to ELILO CVS as of Dec 1, 2005.  This support

+   should be in version 3.5pre2 when it is made available.  To build from

+   source:

 

-	c. Create elilo development tree

-		> mkdir elilo

-		> cd elilo

-		> rpm2cpio ../elilo-3.4-11.src.rpm | cpio -div

-		> tar xvfz elilo-3.4.tar.gz

-		> cd elilo-3.4

-		> // read elilo.spc for deatiled patch steps

-		> patch -p1 < ../elilo-3.3a-makefile.patch

-		> patch -p1 < ../elilo-3.4-debug.patch

-		> patch -p2 < ../elilo-initrd-size-fix.patch

-		> patch -p1 < ../elilo-argv-fix.patch

-		> patch -p1 < ../elilo-kill-warnings.patch

-		> patch -p1 < ../../elilo-3.4.11.xen.patch

-		> make		<=== get the elilo.efi

+1. Build the new elilo

+	a. Get current elilo CVS from http://sourceforge.net/projects/elilo

+	b. make (Note that gnu-efi is a build dependency)

 

 2. How to run with the new elilo.efi?

 	a. Example to run

 		modify elilo.conf with following entry

 

-		image=XenoLinux.uncompressed

+		image=XenoLinux.gz

         		label=xen

         		vmm=xen.gz

         		initrd=initrd-2.6.9-5.7.EL.img

         		read-only

-        		append="com2=57600,8n1 console=com2 sched=bvt -- nomca console=ttyS1,576 00 console=tty0 root=/dev/sda3"

-

-

+        		append="com2=57600,8n1 console=com2 sched=bvt -- nomca console=ttyS1,57600 console=tty0 root=/dev/sda3"

diff --git a/xen/arch/ia64/tools/xelilo/xlilo.efi b/xen/arch/ia64/tools/xelilo/xlilo.efi
index da689f29f5..4c9714e088 100755
--- a/xen/arch/ia64/tools/xelilo/xlilo.efi
+++ b/xen/arch/ia64/tools/xelilo/xlilo.efi
diff --git a/xen/arch/ia64/vmx/vlsapic.c b/xen/arch/ia64/vmx/vlsapic.c
index 340bdd40c4..3b378d07b4 100644
--- a/xen/arch/ia64/vmx/vlsapic.c
+++ b/xen/arch/ia64/vmx/vlsapic.c
@@ -529,7 +529,7 @@ int vmx_check_pending_irq(VCPU *vcpu)
     int injected=0;
     uint64_t    isr;
     IA64_PSR    vpsr;
-
+    REGS *regs=vcpu_regs(vcpu);
     local_irq_save(spsr);
     h_pending = highest_pending_irq(vcpu);
     if ( h_pending == NULL_VECTOR ) goto chk_irq_exit;
@@ -541,7 +541,7 @@ int vmx_check_pending_irq(VCPU *vcpu)
         isr = vpsr.val & IA64_PSR_RI;
         if ( !vpsr.ic )
             panic("Interrupt when IC=0\n");
-        vmx_reflect_interruption(0,isr,0, 12 ); // EXT IRQ
+        vmx_reflect_interruption(0,isr,0, 12, regs ); // EXT IRQ
         injected = 1;
     }
     else if ( mask == IRQ_MASKED_BY_INSVC ) {
@@ -601,13 +601,13 @@ static void generate_exirq(VCPU *vcpu)
 {
     IA64_PSR    vpsr;
     uint64_t    isr;
-    
+    REGS *regs=vcpu_regs(vcpu);
     vpsr.val = vmx_vcpu_get_psr(vcpu);
     update_vhpi(vcpu, NULL_VECTOR);
     isr = vpsr.val & IA64_PSR_RI;
     if ( !vpsr.ic )
         panic("Interrupt when IC=0\n");
-    vmx_reflect_interruption(0,isr,0, 12 ); // EXT IRQ
+    vmx_reflect_interruption(0,isr,0, 12, regs); // EXT IRQ
 }
 
 vhpi_detection(VCPU *vcpu)
diff --git a/xen/arch/ia64/vmx/vmmu.c b/xen/arch/ia64/vmx/vmmu.c
index 07acfa3bd9..01be4636b7 100644
--- a/xen/arch/ia64/vmx/vmmu.c
+++ b/xen/arch/ia64/vmx/vmmu.c
@@ -162,7 +162,7 @@ static thash_cb_t *init_domain_vhpt(struct vcpu *d)
     vhpt->ht = THASH_VHPT;
     vhpt->vcpu = d;
     vhpt->hash_func = machine_thash;
-    vs -= sizeof (vhpt_special);
+    vcur -= sizeof (vhpt_special);
     vs = vcur;
 
     /* Setup guest pta */
@@ -438,20 +438,23 @@ fetch_code(VCPU *vcpu, u64 gip, u64 *code)
     thash_data_t    *tlb;
     ia64_rr vrr;
     u64     mfn;
-    
+
     if ( !(VCPU(vcpu, vpsr) & IA64_PSR_IT) ) {   // I-side physical mode
         gpip = gip;
     }
     else {
         vmx_vcpu_get_rr(vcpu, gip, &vrr.rrval);
-        tlb = vtlb_lookup_ex (vmx_vcpu_get_vtlb(vcpu), 
+        tlb = vtlb_lookup_ex (vmx_vcpu_get_vtlb(vcpu),
                 vrr.rid, gip, ISIDE_TLB );
-        if ( tlb == NULL ) panic("No entry found in ITLB\n");
+        if( tlb == NULL )
+             tlb = vtlb_lookup_ex (vmx_vcpu_get_vtlb(vcpu),
+                vrr.rid, gip, DSIDE_TLB );
+        if ( tlb == NULL ) panic("No entry found in ITLB and DTLB\n");
         gpip = (tlb->ppn << 12) | ( gip & (PSIZE(tlb->ps)-1) );
     }
     mfn = __gpfn_to_mfn(vcpu->domain, gpip >>PAGE_SHIFT);
     if ( mfn == INVALID_MFN ) return 0;
-    
+ 
     mpa = (gpip & (PAGE_SIZE-1)) | (mfn<<PAGE_SHIFT);
     *code = *(u64*)__va(mpa);
     return 1;
diff --git a/xen/arch/ia64/vmx/vmx_process.c b/xen/arch/ia64/vmx/vmx_process.c
index 170a24f6b5..fbc523c66e 100644
--- a/xen/arch/ia64/vmx/vmx_process.c
+++ b/xen/arch/ia64/vmx/vmx_process.c
@@ -47,13 +47,12 @@
 #include <asm/kregs.h>
 #include <asm/vmx.h>
 #include <asm/vmx_mm_def.h>
+#include <asm/vmx_phy_mode.h>
 #include <xen/mm.h>
 /* reset all PSR field to 0, except up,mfl,mfh,pk,dt,rt,mc,it */
 #define INITIAL_PSR_VALUE_AT_INTERRUPTION 0x0000001808028034
 
