diff -r 2e35cf028ff0 xen/arch/x86/hvm/hvm.c
--- a/xen/arch/x86/hvm/hvm.c	Thu Nov 09 15:43:24 2006 +0000
+++ b/xen/arch/x86/hvm/hvm.c	Fri Nov 10 15:00:30 2006 +0800
@@ -176,8 +176,6 @@ int hvm_vcpu_initialise(struct vcpu *v)
         get_vio(v->domain, v->vcpu_id)->vp_eport =
             v->arch.hvm_vcpu.xen_port;
 
-    init_timer(&v->arch.hvm_vcpu.hlt_timer, hlt_timer_fn, v, v->processor);
-
     if ( v->vcpu_id != 0 )
         return 0;
 
@@ -198,7 +196,6 @@ int hvm_vcpu_initialise(struct vcpu *v)
 
 void hvm_vcpu_destroy(struct vcpu *v)
 {
-    kill_timer(&v->arch.hvm_vcpu.hlt_timer);
     vlapic_destroy(v);
     hvm_funcs.vcpu_destroy(v);
 
@@ -273,8 +270,6 @@ void hvm_hlt(unsigned long rflags)
 void hvm_hlt(unsigned long rflags)
 {
     struct vcpu *v = current;
-    struct periodic_time *pt = &v->domain->arch.hvm_domain.pl_time.periodic_tm;
-    s_time_t next_pt = -1, next_wakeup;
 
     /*
      * If we halt with interrupts disabled, that's a pretty sure sign that we
@@ -284,14 +279,8 @@ void hvm_hlt(unsigned long rflags)
     if ( unlikely(!(rflags & X86_EFLAGS_IF)) )
         return hvm_vcpu_down();
 
-    if ( !v->vcpu_id )
-        next_pt = get_scheduled(v, pt->irq, pt);
-    next_wakeup = get_apictime_scheduled(v);
-    if ( (next_pt != -1 && next_pt < next_wakeup) || next_wakeup == -1 )
-        next_wakeup = next_pt;
-    if ( next_wakeup != - 1 ) 
-        set_timer(&current->arch.hvm_vcpu.hlt_timer, next_wakeup);
-    do_sched_op_compat(SCHEDOP_block, 0);
+    set_bit(_VCPUF_blocked, &v->vcpu_flags);
+    raise_softirq(SCHEDULE_SOFTIRQ);
 }
 
 /*
diff -r 2e35cf028ff0 xen/arch/x86/hvm/intercept.c
--- a/xen/arch/x86/hvm/intercept.c	Thu Nov 09 15:43:24 2006 +0000
+++ b/xen/arch/x86/hvm/intercept.c	Fri Nov 10 15:07:47 2006 +0800
@@ -268,13 +268,6 @@ int register_io_handler(
     return 1;
 }
 
-/* Hook function for the HLT instruction emulation wakeup. */
-void hlt_timer_fn(void *data)
-{
-    struct vcpu *v = data;
-    vcpu_kick(v);
-}
-
 static __inline__ void missed_ticks(struct periodic_time *pt)
 {
     s_time_t missed_ticks;
@@ -297,16 +290,17 @@ void pt_timer_fn(void *data)
 void pt_timer_fn(void *data)
 {
     struct vcpu *v = data;
-    struct periodic_time *pt = &(v->domain->arch.hvm_domain.pl_time.periodic_tm);
+    struct periodic_time *pt = &v->domain->arch.hvm_domain.pl_time.periodic_tm;
 
     pt->pending_intr_nr++;
     pt->scheduled += pt->period;
 
     /* pick up missed timer tick */
     missed_ticks(pt);
-    if ( test_bit(_VCPUF_running, &v->vcpu_flags) ) {
-        set_timer(&pt->timer, pt->scheduled);
-    }
+
+    set_timer(&pt->timer, pt->scheduled);
+
+    vcpu_unblock(v);
 }
 
