commit xen.4554 for openSUSE:13.2:Update

3 Feb 2016

Hello community,

here is the log from the commit of package xen.4554 for openSUSE:13.2:Update checked in at 2016-02-03 11:14:26
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:13.2:Update/xen.4554 (Old)
 and      /work/SRC/openSUSE:13.2:Update/.xen.4554.new (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Package is "xen.4554"

Changes:
--------
New Changes file:

--- /dev/null	2016-01-27 19:41:03.648095915 +0100
+++ /work/SRC/openSUSE:13.2:Update/.xen.4554.new/xen.changes	2016-02-03 11:14:33.000000000 +0100
@@ -0,0 +1,9174 @@
+-------------------------------------------------------------------
+Wed Dec 16 12:16:21 MST 2015 - carnold@suse.com
+
+- bsc#959387 - VUL-0: CVE-2015-8568 CVE-2015-8567: xen: qemu: net:
+  vmxnet3: host memory leakage
+  CVE-2015-8568-qemuu-net-vmxnet3-avoid-memory-leakage-in-activate_device.patch
+
+-------------------------------------------------------------------
+Mon Dec 14 10:12:05 MST 2015 - carnold@suse.com
+
+- bsc#957988 - VUL-0: CVE-2015-8550: xen: paravirtualized drivers
+  incautious about shared memory contents (XSA-155)
+  xsa155-xen-0001-xen-Add-RING_COPY_REQUEST.patch
+  xsa155-xen-0002-blktap2-Use-RING_COPY_REQUEST.patch
+  xsa155-xen-0003-libvchan-Read-prod-cons-only-once.patch
+  xsa155-qemuu-qdisk-double-access.patch
+  xsa155-qemut-qdisk-double-access.patch
+  xsa155-qemuu-xenfb.patch
+  xsa155-qemut-xenfb.patch
+- bsc#959006 - VUL-0: CVE-2015-8558: xen: qemu: usb: infinite loop
+  in ehci_advance_state results in DoS
+  CVE-2015-8558-qemuu-usb-infinite-loop-in-ehci_advance_state-results-in-DoS.patch
+- bsc#958918 - VUL-0: CVE-2015-7549: xen: qemu pci: null pointer
+  dereference issue
+  CVE-2015-7549-qemuu-pci-null-pointer-dereference-issue.patch
+- bsc#958493 - VUL-0: CVE-2015-8504: xen: qemu: ui: vnc: avoid
+  floating point exception
+  CVE-2015-8504-qemuu-vnc-avoid-floating-point-exception.patch
+  CVE-2015-8504-qemut-vnc-avoid-floating-point-exception.patch
+- bsc#958007 - VUL-0: CVE-2015-8554: xen: qemu-dm buffer overrun in
+  MSI-X handling (XSA-164)
+  xsa164.patch
+- bsc#958009 - VUL-0: CVE-2015-8555: xen: information leak in
+  legacy x86 FPU/XMM initialization (XSA-165)
+  xsa165.patch
+- bsc#958523 - VUL-0: xen: ioreq handling possibly susceptible to
+  multiple read issue (XSA-166)
+  xsa166.patch
+- Upstream patches from Jan
+  5641ceec-x86-HVM-always-intercept-AC-and-DB.patch (Replaces CVE-2015-5307-xsa156.patch)
+  5644b756-x86-HVM-don-t-inject-DB-with-error-code.patch
+  56544a57-VMX-fix-adjust-trap-injection.patch
+  56546ab2-sched-fix-insert_vcpu-locking.patch
+  56549f24-x86-vPMU-document-as-unsupported.patch (Replaces xsa163.patch)
+  566052a6-VT-d-drop-unneeded-Ivybridge-quirk-workaround.patch
+  566698e6-x86-time-fix-domain-type-check-in-tsc_set_info.patch
+  5666d471-memory-split-and-tighten-maximum-order-permitted-in-memops.patch
+  5666d4b7-memory-fix-XENMEM_exchange-error-handling.patch (Replaces xsa159.patch)
+  5666f7ad-libxl-Fix-bootloader-related-virtual-memory-leak-on-pv-build-failure.patch (Replaces xsa160.patch)
+
+-------------------------------------------------------------------
+Fri Nov 27 10:39:38 MST 2015 - carnold@suse.com
+
+- bsc#956832 - VUL-0: CVE-2015-8345: xen: qemu: net: eepro100:
+  infinite loop in processing command block list
+  CVE-2015-8345-qemuu-eepro100-infinite-loop-fix.patch
+  CVE-2015-8345-qemut-eepro100-infinite-loop-fix.patch
+
+-------------------------------------------------------------------
+Wed Nov 25 10:06:30 MST 2015 - carnold@suse.com
+
+- bsc#956592 - VUL-0: xen: virtual PMU is unsupported (XSA-163)
+  xsa163.patch
+
+-------------------------------------------------------------------
+Tue Nov 24 13:35:04 MST 2015 - carnold@suse.com
+
+- bsc#956408 - VUL-0: CVE-2015-8339, CVE-2015-8340: xen:
+  XENMEM_exchange error handling issues (XSA-159)
+  xsa159.patch
+- bsc#956409 - VUL-0: CVE-2015-8341: xen: libxl leak of pv kernel
+  and initrd on error (XSA-160)
+  xsa160.patch
+- bsc#956411 - VUL-0: CVE-2015-7504: xen: heap buffer overflow
+  vulnerability in pcnet emulator (XSA-162)
+  xsa162-qemuu.patch
+  xsa162-qemut.patch
+
+-------------------------------------------------------------------
+Thu Nov 19 11:52:28 MST 2015 - carnold@suse.com
+
+- bsc#947165 - VUL-0: CVE-2015-7311: xen: libxl fails to honour
+  readonly flag on disks with qemu-xen (xsa-142)
+  5628fc67-libxl-No-emulated-disk-driver-for-xvdX-disk.patch
+  5649bcbe-libxl-relax-readonly-check-introduced-by-XSA-142-fix.patch
+
+-------------------------------------------------------------------
+Thu Nov  5 07:42:08 MST 2015 - carnold@suse.com
+
+- bsc#954405 - VUL-0: CVE-2015-8104: Xen: guest to host DoS by
+  triggering an infinite loop in microcode via #DB exception
+- bsc#954018 - VUL-0: CVE-2015-5307: xen: x86: CPU lockup during
+  fault delivery (XSA-156)
+  CVE-2015-5307-xsa156.patch
+- Upstream patches from Jan
+  55ffea69-libxl-handle-read-only-drives-with-qemu-xen.patch (Replaces CVE-2015-7311-xsa142.patch)
+  5604f239-x86-PV-properly-populate-descriptor-tables.patch
+  5632127b-x86-guard-against-undue-super-page-PTE-creation.patch (Replaces CVE-2015-7835-xsa148.patch)
+  5632129c-free-domain-s-vcpu-array.patch (Replaces xsa149.patch)
+  563212e4-xenoprof-free-domain-s-vcpu-array.patch (Replaces xsa151.patch)
+  563212ff-x86-rate-limit-logging-in-do_xen-oprof-pmu-_op.patch (Replaces xsa152.patch)
+  56377442-x86-restartable-p2m_pod_empty_cache.patch
+  5638eb5a-vmx-improve-vmentry-failure-handling.patch
+
+-------------------------------------------------------------------
+Mon Nov  2 11:21:15 MST 2015 - carnold@suse.com
+
+- bsc#950704 - VUL-1: CVE-2015-7970: xen: x86: Long latency
+  populate-on-demand operation is not preemptible (XSA-150)
+  563212c9-x86-PoD-Eager-sweep-for-zeroed-pages.patch
+
+-------------------------------------------------------------------
+Fri Oct 23 13:35:59 MDT 2015 - carnold@suse.com
+
+- bsc#951845 - VUL-0: CVE-2015-7972: xen: x86: populate-on-demand
+  balloon size inaccuracy can crash guests (XSA-153)
+  xsa153-libxl.patch
+  xend-xsa153.patch
+- Drop 5604f239-x86-PV-properly-populate-descriptor-tables.patch
+
+-------------------------------------------------------------------
+Fri Oct 16 08:40:31 MDT 2015 - carnold@suse.com
+
+- bsc#950703 - VUL-1: CVE-2015-7969: xen: leak of main per-domain
+  vcpu pointer array (DoS) (XSA-149)
+  xsa149.patch
+- bsc#950705 - VUL-1: CVE-2015-7969: xen: x86: leak of per-domain
+  profiling-related vcpu pointer array (DoS) (XSA-151)
+  xsa151.patch
+- bsc#950706 - VUL-0: CVE-2015-7971: xen: x86: some pmu and
+  profiling hypercalls log without rate limiting (XSA-152)
+  xsa152.patch
+
+-------------------------------------------------------------------
+Thu Oct 15 11:43:23 MDT 2015 - carnold@suse.com
+
+- bsc#932267 - VUL-1: CVE-2015-4037: qemu,kvm,xen: insecure
+  temporary file use in /net/slirp.c
+  CVE-2015-4037-qemuu-smb-config-dir-name.patch
+  CVE-2015-4037-qemut-smb-config-dir-name.patch
+- bsc#877642 - VUL-0: CVE-2014-0222: qemu: qcow1: validate L2 table
+  size to avoid integer overflows
+  CVE-2014-0222-qemuu-qcow1-validate-l2-table-size.patch
+  CVE-2014-0222-qemut-qcow1-validate-l2-table-size.patch
+
+-------------------------------------------------------------------
+Wed Oct 14 10:24:15 MDT 2015 - carnold@suse.com
+
+- bsc#950367 - VUL-0: CVE-2015-7835: xen: x86: Uncontrolled
+  creation of large page mappings by PV guests (XSA-148)
+  CVE-2015-7835-xsa148.patch
+- bsc#907514 - Bus fatal error & sles12 sudden reboot has been
+  observed
+- bsc#910258 - SLES12 Xen host crashes with FATAL NMI after
+  shutdown of guest with VT-d NIC
+- bsc#918984 - Bus fatal error & sles11-SP4 sudden reboot has been
+  observed
+- bsc#923967 - Partner-L3: Bus fatal error & sles11-SP3 sudden
+  reboot has been observed
+  5576f143-x86-adjust-PV-I-O-emulation-functions-types.patch
+  55795a52-x86-vMSI-X-support-qword-MMIO-access.patch
+  5583d9c5-x86-MSI-X-cleanup.patch
+  5583da09-x86-MSI-track-host-and-guest-masking-separately.patch
+  55b0a218-x86-PCI-CFG-write-intercept.patch
+  55b0a255-x86-MSI-X-maskall.patch
+  55b0a283-x86-MSI-X-teardown.patch
+  55b0a2ab-x86-MSI-X-enable.patch
+  55b0a2db-x86-MSI-track-guest-masking.patch
+- bnc#901488 - Intel ixgbe driver assigns rx/tx queues per core
+  resulting in irq problems on servers with a large amount of CPU
+  cores
+  5489c2cf-have-architectures-specify-Dom0-PIRQs.patch
+- Dropped 555ee510-x86-irq-limit-the-maximum-number-of-domain-PIRQs.patch
+- bsc#945167 - Running command ’ xl pci-assignable-add 03:10.1’
+  secondly show errors
+  55f7f9d2-libxl-slightly-refine-pci-assignable-add-remove-handling.patch
+- Upstream patches from Jan
+  55e593f1-x86-NUMA-make-init_node_heap-respect-Xen-heap-limit.patch
+  55f2e438-x86-hvm-fix-saved-pmtimer-and-hpet-values.patch
+  55f9345b-x86-MSI-fail-if-no-hardware-support.patch
+  5604f239-x86-PV-properly-populate-descriptor-tables.patch
+  5604f2e6-vt-d-fix-IM-bit-mask-and-unmask-of-FECTL_REG.patch
+  560a7c36-x86-p2m-pt-delay-freeing-of-intermediate-page-tables.patch
+  560a7c53-x86-p2m-pt-ignore-pt-share-flag-for-shadow-mode-guests.patch
+  560bd926-credit1-fix-tickling-when-it-happens-from-a-remote-pCPU.patch
+  560e6d34-x86-p2m-pt-tighten-conditions-of-IOMMU-mapping-updates.patch
+  561bbc8b-VT-d-don-t-suppress-invalidation-address-write-when-0.patch
+  561d2046-VT-d-use-proper-error-codes-in-iommu_enable_x2apic_IR.patch
+  561d20a0-x86-hide-MWAITX-from-PV-domains.patch
+  561e3283-x86-NUMA-fix-SRAT-table-processor-entry-handling.patch
+
+-------------------------------------------------------------------
+Tue Oct  6 14:52:30 MDT 2015 - jfehlig@suse.com
+
+- bsc#949138 - Setting vcpu affinity under Xen causes libvirtd
+  abort
+  54f4985f-libxl-fix-libvirtd-double-free.patch
++++ 8977 more lines (skipped)
++++ between /dev/null
++++ and /work/SRC/openSUSE:13.2:Update/.xen.4554.new/xen.changes

New:
----
  0001-net-move-the-tap-buffer-into-TAPState.patch
  0002-net-increase-tap-buffer-size.patch
  0003-e1000-fix-access-4-bytes-beyond-buffer-end.patch
  0004-e1000-secrc-support.patch
  0005-e1000-multi-buffer-packet-support.patch
  0006-e1000-clear-EOP-for-multi-buffer-descriptors.patch
  0007-e1000-verify-we-have-buffers-upfront.patch
  0008-e1000-check-buffer-availability.patch
  2e5738ff-add-vga-none-support.patch
  5315a3bb-x86-don-t-propagate-acpi_skip_timer_override-do-Dom0.patch
  5315a43a-x86-ACPI-also-print-address-space-for-PM1x-fields.patch
  53299d8f-xenconsole-reset-tty-on-failure.patch
  53299d8f-xenconsole-tolerate-tty-errors.patch
  5346a7a0-x86-AMD-support-further-feature-masking-MSRs.patch
  53563ea4-x86-MSI-drop-workaround-for-insecure-Dom0-kernels.patch
  537c790d-fix-memory-leak-in-libxl_cpuid_dispose.patch
  537cd0b0-hvmloader-also-cover-PCI-MMIO-ranges-above-4G-with-UC-MTRR-ranges.patch
  537cd0cc-hvmloader-PA-range-0xfc000000-0xffffffff-should-be-UC.patch
  538c7df7-libxenstat-handle-renamed-vifs.patch
  539ebe62-x86-EFI-improve-boot-time-diagnostics.patch
  53aac342-x86-HVM-consolidate-and-sanitize-CR4-guest-reserved-bit-determination.patch
  53c9151b-Fix-xl-vncviewer-accesses-port-0-by-any-invalid-domid.patch
  53d124e7-fix-list_domain_details-check-config-data-length-0.patch
  53dba447-x86-ACPI-allow-CMOS-RTC-use-even-when-ACPI-says-there-is-none.patch
  53df727b-x86-HVM-extend-LAPIC-shortcuts-around-P2M-lookups.patch
  53e8be5f-x86-vHPET-use-rwlock-instead-of-simple-one.patch
  53fcebab-xen-pass-kernel-initrd-to-qemu.patch
  53ff3659-x86-consolidate-boolean-inputs-in-hvm-and-p2m.patch
  53ff36ae-x86-hvm-treat-non-insn-fetch-NPF-also-as-read-violations.patch
  53ff36d5-x86-mem_event-deliver-gla-fault-EPT-violation-information.patch
  54005472-EPT-utilize-GLA-GPA-translation-known-for-certain-faults.patch
  541ad385-x86-suppress-event-check-IPI-to-MWAITing-CPUs.patch
  541ad3ca-x86-HVM-batch-vCPU-wakeups.patch
  5423e61c-x86emul-fix-SYSCALL-SYSENTER-SYSEXIT-emulation.patch
  5424057f-x86-HVM-fix-miscellaneous-aspects-of-x2APIC-emulation.patch
  542405b4-x86-HVM-fix-ID-handling-of-x2APIC-emulation.patch
  54379e6d-x86-vlapic-don-t-silently-accept-bad-vectors.patch
  54467cfc-x86-hvm-further-restrict-x2apic-MSRs.patch
  5459f759-xentop-dynamically-expand-columns.patch
  5489c2cf-have-architectures-specify-Dom0-PIRQs.patch
  548e9c0d-console-allocate-ring-buffer-earlier.patch
  54f4985f-libxl-fix-libvirtd-double-free.patch
  551ac326-xentop-add-support-for-qdisk.patch
  5527edd2-x86-hvm-Fix-the-unknown-nested-vmexit-reason-80000021-bug.patch
  552d293b-x86-vMSI-X-honor-all-mask-requests.patch
  552d2966-x86-vMSI-X-add-valid-bits-for-read-acceleration.patch
  5548e903-domctl-don-t-truncate-XEN_DOMCTL_max_mem-requests.patch
  5576f143-x86-adjust-PV-I-O-emulation-functions-types.patch
  55795a52-x86-vMSI-X-support-qword-MMIO-access.patch
  5583d9c5-x86-MSI-X-cleanup.patch
  5583da09-x86-MSI-track-host-and-guest-masking-separately.patch
  55b0a218-x86-PCI-CFG-write-intercept.patch
  55b0a255-x86-MSI-X-maskall.patch
  55b0a283-x86-MSI-X-teardown.patch
  55b0a2ab-x86-MSI-X-enable.patch
  55b0a2db-x86-MSI-track-guest-masking.patch
  55c1d83d-x86-gdt-Drop-write-only-xalloc-d-array.patch
  55c3232b-x86-mm-Make-hap-shadow-teardown-preemptible.patch
  55dc78e9-x86-amd_ucode-skip-updates-for-final-levels.patch
  55df2f76-IOMMU-skip-domains-without-page-tables-when-dumping.patch
  55e43fd8-x86-NUMA-fix-setup_node.patch
  55e43ff8-x86-NUMA-don-t-account-hotplug-regions.patch
  55e593f1-x86-NUMA-make-init_node_heap-respect-Xen-heap-limit.patch
  55f2e438-x86-hvm-fix-saved-pmtimer-and-hpet-values.patch
  55f7f9d2-libxl-slightly-refine-pci-assignable-add-remove-handling.patch
  55f9345b-x86-MSI-fail-if-no-hardware-support.patch
  55ffea69-libxl-handle-read-only-drives-with-qemu-xen.patch
  5604f239-x86-PV-properly-populate-descriptor-tables.patch
  5604f2e6-vt-d-fix-IM-bit-mask-and-unmask-of-FECTL_REG.patch
  560a7c36-x86-p2m-pt-delay-freeing-of-intermediate-page-tables.patch
  560a7c53-x86-p2m-pt-ignore-pt-share-flag-for-shadow-mode-guests.patch
  560bd926-credit1-fix-tickling-when-it-happens-from-a-remote-pCPU.patch
  560e6d34-x86-p2m-pt-tighten-conditions-of-IOMMU-mapping-updates.patch
  561bbc8b-VT-d-don-t-suppress-invalidation-address-write-when-0.patch
  561d2046-VT-d-use-proper-error-codes-in-iommu_enable_x2apic_IR.patch
  561d20a0-x86-hide-MWAITX-from-PV-domains.patch
  561e3283-x86-NUMA-fix-SRAT-table-processor-entry-handling.patch
  5628fc67-libxl-No-emulated-disk-driver-for-xvdX-disk.patch
  5632127b-x86-guard-against-undue-super-page-PTE-creation.patch
  5632129c-free-domain-s-vcpu-array.patch
  563212c9-x86-PoD-Eager-sweep-for-zeroed-pages.patch
  563212e4-xenoprof-free-domain-s-vcpu-array.patch
  563212ff-x86-rate-limit-logging-in-do_xen-oprof-pmu-_op.patch
  56377442-x86-restartable-p2m_pod_empty_cache.patch
  5638eb5a-vmx-improve-vmentry-failure-handling.patch
  5641ceec-x86-HVM-always-intercept-AC-and-DB.patch
  5644b756-x86-HVM-don-t-inject-DB-with-error-code.patch
  5649bcbe-libxl-relax-readonly-check-introduced-by-XSA-142-fix.patch
  56544a57-VMX-fix-adjust-trap-injection.patch
  56546ab2-sched-fix-insert_vcpu-locking.patch
  56549f24-x86-vPMU-document-as-unsupported.patch
  566052a6-VT-d-drop-unneeded-Ivybridge-quirk-workaround.patch
  566698e6-x86-time-fix-domain-type-check-in-tsc_set_info.patch
  5666d471-memory-split-and-tighten-maximum-order-permitted-in-memops.patch
  5666d4b7-memory-fix-XENMEM_exchange-error-handling.patch
  5666f7ad-libxl-Fix-bootloader-related-virtual-memory-leak-on-pv-build-failure.patch
  CVE-2013-4540-qemu.patch
  CVE-2014-0222-qemut-qcow1-validate-l2-table-size.patch
  CVE-2014-0222-qemuu-qcow1-validate-l2-table-size.patch
  CVE-2015-4037-qemut-smb-config-dir-name.patch
  CVE-2015-4037-qemuu-smb-config-dir-name.patch
  CVE-2015-5154-qemut-fix-START-STOP-UNIT-command-completion.patch
  CVE-2015-5239-qemut-limit-client_cut_text-msg-payload-size.patch
  CVE-2015-5239-qemuu-limit-client_cut_text-msg-payload-size.patch
  CVE-2015-6815-qemut-e1000-fix-infinite-loop.patch
  CVE-2015-6815-qemuu-e1000-fix-infinite-loop.patch
  CVE-2015-7549-qemuu-pci-null-pointer-dereference-issue.patch
  CVE-2015-8345-qemut-eepro100-infinite-loop-fix.patch
  CVE-2015-8345-qemuu-eepro100-infinite-loop-fix.patch
  CVE-2015-8504-qemut-vnc-avoid-floating-point-exception.patch
  CVE-2015-8504-qemuu-vnc-avoid-floating-point-exception.patch
  CVE-2015-8558-qemuu-usb-infinite-loop-in-ehci_advance_state-results-in-DoS.patch
  CVE-2015-8568-qemuu-net-vmxnet3-avoid-memory-leakage-in-activate_device.patch
  README.SUSE
  VNC-Support-for-ExtendedKeyEvent-client-message.patch
  aarch64-rename-PSR_MODE_ELxx-to-match-linux-headers.patch
  add-qxl-support.patch
  altgr_2.patch
  baselibs.conf
  bdrv_default_rwflag.patch
  bdrv_open2_fix_flags.patch
  bdrv_open2_flags_2.patch
  blktap-control-socket-race.patch
  blktap-pv-cdrom.patch
  blktap.patch
  blktapctrl-close-fifos.patch
  blktapctrl-default-to-ioemu.patch
  blktapctrl-disable-debug-printf.patch
  block-dmmd
  block-iscsi
  block-nbd
  block-npiv
  block-npiv-common.sh
  block-npiv-vport
  boot.local.xenU
  boot.xen
  bridge-bonding.patch
  bridge-opensuse.patch
  bridge-record-creation.patch
  bridge-vlan.patch
  build-tapdisk-ioemu.patch
  capslock_enable.patch
  cdrom-removable.patch
  change-vnc-passwd.patch
  disable-wget-check.patch
  domUloader.py
  etc_pam.d_xen-api
  figlet.tar.bz2
  hibernate.patch
  hotplug-Linux-block-find-free-loop-fix.patch
  init.pciback
  init.xen_loop
  init.xend
  init.xendomains
  ioemu-7615-qcow2-fix-alloc_cluster_link_l2.patch
  ioemu-bdrv-open-CACHE_WB.patch
  ioemu-blktap-barriers.patch
  ioemu-blktap-fv-init.patch
  ioemu-blktap-image-format.patch
  ioemu-blktap-zero-size.patch
  ioemu-disable-emulated-ide-if-pv.patch
  ioemu-disable-scsi.patch
  ioemu-hvm-pv-support.patch
  ioemu-vnc-resize.patch
  ioemu-watchdog-ib700-timer.patch
  ioemu-watchdog-linkage.patch
  ioemu-watchdog-support.patch
  ipxe-enable-nics.patch
  ipxe.tar.bz2
  kernel-boot-hvm.patch
  kmp_filelist
  libxc-pass-errno-to-callers-of-xc_domain_save.patch
  libxen_permissive.patch
  libxl-migration-cleanup-remove-backend-domain-field.patch
  libxl-migration-cleanup-update-uuid-name.patch
  libxl-restore-cleanup-left-xenstore-entries.patch
  libxl.add-option-for-discard-support-to-xl-disk-conf.patch
  libxl.add-option-to-disable-disk-cache-flushes-in-qdisk.patch
  libxl.honor-more-top-level-vfb-options.patch
  libxl.introduce-an-option-to-disable-the-non-O_DIRECT-workaround.patch
  libxl.pvscsi.patch
  libxl.set-migration-constraints-from-cmdline.patch
  local_attach_support_for_phy.patch
  log-guest-console.patch
  logrotate.conf
  magic_ioport_compat.patch
  network-nat-open-SuSEfirewall2-FORWARD.patch
  pvdrv_emulation_control.patch
  pygrub-boot-legacy-sles.patch
  pygrub-netware-xnloader.patch
  qemu-dm-segfault.patch
  qemu-ifup-set-mtu.patch
  qemu-security-etch1.patch
  qemu-support-xen-hvm-direct-kernel-boot.patch
  qemu-xen-dir-remote.tar.bz2
  qemu-xen-enable-spice-support.patch
  qemu-xen-traditional-dir-remote.tar.bz2
  qemu-xen-upstream-blkif-discard.patch
  qemu-xen-upstream-megasas-buildtime.patch
  qemu-xen-upstream-qdisk-cache-unsafe.patch
  seabios-dir-remote.tar.bz2
  set-mtu-from-bridge-for-tap-interface.patch
  stdvga-cache.patch
  stubdom.tar.bz2
  supported_module.patch
  suspend_evtchn_lock.patch
  sysconfig.pciback
  tapdisk-ioemu-logfile.patch
  tapdisk-ioemu-shutdown-fix.patch
  tigervnc-long-press.patch
  tmp-initscript-modprobe.patch
  tmp_build.patch
  udev-rules.patch
  vif-bridge-no-iptables.patch
  vif-bridge-tap-fix.patch
  x86-cpufreq-report.patch
  x86-dom-print.patch
  x86-extra-trap-info.patch
  x86-ioapic-ack-default.patch
  xen-4.4.3-testing-src.tar.bz2
  xen-destdir.patch
  xen-disable-qemu-monitor.patch
  xen-figlet-makefile.patch
  xen-hvm-default-bridge.patch
  xen-qemu-iscsi-fix.patch
  xen-updown.sh
  xen-utils-0.1.tar.bz2
  xen-watchdog.service
  xen-xmexample.patch
  xen.changes
  xen.migrate.tools-xend_move_assert_to_exception_block.patch
  xen.spec
  xen2libvirt.py
  xen_pvonhvm.xen_emul_unplug.patch
  xenalyze.hg.tar.bz2
  xenapiusers
  xencommons.service
  xenconsole-no-multiple-connections.patch
  xend-32on64-extra-mem.patch
  xend-change_home_server.patch
  xend-check_device_status.patch
  xend-checkpoint-rename.patch
  xend-config-enable-dump-comment.patch
  xend-config.patch
  xend-console-port-restore.patch
  xend-core-dump-loc.patch
  xend-cpuinfo-model-name.patch
  xend-del_usb_xend_entry.patch
  xend-devid-or-name.patch
  xend-disable-internal-logrotate.patch
  xend-domain-lock-sfex.patch
  xend-domain-lock.patch
  xend-domu-usb-controller.patch
  xend-fix-sendkey.patch
  xend-hv_extid_compatibility.patch
  xend-hvm-default-pae.patch
  xend-hvm-firmware-passthrough.patch
  xend-managed-pci-device.patch
  xend-max-free-mem.patch
  xend-migration-bridge-check.patch
  xend-migration-domname-fix.patch
  xend-minimum-restart-time.patch
  xend-multi-xvdp.patch
  xend-pvscsi-recognize-also-SCSI-CDROM-devices.patch
  xend-relocation-server.fw
  xend-relocation.sh
  xend-remove-xm-deprecation-warning.patch
  xend-set-migration-constraints-from-cmdline.patch
  xend-tools-watchdog-support.patch
  xend-vcpu-affinity-fix.patch
  xend-vif-route-ifup.patch
  xend-xen-api-auth.patch
  xend-xen-domUloader.patch
  xend-xenapi-console-protocol.patch
  xend-xenpaging.autostart.patch
  xend-xm-create-xflag.patch
  xend-xm-reboot-fix.patch
  xend-xm-save-check-file.patch
  xend-xsa153.patch
  xend.service
  xendomains.service
  xenpaging.doc.patch
  xenpaging.qemu.flush-cache.patch
  xl-check-for-libvirt-managed-domain.patch
  xl-conf-default-bridge.patch
  xl-coredump-file-location.patch
  xmclone.sh
  xmexample.disks
  xmexample.domUloader
  xnloader.py
  xsa140-qemut-1.patch
  xsa140-qemut-2.patch
  xsa140-qemut-3.patch
  xsa140-qemut-4.patch
  xsa140-qemut-5.patch
  xsa140-qemut-6.patch
  xsa140-qemut-7.patch
  xsa153-libxl.patch
  xsa155-qemut-qdisk-double-access.patch
  xsa155-qemut-xenfb.patch
  xsa155-qemuu-qdisk-double-access.patch
  xsa155-qemuu-xenfb.patch
  xsa155-xen-0001-xen-Add-RING_COPY_REQUEST.patch
  xsa155-xen-0002-blktap2-Use-RING_COPY_REQUEST.patch
  xsa155-xen-0003-libvchan-Read-prod-cons-only-once.patch
  xsa162-qemut.patch
  xsa162-qemuu.patch
  xsa164.patch
  xsa165.patch
  xsa166.patch

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ xen.spec ++++++
++++ 1749 lines (skipped)

++++++ 0001-net-move-the-tap-buffer-into-TAPState.patch ++++++
From: Mark McLoughlin 
Date: Mon, 18 May 2009 12:05:44 +0100
Subject: net: move the tap buffer into TAPState
Patch-mainline: v0.11.0-rc0
Git-commit: 5b01e886d9eb4d5e94384a79634dcb43848e7bbf
References: bnc#840196

KVM uses a 64k buffer for reading from tapfd (for GSO support)
and allocates the buffer with TAPState rather than on the stack.

Not allocating it on the stack probably makes sense for qemu
anyway, so merge it in advance of GSO support.

Signed-off-by: Mark McLoughlin 
Signed-off-by: Michal Kubecek 
---
 tools/qemu-xen-traditional-dir-remote/net.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/tools/qemu-xen-traditional-dir-remote/net.c b/tools/qemu-xen-traditional-dir-remote/net.c
index 0e7c77c..2ca85a3 100644
--- a/tools/qemu-xen-traditional-dir-remote/net.c
+++ b/tools/qemu-xen-traditional-dir-remote/net.c
@@ -700,6 +700,7 @@ typedef struct TAPState {
     char down_script[1024];
     char down_script_arg[128];
     char script_arg[1024];
+    uint8_t buf[4096];
 } TAPState;
 
 #ifndef CONFIG_STUBDOM
@@ -735,20 +736,19 @@ static void tap_receive(void *opaque, const uint8_t *buf, int size)
 static void tap_send(void *opaque)
 {
     TAPState *s = opaque;
-    uint8_t buf[4096];
     int size;
 
 #ifdef __sun__
     struct strbuf sbuf;
     int f = 0;
-    sbuf.maxlen = sizeof(buf);
-    sbuf.buf = buf;
+    sbuf.maxlen = sizeof(s->buf);
+    sbuf.buf = s->buf;
     size = getmsg(s->fd, NULL, &sbuf, &f) >=0 ? sbuf.len : -1;
 #else
-    size = read(s->fd, buf, sizeof(buf));
+    size = read(s->fd, s->buf, sizeof(s->buf));
 #endif
     if (size > 0) {
-        qemu_send_packet(s->vc, buf, size);
+        qemu_send_packet(s->vc, s->buf, size);
     }
 }
 
-- 
1.8.1.4

++++++ 0002-net-increase-tap-buffer-size.patch ++++++
From: Michal Kubecek 
Date: Fri, 27 Sep 2013 19:05:45 +0200
Subject: net: increase tap buffer size
Patch-mainline: v0.12.0-rc0
Git-commit: 8e0f8e5bf8fd483dd28329055336cf895b74c89f (partial)
References: bnc#840196

Increase size of buffere embedded in struct TAPState to allow
jumbo frames longer then 4096 bytes.

Part of upstream qemu commit

  8e0f8e5b  net: enable IFF_VNET_HDR on tap fds if available

Signed-off-by: Michal Kubecek 
---
 tools/qemu-xen-traditional-dir-remote/net.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/tools/qemu-xen-traditional-dir-remote/net.c b/tools/qemu-xen-traditional-dir-remote/net.c
index 2ca85a3..502a691 100644
--- a/tools/qemu-xen-traditional-dir-remote/net.c
+++ b/tools/qemu-xen-traditional-dir-remote/net.c
@@ -693,6 +693,11 @@ static void vmchannel_read(void *opaque, const uint8_t *buf, int size)
 
 #if !defined(_WIN32)
 
+/* Maximum GSO packet size (64k) plus plenty of room for
+ * the ethernet and virtio_net headers
+ */
+#define TAP_BUFSIZE (4096 + 65536)
+
 typedef struct TAPState {
     VLANClientState *vc;
     int fd;
@@ -700,7 +705,7 @@ typedef struct TAPState {
     char down_script[1024];
     char down_script_arg[128];
     char script_arg[1024];
-    uint8_t buf[4096];
+    uint8_t buf[TAP_BUFSIZE];
 } TAPState;
 
 #ifndef CONFIG_STUBDOM
-- 
1.8.1.4

++++++ 0003-e1000-fix-access-4-bytes-beyond-buffer-end.patch ++++++
From: "Michael S. Tsirkin" 
Date: Mon, 12 Jul 2010 20:24:59 +0300
Subject: e1000: fix access 4 bytes beyond buffer end
Patch-mainline: v0.13.0-rc0
Git-commit: b0b900070c7cb29bbefb732ec00397abe5de6d73
References: bnc#840196

We do range check for size, and get size as buffer,
but copy size + 4 bytes (4 is for FCS).
Let's copy size bytes but put size + 4 in length.

Signed-off-by: Michael S. Tsirkin 
Acked-by: Michal Kubecek 
---
 tools/qemu-xen-traditional-dir-remote/hw/e1000.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/tools/qemu-xen-traditional-dir-remote/hw/e1000.c b/tools/qemu-xen-traditional-dir-remote/hw/e1000.c
index c75bc5e..9b062db 100644
--- a/tools/qemu-xen-traditional-dir-remote/hw/e1000.c
+++ b/tools/qemu-xen-traditional-dir-remote/hw/e1000.c
@@ -659,7 +659,6 @@ e1000_receive(void *opaque, const uint8_t *buf, int size)
     }
 
     rdh_start = s->mac_reg[RDH];
-    size += 4; // for the header
     do {
         if (s->mac_reg[RDH] == s->mac_reg[RDT] && s->check_rxov) {
             set_ics(s, 0, E1000_ICS_RXO);
@@ -673,7 +672,7 @@ e1000_receive(void *opaque, const uint8_t *buf, int size)
         if (desc.buffer_addr) {
             cpu_physical_memory_write(le64_to_cpu(desc.buffer_addr),
                                       (void *)(buf + vlan_offset), size);
-            desc.length = cpu_to_le16(size);
+            desc.length = cpu_to_le16(size + 4 /* for FCS */);
             desc.status |= E1000_RXD_STAT_EOP|E1000_RXD_STAT_IXSM;
         } else // as per intel docs; skip descriptors with null buf addr
             DBGOUT(RX, "Null RX descriptor!!\n");
-- 
1.8.1.4

++++++ 0004-e1000-secrc-support.patch ++++++
From: "Michael S. Tsirkin" 
Date: Mon, 12 Jul 2010 20:41:02 +0300
Subject: e1000: secrc support
Patch-mainline: v0.13.0-rc0
Git-commit: 55e8d1ce6b09300cc5f3adcd9a705156d168381d
References: bnc#840196

Add support for secrc field. Reportedly needed by old RHEL guests.

Signed-off-by: Michael S. Tsirkin 
Acked-by: Michal Kubecek 
---
 tools/qemu-xen-traditional-dir-remote/hw/e1000.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/tools/qemu-xen-traditional-dir-remote/hw/e1000.c b/tools/qemu-xen-traditional-dir-remote/hw/e1000.c
index 9b062db..07e681d 100644
--- a/tools/qemu-xen-traditional-dir-remote/hw/e1000.c
+++ b/tools/qemu-xen-traditional-dir-remote/hw/e1000.c
@@ -338,6 +338,15 @@ is_vlan_txd(uint32_t txd_lower)
     return ((txd_lower & E1000_TXD_CMD_VLE) != 0);
 }
 
+/* FCS aka Ethernet CRC-32. We don't get it from backends and can't
+ * fill it in, just pad descriptor length by 4 bytes unless guest
+ * told us to trip it off the packet. */
+static inline int
+fcs_len(E1000State *s)
+{
+    return (s->mac_reg[RCTL] & E1000_RCTL_SECRC) ? 0 : 4;
+}
+
 static void
 xmit_seg(E1000State *s)
 {
@@ -672,7 +681,7 @@ e1000_receive(void *opaque, const uint8_t *buf, int size)
         if (desc.buffer_addr) {
             cpu_physical_memory_write(le64_to_cpu(desc.buffer_addr),
                                       (void *)(buf + vlan_offset), size);
-            desc.length = cpu_to_le16(size + 4 /* for FCS */);
+            desc.length = cpu_to_le16(size + fcs_len(s));
             desc.status |= E1000_RXD_STAT_EOP|E1000_RXD_STAT_IXSM;
         } else // as per intel docs; skip descriptors with null buf addr
             DBGOUT(RX, "Null RX descriptor!!\n");
-- 
1.8.1.4

++++++ 0005-e1000-multi-buffer-packet-support.patch ++++++
From: "Michael S. Tsirkin" 
Date: Tue, 15 Feb 2011 18:27:48 +0200
Subject: e1000: multi-buffer packet support
Patch-mainline: v0.15.0-rc0
Git-commit: b19487e27ed3009df7f555998a454ba19aefd4b8
References: bnc#840196

e1000 supports multi-buffer packets larger than rxbuf_size.

This fixes the following (on linux):
- in guest: ifconfig eth1 mtu 16110
- in host: ifconfig tap0 mtu 16110
           ping -s 16082 <guest-ip>

Signed-off-by: Michael S. Tsirkin 
Reviewed-by: Stefan Hajnoczi 
Acked-by: Alex Williamson 
Acked-by: Kevin Wolf 
Signed-off-by: Aurelien Jarno 
Signed-off-by: Michal Kubecek 
---
 tools/qemu-xen-traditional-dir-remote/hw/e1000.c | 39 +++++++++++++++++-------
 1 file changed, 28 insertions(+), 11 deletions(-)

diff --git a/tools/qemu-xen-traditional-dir-remote/hw/e1000.c b/tools/qemu-xen-traditional-dir-remote/hw/e1000.c
index 07e681d..34818e0 100644
--- a/tools/qemu-xen-traditional-dir-remote/hw/e1000.c
+++ b/tools/qemu-xen-traditional-dir-remote/hw/e1000.c
@@ -632,16 +632,13 @@ e1000_receive(void *opaque, const uint8_t *buf, int size)
     uint32_t rdh_start;
     uint16_t vlan_special = 0;
     uint8_t vlan_status = 0, vlan_offset = 0;
+    size_t desc_offset;
+    size_t desc_size;
+    size_t total_size;
 
     if (!(s->mac_reg[RCTL] & E1000_RCTL_EN))
         return;
 
-    if (size > s->rxbuf_size) {
-        DBGOUT(RX, "packet too large for buffers (%d > %d)\n", size,
-               s->rxbuf_size);
-        return;
-    }
-
     /* Discard oversized packets if !LPE and !SBP. */
     if ((size > MAXIMUM_ETHERNET_LPE_SIZE ||
         (size > MAXIMUM_ETHERNET_VLAN_SIZE
@@ -668,8 +665,16 @@ e1000_receive(void *opaque, const uint8_t *buf, int size)
     }
 
     rdh_start = s->mac_reg[RDH];
+    desc_offset = 0;
+    total_size = size + fcs_len(s);
     do {
+        desc_size = total_size - desc_offset;
+        if (desc_size > s->rxbuf_size) {
+            desc_size = s->rxbuf_size;
+        }
         if (s->mac_reg[RDH] == s->mac_reg[RDT] && s->check_rxov) {
+            /* Discard all data written so far */
+            s->mac_reg[RDH] = rdh_start;
             set_ics(s, 0, E1000_ICS_RXO);
             return;
         }
@@ -679,10 +684,22 @@ e1000_receive(void *opaque, const uint8_t *buf, int size)
         desc.special = vlan_special;
         desc.status |= (vlan_status | E1000_RXD_STAT_DD);
         if (desc.buffer_addr) {
-            cpu_physical_memory_write(le64_to_cpu(desc.buffer_addr),
-                                      (void *)(buf + vlan_offset), size);
-            desc.length = cpu_to_le16(size + fcs_len(s));
-            desc.status |= E1000_RXD_STAT_EOP|E1000_RXD_STAT_IXSM;
+            if (desc_offset < size) {
+                size_t copy_size = size - desc_offset;
+                if (copy_size > s->rxbuf_size) {
+                    copy_size = s->rxbuf_size;
+                }
+                cpu_physical_memory_write(le64_to_cpu(desc.buffer_addr),
+                                          (void *)(buf + desc_offset + vlan_offset),
+                                          copy_size);
+            }
+            desc_offset += desc_size;
+            if (desc_offset >= total_size) {
+                desc.length = cpu_to_le16(desc_size);
+                desc.status |= E1000_RXD_STAT_EOP | E1000_RXD_STAT_IXSM;
+            } else {
+                desc.length = cpu_to_le16(desc_size);
+            }
         } else // as per intel docs; skip descriptors with null buf addr
             DBGOUT(RX, "Null RX descriptor!!\n");
         cpu_physical_memory_write(base, (void *)&desc, sizeof(desc));
@@ -697,7 +714,7 @@ e1000_receive(void *opaque, const uint8_t *buf, int size)
             set_ics(s, 0, E1000_ICS_RXO);
             return;
         }
-    } while (desc.buffer_addr == 0);
+    } while (desc_offset < total_size);
 
     s->mac_reg[GPRC]++;
     s->mac_reg[TPR]++;
-- 
1.8.1.4

++++++ 0006-e1000-clear-EOP-for-multi-buffer-descriptors.patch ++++++
From: "Michael S. Tsirkin" 
Date: Tue, 15 Feb 2011 18:27:52 +0200
Subject: e1000: clear EOP for multi-buffer descriptors
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Patch-mainline: v0.15.0-rc0
Git-commit: ee912ccfa007351a62ba42bd60499769f6c02c1e
References: bnc#840196

The e1000 spec says: if software statically allocates
buffers, and uses memory read to check for completed descriptors, it
simply has to zero the status byte in the descriptor to make it ready
for reuse by hardware. This is not a hardware requirement (moving the
hardware tail pointer is), but is necessary for performing an in–memory
scan.

Thus the guest does not have to clear the status byte.  In case it
doesn't we need to clear EOP for all descriptors
except the last.  While I don't know of any such guests,
it's probably a good idea to stick to the spec.

Signed-off-by: Michael S. Tsirkin 
Reported-by: Juan Quintela 
Acked-by: Alex Williamson 
Acked-by: Kevin Wolf 
Signed-off-by: Aurelien Jarno 
Acked-by: Michal Kubecek 
---
 tools/qemu-xen-traditional-dir-remote/hw/e1000.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/tools/qemu-xen-traditional-dir-remote/hw/e1000.c b/tools/qemu-xen-traditional-dir-remote/hw/e1000.c
index 34818e0..7e791dc 100644
--- a/tools/qemu-xen-traditional-dir-remote/hw/e1000.c
+++ b/tools/qemu-xen-traditional-dir-remote/hw/e1000.c
@@ -694,11 +694,13 @@ e1000_receive(void *opaque, const uint8_t *buf, int size)
                                           copy_size);
             }
             desc_offset += desc_size;
+            desc.length = cpu_to_le16(desc_size);
             if (desc_offset >= total_size) {
-                desc.length = cpu_to_le16(desc_size);
                 desc.status |= E1000_RXD_STAT_EOP | E1000_RXD_STAT_IXSM;
             } else {
-                desc.length = cpu_to_le16(desc_size);
+                /* Guest zeroing out status is not a hardware requirement.
+                   Clear EOP in case guest didn't do it. */
+                desc.status &= ~E1000_RXD_STAT_EOP;
             }
         } else // as per intel docs; skip descriptors with null buf addr
             DBGOUT(RX, "Null RX descriptor!!\n");
-- 
1.8.1.4

++++++ 0007-e1000-verify-we-have-buffers-upfront.patch ++++++
From: "Michael S. Tsirkin" 
Date: Tue, 15 Feb 2011 18:27:55 +0200
Subject: e1000: verify we have buffers, upfront
Patch-mainline: v0.15.0-rc0
Git-commit: 322fd48afbed1ef7b834ac343a0c8687bcb33695
References: bnc#840196

The spec says: Any descriptor with a non-zero status byte has been
processed by the hardware, and is ready to be handled by the software.

Thus, once we change a descriptor status to non-zero we should
never move the head backwards and try to reuse this
descriptor from hardware.

This actually happened with a multibuffer packet
that arrives when we don't have enough buffers.

Fix by checking that we have enough buffers upfront
so we never need to discard the packet midway through.

Signed-off-by: Michael S. Tsirkin 
Acked-by: Alex Williamson 
Acked-by: Kevin Wolf 
Signed-off-by: Aurelien Jarno 
Acked-by: Michal Kubecek 
---
 tools/qemu-xen-traditional-dir-remote/hw/e1000.c | 28 +++++++++++++++++++-----
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/tools/qemu-xen-traditional-dir-remote/hw/e1000.c b/tools/qemu-xen-traditional-dir-remote/hw/e1000.c
index 7e791dc..18d7597 100644
--- a/tools/qemu-xen-traditional-dir-remote/hw/e1000.c
+++ b/tools/qemu-xen-traditional-dir-remote/hw/e1000.c
@@ -622,6 +622,24 @@ e1000_can_receive(void *opaque)
     return (s->mac_reg[RCTL] & E1000_RCTL_EN && s->mac_reg[RDLEN] != 0);
 }
 
+static bool e1000_has_rxbufs(E1000State *s, size_t total_size)
+{
+    int bufs;
+    /* Fast-path short packets */
+    if (total_size <= s->rxbuf_size) {
+        return s->mac_reg[RDH] != s->mac_reg[RDT] || !s->check_rxov;
+    }
+    if (s->mac_reg[RDH] < s->mac_reg[RDT]) {
+        bufs = s->mac_reg[RDT] - s->mac_reg[RDH];
+    } else if (s->mac_reg[RDH] > s->mac_reg[RDT] || !s->check_rxov) {
+        bufs = s->mac_reg[RDLEN] /  sizeof(struct e1000_rx_desc) +
+            s->mac_reg[RDT] - s->mac_reg[RDH];
+    } else {
+        return false;
+    }
+    return total_size <= bufs * s->rxbuf_size;
+}
+
 static void
 e1000_receive(void *opaque, const uint8_t *buf, int size)
 {
@@ -667,17 +685,15 @@ e1000_receive(void *opaque, const uint8_t *buf, int size)
     rdh_start = s->mac_reg[RDH];
     desc_offset = 0;
     total_size = size + fcs_len(s);
+    if (!e1000_has_rxbufs(s, total_size)) {
+            set_ics(s, 0, E1000_ICS_RXO);
+            return;
+    }
     do {
         desc_size = total_size - desc_offset;
         if (desc_size > s->rxbuf_size) {
             desc_size = s->rxbuf_size;
         }
-        if (s->mac_reg[RDH] == s->mac_reg[RDT] && s->check_rxov) {
-            /* Discard all data written so far */
-            s->mac_reg[RDH] = rdh_start;
-            set_ics(s, 0, E1000_ICS_RXO);
-            return;
-        }
         base = ((uint64_t)s->mac_reg[RDBAH] << 32) + s->mac_reg[RDBAL] +
                sizeof(desc) * s->mac_reg[RDH];
         cpu_physical_memory_read(base, (void *)&desc, sizeof(desc));
-- 
1.8.1.4

++++++ 0008-e1000-check-buffer-availability.patch ++++++
From: "Michael S. Tsirkin" 
Date: Sun, 27 Mar 2011 13:37:35 +0200
Subject: e1000: check buffer availability
Patch-mainline: v0.15.0-rc0
Git-commit: 6cdfab2868dd593902e2b7db3ba9f49f2cc03e3f
References: bnc#840196

Reduce spurious packet drops on RX ring empty
by verifying that we have at least 1 buffer
ahead of the time.

Signed-off-by: Michael S. Tsirkin 
Acked-by: Michal Kubecek 
---
 tools/qemu-xen-traditional-dir-remote/hw/e1000.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/tools/qemu-xen-traditional-dir-remote/hw/e1000.c b/tools/qemu-xen-traditional-dir-remote/hw/e1000.c
index 18d7597..b07c6cb 100644
--- a/tools/qemu-xen-traditional-dir-remote/hw/e1000.c
+++ b/tools/qemu-xen-traditional-dir-remote/hw/e1000.c
@@ -614,14 +614,6 @@ e1000_set_link_status(VLANClientState *vc)
         set_ics(s, 0, E1000_ICR_LSC);
 }
 
-static int
-e1000_can_receive(void *opaque)
-{
-    E1000State *s = opaque;
-
-    return (s->mac_reg[RCTL] & E1000_RCTL_EN && s->mac_reg[RDLEN] != 0);
-}
-
 static bool e1000_has_rxbufs(E1000State *s, size_t total_size)
 {
     int bufs;
@@ -640,6 +632,15 @@ static bool e1000_has_rxbufs(E1000State *s, size_t total_size)
     return total_size <= bufs * s->rxbuf_size;
 }
 
+static int
+e1000_can_receive(void *opaque)
+{
+    E1000State *s = opaque;
+
+    return (s->mac_reg[RCTL] & E1000_RCTL_EN) && (s->mac_reg[RDLEN] != 0) &&
+           e1000_has_rxbufs(s, 1);
+}
+
 static void
 e1000_receive(void *opaque, const uint8_t *buf, int size)
 {
-- 
1.8.1.4

++++++ 2e5738ff-add-vga-none-support.patch ++++++
Subject: libxl: Add none to vga parameter
From: Fabio Fantoni fabio.fantoni@m2r.biz Thu Mar 13 15:25:47 2014 +0100
Date: Thu Mar 13 18:09:57 2014 +0000:
Git: 2e5738ff47b9d2e1948024100f87b1a25fcf004a

Usage:
  vga="none"

Make possible to not have an emulated vga on hvm domUs.

Signed-off-by: Fabio Fantoni 
Reviewed-by: Anthony PERARD 
Tested-by: Paul Durrant 

Index: xen-4.4.3-testing/docs/man/xl.cfg.pod.5
===================================================================
--- xen-4.4.3-testing.orig/docs/man/xl.cfg.pod.5
+++ xen-4.4.3-testing/docs/man/xl.cfg.pod.5
@@ -1082,7 +1082,7 @@ This option is deprecated, use vga="stdv
 
 =item B
 
-Selects the emulated video card (stdvga|cirrus).
+Selects the emulated video card (none|stdvga|cirrus).
 The default is cirrus.
 
 =item B
Index: xen-4.4.3-testing/tools/libxl/libxl_create.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl_create.c
+++ xen-4.4.3-testing/tools/libxl/libxl_create.c
@@ -226,6 +226,10 @@ int libxl__domain_build_info_setdefault(
         switch (b_info->device_model_version) {
         case LIBXL_DEVICE_MODEL_VERSION_QEMU_XEN_TRADITIONAL:
             switch (b_info->u.hvm.vga.kind) {
+            case LIBXL_VGA_INTERFACE_TYPE_NONE:
+                if (b_info->video_memkb == LIBXL_MEMKB_DEFAULT)
+                    b_info->video_memkb = 0;
+                break;
             case LIBXL_VGA_INTERFACE_TYPE_STD:
                 if (b_info->video_memkb == LIBXL_MEMKB_DEFAULT)
                     b_info->video_memkb = 8 * 1024;
@@ -246,6 +250,10 @@ int libxl__domain_build_info_setdefault(
         case LIBXL_DEVICE_MODEL_VERSION_QEMU_XEN:
         default:
             switch (b_info->u.hvm.vga.kind) {
+            case LIBXL_VGA_INTERFACE_TYPE_NONE:
+                if (b_info->video_memkb == LIBXL_MEMKB_DEFAULT)
+                    b_info->video_memkb = 0;
+                break;
             case LIBXL_VGA_INTERFACE_TYPE_STD:
                 if (b_info->video_memkb == LIBXL_MEMKB_DEFAULT)
                     b_info->video_memkb = 16 * 1024;
Index: xen-4.4.3-testing/tools/libxl/libxl_dm.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl_dm.c
+++ xen-4.4.3-testing/tools/libxl/libxl_dm.c
@@ -226,6 +226,9 @@ static char ** libxl__build_device_model
             break;
         case LIBXL_VGA_INTERFACE_TYPE_CIRRUS:
             break;
+        case LIBXL_VGA_INTERFACE_TYPE_NONE:
+            flexarray_append_pair(dm_args, "-vga", "none");
+            break;
         }
 
         if (b_info->u.hvm.boot) {
@@ -534,6 +537,8 @@ static char ** libxl__build_device_model
                 GCSPRINTF("vga.vram_size_mb=%d",
                 libxl__sizekb_to_mb(b_info->video_memkb)));
             break;
+        case LIBXL_VGA_INTERFACE_TYPE_NONE:
+            break;
         }
 
         if (b_info->u.hvm.boot) {
Index: xen-4.4.3-testing/tools/libxl/libxl_types.idl
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl_types.idl
+++ xen-4.4.3-testing/tools/libxl/libxl_types.idl
@@ -153,6 +153,7 @@ libxl_shutdown_reason = Enumeration("shu
 libxl_vga_interface_type = Enumeration("vga_interface_type", [
     (1, "CIRRUS"),
     (2, "STD"),
+    (3, "NONE"),
     ], init_val = 1)
 
 libxl_vendor_device = Enumeration("vendor_device", [
Index: xen-4.4.3-testing/tools/libxl/xl_cmdimpl.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/xl_cmdimpl.c
+++ xen-4.4.3-testing/tools/libxl/xl_cmdimpl.c
@@ -1667,6 +1667,8 @@ skip_vfb:
                 b_info->u.hvm.vga.kind = LIBXL_VGA_INTERFACE_TYPE_STD;
             } else if (!strcmp(buf, "cirrus")) {
                 b_info->u.hvm.vga.kind = LIBXL_VGA_INTERFACE_TYPE_CIRRUS;
+            } else if (!strcmp(buf, "none")) {
+                b_info->u.hvm.vga.kind = LIBXL_VGA_INTERFACE_TYPE_NONE;
             } else {
                 fprintf(stderr, "Unknown vga \"%s\" specified\n", buf);
                 exit(1);
++++++ 5315a3bb-x86-don-t-propagate-acpi_skip_timer_override-do-Dom0.patch ++++++
# Commit 8db22866dbbcabf30ad6e3814489c730b53d1cf4
# Date 2014-03-04 10:58:19 +0100
# Author Jan Beulich 
# Committer Jan Beulich 
x86: don't propagate acpi_skip_timer_override do Dom0

It's unclear why c/s 4850:923dd9975981 added this - Dom0 isn't
controlling the timer interrupt, and hence has no need to know.

Signed-off-by: Jan Beulich 
Acked-by: Keir Fraser 
Reviewed-by: Andrew Cooper 

--- a/xen/arch/x86/acpi/boot.c
+++ b/xen/arch/x86/acpi/boot.c
@@ -56,7 +56,9 @@ bool_t __initdata acpi_ht = 1;	/* enable
 bool_t __initdata acpi_lapic;
 bool_t __initdata acpi_ioapic;
 
-bool_t acpi_skip_timer_override __initdata;
+/* acpi_skip_timer_override: Skip IRQ0 overrides. */
+static bool_t acpi_skip_timer_override __initdata;
+boolean_param("acpi_skip_timer_override", acpi_skip_timer_override);
 
 #ifdef CONFIG_X86_LOCAL_APIC
 static u64 acpi_lapic_addr __initdata = APIC_DEFAULT_PHYS_BASE;
--- a/xen/arch/x86/setup.c
+++ b/xen/arch/x86/setup.c
@@ -71,10 +71,6 @@ static void parse_acpi_param(char *s);
 custom_param("acpi", parse_acpi_param);
 
 /* **** Linux config option: propagated to domain0. */
-/* acpi_skip_timer_override: Skip IRQ0 overrides. */
-boolean_param("acpi_skip_timer_override", acpi_skip_timer_override);
-
-/* **** Linux config option: propagated to domain0. */
 /* noapic: Disable IOAPIC setup. */
 boolean_param("noapic", skip_ioapic_setup);
 
@@ -1365,9 +1361,6 @@ void __init __start_xen(unsigned long mb
         /* Append any extra parameters. */
         if ( skip_ioapic_setup && !strstr(dom0_cmdline, "noapic") )
             safe_strcat(dom0_cmdline, " noapic");
-        if ( acpi_skip_timer_override &&
-             !strstr(dom0_cmdline, "acpi_skip_timer_override") )
-            safe_strcat(dom0_cmdline, " acpi_skip_timer_override");
         if ( (strlen(acpi_param) == 0) && acpi_disabled )
         {
             printk("ACPI is disabled, notifying Domain 0 (acpi=off)\n");
--- a/xen/include/asm-x86/acpi.h
+++ b/xen/include/asm-x86/acpi.h
@@ -80,7 +80,6 @@ int __acpi_release_global_lock(unsigned 
 
 extern bool_t acpi_lapic, acpi_ioapic, acpi_noirq;
 extern bool_t acpi_force, acpi_ht, acpi_disabled;
-extern bool_t acpi_skip_timer_override;
 extern u32 acpi_smi_cmd;
 extern u8 acpi_enable_value, acpi_disable_value;
 void acpi_pic_sci_set_trigger(unsigned int, u16);
++++++ 5315a43a-x86-ACPI-also-print-address-space-for-PM1x-fields.patch ++++++
# Commit 7acf827b951b4e8501a777676ddf050d200103a4
# Date 2014-03-04 11:00:26 +0100
# Author Jan Beulich 
# Committer Jan Beulich 
x86/ACPI: also print address space for PM1x fields

At least one vendor is in the process of making systems available where
these live in MMIO, not in I/O port space.

Signed-off-by: Jan Beulich 
Acked-by: Keir Fraser 

--- a/xen/arch/x86/acpi/boot.c
+++ b/xen/arch/x86/acpi/boot.c
@@ -404,11 +404,15 @@ acpi_fadt_parse_sleep_info(struct acpi_t
 	acpi_fadt_copy_address(pm1b_evt, pm1b_event, pm1_event);
 
 	printk(KERN_INFO PREFIX
-	       "SLEEP INFO: pm1x_cnt[%"PRIx64",%"PRIx64"], "
-	       "pm1x_evt[%"PRIx64",%"PRIx64"]\n",
+	       "SLEEP INFO: pm1x_cnt[%d:%"PRIx64",%d:%"PRIx64"], "
+	       "pm1x_evt[%d:%"PRIx64",%d:%"PRIx64"]\n",
+	       acpi_sinfo.pm1a_cnt_blk.space_id,
 	       acpi_sinfo.pm1a_cnt_blk.address,
+	       acpi_sinfo.pm1b_cnt_blk.space_id,
 	       acpi_sinfo.pm1b_cnt_blk.address,
+	       acpi_sinfo.pm1a_evt_blk.space_id,
 	       acpi_sinfo.pm1a_evt_blk.address,
+	       acpi_sinfo.pm1b_evt_blk.space_id,
 	       acpi_sinfo.pm1b_evt_blk.address);
 
 	/* Now FACS... */
++++++ 53299d8f-xenconsole-reset-tty-on-failure.patch ++++++
Subject: tools/console: reset tty when xenconsole fails
From: Ian Jackson ian.jackson@eu.citrix.com Mon Feb 24 15:16:19 2014 +0000
Date: Wed Mar 19 13:37:19 2014 +0000:
Git: 111931f36885874103d65685ab15ea3d25d93da7

If xenconsole (the client program) fails, it calls err.  This would
previously neglect to reset the user's terminal to sanity.  Use atexit
to do so.

This routinely happens in Xen 4.4 RC5 with pygrub because libxl
writes the value "" to the tty xenstore key when using xenconsole.
After this patch this just results in a harmless error message.

Reported-by: M A Young 
Signed-off-by: Ian Jackson 
CC: M A Young 
CC: Ian Campbell 
Acked-by: George Dunlap 
Acked-by: Ian Campbell 

---
v2: Fix whitespace error (reintroduce hard tab)
    Fix commit message not to claim ignorance about root cause

Index: xen-4.4.0-testing/tools/console/client/main.c
===================================================================
--- xen-4.4.0-testing.orig/tools/console/client/main.c
+++ xen-4.4.0-testing/tools/console/client/main.c
@@ -258,6 +258,13 @@ typedef enum {
        CONSOLE_SERIAL,
 } console_type;
 
+static struct termios stdin_old_attr;
+
+static void restore_term_stdin(void)
+{
+	restore_term(STDIN_FILENO, &stdin_old_attr);
+}
+
 int main(int argc, char **argv)
 {
 	struct termios attr;
@@ -384,9 +391,9 @@ int main(int argc, char **argv)
 	}
 
 	init_term(spty, &attr);
-	init_term(STDIN_FILENO, &attr);
+	init_term(STDIN_FILENO, &stdin_old_attr);
+	atexit(restore_term_stdin); /* if this fails, oh dear */
 	console_loop(spty, xs, path);
-	restore_term(STDIN_FILENO, &attr);
 
 	free(path);
 	free(dom_path);
++++++ 53299d8f-xenconsole-tolerate-tty-errors.patch ++++++
Subject: tools/console: xenconsole tolerate tty errors
From: Ian Jackson ian.jackson@eu.citrix.com Thu Feb 27 17:46:49 2014 +0000
Date: Wed Mar 19 13:37:19 2014 +0000:
Git: 39ba2989b10b6a1852e253b204eb010f8e7026f1

Since 28d386fc4341 (XSA-57), libxl writes an empty value for the
console tty node, with read-only permission for the guest, when
setting up pv console "frontends".  (The actual tty value is later set
by xenconsoled.)   Writing an empty node is not strictly necessary to
stop the frontend from writing dangerous values here, but it is a good
belt-and-braces approach.

Unfortunately this confuses xenconsole.  It reads the empty value, and
tries to open it as the tty.  xenconsole then exits.

Fix this by having xenconsole treat an empty value the same way as no
value at all.

Also, make the error opening the tty be nonfatal: we just print a
warning, but do not exit.  I think this is helpful in theoretical
situations where xenconsole is racing with libxl and/or xenconsoled.

Signed-off-by: Ian Jackson 
Acked-by: Ian Campbell 
CC: George Dunlap 

---
v2: Combine two conditions and move the free

Index: xen-4.4.0-testing/tools/console/client/main.c
===================================================================
--- xen-4.4.0-testing.orig/tools/console/client/main.c
+++ xen-4.4.0-testing/tools/console/client/main.c
@@ -115,12 +115,12 @@ static int get_pty_fd(struct xs_handle *
 			/* We only watch for one thing, so no need to 
 			 * disambiguate: just read the pty path */
 			pty_path = xs_read(xs, XBT_NULL, path, &len);
-			if (pty_path != NULL) {
+			if (pty_path != NULL && pty_path[0] != '\0') {
 				pty_fd = open(pty_path, O_RDWR | O_NOCTTY);
 				if (pty_fd == -1)
-					err(errno, "Could not open tty `%s'", pty_path);
-				free(pty_path);
+					warn("Could not open tty `%s'", pty_path);
 			}
+			free(pty_path);
 		}
 	} while (pty_fd == -1 && (now = time(NULL)) < start + seconds);
 
++++++ 5346a7a0-x86-AMD-support-further-feature-masking-MSRs.patch ++++++
# Commit e74de9c0b19f9bd16d658a96bf6c9ab9a2a639e9
# Date 2014-04-10 16:16:00 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/AMD: support further feature masking MSRs

Newer AMD CPUs also allow masking CPUID leaf 6 ECX and CPUID leaf 7
sub-leaf 0 EAX and EBX.

