bitkeeper revision 1.1708 (42a9b4dc79oJAGtbQvr8mTDofvBdxQ)

Merge bk://xen.bkbits.net/xeno-unstable.bk
into  bkbits.net:/repos/x/xen-ia64/xeno-unstable-ia64.bk

44 files changed, 300 insertions, 471 deletions

diff --git a/.rootkeys b/.rootkeys
index b64aa43ac2..30f525d435 100644
--- a/.rootkeys
+++ b/.rootkeys
@@ -707,17 +707,6 @@
 428d0d88lVaOC64YBZ1Wzt-WV4JaSw tools/ioemu/osdep.c
 428d0d885W7r27CDEJCW6Jlbxggc9g tools/ioemu/osdep.h
 428d0d88CiP9tVdIdLWAzOnCOSdafg tools/ioemu/path.c
-428d0d88jzHltLAzyhV1lpFckzy8CA tools/ioemu/pc-bios/Makefile
-428d0d889pv_iPNBFn6cNRzQfJMC3A tools/ioemu/pc-bios/README
-428d0d88mhWW8SQFNfp-NaH3c8QQkg tools/ioemu/pc-bios/bios.bin
-428d0d88LMSMDbTFG1-sS8LL90hExw tools/ioemu/pc-bios/bios.diff
-428d0d89SHpdZE1S-ywjJCulIWs4Ag tools/ioemu/pc-bios/linux_boot.S
-428d0d89hiL0UgU71ero86GEu1loaA tools/ioemu/pc-bios/linux_boot.bin
-428d0d894MKpOb385vcoB_s_4q0QOA tools/ioemu/pc-bios/ppc_rom.bin
-428d0d896uo6qr-ONYkpleolayT4zw tools/ioemu/pc-bios/proll.bin
-428d0d893gsF8AcCadeYXcKM-aqssA tools/ioemu/pc-bios/proll.patch
-428d0d89GgbrVx4Ov3Zg-SFX_0BRdw tools/ioemu/pc-bios/vgabios-cirrus.bin
-428d0d89h9nqxPIgDpPMXZIWkdosNw tools/ioemu/pc-bios/vgabios.bin
 428d0d8908B65zMmhdGVME3jv7gpww tools/ioemu/qemu-binfmt-conf.sh
 428d0d89taY6NPlnIyOAMQd_Ww5qUw tools/ioemu/qemu-img.c
 428d0d89FY-g4UPH-ZW7t5ZCqvQVTQ tools/ioemu/readline.c
diff --git a/Makefile b/Makefile
index 809a7150d9..264cc2015e 100644
--- a/Makefile
+++ b/Makefile
@@ -163,10 +163,13 @@ uninstall:
 	rm -rf $(D)/etc/init.d/xend*
 	rm -rf $(D)/usr/$(LIBDIR)/libxc* $(D)/usr/$(LIBDIR)/libxutil*
 	rm -rf $(D)/usr/$(LIBDIR)/python/xen $(D)/usr/include/xen
+	rm -rf $(D)/usr/$(LIBDIR)/share/xen $(D)/usr/$(LIBDIR)/libxenstore*
+	rm -rf $(D)/var/run/xen* $(D)/var/lib/xen*
 	rm -rf $(D)/usr/include/xcs_proto.h $(D)/usr/include/xc.h
+	rm -rf $(D)/usr/include/xs_lib.h $(D)/usr/include/xs.h
 	rm -rf $(D)/usr/sbin/xcs $(D)/usr/sbin/xcsdump $(D)/usr/sbin/xen*
 	rm -rf $(D)/usr/sbin/netfix
-	rm -rf $(D)/usr/sbin/xfrd $(D)/usr/sbin/xm $(D)/var/lib/xen
+	rm -rf $(D)/usr/sbin/xfrd $(D)/usr/sbin/xm
 	rm -rf $(D)/usr/share/doc/xen  $(D)/usr/man/man*/xentrace*
 	rm -rf $(D)/usr/bin/xen* $(D)/usr/bin/miniterm
 	rm -rf $(D)/boot/*xen*
diff --git a/linux-2.6.11-xen-sparse/arch/xen/configs/xen0_defconfig_x86_64 b/linux-2.6.11-xen-sparse/arch/xen/configs/xen0_defconfig_x86_64
index 255983b79b..7df45e168c 100644
--- a/linux-2.6.11-xen-sparse/arch/xen/configs/xen0_defconfig_x86_64
+++ b/linux-2.6.11-xen-sparse/arch/xen/configs/xen0_defconfig_x86_64
@@ -701,7 +701,7 @@ CONFIG_LEGACY_PTY_COUNT=256
 # CONFIG_WATCHDOG is not set
 # CONFIG_HW_RANDOM is not set
 # CONFIG_NVRAM is not set
-# CONFIG_RTC is not set
+CONFIG_RTC=y
 # CONFIG_GEN_RTC is not set
 # CONFIG_DTLK is not set
 # CONFIG_R3964 is not set
diff --git a/linux-2.6.11-xen-sparse/arch/xen/x86_64/kernel/entry.S b/linux-2.6.11-xen-sparse/arch/xen/x86_64/kernel/entry.S
index c0569ffc4a..3f28d0e04e 100644
--- a/linux-2.6.11-xen-sparse/arch/xen/x86_64/kernel/entry.S
+++ b/linux-2.6.11-xen-sparse/arch/xen/x86_64/kernel/entry.S
@@ -109,7 +109,6 @@ VGCF_IN_SYSCALL = (1<<8)
 #define preempt_stop
 #define retint_kernel retint_restore_args
 #endif	
-	
 
 /*
  * C code is not supposed to know about undefined top of stack. Every time 
@@ -118,7 +117,15 @@ VGCF_IN_SYSCALL = (1<<8)
  * RESTORE_TOP_OF_STACK syncs the syscall state after any possible ptregs
  * manipulation.
  */        	
-		
+
+	/* %rsp:at FRAMEEND */ 
+	.macro FIXUP_TOP_OF_STACK tmp
+	movq    $__USER_CS,CS(%rsp)
+	movq 	$-1,RCX(%rsp)
+	.endm
+
+	.macro RESTORE_TOP_OF_STACK tmp,offset=0
+	.endm
 
 	.macro FAKE_STACK_FRAME child_rip
 	/* push in order ss, rsp, eflags, cs, rip */
@@ -209,6 +216,7 @@ rff_action:
 	je   int_ret_from_sys_call
 	testl $_TIF_IA32,threadinfo_flags(%rcx)
 	jnz  int_ret_from_sys_call
+	RESTORE_TOP_OF_STACK %rdi,ARGOFFSET
 	jmp ret_from_sys_call
 rff_trace:
 	movq %rsp,%rdi
@@ -311,6 +319,7 @@ sysret_signal:
 tracesys:			 
 	SAVE_REST
 	movq $-ENOSYS,RAX(%rsp)
+	FIXUP_TOP_OF_STACK %rdi
 	movq %rsp,%rdi
 	call syscall_trace_enter
 	LOAD_ARGS ARGOFFSET  /* reload args from stack in case ptrace changed it */
@@ -323,6 +332,7 @@ tracesys:
 1:	SAVE_REST
 	movq %rsp,%rdi
 	call syscall_trace_leave
+	RESTORE_TOP_OF_STACK %rbx
 	RESTORE_REST
 	jmp ret_from_sys_call
 		
@@ -421,7 +431,9 @@ ENTRY(ptregscall_common)
 	CFI_ADJUST_CFA_OFFSET	-8
 	SAVE_REST
 	movq %r11, %r15
+	FIXUP_TOP_OF_STACK %r11
 	call *%rax
+	RESTORE_TOP_OF_STACK %r11
 	movq %r15, %r11
 	RESTORE_REST
 	pushq %r11
@@ -435,10 +447,12 @@ ENTRY(stub_execve)
 	CFI_ADJUST_CFA_OFFSET	-8
 	SAVE_REST
 	movq %r11, %r15
+	FIXUP_TOP_OF_STACK %r11
 	call sys_execve
 	GET_THREAD_INFO(%rcx)
 	bt $TIF_IA32,threadinfo_flags(%rcx)
 	jc exec_32bit
+	RESTORE_TOP_OF_STACK %r11
 	movq %r15, %r11
 	RESTORE_REST
 	push %r11
@@ -460,6 +474,7 @@ ENTRY(stub_rt_sigreturn)
 	addq $8, %rsp		
 	SAVE_REST
 	movq %rsp,%rdi
+	FIXUP_TOP_OF_STACK %r11
 	call sys_rt_sigreturn
 	movq %rax,RAX(%rsp) # fixme, this could be done at the higher layer
 	RESTORE_REST
diff --git a/tools/ioemu/Makefile b/tools/ioemu/Makefile
index 502413fc8a..d99da37ef4 100644
--- a/tools/ioemu/Makefile
+++ b/tools/ioemu/Makefile
@@ -51,23 +51,9 @@ common  de-ch  es     fo  fr-ca  hu     ja  mk  nl-be      pt  sl     tr
 
 install: all 
 	mkdir -p "$(bindir)"
-ifndef CONFIG_WIN32
-#	install -m 755 -s $(TOOLS) "$(bindir)"
-endif
 	mkdir -p "$(DESTDIR)/$(datadir)"
-	install -m 644 pc-bios/bios.bin pc-bios/vgabios.bin \
-                       pc-bios/vgabios-cirrus.bin \
-                       pc-bios/ppc_rom.bin \
-                       pc-bios/proll.bin \
-                       pc-bios/linux_boot.bin "$(DESTDIR)/$(datadir)"
-	#mkdir -p "$(DESTDIR)/$(docdir)"
-	#install -m 644 qemu-doc.html  qemu-tech.html "$(DESTDIR)/$(docdir)"
-ifndef CONFIG_WIN32
-	#mkdir -p "$(DESTDIR)/$(mandir)/man1"
-	#install qemu.1 qemu-mkcow.1 "$(DESTDIR)/$(mandir)/man1"
 	mkdir -p "$(DESTDIR)/$(datadir)/keymaps"
 	install -m 644 $(addprefix keymaps/,$(KEYMAPS)) "$(DESTDIR)/$(datadir)/keymaps"
-endif
 	for d in $(TARGET_DIRS); do \
 	$(MAKE) -C $$d $@ || exit 1 ; \
         done
@@ -105,14 +91,6 @@ tarbin:
         $(DESTDIR)/$(bindir)/qemu-arm \
         $(DESTDIR)/$(bindir)/qemu-sparc \
         $(DESTDIR)/$(bindir)/qemu-ppc \
-	$(DESTDIR)/$(datadir)/bios.bin \
-	$(DESTDIR)/$(datadir)/vgabios.bin \
-	$(DESTDIR)/$(datadir)/vgabios-cirrus.bin \
-	$(DESTDIR)/$(datadir)/ppc_rom.bin \
-	$(DESTDIR)/$(datadir)/proll.bin \
-	$(DESTDIR)/$(datadir)/linux_boot.bin \
-	$(DESTDIR)/$(docdir)/qemu-doc.html \
-	$(DESTDIR)/$(docdir)/qemu-tech.html \
 	$(DESTDIR)/$(mandir)/man1/qemu.1 $(DESTDIR)/$(mandir)/man1/qemu-mkcow.1 )
 
