- bnc#620694 - Xen yast vm-install for existing paravirtualized

disk fails with UnboundLocalError: local variable 'dev_type' referenced before assignment 21678-xend-mac-fix.patch - bnc#586221 - cannot add DomU with USB host controller defined domu-usb-controller.patch (Chun Yan Liu) - Upstream patches from Jan 21151-trace-bounds-check.patch 21627-cpuidle-wrap.patch 21643-vmx-vpmu-pmc-offset.patch 21682-trace-buffer-range.patch 21683-vtd-kill-timer-conditional.patch 21693-memevent-64bit-only.patch 21695-trace-t_info-readonly.patch 21698-x86-pirq-range-check.patch 21699-p2m-query-for-type-change.patch 21700-32on64-vm86-gpf.patch 21705-trace-printk.patch 21706-trace-security.patch 21712-amd-osvw.patch 21744-x86-cpufreq-range-check.patch - bnc #599550 - Xen cannot distinguish the status of 'pause' addcommand_domstate.patch OBS-URL: https://build.opensuse.org/package/show/Virtualization/xen?expand=0&rev=63
2010-07-14 22:43:11 +00:00 · 2010-07-14 22:43:11 +00:00 · ff4b346ede
commit ff4b346ede
parent fef7e33f0a
35 changed files with 2085 additions and 91 deletions
--- a/21151-trace-bounds-check.patch
+++ b/21151-trace-bounds-check.patch
@ -0,0 +1,205 @@
 # HG changeset patch
 # User Keir Fraser <keir.fraser@citrix.com>
 # Date 1271091288 -3600
 # Node ID 94cae4dfa25bcf9aaeb93fb374926cb40411ebdf
 # Parent  78488a63bbc200095413824cc146134b54635da9
 xentrace: Bounds checking and error handling
 Check tbuf_size to make sure that it will fit on the t_info struct
 allocated at boot.   Also deal with allocation failures more
 gracefully.
 Signed-off-by: George Dunlap <george.dunlap@eu.citrix.com>
 # HG changeset patch
 # User Keir Fraser <keir.fraser@citrix.com>
 # Date 1278093165 -3600
 # Node ID 2f3a68a0b55b1b7df4d6632dfc151040ba08e9ea
 # Parent  2846fd19945cb2ab32d1513531c3500278133484
 trace: Fix T_INFO_FIRST_OFFSET calculation
 This wasn't defined correctly, thus allowing in the
 num_online_cpus() == NR_CPUS case to pass a corrupted MFN to
 Dom0.
 Reported-by: Jan Beulich <jbeulich@novell.com>
 Signed-off-by: George Dunlap <george.dunlap@eu.citrix.com>
 # HG changeset patch
 # User Keir Fraser <keir.fraser@citrix.com>
 # Date 1278093190 -3600
 # Node ID 1390e2ab45c7b63d79ba9496d609cf59af4b44ee
 # Parent  2f3a68a0b55b1b7df4d6632dfc151040ba08e9ea
 trace: improve check_tbuf_size()
 It didn't consider the case of the incoming size not allowing for the
 2*data_size range for t_buf->{prod,cons}
 Signed-off-by: Jan Beulich <jbeulich@novell.com>
 Signed-off-by: George Dunlap <george.dunlap@eu.citrix.com>
 --- a/xen/common/trace.c
 +++ b/xen/common/trace.c
@@ -48,10 +48,12 @@ integer_param("tbuf_size", opt_tbuf_size
 /* Pointers to the meta-data objects for all system trace buffers */
 static struct t_info *t_info;
 #define T_INFO_PAGES 2  /* Size fixed at 2 pages for now. */
 +#define T_INFO_SIZE ((T_INFO_PAGES)*(PAGE_SIZE))
 static DEFINE_PER_CPU_READ_MOSTLY(struct t_buf *, t_bufs);
 static DEFINE_PER_CPU_READ_MOSTLY(unsigned char *, t_data);
 static DEFINE_PER_CPU_READ_MOSTLY(spinlock_t, t_lock);
 static int data_size;
 +static u32 t_info_first_offset __read_mostly;
 /* High water mark for trace buffers; */
 /* Send virtual interrupt when buffer level reaches this point */
@@ -71,6 +73,39 @@ static cpumask_t tb_cpu_mask = CPU_MASK_
 /* which tracing events are enabled */
 static u32 tb_event_mask = TRC_ALL;
 +/* Return the number of elements _type necessary to store at least _x bytes of data
 + * i.e., sizeof(_type) * ans >= _x. */
 +#define fit_to_type(_type, _x) (((_x)+sizeof(_type)-1) / sizeof(_type))
 +
 +static void calc_tinfo_first_offset(void)
 +{
 +    int offset_in_bytes;
 +
 +    offset_in_bytes = offsetof(struct t_info, mfn_offset[NR_CPUS]);
 +
 +    t_info_first_offset = fit_to_type(uint32_t, offset_in_bytes);
 +
 +    gdprintk(XENLOG_INFO, "%s: NR_CPUs %d, offset_in_bytes %d, t_info_first_offset %u\n",
 +           __func__, NR_CPUS, offset_in_bytes, (unsigned)t_info_first_offset);
 +}
 +
 +/**
 + * check_tbuf_size - check to make sure that the proposed size will fit
 + * in the currently sized struct t_info and allows prod and cons to
 + * reach double the value without overflow.
 + */
 +static int check_tbuf_size(u32 pages)
 +{
 +    struct t_buf dummy;
 +    typeof(dummy.prod) size;
 +
 +    size = ((typeof(dummy.prod))pages)  * PAGE_SIZE;
 +
 +    return (size / PAGE_SIZE != pages)
 +           || (size + size < size)
 +           || (num_online_cpus() * pages + t_info_first_offset > T_INFO_SIZE / sizeof(uint32_t));
 +}
 +
 /**
  * alloc_trace_bufs - performs initialization of the per-cpu trace buffers.
  *
@@ -87,7 +122,9 @@ static int alloc_trace_bufs(void)
     unsigned long nr_pages;
     /* Start after a fixed-size array of NR_CPUS */
     uint32_t *t_info_mfn_list = (uint32_t *)t_info;
 -    int offset = (NR_CPUS * 2 + 1 + 1) / 4;
 +    int offset = t_info_first_offset;
 +
 +    BUG_ON(check_tbuf_size(opt_tbuf_size));
     if ( opt_tbuf_size == 0 )
         return -EINVAL;
@@ -180,7 +217,8 @@ out_dealloc:
         }
         spin_unlock_irqrestore(&per_cpu(t_lock, cpu), flags);
     }
 -    return -EINVAL;
 +
 +    return -ENOMEM;
 }
@@ -197,19 +235,35 @@ static int tb_set_size(int size)
      * boot time or via control tools, but not by both. Once buffers
      * are created they cannot be destroyed.
      */
 -    if ( (opt_tbuf_size != 0) || (size <= 0) )
 +    int ret = 0;
 +
 +
 +
 +    if ( (opt_tbuf_size != 0) )
     {
 -        gdprintk(XENLOG_INFO, "tb_set_size from %d to %d not implemented\n",
 -                opt_tbuf_size, size);
 +        if ( size != opt_tbuf_size )
 +            gdprintk(XENLOG_INFO, "tb_set_size from %d to %d not implemented\n",
 +                     opt_tbuf_size, size);
         return -EINVAL;
     }
 -    opt_tbuf_size = size;
 -    if ( alloc_trace_bufs() != 0 )
 +    if ( size <= 0 )
         return -EINVAL;
 -    printk("Xen trace buffers: initialized\n");
 -    return 0;
 +    if ( check_tbuf_size(size) )
 +    {
 +        gdprintk(XENLOG_INFO, "tb size %d too large\n", size);
 +        return -EINVAL;
 +    }
 +
 +    opt_tbuf_size = size;
 +
 +    if ( (ret = alloc_trace_bufs()) == 0 )
 +        printk("Xen trace buffers: initialized\n");
 +    else
 +        opt_tbuf_size = 0;
 +
 +    return ret;
 }
 int trace_will_trace_event(u32 event)
@@ -248,6 +302,10 @@ int trace_will_trace_event(u32 event)
 void __init init_trace_bufs(void)
 {
     int i;
 +
 +    /* Calculate offset in u32 of first mfn */
 +    calc_tinfo_first_offset();
 +
     /* t_info size fixed at 2 pages for now.  That should be big enough / small enough
      * until it's worth making it dynamic. */
     t_info = alloc_xenheap_pages(1, 0);
@@ -265,13 +323,18 @@ void __init init_trace_bufs(void)
         share_xen_page_with_privileged_guests(
             virt_to_page(t_info) + i, XENSHARE_writable);
 -
 -
     if ( opt_tbuf_size == 0 )
     {
         printk("Xen trace buffers: disabled\n");
         return;
     }
 +    else if ( check_tbuf_size(opt_tbuf_size) )
 +    {
 +        gdprintk(XENLOG_INFO, "Xen trace buffers: "
 +                 "tb size %d too large, disabling\n",
 +                 opt_tbuf_size);
 +        opt_tbuf_size = 0;
 +    }
     if ( alloc_trace_bufs() == 0 )
     {
@@ -279,6 +342,13 @@ void __init init_trace_bufs(void)
         wmb(); /* above must be visible before tb_init_done flag set */
         tb_init_done = 1;
     }
 +    else
 +    {
 +        gdprintk(XENLOG_INFO, "Xen trace buffers: "
 +                 "allocation size %d failed, disabling\n",
 +                 opt_tbuf_size);
 +        opt_tbuf_size = 0;
 +    }
 }
 /**
--- a/21333-xentrace-t_info-size.patch
+++ b/21333-xentrace-t_info-size.patch
@ -11,9 +11,11 @@ is more than 1024 but less than 2048.
 Signed-off-by: George Dunlap <george.dunlap@citrix.com>
--- a/xen/common/trace.c
+Index: xen-4.0.0-testing/xen/common/trace.c
-+++ b/xen/common/trace.c
+===================================================================
-@@ -297,7 +297,7 @@ int tb_control(xen_sysctl_tbuf_op_t *tbc
+--- xen-4.0.0-testing.orig/xen/common/trace.c
 +++ xen-4.0.0-testing/xen/common/trace.c
@@ -367,7 +367,7 @@ int tb_control(xen_sysctl_tbuf_op_t *tbc
     case XEN_SYSCTL_TBUFOP_get_info:
         tbc->evt_mask   = tb_event_mask;
         tbc->buffer_mfn = t_info ? virt_to_mfn(t_info) : 0;
--- a/21360-x86-mce-polling-disabled-init.patch
+++ b/21360-x86-mce-polling-disabled-init.patch
@ -0,0 +1,20 @@
 # HG changeset patch
 # User Keir Fraser <keir.fraser@citrix.com>
 # Date 1273651780 -3600
 # Node ID fa94385978e6317732e2c12000923ca6a5e0d2ed
 # Parent  0079f76e906f378f81044da4e135df2fbb878fa5
 mce: MCE polling logic should check mce_disabled during initialisation.
 Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
 --- a/xen/arch/x86/cpu/mcheck/non-fatal.c
 +++ b/xen/arch/x86/cpu/mcheck/non-fatal.c
@@ -91,7 +91,7 @@ static int __init init_nonfatal_mce_chec
 	struct cpuinfo_x86 *c = &boot_cpu_data;
 	/* Check for MCE support */
 -	if (!mce_available(c))
 +	if (mce_disabled || !mce_available(c))
 		return -ENODEV;
 	/*
--- a/21627-cpuidle-wrap.patch
+++ b/21627-cpuidle-wrap.patch
@ -0,0 +1,23 @@
 # HG changeset patch
 # User Keir Fraser <keir.fraser@citrix.com>
 # Date 1276761018 -3600
 # Node ID 7a00c0bd4fc131fb4de5df9f3fdc4e48a29dd5f9
 # Parent  dab8676e97ce7a95c0777e58eee4b1b03bfc5322
 cpuidle: fix wrapped ticks calculation for pm timer.
 Signed-off-by: Wei Gang <gang.wei@intel.com>
 --- a/xen/arch/x86/acpi/cpu_idle.c
 +++ b/xen/arch/x86/acpi/cpu_idle.c
@@ -127,9 +127,9 @@ static inline u32 ticks_elapsed(u32 t1, 
     if ( t2 >= t1 )
         return (t2 - t1);
     else if ( !(acpi_gbl_FADT.flags & ACPI_FADT_32BIT_TIMER) )
 -        return (((0x00FFFFFF - t1) + t2) & 0x00FFFFFF);
 +        return (((0x00FFFFFF - t1) + t2 + 1) & 0x00FFFFFF);
     else
 -        return ((0xFFFFFFFF - t1) + t2);
 +        return ((0xFFFFFFFF - t1) + t2 +1);
 }
 static void acpi_safe_halt(void)
--- a/21643-vmx-vpmu-pmc-offset.patch
+++ b/21643-vmx-vpmu-pmc-offset.patch
@ -0,0 +1,25 @@
 # HG changeset patch
 # User Keir Fraser <keir.fraser@citrix.com>
 # Date 1277110750 -3600
 # Node ID 31708477f0a92be70a940d1c8ff1aa721051bba8
 # Parent  46a4c936b77e483971d2b3eb0b544c61700f824a
 vmx: Fix bug in VMX VPMU fixed function PMC offset
 This is a minor fix to the calculation of bit-width of fixed function
 perfmon counters in Intel processors.  Bits 5-12 of edx register
 should be calculated as (edx & 0x1fe0) >>5 instead of using 0x1f70.
 From: "John, Jaiber J" <jaiber.j.john@intel.com>
 Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
 --- a/xen/arch/x86/hvm/vmx/vpmu_core2.c
 +++ b/xen/arch/x86/hvm/vmx/vpmu_core2.c
@@ -82,7 +82,7 @@ static int core2_get_bitwidth_fix_count(
 {
     u32 eax, ebx, ecx, edx;
     cpuid(0xa, &eax, &ebx, &ecx, &edx);
 -    return ((edx & 0x1f70) >> 5);
 +    return ((edx & 0x1fe0) >> 5);
 }
 static int is_core2_vpmu_msr(u32 msr_index, int *type, int *index)
--- a/21653-xend-mac-addr.patch
+++ b/21653-xend-mac-addr.patch
@ -0,0 +1,46 @@
 # HG changeset patch
 # User Ian Jackson <Ian.Jackson@eu.citrix.com>
 # Date 1277219220 -3600
 # Node ID 9da3abe88c90bd8ec48963a9ec537a8871e266db
 # Parent  2ad890d46cb8a11fc6ea329126d398021307e627
 Check "mac" address sooner in device_create function, before doing device_add.
 In XendDomainInfo.py device_create function, when device type is
 "vif", it has a paragraph to check the validity of "mac"
 address. Before checking validity, device_add has been done. But after
 checking validity, if the mac address is invlid, it raises VmError and
 exits directly without doing clean work like removing the device item
 from config info. This will cause that the incorrect mac address is
 saved into VM Config file and VM fails to restart. If check "mac"
 validity before doing device_add, there will be no problem.
