diff --git a/23103-x86-pirq-guest-eoi-check.patch b/23103-x86-pirq-guest-eoi-check.patch
index db6392d..4443a03 100644
--- a/23103-x86-pirq-guest-eoi-check.patch
+++ b/23103-x86-pirq-guest-eoi-check.patch
@@ -12,7 +12,7 @@ Index: xen-4.1.2-testing/xen/arch/x86/irq.c
 ===================================================================
 --- xen-4.1.2-testing.orig/xen/arch/x86/irq.c
 +++ xen-4.1.2-testing/xen/arch/x86/irq.c
-@@ -1032,6 +1032,12 @@ static void __pirq_guest_eoi(struct doma
+@@ -1033,6 +1033,12 @@ static void __pirq_guest_eoi(struct doma
          return;
      }
  
diff --git a/23233-hvm-cr-access.patch b/23233-hvm-cr-access.patch
index ad167d5..9c4cfa2 100644
--- a/23233-hvm-cr-access.patch
+++ b/23233-hvm-cr-access.patch
@@ -424,7 +424,7 @@ Index: xen-4.1.2-testing/xen/include/asm-x86/processor.h
 ===================================================================
 --- xen-4.1.2-testing.orig/xen/include/asm-x86/processor.h
 +++ xen-4.1.2-testing/xen/include/asm-x86/processor.h
-@@ -590,6 +590,8 @@ int wrmsr_hypervisor_regs(uint32_t idx,
+@@ -592,6 +592,8 @@ int wrmsr_hypervisor_regs(uint32_t idx,
  int microcode_update(XEN_GUEST_HANDLE(const_void), unsigned long len);
  int microcode_resume_cpu(int cpu);
  
diff --git a/23246-x86-xsave-enable.patch b/23246-x86-xsave-enable.patch
new file mode 100644
index 0000000..7df4145
--- /dev/null
+++ b/23246-x86-xsave-enable.patch
@@ -0,0 +1,22 @@
+References: bnc#718668
+
+# HG changeset patch
+# User Tim Deegan <Tim.Deegan@citrix.com>
+# Date 1303297371 -3600
+# Node ID eb4505f8dd97f894ee4b4e1b55ea1272c05e6759
+# Parent  3539ef956a378ad7fe39654ff9aca5b0e7bf8843
+xen/x86: re-enable xsave by default now that it supports live migration.
+
+Signed-off-by: Tim Deegan <Tim.Deegan@citrix.com>
+
+--- a/xen/arch/x86/cpu/common.c
++++ b/xen/arch/x86/cpu/common.c
+@@ -25,7 +25,7 @@ boolean_param("nofxsr", disable_x86_fxsr
+ static bool_t __cpuinitdata disable_x86_serial_nr;
+ boolean_param("noserialnumber", disable_x86_serial_nr);
+ 
+-static bool_t __cpuinitdata use_xsave;
++static bool_t __cpuinitdata use_xsave = 1;
+ boolean_param("xsave", use_xsave);
+ unsigned int __devinitdata opt_cpuid_mask_ecx = ~0u;
+ integer_param("cpuid_mask_ecx", opt_cpuid_mask_ecx);
diff --git a/23305-amd-fam15-xenoprof.patch b/23305-amd-fam15-xenoprof.patch
index e086701..c400872 100644
--- a/23305-amd-fam15-xenoprof.patch
+++ b/23305-amd-fam15-xenoprof.patch
@@ -201,7 +201,7 @@ Index: xen-4.1.2-testing/xen/include/asm-x86/msr-index.h
 ===================================================================
 --- xen-4.1.2-testing.orig/xen/include/asm-x86/msr-index.h
 +++ xen-4.1.2-testing/xen/include/asm-x86/msr-index.h
-@@ -224,6 +224,19 @@
+@@ -219,6 +219,19 @@
  #define MSR_K8_VM_CR			0xc0010114
  #define MSR_K8_VM_HSAVE_PA		0xc0010117
  
diff --git a/23437-amd-fam15-TSC-scaling.patch b/23437-amd-fam15-TSC-scaling.patch
index 51b5a24..0ae7f49 100644
--- a/23437-amd-fam15-TSC-scaling.patch
+++ b/23437-amd-fam15-TSC-scaling.patch
@@ -121,7 +121,7 @@ Index: xen-4.1.2-testing/xen/include/asm-x86/msr-index.h
 ===================================================================
 --- xen-4.1.2-testing.orig/xen/include/asm-x86/msr-index.h
 +++ xen-4.1.2-testing/xen/include/asm-x86/msr-index.h
-@@ -266,6 +266,9 @@
+@@ -261,6 +261,9 @@
  #define MSR_AMD_PATCHLEVEL		0x0000008b
  #define MSR_AMD_PATCHLOADER		0xc0010020
  
diff --git a/23508-vmx-proc-based-ctls-probe.patch b/23508-vmx-proc-based-ctls-probe.patch
index a2dc76d..8882453 100644
--- a/23508-vmx-proc-based-ctls-probe.patch
+++ b/23508-vmx-proc-based-ctls-probe.patch
@@ -16,7 +16,7 @@ Index: xen-4.1.2-testing/xen/arch/x86/hvm/vmx/vmcs.c
 ===================================================================
 --- xen-4.1.2-testing.orig/xen/arch/x86/hvm/vmx/vmcs.c
 +++ xen-4.1.2-testing/xen/arch/x86/hvm/vmx/vmcs.c
-@@ -147,6 +147,11 @@ static int vmx_init_vmcs_config(void)
+@@ -148,6 +148,11 @@ static int vmx_init_vmcs_config(void)
          MSR_IA32_VMX_PINBASED_CTLS, &mismatch);
  
      min = (CPU_BASED_HLT_EXITING |
@@ -28,7 +28,7 @@ Index: xen-4.1.2-testing/xen/arch/x86/hvm/vmx/vmcs.c
             CPU_BASED_INVLPG_EXITING |
             CPU_BASED_CR3_LOAD_EXITING |
             CPU_BASED_CR3_STORE_EXITING |
-@@ -165,13 +170,9 @@ static int vmx_init_vmcs_config(void)
+@@ -166,13 +171,9 @@ static int vmx_init_vmcs_config(void)
          MSR_IA32_VMX_PROCBASED_CTLS, &mismatch);
      _vmx_cpu_based_exec_control &= ~CPU_BASED_RDTSC_EXITING;
  #ifdef __x86_64__
diff --git a/23610-x86-topology-info.patch b/23610-x86-topology-info.patch
index 79c77b4..39a6224 100644
--- a/23610-x86-topology-info.patch
+++ b/23610-x86-topology-info.patch
@@ -200,8 +200,8 @@ Index: xen-4.1.2-testing/xen/include/asm-x86/processor.h
      __u32 apicid;
      unsigned short x86_clflush_size;
  } __cacheline_aligned;
-@@ -194,8 +196,6 @@ extern struct cpuinfo_x86 cpu_data[];
- #endif
+@@ -196,8 +198,6 @@ extern struct cpuinfo_x86 cpu_data[];
+ extern void set_cpuid_faulting(bool_t enable);
  
  extern u64 host_pat;
 -extern int phys_proc_id[NR_CPUS];
@@ -209,7 +209,7 @@ Index: xen-4.1.2-testing/xen/include/asm-x86/processor.h
  extern bool_t opt_cpu_info;
  
  /* Maximum width of physical addresses supported by the hardware */
-@@ -215,8 +215,8 @@ extern void detect_ht(struct cpuinfo_x86
+@@ -217,8 +217,8 @@ extern void detect_ht(struct cpuinfo_x86
  static always_inline void detect_ht(struct cpuinfo_x86 *c) {}
  #endif
  
diff --git a/23614-x86_64-EFI-boot.patch b/23614-x86_64-EFI-boot.patch
index 44fa199..3ac0036 100644
--- a/23614-x86_64-EFI-boot.patch
+++ b/23614-x86_64-EFI-boot.patch
@@ -63,16 +63,16 @@ Index: xen-4.1.2-testing/xen/Makefile
 ===================================================================
 --- xen-4.1.2-testing.orig/xen/Makefile
 +++ xen-4.1.2-testing/xen/Makefile
-@@ -11,6 +11,8 @@ export XEN_DOMAIN	?= $(shell ([ -x /bin/
- 
+@@ -12,6 +12,8 @@ export XEN_DOMAIN	?= $(shell ([ -x /bin/
  export BASEDIR := $(CURDIR)
+ export XEN_ROOT := $(BASEDIR)/..
  
 +EFI_MOUNTPOINT ?= /boot/efi
 +
  .PHONY: default
  default: build
  
-@@ -32,6 +34,18 @@ _install: $(TARGET).gz
+@@ -33,6 +35,18 @@ _install: $(TARGET).gz
  	ln -f -s $(notdir $(TARGET))-$(XEN_FULLVERSION).gz $(DESTDIR)/boot/$(notdir $(TARGET))-$(XEN_VERSION).gz
  	ln -f -s $(notdir $(TARGET))-$(XEN_FULLVERSION).gz $(DESTDIR)/boot/$(notdir $(TARGET)).gz
  	$(INSTALL_DATA) $(TARGET)-syms $(DESTDIR)/boot/$(notdir $(TARGET))-syms-$(XEN_FULLVERSION)
diff --git a/23685-libxl-segfault-fix.patch b/23685-libxl-segfault-fix.patch
deleted file mode 100644
index 73857b5..0000000
--- a/23685-libxl-segfault-fix.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-# HG changeset patch
-# User Stefano Stabellini <stefano.stabellini@eu.citrix.com>
-# Date 1310654989 -3600
-# Node ID 5239811f92e1ffb185a50172fdcf47372e71ba7e
-# Parent  98701b1276c034b2bbbc8c7a975cf4c361caaa63
-libxl: Fix segfault in get_all_assigned_devices
-
-pcidevs is an array of ndev elements (ndev is the number of pci devices
-assigend to a specific domain), but we access pcidevs + *num
-where *num is the global number of pci devices assigned so far to all
-domains in the system.
-
-Fix the issue removing pcidevs and just realloc'ing *list every time we
-want to add a new pci device to the array.
-
-Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
-Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
-
-Index: xen-4.1.2-testing/tools/libxl/libxl_pci.c
-===================================================================
---- xen-4.1.2-testing.orig/tools/libxl/libxl_pci.c
-+++ xen-4.1.2-testing/tools/libxl/libxl_pci.c
-@@ -434,7 +434,6 @@ retry_transaction2:
- 
- static int get_all_assigned_devices(libxl__gc *gc, libxl_device_pci **list, int *num)
- {
--    libxl_device_pci *pcidevs = NULL;
-     char **domlist;
-     unsigned int nd = 0, i;
- 
-@@ -451,8 +450,7 @@ static int get_all_assigned_devices(libx
-             int ndev = atoi(num_devs), j;
-             char *devpath, *bdf;
- 
--            pcidevs = libxl__calloc(gc, sizeof(*pcidevs), ndev);
--            for(j = (pcidevs) ? 0 : ndev; j < ndev; j++) {
-+            for(j = 0; j < ndev; j++) {
-                 devpath = libxl__sprintf(gc, "/local/domain/0/backend/pci/%s/0/dev-%u",
-                                         domlist[i], j);
-                 bdf = libxl__xs_read(gc, XBT_NULL, devpath);
-@@ -461,19 +459,16 @@ static int get_all_assigned_devices(libx
-                     if ( sscanf(bdf, PCI_BDF, &dom, &bus, &dev, &func) != 4 )
-                         continue;
- 
--                    pcidev_init(pcidevs + *num, dom, bus, dev, func, 0);
-+                    *list = realloc(*list, sizeof(libxl_device_pci) * ((*num) + 1));
-+                    if (*list == NULL)
-+                        return ERROR_NOMEM;
-+                    pcidev_init(*list + *num, dom, bus, dev, func, 0);
-                     (*num)++;
-                 }
-             }
-         }
-     }
--
--    if ( 0 == *num ) {
--        free(pcidevs);
--        pcidevs = NULL;
--    }else{
--        *list = pcidevs;
--    }
-+    libxl__ptr_add(gc, *list);
- 
-     return 0;
- }
diff --git a/23726-x86-intel-flexmigration-v2.patch b/23726-x86-intel-flexmigration-v2.patch
new file mode 100644
index 0000000..87a84b8
--- /dev/null
+++ b/23726-x86-intel-flexmigration-v2.patch
@@ -0,0 +1,127 @@
+# HG changeset patch
+# User Jan Beulich <jbeulich@novell.com>
+# Date 1311081291 -3600
+# Node ID fd97ca086df6808bffc6ecf3f79cebca64c60bc3
+# Parent  4dc6a9ba90d60fdf0cc0898fc9a8fe84ae9030fc
+x86: update Intel CPUID masking code to latest spec
+
+..., which adds masking of the xsave feature leaf.
+
+Also fix the printing (to actually make it do what it was supposed to
+do from the beginning) of what specific masking couldn't be done in
+case the user requested something the hardware doesn't support.
+
+Signed-off-by: Jan Beulich <jbeulich@novell.com>
+
+# HG changeset patch
+# User Jan Beulich <jbeulich@novell.com>
+# Date 1311255291 -3600
+# Node ID 48f72b389b04cfa8d44924577a69ed59e48fbe77
+# Parent  dd5eecf739d152fb16bd44897875ea878d4c9d59
+x86: add change missing in c/s 23726:fd97ca086df6
+
+The early "do we need to do anything" check needs adjustment, too.
+Thanks to Haitao Shan for pointing this out.
+
+Signed-off-by: Jan Beulich <jbeulich@novell.com>
+
+--- a/xen/arch/x86/cpu/common.c
++++ b/xen/arch/x86/cpu/common.c
+@@ -27,10 +27,15 @@ boolean_param("noserialnumber", disable_
+ 
+ static bool_t __cpuinitdata use_xsave = 1;
+ boolean_param("xsave", use_xsave);
++
+ unsigned int __devinitdata opt_cpuid_mask_ecx = ~0u;
+ integer_param("cpuid_mask_ecx", opt_cpuid_mask_ecx);
+ unsigned int __devinitdata opt_cpuid_mask_edx = ~0u;
+ integer_param("cpuid_mask_edx", opt_cpuid_mask_edx);
++
++unsigned int __devinitdata opt_cpuid_mask_xsave_eax = ~0u;
++integer_param("cpuid_mask_xsave_eax", opt_cpuid_mask_xsave_eax);
++
+ unsigned int __devinitdata opt_cpuid_mask_ext_ecx = ~0u;
+ integer_param("cpuid_mask_ext_ecx", opt_cpuid_mask_ext_ecx);
+ unsigned int __devinitdata opt_cpuid_mask_ext_edx = ~0u;
+--- a/xen/arch/x86/cpu/cpu.h
++++ b/xen/arch/x86/cpu/cpu.h
+@@ -22,6 +22,7 @@ struct cpu_dev {
+ extern struct cpu_dev * cpu_devs [X86_VENDOR_NUM];
+ 
+ extern unsigned int opt_cpuid_mask_ecx, opt_cpuid_mask_edx;
++extern unsigned int opt_cpuid_mask_xsave_eax;
+ extern unsigned int opt_cpuid_mask_ext_ecx, opt_cpuid_mask_ext_edx;
+ 
+ extern int get_model_name(struct cpuinfo_x86 *c);
+--- a/xen/arch/x86/cpu/intel.c
++++ b/xen/arch/x86/cpu/intel.c
+@@ -59,10 +59,12 @@ void set_cpuid_faulting(bool_t enable)
+  */
+ static void __devinit set_cpuidmask(const struct cpuinfo_x86 *c)
+ {
++	u32 eax, edx;
+ 	const char *extra = "";
+ 
+ 	if (!~(opt_cpuid_mask_ecx & opt_cpuid_mask_edx &
+-	       opt_cpuid_mask_ext_ecx & opt_cpuid_mask_ext_edx))
++	       opt_cpuid_mask_ext_ecx & opt_cpuid_mask_ext_edx &
++               opt_cpuid_mask_xsave_eax))
+ 		return;
+ 
+ 	/* Only family 6 supports this feature  */
+@@ -75,9 +77,12 @@ static void __devinit set_cpuidmask(cons
+ 		wrmsr(MSR_INTEL_CPUID_FEATURE_MASK,
+ 		      opt_cpuid_mask_ecx,
+ 		      opt_cpuid_mask_edx);
+-		if (!~(opt_cpuid_mask_ext_ecx & opt_cpuid_mask_ext_edx))
++		if (~(opt_cpuid_mask_ext_ecx & opt_cpuid_mask_ext_edx))
++			extra = "extended ";
++		else if (~opt_cpuid_mask_xsave_eax)
++			extra = "xsave ";
++		else
+ 			return;
+-		extra = "extended ";
+ 		break;
+ /* 
+  * CPU supports this feature if the processor signature meets the following:
+@@ -97,11 +102,25 @@ static void __devinit set_cpuidmask(cons
+ 		wrmsr(MSR_INTEL_CPUID80000001_FEATURE_MASK,
+ 		      opt_cpuid_mask_ext_ecx,
+ 		      opt_cpuid_mask_ext_edx);
++		if (!~opt_cpuid_mask_xsave_eax)
++			return;
++		extra = "xsave ";
++		break;
++	case 0x2a:
++		wrmsr(MSR_INTEL_CPUID1_FEATURE_MASK_V2,
++		      opt_cpuid_mask_ecx,
++		      opt_cpuid_mask_edx);
++		rdmsr(MSR_INTEL_CPUIDD_01_FEATURE_MASK, eax, edx);
++		wrmsr(MSR_INTEL_CPUIDD_01_FEATURE_MASK,
++		      opt_cpuid_mask_xsave_eax, edx);
++		wrmsr(MSR_INTEL_CPUID80000001_FEATURE_MASK_V2,
++		      opt_cpuid_mask_ext_ecx,
++		      opt_cpuid_mask_ext_edx);
+ 		return;
+ 	}
+ 
+-	printk(XENLOG_ERR "Cannot set CPU feature mask on CPU#%d\n",
+-	       smp_processor_id());
++	printk(XENLOG_ERR "Cannot set CPU %sfeature mask on CPU#%d\n",
++	       extra, smp_processor_id());
+ }
+ 
+ void __devinit early_intel_workaround(struct cpuinfo_x86 *c)
+--- a/xen/include/asm-x86/msr-index.h
++++ b/xen/include/asm-x86/msr-index.h
+@@ -488,6 +488,10 @@
+ #define MSR_INTEL_CPUID1_FEATURE_MASK	0x00000130
+ #define MSR_INTEL_CPUID80000001_FEATURE_MASK 0x00000131
+ 
++#define MSR_INTEL_CPUID1_FEATURE_MASK_V2        0x00000132
++#define MSR_INTEL_CPUID80000001_FEATURE_MASK_V2 0x00000133
++#define MSR_INTEL_CPUIDD_01_FEATURE_MASK        0x00000134
++
+ /* Intel cpuid faulting MSRs */
+ #define MSR_INTEL_PLATFORM_INFO		0x000000ce
+ #define MSR_INTEL_MISC_FEATURES_ENABLES	0x00000140
diff --git a/23771-x86-ioapic-clear-pin.patch b/23771-x86-ioapic-clear-pin.patch
index 98c7cf3..8086796 100644
--- a/23771-x86-ioapic-clear-pin.patch
+++ b/23771-x86-ioapic-clear-pin.patch
@@ -23,7 +23,7 @@ Index: xen-4.1.2-testing/xen/arch/x86/io_apic.c
 ===================================================================
 --- xen-4.1.2-testing.orig/xen/arch/x86/io_apic.c
 +++ xen-4.1.2-testing/xen/arch/x86/io_apic.c
-@@ -365,14 +365,12 @@ static void eoi_IO_APIC_irq(unsigned int
+@@ -471,14 +471,12 @@ static void eoi_IO_APIC_irq(unsigned int
      spin_unlock_irqrestore(&ioapic_lock, flags);
  }
  
