Index: xen-unstable.hg/xen/arch/ia64/linux-xen/head.S
===================================================================
--- xen-unstable.hg.orig/xen/arch/ia64/linux-xen/head.S	2007-12-04 16:21:04.000000000 +0900
+++ xen-unstable.hg/xen/arch/ia64/linux-xen/head.S	2007-12-04 16:21:11.000000000 +0900
@@ -264,15 +264,21 @@ start_ap:
 	;;
 	srlz.i
 	;;
+	mov r20=r17
+	mov r21=r18
 	/* XEN HEAP is identity mapped */
 	mov r16 = IA64_TR_XEN_HEAP_REGS
-	dep r17 = -1, r2, 60, 4
+	//dep r17 = -1, r2, 60, 4
+	movl r17 = 0xf000000004000000
 	;;
 	mov cr.ifa = r17
 	;;
 	itr.d dtr[r16]=r18
 	;;
 	srlz.i
+	;;
+	mov r22=r17
+	mov r23=r18
 
 	/*
 	 * Switch into virtual mode:
@@ -290,6 +296,23 @@ start_ap:
 	;;
 1:	// now we are in virtual mode
 
+	movl r3=saved_20
+	;;
+	st8 [r3]=r20
+	;;
+	movl r3=saved_21
+	;;
+	st8 [r3]=r21
+	;;
+	movl r3=saved_22
+	;;
+	st8 [r3]=r22
+	;;
+	movl r3=saved_23
+	;;
+	st8 [r3]=r23
+	;;
+
 	SET_AREA_FOR_BOOTING_CPU(r2, r16);
 
 	STORE_REGION_REGS(r16, r8,r9,r10,r11,r12,r13,r14,r15);
Index: xen-unstable.hg/xen/arch/ia64/linux-xen/mca_asm.S
===================================================================
--- xen-unstable.hg.orig/xen/arch/ia64/linux-xen/mca_asm.S	2007-12-04 16:21:04.000000000 +0900
+++ xen-unstable.hg/xen/arch/ia64/linux-xen/mca_asm.S	2007-12-04 16:23:08.000000000 +0900
@@ -271,6 +271,7 @@ ia64_do_tlb_purge:
 	srlz.i 			// srlz.i implies srlz.d
 	;;
 
+#if 0
         // Now purge addresses formerly mapped by TR registers
 	// 1. Purge ITR&DTR for kernel.
 	movl r16=KERNEL_START
@@ -335,6 +336,15 @@ ia64_do_tlb_purge:
 	srlz.d
 	;;
 #endif
+	// 6. Xen Heap
+	movl r16=0xf000000004000000
+	mov r18=KERNEL_TR_PAGE_SHIFT<<2
+	;;
+	ptr.d r16,r18
+	;;
+	srlz.d
+	;;
+#endif
 #endif
 	// Now branch away to caller.
 	br.sptk.many b1
Index: xen-unstable.hg/xen/arch/ia64/xen/machine_kexec.c
===================================================================
--- xen-unstable.hg.orig/xen/arch/ia64/xen/machine_kexec.c	2007-12-04 16:21:04.000000000 +0900
+++ xen-unstable.hg/xen/arch/ia64/xen/machine_kexec.c	2007-12-04 16:21:11.000000000 +0900
@@ -33,7 +33,8 @@ typedef asmlinkage NORET_TYPE void (*rel
 					unsigned long cpu_data_pa,
 					unsigned long kernel_start,
 					unsigned long page_offset,
-					unsigned long vhpt)
+					unsigned long vhpt,
+					unsigned long xen_heap)
 					ATTRIB_NORET;
 
 #define kexec_flush_icache_page(page)					\
@@ -87,9 +88,24 @@ static void ia64_machine_kexec(struct un
 	vhpt = __va_ul(vcpu_vhpt_maddr(current));
 	BUG_ON(!vhpt);
 	rnk = (relocate_new_kernel_t)&code_addr;
+	{
+		char * blah;
+		blah = alloc_xenheap_pages(1);
+		printk("xen_pstart=0x%016lx KERNEL_START=0x%016lx "
+		       "xenheap_size0x%016lx\n", xen_pstart, KERNEL_START,
+		       xenheap_size);
+		printk("&blah=%p %p\n", &blah, __pa(&blah));
+	}
+	printk("image->indirection_page=0x%016lx\n", image->indirection_page);
+	printk("image->start_address=0x%016lx\n", image->start_address);
+	printk("pal_vaddr=0x%016lx\n", pal_vaddr);
+	printk("cpu_data_pa=0x%016lx\n", cpu_data_pa);
+	printk("KERNEL_START=0x%016lx\n", KERNEL_START);
+	printk("PAGE_OFFSET=0x%016lx\n", PAGE_OFFSET);
+	printk("vhpt=0x%016lx\n", vhpt);
 	(*rnk)(image->indirection_page, image->start_address, ia64_boot_param,
 	       GRANULEROUNDDOWN((unsigned long) pal_vaddr), cpu_data_pa,
-	       KERNEL_START, PAGE_OFFSET, vhpt);
+	       KERNEL_START, PAGE_OFFSET, vhpt, 0xf000000004000000);
 	BUG();
 }
 