 ifneq ($(wildcard .depend),)
diff --git a/tools/ioemu/pc-bios/Makefile b/tools/ioemu/pc-bios/Makefile
deleted file mode 100644
index 7ae0ff02a0..0000000000
--- a/tools/ioemu/pc-bios/Makefile
+++ /dev/null
@@ -1,24 +0,0 @@
-#
-# NOTE: only compilable with x86 cross compile tools
-#
-include ../config-host.mak
-
-DEFINES=
-
-TARGETS=
-ifeq ($(ARCH),i386)
-TARGETS+=linux_boot.bin
-endif
-
-all: $(TARGETS)
-
-linux_boot.bin: linux_boot.o
-	ld --oformat binary -Ttext 0 -o $@ $<
-	chmod a-x $@
-
-%.o: %.S
-	$(CC) $(DEFINES) -c -o $@ $<
-
-clean:
-	rm -f $(TARGETS) *.o *~
-
diff --git a/tools/ioemu/pc-bios/README b/tools/ioemu/pc-bios/README
deleted file mode 100644
index a10a9f0dfa..0000000000
--- a/tools/ioemu/pc-bios/README
+++ /dev/null
@@ -1,13 +0,0 @@
-- The PC BIOS comes from the Bochs project
-  (http://bochs.sourceforge.net/). A patch from bios.diff was applied.
-
-- The VGA BIOS and the Cirrus VGA BIOS come from the LGPL VGA bios
-  project (http://www.nongnu.org/vgabios/).
-
-- The PowerPC Open Hack'Ware Open Firmware Compatible BIOS is
-  available at http://site.voila.fr/jmayer/OpenHackWare/index.htm.
-
-- Proll is a GPL'd boot PROM for Sparc JavaStations
-  (http://people.redhat.com/zaitcev/linux/).
-  Applying proll.patch allows circumventing some bugs and enables
-  faster kernel load through a hack.
diff --git a/tools/ioemu/pc-bios/bios.bin b/tools/ioemu/pc-bios/bios.bin
deleted file mode 100644
index fe9816e0a7..0000000000
--- a/tools/ioemu/pc-bios/bios.bin
+++ /dev/null
diff --git a/tools/ioemu/pc-bios/bios.diff b/tools/ioemu/pc-bios/bios.diff
deleted file mode 100644
index 7850769642..0000000000
--- a/tools/ioemu/pc-bios/bios.diff
+++ /dev/null
@@ -1,162 +0,0 @@
-Index: rombios.c
-===================================================================
-RCS file: /cvsroot/bochs/bochs/bios/rombios.c,v
-retrieving revision 1.110
-diff -u -w -r1.110 rombios.c
---- rombios.c	31 May 2004 13:11:27 -0000	1.110
-+++ rombios.c	7 Oct 2004 21:23:50 -0000
-@@ -137,6 +137,7 @@
- #define DEBUG_INT16        0
- #define DEBUG_INT1A        0
- #define DEBUG_INT74        0
-+#define DEBUG_APM          0
- 
- #define BX_CPU           3
- #define BX_USE_PS2_MOUSE 1
-@@ -145,6 +146,7 @@
- #define BX_SUPPORT_FLOPPY 1
- #define BX_FLOPPY_ON_CNT 37   // 2 seconds
- #define BX_PCIBIOS       1
-+#define BX_APM           1
- 
- #define BX_USE_ATADRV    1
- #define BX_ELTORITO_BOOT 1
-@@ -230,17 +232,6 @@
-   out dx,ax
- MEND
- 
--MACRO HALT2
--  ;; the HALT macro is called with the line number of the HALT call.
--  ;; The line number is then sent to the PANIC_PORT, causing Bochs/Plex
--  ;; to print a BX_PANIC message.  This will normally halt the simulation
--  ;; with a message such as "BIOS panic at rombios.c, line 4091".
--  ;; However, users can choose to make panics non-fatal and continue.
--  mov dx,#PANIC_PORT2
--  mov ax,#?1
--  out dx,ax
--MEND
--
- MACRO JMP_AP
-   db 0xea
-   dw ?2
-@@ -1543,15 +1534,12 @@
-     }
- 
-   if (action & BIOS_PRINTF_HALT) {
--    // freeze in a busy loop.  If I do a HLT instruction, then in versions
--    // 1.3.pre1 and earlier, it will panic without ever updating the VGA
--    // display, so the panic message will not be visible.  By waiting
--    // forever, you are certain to see the panic message on screen.
--    // After a few more versions have passed, we can turn this back into
--    // a halt or something.
--    // do {} while (1);
-+    // freeze in a busy loop.  
- ASM_START
--    HALT2(__LINE__)
-+    cli
-+ halt2_loop:
-+    hlt
-+    jmp halt2_loop
- ASM_END
-     }
- }
-@@ -5412,8 +5400,8 @@
-         case 0x03: SET_BL( 0x06 ); break;
-         }
- 
--      DI = 0xefc7;
--      ES = 0xf000;
-+      DI = read_word(0x00, 0x1e*4); // INT vector 0x1E
-+      ES = read_word(0x00, 0x1e*4+2);
-       goto int13_success;
-       break;
- 
-@@ -6984,8 +6972,8 @@
-         }
- 
-       /* set es & di to point to 11 byte diskette param table in ROM */
--      DI = 0xefc7;
--      ES = 0xf000;
-+      DI = read_word(0x00, 0x1e*4); // INT vector 0x1E
-+      ES = read_word(0x00, 0x1e*4+2);
-       CLEAR_CF(); // success
-       /* disk status not changed upon success */
-       return;
-@@ -7880,7 +7868,7 @@
-   mov  al, #0x02
-   out  #0x0a, al   ;; clear DMA-1 channel 2 mask bit
- 
--  SET_INT_VECTOR(0x1E, #0xF000, #diskette_param_table)
-+  SET_INT_VECTOR(0x1E, #0xF000, #diskette_param_table2)
-   SET_INT_VECTOR(0x40, #0xF000, #int13_diskette)
-   SET_INT_VECTOR(0x0E, #0xF000, #int0e_handler) ;; IRQ 6
- 
-@@ -8344,6 +8332,19 @@
-   pop   ax
-   iret
- 
-+
-+;--------------------
-+#if BX_APM
-+use32 386
-+#define APM_PROT32
-+#include "apmbios.S"
-+use16 386
-+
-+#define APM_REAL
-+#include "apmbios.S"
-+
-+#endif
-+
- ;--------------------
- #if BX_PCIBIOS
- use32 386
-@@ -9515,6 +9516,26 @@
-   pop  ds
-   iret
- 
-+diskette_param_table2:
-+;;  New diskette parameter table adding 3 parameters from IBM
-+;;  Since no provisions are made for multiple drive types, most
-+;;  values in this table are ignored.  I set parameters for 1.44M
-+;;  floppy here
-+db  0xAF
-+db  0x02 ;; head load time 0000001, DMA used
-+db  0x25
-+db  0x02
-+db    18
-+db  0x1B
-+db  0xFF
-+db  0x6C
-+db  0xF6
-+db  0x0F
-+db  0x08
-+db    79 ;; maximum track
-+db     0 ;; data transfer rate
-+db     4 ;; drive type in cmos
-+
- .org 0xf045 ; INT 10 Functions 0-Fh Entry Point
-   HALT(__LINE__)
-   iret
-@@ -9560,6 +9581,10 @@
- .org 0xf859 ; INT 15h System Services Entry Point
- int15_handler:
-   pushf
-+#if BX_APM
-+  cmp ah, #0x53
-+  je apm_call
-+#endif
-   push  ds
-   push  es
-   pushad
-@@ -9570,6 +9595,10 @@
-   popf
-   //JMPL(iret_modify_cf)
-   jmp iret_modify_cf
-+#if BX_APM
-+apm_call:
-+  jmp _apmreal_entry
-+#endif
- 
- ;; Protected mode IDT descriptor
- ;;
diff --git a/tools/ioemu/pc-bios/linux_boot.S b/tools/ioemu/pc-bios/linux_boot.S
deleted file mode 100644
index 22fcd4be80..0000000000
--- a/tools/ioemu/pc-bios/linux_boot.S
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * QEMU Boot sector to launch a preloaded Linux kernel
- * Copyright (c) 2004 Fabrice Bellard
- */
-
-#define LOAD_SEG 0x9000
-        
-.code16	
-.text
-	.globl	_start
-
-_start:
-        cli
-        cld
-        mov $LOAD_SEG, %ax
-        mov %ax, %ds
-        mov %ax, %es
-        mov %ax, %fs
-        mov %ax, %gs
-        mov %ax, %ss
-        mov $0x8ffe, %sp
-        ljmp $LOAD_SEG + 0x20, $0
-
-1:              
-        .fill 510 - (1b - _start), 1, 0
-
-        /* boot sector signature */
-        .byte 0x55
-        .byte 0xaa
diff --git a/tools/ioemu/pc-bios/linux_boot.bin b/tools/ioemu/pc-bios/linux_boot.bin
deleted file mode 100644
index 80f7b5fee1..0000000000
--- a/tools/ioemu/pc-bios/linux_boot.bin
+++ /dev/null
diff --git a/tools/ioemu/pc-bios/ppc_rom.bin b/tools/ioemu/pc-bios/ppc_rom.bin
deleted file mode 100644
index d882dee3e3..0000000000
--- a/tools/ioemu/pc-bios/ppc_rom.bin
+++ /dev/null
diff --git a/tools/ioemu/pc-bios/proll.bin b/tools/ioemu/pc-bios/proll.bin
deleted file mode 100644
index 0489cc245f..0000000000
--- a/tools/ioemu/pc-bios/proll.bin
+++ /dev/null
diff --git a/tools/ioemu/pc-bios/proll.patch b/tools/ioemu/pc-bios/proll.patch
deleted file mode 100644
index b0860e26f4..0000000000
--- a/tools/ioemu/pc-bios/proll.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-diff -ru proll_18.orig/mrcoffee/main.c proll_18/mrcoffee/main.c
---- proll_18.orig/mrcoffee/main.c	2002-09-13 16:16:59.000000000 +0200
-+++ proll_18/mrcoffee/main.c	2004-09-26 11:52:23.000000000 +0200
-@@ -101,6 +101,7 @@
- 	le_probe();
- 	init_net();
- 
-+#ifdef ORIG
- #if 0 /* RARP */
- 	if (rarp() != 0) fatal();
- 	/* printrarp(); */
-@@ -117,13 +118,20 @@
- 	xtoa(myipaddr, fname, 8);
- 	if (load(boot_rec.bp_siaddr, fname) != 0) fatal();
- #endif
-+#endif
- 
- 	romvec = init_openprom(bb.nbanks, bb.bankv, hiphybas);
- 
- 	printk("Memory used: virt 0x%x:0x%x[%dK] iomap 0x%x:0x%x\n",
- 	    PROLBASE, (int)cmem.curp, ((unsigned) cmem.curp - PROLBASE)/1024,
- 	    (int)cio.start, (int)cio.curp);
-+#ifdef ORIG
- 	set_timeout(5);  while (!chk_timeout()) { }  /* P3: let me read */
-+#else
-+	printk("loading kernel:");
-+	i = ld_bypass(0x20000000);
-+	printk(" done, size %d\n", i);
-+#endif
- 
- 	{
- 		void (*entry)(void *, int) = (void (*)(void*, int)) LOADBASE;
-diff -ru proll_18.orig/mrcoffee/openprom.c proll_18/mrcoffee/openprom.c
---- proll_18.orig/mrcoffee/openprom.c	2002-09-13 16:17:03.000000000 +0200
-+++ proll_18/mrcoffee/openprom.c	2004-09-21 21:27:16.000000000 +0200
-@@ -144,10 +144,14 @@
- };
- 
- static int cpu_nctx = NCTX_SWIFT;
-+static int cpu_cache_line_size = 0x20;
-+static int cpu_cache_nlines = 0x200;
- static struct property propv_cpu[] = {
- 	{"name",	"STP1012PGA", sizeof("STP1012PGA") },
- 	{"device_type",	"cpu", 4 },
- 	{"mmu-nctx",	(char*)&cpu_nctx, sizeof(int)},
-+	{"cache-line-size",	(char*)&cpu_cache_line_size, sizeof(int)},
-+	{"cache-nlines",	(char*)&cpu_cache_nlines, sizeof(int)},
- 	{NULL, NULL, -1}
- };
- 
diff --git a/tools/ioemu/pc-bios/vgabios-cirrus.bin b/tools/ioemu/pc-bios/vgabios-cirrus.bin
deleted file mode 100644
index 4e3c829545..0000000000
--- a/tools/ioemu/pc-bios/vgabios-cirrus.bin
+++ /dev/null
diff --git a/tools/ioemu/pc-bios/vgabios.bin b/tools/ioemu/pc-bios/vgabios.bin
deleted file mode 100644
index ed31b12b13..0000000000
--- a/tools/ioemu/pc-bios/vgabios.bin
+++ /dev/null
diff --git a/tools/python/xen/lowlevel/xs/xs.c b/tools/python/xen/lowlevel/xs/xs.c
index 98d7826809..6ecddc6fd4 100644
--- a/tools/python/xen/lowlevel/xs/xs.c
+++ b/tools/python/xen/lowlevel/xs/xs.c
@@ -85,7 +85,7 @@ static PyObject *xspy_read(PyObject *self, PyObject *args, PyObject *kwds)
 