Signed-off-by: Jan Beulich 
Reviewed-by: Aravind Gopalakrishnan

Index: xen-4.4.3-testing/docs/misc/xen-command-line.markdown
===================================================================
--- xen-4.4.3-testing.orig/docs/misc/xen-command-line.markdown
+++ xen-4.4.3-testing/docs/misc/xen-command-line.markdown
@@ -318,24 +318,42 @@ Indicate where the responsibility for dr
 ### cpuid\_mask\_cpu (AMD only)
...
`= fam_0f_rev_c | fam_0f_rev_d | fam_0f_rev_e | fam_0f_rev_f | fam_0f_rev_g | fam_10_rev_b | fam_10_rev_c | fam_11_rev_b`
-If the other **cpuid\_mask\_{,ext\_}e{c,d}x** options are fully set
-(unspecified on the command line), specify a pre-canned cpuid mask to
-mask the current processor down to appear as the specified processor.
-It is important to ensure that all hosts in a pool appear the same to
-guests to allow successful live migration.
+If the other **cpuid\_mask\_{,ext\_,thermal\_,l7s0\_}e{a,b,c,d}x**
+options are fully set (unspecified on the command line), specify a
+pre-canned cpuid mask to mask the current processor down to appear as
+the specified processor. It is important to ensure that all hosts in a
+pool appear the same to guests to allow successful live migration.
 
-### cpuid\_mask\_ ecx,edx,ext\_ecx,ext\_edx,xsave_eax
+### cpuid\_mask\_{{,ext\_}ecx,edx}
...
`= <integer>`
...
Default: `~0` (all bits set)
-These five command line parameters are used to specify cpuid masks to
+These four command line parameters are used to specify cpuid masks to
 help with cpuid levelling across a pool of hosts.  Setting a bit in
 the mask indicates that the feature should be enabled, while clearing
 a bit in the mask indicates that the feature should be disabled.  It
 is important to ensure that all hosts in a pool appear the same to
 guests to allow successful live migration.
 
+### cpuid\_mask\_xsave\_eax (Intel only)
+> `= <integer>`
+
+> Default: `~0` (all bits set)
+
+This command line parameter is also used to specify a cpuid mask to
+help with cpuid levelling across a pool of hosts.  See the description
+of the other respective options above.
+
+### cpuid\_mask\_{l7s0\_{eax,ebx},thermal\_ecx} (AMD only)
+> `= <integer>`
+
+> Default: `~0` (all bits set)
+
+These three command line parameters are also used to specify cpuid
+masks to help with cpuid levelling across a pool of hosts.  See the
+description of the other respective options above.
+
 ### cpuidle
...
`= <boolean>`
Index: xen-4.4.3-testing/xen/arch/x86/cpu/amd.c
===================================================================
--- xen-4.4.3-testing.orig/xen/arch/x86/cpu/amd.c
+++ xen-4.4.3-testing/xen/arch/x86/cpu/amd.c
@@ -30,9 +30,17 @@
  * "fam_10_rev_c"
  * "fam_11_rev_b"
  */
-static char opt_famrev[14];
+static char __initdata opt_famrev[14];
 string_param("cpuid_mask_cpu", opt_famrev);
 
+static unsigned int __initdata opt_cpuid_mask_l7s0_eax = ~0u;
+integer_param("cpuid_mask_l7s0_eax", opt_cpuid_mask_l7s0_eax);
+static unsigned int __initdata opt_cpuid_mask_l7s0_ebx = ~0u;
+integer_param("cpuid_mask_l7s0_ebx", opt_cpuid_mask_l7s0_ebx);
+
+static unsigned int __initdata opt_cpuid_mask_thermal_ecx = ~0u;
+integer_param("cpuid_mask_thermal_ecx", opt_cpuid_mask_thermal_ecx);
+
 /* 1 = allow, 0 = don't allow guest creation, -1 = don't allow boot */
 s8 __read_mostly opt_allow_unsafe;
 boolean_param("allow_unsafe", opt_allow_unsafe);
@@ -96,7 +104,11 @@ static void __devinit set_cpuidmask(cons
 {
 	static unsigned int feat_ecx, feat_edx;
 	static unsigned int extfeat_ecx, extfeat_edx;
+	static unsigned int l7s0_eax, l7s0_ebx;
+	static unsigned int thermal_ecx;
+	static bool_t skip_l7s0_eax_ebx, skip_thermal_ecx;
 	static enum { not_parsed, no_mask, set_mask } status;
+	unsigned int eax, ebx, ecx, edx;
 
 	if (status == no_mask)
 		return;
@@ -104,7 +116,7 @@ static void __devinit set_cpuidmask(cons
 	if (status == set_mask)
 		goto setmask;
 
-	ASSERT((status == not_parsed) && (smp_processor_id() == 0));
+	ASSERT((status == not_parsed) && (c == &boot_cpu_data));
 	status = no_mask;
 
 	/* Fam11 doesn't support masking at all. */
@@ -112,11 +124,16 @@ static void __devinit set_cpuidmask(cons
 		return;
 
 	if (~(opt_cpuid_mask_ecx & opt_cpuid_mask_edx &
-	      opt_cpuid_mask_ext_ecx & opt_cpuid_mask_ext_edx)) {
+	      opt_cpuid_mask_ext_ecx & opt_cpuid_mask_ext_edx &
+	      opt_cpuid_mask_l7s0_eax & opt_cpuid_mask_l7s0_ebx &
+	      opt_cpuid_mask_thermal_ecx)) {
 		feat_ecx = opt_cpuid_mask_ecx;
 		feat_edx = opt_cpuid_mask_edx;
 		extfeat_ecx = opt_cpuid_mask_ext_ecx;
 		extfeat_edx = opt_cpuid_mask_ext_edx;
+		l7s0_eax = opt_cpuid_mask_l7s0_eax;
+		l7s0_ebx = opt_cpuid_mask_l7s0_ebx;
+		thermal_ecx = opt_cpuid_mask_thermal_ecx;
 	} else if (*opt_famrev == '\0') {
 		return;
 	} else if (!strcmp(opt_famrev, "fam_0f_rev_c")) {
@@ -179,11 +196,39 @@ static void __devinit set_cpuidmask(cons
 	printk("Writing CPUID extended feature mask ECX:EDX -> %08Xh:%08Xh\n", 
 	       extfeat_ecx, extfeat_edx);
 
+	if (c->cpuid_level >= 7)
+		cpuid_count(7, 0, &eax, &ebx, &ecx, &edx);
+	else
+		ebx = eax = 0;
+	if ((eax | ebx) && ~(l7s0_eax & l7s0_ebx)) {
+		if (l7s0_eax > eax)
+			l7s0_eax = eax;
+		l7s0_ebx &= ebx;
+		printk("Writing CPUID leaf 7 subleaf 0 feature mask EAX:EBX -> %08Xh:%08Xh\n",
+		       l7s0_eax, l7s0_ebx);
+	} else
+		skip_l7s0_eax_ebx = 1;
+
+	/* Only Fam15 has the respective MSR. */
+	ecx = c->x86 == 0x15 && c->cpuid_level >= 6 ? cpuid_ecx(6) : 0;
+	if (ecx && ~thermal_ecx) {
+		thermal_ecx &= ecx;
+		printk("Writing CPUID thermal/power feature mask ECX -> %08Xh\n",
+		       thermal_ecx);
+	} else
+		skip_thermal_ecx = 1;
+
  setmask:
 	/* AMD processors prior to family 10h required a 32-bit password */
 	if (c->x86 >= 0x10) {
 		wrmsr(MSR_K8_FEATURE_MASK, feat_edx, feat_ecx);
 		wrmsr(MSR_K8_EXT_FEATURE_MASK, extfeat_edx, extfeat_ecx);
+		if (!skip_l7s0_eax_ebx)
+			wrmsr(MSR_AMD_L7S0_FEATURE_MASK, l7s0_ebx, l7s0_eax);
+		if (!skip_thermal_ecx) {
+			rdmsr(MSR_AMD_THRM_FEATURE_MASK, eax, edx);
+			wrmsr(MSR_AMD_THRM_FEATURE_MASK, thermal_ecx, edx);
+		}
 	} else {
 		wrmsr_amd(MSR_K8_FEATURE_MASK, feat_edx, feat_ecx);
 		wrmsr_amd(MSR_K8_EXT_FEATURE_MASK, extfeat_edx, extfeat_ecx);
Index: xen-4.4.3-testing/xen/include/asm-x86/msr-index.h
===================================================================
--- xen-4.4.3-testing.orig/xen/include/asm-x86/msr-index.h
+++ xen-4.4.3-testing/xen/include/asm-x86/msr-index.h
@@ -204,6 +204,8 @@
 #define MSR_AMD_FAM15H_EVNTSEL5		0xc001020a
 #define MSR_AMD_FAM15H_PERFCTR5		0xc001020b
 
+#define MSR_AMD_L7S0_FEATURE_MASK	0xc0011002
+#define MSR_AMD_THRM_FEATURE_MASK	0xc0011003
 #define MSR_K8_FEATURE_MASK		0xc0011004
 #define MSR_K8_EXT_FEATURE_MASK		0xc0011005
 
++++++ 53563ea4-x86-MSI-drop-workaround-for-insecure-Dom0-kernels.patch ++++++
# Commit 061eebe0e99ad45c9c3b1a778b06140de4a91f25
# Date 2014-04-22 12:04:20 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/MSI: drop workaround for insecure Dom0 kernels

Considering that
- the workaround is expensive (iterating through the entire P2M space
  of a domain),
- the planned elimination of the expensiveness (by propagating the type
  change step by step to the individual P2M leaves) wouldn't address
  the IOMMU side of things (as for it to obey to the changed
  permissions the adjustments must be pushed down immediately through
  the entire tree)
- the proper solution (PHYSDEVOP_msix_prepare) should by now be
  implemented by all security conscious Dom0 kernels
remove the workaround, killing eventual guests that would be known to
become a security risk instead.

Signed-off-by: Jan Beulich 
Acked-by: Kevin Tian 

Index: xen-4.4.3-testing/xen/arch/x86/mm/p2m-ept.c
===================================================================
--- xen-4.4.3-testing.orig/xen/arch/x86/mm/p2m-ept.c
+++ xen-4.4.3-testing/xen/arch/x86/mm/p2m-ept.c
@@ -680,7 +680,7 @@ static void ept_change_entry_type_global
         return;
 
     BUG_ON(p2m_is_grant(ot) || p2m_is_grant(nt));
-    BUG_ON(ot != nt && (ot == p2m_mmio_direct || nt == p2m_mmio_direct));
+    BUG_ON(p2m_is_mmio(ot) || p2m_is_mmio(nt));
 
     ept_change_entry_type_page(_mfn(ept_get_asr(ept)),
                                ept_get_wl(ept), ot, nt);
Index: xen-4.4.3-testing/xen/arch/x86/msi.c
===================================================================
--- xen-4.4.3-testing.orig/xen/arch/x86/msi.c
+++ xen-4.4.3-testing/xen/arch/x86/msi.c
@@ -832,32 +832,22 @@ static int msix_capability_init(struct p
                                 msix->pba.last) )
             WARN();
 
-        if ( dev->domain )
-            p2m_change_entry_type_global(dev->domain,
-                                         p2m_mmio_direct, p2m_mmio_direct);
-        if ( desc && (!dev->domain || !paging_mode_translate(dev->domain)) )
+        if ( desc )
         {
-            struct domain *d = dev->domain;
+            struct domain *currd = current->domain;
+            struct domain *d = dev->domain ?: currd;
 
-            if ( !d )
-                for_each_domain(d)
-                    if ( !paging_mode_translate(d) &&
-                         (iomem_access_permitted(d, msix->table.first,
-                                                 msix->table.last) ||
-                          iomem_access_permitted(d, msix->pba.first,
-                                                 msix->pba.last)) )
-                        break;
-            if ( d )
-            {
-                if ( !is_hardware_domain(d) && msix->warned != d->domain_id )
-                {
-                    msix->warned = d->domain_id;
-                    printk(XENLOG_ERR
-                           "Potentially insecure use of MSI-X on %04x:%02x:%02x.%u by Dom%d\n",
-                           seg, bus, slot, func, d->domain_id);
-                }
-                /* XXX How to deal with existing mappings? */
-            }
+            if ( !is_hardware_domain(currd) || d != currd )
+                printk("%s use of MSI-X on %04x:%02x:%02x.%u by Dom%d\n",
+                       is_hardware_domain(currd)
+                       ? XENLOG_WARNING "Potentially insecure"
+                       : XENLOG_ERR "Insecure",
+                       seg, bus, slot, func, d->domain_id);
+            if ( !is_hardware_domain(d) &&
+                 /* Assume a domain without memory has no mappings yet. */
+                 (!is_hardware_domain(currd) || d->tot_pages) )
+                domain_crash(d);
+            /* XXX How to deal with existing mappings? */
         }
     }
     WARN_ON(msix->nr_entries != nr_entries);
++++++ 537c790d-fix-memory-leak-in-libxl_cpuid_dispose.patch ++++++
Subject: libxl: fix memory leak in libxl_cpuid_dispose
From: Wei Liu wei.liu2@citrix.com Tue May 13 22:53:48 2014 +0100
Date: Wed May 21 10:59:41 2014 +0100:
Git: e620f2dfa5ef288efcae0995cbf197bd79c364b6

libxl_cpuid_policy_list is not allocated with GC-aware allocation so it
needs to be freed manually, just like what libxl_string_list_dispose and
libxl_key_value_list_dispose do.

Signed-off-by: Wei Liu 
Acked-by: Ian Campbell 

Index: xen-4.4.3-testing/tools/libxl/libxl_cpuid.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl_cpuid.c
+++ xen-4.4.3-testing/tools/libxl/libxl_cpuid.c
@@ -26,6 +26,7 @@ void libxl_cpuid_dispose(libxl_cpuid_pol
             if (cpuid_list[i].policy[j] != NULL)
                 free(cpuid_list[i].policy[j]);
     }
+    free(cpuid_list);
     return;
 }
 
++++++ 537cd0b0-hvmloader-also-cover-PCI-MMIO-ranges-above-4G-with-UC-MTRR-ranges.patch ++++++
# Commit d06886694328a31369addc1f614cf326728d65a6
# Date 2014-05-21 18:13:36 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
hvmloader: also cover PCI MMIO ranges above 4G with UC MTRR ranges

When adding support for BAR assignments to addresses above 4G, the MTRR
side of things was left out.

Additionally the MMIO ranges in the DSDT's \_SB.PCI0._CRS were having
memory types not matching the ones put into MTRRs: The legacy VGA range
is supposed to be WC, and the other ones should be UC.

Signed-off-by: Jan Beulich 
Acked-by: Ian Campbell 

# Commit 119d8a42d3bfe6ebc1785720e1a7260e5c698632
# Date 2014-05-22 14:20:19 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
hvmloader: fix build with certain iasl versions

While most of them support what we have now, Wheezy's dislikes the
empty range. Put a fake one in place - it's getting overwritten upon
evaluation of _CRS anyway.

The range could be grown (downwards) if necessary; the way it is now
it is
- the highest possible one below the 36-bit boundary (with 36 bits
  being the lowest common denominator for all supported systems),
- the smallest possible one that said iasl accepts.

Reported-by: Sander Eikelenboom 
Signed-off-by: Jan Beulich 
Acked-by: Ian Campbell 

# Commit 7f8d8abcf6dfb85fae591a547b24f9b27d92272c
# Date 2014-05-28 10:57:18 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
hvmloader: don't use AML operations on 64-bit fields

WinXP and Win2K3, while having no problem with the QWordMemory resource
(there was another one there before), don't like operations on 64-bit
fields. Split the fields d0688669 ("hvmloader: also cover PCI MMIO
ranges above 4G with UC MTRR ranges") added to 32-bit ones, handling
carry over explicitly.

Sadly the constructs needed to create the sub-fields - nominally

    CreateDWordField(PRT0, \_SB.PCI0._CRS._Y02._MIN, MINL)
    CreateDWordField(PRT0, Add(\_SB.PCI0._CRS._Y02._MIN, 4), MINH)

- can't be used: The former gets warned upon by newer iasl, i.e. would
need to be replaced by the latter just with the addend changed to 0,
and the latter doesn't translate properly with recent iasl). Hence,
short of having an ASL/iasl expert at hand, we need to work around the
shortcomings of various iasl versions. See the code comment.

Signed-off-by: Jan Beulich 
Acked-by: Ian Campbell 

Index: xen-4.4.3-testing/tools/firmware/hvmloader/acpi/build.c
===================================================================
--- xen-4.4.3-testing.orig/tools/firmware/hvmloader/acpi/build.c
+++ xen-4.4.3-testing/tools/firmware/hvmloader/acpi/build.c
@@ -51,6 +51,7 @@ struct acpi_info {
     uint32_t madt_csum_addr;    /* 12   - Address of MADT checksum */
     uint32_t madt_lapic0_addr;  /* 16   - Address of first MADT LAPIC struct */
     uint32_t vm_gid_addr;       /* 20   - Address of VM generation id buffer */
+    uint64_t pci_hi_min, pci_hi_len; /* 24, 32 - PCI I/O hole boundaries */
 };
 
 /* Number of processor objects in the chosen DSDT. */
@@ -525,6 +526,11 @@ void acpi_build_tables(struct acpi_confi
     acpi_info->hpet_present = hpet_exists(ACPI_HPET_ADDRESS);
     acpi_info->pci_min = pci_mem_start;
     acpi_info->pci_len = pci_mem_end - pci_mem_start;
+    if ( pci_hi_mem_end > pci_hi_mem_start )
+    {
+        acpi_info->pci_hi_min = pci_hi_mem_start;
+        acpi_info->pci_hi_len = pci_hi_mem_end - pci_hi_mem_start;
+    }
 
     return;
 
Index: xen-4.4.3-testing/tools/firmware/hvmloader/acpi/dsdt.asl
===================================================================
--- xen-4.4.3-testing.orig/tools/firmware/hvmloader/acpi/dsdt.asl
+++ xen-4.4.3-testing/tools/firmware/hvmloader/acpi/dsdt.asl
@@ -45,7 +45,7 @@ DefinitionBlock ("DSDT.aml", "DSDT", 2,
     Scope (\_SB)
     {
        /* ACPI_INFO_PHYSICAL_ADDRESS == 0xFC000000 */
-       OperationRegion(BIOS, SystemMemory, 0xFC000000, 24)
+       OperationRegion(BIOS, SystemMemory, 0xFC000000, 40)
        Field(BIOS, ByteAcc, NoLock, Preserve) {
            UAR1, 1,
            UAR2, 1,
@@ -56,7 +56,11 @@ DefinitionBlock ("DSDT.aml", "DSDT", 2,
            PLEN, 32,
            MSUA, 32, /* MADT checksum address */
            MAPA, 32, /* MADT LAPIC0 address */
-           VGIA, 32  /* VM generation id address */
+           VGIA, 32, /* VM generation id address */
+           LMIN, 32,
+           HMIN, 32,
+           LLEN, 32,
+           HLEN, 32
        }
 
         /* Fix HCT test for 0x400 pci memory:
@@ -136,7 +140,7 @@ DefinitionBlock ("DSDT.aml", "DSDT", 2,
                     /* reserve memory for pci devices */
                     DWordMemory(
                         ResourceProducer, PosDecode, MinFixed, MaxFixed,
-                        Cacheable, ReadWrite,
+                        WriteCombining, ReadWrite,
                         0x00000000,
                         0x000A0000,
                         0x000BFFFF,
@@ -145,13 +149,24 @@ DefinitionBlock ("DSDT.aml", "DSDT", 2,
 
                     DWordMemory(
                         ResourceProducer, PosDecode, MinFixed, MaxFixed,
-                        Cacheable, ReadWrite,
+                        NonCacheable, ReadWrite,
                         0x00000000,
                         0xF0000000,
                         0xF4FFFFFF,
                         0x00000000,
                         0x05000000,
                         ,, _Y01)
+
+                    QWordMemory (
+                        ResourceProducer, PosDecode, MinFixed, MaxFixed,
+                        NonCacheable, ReadWrite,
+                        0x0000000000000000,
+                        0x0000000FFFFFFFF0,
+                        0x0000000FFFFFFFFF,
+                        0x0000000000000000,
+                        0x0000000000000010,
+                        ,, _Y02)
+
                 })
 
                 CreateDWordField(PRT0, \_SB.PCI0._CRS._Y01._MIN, MMIN)
@@ -163,6 +178,43 @@ DefinitionBlock ("DSDT.aml", "DSDT", 2,
                 Add(MMIN, MLEN, MMAX)
                 Subtract(MMAX, One, MMAX)
 
+                /*
+                 * WinXP / Win2K3 blue-screen for operations on 64-bit values.
+                 * Therefore we need to split the 64-bit calculations needed
+                 * here, but different iasl versions evaluate name references
+                 * to integers differently:
+                 * Year (approximate)          2006    2008    2012
+                 * \_SB.PCI0._CRS._Y02         zero   valid   valid
+                 * \_SB.PCI0._CRS._Y02._MIN   valid   valid    huge
+                 */
+                If(LEqual(Zero, \_SB.PCI0._CRS._Y02)) {
+                    Subtract(\_SB.PCI0._CRS._Y02._MIN, 14, Local0)
+                } Else {
+                    Store(\_SB.PCI0._CRS._Y02, Local0)
+                }
+                CreateDWordField(PRT0, Add(Local0, 14), MINL)
+                CreateDWordField(PRT0, Add(Local0, 18), MINH)
+                CreateDWordField(PRT0, Add(Local0, 22), MAXL)
+                CreateDWordField(PRT0, Add(Local0, 26), MAXH)
+                CreateDWordField(PRT0, Add(Local0, 38), LENL)
+                CreateDWordField(PRT0, Add(Local0, 42), LENH)
+
+                Store(\_SB.LMIN, MINL)
+                Store(\_SB.HMIN, MINH)
+                Store(\_SB.LLEN, LENL)
+                Store(\_SB.HLEN, LENH)
+                Add(MINL, LENL, MAXL)
+                Add(MINH, LENH, MAXH)
+                If(LLess(MAXL, MINL)) {
+                    Add(MAXH, One, MAXH)
+                }
+                If(LOr(MINH, LENL)) {
+                    If(LEqual(MAXL, 0)) {
+                        Subtract(MAXH, One, MAXH)
+                    }
+                    Subtract(MAXL, One, MAXL)
+                }
+
                 Return (PRT0)
             }
 
Index: xen-4.4.3-testing/tools/firmware/hvmloader/cacheattr.c
===================================================================
--- xen-4.4.3-testing.orig/tools/firmware/hvmloader/cacheattr.c
+++ xen-4.4.3-testing/tools/firmware/hvmloader/cacheattr.c
@@ -97,8 +97,7 @@ void cacheattr_init(void)
     nr_var_ranges = (uint8_t)mtrr_cap;
     if ( nr_var_ranges != 0 )
     {
-        unsigned long base = pci_mem_start, size;
-        int i;
+        uint64_t base = pci_mem_start, size;
 
         for ( i = 0; (base != pci_mem_end) && (i < nr_var_ranges); i++ )
         {
@@ -109,8 +108,22 @@ void cacheattr_init(void)
                 size >>= 1;
 
             wrmsr(MSR_MTRRphysBase(i), base);
-            wrmsr(MSR_MTRRphysMask(i),
-                  (~(uint64_t)(size-1) & addr_mask) | (1u << 11));
+            wrmsr(MSR_MTRRphysMask(i), (~(size - 1) & addr_mask) | (1u << 11));
+
+            base += size;
+        }
+
+        for ( base = pci_hi_mem_start;
+              (base != pci_hi_mem_end) && (i < nr_var_ranges); i++ )
+        {
+            size = PAGE_SIZE;
+            while ( !(base & size) )
+                size <<= 1;
+            while ( (base + size < base) || (base + size > pci_hi_mem_end) )
+                size >>= 1;
+
+            wrmsr(MSR_MTRRphysBase(i), base);
+            wrmsr(MSR_MTRRphysMask(i), (~(size - 1) & addr_mask) | (1u << 11));
 
             base += size;
         }
Index: xen-4.4.3-testing/tools/firmware/hvmloader/config.h
===================================================================
--- xen-4.4.3-testing.orig/tools/firmware/hvmloader/config.h
+++ xen-4.4.3-testing/tools/firmware/hvmloader/config.h
@@ -57,7 +57,7 @@ extern struct bios_config ovmf_config;
 #define PCI_MEM_END         0xfc000000
 
 extern unsigned long pci_mem_start, pci_mem_end;
-
+extern uint64_t pci_hi_mem_start, pci_hi_mem_end;
 
 /* Memory map. */
 #define SCRATCH_PHYSICAL_ADDRESS      0x00010000
Index: xen-4.4.3-testing/tools/firmware/hvmloader/pci.c
===================================================================
--- xen-4.4.3-testing.orig/tools/firmware/hvmloader/pci.c
+++ xen-4.4.3-testing/tools/firmware/hvmloader/pci.c
@@ -32,6 +32,7 @@
 
 unsigned long pci_mem_start = PCI_MEM_START;
 unsigned long pci_mem_end = PCI_MEM_END;
+uint64_t pci_hi_mem_start = 0, pci_hi_mem_end = 0;
 
 enum virtual_vga virtual_vga = VGA_none;
 unsigned long igd_opregion_pgbase = 0;
@@ -359,9 +360,8 @@ void pci_setup(void)
                 if ( high_mem_resource.base & (bar_sz - 1) )
                     high_mem_resource.base = high_mem_resource.base - 
                         (high_mem_resource.base & (bar_sz - 1)) + bar_sz;
-                else
-                    high_mem_resource.base = high_mem_resource.base - 
-                        (high_mem_resource.base & (bar_sz - 1));
+                if ( !pci_hi_mem_start )
+                    pci_hi_mem_start = high_mem_resource.base;
                 resource = &high_mem_resource;
                 bar_data &= ~PCI_BASE_ADDRESS_MEM_MASK;
             } 
@@ -412,6 +412,16 @@ void pci_setup(void)
         pci_writew(devfn, PCI_COMMAND, cmd);
     }
 
+    if ( pci_hi_mem_start )
+    {
+        /*
+         * Make end address alignment match the start address one's so that
+         * fewer variable range MTRRs are needed to cover the range.
+         */
+        pci_hi_mem_end = ((high_mem_resource.base - 1) |
+                          ((pci_hi_mem_start & -pci_hi_mem_start) - 1)) + 1;
+    }
+
     if ( vga_devfn != 256 )
     {
         /*
++++++ 537cd0cc-hvmloader-PA-range-0xfc000000-0xffffffff-should-be-UC.patch ++++++
# Commit c22bd567ce22f6ad9bd93318ad0d7fd1c2eadb0d
# Date 2014-05-21 18:14:04 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
hvmloader: PA range 0xfc000000-0xffffffff should be UC

Rather than leaving the range from PCI_MEM_END (0xfc000000) to 4G
uncovered, we should include this in the UC range created for the (low)
PCI range. Besides being more correct, this also has the advantage that
with the way pci_setup() currently works the range will always be
mappable with a single variable range MTRR (rather than from 2 to 5
depending on how much the lower boundary gets shifted down to
accommodate all devices).

Signed-off-by: Jan Beulich 
Acked-by: Ian Campbell 

--- a/tools/firmware/hvmloader/cacheattr.c
+++ b/tools/firmware/hvmloader/cacheattr.c
@@ -99,12 +99,12 @@ void cacheattr_init(void)
     {
         uint64_t base = pci_mem_start, size;
 
-        for ( i = 0; (base != pci_mem_end) && (i < nr_var_ranges); i++ )
+        for ( i = 0; !(base >> 32) && (i < nr_var_ranges); i++ )
         {
             size = PAGE_SIZE;
             while ( !(base & size) )
                 size <<= 1;
-            while ( ((base + size) < base) || ((base + size) > pci_mem_end) )
+            while ( ((base + size) < base) || ((base + size - 1) >> 32) )
                 size >>= 1;
 
             wrmsr(MSR_MTRRphysBase(i), base);
++++++ 538c7df7-libxenstat-handle-renamed-vifs.patch ++++++
Subject: libxenstat: handle renamed VIFs
From: Jacek Konieczny jajcus@jajcus.net Fri May 23 14:47:21 2014 +0200
Date: Mon Jun 2 14:36:55 2014 +0100:
Git: b2a332bfde7aff580f461a1d81b5340573d556d1

Before trying to parse network interface name as 'vif*.*'
try to get the domid and network number from sysfs.

Fixes xentop output for domains with VIF renamed through the
'vifname' xl option.

Signed-off-by: Jacek Konieczny 
Acked-by: Ian Campbell 

Index: xen-4.4.1-testing/tools/xenstat/libxenstat/src/xenstat_linux.c
===================================================================
--- xen-4.4.1-testing.orig/tools/xenstat/libxenstat/src/xenstat_linux.c
+++ xen-4.4.1-testing/tools/xenstat/libxenstat/src/xenstat_linux.c
@@ -235,6 +235,29 @@ int parseNetDevLine(char *line, char *if
 	return 0;
 }
 
+/* Find out the domid and network number given an interface name.
+ * Return 0 if the iface cannot be recognized as a Xen VIF. */
+static int get_iface_domid_network(const char *iface, unsigned int *domid_p, unsigned int *netid_p)
+{
+	char nodename_path[48];
+	FILE * nodename_file;
+	int ret;
+
+	snprintf(nodename_path, 48, "/sys/class/net/%s/device/nodename", iface);
+	nodename_file = fopen(nodename_path, "r");
+	if (nodename_file != NULL) {
+		ret = fscanf(nodename_file, "backend/vif/%u/%u", domid_p, netid_p);
+		fclose(nodename_file);
+		if (ret == 2)
+			return 1;
+	}
+
+	if (sscanf(iface, "vif%u.%u", domid_p, netid_p) == 2)
+		return 1;
+
+	return 0;
+}
+
 /* Collect information about networks */
 int xenstat_collect_networks(xenstat_node * node)
 {
@@ -311,8 +334,7 @@ int xenstat_collect_networks(xenstat_nod
 			}
 		}
 		else /* Otherwise we need to preserve old behaviour */
-		if (strstr(iface, "vif") != NULL) {
-			sscanf(iface, "vif%u.%u", &domid, &net.id);
+		if (get_iface_domid_network(iface, &domid, &net.id)) {
 
 			net.tbytes = txBytes;
 			net.tpackets = txPackets;
++++++ 539ebe62-x86-EFI-improve-boot-time-diagnostics.patch ++++++
# Commit ebbb51dc8c1790e5187442a808003298b6796762
# Date 2014-06-16 11:52:34 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/EFI: improve boot time diagnostics

To aid analysis of eventual errors, print EFI status codes with error
messages where available. Also remove a case where the status gets
stored into a local variable without being used examined (which mis-
guided me to add an error check there in try 1 of this patch).

Signed-off-by: Jan Beulich 

Index: xen-4.4.3-testing/xen/arch/x86/efi/boot.c
===================================================================
--- xen-4.4.3-testing.orig/xen/arch/x86/efi/boot.c
+++ xen-4.4.3-testing/xen/arch/x86/efi/boot.c
@@ -355,11 +355,12 @@ static EFI_FILE_HANDLE __init get_parent
         ret = efi_bs->HandleProtocol(loaded_image->DeviceHandle,
                                      &fs_protocol, (void **)&fio);
         if ( EFI_ERROR(ret) )
-            blexit(L"Couldn't obtain the File System Protocol Interface");
+            PrintErrMesg(L"Couldn't obtain the File System Protocol Interface",
+                         ret);
         ret = fio->OpenVolume(fio, &dir_handle);
     } while ( ret == EFI_MEDIA_CHANGED );
     if ( ret != EFI_SUCCESS )
-        blexit(L"OpenVolume failure");
+        PrintErrMesg(L"OpenVolume failure", ret);
 
 #define buffer ((CHAR16 *)keyhandler_scratch)
 #define BUFFERSIZE sizeof(keyhandler_scratch)
@@ -982,8 +983,8 @@ efi_start(EFI_HANDLE ImageHandle, EFI_SY
 
     if ( !EFI_ERROR(efi_bs->LocateProtocol(&shim_lock_guid, NULL,
                     (void **)&shim_lock)) &&
-         shim_lock->Verify(kernel.ptr, kernel.size) != EFI_SUCCESS )
-        blexit(L"Dom0 kernel image could not be verified.");
+         (status = shim_lock->Verify(kernel.ptr, kernel.size)) != EFI_SUCCESS )
+        PrintErrMesg(L"Dom0 kernel image could not be verified", status);
 
     name.s = get_value(&cfg, section.s, "ramdisk");
     if ( name.s )
++++++ 53aac342-x86-HVM-consolidate-and-sanitize-CR4-guest-reserved-bit-determination.patch ++++++
# Commit dab11417da4e21f43625f4ebbb68158f07003d04
# Date 2014-06-25 14:40:34 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/HVM: consolidate and sanitize CR4 guest reserved bit determination

First of all, this is needed by just a single source file, so it gets
moved there instead of getting fed to the compiler for most other
source files too. With that it becomes sensible for this to no longer
be a macro, allowing elimination of the mostly redundant helpers
hvm_vcpu_has_{smep,smap}(). And finally, following the model SMEP and
SMAP already used, tie the determination of reserved bits to the
features the guest is shown rather than the host's.

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 

Index: xen-4.4.2-testing/xen/arch/x86/hvm/hvm.c
===================================================================
--- xen-4.4.2-testing.orig/xen/arch/x86/hvm/hvm.c
+++ xen-4.4.2-testing/xen/arch/x86/hvm/hvm.c
@@ -827,6 +827,73 @@ static bool_t hvm_efer_valid(struct doma
              ((value & (EFER_LME|EFER_LMA)) == EFER_LMA));
 }
 
+/* These reserved bits in lower 32 remain 0 after any load of CR0 */
+#define HVM_CR0_GUEST_RESERVED_BITS             \
+    (~((unsigned long)                          \
+       (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM |  \
+        X86_CR0_TS | X86_CR0_ET | X86_CR0_NE |  \
+        X86_CR0_WP | X86_CR0_AM | X86_CR0_NW |  \
+        X86_CR0_CD | X86_CR0_PG)))
+
+/* These bits in CR4 cannot be set by the guest. */
+static unsigned long hvm_cr4_guest_reserved_bits(const struct vcpu *v,
+                                                 bool_t restore)
+{
+    unsigned int leaf1_ecx = 0, leaf1_edx = 0;
+    unsigned int leaf7_0_ebx = 0, leaf7_0_ecx = 0;
+
+    if ( likely(!restore) )
+    {
+        unsigned int level;
+
+        ASSERT(v == current);
+        hvm_cpuid(0, &level, NULL, NULL, NULL);
+        if ( level >= 1 )
+            hvm_cpuid(1, NULL, NULL, &leaf1_ecx, &leaf1_edx);
+        if ( level >= 7 )
+            hvm_cpuid(7, NULL, &leaf7_0_ebx, &leaf7_0_ecx, NULL);
+    }
+    else
+    {
+        leaf1_edx = boot_cpu_data.x86_capability[X86_FEATURE_VME / 32];
+        leaf1_ecx = boot_cpu_data.x86_capability[X86_FEATURE_PCID / 32];
+        leaf7_0_ebx = boot_cpu_data.x86_capability[X86_FEATURE_FSGSBASE / 32];
+    }
+
+    return ~(unsigned long)
+            ((leaf1_edx & cpufeat_mask(X86_FEATURE_VME) ?
+              X86_CR4_VME | X86_CR4_PVI : 0) |
+             (leaf1_edx & cpufeat_mask(X86_FEATURE_TSC) ?
+              X86_CR4_TSD : 0) |
+             (leaf1_edx & cpufeat_mask(X86_FEATURE_DE) ?
+              X86_CR4_DE : 0) |
+             (leaf1_edx & cpufeat_mask(X86_FEATURE_PSE) ?
+              X86_CR4_PSE : 0) |
+             (leaf1_edx & cpufeat_mask(X86_FEATURE_PAE) ?
+              X86_CR4_PAE : 0) |
+             (leaf1_edx & (cpufeat_mask(X86_FEATURE_MCE) |
+                           cpufeat_mask(X86_FEATURE_MCA)) ?
+              X86_CR4_MCE : 0) |
+             (leaf1_edx & cpufeat_mask(X86_FEATURE_PGE) ?
+              X86_CR4_PGE : 0) |
+             X86_CR4_PCE |
+             (leaf1_edx & cpufeat_mask(X86_FEATURE_FXSR) ?
+              X86_CR4_OSFXSR : 0) |
+             (leaf1_edx & cpufeat_mask(X86_FEATURE_XMM) ?
+              X86_CR4_OSXMMEXCPT : 0) |
+             ((restore || nestedhvm_enabled(v->domain)) &&
+              (leaf1_ecx & cpufeat_mask(X86_FEATURE_VMXE)) ?
+              X86_CR4_VMXE : 0) |
+             (leaf7_0_ebx & cpufeat_mask(X86_FEATURE_FSGSBASE) ?
+              X86_CR4_FSGSBASE : 0) |
+             (leaf1_ecx & cpufeat_mask(X86_FEATURE_PCID) ?
+              X86_CR4_PCIDE : 0) |
+             (leaf1_ecx & cpufeat_mask(X86_FEATURE_XSAVE) ?
+              X86_CR4_OSXSAVE : 0) |
+             (leaf7_0_ebx & cpufeat_mask(X86_FEATURE_SMEP) ?
+              X86_CR4_SMEP : 0));
+}
+
 static int hvm_load_cpu_ctxt(struct domain *d, hvm_domain_context_t *h)
 {
     int vcpuid;
@@ -857,7 +924,7 @@ static int hvm_load_cpu_ctxt(struct doma
         return -EINVAL;
     }
 
-    if ( ctxt.cr4 & HVM_CR4_GUEST_RESERVED_BITS(v, 1) )
+    if ( ctxt.cr4 & hvm_cr4_guest_reserved_bits(v, 1) )
     {
         printk(XENLOG_G_ERR "HVM%d restore: bad CR4 %#" PRIx64 "\n",
                d->domain_id, ctxt.cr4);
@@ -1990,7 +2057,7 @@ int hvm_set_cr4(unsigned long value)
     struct vcpu *v = current;
     unsigned long old_cr;
 
-    if ( value & HVM_CR4_GUEST_RESERVED_BITS(v, 0) )
+    if ( value & hvm_cr4_guest_reserved_bits(v, 0) )
     {
         HVM_DBG_LOG(DBG_LEVEL_1,
                     "Guest attempts to set reserved bit in CR4: %lx",
Index: xen-4.4.2-testing/xen/include/asm-x86/hvm/hvm.h
===================================================================
--- xen-4.4.2-testing.orig/xen/include/asm-x86/hvm/hvm.h
+++ xen-4.4.2-testing/xen/include/asm-x86/hvm/hvm.h
@@ -347,51 +347,10 @@ static inline int hvm_event_pending(stru
     return hvm_funcs.event_pending(v);
 }
 
-static inline bool_t hvm_vcpu_has_smep(void)
-{
-    unsigned int eax, ebx;
-
-    hvm_cpuid(0, &eax, NULL, NULL, NULL);
-
-    if ( eax < 7 )
-        return 0;
-
-    hvm_cpuid(7, NULL, &ebx, NULL, NULL);
-    return !!(ebx & cpufeat_mask(X86_FEATURE_SMEP));
-}
-
-/* These reserved bits in lower 32 remain 0 after any load of CR0 */
-#define HVM_CR0_GUEST_RESERVED_BITS             \
-    (~((unsigned long)                          \
-       (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM |  \
-        X86_CR0_TS | X86_CR0_ET | X86_CR0_NE |  \
-        X86_CR0_WP | X86_CR0_AM | X86_CR0_NW |  \
-        X86_CR0_CD | X86_CR0_PG)))
-
 /* These bits in CR4 are owned by the host. */
 #define HVM_CR4_HOST_MASK (mmu_cr4_features & \
     (X86_CR4_VMXE | X86_CR4_PAE | X86_CR4_MCE))
 
-/* These bits in CR4 cannot be set by the guest. */
-#define HVM_CR4_GUEST_RESERVED_BITS(v, restore) ({      \
-    const struct vcpu *_v = (v);                        \
-    bool_t _restore = !!(restore);                      \
-    ASSERT((_restore) || _v == current);                \
-    (~((unsigned long)                                  \
-       (X86_CR4_VME | X86_CR4_PVI | X86_CR4_TSD |       \
-        X86_CR4_DE  | X86_CR4_PSE | X86_CR4_PAE |       \
-        X86_CR4_MCE | X86_CR4_PGE | X86_CR4_PCE |       \
-        X86_CR4_OSFXSR | X86_CR4_OSXMMEXCPT |           \
-        (((_restore) ? cpu_has_smep :                   \
-                       hvm_vcpu_has_smep()) ?           \
-         X86_CR4_SMEP : 0) |                            \
-        (cpu_has_fsgsbase ? X86_CR4_FSGSBASE : 0) |     \
-        ((nestedhvm_enabled(_v->domain) && cpu_has_vmx) \
-                      ? X86_CR4_VMXE : 0)  |            \
-        (cpu_has_pcid ? X86_CR4_PCIDE : 0) |            \
-        (cpu_has_xsave ? X86_CR4_OSXSAVE : 0))));       \
-})
-
 /* These exceptions must always be intercepted. */
 #define HVM_TRAP_MASK ((1U << TRAP_machine_check) | (1U << TRAP_invalid_op))
 
++++++ 53c9151b-Fix-xl-vncviewer-accesses-port-0-by-any-invalid-domid.patch ++++++
Subject: xl: 'xl vncviewer' accesses port 0 by any invalid domid
From: Chunyan Liu cyliu@suse.com Fri Jul 18 14:18:04 2014 +0800
Date: Fri Jul 18 13:37:47 2014 +0100:
Git: 2a8cc1a55329ead252ed323ec4bbee534d5c0f23

Currently, with command:
  xl vncviewer invalid_domid
it always brings user to the domU using vncport 5900.
The invalid domid could be an non-existing one or Dom0.
It's better to report error in this case.

Correct libxl_vncviewer_exec:
  In existing code, when vncport is NULL, it still continues
  and will show vncport 5900. So, with 'xl vncviewer 0' it also
  wrongly shows domU using vncport 5900. Correct it to report error
  if vncport is NULL.

Signed-off-by: Chunyan Liu 
Acked-by: Ian Campbell 

Index: xen-4.4.3-testing/tools/libxl/libxl.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl.c
+++ xen-4.4.3-testing/tools/libxl/libxl.c
@@ -1641,8 +1641,12 @@ int libxl_vncviewer_exec(libxl_ctx *ctx,
     vnc_port = libxl__xs_read(gc, XBT_NULL,
                             libxl__sprintf(gc,
                             "/local/domain/%d/console/vnc-port", domid));
-    if ( vnc_port )
-        port = atoi(vnc_port) - 5900;
+    if (!vnc_port) {
+        LOG(ERROR, "Cannot get vnc-port of domain %d", domid);
+        goto x_fail;
+    }
+
+    port = atoi(vnc_port) - 5900;
 
     vnc_listen = libxl__xs_read(gc, XBT_NULL,
                                 libxl__sprintf(gc,
++++++ 53d124e7-fix-list_domain_details-check-config-data-length-0.patch ++++++
...
From ef8cf0d4902c90595a0b0766e2a9a6ecbcbc4581 Mon Sep 17 00:00:00 2001
From: Chunyan Liu 
Date: Wed, 23 Jul 2014 17:42:09 +0800
Subject: [PATCH] fix list_domain_details: check config data length=0
If domain is created through virsh, then in xl, one could see it
with 'xl list', but with 'xl list --long domU', it reports:
"Domain name must be specified."
The reason is xl config data does not exist but it still tries
to parse_config_data in current code.

Improve list_domain_details:
If len of config data is 0, just pass, do not go forward to
parse_config_data, otherwise, it will meet error like
"Domain name not specified" and exit. This error is not expected,
since if code enters list_domain_details, domain name validness
is already checked and domain does exist.

Length of config data is 0 may means: config data does not exist due
to some reason, like: domain is created by libvirt, or in destroying
domain process config data is cleared but domain fails to clean up.
No matter in which case, list_domain_details could just show empty
info, but not error like "Domain name not specified".

Signed-off-by: Chunyan Liu 
Acked-by: Ian Jackson 
---
 tools/libxl/xl_cmdimpl.c | 2 ++
 1 file changed, 2 insertions(+)

--- a/tools/libxl/xl_cmdimpl.c
+++ b/tools/libxl/xl_cmdimpl.c
@@ -3200,6 +3200,8 @@ static void list_domains_details(const l
         rc = libxl_userdata_retrieve(ctx, info[i].domid, "xl", &data, &len);
         if (rc)
             continue;
+        if (len == 0)
+            continue;
         CHK_SYSCALL(asprintf(&config_source, "", info[i].domid));
         libxl_domain_config_init(&d_config);
         parse_config_data(config_source, (char *)data, len, &d_config, NULL);
++++++ 53dba447-x86-ACPI-allow-CMOS-RTC-use-even-when-ACPI-says-there-is-none.patch ++++++
References: bnc#883112

# Commit e9425f05b90811458a08355a55a0b0d608c440cf
# Date 2014-08-01 16:29:27 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/ACPI: allow CMOS RTC use even when ACPI says there is none

HP is setting the ACPI_FADT_NO_CMOS_RTC flag on newer systems,
regardless of whether they're being booted from UEFI. Add a command
line option to allow probing for a working RTC in that case.

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 

Index: xen-4.4.2-testing/docs/misc/xen-command-line.markdown
===================================================================
--- xen-4.4.2-testing.orig/docs/misc/xen-command-line.markdown
+++ xen-4.4.2-testing/docs/misc/xen-command-line.markdown
@@ -210,6 +210,14 @@ If set, override Xen's calculation of th
 
 If set, override Xen's default choice for the platform timer.
 
+### cmos-rtc-probe
+> `= <boolean>`
+
+> Default: `false`
+
+Flag to indicate whether to probe for a CMOS Real Time Clock irrespective of
+ACPI indicating none to be there.
+
 ### com1,com2
...
`= <baud>[/][,[DPS][,[<io-base>|pci|amt][,[<irq>][,[<port-bdf>][,[<bridge-bdf>]]]]]]`
Index: xen-4.4.2-testing/xen/arch/x86/time.c
===================================================================
--- xen-4.4.2-testing.orig/xen/arch/x86/time.c
+++ xen-4.4.2-testing/xen/arch/x86/time.c
@@ -651,37 +651,40 @@ mktime (unsigned int year, unsigned int
         )*60 + sec; /* finally seconds */
 }
 
-static unsigned long __get_cmos_time(void)
-{
+struct rtc_time {
     unsigned int year, mon, day, hour, min, sec;
+};
 
-    sec  = CMOS_READ(RTC_SECONDS);
-    min  = CMOS_READ(RTC_MINUTES);
-    hour = CMOS_READ(RTC_HOURS);
-    day  = CMOS_READ(RTC_DAY_OF_MONTH);
-    mon  = CMOS_READ(RTC_MONTH);
-    year = CMOS_READ(RTC_YEAR);
+static void __get_cmos_time(struct rtc_time *rtc)
+{
+    rtc->sec  = CMOS_READ(RTC_SECONDS);
+    rtc->min  = CMOS_READ(RTC_MINUTES);
+    rtc->hour = CMOS_READ(RTC_HOURS);
+    rtc->day  = CMOS_READ(RTC_DAY_OF_MONTH);
+    rtc->mon  = CMOS_READ(RTC_MONTH);
+    rtc->year = CMOS_READ(RTC_YEAR);
     
     if ( !(CMOS_READ(RTC_CONTROL) & RTC_DM_BINARY) || RTC_ALWAYS_BCD )
     {
-        BCD_TO_BIN(sec);
-        BCD_TO_BIN(min);
-        BCD_TO_BIN(hour);
-        BCD_TO_BIN(day);
-        BCD_TO_BIN(mon);
-        BCD_TO_BIN(year);
+        BCD_TO_BIN(rtc->sec);
+        BCD_TO_BIN(rtc->min);
+        BCD_TO_BIN(rtc->hour);
+        BCD_TO_BIN(rtc->day);
+        BCD_TO_BIN(rtc->mon);
+        BCD_TO_BIN(rtc->year);
     }
 
-    if ( (year += 1900) < 1970 )
-        year += 100;
-
-    return mktime(year, mon, day, hour, min, sec);
+    if ( (rtc->year += 1900) < 1970 )
+        rtc->year += 100;
 }
 
 static unsigned long get_cmos_time(void)
 {
     unsigned long res, flags;
-    int i;
+    struct rtc_time rtc;
+    unsigned int seconds = 60;
+    static bool_t __read_mostly cmos_rtc_probe;
+    boolean_param("cmos-rtc-probe", cmos_rtc_probe);
 
     if ( efi_enabled )
     {
@@ -690,23 +693,58 @@ static unsigned long get_cmos_time(void)
             return res;
     }
 
-    if ( unlikely(acpi_gbl_FADT.boot_flags & ACPI_FADT_NO_CMOS_RTC) )
-        panic("System without CMOS RTC must be booted from EFI");
+    if ( likely(!(acpi_gbl_FADT.boot_flags & ACPI_FADT_NO_CMOS_RTC)) )
+        cmos_rtc_probe = 0;
+    else if ( system_state < SYS_STATE_active && !cmos_rtc_probe )
+        panic("System with no CMOS RTC advertised must be booted from EFI"
+              " (or with command line option \"cmos-rtc-probe\")");
+
+    for ( ; ; )
+    {
+        s_time_t start, t1, t2;
 
-    spin_lock_irqsave(&rtc_lock, flags);
+        spin_lock_irqsave(&rtc_lock, flags);
 
-    /* read RTC exactly on falling edge of update flag */
-    for ( i = 0 ; i < 1000000 ; i++ ) /* may take up to 1 second... */
-        if ( (CMOS_READ(RTC_FREQ_SELECT) & RTC_UIP) )
+        /* read RTC exactly on falling edge of update flag */
+        start = NOW();
+        do { /* may take up to 1 second... */
+            t1 = NOW() - start;
+        } while ( !(CMOS_READ(RTC_FREQ_SELECT) & RTC_UIP) &&
+                  t1 <= SECONDS(1) );
+
+        start = NOW();
+        do { /* must try at least 2.228 ms */
+            t2 = NOW() - start;
+        } while ( (CMOS_READ(RTC_FREQ_SELECT) & RTC_UIP) &&
+                  t2 < MILLISECS(3) );
+
+        __get_cmos_time(&rtc);
+
+        spin_unlock_irqrestore(&rtc_lock, flags);
+
+        if ( likely(!cmos_rtc_probe) ||
+             t1 > SECONDS(1) || t2 >= MILLISECS(3) ||
+             rtc.sec >= 60 || rtc.min >= 60 || rtc.hour >= 24 ||
+             !rtc.day || rtc.day > 31 ||
+             !rtc.mon || rtc.mon > 12 )
             break;
-    for ( i = 0 ; i < 1000000 ; i++ ) /* must try at least 2.228 ms */
-        if ( !(CMOS_READ(RTC_FREQ_SELECT) & RTC_UIP) )
+
+        if ( seconds < 60 )
+        {
+            if ( rtc.sec != seconds )
+                cmos_rtc_probe = 0;
             break;
+        }
+
+        process_pending_softirqs();
+
+        seconds = rtc.sec;
+    }
 
-    res = __get_cmos_time();
+    if ( unlikely(cmos_rtc_probe) )
+        panic("No CMOS RTC found - system must be booted from EFI");
 
-    spin_unlock_irqrestore(&rtc_lock, flags);
-    return res;
+    return mktime(rtc.year, rtc.mon, rtc.day, rtc.hour, rtc.min, rtc.sec);
 }
 
 /***************************************************************************
++++++ 53df727b-x86-HVM-extend-LAPIC-shortcuts-around-P2M-lookups.patch ++++++
References: bnc#882089

# Commit fd1863847af15c3676348447755e1a1801f9d394
# Date 2014-08-04 13:46:03 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/HVM: extend LAPIC shortcuts around P2M lookups

... to all internally handled MMIO regions. It is in particular the
HPET page that, e.g. on Windows Server 2012 R2, can get heavily
accessed, and hence avoiding the unnecessary lookups is rather
beneficial (in the reported case a 40+-vCPU guest would previously not
have booted at all while with hvm_hap_nested_page_fault() shortcut
alone it was able to boot up in 18 minutes [i.e. still room for
improvement]).

Note the apparently unrelated addition of a is_hvm_vcpu() check to the
__hvm_copy() code: Afaict for PVH this shortcut should never have taken
effect (since there's no LAPIC in that case).

Signed-off-by: Jan Beulich 
Reviewed-by: Tim Deegan 


Index: xen-4.4.2-testing/xen/arch/x86/hvm/hvm.c
===================================================================
--- xen-4.4.2-testing.orig/xen/arch/x86/hvm/hvm.c
+++ xen-4.4.2-testing/xen/arch/x86/hvm/hvm.c
@@ -1530,11 +1530,14 @@ int hvm_hap_nested_page_fault(paddr_t gp
         }
     }
 
-    /* For the benefit of 32-bit WinXP (& older Windows) on AMD CPUs,
-     * a fast path for LAPIC accesses, skipping the p2m lookup. */
+    /*
+     * No need to do the P2M lookup for internally handled MMIO, benefiting
+     * - 32-bit WinXP (& older Windows) on AMD CPUs for LAPIC accesses,
+     * - newer Windows (like Server 2012) for HPET accesses.
+     */
     if ( !nestedhvm_vcpu_in_guestmode(v)
          && is_hvm_vcpu(v)
-         && gfn == PFN_DOWN(vlapic_base_address(vcpu_vlapic(v))) )
+         && hvm_mmio_internal(gpa) )
     {
         if ( !handle_mmio() )
             hvm_inject_hw_exception(TRAP_gp_fault, 0);
@@ -2653,7 +2656,9 @@ static enum hvm_copy_result __hvm_copy(
 
     while ( todo > 0 )
     {
-        count = min_t(int, PAGE_SIZE - (addr & ~PAGE_MASK), todo);
+        paddr_t gpa = addr & ~PAGE_MASK;
+
+        count = min_t(int, PAGE_SIZE - gpa, todo);
 
         if ( flags & HVMCOPY_virt )
         {
@@ -2668,16 +2673,22 @@ static enum hvm_copy_result __hvm_copy(
                     hvm_inject_page_fault(pfec, addr);
                 return HVMCOPY_bad_gva_to_gfn;
             }
+            gpa |= (paddr_t)gfn << PAGE_SHIFT;
         }
         else
         {
             gfn = addr >> PAGE_SHIFT;
+            gpa = addr;
         }
 
-        /* For the benefit of 32-bit WinXP (& older Windows) on AMD CPUs,
-         * a fast path for LAPIC accesses, skipping the p2m lookup. */
+        /*
+         * No need to do the P2M lookup for internally handled MMIO, benefiting
+         * - 32-bit WinXP (& older Windows) on AMD CPUs for LAPIC accesses,
+         * - newer Windows (like Server 2012) for HPET accesses.
+         */
         if ( !nestedhvm_vcpu_in_guestmode(curr)
-             && gfn == PFN_DOWN(vlapic_base_address(vcpu_vlapic(curr))) )
+             && is_hvm_vcpu(curr)
+             && hvm_mmio_internal(gpa) )
             return HVMCOPY_bad_gfn_to_mfn;
 
         page = get_page_from_gfn(curr->domain, gfn, &p2mt, P2M_UNSHARE);
Index: xen-4.4.2-testing/xen/arch/x86/hvm/intercept.c
===================================================================
--- xen-4.4.2-testing.orig/xen/arch/x86/hvm/intercept.c
+++ xen-4.4.2-testing/xen/arch/x86/hvm/intercept.c
@@ -163,6 +163,18 @@ static int hvm_mmio_access(struct vcpu *
     return rc;
 }
 
+bool_t hvm_mmio_internal(paddr_t gpa)
+{
+    struct vcpu *curr = current;
+    unsigned int i;
+
+    for ( i = 0; i < HVM_MMIO_HANDLER_NR; ++i )
+        if ( hvm_mmio_handlers[i]->check_handler(curr, gpa) )
+            return 1;
+
+    return 0;
+}
+
 int hvm_mmio_intercept(ioreq_t *p)
 {
     struct vcpu *v = current;
Index: xen-4.4.2-testing/xen/include/asm-x86/hvm/io.h
===================================================================
--- xen-4.4.2-testing.orig/xen/include/asm-x86/hvm/io.h
+++ xen-4.4.2-testing/xen/include/asm-x86/hvm/io.h
@@ -91,6 +91,7 @@ static inline int hvm_buffered_io_interc
     return hvm_io_intercept(p, HVM_BUFFERED_IO);
 }
 
+bool_t hvm_mmio_internal(paddr_t gpa);
 int hvm_mmio_intercept(ioreq_t *p);
 int hvm_buffered_io_send(ioreq_t *p);
 
++++++ 53e8be5f-x86-vHPET-use-rwlock-instead-of-simple-one.patch ++++++
References: bnc#882089

# Commit ded2100990d1688b96c2edc7221887c56c1a8e04
# Date 2014-08-11 15:00:15 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/vHPET: use rwlock instead of simple one

This namely benefits guests heavily reading the main counter, but not
touching the HPET much otherwise. Note that due to the way
hpet_get_comparator() works hpet_read() has to special cases reads from
the comparator registers and use a write lock there instead of the read
one used for all other registers.

Signed-off-by: Jan Beulich 

--- a/xen/arch/x86/hvm/hpet.c
+++ b/xen/arch/x86/hvm/hpet.c
@@ -75,7 +75,7 @@
 
 static inline uint64_t hpet_read_maincounter(HPETState *h)
 {
-    ASSERT(spin_is_locked(&h->lock));
+    ASSERT(rw_is_locked(&h->lock));
 
     if ( hpet_enabled(h) )
         return guest_time_hpet(h) + h->mc_offset;
@@ -88,6 +88,8 @@ static uint64_t hpet_get_comparator(HPET
     uint64_t comparator;
     uint64_t elapsed;
 
+    ASSERT(rw_is_write_locked(&h->lock));
+
     comparator = h->hpet.comparator64[tn];
     if ( timer_is_periodic(h, tn) )
     {
@@ -172,16 +174,24 @@ static int hpet_read(
         goto out;
     }
 
-    spin_lock(&h->lock);
+    result = addr < HPET_Tn_CMP(0) ||
+             ((addr - HPET_Tn_CMP(0)) % (HPET_Tn_CMP(1) - HPET_Tn_CMP(0))) > 7;
+    if ( result )
+        read_lock(&h->lock);
+    else
+        write_lock(&h->lock);
 
     val = hpet_read64(h, addr);
 
+    if ( result )
+        read_unlock(&h->lock);
+    else
+        write_unlock(&h->lock);
+
     result = val;
     if ( length != 8 )
         result = (val >> ((addr & 7) * 8)) & ((1ULL << (length * 8)) - 1);
 
-    spin_unlock(&h->lock);
-
  out:
     *pval = result;
     return X86EMUL_OKAY;
@@ -190,7 +200,7 @@ static int hpet_read(
 static void hpet_stop_timer(HPETState *h, unsigned int tn)
 {
     ASSERT(tn < HPET_TIMER_NUM);
-    ASSERT(spin_is_locked(&h->lock));
+    ASSERT(rw_is_write_locked(&h->lock));
     destroy_periodic_time(&h->pt[tn]);
     /* read the comparator to get it updated so a read while stopped will
      * return the expected value. */
@@ -208,7 +218,7 @@ static void hpet_set_timer(HPETState *h,
     unsigned int oneshot;
 
     ASSERT(tn < HPET_TIMER_NUM);
-    ASSERT(spin_is_locked(&h->lock));
+    ASSERT(rw_is_write_locked(&h->lock));
 
     if ( (tn == 0) && (h->hpet.config & HPET_CFG_LEGACY) )
     {
@@ -289,7 +299,7 @@ static int hpet_write(
     if ( hpet_check_access_length(addr, length) != 0 )
         goto out;
 
-    spin_lock(&h->lock);
+    write_lock(&h->lock);
 
     old_val = hpet_read64(h, addr);
     new_val = val;
@@ -448,7 +458,7 @@ static int hpet_write(
 #undef set_start_timer
 #undef set_restart_timer
 
-    spin_unlock(&h->lock);
+    write_unlock(&h->lock);
 
  out:
     return X86EMUL_OKAY;
@@ -473,7 +483,7 @@ static int hpet_save(struct domain *d, h
     HPETState *hp = domain_vhpet(d);
     int rc;
 
-    spin_lock(&hp->lock);
+    write_lock(&hp->lock);
 
     /* Write the proper value into the main counter */
     hp->hpet.mc64 = hp->mc_offset + guest_time_hpet(hp);
@@ -507,7 +517,7 @@ static int hpet_save(struct domain *d, h
         rec->timers[2].cmp = hp->hpet.comparator64[2];
     }
 
-    spin_unlock(&hp->lock);
+    write_unlock(&hp->lock);
 
     return rc;
 }
@@ -519,12 +529,12 @@ static int hpet_load(struct domain *d, h
     uint64_t cmp;
     int i;
 
-    spin_lock(&hp->lock);
+    write_lock(&hp->lock);
 
     /* Reload the HPET registers */
     if ( _hvm_check_entry(h, HVM_SAVE_CODE(HPET), HVM_SAVE_LENGTH(HPET), 1) )
     {
-        spin_unlock(&hp->lock);
+        write_unlock(&hp->lock);
         return -EINVAL;
     }
 
@@ -564,7 +574,7 @@ static int hpet_load(struct domain *d, h
             if ( timer_enabled(hp, i) )
                 hpet_set_timer(hp, i);
 
-    spin_unlock(&hp->lock);
+    write_unlock(&hp->lock);
 
     return 0;
 }
@@ -578,7 +588,7 @@ void hpet_init(struct vcpu *v)
 
     memset(h, 0, sizeof(HPETState));
 
-    spin_lock_init(&h->lock);
+    rwlock_init(&h->lock);
 
     h->stime_freq = S_TO_NS;
 
@@ -607,14 +617,14 @@ void hpet_deinit(struct domain *d)
     int i;
     HPETState *h = domain_vhpet(d);
 
-    spin_lock(&h->lock);
+    write_lock(&h->lock);
 
     if ( hpet_enabled(h) )
         for ( i = 0; i < HPET_TIMER_NUM; i++ )
             if ( timer_enabled(h, i) )
                 hpet_stop_timer(h, i);
 
-    spin_unlock(&h->lock);
+    write_unlock(&h->lock);
 }
 
 void hpet_reset(struct domain *d)
--- a/xen/arch/x86/hvm/vpt.c
+++ b/xen/arch/x86/hvm/vpt.c
@@ -508,10 +508,10 @@ void pt_adjust_global_vcpu_target(struct
     pt_adjust_vcpu(&pl_time->vrtc.pt, v);
     spin_unlock(&pl_time->vrtc.lock);
 
-    spin_lock(&pl_time->vhpet.lock);
+    write_lock(&pl_time->vhpet.lock);
     for ( i = 0; i < HPET_TIMER_NUM; i++ )
         pt_adjust_vcpu(&pl_time->vhpet.pt[i], v);
-    spin_unlock(&pl_time->vhpet.lock);
+    write_unlock(&pl_time->vhpet.lock);
 }
 
 
--- a/xen/include/asm-x86/hvm/vpt.h
+++ b/xen/include/asm-x86/hvm/vpt.h
@@ -96,7 +96,7 @@ typedef struct HPETState {
     uint64_t hpet_to_ns_limit; /* max hpet ticks convertable to ns      */
     uint64_t mc_offset;
     struct periodic_time pt[HPET_TIMER_NUM];
-    spinlock_t lock;
+    rwlock_t lock;
 } HPETState;
 
 typedef struct RTCState {
++++++ 53fcebab-xen-pass-kernel-initrd-to-qemu.patch ++++++
Subject: xen: pass kernel initrd to qemu
From: Chunyan Liu cyliu@suse.com Mon Jul 7 14:34:33 2014 +0800
Date: Tue Aug 26 21:18:51 2014 +0100:
Git: 11dffa2359e8a2629490c14c029c7c7c777b3e47

xen side patch to support xen HVM direct kernel boot:
support 'kernel', 'ramdisk', 'cmdline' (and 'root', 'extra' as well
which would be deprecated later) in HVM config file, parse config file,
pass -kernel, -initrd, -append parameters to qemu.