 
-extern struct ia64_sal_retval pal_emulator_static(UINT64);
-extern struct ia64_sal_retval sal_emulator(UINT64,UINT64,UINT64,UINT64,UINT64,UINT64,UINT64,UINT64);
 extern void rnat_consumption (VCPU *vcpu);
 #define DOMN_PAL_REQUEST    0x110000
 
@@ -109,14 +108,15 @@ vmx_ia64_handle_break (unsigned long ifa, struct pt_regs *regs, unsigned long is
 	}
 #endif
 	if (iim == d->arch.breakimm) {
-		struct ia64_sal_retval x;
+		struct ia64_pal_retval y;
+		struct sal_ret_values x;
 		switch (regs->r2) {
 		    case FW_HYPERCALL_PAL_CALL:
 			//printf("*** PAL hypercall: index=%d\n",regs->r28);
 			//FIXME: This should call a C routine
-			x = pal_emulator_static(VCPU(v, vgr[12]));
-			regs->r8 = x.status; regs->r9 = x.v0;
-			regs->r10 = x.v1; regs->r11 = x.v2;
+			y = pal_emulator_static(VCPU(v, vgr[12]));
+			regs->r8 = y.status; regs->r9 = y.v0;
+			regs->r10 = y.v1; regs->r11 = y.v2;
 #if 0
 			if (regs->r8)
 				printk("Failed vpal emulation, with index:0x%lx\n",
@@ -130,8 +130,8 @@ vmx_ia64_handle_break (unsigned long ifa, struct pt_regs *regs, unsigned long is
 					 sal_param[2], sal_param[3],
 					 sal_param[4], sal_param[5],
 					 sal_param[6], sal_param[7]);
-			regs->r8 = x.status; regs->r9 = x.v0;
-			regs->r10 = x.v1; regs->r11 = x.v2;
+			regs->r8 = x.r8; regs->r9 = x.r9;
+			regs->r10 = x.r10; regs->r11 = x.r11;
 #if 0
 			if (regs->r8)
 				printk("Failed vsal emulation, with index:0x%lx\n",
@@ -267,6 +267,12 @@ void leave_hypervisor_tail(struct pt_regs *regs)
 
 extern ia64_rr vmx_vcpu_rr(VCPU *vcpu,UINT64 vadr);
 
+static int vmx_handle_lds(REGS* regs)
+{
+    regs->cr_ipsr |=IA64_PSR_ED;
+    return IA64_FAULT;
+}
+
 /* We came here because the H/W VHPT walker failed to find an entry */
 void vmx_hpw_miss(u64 vadr , u64 vec, REGS* regs)
 {
@@ -294,18 +300,19 @@ void vmx_hpw_miss(u64 vadr , u64 vec, REGS* regs)
         return;
     }
 */
-
-    if((vec==1)&&(!vpsr.it)){
-        physical_itlb_miss(v, vadr);
-        return;
-    }
-    if((vec==2)&&(!vpsr.dt)){
-        if(v->domain!=dom0&&__gpfn_is_io(v->domain,(vadr<<1)>>(PAGE_SHIFT+1))){
-            emulate_io_inst(v,((vadr<<1)>>1),4);   //  UC
-        }else{
-            physical_dtlb_miss(v, vadr);
+    if(is_physical_mode(v)&&(!(vadr<<1>>62))){
+        if(vec==1){
+            physical_itlb_miss(v, vadr);
+            return;
+        }
+        if(vec==2){
+            if(v->domain!=dom0&&__gpfn_is_io(v->domain,(vadr<<1)>>(PAGE_SHIFT+1))){
+                emulate_io_inst(v,((vadr<<1)>>1),4);   //  UC
+            }else{
+                physical_dtlb_miss(v, vadr);
+            }
+            return;
         }
-        return;
     }
     vrr = vmx_vcpu_rr(v, vadr);
     if(vec == 1) type = ISIDE_TLB;
@@ -336,7 +343,8 @@ void vmx_hpw_miss(u64 vadr , u64 vec, REGS* regs)
             } else{
                 if(misr.sp){
                     //TODO  lds emulation
-                    panic("Don't support speculation load");
+                    //panic("Don't support speculation load");
+                    return vmx_handle_lds(regs);
                 }else{
                     nested_dtlb(v);
                     return IA64_FAULT;
@@ -353,8 +361,9 @@ void vmx_hpw_miss(u64 vadr , u64 vec, REGS* regs)
                     return IA64_FAULT;
                 }else{
                     if(misr.sp){
-                        //TODO  lds emulation
-                        panic("Don't support speculation load");
+                    //TODO  lds emulation
+                    //panic("Don't support speculation load");
+                    return vmx_handle_lds(regs);
                     }else{
                         nested_dtlb(v);
                         return IA64_FAULT;
@@ -367,8 +376,9 @@ void vmx_hpw_miss(u64 vadr , u64 vec, REGS* regs)
                     return IA64_FAULT;
                 }else{
                     if(misr.sp){
-                        //TODO  lds emulation
-                        panic("Don't support speculation load");
+                    //TODO  lds emulation
+                    //panic("Don't support speculation load");
+                    return vmx_handle_lds(regs);
                     }else{
                         nested_dtlb(v);
                         return IA64_FAULT;
diff --git a/xen/arch/ia64/vmx/vmx_virt.c b/xen/arch/ia64/vmx/vmx_virt.c
index b118ac03cd..74c1d59291 100644
--- a/xen/arch/ia64/vmx/vmx_virt.c
+++ b/xen/arch/ia64/vmx/vmx_virt.c
@@ -835,6 +835,7 @@ IA64FAULT vmx_emul_mov_to_rr(VCPU *vcpu, INST64 inst)
 
 IA64FAULT vmx_emul_mov_to_dbr(VCPU *vcpu, INST64 inst)
 {
+    return IA64_NO_FAULT;
     u64 r3,r2;
 #ifdef  CHECK_FAULT
     IA64_PSR vpsr;
@@ -858,6 +859,7 @@ IA64FAULT vmx_emul_mov_to_dbr(VCPU *vcpu, INST64 inst)
 
 IA64FAULT vmx_emul_mov_to_ibr(VCPU *vcpu, INST64 inst)
 {
+    return IA64_NO_FAULT;
     u64 r3,r2;
 #ifdef  CHECK_FAULT
     IA64_PSR vpsr;
@@ -1272,8 +1274,7 @@ IA64FAULT vmx_emul_mov_from_cr(VCPU *vcpu, INST64 inst)
         case 74:return vmx_cr_get(cmcv);
         case 80:return vmx_cr_get(lrr0);
         case 81:return vmx_cr_get(lrr1);
-        default:
-            panic("Read reserved cr register");
+        default: return IA64_NO_FAULT;
     }
 }
 