     struct xs_handle *xh = xshandle(self);
     char *xsval = NULL;
-    int xsval_n = 0;
+    unsigned int xsval_n = 0;
     PyObject *val = NULL;
 
     if (!xh)
@@ -134,7 +134,7 @@ static PyObject *xspy_ls(PyObject *self, PyObject *args, PyObject *kwds)
     struct xs_handle *xh = xshandle(self);
     PyObject *val = NULL;
     char **xsval = NULL;
-    int xsval_n = 0;
+    unsigned int xsval_n = 0;
     int i;
 
     if (!xh)
@@ -183,7 +183,7 @@ static PyObject *xspy_get_permissions(PyObject *self, PyObject *args,
     struct xs_handle *xh = xshandle(self);
     PyObject *val = NULL;
     struct xs_permissions *perms;
-    int perms_n = 0;
+    unsigned int perms_n = 0;
     int i;
 
     if (!xh)
diff --git a/tools/python/xen/lowlevel/xu/xu.c b/tools/python/xen/lowlevel/xu/xu.c
index 359cb71a2d..65660ba6dc 100644
--- a/tools/python/xen/lowlevel/xu/xu.c
+++ b/tools/python/xen/lowlevel/xu/xu.c
@@ -908,7 +908,6 @@ static PyObject *xu_message_new(PyObject *self, PyObject *args)
         break;
     case TYPE(CMSG_MEM_REQUEST, CMSG_MEM_REQUEST_SET):
         P2C(mem_request_t, target, u32);
-        P2C(mem_request_t, status, u32);
         break;
     case TYPE(CMSG_USBIF_FE, CMSG_USBIF_FE_INTERFACE_STATUS_CHANGED):
         P2C(usbif_fe_interface_status_changed_t, status, u32);
diff --git a/tools/xenstore/Makefile b/tools/xenstore/Makefile
index b5511aea3c..408078efba 100644
--- a/tools/xenstore/Makefile
+++ b/tools/xenstore/Makefile
@@ -92,8 +92,11 @@ install: xenstored libxenstore.a
 	$(INSTALL_DIR) -p $(DESTDIR)/var/run/xenstored
 	$(INSTALL_DIR) -p $(DESTDIR)/var/lib/xenstored
 	$(INSTALL_DIR) -p $(DESTDIR)/usr/sbin
+	$(INSTALL_DIR) -p $(DESTDIR)/usr/include
 	$(INSTALL_PROG) xenstored $(DESTDIR)/usr/sbin
 	$(INSTALL_DIR) -p $(DESTDIR)/usr/$(LIBDIR)
 	$(INSTALL_DATA) libxenstore.a $(DESTDIR)/usr/$(LIBDIR)
+	$(INSTALL_DATA) xs.h $(DESTDIR)/usr/include
+	$(INSTALL_DATA) xs_lib.h $(DESTDIR)/usr/include
 
 -include $(PROG_DEP)
diff --git a/tools/xenstore/fake_libxc.c b/tools/xenstore/fake_libxc.c
index decfb4001d..50e1db717c 100644
--- a/tools/xenstore/fake_libxc.c
+++ b/tools/xenstore/fake_libxc.c
@@ -71,7 +71,7 @@ int xc_interface_open(void)
 		return fd;
 
 	memset(page, 0, sizeof(page));
-	if (!write_all(fd, page, sizeof(page)))
+	if (!xs_write_all(fd, page, sizeof(page)))
 		barf_perror("Failed to write /tmp/xcmap page");
 	
 	return fd;
diff --git a/tools/xenstore/xenstored_core.c b/tools/xenstore/xenstored_core.c
index 9d15848463..1df00f37b4 100644
--- a/tools/xenstore/xenstored_core.c
+++ b/tools/xenstore/xenstored_core.c
@@ -81,7 +81,7 @@ bool test_write_all(int fd, void *contents, unsigned int len)
 		errno = ENOSPC;
 		return false;
 	}
-	return write_all(fd, contents, len);
+	return xs_write_all(fd, contents, len);
 }
 
 int test_mkdir(const char *dir, int perms);
@@ -443,9 +443,9 @@ static struct xs_permissions *get_perms(struct transaction *transaction,
 	if (!strings)
 		return NULL;
 
-	*num = count_strings(strings, size);
+	*num = xs_count_strings(strings, size);
 	ret = talloc_array(node, struct xs_permissions, *num);
-	if (!strings_to_perms(ret, *num, strings))
+	if (!xs_strings_to_perms(ret, *num, strings))
 		corrupt(NULL, "Permissions corrupt for %s", node);
 
 	return ret;
@@ -460,7 +460,7 @@ static char *perms_to_strings(const char *node,
 	char buffer[MAX_STRLEN(domid_t) + 1];
 
 	for (*len = 0, i = 0; i < num; i++) {
-		if (!perm_to_string(&perms[i], buffer))
+		if (!xs_perm_to_string(&perms[i], buffer))
 			return NULL;
 
 		strings = talloc_realloc(node, strings, char,
@@ -506,7 +506,7 @@ static char *tempfile(const char *path, void *contents, unsigned int len)
 	if (!fd)
 		return NULL;
 	talloc_set_destructor(tmppath, destroy_path);
-	if (!write_all(*fd, contents, len))
+	if (!xs_write_all(*fd, contents, len))
 		return NULL;
 
 	return tmppath;
@@ -617,7 +617,7 @@ bool check_node_perms(struct connection *conn, const char *node,
 		return false;
 	}
 
-	if (!conn->write && (perm & XS_PERM_WRITE)) {
+	if (!conn->can_write && (perm & XS_PERM_WRITE)) {
 		errno = EROFS;
 		return false;
 	}
@@ -721,14 +721,14 @@ static bool new_directory(struct connection *conn,
 	permstr = perms_to_strings(dir, &perms, 1, &len);
 	fd = talloc_open(node_permfile(conn->transaction, node),
 			 O_WRONLY|O_CREAT|O_EXCL, 0640);
-	if (!fd || !write_all(*fd, permstr, len))
+	if (!fd || !xs_write_all(*fd, permstr, len))
 		return false;
 
 	if (data) {
 		char *datapath = node_datafile(conn->transaction, node);
 
 		fd = talloc_open(datapath, O_WRONLY|O_CREAT|O_EXCL, 0640);
-		if (!fd || !write_all(*fd, data, datalen))
+		if (!fd || !xs_write_all(*fd, data, datalen))
 			return false;
 	}
 
@@ -878,7 +878,7 @@ static bool do_set_perms(struct connection *conn, struct buffered_data *in)
 	char *node;
 	struct xs_permissions *perms;
 
-	num = count_strings(in->buffer, in->used);
+	num = xs_count_strings(in->buffer, in->used);
 	if (num < 2)
 		return send_error(conn, EINVAL);
 
@@ -898,7 +898,7 @@ static bool do_set_perms(struct connection *conn, struct buffered_data *in)
 		return send_error(conn, errno);
 
 	perms = talloc_array(node, struct xs_permissions, num);
-	if (!strings_to_perms(perms, num, in->buffer))
+	if (!xs_strings_to_perms(perms, num, in->buffer))
 		return send_error(conn, errno);
 
 	if (!set_perms(conn->transaction, node, perms, num))
@@ -938,6 +938,12 @@ static bool process_message(struct connection *conn, struct buffered_data *in)
 		return do_set_perms(conn, in);
 
 	case XS_SHUTDOWN:
+		/* FIXME: Implement gentle shutdown too. */
+		/* Only tools can do this. */
+		if (conn->id != 0)
+			return send_error(conn, EACCES);
+		if (!conn->can_write)
+			return send_error(conn, EROFS);
 		send_ack(conn, XS_SHUTDOWN);
 		/* Everything hangs off auto-free context, freed at exit. */
 		exit(0);
@@ -1137,6 +1143,7 @@ struct connection *new_connection(connwritefn_t *write, connreadfn_t *read)
 	new->transaction = NULL;
 	new->write = write;
 	new->read = read;
+	new->can_write = true;
 
 	talloc_set_fail_handler(out_of_mem, &talloc_fail);
 	if (setjmp(talloc_fail)) {
@@ -1170,10 +1177,11 @@ static void accept_connection(int sock, bool canwrite)
 	if (fd < 0)
 		return;
 
-	conn = new_connection(canwrite ? writefd : NULL, readfd);
-	if (conn)
+	conn = new_connection(writefd, readfd);
+	if (conn) {
 		conn->fd = fd;
-	else
+		conn->can_write = canwrite;
+	} else
 		close(fd);
 }
 
diff --git a/tools/xenstore/xenstored_core.h b/tools/xenstore/xenstored_core.h
index fe6eec8f72..0d0ebcaae0 100644
--- a/tools/xenstore/xenstored_core.h
+++ b/tools/xenstore/xenstored_core.h
@@ -56,6 +56,9 @@ struct connection
 	/* Are we blocked waiting for a transaction to end?  Contains node. */
 	char *blocked;
 
+	/* Is this a read-only connection? */
+	bool can_write;
+
 	/* Our current event.  If all used, we're waiting for ack. */
 	struct watch_event *event;
 
diff --git a/tools/xenstore/xenstored_domain.c b/tools/xenstore/xenstored_domain.c
index bcc0a64967..a6f69ddf5b 100644
--- a/tools/xenstore/xenstored_domain.c
+++ b/tools/xenstore/xenstored_domain.c
@@ -268,6 +268,9 @@ bool do_introduce(struct connection *conn, struct buffered_data *in)
 	if (get_strings(in, vec, ARRAY_SIZE(vec)) < ARRAY_SIZE(vec))
 		return send_error(conn, EINVAL);
 
+	if (!conn->can_write)
+		return send_error(conn, EROFS);
+
 	/* Hang domain off "in" until we're finished. */
 	domain = talloc(in, struct domain);
 	domain->domid = atoi(vec[0]);
diff --git a/tools/xenstore/xenstored_test.h b/tools/xenstore/xenstored_test.h
index f173a5ca91..cf607cf2e0 100644
--- a/tools/xenstore/xenstored_test.h
+++ b/tools/xenstore/xenstored_test.h
@@ -21,7 +21,7 @@
 
 #ifdef TESTING
 bool test_write_all(int fd, void *contents, unsigned int len);
-#define write_all test_write_all
+#define xs_write_all test_write_all
 
 int test_mkdir(const char *dir, int perms);
 #define mkdir test_mkdir
diff --git a/tools/xenstore/xs.c b/tools/xenstore/xs.c
index d5058abfb3..d6e41380f9 100644
--- a/tools/xenstore/xs.c
+++ b/tools/xenstore/xs.c
@@ -118,7 +118,7 @@ static bool read_all(int fd, void *data, unsigned int len)
 