Signed-off-by: Chunyan Liu 
Acked-by: Ian Campbell 

Index: xen-4.4.3-testing/docs/man/xl.cfg.pod.5
===================================================================
--- xen-4.4.3-testing.orig/docs/man/xl.cfg.pod.5
+++ xen-4.4.3-testing/docs/man/xl.cfg.pod.5
@@ -296,6 +296,37 @@ Action to take if the domain crashes.  D
 
 =back
 
+=head3 Direct Kernel Boot
+
+Direct kernel boot allows booting directly from a kernel and initrd
+stored in the host physical machine OS, allowing command line arguments
+to be passed directly. PV guest direct kernel boot is supported. HVM
+guest direct kernel boot is supported with limitation (it's supported
+when using qemu-xen and default BIOS 'seabios'; not supported in case of
+stubdom-dm and old rombios.)
+
+=over 4
+
+=item B
+
+Load the specified file as the kernel image.
+
+=item B
+
+Load the specified file as the ramdisk.
+
+=item B
+
+Append B to the kernel command line (Note: it is guest
+specific what meaning this has).
+
+=item B
+
+Append B<STRING> to the kernel command line. (Note: it is guest
+specific what meaning this has).
+
+=back
+
 =head3 Other Options
 
 =over 4
@@ -625,20 +656,12 @@ The following options apply only to Para
 
 =over 4
 
-=item B
-
-Load the specified file as the kernel image.  Either B<kernel> or
-B<bootloader> must be specified for PV guests.
-
-=item B
-
-Load the specified file as the ramdisk.
-
 =item B
 
 Run C<PROGRAM> to find the kernel image and ramdisk to use.  Normally
 C<PROGRAM> would be C<pygrub>, which is an emulation of
-grub/grub2/syslinux.
+grub/grub2/syslinux. Either B<kernel> or B<bootloader> must be specified
+for PV guests.
 
 =item B
 
@@ -646,16 +669,6 @@ Append B<ARG>s to the arguments to the B
 program. Alternatively if the argument is a simple string then it will
 be split into words at whitespace (this second option is deprecated).
 
-=item B
-
-Append B to the kernel command line (Note: it is guest
-specific what meaning this has).
-
-=item B
-
-Append B<STRING> to the kernel command line. Note: it is guest
-specific what meaning this has).
-
 =item B
 
 Selects whether to expose the host e820 (memory map) to the guest via
Index: xen-4.4.3-testing/tools/libxl/libxl.h
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl.h
+++ xen-4.4.3-testing/tools/libxl/libxl.h
@@ -445,6 +445,21 @@
 #define LIBXL_HAVE_NO_SUSPEND_RESUME 1
 #endif
 
+/*
+ * LIBXL_HAVE_BUILDINFO_KERNEL
+ *
+ * If this is defined, then the libxl_domain_build_info structure will
+ * contain 'kernel', 'ramdisk', 'cmdline' fields. 'kernel' is a string
+ * to indicate kernel image location, 'ramdisk' is a string to indicate
+ * ramdisk location, 'cmdline' is a string to indicate the paramters which
+ * would be appended to kernel image.
+ *
+ * Both PV guest and HVM guest can use these fields for direct kernel boot.
+ * But for compatibility reason, u.pv.kernel, u.pv.ramdisk and u.pv.cmdline
+ * still exist.
+ */
+#define LIBXL_HAVE_BUILDINFO_KERNEL 1
+
 /* Functions annotated with LIBXL_EXTERNAL_CALLERS_ONLY may not be
  * called from within libxl itself. Callers outside libxl, who
  * do not #include libxl_internal.h, are fine. */
Index: xen-4.4.3-testing/tools/libxl/libxl_bootloader.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl_bootloader.c
+++ xen-4.4.3-testing/tools/libxl/libxl_bootloader.c
@@ -56,12 +56,12 @@ static void make_bootloader_args(libxl__
 
     ARG(bootloader_path);
 
-    if (info->u.pv.kernel)
-        ARG(libxl__sprintf(gc, "--kernel=%s", info->u.pv.kernel));
-    if (info->u.pv.ramdisk)
-        ARG(libxl__sprintf(gc, "--ramdisk=%s", info->u.pv.ramdisk));
-    if (info->u.pv.cmdline && *info->u.pv.cmdline != '\0')
-        ARG(libxl__sprintf(gc, "--args=%s", info->u.pv.cmdline));
+    if (info->kernel)
+        ARG(libxl__sprintf(gc, "--kernel=%s", info->kernel));
+    if (info->ramdisk)
+        ARG(libxl__sprintf(gc, "--ramdisk=%s", info->ramdisk));
+    if (info->cmdline && *info->cmdline != '\0')
+        ARG(libxl__sprintf(gc, "--args=%s", info->cmdline));
 
     ARG(libxl__sprintf(gc, "--output=%s", bl->outputpath));
     ARG("--output-format=simple0");
@@ -325,9 +325,9 @@ void libxl__bootloader_run(libxl__egc *e
 
     if (!info->u.pv.bootloader) {
         LOG(DEBUG, "no bootloader configured, using user supplied kernel");
-        bl->kernel->path = bl->info->u.pv.kernel;
-        bl->ramdisk->path = bl->info->u.pv.ramdisk;
-        bl->cmdline = bl->info->u.pv.cmdline;
+        bl->kernel->path = bl->info->kernel;
+        bl->ramdisk->path = bl->info->ramdisk;
+        bl->cmdline = bl->info->cmdline;
         rc = 0;
         goto out_ok;
     }
Index: xen-4.4.3-testing/tools/libxl/libxl_create.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl_create.c
+++ xen-4.4.3-testing/tools/libxl/libxl_create.c
@@ -345,6 +345,25 @@ int libxl__domain_build_info_setdefault(
             b_info->shadow_memkb = 0;
         if (b_info->u.pv.slack_memkb == LIBXL_MEMKB_DEFAULT)
             b_info->u.pv.slack_memkb = 0;
+
+        /* For compatibility, fill in b_info->kernel|ramdisk|cmdline
+         * with the value in u.pv, later processing will use
+         * b_info->kernel|ramdisk|cmdline only.
+         * User with old APIs that passes u.pv.kernel|ramdisk|cmdline
+         * is not affected.
+         */
+        if (!b_info->kernel && b_info->u.pv.kernel) {
+            b_info->kernel = b_info->u.pv.kernel;
+            b_info->u.pv.kernel = NULL;
+        }
+        if (!b_info->ramdisk && b_info->u.pv.ramdisk) {
+            b_info->ramdisk = b_info->u.pv.ramdisk;
+            b_info->u.pv.ramdisk = NULL;
+        }
+        if (!b_info->cmdline && b_info->u.pv.cmdline) {
+            b_info->cmdline = b_info->u.pv.cmdline;
+            b_info->u.pv.cmdline = NULL;
+        }
         break;
     default:
         LIBXL__LOG(CTX, LIBXL__LOG_ERROR,
Index: xen-4.4.3-testing/tools/libxl/libxl_dm.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl_dm.c
+++ xen-4.4.3-testing/tools/libxl/libxl_dm.c
@@ -205,6 +205,12 @@ static char ** libxl__build_device_model
         int nr_set_cpus = 0;
         char *s;
 
+        if (b_info->kernel) {
+            LOG(ERROR, "HVM direct kernel boot is not supported by "
+                "qemu-xen-traditional");
+            return NULL;
+        }
+
         if (b_info->u.hvm.serial) {
             flexarray_vappend(dm_args, "-serial", b_info->u.hvm.serial, NULL);
         }
@@ -503,6 +509,15 @@ static char ** libxl__build_device_model
     if (b_info->type == LIBXL_DOMAIN_TYPE_HVM) {
         int ioemu_nics = 0;
 
+        if (b_info->kernel)
+            flexarray_vappend(dm_args, "-kernel", b_info->kernel, NULL);
+
+        if (b_info->ramdisk)
+            flexarray_vappend(dm_args, "-initrd", b_info->ramdisk, NULL);
+
+        if (b_info->cmdline)
+            flexarray_vappend(dm_args, "-append", b_info->cmdline, NULL);
+
         if (b_info->u.hvm.serial) {
             flexarray_vappend(dm_args, "-serial", b_info->u.hvm.serial, NULL);
         }
Index: xen-4.4.3-testing/tools/libxl/libxl_types.idl
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl_types.idl
+++ xen-4.4.3-testing/tools/libxl/libxl_types.idl
@@ -334,6 +334,9 @@ libxl_domain_build_info = Struct("domain
     ("iomem",            Array(libxl_iomem_range, "num_iomem")),
     ("claim_mode",	     libxl_defbool),
     ("event_channels",   uint32),
+    ("kernel",           string),
+    ("cmdline",          string),
+    ("ramdisk",          string),
     ("u", KeyedUnion(None, libxl_domain_type, "type",
                 [("hvm", Struct(None, [("firmware",         string),
                                        ("bios",             libxl_bios_type),
Index: xen-4.4.3-testing/tools/libxl/xl_cmdimpl.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/xl_cmdimpl.c
+++ xen-4.4.3-testing/tools/libxl/xl_cmdimpl.c
@@ -721,6 +721,29 @@ static void parse_top_level_vnc_options(
     xlu_cfg_get_defbool(config, "vncunused", &vnc->findunused, 0);
 }
 
+static char *parse_cmdline(XLU_Config *config)
+{
+    char *cmdline = NULL;
+    const char *root = NULL, *extra = "";
+
+    xlu_cfg_get_string (config, "root", &root, 0);
+    xlu_cfg_get_string (config, "extra", &extra, 0);
+
+    if (root) {
+        if (asprintf(&cmdline, "root=%s %s", root, extra) == -1)
+            cmdline = NULL;
+    } else {
+        cmdline = strdup(extra);
+    }
+
+    if ((root || extra) && !cmdline) {
+        fprintf(stderr, "Failed to allocate memory for cmdline\n");
+        exit(1);
+    }
+
+    return cmdline;
+}
+
 static void parse_config_data(const char *config_source,
                               const char *config_data,
                               int config_len,
@@ -998,13 +1021,21 @@ static void parse_config_data(const char
     if (!xlu_cfg_get_long(config, "max_event_channels", &l, 0))
         b_info->event_channels = l;
 
+    xlu_cfg_replace_string (config, "kernel", &b_info->kernel, 0);
+    xlu_cfg_replace_string (config, "ramdisk", &b_info->ramdisk, 0);
+    b_info->cmdline = parse_cmdline(config);
+
     xlu_cfg_get_defbool(config, "driver_domain", &c_info->driver_domain, 0);
 
     switch(b_info->type) {
     case LIBXL_DOMAIN_TYPE_HVM:
-        if (!xlu_cfg_get_string (config, "kernel", &buf, 0))
-            fprintf(stderr, "WARNING: ignoring \"kernel\" directive for HVM guest. "
-                    "Use \"firmware_override\" instead if you really want a non-default firmware\n");
+        if (!strcmp(libxl_basename(b_info->kernel), "hvmloader")) {
+            fprintf(stderr, "WARNING: you seem to be using \"kernel\" "
+                    "directive to override HVM guest firmware. Ignore "
+                    "that. Use \"firmware_override\" instead if you "
+                    "really want a non-default firmware\n");
+            b_info->kernel = NULL;
+        }
 
         xlu_cfg_replace_string (config, "firmware_override",
                                 &b_info->u.hvm.firmware, 0);
@@ -1056,26 +1087,6 @@ static void parse_config_data(const char
         break;
     case LIBXL_DOMAIN_TYPE_PV:
     {
-        char *cmdline = NULL;
-        const char *root = NULL, *extra = "";
-
-        xlu_cfg_replace_string (config, "kernel", &b_info->u.pv.kernel, 0);
-
-        xlu_cfg_get_string (config, "root", &root, 0);
-        xlu_cfg_get_string (config, "extra", &extra, 0);
-
-        if (root) {
-            if (asprintf(&cmdline, "root=%s %s", root, extra) == -1)
-                cmdline = NULL;
-        } else {
-            cmdline = strdup(extra);
-        }
-
-        if ((root || extra) && !cmdline) {
-            fprintf(stderr, "Failed to allocate memory for cmdline\n");
-            exit(1);
-        }
-
         xlu_cfg_replace_string (config, "bootloader", &b_info->u.pv.bootloader, 0);
         switch (xlu_cfg_get_list_as_string_list(config, "bootloader_args",
                                       &b_info->u.pv.bootloader_args, 1))
@@ -1098,13 +1109,11 @@ static void parse_config_data(const char
             exit(-ERROR_FAIL);
         }
 
-        if (!b_info->u.pv.bootloader && !b_info->u.pv.kernel) {
+        if (!b_info->u.pv.bootloader && !b_info->kernel) {
             fprintf(stderr, "Neither kernel nor bootloader specified\n");
             exit(1);
         }
 
-        b_info->u.pv.cmdline = cmdline;
-        xlu_cfg_replace_string (config, "ramdisk", &b_info->u.pv.ramdisk, 0);
         break;
     }
     default:
++++++ 53ff3659-x86-consolidate-boolean-inputs-in-hvm-and-p2m.patch ++++++
References: bnc#882089

# Commit 3d4d4f9336159f3f77a7b480ce9984fd3ff7949f
# Date 2014-08-28 16:02:01 +0200
# Author Tamas K Lengyel 
# Committer Jan Beulich 
x86: consolidate boolean inputs in hvm and p2m into a shared bitmap

This patch consolidates the boolean input parameters of
hvm_hap_nested_page_fault and p2m_mem_access_check into a common bitmap
and defines the bitmap members accordingly.

Signed-off-by: Tamas K Lengyel 
Reviewed-by: Jan Beulich 
Acked-by: Kevin Tian 
Reviewed-by: Tim Deegan 

# Commit 24857896a30105b7947e2cd36d63768054538bbc
# Date 2014-09-03 15:06:06 +0200
# Author Andrew Cooper 
# Committer Jan Beulich 
x86/hvm: fix operator precedence bug introduced by 3d4d4f9336

Bitwise or has greater precedence than the ternary operator, making the result
of the expression a constant P2M_UNSHARE.

Coverity-ID: 1234633
Signed-off-by: Andrew Cooper 
Signed-off-by: Jan Beulich 
Reviewed-by: Don Slutz 

Index: xen-4.4.2-testing/xen/arch/x86/hvm/hvm.c
===================================================================
--- xen-4.4.2-testing.orig/xen/arch/x86/hvm/hvm.c
+++ xen-4.4.2-testing/xen/arch/x86/hvm/hvm.c
@@ -1473,12 +1473,8 @@ void hvm_inject_page_fault(int errcode,
     hvm_inject_trap(&trap);
 }
 
-int hvm_hap_nested_page_fault(paddr_t gpa,
-                              bool_t gla_valid,
-                              unsigned long gla,
-                              bool_t access_r,
-                              bool_t access_w,
-                              bool_t access_x)
+int hvm_hap_nested_page_fault(paddr_t gpa, unsigned long gla,
+                              struct npfec npfec)
 {
     unsigned long gfn = gpa >> PAGE_SHIFT;
     p2m_type_t p2mt;
@@ -1507,8 +1503,11 @@ int hvm_hap_nested_page_fault(paddr_t gp
          * into l1 guest if not fixable. The algorithm is
          * the same as for shadow paging.
          */
-        rv = nestedhvm_hap_nested_page_fault(v, &gpa,
-                                             access_r, access_w, access_x);
+
+         rv = nestedhvm_hap_nested_page_fault(v, &gpa,
+                                              npfec.read_access,
+                                              npfec.write_access,
+                                              npfec.insn_fetch);
         switch (rv) {
         case NESTEDHVM_PAGEFAULT_DONE:
         case NESTEDHVM_PAGEFAULT_RETRY:
@@ -1547,47 +1546,49 @@ int hvm_hap_nested_page_fault(paddr_t gp
 
     p2m = p2m_get_hostp2m(v->domain);
     mfn = get_gfn_type_access(p2m, gfn, &p2mt, &p2ma, 
-                              P2M_ALLOC | (access_w ? P2M_UNSHARE : 0), NULL);
+                              P2M_ALLOC | (npfec.write_access ? P2M_UNSHARE : 0),
+                              NULL);
 
     /* Check access permissions first, then handle faults */
     if ( mfn_x(mfn) != INVALID_MFN )
     {
-        int violation = 0;
+        bool_t violation;
+
         /* If the access is against the permissions, then send to mem_event */
-        switch (p2ma) 
+        switch (p2ma)
         {
         case p2m_access_n:
         case p2m_access_n2rwx:
         default:
-            violation = access_r || access_w || access_x;
+            violation = npfec.read_access || npfec.write_access || npfec.insn_fetch;
             break;
         case p2m_access_r:
-            violation = access_w || access_x;
+            violation = npfec.write_access || npfec.insn_fetch;
             break;
         case p2m_access_w:
-            violation = access_r || access_x;
+            violation = npfec.read_access || npfec.insn_fetch;
             break;
         case p2m_access_x:
-            violation = access_r || access_w;
+            violation = npfec.read_access || npfec.write_access;
             break;
         case p2m_access_rx:
         case p2m_access_rx2rw:
-            violation = access_w;
+            violation = npfec.write_access;
             break;
         case p2m_access_wx:
-            violation = access_r;
+            violation = npfec.read_access;
             break;
         case p2m_access_rw:
-            violation = access_x;
+            violation = npfec.insn_fetch;
             break;
         case p2m_access_rwx:
+            violation = 0;
             break;
         }
 
         if ( violation )
         {
-            if ( p2m_mem_access_check(gpa, gla_valid, gla, access_r, 
-                                        access_w, access_x, &req_ptr) )
+            if ( p2m_mem_access_check(gpa, gla, npfec, &req_ptr) )
             {
                 fall_through = 1;
             } else {
@@ -1603,7 +1604,7 @@ int hvm_hap_nested_page_fault(paddr_t gp
      * to the mmio handler.
      */
     if ( (p2mt == p2m_mmio_dm) || 
-         (access_w && (p2mt == p2m_ram_ro)) )
+         (npfec.write_access && (p2mt == p2m_ram_ro)) )
     {
         put_gfn(p2m->domain, gfn);
 
@@ -1622,7 +1623,7 @@ int hvm_hap_nested_page_fault(paddr_t gp
         paged = 1;
 
     /* Mem sharing: unshare the page and try again */
-    if ( access_w && (p2mt == p2m_ram_shared) )
+    if ( npfec.write_access && (p2mt == p2m_ram_shared) )
     {
         ASSERT(!p2m_is_nestedp2m(p2m));
         sharing_enomem = 
@@ -1639,7 +1640,7 @@ int hvm_hap_nested_page_fault(paddr_t gp
          * a large page, we do not change other pages type within that large
          * page.
          */
-        if ( access_w )
+        if ( npfec.write_access )
         {
             paging_mark_dirty(v->domain, mfn_x(mfn));
             p2m_change_type(v->domain, gfn, p2m_ram_logdirty, p2m_ram_rw);
@@ -1649,7 +1650,7 @@ int hvm_hap_nested_page_fault(paddr_t gp
     }
 
     /* Shouldn't happen: Maybe the guest was writing to a r/o grant mapping? */
-    if ( access_w && (p2mt == p2m_grant_map_ro) )
+    if ( npfec.write_access && (p2mt == p2m_grant_map_ro) )
     {
         gdprintk(XENLOG_WARNING,
                  "trying to write to read-only grant mapping\n");
Index: xen-4.4.2-testing/xen/arch/x86/hvm/svm/svm.c
===================================================================
--- xen-4.4.2-testing.orig/xen/arch/x86/hvm/svm/svm.c
+++ xen-4.4.2-testing/xen/arch/x86/hvm/svm/svm.c
@@ -1298,7 +1298,7 @@ const struct hvm_function_table * __init
 }
 
 static void svm_do_nested_pgfault(struct vcpu *v,
-    struct cpu_user_regs *regs, uint32_t npfec, paddr_t gpa)
+    struct cpu_user_regs *regs, uint32_t pfec, paddr_t gpa)
 {
     int ret;
     unsigned long gfn = gpa >> PAGE_SHIFT;
@@ -1307,10 +1307,13 @@ static void svm_do_nested_pgfault(struct
     p2m_access_t p2ma;
     struct p2m_domain *p2m = NULL;
 
-    ret = hvm_hap_nested_page_fault(gpa, 0, ~0ul, 
-                                    1, /* All NPFs count as reads */
-                                    npfec & PFEC_write_access, 
-                                    npfec & PFEC_insn_fetch);
+    struct npfec npfec = {
+        .read_access = 1, /* All NPFs count as reads */
+        .write_access = !!(pfec & PFEC_write_access),
+        .insn_fetch = !!(pfec & PFEC_insn_fetch)
+    };
+
+    ret = hvm_hap_nested_page_fault(gpa, ~0ul, npfec);
 
     if ( tb_init_done )
     {
@@ -1338,7 +1341,7 @@ static void svm_do_nested_pgfault(struct
     case -1:
         ASSERT(nestedhvm_enabled(v->domain) && nestedhvm_vcpu_in_guestmode(v));
         /* inject #VMEXIT(NPF) into guest. */
-        nestedsvm_vmexit_defer(v, VMEXIT_NPF, npfec, gpa);
+        nestedsvm_vmexit_defer(v, VMEXIT_NPF, pfec, gpa);
         return;
     }
 
Index: xen-4.4.2-testing/xen/arch/x86/hvm/vmx/vmx.c
===================================================================
--- xen-4.4.2-testing.orig/xen/arch/x86/hvm/vmx/vmx.c
+++ xen-4.4.2-testing/xen/arch/x86/hvm/vmx/vmx.c
@@ -2305,6 +2305,11 @@ static void ept_handle_violation(unsigne
     p2m_type_t p2mt;
     int ret;
     struct domain *d = current->domain;
+    struct npfec npfec = {
+        .read_access = !!(qualification & EPT_READ_VIOLATION),
+        .write_access = !!(qualification & EPT_WRITE_VIOLATION),
+        .insn_fetch = !!(qualification & EPT_EXEC_VIOLATION)
+    };
 
     if ( tb_init_done )
     {
@@ -2323,14 +2328,14 @@ static void ept_handle_violation(unsigne
     }
 
     if ( qualification & EPT_GLA_VALID )
+    {
         __vmread(GUEST_LINEAR_ADDRESS, &gla);
+        npfec.gla_valid = 1;
+    }
     else
         gla = ~0ull;
-    ret = hvm_hap_nested_page_fault(gpa,
-                                    !!(qualification & EPT_GLA_VALID), gla,
-                                    !!(qualification & EPT_READ_VIOLATION),
-                                    !!(qualification & EPT_WRITE_VIOLATION),
-                                    !!(qualification & EPT_EXEC_VIOLATION));
+
+    ret = hvm_hap_nested_page_fault(gpa, gla, npfec);
     switch ( ret )
     {
     case 0:         // Unhandled L1 EPT violation
Index: xen-4.4.2-testing/xen/arch/x86/mm/p2m.c
===================================================================
--- xen-4.4.2-testing.orig/xen/arch/x86/mm/p2m.c
+++ xen-4.4.2-testing/xen/arch/x86/mm/p2m.c
@@ -1261,9 +1261,9 @@ void p2m_mem_paging_resume(struct domain
     }
 }
 
-bool_t p2m_mem_access_check(paddr_t gpa, bool_t gla_valid, unsigned long gla, 
-                          bool_t access_r, bool_t access_w, bool_t access_x,
-                          mem_event_request_t **req_ptr)
+bool_t p2m_mem_access_check(paddr_t gpa, unsigned long gla,
+                            struct npfec npfec,
+                            mem_event_request_t **req_ptr)
 {
     struct vcpu *v = current;
     unsigned long gfn = gpa >> PAGE_SHIFT;
@@ -1281,7 +1281,7 @@ bool_t p2m_mem_access_check(paddr_t gpa,
     gfn_lock(p2m, gfn, 0);
     mfn = p2m->get_entry(p2m, gfn, &p2mt, &p2ma, 0, NULL);
 
-    if ( access_w && p2ma == p2m_access_rx2rw ) 
+    if ( npfec.write_access && p2ma == p2m_access_rx2rw )
     {
         rc = p2m->set_entry(p2m, gfn, mfn, PAGE_ORDER_4K, p2mt, p2m_access_rw);
         ASSERT(rc);
@@ -1290,7 +1290,7 @@ bool_t p2m_mem_access_check(paddr_t gpa,
     }
     else if ( p2ma == p2m_access_n2rwx )
     {
-        ASSERT(access_w || access_r || access_x);
+        ASSERT(npfec.write_access || npfec.read_access || npfec.insn_fetch);
         rc = p2m->set_entry(p2m, gfn, mfn, PAGE_ORDER_4K,
                             p2mt, p2m_access_rwx);
         ASSERT(rc);
@@ -1341,11 +1341,11 @@ bool_t p2m_mem_access_check(paddr_t gpa,
         /* Send request to mem event */
         req->gfn = gfn;
         req->offset = gpa & ((1 << PAGE_SHIFT) - 1);
-        req->gla_valid = gla_valid;
+        req->gla_valid = npfec.gla_valid;
         req->gla = gla;
-        req->access_r = access_r;
-        req->access_w = access_w;
-        req->access_x = access_x;
+        req->access_r = npfec.read_access;
+        req->access_w = npfec.write_access;
+        req->access_x = npfec.insn_fetch;
     
         req->vcpu_id = v->vcpu_id;
     }
Index: xen-4.4.2-testing/xen/include/asm-x86/hvm/hvm.h
===================================================================
--- xen-4.4.2-testing.orig/xen/include/asm-x86/hvm/hvm.h
+++ xen-4.4.2-testing/xen/include/asm-x86/hvm/hvm.h
@@ -435,11 +435,8 @@ static inline void hvm_invalidate_regs_f
 #endif
 }
 
-int hvm_hap_nested_page_fault(paddr_t gpa,
-                              bool_t gla_valid, unsigned long gla,
-                              bool_t access_r,
-                              bool_t access_w,
-                              bool_t access_x);
+int hvm_hap_nested_page_fault(paddr_t gpa, unsigned long gla,
+                              struct npfec npfec);
 
 #define hvm_msr_tsc_aux(v) ({                                               \
     struct domain *__d = (v)->domain;                                       \
Index: xen-4.4.2-testing/xen/include/asm-x86/mm.h
===================================================================
--- xen-4.4.2-testing.orig/xen/include/asm-x86/mm.h
+++ xen-4.4.2-testing/xen/include/asm-x86/mm.h
@@ -551,6 +551,16 @@ void audit_domains(void);
 
 #endif
 
+/*
+ * Nested page fault exception codes.
+ */
+struct npfec {
+    unsigned int read_access:1;
+    unsigned int write_access:1;
+    unsigned int insn_fetch:1;
+    unsigned int gla_valid:1;
+};
+
 int new_guest_cr3(unsigned long pfn);
 void make_cr3(struct vcpu *v, unsigned long mfn);
 void update_cr3(struct vcpu *v);
Index: xen-4.4.2-testing/xen/include/asm-x86/p2m.h
===================================================================
--- xen-4.4.2-testing.orig/xen/include/asm-x86/p2m.h
+++ xen-4.4.2-testing/xen/include/asm-x86/p2m.h
@@ -568,9 +568,9 @@ void p2m_mem_paging_resume(struct domain
  * been promoted with no underlying vcpu pause. If the req_ptr has been populated, 
  * then the caller must put the event in the ring (once having released get_gfn*
  * locks -- caller must also xfree the request. */
-bool_t p2m_mem_access_check(paddr_t gpa, bool_t gla_valid, unsigned long gla, 
-                          bool_t access_r, bool_t access_w, bool_t access_x,
-                          mem_event_request_t **req_ptr);
+bool_t p2m_mem_access_check(paddr_t gpa, unsigned long gla,
+                            struct npfec npfec,
+                            mem_event_request_t **req_ptr);
 /* Resumes the running of the VCPU, restarting the last instruction */
 void p2m_mem_access_resume(struct domain *d);
 
++++++ 53ff36ae-x86-hvm-treat-non-insn-fetch-NPF-also-as-read-violations.patch ++++++
References: bnc#882089

# Commit 401d5c5cc5a780cad160aa0e3c282c11ac11dd0c
# Date 2014-08-28 16:03:26 +0200
# Author Tamas K Lengyel 
# Committer Jan Beulich 
x86/hvm: treat non-instruction fetch nested page faults also as read violations

As pointed out by Jan Beulich in
http://lists.xen.org/archives/html/xen-devel/2014-08/msg01269.html:
"Read-modify-write instructions absolutely need to be treated as read
accesses, yet hardware doesn't guarantee to tell us so (they may
surface as just write accesses)." This patch addresses the issue in
both the VMX and the SVM side.

VMX: Treat all write data access violations also as read violations (in
     addition to those that were already reported as read violations).
SVM: Refine the meaning of read data access violations to distinguish
     between read/write and instruction fetch access violations.

With this patch both VMX and SVM specific nested page fault handling code reports violations the same way, thus abstracting the hardware specific behaviour from the layers above.

Suggested-by: Jan Beulich 
Signed-off-by: Tamas K Lengyel 
Reviewed-by: Boris Ostrovsky 
Reviewed-by: Tim Deegan 

Index: xen-4.4.2-testing/xen/arch/x86/hvm/svm/svm.c
===================================================================
--- xen-4.4.2-testing.orig/xen/arch/x86/hvm/svm/svm.c
+++ xen-4.4.2-testing/xen/arch/x86/hvm/svm/svm.c
@@ -1307,8 +1307,13 @@ static void svm_do_nested_pgfault(struct
     p2m_access_t p2ma;
     struct p2m_domain *p2m = NULL;
 
+    /*
+     * Since HW doesn't explicitly provide a read access bit and we need to
+     * somehow describe read-modify-write instructions we will conservatively
+     * set read_access for all memory accesses that are not instruction fetches.
+     */
     struct npfec npfec = {
-        .read_access = 1, /* All NPFs count as reads */
+        .read_access = !(pfec & PFEC_insn_fetch),
         .write_access = !!(pfec & PFEC_write_access),
         .insn_fetch = !!(pfec & PFEC_insn_fetch)
     };
Index: xen-4.4.2-testing/xen/arch/x86/hvm/vmx/vmx.c
===================================================================
--- xen-4.4.2-testing.orig/xen/arch/x86/hvm/vmx/vmx.c
+++ xen-4.4.2-testing/xen/arch/x86/hvm/vmx/vmx.c
@@ -2305,8 +2305,21 @@ static void ept_handle_violation(unsigne
     p2m_type_t p2mt;
     int ret;
     struct domain *d = current->domain;
+
+    /*
+     * We treat all write violations also as read violations.
+     * The reason why this is required is the following warning:
+     * "An EPT violation that occurs during as a result of execution of a
+     * read-modify-write operation sets bit 1 (data write). Whether it also
+     * sets bit 0 (data read) is implementation-specific and, for a given
+     * implementation, may differ for different kinds of read-modify-write
+     * operations."
+     * - Intel(R) 64 and IA-32 Architectures Software Developer's Manual
+     *   Volume 3C: System Programming Guide, Part 3
+     */
     struct npfec npfec = {
-        .read_access = !!(qualification & EPT_READ_VIOLATION),
+        .read_access = !!(qualification & EPT_READ_VIOLATION) ||
+                       !!(qualification & EPT_WRITE_VIOLATION),
         .write_access = !!(qualification & EPT_WRITE_VIOLATION),
         .insn_fetch = !!(qualification & EPT_EXEC_VIOLATION)
     };
++++++ 53ff36d5-x86-mem_event-deliver-gla-fault-EPT-violation-information.patch ++++++
References: bnc#882089

# Commit 692f3cc7dd05b80dbd027e46372b1c25d7975332
# Date 2014-08-28 16:04:05 +0200
# Author Tamas K Lengyel 
# Committer Jan Beulich 
x86/mem_event: deliver gla fault EPT violation information

On Intel EPT the exit qualification generated by a violation also
includes a bit (EPT_GLA_FAULT) which describes the following
information: Set if the access causing the EPT violation is to a
guest-physical address that is the translation of a linear address.
Clear if the access causing the EPT violation is to a paging-structure
entry as part of a page walk or the update of an accessed or dirty bit.

For more information see Table 27-7 in the Intel SDM.

This patch extends the mem_event system to deliver this extra
information, which could be useful for determining the cause of a
violation.

Signed-off-by: Tamas K Lengyel 
Reviewed-by: Jan Beulich 
Acked-by: Kevin Tian 
Acked-by: Tim Deegan 

Index: xen-4.4.2-testing/xen/arch/x86/hvm/svm/svm.c
===================================================================
--- xen-4.4.2-testing.orig/xen/arch/x86/hvm/svm/svm.c
+++ xen-4.4.2-testing/xen/arch/x86/hvm/svm/svm.c
@@ -1298,7 +1298,7 @@ const struct hvm_function_table * __init
 }
 
 static void svm_do_nested_pgfault(struct vcpu *v,
-    struct cpu_user_regs *regs, uint32_t pfec, paddr_t gpa)
+    struct cpu_user_regs *regs, uint64_t pfec, paddr_t gpa)
 {
     int ret;
     unsigned long gfn = gpa >> PAGE_SHIFT;
@@ -1318,6 +1318,12 @@ static void svm_do_nested_pgfault(struct
         .insn_fetch = !!(pfec & PFEC_insn_fetch)
     };
 
+    /* These bits are mutually exclusive */
+    if ( pfec & NPT_PFEC_with_gla )
+        npfec.kind = npfec_kind_with_gla;
+    else if ( pfec & NPT_PFEC_in_gpt )
+        npfec.kind = npfec_kind_in_gpt;
+
     ret = hvm_hap_nested_page_fault(gpa, ~0ul, npfec);
 
     if ( tb_init_done )
Index: xen-4.4.2-testing/xen/arch/x86/hvm/vmx/vmx.c
===================================================================
--- xen-4.4.2-testing.orig/xen/arch/x86/hvm/vmx/vmx.c
+++ xen-4.4.2-testing/xen/arch/x86/hvm/vmx/vmx.c
@@ -2344,6 +2344,10 @@ static void ept_handle_violation(unsigne
     {
         __vmread(GUEST_LINEAR_ADDRESS, &gla);
         npfec.gla_valid = 1;
+        if( qualification & EPT_GLA_FAULT )
+            npfec.kind = npfec_kind_with_gla;
+        else
+            npfec.kind = npfec_kind_in_gpt;
     }
     else
         gla = ~0ull;
Index: xen-4.4.2-testing/xen/arch/x86/mm/p2m.c
===================================================================
--- xen-4.4.2-testing.orig/xen/arch/x86/mm/p2m.c
+++ xen-4.4.2-testing/xen/arch/x86/mm/p2m.c
@@ -1343,10 +1343,13 @@ bool_t p2m_mem_access_check(paddr_t gpa,
         req->offset = gpa & ((1 << PAGE_SHIFT) - 1);
         req->gla_valid = npfec.gla_valid;
         req->gla = gla;
+        if ( npfec.kind == npfec_kind_with_gla )
+            req->fault_with_gla = 1;
+        else if ( npfec.kind == npfec_kind_in_gpt )
+            req->fault_in_gpt = 1;
         req->access_r = npfec.read_access;
         req->access_w = npfec.write_access;
         req->access_x = npfec.insn_fetch;
-    
         req->vcpu_id = v->vcpu_id;
     }
 
Index: xen-4.4.2-testing/xen/include/asm-x86/hvm/svm/svm.h
===================================================================
--- xen-4.4.2-testing.orig/xen/include/asm-x86/hvm/svm/svm.h
+++ xen-4.4.2-testing/xen/include/asm-x86/hvm/svm/svm.h
@@ -105,4 +105,10 @@ extern u32 svm_feature_flags;
 extern void svm_host_osvw_reset(void);
 extern void svm_host_osvw_init(void);
 
+/* EXITINFO1 fields on NPT faults */
+#define _NPT_PFEC_with_gla     32
+#define NPT_PFEC_with_gla      (1UL<<_NPT_PFEC_with_gla)
+#define _NPT_PFEC_in_gpt       33
+#define NPT_PFEC_in_gpt        (1UL<<_NPT_PFEC_in_gpt)
+
 #endif /* __ASM_X86_HVM_SVM_H__ */
Index: xen-4.4.2-testing/xen/include/asm-x86/mm.h
===================================================================
--- xen-4.4.2-testing.orig/xen/include/asm-x86/mm.h
+++ xen-4.4.2-testing/xen/include/asm-x86/mm.h
@@ -552,6 +552,16 @@ void audit_domains(void);
 #endif
 
 /*
+ * Extra fault info types which are used to further describe
+ * the source of an access violation.
+ */
+typedef enum {
+    npfec_kind_unknown, /* must be first */
+    npfec_kind_in_gpt,  /* violation in guest page table */
+    npfec_kind_with_gla /* violation with guest linear address */
+} npfec_kind_t;
+
+/*
  * Nested page fault exception codes.
  */
 struct npfec {
@@ -559,6 +569,7 @@ struct npfec {
     unsigned int write_access:1;
     unsigned int insn_fetch:1;
     unsigned int gla_valid:1;
+    unsigned int kind:2;  /* npfec_kind_t */
 };
 
 int new_guest_cr3(unsigned long pfn);
Index: xen-4.4.2-testing/xen/include/public/mem_event.h
===================================================================
--- xen-4.4.2-testing.orig/xen/include/public/mem_event.h
+++ xen-4.4.2-testing/xen/include/public/mem_event.h
@@ -62,7 +62,9 @@ typedef struct mem_event_st {
     uint16_t access_w:1;
     uint16_t access_x:1;
     uint16_t gla_valid:1;
-    uint16_t available:12;
+    uint16_t fault_with_gla:1;
+    uint16_t fault_in_gpt:1;
+    uint16_t available:10;
 
     uint16_t reason;
 } mem_event_request_t, mem_event_response_t;
++++++ 54005472-EPT-utilize-GLA-GPA-translation-known-for-certain-faults.patch ++++++
References: bnc#882089

# Commit ecb69533582e51999e5d76bce513be870222908f
# Date 2014-08-29 12:22:42 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
EPT: utilize GLA->GPA translation known for certain faults

Rather than doing the translation ourselves in __hvmemul_{read,write}()
leverage that we know the association for faults other than such having
occurred when translating addresses of page tables.

There is one intentional but not necessarily obvious (and possibly
subtle) adjustment to behavior: __hvmemul_read() no longer blindly
bails on instruction fetches matching the MMIO GVA (the callers of
handle_mmio_with_translation() now control the behavior via the struct
npfec they pass, and it didn't seem right to bail here rather than just
falling through to the unaccelerated path)

Signed-off-by: Jan Beulich 
Reviewed-by: Tim Deegan 

Index: xen-4.4.2-testing/xen/arch/x86/hvm/emulate.c
===================================================================
--- xen-4.4.2-testing.orig/xen/arch/x86/hvm/emulate.c
+++ xen-4.4.2-testing/xen/arch/x86/hvm/emulate.c
@@ -496,10 +496,11 @@ static int __hvmemul_read(
         while ( off & (chunk - 1) )
             chunk >>= 1;
 
-    if ( unlikely(vio->mmio_gva == (addr & PAGE_MASK)) && vio->mmio_gva )
+    if ( ((access_type != hvm_access_insn_fetch
+           ? vio->mmio_access.read_access
+           : vio->mmio_access.insn_fetch)) &&
+         (vio->mmio_gva == (addr & PAGE_MASK)) )
     {
-        if ( access_type == hvm_access_insn_fetch )
-            return X86EMUL_UNHANDLEABLE;
         gpa = (((paddr_t)vio->mmio_gpfn << PAGE_SHIFT) | off);
         while ( (off + chunk) <= PAGE_SIZE )
         {
@@ -639,7 +640,8 @@ static int hvmemul_write(
         while ( off & (chunk - 1) )
             chunk >>= 1;
 
-    if ( unlikely(vio->mmio_gva == (addr & PAGE_MASK)) && vio->mmio_gva )
+    if ( vio->mmio_access.write_access &&
+         (vio->mmio_gva == (addr & PAGE_MASK)) )
     {
         gpa = (((paddr_t)vio->mmio_gpfn << PAGE_SHIFT) | off);
         while ( (off + chunk) <= PAGE_SIZE )
Index: xen-4.4.2-testing/xen/arch/x86/hvm/hvm.c
===================================================================
--- xen-4.4.2-testing.orig/xen/arch/x86/hvm/hvm.c
+++ xen-4.4.2-testing/xen/arch/x86/hvm/hvm.c
@@ -1538,7 +1538,7 @@ int hvm_hap_nested_page_fault(paddr_t gp
          && is_hvm_vcpu(v)
          && hvm_mmio_internal(gpa) )
     {
-        if ( !handle_mmio() )
+        if ( !handle_mmio_with_translation(gla, gpa >> PAGE_SHIFT, npfec) )
             hvm_inject_hw_exception(TRAP_gp_fault, 0);
         rc = 1;
         goto out;
@@ -1612,7 +1612,7 @@ int hvm_hap_nested_page_fault(paddr_t gp
         if ( unlikely(is_pvh_vcpu(v)) )
             goto out;
 
-        if ( !handle_mmio() )
+        if ( !handle_mmio_with_translation(gla, gpa >> PAGE_SHIFT, npfec) )
             hvm_inject_hw_exception(TRAP_gp_fault, 0);
         rc = 1;
         goto out;
Index: xen-4.4.2-testing/xen/arch/x86/hvm/io.c
===================================================================
--- xen-4.4.2-testing.orig/xen/arch/x86/hvm/io.c
+++ xen-4.4.2-testing/xen/arch/x86/hvm/io.c
@@ -189,7 +189,7 @@ int handle_mmio(void)
     if ( vio->io_state == HVMIO_awaiting_completion )
         vio->io_state = HVMIO_handle_mmio_awaiting_completion;
     else
-        vio->mmio_gva = 0;
+        vio->mmio_access = (struct npfec){};
 
     switch ( rc )
     {
@@ -218,9 +218,14 @@ int handle_mmio(void)
     return 1;
 }
 
-int handle_mmio_with_translation(unsigned long gva, unsigned long gpfn)
+int handle_mmio_with_translation(unsigned long gva, unsigned long gpfn,
+                                 struct npfec access)
 {
     struct hvm_vcpu_io *vio = ¤t->arch.hvm_vcpu.hvm_io;
+
+    vio->mmio_access = access.gla_valid &&
+                       access.kind == npfec_kind_with_gla
+                       ? access : (struct npfec){};
     vio->mmio_gva = gva & PAGE_MASK;
     vio->mmio_gpfn = gpfn;
     return handle_mmio();
Index: xen-4.4.2-testing/xen/arch/x86/mm/shadow/multi.c
===================================================================
--- xen-4.4.2-testing.orig/xen/arch/x86/mm/shadow/multi.c
+++ xen-4.4.2-testing/xen/arch/x86/mm/shadow/multi.c
@@ -2839,6 +2839,11 @@ static int sh_page_fault(struct vcpu *v,
     p2m_type_t p2mt;
     uint32_t rc;
     int version;
+    struct npfec access = {
+         .read_access = 1,
+         .gla_valid = 1,
+         .kind = npfec_kind_with_gla
+    };
 #if SHADOW_OPTIMIZATIONS & SHOPT_FAST_EMULATION
     int fast_emul = 0;
 #endif
@@ -2849,6 +2854,9 @@ static int sh_page_fault(struct vcpu *v,
 
     perfc_incr(shadow_fault);
 
+    if ( regs->error_code & PFEC_write_access )
+        access.write_access = 1;
+
 #if SHADOW_OPTIMIZATIONS & SHOPT_FAST_EMULATION
     /* If faulting frame is successfully emulated in last shadow fault
      * it's highly likely to reach same emulation action for this frame.
@@ -2950,7 +2958,7 @@ static int sh_page_fault(struct vcpu *v,
             SHADOW_PRINTK("fast path mmio %#"PRIpaddr"\n", gpa);
             reset_early_unshadow(v);
             trace_shadow_gen(TRC_SHADOW_FAST_MMIO, va);
-            return (handle_mmio_with_translation(va, gpa >> PAGE_SHIFT)
+            return (handle_mmio_with_translation(va, gpa >> PAGE_SHIFT, access)
                     ? EXCRET_fault_fixed : 0);
         }
         else
@@ -3447,7 +3455,7 @@ static int sh_page_fault(struct vcpu *v,
     paging_unlock(d);
     put_gfn(d, gfn_x(gfn));
     trace_shadow_gen(TRC_SHADOW_MMIO, va);
-    return (handle_mmio_with_translation(va, gpa >> PAGE_SHIFT)
+    return (handle_mmio_with_translation(va, gpa >> PAGE_SHIFT, access)
             ? EXCRET_fault_fixed : 0);
 
  not_a_shadow_fault:
Index: xen-4.4.2-testing/xen/include/asm-x86/hvm/io.h
===================================================================
--- xen-4.4.2-testing.orig/xen/include/asm-x86/hvm/io.h
+++ xen-4.4.2-testing/xen/include/asm-x86/hvm/io.h
@@ -119,7 +119,8 @@ static inline void register_buffered_io_
 void send_timeoffset_req(unsigned long timeoff);
 void send_invalidate_req(void);
 int handle_mmio(void);
-int handle_mmio_with_translation(unsigned long gva, unsigned long gpfn);
+int handle_mmio_with_translation(unsigned long gva, unsigned long gpfn,
+                                 struct npfec);
 int handle_pio(uint16_t port, unsigned int size, int dir);
 void hvm_interrupt_post(struct vcpu *v, int vector, int type);
 void hvm_io_assist(ioreq_t *p);
Index: xen-4.4.2-testing/xen/include/asm-x86/hvm/vcpu.h
===================================================================
--- xen-4.4.2-testing.orig/xen/include/asm-x86/hvm/vcpu.h
+++ xen-4.4.2-testing/xen/include/asm-x86/hvm/vcpu.h
@@ -54,8 +54,9 @@ struct hvm_vcpu_io {
      * HVM emulation:
      *  Virtual address @mmio_gva maps to MMIO physical frame @mmio_gpfn.
      *  The latter is known to be an MMIO frame (not RAM).
-     *  This translation is only valid if @mmio_gva is non-zero.
+     *  This translation is only valid for accesses as per @mmio_access.
      */
+    struct npfec        mmio_access;
     unsigned long       mmio_gva;
     unsigned long       mmio_gpfn;
 
++++++ 541ad385-x86-suppress-event-check-IPI-to-MWAITing-CPUs.patch ++++++
References: bnc#882089

# Commit 9a727a813e9b25003e433b3dc3fa47e621f9e238
# Date 2014-09-18 14:43:49 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86: suppress event check IPI to MWAITing CPUs

Mass wakeups (via vlapic_ipi()) can take enormous amounts of time,
especially when many of the remote pCPU-s are in deep C-states. For
64-vCPU Windows Server 2012 R2 guests on Ivybridge hardware,
accumulated times of over 2ms were observed (average 1.1ms).
Considering that Windows broadcasts IPIs from its timer interrupt,
which at least at certain times can run at 1kHz, it is clear that this
can't result in good guest behavior. In fact, on said hardware guests
with significantly beyond 40 vCPU-s simply hung when e.g. ServerManager
gets started.

Recognizing that writes to softirq_pending() already have the effect of
waking remote CPUs from MWAITing (due to being co-located on the same
cache line with mwait_wakeup()), we can avoid sending IPIs to CPUs we
know are in a (deep) C-state entered via MWAIT.

With this, average broadcast times for a 64-vCPU guest went down to a
measured maximum of 255us (which is still quite a lot).

One aspect worth noting is that cpumask_raise_softirq() gets brought in
sync here with cpu_raise_softirq() in that now both don't attempt to
raise a self-IPI on the processing CPU.

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 
Reviewed-by: Tim Deegan 

--- a/xen/arch/x86/acpi/cpu_idle.c
+++ b/xen/arch/x86/acpi/cpu_idle.c
@@ -294,6 +294,16 @@ void cpuidle_wakeup_mwait(cpumask_t *mas
     cpumask_andnot(mask, mask, &target);
 }
 
+bool_t arch_skip_send_event_check(unsigned int cpu)
+{
+    /*
+     * This relies on softirq_pending() and mwait_wakeup() to access data
+     * on the same cache line.
+     */
+    smp_mb();
+    return !!cpumask_test_cpu(cpu, &cpuidle_mwait_flags);
+}
+
 void mwait_idle_with_hints(unsigned int eax, unsigned int ecx)
 {
     unsigned int cpu = smp_processor_id();
@@ -313,7 +323,7 @@ void mwait_idle_with_hints(unsigned int 
      * Timer deadline passing is the event on which we will be woken via
      * cpuidle_mwait_wakeup. So check it now that the location is armed.
      */
-    if ( expires > NOW() || expires == 0 )
+    if ( (expires > NOW() || expires == 0) && !softirq_pending(cpu) )
     {
         cpumask_set_cpu(cpu, &cpuidle_mwait_flags);
         __mwait(eax, ecx);
--- a/xen/common/softirq.c
+++ b/xen/common/softirq.c
@@ -70,12 +70,14 @@ void open_softirq(int nr, softirq_handle
 
 void cpumask_raise_softirq(const cpumask_t *mask, unsigned int nr)
 {
-    int cpu;
+    unsigned int cpu, this_cpu = smp_processor_id();
     cpumask_t send_mask;
 
     cpumask_clear(&send_mask);
     for_each_cpu(cpu, mask)
-        if ( !test_and_set_bit(nr, &softirq_pending(cpu)) )
+        if ( !test_and_set_bit(nr, &softirq_pending(cpu)) &&
+             cpu != this_cpu &&
+             !arch_skip_send_event_check(cpu) )
             cpumask_set_cpu(cpu, &send_mask);
 
     smp_send_event_check_mask(&send_mask);
@@ -84,7 +86,8 @@ void cpumask_raise_softirq(const cpumask
 void cpu_raise_softirq(unsigned int cpu, unsigned int nr)
 {
     if ( !test_and_set_bit(nr, &softirq_pending(cpu))
-         && (cpu != smp_processor_id()) )
+         && (cpu != smp_processor_id())
+         && !arch_skip_send_event_check(cpu) )
         smp_send_event_check_cpu(cpu);
 }
 
--- a/xen/include/asm-arm/softirq.h
+++ b/xen/include/asm-arm/softirq.h
@@ -3,6 +3,8 @@
 
 #define NR_ARCH_SOFTIRQS       0
 
+#define arch_skip_send_event_check(cpu) 0
+
 #endif /* __ASM_SOFTIRQ_H__ */
 /*
  * Local variables:
--- a/xen/include/asm-x86/softirq.h
+++ b/xen/include/asm-x86/softirq.h
@@ -9,4 +9,6 @@
 #define PCI_SERR_SOFTIRQ       (NR_COMMON_SOFTIRQS + 4)
 #define NR_ARCH_SOFTIRQS       5
 
+bool_t arch_skip_send_event_check(unsigned int cpu);
+
 #endif /* __ASM_SOFTIRQ_H__ */
++++++ 541ad3ca-x86-HVM-batch-vCPU-wakeups.patch ++++++
References: bnc#882089

# Commit c47c316d99b3b570d0bb968b99331e6714ef1df7
# Date 2014-09-18 14:44:58 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/HVM: batch vCPU wakeups

Mass wakeups (via vlapic_ipi()) can take enormous amounts of time,
especially when many of the remote pCPU-s are in deep C-states. For
64-vCPU Windows Server 2012 R2 guests on Ivybridge hardware,
accumulated times of over 2ms were observed (average 1.1ms).
Considering that Windows broadcasts IPIs from its timer interrupt,
which at least at certain times can run at 1kHz, it is clear that this
can't result in good guest behavior. In fact, on said hardware guests
with significantly beyond 40 vCPU-s simply hung when e.g. ServerManager
gets started.

This isn't just helping to reduce the number of ICR writes when the
host APICs run in clustered mode, it also reduces them by suppressing
the sends altogether when - by the time
cpu_raise_softirq_batch_finish() is reached - the remote CPU already
managed to handle the softirq. Plus - when using MONITOR/MWAIT - the
update of softirq_pending(cpu), being on the monitored cache line -
should make the remote CPU wake up ahead of the ICR being sent,
allowing the wait-for-ICR-idle latencies to be reduced (perhaps to a
large part due to overlapping the wakeups of multiple CPUs).

With this alone (i.e. without the IPI avoidance patch in place),
average broadcast times for a 64-vCPU guest went down to a measured
maximum of 310us. With that other patch in place, improvements aren't
as clear anymore (short term averages only went down from 255us to
250us, which clearly is within the error range of the measurements),
but longer term an improvement of the averages is still visible.
Depending on hardware, long term maxima were observed to go down quite
a bit (on aforementioned hardware), while they were seen to go up
again on a (single core) Nehalem (where instead the improvement on the
average values was more visible).

Of course this necessarily increases the latencies for the remote
CPU wakeup at least slightly. To weigh between the effects, the
condition to enable batching in vlapic_ipi() may need further tuning.

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 
Reviewed-by: Tim Deegan 

# Commit 5dbdf33c57e3c95125b92f86d847ed8432e28f1c
# Date 2015-02-27 16:09:27 +0100
# Author Jan Beulich 
# Committer Jan Beulich 
complete conversion set_bit() -> __cpumask_set_cpu() by 4aaca0e9cd

While converting to __cpumask_set_cpu() was correct, the first argument
passed should have been corrected to be "cpu" instead of "nr" at once.
The wrong construct results in problems on systems with relatively few
CPUs.

Reported-by: Sander Eikelenboom 
Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 
Acked-by: Ian Campbell 

--- a/xen/arch/x86/hvm/vlapic.c
+++ b/xen/arch/x86/hvm/vlapic.c
@@ -409,6 +409,26 @@ void vlapic_handle_EOI_induced_exit(stru
     hvm_dpci_msi_eoi(current->domain, vector);
 }
 
+static bool_t is_multicast_dest(struct vlapic *vlapic, unsigned int short_hand,
+                                uint32_t dest, bool_t dest_mode)
+{
+    if ( vlapic_domain(vlapic)->max_vcpus <= 2 )
+        return 0;
+
+    if ( short_hand )
+        return short_hand != APIC_DEST_SELF;
+
+    if ( vlapic_x2apic_mode(vlapic) )
+        return dest_mode ? hweight16(dest) > 1 : dest == 0xffffffff;
+
+    if ( dest_mode )
+        return hweight8(dest &
+                        GET_xAPIC_DEST_FIELD(vlapic_get_reg(vlapic,
+                                                            APIC_DFR))) > 1;
+
+    return dest == 0xff;
+}
+
 void vlapic_ipi(
     struct vlapic *vlapic, uint32_t icr_low, uint32_t icr_high)
 {
@@ -447,12 +467,18 @@ void vlapic_ipi(
 
     default: {
         struct vcpu *v;
+        bool_t batch = is_multicast_dest(vlapic, short_hand, dest, dest_mode);
+
+        if ( batch )
+            cpu_raise_softirq_batch_begin();
         for_each_vcpu ( vlapic_domain(vlapic), v )
         {
             if ( vlapic_match_dest(vcpu_vlapic(v), vlapic,
                                    short_hand, dest, dest_mode) )
                 vlapic_accept_irq(v, icr_low);
         }
+        if ( batch )
+            cpu_raise_softirq_batch_finish();
         break;
     }
     }
--- a/xen/common/softirq.c
+++ b/xen/common/softirq.c
@@ -23,6 +23,9 @@ irq_cpustat_t irq_stat[NR_CPUS];
 
 static softirq_handler softirq_handlers[NR_SOFTIRQS];
 
+static DEFINE_PER_CPU(cpumask_t, batch_mask);
+static DEFINE_PER_CPU(unsigned int, batching);
+
 static void __do_softirq(unsigned long ignore_mask)
 {
     unsigned int i, cpu;
@@ -71,24 +74,58 @@ void open_softirq(int nr, softirq_handle
 void cpumask_raise_softirq(const cpumask_t *mask, unsigned int nr)
 {
     unsigned int cpu, this_cpu = smp_processor_id();
-    cpumask_t send_mask;
+    cpumask_t send_mask, *raise_mask;
+
+    if ( !per_cpu(batching, this_cpu) || in_irq() )
+    {
+        cpumask_clear(&send_mask);
+        raise_mask = &send_mask;
+    }
+    else
+        raise_mask = &per_cpu(batch_mask, this_cpu);
 
-    cpumask_clear(&send_mask);
     for_each_cpu(cpu, mask)
         if ( !test_and_set_bit(nr, &softirq_pending(cpu)) &&
              cpu != this_cpu &&
              !arch_skip_send_event_check(cpu) )
-            cpumask_set_cpu(cpu, &send_mask);
+            cpumask_set_cpu(cpu, raise_mask);
 
-    smp_send_event_check_mask(&send_mask);
+    if ( raise_mask == &send_mask )
+        smp_send_event_check_mask(raise_mask);
 }
 
 void cpu_raise_softirq(unsigned int cpu, unsigned int nr)
 {
-    if ( !test_and_set_bit(nr, &softirq_pending(cpu))
-         && (cpu != smp_processor_id())
-         && !arch_skip_send_event_check(cpu) )
+    unsigned int this_cpu = smp_processor_id();
+
+    if ( test_and_set_bit(nr, &softirq_pending(cpu))
+         || (cpu == this_cpu)
+         || arch_skip_send_event_check(cpu) )
+        return;
+
+    if ( !per_cpu(batching, this_cpu) || in_irq() )
         smp_send_event_check_cpu(cpu);
+    else
+        cpumask_set_cpu(cpu, &per_cpu(batch_mask, this_cpu));
+}
+
+void cpu_raise_softirq_batch_begin(void)
+{
+    ++this_cpu(batching);
+}
+
+void cpu_raise_softirq_batch_finish(void)
+{
+    unsigned int cpu, this_cpu = smp_processor_id();
+    cpumask_t *mask = &per_cpu(batch_mask, this_cpu);
+
+    ASSERT(per_cpu(batching, this_cpu));
+    for_each_cpu ( cpu, mask )
+        if ( !softirq_pending(cpu) )
+            cpumask_clear_cpu(cpu, mask);
+    smp_send_event_check_mask(mask);
+    cpumask_clear(mask);
+    --per_cpu(batching, this_cpu);
 }
 
 void raise_softirq(unsigned int nr)
--- a/xen/include/xen/softirq.h
+++ b/xen/include/xen/softirq.h
@@ -30,6 +30,9 @@ void cpumask_raise_softirq(const cpumask
 void cpu_raise_softirq(unsigned int cpu, unsigned int nr);
 void raise_softirq(unsigned int nr);
 
+void cpu_raise_softirq_batch_begin(void);
+void cpu_raise_softirq_batch_finish(void);
+
 /*
  * Process pending softirqs on this CPU. This should be called periodically
  * when performing work that prevents softirqs from running in a timely manner.
++++++ 5423e61c-x86emul-fix-SYSCALL-SYSENTER-SYSEXIT-emulation.patch ++++++
# Commit 970cfb09da6704088ab12fe5014793f497d3654f
# Date 2014-09-25 11:53:32 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86emul: fix SYSCALL/SYSENTER/SYSEXIT emulation

SYSCALL:
- make sure SS selector has RPL 0
- only use 32 bits of RIP to fill RCX when target execution mode is 32-bit
- don't shadow function wide variable 'rc'
- consolidate CS attribute setting into single statements
- drop pointless initializers and casts
- drop redundant MSR_STAR read (as suggested by Andrew Cooper)

SYSENTER/SYSEXIT:
- #GP condition doesn't depend on guest mode
- only use 32 bits for setting RIP/RSP when target execution mode is 32-bit
- don't shadow function wide variable 'rc'
- consolidate CS attribute setting into single statements
- drop pointless (and inconsistently used) casts

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 

Index: xen-4.4.3-testing/xen/arch/x86/x86_emulate/x86_emulate.c
===================================================================
--- xen-4.4.3-testing.orig/xen/arch/x86/x86_emulate/x86_emulate.c
+++ xen-4.4.3-testing/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -3788,8 +3788,7 @@ x86_emulate(
 
     case 0x05: /* syscall */ {
         uint64_t msr_content;
-        struct segment_register cs = { 0 }, ss = { 0 };
-        int rc;
+        struct segment_register cs, ss;
 
         generate_exception_if(in_realmode(ctxt, ops), EXC_UD, -1);
         generate_exception_if(!in_protmode(ctxt, ops), EXC_UD, -1);
@@ -3803,13 +3802,11 @@ x86_emulate(
         if ( (rc = ops->read_msr(MSR_STAR, &msr_content, ctxt)) != 0 )
             goto done;
 
-        msr_content >>= 32;
-        cs.sel = (uint16_t)(msr_content & 0xfffc);
-        ss.sel = (uint16_t)(msr_content + 8);
+        cs.sel = (msr_content >> 32) & ~3; /* SELECTOR_RPL_MASK */
+        ss.sel = cs.sel + 8;
 
         cs.base = ss.base = 0; /* flat segment */
         cs.limit = ss.limit = ~0u;  /* 4GB limit */
-        cs.attr.bytes = 0xc9b; /* G+DB+P+S+Code */
         ss.attr.bytes = 0xc93; /* G+DB+P+S+Data */
 
 #ifdef __x86_64__
@@ -3818,8 +3815,7 @@ x86_emulate(
             goto cannot_emulate;
         if ( rc )
         {
-            cs.attr.fields.db = 0;
-            cs.attr.fields.l = 1;
+            cs.attr.bytes = 0xa9b; /* L+DB+P+S+Code */
 
             _regs.rcx = _regs.rip;
             _regs.r11 = _regs.eflags & ~EFLG_RF;
@@ -3836,10 +3832,9 @@ x86_emulate(
         else
 #endif
         {
-            if ( (rc = ops->read_msr(MSR_STAR, &msr_content, ctxt)) != 0 )
-                goto done;
+            cs.attr.bytes = 0xc9b; /* G+DB+P+S+Code */
 
-            _regs.ecx = _regs.eip;
+            _regs.ecx = (uint32_t)_regs.eip;
             _regs.eip = (uint32_t)msr_content;
             _regs.eflags &= ~(EFLG_VM | EFLG_IF | EFLG_RF);
         }
@@ -4031,7 +4026,7 @@ x86_emulate(
     case 0x34: /* sysenter */ {
         uint64_t msr_content;
         struct segment_register cs, ss;
-        int rc;
+        int lm;
 
         generate_exception_if(mode_ring0(), EXC_GP, 0);
         generate_exception_if(in_realmode(ctxt, ops), EXC_GP, 0);
@@ -4041,34 +4036,26 @@ x86_emulate(
         if ( (rc = ops->read_msr(MSR_SYSENTER_CS, &msr_content, ctxt)) != 0 )
             goto done;
 
-        if ( mode_64bit() )
-            generate_exception_if(msr_content == 0, EXC_GP, 0);
-        else
-            generate_exception_if((msr_content & 0xfffc) == 0, EXC_GP, 0);
+        generate_exception_if(!(msr_content & 0xfffc), EXC_GP, 0);
+        lm = in_longmode(ctxt, ops);
+        if ( lm < 0 )
+            goto cannot_emulate;
 