 Signed-off-by Chunyan Liu <CYLiu@novell.com>
 Index: xen-4.0.0-testing/tools/python/xen/xend/XendDomainInfo.py
 ===================================================================
 --- xen-4.0.0-testing.orig/tools/python/xen/xend/XendDomainInfo.py
 +++ xen-4.0.0-testing/tools/python/xen/xend/XendDomainInfo.py
@@ -847,11 +847,6 @@ class XendDomainInfo:
         @type  dev_config: SXP object (parsed config)
         """
         log.debug("XendDomainInfo.device_create: %s" % scrub_password(dev_config))
 -        dev_type = sxp.name(dev_config)
 -        dev_uuid = self.info.device_add(dev_type, cfg_sxp = dev_config)
 -        dev_config_dict = self.info['devices'][dev_uuid][1]
 -        log.debug("XendDomainInfo.device_create: %s" % scrub_password(dev_config_dict))
 -
         if dev_type == 'vif':
             for x in dev_config:
                 if x != 'vif' and x[0] == 'mac':
@@ -859,6 +854,11 @@ class XendDomainInfo:
                         log.error("Virtual network interface creation error - invalid MAC Address entered: %s", x[1])
                         raise VmError("Cannot create a new virtual network interface - MAC address is not valid!");
 +        dev_type = sxp.name(dev_config)
 +        dev_uuid = self.info.device_add(dev_type, cfg_sxp = dev_config)
 +        dev_config_dict = self.info['devices'][dev_uuid][1]
 +        log.debug("XendDomainInfo.device_create: %s" % scrub_password(dev_config_dict))
 +
         if self.domid is not None:
             try:
                 dev_config_dict['devid'] = devid = \
--- a/21678-xend-mac-fix.patch
+++ b/21678-xend-mac-fix.patch
@ -0,0 +1,39 @@
 # HG changeset patch
 # User Ian Jackson <Ian.Jackson@eu.citrix.com>
 # Date 1277475191 -3600
 # Node ID e307aa11ed27ea91cf175461b3a715fe3f7253bc
 # Parent  e7b55cc5533aed48a47cf70e20aa9fb991bf2de4
 xend: Fix up check "mac" address sooner change
 In changeset 21653,
         dev_type = sxp.name(dev_config)
 should not have been moved, otherwise, the checking "mac"
 paragraph is of no use.
 (The original patch as submitted was correct but I had to make the
 change manually as it had been mangled.)
 Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
 Signed-off-by Chunyan Liu <CYLiu@novell.com>
 Index: xen-4.0.0-testing/tools/python/xen/xend/XendDomainInfo.py
 ===================================================================
 --- xen-4.0.0-testing.orig/tools/python/xen/xend/XendDomainInfo.py
 +++ xen-4.0.0-testing/tools/python/xen/xend/XendDomainInfo.py
@@ -847,6 +847,8 @@ class XendDomainInfo:
         @type  dev_config: SXP object (parsed config)
         """
         log.debug("XendDomainInfo.device_create: %s" % scrub_password(dev_config))
 +        dev_type = sxp.name(dev_config)
 +
         if dev_type == 'vif':
             for x in dev_config:
                 if x != 'vif' and x[0] == 'mac':
@@ -854,7 +856,6 @@ class XendDomainInfo:
                         log.error("Virtual network interface creation error - invalid MAC Address entered: %s", x[1])
                         raise VmError("Cannot create a new virtual network interface - MAC address is not valid!");
 -        dev_type = sxp.name(dev_config)
         dev_uuid = self.info.device_add(dev_type, cfg_sxp = dev_config)
         dev_config_dict = self.info['devices'][dev_uuid][1]
         log.debug("XendDomainInfo.device_create: %s" % scrub_password(dev_config_dict))
--- a/21682-trace-buffer-range.patch
+++ b/21682-trace-buffer-range.patch
@ -0,0 +1,26 @@
 # HG changeset patch
 # User Keir Fraser <keir.fraser@citrix.com>
 # Date 1277738876 -3600
 # Node ID 7e46fdbe8a1187cee2ab609256300d7967f37f06
 # Parent  bf64e1081333696c68c9430cbc32c8bd6ee18796
 xentrace: restrict trace buffer MFNs
 Since they're being passed to Dom0 using an array of uint32_t, they
 must be representable as 32-bit quantities, and hence the buffer
 allocation must specify an upper address boundary.
 Signed-off-by: Jan Beulich <jbeulich@novell.com>
 Acked-by: George Dunlap <george.dunlap@eu.citrix.com>
 --- a/xen/common/trace.c
 +++ b/xen/common/trace.c
@@ -152,7 +152,8 @@ static int alloc_trace_bufs(void)
         char         *rawbuf;
         struct t_buf *buf;
 -        if ( (rawbuf = alloc_xenheap_pages(order, 0)) == NULL )
 +        if ( (rawbuf = alloc_xenheap_pages(
 +                order, MEMF_bits(32 + PAGE_SHIFT))) == NULL )
         {
             printk("Xen trace buffers: memory allocation failed\n");
             opt_tbuf_size = 0;
--- a/21683-vtd-kill-timer-conditional.patch
+++ b/21683-vtd-kill-timer-conditional.patch
@ -0,0 +1,43 @@
 # HG changeset patch
 # User Keir Fraser <keir.fraser@citrix.com>
 # Date 1277739919 -3600
 # Node ID 059a12afce52a213db56bd8e9442d9eeadfdd34c
 # Parent  7e46fdbe8a1187cee2ab609256300d7967f37f06
 vtd: Only kill_timer() an init_timer()'ed timer.
 Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
 --- a/xen/drivers/passthrough/io.c
 +++ b/xen/drivers/passthrough/io.c
@@ -27,7 +27,7 @@
 static void hvm_dirq_assist(unsigned long _d);
 -static int pt_irq_need_timer(uint32_t flags)
 +bool_t pt_irq_need_timer(uint32_t flags)
 {
     return !(flags & (HVM_IRQ_DPCI_GUEST_MSI | HVM_IRQ_DPCI_TRANSLATE));
 }
 --- a/xen/drivers/passthrough/pci.c
 +++ b/xen/drivers/passthrough/pci.c
@@ -257,7 +257,9 @@ static void pci_clean_dpci_irqs(struct d
               i = find_next_bit(hvm_irq_dpci->mapping, d->nr_pirqs, i + 1) )
         {
             pirq_guest_unbind(d, i);
 -            kill_timer(&hvm_irq_dpci->hvm_timer[domain_pirq_to_irq(d, i)]);
 +
 +            if ( pt_irq_need_timer(hvm_irq_dpci->mirq[i].flags) )
 +                kill_timer(&hvm_irq_dpci->hvm_timer[domain_pirq_to_irq(d, i)]);
             list_for_each_safe ( digl_list, tmp,
                                  &hvm_irq_dpci->mirq[i].digl_list )
 --- a/xen/include/xen/iommu.h
 +++ b/xen/include/xen/iommu.h
@@ -92,6 +92,7 @@ void hvm_dpci_isairq_eoi(struct domain *
 struct hvm_irq_dpci *domain_get_irq_dpci(struct domain *domain);
 int domain_set_irq_dpci(struct domain *domain, struct hvm_irq_dpci *dpci);
 void free_hvm_irq_dpci(struct hvm_irq_dpci *dpci);
 +bool_t pt_irq_need_timer(uint32_t flags);
 #define PT_IRQ_TIME_OUT MILLISECS(8)
 #define VTDPREFIX "[VT-D]"
--- a/21693-memevent-64bit-only.patch
+++ b/21693-memevent-64bit-only.patch
@ -0,0 +1,270 @@
 # HG changeset patch
 # User Keir Fraser <keir.fraser@citrix.com>
 # Date 1277831801 -3600
 # Node ID 6b5a5bfaf3577a050c6779b0b62245560fda53f6
 # Parent  3ea84fd20b263a8e443e3bb16d5495cd3dbd8033
 x86: Only build memory-event features on 64-bit Xen
 32-bit Xen doesn't have enough p2m types to support them.
 Signed-off-by: Tim Deegan <Tim.Deegan@citrix.com>
 # HG changeset patch
 # User Keir Fraser <keir.fraser@citrix.com>
 # Date 1278579370 -3600
 # Node ID a7a680442b738928eb963b31e22a3e428ac111a0
 # Parent  92ac9536ac5abc17f414f024f3df92658cf2ee96
 xend: Continue domain building even if memshr extensions are not
 present in the hypervisor.
 Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
 --- a/tools/python/xen/xend/image.py
 +++ b/tools/python/xen/xend/image.py
@@ -830,8 +830,10 @@ class HVMImageHandler(ImageHandler):
         self.acpi = int(vmConfig['platform'].get('acpi', 0))
         self.guest_os_type = vmConfig['platform'].get('guest_os_type')
         self.memory_sharing = int(vmConfig['memory_sharing'])
 -        xc.dom_set_memshr(self.vm.getDomid(), self.memory_sharing)
 -
 +        try:
 +            xc.dom_set_memshr(self.vm.getDomid(), self.memory_sharing)
 +        except:
 +            pass
     # Return a list of cmd line args to the device models based on the
     # xm config file
 --- a/xen/arch/x86/domctl.c
 +++ b/xen/arch/x86/domctl.c
@@ -1420,6 +1420,7 @@ long arch_do_domctl(
     break;
 #endif /* XEN_GDBSX_CONFIG */
 +#ifdef __x86_64__
     case XEN_DOMCTL_mem_event_op:
     {
         struct domain *d;
@@ -1450,6 +1451,7 @@ long arch_do_domctl(
         } 
     }
     break;
 +#endif /* __x86_64__ */
     default:
         ret = -ENOSYS;
 --- a/xen/arch/x86/hvm/hvm.c
 +++ b/xen/arch/x86/hvm/hvm.c
@@ -948,6 +948,7 @@ bool_t hvm_hap_nested_page_fault(unsigne
         return 1;
     }
 +#ifdef __x86_64__
     /* Check if the page has been paged out */
     if ( p2m_is_paged(p2mt) || (p2mt == p2m_ram_paging_out) )
         p2m_mem_paging_populate(current->domain, gfn);
@@ -958,6 +959,7 @@ bool_t hvm_hap_nested_page_fault(unsigne
         mem_sharing_unshare_page(current->domain, gfn, 0);
         return 1;
     }
 +#endif
     /* Spurious fault? PoD and log-dirty also take this path. */
     if ( p2m_is_ram(p2mt) )
 --- a/xen/arch/x86/mm.c
 +++ b/xen/arch/x86/mm.c
@@ -3179,20 +3179,23 @@ int do_mmu_update(
                         rc = -ENOENT;
                         break;
                     }
 +#ifdef __x86_64__
                     /* XXX: Ugly: pull all the checks into a separate function. 
                      * Don't want to do it now, not to interfere with mem_paging
                      * patches */
                     else if ( p2m_ram_shared == l1e_p2mt )
                     {
                         /* Unshare the page for RW foreign mappings */
 -                        if(l1e_get_flags(l1e) & _PAGE_RW)
 +                        if ( l1e_get_flags(l1e) & _PAGE_RW )
                         {
                             rc = mem_sharing_unshare_page(pg_owner, 
                                                           l1e_get_pfn(l1e), 
                                                           0);
 -                            if(rc) break; 
 +                            if ( rc )
 +                                break;
                         }
                     } 
 +#endif
                     okay = mod_l1_entry(va, l1e, mfn,
                                         cmd == MMU_PT_UPDATE_PRESERVE_AD, v,
@@ -4537,8 +4540,10 @@ long arch_memory_op(int op, XEN_GUEST_HA
         return rc;
     }
 +#ifdef __x86_64__
     case XENMEM_get_sharing_freed_pages:
         return mem_sharing_get_nr_saved_mfns();
 +#endif
     default:
         return subarch_memory_op(op, arg);
 --- a/xen/arch/x86/mm/Makefile
 +++ b/xen/arch/x86/mm/Makefile
@@ -6,9 +6,9 @@ obj-y += p2m.o
 obj-y += guest_walk_2.o
 obj-y += guest_walk_3.o
 obj-$(x86_64) += guest_walk_4.o
 -obj-y += mem_event.o
 -obj-y += mem_paging.o
 -obj-y += mem_sharing.o
 +obj-$(x86_64) += mem_event.o
 +obj-$(x86_64) += mem_paging.o
 +obj-$(x86_64) += mem_sharing.o
 guest_walk_%.o: guest_walk.c Makefile
 	$(CC) $(CFLAGS) -DGUEST_PAGING_LEVELS=$* -c $< -o $@
 --- a/xen/arch/x86/mm/p2m.c
 +++ b/xen/arch/x86/mm/p2m.c
@@ -1708,17 +1708,23 @@ void p2m_teardown(struct domain *d)
 {
     struct page_info *pg;
     struct p2m_domain *p2m = d->arch.p2m;
 +#ifdef __x86_64__
     unsigned long gfn;
     p2m_type_t t;
     mfn_t mfn;
 +#endif
     p2m_lock(p2m);
 -    for(gfn=0; gfn < p2m->max_mapped_pfn; gfn++)
 +
 +#ifdef __x86_64__
 +    for ( gfn=0; gfn < p2m->max_mapped_pfn; gfn++ )
     {
         mfn = p2m->get_entry(d, gfn, &t, p2m_query);
 -        if(mfn_valid(mfn) && (t == p2m_ram_shared))
 +        if ( mfn_valid(mfn) && (t == p2m_ram_shared) )
             BUG_ON(mem_sharing_unshare_page(d, gfn, MEM_SHARING_DESTROY_GFN));
     }
 +#endif
 +
     d->arch.phys_table = pagetable_null();
     while ( (pg = page_list_remove_head(&p2m->pages)) )
@@ -2410,6 +2416,7 @@ clear_mmio_p2m_entry(struct domain *d, u
     return rc;
 }
 +#ifdef __x86_64__
 int
 set_shared_p2m_entry(struct domain *d, unsigned long gfn, mfn_t mfn)
 {
@@ -2592,7 +2599,7 @@ void p2m_mem_paging_resume(struct domain
     /* Unpause any domains that were paused because the ring was full */
     mem_event_unpause_vcpus(d);
 }
 -
 +#endif /* __x86_64__ */
 /*
  * Local variables:
 --- a/xen/include/asm-x86/mem_sharing.h
 +++ b/xen/include/asm-x86/mem_sharing.h
@@ -22,6 +22,8 @@
 #ifndef __MEM_SHARING_H__
 #define __MEM_SHARING_H__
 +#ifdef __x86_64__
 +
 #define sharing_supported(_d) \
     (is_hvm_domain(_d) && (_d)->arch.hvm_domain.hap_enabled) 
@@ -43,4 +45,10 @@ int mem_sharing_domctl(struct domain *d,
                        xen_domctl_mem_sharing_op_t *mec);
 void mem_sharing_init(void);
 +#else
 +
 +#define mem_sharing_init()  do { } while (0)
 +
 +#endif /* __x86_64__ */
 +
 #endif /* __MEM_SHARING_H__ */
 --- a/xen/include/asm-x86/p2m.h
 +++ b/xen/include/asm-x86/p2m.h
@@ -77,11 +77,12 @@ typedef enum {
     p2m_grant_map_rw = 7,       /* Read/write grant mapping */
     p2m_grant_map_ro = 8,       /* Read-only grant mapping */