 #ifdef XSTEST
 #define read_all read_all_choice
-#define write_all write_all_choice
+#define xs_write_all write_all_choice
 #endif
 
 static int get_error(const char *errorstring)
@@ -179,11 +179,11 @@ static void *xs_talkv(struct xs_handle *h, enum xsd_sockmsg_type type,
 	ignorepipe.sa_flags = 0;
 	sigaction(SIGPIPE, &ignorepipe, &oldact);
 
-	if (!write_all(h->fd, &msg, sizeof(msg)))
+	if (!xs_write_all(h->fd, &msg, sizeof(msg)))
 		goto fail;
 
 	for (i = 0; i < num_vecs; i++)
-		if (!write_all(h->fd, iovec[i].iov_base, iovec[i].iov_len))
+		if (!xs_write_all(h->fd, iovec[i].iov_base, iovec[i].iov_len))
 			goto fail;
 
 	/* Watches can have fired before reply comes: daemon detects
@@ -253,7 +253,7 @@ char **xs_directory(struct xs_handle *h, const char *path, unsigned int *num)
 		return NULL;
 
 	/* Count the strings. */
-	*num = count_strings(strings, len);
+	*num = xs_count_strings(strings, len);
 
 	/* Transfer to one big alloc for easy freeing. */
 	ret = malloc(*num * sizeof(char *) + len);
@@ -342,7 +342,7 @@ struct xs_permissions *xs_get_permissions(struct xs_handle *h,
 		return NULL;
 
 	/* Count the strings: each one perms then domid. */
-	*num = count_strings(strings, len);
+	*num = xs_count_strings(strings, len);
 
 	/* Transfer to one big alloc for easy freeing. */
 	ret = malloc(*num * sizeof(struct xs_permissions));
@@ -351,7 +351,7 @@ struct xs_permissions *xs_get_permissions(struct xs_handle *h,
 		return NULL;
 	}
 
-	if (!strings_to_perms(ret, *num, strings)) {
+	if (!xs_strings_to_perms(ret, *num, strings)) {
 		free_no_errno(ret);
 		ret = NULL;
 	}
@@ -376,7 +376,7 @@ bool xs_set_permissions(struct xs_handle *h, const char *path,
 	for (i = 0; i < num_perms; i++) {
 		char buffer[MAX_STRLEN(domid_t)+1];
 
-		if (!perm_to_string(&perms[i], buffer))
+		if (!xs_perm_to_string(&perms[i], buffer))
 			goto unwind;
 
 		iov[i+1].iov_base = strdup(buffer);
diff --git a/tools/xenstore/xs_lib.c b/tools/xenstore/xs_lib.c
index 8630eaffce..3f4f4b0899 100644
--- a/tools/xenstore/xs_lib.c
+++ b/tools/xenstore/xs_lib.c
@@ -48,7 +48,7 @@ const char *xs_daemon_transactions(void)
 }
 
 /* Simple routines for writing to sockets, etc. */
-bool write_all(int fd, const void *data, unsigned int len)
+bool xs_write_all(int fd, const void *data, unsigned int len)
 {
 	while (len) {
 		int done;
@@ -66,7 +66,7 @@ bool write_all(int fd, const void *data, unsigned int len)
 }
 
 /* Convert strings to permissions.  False if a problem. */
-bool strings_to_perms(struct xs_permissions *perms, unsigned int num,
+bool xs_strings_to_perms(struct xs_permissions *perms, unsigned int num,
 		      const char *strings)
 {
 	const char *p;
@@ -104,7 +104,7 @@ bool strings_to_perms(struct xs_permissions *perms, unsigned int num,
 }
 
 /* Convert permissions to a string (up to len MAX_STRLEN(domid_t)+1). */
-bool perm_to_string(const struct xs_permissions *perm, char *buffer)
+bool xs_perm_to_string(const struct xs_permissions *perm, char *buffer)
 {
 	switch (perm->perms) {
 	case XS_PERM_WRITE:
@@ -128,7 +128,7 @@ bool perm_to_string(const struct xs_permissions *perm, char *buffer)
 }
 
 /* Given a string and a length, count how many strings (nul terms). */
-unsigned int count_strings(const char *strings, unsigned int len)
+unsigned int xs_count_strings(const char *strings, unsigned int len)
 {
 	unsigned int num;
 	const char *p;
diff --git a/tools/xenstore/xs_lib.h b/tools/xenstore/xs_lib.h
index a946ab0b19..76ea9b67fe 100644
--- a/tools/xenstore/xs_lib.h
+++ b/tools/xenstore/xs_lib.h
@@ -48,16 +48,16 @@ const char *xs_daemon_store(void);
 const char *xs_daemon_transactions(void);
 
 /* Simple write function: loops for you. */
-bool write_all(int fd, const void *data, unsigned int len);
+bool xs_write_all(int fd, const void *data, unsigned int len);
 
 /* Convert strings to permissions.  False if a problem. */
-bool strings_to_perms(struct xs_permissions *perms, unsigned int num,
+bool xs_strings_to_perms(struct xs_permissions *perms, unsigned int num,
 		      const char *strings);
 
 /* Convert permissions to a string (up to len MAX_STRLEN(domid_t)+1). */
-bool perm_to_string(const struct xs_permissions *perm, char *buffer);
+bool xs_perm_to_string(const struct xs_permissions *perm, char *buffer);
 
 /* Given a string and a length, count how many strings (nul terms). */
-unsigned int count_strings(const char *strings, unsigned int len);
+unsigned int xs_count_strings(const char *strings, unsigned int len);
 
 #endif /* _XS_LIB_H */
diff --git a/tools/xenstore/xs_random.c b/tools/xenstore/xs_random.c
index ef5d44d0b0..675cc89093 100644
--- a/tools/xenstore/xs_random.c
+++ b/tools/xenstore/xs_random.c
@@ -223,10 +223,10 @@ static struct xs_permissions *file_get_perms(struct file_ops_info *info,
 		release_file(perms, size);
 		return ret;
 	}
-	*num = count_strings(perms, size);
+	*num = xs_count_strings(perms, size);
 
 	ret = new_array(struct xs_permissions, *num);
-	if (!strings_to_perms(ret, *num, perms))
+	if (!xs_strings_to_perms(ret, *num, perms))
 		barf("Reading permissions from %s", permfile);
 	release_file(perms, size);
 	return ret;
@@ -267,7 +267,7 @@ static bool file_set_perms(struct file_ops_info *info,
 	for (i = 0; i < num; i++) {
 		char buffer[100];
 
-		if (!perm_to_string(&perms[i], buffer)) {
+		if (!xs_perm_to_string(&perms[i], buffer)) {
 			int saved_errno = errno;
 			close(fd);
 			errno = saved_errno;
@@ -536,7 +536,7 @@ static char *dump_dir(struct ops *ops,
 		ret = talloc_asprintf_append(ret, "%s%s: ", spacing, dir[i]);
 		for (j = 0; j < numperms; j++) {
 			char buffer[100];
-			if (!perm_to_string(&perms[j], buffer))
+			if (!xs_perm_to_string(&perms[j], buffer))
 				barf("perm to string");
 			ret = talloc_asprintf_append(ret, "%s ", buffer);
 		}
diff --git a/tools/xenstore/xs_test.c b/tools/xenstore/xs_test.c
index f1e66cbe28..4d769e220d 100644
--- a/tools/xenstore/xs_test.c
+++ b/tools/xenstore/xs_test.c
@@ -153,7 +153,7 @@ static bool write_all_choice(int fd, const void *data, unsigned int len)
 {
 	if (fd == -2)
 		return write_all_shmem(fd, data, len);
-	return write_all(fd, data, len);
+	return xs_write_all(fd, data, len);
 }
 
 /* We want access to internal functions. */
@@ -176,11 +176,11 @@ static void __attribute__((noreturn)) usage(void)
 	     "  watch <path> <prio>\n"
 	     "  waitwatch\n"
 	     "  ackwatch\n"
-	     "  unwatch <path>\n"
+	     "  unwatch <path> <token>\n"
 	     "  close\n"
 	     "  start <node>\n"
 	     "  abort\n"
-	     "  introduce <domid> <mfn> <eventchn>\n"
+	     "  introduce <domid> <mfn> <eventchn> <path>\n"
 	     "  commit\n"
 	     "  sleep <seconds>\n"
 	     "  dump\n");
@@ -491,7 +491,7 @@ static void dump_dir(unsigned int handle,
 		printf("%s%s: ", spacing, dir[i]);
 		for (j = 0; j < numperms; j++) {
 			char buffer[100];
-			if (!perm_to_string(&perms[j], buffer))
+			if (!xs_perm_to_string(&perms[j], buffer))
 				barf("perm to string");
 			printf("%s ", buffer);
 		}
diff --git a/xen/arch/ia64/vmx_init.c b/xen/arch/ia64/vmx_init.c
index 87c1339ea4..f89659ba0c 100644
--- a/xen/arch/ia64/vmx_init.c
+++ b/xen/arch/ia64/vmx_init.c
@@ -41,6 +41,7 @@
 #include <public/arch-ia64.h>
 #include <asm/vmx_phy_mode.h>
 #include <asm/vmx.h>
+#include <xen/mm.h>
 
 /* Global flag to identify whether Intel vmx feature is on */
 u32 vmx_enabled = 0;
diff --git a/xen/arch/ia64/xenmem.c b/xen/arch/ia64/xenmem.c
index 29788d2a3f..3a749840a0 100644
--- a/xen/arch/ia64/xenmem.c
+++ b/xen/arch/ia64/xenmem.c
@@ -11,7 +11,7 @@
 
 #include <linux/config.h>
 #include <asm/pgtable.h>
-#include <asm/mm.h>
+#include <xen/mm.h>
 
 extern struct page *zero_page_memmap_ptr;
 struct pfn_info *frame_table;
diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c
index b892e15955..169138667d 100644
--- a/xen/arch/x86/domain.c
+++ b/xen/arch/x86/domain.c
@@ -414,7 +414,7 @@ int arch_set_info_guest(
         /* Ensure real hardware interrupts are enabled. */
         v->arch.guest_context.user_regs.eflags |= EF_IE;
     } else {
-        __vmwrite(GUEST_EFLAGS, v->arch.guest_context.user_regs.eflags);
+        __vmwrite(GUEST_RFLAGS, v->arch.guest_context.user_regs.eflags);
         if (v->arch.guest_context.user_regs.eflags & EF_TF)
                 __vm_set_bit(EXCEPTION_BITMAP, EXCEPTION_BITMAP_DB);
         else 
diff --git a/xen/arch/x86/traps.c b/xen/arch/x86/traps.c
index cf7aaa3d19..2986d9c2b5 100644
--- a/xen/arch/x86/traps.c
+++ b/xen/arch/x86/traps.c
@@ -423,6 +423,7 @@ asmlinkage int do_page_fault(struct cpu_user_regs *regs)
         }
 
         if ( (addr < HYPERVISOR_VIRT_START) &&
+             KERNEL_MODE(v, regs) &&
              ((regs->error_code & 3) == 3) && /* write-protection fault */
              ptwr_do_page_fault(d, addr) )
         {
diff --git a/xen/arch/x86/vmx.c b/xen/arch/x86/vmx.c
index ffc22f638b..d4a16823eb 100644
--- a/xen/arch/x86/vmx.c
+++ b/xen/arch/x86/vmx.c
@@ -114,8 +114,8 @@ static void inline __update_guest_eip(unsigned long inst_len)
 {
     unsigned long current_eip;
 
-    __vmread(GUEST_EIP, &current_eip);
-    __vmwrite(GUEST_EIP, current_eip + inst_len);
+    __vmread(GUEST_RIP, &current_eip);
+    __vmwrite(GUEST_RIP, current_eip + inst_len);
 }
 
 
@@ -128,7 +128,7 @@ static int vmx_do_page_fault(unsigned long va, struct cpu_user_regs *regs)
 