         _regs.eflags &= ~(EFLG_VM | EFLG_IF | EFLG_RF);
 
         fail_if(ops->read_segment == NULL);
         ops->read_segment(x86_seg_cs, &cs, ctxt);
-        cs.sel = (uint16_t)msr_content & ~3; /* SELECTOR_RPL_MASK */
+        cs.sel = msr_content & ~3; /* SELECTOR_RPL_MASK */
         cs.base = 0;   /* flat segment */
         cs.limit = ~0u;  /* 4GB limit */
-        cs.attr.bytes = 0xc9b; /* G+DB+P+S+Code */
+        cs.attr.bytes = lm ? 0xa9b  /* L+DB+P+S+Code */
+                           : 0xc9b; /* G+DB+P+S+Code */
 
         ss.sel = cs.sel + 8;
         ss.base = 0;   /* flat segment */
         ss.limit = ~0u;  /* 4GB limit */
         ss.attr.bytes = 0xc93; /* G+DB+P+S+Data */
 
-        rc = in_longmode(ctxt, ops);
-        if ( rc < 0 )
-            goto cannot_emulate;
-        if ( rc )
-        {
-            cs.attr.fields.db = 0;
-            cs.attr.fields.l = 1;
-        }
-
         fail_if(ops->write_segment == NULL);
         if ( (rc = ops->write_segment(x86_seg_cs, &cs, ctxt)) != 0 ||
              (rc = ops->write_segment(x86_seg_ss, &ss, ctxt)) != 0 )
@@ -4076,11 +4063,11 @@ x86_emulate(
 
         if ( (rc = ops->read_msr(MSR_SYSENTER_EIP, &msr_content, ctxt)) != 0 )
             goto done;
-        _regs.eip = msr_content;
+        _regs.eip = lm ? msr_content : (uint32_t)msr_content;
 
         if ( (rc = ops->read_msr(MSR_SYSENTER_ESP, &msr_content, ctxt)) != 0 )
             goto done;
-        _regs.esp = msr_content;
+        _regs.esp = lm ? msr_content : (uint32_t)msr_content;
 
         break;
     }
@@ -4089,7 +4076,6 @@ x86_emulate(
         uint64_t msr_content;
         struct segment_register cs, ss;
         bool_t user64 = !!(rex_prefix & REX_W);
-        int rc;
 
         generate_exception_if(!mode_ring0(), EXC_GP, 0);
         generate_exception_if(in_realmode(ctxt, ops), EXC_GP, 0);
@@ -4099,42 +4085,27 @@ x86_emulate(
         if ( (rc = ops->read_msr(MSR_SYSENTER_CS, &msr_content, ctxt)) != 0 )
             goto done;
 
-        if ( user64 )
-        {
-            cs.sel = (uint16_t)(msr_content + 32);
-            ss.sel = (cs.sel + 8);
-            generate_exception_if(msr_content == 0, EXC_GP, 0);
-        }
-        else
-        {
-            cs.sel = (uint16_t)(msr_content + 16);
-            ss.sel = (uint16_t)(msr_content + 24);
-            generate_exception_if((msr_content & 0xfffc) == 0, EXC_GP, 0);
-        }
+        generate_exception_if(!(msr_content & 0xfffc), EXC_GP, 0);
 
-        cs.sel |= 0x3;   /* SELECTOR_RPL_MASK */
+        cs.sel = (msr_content | 3) + /* SELECTOR_RPL_MASK */
+                 (user64 ? 32 : 16);
         cs.base = 0;   /* flat segment */
         cs.limit = ~0u;  /* 4GB limit */
-        cs.attr.bytes = 0xcfb; /* G+DB+P+DPL3+S+Code */
+        cs.attr.bytes = user64 ? 0xafb  /* L+DB+P+DPL3+S+Code */
+                               : 0xcfb; /* G+DB+P+DPL3+S+Code */
 
-        ss.sel |= 0x3;   /* SELECTOR_RPL_MASK */
+        ss.sel = cs.sel + 8;
         ss.base = 0;   /* flat segment */
         ss.limit = ~0u;  /* 4GB limit */
         ss.attr.bytes = 0xcf3; /* G+DB+P+DPL3+S+Data */
 
-        if ( user64 )
-        {
-            cs.attr.fields.db = 0;
-            cs.attr.fields.l = 1;
-        }
-
         fail_if(ops->write_segment == NULL);
         if ( (rc = ops->write_segment(x86_seg_cs, &cs, ctxt)) != 0 ||
              (rc = ops->write_segment(x86_seg_ss, &ss, ctxt)) != 0 )
             goto done;
 
-        _regs.eip = _regs.edx;
-        _regs.esp = _regs.ecx;
+        _regs.eip = user64 ? _regs.edx : (uint32_t)_regs.edx;
+        _regs.esp = user64 ? _regs.ecx : (uint32_t)_regs.ecx;
         break;
     }
 
++++++ 5424057f-x86-HVM-fix-miscellaneous-aspects-of-x2APIC-emulation.patch ++++++
# Commit 70173dbb9948b13f423aabbd49d7f7cea6b34d1e
# Date 2014-09-25 14:07:27 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/HVM: fix miscellaneous aspects of x2APIC emulation

- generate #GP on invalid APIC base MSR transitions
- fail reads from the EOI and self-IPI registers (which are write-only)
- handle self-IPI writes and the ICR2 half of ICR writes largely in
  hvm_x2apic_msr_write() and (for self-IPI only) vlapic_apicv_write()
- don't permit MMIO-based access in x2APIC mode
- filter writes to read-only registers in hvm_x2apic_msr_write(),
  allowing conditionals to be dropped from vlapic_reg_write()
- don't ignore upper half of MSR-based write to ESR being non-zero
- don't ignore other writes to reserved bits
- VMX's EXIT_REASON_APIC_WRITE must not result in #GP (this exit being
  trap-like, this exception would get raised on the wrong RIP)
- make hvm_x2apic_msr_read() produce X86EMUL_* return codes just like
  hvm_x2apic_msr_write() does (benign to the only caller)

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 
Acked-by: Tim Deegan 

Index: xen-4.4.2-testing/xen/arch/x86/hvm/hvm.c
===================================================================
--- xen-4.4.2-testing.orig/xen/arch/x86/hvm/hvm.c
+++ xen-4.4.2-testing/xen/arch/x86/hvm/hvm.c
@@ -3229,7 +3229,8 @@ int hvm_msr_write_intercept(unsigned int
         break;
 
     case MSR_IA32_APICBASE:
-        vlapic_msr_set(vcpu_vlapic(v), msr_content);
+        if ( !vlapic_msr_set(vcpu_vlapic(v), msr_content) )
+            goto gp_fault;
         break;
 
     case MSR_IA32_TSC_DEADLINE:
Index: xen-4.4.2-testing/xen/arch/x86/hvm/vlapic.c
===================================================================
--- xen-4.4.2-testing.orig/xen/arch/x86/hvm/vlapic.c
+++ xen-4.4.2-testing/xen/arch/x86/hvm/vlapic.c
@@ -45,11 +45,11 @@
 #define VLAPIC_LVT_NUM                  6
 
 #define LVT_MASK \
-    APIC_LVT_MASKED | APIC_SEND_PENDING | APIC_VECTOR_MASK
+    (APIC_LVT_MASKED | APIC_SEND_PENDING | APIC_VECTOR_MASK)
 
 #define LINT_MASK   \
-    LVT_MASK | APIC_MODE_MASK | APIC_INPUT_POLARITY |\
-    APIC_LVT_REMOTE_IRR | APIC_LVT_LEVEL_TRIGGER
+    (LVT_MASK | APIC_MODE_MASK | APIC_INPUT_POLARITY |\
+    APIC_LVT_REMOTE_IRR | APIC_LVT_LEVEL_TRIGGER)
 
 static const unsigned int vlapic_lvt_mask[VLAPIC_LVT_NUM] =
 {
@@ -614,7 +614,7 @@ int hvm_x2apic_msr_read(struct vcpu *v,
     uint32_t low, high = 0, offset = (msr - MSR_IA32_APICBASE_MSR) << 4;
 
     if ( !vlapic_x2apic_mode(vlapic) )
-        return 1;
+        return X86EMUL_UNHANDLEABLE;
 
     vlapic_read_aligned(vlapic, offset, &low);
     switch ( offset )
@@ -627,12 +627,15 @@ int hvm_x2apic_msr_read(struct vcpu *v,
         vlapic_read_aligned(vlapic, APIC_ICR2, &high);
         break;
 
+    case APIC_EOI:
     case APIC_ICR2:
-        return 1;
+    case APIC_SELF_IPI:
+        return X86EMUL_UNHANDLEABLE;
     }
 
     *msr_content = (((uint64_t)high) << 32) | low;
-    return 0;
+
+    return X86EMUL_OKAY;
 }
 
 static void vlapic_pt_cb(struct vcpu *v, void *data)
@@ -655,10 +658,7 @@ static int vlapic_reg_write(struct vcpu
     switch ( offset )
     {
     case APIC_ID:
-        if ( !vlapic_x2apic_mode(vlapic) )
-            vlapic_set_reg(vlapic, APIC_ID, val);
-        else
-            rc = X86EMUL_UNHANDLEABLE;
+        vlapic_set_reg(vlapic, APIC_ID, val);
         break;
 
     case APIC_TASKPRI:
@@ -670,17 +670,11 @@ static int vlapic_reg_write(struct vcpu
         break;
 
     case APIC_LDR:
-        if ( !vlapic_x2apic_mode(vlapic) )
-            vlapic_set_reg(vlapic, APIC_LDR, val & APIC_LDR_MASK);
-        else
-            rc = X86EMUL_UNHANDLEABLE;
+        vlapic_set_reg(vlapic, APIC_LDR, val & APIC_LDR_MASK);
         break;
 
     case APIC_DFR:
-        if ( !vlapic_x2apic_mode(vlapic) )
-            vlapic_set_reg(vlapic, APIC_DFR, val | 0x0FFFFFFF);
-        else
-            rc = X86EMUL_UNHANDLEABLE;
+        vlapic_set_reg(vlapic, APIC_DFR, val | 0x0FFFFFFF);
         break;
 
     case APIC_SPIV:
@@ -707,21 +701,6 @@ static int vlapic_reg_write(struct vcpu
         }
         break;
 
-    case APIC_ESR:
-        if ( vlapic_x2apic_mode(vlapic) && (val != 0) )
-        {
-            gdprintk(XENLOG_ERR, "Local APIC write ESR with non-zero %lx\n",
-                    val);
-            rc = X86EMUL_UNHANDLEABLE;
-        }
-        break;
-
-    case APIC_SELF_IPI:
-        rc = vlapic_x2apic_mode(vlapic)
-            ? vlapic_reg_write(v, APIC_ICR, 0x40000 | (val & 0xff))
-            : X86EMUL_UNHANDLEABLE;
-        break;
-
     case APIC_ICR:
         val &= ~(1 << 12); /* always clear the pending bit */
         vlapic_ipi(vlapic, val, vlapic_get_reg(vlapic, APIC_ICR2));
@@ -729,9 +708,7 @@ static int vlapic_reg_write(struct vcpu
         break;
 
     case APIC_ICR2:
-        if ( !vlapic_x2apic_mode(vlapic) )
-            val &= 0xff000000;
-        vlapic_set_reg(vlapic, APIC_ICR2, val);
+        vlapic_set_reg(vlapic, APIC_ICR2, val & 0xff000000);
         break;
 
     case APIC_LVTT:         /* LVT Timer Reg */
@@ -871,8 +848,17 @@ static int vlapic_write(struct vcpu *v,
 
 int vlapic_apicv_write(struct vcpu *v, unsigned int offset)
 {
-    uint32_t val = vlapic_get_reg(vcpu_vlapic(v), offset);
-    return vlapic_reg_write(v, offset, val);
+    struct vlapic *vlapic = vcpu_vlapic(v);
+    uint32_t val = vlapic_get_reg(vlapic, offset);
+
+    if ( !vlapic_x2apic_mode(vlapic) )
+        return vlapic_reg_write(v, offset, val);
+
+    if ( offset != APIC_SELF_IPI )
+        return X86EMUL_UNHANDLEABLE;
+
+    return vlapic_reg_write(v, APIC_ICR,
+                            APIC_DEST_SELF | (val & APIC_VECTOR_MASK));
 }
 
 int hvm_x2apic_msr_write(struct vcpu *v, unsigned int msr, uint64_t msr_content)
@@ -885,16 +871,69 @@ int hvm_x2apic_msr_write(struct vcpu *v,
 
     switch ( offset )
     {
-        int rc;
+    case APIC_TASKPRI:
+        if ( msr_content & ~APIC_TPRI_MASK )
+            return X86EMUL_UNHANDLEABLE;
+        break;
+
+    case APIC_SPIV:
+        if ( msr_content & ~(APIC_VECTOR_MASK | APIC_SPIV_APIC_ENABLED |
+                             (VLAPIC_VERSION & APIC_LVR_DIRECTED_EOI
+                              ? APIC_SPIV_DIRECTED_EOI : 0)) )
+            return X86EMUL_UNHANDLEABLE;
+        break;
+
+    case APIC_LVTT:
+        if ( msr_content & ~(LVT_MASK | APIC_TIMER_MODE_MASK) )
+            return X86EMUL_UNHANDLEABLE;
+        break;
+
+    case APIC_LVTTHMR:
+    case APIC_LVTPC:
+    case APIC_CMCI:
+        if ( msr_content & ~(LVT_MASK | APIC_MODE_MASK) )
+            return X86EMUL_UNHANDLEABLE;
+        break;
+
+    case APIC_LVT0:
+    case APIC_LVT1:
+        if ( msr_content & ~LINT_MASK )
+            return X86EMUL_UNHANDLEABLE;
+        break;
+
+    case APIC_LVTERR:
+        if ( msr_content & ~LVT_MASK )
+            return X86EMUL_UNHANDLEABLE;
+        break;
+
+    case APIC_TMICT:
+        break;
+
+    case APIC_TDCR:
+        if ( msr_content & ~APIC_TDR_DIV_1 )
+            return X86EMUL_UNHANDLEABLE;
+        break;
 
     case APIC_ICR:
-        rc = vlapic_reg_write(v, APIC_ICR2, (uint32_t)(msr_content >> 32));
-        if ( rc )
-            return rc;
+        if ( (uint32_t)msr_content & ~(APIC_VECTOR_MASK | APIC_MODE_MASK |
+                                       APIC_DEST_MASK | APIC_INT_ASSERT |
+                                       APIC_INT_LEVELTRIG | APIC_SHORT_MASK) )
+            return X86EMUL_UNHANDLEABLE;
+        vlapic_set_reg(vlapic, APIC_ICR2, msr_content >> 32);
         break;
 
-    case APIC_ICR2:
-        return X86EMUL_UNHANDLEABLE;
+    case APIC_SELF_IPI:
+        if ( msr_content & ~APIC_VECTOR_MASK )
+            return X86EMUL_UNHANDLEABLE;
+        offset = APIC_ICR;
+        msr_content = APIC_DEST_SELF | (msr_content & APIC_VECTOR_MASK);
+        break;
+
+    case APIC_EOI:
+    case APIC_ESR:
+        if ( msr_content )
+    default:
+            return X86EMUL_UNHANDLEABLE;
     }
 
     return vlapic_reg_write(v, offset, (uint32_t)msr_content);
@@ -904,7 +943,10 @@ static int vlapic_range(struct vcpu *v,
 {
     struct vlapic *vlapic = vcpu_vlapic(v);
     unsigned long offset  = addr - vlapic_base_address(vlapic);
-    return (!vlapic_hw_disabled(vlapic) && (offset < PAGE_SIZE));
+
+    return !vlapic_hw_disabled(vlapic) &&
+           !vlapic_x2apic_mode(vlapic) &&
+           (offset < PAGE_SIZE);
 }
 
 const struct hvm_mmio_handler vlapic_mmio_handler = {
@@ -913,10 +955,12 @@ const struct hvm_mmio_handler vlapic_mmi
     .write_handler = vlapic_write
 };
 
-void vlapic_msr_set(struct vlapic *vlapic, uint64_t value)
+bool_t vlapic_msr_set(struct vlapic *vlapic, uint64_t value)
 {
     if ( (vlapic->hw.apic_base_msr ^ value) & MSR_IA32_APICBASE_ENABLE )
     {
+        if ( unlikely(value & MSR_IA32_APICBASE_EXTD) )
+            return 0;
         if ( value & MSR_IA32_APICBASE_ENABLE )
         {
             vlapic_reset(vlapic);
@@ -925,10 +969,15 @@ void vlapic_msr_set(struct vlapic *vlapi
         }
         else
         {
+            if ( unlikely(vlapic_x2apic_mode(vlapic)) )
+                return 0;
             vlapic->hw.disabled |= VLAPIC_HW_DISABLED;
             pt_may_unmask_irq(vlapic_domain(vlapic), NULL);
         }
     }
+    else if ( !(value & MSR_IA32_APICBASE_ENABLE) &&
+              unlikely(value & MSR_IA32_APICBASE_EXTD) )
+        return 0;
 
     vlapic->hw.apic_base_msr = value;
 
@@ -943,6 +992,8 @@ void vlapic_msr_set(struct vlapic *vlapi
 
     HVM_DBG_LOG(DBG_LEVEL_VLAPIC,
                 "apic base msr is 0x%016"PRIx64, vlapic->hw.apic_base_msr);
+
+    return 1;
 }
 
 uint64_t  vlapic_tdt_msr_get(struct vlapic *vlapic)
@@ -1217,6 +1268,10 @@ static int lapic_load_hidden(struct doma
     if ( hvm_load_entry_zeroextend(LAPIC, h, &s->hw) != 0 ) 
         return -EINVAL;
 
+    if ( !(s->hw.apic_base_msr & MSR_IA32_APICBASE_ENABLE) &&
+         unlikely(vlapic_x2apic_mode(s)) )
+        return -EINVAL;
+
     vmx_vlapic_msr_changed(v);
 
     return 0;
Index: xen-4.4.2-testing/xen/arch/x86/hvm/vmx/vmx.c
===================================================================
--- xen-4.4.2-testing.orig/xen/arch/x86/hvm/vmx/vmx.c
+++ xen-4.4.2-testing/xen/arch/x86/hvm/vmx/vmx.c
@@ -3040,8 +3040,7 @@ void vmx_vmexit_handler(struct cpu_user_
         break;
 
     case EXIT_REASON_APIC_WRITE:
-        if ( vmx_handle_apic_write() )
-            hvm_inject_hw_exception(TRAP_gp_fault, 0);
+        vmx_handle_apic_write();
         break;
 
     case EXIT_REASON_ACCESS_GDTR_OR_IDTR:
Index: xen-4.4.2-testing/xen/include/asm-x86/hvm/vlapic.h
===================================================================
--- xen-4.4.2-testing.orig/xen/include/asm-x86/hvm/vlapic.h
+++ xen-4.4.2-testing/xen/include/asm-x86/hvm/vlapic.h
@@ -108,7 +108,7 @@ void vlapic_destroy(struct vcpu *v);
 
 void vlapic_reset(struct vlapic *vlapic);
 
-void vlapic_msr_set(struct vlapic *vlapic, uint64_t value);
+bool_t vlapic_msr_set(struct vlapic *vlapic, uint64_t value);
 void vlapic_tdt_msr_set(struct vlapic *vlapic, uint64_t value);
 uint64_t vlapic_tdt_msr_get(struct vlapic *vlapic);
 
++++++ 542405b4-x86-HVM-fix-ID-handling-of-x2APIC-emulation.patch ++++++
# Commit f9e0cccf7b355896d8fd9f87d66e34f77de61061
# Date 2014-09-25 14:08:20 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/HVM: fix ID handling of x2APIC emulation

- properly change ID when switching into x2APIC mode (instead of
  mimicking necessary behavior in hvm_x2apic_msr_read())
- correctly (meaningfully) set LDR (so far it ended up being 1 on all
  vCPU-s)
- even if we don't support more than 128 vCPU-s in a HVM guest for now,
  we should properly handle IDs as 32-bit values (i.e. not ignore the
  top 24 bits)
- with that, properly do cluster ID and bit mask check in
  vlapic_match_logical_addr()

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 
Acked-by: Tim Deegan 

Index: xen-4.4.2-testing/xen/arch/x86/hvm/vlapic.c
===================================================================
--- xen-4.4.2-testing.orig/xen/arch/x86/hvm/vlapic.c
+++ xen-4.4.2-testing/xen/arch/x86/hvm/vlapic.c
@@ -173,18 +173,17 @@ uint32_t vlapic_set_ppr(struct vlapic *v
    return ppr;
 }
 
-static int vlapic_match_logical_addr(struct vlapic *vlapic, uint8_t mda)
+static int vlapic_match_logical_addr(struct vlapic *vlapic, uint32_t mda)
 {
     int result = 0;
-    uint32_t logical_id;
+    uint32_t logical_id = vlapic_get_reg(vlapic, APIC_LDR);
 
     if ( vlapic_x2apic_mode(vlapic) )
-    {
-        logical_id = vlapic_get_reg(vlapic, APIC_LDR);
-        return !!(logical_id & mda);
-    }
+        return ((logical_id >> 16) == (mda >> 16)) &&
+               (uint16_t)(logical_id & mda);
 
-    logical_id = GET_xAPIC_LOGICAL_ID(vlapic_get_reg(vlapic, APIC_LDR));
+    logical_id = GET_xAPIC_LOGICAL_ID(logical_id);
+    mda = (uint8_t)mda;
 
     switch ( vlapic_get_reg(vlapic, APIC_DFR) )
     {
@@ -208,7 +207,7 @@ static int vlapic_match_logical_addr(str
 
 bool_t vlapic_match_dest(
     struct vlapic *target, struct vlapic *source,
-    int short_hand, uint8_t dest, uint8_t dest_mode)
+    int short_hand, uint32_t dest, uint8_t dest_mode)
 {
     HVM_DBG_LOG(DBG_LEVEL_VLAPIC, "target %p, source %p, dest %#x, "
                 "dest_mode %#x, short_hand %#x",
@@ -219,7 +218,8 @@ bool_t vlapic_match_dest(
     case APIC_DEST_NOSHORT:
         if ( dest_mode )
             return vlapic_match_logical_addr(target, dest);
-        return ((dest == 0xFF) || (dest == VLAPIC_ID(target)));
+        return (dest == _VLAPIC_ID(target, 0xffffffff)) ||
+               (dest == VLAPIC_ID(target));
 
     case APIC_DEST_SELF:
         return (target == source);
@@ -353,7 +353,7 @@ static void vlapic_accept_irq(struct vcp
 
 struct vlapic *vlapic_lowest_prio(
     struct domain *d, struct vlapic *source,
-    int short_hand, uint8_t dest, uint8_t dest_mode)
+    int short_hand, uint32_t dest, uint8_t dest_mode)
 {
     int old = d->arch.hvm_domain.irq.round_robin_prev_vcpu;
     uint32_t ppr, target_ppr = UINT_MAX;
@@ -438,9 +438,7 @@ void vlapic_ipi(
 
     HVM_DBG_LOG(DBG_LEVEL_VLAPIC, "icr = 0x%08x:%08x", icr_high, icr_low);
 
-    dest = (vlapic_x2apic_mode(vlapic)
-            ? icr_high
-            : GET_xAPIC_DEST_FIELD(icr_high));
+    dest = _VLAPIC_ID(vlapic, icr_high);
 
     switch ( icr_low & APIC_MODE_MASK )
     {
@@ -619,10 +617,6 @@ int hvm_x2apic_msr_read(struct vcpu *v,
     vlapic_read_aligned(vlapic, offset, &low);
     switch ( offset )
     {
-    case APIC_ID:
-        low = GET_xAPIC_ID(low);
-        break;
-
     case APIC_ICR:
         vlapic_read_aligned(vlapic, APIC_ICR2, &high);
         break;
@@ -655,6 +649,8 @@ static int vlapic_reg_write(struct vcpu
     struct vlapic *vlapic = vcpu_vlapic(v);
     int rc = X86EMUL_OKAY;
 
+    memset(&vlapic->loaded, 0, sizeof(vlapic->loaded));
+
     switch ( offset )
     {
     case APIC_ID:
@@ -955,6 +951,15 @@ const struct hvm_mmio_handler vlapic_mmi
     .write_handler = vlapic_write
 };
 
+static void set_x2apic_id(struct vlapic *vlapic)
+{
+    u32 id = vlapic_vcpu(vlapic)->vcpu_id;
+    u32 ldr = ((id & ~0xf) << 12) | (1 << (id & 0xf));
+
+    vlapic_set_reg(vlapic, APIC_ID, id * 2);
+    vlapic_set_reg(vlapic, APIC_LDR, ldr);
+}
+
 bool_t vlapic_msr_set(struct vlapic *vlapic, uint64_t value)
 {
     if ( (vlapic->hw.apic_base_msr ^ value) & MSR_IA32_APICBASE_ENABLE )
@@ -980,13 +985,10 @@ bool_t vlapic_msr_set(struct vlapic *vla
         return 0;
 
     vlapic->hw.apic_base_msr = value;
+    memset(&vlapic->loaded, 0, sizeof(vlapic->loaded));
 
     if ( vlapic_x2apic_mode(vlapic) )
-    {
-        u32 id = vlapic_get_reg(vlapic, APIC_ID);
-        u32 ldr = ((id & ~0xf) << 16) | (1 << (id & 0xf));
-        vlapic_set_reg(vlapic, APIC_LDR, ldr);
-    }
+        set_x2apic_id(vlapic);
 
     vmx_vlapic_msr_changed(vlapic_vcpu(vlapic));
 
@@ -1249,6 +1251,36 @@ static int lapic_save_regs(struct domain
     return rc;
 }
 
+/*
+ * Following lapic_load_hidden()/lapic_load_regs() we may need to
+ * correct ID and LDR when they come from an old, broken hypervisor.
+ */
+static void lapic_load_fixup(struct vlapic *vlapic)
+{
+    uint32_t id = vlapic->loaded.id;
+
+    if ( vlapic_x2apic_mode(vlapic) && id && vlapic->loaded.ldr == 1 )
+    {
+        /*
+         * This is optional: ID != 0 contradicts LDR == 1. It's being added
+         * to aid in eventual debugging of issues arising from the fixup done
+         * here, but can be dropped as soon as it is found to conflict with
+         * other (future) changes.
+         */
+        if ( GET_xAPIC_ID(id) != vlapic_vcpu(vlapic)->vcpu_id * 2 ||
+             id != SET_xAPIC_ID(GET_xAPIC_ID(id)) )
+            printk(XENLOG_G_WARNING "d%dv%d: bogus APIC ID %#x loaded\n",
+                   vlapic_domain(vlapic)->domain_id,
+                   vlapic_vcpu(vlapic)->vcpu_id, id);
+        set_x2apic_id(vlapic);
+    }
+    else /* Undo an eventual earlier fixup. */
+    {
+        vlapic_set_reg(vlapic, APIC_ID, id);
+        vlapic_set_reg(vlapic, APIC_LDR, vlapic->loaded.ldr);
+    }
+}
+
 static int lapic_load_hidden(struct domain *d, hvm_domain_context_t *h)
 {
     uint16_t vcpuid;
@@ -1268,6 +1300,10 @@ static int lapic_load_hidden(struct doma
     if ( hvm_load_entry_zeroextend(LAPIC, h, &s->hw) != 0 ) 
         return -EINVAL;
 
+    s->loaded.hw = 1;
+    if ( s->loaded.regs )
+        lapic_load_fixup(s);
+
     if ( !(s->hw.apic_base_msr & MSR_IA32_APICBASE_ENABLE) &&
          unlikely(vlapic_x2apic_mode(s)) )
         return -EINVAL;
@@ -1296,6 +1332,12 @@ static int lapic_load_regs(struct domain
     if ( hvm_load_entry(LAPIC_REGS, h, s->regs) != 0 ) 
         return -EINVAL;
 
+    s->loaded.id = vlapic_get_reg(s, APIC_ID);
+    s->loaded.ldr = vlapic_get_reg(s, APIC_LDR);
+    s->loaded.regs = 1;
+    if ( s->loaded.hw )
+        lapic_load_fixup(s);
+
     if ( hvm_funcs.process_isr )
         hvm_funcs.process_isr(vlapic_find_highest_isr(s), v);
 
Index: xen-4.4.2-testing/xen/include/asm-x86/hvm/vlapic.h
===================================================================
--- xen-4.4.2-testing.orig/xen/include/asm-x86/hvm/vlapic.h
+++ xen-4.4.2-testing/xen/include/asm-x86/hvm/vlapic.h
@@ -30,8 +30,9 @@
 #define vlapic_vcpu(x)   (container_of((x), struct vcpu, arch.hvm_vcpu.vlapic))
 #define vlapic_domain(x) (vlapic_vcpu(x)->domain)
 
-#define VLAPIC_ID(vlapic)   \
-    (GET_xAPIC_ID(vlapic_get_reg((vlapic), APIC_ID)))
+#define _VLAPIC_ID(vlapic, id) (vlapic_x2apic_mode(vlapic) \
+                                ? (id) : GET_xAPIC_ID(id))
+#define VLAPIC_ID(vlapic) _VLAPIC_ID(vlapic, vlapic_get_reg(vlapic, APIC_ID))
 
 /*
  * APIC can be disabled in two ways:
@@ -72,6 +73,10 @@
 struct vlapic {
     struct hvm_hw_lapic      hw;
     struct hvm_hw_lapic_regs *regs;
+    struct {
+        bool_t               hw, regs;
+        uint32_t             id, ldr;
+    }                        loaded;
     struct periodic_time     pt;
     s_time_t                 timer_last_update;
     struct page_info         *regs_page;
@@ -126,10 +131,10 @@ int vlapic_apicv_write(struct vcpu *v, u
 
 struct vlapic *vlapic_lowest_prio(
     struct domain *d, struct vlapic *source,
-    int short_hand, uint8_t dest, uint8_t dest_mode);
+    int short_hand, uint32_t dest, uint8_t dest_mode);
 
 bool_t vlapic_match_dest(
     struct vlapic *target, struct vlapic *source,
-    int short_hand, uint8_t dest, uint8_t dest_mode);
+    int short_hand, uint32_t dest, uint8_t dest_mode);
 
 #endif /* __ASM_X86_HVM_VLAPIC_H__ */
++++++ 54379e6d-x86-vlapic-don-t-silently-accept-bad-vectors.patch ++++++
# Commit 5f32d186a8b1eeb707cd9bc468d84335d562491c
# Date 2014-10-10 10:53:01 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/vlapic: don't silently accept bad vectors

Vectors 0-15 are reserved, and a physical LAPIC - upon sending or
receiving one - would generate an APIC error instead of doing the
requested action. Make our emulation behave similarly.

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 

Index: xen-4.4.2-testing/xen/arch/x86/hvm/vlapic.c
===================================================================
--- xen-4.4.2-testing.orig/xen/arch/x86/hvm/vlapic.c
+++ xen-4.4.2-testing/xen/arch/x86/hvm/vlapic.c
@@ -123,10 +123,34 @@ static int vlapic_find_highest_irr(struc
     return vlapic_find_highest_vector(&vlapic->regs->data[APIC_IRR]);
 }
 
+static void vlapic_error(struct vlapic *vlapic, unsigned int errmask)
+{
+    unsigned long flags;
+    uint32_t esr;
+
+    spin_lock_irqsave(&vlapic->esr_lock, flags);
+    esr = vlapic_get_reg(vlapic, APIC_ESR);
+    if ( (esr & errmask) != errmask )
+    {
+        uint32_t lvterr = vlapic_get_reg(vlapic, APIC_LVTERR);
+
+        vlapic_set_reg(vlapic, APIC_ESR, esr | errmask);
+        if ( !(lvterr & APIC_LVT_MASKED) )
+            vlapic_set_irq(vlapic, lvterr & APIC_VECTOR_MASK, 0);
+    }
+    spin_unlock_irqrestore(&vlapic->esr_lock, flags);
+}
+
 void vlapic_set_irq(struct vlapic *vlapic, uint8_t vec, uint8_t trig)
 {
     struct vcpu *target = vlapic_vcpu(vlapic);
 
+    if ( unlikely(vec < 16) )
+    {
+        vlapic_error(vlapic, APIC_ESR_RECVILL);
+        return;
+    }
+
     if ( trig )
         vlapic_set_vector(vec, &vlapic->regs->data[APIC_TMR]);
 
@@ -458,11 +482,21 @@ void vlapic_ipi(
     case APIC_DM_LOWEST: {
         struct vlapic *target = vlapic_lowest_prio(
             vlapic_domain(vlapic), vlapic, short_hand, dest, dest_mode);
-        if ( target != NULL )
+
+        if ( unlikely((icr_low & APIC_VECTOR_MASK) < 16) )
+            vlapic_error(vlapic, APIC_ESR_SENDILL);
+        else if ( target )
             vlapic_accept_irq(vlapic_vcpu(target), icr_low);
         break;
     }
 
+    case APIC_DM_FIXED:
+        if ( unlikely((icr_low & APIC_VECTOR_MASK) < 16) )
+        {
+            vlapic_error(vlapic, APIC_ESR_SENDILL);
+            break;
+        }
+        /* fall through */
     default: {
         struct vcpu *v;
         bool_t batch = is_multicast_dest(vlapic, short_hand, dest, dest_mode);
@@ -1389,6 +1423,8 @@ int vlapic_init(struct vcpu *v)
     if ( v->vcpu_id == 0 )
         vlapic->hw.apic_base_msr |= MSR_IA32_APICBASE_BSP;
 
+    spin_lock_init(&vlapic->esr_lock);
+
     tasklet_init(&vlapic->init_sipi.tasklet,
                  vlapic_init_sipi_action,
                  (unsigned long)v);
Index: xen-4.4.2-testing/xen/include/asm-x86/hvm/vlapic.h
===================================================================
--- xen-4.4.2-testing.orig/xen/include/asm-x86/hvm/vlapic.h
+++ xen-4.4.2-testing/xen/include/asm-x86/hvm/vlapic.h
@@ -77,6 +77,7 @@ struct vlapic {
         bool_t               hw, regs;
         uint32_t             id, ldr;
     }                        loaded;
+    spinlock_t               esr_lock;
     struct periodic_time     pt;
     s_time_t                 timer_last_update;
     struct page_info         *regs_page;
++++++ 54467cfc-x86-hvm-further-restrict-x2apic-MSRs.patch ++++++
# Commit 8d0a20587e4ebf3691ee88a55f91f398c4d2ee83
# Date 2014-10-21 17:34:20 +0200
# Author Andrew Cooper 
# Committer Jan Beulich 
x86/hvm: further restrict access to x2apic MSRs

The x2apic specification reserves the entire MSR range 0x800-0xbff, while only
the first 0x3f MSRs have defined purposes.  All reserved MSRs in this region
are architecturally required to raise #GP faults upon access.

Xen used to pass this entire range to hvm_x2apic_msr_{read,write}(), but the
range was restricted somewhat by XSA-108 (c/s 61fdda7ac) to prevent guests
being able to read pages adjacent to the domheap page backing the vlapic->regs
array.

While removing the vulnerability, a side effect of XSA-108 was that the MSR
range 0x900-0xbff fell through the switch statement and ends up reading the
hosts x2apic range. This behaviour is a problem in general, but specifically
it turns out that MSRs 0xa00-0xa02 are implemented (but undocumented) on
certain SandyBridge and IvyBridge systems.

Experimentally, no operating system in XenServer's test suite (including all
versions of Windows currently supported by Microsoft) ever peek at these MSRs,
even on hosts where some of them are implemented.

This patch undoes the fix for XSA-108 (c/s 61fdda7ac), returning the primary
bounds check to the entire specified range.  hvm_x2apic_msr_write() was always
safe, as it is whitelist based.  hvm_x2apic_msr_read() changes to a whitelist
approach, which avoids the vulnerability, and provides a more architecturally
accurate emulation of the reserved MSRs (which would previously read as 0
rather than fault).

Signed-off-by: Andrew Cooper 
Reviewed-by: Jan Beulich 
Acked-by: Jun Nakajima 

Index: xen-4.4.2-testing/xen/arch/x86/hvm/hvm.c
===================================================================
--- xen-4.4.2-testing.orig/xen/arch/x86/hvm/hvm.c
+++ xen-4.4.2-testing/xen/arch/x86/hvm/hvm.c
@@ -3110,7 +3110,7 @@ int hvm_msr_read_intercept(unsigned int
         *msr_content = vcpu_vlapic(v)->hw.apic_base_msr;
         break;
 
-    case MSR_IA32_APICBASE_MSR ... MSR_IA32_APICBASE_MSR + 0xff:
+    case MSR_IA32_APICBASE_MSR ... MSR_IA32_APICBASE_MSR + 0x3ff:
         if ( hvm_x2apic_msr_read(v, msr, msr_content) )
             goto gp_fault;
         break;
@@ -3237,7 +3237,7 @@ int hvm_msr_write_intercept(unsigned int
         vlapic_tdt_msr_set(vcpu_vlapic(v), msr_content);
         break;
 
-    case MSR_IA32_APICBASE_MSR ... MSR_IA32_APICBASE_MSR + 0xff:
+    case MSR_IA32_APICBASE_MSR ... MSR_IA32_APICBASE_MSR + 0x3ff:
         if ( hvm_x2apic_msr_write(v, msr, msr_content) )
             goto gp_fault;
         break;
Index: xen-4.4.2-testing/xen/arch/x86/hvm/vlapic.c
===================================================================
--- xen-4.4.2-testing.orig/xen/arch/x86/hvm/vlapic.c
+++ xen-4.4.2-testing/xen/arch/x86/hvm/vlapic.c
@@ -648,16 +648,35 @@ int hvm_x2apic_msr_read(struct vcpu *v,
     if ( !vlapic_x2apic_mode(vlapic) )
         return X86EMUL_UNHANDLEABLE;
 
-    vlapic_read_aligned(vlapic, offset, &low);
     switch ( offset )
     {
     case APIC_ICR:
         vlapic_read_aligned(vlapic, APIC_ICR2, &high);
+        /* Fallthrough. */
+    case APIC_ID:
+    case APIC_LVR:
+    case APIC_TASKPRI:
+    case APIC_PROCPRI:
+    case APIC_LDR:
+    case APIC_SPIV:
+    case APIC_ISR ... APIC_ISR + 0x70:
+    case APIC_TMR ... APIC_TMR + 0x70:
+    case APIC_IRR ... APIC_IRR + 0x70:
+    case APIC_ESR:
+    case APIC_CMCI:
+    case APIC_LVTT:
+    case APIC_LVTTHMR:
+    case APIC_LVTPC:
+    case APIC_LVT0:
+    case APIC_LVT1:
+    case APIC_LVTERR:
+    case APIC_TMICT:
+    case APIC_TMCCT:
+    case APIC_TDCR:
+        vlapic_read_aligned(vlapic, offset, &low);
         break;
 
-    case APIC_EOI:
-    case APIC_ICR2:
-    case APIC_SELF_IPI:
+    default:
         return X86EMUL_UNHANDLEABLE;
     }
 
++++++ 5459f759-xentop-dynamically-expand-columns.patch ++++++
Subject: xentop: Dynamically expand some columns
From: Markus Hauschild Markus.Hauschild@rz.uni-regensburg.de Wed Oct 29 12:24:32 2014 +0100
Date: Wed Nov 5 10:09:29 2014 +0000:
Git: 1210f81cdf1b846091d8e6042923d68403cc53e2

Allow certain xentop columns to automatically expand as the amount
of data reported gets larger.  The columns allowed to auto expand are:

NETTX(k), NETRX(k), VBD_RD, VBD_WR, VBD_RSECT, VBD_WSECT

If the -f option is used to allow full length VM names, those names will
also be aligned based on the longest name in the NAME column.

The default minimum width of all columns remains unchanged.

Signed-off-by: Markus Hauschild 
Signed-off-by: Charles Arnold 
Acked-by: Ian Campbell 

diff --git a/tools/xenstat/xentop/Makefile b/tools/xenstat/xentop/Makefile
index 18bccb6..076e44c 100644
--- a/tools/xenstat/xentop/Makefile
+++ b/tools/xenstat/xentop/Makefile
@@ -19,7 +19,7 @@ all install xentop:
 else
 
 CFLAGS += -DGCC_PRINTF -Wall -Werror $(CFLAGS_libxenstat)
-LDLIBS += $(LDLIBS_libxenstat) $(CURSES_LIBS) $(SOCKET_LIBS)
+LDLIBS += $(LDLIBS_libxenstat) $(CURSES_LIBS) $(SOCKET_LIBS) -lm
 CFLAGS += -DHOST_$(XEN_OS)
 
 # Include configure output (config.h) to headers search path
diff --git a/tools/xenstat/xentop/xentop.c b/tools/xenstat/xentop/xentop.c
index dd11927..3062cb5 100644
--- a/tools/xenstat/xentop/xentop.c
+++ b/tools/xenstat/xentop/xentop.c
@@ -27,6 +27,7 @@
 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -70,6 +71,8 @@
 #define curses_str_t const char *
 #endif
 
+#define INT_FIELD_WIDTH(n) ((unsigned int)(log10(n) + 1))
+
 /*
  * Function prototypes
  */
@@ -127,7 +130,8 @@ static int compare_vbd_rsect(xenstat_domain *domain1, xenstat_domain *domain2);
 static void print_vbd_rsect(xenstat_domain *domain);
 static int compare_vbd_wsect(xenstat_domain *domain1, xenstat_domain *domain2);
 static void print_vbd_wsect(xenstat_domain *domain);
-
+static void reset_field_widths(void);
+static void adjust_field_widths(xenstat_domain *domain);
 
 /* Section printing functions */
 static void do_summary(void);
@@ -444,7 +448,7 @@ int compare_name(xenstat_domain *domain1, xenstat_domain *domain2)
 void print_name(xenstat_domain *domain)
 {
 	if(show_full_name)
-		print("%10s", xenstat_domain_name(domain));
+		print("%*s", fields[FIELD_NAME-1].default_width, xenstat_domain_name(domain));
 	else
 		print("%10.10s", xenstat_domain_name(domain));
 }
@@ -623,7 +627,7 @@ static int compare_net_tx(xenstat_domain *domain1, xenstat_domain *domain2)
 /* Prints number of total network tx bytes statistic */
 static void print_net_tx(xenstat_domain *domain)
 {
-	print("%8llu", tot_net_bytes(domain, FALSE)/1024);
+	print("%*llu", fields[FIELD_NET_TX-1].default_width, tot_net_bytes(domain, FALSE)/1024);
 }
 
 /* Compares number of total network rx bytes of two domains, returning -1,0,1
@@ -637,7 +641,7 @@ static int compare_net_rx(xenstat_domain *domain1, xenstat_domain *domain2)
 /* Prints number of total network rx bytes statistic */
 static void print_net_rx(xenstat_domain *domain)
 {
-	print("%8llu", tot_net_bytes(domain, TRUE)/1024);
+	print("%*llu", fields[FIELD_NET_RX-1].default_width, tot_net_bytes(domain, TRUE)/1024);
 }
 
 /* Gets number of total network bytes statistic, if rx true, then rx bytes
@@ -705,7 +709,7 @@ static int compare_vbd_rd(xenstat_domain *domain1, xenstat_domain *domain2)
 /* Prints number of total VBD READ requests statistic */
 static void print_vbd_rd(xenstat_domain *domain)
 {
-	print("%8llu", tot_vbd_reqs(domain, FIELD_VBD_RD));
+	print("%*llu", fields[FIELD_VBD_RD-1].default_width, tot_vbd_reqs(domain, FIELD_VBD_RD));
 }
 
 /* Compares number of total VBD WRITE requests of two domains,
@@ -719,7 +723,7 @@ static int compare_vbd_wr(xenstat_domain *domain1, xenstat_domain *domain2)
 /* Prints number of total VBD WRITE requests statistic */
 static void print_vbd_wr(xenstat_domain *domain)
 {
-	print("%8llu", tot_vbd_reqs(domain, FIELD_VBD_WR));
+	print("%*llu", fields[FIELD_VBD_WR-1].default_width, tot_vbd_reqs(domain, FIELD_VBD_WR));
 }
 
 /* Compares number of total VBD READ sectors of two domains,
@@ -733,7 +737,7 @@ static int compare_vbd_rsect(xenstat_domain *domain1, xenstat_domain *domain2)
 /* Prints number of total VBD READ sectors statistic */
 static void print_vbd_rsect(xenstat_domain *domain)
 {
-	print("%10llu", tot_vbd_reqs(domain, FIELD_VBD_RSECT));
+	print("%*llu", fields[FIELD_VBD_RSECT-1].default_width, tot_vbd_reqs(domain, FIELD_VBD_RSECT));
 }
 
 /* Compares number of total VBD WRITE sectors of two domains,
@@ -747,7 +751,7 @@ static int compare_vbd_wsect(xenstat_domain *domain1, xenstat_domain *domain2)
 /* Prints number of total VBD WRITE sectors statistic */
 static void print_vbd_wsect(xenstat_domain *domain)
 {
-	print("%10llu", tot_vbd_reqs(domain, FIELD_VBD_WSECT));
+	print("%*llu", fields[FIELD_VBD_WSECT-1].default_width, tot_vbd_reqs(domain, FIELD_VBD_WSECT));
 }
 
 
@@ -806,6 +810,54 @@ static void print_ssid(xenstat_domain *domain)
 	print("%4u", xenstat_domain_ssid(domain));
 }
 
+/* Resets default_width for fields with potentially large numbers */
+void reset_field_widths(void)
+{
+	fields[FIELD_NET_TX-1].default_width = 8;
+	fields[FIELD_NET_RX-1].default_width = 8;
+	fields[FIELD_VBD_RD-1].default_width = 8;
+	fields[FIELD_VBD_WR-1].default_width = 8;
+	fields[FIELD_VBD_RSECT-1].default_width = 10;
+	fields[FIELD_VBD_WSECT-1].default_width = 10;
+}
+
+/* Adjusts default_width for fields with potentially large numbers */
+void adjust_field_widths(xenstat_domain *domain)
+{
+	unsigned int length;
+
+	if (show_full_name) {
+		length = strlen(xenstat_domain_name(domain));
+		if (length > fields[FIELD_NAME-1].default_width)
+			fields[FIELD_NAME-1].default_width = length;
+	}
+
+	length = INT_FIELD_WIDTH((tot_net_bytes(domain, FALSE)/1024) + 1);
+	if (length > fields[FIELD_NET_TX-1].default_width)
+		fields[FIELD_NET_TX-1].default_width = length;
+
+	length = INT_FIELD_WIDTH((tot_net_bytes(domain, TRUE)/1024) + 1);
+	if (length > fields[FIELD_NET_RX-1].default_width)
+		fields[FIELD_NET_RX-1].default_width = length;
+
+	length = INT_FIELD_WIDTH((tot_vbd_reqs(domain, FIELD_VBD_RD)) + 1);
+	if (length > fields[FIELD_VBD_RD-1].default_width)
+		fields[FIELD_VBD_RD-1].default_width = length;
+
+	length = INT_FIELD_WIDTH((tot_vbd_reqs(domain, FIELD_VBD_WR)) + 1);
+	if (length > fields[FIELD_VBD_WR-1].default_width)
+		fields[FIELD_VBD_WR-1].default_width = length;
+
+	length = INT_FIELD_WIDTH((tot_vbd_reqs(domain, FIELD_VBD_RSECT)) + 1);
+	if (length > fields[FIELD_VBD_RSECT-1].default_width)
+		fields[FIELD_VBD_RSECT-1].default_width = length;
+
+	length = INT_FIELD_WIDTH((tot_vbd_reqs(domain, FIELD_VBD_WSECT)) + 1);
+	if (length > fields[FIELD_VBD_WSECT-1].default_width)
+		fields[FIELD_VBD_WSECT-1].default_width = length;
+}
+
+
 /* Section printing functions */
 /* Prints the top summary, above the domain table */
 void do_summary(void)
@@ -1088,6 +1140,12 @@ static void top(void)
 	if(first_domain_index >= num_domains)
 		first_domain_index = num_domains-1;
 
+	/* Adjust default_width for fields with potentially large numbers */
+	reset_field_widths();
+	for (i = first_domain_index; i < num_domains; i++) {
+		adjust_field_widths(domains[i]);
+	}
+
 	for (i = first_domain_index; i < num_domains; i++) {
 		if(!batch && current_row() == lines()-1)
 			break;
++++++ 5489c2cf-have-architectures-specify-Dom0-PIRQs.patch ++++++
References: bsc#901488

# Commit 7e73a6e7f12ae080222c5d339799905de3443a6e
# Date 2014-12-11 17:14:07 +0100
# Author Jan Beulich 
# Committer Jan Beulich 
have architectures specify the number of PIRQs Dom0 gets

The current value of nr_static_irqs + 256 is often too small for larger
systems. Make it dependent on CPU count and number of IO-APIC pins on
x86, and (until it obtains PCI support) simply NR_IRQS on ARM.

Signed-off-by: Jan Beulich 
Acked-by: David Vrabel 
Acked-by: Ian Campbell 

# Commit 75d28c917094b0e264874e92e8980b00a372b99f
# Date 2015-05-22 10:13:04 +0200
# Author Andrew Cooper 
# Committer Jan Beulich 
x86/irq: limit the maximum number of domain PIRQs

c/s 7e73a6e "have architectures specify the number of PIRQs a hardware domain
gets" increased the default number of pirqs for dom0, as 256 was found to be
too low in some cases.

However, it didn't account for the upper bound presented by the domains EOI
bitmap, registered with the PHYSDEVOP_pirq_eoi_gmfn_v* hypercall.

On a server with 240 cpus, Xen was observed to be attempting to clear the EOI
bit for dom0's pirq 0xb40f, which hit a pagefault.

Signed-off-by: Andrew Cooper 

--- a/docs/misc/xen-command-line.markdown
+++ b/docs/misc/xen-command-line.markdown
@@ -540,13 +540,16 @@ effect the inverse meaning.
 ### extra\_guest\_irqs
...
`= [<domU number>][,<dom0 number>]`
-> Default: `32,256`
+> Default: `32,<variable>`
 
 Change the number of PIRQs available for guests.  The optional first number is
 common for all domUs, while the optional second number (preceded by a comma)
 is for dom0.  Changing the setting for domU has no impact on dom0 and vice
 versa.  For example to change dom0 without changing domU, use
-`extra_guest_irqs=,512`
+`extra_guest_irqs=,512`.  The default value for Dom0 is architecture
+dependent.
+Note that specifying zero as domU value means zero, while for dom0 it means
+to use the default.
 
 ### flask\_enabled
...
`= <integer>`
--- a/xen/arch/x86/domain_build.c
+++ b/xen/arch/x86/domain_build.c
@@ -100,7 +100,7 @@ static void __init parse_dom0_max_vcpus(
 }
 custom_param("dom0_max_vcpus", parse_dom0_max_vcpus);
-struct vcpu *__init alloc_dom0_vcpu0(void)
+unsigned int __init dom0_max_vcpus(void)
 {
     unsigned max_vcpus;
 
@@ -112,6 +112,13 @@ struct vcpu *__init alloc_dom0_vcpu0(voi
     if ( max_vcpus > MAX_VIRT_CPUS )
         max_vcpus = MAX_VIRT_CPUS;
 
+    return max_vcpus;
+}
+
+struct vcpu *__init alloc_dom0_vcpu0(void)
+{
+    unsigned int max_vcpus = dom0_max_vcpus();
+
     dom0->vcpu = xzalloc_array(struct vcpu *, max_vcpus);
     if ( !dom0->vcpu )
         return NULL;
--- a/xen/arch/x86/io_apic.c
+++ b/xen/arch/x86/io_apic.c
@@ -33,6 +33,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -2606,3 +2607,17 @@ void __init init_ioapic_mappings(void)
            nr_irqs_gsi, nr_irqs - nr_irqs_gsi);
 }
 
+unsigned int arch_dom0_irqs(void)
+{
+    unsigned int n = min_t(unsigned int, fls(num_present_cpus()),
+                           dom0_max_vcpus());
+
+    n = min(nr_irqs_gsi + n * NR_DYNAMIC_VECTORS, nr_irqs);
+
+    /* Bounded by the domain pirq eoi bitmap gfn. */
+    n = min_t(unsigned int, n, PAGE_SIZE * BITS_PER_BYTE);
+
+    printk("Dom0 has maximum %u PIRQs\n", n);
+
+    return n;
+}
--- a/xen/arch/x86/irq.c
+++ b/xen/arch/x86/irq.c
@@ -1070,13 +1070,19 @@ bool_t cpu_has_pending_apic_eoi(void)
 static inline void set_pirq_eoi(struct domain *d, unsigned int irq)
 {
     if ( is_pv_domain(d) && d->arch.pv_domain.pirq_eoi_map )
+    {
+        ASSERT(irq < PAGE_SIZE * BITS_PER_BYTE);
         set_bit(irq, d->arch.pv_domain.pirq_eoi_map);
+    }
 }
 
 static inline void clear_pirq_eoi(struct domain *d, unsigned int irq)
 {
     if ( is_pv_domain(d) && d->arch.pv_domain.pirq_eoi_map )
+    {
+        ASSERT(irq < PAGE_SIZE * BITS_PER_BYTE);
         clear_bit(irq, d->arch.pv_domain.pirq_eoi_map);
+    }
 }
 
 static void set_eoi_ready(void *data);
--- a/xen/common/domain.c
+++ b/xen/common/domain.c
@@ -183,7 +183,7 @@ struct vcpu *alloc_vcpu(
     return v;
 }
 
-static unsigned int __read_mostly extra_dom0_irqs = 256;
+static unsigned int __read_mostly extra_dom0_irqs;
 static unsigned int __read_mostly extra_domU_irqs = 32;
 static void __init parse_extra_guest_irqs(const char *s)
 {
@@ -270,7 +270,8 @@ struct domain *domain_create(
         if ( domid )
             d->nr_pirqs = nr_static_irqs + extra_domU_irqs;
         else
-            d->nr_pirqs = nr_static_irqs + extra_dom0_irqs;
+            d->nr_pirqs = extra_dom0_irqs ? nr_static_irqs + extra_dom0_irqs
+                                          : arch_dom0_irqs();
         if ( d->nr_pirqs > nr_irqs )
             d->nr_pirqs = nr_irqs;
 
--- a/xen/include/asm-arm/irq.h
+++ b/xen/include/asm-arm/irq.h
@@ -21,10 +21,10 @@ struct irq_cfg {
 
 #define NR_LOCAL_IRQS	32
 #define NR_IRQS		1024
-#define nr_irqs NR_IRQS
 
 #define nr_irqs NR_IRQS
 #define nr_static_irqs NR_IRQS
+#define arch_dom0_irqs() NR_IRQS
 
 struct irq_desc;
 struct irqaction;
--- a/xen/include/asm-x86/setup.h
+++ b/xen/include/asm-x86/setup.h
@@ -36,6 +36,8 @@ int construct_dom0(
 unsigned long initial_images_nrpages(void);
 void discard_initial_images(void);
 
+unsigned int dom0_max_vcpus(void);
+
 int xen_in_range(unsigned long mfn);
 
 void microcode_grab_module(
--- a/xen/include/xen/irq.h
+++ b/xen/include/xen/irq.h
@@ -149,4 +149,8 @@ static inline void set_native_irq_info(u
 
 unsigned int set_desc_affinity(struct irq_desc *, const cpumask_t *);
 
+#ifndef arch_dom0_irqs
+unsigned int arch_dom0_irqs(void);
+#endif
+
 #endif /* __XEN_IRQ_H__ */
++++++ 548e9c0d-console-allocate-ring-buffer-earlier.patch ++++++
# Commit 2676bc915157ab474ee478d929b0928cf696b385
# Date 2014-12-15 09:30:05 +0100
# Author Jan Beulich 
# Committer Jan Beulich 
console: allocate ring buffer earlier

... when "conring_size=" was specified on the command line. We can't
really do this as early as we would want to when the option was not
specified, as the default depends on knowing the system CPU count. Yet
the parsing of the ACPI tables is one of the things that generates a
lot of output especially on large systems.

Signed-off-by: Jan Beulich 
Acked-by: Ian Campbell  (ARM and generic bits)

--- a/xen/arch/arm/setup.c
+++ b/xen/arch/arm/setup.c
@@ -684,6 +684,7 @@ void __init start_xen(unsigned long boot
 
     dt_uart_init();
     console_init_preirq();
+    console_init_ring();
 
     system_state = SYS_STATE_boot;
 
--- a/xen/arch/x86/setup.c
+++ b/xen/arch/x86/setup.c
@@ -1188,6 +1188,7 @@ void __init __start_xen(unsigned long mb
     }
 
     vm_init();
+    console_init_ring();
     vesa_init();
 
     softirq_init();
--- a/xen/drivers/char/console.c
+++ b/xen/drivers/char/console.c
@@ -684,15 +684,14 @@ void __init console_init_preirq(void)
     }
 }
 
-void __init console_init_postirq(void)
+void __init console_init_ring(void)
 {
     char *ring;
     unsigned int i, order, memflags;
-
-    serial_init_postirq();
+    unsigned long flags;
 
     if ( !opt_conring_size )
-        opt_conring_size = num_present_cpus() << (9 + xenlog_lower_thresh);
+        return;
 
     order = get_order_from_bytes(max(opt_conring_size, conring_size));
     memflags = MEMF_bits(crashinfo_maxaddr_bits);
@@ -703,17 +702,30 @@ void __init console_init_postirq(void)
     }
     opt_conring_size = PAGE_SIZE << order;
 
-    spin_lock_irq(&console_lock);
+    spin_lock_irqsave(&console_lock, flags);
     for ( i = conringc ; i != conringp; i++ )
         ring[i & (opt_conring_size - 1)] = conring[i & (conring_size - 1)];
     conring = ring;
     smp_wmb(); /* Allow users of console_force_unlock() to see larger buffer. */
     conring_size = opt_conring_size;
-    spin_unlock_irq(&console_lock);
+    spin_unlock_irqrestore(&console_lock, flags);
 
     printk("Allocated console ring of %u KiB.\n", opt_conring_size >> 10);
 }
 
+void __init console_init_postirq(void)
+{
+    serial_init_postirq();
+
+    if ( conring != _conring )
+        return;
+
+    if ( !opt_conring_size )
+        opt_conring_size = num_present_cpus() << (9 + xenlog_lower_thresh);
+
+    console_init_ring();
+}
+
 void __init console_endboot(void)
 {
     int i, j;
--- a/xen/include/xen/console.h
+++ b/xen/include/xen/console.h
@@ -14,6 +14,7 @@ struct xen_sysctl_readconsole;
 long read_console_ring(struct xen_sysctl_readconsole *op);
 
 void console_init_preirq(void);
+void console_init_ring(void);
 void console_init_postirq(void);
 void console_endboot(void);
 int console_has(const char *device);
++++++ 54f4985f-libxl-fix-libvirtd-double-free.patch ++++++
References: bsc#949138

Subject: libxl: make some _dispose functions idempotent and tolerate NULL
From: Wei Liu wei.liu2@citrix.com Wed Feb 25 14:56:02 2015 +0000
Date: Mon Mar 2 17:05:35 2015 +0000:
Git: 1ea68f1a82ef94b3cc644fa70307c5151f356baf

These functions are not generated, so we need to do it by hand.

Functions list:
 libxl_bitmap_dispose
 libxl_string_list_dispose
 libxl_key_value_list_dipose
 libxl_cpuid_dispose

Signed-off-by: Wei Liu 
Cc: Ian Campbell 
Cc: Ian Jackson 
Acked-by: Ian Campbell 

Index: xen-4.4.3-testing/tools/libxl/libxl.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl.c
+++ xen-4.4.3-testing/tools/libxl/libxl.c
@@ -195,9 +195,12 @@ void libxl_string_list_dispose(libxl_str
     if (!sl)
         return;
 
-    for (i = 0; sl[i] != NULL; i++)
+    for (i = 0; sl[i] != NULL; i++) {
         free(sl[i]);
+        sl[i] = NULL;
+    }
     free(sl);
+    *psl = NULL;
 }
 
 int libxl_string_list_length(const libxl_string_list *psl)
@@ -221,10 +224,14 @@ void libxl_key_value_list_dispose(libxl_
 
     for (i = 0; kvl[i] != NULL; i += 2) {
         free(kvl[i]);
-        if (kvl[i + 1])
+        kvl[i] = NULL;
+        if (kvl[i + 1]) {
             free(kvl[i + 1]);
+            kvl[i+1] = NULL;
+        }
     }
     free(kvl);
+    *pkvl = NULL;
 }
 
 #define LIBXL__DEFBOOL_DEFAULT (0)
Index: xen-4.4.3-testing/tools/libxl/libxl_cpuid.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl_cpuid.c
+++ xen-4.4.3-testing/tools/libxl/libxl_cpuid.c
@@ -23,10 +23,13 @@ void libxl_cpuid_dispose(libxl_cpuid_pol
         return;
     for (i = 0; cpuid_list[i].input[0] != XEN_CPUID_INPUT_UNUSED; i++) {
         for (j = 0; j < 4; j++)
-            if (cpuid_list[i].policy[j] != NULL)
+            if (cpuid_list[i].policy[j] != NULL) {
                 free(cpuid_list[i].policy[j]);
+                cpuid_list[i].policy[j] = NULL;
+            }
     }
     free(cpuid_list);
+    *p_cpuid_list = NULL;
     return;
 }
 
Index: xen-4.4.3-testing/tools/libxl/libxl_utils.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl_utils.c
+++ xen-4.4.3-testing/tools/libxl/libxl_utils.c
@@ -570,7 +570,12 @@ void libxl_bitmap_init(libxl_bitmap *map
 
 void libxl_bitmap_dispose(libxl_bitmap *map)
 {
+    if (!map)
+        return;
+
     free(map->map);
+    map->map = NULL;
+    map->size = 0;
 }
 
 void libxl_bitmap_copy(libxl_ctx *ctx, libxl_bitmap *dptr,
++++++ 551ac326-xentop-add-support-for-qdisk.patch ++++++
++++ 630 lines (skipped)

++++++ 5527edd2-x86-hvm-Fix-the-unknown-nested-vmexit-reason-80000021-bug.patch ++++++
# Commit f7708796db463410a97b5fa3dd5902f6e8a1d102
# Date 2015-04-10 11:35:46 -0400
# Author Liang Li 
# Committer Konrad Rzeszutek Wilk 
x86/hvm: Fix the unknown nested vmexit reason 80000021 bug

This bug will be trigged when NMI happen in the L2 guest. The current
code handles the NMI incorrectly. According to Intel SDM 31.7.1.2
(Resuming Guest Software after Handling an Exception), If bit 31 of the
IDT-vectoring information fields is set, and the virtual NMIs VM-execution
control is 1, while bits 10:8 in the IDT-vectoring information field is
2, bit 3 in the interruptibility-state field should be cleared to avoid
the next VM entry fail.

Signed-off-by: Liang Li 
Acked-by: Kevin Tian 
Acked-by: Andrew Cooper 

--- a/xen/arch/x86/hvm/vmx/vmx.c
+++ b/xen/arch/x86/hvm/vmx/vmx.c
@@ -2505,7 +2505,8 @@ static void vmx_idtv_reinject(unsigned l
          * Clear NMI-blocking interruptibility info if an NMI delivery faulted.
          * Re-delivery will re-set it (see SDM 3B 25.7.1.2).
          */
-        if ( (idtv_info & INTR_INFO_INTR_TYPE_MASK) == (X86_EVENTTYPE_NMI<<8) )
+        if ( cpu_has_vmx_vnmi && ((idtv_info & INTR_INFO_INTR_TYPE_MASK) ==
+                                 (X86_EVENTTYPE_NMI<<8)) )
         {
             unsigned long intr_info;
 
@@ -2656,8 +2657,7 @@ void vmx_vmexit_handler(struct cpu_user_
     hvm_maybe_deassert_evtchn_irq();
 
     __vmread(IDT_VECTORING_INFO, &idtv_info);
-    if ( !nestedhvm_vcpu_in_guestmode(v) && 
-         exit_reason != EXIT_REASON_TASK_SWITCH )
+    if ( exit_reason != EXIT_REASON_TASK_SWITCH )
         vmx_idtv_reinject(idtv_info);
 
     switch ( exit_reason )
++++++ 552d293b-x86-vMSI-X-honor-all-mask-requests.patch ++++++
# Commit 70a3cbb8c9cb17a61fa25c48ba3d7b44fd059c90
# Date 2015-04-14 16:50:35 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/vMSI-X: honor all mask requests

Commit 74fd0036de ("x86: properly handle MSI-X unmask operation from
guests") didn't go far enough: it fixed an issue with unmasking, but
left an issue with masking in place: Due to the (late) point in time
when qemu requests the hypervisor to set up MSI-X interrupts (which is
where the MMIO intercept gets put in place), the hypervisor doesn't
see all guest writes, and hence shouldn't make assumptions on the state
the virtual MSI-X resources are in. Bypassing the rest of the logic on
a guest mask operation leads to

[00:04.0] pci_msix_write: Error: Can't update msix entry 1 since MSI-X is already enabled.

which surprisingly enough doesn't lead to the device not working
anymore (I didn't dig in deep enough to figure out why that is). But it
does prevent the IRQ to be migrated inside the guest, i.e. all
interrupts will always arrive in vCPU 0.

