merge with xen-unstable.hg (staging)

22 files changed, 218 insertions, 121 deletions

diff --git a/docs/misc/vtd.txt b/docs/misc/vtd.txt
index 1d4e68ce5a..32f1d45b78 100644
--- a/docs/misc/vtd.txt
+++ b/docs/misc/vtd.txt
@@ -2,7 +2,7 @@ Title   : How to do PCI Passthrough with VT-d
 Authors : Allen Kay    <allen.m.kay@intel.com>
           Weidong Han  <weidong.han@intel.com>
 Created : October-24-2007
-Updated : December-11-2007
+Updated : December-13-2007
 
 How to turn on VT-d in Xen
 --------------------------
@@ -41,6 +41,22 @@ PCIe-to-PCI bridge have to be assigned to the same domain.
 PCIe devices do not have this restriction.
 
 
+VT-d Works on OS:
+-----------------
+
+1) Host OS: PAE, 64-bit
+2) Guest OS: 32-bit, PAE, 64-bit
+
+Because current Xen doesn't support MSI, for guest OS which uses MSI by default, need to add "pci=nomsi" option on its grub, e.g. RHEL5, FC6.
+
+
+Combinations Tested:
+--------------------
+
+1) 64-bit host: 32/PAE/64 Linux/XP/Win2003/Vista guests
+2) PAE host: 32/PAE Linux/XP/Win2003/Vista guests
+
+
 VT-d Enabled Systems
 --------------------
 
diff --git a/docs/misc/xenstore.txt b/docs/misc/xenstore.txt
index 3916403317..90632863df 100644
--- a/docs/misc/xenstore.txt
+++ b/docs/misc/xenstore.txt
@@ -38,7 +38,9 @@ The permitted character for paths set is ASCII alphanumerics and plus
 the four punctuation characters -/_@ (hyphen slash underscore atsign).
 @ should be avoided except to specify special watches (see below).
 Doubled slashes and trailing slashes (except to specify the root) are
-forbidden.  The empty path is also forbidden.
+forbidden.  The empty path is also forbidden.  Paths longer than 3072
+bytes are forbidden; clients specifying relative paths should keep
+them to within 2048 bytes.  (See XENSTORE_*_PATH_MAX in xs_wire.h.)
 
 
 Communication with xenstore is via either sockets, or event channel
@@ -56,6 +58,20 @@ order and must use req_id (and tx_id, if applicable) to match up
 replies to requests.  (The current implementation always replies to
 requests in the order received but this should not be relied on.)
 
+The payload length (len field of the header) is limited to 4096
+(XENSTORE_PAYLOAD_MAX) in both directions.  If a client exceeds the
+limit, its xenstored connection will be immediately killed by
+xenstored, which is usually catastrophic from the client's point of
+view.  Clients (particularly domains, which cannot just reconnect)
+should avoid this.
+
+Existing clients do not always contain defences against overly long
+payloads.  Increasing xenstored's limit is therefore difficult; it
+would require negotiation with the client, and obviously would make
+parts of xenstore inaccessible to some clients.  In any case passing
+bulk data through xenstore is not recommended as the performance
+properties are poor.
+
 
 ---------- Xenstore protocol details - introduction ----------
 
@@ -174,6 +190,17 @@ WATCH			<wpath>|<token>|?
 	away, with <path> equal to <wpath>.  Watches may be triggered
 	spuriously.  The tx_id in a WATCH request is ignored.
 
+	Watches are supposed to be restricted by the permissions
+	system but in practice the implementation is imperfect.
+	Applications should not rely on being sent a notification for
+	paths that they cannot read; however, an application may rely
+	on being sent a watch when a path which it _is_ able to read
+	is deleted even if that leaves only a nonexistent unreadable
+	parent.  A notification may omitted if a node's permissions
+	are changed so as to make it unreadable, in which case future
+	notifications may be suppressed (and if the node is later made
+	readable, some notifications may have been lost).
+
 WATCH_EVENT					<epath>|<token>|
 	Unsolicited `reply' generated for matching modfication events
 	as described above.  req_id and tx_id are both 0.
@@ -182,7 +209,7 @@ WATCH_EVENT					<epath>|<token>|
 	modifed; however if the event was the recursive removal of an
 	parent of <wpath>, <epath> is just
 	<wpath> (rather than the actual path which was removed).  So
-	<epath> is a child of <epath>, regardless.
+	<epath> is a child of <wpath>, regardless.
 
