4 files changed, 13 insertions, 7 deletions

diff --git a/drivers/xen/cpu_hotplug.c b/drivers/xen/cpu_hotplug.c
index 14e2d995e958..4dcfced107f5 100644
--- a/drivers/xen/cpu_hotplug.c
+++ b/drivers/xen/cpu_hotplug.c
@@ -30,7 +30,8 @@ static int vcpu_online(unsigned int cpu)
         sprintf(dir, "cpu/%u", cpu);
         err = xenbus_scanf(XBT_NIL, dir, "availability", "%s", state);
         if (err != 1) {
-                printk(KERN_ERR "XENBUS: Unable to read cpu state\n");
+                if (!xen_initial_domain())
+                        printk(KERN_ERR "XENBUS: Unable to read cpu state\n");
                 return err;
         }
 
diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c
index 7944a17f5cbf..19834d1c7c36 100644
--- a/drivers/xen/xen-pciback/pci_stub.c
+++ b/drivers/xen/xen-pciback/pci_stub.c
@@ -884,7 +884,7 @@ static inline int str_to_quirk(const char *buf, int *domain, int *bus, int
         int err;
 
         err =
-            sscanf(buf, " %04x:%02x:%02x.%1x-%08x:%1x:%08x", domain, bus, slot,
+            sscanf(buf, " %04x:%02x:%02x.%d-%08x:%1x:%08x", domain, bus, slot,
                    func, reg, size, mask);
         if (err == 7)
                 return 0;
@@ -904,7 +904,7 @@ static int pcistub_device_id_add(int domain, int bus, int slot, int func)
         pci_dev_id->bus = bus;
         pci_dev_id->devfn = PCI_DEVFN(slot, func);
 
-        pr_debug(DRV_NAME ": wants to seize %04x:%02x:%02x.%01x\n",
+        pr_debug(DRV_NAME ": wants to seize %04x:%02x:%02x.%d\n",
                  domain, bus, slot, func);
 
         spin_lock_irqsave(&device_ids_lock, flags);
@@ -934,7 +934,7 @@ static int pcistub_device_id_remove(int domain, int bus, int slot, int func)
 
                         err = 0;
 
-                        pr_debug(DRV_NAME ": removed %04x:%02x:%02x.%01x from "
+                        pr_debug(DRV_NAME ": removed %04x:%02x:%02x.%d from "
                                  "seize list\n", domain, bus, slot, func);
                 }
         }
@@ -1029,7 +1029,7 @@ static ssize_t pcistub_slot_show(struct device_driver *drv, char *buf)
                         break;
 
                 count += scnprintf(buf + count, PAGE_SIZE - count,
-                                   "%04x:%02x:%02x.%01x\n",
+                                   "%04x:%02x:%02x.%d\n",
                                    pci_dev_id->domain, pci_dev_id->bus,
                                    PCI_SLOT(pci_dev_id->devfn),
                                    PCI_FUNC(pci_dev_id->devfn));
diff --git a/drivers/xen/xen-pciback/xenbus.c b/drivers/xen/xen-pciback/xenbus.c
index d5dcf8d5d3d9..64b11f99eacc 100644
--- a/drivers/xen/xen-pciback/xenbus.c
+++ b/drivers/xen/xen-pciback/xenbus.c
@@ -206,6 +206,7 @@ static int xen_pcibk_publish_pci_dev(struct xen_pcibk_device *pdev,
                 goto out;
         }
 
+        /* Note: The PV protocol uses %02x, don't change it */
         err = xenbus_printf(XBT_NIL, pdev->xdev->nodename, str,
                             "%04x:%02x:%02x.%02x", domain, bus,
                             PCI_SLOT(devfn), PCI_FUNC(devfn));
@@ -229,7 +230,7 @@ static int xen_pcibk_export_device(struct xen_pcibk_device *pdev,
                 err = -EINVAL;
                 xenbus_dev_fatal(pdev->xdev, err,
                                  "Couldn't locate PCI device "
-                                 "(%04x:%02x:%02x.%01x)! "
+                                 "(%04x:%02x:%02x.%d)! "
                                  "perhaps already in-use?",
                                  domain, bus, slot, func);
                 goto out;
@@ -274,7 +275,7 @@ static int xen_pcibk_remove_device(struct xen_pcibk_device *pdev,
         if (!dev) {
                 err = -EINVAL;
                 dev_dbg(&pdev->xdev->dev, "Couldn't locate PCI device "
-                        "(%04x:%02x:%02x.%01x)! not owned by this domain\n",
+                        "(%04x:%02x:%02x.%d)! not owned by this domain\n",
                         domain, bus, slot, func);
                 goto out;
         }
diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
index 527dc2a3b89f..89f76252a16f 100644
--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
@@ -369,6 +369,10 @@ static int xenbus_write_watch(unsigned msg_type, struct xenbus_file_priv *u)
                 goto out;
         }
         token++;
+        if (memchr(token, 0, u->u.msg.len - (token - path)) == NULL) {
+                rc = -EILSEQ;
+                goto out;
+        }
 
         if (msg_type == XS_WATCH) {
                 watch = alloc_watch_adapter(path, token);