Signed-off-by: Jan Beulich 
Reviewed-by: Konrad Rzeszutek Wilk 
Reviewed-by: Andrew Cooper 

--- a/xen/arch/x86/hvm/vmsi.c
+++ b/xen/arch/x86/hvm/vmsi.c
@@ -295,11 +295,11 @@ static int msixtbl_write(struct vcpu *v,
         goto out;
     }
 
-    /* exit to device model if address/data has been modified */
-    if ( test_and_clear_bit(nr_entry, &entry->table_flags) )
+    /* Exit to device model when unmasking and address/data got modified. */
+    if ( !(val & PCI_MSIX_VECTOR_BITMASK) &&
+         test_and_clear_bit(nr_entry, &entry->table_flags) )
     {
-        if ( !(val & PCI_MSIX_VECTOR_BITMASK) )
-            v->arch.hvm_vcpu.hvm_io.msix_unmask_address = address;
+        v->arch.hvm_vcpu.hvm_io.msix_unmask_address = address;
         goto out;
     }
 
++++++ 552d2966-x86-vMSI-X-add-valid-bits-for-read-acceleration.patch ++++++
# Commit df9f5676b3711c95127d44e871ad7ca38d6ed28a
# Date 2015-04-14 16:51:18 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/vMSI-X: add valid bits for read acceleration

Again because Xen doesn't get to see all guest writes, it shouldn't
serve reads from its cache before having seen a write to the respective
address.

Also use DECLARE_BITMAP() in a related field declaration instead of
open coding it.

Signed-off-by: Jan Beulich 
Reviewed-by: Konrad Rzeszutek Wilk 
Reviewed-by: Andrew Cooper 

--- a/xen/arch/x86/hvm/vmsi.c
+++ b/xen/arch/x86/hvm/vmsi.c
@@ -163,11 +163,14 @@ struct msixtbl_entry
     struct pci_dev *pdev;
     unsigned long gtable;       /* gpa of msix table */
     unsigned long table_len;
-    unsigned long table_flags[BITS_TO_LONGS(MAX_MSIX_TABLE_ENTRIES)];
+    DECLARE_BITMAP(table_flags, MAX_MSIX_TABLE_ENTRIES);
 #define MAX_MSIX_ACC_ENTRIES 3
     struct { 
         uint32_t msi_ad[3];	/* Shadow of address low, high and data */
     } gentries[MAX_MSIX_ACC_ENTRIES];
+    DECLARE_BITMAP(acc_valid, 3 * MAX_MSIX_ACC_ENTRIES);
+#define acc_bit(what, ent, slot, idx) \
+        what##_bit((slot) * 3 + (idx), (ent)->acc_valid)
     struct rcu_head rcu;
 };
 
@@ -242,9 +245,10 @@ static int msixtbl_read(
     if ( offset != PCI_MSIX_ENTRY_VECTOR_CTRL_OFFSET )
     {
         nr_entry = (address - entry->gtable) / PCI_MSIX_ENTRY_SIZE;
-        if ( nr_entry >= MAX_MSIX_ACC_ENTRIES )
-            goto out;
         index = offset / sizeof(uint32_t);
+        if ( nr_entry >= MAX_MSIX_ACC_ENTRIES ||
+             !acc_bit(test, entry, nr_entry, index) )
+            goto out;
         *pval = entry->gentries[nr_entry].msi_ad[index];
     }
     else 
@@ -290,6 +294,7 @@ static int msixtbl_write(struct vcpu *v,
         {
             index = offset / sizeof(uint32_t);
             entry->gentries[nr_entry].msi_ad[index] = val;
+            acc_bit(set, entry, nr_entry, index);
         }
         set_bit(nr_entry, &entry->table_flags);
         goto out;
++++++ 5548e903-domctl-don-t-truncate-XEN_DOMCTL_max_mem-requests.patch ++++++
# Commit 017e667c433a1040306db6265b05e104568c70c8
# Date 2015-05-05 18:00:03 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
domctl: don't truncate XEN_DOMCTL_max_mem requests

Instead saturate the value if the input can't be represented in the
respective struct domain field.

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 
Acked-by: Tim Deegan 

--- a/xen/common/domctl.c
+++ b/xen/common/domctl.c
@@ -740,7 +740,7 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xe
 
     case XEN_DOMCTL_max_mem:
     {
-        unsigned long new_max;
+        uint64_t new_max;
 
         ret = -EINVAL;
         new_max = op->u.max_mem.max_memkb >> (PAGE_SHIFT-10);
@@ -751,7 +751,7 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xe
          * that the domain will now be allowed to "ratchet" down to new_max. In
          * the meantime, while tot > max, all new allocations are disallowed.
          */
-        d->max_pages = new_max;
+        d->max_pages = min(new_max, (uint64_t)(typeof(d->max_pages))-1);
         ret = 0;
         spin_unlock(&d->page_alloc_lock);
     }
++++++ 5576f143-x86-adjust-PV-I-O-emulation-functions-types.patch ++++++
References: bsc#907514 bsc#910258 bsc#918984 bsc#923967

# Commit 85baced14dec2fafa9fe560969dba2ae28e8bebb
# Date 2015-06-09 15:59:31 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86: adjust PV I/O emulation functions' types

admin_io_okay(), guest_io_read(), and guest_io_write() all don't need
their current "regs" parameter at all, and they don't use the vCPU
passed to them for other than obtaining its domain. Drop the former and
replace the latter by a struct domain pointer.

pci_cfg_okay() returns a boolean type, and its "write" parameter is of
boolean kind too.

All of them get called for the current vCPU (and hence current domain)
only, so name the domain parameters accordingly except in the
admin_io_okay() case, which a subsequent patch will use for simplifying
setup_io_bitmap().

Latch current->domain into a local variable in emulate_privileged_op().

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 

# Commit 2d67a7a4d37a4759bcd7f2ee2d740497ad669c7d
# Date 2015-06-18 15:07:10 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86: synchronize PCI config space access decoding

Both PV and HVM logic have similar but not similar enough code here.
Synchronize the two so that
- in the HVM case we don't unconditionally try to access extended
  config space
- in the PV case we pass a correct range to the XSM hook
- in the PV case we don't needlessly deny access when the operation
  isn't really on PCI config space
All this along with sharing the macros HVM already had here.

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 

Backport stripped down to just the pci_cfg_ok() adjustments.

--- a/xen/arch/x86/traps.c
+++ b/xen/arch/x86/traps.c
@@ -1660,14 +1660,18 @@ static int admin_io_okay(
     return ioports_access_permitted(v->domain, port, port + bytes - 1);
 }
 
-static int pci_cfg_ok(struct domain *d, int write, int size)
+static bool_t pci_cfg_ok(struct domain *currd, bool_t write,
+                         unsigned int start, unsigned int size)
 {
     uint32_t machine_bdf;
-    uint16_t start, end;
-    if (!is_hardware_domain(d))
+
+    if ( !is_hardware_domain(currd) )
         return 0;
 
-    machine_bdf = (d->arch.pci_cf8 >> 8) & 0xFFFF;
+    if ( !CF8_ENABLED(currd->arch.pci_cf8) )
+        return 1;
+
+    machine_bdf = CF8_BDF(currd->arch.pci_cf8);
     if ( write )
     {
         const unsigned long *ro_map = pci_get_ro_map(0);
@@ -1675,9 +1679,9 @@ static int pci_cfg_ok(struct domain *d, 
         if ( ro_map && test_bit(machine_bdf, ro_map) )
             return 0;
     }
-    start = d->arch.pci_cf8 & 0xFF;
+    start |= CF8_ADDR_LO(currd->arch.pci_cf8);
     /* AMD extended configuration space access? */
-    if ( (d->arch.pci_cf8 & 0x0F000000) &&
+    if ( CF8_ADDR_HI(currd->arch.pci_cf8) &&
          boot_cpu_data.x86_vendor == X86_VENDOR_AMD &&
          boot_cpu_data.x86 >= 0x10 && boot_cpu_data.x86 <= 0x17 )
     {
@@ -1686,12 +1690,11 @@ static int pci_cfg_ok(struct domain *d, 
         if ( rdmsr_safe(MSR_AMD64_NB_CFG, msr_val) )
             return 0;
         if ( msr_val & (1ULL << AMD64_NB_CFG_CF8_EXT_ENABLE_BIT) )
-            start |= (d->arch.pci_cf8 >> 16) & 0xF00;
+            start |= CF8_ADDR_HI(currd->arch.pci_cf8);
     }
-    end = start + size - 1;
-    if (xsm_pci_config_permission(XSM_HOOK, d, machine_bdf, start, end, write))
-        return 0;
-    return 1;
+
+    return !xsm_pci_config_permission(XSM_HOOK, currd, machine_bdf,
+                                      start, start + size - 1, write);
 }
 
 uint32_t guest_io_read(
@@ -1745,7 +1748,7 @@ uint32_t guest_io_read(
             size = min(bytes, 4 - (port & 3));
             if ( size == 3 )
                 size = 2;
-            if ( pci_cfg_ok(v->domain, 0, size) )
+            if ( pci_cfg_ok(v->domain, 0, port & 3, size) )
                 sub_data = pci_conf_read(v->domain->arch.pci_cf8, port & 3, size);
         }
 
@@ -1818,7 +1821,7 @@ void guest_io_write(
             size = min(bytes, 4 - (port & 3));
             if ( size == 3 )
                 size = 2;
-            if ( pci_cfg_ok(v->domain, 1, size) )
+            if ( pci_cfg_ok(v->domain, 1, port & 3, size) )
                 pci_conf_write(v->domain->arch.pci_cf8, port & 3, size, data);
         }
 
--- a/xen/include/asm-x86/pci.h
+++ b/xen/include/asm-x86/pci.h
@@ -1,6 +1,11 @@
 #ifndef __X86_PCI_H__
 #define __X86_PCI_H__
 
+#define CF8_BDF(cf8)     (  ((cf8) & 0x00ffff00) >> 8)
+#define CF8_ADDR_LO(cf8) (   (cf8) & 0x000000fc)
+#define CF8_ADDR_HI(cf8) (  ((cf8) & 0x0f000000) >> 16)
+#define CF8_ENABLED(cf8) (!!((cf8) & 0x80000000))
+
 #define IS_SNB_GFX(id) (id == 0x01068086 || id == 0x01168086 \
                         || id == 0x01268086 || id == 0x01028086 \
                         || id == 0x01128086 || id == 0x01228086 \
++++++ 55795a52-x86-vMSI-X-support-qword-MMIO-access.patch ++++++
References: bsc#907514 bsc#910258 bsc#918984 bsc#923967

# Commit 284ffb4f9b0d5c3a33c4c5bd87645d0cc342ca96
# Date 2015-06-11 11:52:18 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/vMSI-X: support qword MMIO access

The specification explicitly provides for this, so we should have
supported this from the beginning.

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 

--- a/xen/arch/x86/hvm/vmsi.c
+++ b/xen/arch/x86/hvm/vmsi.c
@@ -232,7 +232,7 @@ static int msixtbl_read(
     unsigned int nr_entry, index;
     int r = X86EMUL_UNHANDLEABLE;
 
-    if ( len != 4 || (address & 3) )
+    if ( (len != 4 && len != 8) || (address & (len - 1)) )
         return r;
 
     rcu_read_lock(&msixtbl_rcu_lock);
@@ -250,13 +250,25 @@ static int msixtbl_read(
              !acc_bit(test, entry, nr_entry, index) )
             goto out;
         *pval = entry->gentries[nr_entry].msi_ad[index];
+        if ( len == 8 )
+        {
+            if ( index )
+                offset = PCI_MSIX_ENTRY_VECTOR_CTRL_OFFSET;
+            else if ( acc_bit(test, entry, nr_entry, 1) )
+                *pval |= (u64)entry->gentries[nr_entry].msi_ad[1] << 32;
+            else
+                goto out;
+        }
     }
-    else 
+    if ( offset == PCI_MSIX_ENTRY_VECTOR_CTRL_OFFSET )
     {
         virt = msixtbl_addr_to_virt(entry, address);
         if ( !virt )
             goto out;
-        *pval = readl(virt);
+        if ( len == 4 )
+            *pval = readl(virt);
+        else
+            *pval |= (u64)readl(virt) << 32;
     }
     
     r = X86EMUL_OKAY;
@@ -277,7 +289,7 @@ static int msixtbl_write(struct vcpu *v,
     unsigned long flags, orig;
     struct irq_desc *desc;
 
-    if ( len != 4 || (address & 3) )
+    if ( (len != 4 && len != 8) || (address & (len - 1)) )
         return r;
 
     rcu_read_lock(&msixtbl_rcu_lock);
@@ -288,16 +300,23 @@ static int msixtbl_write(struct vcpu *v,
     nr_entry = (address - entry->gtable) / PCI_MSIX_ENTRY_SIZE;
 
     offset = address & (PCI_MSIX_ENTRY_SIZE - 1);
-    if ( offset != PCI_MSIX_ENTRY_VECTOR_CTRL_OFFSET)
+    if ( offset != PCI_MSIX_ENTRY_VECTOR_CTRL_OFFSET )
     {
+        index = offset / sizeof(uint32_t);
         if ( nr_entry < MAX_MSIX_ACC_ENTRIES ) 
         {
-            index = offset / sizeof(uint32_t);
             entry->gentries[nr_entry].msi_ad[index] = val;
             acc_bit(set, entry, nr_entry, index);
+            if ( len == 8 && !index )
+            {
+                entry->gentries[nr_entry].msi_ad[1] = val >> 32;
+                acc_bit(set, entry, nr_entry, 1);
+            }
         }
         set_bit(nr_entry, &entry->table_flags);
-        goto out;
+        if ( len != 8 || !index )
+            goto out;
+        val >>= 32;
     }
 
     /* Exit to device model when unmasking and address/data got modified. */
@@ -361,7 +380,8 @@ static int msixtbl_write(struct vcpu *v,
 
 unlock:
     spin_unlock_irqrestore(&desc->lock, flags);
-    r = X86EMUL_OKAY;
+    if ( len == 4 )
+        r = X86EMUL_OKAY;
 
 out:
     rcu_read_unlock(&msixtbl_rcu_lock);
++++++ 5583d9c5-x86-MSI-X-cleanup.patch ++++++
References: bsc#907514 bsc#910258 bsc#918984 bsc#923967

# Commit 236e13ce60e1c0eb0535ad258e74a3789bc0d074
# Date 2015-06-19 10:58:45 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/MSI-X: cleanup

- __pci_enable_msix() now checks that an MSI-X capability was actually
  found
- pass "pos" to msix_capability_init() as both callers already know it
  (and hence there's no need to re-obtain it)
- call __pci_disable_msi{,x}() directly instead of via
  pci_disable_msi() from __pci_enable_msi{x,}() state validation paths
- use msix_control_reg() instead of open coding it
- log message adjustments
- coding style corrections

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 

--- a/xen/arch/x86/msi.c
+++ b/xen/arch/x86/msi.c
@@ -35,6 +35,8 @@
 static s8 __read_mostly use_msi = -1;
 boolean_param("msi", use_msi);
 
+static void __pci_disable_msix(struct msi_desc *);
+
 /* bitmap indicate which fixed map is free */
 static DEFINE_SPINLOCK(msix_fixmap_lock);
 static DECLARE_BITMAP(msix_fixmap_pages, FIX_MSIX_MAX_PAGES);
@@ -129,12 +131,14 @@ void msi_compose_msg(unsigned vector, co
     unsigned dest;
 
     memset(msg, 0, sizeof(*msg));
-    if ( !cpumask_intersects(cpu_mask, &cpu_online_map) ) {
+    if ( !cpumask_intersects(cpu_mask, &cpu_online_map) )
+    {
         dprintk(XENLOG_ERR,"%s, compose msi message error!!\n", __func__);
         return;
     }
 
-    if ( vector ) {
+    if ( vector )
+    {
         cpumask_t *mask = this_cpu(scratch_mask);
 
         cpumask_and(mask, cpu_mask, &cpu_online_map);
@@ -195,8 +199,7 @@ static void read_msi_msg(struct msi_desc
     }
     case PCI_CAP_ID_MSIX:
     {
-        void __iomem *base;
-        base = entry->mask_base;
+        void __iomem *base = entry->mask_base;
 
         msg->address_lo = readl(base + PCI_MSIX_ENTRY_LOWER_ADDR_OFFSET);
         msg->address_hi = readl(base + PCI_MSIX_ENTRY_UPPER_ADDR_OFFSET);
@@ -257,8 +260,7 @@ static int write_msi_msg(struct msi_desc
     }
     case PCI_CAP_ID_MSIX:
     {
-        void __iomem *base;
-        base = entry->mask_base;
+        void __iomem *base = entry->mask_base;
 
         writel(msg->address_lo,
                base + PCI_MSIX_ENTRY_LOWER_ADDR_OFFSET);
@@ -281,7 +283,7 @@ void set_msi_affinity(struct irq_desc *d
     struct msi_desc *msi_desc = desc->msi_desc;
 
     dest = set_desc_affinity(desc, mask);
-    if (dest == BAD_APICID || !msi_desc)
+    if ( dest == BAD_APICID || !msi_desc )
         return;
 
     ASSERT(spin_is_locked(&desc->lock));
@@ -332,11 +334,11 @@ static void msix_set_enable(struct pci_d
     pos = pci_find_cap_offset(seg, bus, slot, func, PCI_CAP_ID_MSIX);
     if ( pos )
     {
-        control = pci_conf_read16(seg, bus, slot, func, pos + PCI_MSIX_FLAGS);
+        control = pci_conf_read16(seg, bus, slot, func, msix_control_reg(pos));
         control &= ~PCI_MSIX_FLAGS_ENABLE;
         if ( enable )
             control |= PCI_MSIX_FLAGS_ENABLE;
-        pci_conf_write16(seg, bus, slot, func, pos + PCI_MSIX_FLAGS, control);
+        pci_conf_write16(seg, bus, slot, func, msix_control_reg(pos), control);
     }
 }
 
@@ -353,9 +355,11 @@ static void msi_set_mask_bit(struct irq_
 
     ASSERT(spin_is_locked(&desc->lock));
     BUG_ON(!entry || !entry->dev);
-    switch (entry->msi_attrib.type) {
+    switch ( entry->msi_attrib.type )
+    {
     case PCI_CAP_ID_MSI:
-        if (entry->msi_attrib.maskbit) {
+        if ( entry->msi_attrib.maskbit )
+        {
             u32 mask_bits;
             u16 seg = entry->dev->seg;
             u8 bus = entry->dev->bus;
@@ -701,13 +705,14 @@ static u64 read_pci_mem_bar(u16 seg, u8 
  * requested MSI-X entries with allocated irqs or non-zero for otherwise.
  **/
 static int msix_capability_init(struct pci_dev *dev,
+                                unsigned int pos,
                                 struct msi_info *msi,
                                 struct msi_desc **desc,
                                 unsigned int nr_entries)
 {
     struct arch_msix *msix = dev->msix;
     struct msi_desc *entry = NULL;
-    int pos, vf;
+    int vf;
     u16 control;
     u64 table_paddr;
     u32 table_offset;
@@ -719,7 +724,6 @@ static int msix_capability_init(struct p
 
     ASSERT(spin_is_locked(&pcidevs_lock));
 
-    pos = pci_find_cap_offset(seg, bus, slot, func, PCI_CAP_ID_MSIX);
     control = pci_conf_read16(seg, bus, slot, func, msix_control_reg(pos));
     msix_set_enable(dev, 0);/* Ensure msix is disabled as I set it up */
 
@@ -884,10 +888,9 @@ static int __pci_enable_msi(struct msi_i
     old_desc = find_msi_entry(pdev, msi->irq, PCI_CAP_ID_MSI);
     if ( old_desc )
     {
-        dprintk(XENLOG_WARNING, "irq %d has already mapped to MSI on "
-                "device %04x:%02x:%02x.%01x\n",
-                msi->irq, msi->seg, msi->bus,
-                PCI_SLOT(msi->devfn), PCI_FUNC(msi->devfn));
+        printk(XENLOG_WARNING "irq %d already mapped to MSI on %04x:%02x:%02x.%u\n",
+               msi->irq, msi->seg, msi->bus,
+               PCI_SLOT(msi->devfn), PCI_FUNC(msi->devfn));
         *desc = old_desc;
         return 0;
     }
@@ -895,10 +898,10 @@ static int __pci_enable_msi(struct msi_i
     old_desc = find_msi_entry(pdev, -1, PCI_CAP_ID_MSIX);
     if ( old_desc )
     {
-        dprintk(XENLOG_WARNING, "MSI-X is already in use on "
-                "device %04x:%02x:%02x.%01x\n", msi->seg, msi->bus,
-                PCI_SLOT(msi->devfn), PCI_FUNC(msi->devfn));
-        pci_disable_msi(old_desc);
+        printk(XENLOG_WARNING "MSI-X already in use on %04x:%02x:%02x.%u\n",
+               msi->seg, msi->bus,
+               PCI_SLOT(msi->devfn), PCI_FUNC(msi->devfn));
+        __pci_disable_msix(old_desc);
     }
 
     return msi_capability_init(pdev, msi->irq, desc, msi->entry_nr);
@@ -912,7 +915,6 @@ static void __pci_disable_msi(struct msi
     msi_set_enable(dev, 0);
 
     BUG_ON(list_empty(&dev->msi_list));
-
 }
 
 /**
@@ -932,7 +934,7 @@ static void __pci_disable_msi(struct msi
  **/
 static int __pci_enable_msix(struct msi_info *msi, struct msi_desc **desc)
 {
-    int status, pos, nr_entries;
+    int pos, nr_entries;
     struct pci_dev *pdev;
     u16 control;
     u8 slot = PCI_SLOT(msi->devfn);
@@ -941,23 +943,22 @@ static int __pci_enable_msix(struct msi_
 
     ASSERT(spin_is_locked(&pcidevs_lock));
     pdev = pci_get_pdev(msi->seg, msi->bus, msi->devfn);
-    if ( !pdev )
+    pos = pci_find_cap_offset(msi->seg, msi->bus, slot, func, PCI_CAP_ID_MSIX);
+    if ( !pdev || !pos )
         return -ENODEV;
 
-    pos = pci_find_cap_offset(msi->seg, msi->bus, slot, func, PCI_CAP_ID_MSIX);
     control = pci_conf_read16(msi->seg, msi->bus, slot, func,
                               msix_control_reg(pos));
     nr_entries = multi_msix_capable(control);
-    if (msi->entry_nr >= nr_entries)
+    if ( msi->entry_nr >= nr_entries )
         return -EINVAL;
 
     old_desc = find_msi_entry(pdev, msi->irq, PCI_CAP_ID_MSIX);
     if ( old_desc )
     {
-        dprintk(XENLOG_WARNING, "irq %d has already mapped to MSIX on "
-                "device %04x:%02x:%02x.%01x\n",
-                msi->irq, msi->seg, msi->bus,
-                PCI_SLOT(msi->devfn), PCI_FUNC(msi->devfn));
+        printk(XENLOG_WARNING "irq %d already mapped to MSI-X on %04x:%02x:%02x.%u\n",
+               msi->irq, msi->seg, msi->bus,
+               PCI_SLOT(msi->devfn), PCI_FUNC(msi->devfn));
         *desc = old_desc;
         return 0;
     }
@@ -965,15 +966,13 @@ static int __pci_enable_msix(struct msi_
     old_desc = find_msi_entry(pdev, -1, PCI_CAP_ID_MSI);
     if ( old_desc )
     {
-        dprintk(XENLOG_WARNING, "MSI is already in use on "
-                "device %04x:%02x:%02x.%01x\n", msi->seg, msi->bus,
-                PCI_SLOT(msi->devfn), PCI_FUNC(msi->devfn));
-        pci_disable_msi(old_desc);
-
+        printk(XENLOG_WARNING "MSI already in use on %04x:%02x:%02x.%u\n",
+               msi->seg, msi->bus,
+               PCI_SLOT(msi->devfn), PCI_FUNC(msi->devfn));
+        __pci_disable_msi(old_desc);
     }
 
-    status = msix_capability_init(pdev, msi, desc, nr_entries);
-    return status;
+    return msix_capability_init(pdev, pos, msi, desc, nr_entries);
 }
 
 static void _pci_cleanup_msix(struct arch_msix *msix)
@@ -991,19 +990,16 @@ static void _pci_cleanup_msix(struct arc
 
 static void __pci_disable_msix(struct msi_desc *entry)
 {
-    struct pci_dev *dev;
-    int pos;
-    u16 control, seg;
-    u8 bus, slot, func;
-
-    dev = entry->dev;
-    seg = dev->seg;
-    bus = dev->bus;
-    slot = PCI_SLOT(dev->devfn);
-    func = PCI_FUNC(dev->devfn);
+    struct pci_dev *dev = entry->dev;
+    u16 seg = dev->seg;
+    u8 bus = dev->bus;
+    u8 slot = PCI_SLOT(dev->devfn);
+    u8 func = PCI_FUNC(dev->devfn);
+    unsigned int pos = pci_find_cap_offset(seg, bus, slot, func,
+                                           PCI_CAP_ID_MSIX);
+    u16 control = pci_conf_read16(seg, bus, slot, func,
+                                  msix_control_reg(entry->msi_attrib.pos));
 
-    pos = pci_find_cap_offset(seg, bus, slot, func, PCI_CAP_ID_MSIX);
-    control = pci_conf_read16(seg, bus, slot, func, msix_control_reg(pos));
     msix_set_enable(dev, 0);
 
     BUG_ON(list_empty(&dev->msi_list));
@@ -1045,7 +1041,7 @@ int pci_prepare_msix(u16 seg, u8 bus, u8
         u16 control = pci_conf_read16(seg, bus, slot, func,
                                       msix_control_reg(pos));
 
-        rc = msix_capability_init(pdev, NULL, NULL,
+        rc = msix_capability_init(pdev, pos, NULL, NULL,
                                   multi_msix_capable(control));
     }
     spin_unlock(&pcidevs_lock);
@@ -1064,8 +1060,8 @@ int pci_enable_msi(struct msi_info *msi,
     if ( !use_msi )
         return -EPERM;
 
-    return  msi->table_base ? __pci_enable_msix(msi, desc) :
-        __pci_enable_msi(msi, desc);
+    return msi->table_base ? __pci_enable_msix(msi, desc) :
+                             __pci_enable_msi(msi, desc);
 }
 
 /*
@@ -1115,7 +1111,9 @@ int pci_restore_msi_state(struct pci_dev
     if ( !pdev )
         return -EINVAL;
 
-    ret = xsm_resource_setup_pci(XSM_PRIV, (pdev->seg << 16) | (pdev->bus << 8) | pdev->devfn);
+    ret = xsm_resource_setup_pci(XSM_PRIV,
+                                (pdev->seg << 16) | (pdev->bus << 8) |
+                                pdev->devfn);
     if ( ret )
         return ret;
 
++++++ 5583da09-x86-MSI-track-host-and-guest-masking-separately.patch ++++++
References: bsc#907514 bsc#910258 bsc#918984 bsc#923967

# Commit ad28e42bd1d28d746988ed71654e8aa670629753
# Date 2015-06-19 10:59:53 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/MSI: track host and guest masking separately

In particular we want to avoid losing track of our own intention to
have an entry masked. Physical unmasking now happens only when both
host and guest requested so.

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 

# Commit 84d6add5593d865736831d150da7c38588f669f6
# Date 2015-07-10 12:36:24 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/MSI: fix guest unmasking when handling IRQ via event channel

Rather than assuming only PV guests need special treatment (and
dealing with that directly when an IRQ gets set up), keep all guest MSI
IRQs masked until either the (HVM) guest unmasks them via vMSI or the
(PV, PVHVM, or PVH) guest sets up an event channel for it.

To not further clutter the common evtchn_bind_pirq() with x86-specific
code, introduce an arch_evtchn_bind_pirq() hook instead.

Reported-by: Sander Eikelenboom 
Signed-off-by: Jan Beulich 
Tested-by: Sander Eikelenboom 
Reviewed-by: Andrew Cooper 
Acked-by: Ian Campbell 

# Commit bde63cd088b7d9fa99b8ed6d110cd768f87bbc60
# Date 2015-08-27 17:39:37 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/MSI: don't flag non-maskable entries as host-masked

'M' debug key output looks confusing without this adjustment.

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 

--- a/xen/arch/x86/hpet.c
+++ b/xen/arch/x86/hpet.c
@@ -240,7 +240,7 @@ static void hpet_msi_unmask(struct irq_d
     cfg = hpet_read32(HPET_Tn_CFG(ch->idx));
     cfg |= HPET_TN_ENABLE;
     hpet_write32(cfg, HPET_Tn_CFG(ch->idx));
-    ch->msi.msi_attrib.masked = 0;
+    ch->msi.msi_attrib.host_masked = 0;
 }
 
 static void hpet_msi_mask(struct irq_desc *desc)
@@ -251,7 +251,7 @@ static void hpet_msi_mask(struct irq_des
     cfg = hpet_read32(HPET_Tn_CFG(ch->idx));
     cfg &= ~HPET_TN_ENABLE;
     hpet_write32(cfg, HPET_Tn_CFG(ch->idx));
-    ch->msi.msi_attrib.masked = 1;
+    ch->msi.msi_attrib.host_masked = 1;
 }
 
 static int hpet_msi_write(struct hpet_event_channel *ch, struct msi_msg *msg)
--- a/xen/arch/x86/hvm/vmsi.c
+++ b/xen/arch/x86/hvm/vmsi.c
@@ -228,7 +228,6 @@ static int msixtbl_read(
 {
     unsigned long offset;
     struct msixtbl_entry *entry;
-    void *virt;
     unsigned int nr_entry, index;
     int r = X86EMUL_UNHANDLEABLE;
 
@@ -262,13 +261,20 @@ static int msixtbl_read(
     }
     if ( offset == PCI_MSIX_ENTRY_VECTOR_CTRL_OFFSET )
     {
-        virt = msixtbl_addr_to_virt(entry, address);
+        const struct msi_desc *msi_desc;
+        void *virt = msixtbl_addr_to_virt(entry, address);
+
         if ( !virt )
             goto out;
+        msi_desc = virt_to_msi_desc(entry->pdev, virt);
+        if ( !msi_desc )
+            goto out;
         if ( len == 4 )
-            *pval = readl(virt);
+            *pval = MASK_INSR(msi_desc->msi_attrib.guest_masked,
+                              PCI_MSIX_VECTOR_BITMASK);
         else
-            *pval |= (u64)readl(virt) << 32;
+            *pval |= (u64)MASK_INSR(msi_desc->msi_attrib.guest_masked,
+                                    PCI_MSIX_VECTOR_BITMASK) << 32;
     }
     
     r = X86EMUL_OKAY;
@@ -286,7 +292,7 @@ static int msixtbl_write(struct vcpu *v,
     void *virt;
     unsigned int nr_entry, index;
     int r = X86EMUL_UNHANDLEABLE;
-    unsigned long flags, orig;
+    unsigned long flags;
     struct irq_desc *desc;
 
     if ( (len != 4 && len != 8) || (address & (len - 1)) )
@@ -346,37 +352,7 @@ static int msixtbl_write(struct vcpu *v,
 
     ASSERT(msi_desc == desc->msi_desc);
    
-    orig = readl(virt);
-
-    /*
-     * Do not allow guest to modify MSI-X control bit if it is masked 
-     * by Xen. We'll only handle the case where Xen thinks that
-     * bit is unmasked, but hardware has silently masked the bit
-     * (in case of SR-IOV VF reset, etc). On the other hand, if Xen 
-     * thinks that the bit is masked, but it's really not, 
-     * we log a warning.
-     */
-    if ( msi_desc->msi_attrib.masked )
-    {
-        if ( !(orig & PCI_MSIX_VECTOR_BITMASK) )
-            printk(XENLOG_WARNING "MSI-X control bit is unmasked when"
-                   " it is expected to be masked [%04x:%02x:%02x.%u]\n", 
-                   entry->pdev->seg, entry->pdev->bus,
-                   PCI_SLOT(entry->pdev->devfn), 
-                   PCI_FUNC(entry->pdev->devfn));
-
-        goto unlock;
-    }
-
-    /*
-     * The mask bit is the only defined bit in the word. But we 
-     * ought to preserve the reserved bits. Clearing the reserved 
-     * bits can result in undefined behaviour (see PCI Local Bus
-     * Specification revision 2.3).
-     */
-    val &= PCI_MSIX_VECTOR_BITMASK;
-    val |= (orig & ~PCI_MSIX_VECTOR_BITMASK);
-    writel(val, virt);
+    guest_mask_msi_irq(desc, !!(val & PCI_MSIX_VECTOR_BITMASK));
 
 unlock:
     spin_unlock_irqrestore(&desc->lock, flags);
--- a/xen/arch/x86/irq.c
+++ b/xen/arch/x86/irq.c
@@ -2499,6 +2499,25 @@ int unmap_domain_pirq_emuirq(struct doma
     return ret;
 }
 
+void arch_evtchn_bind_pirq(struct domain *d, int pirq)
+{
+    int irq = domain_pirq_to_irq(d, pirq);
+    struct irq_desc *desc;
+    unsigned long flags;
+
+    if ( irq <= 0 )
+        return;
+
+    if ( is_hvm_domain(d) )
+        map_domain_emuirq_pirq(d, pirq, IRQ_PT);
+
+    desc = irq_to_desc(irq);
+    spin_lock_irqsave(&desc->lock, flags);
+    if ( desc->msi_desc )
+        guest_mask_msi_irq(desc, 0);
+    spin_unlock_irqrestore(&desc->lock, flags);
+}
+
 bool_t hvm_domain_use_pirq(const struct domain *d, const struct pirq *pirq)
 {
     return is_hvm_domain(d) && pirq &&
--- a/xen/arch/x86/msi.c
+++ b/xen/arch/x86/msi.c
@@ -349,9 +349,10 @@ int msi_maskable_irq(const struct msi_de
            || entry->msi_attrib.maskbit;
 }
 
-static void msi_set_mask_bit(struct irq_desc *desc, int flag)
+static void msi_set_mask_bit(struct irq_desc *desc, bool_t host, bool_t guest)
 {
     struct msi_desc *entry = desc->msi_desc;
+    bool_t flag = host || guest;
 
     ASSERT(spin_is_locked(&desc->lock));
     BUG_ON(!entry || !entry->dev);
@@ -383,7 +384,8 @@ static void msi_set_mask_bit(struct irq_
         BUG();
         break;
     }
-    entry->msi_attrib.masked = !!flag;
+    entry->msi_attrib.host_masked = host;
+    entry->msi_attrib.guest_masked = guest;
 }
 
 static int msi_get_mask_bit(const struct msi_desc *entry)
@@ -405,20 +407,30 @@ static int msi_get_mask_bit(const struct
 
 void mask_msi_irq(struct irq_desc *desc)
 {
-    msi_set_mask_bit(desc, 1);
+    msi_set_mask_bit(desc, 1, desc->msi_desc->msi_attrib.guest_masked);
 }
 
 void unmask_msi_irq(struct irq_desc *desc)
 {
-    msi_set_mask_bit(desc, 0);
+    msi_set_mask_bit(desc, 0, desc->msi_desc->msi_attrib.guest_masked);
+}
+
+void guest_mask_msi_irq(struct irq_desc *desc, bool_t mask)
+{
+    msi_set_mask_bit(desc, desc->msi_desc->msi_attrib.host_masked, mask);
 }
 
 static unsigned int startup_msi_irq(struct irq_desc *desc)
 {
-    unmask_msi_irq(desc);
+    msi_set_mask_bit(desc, 0, !!(desc->status & IRQ_GUEST));
     return 0;
 }
 
+static void shutdown_msi_irq(struct irq_desc *desc)
+{
+    msi_set_mask_bit(desc, 1, 1);
+}
+
 void ack_nonmaskable_msi_irq(struct irq_desc *desc)
 {
     irq_complete_move(desc);
@@ -443,7 +455,7 @@ void end_nonmaskable_msi_irq(struct irq_
 static hw_irq_controller pci_msi_maskable = {
     .typename     = "PCI-MSI/-X",
     .startup      = startup_msi_irq,
-    .shutdown     = mask_msi_irq,
+    .shutdown     = shutdown_msi_irq,
     .enable       = unmask_msi_irq,
     .disable      = mask_msi_irq,
     .ack          = ack_maskable_msi_irq,
@@ -590,8 +602,9 @@ static int msi_capability_init(struct pc
         entry[i].msi_attrib.type = PCI_CAP_ID_MSI;
         entry[i].msi_attrib.is_64 = is_64bit_address(control);
         entry[i].msi_attrib.entry_nr = i;
+        entry[i].msi_attrib.host_masked =
         entry[i].msi_attrib.maskbit = is_mask_bit_support(control);
-        entry[i].msi_attrib.masked = 1;
+        entry[i].msi_attrib.guest_masked = 0;
         entry[i].msi_attrib.pos = pos;
         if ( entry[i].msi_attrib.maskbit )
             entry[i].msi.mpos = mpos;
@@ -817,7 +830,8 @@ static int msix_capability_init(struct p
         entry->msi_attrib.is_64 = 1;
         entry->msi_attrib.entry_nr = msi->entry_nr;
         entry->msi_attrib.maskbit = 1;
-        entry->msi_attrib.masked = 1;
+        entry->msi_attrib.host_masked = 1;
+        entry->msi_attrib.guest_masked = 1;
         entry->msi_attrib.pos = pos;
         entry->irq = msi->irq;
         entry->dev = dev;
@@ -1152,7 +1166,8 @@ int pci_restore_msi_state(struct pci_dev
 
         for ( i = 0; ; )
         {
-            msi_set_mask_bit(desc, entry[i].msi_attrib.masked);
+            msi_set_mask_bit(desc, entry[i].msi_attrib.host_masked,
+                             entry[i].msi_attrib.guest_masked);
 
             if ( !--nr )
                 break;
@@ -1304,7 +1319,7 @@ static void dump_msi(unsigned char key)
         else
             mask = '?';
         printk(" %-6s%4u vec=%02x%7s%6s%3sassert%5s%7s"
-               " dest=%08x mask=%d/%d/%c\n",
+               " dest=%08x mask=%d/%c%c/%c\n",
                type, irq,
                (data & MSI_DATA_VECTOR_MASK) >> MSI_DATA_VECTOR_SHIFT,
                data & MSI_DATA_DELIVERY_LOWPRI ? "lowest" : "fixed",
@@ -1312,7 +1327,10 @@ static void dump_msi(unsigned char key)
                data & MSI_DATA_LEVEL_ASSERT ? "" : "de",
                addr & MSI_ADDR_DESTMODE_LOGIC ? "log" : "phys",
                addr & MSI_ADDR_REDIRECTION_LOWPRI ? "lowest" : "cpu",
-               dest32, attr.maskbit, attr.masked, mask);
+               dest32, attr.maskbit,
+               attr.host_masked ? 'H' : ' ',
+               attr.guest_masked ? 'G' : ' ',
+               mask);
     }
 }
 
--- a/xen/common/event_channel.c
+++ b/xen/common/event_channel.c
@@ -445,10 +445,7 @@ static long evtchn_bind_pirq(evtchn_bind
 
     bind->port = port;
 
-#ifdef CONFIG_X86
-    if ( is_hvm_domain(d) && domain_pirq_to_irq(d, pirq) > 0 )
-        map_domain_emuirq_pirq(d, pirq, IRQ_PT);
-#endif
+    arch_evtchn_bind_pirq(d, pirq);
 
  out:
     spin_unlock(&d->event_lock);
--- a/xen/drivers/passthrough/amd/iommu_init.c
+++ b/xen/drivers/passthrough/amd/iommu_init.c
@@ -451,7 +451,7 @@ static void iommu_msi_unmask(struct irq_
     spin_lock_irqsave(&iommu->lock, flags);
     amd_iommu_msi_enable(iommu, IOMMU_CONTROL_ENABLED);
     spin_unlock_irqrestore(&iommu->lock, flags);
-    iommu->msi.msi_attrib.masked = 0;
+    iommu->msi.msi_attrib.host_masked = 0;
 }
 
 static void iommu_msi_mask(struct irq_desc *desc)
@@ -464,7 +464,7 @@ static void iommu_msi_mask(struct irq_de
     spin_lock_irqsave(&iommu->lock, flags);
     amd_iommu_msi_enable(iommu, IOMMU_CONTROL_DISABLED);
     spin_unlock_irqrestore(&iommu->lock, flags);
-    iommu->msi.msi_attrib.masked = 1;
+    iommu->msi.msi_attrib.host_masked = 1;
 }
 
 static unsigned int iommu_msi_startup(struct irq_desc *desc)
--- a/xen/drivers/passthrough/vtd/iommu.c
+++ b/xen/drivers/passthrough/vtd/iommu.c
@@ -997,7 +997,7 @@ static void dma_msi_unmask(struct irq_de
     spin_lock_irqsave(&iommu->register_lock, flags);
     dmar_writel(iommu->reg, DMAR_FECTL_REG, 0);
     spin_unlock_irqrestore(&iommu->register_lock, flags);
-    iommu->msi.msi_attrib.masked = 0;
+    iommu->msi.msi_attrib.host_masked = 0;
 }
 
 static void dma_msi_mask(struct irq_desc *desc)
@@ -1009,7 +1009,7 @@ static void dma_msi_mask(struct irq_desc
     spin_lock_irqsave(&iommu->register_lock, flags);
     dmar_writel(iommu->reg, DMAR_FECTL_REG, DMA_FECTL_IM);
     spin_unlock_irqrestore(&iommu->register_lock, flags);
-    iommu->msi.msi_attrib.masked = 1;
+    iommu->msi.msi_attrib.host_masked = 1;
 }
 
 static unsigned int dma_msi_startup(struct irq_desc *desc)
--- a/xen/include/asm-arm/irq.h
+++ b/xen/include/asm-arm/irq.h
@@ -45,6 +45,8 @@ int __init request_dt_irq(const struct d
                           const char *devname, void *dev_id);
 int __init setup_dt_irq(const struct dt_irq *irq, struct irqaction *new);
 
+#define arch_evtchn_bind_pirq(d, pirq) ((void)((d) + (pirq)))
+
 #endif /* _ASM_HW_IRQ_H */
 /*
  * Local variables:
--- a/xen/include/asm-x86/msi.h
+++ b/xen/include/asm-x86/msi.h
@@ -90,12 +90,13 @@ extern unsigned int pci_msix_get_table_l
 
 struct msi_desc {
 	struct msi_attrib {
-		__u8	type	: 5; 	/* {0: unused, 5h:MSI, 11h:MSI-X} */
-		__u8	maskbit	: 1; 	/* mask-pending bit supported ?   */
-		__u8	masked	: 1;
+		__u8	type;		/* {0: unused, 5h:MSI, 11h:MSI-X} */
+		__u8	pos;		/* Location of the MSI capability */
+		__u8	maskbit	: 1;	/* mask/pending bit supported ?   */
 		__u8	is_64	: 1;	/* Address size: 0=32bit 1=64bit  */
-		__u8	pos;	 	/* Location of the msi capability */
-		__u16	entry_nr;    	/* specific enabled entry 	  */
+		__u8	host_masked : 1;
+		__u8	guest_masked : 1;
+		__u16	entry_nr;	/* specific enabled entry 	  */
 	} msi_attrib;
 
 	struct list_head list;
@@ -236,6 +237,7 @@ void msi_compose_msg(unsigned vector, co
 void __msi_set_enable(u16 seg, u8 bus, u8 slot, u8 func, int pos, int enable);
 void mask_msi_irq(struct irq_desc *);
 void unmask_msi_irq(struct irq_desc *);
+void guest_mask_msi_irq(struct irq_desc *, bool_t mask);
 void ack_nonmaskable_msi_irq(struct irq_desc *);
 void end_nonmaskable_msi_irq(struct irq_desc *, u8 vector);
 void set_msi_affinity(struct irq_desc *, const cpumask_t *);
--- a/xen/include/xen/irq.h
+++ b/xen/include/xen/irq.h
@@ -153,4 +153,8 @@ unsigned int set_desc_affinity(struct ir
 unsigned int arch_dom0_irqs(void);
 #endif
 
+#ifndef arch_evtchn_bind_pirq
+void arch_evtchn_bind_pirq(struct domain *, int pirq);
+#endif
+
 #endif /* __XEN_IRQ_H__ */
++++++ 55b0a218-x86-PCI-CFG-write-intercept.patch ++++++
References: bsc#907514 bsc#910258 bsc#918984 bsc#923967

# Commit a88b72fddd046a0978242411276861039ec99ad0
# Date 2015-07-23 10:13:12 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/PCI: add config space abstract write intercept logic

This is to be used by MSI code, and later to also be hooked up to
MMCFG accesses by Dom0.

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 

--- a/xen/arch/x86/msi.c
+++ b/xen/arch/x86/msi.c
@@ -1108,6 +1108,12 @@ void pci_cleanup_msi(struct pci_dev *pde
     msi_free_irqs(pdev);
 }
 
+int pci_msi_conf_write_intercept(struct pci_dev *pdev, unsigned int reg,
+                                 unsigned int size, uint32_t *data)
+{
+    return 0;
+}
+
 int pci_restore_msi_state(struct pci_dev *pdev)
 {
     unsigned long flags;
--- a/xen/arch/x86/pci.c
+++ b/xen/arch/x86/pci.c
@@ -67,3 +67,28 @@ void pci_conf_write(uint32_t cf8, uint8_
 
     spin_unlock_irqrestore(&pci_config_lock, flags);
 }
+
+int pci_conf_write_intercept(unsigned int seg, unsigned int bdf,
+                             unsigned int reg, unsigned int size,
+                             uint32_t *data)
+{
+    struct pci_dev *pdev;
+    int rc = 0;
+
+    /*
+     * Avoid expensive operations when no hook is going to do anything
+     * for the access anyway.
+     */
+    if ( reg < 64 || reg >= 256 )
+        return 0;
+
+    spin_lock(&pcidevs_lock);
+
+    pdev = pci_get_pdev(seg, PCI_BUS(bdf), PCI_DEVFN2(bdf));
+    if ( pdev )
+        rc = pci_msi_conf_write_intercept(pdev, reg, size, data);
+
+    spin_unlock(&pcidevs_lock);
+
+    return rc;
+}
--- a/xen/arch/x86/traps.c
+++ b/xen/arch/x86/traps.c
@@ -1660,8 +1660,8 @@ static int admin_io_okay(
     return ioports_access_permitted(v->domain, port, port + bytes - 1);
 }
 
-static bool_t pci_cfg_ok(struct domain *currd, bool_t write,
-                         unsigned int start, unsigned int size)
+static bool_t pci_cfg_ok(struct domain *currd, unsigned int start,
+                         unsigned int size, uint32_t *write)
 {
     uint32_t machine_bdf;
 
@@ -1693,8 +1693,12 @@ static bool_t pci_cfg_ok(struct domain *
             start |= CF8_ADDR_HI(currd->arch.pci_cf8);
     }
 
-    return !xsm_pci_config_permission(XSM_HOOK, currd, machine_bdf,
-                                      start, start + size - 1, write);
+    if ( xsm_pci_config_permission(XSM_HOOK, currd, machine_bdf,
+                                   start, start + size - 1, !!write) != 0 )
+         return 0;
+
+    return !write ||
+           pci_conf_write_intercept(0, machine_bdf, start, size, write) >= 0;
 }
 
 uint32_t guest_io_read(
@@ -1748,7 +1752,7 @@ uint32_t guest_io_read(
             size = min(bytes, 4 - (port & 3));
             if ( size == 3 )
                 size = 2;
-            if ( pci_cfg_ok(v->domain, 0, port & 3, size) )
+            if ( pci_cfg_ok(v->domain, port & 3, size, NULL) )
                 sub_data = pci_conf_read(v->domain->arch.pci_cf8, port & 3, size);
         }
 
@@ -1821,7 +1825,7 @@ void guest_io_write(
             size = min(bytes, 4 - (port & 3));
             if ( size == 3 )
                 size = 2;
-            if ( pci_cfg_ok(v->domain, 1, port & 3, size) )
+            if ( pci_cfg_ok(v->domain, port & 3, size, &data) )
                 pci_conf_write(v->domain->arch.pci_cf8, port & 3, size, data);
         }
 
--- a/xen/include/asm-x86/pci.h
+++ b/xen/include/asm-x86/pci.h
@@ -15,4 +15,11 @@ struct arch_pci_dev {
     vmask_t used_vectors;
 };
 
+struct pci_dev;
+int pci_conf_write_intercept(unsigned int seg, unsigned int bdf,
+                             unsigned int reg, unsigned int size,
+                             uint32_t *data);
+int pci_msi_conf_write_intercept(struct pci_dev *, unsigned int reg,
+                                 unsigned int size, uint32_t *data);
+
 #endif /* __X86_PCI_H__ */
++++++ 55b0a255-x86-MSI-X-maskall.patch ++++++
References: bsc#907514 bsc#910258 bsc#918984 bsc#923967

# Commit 484d7c852e4ff79c945406ed28b5db63a5a0b7f3
# Date 2015-07-23 10:14:13 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/MSI-X: track host and guest mask-all requests separately

Host uses of the bits will be added subsequently, and must not be
overridden by guests (including Dom0, namely when acting on behalf of
a guest).

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 

--- a/xen/arch/x86/msi.c
+++ b/xen/arch/x86/msi.c
@@ -843,6 +843,12 @@ static int msix_capability_init(struct p
 
     if ( !msix->used_entries )
     {
+        msix->host_maskall = 0;
+        if ( !msix->guest_maskall )
+            control &= ~PCI_MSIX_FLAGS_MASKALL;
+        else
+            control |= PCI_MSIX_FLAGS_MASKALL;
+
         if ( rangeset_add_range(mmio_ro_ranges, msix->table.first,
                                 msix->table.last) )
             WARN();
@@ -1111,6 +1117,34 @@ void pci_cleanup_msi(struct pci_dev *pde
 int pci_msi_conf_write_intercept(struct pci_dev *pdev, unsigned int reg,
                                  unsigned int size, uint32_t *data)
 {
+    u16 seg = pdev->seg;
+    u8 bus = pdev->bus;
+    u8 slot = PCI_SLOT(pdev->devfn);
+    u8 func = PCI_FUNC(pdev->devfn);
+    struct msi_desc *entry;
+    unsigned int pos;
+
+    if ( pdev->msix )
+    {
+        entry = find_msi_entry(pdev, -1, PCI_CAP_ID_MSIX);
+        pos = entry ? entry->msi_attrib.pos
+                    : pci_find_cap_offset(seg, bus, slot, func,
+                                          PCI_CAP_ID_MSIX);
+        ASSERT(pos);
+
+        if ( reg < pos || reg >= msix_pba_offset_reg(pos) + 4 )
+            return 0;
+
+        if ( reg != msix_control_reg(pos) || size != 2 )
+            return -EACCES;
+
+        pdev->msix->guest_maskall = !!(*data & PCI_MSIX_FLAGS_MASKALL);
+        if ( pdev->msix->host_maskall )
+            *data |= PCI_MSIX_FLAGS_MASKALL;
+
+        return 1;
+    }
+
     return 0;
 }
 
--- a/xen/include/asm-x86/msi.h
+++ b/xen/include/asm-x86/msi.h
@@ -228,6 +228,7 @@ struct arch_msix {
     int table_refcnt[MAX_MSIX_TABLE_PAGES];
     int table_idx[MAX_MSIX_TABLE_PAGES];
     spinlock_t table_lock;
+    bool_t host_maskall, guest_maskall;
     domid_t warned;
 };
 
++++++ 55b0a283-x86-MSI-X-teardown.patch ++++++
References: bsc#907514 bsc#910258 bsc#918984 bsc#923967

# Commit 082fdc6ce85e5b603f8fb24553cf200e3b67889f
# Date 2015-07-23 10:14:59 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/MSI-X: be more careful during teardown

When a device gets detached from a guest, pciback will clear its
command register, thus disabling both memory and I/O decoding. The
disabled memory decoding, however, has an effect on the MSI-X table
accesses the hypervisor does: These won't have the intended effect
anymore. Even worse, for PCIe devices (but not SR-IOV virtual
functions) such accesses may (will?) be treated as Unsupported
Requests, causing respective errors to be surfaced, potentially in the
form of NMIs that may be fatal to the hypervisor or Dom0 is different
ways. Hence rather than carrying out these accesses, we should avoid
them where we can, and use alternative (e.g. PCI config space based)
mechanisms to achieve at least the same effect.

At this time it continues to be unclear whether this is fixing an
actual bug or is rather just working around bogus (but apparently
common) system behavior.

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 
---
Backporting note (largely to myself):
   Depends on (not yet backported to 4.4 and earlier) commit 061eebe0e
   "x86/MSI: drop workaround for insecure Dom0 kernels" (due to re-use
   of struct arch_msix's warned field).

--- a/xen/arch/x86/irq.c
+++ b/xen/arch/x86/irq.c
@@ -217,9 +217,9 @@ void destroy_irq(unsigned int irq)
     }
 
     spin_lock_irqsave(&desc->lock, flags);
-    desc->status  |= IRQ_DISABLED;
     desc->status  &= ~IRQ_GUEST;
     desc->handler->shutdown(desc);
+    desc->status |= IRQ_DISABLED;
     action = desc->action;
     desc->action  = NULL;
     desc->msi_desc = NULL;
@@ -995,8 +995,8 @@ void __init release_irq(unsigned int irq
     spin_lock_irqsave(&desc->lock,flags);
     action = desc->action;
     desc->action  = NULL;
-    desc->status |= IRQ_DISABLED;
     desc->handler->shutdown(desc);
+    desc->status |= IRQ_DISABLED;
     spin_unlock_irqrestore(&desc->lock,flags);
 
     /* Wait to make sure it's not being used on another CPU */
@@ -1729,8 +1729,8 @@ static irq_guest_action_t *__pirq_guest_
     BUG_ON(action->in_flight != 0);
 
     /* Disabling IRQ before releasing the desc_lock avoids an IRQ storm. */
-    desc->status |= IRQ_DISABLED;
     desc->handler->disable(desc);
+    desc->status |= IRQ_DISABLED;
 
     /*
      * Mark any remaining pending EOIs as ready to flush.
--- a/xen/arch/x86/msi.c
+++ b/xen/arch/x86/msi.c
@@ -123,6 +123,27 @@ static void msix_put_fixmap(struct arch_
     spin_unlock(&msix->table_lock);
 }
 
+static bool_t memory_decoded(const struct pci_dev *dev)
+{
+    u8 bus, slot, func;
+
+    if ( !dev->info.is_virtfn )
+    {
+        bus = dev->bus;
+        slot = PCI_SLOT(dev->devfn);
+        func = PCI_FUNC(dev->devfn);
+    }
+    else
+    {
+        bus = dev->info.physfn.bus;
+        slot = PCI_SLOT(dev->info.physfn.devfn);
+        func = PCI_FUNC(dev->info.physfn.devfn);
+    }
+
+    return !!(pci_conf_read16(dev->seg, bus, slot, func, PCI_COMMAND) &
+              PCI_COMMAND_MEMORY);
+}
+
 /*
  * MSI message composition
  */
@@ -166,7 +187,7 @@ void msi_compose_msg(unsigned vector, co
     }
 }
 
-static void read_msi_msg(struct msi_desc *entry, struct msi_msg *msg)
+static bool_t read_msi_msg(struct msi_desc *entry, struct msi_msg *msg)
 {
     switch ( entry->msi_attrib.type )
     {
@@ -201,6 +222,8 @@ static void read_msi_msg(struct msi_desc
     {
         void __iomem *base = entry->mask_base;
 
+        if ( unlikely(!memory_decoded(entry->dev)) )
+            return 0;
         msg->address_lo = readl(base + PCI_MSIX_ENTRY_LOWER_ADDR_OFFSET);
         msg->address_hi = readl(base + PCI_MSIX_ENTRY_UPPER_ADDR_OFFSET);
         msg->data = readl(base + PCI_MSIX_ENTRY_DATA_OFFSET);
@@ -212,6 +235,8 @@ static void read_msi_msg(struct msi_desc
 
     if ( iommu_intremap )
         iommu_read_msi_from_ire(entry, msg);
+
+    return 1;
 }
 
 static int write_msi_msg(struct msi_desc *entry, struct msi_msg *msg)
@@ -262,6 +287,8 @@ static int write_msi_msg(struct msi_desc
     {
         void __iomem *base = entry->mask_base;
 
+        if ( unlikely(!memory_decoded(entry->dev)) )
+            return -ENXIO;
         writel(msg->address_lo,
                base + PCI_MSIX_ENTRY_LOWER_ADDR_OFFSET);
         writel(msg->address_hi,
@@ -289,7 +316,8 @@ void set_msi_affinity(struct irq_desc *d
     ASSERT(spin_is_locked(&desc->lock));
 
     memset(&msg, 0, sizeof(msg));
-    read_msi_msg(msi_desc, &msg);
+    if ( !read_msi_msg(msi_desc, &msg) )
+        return;
 
     msg.data &= ~MSI_DATA_VECTOR_MASK;
     msg.data |= MSI_DATA_VECTOR(desc->arch.vector);
@@ -349,23 +377,27 @@ int msi_maskable_irq(const struct msi_de
            || entry->msi_attrib.maskbit;
 }
 
-static void msi_set_mask_bit(struct irq_desc *desc, bool_t host, bool_t guest)
+static bool_t msi_set_mask_bit(struct irq_desc *desc, bool_t host, bool_t guest)
 {
     struct msi_desc *entry = desc->msi_desc;
+    struct pci_dev *pdev;
+    u16 seg;
+    u8 bus, slot, func;
     bool_t flag = host || guest;
 
     ASSERT(spin_is_locked(&desc->lock));
     BUG_ON(!entry || !entry->dev);
+    pdev = entry->dev;
+    seg = pdev->seg;
+    bus = pdev->bus;
+    slot = PCI_SLOT(pdev->devfn);
+    func = PCI_FUNC(pdev->devfn);
     switch ( entry->msi_attrib.type )
     {
     case PCI_CAP_ID_MSI:
         if ( entry->msi_attrib.maskbit )
         {
             u32 mask_bits;
-            u16 seg = entry->dev->seg;
-            u8 bus = entry->dev->bus;
-            u8 slot = PCI_SLOT(entry->dev->devfn);
-            u8 func = PCI_FUNC(entry->dev->devfn);
 
             mask_bits = pci_conf_read32(seg, bus, slot, func, entry->msi.mpos);
             mask_bits &= ~((u32)1 << entry->msi_attrib.entry_nr);
@@ -374,25 +406,54 @@ static void msi_set_mask_bit(struct irq_
         }
         break;
     case PCI_CAP_ID_MSIX:
-    {
-        int offset = PCI_MSIX_ENTRY_VECTOR_CTRL_OFFSET;
-        writel(flag, entry->mask_base + offset);
-        readl(entry->mask_base + offset);
-        break;
-    }
+        if ( likely(memory_decoded(pdev)) )
+        {
+            writel(flag, entry->mask_base + PCI_MSIX_ENTRY_VECTOR_CTRL_OFFSET);
+            readl(entry->mask_base + PCI_MSIX_ENTRY_VECTOR_CTRL_OFFSET);
+            break;
+        }
+        if ( flag )
+        {
+            u16 control;
+            domid_t domid = pdev->domain->domain_id;
+
+            pdev->msix->host_maskall = 1;
+            control = pci_conf_read16(seg, bus, slot, func,
+                                      msix_control_reg(entry->msi_attrib.pos));
+            if ( control & PCI_MSIX_FLAGS_MASKALL )
+                break;
+            pci_conf_write16(seg, bus, slot, func,
+                             msix_control_reg(entry->msi_attrib.pos),
+                             control | PCI_MSIX_FLAGS_MASKALL);
+            if ( pdev->msix->warned != domid )
+            {
+                pdev->msix->warned = domid;
+                printk(XENLOG_G_WARNING
+                       "cannot mask IRQ %d: masked MSI-X on Dom%d's %04x:%02x:%02x.%u\n",
+                       desc->irq, domid, pdev->seg, pdev->bus,
+                       PCI_SLOT(pdev->devfn), PCI_FUNC(pdev->devfn));
+            }
+            break;
+        }
+        /* fall through */
     default:
-        BUG();
-        break;
+        return 0;
     }
     entry->msi_attrib.host_masked = host;
     entry->msi_attrib.guest_masked = guest;
+
+    return 1;
 }
 
 static int msi_get_mask_bit(const struct msi_desc *entry)
 {
-    switch (entry->msi_attrib.type) {
+    if ( !entry->dev )
+        return -1;
+
+    switch ( entry->msi_attrib.type )
+    {
     case PCI_CAP_ID_MSI:
-        if (!entry->dev || !entry->msi_attrib.maskbit)
+        if ( !entry->msi_attrib.maskbit )
             break;
         return (pci_conf_read32(entry->dev->seg, entry->dev->bus,
                                 PCI_SLOT(entry->dev->devfn),
@@ -400,6 +461,8 @@ static int msi_get_mask_bit(const struct
                                 entry->msi.mpos) >>
                 entry->msi_attrib.entry_nr) & 1;
     case PCI_CAP_ID_MSIX:
+        if ( unlikely(!memory_decoded(entry->dev)) )
+            break;
         return readl(entry->mask_base + PCI_MSIX_ENTRY_VECTOR_CTRL_OFFSET) & 1;
     }
     return -1;
@@ -407,12 +470,16 @@ static int msi_get_mask_bit(const struct
 
 void mask_msi_irq(struct irq_desc *desc)
 {
-    msi_set_mask_bit(desc, 1, desc->msi_desc->msi_attrib.guest_masked);
+    if ( unlikely(!msi_set_mask_bit(desc, 1,
+                                    desc->msi_desc->msi_attrib.guest_masked)) )
+        BUG_ON(!(desc->status & IRQ_DISABLED));
 }
 
 void unmask_msi_irq(struct irq_desc *desc)
 {
-    msi_set_mask_bit(desc, 0, desc->msi_desc->msi_attrib.guest_masked);
+    if ( unlikely(!msi_set_mask_bit(desc, 0,
+                                    desc->msi_desc->msi_attrib.guest_masked)) )
+        WARN();
 }
 
 void guest_mask_msi_irq(struct irq_desc *desc, bool_t mask)
@@ -422,13 +489,15 @@ void guest_mask_msi_irq(struct irq_desc 
 
 static unsigned int startup_msi_irq(struct irq_desc *desc)
 {
-    msi_set_mask_bit(desc, 0, !!(desc->status & IRQ_GUEST));
+    if ( unlikely(!msi_set_mask_bit(desc, 0, !!(desc->status & IRQ_GUEST))) )
+        WARN();
     return 0;
 }
 
 static void shutdown_msi_irq(struct irq_desc *desc)
 {
-    msi_set_mask_bit(desc, 1, 1);
+    if ( unlikely(!msi_set_mask_bit(desc, 1, 1)) )
+        BUG_ON(!(desc->status & IRQ_DISABLED));
 }
 
 void ack_nonmaskable_msi_irq(struct irq_desc *desc)
@@ -740,6 +809,9 @@ static int msix_capability_init(struct p
     control = pci_conf_read16(seg, bus, slot, func, msix_control_reg(pos));
     msix_set_enable(dev, 0);/* Ensure msix is disabled as I set it up */
 
+    if ( unlikely(!memory_decoded(dev)) )
+        return -ENXIO;
+
     if ( desc )
     {
         entry = alloc_msi_entry(1);
@@ -879,7 +951,8 @@ static int msix_capability_init(struct p
     ++msix->used_entries;
 
     /* Restore MSI-X enabled bits */
-    pci_conf_write16(seg, bus, slot, func, msix_control_reg(pos), control);
+    pci_conf_write16(seg, bus, slot, func, msix_control_reg(pos),
+                     control & ~PCI_MSIX_FLAGS_MASKALL);
 
     return 0;
 }
@@ -1024,8 +1097,16 @@ static void __pci_disable_msix(struct ms
 
     BUG_ON(list_empty(&dev->msi_list));
 
-    writel(1, entry->mask_base + PCI_MSIX_ENTRY_VECTOR_CTRL_OFFSET);
-
+    if ( likely(memory_decoded(dev)) )
+        writel(1, entry->mask_base + PCI_MSIX_ENTRY_VECTOR_CTRL_OFFSET);
+    else if ( !(control & PCI_MSIX_FLAGS_MASKALL) )
+    {
+        printk(XENLOG_WARNING
+               "cannot disable IRQ %d: masking MSI-X on %04x:%02x:%02x.%u\n",
+               entry->irq, dev->seg, dev->bus,
+               PCI_SLOT(dev->devfn), PCI_FUNC(dev->devfn));
+        control |= PCI_MSIX_FLAGS_MASKALL;
+    }
     pci_conf_write16(seg, bus, slot, func, msix_control_reg(pos), control);
 
     _pci_cleanup_msix(dev->msix);
@@ -1199,15 +1280,24 @@ int pci_restore_msi_state(struct pci_dev
             nr = entry->msi.nvec;
         }
         else if ( entry->msi_attrib.type == PCI_CAP_ID_MSIX )
+        {
             msix_set_enable(pdev, 0);
+            if ( unlikely(!memory_decoded(pdev)) )
+            {
+                spin_unlock_irqrestore(&desc->lock, flags);
+                return -ENXIO;
+            }
+        }
 
         msg = entry->msg;
         write_msi_msg(entry, &msg);
 
         for ( i = 0; ; )
         {
-            msi_set_mask_bit(desc, entry[i].msi_attrib.host_masked,
-                             entry[i].msi_attrib.guest_masked);
+            if ( unlikely(!msi_set_mask_bit(desc,
+                                            entry[i].msi_attrib.host_masked,
+                                            entry[i].msi_attrib.guest_masked)) )
+                BUG();
 
             if ( !--nr )
                 break;
++++++ 55b0a2ab-x86-MSI-X-enable.patch ++++++
References: bsc#907514 bsc#910258 bsc#918984 bsc#923967

# Commit 0dba393db07331e9cff42df10e95b67547dfdb3e
# Date 2015-07-23 10:15:39 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/MSI-X: access MSI-X table only after having enabled MSI-X

As done in Linux by f598282f51 ("PCI: Fix the NIU MSI-X problem in a
better way") and its broken predecessor, make sure we don't access the
MSI-X table without having enabled MSI-X first, using the mask-all flag
instead to prevent interrupts from occurring.