 +    /* Likewise, although these are defined in all builds, they can only
 +     * be used in 64-bit builds */
     p2m_ram_paging_out = 9,       /* Memory that is being paged out */
     p2m_ram_paged = 10,           /* Memory that has been paged out */
     p2m_ram_paging_in = 11,       /* Memory that is being paged in */
     p2m_ram_paging_in_start = 12, /* Memory that is being paged in */
 -
     p2m_ram_shared = 13,          /* Shared or sharable memory */
 } p2m_type_t;
@@ -154,6 +155,7 @@ typedef enum {
 #define p2m_is_sharable(_t) (p2m_to_mask(_t) & P2M_SHARABLE_TYPES)
 #define p2m_is_shared(_t)   (p2m_to_mask(_t) & P2M_SHARED_TYPES)
 +
 /* Populate-on-demand */
 #define POPULATE_ON_DEMAND_MFN  (1<<9)
 #define POD_PAGE_ORDER 9
@@ -314,20 +316,21 @@ static inline mfn_t gfn_to_mfn_unshare(s
                                        int must_succeed)
 {
     mfn_t mfn;
 -    int ret;
     mfn = gfn_to_mfn(d, gfn, p2mt);
 -    if(p2m_is_shared(*p2mt))
 +#ifdef __x86_64__
 +    if ( p2m_is_shared(*p2mt) )
     {
 -        ret = mem_sharing_unshare_page(d, gfn,
 -                must_succeed ? MEM_SHARING_MUST_SUCCEED : 0);
 -        if(ret < 0)
 +        if ( mem_sharing_unshare_page(d, gfn,
 +                                      must_succeed
 +                                      ? MEM_SHARING_MUST_SUCCEED : 0) )
         {
             BUG_ON(must_succeed);
             return mfn;
         }
         mfn = gfn_to_mfn(d, gfn, p2mt);
     }
 +#endif
     return mfn;
 }
@@ -429,10 +432,11 @@ p2m_type_t p2m_change_type(struct domain
 /* Set mmio addresses in the p2m table (for pass-through) */
 int set_mmio_p2m_entry(struct domain *d, unsigned long gfn, mfn_t mfn);
 int clear_mmio_p2m_entry(struct domain *d, unsigned long gfn);
 -/* Modify p2m table for shared gfn */
 -int
 -set_shared_p2m_entry(struct domain *d, unsigned long gfn, mfn_t mfn);
 +
 +#ifdef __x86_64__
 +/* Modify p2m table for shared gfn */
 +int set_shared_p2m_entry(struct domain *d, unsigned long gfn, mfn_t mfn);
 /* Check if a nominated gfn is valid to be paged out */
 int p2m_mem_paging_nominate(struct domain *d, unsigned long gfn);
 /* Evict a frame */
@@ -443,6 +447,10 @@ void p2m_mem_paging_populate(struct doma
 int p2m_mem_paging_prep(struct domain *d, unsigned long gfn);
 /* Resume normal operation (in case a domain was paused) */
 void p2m_mem_paging_resume(struct domain *d);
 +#else
 +static inline void p2m_mem_paging_populate(struct domain *d, unsigned long gfn)
 +{ }
 +#endif
 #endif /* _XEN_P2M_H */
--- a/21695-trace-t_info-readonly.patch
+++ b/21695-trace-t_info-readonly.patch
@ -0,0 +1,90 @@
 # HG changeset patch
 # User Keir Fraser <keir.fraser@citrix.com>
 # Date 1277831922 -3600
 # Node ID c5f3fe17374cead91fdaa94f60cf7b3115eaa091
 # Parent  2a3a5979e3f16d77f5b526050c45acba186482b0
 trace: share t_info pages only in read-only mode
 There's no need to share writably the t_info pages (Dom0 only wants
 [and needs] to read it)
 Signed-off-by: Jan Beulich <jbeulich@novell.com>
 Acked-by: George Dunlap <george.dunlap@eu.citrix.com>
 --- a/tools/xenmon/xenbaked.c
 +++ b/tools/xenmon/xenbaked.c
@@ -84,7 +84,7 @@ typedef struct settings_st {
 } settings_t;
 struct t_struct {
 -    struct t_info *t_info;  /* Structure with information about individual buffers */
 +    const struct t_info *t_info; /* Structure with information about individual buffers */
     struct t_buf **meta;    /* Pointers to trace buffer metadata */
     unsigned char **data;   /* Pointers to trace buffer data areas */
 };
@@ -376,9 +376,8 @@ static struct t_struct *map_tbufs(unsign
     }
     /* Map t_info metadata structure */
 -    tbufs.t_info = xc_map_foreign_range(xc_handle, DOMID_XEN,
 -                                        tinfo_size, PROT_READ | PROT_WRITE,
 -                                        tbufs_mfn);
 +    tbufs.t_info = xc_map_foreign_range(xc_handle, DOMID_XEN, tinfo_size,
 +                                        PROT_READ, tbufs_mfn);
     if ( tbufs.t_info == 0 ) 
     {
@@ -404,7 +403,8 @@ static struct t_struct *map_tbufs(unsign
     for(i=0; i<num; i++)
     {
 -        uint32_t *mfn_list = ((uint32_t *)tbufs.t_info) + tbufs.t_info->mfn_offset[i];
 +        const uint32_t *mfn_list = (const uint32_t *)tbufs.t_info
 +                                   + tbufs.t_info->mfn_offset[i];
         int j;
         xen_pfn_t pfn_list[tbufs.t_info->tbuf_size];
 --- a/tools/xentrace/xentrace.c
 +++ b/tools/xentrace/xentrace.c
@@ -62,7 +62,7 @@ typedef struct settings_st {
 } settings_t;
 struct t_struct {
 -    struct t_info *t_info;  /* Structure with information about individual buffers */
 +    const struct t_info *t_info; /* Structure with information about individual buffers */
     struct t_buf **meta;    /* Pointers to trace buffer metadata */
     unsigned char **data;   /* Pointers to trace buffer data areas */
 };
@@ -459,9 +459,8 @@ static struct t_struct *map_tbufs(unsign
     int i;
     /* Map t_info metadata structure */
 -    tbufs.t_info = xc_map_foreign_range(xc_handle, DOMID_XEN,
 -                                        tinfo_size, PROT_READ | PROT_WRITE,
 -                                        tbufs_mfn);
 +    tbufs.t_info = xc_map_foreign_range(xc_handle, DOMID_XEN, tinfo_size,
 +                                        PROT_READ, tbufs_mfn);
     if ( tbufs.t_info == 0 ) 
     {
@@ -487,7 +486,8 @@ static struct t_struct *map_tbufs(unsign
     for(i=0; i<num; i++)
     {
 -        uint32_t *mfn_list = ((uint32_t *)tbufs.t_info) + tbufs.t_info->mfn_offset[i];
 +        const uint32_t *mfn_list = (const uint32_t *)tbufs.t_info
 +                                   + tbufs.t_info->mfn_offset[i];
         int j;
         xen_pfn_t pfn_list[tbufs.t_info->tbuf_size];
 --- a/xen/common/trace.c
 +++ b/xen/common/trace.c
@@ -322,7 +322,7 @@ void __init init_trace_bufs(void)
     for(i=0; i<T_INFO_PAGES; i++)
         share_xen_page_with_privileged_guests(
 -            virt_to_page(t_info) + i, XENSHARE_writable);
 +            virt_to_page(t_info) + i, XENSHARE_readonly);
     if ( opt_tbuf_size == 0 )
     {
--- a/21698-x86-pirq-range-check.patch
+++ b/21698-x86-pirq-range-check.patch
@ -0,0 +1,20 @@
 # HG changeset patch
 # User Keir Fraser <keir.fraser@citrix.com>
 # Date 1277917869 -3600
 # Node ID 81d6471ff1235fde2c30428b920cb6e00ba546d6
 # Parent  a9caa0f2d693a1d0d008b4295e49da3ea1d70334
 x86: fix an off-by-one pirq range check
 Signed-off-by: Jan Beulich <jbeulich@novell.com>
 --- a/xen/arch/x86/irq.c
 +++ b/xen/arch/x86/irq.c
@@ -1019,7 +1019,7 @@ static void __pirq_guest_eoi(struct doma
 int pirq_guest_eoi(struct domain *d, int irq)
 {
 -    if ( (irq < 0) || (irq > d->nr_pirqs) )
 +    if ( (irq < 0) || (irq >= d->nr_pirqs) )
         return -EINVAL;
     __pirq_guest_eoi(d, irq);
--- a/21699-p2m-query-for-type-change.patch
+++ b/21699-p2m-query-for-type-change.patch
@ -0,0 +1,24 @@
 # HG changeset patch
 # User Keir Fraser <keir.fraser@citrix.com>
 # Date 1277917902 -3600
 # Node ID 7cda3ad44c6d4e799e65b2ffe21e609f50cdb94b
 # Parent  81d6471ff1235fde2c30428b920cb6e00ba546d6
 Use gfn_to_mfn_query() rather then gfn_to_mfn() when changing P2M types
 Use gfn_to_mfn_query() rather then gfn_to_mfn() when changing
 P2M types since we do not really want to force a PoD allocation
 as a side effect.
 Signed-off-by: Paul Durrant <Paul.Durrant@citrix.com>
 --- a/xen/arch/x86/mm/p2m.c
 +++ b/xen/arch/x86/mm/p2m.c
@@ -2351,7 +2351,7 @@ p2m_type_t p2m_change_type(struct domain
     p2m_lock(d->arch.p2m);
 -    mfn = gfn_to_mfn(d, gfn, &pt);
 +    mfn = gfn_to_mfn_query(d, gfn, &pt);
     if ( pt == ot )
         set_p2m_entry(d, gfn, mfn, 0, nt);
--- a/21700-32on64-vm86-gpf.patch
+++ b/21700-32on64-vm86-gpf.patch
@ -0,0 +1,25 @@
 # HG changeset patch
 # User Keir Fraser <keir.fraser@citrix.com>
 # Date 1277917963 -3600
 # Node ID fae04060a4f4e364c5012692b97ae1eeec3a326e
 # Parent  7cda3ad44c6d4e799e65b2ffe21e609f50cdb94b
 Fix #GPF injection into compat guests in vm86 code
 not to let the guest disable interrupts in the real EFLAGS.
 Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
 --- a/xen/arch/x86/x86_64/compat/traps.c
 +++ b/xen/arch/x86/x86_64/compat/traps.c
@@ -127,9 +127,8 @@ unsigned int compat_iret(void)
         ti = &v->arch.guest_context.trap_ctxt[13];
         if ( TI_GET_IF(ti) )
             eflags &= ~X86_EFLAGS_IF;
 -        regs->_eflags = eflags & ~(X86_EFLAGS_VM|X86_EFLAGS_RF|
 -                                   X86_EFLAGS_NT|X86_EFLAGS_TF);
 -
 +        regs->_eflags &= ~(X86_EFLAGS_VM|X86_EFLAGS_RF|
 +                           X86_EFLAGS_NT|X86_EFLAGS_TF);
         if ( unlikely(__put_user(0, (u32 *)regs->rsp)) )
             goto exit_and_crash;
         regs->_eip = ti->address;
--- a/21705-trace-printk.patch
+++ b/21705-trace-printk.patch
@ -0,0 +1,51 @@
 # HG changeset patch
 # User Keir Fraser <keir.fraser@citrix.com>
 # Date 1278093217 -3600
 # Node ID 19f4d637a52b8723ac1fbcf666c146951bee8e57
 # Parent  1390e2ab45c7b63d79ba9496d609cf59af4b44ee
 trace: adjust printk()s
 They should be lower level or rate limited.
 Signed-off-by: Jan Beulich <jbeulich@novell.com>
 Acked-by: George Dunlap <george.dunlap@eu.citrix.com>
 --- a/xen/common/trace.c
 +++ b/xen/common/trace.c
@@ -137,7 +137,7 @@ static int alloc_trace_bufs(void)
     }
     t_info->tbuf_size = opt_tbuf_size;
 -    printk("tbuf_size %d\n", t_info->tbuf_size);
 +    printk(XENLOG_INFO "tbuf_size %d\n", t_info->tbuf_size);
     nr_pages = opt_tbuf_size;
     order = get_order_from_pages(nr_pages);
@@ -194,7 +194,7 @@ static int alloc_trace_bufs(void)
             /* Write list first, then write per-cpu offset. */
             wmb();
             t_info->mfn_offset[cpu]=offset;
 -            printk("p%d mfn %"PRIx32" offset %d\n",
 +            printk(XENLOG_INFO "p%d mfn %"PRIx32" offset %d\n",
                    cpu, mfn, offset);
             offset+=i;
         }
@@ -489,12 +489,13 @@ static inline int __insert_record(struct
     /* Double-check once more that we have enough space.
      * Don't bugcheck here, in case the userland tool is doing
      * something stupid. */
 -    if ( calc_bytes_avail(buf) < rec_size )
 +    next = calc_bytes_avail(buf);
 +    if ( next < rec_size )
     {
 -        printk("%s: %u bytes left (%u - ((%u - %u) %% %u) recsize %u.\n",
 -               __func__,
 -               calc_bytes_avail(buf),
 -               data_size, buf->prod, buf->cons, data_size, rec_size);
 +        if ( printk_ratelimit() )
 +            printk(XENLOG_WARNING
 +                   "%s: avail=%u (size=%08x prod=%08x cons=%08x) rec=%u\n",
 +                   __func__, next, data_size, buf->prod, buf->cons, rec_size);
         return 0;
     }
     rmb();
--- a/21706-trace-security.patch
+++ b/21706-trace-security.patch
@ -0,0 +1,396 @@
 # HG changeset patch
 # User Keir Fraser <keir.fraser@citrix.com>
 # Date 1278093394 -3600
 # Node ID ae68758f8862bc43ab6bbe4ad3a8594c28b9bc39
 # Parent  19f4d637a52b8723ac1fbcf666c146951bee8e57
 trace: fix security issues
 After getting a report of 3.2.3's xenmon crashing Xen (as it turned
 out this was because c/s 17000 was backported to that tree without
 also applying c/s 17515), I figured that the hypervisor shouldn't rely
 on any specific state of the actual trace buffer (as it is shared
 writable with Dom0)
 [GWD: Volatile quantifiers have been taken out and moved to another
 patch]
 To make clear what purpose specific variables have and/or where they
 got loaded from, the patch also changes the type of some of them to be
 explicitly u32/s32, and removes pointless assertions (like checking an
 unsigned variable to be >= 0).
 I also took the prototype adjustment of __trace_var() as an
 opportunity to simplify the TRACE_xD() macros. Similar simplification
 could be done on the (quite numerous) direct callers of the function.
 Signed-off-by: Jan Beulich <jbeulich@novell.com>
 Signed-off-by: George Dunlap <george.dunlap@eu.citrix.com>
 # HG changeset patch
 # User Keir Fraser <keir.fraser@citrix.com>
 # Date 1278314658 -3600
 # Node ID 9074d50d09358cd8349d54c7ab2e2ead81fa1570
 # Parent  f483b5ce7be235494156fee164decd73e0472cb7
 trace: insert compiler memory barriers
 This is to ensure fields shared writably with Dom0 get read only once
 for any consistency checking followed by actual calculations.
 I realized there was another multiple-read issue, a fix for which is
 also included (which at once simplifies __insert_record()).
