diff -r c886f74b54a4 linux-2.6-xen-sparse/include/asm-xen/gnttab.h
--- a/linux-2.6-xen-sparse/include/asm-xen/gnttab.h	Wed Jan 11 12:02:54 2006
+++ b/linux-2.6-xen-sparse/include/asm-xen/gnttab.h	Wed Jan 11 16:21:56 2006
@@ -21,7 +21,7 @@
 #ifdef __ia64__
 #define NR_GRANT_FRAMES 1
 #else
-#define NR_GRANT_FRAMES 4
+#define NR_GRANT_FRAMES 16
 #endif
 
 struct gnttab_free_callback {
diff -r c886f74b54a4 xen/common/grant_table.c
--- a/xen/common/grant_table.c	2006-01-12 08:46:29.000000000 +0100
+++ b/xen/common/grant_table.c	2006-01-12 00:19:16.000000000 +0100
@@ -45,7 +45,7 @@
     unsigned int h;
     if ( unlikely((h = t->maptrack_head) == (t->maptrack_limit - 1)) )
         return -1;
-    t->maptrack_head = t->maptrack[h].ref_and_flags >> MAPTRACK_REF_SHIFT;
+    t->maptrack_head = t->maptrack[h].ref;
     t->map_count++;
     return h;
 }
@@ -54,7 +54,8 @@
 put_maptrack_handle(
     grant_table_t *t, int handle)
 {
-    t->maptrack[handle].ref_and_flags = t->maptrack_head << MAPTRACK_REF_SHIFT;
+    t->maptrack[handle].ref   = t->maptrack_head;
+    t->maptrack[handle].flags = 0;
     t->maptrack_head = handle;
     t->map_count--;
 }
@@ -161,7 +162,10 @@
 
         memcpy(new_mt, lgt->maptrack, PAGE_SIZE << lgt->maptrack_order);
         for ( i = lgt->maptrack_limit; i < (lgt->maptrack_limit << 1); i++ )
-            new_mt[i].ref_and_flags = (i+1) << MAPTRACK_REF_SHIFT;
+        {
+            new_mt[i].ref   = (i+1);
+            new_mt[i].flags = 0;
+        }
 
         free_xenheap_pages(lgt->maptrack, lgt->maptrack_order);
         lgt->maptrack          = new_mt;
@@ -363,10 +367,9 @@
 
     TRACE_1D(TRC_MEM_PAGE_GRANT_MAP, dom);
 
-    ld->grant_table->maptrack[handle].domid         = dom;
-    ld->grant_table->maptrack[handle].ref_and_flags =
-        (ref << MAPTRACK_REF_SHIFT) |
-        (dev_hst_ro_flags & MAPTRACK_GNTMAP_MASK);
+    ld->grant_table->maptrack[handle].domid = dom;
+    ld->grant_table->maptrack[handle].ref   = ref;
+    ld->grant_table->maptrack[handle].flags = (u8) dev_hst_ro_flags;
 
     (void)__put_user((u64)frame << PAGE_SHIFT, &uop->dev_bus_addr);
     (void)__put_user(handle, &uop->handle);
@@ -427,7 +430,7 @@
     map = &ld->grant_table->maptrack[handle];
 
     if ( unlikely(handle >= ld->grant_table->maptrack_limit) ||
-         unlikely(!(map->ref_and_flags & MAPTRACK_GNTMAP_MASK)) )
+         unlikely(!(map->flags)) )
     {
         DPRINTK("Bad handle (%d).\n", handle);
         (void)__put_user(GNTST_bad_handle, &uop->status);
@@ -435,8 +438,8 @@
     }
 
     dom   = map->domid;
-    ref   = map->ref_and_flags >> MAPTRACK_REF_SHIFT;
-    flags = map->ref_and_flags & MAPTRACK_GNTMAP_MASK;
+    ref   = map->ref;
+    flags = map->flags;
 
     if ( unlikely((rd = find_domain_by_id(dom)) == NULL) ||
          unlikely(ld == rd) )
@@ -468,7 +471,7 @@
             act->pin -= (flags & GNTMAP_readonly) ? GNTPIN_devr_inc
                                                   : GNTPIN_devw_inc;
 
-        map->ref_and_flags &= ~GNTMAP_device_map;
+	map->flags &= ~GNTMAP_device_map;
         (void)__put_user(0, &uop->dev_bus_addr);
     }
 
@@ -479,15 +482,16 @@
         if ( (rc = destroy_grant_host_mapping(addr, frame, flags)) < 0 )
             goto unmap_out;
 
-        map->ref_and_flags &= ~GNTMAP_host_map;
+	map->flags &= ~GNTMAP_host_map;
 
         act->pin -= (flags & GNTMAP_readonly) ? GNTPIN_hstr_inc
                                               : GNTPIN_hstw_inc;
     }
 
-    if ( (map->ref_and_flags & (GNTMAP_device_map|GNTMAP_host_map)) == 0)
+    if ( (map->flags & (GNTMAP_device_map|GNTMAP_host_map)) == 0 )
     {
-        map->ref_and_flags = 0;
+        map->ref   = 0;
+	map->flags = 0;
         put_maptrack_handle(ld->grant_table, handle);
     }
 