@@ -40,7 +40,7 @@ Index: xen-4.1.2-testing/xen/arch/x86/io_apic.c
      if (entry.delivery_mode == dest_SMI)
          return;
  
-@@ -381,7 +379,7 @@ static void __clear_IO_APIC_pin(unsigned
+@@ -487,7 +485,7 @@ static void __clear_IO_APIC_pin(unsigned
       */
      memset(&entry, 0, sizeof(entry));
      entry.mask = 1;
@@ -49,7 +49,7 @@ Index: xen-4.1.2-testing/xen/arch/x86/io_apic.c
  }
  
  static void clear_IO_APIC (void)
-@@ -389,10 +387,8 @@ static void clear_IO_APIC (void)
+@@ -495,10 +493,8 @@ static void clear_IO_APIC (void)
      int apic, pin;
  
      for (apic = 0; apic < nr_ioapics; apic++) {
diff --git a/23782-x86-ioapic-clear-irr.patch b/23782-x86-ioapic-clear-irr.patch
index 1177788..f2c6f1f 100644
--- a/23782-x86-ioapic-clear-irr.patch
+++ b/23782-x86-ioapic-clear-irr.patch
@@ -20,11 +20,9 @@ Based on a Linux patch from suresh.b.siddha@intel.com.
 
 Signed-off-by: Jan Beulich <jbeulich@novell.com>
 
-Index: xen-4.1.2-testing/xen/arch/x86/io_apic.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/io_apic.c
-+++ xen-4.1.2-testing/xen/arch/x86/io_apic.c
-@@ -375,11 +375,46 @@ static void clear_IO_APIC_pin(unsigned i
+--- a/xen/arch/x86/io_apic.c
++++ b/xen/arch/x86/io_apic.c
+@@ -481,11 +481,35 @@ static void clear_IO_APIC_pin(unsigned i
          return;
  
      /*
@@ -43,18 +41,7 @@ Index: xen-4.1.2-testing/xen/arch/x86/io_apic.c
 +            entry.trigger = 1;
 +            __ioapic_write_entry(apic, pin, TRUE, entry);
 +        }
-+        if (mp_ioapics[apic].mpc_apicver >= 0x20)
-+            io_apic_eoi(apic, entry.vector);
-+        else {
-+            /*
-+             * Mechanism by which we clear remoteIRR in this case is by
-+             * changing the trigger mode to edge and back to level.
-+             */
-+            entry.trigger = 0;
-+            __ioapic_write_entry(apic, pin, TRUE, entry);
-+            entry.trigger = 1;
-+            __ioapic_write_entry(apic, pin, TRUE, entry);
-+        }
++        __io_apic_eoi(apic, entry.vector, pin);
 +    }
 +
 +    /*
diff --git a/23783-ACPI-set-_PDC-bits.patch b/23783-ACPI-set-_PDC-bits.patch
index be1570b..a4c5f1c 100644
--- a/23783-ACPI-set-_PDC-bits.patch
+++ b/23783-ACPI-set-_PDC-bits.patch
@@ -230,7 +230,7 @@ Index: xen-4.1.2-testing/xen/include/asm-x86/cpufeature.h
 ===================================================================
 --- xen-4.1.2-testing.orig/xen/include/asm-x86/cpufeature.h
 +++ xen-4.1.2-testing/xen/include/asm-x86/cpufeature.h
-@@ -150,6 +150,10 @@
+@@ -151,6 +151,10 @@
  #define boot_cpu_has(bit)	test_bit(bit, boot_cpu_data.x86_capability)
  #define cpufeat_mask(idx)       (1u << ((idx) & 31))
  
diff --git a/23804-x86-IPI-counts.patch b/23804-x86-IPI-counts.patch
index 98a8136..436eb68 100644
--- a/23804-x86-IPI-counts.patch
+++ b/23804-x86-IPI-counts.patch
@@ -11,10 +11,8 @@ currently counted.
 
 Signed-off-by: Kevin Tian <kevin.tian@intel.com>
 
-Index: xen-4.1.2-testing/xen/arch/x86/apic.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/apic.c
-+++ xen-4.1.2-testing/xen/arch/x86/apic.c
+--- a/xen/arch/x86/apic.c
++++ b/xen/arch/x86/apic.c
 @@ -1372,6 +1372,7 @@ fastcall void smp_apic_timer_interrupt(s
      struct cpu_user_regs *old_regs = set_irq_regs(regs);
      ack_APIC_irq();
@@ -47,10 +45,8 @@ Index: xen-4.1.2-testing/xen/arch/x86/apic.c
      hvm_do_pmu_interrupt(regs);
      set_irq_regs(old_regs);
  }
-Index: xen-4.1.2-testing/xen/arch/x86/cpu/mcheck/mce_intel.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/cpu/mcheck/mce_intel.c
-+++ xen-4.1.2-testing/xen/arch/x86/cpu/mcheck/mce_intel.c
+--- a/xen/arch/x86/cpu/mcheck/mce_intel.c
++++ b/xen/arch/x86/cpu/mcheck/mce_intel.c
 @@ -66,6 +66,7 @@ static void (*vendor_thermal_interrupt)(
  fastcall void smp_thermal_interrupt(struct cpu_user_regs *regs)
  {
@@ -59,7 +55,7 @@ Index: xen-4.1.2-testing/xen/arch/x86/cpu/mcheck/mce_intel.c
      irq_enter();
      vendor_thermal_interrupt(regs);
      irq_exit();
-@@ -1094,6 +1095,7 @@ fastcall void smp_cmci_interrupt(struct
+@@ -1094,6 +1095,7 @@ fastcall void smp_cmci_interrupt(struct 
      struct cpu_user_regs *old_regs = set_irq_regs(regs);
  
      ack_APIC_irq();
@@ -67,11 +63,9 @@ Index: xen-4.1.2-testing/xen/arch/x86/cpu/mcheck/mce_intel.c
      irq_enter();
  
      mctc = mcheck_mca_logout(
-Index: xen-4.1.2-testing/xen/arch/x86/io_apic.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/io_apic.c
-+++ xen-4.1.2-testing/xen/arch/x86/io_apic.c
-@@ -434,6 +434,7 @@ fastcall void smp_irq_move_cleanup_inter
+--- a/xen/arch/x86/io_apic.c
++++ b/xen/arch/x86/io_apic.c
+@@ -529,6 +529,7 @@ fastcall void smp_irq_move_cleanup_inter
      struct cpu_user_regs *old_regs = set_irq_regs(regs);
  
      ack_APIC_irq();
@@ -79,10 +73,8 @@ Index: xen-4.1.2-testing/xen/arch/x86/io_apic.c
      irq_enter();
  