 Signed-off-by: Jan Beulich <jbeulich@novell.com>
 --- a/xen/common/trace.c
 +++ b/xen/common/trace.c
@@ -52,12 +52,12 @@ static struct t_info *t_info;
 static DEFINE_PER_CPU_READ_MOSTLY(struct t_buf *, t_bufs);
 static DEFINE_PER_CPU_READ_MOSTLY(unsigned char *, t_data);
 static DEFINE_PER_CPU_READ_MOSTLY(spinlock_t, t_lock);
 -static int data_size;
 +static u32 data_size;
 static u32 t_info_first_offset __read_mostly;
 /* High water mark for trace buffers; */
 /* Send virtual interrupt when buffer level reaches this point */
 -static int t_buf_highwater;
 +static u32 t_buf_highwater;
 /* Number of records lost due to per-CPU trace buffer being full. */
 static DEFINE_PER_CPU(unsigned long, lost_records);
@@ -162,7 +162,7 @@ static int alloc_trace_bufs(void)
         spin_lock_irqsave(&per_cpu(t_lock, cpu), flags);
 -        buf = per_cpu(t_bufs, cpu) = (struct t_buf *)rawbuf;
 +        per_cpu(t_bufs, cpu) = buf = (struct t_buf *)rawbuf;
         buf->cons = buf->prod = 0;
         per_cpu(t_data, cpu) = (unsigned char *)(buf + 1);
@@ -213,6 +213,7 @@ out_dealloc:
         spin_lock_irqsave(&per_cpu(t_lock, cpu), flags);
         if ( (rawbuf = (char *)per_cpu(t_bufs, cpu)) )
         {
 +            per_cpu(t_bufs, cpu) = NULL;
             ASSERT(!(virt_to_page(rawbuf)->count_info & PGC_allocated));
             free_xenheap_pages(rawbuf, order);
         }
@@ -418,19 +419,39 @@ int tb_control(xen_sysctl_tbuf_op_t *tbc
     return rc;
 }
 -static inline int calc_rec_size(int cycles, int extra) 
 +static inline unsigned int calc_rec_size(bool_t cycles, unsigned int extra)
 {
 -    int rec_size;
 -    rec_size = 4;
 +    unsigned int rec_size = 4;
 +
     if ( cycles )
         rec_size += 8;
     rec_size += extra;
     return rec_size;
 }
 -static inline int calc_unconsumed_bytes(struct t_buf *buf)
 +static inline bool_t bogus(u32 prod, u32 cons)
 {
 -    int x = buf->prod - buf->cons;
 +    if ( unlikely(prod & 3) || unlikely(prod >= 2 * data_size) ||
 +         unlikely(cons & 3) || unlikely(cons >= 2 * data_size) )
 +    {
 +        tb_init_done = 0;
 +        printk(XENLOG_WARNING "trc#%u: bogus prod (%08x) and/or cons (%08x)\n",
 +               smp_processor_id(), prod, cons);
 +        return 1;
 +    }
 +    return 0;
 +}
 +
 +static inline u32 calc_unconsumed_bytes(const struct t_buf *buf)
 +{
 +    u32 prod = buf->prod, cons = buf->cons;
 +    s32 x;
 +
 +    barrier(); /* must read buf->prod and buf->cons only once */
 +    if ( bogus(prod, cons) )
 +        return data_size;
 +
 +    x = prod - cons;
     if ( x < 0 )
         x += 2*data_size;
@@ -440,9 +461,16 @@ static inline int calc_unconsumed_bytes(
     return x;
 }
 -static inline int calc_bytes_to_wrap(struct t_buf *buf)
 +static inline u32 calc_bytes_to_wrap(const struct t_buf *buf)
 {
 -    int x = data_size - buf->prod;
 +    u32 prod = buf->prod, cons = buf->cons;
 +    s32 x;
 +
 +    barrier(); /* must read buf->prod and buf->cons only once */
 +    if ( bogus(prod, cons) )
 +        return 0;
 +
 +    x = data_size - prod;
     if ( x <= 0 )
         x += data_size;
@@ -452,55 +480,60 @@ static inline int calc_bytes_to_wrap(str
     return x;
 }
 -static inline int calc_bytes_avail(struct t_buf *buf)
 +static inline u32 calc_bytes_avail(const struct t_buf *buf)
 {
     return data_size - calc_unconsumed_bytes(buf);
 }
 -static inline struct t_rec *
 -next_record(struct t_buf *buf)
 +static inline struct t_rec *next_record(const struct t_buf *buf,
 +                                        uint32_t *next)
 {
 -    int x = buf->prod;
 +    u32 x = buf->prod, cons = buf->cons;
 +
 +    barrier(); /* must read buf->prod and buf->cons only once */
 +    *next = x;
 +    if ( !tb_init_done || bogus(x, cons) )
 +        return NULL;
 +
     if ( x >= data_size )
         x -= data_size;
 -    ASSERT(x >= 0);
     ASSERT(x < data_size);
     return (struct t_rec *)&this_cpu(t_data)[x];
 }
 -static inline int __insert_record(struct t_buf *buf,
 -                                  unsigned long event,
 -                                  int extra,
 -                                  int cycles,
 -                                  int rec_size,
 -                                  unsigned char *extra_data)
 +static inline void __insert_record(struct t_buf *buf,
 +                                   unsigned long event,
 +                                   unsigned int extra,
 +                                   bool_t cycles,
 +                                   unsigned int rec_size,
 +                                   const void *extra_data)
 {
     struct t_rec *rec;
     unsigned char *dst;
 -    unsigned long extra_word = extra/sizeof(u32);
 -    int local_rec_size = calc_rec_size(cycles, extra);
 +    unsigned int extra_word = extra / sizeof(u32);
 +    unsigned int local_rec_size = calc_rec_size(cycles, extra);
     uint32_t next;
     BUG_ON(local_rec_size != rec_size);
     BUG_ON(extra & 3);
 +    rec = next_record(buf, &next);
 +    if ( !rec )
 +        return;
     /* Double-check once more that we have enough space.
      * Don't bugcheck here, in case the userland tool is doing
      * something stupid. */
 -    next = calc_bytes_avail(buf);
 -    if ( next < rec_size )
 +    if ( (unsigned char *)rec + rec_size > this_cpu(t_data) + data_size )
     {
         if ( printk_ratelimit() )
             printk(XENLOG_WARNING
 -                   "%s: avail=%u (size=%08x prod=%08x cons=%08x) rec=%u\n",
 -                   __func__, next, data_size, buf->prod, buf->cons, rec_size);
 -        return 0;
 +                   "%s: size=%08x prod=%08x cons=%08x rec=%u\n",
 +                   __func__, data_size, next, buf->cons, rec_size);
 +        return;
     }
 -    rmb();
 -    rec = next_record(buf);
     rec->event = event;
     rec->extra_u32 = extra_word;
     dst = (unsigned char *)rec->u.nocycles.extra_u32;
@@ -517,21 +550,19 @@ static inline int __insert_record(struct
     wmb();
 -    next = buf->prod + rec_size;
 +    next += rec_size;
     if ( next >= 2*data_size )
         next -= 2*data_size;
 -    ASSERT(next >= 0);
     ASSERT(next < 2*data_size);
     buf->prod = next;
 -
 -    return rec_size;
 }
 -static inline int insert_wrap_record(struct t_buf *buf, int size)
 +static inline void insert_wrap_record(struct t_buf *buf,
 +                                      unsigned int size)
 {
 -    int space_left = calc_bytes_to_wrap(buf);
 -    unsigned long extra_space = space_left - sizeof(u32);
 -    int cycles = 0;
 +    u32 space_left = calc_bytes_to_wrap(buf);
 +    unsigned int extra_space = space_left - sizeof(u32);
 +    bool_t cycles = 0;
     BUG_ON(space_left > size);
@@ -543,17 +574,13 @@ static inline int insert_wrap_record(str
         ASSERT((extra_space/sizeof(u32)) <= TRACE_EXTRA_MAX);
     }
 -    return __insert_record(buf,
 -                    TRC_TRACE_WRAP_BUFFER,
 -                    extra_space,
 -                    cycles,
 -                    space_left,
 -                    NULL);
 +    __insert_record(buf, TRC_TRACE_WRAP_BUFFER, extra_space, cycles,
 +                    space_left, NULL);
 }
 #define LOST_REC_SIZE (4 + 8 + 16) /* header + tsc + sizeof(struct ed) */
 -static inline int insert_lost_records(struct t_buf *buf)
 +static inline void insert_lost_records(struct t_buf *buf)
 {
     struct {
         u32 lost_records;
@@ -568,12 +595,8 @@ static inline int insert_lost_records(st
     this_cpu(lost_records) = 0;
 -    return __insert_record(buf,
 -                           TRC_LOST_RECORDS,
 -                           sizeof(ed),
 -                           1 /* cycles */,
 -                           LOST_REC_SIZE,
 -                           (unsigned char *)&ed);
 +    __insert_record(buf, TRC_LOST_RECORDS, sizeof(ed), 1 /* cycles */,
 +                    LOST_REC_SIZE, &ed);
 }
 /*
@@ -595,13 +618,15 @@ static DECLARE_TASKLET(trace_notify_dom0
  * failure, otherwise 0.  Failure occurs only if the trace buffers are not yet
  * initialised.
  */
 -void __trace_var(u32 event, int cycles, int extra, unsigned char *extra_data)
 +void __trace_var(u32 event, bool_t cycles, unsigned int extra,
 +                 const void *extra_data)
 {
     struct t_buf *buf;
 -    unsigned long flags, bytes_to_tail, bytes_to_wrap;
 -    int rec_size, total_size;
 -    int extra_word;
 -    int started_below_highwater = 0;
 +    unsigned long flags;
 +    u32 bytes_to_tail, bytes_to_wrap;
 +    unsigned int rec_size, total_size;
 +    unsigned int extra_word;
 +    bool_t started_below_highwater;
     if( !tb_init_done )
         return;
@@ -640,7 +665,11 @@ void __trace_var(u32 event, int cycles, 
     buf = this_cpu(t_bufs);
     if ( unlikely(!buf) )
 +    {
 +        /* Make gcc happy */
 +        started_below_highwater = 0;
         goto unlock;
 +    }
     started_below_highwater = (calc_unconsumed_bytes(buf) < t_buf_highwater);
@@ -721,8 +750,9 @@ unlock:
     spin_unlock_irqrestore(&this_cpu(t_lock), flags);
     /* Notify trace buffer consumer that we've crossed the high water mark. */
 -    if ( started_below_highwater &&
 -         (calc_unconsumed_bytes(buf) >= t_buf_highwater) )
 +    if ( likely(buf!=NULL)
 +         && started_below_highwater
 +         && (calc_unconsumed_bytes(buf) >= t_buf_highwater) )
         tasklet_schedule(&trace_notify_dom0_tasklet);
 }
 --- a/xen/include/xen/trace.h
 +++ b/xen/include/xen/trace.h
@@ -36,7 +36,7 @@ int tb_control(struct xen_sysctl_tbuf_op
 int trace_will_trace_event(u32 event);
 -void __trace_var(u32 event, int cycles, int extra, unsigned char *extra_data);
 +void __trace_var(u32 event, bool_t cycles, unsigned int extra, const void *);
 static inline void trace_var(u32 event, int cycles, int extra,
                                unsigned char *extra_data)
@@ -57,7 +57,7 @@ static inline void trace_var(u32 event, 
         {                                                       \
             u32 _d[1];                                          \
             _d[0] = d1;                                         \
 -            __trace_var(_e, 1, sizeof(*_d), (unsigned char *)_d); \
 +            __trace_var(_e, 1, sizeof(_d), _d);                 \
         }                                                       \
     } while ( 0 )
@@ -68,7 +68,7 @@ static inline void trace_var(u32 event, 
             u32 _d[2];                                          \
             _d[0] = d1;                                         \
             _d[1] = d2;                                         \
 -            __trace_var(_e, 1, sizeof(*_d)*2, (unsigned char *)_d); \
 +            __trace_var(_e, 1, sizeof(_d), _d);                 \
         }                                                       \
     } while ( 0 )
@@ -80,7 +80,7 @@ static inline void trace_var(u32 event, 
             _d[0] = d1;                                         \
             _d[1] = d2;                                         \
             _d[2] = d3;                                         \
 -            __trace_var(_e, 1, sizeof(*_d)*3, (unsigned char *)_d); \
 +            __trace_var(_e, 1, sizeof(_d), _d);                 \
         }                                                       \
     } while ( 0 )
@@ -93,7 +93,7 @@ static inline void trace_var(u32 event, 
             _d[1] = d2;                                         \
             _d[2] = d3;                                         \
             _d[3] = d4;                                         \
 -            __trace_var(_e, 1, sizeof(*_d)*4, (unsigned char *)_d); \
 +            __trace_var(_e, 1, sizeof(_d), _d);                 \
         }                                                       \
     } while ( 0 )
@@ -107,7 +107,7 @@ static inline void trace_var(u32 event, 
             _d[2] = d3;                                         \
             _d[3] = d4;                                         \
             _d[4] = d5;                                         \
 -            __trace_var(_e, 1, sizeof(*_d)*5, (unsigned char *)_d); \
 +            __trace_var(_e, 1, sizeof(_d), _d);                 \
         }                                                       \
     } while ( 0 )
@@ -122,7 +122,7 @@ static inline void trace_var(u32 event, 
             _d[3] = d4;                                         \
             _d[4] = d5;                                         \
             _d[5] = d6;                                         \
 -            __trace_var(_e, 1, sizeof(*_d)*6, (unsigned char *)_d); \
 +            __trace_var(_e, 1, sizeof(_d), _d);                 \
         }                                                       \
     } while ( 0 )
--- a/21712-amd-osvw.patch
+++ b/21712-amd-osvw.patch
@ -0,0 +1,400 @@
 # HG changeset patch
 # User Keir Fraser <keir.fraser@citrix.com>
 # Date 1278093897 -3600
 # Node ID f483b5ce7be235494156fee164decd73e0472cb7
 # Parent  4d091e6e04918ba3ef19cc45ae2fffaee4f18afe
 AMD OSVW (OS Visible Workaround) for Xen
 This path enables AMD OSVW (OS Visible Workaround) feature for
 Xen. New AMD errata will have a OSVW id assigned in the future. OS is
 supposed to check OSVW status MSR to find out whether CPU has a
 specific erratum. Legacy errata are also supported in this patch:
 traditional family/model/stepping approach will be used if OSVW
 feature isn't applicable.  This patch is adapted from Hans Rosenfeld's
 patch submitted to Linux kernel.
 Signed-off-by: Wei Huang <wei.huang2@amd.com>
 Signed-off-by: Hans Rosenfeld <hands.rosenfeld@amd.com>
 Acked-by: Jan Beulich <jbeulich@novell.com>
 Index: xen-4.0.0-testing/xen/arch/x86/cpu/amd.c
 ===================================================================
 --- xen-4.0.0-testing.orig/xen/arch/x86/cpu/amd.c
 +++ xen-4.0.0-testing/xen/arch/x86/cpu/amd.c
@@ -7,11 +7,11 @@
 #include <asm/io.h>
 #include <asm/msr.h>
 #include <asm/processor.h>
 +#include <asm/amd.h>
 #include <asm/hvm/support.h>
 #include <asm/setup.h> /* amd_init_cpu */
 #include "cpu.h"
 -#include "amd.h"
 void start_svm(struct cpuinfo_x86 *c);
@@ -157,6 +157,54 @@ static void __devinit set_cpuidmask(stru
 }
 /*
 + * Check for the presence of an AMD erratum. Arguments are defined in amd.h
 + * for each known erratum. Return 1 if erratum is found.
 + */
 +int cpu_has_amd_erratum(const struct cpuinfo_x86 *cpu, int osvw, ...)
 +{
 +	va_list ap;
 +	u32 range;
 +	u32 ms;
 +
 +	if (cpu->x86_vendor != X86_VENDOR_AMD)
 +		return 0;
 +
 +	va_start(ap, osvw);
 +
 +	if (osvw) {
 +		u16 osvw_id = va_arg(ap, int);
 +
 +		if (cpu_has(cpu, X86_FEATURE_OSVW)) {
 +			u64 osvw_len;
 +			rdmsrl(MSR_AMD_OSVW_ID_LENGTH, osvw_len);
 +
 +			if (osvw_id < osvw_len) {
 +				u64 osvw_bits;
 +				rdmsrl(MSR_AMD_OSVW_STATUS + (osvw_id >> 6),
 +				       osvw_bits);
 +
 +				va_end(ap);
 +				return (osvw_bits >> (osvw_id & 0x3f)) & 0x01;
 +			}
 +		}
 +	}
 +
 +	/* OSVW unavailable or ID unknown, match family-model-stepping range */
 +	ms = (cpu->x86_model << 8) | cpu->x86_mask;
 +	while ((range = va_arg(ap, int))) {
 +		if ((cpu->x86 == AMD_MODEL_RANGE_FAMILY(range)) &&
 +		    (ms >= AMD_MODEL_RANGE_START(range)) &&
 +		    (ms <= AMD_MODEL_RANGE_END(range))) {
 +			va_end(ap);
 +			return 1;
 +		}
 +	}
 +
 +	va_end(ap);
 +	return 0;
 +}
 +
 +/*
  * amd_flush_filter={on,off}. Forcibly Enable or disable the TLB flush
  * filter on AMD 64-bit processors.