 	Iff <wpath> for the watch was specified as a relative pathname,
 	the <epath> path will also be relative (with the same base,
@@ -192,7 +219,7 @@ UNWATCH			<wpath>|<token>|?
 
 ---------- Transactions ----------
 
-TRANSACTION_START	??			<transid>|
+TRANSACTION_START	|			<transid>|
 	<transid> is an opaque uint32_t allocated by xenstored
 	represented as unsigned decimal.  After this, transaction may
 	be referenced by using <transid> (as 32-bit binary) in the
@@ -202,11 +229,6 @@ TRANSACTION_START	??			<transid>|
 	Currently xenstored has the bug that after 2^32 transactions
 	it will allocate the transid 0 for an actual transaction.
 
-	Clients using the provided xs.c bindings will send a single
-	nul byte for the argument payload.  We recommend that future
-	clients continue to do the same; any future extension will not
-	use that syntax.
-
 TRANSACTION_END		T|
 TRANSACTION_END		F|
 	tx_id must refer to existing transaction.  After this
diff --git a/tools/libfsimage/Rules.mk b/tools/libfsimage/Rules.mk
index 9d49c6373d..ca6380a4a1 100644
--- a/tools/libfsimage/Rules.mk
+++ b/tools/libfsimage/Rules.mk
@@ -27,6 +27,6 @@ $(FSLIB): $(PIC_OBJS)
 	$(CC) $(CFLAGS) $(LDFLAGS) $(SHLIB_CFLAGS) -o $@ $^ -lfsimage $(FS_LIBDEPS)
 
 clean distclean:
-	rm -f $(PIC_OBJS) $(FSLIB)
+	rm -f $(PIC_OBJS) $(FSLIB) $(DEPS)
 
 -include $(DEPS)
diff --git a/tools/libfsimage/common/Makefile b/tools/libfsimage/common/Makefile
index 6efce44f02..5c22fa974d 100644
--- a/tools/libfsimage/common/Makefile
+++ b/tools/libfsimage/common/Makefile
@@ -32,7 +32,7 @@ install: all
 	$(INSTALL_DATA) fsimage_grub.h $(DESTDIR)/usr/include
 
 clean distclean:
-	rm -f $(PIC_OBJS) $(LIB)
+	rm -f $(PIC_OBJS) $(LIB) $(DEPS)
 
 libfsimage.so: libfsimage.so.$(MAJOR)
 	ln -sf $< $@
diff --git a/tools/libxc/Makefile b/tools/libxc/Makefile
index 3c9899d152..618b371615 100644
--- a/tools/libxc/Makefile
+++ b/tools/libxc/Makefile
@@ -125,7 +125,8 @@ TAGS:
 clean:
 	rm -rf *.rpm $(LIB) *~ $(DEPS) xen \
             $(CTRL_LIB_OBJS) $(CTRL_PIC_OBJS) \
-            $(GUEST_LIB_OBJS) $(GUEST_PIC_OBJS)
+            $(GUEST_LIB_OBJS) $(GUEST_PIC_OBJS) \
+            $(LIBELF_SRCS) libelf-private.h
 
 .PHONY: rpm
 rpm: build
diff --git a/tools/python/Makefile b/tools/python/Makefile
index 880a19c9ff..21be26b99b 100644
--- a/tools/python/Makefile
+++ b/tools/python/Makefile
@@ -104,4 +104,4 @@ test:
 
 .PHONY: clean
 clean:
-	rm -rf build *.pyc *.pyo *.o *.a *~ $(CATALOGS) xen/util/xsm/xsm.py
+	rm -rf build *.pyc *.pyo *.o *.a *~ $(CATALOGS) xen/util/xsm/xsm.py xen/util/auxbin.pyc
diff --git a/tools/python/xen/util/xsm/acm/acm.py b/tools/python/xen/util/xsm/acm/acm.py
index 7973a5b704..8bb0928c6e 100644
--- a/tools/python/xen/util/xsm/acm/acm.py
+++ b/tools/python/xen/util/xsm/acm/acm.py
@@ -1545,21 +1545,44 @@ def get_security_label(self, xspol=None):
         label = self.info.get('security_label', label)
     return label
 