      me = smp_processor_id();
-Index: xen-4.1.2-testing/xen/arch/x86/smp.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/smp.c
-+++ xen-4.1.2-testing/xen/arch/x86/smp.c
+--- a/xen/arch/x86/smp.c
++++ b/xen/arch/x86/smp.c
 @@ -221,6 +221,7 @@ fastcall void smp_invalidate_interrupt(v
  {
      ack_APIC_irq();
diff --git a/23833-x86-IO-APIC-EOI.patch b/23833-x86-IO-APIC-EOI.patch
deleted file mode 100644
index 5f40861..0000000
--- a/23833-x86-IO-APIC-EOI.patch
+++ /dev/null
@@ -1,199 +0,0 @@
-# HG changeset patch
-# User Andrew Cooper <andrew.cooper3@citrix.com>
-# Date 1315906390 -3600
-# Node ID ffe8e65f6687cde49b2cb2bf991bd3f5dff9c189
-# Parent  ad3b4bb097cb6308f73e597c5412395ad783ea4a
-IRQ: IO-APIC support End Of Interrupt for older IO-APICs
-
-The old io_apic_eoi() function using the EOI register only works for
-IO-APICs with a version of 0x20.  Older IO-APICs do not have an EOI
-register so line level interrupts have to be EOI'd by flipping the
-mode to edge and back, which clears the IRR and Delivery Status bits.
-
-This patch replaces the current io_apic_eoi() function with one which
-takes into account the version of the IO-APIC and EOI's
-appropriately.
-
-v2: make recursive call to __io_apic_eoi() to reduce code size.
-
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-
---- a/xen/arch/x86/io_apic.c
-+++ b/xen/arch/x86/io_apic.c
-@@ -66,6 +66,13 @@ int __read_mostly nr_ioapics;
- #define MAX_PLUS_SHARED_IRQS nr_irqs_gsi
- #define PIN_MAP_SIZE (MAX_PLUS_SHARED_IRQS + nr_irqs_gsi)
- 
-+
-+#define ioapic_has_eoi_reg(apic) (mp_ioapics[(apic)].mpc_apicver >= 0x20)
-+
-+#define io_apic_eoi_vector(apic, vector) io_apic_eoi((apic), (vector), -1)
-+#define io_apic_eoi_pin(apic, pin) io_apic_eoi((apic), -1, (pin))
-+
-+
- /*
-  * This is performance-critical, we want to do it O(1)
-  *
-@@ -201,6 +208,105 @@ static void ioapic_write_entry(int apic,
-     spin_unlock_irqrestore(&ioapic_lock, flags);
- }
- 
-+/* EOI an IO-APIC entry.  One of vector or pin may be -1, indicating that
-+ * it should be worked out using the other.  This function expect that the
-+ * ioapic_lock is taken, and interrupts are disabled (or there is a good reason
-+ * not to), and that if both pin and vector are passed, that they refer to the
-+ * same redirection entry in the IO-APIC. */
-+static void __io_apic_eoi(unsigned int apic, unsigned int vector, unsigned int pin)
-+{
-+    /* Ensure some useful information is passed in */
-+    BUG_ON( (vector == -1 && pin == -1) );
-+
-+    /* Prefer the use of the EOI register if available */
-+    if ( ioapic_has_eoi_reg(apic) )
-+    {
-+        /* If vector is unknown, read it from the IO-APIC */
-+        if ( vector == -1 )
-+            vector = __ioapic_read_entry(apic, pin, TRUE).vector;
-+
-+        *(IO_APIC_BASE(apic)+16) = vector;
-+    }
-+    else
-+    {
-+        /* Else fake an EOI by switching to edge triggered mode
-+         * and back */
-+        struct IO_APIC_route_entry entry;
-+        bool_t need_to_unmask = 0;
-+
-+        /* If pin is unknown, search for it */
-+        if ( pin == -1 )
-+        {
-+            unsigned int p;
-+            for ( p = 0; p < nr_ioapic_registers[apic]; ++p )
-+            {
-+                entry = __ioapic_read_entry(apic, p, TRUE);
-+                if ( entry.vector == vector )
-+                {
-+                    pin = p;
-+                    /* break; */
-+
-+                    /* Here should be a break out of the loop, but at the
-+                     * Xen code doesn't actually prevent multiple IO-APIC
-+                     * entries being assigned the same vector, so EOI all
-+                     * pins which have the correct vector.
-+                     *
-+                     * Remove the following code when the above assertion
-+                     * is fulfilled. */
-+                    __io_apic_eoi(apic, vector, p);
-+                }
-+            }
-+
-+            /* If search fails, nothing to do */
-+
-+            /* if ( pin == -1 ) */
-+
-+            /* Because the loop wasn't broken out of (see comment above),
-+             * all relevant pins have been EOI, so we can always return.
-+             *
-+             * Re-instate the if statement above when the Xen logic has been
-+             * fixed.*/
-+
-+            return;
-+        }
-+
-+        entry = __ioapic_read_entry(apic, pin, TRUE);
-+
-+        if ( ! entry.mask )
-+        {
-+            /* If entry is not currently masked, mask it and make
-+             * a note to unmask it later */
-+            entry.mask = 1;
-+            __ioapic_write_entry(apic, pin, TRUE, entry);
-+            need_to_unmask = 1;
-+        }
-+
-+        /* Flip the trigger mode to edge and back */
-+        entry.trigger = 0;
-+        __ioapic_write_entry(apic, pin, TRUE, entry);
-+        entry.trigger = 1;
-+        __ioapic_write_entry(apic, pin, TRUE, entry);
-+
-+        if ( need_to_unmask )
-+        {
-+            /* Unmask if neccesary */
-+            entry.mask = 0;
-+            __ioapic_write_entry(apic, pin, TRUE, entry);
-+        }
-+    }
-+}
-+
-+/* EOI an IO-APIC entry.  One of vector or pin may be -1, indicating that
-+ * it should be worked out using the other.  This function disables interrupts
-+ * and takes the ioapic_lock */
-+static void io_apic_eoi(unsigned int apic, unsigned int vector, unsigned int pin)
-+{
-+    unsigned int flags;
-+    spin_lock_irqsave(&ioapic_lock, flags);
-+    __io_apic_eoi(apic, vector, pin);
-+    spin_unlock_irqrestore(&ioapic_lock, flags);
-+}
-+
- /*
-  * Saves all the IO-APIC RTE's
-  */
-@@ -350,7 +456,7 @@ static void __eoi_IO_APIC_irq(unsigned i
-         pin = entry->pin;
-         if (pin == -1)
-             break;
--        io_apic_eoi(entry->apic, vector);
-+        __io_apic_eoi(entry->apic, vector, pin);
-         if (!entry->next)
-             break;
-         entry = irq_2_pin + entry->next;
-@@ -390,18 +496,7 @@ static void clear_IO_APIC_pin(unsigned i
-             entry.trigger = 1;
-             __ioapic_write_entry(apic, pin, TRUE, entry);
-         }
--        if (mp_ioapics[apic].mpc_apicver >= 0x20)
--            io_apic_eoi(apic, entry.vector);
--        else {
--            /*
--             * Mechanism by which we clear remoteIRR in this case is by
--             * changing the trigger mode to edge and back to level.
--             */
--            entry.trigger = 0;
--            __ioapic_write_entry(apic, pin, TRUE, entry);
--            entry.trigger = 1;
--            __ioapic_write_entry(apic, pin, TRUE, entry);
--        }
-+        __io_apic_eoi(apic, entry.vector, pin);
-     }
- 
-     /*
-@@ -1731,7 +1826,7 @@ static void end_level_ioapic_irq (unsign
-     {
-         int ioapic;
-         for (ioapic = 0; ioapic < nr_ioapics; ioapic++)
--            io_apic_eoi(ioapic, i);
-+            io_apic_eoi_vector(ioapic, i);
-     }
- 
-     v = apic_read(APIC_TMR + ((i & ~0x1f) >> 1));
-@@ -2604,3 +2699,4 @@ void __init init_ioapic_mappings(void)
-     printk(XENLOG_INFO "IRQ limits: %u GSI, %u MSI/MSI-X\n",
-            nr_irqs_gsi, nr_irqs - nr_irqs_gsi);
- }
-+
---- a/xen/include/asm-x86/io_apic.h
-+++ b/xen/include/asm-x86/io_apic.h
-@@ -157,11 +157,6 @@ static inline void io_apic_write(unsigne
- 	__io_apic_write(apic, reg, value);
- }
- 
--static inline void io_apic_eoi(unsigned int apic, unsigned int vector)
--{
--	*(IO_APIC_BASE(apic)+16) = vector;
--}
--
- /*
-  * Re-write a value: to be used for read-modify-write
-  * cycles where the read already set up the index register.
diff --git a/23853-x86-pv-cpuid-xsave.patch b/23853-x86-pv-cpuid-xsave.patch
new file mode 100644
index 0000000..d905d43
--- /dev/null
+++ b/23853-x86-pv-cpuid-xsave.patch
@@ -0,0 +1,61 @@
+# HG changeset patch
+# User Shan Haitao <haitao.shan@intel.com>
+# Date 1316300518 -3600
+# Node ID b78235de5c6407023759f9bbf723dd83887fedf0
+# Parent  c944e82bb092925f31403a129087e9d40e0fa06a
+Fix PV CPUID virtualization of XSave
+
+The patch will fix XSave CPUID virtualization for PV guests. The XSave
+area size returned by CPUID leaf D is changed dynamically depending on
+the XCR0. Tools/libxc only assigns a static value. The fix will adjust
+xsave area size during runtime.
+
+Note: This fix is already in HVM cpuid virtualization. And Dom0 is not
+affected, either.
+
+Signed-off-by:  Shan Haitao <haitao.shan@intel.com>
+
+--- a/xen/arch/x86/hvm/hvm.c
++++ b/xen/arch/x86/hvm/hvm.c
+@@ -2310,7 +2310,7 @@ void hvm_cpuid(unsigned int input, unsig
+         {
+             /* reset EBX to default value first */
+             *ebx = XSAVE_AREA_MIN_SIZE; 
+-            for ( sub_leaf = 2; sub_leaf < 64; sub_leaf++ )
++            for ( sub_leaf = 2; sub_leaf < 63; sub_leaf++ )
+             {
+                 if ( !(v->arch.xcr0 & (1ULL << sub_leaf)) )
+                     continue;
+--- a/xen/arch/x86/traps.c
++++ b/xen/arch/x86/traps.c
+@@ -768,6 +768,30 @@ static void pv_cpuid(struct cpu_user_reg
+     {
+         if ( !cpuid_hypervisor_leaves(a, c, &a, &b, &c, &d) )
+             domain_cpuid(current->domain, a, c, &a, &b, &c, &d);
++
++        switch ( a )
++        {
++        case 0xd:
++        {
++            unsigned int sub_leaf, _eax, _ebx, _ecx, _edx;
++            /* EBX value of main leaf 0 depends on enabled xsave features */
++            if ( c == 0 && current->arch.xcr0 )
++            {
++                /* reset EBX to default value first */
++                b = XSAVE_AREA_MIN_SIZE;
++                for ( sub_leaf = 2; sub_leaf < 63; sub_leaf++ )
++                {
++                    if ( !(current->arch.xcr0 & (1ULL << sub_leaf)) )
++                        continue;
++                    domain_cpuid(current->domain, a, c, &_eax, &_ebx, &_ecx,
++                                 &_edx);
++                    if ( (_eax + _ebx) > b )
++                        b = _eax + _ebx;
++                }
++            }
++        break;
++        }
++        }
+         goto out;
+     }
+ 
diff --git a/23897-x86-mce-offline-again.patch b/23897-x86-mce-offline-again.patch
new file mode 100644
index 0000000..9d2856f
--- /dev/null
+++ b/23897-x86-mce-offline-again.patch
@@ -0,0 +1,63 @@
+# HG changeset patch
+# User Keir Fraser <keir@xen.org>
+# Date 1317413803 -3600
+# Node ID 2215d7d7382617adbe97831fe35752a027917d1d
+# Parent  d568e2313fd6f055b66a6c3cb2bca6372b77692e
+X86 MCE: Prevent malicious guest access broken page again
+
+To avoid recursive mce.
+
+Signed-off-by: Liu, Jinsong <jinsong.liu@intel.com>
+Committed-by: Keir Fraser <keir@xen.org>
+
+--- a/xen/arch/x86/cpu/mcheck/mce_intel.c
++++ b/xen/arch/x86/cpu/mcheck/mce_intel.c
+@@ -639,6 +639,8 @@ static void intel_memerr_dhandler(int bn
+     /* This is free page */
+     if (status & PG_OFFLINE_OFFLINED)
+         result->result = MCA_RECOVERED;
++    else if (status & PG_OFFLINE_AGAIN)
++        result->result = MCA_NO_ACTION;
+     else if (status & PG_OFFLINE_PENDING) {
+         /* This page has owner */
+         if (status & PG_OFFLINE_OWNED) {
+--- a/xen/common/page_alloc.c
++++ b/xen/common/page_alloc.c
+@@ -38,6 +38,7 @@
+ #include <xen/tmem.h>
+ #include <xen/tmem_xen.h>
+ #include <public/sysctl.h>
++#include <public/sched.h>
+ #include <asm/page.h>
+ #include <asm/numa.h>
+ #include <asm/flushtlb.h>
+@@ -704,6 +705,19 @@ int offline_page(unsigned long mfn, int 
+         return -EINVAL;
+     }
+ 
++    /*
++     * NB. When broken page belong to guest, usually hypervisor will
++     * notify the guest to handle the broken page. However, hypervisor
++     * need to prevent malicious guest access the broken page again.
++     * Under such case, hypervisor shutdown guest, preventing recursive mce.
++     */
++    if ( (pg->count_info & PGC_broken) && (owner = page_get_owner(pg)) )
++    {
++        *status = PG_OFFLINE_AGAIN;
++        domain_shutdown(owner, SHUTDOWN_crash);
++        return 0;
++    }
++
+     spin_lock(&heap_lock);
+ 
+     old_info = mark_page_offline(pg, broken);
+--- a/xen/include/public/sysctl.h
++++ b/xen/include/public/sysctl.h
+@@ -399,6 +399,7 @@ struct xen_sysctl_page_offline_op {
+ #define PG_OFFLINE_OFFLINED  (0x1UL << 1)
+ #define PG_OFFLINE_PENDING   (0x1UL << 2)
+ #define PG_OFFLINE_FAILED    (0x1UL << 3)
++#define PG_OFFLINE_AGAIN     (0x1UL << 4)
+ 
+ #define PG_ONLINE_FAILED     PG_OFFLINE_FAILED
+ #define PG_ONLINE_ONLINED    PG_OFFLINE_OFFLINED
diff --git a/23925-x86-AMD-ARAT-Fam12.patch b/23925-x86-AMD-ARAT-Fam12.patch
new file mode 100644
index 0000000..3853562
--- /dev/null
+++ b/23925-x86-AMD-ARAT-Fam12.patch
@@ -0,0 +1,33 @@
+# HG changeset patch
+# User Boris Ostrovsky <boris.ostrovsky@amd.com>
+# Date 1317976335 -7200
+# Node ID 08d6ba4e447d6c13c6dfac5c23e84b73961cb109
+# Parent  159be83e5fe9111bb30d8b1f83127f5724d44424
+x86/AMD: Do not enable ARAT feature on AMD processors below family 0x12
+
+Determining whether an AMD processor is affected by erratum 400 may
+have some corner cases and handling these cases is somewhat complicated.
+In the interest of simplicity we won't claim ARAT support on processor
+families below 0x12.
+
+Mirrors Linux commit e9cdd343a5e42c43bcda01e609fa23089e026470
+
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@amd.com>
+Committed-by: Jan Beulich <jbeulich@suse.com>
+
+--- a/xen/arch/x86/cpu/amd.c
++++ b/xen/arch/x86/cpu/amd.c
+@@ -632,8 +632,11 @@ static void __devinit init_amd(struct cp
+ 	}
+ #endif
+ 
+-	/* As a rule processors have APIC timer running in deep C states */
+-	if (c->x86 > 0xf && !cpu_has_amd_erratum(c, AMD_ERRATUM_400))
++	/*
++	 * Family 0x12 and above processors have APIC timer
++	 * running in deep C states.
++	 */
++	if (c->x86 > 0x11)
+ 		set_bit(X86_FEATURE_ARAT, c->x86_capability);
+ 
+ 	/* Prevent TSC drift in non single-processor, single-core platforms. */
diff --git a/23933-pt-bus2bridge-update.patch b/23933-pt-bus2bridge-update.patch
new file mode 100644
index 0000000..28dc248
--- /dev/null
+++ b/23933-pt-bus2bridge-update.patch
@@ -0,0 +1,138 @@
+# HG changeset patch
+# User Jan Beulich <jbeulich@suse.com>
+# Date 1318231292 -7200
+# Node ID 0b81515b8e982e8012c28e5f8d9e965c63b6503d
+# Parent  0c2bfd1f9c6822fbd23af0043f83d93be976323c
+passthrough: update bus2bridge mapping as PCI devices get added/removed
+
+This deals with two limitations at once: On device removal, the
+mapping did not get updated so far at all, and hotplugged devices as
+well as such not discoverable by Xen's initial bus scan (including the
+case where a non-zero PCI segment wasn't accessible during Xen boot,
+but became accessible after Dom0 validated access information against
+ACPI data) wouldn't cause updates to the mapping either.
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Acked-by: "Kay, Allen M" <allen.m.kay@intel.com>
+
+--- a/xen/drivers/passthrough/pci.c
++++ b/xen/drivers/passthrough/pci.c
+@@ -63,11 +63,67 @@ static struct pci_dev *alloc_pdev(u8 bus
+     list_add(&pdev->alldevs_list, &alldevs_list);
+     spin_lock_init(&pdev->msix_table_lock);
+ 
++    /* update bus2bridge */
++    switch ( pdev_type(bus, devfn) )
++    {
++        u8 sec_bus, sub_bus;
++
++        case DEV_TYPE_PCIe_BRIDGE:
++            break;
++
++        case DEV_TYPE_PCIe2PCI_BRIDGE:
++        case DEV_TYPE_LEGACY_PCI_BRIDGE:
++            sec_bus = pci_conf_read8(bus, PCI_SLOT(devfn), PCI_FUNC(devfn),
++                                     PCI_SECONDARY_BUS);
++            sub_bus = pci_conf_read8(bus, PCI_SLOT(devfn), PCI_FUNC(devfn),
++                                     PCI_SUBORDINATE_BUS);
++
++            spin_lock(&bus2bridge_lock);
++            for ( ; sec_bus <= sub_bus; sec_bus++ )
++            {
++                bus2bridge[sec_bus].map = 1;
++                bus2bridge[sec_bus].bus = bus;
++                bus2bridge[sec_bus].devfn = devfn;
++            }
++            spin_unlock(&bus2bridge_lock);
++            break;
++
++        case DEV_TYPE_PCIe_ENDPOINT:
++        case DEV_TYPE_PCI:
++            break;
++
++        default:
++            printk(XENLOG_WARNING "%s: unknown type: %02x:%02x.%u\n",
++                   __func__, bus, PCI_SLOT(devfn), PCI_FUNC(devfn));
++            break;
++    }
++
+     return pdev;
+ }
+ 
+ static void free_pdev(struct pci_dev *pdev)
+ {
++    /* update bus2bridge */
++    switch ( pdev_type(pdev->bus, pdev->devfn) )
++    {
++        u8 dev, func, sec_bus, sub_bus;
++
++        case DEV_TYPE_PCIe2PCI_BRIDGE:
++        case DEV_TYPE_LEGACY_PCI_BRIDGE:
++            dev = PCI_SLOT(pdev->devfn);
++            func = PCI_FUNC(pdev->devfn);
++            sec_bus = pci_conf_read8(pdev->bus, dev, func,
++                                     PCI_SECONDARY_BUS);
++            sub_bus = pci_conf_read8(pdev->bus, dev, func,
++                                     PCI_SUBORDINATE_BUS);
++
++            spin_lock(&bus2bridge_lock);
++            for ( ; sec_bus <= sub_bus; sec_bus++ )
++                bus2bridge[sec_bus] = bus2bridge[pdev->bus];
++            spin_unlock(&bus2bridge_lock);
++            break;
++    }
++
+     list_del(&pdev->alldevs_list);
+     xfree(pdev);
+ }
+@@ -432,8 +488,6 @@ int __init scan_pci_devices(void)
+ {
+     struct pci_dev *pdev;
+     int bus, dev, func;
+-    u8 sec_bus, sub_bus;
+-    int type;
+ 
+     spin_lock(&pcidevs_lock);
+     for ( bus = 0; bus < 256; bus++ )
+@@ -453,41 +507,6 @@ int __init scan_pci_devices(void)
+                     return -ENOMEM;
+                 }
+ 
+-                /* build bus2bridge */
+-                type = pdev_type(bus, PCI_DEVFN(dev, func));
+-                switch ( type )
+-                {
+-                    case DEV_TYPE_PCIe_BRIDGE:
+-                        break;
+-
+-                    case DEV_TYPE_PCIe2PCI_BRIDGE:
+-                    case DEV_TYPE_LEGACY_PCI_BRIDGE:
+-                        sec_bus = pci_conf_read8(bus, dev, func,
+-                                                 PCI_SECONDARY_BUS);
+-                        sub_bus = pci_conf_read8(bus, dev, func,
+-                                                 PCI_SUBORDINATE_BUS);
+-
+-                        spin_lock(&bus2bridge_lock);
+-                        for ( sub_bus &= 0xff; sec_bus <= sub_bus; sec_bus++ )
+-                        {
+-                            bus2bridge[sec_bus].map = 1;
+-                            bus2bridge[sec_bus].bus =  bus;
+-                            bus2bridge[sec_bus].devfn =  PCI_DEVFN(dev, func);
+-                        }
+-                        spin_unlock(&bus2bridge_lock);
+-                        break;
+-
+-                    case DEV_TYPE_PCIe_ENDPOINT:
+-                    case DEV_TYPE_PCI:
+-                        break;
+-
+-                    default:
+-                        printk("%s: unknown type: bdf = %x:%x.%x\n",
+-                               __func__, bus, dev, func);
+-                        spin_unlock(&pcidevs_lock);
+-                        return -EINVAL;
+-                }
+-
+                 if ( !func && !(pci_conf_read8(bus, dev, func,
+                                                PCI_HEADER_TYPE) & 0x80) )
+                     break;
diff --git a/23955-x86-pv-cpuid-xsave.patch b/23955-x86-pv-cpuid-xsave.patch
new file mode 100644
index 0000000..7c04efb
--- /dev/null
+++ b/23955-x86-pv-cpuid-xsave.patch
@@ -0,0 +1,45 @@
+# HG changeset patch
+# User Shan Haitao <haitao.shan@intel.com>
+# Date 1318517935 -3600
+# Node ID bbde1453cbd95d6d36febe9c552f9cfa26b5c49e
+# Parent  c1bd53fac3d5e5868352894d62dbacd6de0b0e7a
+x86: Further fixes for xsave leaf in pv_cpuid().
+
+Signed-off-by: Shan Haitao <haitao.shan@intel.com>
+Committed-by: Keir Fraser <keir@xen.org>
+
+--- a/xen/arch/x86/traps.c
++++ b/xen/arch/x86/traps.c
+@@ -766,16 +766,18 @@ static void pv_cpuid(struct cpu_user_reg
+ 
+     if ( current->domain->domain_id != 0 )
+     {
++        unsigned int cpuid_leaf = a, sub_leaf = c;
++
+         if ( !cpuid_hypervisor_leaves(a, c, &a, &b, &c, &d) )
+             domain_cpuid(current->domain, a, c, &a, &b, &c, &d);
+ 
+-        switch ( a )
++        switch ( cpuid_leaf )
+         {
+         case 0xd:
+         {
+-            unsigned int sub_leaf, _eax, _ebx, _ecx, _edx;
++            unsigned int _eax, _ebx, _ecx, _edx;
+             /* EBX value of main leaf 0 depends on enabled xsave features */
+-            if ( c == 0 && current->arch.xcr0 )
++            if ( sub_leaf == 0 && current->arch.xcr0 )
+             {
+                 /* reset EBX to default value first */
+                 b = XSAVE_AREA_MIN_SIZE;
+@@ -783,8 +785,8 @@ static void pv_cpuid(struct cpu_user_reg
+                 {
+                     if ( !(current->arch.xcr0 & (1ULL << sub_leaf)) )
+                         continue;
+-                    domain_cpuid(current->domain, a, c, &_eax, &_ebx, &_ecx,
+-                                 &_edx);
++                    domain_cpuid(current->domain, cpuid_leaf, sub_leaf,
++                                 &_eax, &_ebx, &_ecx, &_edx);
+                     if ( (_eax + _ebx) > b )
+                         b = _eax + _ebx;
+                 }
diff --git a/23957-cpufreq-error-paths.patch b/23957-cpufreq-error-paths.patch
new file mode 100644
index 0000000..dd2cfa4
--- /dev/null
+++ b/23957-cpufreq-error-paths.patch
@@ -0,0 +1,62 @@
+# HG changeset patch
+# User Jan Beulich <jbeulich@suse.com>
+# Date 1318580154 -7200
+# Node ID de316831471a8e0f11f615e7bf336dee2ba811e7
+# Parent  a65693f9fb1250ff4819774a70284693705db9e7
+cpufreq: error path fixes
+
+This fixes an actual bug (failure to exit from a function after an
+allocation failure), an inconsistency (not removing the cpufreq_dom
+list member upon failure), and a latent bug (not clearing the current
+governor upon governor initialization failure when there was no old
+one; latent because the only current code path leading to this
+situation frees the policy upon failure and hence the governor not
+getting cleared is benign).
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Acked-by: Keir Fraser <keir@xen.org>
+
+--- a/xen/drivers/cpufreq/cpufreq.c
++++ b/xen/drivers/cpufreq/cpufreq.c
+@@ -195,8 +195,10 @@ int cpufreq_add_cpu(unsigned int cpu)
+ 
+     if (!domexist || hw_all) {
+         policy = xmalloc(struct cpufreq_policy);
+-        if (!policy)
++        if (!policy) {
+             ret = -ENOMEM;
++            goto err0;
++        }
+ 
+         memset(policy, 0, sizeof(struct cpufreq_policy));
+         policy->cpu = cpu;
+@@ -206,7 +208,7 @@ int cpufreq_add_cpu(unsigned int cpu)
+         if (ret) {
+             xfree(policy);
+             per_cpu(cpufreq_cpu_policy, cpu) = NULL;
+-            return ret;
++            goto err0;
+         }
+         if (cpufreq_verbose)
+             printk("CPU %u initialization completed\n", cpu);
+@@ -263,7 +265,7 @@ err1:
+         cpufreq_driver->exit(policy);
+         xfree(policy);
+     }
+-
++err0:
+     if (cpus_empty(cpufreq_dom->map)) {
+         list_del(&cpufreq_dom->node);
+         xfree(cpufreq_dom);
+--- a/xen/drivers/cpufreq/utility.c
++++ b/xen/drivers/cpufreq/utility.c
+@@ -462,8 +462,8 @@ int __cpufreq_set_policy(struct cpufreq_
+                                  data->governor->name);
+ 
+             /* new governor failed, so re-start old one */
++            data->governor = old_gov;
+             if (old_gov) {
+-                data->governor = old_gov;
+                 __cpufreq_governor(data, CPUFREQ_GOV_START);
+                 printk(KERN_WARNING "Still stay at %s governor\n",
+                                      data->governor->name);
diff --git a/init.pciback b/init.pciback
new file mode 100644
index 0000000..1f1cdba
--- /dev/null
+++ b/init.pciback
@@ -0,0 +1,119 @@
+#!/bin/bash
+#
+# Copyright (c) 2001 SuSE GmbH Nuernberg, Germany.  All rights reserved.
+#
+# /etc/init.d/pciback
+#
+### BEGIN INIT INFO
+# Provides:          pciback
+# Required-Start:    $syslog $network
+# Should-Start:      $null
+# Required-Stop:     $syslog $network
+# Should-Stop:       $null
+# Default-Start:     3 5
+# Default-Stop:      0 1 2 6
+# Description:       bind PCI devices to pciback
+### END INIT INFO
+
+. /etc/rc.status
+. /etc/sysconfig/pciback
+
+rc_reset
+
+load_pciback() {
+  if ! lsmod | grep -qi "pciback"
+  then
+    echo "Loading pciback ..."
+    modprobe pciback
+  fi
+}
+
+unload_pciback() {
+  if lsmod | grep -qi "pciback"
+  then
+    echo "Unloading pciback ..."
+    modprobe -r pciback
+  fi
+}
+
+bind_dev_to_pciback() {
+  for DEVICE in ${XEN_PCI_HIDE_LIST}
+  do
+    local DRV=`echo ${DEVICE} | /usr/bin/cut -d "," -f 1`
+    local PCIID=`echo ${DEVICE} | /usr/bin/cut -d "," -f 2`
+
+    if ! ls /sys/bus/pci/drivers/pciback/${PCIID} > /dev/null 2>&1
+    then
+      echo "Binding ${PCIID} ..."
+      if ls /sys/bus/pci/drivers/${DRV}/${PCIID} > /dev/null 2>&1
+      then
+        echo -n ${PCIID} > /sys/bus/pci/drivers/${DRV}/unbind
+      fi
+      echo -n ${PCIID} > /sys/bus/pci/drivers/pciback/new_slot
+      echo -n ${PCIID} > /sys/bus/pci/drivers/pciback/bind
+    fi
+  done
+}
+
+unbind_dev_from_pciback() {
+  for DEVICE in ${XEN_PCI_HIDE_LIST}
+  do
+    local DRV=`echo ${DEVICE} | /usr/bin/cut -d "," -f 1`
+    local PCIID=`echo ${DEVICE} | /usr/bin/cut -d "," -f 2`
+
+    if ls /sys/bus/pci/drivers/pciback/${PCIID} > /dev/null
+    then
+      echo "Unbinding ${PCIID} ..."
+      echo -n ${PCIID} > /sys/bus/pci/drivers/pciback/unbind
+    fi
+  done
+}
+
+test "uname -r" | grep xen && exit 0
+
+case $1 in
+  start)
+    echo "Starting pciback ..."
+    echo 
+    load_pciback
+    bind_dev_to_pciback
+
+    rc_status -v -r
+  ;;
+  stop)
+    echo "Stopping pciback ..."
+    echo 
+    unbind_dev_from_pciback
+    unload_pciback
+
+    rc_status -v
+  ;;
+  reload|restart)
+    echo "Stopping pciback ..."
+    echo 
+    unbind_dev_from_pciback
+    unload_pciback
+    echo "Starting pciback ..."
+    echo 
+    load_pciback
+    bind_dev_to_pciback
+  ;;
+  status)
+    if lsmod | grep -qi pciback
+    then
+      echo
+      echo "pciback:  loaded"
+      echo
+      echo "Currently bound devices ..."
+      echo "-----------------------------"
+      ls /sys/bus/pci/drivers/pciback | grep ^0000
+      echo
+    else
+      echo "pciback:  not loaded"
+    fi
+  ;;
+  *)
+    echo "Usage: $0 [start|stop|restart|reload|status]"
+    exit 1
+  ;;
+esac
diff --git a/init.xendomains b/init.xendomains
index face621..f311eec 100644
--- a/init.xendomains
+++ b/init.xendomains
@@ -24,7 +24,7 @@ rc_reset
 LOCKFILE=/var/lock/subsys/xendomains
 XENDOM_CONFIG=/etc/sysconfig/xendomains
 RETCODE_FILE=/tmp/xendomains.rc.$$
-xm_cmd=xl
+xm_cmd=echo
 