  */
 Index: xen-4.0.0-testing/xen/arch/x86/cpu/amd.h
 ===================================================================
 --- xen-4.0.0-testing.orig/xen/arch/x86/cpu/amd.h
 +++ /dev/null
@@ -1,103 +0,0 @@
 -/*
 - * amd.h - AMD processor specific definitions
 - */
 -
 -#ifndef __AMD_H__
 -#define __AMD_H__
 -
 -#include <asm/cpufeature.h>
 -
 -/* CPUID masked for use by AMD-V Extended Migration */
 -
 -#define X86_FEATURE_BITPOS(_feature_) ((_feature_) % 32)
 -#define __bit(_x_) (1U << X86_FEATURE_BITPOS(_x_))
 -
 -/* Family 0Fh, Revision C */
 -#define AMD_FEATURES_K8_REV_C_ECX  0
 -#define AMD_FEATURES_K8_REV_C_EDX (					\
 -	__bit(X86_FEATURE_FPU)      | __bit(X86_FEATURE_VME)   |	\
 -	__bit(X86_FEATURE_DE)       | __bit(X86_FEATURE_PSE)   |	\
 -	__bit(X86_FEATURE_TSC)      | __bit(X86_FEATURE_MSR)   |	\
 -	__bit(X86_FEATURE_PAE)      | __bit(X86_FEATURE_MCE)   |	\
 -	__bit(X86_FEATURE_CX8)      | __bit(X86_FEATURE_APIC)  |	\
 -	__bit(X86_FEATURE_SEP)      | __bit(X86_FEATURE_MTRR)  |	\
 -	__bit(X86_FEATURE_PGE)      | __bit(X86_FEATURE_MCA)   | 	\
 -	__bit(X86_FEATURE_CMOV)     | __bit(X86_FEATURE_PAT)   |	\
 -	__bit(X86_FEATURE_PSE36)    | __bit(X86_FEATURE_CLFLSH)|	\
 -	__bit(X86_FEATURE_MMX)      | __bit(X86_FEATURE_FXSR)  | 	\
 -	__bit(X86_FEATURE_XMM)      | __bit(X86_FEATURE_XMM2))
 -#define AMD_EXTFEATURES_K8_REV_C_ECX  0 
 -#define AMD_EXTFEATURES_K8_REV_C_EDX  (					\
 -	__bit(X86_FEATURE_FPU)      | __bit(X86_FEATURE_VME)   |	\
 -	__bit(X86_FEATURE_DE)       | __bit(X86_FEATURE_PSE)   |	\
 -	__bit(X86_FEATURE_TSC)      | __bit(X86_FEATURE_MSR)   |	\
 -	__bit(X86_FEATURE_PAE)      | __bit(X86_FEATURE_MCE)   |	\
 -	__bit(X86_FEATURE_CX8)      | __bit(X86_FEATURE_APIC)  |	\
 -	__bit(X86_FEATURE_SYSCALL)  | __bit(X86_FEATURE_MTRR)  |	\
 -	__bit(X86_FEATURE_PGE)      | __bit(X86_FEATURE_MCA)   |	\
 -	__bit(X86_FEATURE_CMOV)     | __bit(X86_FEATURE_PAT)   |	\
 -	__bit(X86_FEATURE_PSE36)    | __bit(X86_FEATURE_NX)    |	\
 -	__bit(X86_FEATURE_MMXEXT)   | __bit(X86_FEATURE_MMX)   |	\
 -	__bit(X86_FEATURE_FXSR)     | __bit(X86_FEATURE_LM)    |	\
 -	__bit(X86_FEATURE_3DNOWEXT) | __bit(X86_FEATURE_3DNOW))
 -
 -/* Family 0Fh, Revision D */
 -#define AMD_FEATURES_K8_REV_D_ECX         AMD_FEATURES_K8_REV_C_ECX
 -#define AMD_FEATURES_K8_REV_D_EDX         AMD_FEATURES_K8_REV_C_EDX
 -#define AMD_EXTFEATURES_K8_REV_D_ECX     (AMD_EXTFEATURES_K8_REV_C_ECX |\
 -	__bit(X86_FEATURE_LAHF_LM))
 -#define AMD_EXTFEATURES_K8_REV_D_EDX     (AMD_EXTFEATURES_K8_REV_C_EDX |\
 -	__bit(X86_FEATURE_FFXSR))
 -
 -/* Family 0Fh, Revision E */
 -#define AMD_FEATURES_K8_REV_E_ECX        (AMD_FEATURES_K8_REV_D_ECX |	\
 -	__bit(X86_FEATURE_XMM3))
 -#define AMD_FEATURES_K8_REV_E_EDX        (AMD_FEATURES_K8_REV_D_EDX | 	\
 -	__bit(X86_FEATURE_HT))
 -#define AMD_EXTFEATURES_K8_REV_E_ECX     (AMD_EXTFEATURES_K8_REV_D_ECX |\
 -	__bit(X86_FEATURE_CMP_LEGACY)) 
 -#define AMD_EXTFEATURES_K8_REV_E_EDX      AMD_EXTFEATURES_K8_REV_D_EDX
 -
 -/* Family 0Fh, Revision F */
 -#define AMD_FEATURES_K8_REV_F_ECX        (AMD_FEATURES_K8_REV_E_ECX | 	\
 -	__bit(X86_FEATURE_CX16))
 -#define AMD_FEATURES_K8_REV_F_EDX         AMD_FEATURES_K8_REV_E_EDX
 -#define AMD_EXTFEATURES_K8_REV_F_ECX     (AMD_EXTFEATURES_K8_REV_E_ECX |\
 -	__bit(X86_FEATURE_SVME) | __bit(X86_FEATURE_EXTAPICSPACE) |	\
 -	__bit(X86_FEATURE_ALTMOVCR))
 -#define AMD_EXTFEATURES_K8_REV_F_EDX     (AMD_EXTFEATURES_K8_REV_E_EDX |\
 -	__bit(X86_FEATURE_RDTSCP))
 -
 -/* Family 0Fh, Revision G */
 -#define AMD_FEATURES_K8_REV_G_ECX         AMD_FEATURES_K8_REV_F_ECX
 -#define AMD_FEATURES_K8_REV_G_EDX         AMD_FEATURES_K8_REV_F_EDX
 -#define AMD_EXTFEATURES_K8_REV_G_ECX     (AMD_EXTFEATURES_K8_REV_F_ECX |\
 -	__bit(X86_FEATURE_3DNOWPF))
 -#define AMD_EXTFEATURES_K8_REV_G_EDX      AMD_EXTFEATURES_K8_REV_F_EDX
 -
 -/* Family 10h, Revision B */
 -#define AMD_FEATURES_FAM10h_REV_B_ECX    (AMD_FEATURES_K8_REV_F_ECX | 	\
 -	__bit(X86_FEATURE_POPCNT) | __bit(X86_FEATURE_MWAIT))
 -#define AMD_FEATURES_FAM10h_REV_B_EDX     AMD_FEATURES_K8_REV_F_EDX
 -#define AMD_EXTFEATURES_FAM10h_REV_B_ECX (AMD_EXTFEATURES_K8_REV_F_ECX |\
 -	__bit(X86_FEATURE_ABM) | __bit(X86_FEATURE_SSE4A) | 		\
 -	__bit(X86_FEATURE_MISALIGNSSE) | __bit(X86_FEATURE_OSVW) | 	\
 -	__bit(X86_FEATURE_IBS))
 -#define AMD_EXTFEATURES_FAM10h_REV_B_EDX (AMD_EXTFEATURES_K8_REV_F_EDX |\
 -	__bit(X86_FEATURE_PAGE1GB))
 -
 -/* Family 10h, Revision C */
 -#define AMD_FEATURES_FAM10h_REV_C_ECX     AMD_FEATURES_FAM10h_REV_B_ECX
 -#define AMD_FEATURES_FAM10h_REV_C_EDX     AMD_FEATURES_FAM10h_REV_B_EDX
 -#define AMD_EXTFEATURES_FAM10h_REV_C_ECX (AMD_EXTFEATURES_FAM10h_REV_B_ECX |\
 -	__bit(X86_FEATURE_SKINIT) | __bit(X86_FEATURE_WDT))
 -#define AMD_EXTFEATURES_FAM10h_REV_C_EDX  AMD_EXTFEATURES_FAM10h_REV_B_EDX
 -
 -/* Family 11h, Revision B */
 -#define AMD_FEATURES_FAM11h_REV_B_ECX     AMD_FEATURES_K8_REV_G_ECX
 -#define AMD_FEATURES_FAM11h_REV_B_EDX     AMD_FEATURES_K8_REV_G_EDX
 -#define AMD_EXTFEATURES_FAM11h_REV_B_ECX (AMD_EXTFEATURES_K8_REV_G_ECX |\
 -	__bit(X86_FEATURE_SKINIT))
 -#define AMD_EXTFEATURES_FAM11h_REV_B_EDX  AMD_EXTFEATURES_K8_REV_G_EDX
 -
 -#endif /* __AMD_H__ */
 Index: xen-4.0.0-testing/xen/arch/x86/hvm/svm/asid.c
 ===================================================================
 --- xen-4.0.0-testing.orig/xen/arch/x86/hvm/svm/asid.c
 +++ xen-4.0.0-testing/xen/arch/x86/hvm/svm/asid.c
@@ -21,14 +21,14 @@
 #include <xen/lib.h>
 #include <xen/perfc.h>
 #include <asm/hvm/svm/asid.h>
 +#include <asm/amd.h>
 void svm_asid_init(struct cpuinfo_x86 *c)
 {
     int nasids = 0;
     /* Check for erratum #170, and leave ASIDs disabled if it's present. */
 -    if ( (c->x86 == 0x10) ||
 -         ((c->x86 == 0xf) && (c->x86_model >= 0x68) && (c->x86_mask >= 1)) )
 +    if ( !cpu_has_amd_erratum(c, AMD_ERRATUM_170) )
         nasids = cpuid_ebx(0x8000000A);
     hvm_asid_init(nasids);
 Index: xen-4.0.0-testing/xen/arch/x86/hvm/svm/svm.c
 ===================================================================
 --- xen-4.0.0-testing.orig/xen/arch/x86/hvm/svm/svm.c
 +++ xen-4.0.0-testing/xen/arch/x86/hvm/svm/svm.c
@@ -34,6 +34,7 @@
 #include <asm/regs.h>
 #include <asm/cpufeature.h>
 #include <asm/processor.h>
 +#include <asm/amd.h>
 #include <asm/types.h>
 #include <asm/debugreg.h>
 #include <asm/msr.h>
@@ -828,8 +829,8 @@ static void svm_init_erratum_383(struct
 {
     uint64_t msr_content;
 -    /* only family 10h is affected */
 -    if ( c->x86 != 0x10 )
 +    /* check whether CPU is affected */
 +    if ( !cpu_has_amd_erratum(c, AMD_ERRATUM_383) )
         return;
     rdmsrl(MSR_AMD64_DC_CFG, msr_content);
 Index: xen-4.0.0-testing/xen/include/asm-x86/amd.h
 ===================================================================
 --- /dev/null
 +++ xen-4.0.0-testing/xen/include/asm-x86/amd.h
@@ -0,0 +1,137 @@
 +/*
 + * amd.h - AMD processor specific definitions
 + */
 +
 +#ifndef __AMD_H__
 +#define __AMD_H__
 +
 +#include <asm/cpufeature.h>
 +
 +/* CPUID masked for use by AMD-V Extended Migration */
 +
 +#define X86_FEATURE_BITPOS(_feature_) ((_feature_) % 32)
 +#define __bit(_x_) (1U << X86_FEATURE_BITPOS(_x_))
 +
 +/* Family 0Fh, Revision C */
 +#define AMD_FEATURES_K8_REV_C_ECX  0
 +#define AMD_FEATURES_K8_REV_C_EDX (					\
 +	__bit(X86_FEATURE_FPU)      | __bit(X86_FEATURE_VME)   |	\
 +	__bit(X86_FEATURE_DE)       | __bit(X86_FEATURE_PSE)   |	\
 +	__bit(X86_FEATURE_TSC)      | __bit(X86_FEATURE_MSR)   |	\
 +	__bit(X86_FEATURE_PAE)      | __bit(X86_FEATURE_MCE)   |	\
 +	__bit(X86_FEATURE_CX8)      | __bit(X86_FEATURE_APIC)  |	\
 +	__bit(X86_FEATURE_SEP)      | __bit(X86_FEATURE_MTRR)  |	\
 +	__bit(X86_FEATURE_PGE)      | __bit(X86_FEATURE_MCA)   | 	\
 +	__bit(X86_FEATURE_CMOV)     | __bit(X86_FEATURE_PAT)   |	\
 +	__bit(X86_FEATURE_PSE36)    | __bit(X86_FEATURE_CLFLSH)|	\
 +	__bit(X86_FEATURE_MMX)      | __bit(X86_FEATURE_FXSR)  | 	\
 +	__bit(X86_FEATURE_XMM)      | __bit(X86_FEATURE_XMM2))
 +#define AMD_EXTFEATURES_K8_REV_C_ECX  0
 +#define AMD_EXTFEATURES_K8_REV_C_EDX  (					\
 +	__bit(X86_FEATURE_FPU)      | __bit(X86_FEATURE_VME)   |	\
 +	__bit(X86_FEATURE_DE)       | __bit(X86_FEATURE_PSE)   |	\
 +	__bit(X86_FEATURE_TSC)      | __bit(X86_FEATURE_MSR)   |	\
 +	__bit(X86_FEATURE_PAE)      | __bit(X86_FEATURE_MCE)   |	\
 +	__bit(X86_FEATURE_CX8)      | __bit(X86_FEATURE_APIC)  |	\
 +	__bit(X86_FEATURE_SYSCALL)  | __bit(X86_FEATURE_MTRR)  |	\
 +	__bit(X86_FEATURE_PGE)      | __bit(X86_FEATURE_MCA)   |	\
 +	__bit(X86_FEATURE_CMOV)     | __bit(X86_FEATURE_PAT)   |	\
 +	__bit(X86_FEATURE_PSE36)    | __bit(X86_FEATURE_NX)    |	\
 +	__bit(X86_FEATURE_MMXEXT)   | __bit(X86_FEATURE_MMX)   |	\
 +	__bit(X86_FEATURE_FXSR)     | __bit(X86_FEATURE_LM)    |	\
 +	__bit(X86_FEATURE_3DNOWEXT) | __bit(X86_FEATURE_3DNOW))
 +
 +/* Family 0Fh, Revision D */
 +#define AMD_FEATURES_K8_REV_D_ECX         AMD_FEATURES_K8_REV_C_ECX
 +#define AMD_FEATURES_K8_REV_D_EDX         AMD_FEATURES_K8_REV_C_EDX
 +#define AMD_EXTFEATURES_K8_REV_D_ECX     (AMD_EXTFEATURES_K8_REV_C_ECX |\
 +	__bit(X86_FEATURE_LAHF_LM))
 +#define AMD_EXTFEATURES_K8_REV_D_EDX     (AMD_EXTFEATURES_K8_REV_C_EDX |\
 +	__bit(X86_FEATURE_FFXSR))
 +
 +/* Family 0Fh, Revision E */
 +#define AMD_FEATURES_K8_REV_E_ECX        (AMD_FEATURES_K8_REV_D_ECX |	\
 +	__bit(X86_FEATURE_XMM3))
 +#define AMD_FEATURES_K8_REV_E_EDX        (AMD_FEATURES_K8_REV_D_EDX | 	\
 +	__bit(X86_FEATURE_HT))
 +#define AMD_EXTFEATURES_K8_REV_E_ECX     (AMD_EXTFEATURES_K8_REV_D_ECX |\
 +	__bit(X86_FEATURE_CMP_LEGACY))
 +#define AMD_EXTFEATURES_K8_REV_E_EDX      AMD_EXTFEATURES_K8_REV_D_EDX
 +
 +/* Family 0Fh, Revision F */
 +#define AMD_FEATURES_K8_REV_F_ECX        (AMD_FEATURES_K8_REV_E_ECX | 	\
 +	__bit(X86_FEATURE_CX16))
 +#define AMD_FEATURES_K8_REV_F_EDX         AMD_FEATURES_K8_REV_E_EDX
 +#define AMD_EXTFEATURES_K8_REV_F_ECX     (AMD_EXTFEATURES_K8_REV_E_ECX |\
 +	__bit(X86_FEATURE_SVME) | __bit(X86_FEATURE_EXTAPICSPACE) |	\
 +	__bit(X86_FEATURE_ALTMOVCR))
 +#define AMD_EXTFEATURES_K8_REV_F_EDX     (AMD_EXTFEATURES_K8_REV_E_EDX |\
 +	__bit(X86_FEATURE_RDTSCP))
 +
 +/* Family 0Fh, Revision G */
 +#define AMD_FEATURES_K8_REV_G_ECX         AMD_FEATURES_K8_REV_F_ECX
 +#define AMD_FEATURES_K8_REV_G_EDX         AMD_FEATURES_K8_REV_F_EDX
 +#define AMD_EXTFEATURES_K8_REV_G_ECX     (AMD_EXTFEATURES_K8_REV_F_ECX |\
 +	__bit(X86_FEATURE_3DNOWPF))
 +#define AMD_EXTFEATURES_K8_REV_G_EDX      AMD_EXTFEATURES_K8_REV_F_EDX
 +
 +/* Family 10h, Revision B */
 +#define AMD_FEATURES_FAM10h_REV_B_ECX    (AMD_FEATURES_K8_REV_F_ECX | 	\
 +	__bit(X86_FEATURE_POPCNT) | __bit(X86_FEATURE_MWAIT))
 +#define AMD_FEATURES_FAM10h_REV_B_EDX     AMD_FEATURES_K8_REV_F_EDX
 +#define AMD_EXTFEATURES_FAM10h_REV_B_ECX (AMD_EXTFEATURES_K8_REV_F_ECX |\
 +	__bit(X86_FEATURE_ABM) | __bit(X86_FEATURE_SSE4A) | 		\
 +	__bit(X86_FEATURE_MISALIGNSSE) | __bit(X86_FEATURE_OSVW) | 	\
 +	__bit(X86_FEATURE_IBS))
 +#define AMD_EXTFEATURES_FAM10h_REV_B_EDX (AMD_EXTFEATURES_K8_REV_F_EDX |\
 +	__bit(X86_FEATURE_PAGE1GB))
 +