Index: xen-unstable.hg/xen/arch/ia64/xen/xensetup.c
===================================================================
--- xen-unstable.hg.orig/xen/arch/ia64/xen/xensetup.c	2007-12-04 16:21:04.000000000 +0900
+++ xen-unstable.hg/xen/arch/ia64/xen/xensetup.c	2007-12-04 16:21:11.000000000 +0900
@@ -266,6 +266,11 @@ is_platform_hp_ski(void)
     return 1;
 }
 
+unsigned long saved_20;
+unsigned long saved_21;
+unsigned long saved_22;
+unsigned long saved_23;
+
 void __init start_kernel(void)
 {
     char *cmdline;
@@ -327,6 +332,8 @@ void __init start_kernel(void)
         ia64_boot_param->initrd_size = 0;
     }
 
+    printk("saved_20=0x%016lx saved_21=0x%016lx\n", saved_20, saved_21);
+    printk("saved_22=0x%016lx saved_23=0x%016lx\n", saved_22, saved_23);
     printk("Xen command line: %s\n", saved_command_line);
     /* xenheap should be in same TR-covered range with xen image */
     xenheap_phys_end = xen_pstart + xenheap_size;
Index: xen-unstable.hg/xen/arch/ia64/vmx/vmx_entry.S
===================================================================
--- xen-unstable.hg.orig/xen/arch/ia64/vmx/vmx_entry.S	2007-12-04 16:21:04.000000000 +0900
+++ xen-unstable.hg/xen/arch/ia64/vmx/vmx_entry.S	2007-12-04 16:21:45.000000000 +0900
@@ -669,6 +669,8 @@ GLOBAL_ENTRY(vmx_switch_rr7)
     ptr.i   r17,r18
     ptr.d   r17,r18
     ;;
+    srlz.i
+    ;;
     mov cr.itir=r18
     mov cr.ifa=r17
     mov r16=IA64_TR_KERNEL
@@ -685,16 +687,23 @@ GLOBAL_ENTRY(vmx_switch_rr7)
    ;;
    itr.d dtr[r16]=r24
    ;;
+   srlz.i
+   ;;
    /* xen heap is also identity mapped */
    mov r16 = IA64_TR_XEN_HEAP_REGS
-   dep r17=-1,r3,60,4
+   //dep r17=-1,r3,60,4
+   movl r17 = 0xf000000004000000
    ;;
    ptr.d r17, r18
    ;;
+   srlz.i
+   ;;
    mov cr.ifa=r17
    ;;
    itr.d dtr[r16]=r24
    ;;
+   srlz.i
+   ;;
 
    // re-pin mappings for per-cpu data
 
@@ -706,11 +715,15 @@ GLOBAL_ENTRY(vmx_switch_rr7)
    ;;
    ptr.d   r22,r23
    ;;
+   srlz.i
+   ;;
    mov cr.itir=r23
    mov cr.ifa=r22
    ;;
    itr.d dtr[r24]=loc2     // wire in new mapping...
    ;;
+   srlz.i
+   ;;
 
    // re-pin mappings for guest_vhpt
 
@@ -722,11 +735,15 @@ GLOBAL_ENTRY(vmx_switch_rr7)
    ;;
    ptr.d   in1,r23
    ;;
+   srlz.i
+   ;;
    mov cr.itir=r23
    mov cr.ifa=in1
    ;;
    itr.d dtr[r24]=loc5     // wire in new mapping...
    ;;
+   srlz.i
+   ;;
 
    // re-pin mappings for PAL code section
 
@@ -736,11 +753,15 @@ GLOBAL_ENTRY(vmx_switch_rr7)
    ;;
    ptr.i   in2,r23
    ;;
+   srlz.i
+   ;;
    mov cr.itir=r23
    mov cr.ifa=in2
    ;;
    itr.i itr[r24]=loc6     // wire in new mapping...
    ;;
+   srlz.i
+   ;;
 