 . "$XENDOM_CONFIG"
 
@@ -57,7 +57,11 @@ xendomains_abort()
 check()
 {
        XEND=`pidof -x /usr/sbin/xend`
-
+	if [ -z "$XEND" ]; then
+		xm_cmd="xl -f"
+	else
+		xm_cmd="xm"
+	fi
 	if [ "$1" = status ]; then
 		if [ ! -e /proc/xen/capabilities ] || [ ! -r "$XENDOM_CONFIG" ] || [ -z "$XEND" ]; then
 			xendomains_abort 3
diff --git a/sysconfig.pciback b/sysconfig.pciback
new file mode 100644
index 0000000..ae012c3
--- /dev/null
+++ b/sysconfig.pciback
@@ -0,0 +1,9 @@
+## Path: System/Virtualization
+## Type: string
+## Default: ""
+#
+# Space delimited list of PCI devices to late bind to pciback
+# Format:  <driver>,<PCI ID>
+#
+#XEN_PCI_HIDE_LIST="e1000,0000:0b:00.0 e1000,0000:0b:00.1"
+XEN_PCI_HIDE_LIST=""
diff --git a/udev-rules.patch b/udev-rules.patch
index bac7b77..af4979f 100644
--- a/udev-rules.patch
+++ b/udev-rules.patch
@@ -2,8 +2,10 @@ Index: xen-4.1.2-testing/tools/hotplug/Linux/xen-backend.rules
 ===================================================================
 --- xen-4.1.2-testing.orig/tools/hotplug/Linux/xen-backend.rules
 +++ xen-4.1.2-testing/tools/hotplug/Linux/xen-backend.rules
-@@ -14,3 +14,4 @@ KERNEL=="gntdev", NAME="xen/%k", MODE="0
+@@ -13,4 +13,5 @@ KERNEL=="blktap-control", NAME="xen/blkt
+ KERNEL=="gntdev", NAME="xen/%k", MODE="0600"
  KERNEL=="pci_iomul", NAME="xen/%k", MODE="0600"
  KERNEL=="tapdev[a-z]*", NAME="xen/blktap-2/tapdev%m", MODE="0600"
- SUBSYSTEM=="net", KERNEL=="tap*", ACTION=="add", RUN+="/etc/xen/scripts/vif-setup $env{ACTION} type_if=tap"
+-SUBSYSTEM=="net", KERNEL=="tap*", ACTION=="add", RUN+="/etc/xen/scripts/vif-setup $env{ACTION} type_if=tap"
++SUBSYSTEM=="net", KERNEL=="tap*", ACTION=="add", TEST="/proc/xen", RUN+="/etc/xen/scripts/vif-setup $env{ACTION} type_if=tap"
 +KERNELS=="xen", KERNEL=="xvd*", SUBSYSTEM=="block", OPTIONS+="last_rule"
diff --git a/x86-show-page-walk-early.patch b/x86-show-page-walk-early.patch
index 59c039e..54bf906 100644
--- a/x86-show-page-walk-early.patch
+++ b/x86-show-page-walk-early.patch
@@ -1,7 +1,5 @@
-Index: xen-4.1.2-testing/xen/arch/x86/mm.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/mm.c
-+++ xen-4.1.2-testing/xen/arch/x86/mm.c
+--- a/xen/arch/x86/mm.c
++++ b/xen/arch/x86/mm.c
 @@ -162,6 +162,8 @@ static int get_superpage(unsigned long m
  #endif
  static void put_superpage(unsigned long mfn);
@@ -11,11 +9,9 @@ Index: xen-4.1.2-testing/xen/arch/x86/mm.c
  #define l1_disallow_mask(d)                                     \
      ((d != dom_io) &&                                           \
       (rangeset_is_empty((d)->iomem_caps) &&                     \
-Index: xen-4.1.2-testing/xen/arch/x86/traps.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/traps.c
-+++ xen-4.1.2-testing/xen/arch/x86/traps.c
-@@ -1430,6 +1430,7 @@ asmlinkage void __init do_early_page_fau
+--- a/xen/arch/x86/traps.c
++++ b/xen/arch/x86/traps.c
+@@ -1456,6 +1456,7 @@ asmlinkage void __init do_early_page_fau
          unsigned long *stk = (unsigned long *)regs;
          printk("Early fatal page fault at %04x:%p (cr2=%p, ec=%04x)\n", 
                 regs->cs, _p(regs->eip), _p(cr2), regs->error_code);
@@ -23,10 +19,8 @@ Index: xen-4.1.2-testing/xen/arch/x86/traps.c
          printk("Stack dump: ");
          while ( ((long)stk & ((PAGE_SIZE - 1) & ~(BYTES_PER_LONG - 1))) != 0 )
              printk("%p ", _p(*stk++));
-Index: xen-4.1.2-testing/xen/arch/x86/x86_32/mm.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/x86_32/mm.c
-+++ xen-4.1.2-testing/xen/arch/x86/x86_32/mm.c
+--- a/xen/arch/x86/x86_32/mm.c
++++ b/xen/arch/x86/x86_32/mm.c
 @@ -122,6 +122,8 @@ void __init paging_init(void)
  #undef CNT
  #undef MFN
@@ -36,10 +30,8 @@ Index: xen-4.1.2-testing/xen/arch/x86/x86_32/mm.c
      /* Create page tables for ioremap()/map_domain_page_global(). */
      for ( i = 0; i < (IOREMAP_MBYTES >> (L2_PAGETABLE_SHIFT - 20)); i++ )
      {
-Index: xen-4.1.2-testing/xen/arch/x86/x86_32/traps.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/x86_32/traps.c
-+++ xen-4.1.2-testing/xen/arch/x86/x86_32/traps.c
+--- a/xen/arch/x86/x86_32/traps.c
++++ b/xen/arch/x86/x86_32/traps.c
 @@ -164,7 +164,8 @@ void show_page_walk(unsigned long addr)
      l3t += (cr3 & 0xFE0UL) >> 3;
      l3e = l3t[l3_table_offset(addr)];
@@ -70,10 +62,8 @@ Index: xen-4.1.2-testing/xen/arch/x86/x86_32/traps.c
      printk(" L1[0x%03lx] = %"PRIpte" %08lx\n",
             l1_table_offset(addr), l1e_get_intpte(l1e), pfn);
      unmap_domain_page(l1t);
-Index: xen-4.1.2-testing/xen/arch/x86/x86_64/mm.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/x86_64/mm.c
-+++ xen-4.1.2-testing/xen/arch/x86/x86_64/mm.c
+--- a/xen/arch/x86/x86_64/mm.c
++++ b/xen/arch/x86/x86_64/mm.c
 @@ -751,6 +751,8 @@ void __init paging_init(void)
  #undef CNT
  #undef MFN
@@ -83,10 +73,8 @@ Index: xen-4.1.2-testing/xen/arch/x86/x86_64/mm.c
      /* Create user-accessible L2 directory to map the MPT for compat guests. */
      BUILD_BUG_ON(l4_table_offset(RDWR_MPT_VIRT_START) !=
                   l4_table_offset(HIRO_COMPAT_MPT_VIRT_START));
-Index: xen-4.1.2-testing/xen/arch/x86/x86_64/traps.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/x86_64/traps.c
-+++ xen-4.1.2-testing/xen/arch/x86/x86_64/traps.c
+--- a/xen/arch/x86/x86_64/traps.c
++++ b/xen/arch/x86/x86_64/traps.c
 @@ -176,7 +176,8 @@ void show_page_walk(unsigned long addr)
      l4t = mfn_to_virt(mfn);
      l4e = l4t[l4_table_offset(addr)];
@@ -127,10 +115,8 @@ Index: xen-4.1.2-testing/xen/arch/x86/x86_64/traps.c
      printk(" L1[0x%03lx] = %"PRIpte" %016lx\n",
             l1_table_offset(addr), l1e_get_intpte(l1e), pfn);
  }
-Index: xen-4.1.2-testing/xen/include/asm-x86/mm.h
-===================================================================
---- xen-4.1.2-testing.orig/xen/include/asm-x86/mm.h
-+++ xen-4.1.2-testing/xen/include/asm-x86/mm.h
+--- a/xen/include/asm-x86/mm.h
++++ b/xen/include/asm-x86/mm.h
 @@ -467,6 +467,8 @@ TYPE_SAFE(unsigned long,mfn);
  #define SHARED_M2P_ENTRY         (~0UL - 1UL)
  #define SHARED_M2P(_e)           ((_e) == SHARED_M2P_ENTRY)
diff --git a/xen-4.1.2-testing-src.tar.bz2 b/xen-4.1.2-testing-src.tar.bz2
index 6ef3265..7c791d7 100644
--- a/xen-4.1.2-testing-src.tar.bz2
+++ b/xen-4.1.2-testing-src.tar.bz2
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:5ee444a5465b7de91b29405c00b0c45f20f978b78fbee33394c15ae49e4a92fc
-size 10786361
+oid sha256:da40746250019fd62c9c0c71085545f8eb4adcf45ca9e3a7af7560c715e0e970
+size 10786312
diff --git a/xen-changeset.diff b/xen-changeset.diff
index 85f37cc..e3a5cef 100644
--- a/xen-changeset.diff
+++ b/xen-changeset.diff
@@ -7,7 +7,7 @@ Index: xen-4.1.2-testing/xen/Makefile
  # This is the correct place to edit the build version.
  # All other places this is stored (eg. compile.h) should be autogenerated.
  export XEN_VERSION       = 4
-@@ -96,7 +97,7 @@ delete-unfresh-files:
+@@ -97,7 +98,7 @@ delete-unfresh-files:
  	@rm -f $@1 $@2
  