+
+__cond = threading.Condition()
+__script_runner = None
+__orders = []
+
 def run_resource_label_change_script(resource, label, command):
-    def __run_resource_label_change_script(label, command):
+    global __cond, __orders, __script_runner
+
+    def __run_resource_label_change_script():
+        global __cond, __orders
         script = XendOptions.instance().get_resource_label_change_script()
         if script:
-            parms = {
-                'resource' : resource,
-                'label'    : label,
-                'command'  : command,
-            }
-            log.info("Running resource label change script %s: %s" %
-                     (script, parms))
-            parms.update(os.environ)
-            os.spawnve(os.P_WAIT, script[0], script, parms)
+            parms = {}
+            while True:
+                __cond.acquire()
+                if len(__orders) == 0:
+                    __cond.wait()
+
+                parms['label'], \
+                   parms['command'], \
+                   parms['resource'] = __orders[0]
+
+                __orders = __orders[1:]
+                __cond.release()
+
+                log.info("Running resource label change script %s: %s" %
+                         (script, parms))
+                parms.update(os.environ)
+                os.spawnve(os.P_WAIT, script[0], script, parms)
         else:
             log.info("No script given for relabeling of resources.")
-    thread = threading.Thread(target=__run_resource_label_change_script,
-                              args=(label,command))
-    thread.start()
+    if not __script_runner:
+        __script_runner = \
+                 threading.Thread(target=__run_resource_label_change_script,
+                                  args=())
+        __script_runner.start()
+
+    __cond.acquire()
+    __orders.append((label,command,resource))
+    __cond.notify()
+    __cond.release()
diff --git a/tools/python/xen/util/xsm/dummy/dummy.py b/tools/python/xen/util/xsm/dummy/dummy.py
index 66fc8c2bd2..b82e1b9ff5 100644
--- a/tools/python/xen/util/xsm/dummy/dummy.py
+++ b/tools/python/xen/util/xsm/dummy/dummy.py
@@ -33,7 +33,6 @@ xmlrpc_exports = [
 def err(msg):
     """Raise XSM-dummy exception.
     """
-    sys.stderr.write("XSM-dummyError: " + msg + "\n")
     raise XSMError(msg)
 
 def on():
@@ -123,3 +122,12 @@ def get_domain_label(domain):
 
 def set_domain_label():
     err("Command not supported under xsm 'dummy' module.")
+
+def dump_policy():
+    pass
+
+def dump_policy_file():
+    pass
+
+def get_ssid(domain):
+    err("No ssid has been assigned to any domain under xsm dummy module.")
diff --git a/tools/xenstore/xenstored_core.c b/tools/xenstore/xenstored_core.c
index 825d834e37..acf6dd3918 100644
--- a/tools/xenstore/xenstored_core.c
+++ b/tools/xenstore/xenstored_core.c
@@ -672,6 +672,9 @@ bool is_valid_nodename(const char *node)
 	if (strstr(node, "//"))
 		return false;
 
+	if (strlen(node) > XENSTORE_ABS_PATH_MAX)
+		return false;
+
 	return valid_chars(node);
 }
 
@@ -1281,7 +1284,7 @@ static void handle_input(struct connection *conn)
 		if (in->used != sizeof(in->hdr))
 			return;
 
-		if (in->hdr.msg.len > PATH_MAX) {
+		if (in->hdr.msg.len > XENSTORE_PAYLOAD_MAX) {
 			syslog(LOG_ERR, "Client tried to feed us %i",
 			       in->hdr.msg.len);
 			goto bad_client;
diff --git a/tools/xenstore/xenstored_watch.c b/tools/xenstore/xenstored_watch.c
index 72927fa9c7..8e3e4f2b61 100644
--- a/tools/xenstore/xenstored_watch.c
+++ b/tools/xenstore/xenstored_watch.c
@@ -125,6 +125,10 @@ void do_watch(struct connection *conn, struct buffered_data *in)
 
 	if (strstarts(vec[0], "@")) {
 		relative = false;
+		if (strlen(vec[0]) > XENSTORE_REL_PATH_MAX) {
+			send_error(conn, EINVAL);
+			return;
+		}
 		/* check if valid event */
 	} else {
 		relative = !strstarts(vec[0], "/");
diff --git a/tools/xenstore/xs.c b/tools/xenstore/xs.c
index faa7e5c80f..a815257798 100644
--- a/tools/xenstore/xs.c
+++ b/tools/xenstore/xs.c
@@ -319,6 +319,11 @@ static void *xs_talkv(struct xs_handle *h, xs_transaction_t t,
 	for (i = 0; i < num_vecs; i++)
 		msg.len += iovec[i].iov_len;
 