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 

--- a/xen/arch/x86/msi.c
+++ b/xen/arch/x86/msi.c
@@ -144,6 +144,17 @@ static bool_t memory_decoded(const struc
               PCI_COMMAND_MEMORY);
 }
 
+static bool_t msix_memory_decoded(const struct pci_dev *dev, unsigned int pos)
+{
+    u16 control = pci_conf_read16(dev->seg, dev->bus, PCI_SLOT(dev->devfn),
+                                  PCI_FUNC(dev->devfn), msix_control_reg(pos));
+
+    if ( !(control & PCI_MSIX_FLAGS_ENABLE) )
+        return 0;
+
+    return memory_decoded(dev);
+}
+
 /*
  * MSI message composition
  */
@@ -222,7 +233,8 @@ static bool_t read_msi_msg(struct msi_de
     {
         void __iomem *base = entry->mask_base;
 
-        if ( unlikely(!memory_decoded(entry->dev)) )
+        if ( unlikely(!msix_memory_decoded(entry->dev,
+                                           entry->msi_attrib.pos)) )
             return 0;
         msg->address_lo = readl(base + PCI_MSIX_ENTRY_LOWER_ADDR_OFFSET);
         msg->address_hi = readl(base + PCI_MSIX_ENTRY_UPPER_ADDR_OFFSET);
@@ -287,7 +299,8 @@ static int write_msi_msg(struct msi_desc
     {
         void __iomem *base = entry->mask_base;
 
-        if ( unlikely(!memory_decoded(entry->dev)) )
+        if ( unlikely(!msix_memory_decoded(entry->dev,
+                                           entry->msi_attrib.pos)) )
             return -ENXIO;
         writel(msg->address_lo,
                base + PCI_MSIX_ENTRY_LOWER_ADDR_OFFSET);
@@ -381,9 +394,9 @@ static bool_t msi_set_mask_bit(struct ir
 {
     struct msi_desc *entry = desc->msi_desc;
     struct pci_dev *pdev;
-    u16 seg;
+    u16 seg, control;
     u8 bus, slot, func;
-    bool_t flag = host || guest;
+    bool_t flag = host || guest, maskall;
 
     ASSERT(spin_is_locked(&desc->lock));
     BUG_ON(!entry || !entry->dev);
@@ -406,36 +419,45 @@ static bool_t msi_set_mask_bit(struct ir
         }
         break;
     case PCI_CAP_ID_MSIX:
+        maskall = pdev->msix->host_maskall;
+        control = pci_conf_read16(seg, bus, slot, func,
+                                  msix_control_reg(entry->msi_attrib.pos));
+        if ( unlikely(!(control & PCI_MSIX_FLAGS_ENABLE)) )
+        {
+            pdev->msix->host_maskall = 1;
+            pci_conf_write16(seg, bus, slot, func,
+                             msix_control_reg(entry->msi_attrib.pos),
+                             control | (PCI_MSIX_FLAGS_ENABLE |
+                                        PCI_MSIX_FLAGS_MASKALL));
+        }
         if ( likely(memory_decoded(pdev)) )
         {
             writel(flag, entry->mask_base + PCI_MSIX_ENTRY_VECTOR_CTRL_OFFSET);
             readl(entry->mask_base + PCI_MSIX_ENTRY_VECTOR_CTRL_OFFSET);
-            break;
+            if ( likely(control & PCI_MSIX_FLAGS_ENABLE) )
+                break;
+            flag = 1;
         }
-        if ( flag )
+        else if ( flag && !(control & PCI_MSIX_FLAGS_MASKALL) )
         {
-            u16 control;
             domid_t domid = pdev->domain->domain_id;
 
-            pdev->msix->host_maskall = 1;
-            control = pci_conf_read16(seg, bus, slot, func,
-                                      msix_control_reg(entry->msi_attrib.pos));
-            if ( control & PCI_MSIX_FLAGS_MASKALL )
-                break;
-            pci_conf_write16(seg, bus, slot, func,
-                             msix_control_reg(entry->msi_attrib.pos),
-                             control | PCI_MSIX_FLAGS_MASKALL);
+            maskall = 1;
             if ( pdev->msix->warned != domid )
             {
                 pdev->msix->warned = domid;
                 printk(XENLOG_G_WARNING
-                       "cannot mask IRQ %d: masked MSI-X on Dom%d's %04x:%02x:%02x.%u\n",
+                       "cannot mask IRQ %d: masking MSI-X on Dom%d's %04x:%02x:%02x.%u\n",
                        desc->irq, domid, pdev->seg, pdev->bus,
                        PCI_SLOT(pdev->devfn), PCI_FUNC(pdev->devfn));
             }
-            break;
         }
-        /* fall through */
+        pdev->msix->host_maskall = maskall;
+        if ( maskall || pdev->msix->guest_maskall )
+            control |= PCI_MSIX_FLAGS_MASKALL;
+        pci_conf_write16(seg, bus, slot, func,
+                         msix_control_reg(entry->msi_attrib.pos), control);
+        return flag;
     default:
         return 0;
     }
@@ -461,7 +483,8 @@ static int msi_get_mask_bit(const struct
                                 entry->msi.mpos) >>
                 entry->msi_attrib.entry_nr) & 1;
     case PCI_CAP_ID_MSIX:
-        if ( unlikely(!memory_decoded(entry->dev)) )
+        if ( unlikely(!msix_memory_decoded(entry->dev,
+                                           entry->msi_attrib.pos)) )
             break;
         return readl(entry->mask_base + PCI_MSIX_ENTRY_VECTOR_CTRL_OFFSET) & 1;
     }
@@ -564,9 +587,31 @@ static struct msi_desc *alloc_msi_entry(
 
 int setup_msi_irq(struct irq_desc *desc, struct msi_desc *msidesc)
 {
-    return __setup_msi_irq(desc, msidesc,
-                           msi_maskable_irq(msidesc) ? &pci_msi_maskable
-                                                     : &pci_msi_nonmaskable);
+    const struct pci_dev *pdev = msidesc->dev;
+    unsigned int cpos = msix_control_reg(msidesc->msi_attrib.pos);
+    u16 control = ~0;
+    int rc;
+
+    if ( msidesc->msi_attrib.type == PCI_CAP_ID_MSIX )
+    {
+        control = pci_conf_read16(pdev->seg, pdev->bus, PCI_SLOT(pdev->devfn),
+                                  PCI_FUNC(pdev->devfn), cpos);
+        if ( !(control & PCI_MSIX_FLAGS_ENABLE) )
+            pci_conf_write16(pdev->seg, pdev->bus, PCI_SLOT(pdev->devfn),
+                             PCI_FUNC(pdev->devfn), cpos,
+                             control | (PCI_MSIX_FLAGS_ENABLE |
+                                        PCI_MSIX_FLAGS_MASKALL));
+    }
+
+    rc = __setup_msi_irq(desc, msidesc,
+                         msi_maskable_irq(msidesc) ? &pci_msi_maskable
+                                                   : &pci_msi_nonmaskable);
+
+    if ( !(control & PCI_MSIX_FLAGS_ENABLE) )
+        pci_conf_write16(pdev->seg, pdev->bus, PCI_SLOT(pdev->devfn),
+                         PCI_FUNC(pdev->devfn), cpos, control);
+
+    return rc;
 }
 
 int __setup_msi_irq(struct irq_desc *desc, struct msi_desc *msidesc,
@@ -803,20 +848,38 @@ static int msix_capability_init(struct p
     u8 bus = dev->bus;
     u8 slot = PCI_SLOT(dev->devfn);
     u8 func = PCI_FUNC(dev->devfn);
+    bool_t maskall = msix->host_maskall;
 
     ASSERT(spin_is_locked(&pcidevs_lock));
 
     control = pci_conf_read16(seg, bus, slot, func, msix_control_reg(pos));
-    msix_set_enable(dev, 0);/* Ensure msix is disabled as I set it up */
+    /*
+     * Ensure MSI-X interrupts are masked during setup. Some devices require
+     * MSI-X to be enabled before we can touch the MSI-X registers. We need
+     * to mask all the vectors to prevent interrupts coming in before they're
+     * fully set up.
+     */
+    msix->host_maskall = 1;
+    pci_conf_write16(seg, bus, slot, func, msix_control_reg(pos),
+                     control | (PCI_MSIX_FLAGS_ENABLE |
+                                PCI_MSIX_FLAGS_MASKALL));
 
     if ( unlikely(!memory_decoded(dev)) )
+    {
+        pci_conf_write16(seg, bus, slot, func, msix_control_reg(pos),
+                         control & ~PCI_MSIX_FLAGS_ENABLE);
         return -ENXIO;
+    }
 
     if ( desc )
     {
         entry = alloc_msi_entry(1);
         if ( !entry )
+        {
+            pci_conf_write16(seg, bus, slot, func, msix_control_reg(pos),
+                             control & ~PCI_MSIX_FLAGS_ENABLE);
             return -ENOMEM;
+        }
         ASSERT(msi);
     }
 
@@ -847,6 +910,8 @@ static int msix_capability_init(struct p
     {
         if ( !msi || !msi->table_base )
         {
+            pci_conf_write16(seg, bus, slot, func, msix_control_reg(pos),
+                             control & ~PCI_MSIX_FLAGS_ENABLE);
             xfree(entry);
             return -ENXIO;
         }
@@ -889,6 +954,8 @@ static int msix_capability_init(struct p
 
         if ( idx < 0 )
         {
+            pci_conf_write16(seg, bus, slot, func, msix_control_reg(pos),
+                             control & ~PCI_MSIX_FLAGS_ENABLE);
             xfree(entry);
             return idx;
         }
@@ -915,7 +982,7 @@ static int msix_capability_init(struct p
 
     if ( !msix->used_entries )
     {
-        msix->host_maskall = 0;
+        maskall = 0;
         if ( !msix->guest_maskall )
             control &= ~PCI_MSIX_FLAGS_MASKALL;
         else
@@ -951,8 +1018,8 @@ static int msix_capability_init(struct p
     ++msix->used_entries;
 
     /* Restore MSI-X enabled bits */
-    pci_conf_write16(seg, bus, slot, func, msix_control_reg(pos),
-                     control & ~PCI_MSIX_FLAGS_MASKALL);
+    msix->host_maskall = maskall;
+    pci_conf_write16(seg, bus, slot, func, msix_control_reg(pos), control);
 
     return 0;
 }
@@ -1092,8 +1159,15 @@ static void __pci_disable_msix(struct ms
                                            PCI_CAP_ID_MSIX);
     u16 control = pci_conf_read16(seg, bus, slot, func,
                                   msix_control_reg(entry->msi_attrib.pos));
+    bool_t maskall = dev->msix->host_maskall;
 
-    msix_set_enable(dev, 0);
+    if ( unlikely(!(control & PCI_MSIX_FLAGS_ENABLE)) )
+    {
+        dev->msix->host_maskall = 1;
+        pci_conf_write16(seg, bus, slot, func, msix_control_reg(pos),
+                         control | (PCI_MSIX_FLAGS_ENABLE |
+                                    PCI_MSIX_FLAGS_MASKALL));
+    }
 
     BUG_ON(list_empty(&dev->msi_list));
 
@@ -1105,8 +1179,11 @@ static void __pci_disable_msix(struct ms
                "cannot disable IRQ %d: masking MSI-X on %04x:%02x:%02x.%u\n",
                entry->irq, dev->seg, dev->bus,
                PCI_SLOT(dev->devfn), PCI_FUNC(dev->devfn));
-        control |= PCI_MSIX_FLAGS_MASKALL;
+        maskall = 1;
     }
+    dev->msix->host_maskall = maskall;
+    if ( maskall || dev->msix->guest_maskall )
+        control |= PCI_MSIX_FLAGS_MASKALL;
     pci_conf_write16(seg, bus, slot, func, msix_control_reg(pos), control);
 
     _pci_cleanup_msix(dev->msix);
@@ -1255,6 +1332,8 @@ int pci_restore_msi_state(struct pci_dev
     list_for_each_entry_safe( entry, tmp, &pdev->msi_list, list )
     {
         unsigned int i = 0, nr = 1;
+        u16 control = 0;
+        u8 slot = PCI_SLOT(pdev->devfn), func = PCI_FUNC(pdev->devfn);
 
         irq = entry->irq;
         desc = &irq_desc[irq];
@@ -1281,10 +1360,18 @@ int pci_restore_msi_state(struct pci_dev
         }
         else if ( entry->msi_attrib.type == PCI_CAP_ID_MSIX )
         {
-            msix_set_enable(pdev, 0);
+            control = pci_conf_read16(pdev->seg, pdev->bus, slot, func,
+                                      msix_control_reg(entry->msi_attrib.pos));
+            pci_conf_write16(pdev->seg, pdev->bus, slot, func,
+                             msix_control_reg(entry->msi_attrib.pos),
+                             control | (PCI_MSIX_FLAGS_ENABLE |
+                                        PCI_MSIX_FLAGS_MASKALL));
             if ( unlikely(!memory_decoded(pdev)) )
             {
                 spin_unlock_irqrestore(&desc->lock, flags);
+                pci_conf_write16(pdev->seg, pdev->bus, slot, func,
+                                 msix_control_reg(entry->msi_attrib.pos),
+                                 control & ~PCI_MSIX_FLAGS_ENABLE);
                 return -ENXIO;
             }
         }
@@ -1314,11 +1401,9 @@ int pci_restore_msi_state(struct pci_dev
         if ( entry->msi_attrib.type == PCI_CAP_ID_MSI )
         {
             unsigned int cpos = msi_control_reg(entry->msi_attrib.pos);
-            u16 control = pci_conf_read16(pdev->seg, pdev->bus,
-                                          PCI_SLOT(pdev->devfn),
-                                          PCI_FUNC(pdev->devfn), cpos);
 
-            control &= ~PCI_MSI_FLAGS_QSIZE;
+            control = pci_conf_read16(pdev->seg, pdev->bus, slot, func, cpos) &
+                      ~PCI_MSI_FLAGS_QSIZE;
             multi_msi_enable(control, entry->msi.nvec);
             pci_conf_write16(pdev->seg, pdev->bus, PCI_SLOT(pdev->devfn),
                              PCI_FUNC(pdev->devfn), cpos, control);
@@ -1326,7 +1411,9 @@ int pci_restore_msi_state(struct pci_dev
             msi_set_enable(pdev, 1);
         }
         else if ( entry->msi_attrib.type == PCI_CAP_ID_MSIX )
-            msix_set_enable(pdev, 1);
+            pci_conf_write16(pdev->seg, pdev->bus, slot, func,
+                             msix_control_reg(entry->msi_attrib.pos),
+                             control | PCI_MSIX_FLAGS_ENABLE);
     }
 
     return 0;
++++++ 55b0a2db-x86-MSI-track-guest-masking.patch ++++++
References: bsc#907514 bsc#910258 bsc#918984 bsc#923967

# Commit aa7c1fdf9dd04a1287f4770906b2c41b88a28228
# Date 2015-07-23 10:16:27 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/MSI: properly track guest masking requests

... by monitoring writes to the mask register.

This allows reverting the main effect of the XSA-129 patches in qemu.

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 

--- a/xen/arch/x86/msi.c
+++ b/xen/arch/x86/msi.c
@@ -1303,6 +1303,37 @@ int pci_msi_conf_write_intercept(struct 
         return 1;
     }
 
+    entry = find_msi_entry(pdev, -1, PCI_CAP_ID_MSI);
+    if ( entry && entry->msi_attrib.maskbit )
+    {
+        uint16_t cntl;
+        uint32_t unused;
+
+        pos = entry->msi_attrib.pos;
+        if ( reg < pos || reg >= entry->msi.mpos + 8 )
+            return 0;
+
+        if ( reg == msi_control_reg(pos) )
+            return size == 2 ? 1 : -EACCES;
+        if ( reg < entry->msi.mpos || reg >= entry->msi.mpos + 4 || size != 4 )
+            return -EACCES;
+
+        cntl = pci_conf_read16(seg, bus, slot, func, msi_control_reg(pos));
+        unused = ~(uint32_t)0 >> (32 - multi_msi_capable(cntl));
+        for ( pos = 0; pos < entry->msi.nvec; ++pos, ++entry )
+        {
+            entry->msi_attrib.guest_masked =
+                *data >> entry->msi_attrib.entry_nr;
+            if ( entry->msi_attrib.host_masked )
+                *data |= 1 << pos;
+            unused &= ~(1 << pos);
+        }
+
+        *data |= unused;
+
+        return 1;
+    }
+
     return 0;
 }
 
++++++ 55c1d83d-x86-gdt-Drop-write-only-xalloc-d-array.patch ++++++
# Commit a7bd9b1661304500cd18b7d216d616ecf053ebdb
# Date 2015-08-05 10:32:45 +0100
# Author Andrew Cooper 
# Committer Ian Campbell 
x86/gdt: Drop write-only, xalloc()'d array from set_gdt()

It is not used, and can cause a spurious failure of the set_gdt() hypercall in
low memory situations.

Signed-off-by: Andrew Cooper 
Reviewed-by: Wei Liu 
Reviewed-by: Ian Campbell 
Reviewed-by: George Dunlap 

--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -4361,20 +4361,15 @@ long set_gdt(struct vcpu *v, 
     l1_pgentry_t *pl1e;
     /* NB. There are 512 8-byte entries per GDT page. */
     int i, nr_pages = (entries + 511) / 512;
-    unsigned long mfn, *pfns;
 
     if ( entries > FIRST_RESERVED_GDT_ENTRY )
         return -EINVAL;
 
-    pfns = xmalloc_array(unsigned long, nr_pages);
-    if ( !pfns )
-        return -ENOMEM;
-
     /* Check the pages in the new GDT. */
     for ( i = 0; i < nr_pages; i++ )
     {
         struct page_info *page;
-        pfns[i] = frames[i];
+
         page = get_page_from_gfn(d, frames[i], NULL, P2M_ALLOC);
         if ( !page )
             goto fail;
@@ -4383,7 +4378,7 @@ long set_gdt(struct vcpu *v, 
             put_page(page);
             goto fail;
         }
-        mfn = frames[i] = page_to_mfn(page);
+        frames[i] = page_to_mfn(page);
     }
 
     /* Tear down the old GDT. */
@@ -4398,7 +4393,6 @@ long set_gdt(struct vcpu *v, 
         l1e_write(&pl1e[i], l1e_from_pfn(frames[i], __PAGE_HYPERVISOR));
     }
 
-    xfree(pfns);
     return 0;
 
  fail:
@@ -4406,7 +4400,6 @@ long set_gdt(struct vcpu *v, 
     {
         put_page_and_type(mfn_to_page(frames[i]));
     }
-    xfree(pfns);
     return -EINVAL;
 }
 
++++++ 55c3232b-x86-mm-Make-hap-shadow-teardown-preemptible.patch ++++++
# Commit 0174da5b79752e2d5d6ca0faed89536e8f3d91c7
# Date 2015-08-06 10:04:43 +0100
# Author Anshul Makkar 
# Committer Ian Campbell 
x86/mm: Make {hap, shadow}_teardown() preemptible

A domain with sufficient shadow allocation can cause a watchdog timeout
during domain destruction.  Expand the existing -EAGAIN logic in
paging_teardown() to allow {hap/sh}_set_allocation() to become
restartable during the DOMCTL_destroydomain hypercall.

Signed-off-by: Anshul Makkar 
Signed-off-by: Andrew Cooper 
Reviewed-by: Tim Deegan 
Reviewed-by: George Dunlap 

--- a/xen/arch/x86/mm/hap/hap.c
+++ b/xen/arch/x86/mm/hap/hap.c
@@ -498,7 +498,7 @@ void hap_final_teardown(struct domain *d
     }
 
     if ( d->arch.paging.hap.total_pages != 0 )
-        hap_teardown(d);
+        hap_teardown(d, NULL);
 
     p2m_teardown(p2m_get_hostp2m(d));
     /* Free any memory that the p2m teardown released */
@@ -508,7 +508,7 @@ void hap_final_teardown(struct domain *d
     paging_unlock(d);
 }
 
-void hap_teardown(struct domain *d)
+void hap_teardown(struct domain *d, int *preempted)
 {
     struct vcpu *v;
     mfn_t mfn;
@@ -536,18 +536,11 @@ void hap_teardown(struct domain *d)
 
     if ( d->arch.paging.hap.total_pages != 0 )
     {
-        HAP_PRINTK("teardown of domain %u starts."
-                      "  pages total = %u, free = %u, p2m=%u\n",
-                      d->domain_id,
-                      d->arch.paging.hap.total_pages,
-                      d->arch.paging.hap.free_pages,
-                      d->arch.paging.hap.p2m_pages);
-        hap_set_allocation(d, 0, NULL);
-        HAP_PRINTK("teardown done."
-                      "  pages total = %u, free = %u, p2m=%u\n",
-                      d->arch.paging.hap.total_pages,
-                      d->arch.paging.hap.free_pages,
-                      d->arch.paging.hap.p2m_pages);
+        hap_set_allocation(d, 0, preempted);
+
+        if ( preempted && *preempted )
+            goto out;
+
         ASSERT(d->arch.paging.hap.total_pages == 0);
     }
 
@@ -556,6 +549,7 @@ void hap_teardown(struct domain *d)
     xfree(d->arch.hvm_domain.dirty_vram);
     d->arch.hvm_domain.dirty_vram = NULL;
 
+out:
     paging_unlock(d);
 }
 
--- a/xen/arch/x86/mm/paging.c
+++ b/xen/arch/x86/mm/paging.c
@@ -777,12 +777,15 @@ long paging_domctl_continuation(XEN_GUES
 /* Call when destroying a domain */
 int paging_teardown(struct domain *d)
 {
-    int rc;
+    int rc, preempted = 0;
 
     if ( hap_enabled(d) )
-        hap_teardown(d);
+        hap_teardown(d, &preempted);
     else
-        shadow_teardown(d);
+        shadow_teardown(d, &preempted);
+
+    if ( preempted )
+        return -EAGAIN;
 
     /* clean up log dirty resources. */
     rc = paging_free_log_dirty_bitmap(d, 0);
--- a/xen/arch/x86/mm/shadow/common.c
+++ b/xen/arch/x86/mm/shadow/common.c
@@ -3031,7 +3031,7 @@ int shadow_enable(struct domain *d, u32 
     return rv;
 }
 
-void shadow_teardown(struct domain *d)
+void shadow_teardown(struct domain *d, int *preempted)
 /* Destroy the shadow pagetables of this domain and free its shadow memory.
  * Should only be called for dying domains. */
 {
@@ -3092,23 +3092,16 @@ void shadow_teardown(struct domain *d)
 
     if ( d->arch.paging.shadow.total_pages != 0 )
     {
-        SHADOW_PRINTK("teardown of domain %u starts."
-                       "  Shadow pages total = %u, free = %u, p2m=%u\n",
-                       d->domain_id,
-                       d->arch.paging.shadow.total_pages, 
-                       d->arch.paging.shadow.free_pages, 
-                       d->arch.paging.shadow.p2m_pages);
         /* Destroy all the shadows and release memory to domheap */
-        sh_set_allocation(d, 0, NULL);
+        sh_set_allocation(d, 0, preempted);
+
+        if ( preempted && *preempted )
+            goto out;
+
         /* Release the hash table back to xenheap */
         if (d->arch.paging.shadow.hash_table) 
             shadow_hash_teardown(d);
-        /* Should not have any more memory held */
-        SHADOW_PRINTK("teardown done."
-                       "  Shadow pages total = %u, free = %u, p2m=%u\n",
-                       d->arch.paging.shadow.total_pages, 
-                       d->arch.paging.shadow.free_pages, 
-                       d->arch.paging.shadow.p2m_pages);
+
         ASSERT(d->arch.paging.shadow.total_pages == 0);
     }
 
@@ -3139,6 +3132,7 @@ void shadow_teardown(struct domain *d)
         d->arch.hvm_domain.dirty_vram = NULL;
     }
 
+out:
     paging_unlock(d);
 
     /* Must be called outside the lock */
@@ -3160,7 +3154,7 @@ void shadow_final_teardown(struct domain
      * It is possible for a domain that never got domain_kill()ed
      * to get here with its shadow allocation intact. */
     if ( d->arch.paging.shadow.total_pages != 0 )
-        shadow_teardown(d);
+        shadow_teardown(d, NULL);
 
     /* It is now safe to pull down the p2m map. */
     p2m_teardown(p2m_get_hostp2m(d));
--- a/xen/include/asm-x86/hap.h
+++ b/xen/include/asm-x86/hap.h
@@ -54,7 +54,7 @@ int   hap_domctl(struct domain *d, xen_d
                  XEN_GUEST_HANDLE_PARAM(void) u_domctl);
 int   hap_enable(struct domain *d, u32 mode);
 void  hap_final_teardown(struct domain *d);
-void  hap_teardown(struct domain *d);
+void  hap_teardown(struct domain *d, int *preempted);
 void  hap_vcpu_init(struct vcpu *v);
 void  hap_logdirty_init(struct domain *d);
 int   hap_track_dirty_vram(struct domain *d,
--- a/xen/include/asm-x86/shadow.h
+++ b/xen/include/asm-x86/shadow.h
@@ -76,7 +76,7 @@ int shadow_domctl(struct domain *d, 
                   XEN_GUEST_HANDLE_PARAM(void) u_domctl);
 
 /* Call when destroying a domain */
-void shadow_teardown(struct domain *d);
+void shadow_teardown(struct domain *d, int *preempted);
 
 /* Call once all of the references to the domain have gone away */
 void shadow_final_teardown(struct domain *d);
++++++ 55dc78e9-x86-amd_ucode-skip-updates-for-final-levels.patch ++++++
# Commit 22c5675877c8209adcfdb6bceddb561320374529
# Date 2015-08-25 16:17:13 +0200
# Author Aravind Gopalakrishnan 
# Committer Jan Beulich 
x86, amd_ucode: skip microcode updates for final levels

Some of older[Fam10h] systems require that certain number of
applied microcode patch levels should not be overwritten by
the microcode loader. Otherwise, system hangs are known to occur.

The 'final_levels' of patch ids have been obtained empirically.
Refer bug https://bugzilla.suse.com/show_bug.cgi?id=913996
for details of the issue.

The short version is that people have predominantly noticed
system hang issues when trying to update microcode levels
beyond the patch IDs below.
[0x01000098, 0x0100009f, 0x010000af]
...
From internal discussions, we gathered that OS/hypervisor
cannot reliably perform microcode updates beyond these levels
due to hardware issues. Therefore, we need to abort microcode
update process if we hit any of these levels.
In this patch, we check for those microcode versions and abort
if the current core has one of those final patch levels applied
by the BIOS

A linux version of the patch has already made it into tip-
http://marc.info/?l=linux-kernel&m=143703405627170

Signed-off-by: Aravind Gopalakrishnan 
Reviewed-by: Andrew Cooper 
Reviewed-by: Boris Ostrovsky 

--- a/xen/arch/x86/microcode_amd.c
+++ b/xen/arch/x86/microcode_amd.c
@@ -270,6 +270,43 @@ static int install_equiv_cpu_table(
     return 0;
 }
 
+/*
+ * The 'final_levels' of patch ids have been obtained empirically.
+ * Refer bug https://bugzilla.suse.com/show_bug.cgi?id=913996
+ * for details of the issue. The short version is that people
+ * using certain Fam10h systems noticed system hang issues when
+ * trying to update microcode levels beyond the patch IDs below.
+ * From internal discussions, we gathered that OS/hypervisor
+ * cannot reliably perform microcode updates beyond these levels
+ * due to hardware issues. Therefore, we need to abort microcode
+ * update process if we hit any of these levels.
+ */
+static const unsigned int final_levels[] = {
+    0x01000098,
+    0x0100009f,
+    0x010000af
+};
+
+static bool_t check_final_patch_levels(unsigned int cpu)
+{
+    /*
+     * Check the current patch levels on the cpu. If they are equal to
+     * any of the 'final_levels', then we should not update the microcode
+     * patch on the cpu as system will hang otherwise.
+     */
+    struct ucode_cpu_info *uci = &per_cpu(ucode_cpu_info, cpu);
+    unsigned int i;
+
+    if ( boot_cpu_data.x86 != 0x10 )
+        return 0;
+
+    for ( i = 0; i < ARRAY_SIZE(final_levels); i++ )
+        if ( uci->cpu_sig.rev == final_levels[i] )
+            return 1;
+
+    return 0;
+}
+
 static int cpu_request_microcode(int cpu, const void *buf, size_t bufsize)
 {
     struct microcode_amd *mc_amd, *mc_old;
@@ -288,6 +325,14 @@ static int cpu_request_microcode(int cpu
         goto out;
     }
 
+    if ( check_final_patch_levels(cpu) )
+    {
+        printk(XENLOG_INFO
+               "microcode: Cannot update microcode patch on the cpu as we hit a final level\n");
+        error = -EPERM;
+        goto out;
+    }
+
     mc_amd = xmalloc(struct microcode_amd);
     if ( !mc_amd )
     {
++++++ 55df2f76-IOMMU-skip-domains-without-page-tables-when-dumping.patch ++++++
# Commit 5f335544cf5b716b0af51223e33373c4a7d65e8c
# Date 2015-08-27 17:40:38 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
IOMMU: skip domains without page tables when dumping

Reported-by: Roger Pau Monné 
Signed-off-by: Jan Beulich 
Tested-by: Roger Pau Monné 

--- a/xen/drivers/passthrough/iommu.c
+++ b/xen/drivers/passthrough/iommu.c
@@ -817,7 +817,7 @@ static void iommu_dump_p2m_table(unsigne
     ops = iommu_get_ops();
     for_each_domain(d)
     {
-        if ( !d->domain_id )
+        if ( !d->domain_id || need_iommu(d) <= 0 )
             continue;
 
         if ( iommu_use_hap_pt(d) )
++++++ 55e43fd8-x86-NUMA-fix-setup_node.patch ++++++
# Commit 8f945d36d9bddd5b589ba23c7322b30d623dd084
# Date 2015-08-31 13:51:52 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/NUMA: fix setup_node()

The function referenced an __initdata object (nodes_found). Since this
being a node mask was more complicated than needed, the variable gets
replaced by a simple counter. Check at once that the count of nodes
doesn't go beyond MAX_NUMNODES.

Also consolidate three printk()s related to the function's use into just
one.

Finally (quite the opposite of the above issue) __init-annotate
nodes_cover_memory().

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 

--- a/xen/arch/x86/srat.c
+++ b/xen/arch/x86/srat.c
@@ -25,7 +25,6 @@ static struct acpi_table_slit *__read_mo
 
 static nodemask_t memory_nodes_parsed __initdata;
 static nodemask_t processor_nodes_parsed __initdata;
-static nodemask_t nodes_found __initdata;
 static struct node nodes[MAX_NUMNODES] __initdata;
 static u8 __read_mostly pxm2node[256] = { [0 ... 255] = NUMA_NO_NODE };
 
@@ -45,17 +44,25 @@ int pxm_to_node(int pxm)
 	return (signed char)pxm2node[pxm];
 }
 
-__devinit int setup_node(int pxm)
+int setup_node(int pxm)
 {
 	unsigned node = pxm2node[pxm];
-	if (node == 0xff) {
-		if (nodes_weight(nodes_found) >= MAX_NUMNODES)
+
+	if (node == NUMA_NO_NODE) {
+		static bool_t warned;
+		static unsigned nodes_found;
+
+		node = nodes_found++;
+		if (node >= MAX_NUMNODES) {
+			printk(KERN_WARNING
+			       "SRAT: Too many proximity domains (%#x)\n",
+			       pxm);
+			warned = 1;
 			return -1;
-		node = first_unset_node(nodes_found); 
-		node_set(node, nodes_found);
+		}
 		pxm2node[pxm] = node;
 	}
-	return pxm2node[pxm];
+	return node;
 }
 
 int valid_numa_range(u64 start, u64 end, int node)
@@ -176,7 +183,6 @@ acpi_numa_x2apic_affinity_init(struct ac
 	pxm = pa->proximity_domain;
 	node = setup_node(pxm);
 	if (node < 0) {
-		printk(KERN_ERR "SRAT: Too many proximity domains %x\n", pxm);
 		bad_srat();
 		return;
 	}
@@ -209,7 +215,6 @@ acpi_numa_processor_affinity_init(struct
 	}
 	node = setup_node(pxm);
 	if (node < 0) {
-		printk(KERN_ERR "SRAT: Too many proximity domains %x\n", pxm);
 		bad_srat();
 		return;
 	}
@@ -253,7 +258,6 @@ acpi_numa_memory_affinity_init(struct ac
 		pxm &= 0xff;
 	node = setup_node(pxm);
 	if (node < 0) {
-		printk(KERN_ERR "SRAT: Too many proximity domains.\n");
 		bad_srat();
 		return;
 	}
@@ -295,7 +299,7 @@ acpi_numa_memory_affinity_init(struct ac
 
 /* Sanity check to catch more bad SRATs (they are amazingly common).
    Make sure the PXMs cover all memory. */
-static int nodes_cover_memory(void)
+static int __init nodes_cover_memory(void)
 {
 	int i;
 
++++++ 55e43ff8-x86-NUMA-don-t-account-hotplug-regions.patch ++++++
# Commit c011f470e6e79208f5baa071b4d072b78c88e2ba
# Date 2015-08-31 13:52:24 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/NUMA: don't account hotplug regions

... except in cases where they really matter: node_memblk_range[] now
is the only place all regions get stored. nodes[] and NODE_DATA() track
present memory only. This improves the reporting when nodes have
disjoint "normal" and hotplug regions, with the hotplug region sitting
above the highest populated page. In such cases a node's spanned-pages
value (visible in both XEN_SYSCTL_numainfo and 'u' debug key output)
covered all the way up to top of populated memory, giving quite
different a picture from what an otherwise identically configured
system without and hotplug regions would report. Note, however, that
the actual hotplug case (as well as cases of nodes with multiple
disjoint present regions) is still not being handled such that the
reported values would represent how much memory a node really has (but
that can be considered intentional).

Reported-by: Jim Fehlig 

This at once makes nodes_cover_memory() no longer consider E820_RAM
regions covered by SRAT hotplug regions.

Also reject self-overlaps with mismatching hotplug flags.

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 
Tested-by: Jim Fehlig 

--- a/xen/arch/x86/srat.c
+++ b/xen/arch/x86/srat.c
@@ -32,7 +32,7 @@ static u8 __read_mostly pxm2node[256] = 
 static int num_node_memblks;
 static struct node node_memblk_range[NR_NODE_MEMBLKS];
 static int memblk_nodeid[NR_NODE_MEMBLKS];
-
+static __initdata DECLARE_BITMAP(memblk_hotplug, NR_NODE_MEMBLKS);
 
 static int node_to_pxm(int n);
 
@@ -89,9 +89,9 @@ static __init int conflicting_memblks(u6
 		if (nd->start == nd->end)
 			continue;
 		if (nd->end > start && nd->start < end)
-			return memblk_nodeid[i];
+			return i;
 		if (nd->end == end && nd->start == start)
-			return memblk_nodeid[i];
+			return i;
 	}
 	return -1;
 }
@@ -229,7 +229,6 @@ acpi_numa_processor_affinity_init(struct
 void __init
 acpi_numa_memory_affinity_init(struct acpi_srat_mem_affinity *ma)
 {
-	struct node *nd;
 	u64 start, end;
 	int node, pxm;
 	int i;
@@ -263,30 +262,40 @@ acpi_numa_memory_affinity_init(struct ac
 	}
 	/* It is fine to add this area to the nodes data it will be used later*/
 	i = conflicting_memblks(start, end);
-	if (i == node) {
-		printk(KERN_WARNING
-		"SRAT: Warning: PXM %d (%"PRIx64"-%"PRIx64") overlaps with itself (%"
-		PRIx64"-%"PRIx64")\n", pxm, start, end, nodes[i].start, nodes[i].end);
-	} else if (i >= 0) {
+	if (i < 0)
+		/* everything fine */;
+	else if (memblk_nodeid[i] == node) {
+		bool_t mismatch = !(ma->flags & ACPI_SRAT_MEM_HOT_PLUGGABLE) !=
+		                  !test_bit(i, memblk_hotplug);
+
+		printk("%sSRAT: PXM %u (%"PRIx64"-%"PRIx64") overlaps with itself (%"PRIx64"-%"PRIx64")\n",
+		       mismatch ? KERN_ERR : KERN_WARNING, pxm, start, end,
+		       node_memblk_range[i].start, node_memblk_range[i].end);
+		if (mismatch) {
+			bad_srat();
+			return;
+		}
+	} else {
 		printk(KERN_ERR
-		       "SRAT: PXM %d (%"PRIx64"-%"PRIx64") overlaps with PXM %d (%"
-		       PRIx64"-%"PRIx64")\n", pxm, start, end, node_to_pxm(i),
-			   nodes[i].start, nodes[i].end);
+		       "SRAT: PXM %u (%"PRIx64"-%"PRIx64") overlaps with PXM %u (%"PRIx64"-%"PRIx64")\n",
+		       pxm, start, end, node_to_pxm(memblk_nodeid[i]),
+		       node_memblk_range[i].start, node_memblk_range[i].end);
 		bad_srat();
 		return;
 	}
-	nd = &nodes[node];
-	if (!node_test_and_set(node, memory_nodes_parsed)) {
-		nd->start = start;
-		nd->end = end;
-	} else {
-		if (start < nd->start)
+	if (!(ma->flags & ACPI_SRAT_MEM_HOT_PLUGGABLE)) {
+		struct node *nd = &nodes[node];
+
+		if (!node_test_and_set(node, memory_nodes_parsed)) {
 			nd->start = start;
-		if (nd->end < end)
 			nd->end = end;
+		} else {
+			if (start < nd->start)
+				nd->start = start;
+			if (nd->end < end)
+				nd->end = end;
+		}
 	}
-	if ((ma->flags & ACPI_SRAT_MEM_HOT_PLUGGABLE) && end > mem_hotplug)
-		mem_hotplug = end;
 	printk(KERN_INFO "SRAT: Node %u PXM %u %"PRIx64"-%"PRIx64"%s\n",
 	       node, pxm, start, end,
 	       ma->flags & ACPI_SRAT_MEM_HOT_PLUGGABLE ? " (hotplug)" : "");
@@ -294,6 +303,11 @@ acpi_numa_memory_affinity_init(struct ac
 	node_memblk_range[num_node_memblks].start = start;
 	node_memblk_range[num_node_memblks].end = end;
 	memblk_nodeid[num_node_memblks] = node;
+	if (ma->flags & ACPI_SRAT_MEM_HOT_PLUGGABLE) {
+		__set_bit(num_node_memblks, memblk_hotplug);
+		if (end > mem_hotplug)
+			mem_hotplug = end;
+	}
 	num_node_memblks++;
 }
 
++++++ 55e593f1-x86-NUMA-make-init_node_heap-respect-Xen-heap-limit.patch ++++++
# Commit 88e3ed61642bb393458acc7a9bd2f96edc337190
# Date 2015-09-01 14:02:57 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/NUMA: make init_node_heap() respect Xen heap limit

On NUMA systems, where we try to use node local memory for the basic
control structures of the buddy allocator, this special case needs to
take into consideration a possible address width limit placed on the
Xen heap. In turn this (but also other, more abstract considerations)
requires that xenheap_max_mfn() not be called more than once (at most
we might permit it to be called a second time with a larger value than
was passed the first time), and be called only before calling
end_boot_allocator().

While inspecting all the involved code, a couple of off-by-one issues
were found (and are being corrected here at once):
- arch_init_memory() cleared one too many page table slots
- the highmem_start based invocation of xenheap_max_mfn() passed too
  big a value
- xenheap_max_mfn() calculated the wrong bit count in edge cases

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 
Acked-by: Ian Campbell 

# Commit 0a7167d9b20cdc48e6ea320fbbb920b3267c9757
# Date 2015-09-04 14:58:07 +0100
# Author Julien Grall 
# Committer Ian Campbell 
xen/arm64: do not (incorrectly) limit size of xenheap

The commit 88e3ed61642bb393458acc7a9bd2f96edc337190 "x86/NUMA: make
init_node_heap() respect Xen heap limit" breaks boot on the arm64 board
X-Gene.

The xenheap bits variable is used to know the last RAM MFN always mapped
in Xen virtual memory. If the value is 0, it means that all the memory is
always mapped in Xen virtual memory.

On X-gene the RAM bank resides above 128GB and last xenheap MFN is
0x4400000. With the new way to calculate the number of bits, xenheap_bits
will be equal to 38 bits. This will result to hide all the RAM and the
impossibility to allocate xenheap memory.

Given that aarch64 have always all the memory mapped in Xen virtual
memory, it's not necessary to call xenheap_max_mfn which set the number
of bits.

Suggested-by: Jan Beulich 
Signed-off-by: Julien Grall 
Acked-by: Ian Campbell 

--- a/xen/arch/arm/setup.c
+++ b/xen/arch/arm/setup.c
@@ -616,7 +616,6 @@ static void __init setup_mm(unsigned lon
     xenheap_virt_end = XENHEAP_VIRT_START + ram_end - ram_start;
     xenheap_mfn_start = ram_start >> PAGE_SHIFT;
     xenheap_mfn_end = ram_end >> PAGE_SHIFT;
-    xenheap_max_mfn(xenheap_mfn_end);
 
     /*
      * Need enough mapped pages for copying the DTB.
--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -379,7 +379,7 @@ void __init arch_init_memory(void)
 
                     for ( i = 0; i < l3_table_offset(split_va); ++i )
                         l3tab[i] = l3idle[i];
-                    for ( ; i <= L3_PAGETABLE_ENTRIES; ++i )
+                    for ( ; i < L3_PAGETABLE_ENTRIES; ++i )
                         l3tab[i] = l3e_empty();
                     split_l4e = l4e_from_pfn(virt_to_mfn(l3tab),
                                              __PAGE_HYPERVISOR);
--- a/xen/arch/x86/setup.c
+++ b/xen/arch/x86/setup.c
@@ -971,7 +971,7 @@ void __init __start_xen(unsigned long mb
 
     setup_max_pdx(raw_max_page);
     if ( highmem_start )
-        xenheap_max_mfn(PFN_DOWN(highmem_start));
+        xenheap_max_mfn(PFN_DOWN(highmem_start - 1));
 
     /*
      * Walk every RAM region and map it in its entirety (on x86/64, at least)
@@ -1152,9 +1152,6 @@ void __init __start_xen(unsigned long mb
 
     numa_initmem_init(0, raw_max_page);
 
-    end_boot_allocator();
-    system_state = SYS_STATE_boot;
-
     if ( max_page - 1 > virt_to_mfn(HYPERVISOR_VIRT_END - 1) )
     {
         unsigned long limit = virt_to_mfn(HYPERVISOR_VIRT_END - 1);
@@ -1163,6 +1160,8 @@ void __init __start_xen(unsigned long mb
         if ( !highmem_start )
             xenheap_max_mfn(limit);
 
+        end_boot_allocator();
+
         /* Pass the remaining memory to the allocator. */
         for ( i = 0; i < boot_e820.nr_map; i++ )
         {
@@ -1186,6 +1185,10 @@ void __init __start_xen(unsigned long mb
            opt_tmem = 0;
         }
     }
+    else
+        end_boot_allocator();
+
+    system_state = SYS_STATE_boot;
 
     vm_init();
     console_init_ring();
--- a/xen/common/page_alloc.c
+++ b/xen/common/page_alloc.c
@@ -388,13 +388,19 @@ void get_outstanding_claims(uint64_t *fr
     spin_unlock(&heap_lock);
 }
 
+static bool_t __read_mostly first_node_initialised;
+#ifndef CONFIG_SEPARATE_XENHEAP
+static unsigned int __read_mostly xenheap_bits;
+#else
+#define xenheap_bits 0
+#endif
+
 static unsigned long init_node_heap(int node, unsigned long mfn,
                                     unsigned long nr, bool_t *use_tail)
 {
     /* First node to be discovered has its heap metadata statically alloced. */
     static heap_by_zone_and_order_t _heap_static;
     static unsigned long avail_static[NR_ZONES];
-    static int first_node_initialised;
     unsigned long needed = (sizeof(**_heap) +
                             sizeof(**avail) * NR_ZONES +
                             PAGE_SIZE - 1) >> PAGE_SHIFT;
@@ -412,14 +418,18 @@ static unsigned long init_node_heap(int 
     }
 #ifdef DIRECTMAP_VIRT_END
     else if ( *use_tail && nr >= needed &&
-              (mfn + nr) <= (virt_to_mfn(eva - 1) + 1) )
+              (mfn + nr) <= (virt_to_mfn(eva - 1) + 1) &&
+              (!xenheap_bits ||
+               !((mfn + nr - 1) >> (xenheap_bits - PAGE_SHIFT))) )
     {
         _heap[node] = mfn_to_virt(mfn + nr - needed);
         avail[node] = mfn_to_virt(mfn + nr - 1) +
                       PAGE_SIZE - sizeof(**avail) * NR_ZONES;
     }
     else if ( nr >= needed &&
-              (mfn + needed) <= (virt_to_mfn(eva - 1) + 1) )
+              (mfn + needed) <= (virt_to_mfn(eva - 1) + 1) &&
+              (!xenheap_bits ||
+               !((mfn + needed - 1) >> (xenheap_bits - PAGE_SHIFT))) )
     {
         _heap[node] = mfn_to_virt(mfn);
         avail[node] = mfn_to_virt(mfn + needed - 1) +
@@ -1363,11 +1373,13 @@ void free_xenheap_pages(void *v, unsigne
 
 #else
 
-static unsigned int __read_mostly xenheap_bits;
-
 void __init xenheap_max_mfn(unsigned long mfn)
 {
-    xenheap_bits = fls(mfn) + PAGE_SHIFT;
+    ASSERT(!first_node_initialised);
+    ASSERT(!xenheap_bits);
+    BUILD_BUG_ON(PADDR_BITS >= BITS_PER_LONG);
+    xenheap_bits = min(fls(mfn + 1) - 1 + PAGE_SHIFT, PADDR_BITS);
+    printk(XENLOG_INFO "Xen heap: %u bits\n", xenheap_bits);
 }
 
 void init_xenheap_pages(paddr_t ps, paddr_t pe)
++++++ 55f2e438-x86-hvm-fix-saved-pmtimer-and-hpet-values.patch ++++++
# Commit 244582a01dcb49fa30083725964a066937cc94f2
# Date 2015-09-11 16:24:56 +0200
# Author Kouya Shimura 
# Committer Jan Beulich 
x86/hvm: fix saved pmtimer and hpet values

The ACPI PM timer is sometimes broken on live migration.
Since vcpu->arch.hvm_vcpu.guest_time is always zero in other than
"delay for missed ticks mode". Even in "delay for missed ticks mode",
vcpu's guest_time field is not valid (i.e. zero) when
the state of vcpu is "blocked". (see pt_save_timer function)

The original author (Tim Deegan) of pmtimer_save() must have intended
that it saves the last scheduled time of the vcpu. Unfortunately it was
already implied this bug. FYI, there is no other timer mode than
"delay for missed ticks mode" then.

For consistency with HPET, pmtimer_save() should refer hvm_get_guest_time()
to update the counter as well as hpet_save() does.

Without this patch, the clock of windows server 2012R2 without HPET
might leap forward several minutes on live migration.

Signed-off-by: Kouya Shimura 

Retain use of ->arch.hvm_vcpu.guest_time when non-zero. Do the inverse
adjustment for vHPET.

Signed-off-by: Jan Beulich 
Reviewed-by: Tim Deegan 
Reviewed-by: Kouya Shimura 

--- a/xen/arch/x86/hvm/hpet.c
+++ b/xen/arch/x86/hvm/hpet.c
@@ -481,12 +481,15 @@ const struct hvm_mmio_handler hpet_mmio_
 static int hpet_save(struct domain *d, hvm_domain_context_t *h)
 {
     HPETState *hp = domain_vhpet(d);
+    struct vcpu *v = pt_global_vcpu_target(d);
     int rc;
 
     write_lock(&hp->lock);
 
     /* Write the proper value into the main counter */
-    hp->hpet.mc64 = hp->mc_offset + guest_time_hpet(hp);
+    hp->hpet.mc64 = hp->mc_offset +
+                    (v->arch.hvm_vcpu.guest_time ?: hvm_get_guest_time(v)) /
+                    STIME_PER_HPET_TICK;
 
     /* Save the HPET registers */
     rc = _hvm_init_entry(h, HVM_SAVE_CODE(HPET), 0, HVM_SAVE_LENGTH(HPET));
--- a/xen/arch/x86/hvm/pmtimer.c
+++ b/xen/arch/x86/hvm/pmtimer.c
@@ -250,10 +250,12 @@ static int pmtimer_save(struct domain *d
 
     spin_lock(&s->lock);
 
-    /* Update the counter to the guest's current time.  We always save
-     * with the domain paused, so the saved time should be after the
-     * last_gtime, but just in case, make sure we only go forwards */
-    x = ((s->vcpu->arch.hvm_vcpu.guest_time - s->last_gtime) * s->scale) >> 32;
+    /*
+     * Update the counter to the guest's current time.  Make sure it only
+     * goes forwards.
+     */
+    x = (((s->vcpu->arch.hvm_vcpu.guest_time ?: hvm_get_guest_time(s->vcpu)) -
+          s->last_gtime) * s->scale) >> 32;
     if ( x < 1UL<<31 )
         s->pm.tmr_val += x;
     if ( (s->pm.tmr_val & TMR_VAL_MSB) != msb )
++++++ 55f7f9d2-libxl-slightly-refine-pci-assignable-add-remove-handling.patch ++++++
References: bsc#945167

# Commit 6e1e3480c3878bac5d244925974a6852c47c809b
# Date 2015-09-15 11:58:26 +0100
# Author Jan Beulich 
# Committer Ian Campbell 
libxl: slightly refine pci-assignable-{add, remove} handling

While it appears to be intentional for "xl pci-assignable-remove" to
not re-bind the original driver by default (requires the -r option),
permanently losing the information which driver was originally used
seems bad. Make "add; remove; add; remove -r" re-bind the original
driver by allowing "remove" to delete the information only upon
successful re-bind.

In the course of this I also noticed that binding information is lost
when upon first "add" pciback isn't loaded yet, due to its presence not
being checked for early enough. Adjust pciback_dev_is_assigned()
accordingly, and properly distinguish "yes" and "error" returns in the
"add" case (removing a redundant error message from the "remove" path
for consistency).

Signed-off-by: Jan Beulich 
Reviewed-by: George Dunlap 
Acked-by: Ian Campbell 

--- a/tools/libxl/libxl_pci.c
+++ b/tools/libxl/libxl_pci.c
@@ -499,6 +499,17 @@ static int pciback_dev_is_assigned(libxl
     int rc;
     struct stat st;
 
+    if ( access(SYSFS_PCIBACK_DRIVER, F_OK) < 0 ) {
+        if ( errno == ENOENT ) {
+            LIBXL__LOG(ctx, LIBXL__LOG_ERROR,
+                       "Looks like pciback driver is not loaded");
+        } else {
+            LIBXL__LOG_ERRNO(ctx, LIBXL__LOG_ERROR,
+                             "Can't access "SYSFS_PCIBACK_DRIVER);
+        }
+        return -1;
+    }
+
     spath = libxl__sprintf(gc, SYSFS_PCIBACK_DRIVER"/"PCI_BDF,
                            pcidev->domain, pcidev->bus,
                            pcidev->dev, pcidev->func);
@@ -614,6 +625,7 @@ static int libxl__device_pci_assignable_
     libxl_ctx *ctx = libxl__gc_owner(gc);
     unsigned dom, bus, dev, func;
     char *spath, *driver_path = NULL;
+    int rc;
     struct stat st;
 
     /* Local copy for convenience */
@@ -630,7 +642,11 @@ static int libxl__device_pci_assignable_
     }
 
     /* Check to see if it's already assigned to pciback */
-    if ( pciback_dev_is_assigned(gc, pcidev) ) {
+    rc = pciback_dev_is_assigned(gc, pcidev);
+    if ( rc < 0 ) {
+        return ERROR_FAIL;
+    }
+    if ( rc ) {
         LIBXL__LOG(ctx, LIBXL__LOG_WARNING, PCI_BDF" already assigned to pciback",
                    dom, bus, dev, func);
         return 0;
@@ -648,11 +664,18 @@ static int libxl__device_pci_assignable_
     if ( rebind ) {
         if ( driver_path ) {
             pci_assignable_driver_path_write(gc, pcidev, driver_path);
+        } else if ( (driver_path =
+                     pci_assignable_driver_path_read(gc, pcidev)) != NULL ) {
+            LIBXL__LOG(ctx, LIBXL__LOG_INFO,
+                       PCI_BDF" not bound to a driver, will be rebound to %s",
+                       dom, bus, dev, func, driver_path);
         } else {
             LIBXL__LOG(ctx, LIBXL__LOG_WARNING,
                        PCI_BDF" not bound to a driver, will not be rebound.",
                        dom, bus, dev, func);
         }
+    } else {
+        pci_assignable_driver_path_remove(gc, pcidev);
     }
 
     if ( pciback_dev_assign(gc, pcidev) ) {
@@ -673,7 +696,6 @@ static int libxl__device_pci_assignable_
 
     /* Unbind from pciback */
     if ( (rc=pciback_dev_is_assigned(gc, pcidev)) < 0 ) {
-        LIBXL__LOG(ctx, LIBXL__LOG_ERROR, "Checking if pciback was assigned");
         return ERROR_FAIL;
     } else if ( rc ) {
         pciback_dev_unassign(gc, pcidev);
@@ -697,9 +719,9 @@ static int libxl__device_pci_assignable_
                                  "Couldn't bind device to %s", driver_path);
                 return -1;
             }
-        }
 
-        pci_assignable_driver_path_remove(gc, pcidev);
+            pci_assignable_driver_path_remove(gc, pcidev);
+        }
     } else {
         if ( rebind ) {
             LIBXL__LOG(ctx, LIBXL__LOG_WARNING,
++++++ 55f9345b-x86-MSI-fail-if-no-hardware-support.patch ++++++
# Commit c7d5d5d8ea1ecbd6ef8b47dace4dec825f0f6e48
# Date 2015-09-16 11:20:27 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/MSI: fail if no hardware support

This is to guard against buggy callers (luckily Dom0 only) invoking
the respective hypercall for a device not being MSI-capable.

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 

--- a/xen/arch/x86/msi.c
+++ b/xen/arch/x86/msi.c
@@ -696,6 +696,8 @@ static int msi_capability_init(struct pc
 
     ASSERT(spin_is_locked(&pcidevs_lock));
     pos = pci_find_cap_offset(seg, bus, slot, func, PCI_CAP_ID_MSI);
+    if ( !pos )
+        return -ENODEV;
     control = pci_conf_read16(seg, bus, slot, func, msi_control_reg(pos));
     maxvec = multi_msi_capable(control);
     if ( nvec > maxvec )
++++++ 55ffea69-libxl-handle-read-only-drives-with-qemu-xen.patch ++++++
References: bsc#947165 CVE-2015-7311 XSA-142

Subject: libxl: handle read-only drives with qemu-xen
From: Stefano Stabellini stefano.stabellini@eu.citrix.com Tue Sep 22 16:56:29 2015 +0100
Date: Tue Sep 22 16:56:29 2015 +0100:
Git: 4d99a76cfeba6d23504121a51e7750f230128d85

The current libxl code doesn't deal with read-only drives at all.

Upstream QEMU and qemu-xen only support read-only cdrom drives: make
sure to specify "readonly=on" for cdrom drives and return error in case
the user requested a non-cdrom read-only drive.

This is XSA-142, discovered by Lin Liu
(https://bugzilla.redhat.com/show_bug.cgi?id=1257893).

Signed-off-by: Stefano Stabellini 

Backport to Xen 4.5 and earlier, apropos of report and review from
Michael Young.

Signed-off-by: Ian Jackson 

Index: xen-4.4.3-testing/tools/libxl/libxl_dm.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl_dm.c
+++ xen-4.4.3-testing/tools/libxl/libxl_dm.c
@@ -737,13 +737,18 @@ static char ** libxl__build_device_model
             if (disks[i].is_cdrom) {
                 if (disks[i].format == LIBXL_DISK_FORMAT_EMPTY)
                     drive = libxl__sprintf
-                        (gc, "if=ide,index=%d,media=cdrom,cache=writeback,id=ide-%i",
-                         disk, dev_number);
+                        (gc, "if=ide,index=%d,readonly=%s,media=cdrom,cache=writeback,id=ide-%i",
+                         disk, disks[i].readwrite ? "off" : "on", dev_number);
                 else
                     drive = libxl__sprintf
-                        (gc, "file=%s,if=ide,index=%d,media=cdrom,format=%s,cache=writeback,id=ide-%i",
-                         disks[i].pdev_path, disk, format, dev_number);
+                        (gc, "file=%s,if=ide,index=%d,readonly=%s,media=cdrom,format=%s,cache=writeback,id=ide-%i",
+                         disks[i].pdev_path, disk, disks[i].readwrite ? "off" : "on", format, dev_number);
             } else {
+                if (!disks[i].readwrite) {
+                    LIBXL__LOG(ctx, LIBXL__LOG_ERROR, "qemu-xen doesn't support read-only disk drivers");
+                    return NULL;
+                }
+
                 if (disks[i].format == LIBXL_DISK_FORMAT_EMPTY) {
                     LIBXL__LOG(ctx, LIBXL__LOG_WARNING, "cannot support"
                                " empty disk format for %s", disks[i].vdev);
++++++ 5604f239-x86-PV-properly-populate-descriptor-tables.patch ++++++
# Commit cf6d39f81992c29a637c603dbabf1e21a0ea563f
# Date 2015-09-25 09:05:29 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/PV: properly populate descriptor tables

Us extending the GDT limit past the Xen descriptors so far meant that
guests (including user mode programs) accessing any descriptor table
slot above the original OS'es limit but below the first Xen descriptor
caused a #PF, converted to a #GP in our #PF handler. Which is quite
different from the native behavior, where some of such accesses (LAR
and LSL) don't fault. Mimic that behavior by mapping a blank page into
unused slots.

While not strictly required, treat the LDT the same for consistency.

Reported-by: Andrew Cooper 
Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 

# Commit 61031e64d3dafd2fb1953436444bf02eccb9b146
# Date 2015-10-27 14:46:12 +0100
# Author Jan Beulich 
# Committer Jan Beulich 
x86/PV: don't zero-map LDT

This effectvely reverts the LDT related part of commit cf6d39f819
("x86/PV: properly populate descriptor tables"), which broke demand
paged LDT handling in guests.

Reported-by: David Vrabel 
Diagnosed-by: Andrew Cooper 
Signed-off-by: Jan Beulich 
Tested-by: David Vrabel 
Reviewed-by: Andrew Cooper 

--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -512,12 +512,12 @@ void update_cr3(struct vcpu *v)
     make_cr3(v, cr3_mfn);
 }
 
+static const char __section(".bss.page_aligned") zero_page[PAGE_SIZE];
 
 static void invalidate_shadow_ldt(struct vcpu *v, int flush)
 {
     l1_pgentry_t *pl1e;
-    int i;
-    unsigned long pfn;
+    unsigned int i;
     struct page_info *page;
 
     BUG_ON(unlikely(in_irq()));
@@ -532,10 +532,10 @@ static void invalidate_shadow_ldt(struct
 
     for ( i = 16; i < 32; i++ )
     {
-        pfn = l1e_get_pfn(pl1e[i]);
-        if ( pfn == 0 ) continue;
+        if ( !(l1e_get_flags(pl1e[i]) & _PAGE_PRESENT) )
+            continue;
+        page = l1e_get_page(pl1e[i]);
         l1e_write(&pl1e[i], l1e_empty());
-        page = mfn_to_page(pfn);
         ASSERT_PAGE_IS_TYPE(page, PGT_seg_desc_page);
         ASSERT_PAGE_IS_DOMAIN(page, v->domain);
         put_page_and_type(page);
@@ -4338,16 +4338,18 @@ long do_update_va_mapping_otherdomain(un
 void destroy_gdt(struct vcpu *v)
 {
     l1_pgentry_t *pl1e;
-    int i;
-    unsigned long pfn;
+    unsigned int i;
+    unsigned long pfn, zero_pfn = PFN_DOWN(__pa(zero_page));
 
     v->arch.pv_vcpu.gdt_ents = 0;
     pl1e = gdt_ldt_ptes(v->domain, v);
     for ( i = 0; i < FIRST_RESERVED_GDT_PAGE; i++ )
     {
-        if ( (pfn = l1e_get_pfn(pl1e[i])) != 0 )
+        pfn = l1e_get_pfn(pl1e[i]);
+        if ( (l1e_get_flags(pl1e[i]) & _PAGE_PRESENT) && pfn != zero_pfn )
             put_page_and_type(mfn_to_page(pfn));
-        l1e_write(&pl1e[i], l1e_empty());
+        l1e_write(&pl1e[i],
+                  l1e_from_pfn(zero_pfn, __PAGE_HYPERVISOR & ~_PAGE_RW));
         v->arch.pv_vcpu.gdt_frames[i] = 0;
     }
 }
@@ -4360,7 +4362,7 @@ long set_gdt(struct vcpu *v,
     struct domain *d = v->domain;
     l1_pgentry_t *pl1e;
     /* NB. There are 512 8-byte entries per GDT page. */
-    int i, nr_pages = (entries + 511) / 512;
+    unsigned int i, nr_pages = (entries + 511) / 512;
 
     if ( entries > FIRST_RESERVED_GDT_ENTRY )
         return -EINVAL;
++++++ 5604f2e6-vt-d-fix-IM-bit-mask-and-unmask-of-FECTL_REG.patch ++++++
# Commit 86f3ff9fc4cc3cb69b96c1de74bcc51f738fe2b9
# Date 2015-09-25 09:08:22 +0200
# Author Quan Xu 
# Committer Jan Beulich 
vt-d: fix IM bit mask and unmask of Fault Event Control Register

Bit 0:29 in Fault Event Control Register are 'Reserved and Preserved',
software cannot write 0 to it unconditionally. Software must preserve
the value read for writes.