 #if VMX_DEBUG
     {
-        __vmread(GUEST_EIP, &eip);
+        __vmread(GUEST_RIP, &eip);
         VMX_DBG_LOG(DBG_LEVEL_VMMU, 
                 "vmx_do_page_fault = 0x%lx, eip = %lx, error_code = %lx",
                 va, eip, (unsigned long)regs->error_code);
@@ -152,7 +152,7 @@ static int vmx_do_page_fault(unsigned long va, struct cpu_user_regs *regs)
 #if 0
     if ( !result )
     {
-        __vmread(GUEST_EIP, &eip);
+        __vmread(GUEST_RIP, &eip);
         printk("vmx pgfault to guest va=%p eip=%p\n", va, eip);
     }
 #endif
@@ -180,7 +180,7 @@ static void vmx_do_general_protection_fault(struct cpu_user_regs *regs)
     unsigned long eip, error_code;
     unsigned long intr_fields;
 
-    __vmread(GUEST_EIP, &eip);
+    __vmread(GUEST_RIP, &eip);
     __vmread(VM_EXIT_INTR_ERROR_CODE, &error_code);
 
     VMX_DBG_LOG(DBG_LEVEL_1,
@@ -207,7 +207,7 @@ static void vmx_vmexit_do_cpuid(unsigned long input, struct cpu_user_regs *regs)
     unsigned int eax, ebx, ecx, edx;
     unsigned long eip;
 
-    __vmread(GUEST_EIP, &eip);
+    __vmread(GUEST_RIP, &eip);
 
     VMX_DBG_LOG(DBG_LEVEL_1, 
                 "do_cpuid: (eax) %lx, (ebx) %lx, (ecx) %lx, (edx) %lx,"
@@ -245,7 +245,7 @@ static void vmx_dr_access (unsigned long exit_qualification, struct cpu_user_reg
     struct vcpu *v = current;
     unsigned long eip;
 
-    __vmread(GUEST_EIP, &eip);
+    __vmread(GUEST_RIP, &eip);
 
     reg = exit_qualification & DEBUG_REG_ACCESS_NUM;
 
@@ -274,7 +274,7 @@ static void vmx_dr_access (unsigned long exit_qualification, struct cpu_user_reg
             v->arch.guest_context.debugreg[reg] = *reg_p; 
         else {
             unsigned long value;
-            __vmread(GUEST_ESP, &value);
+            __vmread(GUEST_RSP, &value);
             v->arch.guest_context.debugreg[reg] = value;
         }
         break;
@@ -282,7 +282,7 @@ static void vmx_dr_access (unsigned long exit_qualification, struct cpu_user_reg
         if (reg != REG_ESP)
             *reg_p = v->arch.guest_context.debugreg[reg];
         else {
-            __vmwrite(GUEST_ESP, v->arch.guest_context.debugreg[reg]);
+            __vmwrite(GUEST_RSP, v->arch.guest_context.debugreg[reg]);
         }
         break;
     }
@@ -297,7 +297,7 @@ static void vmx_vmexit_do_invlpg(unsigned long va)
     unsigned long eip;
     struct vcpu *v = current;
 
-    __vmread(GUEST_EIP, &eip);
+    __vmread(GUEST_RIP, &eip);
 
     VMX_DBG_LOG(DBG_LEVEL_VMMU, "vmx_vmexit_do_invlpg: eip=%lx, va=%lx",
                 eip, va);
@@ -368,9 +368,9 @@ static void vmx_io_instruction(struct cpu_user_regs *regs,
     unsigned long eip, cs, eflags;
     int vm86;
 
-    __vmread(GUEST_EIP, &eip);
+    __vmread(GUEST_RIP, &eip);
     __vmread(GUEST_CS_SELECTOR, &cs);
-    __vmread(GUEST_EFLAGS, &eflags);
+    __vmread(GUEST_RFLAGS, &eflags);
     vm86 = eflags & X86_EFLAGS_VM ? 1 : 0;
 
     VMX_DBG_LOG(DBG_LEVEL_1, 
@@ -495,10 +495,10 @@ vmx_world_save(struct vcpu *d, struct vmx_assist_context *c)
     int error = 0;
 
     error |= __vmread(INSTRUCTION_LEN, &inst_len);
-    error |= __vmread(GUEST_EIP, &c->eip);
+    error |= __vmread(GUEST_RIP, &c->eip);
     c->eip += inst_len; /* skip transition instruction */
-    error |= __vmread(GUEST_ESP, &c->esp);
-    error |= __vmread(GUEST_EFLAGS, &c->eflags);
+    error |= __vmread(GUEST_RSP, &c->esp);
+    error |= __vmread(GUEST_RFLAGS, &c->eflags);
 
     error |= __vmread(CR0_READ_SHADOW, &c->cr0);
     c->cr3 = d->arch.arch_vmx.cpu_cr3;
@@ -559,9 +559,9 @@ vmx_world_restore(struct vcpu *d, struct vmx_assist_context *c)
     unsigned long mfn, old_cr4;
     int error = 0;
 
-    error |= __vmwrite(GUEST_EIP, c->eip);
-    error |= __vmwrite(GUEST_ESP, c->esp);
-    error |= __vmwrite(GUEST_EFLAGS, c->eflags);
+    error |= __vmwrite(GUEST_RIP, c->eip);
+    error |= __vmwrite(GUEST_RSP, c->esp);
+    error |= __vmwrite(GUEST_RFLAGS, c->eflags);
 
     error |= __vmwrite(CR0_READ_SHADOW, c->cr0);
 
@@ -783,25 +783,25 @@ static int vmx_set_cr0(unsigned long value)
      * a partition disables the CR0.PE bit.
      */
     if ((value & X86_CR0_PE) == 0) {
-	__vmread(GUEST_EIP, &eip);
+	__vmread(GUEST_RIP, &eip);
 	VMX_DBG_LOG(DBG_LEVEL_1,
 	    "Disabling CR0.PE at %%eip 0x%lx\n", eip);
 	if (vmx_assist(d, VMX_ASSIST_INVOKE)) {
 	    set_bit(VMX_CPU_STATE_ASSIST_ENABLED, &d->arch.arch_vmx.cpu_state);
-	    __vmread(GUEST_EIP, &eip);
+	    __vmread(GUEST_RIP, &eip);
 	    VMX_DBG_LOG(DBG_LEVEL_1,
 		"Transfering control to vmxassist %%eip 0x%lx\n", eip);
 	    return 0; /* do not update eip! */
 	}
     } else if (test_bit(VMX_CPU_STATE_ASSIST_ENABLED,
 					&d->arch.arch_vmx.cpu_state)) {
-	__vmread(GUEST_EIP, &eip);
+	__vmread(GUEST_RIP, &eip);
 	VMX_DBG_LOG(DBG_LEVEL_1,
 	    "Enabling CR0.PE at %%eip 0x%lx\n", eip);
 	if (vmx_assist(d, VMX_ASSIST_RESTORE)) {
 	    clear_bit(VMX_CPU_STATE_ASSIST_ENABLED,
 					&d->arch.arch_vmx.cpu_state);
-	    __vmread(GUEST_EIP, &eip);
+	    __vmread(GUEST_RIP, &eip);
 	    VMX_DBG_LOG(DBG_LEVEL_1,
 		"Restoring to %%eip 0x%lx\n", eip);
 	    return 0; /* do not update eip! */
@@ -832,7 +832,7 @@ static int mov_to_cr(int gp, int cr, struct cpu_user_regs *regs)
         CASE_GET_REG(ESI, esi);
         CASE_GET_REG(EDI, edi);
     case REG_ESP:
-        __vmread(GUEST_ESP, &value);
+        __vmread(GUEST_RSP, &value);
         break;
     default:
         printk("invalid gp: %d\n", gp);
@@ -953,7 +953,7 @@ static void mov_from_cr(int cr, int gp, struct cpu_user_regs *regs)
         CASE_SET_REG(ESI, esi);
         CASE_SET_REG(EDI, edi);
     case REG_ESP:
-        __vmwrite(GUEST_ESP, value);
+        __vmwrite(GUEST_RSP, value);
         regs->esp = value;
         break;
     default:
@@ -1025,7 +1025,7 @@ static inline void vmx_vmexit_do_hlt(void)
 {
 #if VMX_DEBUG
     unsigned long eip;
-    __vmread(GUEST_EIP, &eip);
+    __vmread(GUEST_RIP, &eip);
 #endif
     VMX_DBG_LOG(DBG_LEVEL_1, "vmx_vmexit_do_hlt:eip=%lx", eip);
     raise_softirq(SCHEDULE_SOFTIRQ);
@@ -1035,7 +1035,7 @@ static inline void vmx_vmexit_do_mwait(void)
 {
 #if VMX_DEBUG
     unsigned long eip;
-    __vmread(GUEST_EIP, &eip);
+    __vmread(GUEST_RIP, &eip);
 #endif
     VMX_DBG_LOG(DBG_LEVEL_1, "vmx_vmexit_do_mwait:eip=%lx", eip);
     raise_softirq(SCHEDULE_SOFTIRQ);
@@ -1064,10 +1064,10 @@ static void vmx_print_line(const char c, struct vcpu *d)
 void save_vmx_cpu_user_regs(struct cpu_user_regs *ctxt)
 {
     __vmread(GUEST_SS_SELECTOR, &ctxt->ss);
-    __vmread(GUEST_ESP, &ctxt->esp);
-    __vmread(GUEST_EFLAGS, &ctxt->eflags);
+    __vmread(GUEST_RSP, &ctxt->esp);
+    __vmread(GUEST_RFLAGS, &ctxt->eflags);
     __vmread(GUEST_CS_SELECTOR, &ctxt->cs);
-    __vmread(GUEST_EIP, &ctxt->eip);
+    __vmread(GUEST_RIP, &ctxt->eip);
 
     __vmread(GUEST_GS_SELECTOR, &ctxt->gs);
     __vmread(GUEST_FS_SELECTOR, &ctxt->fs);
@@ -1079,10 +1079,10 @@ void save_vmx_cpu_user_regs(struct cpu_user_regs *ctxt)
 void save_cpu_user_regs(struct cpu_user_regs *regs)
 {
     __vmread(GUEST_SS_SELECTOR, &regs->xss);
-    __vmread(GUEST_ESP, &regs->esp);
-    __vmread(GUEST_EFLAGS, &regs->eflags);
+    __vmread(GUEST_RSP, &regs->esp);
+    __vmread(GUEST_RFLAGS, &regs->eflags);
     __vmread(GUEST_CS_SELECTOR, &regs->xcs);
-    __vmread(GUEST_EIP, &regs->eip);
+    __vmread(GUEST_RIP, &regs->eip);
 
     __vmread(GUEST_GS_SELECTOR, &regs->xgs);
     __vmread(GUEST_FS_SELECTOR, &regs->xfs);
@@ -1093,10 +1093,10 @@ void save_cpu_user_regs(struct cpu_user_regs *regs)
 void restore_cpu_user_regs(struct cpu_user_regs *regs)
 {
     __vmwrite(GUEST_SS_SELECTOR, regs->xss);
-    __vmwrite(GUEST_ESP, regs->esp);
-    __vmwrite(GUEST_EFLAGS, regs->eflags);
+    __vmwrite(GUEST_RSP, regs->esp);
+    __vmwrite(GUEST_RFLAGS, regs->eflags);
     __vmwrite(GUEST_CS_SELECTOR, regs->xcs);
-    __vmwrite(GUEST_EIP, regs->eip);
+    __vmwrite(GUEST_RIP, regs->eip);
 
     __vmwrite(GUEST_GS_SELECTOR, regs->xgs);
     __vmwrite(GUEST_FS_SELECTOR, regs->xfs);
@@ -1142,7 +1142,7 @@ asmlinkage void vmx_vmexit_handler(struct cpu_user_regs regs)
         return;
     }
 