diff --git a/xen/arch/ia64/vmx/vtlb.c b/xen/arch/ia64/vmx/vtlb.c
index 2d726efe21..d6ae1a6220 100644
--- a/xen/arch/ia64/vmx/vtlb.c
+++ b/xen/arch/ia64/vmx/vtlb.c
@@ -391,6 +391,7 @@ void vtlb_insert(thash_cb_t *hcb, thash_data_t *entry, u64 va)
 #if 1
     vrr=vmx_vcpu_rr(current, va);
     if (vrr.ps != entry->ps) {
+        machine_tlb_insert(hcb->vcpu, entry);
 	printk("not preferred ps with va: 0x%lx\n", va);
 	return;
     }
diff --git a/xen/arch/ia64/xen/dom0_ops.c b/xen/arch/ia64/xen/dom0_ops.c
index 540e09caa4..c29a77f327 100644
--- a/xen/arch/ia64/xen/dom0_ops.c
+++ b/xen/arch/ia64/xen/dom0_ops.c
@@ -194,7 +194,29 @@ long arch_do_dom0_op(dom0_op_t *op, dom0_op_t *u_dom0_op)
         }
     }
     break;
+
+    case DOM0_PHYSINFO:
+    {
+        dom0_physinfo_t *pi = &op->u.physinfo;
+
+        pi->threads_per_core = smp_num_siblings;
+        pi->cores_per_socket = 1; // FIXME
+        pi->sockets_per_node = 
+            num_online_cpus() / (pi->threads_per_core * pi->cores_per_socket);
+        pi->nr_nodes         = 1;
+        pi->total_pages      = 99;  // FIXME
+        pi->free_pages       = avail_domheap_pages();
+        pi->cpu_khz          = 100;  // FIXME cpu_khz;
+        memset(pi->hw_cap, 0, sizeof(pi->hw_cap));
+        //memcpy(pi->hw_cap, boot_cpu_data.x86_capability, NCAPINTS*4);
+        ret = 0;
+        if ( copy_to_user(u_dom0_op, op, sizeof(*op)) )
+	    ret = -EFAULT;
+    }
+    break;
+
     default:
+printf("arch_do_dom0_op: unrecognized dom0 op: %d!!!\n",op->cmd);
         ret = -ENOSYS;
 
     }
diff --git a/xen/arch/ia64/xen/dom_fw.c b/xen/arch/ia64/xen/dom_fw.c
index d02bd11d84..9192ddb52a 100644
--- a/xen/arch/ia64/xen/dom_fw.c
+++ b/xen/arch/ia64/xen/dom_fw.c
@@ -13,11 +13,12 @@
 #include <asm/io.h>
 #include <asm/pal.h>
 #include <asm/sal.h>
+#include <xen/compile.h>
 #include <xen/acpi.h>
 
 #include <asm/dom_fw.h>
 
-struct ia64_boot_param *dom_fw_init(struct domain *, char *,int,char *,int);
+static struct ia64_boot_param *dom_fw_init(struct domain *, char *,int,char *,int);
 extern unsigned long domain_mpa_to_imva(struct domain *,unsigned long mpaddr);
 extern struct domain *dom0;
 extern unsigned long dom0_start;
@@ -55,15 +56,24 @@ void dom_efi_hypercall_patch(struct domain *d, unsigned long paddr, unsigned lon
 
 
 // builds a hypercall bundle at domain physical address
-void dom_fw_hypercall_patch(struct domain *d, unsigned long paddr, unsigned long hypercall,unsigned long ret)
+static void dom_fw_hypercall_patch(struct domain *d, unsigned long paddr, unsigned long hypercall,unsigned long ret)
 {
 	unsigned long imva;
 
-	if (d == dom0) paddr += dom0_start;
 	imva = domain_mpa_to_imva(d,paddr);
 	build_hypercall_bundle(imva,d->arch.breakimm,hypercall,ret);
 }
 
+static void dom_fw_pal_hypercall_patch(struct domain *d, unsigned long paddr)
+{
+	unsigned long *imva;
+
+	imva = (unsigned long *)domain_mpa_to_imva(d,paddr);
+
+	build_pal_hypercall_bundles (imva, d->arch.breakimm,
+				      FW_HYPERCALL_PAL_CALL);
+}
+
 
 // FIXME: This is really a hack: Forcing the boot parameter block
 // at domain mpaddr 0 page, then grabbing only the low bits of the
@@ -154,8 +164,6 @@ offtime (unsigned long t, efi_time_t *tp)
 	return 1;
 }
 
-extern struct ia64_pal_retval pal_emulator_static (unsigned long);
-
 /* Macro to emulate SAL call using legacy IN and OUT calls to CF8, CFC etc.. */
 
 #define BUILD_CMD(addr)		((0x80000000 | (addr)) & ~3)
@@ -292,11 +300,6 @@ xen_pal_emulator(unsigned long index, unsigned long in1,
 	long status = -1;
 
 	if (running_on_sim) return pal_emulator_static(index);
-	if (index >= PAL_COPY_PAL) {
-		// build_hypercall_bundle needs to be modified to generate
-		// a second bundle that conditionally does a br.ret
-		panic("xen_pal_emulator: stacked calls not supported!!\n");
-	}
 	printk("xen_pal_emulator: index=%d\n",index);
 	// pal code must be mapped by a TR when pal is called, however
 	// calls are rare enough that we will map it lazily rather than
@@ -389,9 +392,26 @@ xen_pal_emulator(unsigned long index, unsigned long in1,
 	    case PAL_VM_TR_READ:	/* FIXME: vcpu_get_tr?? */
 		printk("PAL_VM_TR_READ NOT IMPLEMENTED, IGNORED!\n");
 		break;
-	    case PAL_HALT_INFO:		/* inappropriate info for guest? */
-		printk("PAL_HALT_INFO NOT IMPLEMENTED, IGNORED!\n");
+	    case PAL_HALT_INFO:
+	        {
+		    /* 1000 cycles to enter/leave low power state,
+		       consumes 10 mW, implemented and cache/TLB coherent.  */
+		    unsigned long res = 1000UL | (1000UL << 16) | (10UL << 32)
+			    | (1UL << 61) | (1UL << 60);
+		    if (copy_to_user ((void *)in1, &res, sizeof (res)))
+			    status = PAL_STATUS_EINVAL;    
+		    else
+			    status = PAL_STATUS_SUCCESS;
+	        }
 		break;
+	    case PAL_HALT:
+		    if (current->domain == dom0) {
+			    printf ("Domain0 halts the machine\n");
+			    (*efi.reset_system)(EFI_RESET_SHUTDOWN,0,0,NULL);
+		    }
+		    else
+			    domain_shutdown (current->domain, 0);
+		    break;
 	    default:
 		printk("xen_pal_emulator: UNIMPLEMENTED PAL CALL %d!!!!\n",
 				index);
@@ -400,6 +420,7 @@ xen_pal_emulator(unsigned long index, unsigned long in1,
 	return ((struct ia64_pal_retval) {status, r9, r10, r11});
 }
 
+
 #define NFUNCPTRS 20
 
 void print_md(efi_memory_desc_t *md)
@@ -437,29 +458,29 @@ acpi_update_lsapic (acpi_table_entry_header *header)
 	return 0;
 }
 
