diff --git a/xen/arch/x86/hvm/vioapic.c b/xen/arch/x86/hvm/vioapic.c
index d3c681b..8196268 100644
--- a/xen/arch/x86/hvm/vioapic.c
+++ b/xen/arch/x86/hvm/vioapic.c
@@ -238,8 +238,13 @@ static int vioapic_write(
 
 static int vioapic_range(struct vcpu *v, unsigned long addr)
 {
-    struct hvm_hw_vioapic *vioapic = domain_vioapic(v->domain);
+    struct hvm_hw_vioapic *vioapic;
+
+    /* pvh uses event channel callback */
+    if ( is_pvh_vcpu(v) )
+        return 0;
 
+    vioapic = domain_vioapic(v->domain);
     return ((addr >= vioapic->base_address &&
              (addr < vioapic->base_address + VIOAPIC_MEM_LENGTH)));
 }
diff --git a/xen/common/domain.c b/xen/common/domain.c
index 2917855..4beec35 100644
--- a/xen/common/domain.c
+++ b/xen/common/domain.c
@@ -1096,7 +1096,7 @@ long do_vcpu_op(int cmd, int vcpuid, XEN_GUEST_HANDLE_PARAM(void) arg)
         if ( (set.flags & VCPU_SSHOTTMR_future) &&
              (set.timeout_abs_ns < NOW()) )
             return -ETIME;
-
+mukchk(0x99);
         migrate_timer(&v->singleshot_timer, smp_processor_id());
         set_timer(&v->singleshot_timer, set.timeout_abs_ns);
 
diff --git a/xen/kdb/kdb_cmds.c b/xen/kdb/kdb_cmds.c
index d34e861..bf50afd 100644
--- a/xen/kdb/kdb_cmds.c
+++ b/xen/kdb/kdb_cmds.c
@@ -2070,6 +2070,17 @@ static void kdb_display_pv_vcpu(struct vcpu *vp)
     kdbp("\n");
 }
 
+static void
+kdb_print_timer(struct timer *tp, char *name)
+{
+    kdbp("\n");
+    kdbp("    TIMER: %s\n", name);
+    kdbp("        expires:%016lx fn:%016lx data:%016lx\n", 
+         tp->expires, tp->function, tp->data);
+    kdbp("        status:%d (see TIMER_STATUS_invalid)\n", tp->status);
+    kdbp("\n");
+}
+
 /* Display one VCPU info */
 static void
 kdb_display_vcpu(struct vcpu *vp)
@@ -2105,6 +2116,10 @@ kdb_display_vcpu(struct vcpu *vp)
 
     kdbp("  next:%p periodic: period:0x%lx last_event:0x%lx\n", 
          vp->next_in_list, vp->periodic_period, vp->periodic_last_event);
+
+    kdb_print_timer(&vp->periodic_timer, "periodic_timer");
+    kdb_print_timer(&vp->singleshot_timer, "singleshot_timer");
+
     kdbp("  cpu_affinity:0x%lx vcpu_dirty_cpumask:%p sched_priv:0x%p\n",
          vp->cpu_affinity, vp->vcpu_dirty_cpumask, vp->sched_priv);
     kdbp("  &runstate: %p state: %x (eg. RUNSTATE_running) guestptr:%p",