-    __vmread(GUEST_EIP, &eip);
+    __vmread(GUEST_RIP, &eip);
     TRACE_3D(TRC_VMX_VMEXIT, v->domain->domain_id, eip, exit_reason);
 
     switch (exit_reason) {
@@ -1296,7 +1296,7 @@ asmlinkage void vmx_vmexit_handler(struct cpu_user_regs regs)
     }
     case EXIT_REASON_VMCALL:
         __get_instruction_length(inst_len);
-        __vmread(GUEST_EIP, &eip);
+        __vmread(GUEST_RIP, &eip);
         __vmread(EXIT_QUALIFICATION, &exit_qualification);
 
         vmx_print_line(regs.eax, v); /* provides the current domain */
@@ -1304,7 +1304,7 @@ asmlinkage void vmx_vmexit_handler(struct cpu_user_regs regs)
         break;
     case EXIT_REASON_CR_ACCESS:
     {
-        __vmread(GUEST_EIP, &eip);
+        __vmread(GUEST_RIP, &eip);
         __get_instruction_length(inst_len);
         __vmread(EXIT_QUALIFICATION, &exit_qualification);
 
@@ -1331,7 +1331,7 @@ asmlinkage void vmx_vmexit_handler(struct cpu_user_regs regs)
         __update_guest_eip(inst_len);
         break;
     case EXIT_REASON_MSR_WRITE:
-        __vmread(GUEST_EIP, &eip);
+        __vmread(GUEST_RIP, &eip);
         VMX_DBG_LOG(DBG_LEVEL_1, "MSR_WRITE: eip=%lx, eax=%lx, edx=%lx",
                 eip, (unsigned long)regs.eax, (unsigned long)regs.edx);
         /* just ignore this point */
diff --git a/xen/arch/x86/vmx_io.c b/xen/arch/x86/vmx_io.c
index 240a327223..370c3bb5db 100644
--- a/xen/arch/x86/vmx_io.c
+++ b/xen/arch/x86/vmx_io.c
@@ -42,10 +42,10 @@ static void load_cpu_user_regs(struct cpu_user_regs *regs)
      * Write the guest register value into VMCS
      */
     __vmwrite(GUEST_SS_SELECTOR, regs->ss);
-    __vmwrite(GUEST_ESP, regs->esp);
-    __vmwrite(GUEST_EFLAGS, regs->eflags);
+    __vmwrite(GUEST_RSP, regs->esp);
+    __vmwrite(GUEST_RFLAGS, regs->eflags);
     __vmwrite(GUEST_CS_SELECTOR, regs->cs);
-    __vmwrite(GUEST_EIP, regs->eip);
+    __vmwrite(GUEST_RIP, regs->eip);
 }
 
 static void set_reg_value (int size, int index, int seg, struct cpu_user_regs *regs, long value)
@@ -439,7 +439,7 @@ void vmx_intr_assist(struct vcpu *d)
         return;
     }
 
-    __vmread(GUEST_EFLAGS, &eflags);
+    __vmread(GUEST_RFLAGS, &eflags);
     if (irq_masked(eflags)) {
         VMX_DBG_LOG(DBG_LEVEL_1, "guesting pending: %x, eflags: %lx",
                     highest_vector, eflags);
@@ -479,7 +479,7 @@ void vmx_do_resume(struct vcpu *d)
         __vmwrite(GUEST_CR3, pagetable_get_paddr(d->domain->arch.phys_table));
 
     __vmwrite(HOST_CR3, pagetable_get_paddr(d->arch.monitor_table));
-    __vmwrite(HOST_ESP, (unsigned long)get_stack_bottom());
+    __vmwrite(HOST_RSP, (unsigned long)get_stack_bottom());
 
     if (event_pending(d)) {
         vmx_check_events(d);
diff --git a/xen/arch/x86/vmx_platform.c b/xen/arch/x86/vmx_platform.c
index 96e7572750..339f4da59b 100644
--- a/xen/arch/x86/vmx_platform.c
+++ b/xen/arch/x86/vmx_platform.c
@@ -52,12 +52,12 @@ static long get_reg_value(int size, int index, int seg, struct cpu_user_regs *re
 void store_cpu_user_regs(struct cpu_user_regs *regs)
 {
     __vmread(GUEST_SS_SELECTOR, &regs->ss);
-    __vmread(GUEST_ESP, &regs->esp);
-    __vmread(GUEST_EFLAGS, &regs->eflags);
+    __vmread(GUEST_RSP, &regs->esp);
+    __vmread(GUEST_RFLAGS, &regs->eflags);
     __vmread(GUEST_CS_SELECTOR, &regs->cs);
     __vmread(GUEST_DS_SELECTOR, &regs->ds);
     __vmread(GUEST_ES_SELECTOR, &regs->es);
-    __vmread(GUEST_EIP, &regs->eip);
+    __vmread(GUEST_RIP, &regs->eip);
 }
 
 static long get_reg_value(int size, int index, int seg, struct cpu_user_regs *regs)
@@ -238,7 +238,7 @@ static int vmx_decode(const unsigned char *inst, struct instruction *thread_inst
     unsigned long eflags;
     int index, vm86 = 0;
 
-    __vmread(GUEST_EFLAGS, &eflags);
+    __vmread(GUEST_RFLAGS, &eflags);
     if (eflags & X86_EFLAGS_VM)
 	vm86 = 1;
 
@@ -551,10 +551,10 @@ void handle_mmio(unsigned long va, unsigned long gpa)
     mpci_p = &current->arch.arch_vmx.vmx_platform.mpci;
     inst_decoder_regs = mpci_p->inst_decoder_regs;
 
-    __vmread(GUEST_EIP, &eip);
+    __vmread(GUEST_RIP, &eip);
     __vmread(INSTRUCTION_LEN, &inst_len);
 
-    __vmread(GUEST_EFLAGS, &eflags);
+    __vmread(GUEST_RFLAGS, &eflags);
     vm86 = eflags & X86_EFLAGS_VM;
 
     if (vm86) {
@@ -583,7 +583,7 @@ void handle_mmio(unsigned long va, unsigned long gpa)
     if (vmx_decode(check_prefix(inst, &mmio_inst), &mmio_inst) == DECODE_failure)
         domain_crash_synchronous();
 
-    __vmwrite(GUEST_EIP, eip + inst_len);
+    __vmwrite(GUEST_RIP, eip + inst_len);
     store_cpu_user_regs(inst_decoder_regs);
 
     // Only handle "mov" and "movs" instructions!
diff --git a/xen/arch/x86/vmx_vmcs.c b/xen/arch/x86/vmx_vmcs.c
index acaa8f6d5c..9b32d1d502 100644
--- a/xen/arch/x86/vmx_vmcs.c
+++ b/xen/arch/x86/vmx_vmcs.c
@@ -199,7 +199,7 @@ void vmx_do_launch(struct vcpu *v)
 
     __vmwrite(GUEST_CR3, pagetable_get_paddr(v->arch.guest_table));
     __vmwrite(HOST_CR3, pagetable_get_paddr(v->arch.monitor_table));
-    __vmwrite(HOST_ESP, (unsigned long)get_stack_bottom());
+    __vmwrite(HOST_RSP, (unsigned long)get_stack_bottom());
 
     v->arch.schedule_tail = arch_vmx_do_resume;
 }
@@ -308,19 +308,19 @@ construct_init_vmcs_guest(struct cpu_user_regs *regs,
     error |= __vmwrite(GUEST_GS_BASE, host_env->ds_base);
     error |= __vmwrite(GUEST_IDTR_BASE, host_env->idtr_base);
 
-    error |= __vmwrite(GUEST_ESP, regs->esp);
-    error |= __vmwrite(GUEST_EIP, regs->eip);
+    error |= __vmwrite(GUEST_RSP, regs->esp);
+    error |= __vmwrite(GUEST_RIP, regs->eip);
 
     eflags = regs->eflags & ~VMCS_EFLAGS_RESERVED_0; /* clear 0s */
     eflags |= VMCS_EFLAGS_RESERVED_1; /* set 1s */
 
-    error |= __vmwrite(GUEST_EFLAGS, eflags);
+    error |= __vmwrite(GUEST_RFLAGS, eflags);
 
     error |= __vmwrite(GUEST_INTERRUPTIBILITY_INFO, 0);
     __asm__ __volatile__ ("mov %%dr7, %0\n" : "=r" (dr7));
     error |= __vmwrite(GUEST_DR7, dr7);
-    error |= __vmwrite(GUEST_VMCS0, 0xffffffff);
-    error |= __vmwrite(GUEST_VMCS1, 0xffffffff);
+    error |= __vmwrite(VMCS_LINK_POINTER, 0xffffffff);
+    error |= __vmwrite(VMCS_LINK_POINTER_HIGH, 0xffffffff);
 
     return error;
 }
@@ -362,7 +362,7 @@ static inline int construct_vmcs_host(struct host_execution_env *host_env)
     __asm__ __volatile__ ("mov %%cr4,%0" : "=r" (crn) : ); 
     host_env->cr4 = crn;
     error |= __vmwrite(HOST_CR4, crn);
-    error |= __vmwrite(HOST_EIP, (unsigned long) vmx_asm_vmexit_handler);
+    error |= __vmwrite(HOST_RIP, (unsigned long) vmx_asm_vmexit_handler);
 
     return error;
 }
diff --git a/xen/arch/x86/x86_32/entry.S b/xen/arch/x86/x86_32/entry.S
index 622833ed33..8e7ecfe31d 100644
--- a/xen/arch/x86/x86_32/entry.S
+++ b/xen/arch/x86/x86_32/entry.S
@@ -176,10 +176,10 @@ vmx_process_softirqs:
 restore_all_guest:
         testl $X86_EFLAGS_VM,UREGS_eflags(%esp)
         jnz  restore_all_vm86
-FLT1:   movl UREGS_ds(%esp),%ds
-FLT2:   movl UREGS_es(%esp),%es
-FLT3:   movl UREGS_fs(%esp),%fs
-FLT4:   movl UREGS_gs(%esp),%gs
+FLT1:   mov UREGS_ds(%esp),%ds
+FLT2:   mov UREGS_es(%esp),%es
+FLT3:   mov UREGS_fs(%esp),%fs
+FLT4:   mov UREGS_gs(%esp),%gs
 restore_all_vm86:
         popl %ebx
         popl %ecx
@@ -306,7 +306,7 @@ create_bounce_frame:
         testl $(2|X86_EFLAGS_VM),%ecx
         jz   ring1 /* jump if returning to an existing ring-1 activation */
         movl VCPU_kernel_sp(%ebx),%esi
-FLT6:   movl VCPU_kernel_ss(%ebx),%gs
+FLT6:   mov VCPU_kernel_ss(%ebx),%gs
         testl $X86_EFLAGS_VM,UREGS_eflags+4(%esp)
         jz   nvm86_1
         subl $16,%esi       /* push ES/DS/FS/GS (VM86 stack frame) */
@@ -326,7 +326,7 @@ FLT12:  movl %eax,%gs:4(%esi)
         jmp 1f
 ring1:  /* obtain ss/esp from oldss/oldesp -- a ring-1 activation exists */
         movl UREGS_esp+4(%esp),%esi
-FLT13:  movl UREGS_ss+4(%esp),%gs 
+FLT13:  mov UREGS_ss+4(%esp),%gs 
 1:      /* Construct a stack frame: EFLAGS, CS/EIP */
         movb TRAPBOUNCE_flags(%edx),%cl
         subl $12,%esi
@@ -383,7 +383,7 @@ FLT26:  movl %eax,%gs:12(%esi)
 nvm86_3:/* Rewrite our stack frame and return to ring 1. */
         /* IA32 Ref. Vol. 3: TF, VM, RF and NT flags are cleared on trap. */
         andl $0xfffcbeff,UREGS_eflags+4(%esp)
-        movl %gs,UREGS_ss+4(%esp)
+        mov %gs,UREGS_ss+4(%esp)
         movl %esi,UREGS_esp+4(%esp)
         movzwl TRAPBOUNCE_cs(%edx),%eax
         movl %eax,UREGS_cs+4(%esp)
@@ -670,7 +670,7 @@ do_switch_vm86:
 