+static u8
+generate_acpi_checksum(void *tbl, unsigned long len)
+{
+	u8 *ptr, sum = 0;
+
+	for (ptr = tbl; len > 0 ; len--, ptr++)
+		sum += *ptr;
+
+	return 0 - sum;
+}
+
 static int
 acpi_update_madt_checksum (unsigned long phys_addr, unsigned long size)
 {
-	u8 checksum=0;
-    	u8* ptr;
-	int len;
 	struct acpi_table_madt* acpi_madt;
 
 	if (!phys_addr || !size)
 		return -EINVAL;
 
 	acpi_madt = (struct acpi_table_madt *) __va(phys_addr);
-	acpi_madt->header.checksum=0;
-
-    	/* re-calculate MADT checksum */
-	ptr = (u8*)acpi_madt;
-    	len = acpi_madt->header.length;
-	while (len>0){
-		checksum = (u8)( checksum + (*ptr++) );
-		len--;
-	}
-    	acpi_madt->header.checksum = 0x0 - checksum;	
-	
+	acpi_madt->header.checksum = 0;
+	acpi_madt->header.checksum = generate_acpi_checksum(acpi_madt, size);
+
 	return 0;
 }
 
@@ -473,8 +494,140 @@ void touch_acpi_table(void)
 	return;
 }
 
+struct fake_acpi_tables {
+	struct acpi20_table_rsdp rsdp;
+	struct xsdt_descriptor_rev2 xsdt;
+	u64 madt_ptr;
+	struct fadt_descriptor_rev2 fadt;
+	struct facs_descriptor_rev2 facs;
+	struct acpi_table_header dsdt;
+	u8 aml[16];
+	struct acpi_table_madt madt;
+	struct acpi_table_lsapic lsapic;
+	u8 pm1a_evt_blk[4];
+	u8 pm1a_cnt_blk[1];
+	u8 pm_tmr_blk[4];
+};
+
+/* Create enough of an ACPI structure to make the guest OS ACPI happy. */
+void
+dom_fw_fake_acpi(struct fake_acpi_tables *tables)
+{
+	struct acpi20_table_rsdp *rsdp = &tables->rsdp;
+	struct xsdt_descriptor_rev2 *xsdt = &tables->xsdt;
+	struct fadt_descriptor_rev2 *fadt = &tables->fadt;
+	struct facs_descriptor_rev2 *facs = &tables->facs;
+	struct acpi_table_header *dsdt = &tables->dsdt;
+	struct acpi_table_madt *madt = &tables->madt;
+	struct acpi_table_lsapic *lsapic = &tables->lsapic;
+
+	memset(tables, 0, sizeof(struct fake_acpi_tables));
+
+	/* setup XSDT (64bit version of RSDT) */
+	strncpy(xsdt->signature, XSDT_SIG, 4);
+	/* XSDT points to both the FADT and the MADT, so add one entry */
+	xsdt->length = sizeof(struct xsdt_descriptor_rev2) + sizeof(u64);
+	xsdt->revision = 1;
+	strcpy(xsdt->oem_id, "XEN");
+	strcpy(xsdt->oem_table_id, "Xen/ia64");
+	strcpy(xsdt->asl_compiler_id, "XEN");
+	xsdt->asl_compiler_revision = (XEN_VERSION<<16)|(XEN_SUBVERSION);
+
+	xsdt->table_offset_entry[0] = dom_pa(fadt);
+	tables->madt_ptr = dom_pa(madt);
+
+	xsdt->checksum = generate_acpi_checksum(xsdt, xsdt->length);
+
+	/* setup FADT */
+	strncpy(fadt->signature, FADT_SIG, 4);
+	fadt->length = sizeof(struct fadt_descriptor_rev2);
+	fadt->revision = FADT2_REVISION_ID;
+	strcpy(fadt->oem_id, "XEN");
+	strcpy(fadt->oem_table_id, "Xen/ia64");
+	strcpy(fadt->asl_compiler_id, "XEN");
+	fadt->asl_compiler_revision = (XEN_VERSION<<16)|(XEN_SUBVERSION);
+
+	strncpy(facs->signature, FACS_SIG, 4);
+	facs->version = 1;
+	facs->length = sizeof(struct facs_descriptor_rev2);
+
+	fadt->xfirmware_ctrl = dom_pa(facs);
+	fadt->Xdsdt = dom_pa(dsdt);
+
+	/*
+	 * All of the below FADT entries are filled it to prevent warnings
+	 * from sanity checks in the ACPI CA.  Emulate required ACPI hardware
+	 * registers in system memory.
+	 */
+	fadt->pm1_evt_len = 4;
+	fadt->xpm1a_evt_blk.address_space_id = ACPI_ADR_SPACE_SYSTEM_MEMORY;
+	fadt->xpm1a_evt_blk.register_bit_width = 8;
+	fadt->xpm1a_evt_blk.address = dom_pa(&tables->pm1a_evt_blk);
+	fadt->pm1_cnt_len = 1;
+	fadt->xpm1a_cnt_blk.address_space_id = ACPI_ADR_SPACE_SYSTEM_MEMORY;
+	fadt->xpm1a_cnt_blk.register_bit_width = 8;
+	fadt->xpm1a_cnt_blk.address = dom_pa(&tables->pm1a_cnt_blk);
+	fadt->pm_tm_len = 4;
+	fadt->xpm_tmr_blk.address_space_id = ACPI_ADR_SPACE_SYSTEM_MEMORY;
+	fadt->xpm_tmr_blk.register_bit_width = 8;
+	fadt->xpm_tmr_blk.address = dom_pa(&tables->pm_tmr_blk);
+
+	fadt->checksum = generate_acpi_checksum(fadt, fadt->length);
+
+	/* setup RSDP */
+	strncpy(rsdp->signature, RSDP_SIG, 8);
+	strcpy(rsdp->oem_id, "XEN");
+	rsdp->revision = 2; /* ACPI 2.0 includes XSDT */
+	rsdp->length = sizeof(struct acpi20_table_rsdp);
+	rsdp->xsdt_address = dom_pa(xsdt);
+
+	rsdp->checksum = generate_acpi_checksum(rsdp,
+	                                        ACPI_RSDP_CHECKSUM_LENGTH);
+	rsdp->ext_checksum = generate_acpi_checksum(rsdp, rsdp->length);
+
+	/* setup DSDT with trivial namespace. */ 
+	strncpy(dsdt->signature, DSDT_SIG, 4);
+	dsdt->revision = 1;
+	dsdt->length = sizeof(struct acpi_table_header) + sizeof(tables->aml);
+	strcpy(dsdt->oem_id, "XEN");
+	strcpy(dsdt->oem_table_id, "Xen/ia64");
+	strcpy(dsdt->asl_compiler_id, "XEN");
+	dsdt->asl_compiler_revision = (XEN_VERSION<<16)|(XEN_SUBVERSION);
+
+	/* Trivial namespace, avoids ACPI CA complaints */
+	tables->aml[0] = 0x10; /* Scope */
+	tables->aml[1] = 0x12; /* length/offset to next object */
+	strncpy(&tables->aml[2], "_SB_", 4);
+
+	/* The processor object isn't absolutely necessary, revist for SMP */
+	tables->aml[6] = 0x5b; /* processor object */
+	tables->aml[7] = 0x83;
+	tables->aml[8] = 0x0b; /* next */
+	strncpy(&tables->aml[9], "CPU0", 4);
+
+	dsdt->checksum = generate_acpi_checksum(dsdt, dsdt->length);
+
+	/* setup MADT */
+	strncpy(madt->header.signature, APIC_SIG, 4);
+	madt->header.revision = 2;
+	madt->header.length = sizeof(struct acpi_table_madt) +
+	                      sizeof(struct acpi_table_lsapic);
+	strcpy(madt->header.oem_id, "XEN");
+	strcpy(madt->header.oem_table_id, "Xen/ia64");
+	strcpy(madt->header.asl_compiler_id, "XEN");
+	madt->header.asl_compiler_revision = (XEN_VERSION<<16)|(XEN_SUBVERSION);
+
+	/* A single LSAPIC entry describes the CPU.  Revisit for SMP guests */
+	lsapic->header.type = ACPI_MADT_LSAPIC;
+	lsapic->header.length = sizeof(struct acpi_table_lsapic);
+	lsapic->flags.enabled = 1;
+
+	madt->header.checksum = generate_acpi_checksum(madt,
+	                                               madt->header.length);
+	return;
+}
 