 +/* Family 10h, Revision C */
 +#define AMD_FEATURES_FAM10h_REV_C_ECX     AMD_FEATURES_FAM10h_REV_B_ECX
 +#define AMD_FEATURES_FAM10h_REV_C_EDX     AMD_FEATURES_FAM10h_REV_B_EDX
 +#define AMD_EXTFEATURES_FAM10h_REV_C_ECX (AMD_EXTFEATURES_FAM10h_REV_B_ECX |\
 +	__bit(X86_FEATURE_SKINIT) | __bit(X86_FEATURE_WDT))
 +#define AMD_EXTFEATURES_FAM10h_REV_C_EDX  AMD_EXTFEATURES_FAM10h_REV_B_EDX
 +
 +/* Family 11h, Revision B */
 +#define AMD_FEATURES_FAM11h_REV_B_ECX     AMD_FEATURES_K8_REV_G_ECX
 +#define AMD_FEATURES_FAM11h_REV_B_EDX     AMD_FEATURES_K8_REV_G_EDX
 +#define AMD_EXTFEATURES_FAM11h_REV_B_ECX (AMD_EXTFEATURES_K8_REV_G_ECX |\
 +	__bit(X86_FEATURE_SKINIT))
 +#define AMD_EXTFEATURES_FAM11h_REV_B_EDX  AMD_EXTFEATURES_K8_REV_G_EDX
 +
 +/* AMD errata checking
 + *
 + * Errata are defined using the AMD_LEGACY_ERRATUM() or AMD_OSVW_ERRATUM()
 + * macros. The latter is intended for newer errata that have an OSVW id
 + * assigned, which it takes as first argument. Both take a variable number
 + * of family-specific model-stepping ranges created by AMD_MODEL_RANGE().
 + *
 + * Example 1:
 + * #define AMD_ERRATUM_319                                              \
 + *   AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x10, 0x2, 0x1, 0x4, 0x2),      \
 + *                      AMD_MODEL_RANGE(0x10, 0x8, 0x0, 0x8, 0x0),      \
 + *                      AMD_MODEL_RANGE(0x10, 0x9, 0x0, 0x9, 0x0))
 + * Example 2:
 + * #define AMD_ERRATUM_400                                              \
 + *   AMD_OSVW_ERRATUM(1, AMD_MODEL_RANGE(0xf, 0x41, 0x2, 0xff, 0xf),    \
 + *                       AMD_MODEL_RANGE(0x10, 0x2, 0x1, 0xff, 0xf))
 + */
 +
 +#define AMD_LEGACY_ERRATUM(...)         0 /* legacy */, __VA_ARGS__, 0
 +#define AMD_OSVW_ERRATUM(osvw_id, ...)  1 /* osvw */, osvw_id, __VA_ARGS__, 0
 +#define AMD_MODEL_RANGE(f, m_start, s_start, m_end, s_end)              \
 +    ((f << 24) | (m_start << 16) | (s_start << 12) | (m_end << 4) | (s_end))
 +#define AMD_MODEL_RANGE_FAMILY(range)   (((range) >> 24) & 0xff)
 +#define AMD_MODEL_RANGE_START(range)    (((range) >> 12) & 0xfff)
 +#define AMD_MODEL_RANGE_END(range)      ((range) & 0xfff)
 +
 +#define AMD_ERRATUM_170                                                 \
 +    AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x0f, 0x0, 0x0, 0x67, 0xf))
 +
 +#define AMD_ERRATUM_383                                                 \
 +    AMD_OSVW_ERRATUM(3, AMD_MODEL_RANGE(0x10, 0x2, 0x1, 0xff, 0xf),	\
 +		        AMD_MODEL_RANGE(0x12, 0x0, 0x0, 0x1, 0x0))
 +
 +int cpu_has_amd_erratum(const struct cpuinfo_x86 *, int, ...);
 +#endif /* __AMD_H__ */
 Index: xen-4.0.0-testing/xen/include/asm-x86/msr-index.h
 ===================================================================
 --- xen-4.0.0-testing.orig/xen/include/asm-x86/msr-index.h
 +++ xen-4.0.0-testing/xen/include/asm-x86/msr-index.h
@@ -251,6 +251,10 @@
 #define MSR_AMD_PATCHLEVEL		0x0000008b
 #define MSR_AMD_PATCHLOADER		0xc0010020
 +/* AMD OS Visible Workaround MSRs */
 +#define MSR_AMD_OSVW_ID_LENGTH          0xc0010140
 +#define MSR_AMD_OSVW_STATUS             0xc0010141
 +
 /* K6 MSRs */
 #define MSR_K6_EFER			0xc0000080
 #define MSR_K6_STAR			0xc0000081
--- a/21744-x86-cpufreq-range-check.patch
+++ b/21744-x86-cpufreq-range-check.patch
@ -0,0 +1,27 @@
 # HG changeset patch
 # User Keir Fraser <keir.fraser@citrix.com>
 # Date 1278578686 -3600
 # Node ID df63728e1680ce7827bd58f6bda453f70ed41ad9
 # Parent  a0f0ae5be814f19590d5a59d91ab7183cd1a325f
 x86/cpufreq: check array index before use
 ... rather than after.
 Signed-off-by: Jan Beulich <jbeulich@novell.com>
 --- a/xen/arch/x86/acpi/cpufreq/cpufreq.c
 +++ b/xen/arch/x86/acpi/cpufreq/cpufreq.c
@@ -210,9 +210,11 @@
     if (!cpu_isset(cpu, mask))
         cpu = first_cpu(mask);
 +    if (cpu >= NR_CPUS)
 +        return 0;
 +
     policy = cpufreq_cpu_policy[cpu];
 -
 -    if (cpu >= NR_CPUS || !policy || !drv_data[policy->cpu])
 +    if (!policy || !drv_data[policy->cpu])
         return 0;    
     switch (drv_data[policy->cpu]->cpu_feature) {
--- a/32on64-extra-mem.patch
+++ b/32on64-extra-mem.patch
@ -2,7 +2,7 @@ Index: xen-4.0.0-testing/tools/python/xen/xend/XendDomainInfo.py
 ===================================================================
 --- xen-4.0.0-testing.orig/tools/python/xen/xend/XendDomainInfo.py
 +++ xen-4.0.0-testing/tools/python/xen/xend/XendDomainInfo.py
-@@ -2913,7 +2913,7 @@ class XendDomainInfo:
+@@ -2914,7 +2914,7 @@ class XendDomainInfo:
             self.guest_bitsize = self.image.getBitSize()
             # Make sure there's enough RAM available for the domain
--- a/addcommand_domstate.patch
+++ b/addcommand_domstate.patch
@ -0,0 +1,172 @@
 Index: xen-4.0.0-testing/tools/python/xen/xend/XendDomain.py
 ===================================================================
 --- xen-4.0.0-testing.orig/tools/python/xen/xend/XendDomain.py
 +++ xen-4.0.0-testing/tools/python/xen/xend/XendDomain.py
@@ -251,6 +251,18 @@ class XendDomain:
         @return: path to config file.
         """
         return os.path.join(self._managed_path(domuuid), CACHED_CONFIG_FILE)
 +    def domain_setpauseflag(self, dom, flag=False):
 +        try:
 +            dominfo = self.domain_lookup_nr(dom)
 +            dominfo.paused_by_admin = flag
 +        except Exception, err:
 +            log.debug("error in in setpauseflag")
 +    def domain_getpauseflag(self, dom):
 +        try:
 +            dominfo = self.domain_lookup_nr(dom)
 +            return dominfo.paused_by_admin
 +        except Exception, err:
 +            log.debug("error in in getpauseflag")
     def _managed_check_point_path(self, domuuid):
         """Returns absolute path to check point file for managed domain.
 Index: xen-4.0.0-testing/tools/python/xen/xend/XendDomainInfo.py
 ===================================================================
 --- xen-4.0.0-testing.orig/tools/python/xen/xend/XendDomainInfo.py
 +++ xen-4.0.0-testing/tools/python/xen/xend/XendDomainInfo.py
@@ -329,7 +329,9 @@ class XendDomainInfo:
     @type info: dictionary
     @ivar domid: Domain ID (if VM has started)
     @type domid: int or None
 -    @ivar guest_bitsize: the bitsize of guest 
 +    @ivar paused_by_admin: Is this Domain paused by command or API
 +    @type paused_by_admin: bool
 +    @ivar guest_bitsize: the bitsize of guest
     @type guest_bitsize: int or None
     @ivar alloc_mem: the memory domain allocated when booting 
     @type alloc_mem: int or None 
@@ -392,6 +394,7 @@ class XendDomainInfo:
             self.domid = domid
         self.guest_bitsize = None
         self.alloc_mem = None
 +        self.paused_by_admin = False
         maxmem = self.info.get('memory_static_max', 0)
         memory = self.info.get('memory_dynamic_max', 0)
 Index: xen-4.0.0-testing/tools/python/xen/xend/server/SrvDomain.py
 ===================================================================
 --- xen-4.0.0-testing.orig/tools/python/xen/xend/server/SrvDomain.py
 +++ xen-4.0.0-testing/tools/python/xen/xend/server/SrvDomain.py
@@ -250,6 +250,20 @@ class SrvDomain(SrvDir):
         self.acceptCommand(req)
         return self.xd.domain_reset(self.dom.getName())
 +    def op_do_get_pauseflag(self, op, req):
 +        self.acceptCommand(req)
 +        return req.threadRequest(self.do_get_pauseflag, op, req)
 +
 +    def do_get_pauseflag(self, _, req):
 +        return self.xd.domain_getpauseflag(self.dom.getName(), req)
 +
 +    def op_do_set_pauseflag(self, op, req):
 +        self.acceptCommand(req)
 +        return req.threadRequest(self.do_set_pauseflag, op, req)
 +
 +    def do_set_pauseflag(self, _, req):
 +        return self.xd.domain_setpauseflag(self.dom.getName(), req)
 +
     def op_usb_add(self, op, req):
         self.acceptCommand(req)
         return req.threadRequest(self.do_usb_add, op, req)
 Index: xen-4.0.0-testing/tools/python/xen/xm/main.py
 ===================================================================
 --- xen-4.0.0-testing.orig/tools/python/xen/xm/main.py
 +++ xen-4.0.0-testing/tools/python/xen/xm/main.py
@@ -174,6 +174,8 @@ SUBCOMMAND_HELP = {
     #usb
     'usb-add'     : ('<domain> <[host:bus.addr] [host:vendor_id:product_id]>','Add the usb device to FV VM.'),
     'usb-del'     : ('<domain> <[host:bus.addr] [host:vendor_id:product_id]>','Delete the usb device to FV VM.'),
 +    #domstate
 +    'domstate'  : ('<domain> ', 'get the state of a domain'),
     # device commands
@@ -409,6 +411,7 @@ common_commands = [
     "uptime",
     "usb-add",
     "usb-del",
 +    "domstate",
     "vcpu-set",
     ]
@@ -447,6 +450,7 @@ domain_commands = [
     "uptime",
     "usb-add",
     "usb-del",
 +    "domstate",
     "vcpu-list",
     "vcpu-pin",
     "vcpu-set",
@@ -1018,7 +1022,6 @@ def getDomains(domain_names, state, full
                     return "-"
             state_str = "".join([state_on_off(state)
                                  for state in states])
 -            
             dom_rec.update({'name':     dom_rec['name_label'],
                             'memory_actual': int(dom_metrics_rec['memory_actual'])/1024,
                             'vcpus':    dom_metrics_rec['VCPUs_number'],
@@ -1527,8 +1530,10 @@ def xm_pause(args):
     if serverType == SERVER_XEN_API:
         server.xenapi.VM.pause(get_single_vm(dom))
 +        server.xenapi.VM.set_pauseflag(get_single_vm(dom), True)
     else:
         server.xend.domain.pause(dom)
 +        server.xend.domain.setpauseflag(dom, True)
 def xm_unpause(args):
     arg_check(args, "unpause", 1)
@@ -1536,8 +1541,10 @@ def xm_unpause(args):
     if serverType == SERVER_XEN_API:
         server.xenapi.VM.unpause(get_single_vm(dom))
 +        server.xenapi.VM.set_pauseflag(get_single_vm(dom), False)
     else:
         server.xend.domain.unpause(dom)
 +        server.xend.domain.setpauseflag(dom, False)
 def xm_dump_core(args):
     live = False
@@ -1647,6 +1654,32 @@ def xm_usb_add(args):
     arg_check(args, "usb-add", 2)
     server.xend.domain.usb_add(args[0],args[1])
 +def xm_domstate(args):
 +    arg_check(args, "domstate", 1)
 +    (opitons, params) = getopt.gnu_getopt(args, 's',  ['domname='])
 +    doms = getDomains(params, 'all')
 +    d = parse_doms_info(doms[0])
 +    state =  d['state']
 +    if state:
 +        if   state.find('s') > 0:
 +            print 'shutoff'
 +        elif state.find('b') > 0:
 +            print 'idle'
 +        elif state.find('d') > 0:
 +            print 'shutdown'
 +        elif state.find('r') > 0:
 +            print 'running'
 +        elif state.find('c') > 0:
 +            print 'crashed'
 +        elif state.find('p') > 0:
 +            if server.xend.domain.getpauseflag(args[0]):
 +                print 'paused by admin'
 +            else:
 +                print 'paused'
 +    else:
 +        print 'shutoff'
 +    return
 +
 def xm_usb_del(args):
     arg_check(args, "usb-del", 2)
     server.xend.domain.usb_del(args[0],args[1])