  # compile.h contains dynamic build info. Rebuilt on every 'make' invocation.
@@ -16,7 +16,7 @@ Index: xen-4.1.2-testing/xen/Makefile
  	@sed -e 's/@@date@@/$(shell LC_ALL=C date)/g' \
  	    -e 's/@@time@@/$(shell LC_ALL=C date +%T)/g' \
  	    -e 's/@@whoami@@/$(XEN_WHOAMI)/g' \
-@@ -106,10 +107,9 @@ include/xen/compile.h: include/xen/compi
+@@ -107,10 +108,9 @@ include/xen/compile.h: include/xen/compi
  	    -e 's/@@version@@/$(XEN_VERSION)/g' \
  	    -e 's/@@subversion@@/$(XEN_SUBVERSION)/g' \
  	    -e 's/@@extraversion@@/$(XEN_EXTRAVERSION)/g' \
diff --git a/xen-config.diff b/xen-config.diff
index be30330..ef9d539 100644
--- a/xen-config.diff
+++ b/xen-config.diff
@@ -2,16 +2,16 @@ Index: xen-4.1.2-testing/Config.mk
 ===================================================================
 --- xen-4.1.2-testing.orig/Config.mk
 +++ xen-4.1.2-testing/Config.mk
-@@ -194,7 +194,7 @@ endif
+@@ -177,7 +177,7 @@ endif
  # Specify which qemu-dm to use. This may be `ioemu' to use the old
  # Mercurial in-tree version, or a local directory, or a git URL.
  # CONFIG_QEMU ?= `pwd`/$(XEN_ROOT)/../qemu-xen.git
 -CONFIG_QEMU ?= $(QEMU_REMOTE)
 +CONFIG_QEMU ?= ioemu-qemu-xen
  
- QEMU_TAG := xen-4.1.2-rc1
+ QEMU_TAG := xen-4.1.2-rc3
  #QEMU_TAG ?= e073e69457b4d99b6da0b6536296e3498f7f6599
-@@ -204,7 +204,7 @@ QEMU_TAG := xen-4.1.2-rc1
+@@ -187,7 +187,7 @@ QEMU_TAG := xen-4.1.2-rc3
  # Optional components
  XENSTAT_XENTOP     ?= y
  VTPM_TOOLS         ?= n
@@ -45,8 +45,8 @@ Index: xen-4.1.2-testing/tools/Makefile
  		mkdir -p ioemu-dir; \
  	else \
  		if [ ! -d ioemu-remote ]; then \
-@@ -108,7 +110,7 @@ ioemu-dir-find:
- 		$(absolutify_xen_root); \
+@@ -107,7 +109,7 @@ ioemu-dir-find:
+ 	set -e; \
  		$(buildmakevars2shellvars); \
  		cd ioemu-dir; \
 -		$(QEMU_ROOT)/xen-setup $(IOEMU_CONFIGURE_CROSS)
diff --git a/xen-updown.sh b/xen-updown.sh
index b8ae89f..6ce6694 100644
--- a/xen-updown.sh
+++ b/xen-updown.sh
@@ -12,7 +12,7 @@ usage () {
 	exit $R_USAGE
 }
 
-xm_cmd=xl
+xm_cmd="xl -f"
 ######################################################################
 # change the working direcory and source some common files
 #
diff --git a/xen-warnings-unused.diff b/xen-warnings-unused.diff
index bd225fa..746bd5f 100644
--- a/xen-warnings-unused.diff
+++ b/xen-warnings-unused.diff
@@ -1,7 +1,5 @@
-Index: xen-4.1.2-testing/tools/libxc/xc_tmem.c
-===================================================================
---- xen-4.1.2-testing.orig/tools/libxc/xc_tmem.c
-+++ xen-4.1.2-testing/tools/libxc/xc_tmem.c
+--- a/tools/libxc/xc_tmem.c
++++ b/tools/libxc/xc_tmem.c
 @@ -390,7 +390,8 @@ static int xc_tmem_restore_new_pool(
  
  int xc_tmem_restore(xc_interface *xch, int dom, int io_fd)
@@ -12,10 +10,8 @@ Index: xen-4.1.2-testing/tools/libxc/xc_tmem.c
      uint32_t this_max_pools, this_version;
      uint32_t pool_id;
      uint32_t minusone;
-Index: xen-4.1.2-testing/tools/libxc/xc_domain_restore.c
-===================================================================
---- xen-4.1.2-testing.orig/tools/libxc/xc_domain_restore.c
-+++ xen-4.1.2-testing/tools/libxc/xc_domain_restore.c
+--- a/tools/libxc/xc_domain_restore.c
++++ b/tools/libxc/xc_domain_restore.c
 @@ -1087,7 +1087,6 @@ int xc_domain_restore(xc_interface *xch,
      int vcpuextstate = 0;
      uint32_t vcpuextstate_size = 0;
@@ -32,10 +28,8 @@ Index: xen-4.1.2-testing/tools/libxc/xc_domain_restore.c
  
      n = m = 0;
   loadpages:
-Index: xen-4.1.2-testing/tools/misc/gtraceview.c
-===================================================================
---- xen-4.1.2-testing.orig/tools/misc/gtraceview.c
-+++ xen-4.1.2-testing/tools/misc/gtraceview.c
+--- a/tools/misc/gtraceview.c
++++ b/tools/misc/gtraceview.c
 @@ -622,7 +622,8 @@ void crt_init(void)
  void nr_addch(int nr, int ch)
  {
@@ -46,10 +40,8 @@ Index: xen-4.1.2-testing/tools/misc/gtraceview.c
      getyx(stdscr, y, x);
      for (i = 0; i < nr; i++) {
          if (x == COLS-1)
-Index: xen-4.1.2-testing/tools/xcutils/xc_restore.c
-===================================================================
---- xen-4.1.2-testing.orig/tools/xcutils/xc_restore.c
-+++ xen-4.1.2-testing/tools/xcutils/xc_restore.c
+--- a/tools/xcutils/xc_restore.c
++++ b/tools/xcutils/xc_restore.c
 @@ -19,7 +19,8 @@ int
  main(int argc, char **argv)
  {
@@ -60,10 +52,8 @@ Index: xen-4.1.2-testing/tools/xcutils/xc_restore.c
      xc_interface *xch;
      int io_fd, ret;
      int superpages;
-Index: xen-4.1.2-testing/tools/firmware/rombios/32bit/tcgbios/tcgbios.c
-===================================================================
---- xen-4.1.2-testing.orig/tools/firmware/rombios/32bit/tcgbios/tcgbios.c
-+++ xen-4.1.2-testing/tools/firmware/rombios/32bit/tcgbios/tcgbios.c
+--- a/tools/firmware/rombios/32bit/tcgbios/tcgbios.c
++++ b/tools/firmware/rombios/32bit/tcgbios/tcgbios.c
 @@ -1064,7 +1064,7 @@ uint32_t HashLogEvent32(struct hlei *hle
  	uint32_t rc = 0;
  	uint16_t size;
@@ -73,10 +63,8 @@ Index: xen-4.1.2-testing/tools/firmware/rombios/32bit/tcgbios/tcgbios.c
  	uint32_t hashdataptr;
  	uint32_t hashdatalen;
  
-Index: xen-4.1.2-testing/tools/console/client/main.c
-===================================================================
---- xen-4.1.2-testing.orig/tools/console/client/main.c
-+++ xen-4.1.2-testing/tools/console/client/main.c
+--- a/tools/console/client/main.c
++++ b/tools/console/client/main.c
 @@ -277,7 +277,8 @@ int main(int argc, char **argv)
  
  	};
@@ -87,10 +75,8 @@ Index: xen-4.1.2-testing/tools/console/client/main.c
  	struct xs_handle *xs;
  	char *end;
  	console_type type = CONSOLE_INVAL;
-Index: xen-4.1.2-testing/tools/xenstat/xentop/xentop.c
-===================================================================
---- xen-4.1.2-testing.orig/tools/xenstat/xentop/xentop.c
-+++ xen-4.1.2-testing/tools/xenstat/xentop/xentop.c
+--- a/tools/xenstat/xentop/xentop.c
++++ b/tools/xenstat/xentop/xentop.c
 @@ -272,7 +272,8 @@ static void fail(const char *str)
  /* Return the row containing the cursor. */
  static int current_row(void)
@@ -111,11 +97,9 @@ Index: xen-4.1.2-testing/tools/xenstat/xentop/xentop.c
  	getmaxyx(stdscr, y, x);
  	return y;
  }
-Index: xen-4.1.2-testing/tools/libxl/libxlu_cfg.c
-===================================================================
---- xen-4.1.2-testing.orig/tools/libxl/libxlu_cfg.c
-+++ xen-4.1.2-testing/tools/libxl/libxlu_cfg.c
-@@ -348,7 +348,7 @@ char *xlu__cfgl_dequote(CfgParseContext
+--- a/tools/libxl/libxlu_cfg.c
++++ b/tools/libxl/libxlu_cfg.c
+@@ -348,7 +348,7 @@ char *xlu__cfgl_dequote(CfgParseContext 
  
  #define NUMERIC_CHAR(minlen,maxlen,base,basetext) do{                        \
                  char numbuf[(maxlen)+1], *ep;                                \
@@ -124,11 +108,9 @@ Index: xen-4.1.2-testing/tools/libxl/libxlu_cfg.c
                                                                               \
                  strncpy(numbuf,p,(maxlen));                                  \
                  numbuf[(maxlen)]= 0;                                         \
-Index: xen-4.1.2-testing/tools/libxl/libxl.c
-===================================================================
---- xen-4.1.2-testing.orig/tools/libxl/libxl.c
-+++ xen-4.1.2-testing/tools/libxl/libxl.c
-@@ -221,7 +221,7 @@ int libxl_domain_rename(libxl_ctx *ctx,
+--- a/tools/libxl/libxl.c
++++ b/tools/libxl/libxl.c
+@@ -221,7 +221,7 @@ int libxl_domain_rename(libxl_ctx *ctx, 
  int libxl_domain_resume(libxl_ctx *ctx, uint32_t domid)
  {
      libxl__gc gc = LIBXL_INIT_GC(ctx);
@@ -155,10 +137,8 @@ Index: xen-4.1.2-testing/tools/libxl/libxl.c
                             libxl__sprintf(&gc, "%s/device/vif", dompath), &nb_nics);
      if (!l)
          goto err;
-Index: xen-4.1.2-testing/tools/libxl/libxl_pci.c
-===================================================================
---- xen-4.1.2-testing.orig/tools/libxl/libxl_pci.c
-+++ xen-4.1.2-testing/tools/libxl/libxl_pci.c
+--- a/tools/libxl/libxl_pci.c
++++ b/tools/libxl/libxl_pci.c
 @@ -240,7 +240,7 @@ static int libxl_create_pci_backend(libx
      flexarray_t *front = NULL;
      flexarray_t *back = NULL;
@@ -177,10 +157,8 @@ Index: xen-4.1.2-testing/tools/libxl/libxl_pci.c
      LIBXL__LOG(ctx, LIBXL__LOG_DEBUG, "Creating pci backend");
  