+	if (msg.len > XENSTORE_PAYLOAD_MAX) {
+		errno = E2BIG;
+		return 0;
+	}
+
 	ignorepipe.sa_handler = SIG_IGN;
 	sigemptyset(&ignorepipe.sa_mask);
 	ignorepipe.sa_flags = 0;
diff --git a/tools/xenstore/xsls.c b/tools/xenstore/xsls.c
index cd8e3a9dac..337e87cc5b 100644
--- a/tools/xenstore/xsls.c
+++ b/tools/xenstore/xsls.c
@@ -8,7 +8,7 @@
 #include <sys/ioctl.h>
 #include <termios.h>
 
-#define STRING_MAX PATH_MAX
+#define STRING_MAX XENSTORE_ABS_PATH_MAX+1024
 static int max_width = 80;
 static int desired_width = 60;
 static int show_whole_path = 0;
diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index 854e58040e..f0575afdab 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -1405,6 +1405,25 @@ void hvm_cpuid(unsigned int input, unsigned int *eax, unsigned int *ebx,
     }
 }
 
+enum hvm_intblk hvm_interrupt_blocked(struct vcpu *v, struct hvm_intack intack)
+{
+    enum hvm_intblk r;
+    ASSERT(v == current);
+
+    r = hvm_funcs.interrupt_blocked(v, intack);
+    if ( r != hvm_intblk_none )
+        return r;
+
+    if ( intack.source == hvm_intsrc_lapic )
+    {
+        uint32_t tpr = vlapic_get_reg(vcpu_vlapic(v), APIC_TASKPRI) & 0xF0;
+        if ( (tpr >> 4) >= (intack.vector >> 4) )
+            return hvm_intblk_tpr;
+    }
+
+    return r;
+}
+
 static long hvm_grant_table_op(
     unsigned int cmd, XEN_GUEST_HANDLE(void) uop, unsigned int count)
 {
@@ -1425,7 +1444,6 @@ static hvm_hypercall_t *hvm_hypercall32_table[NR_hypercalls] = {
     HYPERCALL(memory_op),
     [ __HYPERVISOR_grant_table_op ] = (hvm_hypercall_t *)hvm_grant_table_op,
     HYPERCALL(xen_version),
-    HYPERCALL(grant_table_op),
     HYPERCALL(event_channel_op),
     HYPERCALL(sched_op),
     HYPERCALL(hvm_op)
@@ -1478,7 +1496,6 @@ static hvm_hypercall_t *hvm_hypercall64_table[NR_hypercalls] = {
     HYPERCALL(memory_op),
     [ __HYPERVISOR_grant_table_op ] = (hvm_hypercall_t *)hvm_grant_table_op,
     HYPERCALL(xen_version),
-    HYPERCALL(grant_table_op),
     HYPERCALL(event_channel_op),
     HYPERCALL(sched_op),
     HYPERCALL(hvm_op)
@@ -1488,7 +1505,6 @@ static hvm_hypercall_t *hvm_hypercall32_table[NR_hypercalls] = {
     [ __HYPERVISOR_memory_op ] = (hvm_hypercall_t *)do_memory_op_compat32,
     [ __HYPERVISOR_grant_table_op ] = (hvm_hypercall_t *)hvm_grant_table_op,
     HYPERCALL(xen_version),
-    HYPERCALL(grant_table_op),
     HYPERCALL(event_channel_op),
     HYPERCALL(sched_op),
     HYPERCALL(hvm_op)
diff --git a/xen/arch/x86/hvm/svm/svm.c b/xen/arch/x86/hvm/svm/svm.c
index f471474b55..ca935e1458 100644
--- a/xen/arch/x86/hvm/svm/svm.c
+++ b/xen/arch/x86/hvm/svm/svm.c
@@ -443,10 +443,6 @@ static enum hvm_intblk svm_interrupt_blocked(
     if ( !(guest_cpu_user_regs()->eflags & X86_EFLAGS_IF) )
         return hvm_intblk_rflags_ie;
 
-    if ( (intack.source == hvm_intsrc_lapic) &&
-         ((vmcb->vintr.fields.tpr & 0xf) >= (intack.vector >> 4)) )
-        return hvm_intblk_tpr;
-
     return hvm_intblk_none;
 }
 
@@ -522,13 +518,6 @@ static void svm_flush_guest_tlbs(void)
     svm_asid_inc_generation();
 }
 