-struct ia64_boot_param *
+static struct ia64_boot_param *
 dom_fw_init (struct domain *d, char *args, int arglen, char *fw_mem, int fw_mem_size)
 {
 	efi_system_table_t *efi_systab;
@@ -482,7 +635,6 @@ dom_fw_init (struct domain *d, char *args, int arglen, char *fw_mem, int fw_mem_
 	efi_config_table_t *efi_tables;
 	struct ia64_sal_systab *sal_systab;
 	efi_memory_desc_t *efi_memmap, *md;
-	unsigned long *pal_desc, *sal_desc;
 	struct ia64_sal_desc_entry_point *sal_ed;
 	struct ia64_boot_param *bp;
 	unsigned long *pfn;
@@ -490,7 +642,7 @@ dom_fw_init (struct domain *d, char *args, int arglen, char *fw_mem, int fw_mem_
 	char *cp, *cmd_line, *fw_vendor;
 	int i = 0;
 	unsigned long maxmem = (d->max_pages - d->arch.sys_pgnr) * PAGE_SIZE;
-	unsigned long start_mpaddr = ((d==dom0)?dom0_start:0);
+	const unsigned long start_mpaddr = ((d==dom0)?dom0_start:0);
 
 #	define MAKE_MD(typ, attr, start, end, abs) 	\	
 	do {						\
@@ -513,13 +665,6 @@ dom_fw_init (struct domain *d, char *args, int arglen, char *fw_mem, int fw_mem_
 */
 	memset(fw_mem, 0, fw_mem_size);
 
-#ifdef USE_PAL_EMULATOR
-	pal_desc = (unsigned long *) &pal_emulator_static;
-#else
-	pal_desc = (unsigned long *) &xen_pal_emulator;
-#endif
-	sal_desc = (unsigned long *) &sal_emulator;
-
 	cp = fw_mem;
 	efi_systab  = (void *) cp; cp += sizeof(*efi_systab);
 	efi_runtime = (void *) cp; cp += sizeof(*efi_runtime);
@@ -562,7 +707,7 @@ dom_fw_init (struct domain *d, char *args, int arglen, char *fw_mem, int fw_mem_
 #define EFI_HYPERCALL_PATCH(tgt,call) do { \
     dom_efi_hypercall_patch(d,FW_HYPERCALL_##call##_PADDR,FW_HYPERCALL_##call); \
     tgt = dom_pa(pfn); \
-    *pfn++ = FW_HYPERCALL_##call##_PADDR + ((d==dom0)?dom0_start:0); \
+    *pfn++ = FW_HYPERCALL_##call##_PADDR + start_mpaddr; \
     *pfn++ = 0; \
     } while (0)
 
@@ -620,6 +765,22 @@ dom_fw_init (struct domain *d, char *args, int arglen, char *fw_mem, int fw_mem_
 			i++;
 		}
 		printf("\n");
+	} else {
+		i = 1;
+
+		if ((unsigned long)fw_mem + fw_mem_size - (unsigned long)cp >=
+		    sizeof(struct fake_acpi_tables)) {
+			struct fake_acpi_tables *acpi_tables;
+
+			acpi_tables = (void *)cp;
+			cp += sizeof(struct fake_acpi_tables);
+			dom_fw_fake_acpi(acpi_tables);
+
+			efi_tables[i].guid = ACPI_20_TABLE_GUID;
+			efi_tables[i].table = dom_pa(acpi_tables);
+			printf(" ACPI 2.0=%0xlx",efi_tables[i].table);
+			i++;
+		}
 	}
 
 	/* fill in the SAL system table: */
@@ -634,12 +795,10 @@ dom_fw_init (struct domain *d, char *args, int arglen, char *fw_mem, int fw_mem_
 
 	/* fill in an entry point: */
 	sal_ed->type = SAL_DESC_ENTRY_POINT;
-#define FW_HYPERCALL_PATCH(tgt,call,ret) do { \
-    dom_fw_hypercall_patch(d,FW_HYPERCALL_##call##_PADDR,FW_HYPERCALL_##call,ret); \
-    tgt = FW_HYPERCALL_##call##_PADDR + ((d==dom0)?dom0_start:0); \
-    } while (0)
-	FW_HYPERCALL_PATCH(sal_ed->pal_proc,PAL_CALL,0);
-	FW_HYPERCALL_PATCH(sal_ed->sal_proc,SAL_CALL,1);
+	sal_ed->pal_proc = FW_HYPERCALL_PAL_CALL_PADDR + start_mpaddr;
+	dom_fw_pal_hypercall_patch (d, sal_ed->pal_proc);
+	sal_ed->sal_proc = FW_HYPERCALL_SAL_CALL_PADDR + start_mpaddr;
+	dom_fw_hypercall_patch (d, sal_ed->sal_proc, FW_HYPERCALL_SAL_CALL, 1);
 	sal_ed->gp = 0;  // will be ignored
 
 	for (cp = (char *) sal_systab; cp < (char *) efi_memmap; ++cp)
diff --git a/xen/arch/ia64/xen/domain.c b/xen/arch/ia64/xen/domain.c
index 52c62d6f24..a4636eb20d 100644
--- a/xen/arch/ia64/xen/domain.c
+++ b/xen/arch/ia64/xen/domain.c
@@ -165,7 +165,7 @@ void free_vcpu_struct(struct vcpu *v)
 
 static void init_switch_stack(struct vcpu *v)
 {
-	struct pt_regs *regs = (struct pt_regs *) ((unsigned long) v + IA64_STK_OFFSET) - 1;
+	struct pt_regs *regs = vcpu_regs (v);
 	struct switch_stack *sw = (struct switch_stack *) regs - 1;
 	extern void ia64_ret_from_clone;
 