      /* add pci device */
-Index: xen-4.1.2-testing/tools/libxl/libxl_dom.c
-===================================================================
---- xen-4.1.2-testing.orig/tools/libxl/libxl_dom.c
-+++ xen-4.1.2-testing/tools/libxl/libxl_dom.c
+--- a/tools/libxl/libxl_dom.c
++++ b/tools/libxl/libxl_dom.c
 @@ -265,14 +265,13 @@ int libxl__build_hvm(libxl_ctx *ctx, uin
                libxl_domain_build_info *info, libxl_domain_build_state *state)
  {
@@ -205,10 +183,8 @@ Index: xen-4.1.2-testing/tools/libxl/libxl_dom.c
  out:
      libxl__free_all(&gc);
      return 0;
-Index: xen-4.1.2-testing/tools/libxl/libxl_utils.c
-===================================================================
---- xen-4.1.2-testing.orig/tools/libxl/libxl_utils.c
-+++ xen-4.1.2-testing/tools/libxl/libxl_utils.c
+--- a/tools/libxl/libxl_utils.c
++++ b/tools/libxl/libxl_utils.c
 @@ -531,7 +531,7 @@ int libxl_devid_to_device_disk(libxl_ctx
      libxl__gc gc = LIBXL_INIT_GC(ctx);
      char *val;
@@ -218,10 +194,8 @@ Index: xen-4.1.2-testing/tools/libxl/libxl_utils.c
      int rc = ERROR_INVAL;
  
      devid_n = libxl__device_disk_dev_number(devid);
-Index: xen-4.1.2-testing/tools/libxl/xl_cmdimpl.c
-===================================================================
---- xen-4.1.2-testing.orig/tools/libxl/xl_cmdimpl.c
-+++ xen-4.1.2-testing/tools/libxl/xl_cmdimpl.c
+--- a/tools/libxl/xl_cmdimpl.c
++++ b/tools/libxl/xl_cmdimpl.c
 @@ -5448,7 +5448,7 @@ int main_cpupoollist(int argc, char **ar
          {"cpus", 0, 0, 'c'},
          {0, 0, 0, 0}
@@ -231,10 +205,8 @@ Index: xen-4.1.2-testing/tools/libxl/xl_cmdimpl.c
      int opt_cpus = 0;
      const char *pool = NULL;
      libxl_cpupoolinfo *poolinfo;
-Index: xen-4.1.2-testing/tools/debugger/gdbsx/gx/gx_comm.c
-===================================================================
---- xen-4.1.2-testing.orig/tools/debugger/gdbsx/gx/gx_comm.c
-+++ xen-4.1.2-testing/tools/debugger/gdbsx/gx/gx_comm.c
+--- a/tools/debugger/gdbsx/gx/gx_comm.c
++++ b/tools/debugger/gdbsx/gx/gx_comm.c
 @@ -163,7 +163,7 @@ readchar(void)
      static char buf[BUFSIZ];
      static int bufcnt = 0;
@@ -244,10 +216,8 @@ Index: xen-4.1.2-testing/tools/debugger/gdbsx/gx/gx_comm.c
  
      if (bufcnt-- > 0)
          return *bufp++ & 0x7f;
-Index: xen-4.1.2-testing/tools/python/xen/lowlevel/checkpoint/libcheckpoint.c
-===================================================================
---- xen-4.1.2-testing.orig/tools/python/xen/lowlevel/checkpoint/libcheckpoint.c
-+++ xen-4.1.2-testing/tools/python/xen/lowlevel/checkpoint/libcheckpoint.c
+--- a/tools/python/xen/lowlevel/checkpoint/libcheckpoint.c
++++ b/tools/python/xen/lowlevel/checkpoint/libcheckpoint.c
 @@ -820,7 +820,7 @@ static int create_suspend_thread(checkpo
  
  static void stop_suspend_thread(checkpoint_state* s)
@@ -257,10 +227,8 @@ Index: xen-4.1.2-testing/tools/python/xen/lowlevel/checkpoint/libcheckpoint.c
  
    s->done = 1;
  
-Index: xen-4.1.2-testing/tools/python/xen/lowlevel/netlink/libnetlink.c
-===================================================================
---- xen-4.1.2-testing.orig/tools/python/xen/lowlevel/netlink/libnetlink.c
-+++ xen-4.1.2-testing/tools/python/xen/lowlevel/netlink/libnetlink.c
+--- a/tools/python/xen/lowlevel/netlink/libnetlink.c
++++ b/tools/python/xen/lowlevel/netlink/libnetlink.c
 @@ -433,7 +433,8 @@ int rtnl_from_file(FILE *rtnl, rtnl_filt
         nladdr.nl_groups = 0;
  
@@ -271,10 +239,8 @@ Index: xen-4.1.2-testing/tools/python/xen/lowlevel/netlink/libnetlink.c
                 int l;
  
                 status = fread(&buf, 1, sizeof(*h), rtnl);
-Index: xen-4.1.2-testing/xen/arch/x86/msi.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/msi.c
-+++ xen-4.1.2-testing/xen/arch/x86/msi.c
+--- a/xen/arch/x86/msi.c
++++ b/xen/arch/x86/msi.c
 @@ -799,7 +799,7 @@ static void __pci_disable_msi(struct msi
  {
      struct pci_dev *dev;
@@ -284,11 +250,9 @@ Index: xen-4.1.2-testing/xen/arch/x86/msi.c
      u8 bus, slot, func;
  
      dev = entry->dev;
-Index: xen-4.1.2-testing/xen/arch/x86/microcode_amd.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/microcode_amd.c
-+++ xen-4.1.2-testing/xen/arch/x86/microcode_amd.c
-@@ -164,7 +164,7 @@ static int apply_microcode(int cpu)
+--- a/xen/arch/x86/microcode_amd.c
++++ b/xen/arch/x86/microcode_amd.c
+@@ -160,7 +160,7 @@ static int apply_microcode(int cpu)
  static int get_next_ucode_from_buffer_amd(void *mc, const void *buf,
                                           size_t size, unsigned long *offset)
  {
@@ -297,10 +261,8 @@ Index: xen-4.1.2-testing/xen/arch/x86/microcode_amd.c
      size_t total_size;
      const uint8_t *bufp = buf;
      unsigned long off;
-Index: xen-4.1.2-testing/xen/common/cpupool.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/common/cpupool.c
-+++ xen-4.1.2-testing/xen/common/cpupool.c
+--- a/xen/common/cpupool.c
++++ b/xen/common/cpupool.c
 @@ -356,7 +356,7 @@ int cpupool_add_domain(struct domain *d,
  {
      struct cpupool *c;
@@ -321,10 +283,8 @@ Index: xen-4.1.2-testing/xen/common/cpupool.c
  
      if ( d->cpupool == NULL )
          return;
-Index: xen-4.1.2-testing/xen/common/grant_table.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/common/grant_table.c
-+++ xen-4.1.2-testing/xen/common/grant_table.c
+--- a/xen/common/grant_table.c
++++ b/xen/common/grant_table.c
 @@ -765,7 +765,7 @@ __gnttab_unmap_common(
      struct domain   *ld, *rd;
      struct active_grant_entry *act;
@@ -334,10 +294,8 @@ Index: xen-4.1.2-testing/xen/common/grant_table.c
  
      ld = current->domain;
  
-Index: xen-4.1.2-testing/xen/common/kexec.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/common/kexec.c
-+++ xen-4.1.2-testing/xen/common/kexec.c
+--- a/xen/common/kexec.c
++++ b/xen/common/kexec.c
 @@ -569,7 +569,8 @@ static int kexec_exec(XEN_GUEST_HANDLE(v
  {
      xen_kexec_exec_t exec;
@@ -348,10 +306,8 @@ Index: xen-4.1.2-testing/xen/common/kexec.c
  
      if ( unlikely(copy_from_guest(&exec, uarg, 1)) )
          return -EFAULT;
-Index: xen-4.1.2-testing/xen/drivers/passthrough/vtd/intremap.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/drivers/passthrough/vtd/intremap.c
-+++ xen-4.1.2-testing/xen/drivers/passthrough/vtd/intremap.c
+--- a/xen/drivers/passthrough/vtd/intremap.c
++++ b/xen/drivers/passthrough/vtd/intremap.c
 @@ -367,7 +367,7 @@ unsigned int io_apic_read_remap_rte(
      unsigned int ioapic_pin = (reg - 0x10) / 2;
      int index;
@@ -370,10 +326,8 @@ Index: xen-4.1.2-testing/xen/drivers/passthrough/vtd/intremap.c
  
          iommu = drhd->iommu;
          qi_ctrl = iommu_qi_ctrl(iommu);
-Index: xen-4.1.2-testing/xen/common/sched_credit2.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/common/sched_credit2.c
-+++ xen-4.1.2-testing/xen/common/sched_credit2.c
+--- a/xen/common/sched_credit2.c
++++ b/xen/common/sched_credit2.c
 @@ -1854,7 +1854,8 @@ static void deactivate_runqueue(struct c
  
  static void init_pcpu(const struct scheduler *ops, int cpu)
@@ -384,11 +338,9 @@ Index: xen-4.1.2-testing/xen/common/sched_credit2.c
      struct csched_private *prv = CSCHED_PRIV(ops);
      struct csched_runqueue_data *rqd;
      spinlock_t *old_lock;
-Index: xen-4.1.2-testing/xen/common/unlzo.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/common/unlzo.c
-+++ xen-4.1.2-testing/xen/common/unlzo.c
-@@ -68,7 +68,7 @@ static int INIT parse_header(u8 *input,
+--- a/xen/common/unlzo.c
++++ b/xen/common/unlzo.c
+@@ -68,7 +68,7 @@ static int INIT parse_header(u8 *input, 
  {
  	int l;
  	u8 *parse = input;
@@ -397,10 +349,8 @@ Index: xen-4.1.2-testing/xen/common/unlzo.c
  	u16 version;
  
  	/* read magic: 9 first bits */
-Index: xen-4.1.2-testing/xen/arch/x86/time.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/time.c
-+++ xen-4.1.2-testing/xen/arch/x86/time.c
+--- a/xen/arch/x86/time.c
++++ b/xen/arch/x86/time.c
 @@ -1009,7 +1009,8 @@ static void local_time_calibration(void)
       * System timestamps, extrapolated from local and master oscillators,
       * taken during this calibration and the previous calibration.
@@ -411,10 +361,8 @@ Index: xen-4.1.2-testing/xen/arch/x86/time.c
      s_time_t prev_master_stime, curr_master_stime;
  
      /* TSC timestamps taken during this calibration and prev calibration. */
-Index: xen-4.1.2-testing/xen/arch/x86/cpu/amd.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/cpu/amd.c
-+++ xen-4.1.2-testing/xen/arch/x86/cpu/amd.c
+--- a/xen/arch/x86/cpu/amd.c
++++ b/xen/arch/x86/cpu/amd.c
 @@ -391,7 +391,7 @@ static void __devinit init_amd(struct cp
  {
  	u32 l, h;
@@ -424,11 +372,9 @@ Index: xen-4.1.2-testing/xen/arch/x86/cpu/amd.c
  
  #ifdef CONFIG_SMP
  	unsigned long long value;
-Index: xen-4.1.2-testing/xen/arch/x86/mm/p2m.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/mm/p2m.c
-+++ xen-4.1.2-testing/xen/arch/x86/mm/p2m.c
-@@ -2338,7 +2338,7 @@ p2m_remove_page(struct p2m_domain *p2m,
+--- a/xen/arch/x86/mm/p2m.c
++++ b/xen/arch/x86/mm/p2m.c
+@@ -2338,7 +2338,7 @@ p2m_remove_page(struct p2m_domain *p2m, 
                  unsigned int page_order)
  {
      unsigned long i;
@@ -446,10 +392,8 @@ Index: xen-4.1.2-testing/xen/arch/x86/mm/p2m.c
      int pod_count = 0;
      int rc = 0;
  
-Index: xen-4.1.2-testing/xen/arch/x86/hvm/emulate.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/hvm/emulate.c
-+++ xen-4.1.2-testing/xen/arch/x86/hvm/emulate.c
+--- a/xen/arch/x86/hvm/emulate.c
++++ b/xen/arch/x86/hvm/emulate.c
 @@ -59,7 +59,7 @@ static int hvmemul_do_io(
      ioreq_t *p = get_ioreq(curr);
      unsigned long ram_gfn = paddr_to_pfn(ram_gpa);
@@ -459,10 +403,8 @@ Index: xen-4.1.2-testing/xen/arch/x86/hvm/emulate.c
      int rc;
  
      /* Check for paged out page */
-Index: xen-4.1.2-testing/xen/arch/x86/hvm/hvm.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/hvm/hvm.c
-+++ xen-4.1.2-testing/xen/arch/x86/hvm/hvm.c
+--- a/xen/arch/x86/hvm/hvm.c
++++ b/xen/arch/x86/hvm/hvm.c
 @@ -253,7 +253,8 @@ void hvm_migrate_timers(struct vcpu *v)
  
  void hvm_migrate_pirqs(struct vcpu *v)
@@ -482,10 +424,8 @@ Index: xen-4.1.2-testing/xen/arch/x86/hvm/hvm.c
              mfn = gfn_to_mfn_unshare(p2m, pfn, &t, 0);
              if ( p2m_is_paging(t) )
              {
-Index: xen-4.1.2-testing/xen/arch/x86/acpi/cpu_idle.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/acpi/cpu_idle.c
-+++ xen-4.1.2-testing/xen/arch/x86/acpi/cpu_idle.c
+--- a/xen/arch/x86/acpi/cpu_idle.c
++++ b/xen/arch/x86/acpi/cpu_idle.c
 @@ -275,7 +275,7 @@ static void acpi_processor_ffh_cstate_en
  
  static void acpi_idle_do_entry(struct acpi_processor_cx *cx)
@@ -495,10 +435,8 @@ Index: xen-4.1.2-testing/xen/arch/x86/acpi/cpu_idle.c
  
      switch ( cx->entry_method )
      {
-Index: xen-4.1.2-testing/xen/arch/x86/cpu/intel_cacheinfo.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/cpu/intel_cacheinfo.c
-+++ xen-4.1.2-testing/xen/arch/x86/cpu/intel_cacheinfo.c
+--- a/xen/arch/x86/cpu/intel_cacheinfo.c
++++ b/xen/arch/x86/cpu/intel_cacheinfo.c
 @@ -170,7 +170,8 @@ unsigned int __cpuinit init_intel_cachei
  	unsigned int trace = 0, l1i = 0, l1d = 0, l2 = 0, l3 = 0; /* Cache sizes */
  	unsigned int new_l1d = 0, new_l1i = 0; /* Cache sizes from cpuid(4) */
@@ -509,11 +447,9 @@ Index: xen-4.1.2-testing/xen/arch/x86/cpu/intel_cacheinfo.c
  
  	if (c->cpuid_level > 3) {
  		static int is_initialized;
-Index: xen-4.1.2-testing/xen/arch/x86/mm/mem_sharing.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/mm/mem_sharing.c
-+++ xen-4.1.2-testing/xen/arch/x86/mm/mem_sharing.c
-@@ -376,7 +376,7 @@ int mem_sharing_debug_gfn(struct domain
+--- a/xen/arch/x86/mm/mem_sharing.c
++++ b/xen/arch/x86/mm/mem_sharing.c
+@@ -376,7 +376,7 @@ int mem_sharing_debug_gfn(struct domain 
  {
      p2m_type_t p2mt;
      mfn_t mfn;
@@ -522,10 +458,8 @@ Index: xen-4.1.2-testing/xen/arch/x86/mm/mem_sharing.c
  
      mfn = gfn_to_mfn(p2m_get_hostp2m(d), gfn, &p2mt);
      page = mfn_to_page(mfn);
-Index: xen-4.1.2-testing/xen/arch/x86/hvm/viridian.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/hvm/viridian.c
-+++ xen-4.1.2-testing/xen/arch/x86/hvm/viridian.c
+--- a/xen/arch/x86/hvm/viridian.c
++++ b/xen/arch/x86/hvm/viridian.c
 @@ -270,7 +270,7 @@ int rdmsr_viridian_regs(uint32_t idx, ui
  int viridian_hypercall(struct cpu_user_regs *regs)
  {
@@ -535,10 +469,8 @@ Index: xen-4.1.2-testing/xen/arch/x86/hvm/viridian.c
      uint16_t status = HV_STATUS_SUCCESS;
  
      union hypercall_input {
-Index: xen-4.1.2-testing/xen/arch/x86/mm.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/mm.c
-+++ xen-4.1.2-testing/xen/arch/x86/mm.c
+--- a/xen/arch/x86/mm.c
++++ b/xen/arch/x86/mm.c
 @@ -4904,7 +4904,7 @@ static int ptwr_emulated_update(
  {
      unsigned long mfn;
@@ -548,10 +480,8 @@ Index: xen-4.1.2-testing/xen/arch/x86/mm.c
      l1_pgentry_t pte, ol1e, nl1e, *pl1e;
      struct vcpu *v = current;
      struct domain *d = v->domain;
-Index: xen-4.1.2-testing/xen/arch/x86/x86_64/mm.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/x86_64/mm.c
-+++ xen-4.1.2-testing/xen/arch/x86/x86_64/mm.c
+--- a/xen/arch/x86/x86_64/mm.c
++++ b/xen/arch/x86/x86_64/mm.c
 @@ -436,7 +436,8 @@ void destroy_m2p_mapping(struct mem_hota
  static int setup_compat_m2p_table(struct mem_hotadd_info *info)
  {
@@ -562,10 +492,8 @@ Index: xen-4.1.2-testing/xen/arch/x86/x86_64/mm.c
      l3_pgentry_t *l3_ro_mpt = NULL;
      l2_pgentry_t *l2_ro_mpt = NULL;
      struct page_info *l1_pg;
-Index: xen-4.1.2-testing/xen/arch/x86/cpu/mcheck/mce.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/cpu/mcheck/mce.c
-+++ xen-4.1.2-testing/xen/arch/x86/cpu/mcheck/mce.c
+--- a/xen/arch/x86/cpu/mcheck/mce.c
++++ b/xen/arch/x86/cpu/mcheck/mce.c
 @@ -151,7 +151,6 @@ static struct mcinfo_bank *mca_init_bank
                                           struct mc_info *mi, int bank)
  {
@@ -582,7 +510,7 @@ Index: xen-4.1.2-testing/xen/arch/x86/cpu/mcheck/mce.c
      if (mib->mc_status & MCi_STATUS_MISCV)
          mib->mc_misc = mca_rdmsr(MSR_IA32_MCx_MISC(bank));
  