-static void svm_update_vtpr(struct vcpu *v, unsigned long value)
-{
-    struct vmcb_struct *vmcb = v->arch.hvm_svm.vmcb;
-
-    vmcb->vintr.fields.tpr = value & 0x0f;
-}
-
 static void svm_sync_vmcb(struct vcpu *v)
 {
     struct arch_svm_struct *arch_svm = &v->arch.hvm_svm;
@@ -788,6 +777,10 @@ static void svm_do_resume(struct vcpu *v)
         svm_asid_init_vcpu(v);
     }
 
+    /* Reflect the vlapic's TPR in the hardware vtpr */
+    v->arch.hvm_svm.vmcb->vintr.fields.tpr = 
+        (vlapic_get_reg(vcpu_vlapic(v), APIC_TASKPRI) & 0xFF) >> 4;
+
     hvm_do_resume(v);
     reset_stack_and_jump(svm_asm_do_resume);
 }
@@ -885,7 +878,6 @@ static struct hvm_function_table svm_function_table = {
     .update_guest_cr      = svm_update_guest_cr,
     .update_guest_efer    = svm_update_guest_efer,
     .flush_guest_tlbs     = svm_flush_guest_tlbs,
-    .update_vtpr          = svm_update_vtpr,
     .stts                 = svm_stts,
     .set_tsc_offset       = svm_set_tsc_offset,
     .inject_exception     = svm_inject_exception,
@@ -2212,6 +2204,10 @@ asmlinkage void svm_vmexit_handler(struct cpu_user_regs *regs)
         domain_crash(v->domain);
         break;
     }
+
+    /* The exit may have updated the TPR: reflect this in the hardware vtpr */
+    vmcb->vintr.fields.tpr = 
+        (vlapic_get_reg(vcpu_vlapic(v), APIC_TASKPRI) & 0xFF) >> 4;
 }
 
 asmlinkage void svm_trace_vmentry(void)
diff --git a/xen/arch/x86/hvm/vlapic.c b/xen/arch/x86/hvm/vlapic.c
index 059b64538d..e32ac13b00 100644
--- a/xen/arch/x86/hvm/vlapic.c
+++ b/xen/arch/x86/hvm/vlapic.c
@@ -120,14 +120,9 @@ static void vlapic_clear_irr(int vector, struct vlapic *vlapic)
     vlapic_clear_vector(vector, &vlapic->regs->data[APIC_IRR]);
 }
 
-int vlapic_find_highest_irr(struct vlapic *vlapic)
+static int vlapic_find_highest_irr(struct vlapic *vlapic)
 {
-    int result;
-
-    result = vlapic_find_highest_vector(&vlapic->regs->data[APIC_IRR]);
-    ASSERT((result == -1) || (result >= 16));
-
-    return result;
+    return vlapic_find_highest_vector(&vlapic->regs->data[APIC_IRR]);
 }
 
 int vlapic_set_irq(struct vlapic *vlapic, uint8_t vec, uint8_t trig)
@@ -142,14 +137,9 @@ int vlapic_set_irq(struct vlapic *vlapic, uint8_t vec, uint8_t trig)
     return ret;
 }
 
-int vlapic_find_highest_isr(struct vlapic *vlapic)
+static int vlapic_find_highest_isr(struct vlapic *vlapic)
 {
-    int result;
-
-    result = vlapic_find_highest_vector(&vlapic->regs->data[APIC_ISR]);
-    ASSERT((result == -1) || (result >= 16));
-
-    return result;
+    return vlapic_find_highest_vector(&vlapic->regs->data[APIC_ISR]);
 }
 
 uint32_t vlapic_get_ppr(struct vlapic *vlapic)
@@ -454,11 +444,9 @@ static void vlapic_set_tdcr(struct vlapic *vlapic, unsigned int val)
                 "timer_divisor: %d", vlapic->hw.timer_divisor);
 }
 
-static void vlapic_read_aligned(struct vlapic *vlapic, unsigned int offset,
-                         unsigned int len, unsigned int *result)
+static void vlapic_read_aligned(
+    struct vlapic *vlapic, unsigned int offset, unsigned int *result)
 {
-    ASSERT((len == 4) && (offset >= 0) && (offset <= APIC_TDCR));
-
     switch ( offset )
     {
     case APIC_PROCPRI:
@@ -487,15 +475,9 @@ static unsigned long vlapic_read(struct vcpu *v, unsigned long address,
     if ( offset > APIC_TDCR )
         return 0;
 
-    /* some bugs on kernel cause read this with byte*/
-    if ( len != 4 )
-        HVM_DBG_LOG(DBG_LEVEL_VLAPIC,
-                    "read with len=0x%lx, should be 4 instead",
-                    len);
-
     alignment = offset & 0x3;
 