@@ -253,7 +253,7 @@ void arch_do_createdomain(struct vcpu *v)
 
 void arch_getdomaininfo_ctxt(struct vcpu *v, struct vcpu_guest_context *c)
 {
-	struct pt_regs *regs = (struct pt_regs *) ((unsigned long) v + IA64_STK_OFFSET) - 1;
+	struct pt_regs *regs = vcpu_regs (v);
 
 	printf("arch_getdomaininfo_ctxt\n");
 	c->regs = *regs;
@@ -264,7 +264,7 @@ void arch_getdomaininfo_ctxt(struct vcpu *v, struct vcpu_guest_context *c)
 
 int arch_set_info_guest(struct vcpu *v, struct vcpu_guest_context *c)
 {
-	struct pt_regs *regs = (struct pt_regs *) ((unsigned long) v + IA64_STK_OFFSET) - 1;
+	struct pt_regs *regs = vcpu_regs (v);
 	struct domain *d = v->domain;
 	int i, rc, ret;
 	unsigned long progress = 0;
@@ -335,7 +335,7 @@ void new_thread(struct vcpu *v,
 	if (d == dom0) start_pc += dom0_start;
 #endif
 
-	regs = (struct pt_regs *) ((unsigned long) v + IA64_STK_OFFSET) - 1;
+	regs = vcpu_regs (v);
 	if (VMX_DOMAIN(v)) {
 		/* dt/rt/it:1;i/ic:1, si:1, vm/bn:1, ac:1 */
 		regs->cr_ipsr = 0x501008826008; /* Need to be expanded as macro */
diff --git a/xen/arch/ia64/xen/hypercall.c b/xen/arch/ia64/xen/hypercall.c
index f195c2ba79..fd694e253f 100644
--- a/xen/arch/ia64/xen/hypercall.c
+++ b/xen/arch/ia64/xen/hypercall.c
@@ -18,8 +18,6 @@
 #include <public/sched.h>
 
 extern unsigned long translate_domain_mpaddr(unsigned long);
-extern struct ia64_pal_retval xen_pal_emulator(UINT64,UINT64,UINT64,UINT64);
-extern struct ia64_sal_retval sal_emulator(UINT64,UINT64,UINT64,UINT64,UINT64,UINT64,UINT64,UINT64);
 
 unsigned long idle_when_pending = 0;
 unsigned long pal_halt_light_count = 0;
@@ -28,8 +26,7 @@ int
 ia64_hypercall (struct pt_regs *regs)
 {
 	struct vcpu *v = (struct domain *) current;
-	struct ia64_sal_retval x;
-	struct ia64_pal_retval y;
+	struct sal_ret_values x;
 	unsigned long *tv, *tc;
 	int pi;
 
@@ -62,25 +59,33 @@ ia64_hypercall (struct pt_regs *regs)
 				pal_halt_light_count++;
 				do_sched_op(SCHEDOP_yield);
 			}
-			//break;
+			regs->r8 = 0;
+			regs->r9 = 0;
+			regs->r10 = 0;
+			regs->r11 = 0;
 		}
-		else if (regs->r28 >= PAL_COPY_PAL) {	/* FIXME */
-			printf("stacked PAL hypercalls not supported\n");
-			regs->r8 = -1;
-			break;
+		else {
+			struct ia64_pal_retval y;
+
+			if (regs->r28 >= PAL_COPY_PAL)
+				y = xen_pal_emulator
+					(regs->r28, vcpu_get_gr (v, 33),
+					 vcpu_get_gr (v, 34),
+					 vcpu_get_gr (v, 35));
+			else
+				y = xen_pal_emulator(regs->r28,regs->r29,
+						     regs->r30,regs->r31);
+			regs->r8 = y.status; regs->r9 = y.v0;
+			regs->r10 = y.v1; regs->r11 = y.v2;
 		}
-		else y = xen_pal_emulator(regs->r28,regs->r29,
-						regs->r30,regs->r31);
-		regs->r8 = y.status; regs->r9 = y.v0;
-		regs->r10 = y.v1; regs->r11 = y.v2;
 		break;
 	    case FW_HYPERCALL_SAL_CALL:
 		x = sal_emulator(vcpu_get_gr(v,32),vcpu_get_gr(v,33),
 			vcpu_get_gr(v,34),vcpu_get_gr(v,35),
 			vcpu_get_gr(v,36),vcpu_get_gr(v,37),
 			vcpu_get_gr(v,38),vcpu_get_gr(v,39));
-		regs->r8 = x.status; regs->r9 = x.v0;
-		regs->r10 = x.v1; regs->r11 = x.v2;
+		regs->r8 = x.r8; regs->r9 = x.r9;
+		regs->r10 = x.r10; regs->r11 = x.r11;
 		break;
 	    case FW_HYPERCALL_EFI_RESET_SYSTEM:
 		printf("efi.reset_system called ");
diff --git a/xen/arch/ia64/xen/privop.c b/xen/arch/ia64/xen/privop.c
index c7999d4928..80c632eee5 100644
--- a/xen/arch/ia64/xen/privop.c
+++ b/xen/arch/ia64/xen/privop.c
@@ -10,6 +10,7 @@
 #include <asm/vcpu.h>
 #include <asm/processor.h>
 #include <asm/delay.h>	// Debug only
+#include <asm/dom_fw.h>
 //#include <debug.h>
 
 long priv_verbose=0;
@@ -54,6 +55,39 @@ void build_hypercall_bundle(UINT64 *imva, UINT64 brkimm, UINT64 hypnum, UINT64 r
 	*imva++ = bundle.i64[0]; *imva = bundle.i64[1];
 }
 
+void build_pal_hypercall_bundles(UINT64 *imva, UINT64 brkimm, UINT64 hypnum)
+{
+	extern unsigned long pal_call_stub[];
+	IA64_BUNDLE bundle;
+	INST64_A5 slot_a5;
+	INST64_M37 slot_m37;
+
+	/* The source of the hypercall stub is the pal_call_stub function
+	   defined in xenasm.S.  */
+
+	/* Copy the first bundle and patch the hypercall number.  */
+	bundle.i64[0] = pal_call_stub[0];
+	bundle.i64[1] = pal_call_stub[1];
+	slot_a5.inst = bundle.slot0;
+	slot_a5.imm7b = hypnum;
+	slot_a5.imm9d = hypnum >> 7;
+	slot_a5.imm5c = hypnum >> 16;
+	bundle.slot0 = slot_a5.inst;
+	imva[0] = bundle.i64[0];
+	imva[1] = bundle.i64[1];
+	
+	/* Copy the second bundle and patch the hypercall vector.  */
+	bundle.i64[0] = pal_call_stub[2];
+	bundle.i64[1] = pal_call_stub[3];
+	slot_m37.inst = bundle.slot0;
+	slot_m37.imm20a = brkimm;
+	slot_m37.i = brkimm >> 20;
+	bundle.slot0 = slot_m37.inst;
+	imva[2] = bundle.i64[0];
+	imva[3] = bundle.i64[1];
+}
+
+
 /**************************************************************************
 Privileged operation emulation routines
 **************************************************************************/
diff --git a/xen/arch/ia64/xen/process.c b/xen/arch/ia64/xen/process.c
index a8d5c96c15..02c221527e 100644
--- a/xen/arch/ia64/xen/process.c
+++ b/xen/arch/ia64/xen/process.c
@@ -33,8 +33,6 @@
 #include <xen/multicall.h>
 
 extern unsigned long vcpu_get_itir_on_fault(struct vcpu *, UINT64);
-extern struct ia64_sal_retval pal_emulator_static(UINT64);
-extern struct ia64_sal_retval sal_emulator(UINT64,UINT64,UINT64,UINT64,UINT64,UINT64,UINT64,UINT64);
 
 extern unsigned long dom0_start, dom0_size;
 
diff --git a/xen/arch/ia64/xen/vcpu.c b/xen/arch/ia64/xen/vcpu.c
index 4aa50eea40..b73467d271 100644
--- a/xen/arch/ia64/xen/vcpu.c
+++ b/xen/arch/ia64/xen/vcpu.c
@@ -33,7 +33,6 @@ typedef	union {
 
