--- xen/arch/x86/setup.c.debug	2007-06-21 15:31:00.000000000 +0200
+++ xen/arch/x86/setup.c	2007-06-22 10:13:39.000000000 +0200
@@ -460,6 +460,11 @@
 
     /* Initialise boot-time allocator with all RAM situated after modules. */
     xenheap_phys_start = init_boot_allocator(__pa(&_end));
+    if (kexec_crash_area.size > 0 && kexec_crash_area.start < xenheap_phys_end) {
+	printk("Moving crashkernel start: %ldm -> %ldm\n",
+	       kexec_crash_area.start >> 20, xenheap_phys_end >> 20);
+	kexec_crash_area.start = xenheap_phys_end;
+    }
     nr_pages = 0;
     for ( i = 0; i < e820.nr_map; i++ )
     {
--- xen/common/page_alloc.c.debug	2007-06-21 15:31:00.000000000 +0200
+++ xen/common/page_alloc.c	2007-06-22 10:12:33.000000000 +0200
@@ -36,6 +36,7 @@
 #include <xen/perfc.h>
 #include <xen/numa.h>
 #include <xen/nodemask.h>
+#include <xen/kexec.h>
 #include <asm/page.h>
 
 /*
@@ -262,9 +263,16 @@
     unsigned long nr_pfns, unsigned long pfn_align)
 {
     unsigned long pg, i;
+    unsigned long start_mfn = first_valid_mfn;
+    unsigned long kexec_end = \
+	(kexec_crash_area.start + kexec_crash_area.size) >> PAGE_SHIFT;
+
+    /* make sure we don't give out pages from the crashkernel area */
+    if (start_mfn < kexec_end)
+	start_mfn = kexec_end;
 
     /* Search forwards to obtain lowest available range. */
-    for ( pg = first_valid_mfn & ~(pfn_align - 1);
+    for ( pg = start_mfn & ~(pfn_align - 1);
           (pg + nr_pfns) <= max_page;
           pg = (pg + i + pfn_align) & ~(pfn_align - 1) )
     {