-@@ -281,7 +279,7 @@ mctelem_cookie_t mcheck_mca_logout(enum
+@@ -281,7 +279,7 @@ mctelem_cookie_t mcheck_mca_logout(enum 
      recover = (mc_recoverable_scan)? 1: 0;
  
      for (i = 0; i < 32 && i < nr_mce_banks; i++) {
@@ -600,10 +528,8 @@ Index: xen-4.1.2-testing/xen/arch/x86/cpu/mcheck/mce.c
      uint64_t hwcr = 0;
      int intpose;
      int i;
-Index: xen-4.1.2-testing/xen/common/tmem.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/common/tmem.c
-+++ xen-4.1.2-testing/xen/common/tmem.c
+--- a/xen/common/tmem.c
++++ b/xen/common/tmem.c
 @@ -1351,7 +1351,8 @@ obj_unlock:
  static int tmem_evict(void)
  {
@@ -624,10 +550,8 @@ Index: xen-4.1.2-testing/xen/common/tmem.c
      client_t *client = pool->client;
      int ret = client->frozen ? -EFROZEN : -ENOMEM;
  
-Index: xen-4.1.2-testing/xen/common/tmem_xen.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/common/tmem_xen.c
-+++ xen-4.1.2-testing/xen/common/tmem_xen.c
+--- a/xen/common/tmem_xen.c
++++ b/xen/common/tmem_xen.c
 @@ -177,7 +177,7 @@ EXPORT int tmh_copy_from_client(pfp_t *p
  EXPORT int tmh_compress_from_client(tmem_cli_mfn_t cmfn,
      void **out_va, size_t *out_len, void *cli_va)
@@ -665,10 +589,8 @@ Index: xen-4.1.2-testing/xen/common/tmem_xen.c
      tmh->persistent_pool = xmem_pool_create(name, tmh_persistent_pool_page_get,
          tmh_persistent_pool_page_put, PAGE_SIZE, 0, PAGE_SIZE);
      if ( tmh->persistent_pool == NULL )
-Index: xen-4.1.2-testing/xen/arch/x86/cpu/mcheck/vmce.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/cpu/mcheck/vmce.c
-+++ xen-4.1.2-testing/xen/arch/x86/cpu/mcheck/vmce.c
+--- a/xen/arch/x86/cpu/mcheck/vmce.c
++++ b/xen/arch/x86/cpu/mcheck/vmce.c
 @@ -574,7 +574,7 @@ int is_vmce_ready(struct mcinfo_bank *ba
   */
  int unmmap_broken_page(struct domain *d, mfn_t mfn, unsigned long gfn)
@@ -678,11 +600,9 @@ Index: xen-4.1.2-testing/xen/arch/x86/cpu/mcheck/vmce.c
      struct p2m_domain *p2m;
      p2m_type_t pt;
  
-Index: xen-4.1.2-testing/xen/arch/x86/mm/shadow/multi.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/mm/shadow/multi.c
-+++ xen-4.1.2-testing/xen/arch/x86/mm/shadow/multi.c
-@@ -124,7 +124,7 @@ set_shadow_status(struct vcpu *v, mfn_t
+--- a/xen/arch/x86/mm/shadow/multi.c
++++ b/xen/arch/x86/mm/shadow/multi.c
+@@ -124,7 +124,7 @@ set_shadow_status(struct vcpu *v, mfn_t 
  /* Put a shadow into the hash table */
  {
      struct domain *d = v->domain;
@@ -700,10 +620,8 @@ Index: xen-4.1.2-testing/xen/arch/x86/mm/shadow/multi.c
      shadow_l1e_t *sl1p, sl1e;
      struct page_info *sp;
  
-Index: xen-4.1.2-testing/xen/arch/x86/domain_build.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/domain_build.c
-+++ xen-4.1.2-testing/xen/arch/x86/domain_build.c
+--- a/xen/arch/x86/domain_build.c
++++ b/xen/arch/x86/domain_build.c
 @@ -378,8 +378,7 @@ int __init construct_dom0(
          return rc;
  
@@ -714,11 +632,9 @@ Index: xen-4.1.2-testing/xen/arch/x86/domain_build.c
      machine = elf_uval(&elf, elf.ehdr, e_machine);
      switch (CONFIG_PAGING_LEVELS) {
      case 3: /* x86_32p */
-Index: xen-4.1.2-testing/xen/arch/x86/traps.c
-===================================================================
---- xen-4.1.2-testing.orig/xen/arch/x86/traps.c
-+++ xen-4.1.2-testing/xen/arch/x86/traps.c
-@@ -1827,7 +1827,11 @@ static int emulate_privileged_op(struct
+--- a/xen/arch/x86/traps.c
++++ b/xen/arch/x86/traps.c
+@@ -1853,7 +1853,11 @@ static int emulate_privileged_op(struct 
      struct vcpu *v = current;
      unsigned long *reg, eip = regs->eip;
      u8 opcode, modrm_reg = 0, modrm_rm = 0, rep_prefix = 0, lock = 0, rex = 0;
diff --git a/xen.changes b/xen.changes
index 4caa6d2..3288fc5 100644
--- a/xen.changes
+++ b/xen.changes
@@ -1,3 +1,77 @@
+-------------------------------------------------------------------
+Mon Oct 17 11:27:51 MDT 2011 - carnold@novell.com
+
+- Upstream patches from Jan
+  23955-x86-pv-cpuid-xsave.patch
+  23957-cpufreq-error-paths.patch 
+
+-------------------------------------------------------------------
+Tue Oct 11 09:38:59 MDT 2011 - carnold@novell.com
+
+- Upstream patches from Jan
+  23933-pt-bus2bridge-update.patch
+  23726-x86-intel-flexmigration-v2.patch
+  23925-x86-AMD-ARAT-Fam12.patch
+  23246-x86-xsave-enable.patch
+  23897-x86-mce-offline-again.patch 
+
+-------------------------------------------------------------------
+Mon Oct 10 09:53:42 MDT 2011 - carnold@novell.com
+
+- Update to Xen 4.1.2_rc3 c/s 23171
+
+-------------------------------------------------------------------
+Thu Oct  6 17:57:56 MDT 2011 - jfehlig@suse.com
+
+- bnc#720054 - Changed /etc/udev/rules.d/40-xen.rules to not run
+  Xen's vif-bridge script when not running Xen.  This is not a
+  solution to the bug but an improvement in the rules regardless.
+  Updated udev-rules.patch
+
+-------------------------------------------------------------------
+Tue Oct  4 11:00:56 MDT 2011 - carnold@novell.com
+
+- Upstream patches from Jan
+  23868-vtd-RMRR-validation.patch
+  23871-x86-microcode-amd-silent.patch
+  23898-cc-option-grep.patch 
+
+-------------------------------------------------------------------
+Fri Sep 30 12:47:59 MDT 2011 - jfehlig@suse.com
+
+- Add pciback init script and sysconf file, giving users a simple
+  mechanism to configure pciback.
+  init.pciback sysconfig.pciback
+
+-------------------------------------------------------------------
+Fri Sep 23 12:11:23 CEST 2011 - ohering@suse.de
+
+- update scripts to use xl -f, or xm if xend is running:
+  xen-updown.sh, init.xendomains, xmclone.sh
+
+-------------------------------------------------------------------
+Fri Sep 23 11:28:36 CEST 2011 - ohering@suse.de
+
+- bnc#694863 - kexec fails in xen 
+  xenstored: allow guest to shutdown all its watches/transactions
+  xenstored.XS_RESET_WATCHES.patch
+
+-------------------------------------------------------------------
+Thu Sep 22 09:33:28 MDT 2011 - carnold@novell.com
+
+- Upstream patches from Jan 
+  23843-scheduler-switch.patch
+  23846-x86-TSC-check.patch
+  23848-vmx-conditional-off.patch
+  23853-x86-pv-cpuid-xsave.patch
+
+-------------------------------------------------------------------
+Fri Sep 16 11:40:28 CEST 2011 - ohering@suse.de
+
+- fate#310510 - fix xenpaging
+  mem_event: add ref counting for free requestslots
+  xenpaging.23817-mem_event_check_ring.patch
+
 -------------------------------------------------------------------
 Wed Sep 14 13:54:21 MDT 2011 - carnold@novell.com
 
@@ -4548,7 +4622,7 @@ Thu May  4 12:52:32 MDT 2006 - rmaxfiel@novell.com
   request comes from the hvm guest. (#159907)
 - Fixed the loss of mouse when a SDL session ends with 'grab'
   in effect.  (#159001)
-	
+
 -------------------------------------------------------------------
 Thu May  4 10:42:32 MDT 2006 - cgriffin@novell.com
 