@@ -3859,6 +3892,8 @@ commands = {
     #usb
     "usb-add": xm_usb_add,
     "usb-del": xm_usb_del,
 +    #domstate
 +    "domstate": xm_domstate,
     }
 ## The commands supported by a separate argument parser in xend.xm.
--- a/blktap.patch
+++ b/blktap.patch
@ -5,7 +5,7 @@ Index: xen-4.0.0-testing/tools/python/xen/xend/XendDomainInfo.py
 ===================================================================
 --- xen-4.0.0-testing.orig/tools/python/xen/xend/XendDomainInfo.py
 +++ xen-4.0.0-testing/tools/python/xen/xend/XendDomainInfo.py
-@@ -3286,7 +3286,7 @@ class XendDomainInfo:
+@@ -3287,7 +3287,7 @@ class XendDomainInfo:
                          (fn, BOOTLOADER_LOOPBACK_DEVICE))
                 vbd = {
--- a/cpu-pools-python.patch
+++ b/cpu-pools-python.patch
@ -1530,7 +1530,7 @@ Index: xen-4.0.0-testing/tools/python/xen/xend/XendDomainInfo.py
 from xen.xend.server.DevConstants import xenbusState
 from xen.xend.server.BlktapController import TAPDISK_DEVICE, parseDeviceString
-@@ -2565,6 +2566,19 @@ class XendDomainInfo:
+@@ -2566,6 +2567,19 @@ class XendDomainInfo:
         oos = self.info['platform'].get('oos', 1)
         oos_off = 1 - int(oos)
@ -1550,7 +1550,7 @@ Index: xen-4.0.0-testing/tools/python/xen/xend/XendDomainInfo.py
         flags = (int(hvm) << 0) | (int(hap) << 1) | (int(s3_integrity) << 2) | (int(oos_off) << 3)
         try:
-@@ -2586,6 +2600,11 @@ class XendDomainInfo:
+@@ -2587,6 +2601,11 @@ class XendDomainInfo:
                 failmsg += ', error=%i' % int(self.domid)
             raise VmError(failmsg)
@ -1562,7 +1562,7 @@ Index: xen-4.0.0-testing/tools/python/xen/xend/XendDomainInfo.py
         self.dompath = GetDomainPath(self.domid)
         self._recreateDom()
-@@ -3613,6 +3632,11 @@ class XendDomainInfo:
+@@ -3614,6 +3633,11 @@ class XendDomainInfo:
         retval = xc.sched_credit_domain_get(self.getDomid())
         return retval
--- a/del_usb_xend_entry.patch
+++ b/del_usb_xend_entry.patch
@ -2,7 +2,7 @@ Index: xen-4.0.0-testing/tools/python/xen/xend/XendDomainInfo.py
 ===================================================================
 --- xen-4.0.0-testing.orig/tools/python/xen/xend/XendDomainInfo.py
 +++ xen-4.0.0-testing/tools/python/xen/xend/XendDomainInfo.py
-@@ -1306,8 +1306,15 @@ class XendDomainInfo:
+@@ -1307,8 +1307,15 @@ class XendDomainInfo:
                 frontpath = self.getDeviceController(deviceClass).frontendPath(dev)
                 backpath = xstransact.Read(frontpath, "backend")
                 thread.start_new_thread(self.getDeviceController(deviceClass).finishDeviceCleanup, (backpath, path))
--- a/domu-usb-controller.patch
+++ b/domu-usb-controller.patch
@ -0,0 +1,20 @@
 Index: xen-4.0.0-testing/tools/python/xen/xend/XendConfig.py
 ===================================================================
 --- xen-4.0.0-testing.orig/tools/python/xen/xend/XendConfig.py
 +++ xen-4.0.0-testing/tools/python/xen/xend/XendConfig.py
@@ -1855,7 +1855,14 @@ class XendConfig(dict):
         ports = sxp.child(dev_sxp, 'port')
         for port in ports[1:]:
             try:
 -                num, bus = port
 +                # When ['port' ['1','']] is saved into sxp file, it will become (port (1 ))
 +                # If using this sxp file, here variable "port" will be port=1,
 +                # we should process it, otherwise, it will report error.
 +                if len(port) == 1:
 +                    num = port[0]
 +                    bus = ""
 +                else:
 +                    num, bus = port
                 dev_config['port-%i' % int(num)] = str(bus)
             except TypeError:
                 pass
--- a/hv_tools.patch
+++ b/hv_tools.patch
@ -1,7 +1,5 @@
-Index: xen-4.0.0-testing/tools/python/xen/lowlevel/xc/xc.c
+--- a/tools/python/xen/lowlevel/xc/xc.c
-===================================================================
+++ b/tools/python/xen/lowlevel/xc/xc.c
 --- xen-4.0.0-testing.orig/tools/python/xen/lowlevel/xc/xc.c
 +++ xen-4.0.0-testing/tools/python/xen/lowlevel/xc/xc.c
@@ -944,16 +944,16 @@ static PyObject *pyxc_hvm_build(XcObject
 #endif
     int i;
@ -32,10 +30,8 @@ Index: xen-4.0.0-testing/tools/python/xen/lowlevel/xc/xc.c
     return Py_BuildValue("{}");
 }
-Index: xen-4.0.0-testing/tools/python/xen/xend/XendConfig.py
+--- a/tools/python/xen/xend/XendConfig.py
-===================================================================
+++ b/tools/python/xen/xend/XendConfig.py
 --- xen-4.0.0-testing.orig/tools/python/xen/xend/XendConfig.py
 +++ xen-4.0.0-testing/tools/python/xen/xend/XendConfig.py
@@ -151,6 +151,7 @@ XENAPI_PLATFORM_CFG_TYPES = {
     'nographic': int,
     'nomigrate': int,
@ -44,10 +40,8 @@ Index: xen-4.0.0-testing/tools/python/xen/xend/XendConfig.py
     'rtc_timeoffset': int,
     'parallel': str,
     'serial': str,
-Index: xen-4.0.0-testing/tools/python/xen/xend/image.py
+--- a/tools/python/xen/xend/image.py
-===================================================================
+++ b/tools/python/xen/xend/image.py
 --- xen-4.0.0-testing.orig/tools/python/xen/xend/image.py
 +++ xen-4.0.0-testing/tools/python/xen/xend/image.py
@@ -839,6 +839,7 @@ class HVMImageHandler(ImageHandler):
         self.apic = int(vmConfig['platform'].get('apic', 0))
@ -55,8 +49,8 @@ Index: xen-4.0.0-testing/tools/python/xen/xend/image.py
 +        self.extid = int(vmConfig['platform'].get('extid', 0))
         self.guest_os_type = vmConfig['platform'].get('guest_os_type')
         self.memory_sharing = int(vmConfig['memory_sharing'])
-         xc.dom_set_memshr(self.vm.getDomid(), self.memory_sharing)
+         try:
-@@ -964,6 +965,7 @@ class HVMImageHandler(ImageHandler):
+@@ -966,6 +967,7 @@ class HVMImageHandler(ImageHandler):
         log.debug("target         = %d", mem_mb)
         log.debug("vcpus          = %d", self.vm.getVCpuCount())
         log.debug("vcpu_avail     = %li", self.vm.getVCpuAvail())
@ -64,7 +58,7 @@ Index: xen-4.0.0-testing/tools/python/xen/xend/image.py
         log.debug("acpi           = %d", self.acpi)
         log.debug("apic           = %d", self.apic)
-@@ -973,6 +975,7 @@ class HVMImageHandler(ImageHandler):
+@@ -975,6 +977,7 @@ class HVMImageHandler(ImageHandler):
                           target         = mem_mb,
                           vcpus          = self.vm.getVCpuCount(),
                           vcpu_avail     = self.vm.getVCpuAvail(),
@ -72,10 +66,8 @@ Index: xen-4.0.0-testing/tools/python/xen/xend/image.py
                           acpi           = self.acpi,
                           apic           = self.apic)
         rc['notes'] = { 'SUSPEND_CANCEL': 1 }
-Index: xen-4.0.0-testing/tools/python/xen/xm/create.py
+--- a/tools/python/xen/xm/create.py
-===================================================================
+++ b/tools/python/xen/xm/create.py
 --- xen-4.0.0-testing.orig/tools/python/xen/xm/create.py
 +++ xen-4.0.0-testing/tools/python/xen/xm/create.py
@@ -242,6 +242,10 @@ gopts.var('viridian', val='VIRIDIAN',
           use="""Expose Viridian interface to x86 HVM guest?
           (Default is 0).""")
--- a/hv_xen_base.patch
+++ b/hv_xen_base.patch
@ -71,7 +71,7 @@ Index: xen-4.0.0-testing/xen/arch/x86/hvm/hvm.c
     tasklet_kill(&v->arch.hvm_vcpu.assert_evtchn_irq_tasklet);
     hvm_vcpu_cacheattr_destroy(v);
     vlapic_destroy(v);
-@@ -1897,7 +1907,7 @@ void hvm_cpuid(unsigned int input, unsig
+@@ -1899,7 +1909,7 @@ void hvm_cpuid(unsigned int input, unsig
         return;
     if ( cpuid_hypervisor_leaves(input, count, eax, ebx, ecx, edx) )
@ -80,7 +80,7 @@ Index: xen-4.0.0-testing/xen/arch/x86/hvm/hvm.c
     domain_cpuid(v->domain, input, *ecx, eax, ebx, ecx, edx);
-@@ -1964,6 +1974,8 @@ void hvm_cpuid(unsigned int input, unsig
+@@ -1966,6 +1976,8 @@ void hvm_cpuid(unsigned int input, unsig
             *edx &= ~bitmaskof(X86_FEATURE_RDTSCP);
         break;
     }
@ -89,7 +89,7 @@ Index: xen-4.0.0-testing/xen/arch/x86/hvm/hvm.c
 }
 void hvm_rdtsc_intercept(struct cpu_user_regs *regs)
-@@ -2064,6 +2076,8 @@ int hvm_msr_read_intercept(struct cpu_us
+@@ -2066,6 +2078,8 @@ int hvm_msr_read_intercept(struct cpu_us
             break;
         /* ret == 0, This is not an MCE MSR, see other MSRs */
         else if (!ret)
@ -98,7 +98,7 @@ Index: xen-4.0.0-testing/xen/arch/x86/hvm/hvm.c
             return hvm_funcs.msr_read_intercept(regs);
     }
-@@ -2162,6 +2176,8 @@ int hvm_msr_write_intercept(struct cpu_u
+@@ -2164,6 +2178,8 @@ int hvm_msr_write_intercept(struct cpu_u
         else if ( ret )
             break;
         else if (!ret)
@ -107,7 +107,7 @@ Index: xen-4.0.0-testing/xen/arch/x86/hvm/hvm.c
             return hvm_funcs.msr_write_intercept(regs);
     }
-@@ -2354,6 +2370,10 @@ int hvm_do_hypercall(struct cpu_user_reg
+@@ -2356,6 +2372,10 @@ int hvm_do_hypercall(struct cpu_user_reg
     case 0:
         break;
     }
@ -118,7 +118,7 @@ Index: xen-4.0.0-testing/xen/arch/x86/hvm/hvm.c
     if ( (eax & 0x80000000) && is_viridian_domain(curr->domain) )
         return viridian_hypercall(regs);
-@@ -2888,6 +2908,18 @@ long do_hvm_op(unsigned long op, XEN_GUE
+@@ -2890,6 +2910,18 @@ long do_hvm_op(unsigned long op, XEN_GUE
                     rc = -EINVAL;
                 break;
--- a/xen-domUloader.diff
+++ b/xen-domUloader.diff
@ -125,7 +125,7 @@ Index: xen-4.0.0-testing/tools/python/xen/xend/XendDomainInfo.py
 import xen.util.xsm.xsm as security
 from xen.util import xsconstants
 from xen.util import mkdir
-@@ -2342,6 +2342,10 @@ class XendDomainInfo:
+@@ -2343,6 +2343,10 @@ class XendDomainInfo:
         deviceClass, config = self.info['devices'].get(dev_uuid)
         self._waitForDevice(deviceClass, config['devid'])
@ -136,7 +136,7 @@ Index: xen-4.0.0-testing/tools/python/xen/xend/XendDomainInfo.py
     def _waitForDevice_destroy(self, deviceClass, devid, backpath):
         return self.getDeviceController(deviceClass).waitForDevice_destroy(
             devid, backpath)
-@@ -3230,7 +3234,7 @@ class XendDomainInfo:
+@@ -3231,7 +3235,7 @@ class XendDomainInfo:
             devtype = devinfo[0]
             disk = devinfo[1]['uname']
@ -145,7 +145,7 @@ Index: xen-4.0.0-testing/tools/python/xen/xend/XendDomainInfo.py
             # If this is a drbd volume, check if we need to activate it
             if disk.find(":") != -1:
-@@ -3241,8 +3245,17 @@ class XendDomainInfo:
+@@ -3242,8 +3246,17 @@ class XendDomainInfo:
                     if state == 'Secondary':
                         os.system('/sbin/drbdadm primary ' + diskname)
@ -165,7 +165,7 @@ Index: xen-4.0.0-testing/tools/python/xen/xend/XendDomainInfo.py
             if mounted:
                 # This is a file, not a device.  pygrub can cope with a
                 # file if it's raw, but if it's QCOW or other such formats
-@@ -3258,7 +3271,8 @@ class XendDomainInfo:
+@@ -3259,7 +3272,8 @@ class XendDomainInfo:
                 from xen.xend import XendDomain
                 dom0 = XendDomain.instance().privilegedDomain()
@ -175,7 +175,7 @@ Index: xen-4.0.0-testing/tools/python/xen/xend/XendDomainInfo.py
                 fn = BOOTLOADER_LOOPBACK_DEVICE
             try:
-@@ -3268,8 +3282,10 @@ class XendDomainInfo:
+@@ -3269,8 +3283,10 @@ class XendDomainInfo:
                 if mounted:
                     log.info("Unmounting %s from %s." %
                              (fn, BOOTLOADER_LOOPBACK_DEVICE))
--- a/xen-hvm-default-bridge.diff
+++ b/xen-hvm-default-bridge.diff
@ -34,7 +34,7 @@ Index: xen-4.0.0-testing/tools/python/xen/xend/image.py
 ===================================================================
 --- xen-4.0.0-testing.orig/tools/python/xen/xend/image.py
 +++ xen-4.0.0-testing/tools/python/xen/xend/image.py
-@@ -910,11 +910,13 @@ class HVMImageHandler(ImageHandler):
+@@ -912,11 +912,13 @@ class HVMImageHandler(ImageHandler):
             mac = devinfo.get('mac')
             if mac is None:
                 raise VmError("MAC address not specified or generated.")