 // this def for vcpu_regs won't work if kernel stack is present
 //#define	vcpu_regs(vcpu) ((struct pt_regs *) vcpu->arch.regs
-#define vcpu_regs(vcpu) (((struct pt_regs *) ((char *) (vcpu) + IA64_STK_OFFSET)) - 1)
 #define	PSCB(x,y)	VCPU(x,y)
 #define	PSCBX(x,y)	x->arch.y
 
diff --git a/xen/arch/ia64/xen/xenasm.S b/xen/arch/ia64/xen/xenasm.S
index 216aeefd7b..f1bc95e59c 100644
--- a/xen/arch/ia64/xen/xenasm.S
+++ b/xen/arch/ia64/xen/xenasm.S
@@ -516,3 +516,27 @@ GLOBAL_ENTRY(vhpt_insert)
 	br.ret.sptk.few rp
 	;;
 END(vhpt_insert)
+
+//  These instructions are copied in the domains.
+//  This is the virtual PAL, which simply does an hypercall.
+//  The size is 2 bunldes (32 Bytes).  It handles both static and stacked
+//    convention.
+//  If you modify this code, you have to modify dom_fw.h (for the size) and
+//   dom_fw_pal_hypercall_patch.
+GLOBAL_ENTRY(pal_call_stub)
+	{
+	 .mii
+	addl r2=0x1000,r0	//  Hypercall number (Value is patched).
+	mov r9=256
+	;; 
+	cmp.gtu p7,p8=r9,r28		/* r32 <= 255? */
+	}
+	{
+	 .mbb
+	break 0x1000	//  Hypercall vector (Value is patched).
+(p7)	br.cond.sptk.few rp
+(p8)	br.ret.sptk.few rp
+	}
+END(pal_call_stub)
+
+
diff --git a/xen/arch/ia64/xen/xenmisc.c b/xen/arch/ia64/xen/xenmisc.c
index aa8ca1124c..099eec5987 100644
--- a/xen/arch/ia64/xen/xenmisc.c
+++ b/xen/arch/ia64/xen/xenmisc.c
@@ -72,7 +72,7 @@ int grant_table_create(struct domain *d) { return 0; }
 void grant_table_destroy(struct domain *d) { return; }
 #endif
 
-struct pt_regs *guest_cpu_user_regs(void) { return ia64_task_regs(current); }
+struct pt_regs *guest_cpu_user_regs(void) { return vcpu_regs(current); }
 
 void raise_actimer_softirq(void)
 {
@@ -141,10 +141,12 @@ void init_percpu_info(void)
     //memset(percpu_info, 0, sizeof(percpu_info));
 }
 
+#if 0
 void free_page_type(struct pfn_info *page, unsigned int type)
 {
 	dummy();
 }
+#endif
 
 ///////////////////////////////
 //// misc memory stuff
diff --git a/xen/arch/ia64/xen/xensetup.c b/xen/arch/ia64/xen/xensetup.c
index 6e6da4c3ea..9dbec81732 100644
--- a/xen/arch/ia64/xen/xensetup.c
+++ b/xen/arch/ia64/xen/xensetup.c
@@ -289,6 +289,11 @@ printk("About to call init_xen_time()\n");
 printk("About to call ac_timer_init()\n");
     ac_timer_init();
 
+#ifdef CONFIG_XEN_CONSOLE_INPUT	/* CONFIG_SERIAL_8250_CONSOLE=n in dom0! */
+    initialize_keytable();
+    serial_init_postirq();
+#endif
+
 #ifdef CONFIG_SMP
     if ( opt_nosmp )
     {
@@ -407,7 +412,7 @@ printk("About to call init_trace_bufs()\n");
     init_trace_bufs();
 
     /* Give up the VGA console if DOM0 is configured to grab it. */
-#ifndef IA64
+#ifdef CONFIG_XEN_CONSOLE_INPUT	/* CONFIG_SERIAL_8250_CONSOLE=n in dom0! */
     console_endboot(cmdline && strstr(cmdline, "tty0"));
 #endif
 
diff --git a/xen/include/asm-ia64/dom_fw.h b/xen/include/asm-ia64/dom_fw.h
index 7603473079..fcf80d0f22 100644
--- a/xen/include/asm-ia64/dom_fw.h
+++ b/xen/include/asm-ia64/dom_fw.h
@@ -35,6 +35,7 @@ extern unsigned long dom_fw_setup(struct domain *, char *, int);
  * rp=b0 indicates the return point.
  *
  * A single hypercall is used for all PAL calls.
+ * The hypercall stub is pal_call_stub (xenasm.S).  Its size is 2 bundles.
  */
 
 #define FW_HYPERCALL_PAL_CALL_INDEX	0x80UL
@@ -53,7 +54,7 @@ extern unsigned long dom_fw_setup(struct domain *, char *, int);
  * A single hypercall is used for all SAL calls.
  */
 
-#define FW_HYPERCALL_SAL_CALL_INDEX	0x81UL
+#define FW_HYPERCALL_SAL_CALL_INDEX	0x82UL
 #define FW_HYPERCALL_SAL_CALL_PADDR	FW_HYPERCALL_PADDR(FW_HYPERCALL_SAL_CALL_INDEX)
 #define FW_HYPERCALL_SAL_CALL		0x1001UL
 
@@ -117,3 +118,12 @@ extern unsigned long dom_fw_setup(struct domain *, char *, int);
 #define FW_HYPERCALL_EFI_SET_VARIABLE_PADDR		FW_HYPERCALL_PADDR(FW_HYPERCALL_EFI_SET_VARIABLE_INDEX)
 #define FW_HYPERCALL_EFI_GET_NEXT_HIGH_MONO_COUNT_PADDR	FW_HYPERCALL_PADDR(FW_HYPERCALL_EFI_GET_NEXT_HIGH_MONO_COUNT_INDEX)
 #define FW_HYPERCALL_EFI_RESET_SYSTEM_PADDR		FW_HYPERCALL_PADDR(FW_HYPERCALL_EFI_RESET_SYSTEM_INDEX)
+
+extern struct ia64_pal_retval xen_pal_emulator(UINT64,UINT64,UINT64,UINT64);
+extern struct sal_ret_values sal_emulator (long index, unsigned long in1, unsigned long in2, unsigned long in3, unsigned long in4, unsigned long in5, unsigned long in6, unsigned long in7);
+extern struct ia64_pal_retval pal_emulator_static (unsigned long);
+
+extern void build_pal_hypercall_bundles(unsigned long *imva, unsigned long brkimm, unsigned long hypnum);
+extern void build_hypercall_bundle(UINT64 *imva, UINT64 brkimm, UINT64 hypnum, UINT64 ret);
+
+
diff --git a/xen/include/asm-ia64/linux/asm/cache.h b/xen/include/asm-ia64/linux-xen/asm/cache.h
index 666d8f175c..7d4cfd5682 100644
--- a/xen/include/asm-ia64/linux/asm/cache.h
+++ b/xen/include/asm-ia64/linux-xen/asm/cache.h
@@ -14,6 +14,10 @@
 