Signed-off-by: Quan Xu 
Acked-by: Yang Zhang 

# Commit 26b300bd727ef00a8f60329212a83c3b027a48f7
# Date 2015-09-25 18:03:04 +0200
# Author Quan Xu 
# Committer Jan Beulich 
vt-d: fix IM bit unmask of Fault Event Control Register in init_vtd_hw()

Bit 0:29 in Fault Event Control Register are 'Reserved and Preserved',
software cannot write 0 to it unconditionally. Software must preserve
the value read for writes.

Suggested-by: Jan Beulich 
Signed-off-by: Quan Xu 

--- a/xen/drivers/passthrough/vtd/iommu.c
+++ b/xen/drivers/passthrough/vtd/iommu.c
@@ -992,10 +992,13 @@ static void dma_msi_unmask(struct irq_de
 {
     struct iommu *iommu = desc->action->dev_id;
     unsigned long flags;
+    u32 sts;
 
     /* unmask it */
     spin_lock_irqsave(&iommu->register_lock, flags);
-    dmar_writel(iommu->reg, DMAR_FECTL_REG, 0);
+    sts = dmar_readl(iommu->reg, DMAR_FECTL_REG);
+    sts &= ~DMA_FECTL_IM;
+    dmar_writel(iommu->reg, DMAR_FECTL_REG, sts);
     spin_unlock_irqrestore(&iommu->register_lock, flags);
     iommu->msi.msi_attrib.host_masked = 0;
 }
@@ -1004,10 +1007,13 @@ static void dma_msi_mask(struct irq_desc
 {
     unsigned long flags;
     struct iommu *iommu = desc->action->dev_id;
+    u32 sts;
 
     /* mask it */
     spin_lock_irqsave(&iommu->register_lock, flags);
-    dmar_writel(iommu->reg, DMAR_FECTL_REG, DMA_FECTL_IM);
+    sts = dmar_readl(iommu->reg, DMAR_FECTL_REG);
+    sts |= DMA_FECTL_IM;
+    dmar_writel(iommu->reg, DMAR_FECTL_REG, sts);
     spin_unlock_irqrestore(&iommu->register_lock, flags);
     iommu->msi.msi_attrib.host_masked = 1;
 }
@@ -2055,6 +2061,7 @@ static int init_vtd_hw(void)
     struct iommu_flush *flush = NULL;
     int ret;
     unsigned long flags;
+    u32 sts;
 
     /*
      * Basic VT-d HW init: set VT-d interrupt, clear VT-d faults.  
@@ -2068,7 +2075,9 @@ static int init_vtd_hw(void)
         clear_fault_bits(iommu);
 
         spin_lock_irqsave(&iommu->register_lock, flags);
-        dmar_writel(iommu->reg, DMAR_FECTL_REG, 0);
+        sts = dmar_readl(iommu->reg, DMAR_FECTL_REG);
+        sts &= ~DMA_FECTL_IM;
+        dmar_writel(iommu->reg, DMAR_FECTL_REG, sts);
         spin_unlock_irqrestore(&iommu->register_lock, flags);
     }
 
++++++ 560a7c36-x86-p2m-pt-delay-freeing-of-intermediate-page-tables.patch ++++++
# Commit 960265fbd878cdc9841473b755e4ccc9eb1942d2
# Date 2015-09-29 13:55:34 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/p2m-pt: delay freeing of intermediate page tables

Old intermediate page tables must be freed only after IOMMU side
updates/flushes have got carried out.

Signed-off-by: Jan Beulich 
Reviewed-by: George Dunlap 

--- a/xen/arch/x86/mm/p2m-pt.c
+++ b/xen/arch/x86/mm/p2m-pt.c
@@ -284,8 +284,9 @@ p2m_set_entry(struct p2m_domain *p2m, un
     mfn_t table_mfn = pagetable_get_mfn(p2m_get_pagetable(p2m));
     void *table =map_domain_page(mfn_x(table_mfn));
     unsigned long i, gfn_remainder = gfn;
-    l1_pgentry_t *p2m_entry;
-    l1_pgentry_t entry_content;
+    l1_pgentry_t *p2m_entry, entry_content;
+    /* Intermediate table to free if we're replacing it with a superpage. */
+    l1_pgentry_t intermediate_entry = l1e_empty();
     l2_pgentry_t l2e_content;
     l3_pgentry_t l3e_content;
     int rv=0;
@@ -321,7 +322,6 @@ p2m_set_entry(struct p2m_domain *p2m, un
      */
     if ( page_order == PAGE_ORDER_1G )
     {
-        l1_pgentry_t old_entry = l1e_empty();
         p2m_entry = p2m_find_entry(table, &gfn_remainder, gfn,
                                    L3_PAGETABLE_SHIFT - PAGE_SHIFT,
                                    L3_PAGETABLE_ENTRIES);
@@ -331,7 +331,7 @@ p2m_set_entry(struct p2m_domain *p2m, un
         {
             /* We're replacing a non-SP page with a superpage.  Make sure to
              * handle freeing the table properly. */
-            old_entry = *p2m_entry;
+            intermediate_entry = *p2m_entry;
         }
 
         ASSERT(!mfn_valid(mfn) || p2mt != p2m_mmio_direct);
@@ -349,10 +349,6 @@ p2m_set_entry(struct p2m_domain *p2m, un
 
         p2m->write_p2m_entry(p2m, gfn, p2m_entry, table_mfn, entry_content, 3);
         /* NB: paging_write_p2m_entry() handles tlb flushes properly */
-
-        /* Free old intermediate tables if necessary */
-        if ( l1e_get_flags(old_entry) & _PAGE_PRESENT )
-            p2m_free_entry(p2m, &old_entry, page_order);
     }
     else if ( !p2m_next_level(p2m, &table_mfn, &table, &gfn_remainder, gfn,
                               L3_PAGETABLE_SHIFT - PAGE_SHIFT,
@@ -389,7 +385,6 @@ p2m_set_entry(struct p2m_domain *p2m, un
     }
     else if ( page_order == PAGE_ORDER_2M )
     {
-        l1_pgentry_t old_entry = l1e_empty();
         p2m_entry = p2m_find_entry(table, &gfn_remainder, gfn,
                                    L2_PAGETABLE_SHIFT - PAGE_SHIFT,
                                    L2_PAGETABLE_ENTRIES);
@@ -401,7 +396,7 @@ p2m_set_entry(struct p2m_domain *p2m, un
         {
             /* We're replacing a non-SP page with a superpage.  Make sure to
              * handle freeing the table properly. */
-            old_entry = *p2m_entry;
+            intermediate_entry = *p2m_entry;
         }
         
         ASSERT(!mfn_valid(mfn) || p2mt != p2m_mmio_direct);
@@ -422,10 +417,6 @@ p2m_set_entry(struct p2m_domain *p2m, un
 
         p2m->write_p2m_entry(p2m, gfn, p2m_entry, table_mfn, entry_content, 2);
         /* NB: paging_write_p2m_entry() handles tlb flushes properly */
-
-        /* Free old intermediate tables if necessary */
-        if ( l1e_get_flags(old_entry) & _PAGE_PRESENT )
-            p2m_free_entry(p2m, &old_entry, page_order);
     }
 
     /* Track the highest gfn for which we have ever had a valid mapping */
@@ -452,6 +443,14 @@ p2m_set_entry(struct p2m_domain *p2m, un
         }
     }
 
+    /*
+     * Free old intermediate tables if necessary.  This has to be the
+     * last thing we do, after removal from the IOMMU tables, so as to
+     * avoid a potential use-after-free.
+     */
+    if ( l1e_get_flags(intermediate_entry) & _PAGE_PRESENT )
+        p2m_free_entry(p2m, &intermediate_entry, page_order);
+
     /* Success */
     rv = 1;
 
++++++ 560a7c53-x86-p2m-pt-ignore-pt-share-flag-for-shadow-mode-guests.patch ++++++
# Commit c0a85795d864dd64c116af661bf676d66ddfd5fc
# Date 2015-09-29 13:56:03 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/p2m-pt: ignore pt-share flag for shadow mode guests

There is no page table sharing in shadow mode.

Signed-off-by: Jan Beulich 
Reviewed-by: George Dunlap 

--- a/xen/arch/x86/mm/p2m-pt.c
+++ b/xen/arch/x86/mm/p2m-pt.c
@@ -426,7 +426,7 @@ p2m_set_entry(struct p2m_domain *p2m, un
 
     if ( iommu_enabled && need_iommu(p2m->domain) )
     {
-        if ( iommu_hap_pt_share )
+        if ( iommu_use_hap_pt(p2m->domain) )
         {
             if ( old_mfn && (old_mfn != mfn_x(mfn)) )
                 amd_iommu_flush_pages(p2m->domain, gfn, page_order);
++++++ 560bd926-credit1-fix-tickling-when-it-happens-from-a-remote-pCPU.patch ++++++
# Commit ea5637968a09a81a64fa5fd73ce49b4ea9789e12
# Date 2015-09-30 14:44:22 +0200
# Author Dario Faggioli 
# Committer Jan Beulich 
credit1: fix tickling when it happens from a remote pCPU

especially if that is also from a different cpupool than the
processor of the vCPU that triggered the tickling.

In fact, it is possible that we get as far as calling vcpu_unblock()-->
vcpu_wake()-->csched_vcpu_wake()-->__runq_tickle() for the vCPU 'vc',
but all while running on a pCPU that is different from 'vc->processor'.

For instance, this can happen when an HVM domain runs in a cpupool,
with a different scheduler than the default one, and issues IOREQs
to Dom0, running in Pool-0 with the default scheduler.
In fact, right in this case, the following crash can be observed:

(XEN) ----[ Xen-4.7-unstable  x86_64  debug=y  Tainted:    C ]----
(XEN) CPU:    7
(XEN) RIP:    e008:[<ffff82d0801230de>] __runq_tickle+0x18f/0x430
(XEN) RFLAGS: 0000000000010086   CONTEXT: hypervisor (d1v0)
(XEN) rax: 0000000000000001   rbx: ffff8303184fee00   rcx: 0000000000000000
(XEN) ... ... ...
(XEN) Xen stack trace from rsp=ffff83031fa57a08:
(XEN)    ffff82d0801fe664 ffff82d08033c820 0000000100000002 0000000a00000001
(XEN)    0000000000006831 0000000000000000 0000000000000000 0000000000000000
(XEN) ... ... ...
(XEN) Xen call trace:
(XEN)    [<ffff82d0801230de>] __runq_tickle+0x18f/0x430
(XEN)    [<ffff82d08012348a>] csched_vcpu_wake+0x10b/0x110
(XEN)    [<ffff82d08012b421>] vcpu_wake+0x20a/0x3ce
(XEN)    [<ffff82d08012b91c>] vcpu_unblock+0x4b/0x4e
(XEN)    [<ffff82d080167bd0>] vcpu_kick+0x17/0x61
(XEN)    [<ffff82d080167c46>] vcpu_mark_events_pending+0x2c/0x2f
(XEN)    [<ffff82d08010ac35>] evtchn_fifo_set_pending+0x381/0x3f6
(XEN)    [<ffff82d08010a0f6>] notify_via_xen_event_channel+0xc9/0xd6
(XEN)    [<ffff82d0801c29ed>] hvm_send_ioreq+0x3e9/0x441
(XEN)    [<ffff82d0801bba7d>] hvmemul_do_io+0x23f/0x2d2
(XEN)    [<ffff82d0801bbb43>] hvmemul_do_io_buffer+0x33/0x64
(XEN)    [<ffff82d0801bc92b>] hvmemul_do_pio_buffer+0x35/0x37
(XEN)    [<ffff82d0801cc49f>] handle_pio+0x58/0x14c
(XEN)    [<ffff82d0801eabcb>] vmx_vmexit_handler+0x16b3/0x1bea
(XEN)    [<ffff82d0801efd21>] vmx_asm_vmexit_handler+0x41/0xc0

In this case, pCPU 7 is not in Pool-0, while the (Dom0's) vCPU being
woken is. pCPU's 7 pool has a different scheduler than credit, but it
is, however, right from pCPU 7 that we are waking the Dom0's vCPUs.
Therefore, the current code tries to access csched_balance_mask for
pCPU 7, but that is not defined, and hence the Oops.

(Note that, in case the two pools run the same scheduler we see no
Oops, but things are still conceptually wrong.)

Cure things by making the csched_balance_mask macro accept a
parameter for fetching a specific pCPU's mask (instead than always
using smp_processor_id()).

Signed-off-by: Dario Faggioli 
Reviewed-by: Juergen Gross 
Reviewed-by: George Dunlap 

--- a/xen/common/sched_credit.c
+++ b/xen/common/sched_credit.c
@@ -140,10 +140,10 @@ struct csched_pcpu {
  * Convenience macro for accessing the per-PCPU cpumask we need for
  * implementing the two steps (vcpu and node affinity) balancing logic.
  * It is stored in csched_pcpu so that serialization is not an issue,
- * as there is a csched_pcpu for each PCPU and we always hold the
- * runqueue spin-lock when using this.
+ * as there is a csched_pcpu for each PCPU, and we always hold the
+ * runqueue lock for the proper PCPU when using this.
  */
-#define csched_balance_mask (CSCHED_PCPU(smp_processor_id())->balance_mask)
+#define csched_balance_mask(c) (CSCHED_PCPU(c)->balance_mask)
 
 /*
  * Virtual CPU
@@ -417,9 +417,10 @@ __runq_tickle(unsigned int cpu, struct c
 
             /* Are there idlers suitable for new (for this balance step)? */
             csched_balance_cpumask(new->vcpu, balance_step,
-                                   csched_balance_mask);
-            cpumask_and(csched_balance_mask, csched_balance_mask, &idle_mask);
-            new_idlers_empty = cpumask_empty(csched_balance_mask);
+                                   csched_balance_mask(cpu));
+            cpumask_and(csched_balance_mask(cpu),
+                        csched_balance_mask(cpu), &idle_mask);
+            new_idlers_empty = cpumask_empty(csched_balance_mask(cpu));
 
             /*
              * Let's not be too harsh! If there aren't idlers suitable
@@ -1506,8 +1507,9 @@ csched_runq_steal(int peer_cpu, int cpu,
                  && !__vcpu_has_node_affinity(vc, vc->cpu_affinity) )
                 continue;
 
-            csched_balance_cpumask(vc, balance_step, csched_balance_mask);
-            if ( __csched_vcpu_is_migrateable(vc, cpu, csched_balance_mask) )
+            csched_balance_cpumask(vc, balance_step, csched_balance_mask(cpu));
+            if ( __csched_vcpu_is_migrateable(vc, cpu,
+                                              csched_balance_mask(cpu)) )
             {
                 /* We got a candidate. Grab it! */
                 TRACE_3D(TRC_CSCHED_STOLEN_VCPU, peer_cpu,
++++++ 560e6d34-x86-p2m-pt-tighten-conditions-of-IOMMU-mapping-updates.patch ++++++
# Commit 660fd65d5578a95ec5eac522128bba23325179eb
# Date 2015-10-02 13:40:36 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/p2m-pt: correct condition of IOMMU mapping updates

Whether the MFN changes does not depend on the new entry being valid
(but solely on the old one).

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 
Reviewed-by: George Dunlap 

--- a/xen/arch/x86/mm/p2m-pt.c
+++ b/xen/arch/x86/mm/p2m-pt.c
@@ -293,7 +293,8 @@ p2m_set_entry(struct p2m_domain *p2m, un
     unsigned int iommu_pte_flags = (p2mt == p2m_ram_rw) ?
                                    IOMMUF_readable|IOMMUF_writable:
                                    0; 
-    unsigned long old_mfn = 0;
+    unsigned int flags;
+    unsigned long old_mfn = INVALID_MFN;
 
     if ( tb_init_done )
     {
@@ -326,12 +327,13 @@ p2m_set_entry(struct p2m_domain *p2m, un
                                    L3_PAGETABLE_SHIFT - PAGE_SHIFT,
                                    L3_PAGETABLE_ENTRIES);
         ASSERT(p2m_entry);
-        if ( (l1e_get_flags(*p2m_entry) & _PAGE_PRESENT) &&
-             !(l1e_get_flags(*p2m_entry) & _PAGE_PSE) )
+        flags = l1e_get_flags(*p2m_entry);
+        if ( flags & _PAGE_PRESENT )
         {
-            /* We're replacing a non-SP page with a superpage.  Make sure to
-             * handle freeing the table properly. */
-            intermediate_entry = *p2m_entry;
+            if ( flags & _PAGE_PSE )
+                old_mfn = l1e_get_pfn(*p2m_entry);
+            else
+                intermediate_entry = *p2m_entry;
         }
 
         ASSERT(!mfn_valid(mfn) || p2mt != p2m_mmio_direct);
@@ -342,10 +344,7 @@ p2m_set_entry(struct p2m_domain *p2m, un
         entry_content.l1 = l3e_content.l3;
 
         if ( entry_content.l1 != 0 )
-        {
             p2m_add_iommu_flags(&entry_content, 0, iommu_pte_flags);
-            old_mfn = l1e_get_pfn(*p2m_entry);
-        }
 
         p2m->write_p2m_entry(p2m, gfn, p2m_entry, table_mfn, entry_content, 3);
         /* NB: paging_write_p2m_entry() handles tlb flushes properly */
@@ -366,7 +365,8 @@ p2m_set_entry(struct p2m_domain *p2m, un
         p2m_entry = p2m_find_entry(table, &gfn_remainder, gfn,
                                    0, L1_PAGETABLE_ENTRIES);
         ASSERT(p2m_entry);
-        
+        old_mfn = l1e_get_pfn(*p2m_entry);
+
         if ( mfn_valid(mfn) || (p2mt == p2m_mmio_direct)
                             || p2m_is_paging(p2mt) )
             entry_content = p2m_l1e_from_pfn(mfn_x(mfn),
@@ -375,10 +375,8 @@ p2m_set_entry(struct p2m_domain *p2m, un
             entry_content = l1e_empty();
 
         if ( entry_content.l1 != 0 )
-        {
             p2m_add_iommu_flags(&entry_content, 0, iommu_pte_flags);
-            old_mfn = l1e_get_pfn(*p2m_entry);
-        }
+
         /* level 1 entry */
         p2m->write_p2m_entry(p2m, gfn, p2m_entry, table_mfn, entry_content, 1);
         /* NB: paging_write_p2m_entry() handles tlb flushes properly */
@@ -389,14 +387,13 @@ p2m_set_entry(struct p2m_domain *p2m, un
                                    L2_PAGETABLE_SHIFT - PAGE_SHIFT,
                                    L2_PAGETABLE_ENTRIES);
         ASSERT(p2m_entry);
-        
-        /* FIXME: Deal with 4k replaced by 2meg pages */
-        if ( (l1e_get_flags(*p2m_entry) & _PAGE_PRESENT) &&
-             !(l1e_get_flags(*p2m_entry) & _PAGE_PSE) )
-        {
-            /* We're replacing a non-SP page with a superpage.  Make sure to
-             * handle freeing the table properly. */
-            intermediate_entry = *p2m_entry;
+        flags = l1e_get_flags(*p2m_entry);
+        if ( flags & _PAGE_PRESENT )
+        {
+            if ( flags & _PAGE_PSE )
+                old_mfn = l1e_get_pfn(*p2m_entry);
+            else
+                intermediate_entry = *p2m_entry;
         }
         
         ASSERT(!mfn_valid(mfn) || p2mt != p2m_mmio_direct);
@@ -410,10 +407,7 @@ p2m_set_entry(struct p2m_domain *p2m, un
         entry_content.l1 = l2e_content.l2;
 
         if ( entry_content.l1 != 0 )
-        {
             p2m_add_iommu_flags(&entry_content, 0, iommu_pte_flags);
-            old_mfn = l1e_get_pfn(*p2m_entry);
-        }
 
         p2m->write_p2m_entry(p2m, gfn, p2m_entry, table_mfn, entry_content, 2);
         /* NB: paging_write_p2m_entry() handles tlb flushes properly */
@@ -424,11 +418,11 @@ p2m_set_entry(struct p2m_domain *p2m, un
          && (gfn + (1UL << page_order) - 1 > p2m->max_mapped_pfn) )
         p2m->max_mapped_pfn = gfn + (1UL << page_order) - 1;
 
-    if ( iommu_enabled && need_iommu(p2m->domain) )
+    if ( iommu_enabled && need_iommu(p2m->domain) && old_mfn != mfn_x(mfn) )
     {
         if ( iommu_use_hap_pt(p2m->domain) )
         {
-            if ( old_mfn && (old_mfn != mfn_x(mfn)) )
+            if ( old_mfn != INVALID_MFN )
                 amd_iommu_flush_pages(p2m->domain, gfn, page_order);
         }
         else
++++++ 561bbc8b-VT-d-don-t-suppress-invalidation-address-write-when-0.patch ++++++
# Commit 710942e57fb42ff8f344ca82f6b678f67e38ae63
# Date 2015-10-12 15:58:35 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
VT-d: don't suppress invalidation address write when it is zero

GFN zero is a valid address, and hence may need invalidation done for
it just like for any other GFN.

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 
Acked-by: Yang Zhang 

--- a/xen/drivers/passthrough/vtd/iommu.c
+++ b/xen/drivers/passthrough/vtd/iommu.c
@@ -415,7 +415,7 @@ static int flush_iotlb_reg(void *_iommu,
 {
     struct iommu *iommu = (struct iommu *) _iommu;
     int tlb_offset = ecap_iotlb_offset(iommu->ecap);
-    u64 val = 0, val_iva = 0;
+    u64 val = 0;
     unsigned long flags;
 
     /*
@@ -436,7 +436,6 @@ static int flush_iotlb_reg(void *_iommu,
     switch ( type )
     {
     case DMA_TLB_GLOBAL_FLUSH:
-        /* global flush doesn't need set IVA_REG */
         val = DMA_TLB_GLOBAL_FLUSH|DMA_TLB_IVT;
         break;
     case DMA_TLB_DSI_FLUSH:
@@ -444,8 +443,6 @@ static int flush_iotlb_reg(void *_iommu,
         break;
     case DMA_TLB_PSI_FLUSH:
         val = DMA_TLB_PSI_FLUSH|DMA_TLB_IVT|DMA_TLB_DID(did);
-        /* Note: always flush non-leaf currently */
-        val_iva = size_order | addr;
         break;
     default:
         BUG();
@@ -458,8 +455,11 @@ static int flush_iotlb_reg(void *_iommu,
 
     spin_lock_irqsave(&iommu->register_lock, flags);
     /* Note: Only uses first TLB reg currently */
-    if ( val_iva )
-        dmar_writeq(iommu->reg, tlb_offset, val_iva);
+    if ( type == DMA_TLB_PSI_FLUSH )
+    {
+        /* Note: always flush non-leaf currently. */
+        dmar_writeq(iommu->reg, tlb_offset, size_order | addr);
+    }
     dmar_writeq(iommu->reg, tlb_offset + 8, val);
 
     /* Make sure hardware complete it */
++++++ 561d2046-VT-d-use-proper-error-codes-in-iommu_enable_x2apic_IR.patch ++++++
# Commit 6851e979874ebc05d270ea94360c49d920d3eaf4
# Date 2015-10-13 17:16:22 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
VT-d: use proper error codes in iommu_enable_x2apic_IR()

... allowing to suppress a confusing message combination: When
ACPI_DMAR_X2APIC_OPT_OUT is set, so far we first logged a message
that IR could not be enabled (hence not using x2APIC), followed by
one indicating successful initialization of IR (if no other problems
prevented that).

Also adjust the return type of iommu_supports_eim() and fix some
broken indentation in the function.

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 
Acked-by: Yang Zhang 

--- a/xen/arch/x86/apic.c
+++ b/xen/arch/x86/apic.c
@@ -964,8 +964,18 @@ void __init x2apic_bsp_setup(void)
     mask_8259A();
     mask_IO_APIC_setup(ioapic_entries);
 
-    if ( iommu_enable_x2apic_IR() )
+    switch ( iommu_enable_x2apic_IR() )
     {
+    case 0:
+        break;
+    case -ENXIO: /* ACPI_DMAR_X2APIC_OPT_OUT set */
+        if ( !x2apic_enabled )
+        {
+            printk("Not enabling x2APIC (upon firmware request)\n");
+            goto restore_out;
+        }
+        /* fall through */
+    default:
         if ( x2apic_enabled )
             panic("Interrupt remapping could not be enabled while "
                   "x2APIC is already enabled by BIOS");
--- a/xen/drivers/passthrough/vtd/intremap.c
+++ b/xen/drivers/passthrough/vtd/intremap.c
@@ -144,10 +144,10 @@ static void set_hpet_source_id(unsigned 
     set_ire_sid(ire, SVT_VERIFY_SID_SQ, SQ_13_IGNORE_3, hpetid_to_bdf(id));
 }
 
-int iommu_supports_eim(void)
+bool_t iommu_supports_eim(void)
 {
     struct acpi_drhd_unit *drhd;
-    int apic;
+    unsigned int apic;
 
     if ( !iommu_qinval || !iommu_intremap || list_empty(&acpi_drhd_units) )
         return 0;
@@ -155,12 +155,12 @@ int iommu_supports_eim(void)
     /* We MUST have a DRHD unit for each IOAPIC. */
     for ( apic = 0; apic < nr_ioapics; apic++ )
         if ( !ioapic_to_drhd(IO_APIC_ID(apic)) )
-    {
+        {
             dprintk(XENLOG_WARNING VTDPREFIX,
                     "There is not a DRHD for IOAPIC %#x (id: %#x)!\n",
                     apic, IO_APIC_ID(apic));
             return 0;
-    }
+        }
 
     for_each_drhd_unit ( drhd )
         if ( !ecap_queued_inval(drhd->iommu->ecap) ||
@@ -836,10 +836,10 @@ int iommu_enable_x2apic_IR(void)
     struct iommu *iommu;
 
     if ( !iommu_supports_eim() )
-        return -1;
+        return -EOPNOTSUPP;
 
     if ( !platform_supports_x2apic() )
-        return -1;
+        return -ENXIO;
 
     for_each_drhd_unit ( drhd )
     {
@@ -864,7 +864,7 @@ int iommu_enable_x2apic_IR(void)
         {
             dprintk(XENLOG_INFO VTDPREFIX,
                     "Failed to enable Queued Invalidation!\n");
-            return -1;
+            return -EIO;
         }
     }
 
@@ -876,7 +876,7 @@ int iommu_enable_x2apic_IR(void)
         {
             dprintk(XENLOG_INFO VTDPREFIX,
                     "Failed to enable Interrupt Remapping!\n");
-            return -1;
+            return -EIO;
         }
     }
 
--- a/xen/include/xen/iommu.h
+++ b/xen/include/xen/iommu.h
@@ -47,7 +47,7 @@ extern bool_t amd_iommu_perdev_intremap;
 #define PAGE_ALIGN_4K(addr) (((addr) + PAGE_SIZE_4K - 1) & PAGE_MASK_4K)
 
 int iommu_setup(void);
-int iommu_supports_eim(void);
+bool_t iommu_supports_eim(void);
 int iommu_enable_x2apic_IR(void);
 void iommu_disable_x2apic_IR(void);
 
++++++ 561d20a0-x86-hide-MWAITX-from-PV-domains.patch ++++++
# Commit 941cd44324db7eddc46cba4596fa13d505066ccf
# Date 2015-10-13 17:17:52 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86: hide MWAITX from PV domains

Since MWAIT is hidden too. (Linux starting with 4.3 is making use of
that feature, and is checking for it without looking at the MWAIT one.)

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 

--- a/xen/arch/x86/traps.c
+++ b/xen/arch/x86/traps.c
@@ -873,6 +873,7 @@ void pv_cpuid(struct cpu_user_regs *regs
         __clear_bit(X86_FEATURE_LWP % 32, &c);
         __clear_bit(X86_FEATURE_NODEID_MSR % 32, &c);
         __clear_bit(X86_FEATURE_TOPOEXT % 32, &c);
+        __clear_bit(X86_FEATURE_MWAITX % 32, &c);
         break;
 
     case 0x00000005: /* MONITOR/MWAIT */
--- a/xen/include/asm-x86/cpufeature.h
+++ b/xen/include/asm-x86/cpufeature.h
@@ -137,6 +137,7 @@
 #define X86_FEATURE_NODEID_MSR  (6*32+19) /* NodeId MSR */
 #define X86_FEATURE_TBM         (6*32+21) /* trailing bit manipulations */
 #define X86_FEATURE_TOPOEXT     (6*32+22) /* topology extensions CPUID leafs */
+#define X86_FEATURE_MWAITX      (6*32+29) /* MWAIT extension (MONITORX/MWAITX) */
 
 /* Intel-defined CPU features, CPUID level 0x00000007:0 (ebx), word 7 */
 #define X86_FEATURE_FSGSBASE	(7*32+ 0) /* {RD,WR}{FS,GS}BASE instructions */
++++++ 561e3283-x86-NUMA-fix-SRAT-table-processor-entry-handling.patch ++++++
# Commit 83281fc9b31396e94c0bfb6550b75c165037a0ad
# Date 2015-10-14 12:46:27 +0200
# Author Jan Beulich 
# Committer Jan Beulich 
x86/NUMA: fix SRAT table processor entry parsing and consumption

- don't overrun apicid_to_node[] (possible in the x2APIC case)
- don't limit number of processor related SRAT entries we can consume
- make acpi_numa_{processor,x2apic}_affinity_init() as similar to one
  another as possible
- print APIC IDs in hex (to ease matching with other log messages), at
  once making legacy and x2APIC ones distinguishable (by width)

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 

--- a/xen/arch/x86/numa.c
+++ b/xen/arch/x86/numa.c
@@ -331,7 +331,8 @@ void __init init_cpu_to_node(void)
 		u32 apicid = x86_cpu_to_apicid[i];
 		if (apicid == BAD_APICID)
 			continue;
-		node = apicid_to_node[apicid];
+		node = apicid < MAX_LOCAL_APIC ? apicid_to_node[apicid]
+					       : NUMA_NO_NODE;
 		if ( node == NUMA_NO_NODE || !node_online(node) )
 			node = 0;
 		numa_set_node(i, node);
--- a/xen/arch/x86/setup.c
+++ b/xen/arch/x86/setup.c
@@ -189,7 +189,7 @@ void __devinit srat_detect_node(int cpu)
     unsigned node;
     u32 apicid = x86_cpu_to_apicid[cpu];
 
-    node = apicid_to_node[apicid];
+    node = apicid < MAX_LOCAL_APIC ? apicid_to_node[apicid] : NUMA_NO_NODE;
     if ( node == NUMA_NO_NODE )
         node = 0;
 
--- a/xen/arch/x86/smpboot.c
+++ b/xen/arch/x86/smpboot.c
@@ -903,7 +903,8 @@ int cpu_add(uint32_t apic_id, uint32_t a
             cpu = node;
             goto out;
         }
-        apicid_to_node[apic_id] = node;
+        if ( apic_id < MAX_LOCAL_APIC )
+             apicid_to_node[apic_id] = node;
     }
 
     /* Physically added CPUs do not have synchronised TSC. */
--- a/xen/arch/x86/srat.c
+++ b/xen/arch/x86/srat.c
@@ -170,7 +170,6 @@ void __init
 acpi_numa_x2apic_affinity_init(struct acpi_srat_x2apic_cpu_affinity *pa)
 {
 	int pxm, node;
-	int apic_id;
 
 	if (srat_disabled())
 		return;
@@ -178,8 +177,13 @@ acpi_numa_x2apic_affinity_init(struct ac
 		bad_srat();
 		return;
 	}
-	if ((pa->flags & ACPI_SRAT_CPU_ENABLED) == 0)
+	if (!(pa->flags & ACPI_SRAT_CPU_ENABLED))
+		return;
+	if (pa->apic_id >= MAX_LOCAL_APIC) {
+		printk(KERN_INFO "SRAT: APIC %08x ignored\n", pa->apic_id);
 		return;
+	}
+
 	pxm = pa->proximity_domain;
 	node = setup_node(pxm);
 	if (node < 0) {
@@ -187,11 +191,11 @@ acpi_numa_x2apic_affinity_init(struct ac
 		return;
 	}
 
-	apic_id = pa->apic_id;
-	apicid_to_node[apic_id] = node;
+	apicid_to_node[pa->apic_id] = node;
+	node_set(node, processor_nodes_parsed);
 	acpi_numa = 1;
-	printk(KERN_INFO "SRAT: PXM %u -> APIC %u -> Node %u\n",
-	       pxm, apic_id, node);
+	printk(KERN_INFO "SRAT: PXM %u -> APIC %08x -> Node %u\n",
+	       pxm, pa->apic_id, node);
 }
 
 /* Callback for Proximity Domain -> LAPIC mapping */
@@ -221,7 +225,7 @@ acpi_numa_processor_affinity_init(struct
 	apicid_to_node[pa->apic_id] = node;
 	node_set(node, processor_nodes_parsed);
 	acpi_numa = 1;
-	printk(KERN_INFO "SRAT: PXM %u -> APIC %u -> Node %u\n",
+	printk(KERN_INFO "SRAT: PXM %u -> APIC %02x -> Node %u\n",
 	       pxm, pa->apic_id, node);
 }
 
--- a/xen/drivers/acpi/numa.c
+++ b/xen/drivers/acpi/numa.c
@@ -199,9 +199,9 @@ int __init acpi_numa_init(void)
 	/* SRAT: Static Resource Affinity Table */
 	if (!acpi_table_parse(ACPI_SIG_SRAT, acpi_parse_srat)) {
 		acpi_table_parse_srat(ACPI_SRAT_TYPE_X2APIC_CPU_AFFINITY,
-				      acpi_parse_x2apic_affinity, NR_CPUS);
+				      acpi_parse_x2apic_affinity, 0);
 		acpi_table_parse_srat(ACPI_SRAT_TYPE_CPU_AFFINITY,
-				      acpi_parse_processor_affinity, NR_CPUS);
+				      acpi_parse_processor_affinity, 0);
 		acpi_table_parse_srat(ACPI_SRAT_TYPE_MEMORY_AFFINITY,
 				      acpi_parse_memory_affinity,
 				      NR_NODE_MEMBLKS);
++++++ 5628fc67-libxl-No-emulated-disk-driver-for-xvdX-disk.patch ++++++
commit c0c099d157cc5bc942afef766cf141628a6380a1
Author: Anthony PERARD 
Date:   Wed Oct 14 12:05:17 2015 +0100

    libxl: No emulated disk driver for xvdX disk
    
    When a guest configuration list xvdX for its disks, there is no need to
    provide an emulated driver for the same target.
    
    Such configuration can work with the OVMF firmware, as it supports PV
    disk.
    
    Signed-off-by: Anthony PERARD 
    Acked-by: Ian Jackson 

Index: xen-4.4.3-testing/tools/libxl/libxl_dm.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl_dm.c
+++ xen-4.4.3-testing/tools/libxl/libxl_dm.c
@@ -771,6 +771,12 @@ static char ** libxl__build_device_model
                     drive = libxl__sprintf
                         (gc, "file=%s,if=scsi,bus=0,unit=%d,format=%s,cache=writeback",
                          disks[i].pdev_path, disk, format);
+                else if (strncmp(disks[i].vdev, "xvd", 3) == 0)
+                    /*
+                     * Do not add any emulated disk when PV disk are
+                     * explicitly asked for.
+                     */
+                    continue;
                 else if (disk < 4)
                     drive = libxl__sprintf
                         (gc, "file=%s,if=ide,index=%d,media=disk,format=%s,cache=writeback",
++++++ 5632127b-x86-guard-against-undue-super-page-PTE-creation.patch ++++++
References: bsc#950367 CVE-2015-7835 XSA-148

# Commit fe360c90ea13f309ef78810f1a2b92f2ae3b30b8
# Date 2015-10-29 13:35:07 +0100
# Author Jan Beulich 
# Committer Jan Beulich 
x86: guard against undue super page PTE creation

When optional super page support got added (commit bd1cd81d64 "x86: PV
support for hugepages"), two adjustments were missed: mod_l2_entry()
needs to consider the PSE and RW bits when deciding whether to use the
fast path, and the PSE bit must not be removed from L2_DISALLOW_MASK
unconditionally.

This is CVE-2015-7835 / XSA-148.

Reported-by: "栾尚聪(好风)" 
Signed-off-by: Jan Beulich 
Reviewed-by: Tim Deegan 

--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -163,7 +163,10 @@ static void put_superpage(unsigned long
 
 static uint32_t base_disallow_mask;
 #define L1_DISALLOW_MASK (base_disallow_mask | _PAGE_GNTTAB)
-#define L2_DISALLOW_MASK (base_disallow_mask & ~_PAGE_PSE)
+
+#define L2_DISALLOW_MASK (unlikely(opt_allow_superpage) \
+                          ? base_disallow_mask & ~_PAGE_PSE \
+                          : base_disallow_mask)
 
 #define l3_disallow_mask(d) (!is_pv_32on64_domain(d) ?  \
                              base_disallow_mask :       \
@@ -1786,7 +1789,10 @@ static int mod_l2_entry(l2_pgentry_t *pl
         }
 
         /* Fast path for identical mapping and presence. */
-        if ( !l2e_has_changed(ol2e, nl2e, _PAGE_PRESENT) )
+        if ( !l2e_has_changed(ol2e, nl2e,
+                              unlikely(opt_allow_superpage)
+                              ? _PAGE_PSE | _PAGE_RW | _PAGE_PRESENT
+                              : _PAGE_PRESENT) )
         {
             adjust_guest_l2e(nl2e, d);
             if ( UPDATE_ENTRY(l2, pl2e, ol2e, nl2e, pfn, vcpu, preserve_ad) )
++++++ 5632129c-free-domain-s-vcpu-array.patch ++++++
References: bsc#950703 CVE-2015-7969 XSA-149

# Commit d46896ebbb23f3a9fef2eb6066ae614fd1acfd96
# Date 2015-10-29 13:35:40 +0100
# Author Jan Beulich 
# Committer Jan Beulich 
free domain's vcpu array

This was overlooked in fb442e2171 ("x86_64: allow more vCPU-s per
guest").

This is CVE-2015-7969 / XSA-149.

Reported-by: Ian Campbell 
Signed-off-by: Jan Beulich 
Reviewed-by: Ian Campbell 

--- a/xen/common/domain.c
+++ b/xen/common/domain.c
@@ -745,6 +745,7 @@ static void complete_domain_destroy(stru
 
     xsm_free_security_domain(d);
     free_cpumask_var(d->domain_dirty_cpumask);
+    xfree(d->vcpu);
     free_domain_struct(d);
 
     send_global_virq(VIRQ_DOM_EXC);
++++++ 563212c9-x86-PoD-Eager-sweep-for-zeroed-pages.patch ++++++
References: bsc#950704 CVE-2015-7970 XSA-150

Subject: x86/PoD: Eager sweep for zeroed pages
From: Andrew Cooper andrew.cooper3@citrix.com Thu Oct 29 14:14:30 2015 +0100
Date: Thu Oct 29 14:14:30 2015 +0100:
Git: 3638ff0e711e1a2bcb1ad8f3706d5ea079a54e79

Based on the contents of a guests physical address space,
p2m_pod_emergency_sweep() could degrade into a linear memcmp() from 0 to
max_gfn, which runs non-preemptibly.

As p2m_pod_emergency_sweep() runs behind the scenes in a number of contexts,
making it preemptible is not feasible.

Instead, a different approach is taken.  Recently-populated pages are eagerly
checked for reclaimation, which amortises the p2m_pod_emergency_sweep()
operation across each p2m_pod_demand_populate() operation.

Note that in the case that a 2M superpage can't be reclaimed as a superpage,
it is shattered if 4K pages of zeros can be reclaimed.  This is unfortunate
but matches the previous behaviour, and is required to avoid regressions
(domain crash from PoD exhaustion) with VMs configured close to the limit.

This is CVE-2015-7970 / XSA-150.

Signed-off-by: Andrew Cooper 
Reviewed-by: Jan Beulich 
Reviewed-by: George Dunlap 
master commit: 101ce53266866144e724ed593173bc4098b300b9
master date: 2015-10-29 13:36:25 +0100

--- a/xen/arch/x86/mm/p2m-pod.c
+++ b/xen/arch/x86/mm/p2m-pod.c
@@ -899,28 +899,6 @@ p2m_pod_zero_check(struct p2m_domain *p2
 }
 
 #define POD_SWEEP_LIMIT 1024
-
-/* When populating a new superpage, look at recently populated superpages
- * hoping that they've been zeroed.  This will snap up zeroed pages as soon as 
- * the guest OS is done with them. */
-static void
-p2m_pod_check_last_super(struct p2m_domain *p2m, unsigned long gfn_aligned)
-{
-    unsigned long check_gfn;
-
-    ASSERT(p2m->pod.last_populated_index < POD_HISTORY_MAX);
-
-    check_gfn = p2m->pod.last_populated[p2m->pod.last_populated_index];
-
-    p2m->pod.last_populated[p2m->pod.last_populated_index] = gfn_aligned;
-
-    p2m->pod.last_populated_index =
-        ( p2m->pod.last_populated_index + 1 ) % POD_HISTORY_MAX;
-
-    p2m_pod_zero_check_superpage(p2m, check_gfn);
-}
-
-
 #define POD_SWEEP_STRIDE  16
 static void
 p2m_pod_emergency_sweep(struct p2m_domain *p2m)
@@ -961,7 +939,7 @@ p2m_pod_emergency_sweep(struct p2m_domai
          * NB that this is a zero-sum game; we're increasing our cache size
          * by re-increasing our 'debt'.  Since we hold the pod lock,
          * (entry_count - count) must remain the same. */
-        if ( p2m->pod.count > 0 && i < limit )
+        if ( i < limit && (p2m->pod.count > 0 || hypercall_preempt_check()) )
             break;
     }
 
@@ -973,6 +951,58 @@ p2m_pod_emergency_sweep(struct p2m_domai
 
 }
 
+static void pod_eager_reclaim(struct p2m_domain *p2m)
+{
+    struct pod_mrp_list *mrp = &p2m->pod.mrp;
+    unsigned int i = 0;
+
+    /*
+     * Always check one page for reclaimation.
+     *
+     * If the PoD pool is empty, keep checking some space is found, or all
+     * entries have been exhaused.
+     */
+    do
+    {
+        unsigned int idx = (mrp->idx + i++) % ARRAY_SIZE(mrp->list);
+        unsigned long gfn = mrp->list[idx];
+
+        if ( gfn != INVALID_GFN )
+        {
+            if ( gfn & POD_LAST_SUPERPAGE )
+            {
+                gfn &= ~POD_LAST_SUPERPAGE;
+
+                if ( p2m_pod_zero_check_superpage(p2m, gfn) == 0 )
+                {
+                    unsigned int x;
+
+                    for ( x = 0; x < SUPERPAGE_PAGES; ++x, ++gfn )
+                        p2m_pod_zero_check(p2m, &gfn, 1);
+                }
+            }
+            else
+                p2m_pod_zero_check(p2m, &gfn, 1);
+
+            mrp->list[idx] = INVALID_GFN;
+        }
+
+    } while ( (p2m->pod.count == 0) && (i < ARRAY_SIZE(mrp->list)) );
+}
+
+static void pod_eager_record(struct p2m_domain *p2m,
+                             unsigned long gfn, unsigned int order)
+{
+    struct pod_mrp_list *mrp = &p2m->pod.mrp;
+
+    ASSERT(mrp->list[mrp->idx] == INVALID_GFN);
+    ASSERT(gfn != INVALID_GFN);
+
+    mrp->list[mrp->idx++] =
+        gfn | (order == PAGE_ORDER_2M ? POD_LAST_SUPERPAGE : 0);
+    mrp->idx %= ARRAY_SIZE(mrp->list);
+}
+
 int
 p2m_pod_demand_populate(struct p2m_domain *p2m, unsigned long gfn,
                         unsigned int order,
@@ -1013,6 +1043,8 @@ p2m_pod_demand_populate(struct p2m_domai
         return 0;
     }
 
+    pod_eager_reclaim(p2m);
+
     /* Only sweep if we're actually out of memory.  Doing anything else
      * causes unnecessary time and fragmentation of superpages in the p2m. */
     if ( p2m->pod.count == 0 )
@@ -1048,6 +1080,8 @@ p2m_pod_demand_populate(struct p2m_domai
     p2m->pod.entry_count -= (1 << order);
     BUG_ON(p2m->pod.entry_count < 0);
 
+    pod_eager_record(p2m, gfn_aligned, order);
+
     if ( tb_init_done )
     {
         struct {
@@ -1063,12 +1097,6 @@ p2m_pod_demand_populate(struct p2m_domai
         __trace_var(TRC_MEM_POD_POPULATE, 0, sizeof(t), &t);
     }
 
-    /* Check the last guest demand-populate */
-    if ( p2m->pod.entry_count > p2m->pod.count 
-         && (order == PAGE_ORDER_2M)
-         && (q & P2M_ALLOC) )
-        p2m_pod_check_last_super(p2m, gfn_aligned);
-
     pod_unlock(p2m);
     return 0;
 out_of_memory:
--- a/xen/arch/x86/mm/p2m.c
+++ b/xen/arch/x86/mm/p2m.c
@@ -59,6 +59,7 @@ boolean_param("hap_2mb", opt_hap_2mb);
 /* Init the datastructures for later use by the p2m code */
 static int p2m_initialise(struct domain *d, struct p2m_domain *p2m)
 {
+    unsigned int i;
     int ret = 0;
 
     mm_rwlock_init(&p2m->lock);
@@ -73,6 +74,9 @@ static int p2m_initialise(struct domain
 
     p2m->np2m_base = P2M_BASE_EADDR;
 
+    for ( i = 0; i < ARRAY_SIZE(p2m->pod.mrp.list); ++i )
+        p2m->pod.mrp.list[i] = INVALID_GFN;
+
     if ( hap_enabled(d) && cpu_has_vmx )
         ret = ept_p2m_init(p2m);
     else
--- a/xen/include/asm-x86/p2m.h
+++ b/xen/include/asm-x86/p2m.h
@@ -270,10 +270,20 @@ struct p2m_domain {
                          entry_count;  /* # of pages in p2m marked pod      */
         unsigned long    reclaim_single; /* Last gpfn of a scan */
         unsigned long    max_guest;    /* gpfn of max guest demand-populate */
-#define POD_HISTORY_MAX 128
-        /* gpfn of last guest superpage demand-populated */
-        unsigned long    last_populated[POD_HISTORY_MAX]; 
-        unsigned int     last_populated_index;
+
+        /*
+         * Tracking of the most recently populated PoD pages, for eager
+         * reclamation.
+         */
+        struct pod_mrp_list {
+#define NR_POD_MRP_ENTRIES 32
+
+/* Encode ORDER_2M superpage in top bit of GFN */
+#define POD_LAST_SUPERPAGE (INVALID_GFN & ~(INVALID_GFN >> 1))
+
+            unsigned long list[NR_POD_MRP_ENTRIES];
+            unsigned int idx;
+        } mrp;
         mm_lock_t        lock;         /* Locking of private pod structs,   *
                                         * not relying on the p2m lock.      */
     } pod;
++++++ 563212e4-xenoprof-free-domain-s-vcpu-array.patch ++++++
References: bsc#950705 CVE-2015-7969 XSA-151

# Commit 6e97c4b37386c2d09e09e9b5d5d232e37728b960
# Date 2015-10-29 13:36:52 +0100
# Author Jan Beulich 
# Committer Jan Beulich 
xenoprof: free domain's vcpu array

This was overlooked in fb442e2171 ("x86_64: allow more vCPU-s per
guest").

This is CVE-2015-7969 / XSA-151.

Signed-off-by: Jan Beulich 
Reviewed-by: Ian Campbell 

--- a/xen/common/xenoprof.c
+++ b/xen/common/xenoprof.c
@@ -239,6 +239,7 @@ static int alloc_xenoprof_struct(
     d->xenoprof->rawbuf = alloc_xenheap_pages(get_order_from_pages(npages), 0);
     if ( d->xenoprof->rawbuf == NULL )
     {
+        xfree(d->xenoprof->vcpu);
         xfree(d->xenoprof);
         d->xenoprof = NULL;
         return -ENOMEM;
@@ -286,6 +287,7 @@ void free_xenoprof_pages(struct domain *
         free_xenheap_pages(x->rawbuf, order);
     }
 
+    xfree(x->vcpu);
     xfree(x);
     d->xenoprof = NULL;
 }
++++++ 563212ff-x86-rate-limit-logging-in-do_xen-oprof-pmu-_op.patch ++++++
References: bsc#950706 CVE-2015-7971 XSA-152

# Commit 95e7415843b94c346e5ba8682665f508f220e04b
# Date 2015-10-29 13:37:19 +0100
# Author Jan Beulich 
# Committer Jan Beulich 
x86: rate-limit logging in do_xen{oprof,pmu}_op()

Some of the sub-ops are acessible to all guests, and hence should be
rate-limited. In the xenoprof case, just like for XSA-146, include them
only in debug builds. Since the vPMU code is rather new, allow them to
be always present, but downgrade them to (rate limited) guest messages.

This is CVE-2015-7971 / XSA-152.

Signed-off-by: Jan Beulich 
Reviewed-by: Ian Campbell 

--- a/xen/common/xenoprof.c
+++ b/xen/common/xenoprof.c
@@ -670,15 +670,13 @@ ret_t do_xenoprof_op(int op, XEN_GUEST_H
     
     if ( (op < 0) || (op > XENOPROF_last_op) )
     {
-        printk("xenoprof: invalid operation %d for domain %d\n",
-               op, current->domain->domain_id);
+        gdprintk(XENLOG_DEBUG, "invalid operation %d\n", op);
         return -EINVAL;
     }
 
     if ( !NONPRIV_OP(op) && (current->domain != xenoprof_primary_profiler) )
     {
-        printk("xenoprof: dom %d denied privileged operation %d\n",
-               current->domain->domain_id, op);
+        gdprintk(XENLOG_DEBUG, "denied privileged operation %d\n", op);
         return -EPERM;
     }
 
@@ -901,8 +899,7 @@ ret_t do_xenoprof_op(int op, XEN_GUEST_H
     spin_unlock(&xenoprof_lock);
 
     if ( ret < 0 )
-        printk("xenoprof: operation %d failed for dom %d (status : %d)\n",
-               op, current->domain->domain_id, ret);
+        gdprintk(XENLOG_DEBUG, "operation %d failed: %d\n", op, ret);
 
     return ret;
 }
++++++ 56377442-x86-restartable-p2m_pod_empty_cache.patch ++++++
# Commit 59a5061723ba47c0028cf48487e5de551c42a378
# Date 2015-11-02 15:33:38 +0100
# Author Andrew Cooper 
# Committer Jan Beulich 
x86/PoD: Make p2m_pod_empty_cache() restartable

This avoids a long running operation when destroying a domain with a
large PoD cache.

Signed-off-by: Andrew Cooper 
Reviewed-by: George Dunlap 

--- a/xen/arch/x86/mm/p2m-pod.c
+++ b/xen/arch/x86/mm/p2m-pod.c
@@ -376,11 +376,11 @@ out:
     return ret;
 }
 
-void
-p2m_pod_empty_cache(struct domain *d)
+int p2m_pod_empty_cache(struct domain *d)
 {
     struct p2m_domain *p2m = p2m_get_hostp2m(d);
     struct page_info *page;
+    unsigned int i;
 
     /* After this barrier no new PoD activities can happen. */
     BUG_ON(!d->is_dying);
@@ -390,8 +390,6 @@ p2m_pod_empty_cache(struct domain *d)
 
     while ( (page = page_list_remove_head(&p2m->pod.super)) )
     {
-        int i;
-            
         for ( i = 0 ; i < SUPERPAGE_PAGES ; i++ )
         {
             BUG_ON(page_get_owner(page + i) != d);
@@ -399,19 +397,27 @@ p2m_pod_empty_cache(struct domain *d)
         }
 
         p2m->pod.count -= SUPERPAGE_PAGES;
+
+        if ( hypercall_preempt_check() )
+            goto out;
     }
 
-    while ( (page = page_list_remove_head(&p2m->pod.single)) )
+    for ( i = 0; (page = page_list_remove_head(&p2m->pod.single)); ++i )
     {
         BUG_ON(page_get_owner(page) != d);
         page_list_add_tail(page, &d->page_list);
 
         p2m->pod.count -= 1;
+
+        if ( i && !(i & 511) && hypercall_preempt_check() )
+            goto out;
     }
 
     BUG_ON(p2m->pod.count != 0);
 
+ out:
     unlock_page_alloc(p2m);
+    return p2m->pod.count ? -ERESTART : 0;
 }
 
 int
--- a/xen/arch/x86/mm/paging.c
+++ b/xen/arch/x86/mm/paging.c
@@ -793,7 +793,7 @@ int paging_teardown(struct domain *d)
         return rc;
 
     /* Move populate-on-demand cache back to domain_list for destruction */
-    p2m_pod_empty_cache(d);
+    rc = p2m_pod_empty_cache(d);
 
     return rc;
 }
--- a/xen/include/asm-x86/p2m.h
+++ b/xen/include/asm-x86/p2m.h
@@ -530,7 +530,7 @@ void p2m_pod_dump_data(struct domain *d)
 
 /* Move all pages from the populate-on-demand cache to the domain page_list
  * (usually in preparation for domain destruction) */
-void p2m_pod_empty_cache(struct domain *d);
+int p2m_pod_empty_cache(struct domain *d);
 
 /* Set populate-on-demand cache size so that the total memory allocated to a
  * domain matches target */
++++++ 5638eb5a-vmx-improve-vmentry-failure-handling.patch ++++++
# Commit bbcf0b218f64b1e3e2b66b0fbb623f51d9014e81
# Date 2015-11-03 18:14:02 +0100
# Author Andrew Cooper 
# Committer Jan Beulich 
x86/vmx: improvements to vmentry failure handling

Combine the almost identical vm_launch_fail() and vm_resume_fail() into a
single vmx_vmentry_failure().

Re-save all GPRs so that domain_crash() prints the real register values,
rather than the stack frame of the vmx_vmentry_failure() call.

Signed-off-by: Andrew Cooper 
Acked-by: Kevin Tian 

--- a/xen/arch/x86/hvm/vmx/entry.S
+++ b/xen/arch/x86/hvm/vmx/entry.S
@@ -102,14 +102,15 @@ UNLIKELY_END(realmode)
 
 /*.Lvmx_resume:*/
         VMRESUME
-        sti
-        call vm_resume_fail
-        ud2
+        jmp  .Lvmx_vmentry_fail
 
 .Lvmx_launch:
         VMLAUNCH
+
+.Lvmx_vmentry_fail:
         sti
-        call vm_launch_fail
+        SAVE_ALL
+        call vmx_vmentry_failure
         ud2
 
 ENTRY(vmx_asm_do_vmentry)
--- a/xen/arch/x86/hvm/vmx/vmcs.c
+++ b/xen/arch/x86/hvm/vmx/vmcs.c
@@ -1292,21 +1292,14 @@ void vmx_destroy_vmcs(struct vcpu *v)
     free_xenheap_page(v->arch.hvm_vmx.msr_bitmap);
 }
 
-void vm_launch_fail(void)
+void vmx_vmentry_failure(void)
 {
+    struct vcpu *curr = current;
     unsigned long error;
 
     __vmread(VM_INSTRUCTION_ERROR, &error);
-    printk(" error code %lx\n", error);
-    domain_crash_synchronous();
-}
-
-void vm_resume_fail(void)
-{
-    unsigned long error;
-
-    __vmread(VM_INSTRUCTION_ERROR, &error);
-    printk(" error code %lx\n", error);
+    printk(XENLOG_G_ERR "%pv: VM%s error: %#lx\n",
+           curr, curr->arch.hvm_vmx.launched ? "RESUME" : "LAUNCH", error);
     domain_crash_synchronous();
 }
 
++++++ 5641ceec-x86-HVM-always-intercept-AC-and-DB.patch ++++++
References: bsc#953527 CVE-2015-5307 XSA-156

# Commit bd2239d9fa975a1ee5bcd27c218ae042cd0a57bc
# Date 2015-11-10 12:03:08 +0100
# Author Jan Beulich 
# Committer Jan Beulich 
x86/HVM: always intercept #AC and #DB

Both being benign exceptions, and both being possible to get triggered
by exception delivery, this is required to prevent a guest from locking
up a CPU (resulting from no other VM exits occurring once getting into
such a loop).

The specific scenarios:

1) #AC may be raised during exception delivery if the handler is set to
be a ring-3 one by a 32-bit guest, and the stack is misaligned.

This is CVE-2015-5307 / XSA-156.

Reported-by: Benjamin Serebrin 

2) #DB may be raised during exception delivery when a breakpoint got
placed on a data structure involved in delivering the exception. This
can result in an endless loop when a 64-bit guest uses a non-zero IST
for the vector 1 IDT entry, but even without use of IST the time it
takes until a contributory fault would get raised (results depending
on the handler) may be quite long.

This is CVE-2015-8104 / XSA-156.

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 
Tested-by: Andrew Cooper 

--- a/xen/arch/x86/hvm/svm/svm.c
+++ b/xen/arch/x86/hvm/svm/svm.c
@@ -941,10 +941,11 @@ static void svm_do_resume(struct vcpu *v
         unlikely(v->arch.hvm_vcpu.debug_state_latch != debug_state) )
     {
         uint32_t intercepts = vmcb_get_exception_intercepts(vmcb);
-        uint32_t mask = (1U << TRAP_debug) | (1U << TRAP_int3);
+
         v->arch.hvm_vcpu.debug_state_latch = debug_state;
         vmcb_set_exception_intercepts(
-            vmcb, debug_state ? (intercepts | mask) : (intercepts & ~mask));
+            vmcb, debug_state ? (intercepts | (1U << TRAP_int3))
+                              : (intercepts & ~(1U << TRAP_int3)));
     }
 
     if ( v->arch.hvm_svm.launch_core != smp_processor_id() )
@@ -2239,8 +2240,9 @@ void svm_vmexit_handler(struct cpu_user_
 
     case VMEXIT_EXCEPTION_DB:
         if ( !v->domain->debugger_attached )
-            goto unexpected_exit_type;
-        domain_pause_for_debugger();
+            hvm_inject_hw_exception(TRAP_debug, HVM_DELIVER_NO_ERROR_CODE);
+        else
+            domain_pause_for_debugger();
         break;
 
     case VMEXIT_EXCEPTION_BP:
@@ -2288,6 +2290,11 @@ void svm_vmexit_handler(struct cpu_user_
         break;
     }
 
+    case VMEXIT_EXCEPTION_AC:
+        HVMTRACE_1D(TRAP, TRAP_alignment_check);
+        hvm_inject_hw_exception(TRAP_alignment_check, vmcb->exitinfo1);
+        break;
+
     case VMEXIT_EXCEPTION_UD:
         svm_vmexit_ud_intercept(regs);
         break;
--- a/xen/arch/x86/hvm/vmx/vmx.c
+++ b/xen/arch/x86/hvm/vmx/vmx.c
@@ -1132,16 +1132,10 @@ static void vmx_update_host_cr3(struct v
 
 void vmx_update_debug_state(struct vcpu *v)
 {
-    unsigned long mask;
-
-    mask = 1u << TRAP_int3;
-    if ( !cpu_has_monitor_trap_flag )
-        mask |= 1u << TRAP_debug;
-
     if ( v->arch.hvm_vcpu.debug_state_latch )
-        v->arch.hvm_vmx.exception_bitmap |= mask;
+        v->arch.hvm_vmx.exception_bitmap |= 1U << TRAP_int3;
     else
-        v->arch.hvm_vmx.exception_bitmap &= ~mask;
+        v->arch.hvm_vmx.exception_bitmap &= ~(1U << TRAP_int3);
 
     vmx_vmcs_enter(v);
     vmx_update_exception_bitmap(v);
@@ -2700,9 +2694,10 @@ void vmx_vmexit_handler(struct cpu_user_
             __vmread(EXIT_QUALIFICATION, &exit_qualification);
             HVMTRACE_1D(TRAP_DEBUG, exit_qualification);
             write_debugreg(6, exit_qualification | 0xffff0ff0);
-            if ( !v->domain->debugger_attached || cpu_has_monitor_trap_flag )
-                goto exit_and_crash;
-            domain_pause_for_debugger();
+            if ( !v->domain->debugger_attached )
+                hvm_inject_hw_exception(vector, HVM_DELIVER_NO_ERROR_CODE);
+            else
+                domain_pause_for_debugger();
             break;
         case TRAP_int3: 
         {
@@ -2767,6 +2762,11 @@ void vmx_vmexit_handler(struct cpu_user_
 
             hvm_inject_page_fault(regs->error_code, exit_qualification);
             break;
+        case TRAP_alignment_check:
+            HVMTRACE_1D(TRAP, vector);
+            __vmread(VM_EXIT_INTR_ERROR_CODE, &ecode);
+            hvm_inject_hw_exception(vector, ecode);
+            break;
         case TRAP_nmi:
             if ( (intr_info & INTR_INFO_INTR_TYPE_MASK) !=
                  (X86_EVENTTYPE_NMI << 8) )
--- a/xen/include/asm-x86/hvm/hvm.h
+++ b/xen/include/asm-x86/hvm/hvm.h
@@ -352,7 +352,10 @@ static inline int hvm_event_pending(stru
     (X86_CR4_VMXE | X86_CR4_PAE | X86_CR4_MCE))
 
 /* These exceptions must always be intercepted. */
-#define HVM_TRAP_MASK ((1U << TRAP_machine_check) | (1U << TRAP_invalid_op))
+#define HVM_TRAP_MASK ((1U << TRAP_debug)           | \
+                       (1U << TRAP_invalid_op)      | \
+                       (1U << TRAP_alignment_check) | \
+                       (1U << TRAP_machine_check))
 
 /*
  * x86 event types. This enumeration is valid for:
++++++ 5644b756-x86-HVM-don-t-inject-DB-with-error-code.patch ++++++
# Commit 057e0e72d2a5d598087c5f167ec6a13203a3cf65
# Date 2015-11-12 16:59:18 +0100
# Author Jan Beulich 
# Committer Jan Beulich 
x86/HVM: don't inject #DB with error code

Signed-off-by: Jan Beulich 
Reviewed-by: Andrew Cooper 

--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -2590,7 +2590,7 @@ void hvm_task_switch(
         goto out;
 
     if ( (tss.trace & 1) && !exn_raised )
-        hvm_inject_hw_exception(TRAP_debug, tss_sel & 0xfff8);
+        hvm_inject_hw_exception(TRAP_debug, HVM_DELIVER_NO_ERROR_CODE);
 
     tr.attr.fields.type = 0xb; /* busy 32-bit tss */
     hvm_set_segment_register(v, x86_seg_tr, &tr);
++++++ 5649bcbe-libxl-relax-readonly-check-introduced-by-XSA-142-fix.patch ++++++
commit ef6cb76026628e26e3d1ae53c50ccde1c3c78b1b
Author: Jim Fehlig 
Date:   Thu Nov 12 19:40:46 2015 -0700

    libxl: relax readonly check introduced by XSA-142 fix
    
    The fix for XSA-142 is quite a big hammer, rejecting readonly
    disk configuration even when the requested backend is known to
    support readonly. While it is true that qemu doesn't support
    readonly for emulated IDE or AHCI disks
    
    $ /usr/lib/xen/bin/qemu-system-i386 \
     -drive file=/tmp/disk.raw,if=ide,media=disk,format=raw,readonly=on
    qemu-system-i386: Can't use a read-only drive
    
    $ /usr/lib/xen/bin/qemu-system-i386 -device ahci,id=ahci0 \
     -drive file=/tmp/disk.raw,if=none,id=ahcidisk-0,format=raw,readonly=on \
     -device ide-hd,bus=ahci0.0,unit=0,drive=ahcidisk-0
    qemu-system-i386: -device ide-hd,bus=ahci0.0,unit=0,drive=ahcidisk-0:
    Can't use a read-only drive
    
    It does support readonly SCSI disks
    
    $ /usr/lib/xen/bin/qemu-system-i386 \
     -drive file=/tmp/disk.raw,if=scsi,media=disk,format=raw,readonly=on
    [ok]
    
    Inside a guest using such a disk, the SCSI kernel driver sees write
    protect on
    
    [   7.339232] sd 2:0:1:0: [sdb] Write Protect is on
    
    Also, PV drivers support readonly, but the patch rejects such
    configuration even when PV drivers (vdev=xvd*) have been explicitly
    specified and creation of an emulated twin is skiped.
    