 /* pick up missed timer ticks at deactive time */
diff -r 2e35cf028ff0 xen/arch/x86/hvm/svm/svm.c
--- a/xen/arch/x86/hvm/svm/svm.c	Thu Nov 09 15:43:24 2006 +0000
+++ b/xen/arch/x86/hvm/svm/svm.c	Fri Nov 10 15:08:38 2006 +0800
@@ -712,11 +712,13 @@ static void svm_freeze_time(struct vcpu 
 static void svm_freeze_time(struct vcpu *v)
 {
     struct periodic_time *pt=&v->domain->arch.hvm_domain.pl_time.periodic_tm;
-    
-    if ( pt->enabled && pt->first_injected && v->vcpu_id == pt->bind_vcpu 
+
+    if ( pt->enabled && pt->first_injected
+            && (v->vcpu_id == pt->bind_vcpu)
             && !v->arch.hvm_vcpu.guest_time ) {
         v->arch.hvm_vcpu.guest_time = hvm_get_guest_time(v);
-        stop_timer(&(pt->timer));
+        if ( test_bit(_VCPUF_blocked, &v->vcpu_flags) )
+            stop_timer(&pt->timer);
     }
 }
 
@@ -853,7 +855,6 @@ static void svm_migrate_timers(struct vc
     if ( pt->enabled )
     {
         migrate_timer(&pt->timer, v->processor);
-        migrate_timer(&v->arch.hvm_vcpu.hlt_timer, v->processor);
     }
     migrate_timer(&vcpu_vlapic(v)->vlapic_timer, v->processor);
     migrate_timer(&vrtc->second_timer, v->processor);
diff -r 2e35cf028ff0 xen/arch/x86/hvm/vlapic.c
--- a/xen/arch/x86/hvm/vlapic.c	Thu Nov 09 15:43:24 2006 +0000
+++ b/xen/arch/x86/hvm/vlapic.c	Fri Nov 10 15:00:30 2006 +0800
@@ -835,6 +835,8 @@ void vlapic_timer_fn(void *data)
     else
         vlapic_set_reg(vlapic, APIC_TMCCT, 0);
 
+    vcpu_unblock(vlapic_vcpu(vlapic));
+
     HVM_DBG_LOG(DBG_LEVEL_VLAPIC_TIMER,
                 "now 0x%016"PRIx64", expire @ 0x%016"PRIx64", "
                 "timer initial count 0x%x, timer current count 0x%x.",
diff -r 2e35cf028ff0 xen/arch/x86/hvm/vmx/vmx.c
--- a/xen/arch/x86/hvm/vmx/vmx.c	Thu Nov 09 15:43:24 2006 +0000
+++ b/xen/arch/x86/hvm/vmx/vmx.c	Fri Nov 10 15:08:19 2006 +0800
@@ -368,11 +368,13 @@ static void vmx_freeze_time(struct vcpu 
 static void vmx_freeze_time(struct vcpu *v)
 {
     struct periodic_time *pt=&v->domain->arch.hvm_domain.pl_time.periodic_tm;
-    
-    if ( pt->enabled && pt->first_injected && v->vcpu_id == pt->bind_vcpu
+
+    if ( pt->enabled && pt->first_injected
+            && (v->vcpu_id == pt->bind_vcpu)
             && !v->arch.hvm_vcpu.guest_time ) {
         v->arch.hvm_vcpu.guest_time = hvm_get_guest_time(v);
-        stop_timer(&(pt->timer));
+        if ( !test_bit(_VCPUF_blocked, &v->vcpu_flags) )
+            stop_timer(&pt->timer);
     }
 }
 
@@ -407,7 +409,6 @@ void vmx_migrate_timers(struct vcpu *v)
     if ( pt->enabled )
     {
         migrate_timer(&pt->timer, v->processor);
-        migrate_timer(&v->arch.hvm_vcpu.hlt_timer, v->processor);
     }
     migrate_timer(&vcpu_vlapic(v)->vlapic_timer, v->processor);
     migrate_timer(&vrtc->second_timer, v->processor);
diff -r 2e35cf028ff0 xen/include/asm-x86/hvm/vcpu.h
--- a/xen/include/asm-x86/hvm/vcpu.h	Thu Nov 09 15:43:24 2006 +0000
+++ b/xen/include/asm-x86/hvm/vcpu.h	Fri Nov 10 15:00:30 2006 +0800
@@ -44,9 +44,6 @@ struct hvm_vcpu {
     /* Flags */
     int                 flag_dr_dirty;
 
-    /* hlt ins emulation wakeup timer */
-    struct timer        hlt_timer;
-
     unsigned long       hvm_trace_values[5];
 
     union {