-    vlapic_read_aligned(vlapic, offset & ~0x3, 4, &tmp);
+    vlapic_read_aligned(vlapic, offset & ~0x3, &tmp);
     switch ( len )
     {
     case 1:
@@ -503,12 +485,14 @@ static unsigned long vlapic_read(struct vcpu *v, unsigned long address,
         break;
 
     case 2:
-        ASSERT( alignment != 3 );
+        if ( alignment == 3 )
+            goto unaligned_exit_and_crash;
         result = *(unsigned short *)((unsigned char *)&tmp + alignment);
         break;
 
     case 4:
-        ASSERT( alignment == 0 );
+        if ( alignment != 0 )
+            goto unaligned_exit_and_crash;
         result = *(unsigned int *)((unsigned char *)&tmp + alignment);
         break;
 
@@ -523,6 +507,9 @@ static unsigned long vlapic_read(struct vcpu *v, unsigned long address,
 
     return result;
 
+ unaligned_exit_and_crash:
+    gdprintk(XENLOG_ERR, "Unaligned LAPIC read len=0x%lx at offset=0x%x.\n",
+             len, offset);
  exit_and_crash:
     domain_crash(v->domain);
     return 0;
@@ -593,7 +580,6 @@ static void vlapic_write(struct vcpu *v, unsigned long address,
     {
     case APIC_TASKPRI:
         vlapic_set_reg(vlapic, APIC_TASKPRI, val & 0xff);
-        hvm_update_vtpr(v, (val >> 4) & 0x0f);
         break;
 
     case APIC_EOI:
diff --git a/xen/arch/x86/hvm/vmx/vmx.c b/xen/arch/x86/hvm/vmx/vmx.c
index ff2d8f3cbc..2aeabacdbd 100644
--- a/xen/arch/x86/hvm/vmx/vmx.c
+++ b/xen/arch/x86/hvm/vmx/vmx.c
@@ -1011,13 +1011,6 @@ static enum hvm_intblk vmx_interrupt_blocked(
     if ( !(guest_cpu_user_regs()->eflags & X86_EFLAGS_IF) )
         return hvm_intblk_rflags_ie;
 
-    if ( intack.source == hvm_intsrc_lapic )
-    {
-        uint32_t tpr = vlapic_get_reg(vcpu_vlapic(v), APIC_TASKPRI) & 0xF0;
-        if ( (tpr >> 4) >= (intack.vector >> 4) )
-            return hvm_intblk_tpr;
-    }
-
     return hvm_intblk_none;
 }
 
@@ -1120,11 +1113,6 @@ static void vmx_inject_exception(
     }
 }
 
-static void vmx_update_vtpr(struct vcpu *v, unsigned long value)
-{
-    /* VMX doesn't have a V_TPR field */
-}
-
 static int vmx_event_pending(struct vcpu *v)
 {
     ASSERT(v == current);
@@ -1148,7 +1136,6 @@ static struct hvm_function_table vmx_function_table = {
     .update_guest_cr      = vmx_update_guest_cr,
     .update_guest_efer    = vmx_update_guest_efer,
     .flush_guest_tlbs     = vmx_flush_guest_tlbs,
-    .update_vtpr          = vmx_update_vtpr,
     .stts                 = vmx_stts,
     .set_tsc_offset       = vmx_set_tsc_offset,
     .inject_exception     = vmx_inject_exception,
diff --git a/xen/arch/x86/oprofile/op_model_ppro.c b/xen/arch/x86/oprofile/op_model_ppro.c
index 6c4344ee21..53ff2182c2 100644
--- a/xen/arch/x86/oprofile/op_model_ppro.c
+++ b/xen/arch/x86/oprofile/op_model_ppro.c
@@ -104,6 +104,8 @@ static int ppro_check_ctrs(unsigned int const cpu,
 	int mode = xenoprofile_get_mode(current, regs);
 
 	for (i = 0 ; i < NUM_COUNTERS; ++i) {
+		if (!reset_value[i])
+			continue;
 		CTR_READ(low, high, msrs, i);
 		if (CTR_OVERFLOWED(low)) {
 			xenoprof_log_event(current, regs, eip, mode, i);
@@ -123,18 +125,30 @@ static int ppro_check_ctrs(unsigned int const cpu,
 static void ppro_start(struct op_msrs const * const msrs)
 {
 	unsigned int low,high;
-	CTRL_READ(low, high, msrs, 0);
-	CTRL_SET_ACTIVE(low);
-	CTRL_WRITE(low, high, msrs, 0);
+	int i;
+
+	for (i = 0; i < NUM_COUNTERS; ++i) {
+		if (reset_value[i]) {
+			CTRL_READ(low, high, msrs, i);
+			CTRL_SET_ACTIVE(low);
+			CTRL_WRITE(low, high, msrs, i);
+		}
+	}
 }
 