diff --git a/xen.spec b/xen.spec
index 106dccd..3d37241 100644
--- a/xen.spec
+++ b/xen.spec
@@ -22,7 +22,7 @@ Name:           xen
 ExclusiveArch:  %ix86 x86_64
 %define xvers 4.1
 %define xvermaj 4
-%define changeset 23152
+%define changeset 23171
 %define xen_build_dir xen-4.1.2-testing
 %define with_kmp 1
 %define with_stubdom 1
@@ -96,7 +96,7 @@ BuildRequires:  glibc-devel
 %if %{?with_kmp}0
 BuildRequires:  kernel-source kernel-syms module-init-tools xorg-x11
 %endif
-Version:        4.1.2_01
+Version:        4.1.2_03
 Release:        1
 License:        GPLv2+
 Group:          System/Kernel
@@ -135,6 +135,9 @@ Source24:       xenapiusers
 Source25:       xen-updown.sh
 # Firewall service file for xend relocation server
 Source26:       xend-relocation-server.fw
+# init script and sysconf file for pciback
+Source27:       init.pciback
+Source28:       sysconfig.pciback
 Source99:       baselibs.conf
 # http://xenbits.xensource.com/ext/xenalyze
 Source20000:    xenalyze.hg.tar.bz2
@@ -153,42 +156,48 @@ Patch11:        23234-svm-decode-assist-base.patch
 Patch12:        23235-svm-decode-assist-crs.patch
 Patch13:        23236-svm-decode-assist-invlpg.patch
 Patch14:        23238-svm-decode-assist-insn-fetch.patch
-Patch15:        23303-cpufreq-misc.patch
-Patch16:        23304-amd-oprofile-strings.patch
-Patch17:        23305-amd-fam15-xenoprof.patch
-Patch18:        23306-amd-fam15-vpmu.patch
-Patch19:        23334-amd-fam12+14-vpmu.patch
-Patch20:        23383-libxc-rm-static-vars.patch
-Patch21:        23437-amd-fam15-TSC-scaling.patch
-Patch22:        23462-libxc-cpu-feature.patch
-Patch23:        23508-vmx-proc-based-ctls-probe.patch
-Patch24:        23511-amd-fam15-no-flush-for-C3.patch
-Patch25:        23571-vtd-fault-verbosity.patch
-Patch26:        23574-x86-dom0-compressed-ELF.patch
-Patch27:        23575-x86-DMI.patch
-Patch28:        23610-x86-topology-info.patch
-Patch29:        23611-amd-fam15-topology.patch
-Patch30:        23613-EFI-headers.patch
-Patch31:        23614-x86_64-EFI-boot.patch
-Patch32:        23615-x86_64-EFI-runtime.patch
-Patch33:        23616-x86_64-EFI-MPS.patch
-Patch34:        23676-x86_64-image-map-bounds.patch
-Patch35:        23685-libxl-segfault-fix.patch
+Patch15:        23246-x86-xsave-enable.patch
+Patch16:        23303-cpufreq-misc.patch
+Patch17:        23304-amd-oprofile-strings.patch
+Patch18:        23305-amd-fam15-xenoprof.patch
+Patch19:        23306-amd-fam15-vpmu.patch
+Patch20:        23334-amd-fam12+14-vpmu.patch
+Patch21:        23383-libxc-rm-static-vars.patch
+Patch22:        23437-amd-fam15-TSC-scaling.patch
+Patch23:        23462-libxc-cpu-feature.patch
+Patch24:        23508-vmx-proc-based-ctls-probe.patch
+Patch25:        23511-amd-fam15-no-flush-for-C3.patch
+Patch26:        23571-vtd-fault-verbosity.patch
+Patch27:        23574-x86-dom0-compressed-ELF.patch
+Patch28:        23575-x86-DMI.patch
+Patch29:        23610-x86-topology-info.patch
+Patch30:        23611-amd-fam15-topology.patch
+Patch31:        23613-EFI-headers.patch
+Patch32:        23614-x86_64-EFI-boot.patch
+Patch33:        23615-x86_64-EFI-runtime.patch
+Patch34:        23616-x86_64-EFI-MPS.patch
+Patch35:        23676-x86_64-image-map-bounds.patch
 Patch36:        23723-x86-CMOS-lock.patch
 Patch37:        23724-x86-smpboot-x2apic.patch
-Patch38:        23735-guest-dom0-cap.patch
-Patch39:        23747-mmcfg-base-address.patch
-Patch40:        23749-mmcfg-reservation.patch
-Patch41:        23771-x86-ioapic-clear-pin.patch
-Patch42:        23772-x86-trampoline.patch
-Patch43:        23774-x86_64-EFI-EDD.patch
-Patch44:        23781-pm-wide-ACPI-ids.patch
-Patch45:        23782-x86-ioapic-clear-irr.patch
-Patch46:        23783-ACPI-set-_PDC-bits.patch
-Patch47:        23795-intel-ich10-quirk.patch
-Patch48:        23800-x86_64-guest-addr-range.patch
-Patch49:        23804-x86-IPI-counts.patch
-Patch50:        23833-x86-IO-APIC-EOI.patch
+Patch38:        23726-x86-intel-flexmigration-v2.patch
+Patch39:        23735-guest-dom0-cap.patch
+Patch40:        23747-mmcfg-base-address.patch
+Patch41:        23749-mmcfg-reservation.patch
+Patch42:        23771-x86-ioapic-clear-pin.patch
+Patch43:        23772-x86-trampoline.patch
+Patch44:        23774-x86_64-EFI-EDD.patch
+Patch45:        23781-pm-wide-ACPI-ids.patch
+Patch46:        23782-x86-ioapic-clear-irr.patch
+Patch47:        23783-ACPI-set-_PDC-bits.patch
+Patch48:        23795-intel-ich10-quirk.patch
+Patch49:        23800-x86_64-guest-addr-range.patch
+Patch50:        23804-x86-IPI-counts.patch
+Patch51:        23853-x86-pv-cpuid-xsave.patch
+Patch52:        23897-x86-mce-offline-again.patch
+Patch53:        23925-x86-AMD-ARAT-Fam12.patch
+Patch54:        23933-pt-bus2bridge-update.patch
+Patch55:        23955-x86-pv-cpuid-xsave.patch
+Patch56:        23957-cpufreq-error-paths.patch
 # Upstream qemu patches
 # Our patches
 Patch300:       xen-config.diff
@@ -292,6 +301,7 @@ Patch453:       tools-watchdog-support.patch
 Patch454:       xend-console-port-restore.patch
 Patch455:       xencommons-proc-xen.patch
 Patch456:       xend-vcpu-affinity-fix.patch
+Patch457:       xenstored.XS_RESET_WATCHES.patch
 # Jim's domain lock patch
 Patch480:       xend-domain-lock.patch
 Patch481:       xend-domain-lock-sfex.patch
@@ -336,6 +346,7 @@ Patch1103:      xenpaging.return-void.patch
 Patch1104:      xenpaging.catch-xc_mem_paging_resume-error.patch
 Patch1105:      xenpaging.xenpaging_populate_page-gfn.patch
 Patch1106:      xenpaging.autostart.patch
+Patch1107:      xenpaging.23817-mem_event_check_ring.patch
 # xenalyze
 Patch20000:     xenalyze.gcc46.patch
 # Build patch
@@ -729,6 +740,12 @@ tar xfj %{SOURCE2} -C $RPM_BUILD_DIR/%{xen_build_dir}/tools
 %patch48 -p1
 %patch49 -p1
 %patch50 -p1
+%patch51 -p1
+%patch52 -p1
+%patch53 -p1
+%patch54 -p1
+%patch55 -p1
+%patch56 -p1
 %patch300 -p1
 %patch301 -p1
 %patch302 -p1
@@ -826,6 +843,7 @@ tar xfj %{SOURCE2} -C $RPM_BUILD_DIR/%{xen_build_dir}/tools
 %patch454 -p1
 %patch455 -p1
 %patch456 -p1
+%patch457 -p1
 %patch480 -p1
 %patch481 -p1
 %patch500 -p1
@@ -868,6 +886,7 @@ tar xfj %{SOURCE2} -C $RPM_BUILD_DIR/%{xen_build_dir}/tools
 %patch1104 -p1
 %patch1105 -p1
 %patch1106 -p1
+%patch1107 -p1
 #
 %patch99998 -p1
 %patch99999 -p1
@@ -1012,6 +1031,9 @@ install %SOURCE6 $RPM_BUILD_ROOT/etc/init.d/xend
 ln -s /etc/init.d/xend $RPM_BUILD_ROOT/usr/sbin/rcxend
 install %SOURCE7 $RPM_BUILD_ROOT/etc/init.d/xendomains
 ln -s /etc/init.d/xendomains $RPM_BUILD_ROOT/usr/sbin/rcxendomains
+install %SOURCE27 $RPM_BUILD_ROOT/etc/init.d/pciback
+ln -s /etc/init.d/pciback $RPM_BUILD_ROOT/usr/sbin/rcpciback
+install %SOURCE28 $RPM_BUILD_ROOT/var/adm/fillup-templates/sysconfig.pciback
 mkdir -p $RPM_BUILD_ROOT/etc/modprobe.d
 install -m644 %SOURCE19 $RPM_BUILD_ROOT/etc/modprobe.d/xen_loop.conf
 # example config
@@ -1145,6 +1167,7 @@ rm -f $RPM_BUILD_ROOT/%{_bindir}/xencons
 /usr/sbin/flask-setenforce
 /usr/sbin/rcxend
 /usr/sbin/rcxendomains
+/usr/sbin/rcpciback
 /usr/sbin/tapdisk
 /usr/sbin/xen*
 /usr/sbin/xm
@@ -1325,6 +1348,7 @@ fi
 %endif
 #
 %{fillup_and_insserv -y -n xendomains xendomains}
+%{fillup_only -n pciback}
 if [ -f /usr/bin/qemu-img ]; then
     if [ -f /usr/bin/qemu-img-xen ]; then
         rm /usr/bin/qemu-img-xen
diff --git a/xenpaging.23817-mem_event_check_ring.patch b/xenpaging.23817-mem_event_check_ring.patch
new file mode 100644
index 0000000..ee25028
--- /dev/null
+++ b/xenpaging.23817-mem_event_check_ring.patch
@@ -0,0 +1,141 @@
+xen-unstable changeset:   23817:083f10851dd8
+date:        Mon Sep 05 15:10:09 2011 +0100
+description:
+mem_event: add ref counting for free requestslots
+
+If mem_event_check_ring() is called by many vcpus at the same time
+before any of them called also mem_event_put_request(), all of the
+callers must assume there are enough free slots available in the ring.
+
+Record the number of request producers in mem_event_check_ring() to
+keep track of available free slots.
+
+Add a new mem_event_put_req_producers() function to release a request
+attempt made in mem_event_check_ring(). Its required for
+p2m_mem_paging_populate() because that function can only modify the
+p2m type if there are free request slots. But in some cases
+p2m_mem_paging_populate() does not actually have to produce another
+request when it is known that the same request was already made
+earlier by a different vcpu.
+
+
+mem_event_check_ring() can not return a reference to a free request
+slot because there could be multiple references for different vcpus
+and the order of mem_event_put_request() calls is not known. As a
+result, incomplete requests could be consumed by the ring user.
+
+Signed-off-by: Olaf Hering <olaf@aepfle.de>
+
+---
+ xen/arch/x86/mm/mem_event.c     |   19 ++++++++++++-------
+ xen/arch/x86/mm/mem_sharing.c   |    1 -
+ xen/arch/x86/mm/p2m.c           |    1 +
+ xen/include/asm-x86/mem_event.h |    1 +
+ xen/include/xen/sched.h         |    1 +
+ 5 files changed, 15 insertions(+), 8 deletions(-)
+
+Index: xen-4.1.2-testing/xen/arch/x86/mm/mem_event.c
+===================================================================
+--- xen-4.1.2-testing.orig/xen/arch/x86/mm/mem_event.c
++++ xen-4.1.2-testing/xen/arch/x86/mm/mem_event.c
+@@ -37,8 +37,6 @@
+ #define mem_event_ring_lock(_d)       spin_lock(&(_d)->mem_event.ring_lock)
+ #define mem_event_ring_unlock(_d)     spin_unlock(&(_d)->mem_event.ring_lock)
+ 
+-#define MEM_EVENT_RING_THRESHOLD 4
+-
+ static int mem_event_enable(struct domain *d, mfn_t ring_mfn, mfn_t shared_mfn)
+ {
+     int rc;
+@@ -109,6 +107,7 @@ void mem_event_put_request(struct domain
+     req_prod++;
+ 
+     /* Update ring */
++    d->mem_event.req_producers--;
+     front_ring->req_prod_pvt = req_prod;
+     RING_PUSH_REQUESTS(front_ring);
+ 
+@@ -153,11 +152,18 @@ void mem_event_mark_and_pause(struct vcp
+     vcpu_sleep_nosync(v);
+ }
+ 
++void mem_event_put_req_producers(struct domain *d)
++{
++    mem_event_ring_lock(d);
++    d->mem_event.req_producers--;
++    mem_event_ring_unlock(d);
++}
++
+ int mem_event_check_ring(struct domain *d)
+ {
+     struct vcpu *curr = current;
+     int free_requests;
+-    int ring_full;
++    int ring_full = 1;
+ 
+     if ( !d->mem_event.ring_page )
+         return -1;
+@@ -165,12 +171,11 @@ int mem_event_check_ring(struct domain *
+     mem_event_ring_lock(d);
+ 
+     free_requests = RING_FREE_REQUESTS(&d->mem_event.front_ring);
+-    if ( unlikely(free_requests < 2) )
++    if ( d->mem_event.req_producers < free_requests )
+     {
+-        gdprintk(XENLOG_INFO, "free request slots: %d\n", free_requests);
+-        WARN_ON(free_requests == 0);
++        d->mem_event.req_producers++;
++        ring_full = 0;
+     }
+-    ring_full = free_requests < MEM_EVENT_RING_THRESHOLD ? 1 : 0;
+ 
+     if ( (curr->domain->domain_id == d->domain_id) && ring_full )
+     {
+Index: xen-4.1.2-testing/xen/arch/x86/mm/mem_sharing.c
+===================================================================
+--- xen-4.1.2-testing.orig/xen/arch/x86/mm/mem_sharing.c
++++ xen-4.1.2-testing/xen/arch/x86/mm/mem_sharing.c
+@@ -322,7 +322,6 @@ static struct page_info* mem_sharing_all
+         req.flags |= MEM_EVENT_FLAG_VCPU_PAUSED;
+     }
+ 
+-    /* XXX: Need to reserve a request, not just check the ring! */
+     if(mem_event_check_ring(d)) return page;
+ 
+     req.gfn = gfn;
+Index: xen-4.1.2-testing/xen/arch/x86/mm/p2m.c
+===================================================================
+--- xen-4.1.2-testing.orig/xen/arch/x86/mm/p2m.c
++++ xen-4.1.2-testing/xen/arch/x86/mm/p2m.c
+@@ -2970,6 +2970,7 @@ void p2m_mem_paging_populate(struct p2m_
+     else if ( p2mt != p2m_ram_paging_out && p2mt != p2m_ram_paged )
+     {
+         /* gfn is already on its way back and vcpu is not paused */
++        mem_event_put_req_producers(d);
+         return;
+     }
+ 
+Index: xen-4.1.2-testing/xen/include/asm-x86/mem_event.h
+===================================================================
+--- xen-4.1.2-testing.orig/xen/include/asm-x86/mem_event.h
++++ xen-4.1.2-testing/xen/include/asm-x86/mem_event.h
+@@ -27,6 +27,7 @@
+ /* Pauses VCPU while marking pause flag for mem event */
+ void mem_event_mark_and_pause(struct vcpu *v);
+ int mem_event_check_ring(struct domain *d);
++void mem_event_put_req_producers(struct domain *d);
+ void mem_event_put_request(struct domain *d, mem_event_request_t *req);
+ void mem_event_get_response(struct domain *d, mem_event_response_t *rsp);
+ void mem_event_unpause_vcpus(struct domain *d);
+Index: xen-4.1.2-testing/xen/include/xen/sched.h
+===================================================================
+--- xen-4.1.2-testing.orig/xen/include/xen/sched.h
++++ xen-4.1.2-testing/xen/include/xen/sched.h
+@@ -190,6 +190,7 @@ struct mem_event_domain
+ {
+     /* ring lock */
+     spinlock_t ring_lock;
++    unsigned int req_producers;
+     /* shared page */
+     mem_event_shared_page_t *shared_page;
+     /* shared ring page */
diff --git a/xenstored.XS_RESET_WATCHES.patch b/xenstored.XS_RESET_WATCHES.patch
new file mode 100644
index 0000000..0a73d7d
--- /dev/null
+++ b/xenstored.XS_RESET_WATCHES.patch
@@ -0,0 +1,115 @@
+changeset:   23839:42a45baf037d
+user:        Olaf Hering <olaf@aepfle.de>
+date:        Thu Sep 15 11:08:05 2011 +0100
+files:       docs/misc/xenstore.txt tools/xenstore/xenstored_core.c tools/xenstore/xenstored_domain.c tools/xenstore/xenstored_domain.h xen/include/public/io/xs_wire.h
+description:
+xenstored: allow guest to shutdown all its watches/transactions
+
+During kexec all old watches have to be removed, otherwise the new
+kernel will receive unexpected events. Allow a guest to reset itself
+and cleanup all of its watches and transactions.
+
+Add a new XS_RESET_WATCHES command to do the reset on behalf of the
+guest.
+
+(Changes by iwj: specify the argument to be a single nul byte.  Permit
+read-only clients to use the new command.)
+
+Signed-off-by: Olaf Hering <olaf@aepfle.de>
+Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
+Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
+
+
+---
+ docs/misc/xenstore.txt            |    3 +++
+ tools/xenstore/xenstored_core.c   |    5 +++++
+ tools/xenstore/xenstored_domain.c |    9 +++++++++
+ tools/xenstore/xenstored_domain.h |    3 +++
+ xen/include/public/io/xs_wire.h   |    3 ++-
+ 5 files changed, 22 insertions(+), 1 deletion(-)
+
+Index: xen-4.1.2-testing/docs/misc/xenstore.txt
+===================================================================
+--- xen-4.1.2-testing.orig/docs/misc/xenstore.txt
++++ xen-4.1.2-testing/docs/misc/xenstore.txt
+@@ -217,6 +217,9 @@ WATCH_EVENT					<epath>|<token>|
+ 
+ UNWATCH			<wpath>|<token>|?
+ 
++RESET_WATCHES		|
++	Reset all watches and transactions of the caller.
++
+ ---------- Transactions ----------
+ 
+ TRANSACTION_START	|			<transid>|
+Index: xen-4.1.2-testing/tools/xenstore/xenstored_core.c
+===================================================================
+--- xen-4.1.2-testing.orig/tools/xenstore/xenstored_core.c
++++ xen-4.1.2-testing/tools/xenstore/xenstored_core.c
+@@ -120,6 +120,7 @@ static char *sockmsg_string(enum xsd_soc
+ 	case XS_IS_DOMAIN_INTRODUCED: return "XS_IS_DOMAIN_INTRODUCED";
+ 	case XS_RESUME: return "RESUME";
+ 	case XS_SET_TARGET: return "SET_TARGET";
++	case XS_RESET_WATCHES: return "RESET_WATCHES";
+ 	default:
+ 		return "**UNKNOWN**";
+ 	}
+@@ -1242,6 +1243,10 @@ static void process_message(struct conne
+ 		do_set_target(conn, in);
+ 		break;
+ 
++	case XS_RESET_WATCHES:
++		do_reset_watches(conn);
++		break;
++
+ 	default:
+ 		eprintf("Client unknown operation %i", in->hdr.msg.type);
+ 		send_error(conn, ENOSYS);
+Index: xen-4.1.2-testing/tools/xenstore/xenstored_domain.c
+===================================================================
+--- xen-4.1.2-testing.orig/tools/xenstore/xenstored_domain.c
++++ xen-4.1.2-testing/tools/xenstore/xenstored_domain.c
+@@ -537,6 +537,15 @@ void do_is_domain_introduced(struct conn
+ 	send_reply(conn, XS_IS_DOMAIN_INTRODUCED, result ? "T" : "F", 2);
+ }
+ 
++/* Allow guest to reset all watches */
++void do_reset_watches(struct connection *conn)
++{
++	conn_delete_all_watches(conn);
++	conn_delete_all_transactions(conn);
++
++	send_ack(conn, XS_RESET_WATCHES);
++}
++
+ static int close_xc_handle(void *_handle)
+ {
+ 	xc_interface_close(*(xc_interface**)_handle);
+Index: xen-4.1.2-testing/tools/xenstore/xenstored_domain.h
+===================================================================
+--- xen-4.1.2-testing.orig/tools/xenstore/xenstored_domain.h
++++ xen-4.1.2-testing/tools/xenstore/xenstored_domain.h
+@@ -40,6 +40,9 @@ void do_set_target(struct connection *co
+ /* domid */
+ void do_get_domain_path(struct connection *conn, const char *domid_str);
+ 
++/* Allow guest to reset all watches */
++void do_reset_watches(struct connection *conn);
++
+ void domain_init(void);
+ 
+ /* Returns the implicit path of a connection (only domains have this) */
+Index: xen-4.1.2-testing/xen/include/public/io/xs_wire.h
+===================================================================
+--- xen-4.1.2-testing.orig/xen/include/public/io/xs_wire.h
++++ xen-4.1.2-testing/xen/include/public/io/xs_wire.h
+@@ -48,7 +48,8 @@ enum xsd_sockmsg_type
+     XS_IS_DOMAIN_INTRODUCED,
+     XS_RESUME,
+     XS_SET_TARGET,
+-    XS_RESTRICT
++    XS_RESTRICT,
++    XS_RESET_WATCHES
+ };
+ 
+ #define XS_WRITE_NONE "NONE"
diff --git a/xmclone.sh b/xmclone.sh
index 43acf36..1c358e8 100644
--- a/xmclone.sh
+++ b/xmclone.sh
@@ -36,7 +36,7 @@ PART=2
 DOMU_IS_FILE_BASED=
 DOMU_ROOTDEV=
 FORCE=no
-xm_cmd=xl
+xm_cmd="xl -f"
 
 
 #