--- a/xen-hvm-default-pae.diff
+++ b/xen-hvm-default-pae.diff
@ -4,7 +4,7 @@ Index: xen-4.0.0-testing/tools/python/xen/xend/image.py
 ===================================================================
 --- xen-4.0.0-testing.orig/tools/python/xen/xend/image.py
 +++ xen-4.0.0-testing/tools/python/xen/xend/image.py
-@@ -1028,7 +1028,7 @@ class X86_HVM_ImageHandler(HVMImageHandl
+@@ -1030,7 +1030,7 @@ class X86_HVM_ImageHandler(HVMImageHandl
     def configure(self, vmConfig):
         HVMImageHandler.configure(self, vmConfig)
--- a/xen-max-free-mem.diff
+++ b/xen-max-free-mem.diff
@ -98,7 +98,7 @@ Index: xen-4.0.0-testing/tools/python/xen/xend/XendDomainInfo.py
 ===================================================================
 --- xen-4.0.0-testing.orig/tools/python/xen/xend/XendDomainInfo.py
 +++ xen-4.0.0-testing/tools/python/xen/xend/XendDomainInfo.py
-@@ -1469,6 +1469,27 @@ class XendDomainInfo:
+@@ -1470,6 +1470,27 @@ class XendDomainInfo:
         pci_conf = self.info['devices'][dev_uuid][1]
         return map(pci_dict_to_bdf_str, pci_conf['devs'])
--- a/xen.changes
+++ b/xen.changes
@ -1,3 +1,49 @@
 -------------------------------------------------------------------
 Thu Jul  8 15:27:14 MDT 2010 - carnold@novell.com
 - bnc#620694 - Xen yast vm-install for existing paravirtualized 
  disk fails with UnboundLocalError: local variable 'dev_type' 
  referenced before assignment 
  21678-xend-mac-fix.patch
 -------------------------------------------------------------------
 Wed Jul  7 11:20:30 MDT 2010 - carnold@novell.com
 - bnc#586221 - cannot add DomU with USB host controller defined
  domu-usb-controller.patch (Chun Yan Liu)
 -------------------------------------------------------------------
 Tue Jul  6 11:31:33 MDT 2010 - carnold@novell.com
 - Upstream patches from Jan
  21151-trace-bounds-check.patch
  21627-cpuidle-wrap.patch
  21643-vmx-vpmu-pmc-offset.patch
  21682-trace-buffer-range.patch
  21683-vtd-kill-timer-conditional.patch
  21693-memevent-64bit-only.patch
  21695-trace-t_info-readonly.patch
  21698-x86-pirq-range-check.patch
  21699-p2m-query-for-type-change.patch
  21700-32on64-vm86-gpf.patch
  21705-trace-printk.patch
  21706-trace-security.patch
  21712-amd-osvw.patch
  21744-x86-cpufreq-range-check.patch
 -------------------------------------------------------------------
 Fri Jun 25 15:43:35 CST 2010 - jsong@novell.com
 - bnc #599550 - Xen cannot distinguish the status of 'pause'
  addcommand_domstate.patch
 -------------------------------------------------------------------
 Tue Jun 22 11:50:35 MDT 2010 - jfehlig@novell.com
 - bnc#604611 - Do not store vif device details when vif config
  contains invalid mac address.
  21653-xend-mac-addr.patch
 -------------------------------------------------------------------
 Wed Jun 16 08:36:44 MDT 2010 - carnold@novell.com
--- a/xen.spec
+++ b/xen.spec
@ -39,7 +39,7 @@ BuildRequires:  glibc-32bit glibc-devel-32bit
 BuildRequires:  kernel-source kernel-syms module-init-tools xorg-x11
 %endif
 Version:        4.0.0_21091_05
-Release:        5
+Release:        6
 License:        GPLv2+
 Group:          System/Kernel
 AutoReqProv:    on
@ -79,44 +79,60 @@ Patch1:         21109-x86-cpu-hotplug.patch
 Patch2:         21128-domain-save-flush.patch
 Patch3:         21129-xen-hotplug-cleanup.patch
 Patch4:         21150-shadow-race.patch
-Patch5:         21160-sysctl-debug-keys.patch
+Patch5:         21151-trace-bounds-check.patch
-Patch6:         21189-x86-emulate-clflush.patch
+Patch6:         21160-sysctl-debug-keys.patch
-Patch7:         21193-blktap-script.patch
+Patch7:         21189-x86-emulate-clflush.patch
-Patch8:         21194-ioemu-subtype.patch
+Patch8:         21193-blktap-script.patch
-Patch9:         21223-xend-preserve-devs.patch
+Patch9:         21194-ioemu-subtype.patch
-Patch10:        21225-conring-iommu.patch
+Patch10:        21223-xend-preserve-devs.patch
-Patch11:        21234-x86-bad-srat-clear-pxm2node.patch
+Patch11:        21225-conring-iommu.patch
-Patch12:        21235-crashkernel-advanced.patch
+Patch12:        21234-x86-bad-srat-clear-pxm2node.patch
-Patch13:        21266-vmx-disabled-check.patch
+Patch13:        21235-crashkernel-advanced.patch
-Patch14:        21271-x86-cache-flush-global.patch
+Patch14:        21266-vmx-disabled-check.patch
-Patch15:        21272-x86-dom0-alloc-performance.patch
+Patch15:        21271-x86-cache-flush-global.patch
-Patch16:        21273-linux-autconf.patch
+Patch16:        21272-x86-dom0-alloc-performance.patch
-Patch17:        21301-svm-lmsl.patch
+Patch17:        21273-linux-autconf.patch
-Patch18:        21304-keyhandler-alternative.patch
+Patch18:        21301-svm-lmsl.patch
-Patch19:        21317-xend-blkif-util-tap2.patch
+Patch19:        21304-keyhandler-alternative.patch
-Patch20:        passthrough-hotplug-segfault.patch
+Patch20:        21317-xend-blkif-util-tap2.patch
-Patch21:        21331-svm-vintr-during-nmi.patch
+Patch21:        passthrough-hotplug-segfault.patch
-Patch22:        21333-xentrace-t_info-size.patch
+Patch22:        21331-svm-vintr-during-nmi.patch
-Patch23:        21340-vtd-dom0-mapping-latency.patch
+Patch23:        21333-xentrace-t_info-size.patch
-Patch24:        21346-x86-platform-timer-wrap.patch
+Patch24:        21340-vtd-dom0-mapping-latency.patch
-Patch25:        21349-x86-memcpy.patch
+Patch25:        21346-x86-platform-timer-wrap.patch
-Patch26:        21360-x86-mce-polling-diabled-init.patch
+Patch26:        21349-x86-memcpy.patch
-Patch27:        21372-x86-cross-cpu-wait.patch
+Patch27:        21360-x86-mce-polling-diabled-init.patch
-Patch28:        21373-dummy-domain-io-caps.patch
+Patch28:        21372-x86-cross-cpu-wait.patch
-Patch29:        21406-x86-microcode-quiet.patch
+Patch29:        21373-dummy-domain-io-caps.patch
-Patch30:        21408-amd-erratum-383.patch
+Patch30:        21406-x86-microcode-quiet.patch
-Patch31:        21421-vts-ats-enabling.patch
+Patch31:        21408-amd-erratum-383.patch
-Patch32:        21435-vmx-retain-global-controls.patch
+Patch32:        21421-vts-ats-enabling.patch
-Patch33:        21446-iommu-graceful-generic-fail.patch
+Patch33:        21435-vmx-retain-global-controls.patch
-Patch34:        21453-shadow-avoid-remove-all-after-teardown.patch
+Patch34:        21446-iommu-graceful-generic-fail.patch
-Patch35:        21456-compat-hvm-addr-check.patch
+Patch35:        21453-shadow-avoid-remove-all-after-teardown.patch
-Patch36:        21459-block-script.patch
+Patch36:        21456-compat-hvm-addr-check.patch
-Patch37:        21460-xend-timeoffset.patch
+Patch37:        21459-block-script.patch
-Patch38:        21492-x86-pirq-unbind.patch
+Patch38:        21460-xend-timeoffset.patch
-Patch39:        21526-x86-nehalem-cpuid-mask.patch
+Patch39:        21492-x86-pirq-unbind.patch
-Patch40:        21542-amd-erratum-411.patch
+Patch40:        21526-x86-nehalem-cpuid-mask.patch
-Patch41:        21615-dont-save-xen-heap-pages.patch
+Patch41:        21542-amd-erratum-411.patch
-Patch42:        21620-x86-signed-domain-irq.patch
+Patch42:        21615-dont-save-xen-heap-pages.patch
 Patch43:        21620-x86-signed-domain-irq.patch
 Patch44:        21627-cpuidle-wrap.patch
 Patch45:        21643-vmx-vpmu-pmc-offset.patch
 Patch46:        21653-xend-mac-addr.patch
 Patch47:        21678-xend-mac-fix.patch
 Patch48:        21682-trace-buffer-range.patch
 Patch49:        21683-vtd-kill-timer-conditional.patch
 Patch50:        21693-memevent-64bit-only.patch
 Patch51:        21695-trace-t_info-readonly.patch
 Patch52:        21698-x86-pirq-range-check.patch
 Patch53:        21699-p2m-query-for-type-change.patch
 Patch54:        21700-32on64-vm86-gpf.patch
 Patch55:        21705-trace-printk.patch
 Patch56:        21706-trace-security.patch
 Patch57:        21712-amd-osvw.patch
 Patch58:        21744-x86-cpufreq-range-check.patch
 # Our patches
 Patch300:       xen-config.diff
 Patch301:       xend-config.diff
@ -146,7 +162,7 @@ Patch326:       network-nat.patch
 Patch327:       udev-rules.patch
 Patch328:       network-route.patch
 Patch329:       vif-route-ifup.patch
-Patch330:       network-nat-open-SuSEfirewall2-FORWARD.patch 
+Patch330:       network-nat-open-SuSEfirewall2-FORWARD.patch
 Patch340:       xen-hvm-default-bridge.diff
 Patch341:       xen-hvm-default-pae.diff
 Patch342:       xm-test-cleanup.diff
@ -168,7 +184,7 @@ Patch358:       vif-bridge-no-iptables.patch
 Patch359:       suse-disable-tap2-default.patch
 # Needs to go upstream
 Patch360:       checkpoint-rename.patch
-Patch361:       xm-save-check-file.patch 
+Patch361:       xm-save-check-file.patch
 Patch362:       xm-create-xflag.patch
 Patch363:       cpupools-core.patch
 Patch364:       cpupools-core-fixup.patch
@ -193,7 +209,7 @@ Patch415:       tapdisk-ioemu-shutdown-fix.patch
 Patch420:       blktapctrl-default-to-ioemu.patch
 Patch421:       ioemu-blktap-barriers.patch
 # Other bug fixes or features
-Patch423:       bdrv_open2_fix_flags.patch 
+Patch423:       bdrv_open2_fix_flags.patch
 Patch424:       bdrv_open2_flags_2.patch
 Patch425:       ioemu-7615-qcow2-fix-alloc_cluster_link_l2.patch
 Patch426:       ioemu-bdrv-open-CACHE_WB.patch
@ -220,7 +236,7 @@ Patch510:       pv-driver-build.patch
 Patch511:       supported_module.diff
 Patch512:       magic_ioport_compat.patch
 Patch650:       disable_emulated_device.diff
-Patch651:       ioemu-disable-scsi.patch 
+Patch651:       ioemu-disable-scsi.patch
 # novell_shim patches
 Patch700:       hv_tools.patch
 Patch701:       hv_xen_base.patch
@ -603,6 +619,22 @@ Authors:
 %patch40 -p1
 %patch41 -p1
 %patch42 -p1
 %patch43 -p1
 %patch44 -p1
 %patch45 -p1
 %patch46 -p1
 %patch47 -p1
 %patch48 -p1
 %patch49 -p1
 %patch50 -p1
 %patch51 -p1
 %patch52 -p1
 %patch53 -p1
 %patch54 -p1
 %patch55 -p1
 %patch56 -p1
 %patch57 -p1
 %patch58 -p1
 %patch300 -p1
 %patch301 -p1
 %patch302 -p1
@ -738,7 +770,7 @@ done
 %install
 test ! -z "$RPM_BUILD_ROOT" -a "$RPM_BUILD_ROOT" != "/" && rm -rf $RPM_BUILD_ROOT
-export CFLAGS="$RPM_OPT_FLAGS" 
+export CFLAGS="$RPM_OPT_FLAGS"
 export RPM_OPT_FLAGS
 install_xen()
 {
@ -795,7 +827,7 @@ install -m644 %SOURCE19 $RPM_BUILD_ROOT/etc/modprobe.d/xen_pvdrivers.conf
 make -C docs install \
    DESTDIR=$RPM_BUILD_ROOT MANDIR=%{_mandir} \
    DOCDIR=%{_defaultdocdir}/xen
-for name in COPYING %SOURCE2 %SOURCE3 %SOURCE4; do 
+for name in COPYING %SOURCE2 %SOURCE3 %SOURCE4; do
    install -m 644 $name $RPM_BUILD_ROOT/%{_defaultdocdir}/xen/
 done
 mkdir -p $RPM_BUILD_ROOT/%{_defaultdocdir}/xen/misc
--- a/xenapi-console-protocol.patch
+++ b/xenapi-console-protocol.patch
@ -2,7 +2,7 @@ Index: xen-4.0.0-testing/tools/python/xen/xend/XendDomainInfo.py
 ===================================================================
 --- xen-4.0.0-testing.orig/tools/python/xen/xend/XendDomainInfo.py
 +++ xen-4.0.0-testing/tools/python/xen/xend/XendDomainInfo.py
-@@ -3920,6 +3920,14 @@ class XendDomainInfo:
+@@ -3921,6 +3921,14 @@ class XendDomainInfo:
             if not config.has_key('backend'):
                 config['backend'] = "00000000-0000-0000-0000-000000000000"
--- a/xend-core-dump-loc.diff
+++ b/xend-core-dump-loc.diff
@ -2,7 +2,7 @@ Index: xen-4.0.0-testing/tools/python/xen/xend/XendDomainInfo.py
 ===================================================================
 --- xen-4.0.0-testing.orig/tools/python/xen/xend/XendDomainInfo.py
 +++ xen-4.0.0-testing/tools/python/xen/xend/XendDomainInfo.py
-@@ -2313,7 +2313,7 @@ class XendDomainInfo:
+@@ -2314,7 +2314,7 @@ class XendDomainInfo:
             # To prohibit directory traversal
             based_name = os.path.basename(self.info['name_label'])
--- a/xend-domain-lock.patch
+++ b/xend-domain-lock.patch
@ -91,7 +91,7 @@ Index: xen-4.0.0-testing/tools/python/xen/xend/XendDomainInfo.py
                 XendTask.log_progress(0, 30, self._constructDomain)
                 XendTask.log_progress(31, 60, self._initDomain)
-@@ -2983,6 +2985,11 @@ class XendDomainInfo:
+@@ -2984,6 +2986,11 @@ class XendDomainInfo:
             self._stateSet(DOM_STATE_HALTED)
             self.domid = None  # Do not push into _stateSet()!
@ -103,7 +103,7 @@ Index: xen-4.0.0-testing/tools/python/xen/xend/XendDomainInfo.py
         finally:
             self.refresh_shutdown_lock.release()
-@@ -4489,6 +4496,74 @@ class XendDomainInfo:
+@@ -4490,6 +4497,74 @@ class XendDomainInfo:
     def has_device(self, dev_class, dev_uuid):
         return (dev_uuid in self.info['%s_refs' % dev_class.lower()])