 
 static void ppro_stop(struct op_msrs const * const msrs)
 {
 	unsigned int low,high;
-	CTRL_READ(low, high, msrs, 0);
-	CTRL_SET_INACTIVE(low);
-	CTRL_WRITE(low, high, msrs, 0);
+	int i;
+
+	for (i = 0; i < NUM_COUNTERS; ++i) {
+		if (!reset_value[i])
+			continue;
+		CTRL_READ(low, high, msrs, i);
+		CTRL_SET_INACTIVE(low);
+		CTRL_WRITE(low, high, msrs, i);
+	}
 }
 
 
diff --git a/xen/arch/x86/traps.c b/xen/arch/x86/traps.c
index 970796e045..d814e296aa 100644
--- a/xen/arch/x86/traps.c
+++ b/xen/arch/x86/traps.c
@@ -1878,7 +1878,7 @@ static int emulate_privileged_op(struct cpu_user_regs *regs)
         eax = regs->eax;
         edx = regs->edx;
         res = ((u64)edx << 32) | eax;
-        switch ( regs->ecx )
+        switch ( (u32)regs->ecx )
         {
 #ifdef CONFIG_X86_64
         case MSR_FS_BASE:
@@ -1916,15 +1916,19 @@ static int emulate_privileged_op(struct cpu_user_regs *regs)
         case MSR_K8_PSTATE5:
         case MSR_K8_PSTATE6:
         case MSR_K8_PSTATE7:
-            if ( (cpufreq_controller != FREQCTL_dom0_kernel) ||
-                 (boot_cpu_data.x86_vendor != X86_VENDOR_AMD) ||
-                 wrmsr_safe(regs->ecx, eax, edx) )
+            if ( boot_cpu_data.x86_vendor != X86_VENDOR_AMD )
+                goto fail;
+            if ( cpufreq_controller != FREQCTL_dom0_kernel )
+                break;
+            if ( wrmsr_safe(regs->ecx, eax, edx) != 0 )
                 goto fail;
             break;
         case MSR_IA32_PERF_CTL:
-            if ( (cpufreq_controller != FREQCTL_dom0_kernel) ||
-                 (boot_cpu_data.x86_vendor != X86_VENDOR_INTEL) ||
-                 wrmsr_safe(regs->ecx, eax, edx) )
+            if ( boot_cpu_data.x86_vendor != X86_VENDOR_INTEL )
+                goto fail;
+            if ( cpufreq_controller != FREQCTL_dom0_kernel )
+                break;
+            if ( wrmsr_safe(regs->ecx, eax, edx) != 0 )
                 goto fail;
             break;
         default:
@@ -1944,7 +1948,7 @@ static int emulate_privileged_op(struct cpu_user_regs *regs)
         break;
 
     case 0x32: /* RDMSR */
-        switch ( regs->ecx )
+        switch ( (u32)regs->ecx )
         {
 #ifdef CONFIG_X86_64
         case MSR_FS_BASE:
@@ -1979,9 +1983,14 @@ static int emulate_privileged_op(struct cpu_user_regs *regs)
         case MSR_K8_PSTATE5:
         case MSR_K8_PSTATE6:
         case MSR_K8_PSTATE7:
-            if ( (cpufreq_controller != FREQCTL_dom0_kernel) ||
-                 (boot_cpu_data.x86_vendor != X86_VENDOR_AMD) ||
-                 rdmsr_safe(regs->ecx, regs->eax, regs->edx) )
+            if ( boot_cpu_data.x86_vendor != X86_VENDOR_AMD )
+                goto fail;
+            if ( cpufreq_controller != FREQCTL_dom0_kernel )
+            {
+                regs->eax = regs->edx = 0;
+                break;
+            }
+            if ( rdmsr_safe(regs->ecx, regs->eax, regs->edx) != 0 )
                 goto fail;
             break;
         case MSR_EFER:
diff --git a/xen/common/xenoprof.c b/xen/common/xenoprof.c
index fee2a6556b..741c9f04d3 100644
--- a/xen/common/xenoprof.c
+++ b/xen/common/xenoprof.c
@@ -12,6 +12,7 @@
 #ifndef COMPAT
 #include <xen/guest_access.h>
 #include <xen/sched.h>
+#include <xen/event.h>
 #include <public/xenoprof.h>
 #include <xen/paging.h>
 #include <xsm/xsm.h>
@@ -747,14 +748,30 @@ int do_xenoprof_op(int op, XEN_GUEST_HANDLE(void) arg)
         break;
 