    // done, switch back to virtual and return
    mov r16=loc4            // r16= original psr
Index: xen-unstable.hg/xen/arch/ia64/xen/xenasm.S
===================================================================
--- xen-unstable.hg.orig/xen/arch/ia64/xen/xenasm.S	2007-12-04 16:21:04.000000000 +0900
+++ xen-unstable.hg/xen/arch/ia64/xen/xenasm.S	2007-12-04 16:21:11.000000000 +0900
@@ -84,6 +84,9 @@ GLOBAL_ENTRY(ia64_new_rr7)
 	;;
 	ptr.i	r17,r24
 	ptr.d	r17,r24
+	;;
+	srlz.i
+	;;
 	mov r16=IA64_TR_KERNEL
 	mov cr.itir=r24
 	mov cr.ifa=r17
@@ -93,16 +96,23 @@ GLOBAL_ENTRY(ia64_new_rr7)
 	;; 
 	itr.d dtr[r16]=r18
 	;;
+	srlz.i
+	;;
 	/* xen heap is also identity mapped */
 	mov r16 = IA64_TR_XEN_HEAP_REGS  
-	dep r17=-1,loc6,58,1
+	//dep r17=-1,loc6,60,4
+	movl r17 = 0xf000000004000000
 	;;
 	ptr.d r17,r24
 	;;
+	srlz.i
+	;;
 	mov cr.ifa=r17
 	;;
 	itr.d dtr[r16]=r18
 	;;
+	srlz.i
+	;;
 	// re-pin mappings for stack (current)
 
 	// unless overlaps with KERNEL_TR
@@ -114,12 +124,18 @@ GLOBAL_ENTRY(ia64_new_rr7)
 	dep r21=0,r13,60,4		// physical address of "current"
 	;;
 	ptr.d	r13,r25
+	;;
+	srlz.i
+	;;
 	or r23=r21,r26			// construct PA | page properties
 	mov cr.itir=r25
 	mov cr.ifa=r13			// VA of next task...
 	mov r21=IA64_TR_CURRENT_STACK
 	;;
 	itr.d dtr[r21]=r23		// wire in new mapping...
+	;;
+	srlz.i
+	;;
 
 	//  Per-cpu	
 .stack_overlaps:
@@ -127,12 +143,18 @@ GLOBAL_ENTRY(ia64_new_rr7)
 	movl r22=PERCPU_ADDR
 	;;
 	ptr.d	r22,r24
+	;;
+	srlz.i
+	;;
 	or r23=loc2,r26			// construct PA | page properties
 	mov cr.itir=r24
 	mov cr.ifa=r22
 	mov r25=IA64_TR_PERCPU_DATA
 	;;
 	itr.d dtr[r25]=r23		// wire in new mapping...
+	;;
+	srlz.i
+	;;
 
 	// VHPT
 #if VHPT_ENABLED
@@ -154,12 +176,18 @@ GLOBAL_ENTRY(ia64_new_rr7)
 	mov r24=IA64_GRANULE_SHIFT<<2
 	;;
 	ptr.d	r15,r24
+	;;
+	srlz.i
+	;;
 	or r23=r22,r26			// construct PA | page properties
 	mov cr.itir=r24
 	mov cr.ifa=r15
 	srlz.d
 	;;
 	itr.d dtr[r21]=r23		// wire in new mapping...
+	;;
+	srlz.i
+	;;
 .vhpt_overlaps:	
 #endif
 
@@ -168,12 +196,18 @@ GLOBAL_ENTRY(ia64_new_rr7)
 	movl r25=__pgprot(__DIRTY_BITS | _PAGE_PL_PRIV | _PAGE_AR_RW)
 	;;
 	ptr.d	in3,r24
+	;;
+	srlz.i
+	;;
 	or r23=in1,r25			// construct PA | page properties
 	mov cr.itir=r24
 	mov cr.ifa=in3
 	mov r21=IA64_TR_SHARED_INFO
 	;;
 	itr.d dtr[r21]=r23		// wire in new mapping...
+	;;
+	srlz.i
+	;;
 	
 	// Map mapped_regs
 	mov r22=XMAPPEDREGS_OFS
@@ -182,12 +216,18 @@ GLOBAL_ENTRY(ia64_new_rr7)
 	add r22=r22,in3
 	;;
 	ptr.d	r22,r24
+	;;
+	srlz.i
+	;;
 	or r23=loc7,r25			// construct PA | page properties
 	mov cr.itir=r24
 	mov cr.ifa=r22
 	mov r21=IA64_TR_MAPPED_REGS
 	;;
 	itr.d dtr[r21]=r23		// wire in new mapping...
+	;;
+	srlz.i
+	;;
 
 	// Purge/insert PAL TR
 	mov r24=IA64_TR_PALCODE
@@ -195,6 +235,9 @@ GLOBAL_ENTRY(ia64_new_rr7)
 	dep r25=0,loc5,60,4		// convert pal vaddr to paddr
 	;;
 	ptr.i	loc5,r23
+	;;
+	srlz.i
+	;;
 	or r25=r25,r26			// construct PA | page properties
 	mov cr.itir=r23
 	mov cr.ifa=loc5