@@ -654,12 +658,12 @@
     for ( i = 0; i < gt->maptrack_limit; i++ )
     {
         maptrack = &gt->maptrack[i];
-        if ( maptrack->ref_and_flags & MAPTRACK_GNTMAP_MASK )
-            DPRINTK("Grant: dom (%hu) MAP (%d) ref:(%hu) flags:(%x) "
+        if ( maptrack->flags )
+            DPRINTK("Grant: dom (%hu) MAP (%d) ref:(%hu) flags:(%c) "
                     "dom:(%hu)\n",
                     op.dom, i,
-                    maptrack->ref_and_flags >> MAPTRACK_REF_SHIFT,
-                    maptrack->ref_and_flags & MAPTRACK_GNTMAP_MASK,
+                    maptrack->ref,
+                    maptrack->flags,
                     maptrack->domid);
     }
 
@@ -925,7 +929,10 @@
     t->maptrack_limit = PAGE_SIZE / sizeof(grant_mapping_t);
     memset(t->maptrack, 0, PAGE_SIZE);
     for ( i = 0; i < t->maptrack_limit; i++ )
-        t->maptrack[i].ref_and_flags = (i+1) << MAPTRACK_REF_SHIFT;
+    {
+        t->maptrack[i].ref   = (i+1);
+        t->maptrack[i].flags = 0;
+    }
 
     /* Shared grant table. */
     t->shared = alloc_xenheap_pages(ORDER_GRANT_FRAMES);
@@ -968,13 +975,13 @@
     for ( handle = 0; handle < gt->maptrack_limit; handle++ )
     {
         map = &gt->maptrack[handle];
-        if ( !(map->ref_and_flags & (GNTMAP_device_map|GNTMAP_host_map)) )
+        if ( !(map->flags & (GNTMAP_device_map|GNTMAP_host_map)) )
             continue;
 
-        ref = map->ref_and_flags >> MAPTRACK_REF_SHIFT;
+        ref = map->ref;
 
-        DPRINTK("Grant release (%hu) ref:(%hu) flags:(%x) dom:(%hu)\n",
-                handle, ref, map->ref_and_flags & MAPTRACK_GNTMAP_MASK,
+        DPRINTK("Grant release (%hu) ref:(%hu) flags:(%c) dom:(%hu)\n",
+                handle, ref, map->flags,
                 map->domid);
 
         rd = find_domain_by_id(map->domid);
@@ -985,15 +992,15 @@
         act = &rd->grant_table->active[ref];
         sha = &rd->grant_table->shared[ref];
 
-        if ( map->ref_and_flags & GNTMAP_readonly )
-        {
-            if ( map->ref_and_flags & GNTMAP_device_map )
+	if ( map->flags & GNTMAP_readonly )
+	{
+            if ( map->flags & GNTMAP_device_map )
             {
                 BUG_ON((act->pin & GNTPIN_devr_mask) == 0);
                 act->pin -= GNTPIN_devr_inc;
             }
 
-            if ( map->ref_and_flags & GNTMAP_host_map )
+            if ( map->flags & GNTMAP_host_map )
             {
                 BUG_ON((act->pin & GNTPIN_hstr_mask) == 0);
                 act->pin -= GNTPIN_hstr_inc;
@@ -1001,13 +1008,13 @@
         }
         else
         {
-            if ( map->ref_and_flags & GNTMAP_device_map )
+            if ( map->flags & GNTMAP_device_map )
             {
                 BUG_ON((act->pin & GNTPIN_devw_mask) == 0);
                 act->pin -= GNTPIN_devw_inc;
             }
 
-            if ( map->ref_and_flags & GNTMAP_host_map )
+            if ( map->flags & GNTMAP_host_map )
             {
                 BUG_ON((act->pin & GNTPIN_hstw_mask) == 0);
                 act->pin -= GNTPIN_hstw_inc;
@@ -1030,7 +1037,8 @@
 
         put_domain(rd);
 
-        map->ref_and_flags = 0;
+        map->ref = 0;
+        map->flags = 0;
     }
 }
 
diff -r c886f74b54a4 xen/include/asm-x86/grant_table.h
--- a/xen/include/asm-x86/grant_table.h	Wed Jan 11 12:02:54 2006
+++ b/xen/include/asm-x86/grant_table.h	Wed Jan 11 16:21:56 2006
@@ -7,7 +7,7 @@
 #ifndef __ASM_GRANT_TABLE_H__
 #define __ASM_GRANT_TABLE_H__
 
-#define ORDER_GRANT_FRAMES 2
+#define ORDER_GRANT_FRAMES 4
 
 /*
  * Caller must own caller's BIGLOCK, is responsible for flushing the TLB, and
diff -r c886f74b54a4 xen/include/xen/grant_table.h
--- a/xen/include/xen/grant_table.h	Wed Jan 11 12:02:54 2006
+++ b/xen/include/xen/grant_table.h	Wed Jan 11 16:21:56 2006
@@ -61,12 +61,11 @@
  * table of these, indexes into which are returned as a 'mapping handle'.
  */
 typedef struct {
-    u16      ref_and_flags; /* 0-4: GNTMAP_* ; 5-15: grant ref */
-    domid_t  domid;         /* granting domain */
+    u16      ref;   /* grant reference */
+    u8       flags; /* 0-4: GNTMAP_*   */
+    domid_t  domid; /* granting domain */
 } grant_mapping_t;
-#define MAPTRACK_GNTMAP_MASK  0x1f
-#define MAPTRACK_REF_SHIFT    5
-#define MAPTRACK_MAX_ENTRIES  (1 << (16 - MAPTRACK_REF_SHIFT))
+#define MAPTRACK_MAX_ENTRIES  (1 << 16) /* limit is sizeof(grant_ref_t) */
 
 /* Per-domain grant information. */
 typedef struct {