 #define L1_CACHE_SHIFT_MAX 7	/* largest L1 which this arch supports */
 
+#ifdef XEN
+# define SMP_CACHE_SHIFT	L1_CACHE_SHIFT
+# define SMP_CACHE_BYTES	L1_CACHE_BYTES
+#else
 #ifdef CONFIG_SMP
 # define SMP_CACHE_SHIFT	L1_CACHE_SHIFT
 # define SMP_CACHE_BYTES	L1_CACHE_BYTES
@@ -26,5 +30,6 @@
 # define SMP_CACHE_SHIFT	3
 # define SMP_CACHE_BYTES	(1 << 3)
 #endif
+#endif
 
 #endif /* _ASM_IA64_CACHE_H */
diff --git a/xen/include/asm-ia64/linux-xen/asm/ptrace.h b/xen/include/asm-ia64/linux-xen/asm/ptrace.h
index ef8bcaef79..a07b305961 100644
--- a/xen/include/asm-ia64/linux-xen/asm/ptrace.h
+++ b/xen/include/asm-ia64/linux-xen/asm/ptrace.h
@@ -98,6 +98,19 @@
 #ifdef XEN
 #include <public/arch-ia64.h>
 #define pt_regs cpu_user_regs
+
+/*  User regs at placed at the end of the vcpu area.
+    Convert a vcpu pointer to a regs pointer.
+    Note: this is the same as ia64_task_regs, but it uses a Xen-friendly name.
+*/
+struct vcpu;
+static inline struct cpu_user_regs *
+vcpu_regs (struct vcpu *v)
+{
+  return (struct cpu_user_regs *) ((unsigned long) v + IA64_STK_OFFSET) - 1;
+}
+
+
 #else
 struct pt_regs {
 	/* The following registers are saved by SAVE_MIN: */
diff --git a/xen/include/asm-ia64/privop.h b/xen/include/asm-ia64/privop.h
index b4d5f8f1c2..ace012263e 100644
--- a/xen/include/asm-ia64/privop.h
+++ b/xen/include/asm-ia64/privop.h
@@ -100,6 +100,11 @@ typedef union U_INST64_M36 {
     struct { unsigned long qp:6, r1:7, :14, x6:6, x3:3, :1, major:4; }; 
 } INST64_M36;
 
+typedef union U_INST64_M37 {
+    IA64_INST inst;
+    struct { unsigned long qp:6, imm20a:20,:1, x4:4,x2:2,x3:3, i:1, major:4; };
+} INST64_M37;
+
 typedef union U_INST64_M41 {
     IA64_INST inst;
     struct { unsigned long qp:6, :7, r2:7, :7, x6:6, x3:3, :1, major:4; }; 
@@ -190,6 +195,7 @@ typedef union U_INST64 {
     INST64_M33 M33;	// mov from cr
     INST64_M35 M35;	// mov to psr
     INST64_M36 M36;	// mov from psr
+    INST64_M37 M37;	// break.m
     INST64_M41 M41;	// translation cache insert
     INST64_M42 M42;	// mov to indirect reg/translation reg insert
     INST64_M43 M43;	// mov from indirect reg
diff --git a/xen/include/asm-ia64/vmx_vcpu.h b/xen/include/asm-ia64/vmx_vcpu.h
index 2ac3532e38..4f90175525 100644
--- a/xen/include/asm-ia64/vmx_vcpu.h
+++ b/xen/include/asm-ia64/vmx_vcpu.h
@@ -44,8 +44,6 @@
 #define VRN7    0x7UL
 // for vlsapic
 #define  VLSAPIC_INSVC(vcpu, i) ((vcpu)->arch.insvc[i])
-// this def for vcpu_regs won't work if kernel stack is present
-#define	vcpu_regs(vcpu) (((struct pt_regs *) ((char *) (vcpu) + IA64_STK_OFFSET)) - 1)
 //#define	VMX_VPD(x,y)	((x)->arch.arch_vmx.vpd->y)
 
 #define VMX(x,y)  ((x)->arch.arch_vmx.y)
diff --git a/xen/include/asm-ia64/xenpage.h b/xen/include/asm-ia64/xenpage.h
index d9f4e1c7e2..8ce32ab076 100644
--- a/xen/include/asm-ia64/xenpage.h
+++ b/xen/include/asm-ia64/xenpage.h
@@ -8,7 +8,7 @@
 #undef pfn_valid
 #undef page_to_pfn
 #undef pfn_to_page
-# define pfn_valid(_pfn)		((_pfn) > max_page)
+# define pfn_valid(_pfn)	((_pfn) < max_page)
 # define page_to_pfn(_page)	((unsigned long) ((_page) - frame_table))
 # define pfn_to_page(_pfn)	(frame_table + (_pfn))
 
diff --git a/xen/include/public/io/blkif.h b/xen/include/public/io/blkif.h
index 44780ced7e..bb92917bc3 100644
--- a/xen/include/public/io/blkif.h
+++ b/xen/include/public/io/blkif.h
@@ -10,6 +10,7 @@
 #define __XEN_PUBLIC_IO_BLKIF_H__
 
 #include "ring.h"
+#include "../grant_table.h"
 
 /*
  * Front->back notifications: When enqueuing a new request, sending a
diff --git a/xen/include/public/io/netif.h b/xen/include/public/io/netif.h
index 8bae672061..dcb9b46d0e 100644
--- a/xen/include/public/io/netif.h
+++ b/xen/include/public/io/netif.h
@@ -10,6 +10,7 @@
 #define __XEN_PUBLIC_IO_NETIF_H__
 
 #include "ring.h"
+#include "../grant_table.h"
 
 /*
  * Note that there is *never* any need to notify the backend when enqueuing
diff --git a/xen/include/public/io/tpmif.h b/xen/include/public/io/tpmif.h
index f84626be9e..7b4a863ea9 100644
--- a/xen/include/public/io/tpmif.h
+++ b/xen/include/public/io/tpmif.h
@@ -16,6 +16,8 @@
 #ifndef __XEN_PUBLIC_IO_TPMIF_H__
 #define __XEN_PUBLIC_IO_TPMIF_H__
 
+#include "../grant_table.h"
+
 typedef struct {
     unsigned long addr;   /* Machine address of packet.   */
     grant_ref_t ref;      /* grant table access reference */