         # GS:ESI == Ring-1 stack activation
         movl UREGS_esp(%esp),%esi
-VFLT1:  movl UREGS_ss(%esp),%gs
+VFLT1:  mov UREGS_ss(%esp),%gs
 
         # ES:EDI == Ring-0 stack activation
         leal UREGS_eip(%esp),%edi
diff --git a/xen/arch/x86/x86_32/traps.c b/xen/arch/x86/x86_32/traps.c
index 3a489f244c..29bb56a0b2 100644
--- a/xen/arch/x86/x86_32/traps.c
+++ b/xen/arch/x86/x86_32/traps.c
@@ -21,9 +21,9 @@ void show_registers(struct cpu_user_regs *regs)
 
     if ( VMX_DOMAIN(current) && (regs->eflags == 0) )
     {
-        __vmread(GUEST_EIP, &eip);
-        __vmread(GUEST_ESP, &esp);
-        __vmread(GUEST_EFLAGS, &eflags);
+        __vmread(GUEST_RIP, &eip);
+        __vmread(GUEST_RSP, &esp);
+        __vmread(GUEST_RFLAGS, &eflags);
         __vmread(GUEST_SS_SELECTOR, &ss);
         __vmread(GUEST_DS_SELECTOR, &ds);
         __vmread(GUEST_ES_SELECTOR, &es);
diff --git a/xen/arch/x86/x86_64/entry.S b/xen/arch/x86/x86_64/entry.S
index fcf9201e4e..e213a70661 100644
--- a/xen/arch/x86/x86_64/entry.S
+++ b/xen/arch/x86/x86_64/entry.S
@@ -19,15 +19,16 @@
         movq (reg),reg;
 
         ALIGN
-/* %rbx: struct vcpu, interrupts disabled */
+/* %rbx: struct vcpu */
 switch_to_kernel:
         leaq  VCPU_trap_bounce(%rbx),%rdx
         movq  VCPU_syscall_addr(%rbx),%rax
         movq  %rax,TRAPBOUNCE_eip(%rdx)
         movw  $0,TRAPBOUNCE_flags(%rdx)
         call  create_bounce_frame
+        jmp   test_all_events
 
-/* %rbx: struct vcpu */
+/* %rbx: struct vcpu, interrupts disabled */
 restore_all_guest:
         RESTORE_ALL
         testw $TRAP_syscall,4(%rsp)
@@ -38,7 +39,6 @@ restore_all_guest:
         popq  %r11                    # CS
         cmpw  $__GUEST_CS32,%r11
         popq  %r11                    # RFLAGS
-        cli                           # No interrupts after stack switch
         popq  %rsp                    # RSP
         je    1f
         sysretq
@@ -107,6 +107,7 @@ restore_all_xen:
  */
         ALIGN
 ENTRY(syscall_enter)
+        sti
         movl  $__GUEST_SS,24(%rsp)
         pushq %rcx
         pushq $0
@@ -117,7 +118,6 @@ ENTRY(syscall_enter)
         jz    switch_to_kernel
 
 /*hypercall:*/
-        sti
         movq  %r10,%rcx
         andq  $(NR_hypercalls-1),%rax
         leaq  hypercall_table(%rip),%r10
@@ -316,7 +316,7 @@ FLT4:   movq  %rax,16(%rsi)             # RFLAGS
         testb $TBF_INTERRUPT,%cl
         setnz VCPUINFO_upcall_mask(%rax)# TBF_INTERRUPT -> clear upcall mask
         popq  %rax
-        shll  $16,%eax                  # Bits 16-23: saved_upcall_mask
+        shlq  $32,%rax                  # Bits 32-39: saved_upcall_mask
         movw  UREGS_cs+8(%rsp),%ax      # Bits  0-15: CS
 FLT5:   movq  %rax,8(%rsi)              # CS/saved_upcall_mask
         movq  UREGS_rip+8(%rsp),%rax
diff --git a/xen/include/asm-x86/vmx.h b/xen/include/asm-x86/vmx.h
index cd1145564c..1aab977981 100644
--- a/xen/include/asm-x86/vmx.h
+++ b/xen/include/asm-x86/vmx.h
@@ -41,11 +41,36 @@ extern unsigned int cpu_rev;
  * Need fill bits for SENTER
  */
 
-#define MONITOR_PIN_BASED_EXEC_CONTROLS         0x0000001f      
-#define MONITOR_CPU_BASED_EXEC_CONTROLS         0x0581e7f2
-#define MONITOR_VM_EXIT_CONTROLS                0x0003edff
-#define MONITOR_VM_ENTRY_CONTROLS               0x000011ff
+#define MONITOR_PIN_BASED_EXEC_CONTROLS_RESERVED_VALUE         0x00000016
 
+#define MONITOR_PIN_BASED_EXEC_CONTROLS       \
+    MONITOR_PIN_BASED_EXEC_CONTROLS_RESERVED_VALUE |   \
+    PIN_BASED_EXT_INTR_MASK |   \
+    PIN_BASED_NMI_EXITING
+
+#define MONITOR_CPU_BASED_EXEC_CONTROLS_RESERVED_VALUE         0x0401e172
+
+#define MONITOR_CPU_BASED_EXEC_CONTROLS \
+    MONITOR_CPU_BASED_EXEC_CONTROLS_RESERVED_VALUE |    \
+    CPU_BASED_HLT_EXITING | \
+    CPU_BASED_INVDPG_EXITING | \
+    CPU_BASED_MWAIT_EXITING | \
+    CPU_BASED_MOV_DR_EXITING | \
+    CPU_BASED_UNCOND_IO_EXITING | \
+    CPU_BASED_CR8_LOAD_EXITING | \
+    CPU_BASED_CR8_STORE_EXITING
+
+#define MONITOR_VM_EXIT_CONTROLS_RESERVED_VALUE                0x0003edff
+
+#define VM_EXIT_CONTROLS_IA_32E_MODE		0x00000200
+
+#define MONITOR_VM_EXIT_CONTROLS                \
+    MONITOR_VM_EXIT_CONTROLS_RESERVED_VALUE |\
+    VM_EXIT_ACK_INTR_ON_EXIT
+
+#define VM_ENTRY_CONTROLS_RESERVED_VALUE        0x000011ff
+#define VM_ENTRY_CONTROLS_IA_32E_MODE           0x00000200
+#define MONITOR_VM_ENTRY_CONTROLS       VM_ENTRY_CONTROLS_RESERVED_VALUE 
 /*
  * Exit Reasons
  */
@@ -91,7 +116,8 @@ extern unsigned int cpu_rev;
 #define TYPE_MOV_FROM_CR                (1 << 4)
 #define TYPE_CLTS                       (2 << 4)
 #define	TYPE_LMSW			(3 << 4)
-#define CONTROL_REG_ACCESS_REG          0x700   /* 10:8, general purpose register */
+#define CONTROL_REG_ACCESS_REG          0xf00   /* 10:8, general purpose register */
+#define	LMSW_SOURCE_DATA		(0xFFFF << 16) /* 16:31 lmsw source */
 #define REG_EAX                         (0 << 8) 
 #define REG_ECX                         (1 << 8) 
 #define REG_EDX                         (2 << 8) 
@@ -100,7 +126,14 @@ extern unsigned int cpu_rev;
 #define REG_EBP                         (5 << 8) 
 #define REG_ESI                         (6 << 8) 
 #define REG_EDI                         (7 << 8) 
-#define	LMSW_SOURCE_DATA		(0xFFFF << 16) /* 16:31 lmsw source */
+#define REG_R8                         (8 << 8)
+#define REG_R9                         (9 << 8)
+#define REG_R10                        (10 << 8)
+#define REG_R11                        (11 << 8)
+#define REG_R12                        (12 << 8)
+#define REG_R13                        (13 << 8)
+#define REG_R14                        (14 << 8)
+#define REG_R15                        (15 << 8)
 
 /*
  * Exit Qualifications for MOV for Debug Register Access
@@ -109,7 +142,7 @@ extern unsigned int cpu_rev;
 #define DEBUG_REG_ACCESS_TYPE           0x10    /* 4, direction of access */
 #define TYPE_MOV_TO_DR                  (0 << 4) 
 #define TYPE_MOV_FROM_DR                (1 << 4)
-#define DEBUG_REG_ACCESS_REG            0x700   /* 11:8, general purpose register */
+#define DEBUG_REG_ACCESS_REG            0xf00   /* 11:8, general purpose register */
  
 #define EXCEPTION_BITMAP_DE     (1 << 0)        /* Divide Error */
 #define EXCEPTION_BITMAP_DB     (1 << 1)        /* Debug */
diff --git a/xen/include/asm-x86/vmx_vmcs.h b/xen/include/asm-x86/vmx_vmcs.h
index 672d9fa47d..571a4b05b8 100644
--- a/xen/include/asm-x86/vmx_vmcs.h
+++ b/xen/include/asm-x86/vmx_vmcs.h
@@ -29,11 +29,36 @@ extern void stop_vmx(void);
 
 void vmx_enter_scheduler(void);
 
-#define	VMX_CPU_STATE_ASSIST_ENABLED	1
+enum {
+    VMX_CPU_STATE_PG_ENABLED=0,
+    VMX_CPU_STATE_PAE_ENABLED,
+    VMX_CPU_STATE_LME_ENABLED,
+    VMX_CPU_STATE_LMA_ENABLED,
+    VMX_CPU_STATE_ASSIST_ENABLED,
+};
+
+#define VMX_LONG_GUEST(ed)    \
+  (test_bit(VMX_CPU_STATE_LMA_ENABLED, &ed->arch.arch_vmx.cpu_state))
 
 struct vmcs_struct {
     u32 vmcs_revision_id;
-    unsigned char data [0x1000 - sizeof (u32)];
+    unsigned char data [0]; /* vmcs size is read from MSR */
+};
+
+enum { 
+    VMX_INDEX_MSR_LSTAR = 0,
+    VMX_INDEX_MSR_STAR,
+    VMX_INDEX_MSR_CSTAR,
+    VMX_INDEX_MSR_SYSCALL_MASK,
+    VMX_INDEX_MSR_EFER,
+
+    VMX_MSR_COUNT,
+};
+
+struct msr_state{
+    unsigned long flags;
+    unsigned long msr_items[VMX_MSR_COUNT];
+    unsigned long shadow_gs;
 };
 
 struct arch_vmx_struct {
@@ -42,6 +67,7 @@ struct arch_vmx_struct {
     unsigned long           cpu_cr2; /* save CR2 */
     unsigned long           cpu_cr3;
     unsigned long           cpu_state;
+    struct msr_state        msr_content;
     struct virutal_platform_def     vmx_platform; 
 };
 
@@ -69,11 +95,34 @@ int  construct_vmcs(struct arch_vmx_struct *, struct cpu_user_regs *,
 #define VMCS_USE_HOST_ENV       1
 #define VMCS_USE_SEPARATE_ENV   0
 
+/* this works for both 32bit & 64bit eflags filteration done in construct_init_vmcs_guest() */
 #define VMCS_EFLAGS_RESERVED_0          0xffc08028 /* bitmap for 0 */
 #define VMCS_EFLAGS_RESERVED_1          0x00000002 /* bitmap for 1 */
 
 extern int vmcs_version;
 