     case XENOPROF_stop:
+    {
+        struct domain *d;
+        struct vcpu *v;
+        int i;
+
         if ( xenoprof_state != XENOPROF_PROFILING )
         {
             ret = -EPERM;
             break;
         }
         xenoprof_arch_stop();
+
+        /* Flush remaining samples. */
+        for ( i = 0; i < adomains; i++ )
+        {
+            if ( !active_ready[i] )
+                continue;
+            d = active_domains[i];
+            for_each_vcpu(d, v)
+                send_guest_vcpu_virq(v, VIRQ_XENOPROF);
+        }
         xenoprof_state = XENOPROF_READY;
         break;
+    }
 
     case XENOPROF_disable_virq:
     {
diff --git a/xen/include/asm-x86/hvm/hvm.h b/xen/include/asm-x86/hvm/hvm.h
index 079e3c5da2..6fe80e9f04 100644
--- a/xen/include/asm-x86/hvm/hvm.h
+++ b/xen/include/asm-x86/hvm/hvm.h
@@ -106,11 +106,6 @@ struct hvm_function_table {
     void (*flush_guest_tlbs)(void);
 
     /*
-     * Reflect the virtual APIC's value in the guest's V_TPR register
-     */
-    void (*update_vtpr)(struct vcpu *v, unsigned long value);
-
-    /*
      * Update specifics of the guest state:
      * 1) TS bit in guest cr0 
      * 2) TSC offset in guest
@@ -161,12 +156,8 @@ u64 hvm_get_guest_tsc(struct vcpu *v);
 #define hvm_long_mode_enabled(v) (v,0)
 #endif
 
-static inline enum hvm_intblk
-hvm_interrupt_blocked(struct vcpu *v, struct hvm_intack intack)
-{
-    ASSERT(v == current);
-    return hvm_funcs.interrupt_blocked(v, intack);
-}
+enum hvm_intblk
+hvm_interrupt_blocked(struct vcpu *v, struct hvm_intack intack);
 
 static inline int
 hvm_guest_x86_mode(struct vcpu *v)
@@ -184,12 +175,6 @@ hvm_update_host_cr3(struct vcpu *v)
     hvm_funcs.update_host_cr3(v);
 }
 
-static inline void
-hvm_update_vtpr(struct vcpu *v, unsigned long value)
-{
-    hvm_funcs.update_vtpr(v, value);
-}
-
 static inline void hvm_update_guest_cr(struct vcpu *v, unsigned int cr)
 {
     hvm_funcs.update_guest_cr(v, cr);
diff --git a/xen/include/asm-x86/hvm/vlapic.h b/xen/include/asm-x86/hvm/vlapic.h
index d20a627882..edefa2c055 100644
--- a/xen/include/asm-x86/hvm/vlapic.h
+++ b/xen/include/asm-x86/hvm/vlapic.h
@@ -73,8 +73,6 @@ static inline void vlapic_set_reg(
 
 int vlapic_set_irq(struct vlapic *vlapic, uint8_t vec, uint8_t trig);
 
-int vlapic_find_highest_irr(struct vlapic *vlapic);
-
 int vlapic_has_pending_irq(struct vcpu *v);
 int vlapic_ack_pending_irq(struct vcpu *v, int vector);
 
diff --git a/xen/include/public/io/xs_wire.h b/xen/include/public/io/xs_wire.h
index 927ed8c944..3994b11fdf 100644
--- a/xen/include/public/io/xs_wire.h
+++ b/xen/include/public/io/xs_wire.h
@@ -108,6 +108,13 @@ struct xenstore_domain_interface {
     XENSTORE_RING_IDX rsp_cons, rsp_prod;
 };
 
+/* Violating this is very bad.  See docs/misc/xenstore.txt. */
+#define XENSTORE_PAYLOAD_MAX 4096
+
+/* Violating these just gets you an error back */
+#define XENSTORE_ABS_PATH_MAX 3072
+#define XENSTORE_REL_PATH_MAX 2048
+
 #endif /* _XS_WIRE_H */
 
 /*