+#define CPU_BASED_VIRTUAL_INTR_PENDING  0x00000004
+#define CPU_BASED_USE_TSC_OFFSETING     0x00000008
+#define CPU_BASED_HLT_EXITING           0x00000080
+#define CPU_BASED_INVDPG_EXITING        0x00000200
+#define CPU_BASED_MWAIT_EXITING         0x00000400
+#define CPU_BASED_RDPMC_EXITING         0x00000800
+#define CPU_BASED_RDTSC_EXITING         0x00001000
+#define CPU_BASED_CR8_LOAD_EXITING      0x00080000
+#define CPU_BASED_CR8_STORE_EXITING     0x00100000
+#define CPU_BASED_TPR_SHADOW            0x00200000
+#define CPU_BASED_MOV_DR_EXITING        0x00800000
+#define CPU_BASED_UNCOND_IO_EXITING     0x01000000
+#define CPU_BASED_ACTIVATE_IO_BITMAP    0x02000000
+#define CPU_BASED_MONITOR_EXITING       0x20000000
+#define CPU_BASED_PAUSE_EXITING         0x40000000
+#define PIN_BASED_EXT_INTR_MASK 0x1
+#define PIN_BASED_NMI_EXITING   0x8
+
+#define VM_EXIT_ACK_INTR_ON_EXIT        0x00008000
+#define VM_EXIT_HOST_ADD_SPACE_SIZE     0x00000200
+
+
 /* VMCS Encordings */
 enum vmcs_field {
     GUEST_ES_SELECTOR               = 0x00000800,
@@ -92,14 +141,23 @@ enum vmcs_field {
     HOST_GS_SELECTOR                = 0x00000c0a,
     HOST_TR_SELECTOR                = 0x00000c0c,
     IO_BITMAP_A                     = 0x00002000, 
+    IO_BITMAP_A_HIGH                = 0x00002001, 
     IO_BITMAP_B                     = 0x00002002, 
+    IO_BITMAP_B_HIGH                = 0x00002003, 
     VM_EXIT_MSR_STORE_ADDR          = 0x00002006,
+    VM_EXIT_MSR_STORE_ADDR_HIGH     = 0x00002007,
     VM_EXIT_MSR_LOAD_ADDR           = 0x00002008,
+    VM_EXIT_MSR_LOAD_ADDR_HIGH      = 0x00002009,
     VM_ENTRY_MSR_LOAD_ADDR          = 0x0000200a,
+    VM_ENTRY_MSR_LOAD_ADDR_HIGH     = 0x0000200b,
     TSC_OFFSET                      = 0x00002010,
-    GUEST_VMCS0                     = 0x00002800,
-    GUEST_VMCS1                     = 0x00002801,
+    TSC_OFFSET_HIGH                 = 0x00002011,
+    VIRTUAL_APIC_PAGE_ADDR          = 0x00002012,
+    VIRTUAL_APIC_PAGE_ADDR_HIGH     = 0x00002013,
+    VMCS_LINK_POINTER               = 0x00002800,
+    VMCS_LINK_POINTER_HIGH          = 0x00002801,
     GUEST_IA32_DEBUGCTL             = 0x00002802,
+    GUEST_IA32_DEBUGCTL_HIGH        = 0x00002803,
     PIN_BASED_VM_EXEC_CONTROL       = 0x00004000,
     CPU_BASED_VM_EXEC_CONTROL       = 0x00004002,   
     EXCEPTION_BITMAP                = 0x00004004,
@@ -113,12 +171,17 @@ enum vmcs_field {
     VM_ENTRY_MSR_LOAD_COUNT         = 0x00004014,
     VM_ENTRY_INTR_INFO_FIELD        = 0x00004016,
     VM_ENTRY_EXCEPTION_ERROR_CODE   = 0x00004018,
+    VM_ENTRY_INSTRUCTION_LENGTH     = 0x0000401a,
+    TPR_THRESHOLD                   = 0x0000401c,
+    SECONDARY_VM_EXEC_CONTROL       = 0x0000401e,
+    VM_INSTRUCTION_ERROR            = 0x00004400,
     VM_EXIT_REASON                  = 0x00004402,
     VM_EXIT_INTR_INFO               = 0x00004404,   
     VM_EXIT_INTR_ERROR_CODE         = 0x00004406,
     IDT_VECTORING_INFO_FIELD        = 0x00004408,
     IDT_VECTORING_ERROR_CODE        = 0x0000440a,
     INSTRUCTION_LEN                 = 0x0000440c,
+    VMX_INSTRUCTION_INFO            = 0x0000440e,
     GUEST_ES_LIMIT                  = 0x00004800,
     GUEST_CS_LIMIT                  = 0x00004802,
     GUEST_SS_LIMIT                  = 0x00004804,
@@ -138,14 +201,18 @@ enum vmcs_field {
     GUEST_LDTR_AR_BYTES             = 0x00004820,
     GUEST_TR_AR_BYTES               = 0x00004822,
     GUEST_INTERRUPTIBILITY_INFO     = 0x00004824,
+    GUEST_SYSENTER_CS               = 0x0000482A,
+    HOST_IA32_SYSENTER_CS           = 0x00004c00,
     CR0_GUEST_HOST_MASK             = 0x00006000,
     CR4_GUEST_HOST_MASK             = 0x00006002,
     CR0_READ_SHADOW                 = 0x00006004,
     CR4_READ_SHADOW                 = 0x00006006,
-    CR3_TARGET_VALUES               = 0x00006008, 
-    CR3_GUEST_HOST_MASK             = 0x00006208,
+    CR3_TARGET_VALUE0               = 0x00006008, 
+    CR3_TARGET_VALUE1               = 0x0000600a, 
+    CR3_TARGET_VALUE2               = 0x0000600c, 
+    CR3_TARGET_VALUE3               = 0x0000600e, 
     EXIT_QUALIFICATION              = 0x00006400,
-    GUEST_LINEAR_ADDRESS	    = 0x0000640A,
+    GUEST_LINEAR_ADDRESS            = 0x0000640a,
     GUEST_CR0                       = 0x00006800,
     GUEST_CR3                       = 0x00006802,
     GUEST_CR4                       = 0x00006804,
@@ -160,10 +227,12 @@ enum vmcs_field {
     GUEST_GDTR_BASE                 = 0x00006816,    
     GUEST_IDTR_BASE                 = 0x00006818,
     GUEST_DR7                       = 0x0000681a,
-    GUEST_ESP                       = 0x0000681c,
-    GUEST_EIP                       = 0x0000681e,
-    GUEST_EFLAGS                    = 0x00006820,
+    GUEST_RSP                       = 0x0000681c,
+    GUEST_RIP                       = 0x0000681e,
+    GUEST_RFLAGS                    = 0x00006820,
     GUEST_PENDING_DBG_EXCEPTIONS    = 0x00006822,
+    GUEST_SYSENTER_ESP              = 0x00006824,
+    GUEST_SYSENTER_EIP              = 0x00006826,
     HOST_CR0                        = 0x00006c00,
     HOST_CR3                        = 0x00006c02,
     HOST_CR4                        = 0x00006c04,
@@ -172,8 +241,10 @@ enum vmcs_field {
     HOST_TR_BASE                    = 0x00006c0a,
     HOST_GDTR_BASE                  = 0x00006c0c,
     HOST_IDTR_BASE                  = 0x00006c0e,
-    HOST_ESP                        = 0x00006c14,
-    HOST_EIP                        = 0x00006c16,
+    HOST_IA32_SYSENTER_ESP          = 0x00006c10,
+    HOST_IA32_SYSENTER_EIP          = 0x00006c12,
+    HOST_RSP                        = 0x00006c14,
+    HOST_RIP                        = 0x00006c16,
 };
 
 #define VMX_DEBUG 1
diff --git a/xen/include/asm-x86/x86_32/asm_defns.h b/xen/include/asm-x86/x86_32/asm_defns.h
index a04033e1b9..7ec44ec290 100644
--- a/xen/include/asm-x86/x86_32/asm_defns.h
+++ b/xen/include/asm-x86/x86_32/asm_defns.h
@@ -19,10 +19,10 @@
         "jmp 3f;"                                                       \
         "2:testb $3,"STR(UREGS_cs)"(%esp);"                             \
         "jz 1f;"                                                        \
-        "movl %ds,"STR(UREGS_ds)"(%esp);"                               \
-        "movl %es,"STR(UREGS_es)"(%esp);"                               \
-        "movl %fs,"STR(UREGS_fs)"(%esp);"                               \
-        "movl %gs,"STR(UREGS_gs)"(%esp);"                               \
+        "mov %ds,"STR(UREGS_ds)"(%esp);"                                \
+        "mov %es,"STR(UREGS_es)"(%esp);"                                \
+        "mov %fs,"STR(UREGS_fs)"(%esp);"                                \
+        "mov %gs,"STR(UREGS_gs)"(%esp);"                                \
         "3:"
 
 #define SAVE_ALL_NOSEGREGS(_reg)                \
@@ -31,8 +31,8 @@
 
 #define SET_XEN_SEGMENTS(_reg)                                  \
         "movl $("STR(__HYPERVISOR_DS)"),%e"STR(_reg)"x;"        \
-        "movl %e"STR(_reg)"x,%ds;"                              \
-        "movl %e"STR(_reg)"x,%es;"
+        "mov %e"STR(_reg)"x,%ds;"                              \
+        "mov %e"STR(_reg)"x,%es;"
 
 #define SAVE_ALL(_reg)                          \
         __SAVE_ALL_PRE                          \
@@ -56,10 +56,10 @@
         jmp 3f;                                         \
         2:testb $3,UREGS_cs(%esp);                      \
         jz 1f;                                          \
-        movl %ds,UREGS_ds(%esp);                        \
-        movl %es,UREGS_es(%esp);                        \
-        movl %fs,UREGS_fs(%esp);                        \
-        movl %gs,UREGS_gs(%esp);                        \
+        mov %ds,UREGS_ds(%esp);                         \
+        mov %es,UREGS_es(%esp);                         \
+        mov %fs,UREGS_fs(%esp);                         \
+        mov %gs,UREGS_gs(%esp);                         \
         3:
 
 #define SAVE_ALL_NOSEGREGS(_reg)                \
@@ -68,8 +68,8 @@
 
 #define SET_XEN_SEGMENTS(_reg)                          \
         movl $(__HYPERVISOR_DS),%e ## _reg ## x;        \
-        movl %e ## _reg ## x,%ds;                       \
-        movl %e ## _reg ## x,%es;
+        mov %e ## _reg ## x,%ds;                        \
+        mov %e ## _reg ## x,%es;
 
 #define SAVE_ALL(_reg)                          \
         __SAVE_ALL_PRE                          \
diff --git a/xen/include/public/arch-x86_64.h b/xen/include/public/arch-x86_64.h
index 65efc977a5..a4f4ac2fcf 100644
--- a/xen/include/public/arch-x86_64.h
+++ b/xen/include/public/arch-x86_64.h
@@ -153,16 +153,16 @@ typedef struct cpu_user_regs {
     u32 error_code;    /* private */
     u32 entry_vector;  /* private */
     union { u64 rip, eip; };
-    u16 cs;
+    u16 cs, _pad0[1];
     u8  saved_upcall_mask;
-    u8  _pad0[5];
+    u8  _pad1[3];
     union { u64 rflags, eflags; };
     union { u64 rsp, esp; };
-    u16 ss, _pad1[3];
-    u16 es, _pad2[3];
-    u16 ds, _pad3[3];
-    u16 fs, _pad4[3]; /* Non-zero => takes precedence over fs_base.      */
-    u16 gs, _pad5[3]; /* Non-zero => takes precedence over gs_base_user. */
+    u16 ss, _pad2[3];
+    u16 es, _pad3[3];
+    u16 ds, _pad4[3];
+    u16 fs, _pad5[3]; /* Non-zero => takes precedence over fs_base.      */
+    u16 gs, _pad6[3]; /* Non-zero => takes precedence over gs_base_user. */
 } cpu_user_regs_t;
 
 typedef u64 tsc_timestamp_t; /* RDTSC timestamp */