    This follow-up patch loosens the restriction to reject readonly when
    creating an emulated IDE or AHCI disk, but allows it when the backend
    is known to support readonly.
    
    Signed-off-by: Jim Fehlig 
    Acked-by: Stefano Stabellini 
    Acked-by: Ian Campbell 

Index: xen-4.4.3-testing/tools/libxl/libxl_dm.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl_dm.c
+++ xen-4.4.3-testing/tools/libxl/libxl_dm.c
@@ -744,11 +744,6 @@ static char ** libxl__build_device_model
                         (gc, "file=%s,if=ide,index=%d,readonly=%s,media=cdrom,format=%s,cache=writeback,id=ide-%i",
                          disks[i].pdev_path, disk, disks[i].readwrite ? "off" : "on", format, dev_number);
             } else {
-                if (!disks[i].readwrite) {
-                    LIBXL__LOG(ctx, LIBXL__LOG_ERROR, "qemu-xen doesn't support read-only disk drivers");
-                    return NULL;
-                }
-
                 if (disks[i].format == LIBXL_DISK_FORMAT_EMPTY) {
                     LIBXL__LOG(ctx, LIBXL__LOG_WARNING, "cannot support"
                                " empty disk format for %s", disks[i].vdev);
@@ -767,22 +762,27 @@ static char ** libxl__build_device_model
                  * For other disks we translate devices 0..3 into
                  * hd[a-d] and ignore the rest.
                  */
-                if (strncmp(disks[i].vdev, "sd", 2) == 0)
+                if (strncmp(disks[i].vdev, "sd", 2) == 0) {
                     drive = libxl__sprintf
-                        (gc, "file=%s,if=scsi,bus=0,unit=%d,format=%s,cache=writeback",
-                         disks[i].pdev_path, disk, format);
-                else if (strncmp(disks[i].vdev, "xvd", 3) == 0)
+                        (gc, "file=%s,if=scsi,bus=0,unit=%d,format=%s,readonly=%s,cache=writeback",
+                         disks[i].pdev_path, disk, format, disks[i].readwrite ? "off" : "on");
+                } else if (strncmp(disks[i].vdev, "xvd", 3) == 0) {
                     /*
                      * Do not add any emulated disk when PV disk are
                      * explicitly asked for.
                      */
                     continue;
-                else if (disk < 4)
+                } else if (disk < 4) {
+                    if (!disks[i].readwrite) {
+                        LOG(ERROR, "qemu-xen doesn't support read-only IDE disk drivers");
+                        return NULL;
+                    }
                     drive = libxl__sprintf
                         (gc, "file=%s,if=ide,index=%d,media=disk,format=%s,cache=writeback",
                          disks[i].pdev_path, disk, format);
-                else
+                } else {
                     continue; /* Do not emulate this disk */
+                }
             }
 
             flexarray_append(dm_args, "-drive");
++++++ 56544a57-VMX-fix-adjust-trap-injection.patch ++++++
# Commit 81a28f14009f4d8577a81b28dd06f6828112054b
# Date 2015-11-24 12:30:31 +0100
# Author Jan Beulich 
# Committer Jan Beulich 
VMX: fix/adjust trap injection

In the course of investigating the 4.1.6 backport issue of the XSA-156
patch I realized that #DB injection has always been broken, but with it
now getting always intercepted the problem has got worse: Documentation
clearly states that neither DR7.GD nor DebugCtl.LBR get cleared before
the intercept, so this is something we need to do before reflecting the
intercepted exception.

While adjusting this (and also with 4.1.6's strange use of
X86_EVENTTYPE_SW_EXCEPTION for #DB in mind) I further realized that
the special casing of individual vectors shouldn't be done for
software interrupts (resulting from INT $nn).

And then some code movement: Setting of CR2 for #PF can be done in the
same switch() statement (no need for a separate if()), and reading of
intr_info is better done close the the consumption of the variable
(allowing the compiler to generate better code / use fewer registers
for variables).

Signed-off-by: Jan Beulich 
Acked-by: Kevin Tian 

--- a/xen/arch/x86/hvm/vmx/vmx.c
+++ b/xen/arch/x86/hvm/vmx/vmx.c
@@ -1409,16 +1409,7 @@ static void vmx_inject_trap(struct hvm_t
     struct vcpu *curr = current;
     struct hvm_trap _trap = *trap;
 
-    if ( (_trap.vector == TRAP_page_fault) &&
-         (_trap.type == X86_EVENTTYPE_HW_EXCEPTION) )
-        current->arch.hvm_vcpu.guest_cr[2] = _trap.cr2;
-
-    if ( nestedhvm_vcpu_in_guestmode(curr) )
-        intr_info = vcpu_2_nvmx(curr).intr.intr_info;
-    else
-        __vmread(VM_ENTRY_INTR_INFO, &intr_info);
-
-    switch ( _trap.vector )
+    switch ( _trap.vector | -(_trap.type == X86_EVENTTYPE_SW_INTERRUPT) )
     {
     case TRAP_debug:
         if ( guest_cpu_user_regs()->eflags & X86_EFLAGS_TF )
@@ -1426,6 +1417,16 @@ static void vmx_inject_trap(struct hvm_t
             __restore_debug_registers(curr);
             write_debugreg(6, read_debugreg(6) | 0x4000);
         }
+        if ( !nestedhvm_vcpu_in_guestmode(curr) ||
+             !nvmx_intercepts_exception(curr, TRAP_debug, _trap.error_code) )
+        {
+            unsigned long val;
+
+            __vmread(GUEST_DR7, &val);
+            __vmwrite(GUEST_DR7, val & ~DR_GENERAL_DETECT);
+            __vmread(GUEST_IA32_DEBUGCTL, &val);
+            __vmwrite(GUEST_IA32_DEBUGCTL, val & ~IA32_DEBUGCTLMSR_LBR);
+        }
         if ( cpu_has_monitor_trap_flag )
             break;
         /* fall through */
@@ -1436,8 +1437,19 @@ static void vmx_inject_trap(struct hvm_t
             domain_pause_for_debugger();
             return;
         }
+        break;
+
+    case TRAP_page_fault:
+        ASSERT(_trap.type == X86_EVENTTYPE_HW_EXCEPTION);
+        curr->arch.hvm_vcpu.guest_cr[2] = _trap.cr2;
+        break;
     }
 
+    if ( nestedhvm_vcpu_in_guestmode(curr) )
+        intr_info = vcpu_2_nvmx(curr).intr.intr_info;
+    else
+        __vmread(VM_ENTRY_INTR_INFO, &intr_info);
+
     if ( unlikely(intr_info & INTR_INFO_VALID_MASK) &&
          (((intr_info >> 8) & 7) == X86_EVENTTYPE_HW_EXCEPTION) )
     {
++++++ 56546ab2-sched-fix-insert_vcpu-locking.patch ++++++
# Commit ae2f41e3d7e7798537b7ea6dbb9a0c6aeb1179e3
# Date 2015-11-24 14:48:34 +0100
# Author Dario Faggioli 
# Committer Jan Beulich 
sched: fix locking for insert_vcpu() in credit1 and RTDS

The insert_vcpu() hook is handled with inconsistent locking.
In fact, schedule_cpu_switch() calls the hook with runqueue
lock held, while sched_move_domain() relies on the hook
implementations to take the lock themselves (and, since that
is not done in Credit1 and RTDS, such operation is not safe
in those cases).

This is fixed as follows:
 - take the lock in the hook implementations, in specific
   schedulers' code;
 - avoid calling insert_vcpu(), for the idle vCPU, in
   schedule_cpu_switch(). In fact, idle vCPUs are set to run
   immediately, and the various schedulers won't insert them
   in their runqueues anyway, even when explicitly asked to.

While there, still in schedule_cpu_switch(), locking with
_irq() is enough (there's no need to do *_irqsave()).

Signed-off-by: Dario Faggioli 
Reviewed-by: Meng Xu 
Reviewed-by: George Dunlap 

--- a/xen/common/sched_credit.c
+++ b/xen/common/sched_credit.c
@@ -910,9 +910,15 @@ static void
 csched_vcpu_insert(const struct scheduler *ops, struct vcpu *vc)
 {
     struct csched_vcpu *svc = vc->sched_priv;
+    spinlock_t *lock;
+    unsigned long flags;
+
+    lock = vcpu_schedule_lock_irqsave(vc, &flags);
 
     if ( !__vcpu_on_runq(svc) && vcpu_runnable(vc) && !vc->is_running )
         __runq_insert(vc->processor, svc);
+
+    vcpu_schedule_unlock_irqrestore(lock, flags, vc);
 }
 
 static void
--- a/xen/common/schedule.c
+++ b/xen/common/schedule.c
@@ -1418,7 +1418,6 @@ void __init scheduler_init(void)
 
 int schedule_cpu_switch(unsigned int cpu, struct cpupool *c)
 {
-    unsigned long flags;
     struct vcpu *idle;
     spinlock_t *lock;
     void *ppriv, *ppriv_old, *vpriv, *vpriv_old;
@@ -1439,7 +1438,7 @@ int schedule_cpu_switch(unsigned int cpu
         return -ENOMEM;
     }
 
-    lock = pcpu_schedule_lock_irqsave(cpu, &flags);
+    lock = pcpu_schedule_lock_irq(cpu);
 
     SCHED_OP(old_ops, tick_suspend, cpu);
     vpriv_old = idle->sched_priv;
@@ -1448,9 +1447,8 @@ int schedule_cpu_switch(unsigned int cpu
     ppriv_old = per_cpu(schedule_data, cpu).sched_priv;
     per_cpu(schedule_data, cpu).sched_priv = ppriv;
     SCHED_OP(new_ops, tick_resume, cpu);
-    SCHED_OP(new_ops, insert_vcpu, idle);
 
-    pcpu_schedule_unlock_irqrestore(lock, flags, cpu);
+    pcpu_schedule_unlock_irq(lock, cpu);
 
     SCHED_OP(old_ops, free_vdata, vpriv_old);
     SCHED_OP(old_ops, free_pdata, ppriv_old, cpu);
++++++ 56549f24-x86-vPMU-document-as-unsupported.patch ++++++
# Commit c03480cf5c4e96fb4afb2237ad0a3cac7162564a
# Date 2015-11-24 18:32:20 +0100
# Author Jan Beulich 
# Committer Jan Beulich 
x86/vPMU: document as unsupported

This is XSA-163.

Signed-off-by: Jan Beulich 

--- a/docs/misc/xen-command-line.markdown
+++ b/docs/misc/xen-command-line.markdown
@@ -1059,8 +1059,9 @@ feature is switched on on Intel processo
 Note that if **watchdog** option is also specified vpmu will be turned off.
 
 *Warning:*
-As the BTS virtualisation is not 100% safe and because of the nehalem quirk
-don't use the vpmu flag on production systems with Intel cpus!
+As the virtualisation is not 100% safe, don't use the vpmu flag on
+production systems (see Xen Security Advisory 163,
+http://xenbits.xen.org/xsa/advisory-163.html)!
 
 ### watchdog
...
`= force | <boolean>`
++++++ 566052a6-VT-d-drop-unneeded-Ivybridge-quirk-workaround.patch ++++++
# Commit a10307b3912e65bbdd9184ba5fe849d252b75f92
# Date 2015-12-03 15:33:10 +0100
# Author Jan Beulich 
# Committer Jan Beulich 
VT-d: drop unneeded Ivybridge quirk workaround
We've been told by Intel that server chipsets don't need the workaround
anymore starting with Ivybridge (Xeon E5/E7 v2); the second half of the
workaround was missing anyway.

Signed-off-by: Jan Beulich 
Acked-by: Kevin Tian 

--- a/xen/drivers/passthrough/vtd/quirks.c
+++ b/xen/drivers/passthrough/vtd/quirks.c
@@ -404,7 +404,6 @@ void pci_vtd_quirk(const struct pci_dev
      *   - This can cause system failure upon non-fatal VT-d faults.
      *   - Potential security issue if malicious guest trigger VT-d faults.
      */
-    case 0x0e28: /* Xeon-E5v2 (IvyBridge) */
     case 0x342e: /* Tylersburg chipset (Nehalem / Westmere systems) */
     case 0x3728: /* Xeon C5500/C3500 (JasperForest) */
     case 0x3c28: /* Sandybridge */
++++++ 566698e6-x86-time-fix-domain-type-check-in-tsc_set_info.patch ++++++
# Commit 3c80d6f3c61eb0f8072f70b0a9a8c8c7adf17572
# Date 2015-12-08 09:46:30 +0100
# Author Haozhong Zhang 
# Committer Jan Beulich 
x86/time: fix domain type check in tsc_set_info()

Replace is_hvm_domain() in tsc_set_info() by has_hvm_container_domain()
to keep consistent with other domain type checks in tsc_set_info().

Signed-off-by: Haozhong Zhang 
Reviewed-by: Boris Ostrovsky 

--- a/xen/arch/x86/time.c
+++ b/xen/arch/x86/time.c
@@ -1956,7 +1956,7 @@ void tsc_set_info(struct domain *d,
         break;
     }
     d->arch.incarnation = incarnation + 1;
-    if ( is_hvm_domain(d) )
+    if ( has_hvm_container_domain(d) )
         hvm_set_rdtsc_exiting(d, d->arch.vtsc);
 }
 
++++++ 5666d471-memory-split-and-tighten-maximum-order-permitted-in-memops.patch ++++++
# Commit 4a578b316eb98975374d88f28904acf13dbcfac2
# Date 2015-12-08 14:00:33 +0100
# Author Jan Beulich 
# Committer Jan Beulich 
memory: split and tighten maximum order permitted in memops

Introduce and enforce separate limits for ordinary DomU, DomU with
pass-through device(s), control domain, and hardware domain.

The DomU defaults were determined based on what so far was allowed by
multipage_allocation_permitted().

The x86 hwdom default was chosen based on linux-2.6.18-xen.hg c/s
1102:82782f1361a9 indicating 2Mb is not enough, plus some slack.

The ARM hwdom default was chosen to allow 2Mb (order-9) mappings, plus
a little bit of slack.

This is CVE-2015-8338 / XSA-158.

Reported-by: Julien Grall 
Signed-off-by: Jan Beulich 
Acked-by: Ian Campbell 

# Commit ff841cead287d7913901ba5c4e7628a6958b5bea
# Date 2015-12-09 13:53:13 +0100
# Author Jan Beulich 
# Committer Jan Beulich 
memory: fix XSA-158 fix

For one the uses of domu_max_order and ptdom_max_order were swapped.

And then gcc warns about an unused result of a __must_check function
in the control part of a conditional expression when both other
expressions can be determined by the compiler to produce the same value
(see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68039), which happens
when HAS_PASSTHROUGH is undefined (i.e. for ARM on 4.4 and older).

Signed-off-by: Jan Beulich 
Acked-by: Ian Campbell 

--- a/docs/misc/xen-command-line.markdown
+++ b/docs/misc/xen-command-line.markdown
@@ -682,6 +682,17 @@ which data structures should be delibera
 so the crash kernel may find find them.  Should be used in combination
 with **crashinfo_maxaddr**.
 
+### memop-max-order
+> `= [<domU>][,[<ctldom>][,[<hwdom>][,<ptdom>]]]`
+
+> x86 default: `9,18,12,12`
+> ARM default: `9,18,10,10`
+
+Change the maximum order permitted for allocation (or allocation-like)
+requests issued by the various kinds of domains (in this order:
+ordinary DomU, control domain, hardware domain, and - when supported
+by the platform - DomU with pass-through device assigned).
+
 ### max\_cstate
...
`= <integer>`
--- a/xen/common/memory.c
+++ b/xen/common/memory.c
@@ -46,6 +46,52 @@ struct memop_args {
     int          preempted;  /* Was the hypercall preempted? */
 };
 
+#ifndef CONFIG_CTLDOM_MAX_ORDER
+#define CONFIG_CTLDOM_MAX_ORDER CONFIG_PAGEALLOC_MAX_ORDER
+#endif
+#ifndef CONFIG_PTDOM_MAX_ORDER
+#define CONFIG_PTDOM_MAX_ORDER CONFIG_HWDOM_MAX_ORDER
+#endif
+
+static unsigned int __read_mostly domu_max_order = CONFIG_DOMU_MAX_ORDER;
+static unsigned int __read_mostly ctldom_max_order = CONFIG_CTLDOM_MAX_ORDER;
+static unsigned int __read_mostly hwdom_max_order = CONFIG_HWDOM_MAX_ORDER;
+#ifdef HAS_PASSTHROUGH
+static unsigned int __read_mostly ptdom_max_order = CONFIG_PTDOM_MAX_ORDER;
+#endif
+static void __init parse_max_order(const char *s)
+{
+    if ( *s != ',' )
+        domu_max_order = simple_strtoul(s, &s, 0);
+    if ( *s == ',' && *++s != ',' )
+        ctldom_max_order = simple_strtoul(s, &s, 0);
+    if ( *s == ',' && *++s != ',' )
+        hwdom_max_order = simple_strtoul(s, &s, 0);
+#ifdef HAS_PASSTHROUGH
+    if ( *s == ',' && *++s != ',' )
+        ptdom_max_order = simple_strtoul(s, &s, 0);
+#endif
+}
+custom_param("memop-max-order", parse_max_order);
+
+static unsigned int max_order(const struct domain *d)
+{
+    unsigned int order = domu_max_order;
+
+#ifdef HAS_PASSTHROUGH
+    if ( cache_flush_permitted(d) && order < ptdom_max_order )
+        order = ptdom_max_order;
+#endif
+
+    if ( is_control_domain(d) && order < ctldom_max_order )
+        order = ctldom_max_order;
+
+    if ( is_hardware_domain(d) && order < hwdom_max_order )
+        order = hwdom_max_order;
+
+    return min(order, MAX_ORDER + 0U);
+}
+
 static void increase_reservation(struct memop_args *a)
 {
     struct page_info *page;
@@ -58,7 +104,7 @@ static void increase_reservation(struct
                                      a->nr_extents-1) )
         return;
 
-    if ( !multipage_allocation_permitted(current->domain, a->extent_order) )
+    if ( a->extent_order > max_order(current->domain) )
         return;
 
     for ( i = a->nr_done; i < a->nr_extents; i++ )
@@ -103,8 +149,8 @@ static void populate_physmap(struct memo
                                      a->nr_extents-1) )
         return;
 
-    if ( a->memflags & MEMF_populate_on_demand ? a->extent_order > MAX_ORDER :
-         !multipage_allocation_permitted(current->domain, a->extent_order) )
+    if ( a->extent_order > (a->memflags & MEMF_populate_on_demand ? MAX_ORDER :
+                            max_order(current->domain)) )
         return;
 
     for ( i = a->nr_done; i < a->nr_extents; i++ )
@@ -263,7 +309,7 @@ static void decrease_reservation(struct
 
     if ( !guest_handle_subrange_okay(a->extent_list, a->nr_done,
                                      a->nr_extents-1) ||
-         a->extent_order > MAX_ORDER )
+         a->extent_order > max_order(current->domain) )
         return;
 
     for ( i = a->nr_done; i < a->nr_extents; i++ )
@@ -328,13 +374,17 @@ static long memory_exchange(XEN_GUEST_HA
     if ( copy_from_guest(&exch, arg, 1) )
         return -EFAULT;
 
+    if ( max(exch.in.extent_order, exch.out.extent_order) >
+         max_order(current->domain) )
+    {
+        rc = -EPERM;
+        goto fail_early;
+    }
+
     /* Various sanity checks. */
     if ( (exch.nr_exchanged > exch.in.nr_extents) ||
          /* Input and output domain identifiers match? */
          (exch.in.domid != exch.out.domid) ||
-         /* Extent orders are sensible? */
-         (exch.in.extent_order > MAX_ORDER) ||
-         (exch.out.extent_order > MAX_ORDER) ||
          /* Sizes of input and output lists do not overflow a long? */
          ((~0UL >> exch.in.extent_order) < exch.in.nr_extents) ||
          ((~0UL >> exch.out.extent_order) < exch.out.nr_extents) ||
@@ -353,16 +403,6 @@ static long memory_exchange(XEN_GUEST_HA
         goto fail_early;
     }
 
-    /* Only privileged guests can allocate multi-page contiguous extents. */
-    if ( !multipage_allocation_permitted(current->domain,
-                                         exch.in.extent_order) ||
-         !multipage_allocation_permitted(current->domain,
-                                         exch.out.extent_order) )
-    {
-        rc = -EPERM;
-        goto fail_early;
-    }
-
     if ( exch.in.extent_order <= exch.out.extent_order )
     {
         in_chunk_order  = exch.out.extent_order - exch.in.extent_order;
--- a/xen/include/asm-arm/config.h
+++ b/xen/include/asm-arm/config.h
@@ -37,6 +37,10 @@
 
 #define CONFIG_VIDEO 1
 
+#define CONFIG_PAGEALLOC_MAX_ORDER 18
+#define CONFIG_DOMU_MAX_ORDER      9
+#define CONFIG_HWDOM_MAX_ORDER     10
+
 #define OPT_CONSOLE_STR "dtuart"
 
 #ifdef MAX_PHYS_CPUS
--- a/xen/include/asm-arm/iocap.h
+++ b/xen/include/asm-arm/iocap.h
@@ -4,10 +4,6 @@
 #define cache_flush_permitted(d)                        \
     (!rangeset_is_empty((d)->iomem_caps))
 
-#define multipage_allocation_permitted(d, order)        \
-    (((order) <= 9) || /* allow 2MB superpages */       \
-     !rangeset_is_empty((d)->iomem_caps))
-
 #endif
 
 /*
--- a/xen/include/asm-x86/config.h
+++ b/xen/include/asm-x86/config.h
@@ -29,9 +29,12 @@
 #define CONFIG_NUMA 1
 #define CONFIG_DISCONTIGMEM 1
 #define CONFIG_NUMA_EMU 1
-#define CONFIG_PAGEALLOC_MAX_ORDER (2 * PAGETABLE_ORDER)
 #define CONFIG_DOMAIN_PAGE 1
 
+#define CONFIG_PAGEALLOC_MAX_ORDER (2 * PAGETABLE_ORDER)
+#define CONFIG_DOMU_MAX_ORDER      PAGETABLE_ORDER
+#define CONFIG_HWDOM_MAX_ORDER     12
+
 /* Intel P4 currently has largest cache line (L2 line size is 128 bytes). */
 #define CONFIG_X86_L1_CACHE_SHIFT 7
 
--- a/xen/include/asm-x86/iocap.h
+++ b/xen/include/asm-x86/iocap.h
@@ -18,9 +18,4 @@
     (!rangeset_is_empty((d)->iomem_caps) ||             \
      !rangeset_is_empty((d)->arch.ioport_caps))
 
-#define multipage_allocation_permitted(d, order)        \
-    (((order) <= 9) || /* allow 2MB superpages */       \
-     !rangeset_is_empty((d)->iomem_caps) ||             \
-     !rangeset_is_empty((d)->arch.ioport_caps))
-
 #endif /* __X86_IOCAP_H__ */
++++++ 5666d4b7-memory-fix-XENMEM_exchange-error-handling.patch ++++++
References: bsc#956408 CVE-2015-8339 CVE-2015-8340 XSA-159

# Commit eedecb3cf0b2ce1ffc2eb08f3c73f88d42c382c9
# Date 2015-12-08 14:01:43 +0100
# Author Jan Beulich 
# Committer Jan Beulich 
memory: fix XENMEM_exchange error handling

assign_pages() can fail due to the domain getting killed in parallel,
which should not result in a hypervisor crash.

Reported-by: Julien Grall 

Also delete a redundant put_gfn() - all relevant paths leading to the
"fail" label already do this (and there are also paths where it was
plain wrong). All of the put_gfn()-s got introduced by 51032ca058
("Modify naming of queries into the p2m"), including the otherwise
unneeded initializer for k (with even a kind of misleading comment -
the compiler warning could actually have served as a hint that the use
is wrong).

This is CVE-2015-8339 + CVE-2015-8340 / XSA-159.

Signed-off-by: Jan Beulich 
Acked-by: Ian Campbell 

--- a/xen/common/memory.c
+++ b/xen/common/memory.c
@@ -365,7 +365,7 @@ static long memory_exchange(XEN_GUEST_HA
     PAGE_LIST_HEAD(out_chunk_list);
     unsigned long in_chunk_order, out_chunk_order;
     xen_pfn_t     gpfn, gmfn, mfn;
-    unsigned long i, j, k = 0; /* gcc ... */
+    unsigned long i, j, k;
     unsigned int  memflags = 0;
     long          rc = 0;
     struct domain *d;
@@ -596,11 +596,12 @@ static long memory_exchange(XEN_GUEST_HA
  fail:
     /* Reassign any input pages we managed to steal. */
     while ( (page = page_list_remove_head(&in_chunk_list)) )
-    {
-        put_gfn(d, gmfn + k--);
         if ( assign_pages(d, page, 0, MEMF_no_refcount) )
-            BUG();
-    }
+        {
+            BUG_ON(!d->is_dying);
+            if ( test_and_clear_bit(_PGC_allocated, &page->count_info) )
+                put_page(page);
+        }
 
  dying:
     rcu_unlock_domain(d);
++++++ 5666f7ad-libxl-Fix-bootloader-related-virtual-memory-leak-on-pv-build-failure.patch ++++++
References: bsc#956409 CVE-2015-8341 XSA-160

# Commit 40412e3c99722229f1ec93cd95fc8486d778f5df
# Date 2015-12-08 15:30:53 +0000
# Author Ian Jackson 
# Committer Ian Jackson 
libxl: Fix bootloader-related virtual memory leak on pv build failure

The bootloader may call libxl__file_reference_map(), which mmap's the
pv_kernel and pv_ramdisk into process memory.  This was only unmapped,
however, on the success path of libxl__build_pv().  If there were a
failure anywhere between libxl_bootloader.c:parse_bootloader_result()
and the end of libxl__build_pv(), the calls to
libxl__file_reference_unmap() would be skipped, leaking the mapped
virtual memory.

Ideally this would be fixed by adding the unmap calls to the
destruction path for libxl__domain_build_state.  Unfortunately the
lifetime of the libxl__domain_build_state is opaque, and it doesn't
have a proper destruction path.  But, the only thing in it that isn't
from the gc are these bootloader references, and they are only ever
set for one libxl__domain_build_state, the one which is
libxl__domain_create_state.build_state.

So we can clean up in the exit path from libxl__domain_create_*, which
always comes through domcreate_complete.

Remove the now-redundant unmaps in libxl__build_pv's success path.

This is XSA-160.

Signed-off-by: George Dunlap 
Signed-off-by: Ian Jackson 
Tested-by: George Dunlap 
Acked-by: Ian Campbell 

--- a/tools/libxl/libxl_create.c
+++ b/tools/libxl/libxl_create.c
@@ -1322,6 +1322,9 @@ static void domcreate_complete(libxl__eg
     STATE_AO_GC(dcs->ao);
     libxl_domain_config *const d_config = dcs->guest_config;
 
+    libxl__file_reference_unmap(&dcs->build_state.pv_kernel);
+    libxl__file_reference_unmap(&dcs->build_state.pv_ramdisk);
+
     if (!rc && d_config->b_info.exec_ssidref)
         rc = xc_flask_relabel_domain(CTX->xch, dcs->guest_domid, d_config->b_info.exec_ssidref);
 
--- a/tools/libxl/libxl_dom.c
+++ b/tools/libxl/libxl_dom.c
@@ -444,9 +444,6 @@ int libxl__build_pv(libxl__gc *gc, uint3
         state->store_mfn = xc_dom_p2m_host(dom, dom->xenstore_pfn);
     }
 
-    libxl__file_reference_unmap(&state->pv_kernel);
-    libxl__file_reference_unmap(&state->pv_ramdisk);
-
     ret = 0;
 out:
     xc_dom_release(dom);
++++++ CVE-2013-4540-qemu.patch ++++++
References: bnc#864801

Subject: zaurus: fix buffer overrun on invalid state load
From: Michael S. Tsirkin mst@redhat.com Thu Apr 3 19:52:13 2014 +0300
Date: Mon May 5 22:15:02 2014 +0200:
Git: 52f91c3723932f8340fe36c8ec8b18a757c37b2b

CVE-2013-4540

Within scoop_gpio_handler_update, if prev_level has a high bit set, then
we get bit > 16 and that causes a buffer overrun.

Since prev_level comes from wire indirectly, this can
happen on invalid state load.

Similarly for gpio_level and gpio_dir.

To fix, limit to 16 bit.

Reported-by: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
Reviewed-by: Dr. David Alan Gilbert 
Signed-off-by: Juan Quintela 

Index: xen-4.4.1-testing/tools/qemu-xen-dir-remote/hw/gpio/zaurus.c
===================================================================
--- xen-4.4.1-testing.orig/tools/qemu-xen-dir-remote/hw/gpio/zaurus.c
+++ xen-4.4.1-testing/tools/qemu-xen-dir-remote/hw/gpio/zaurus.c
@@ -203,6 +203,15 @@ static bool is_version_0 (void *opaque,
     return version_id == 0;
 }
 
+static bool vmstate_scoop_validate(void *opaque, int version_id)
+{
+    ScoopInfo *s = opaque;
+
+    return !(s->prev_level & 0xffff0000) &&
+        !(s->gpio_level & 0xffff0000) &&
+        !(s->gpio_dir & 0xffff0000);
+}
+
 static const VMStateDescription vmstate_scoop_regs = {
     .name = "scoop",
     .version_id = 1,
@@ -215,6 +224,7 @@ static const VMStateDescription vmstate_
         VMSTATE_UINT32(gpio_level, ScoopInfo),
         VMSTATE_UINT32(gpio_dir, ScoopInfo),
         VMSTATE_UINT32(prev_level, ScoopInfo),
+        VMSTATE_VALIDATE("irq levels are 16 bit", vmstate_scoop_validate),
         VMSTATE_UINT16(mcr, ScoopInfo),
         VMSTATE_UINT16(cdr, ScoopInfo),
         VMSTATE_UINT16(ccr, ScoopInfo),
++++++ CVE-2014-0222-qemut-qcow1-validate-l2-table-size.patch ++++++
References: bsc#877642

Subject: qcow1: Validate L2 table size (CVE-2014-0222)
From: Kevin Wolf kwolf@redhat.com Thu May 15 16:10:11 2014 +0200
Date: Mon May 19 11:36:49 2014 +0200:
Git: 42eb58179b3b215bb507da3262b682b8a2ec10b5

Too large L2 table sizes cause unbounded allocations. Images actually
created by qemu-img only have 512 byte or 4k L2 tables.

To keep things consistent with cluster sizes, allow ranges between 512
bytes and 64k (in fact, down to 1 entry = 8 bytes is technically
working, but L2 table sizes smaller than a cluster don't make a lot of
sense).

This also means that the number of bytes on the virtual disk that are
described by the same L2 table is limited to at most 8k * 64k or 2^29,
preventively avoiding any integer overflows.

Cc: qemu-stable@nongnu.org
Signed-off-by: Kevin Wolf 
Reviewed-by: Benoit Canet 

Index: xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/block-qcow.c
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-traditional-dir-remote/block-qcow.c
+++ xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/block-qcow.c
@@ -126,6 +126,10 @@ static int qcow_open(BlockDriverState *b
         goto fail;
     if (header.size <= 1 || header.cluster_bits < 9)
         goto fail;
+    /* l2_bits specifies number of entries; storing a uint64_t in each entry,
+     * so bytes = num_entries << 3. */
+    if (header.l2_bits < 9 - 3 || header.l2_bits > 16 - 3)
+        goto fail;
     if (header.crypt_method > QCOW_CRYPT_AES)
         goto fail;
     s->crypt_method_header = header.crypt_method;
++++++ CVE-2014-0222-qemuu-qcow1-validate-l2-table-size.patch ++++++
References: bsc#877642

Subject: qcow1: Validate L2 table size (CVE-2014-0222)
From: Kevin Wolf kwolf@redhat.com Thu May 15 16:10:11 2014 +0200
Date: Mon May 19 11:36:49 2014 +0200:
Git: 42eb58179b3b215bb507da3262b682b8a2ec10b5

Too large L2 table sizes cause unbounded allocations. Images actually
created by qemu-img only have 512 byte or 4k L2 tables.

To keep things consistent with cluster sizes, allow ranges between 512
bytes and 64k (in fact, down to 1 entry = 8 bytes is technically
working, but L2 table sizes smaller than a cluster don't make a lot of
sense).

This also means that the number of bytes on the virtual disk that are
described by the same L2 table is limited to at most 8k * 64k or 2^29,
preventively avoiding any integer overflows.

Cc: qemu-stable@nongnu.org
Signed-off-by: Kevin Wolf 
Reviewed-by: Benoit Canet 

Index: xen-4.4.3-testing/tools/qemu-xen-dir-remote/block/qcow.c
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-dir-remote/block/qcow.c
+++ xen-4.4.3-testing/tools/qemu-xen-dir-remote/block/qcow.c
@@ -136,6 +136,13 @@ static int qcow_open(BlockDriverState *b
         goto fail;
     }
 
+    /* l2_bits specifies number of entries; storing a uint64_t in each entry,
+     * so bytes = num_entries << 3. */
+    if (header.l2_bits < 9 - 3 || header.l2_bits > 16 - 3) {
+        ret = -EINVAL;
+        goto fail;
+    }
+
     if (header.crypt_method > QCOW_CRYPT_AES) {
         ret = -EINVAL;
         goto fail;
++++++ CVE-2015-4037-qemut-smb-config-dir-name.patch ++++++
References: bsc#932267

Subject: slirp: use less predictable directory name in /tmp for smb config (CVE-2015-4037)
From: Michael Tokarev mjt@tls.msk.ru Thu May 28 14:12:26 2015 +0300
Date: Wed Jun 3 14:21:45 2015 +0300:
Git: 8b8f1c7e9ddb2e88a144638f6527bf70e32343e3

In this version I used mkdtemp(3) which is:

        _BSD_SOURCE
        || /* Since glibc 2.10: */
            (_POSIX_C_SOURCE >= 200809L || _XOPEN_SOURCE >= 700)

(POSIX.1-2008), so should be available on systems we care about.

While at it, reset the resulting directory name within smb structure
on error so cleanup function wont try to remove directory which we
failed to create.

Signed-off-by: Michael Tokarev 
Reviewed-by: Markus Armbruster 

Index: xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/net.c
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-traditional-dir-remote/net.c
+++ xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/net.c
@@ -624,9 +624,10 @@ void net_slirp_smb(const char *exported_
     }
 
     /* XXX: better tmp dir construction */
-    snprintf(smb_dir, sizeof(smb_dir), "/tmp/qemu-smb.%d", getpid());
-    if (mkdir(smb_dir, 0700) < 0) {
+    snprintf(smb_dir, sizeof(smb_dir), "/tmp/qemu-smb.XXXXXX");
+    if (!mkdtemp(smb_dir)) {
         fprintf(stderr, "qemu: could not create samba server dir '%s'\n", smb_dir);
+        smb_dir[0] = 0;
         exit(1);
     }
     snprintf(smb_conf, sizeof(smb_conf), "%s/%s", smb_dir, "smb.conf");
++++++ CVE-2015-4037-qemuu-smb-config-dir-name.patch ++++++
References: bsc#932267

Subject: slirp: use less predictable directory name in /tmp for smb config (CVE-2015-4037)
From: Michael Tokarev mjt@tls.msk.ru Thu May 28 14:12:26 2015 +0300
Date: Wed Jun 3 14:21:45 2015 +0300:
Git: 8b8f1c7e9ddb2e88a144638f6527bf70e32343e3

In this version I used mkdtemp(3) which is:

        _BSD_SOURCE
        || /* Since glibc 2.10: */
            (_POSIX_C_SOURCE >= 200809L || _XOPEN_SOURCE >= 700)

(POSIX.1-2008), so should be available on systems we care about.

While at it, reset the resulting directory name within smb structure
on error so cleanup function wont try to remove directory which we
failed to create.

Signed-off-by: Michael Tokarev 
Reviewed-by: Markus Armbruster 

Index: xen-4.4.3-testing/tools/qemu-xen-dir-remote/net/slirp.c
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-dir-remote/net/slirp.c
+++ xen-4.4.3-testing/tools/qemu-xen-dir-remote/net/slirp.c
@@ -481,7 +481,6 @@ static void slirp_smb_cleanup(SlirpState
 static int slirp_smb(SlirpState* s, const char *exported_dir,
                      struct in_addr vserver_addr)
 {
-    static int instance;
     char smb_conf[128];
     char smb_cmdline[128];
     struct passwd *passwd;
@@ -505,10 +504,10 @@ static int slirp_smb(SlirpState* s, cons
         return -1;
     }
 
-    snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.%ld-%d",
-             (long)getpid(), instance++);
-    if (mkdir(s->smb_dir, 0700) < 0) {
+    snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.XXXXXX");
+    if (!mkdtemp(s->smb_dir)) {
         error_report("could not create samba server dir '%s'", s->smb_dir);
+        s->smb_dir[0] = 0;
         return -1;
     }
     snprintf(smb_conf, sizeof(smb_conf), "%s/%s", s->smb_dir, "smb.conf");
++++++ CVE-2015-5154-qemut-fix-START-STOP-UNIT-command-completion.patch ++++++
Subject: ATAPI: STARTSTOPUNIT only eject/load media if powercondition is 0
From: Ronnie Sahlberg ronniesahlberg@gmail.com Tue Jul 31 11:28:26 2012 +1000
Date: Wed Sep 12 15:50:09 2012 +0200:
Git: ce560dcf20c14194db5ef3b9fc1ea592d4e68109

The START STOP UNIT command will only eject/load media if
power condition is zero.

If power condition is !0 then LOEJ and START will be ignored.
...
From MMC (sbc contains similar wordings too)
  The Power Conditions field requests the block device to be placed
  in the power condition defined in
  Table 558. If this field has a value other than 0h then the Start
  and LoEj bits shall be ignored.
Signed-off-by: Ronnie Sahlberg 
Signed-off-by: Kevin Wolf 
...
From aa851d30acfbb9580098ac1dc82885530cb8b3c1 Mon Sep 17 00:00:00 2001
From: Kevin Wolf 
Date: Wed, 3 Jun 2015 14:17:46 +0200
Subject: [PATCH 2/3] ide/atapi: Fix START STOP UNIT command completion
The command must be completed on all code paths. START STOP UNIT with
pwrcnd set should succeed without doing anything.

Signed-off-by: Kevin Wolf 
---
 hw/ide/atapi.c | 1 +
 1 file changed, 1 insertion(+)

Index: xen-4.2.5-testing/tools/qemu-xen-traditional-dir-remote/hw/ide.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/ide.c
+++ xen-4.2.5-testing/tools/qemu-xen-traditional-dir-remote/hw/ide.c
@@ -2095,9 +2095,16 @@ static void ide_atapi_cmd(IDEState *s)
         break;
     case GPCMD_START_STOP_UNIT:
         {
-            int start, eject;
+            int start, eject, pwrcnd;
             start = packet[4] & 1;
             eject = (packet[4] >> 1) & 1;
+            pwrcnd = buf[4] & 0xf0;
+
+            if (pwrcnd) {
+                /* eject/load only happens for power condition == 0 */
+                ide_atapi_cmd_ok(s);
+                return;
+            }
 
             if (eject && !start) {
                 /* eject the disk */
++++++ CVE-2015-5239-qemut-limit-client_cut_text-msg-payload-size.patch ++++++
References: bsc#944463

Subject: ui/vnc: limit client_cut_text msg payload size
From: Peter Lieven pl@kamp.de Mon Jun 30 10:07:54 2014 +0200
Date: Tue Jul 1 13:26:40 2014 +0200:
Git: f9a70e79391f6d7c2a912d785239ee8effc1922d

currently a malicious client could define a payload
size of 2^32 - 1 bytes and send up to that size of
data to the vnc server. The server would allocated
that amount of memory which could easily create an
out of memory condition.

This patch limits the payload size to 1MB max.

Please note that client_cut_text messages are currently
silently ignored.

Signed-off-by: Peter Lieven 
Signed-off-by: Gerd Hoffmann 

Index: xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/vnc.c
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-traditional-dir-remote/vnc.c
+++ xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/vnc.c
@@ -1779,14 +1779,21 @@ static int protocol_client_msg(VncState
 	pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
 	break;
     case 6:
-	if (len == 1)
+	if (len == 1) {
 	    return 8;
-
+	}
 	if (len == 8) {
 	    uint32_t v;
 	    v = read_u32(data, 4);
-	    if (v)
+	    if (v > (1 << 20)) {
+		VNC_DEBUG("vnc: client_cut_text msg payload has %u bytes"
+			     " which exceeds our limit of 1MB.", v);
+		vnc_client_error(vs);
+		break;
+	    }
+	    if (v > 0) {
 		return 8 + v;
+	    }
 	}
 
 	client_cut_text(vs, read_u32(data, 4), (char *)(data + 8));
++++++ CVE-2015-5239-qemuu-limit-client_cut_text-msg-payload-size.patch ++++++
References: bsc#944463

Subject: ui/vnc: limit client_cut_text msg payload size
From: Peter Lieven pl@kamp.de Mon Jun 30 10:07:54 2014 +0200
Date: Tue Jul 1 13:26:40 2014 +0200:
Git: f9a70e79391f6d7c2a912d785239ee8effc1922d

currently a malicious client could define a payload
size of 2^32 - 1 bytes and send up to that size of
data to the vnc server. The server would allocated
that amount of memory which could easily create an
out of memory condition.

This patch limits the payload size to 1MB max.

Please note that client_cut_text messages are currently
silently ignored.

Signed-off-by: Peter Lieven 
Signed-off-by: Gerd Hoffmann 

Index: xen-4.4.3-testing/tools/qemu-xen-dir-remote/ui/vnc.c
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-dir-remote/ui/vnc.c
+++ xen-4.4.3-testing/tools/qemu-xen-dir-remote/ui/vnc.c
@@ -2163,13 +2163,20 @@ static int protocol_client_msg(VncState
         pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
         break;
     case VNC_MSG_CLIENT_CUT_TEXT:
-        if (len == 1)
+        if (len == 1) {
             return 8;
-
+        }
         if (len == 8) {
             uint32_t dlen = read_u32(data, 4);
-            if (dlen > 0)
+            if (dlen > (1 << 20)) {
+                error_report("vnc: client_cut_text msg payload has %u bytes"
+                             " which exceeds our limit of 1MB.", dlen);
+                vnc_client_error(vs);
+                break;
+            }
+            if (dlen > 0) {
                 return 8 + dlen;
+            }
         }
 
         client_cut_text(vs, read_u32(data, 4), data + 8);
++++++ CVE-2015-6815-qemut-e1000-fix-infinite-loop.patch ++++++
References: bsc#944697

From: P J P 

While processing transmit descriptors, it could lead to an infinite
loop if 'bytes' was to become zero; Add a check to avoid it.

[The guest can force 'bytes' to 0 by setting the hdr_len and mss
descriptor fields to 0.
--Stefan]

Signed-off-by: P J P 
Signed-off-by: Stefan Hajnoczi 
---
 hw/net/e1000.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Index: xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/hw/e1000.c
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/e1000.c
+++ xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/hw/e1000.c
@@ -470,7 +470,8 @@ process_tx_desc(E1000State *s, struct e1
                 memmove(tp->data, tp->header, hdr);
                 tp->size = hdr;
             }
-        } while (split_size -= bytes);
+            split_size -= bytes;
+        } while (bytes && split_size);
     } else if (!tp->tse && tp->cptse) {
         // context descriptor TSE is not set, while data descriptor TSE is set
         DBGOUT(TXERR, "TCP segmentaion Error\n");
++++++ CVE-2015-6815-qemuu-e1000-fix-infinite-loop.patch ++++++
References: bsc#944697

From: P J P 

While processing transmit descriptors, it could lead to an infinite
loop if 'bytes' was to become zero; Add a check to avoid it.

[The guest can force 'bytes' to 0 by setting the hdr_len and mss
descriptor fields to 0.
--Stefan]

Signed-off-by: P J P 
Signed-off-by: Stefan Hajnoczi 
---
 hw/net/e1000.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Index: xen-4.4.3-testing/tools/qemu-xen-dir-remote/hw/net/e1000.c
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-dir-remote/hw/net/e1000.c
+++ xen-4.4.3-testing/tools/qemu-xen-dir-remote/hw/net/e1000.c
@@ -633,7 +633,8 @@ process_tx_desc(E1000State *s, struct e1
                 memmove(tp->data, tp->header, tp->hdr_len);
                 tp->size = tp->hdr_len;
             }
-        } while (split_size -= bytes);
+            split_size -= bytes;
+        } while (bytes && split_size);
     } else if (!tp->tse && tp->cptse) {
         // context descriptor TSE is not set, while data descriptor TSE is set
         DBGOUT(TXERR, "TCP segmentation error\n");
++++++ CVE-2015-7549-qemuu-pci-null-pointer-dereference-issue.patch ++++++
References: bsc#958918 CVE-2015-7549

Subject: msix: implement pba write (but read-only)
From: Marc-André Lureau marcandre.lureau@redhat.com Fri Jun 26 14:25:29 2015 +0200
Date: Sat Oct 24 18:03:18 2015 +0200:
Git: 43b11a91dd861a946b231b89b7542856ade23d1b

qpci_msix_pending() writes on pba region, causing qemu to SEGV:

  Program received signal SIGSEGV, Segmentation fault.
  [Switching to Thread 0x7ffff7fba8c0 (LWP 25882)]
  0x0000000000000000 in ?? ()
  (gdb) bt
  #0  0x0000000000000000 in  ()
  #1  0x00005555556556c5 in memory_region_oldmmio_write_accessor (mr=0x5555579f3f80, addr=0, value=0x7fffffffbf68, size=4, shift=0, mask=4294967295, attrs=...) at /home/elmarco/src/qemu/memory.c:434
  #2  0x00005555556558e1 in access_with_adjusted_size (addr=0, value=0x7fffffffbf68, size=4, access_size_min=1, access_size_max=4, access=0x55555565563e , mr=0x5555579f3f80, attrs=...) at /home/elmarco/src/qemu/memory.c:506
  #3  0x00005555556581eb in memory_region_dispatch_write (mr=0x5555579f3f80, addr=0, data=0, size=4, attrs=...) at /home/elmarco/src/qemu/memory.c:1176
  #4  0x000055555560b6f9 in address_space_rw (as=0x555555eff4e0 , addr=3759147008, attrs=..., buf=0x7fffffffc1b0 "", len=4, is_write=true) at /home/elmarco/src/qemu/exec.c:2439
  #5  0x000055555560baa2 in cpu_physical_memory_rw (addr=3759147008, buf=0x7fffffffc1b0 "", len=4, is_write=1) at /home/elmarco/src/qemu/exec.c:2534
  #6  0x000055555564c005 in cpu_physical_memory_write (addr=3759147008, buf=0x7fffffffc1b0, len=4) at /home/elmarco/src/qemu/include/exec/cpu-common.h:80
  #7  0x000055555564cd9c in qtest_process_command (chr=0x55555642b890, words=0x5555578de4b0) at /home/elmarco/src/qemu/qtest.c:378
  #8  0x000055555564db77 in qtest_process_inbuf (chr=0x55555642b890, inbuf=0x55555641b340) at /home/elmarco/src/qemu/qtest.c:569
  #9  0x000055555564dc07 in qtest_read (opaque=0x55555642b890, buf=0x7fffffffc2e0 "writel 0xe0100800 0x0\n", size=22) at /home/elmarco/src/qemu/qtest.c:581
  #10 0x000055555574ce3e in qemu_chr_be_write (s=0x55555642b890, buf=0x7fffffffc2e0 "writel 0xe0100800 0x0\n", len=22) at qemu-char.c:306
  #11 0x0000555555751263 in tcp_chr_read (chan=0x55555642bcf0, cond=G_IO_IN, opaque=0x55555642b890) at qemu-char.c:2876
  #12 0x00007ffff64c9a8a in g_main_context_dispatch (context=0x55555641c400) at gmain.c:3122

(without this patch, this can be reproduced with the ivshmem qtest)

Implement an empty mmio write to avoid the crash.

Signed-off-by: Marc-André Lureau 
Reviewed-by: Paolo Bonzini 

Index: xen-4.4.3-testing/tools/qemu-xen-dir-remote/hw/pci/msix.c
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-dir-remote/hw/pci/msix.c
+++ xen-4.4.3-testing/tools/qemu-xen-dir-remote/hw/pci/msix.c
@@ -200,8 +200,14 @@ static uint64_t msix_pba_mmio_read(void
     return pci_get_long(dev->msix_pba + addr);
 }
 
+static void msix_pba_mmio_write(void *opaque, hwaddr addr,
+                                uint64_t val, unsigned size)
+{
+}
+
 static const MemoryRegionOps msix_pba_mmio_ops = {
     .read = msix_pba_mmio_read,
+    .write = msix_pba_mmio_write,
     .endianness = DEVICE_LITTLE_ENDIAN,
     .valid = {
         .min_access_size = 4,
++++++ CVE-2015-8345-qemut-eepro100-infinite-loop-fix.patch ++++++
References: bsc#956832 CVE-2015-8345

From: Prasad J Pandit 
Date: Fri, 16 Oct 2015 11:33:27 +0530
Subject: eepro100: prevent an infinite loop over same command block

action_command() routine executes a chain of commands located
in the Command Block List(CBL). Each Command Block(CB) has a
link to the next CB in the list, given by 's->tx.link'.
This is used in conjunction with the base address 's->cu_base'.

An infinite loop unfolds if the 'link' to the next CB is
same as the previous one, the loop ends up executing the same
command over and over again.

Reported-by: Qinghao Tang 
Signed-off-by: Prasad J Pandit 
---
 hw/net/eepro100.c | 2 ++
 1 file changed, 2 insertions(+)

Index: xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/hw/eepro100.c
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/eepro100.c
+++ xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/hw/eepro100.c
@@ -674,6 +674,8 @@ static void eepro100_cu_command(EEPRO100
       next_command:
         cb_address = s->cu_base + s->cu_offset;
         cpu_physical_memory_read(cb_address, (uint8_t *) & tx, sizeof(tx));
+        if (tx.link == s->cu_offset)
+            break;
         uint16_t status = le16_to_cpu(tx.status);
         uint16_t command = le16_to_cpu(tx.command);
         logout
++++++ CVE-2015-8345-qemuu-eepro100-infinite-loop-fix.patch ++++++
References: bsc#956832 CVE-2015-8345

From: Prasad J Pandit 
Date: Fri, 16 Oct 2015 11:33:27 +0530
Subject: eepro100: prevent an infinite loop over same command block

action_command() routine executes a chain of commands located
in the Command Block List(CBL). Each Command Block(CB) has a
link to the next CB in the list, given by 's->tx.link'.
This is used in conjunction with the base address 's->cu_base'.

An infinite loop unfolds if the 'link' to the next CB is
same as the previous one, the loop ends up executing the same
command over and over again.

Reported-by: Qinghao Tang 
Signed-off-by: Prasad J Pandit 
---
 hw/net/eepro100.c | 2 ++
 1 file changed, 2 insertions(+)

Index: xen-4.4.3-testing/tools/qemu-xen-dir-remote/hw/net/eepro100.c
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-dir-remote/hw/net/eepro100.c
+++ xen-4.4.3-testing/tools/qemu-xen-dir-remote/hw/net/eepro100.c
@@ -863,6 +863,8 @@ static void action_command(EEPRO100State
         uint16_t ok_status = STATUS_OK;
         s->cb_address = s->cu_base + s->cu_offset;
         read_cb(s);
+        if (s->tx.link == s->cu_offset)
+            break;
         bit_el = ((s->tx.command & COMMAND_EL) != 0);
         bit_s = ((s->tx.command & COMMAND_S) != 0);
         bit_i = ((s->tx.command & COMMAND_I) != 0);
++++++ CVE-2015-8504-qemut-vnc-avoid-floating-point-exception.patch ++++++
References: bsc#958493 CVE-2015-8504

Index: xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/vnc.c
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-traditional-dir-remote/vnc.c
+++ xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/vnc.c
@@ -1634,15 +1634,15 @@ static void set_pixel_format(VncState *v
     }
 
     vs->clientds = vs->serverds;
-    vs->clientds.pf.rmax = red_max;
+    vs->clientds.pf.rmax = red_max ? red_max : 0xFF;
     count_bits(vs->clientds.pf.rbits, red_max);
     vs->clientds.pf.rshift = red_shift;
     vs->clientds.pf.rmask = red_max << red_shift;
-    vs->clientds.pf.gmax = green_max;
+    vs->clientds.pf.gmax = green_max ? green_max : 0xFF;
     count_bits(vs->clientds.pf.gbits, green_max);
     vs->clientds.pf.gshift = green_shift;
     vs->clientds.pf.gmask = green_max << green_shift;
-    vs->clientds.pf.bmax = blue_max;
+    vs->clientds.pf.bmax = blue_max ? blue_max : 0xFF;
     count_bits(vs->clientds.pf.bbits, blue_max);
     vs->clientds.pf.bshift = blue_shift;
     vs->clientds.pf.bmask = blue_max << blue_shift;
++++++ CVE-2015-8504-qemuu-vnc-avoid-floating-point-exception.patch ++++++
References: bsc#958493 CVE-2015-8504

Index: xen-4.4.3-testing/tools/qemu-xen-dir-remote/ui/vnc.c
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-dir-remote/ui/vnc.c
+++ xen-4.4.3-testing/tools/qemu-xen-dir-remote/ui/vnc.c
@@ -2034,15 +2034,15 @@ static void set_pixel_format(VncState *v
         return;
     }
 
-    vs->client_pf.rmax = red_max;
+    vs->client_pf.rmax = red_max ? red_max : 0xFF;
     vs->client_pf.rbits = hweight_long(red_max);
     vs->client_pf.rshift = red_shift;
     vs->client_pf.rmask = red_max << red_shift;
-    vs->client_pf.gmax = green_max;
+    vs->client_pf.gmax = green_max ? green_max : 0xFF;
     vs->client_pf.gbits = hweight_long(green_max);
     vs->client_pf.gshift = green_shift;
     vs->client_pf.gmask = green_max << green_shift;
-    vs->client_pf.bmax = blue_max;
+    vs->client_pf.bmax = blue_max ? blue_max : 0xFF;
     vs->client_pf.bbits = hweight_long(blue_max);
     vs->client_pf.bshift = blue_shift;
     vs->client_pf.bmask = blue_max << blue_shift;
++++++ CVE-2015-8558-qemuu-usb-infinite-loop-in-ehci_advance_state-results-in-DoS.patch ++++++
References: bsc#959006

Make ehci_process_itd return an error in case we didn't do any actual
iso transfer because we've found no active transaction.  That'll avoid
ehci happily run in circles forever if the guest builds a loop out of
idts.

Reported-by: Qinghao Tang 
Tested-by: P J P 
Signed-off-by: Gerd Hoffmann 
---
 hw/usb/hcd-ehci.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

Index: xen-4.4.3-testing/tools/qemu-xen-dir-remote/hw/usb/hcd-ehci.c
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-dir-remote/hw/usb/hcd-ehci.c
+++ xen-4.4.3-testing/tools/qemu-xen-dir-remote/hw/usb/hcd-ehci.c
@@ -1457,7 +1457,7 @@ static int ehci_process_itd(EHCIState *e
 {
     USBDevice *dev;
     USBEndpoint *ep;
-    uint32_t i, len, pid, dir, devaddr, endp;
+    uint32_t i, len, pid, dir, devaddr, endp, xfers = 0;
     uint32_t pg, off, ptr1, ptr2, max, mult;
 
     ehci->periodic_sched_active = PERIODIC_ACTIVE;
@@ -1547,9 +1547,10 @@ static int ehci_process_itd(EHCIState *e
                 ehci_raise_irq(ehci, USBSTS_INT);
             }
             itd->transact[i] &= ~ITD_XACT_ACTIVE;
+            xfers++;
         }
     }
-    return 0;
+    return xfers ? 0 : -1;
 }
 
 
++++++ CVE-2015-8568-qemuu-net-vmxnet3-avoid-memory-leakage-in-activate_device.patch ++++++
References: bsc#959386 CVE-2015-8568
...
From 3ef66b01874fcc2fe3bfc73d2b61ee3a5b29fdb6 Mon Sep 17 00:00:00 2001
From: Prasad J Pandit 
Date: Tue, 15 Dec 2015 12:17:28 +0530
Subject: [PATCH] net: vmxnet3: avoid memory leakage in activate_device
Vmxnet3 device emulator does not check if the device is active
before activating it, also it did not free the transmit & receive
buffers while deactivating the device, thus resulting in memory
leakage on the host. This patch fixes both these issues to avoid
host memory leakage.

Reported-by: Qinghao Tang 
Signed-off-by: Prasad J Pandit 
---
hw/net/vmxnet3.c | 24 ++++++++++++++++--------
1 file changed, 16 insertions(+), 8 deletions(-)

Index: xen-4.4.3-testing/tools/qemu-xen-dir-remote/hw/net/vmxnet3.c
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-dir-remote/hw/net/vmxnet3.c
+++ xen-4.4.3-testing/tools/qemu-xen-dir-remote/hw/net/vmxnet3.c
@@ -1134,8 +1134,13 @@ static void vmxnet3_reset_mac(VMXNET3Sta
 
 static void vmxnet3_deactivate_device(VMXNET3State *s)
 {
-    VMW_CBPRN("Deactivating vmxnet3...");
-    s->device_active = false;
+    if (s->device_active) {
+        VMW_CBPRN("Deactivating vmxnet3...");
+        vmxnet_tx_pkt_reset(s->tx_pkt);
+        vmxnet_tx_pkt_uninit(s->tx_pkt);
+        vmxnet_rx_pkt_uninit(s->rx_pkt);
+        s->device_active = false;
+    }
 }
 
 static void vmxnet3_reset(VMXNET3State *s)
@@ -1144,7 +1149,6 @@ static void vmxnet3_reset(VMXNET3State *
 
     vmxnet3_deactivate_device(s);
     vmxnet3_reset_interrupt_states(s);
-    vmxnet_tx_pkt_reset(s->tx_pkt);
     s->drv_shmem = 0;
     s->tx_sop = true;
     s->skip_current_tx_pkt = false;
@@ -1361,6 +1365,12 @@ static void vmxnet3_activate_device(VMXN
         return;
     }
 
+    /* Verify if device is active */
+    if (s->device_active) {
+        VMW_CFPRN("Vmxnet3 device is active");
+        return;
+    }
+
     vmxnet3_adjust_by_guest_type(s);
     vmxnet3_update_features(s);
     vmxnet3_update_pm_state(s);
@@ -1554,7 +1564,7 @@ static void vmxnet3_handle_command(VMXNE
         break;
 
     case VMXNET3_CMD_QUIESCE_DEV:
-        VMW_CBPRN("Set: VMXNET3_CMD_QUIESCE_DEV - pause the device");
+        VMW_CBPRN("Set: VMXNET3_CMD_QUIESCE_DEV - deactivate the device");
         vmxnet3_deactivate_device(s);
         break;
 
@@ -1659,7 +1669,7 @@ vmxnet3_io_bar1_write(void *opaque,
          * shared address only after we get the high part
          */
         if (0 == val) {
-            s->device_active = false;
+            vmxnet3_deactivate_device(s);
         }
         s->temp_shared_guest_driver_memory = val;
         s->drv_shmem = 0;
@@ -1939,9 +1949,7 @@ static bool vmxnet3_peer_has_vnet_hdr(VM
 static void vmxnet3_net_uninit(VMXNET3State *s)
 {
     g_free(s->mcast_list);
-    vmxnet_tx_pkt_reset(s->tx_pkt);
-    vmxnet_tx_pkt_uninit(s->tx_pkt);
-    vmxnet_rx_pkt_uninit(s->rx_pkt);
+    vmxnet3_deactivate_device(s);
     qemu_del_nic(s->nic);
 }
 
++++++ README.SUSE ++++++
++++ 643 lines (skipped)

++++++ VNC-Support-for-ExtendedKeyEvent-client-message.patch ++++++
...
From 9ca313aa0824f2d350a7a6c9b1ef6c47e0408f1d Mon Sep 17 00:00:00 2001
From: aliguori 
Date: Sat, 23 Aug 2008 23:27:37 +0000
Subject: [PATCH] VNC: Support for ExtendedKeyEvent client message
This patch adds support for the ExtendedKeyEvent client message.  This message
allows a client to send raw scan codes directly to the server.  If the client
and server are using the same keymap, then it's unnecessary to use the '-k'
option with QEMU when this extension is supported.

This is extension is currently only implemented by gtk-vnc based clients
(gvncviewer, virt-manager, vinagre, etc.).

Signed-off-by: Anthony Liguori 



git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5076 c046a42c-6fe2-441c-8c8c-71466251a162
---
 vnc.c |   59 ++++++++++++++++++++++++++++++++++++++++++++++++++---------
 1 files changed, 50 insertions(+), 9 deletions(-)

Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/vnc.c
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/vnc.c
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/vnc.c
@@ -1285,35 +1285,22 @@ static void press_key_altgr_down(VncStat
     }
 }
 
-static void do_key_event(VncState *vs, int down, uint32_t sym)
+static void do_key_event(VncState *vs, int down, int keycode, int sym, int shift)
 {
-    int keycode;
     int shift_keys = 0;
-    int shift = 0;
     int keypad = 0;
     int altgr = 0;
     int altgr_keys = 0;
 
     if (is_graphic_console()) {
-        if (sym >= 'A' && sym <= 'Z') {
-            sym = sym - 'A' + 'a';
-            shift = 1;
-        }
-        else {
+        if (!shift)
             shift = keysym_is_shift(vs->kbd_layout, sym & 0xFFFF);
-        }
 
         altgr = keysym_is_altgr(vs->kbd_layout, sym & 0xFFFF);
     }
     shift_keys = vs->modifiers_state[0x2a] | vs->modifiers_state[0x36];
     altgr_keys = vs->modifiers_state[0xb8];
 
-    keycode = keysym2scancode(vs->kbd_layout, sym & 0xFFFF);
-    if (keycode == 0) {
-        fprintf(stderr, "Key lost : keysym=0x%x(%d)\n", sym, sym);
-        return;
-    }
-
     /* QEMU console switch */
     switch(keycode) {
     case 0x2a:                          /* Left Shift */
@@ -1445,7 +1432,25 @@ static void do_key_event(VncState *vs, i
 
 static void key_event(VncState *vs, int down, uint32_t sym)
 {
-    do_key_event(vs, down, sym);
+    int keycode;
+    int shift = 0;
+
+    if (sym >= 'A' && sym <= 'Z' && is_graphic_console()) {
+       sym = sym - 'A' + 'a';
+       shift = 1;
+    }
+    keycode = keysym2scancode(vs->kbd_layout, sym & 0xFFFF);
+    do_key_event(vs, down, keycode, sym, shift);
+}
+
+static void ext_key_event(VncState *vs, int down,
+                          uint32_t sym, uint16_t keycode)
+{
+    /* if the user specifies a keyboard layout, always use it */
+    if (keyboard_layout)
+        key_event(vs, down, sym);
+    else
+        do_key_event(vs, down, keycode, sym, 0);
 }
 
 static void framebuffer_set_updated(VncState *vs, int x, int y, int w, int h)
@@ -1534,6 +1539,15 @@ static void framebuffer_update_request(V
     qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock));
 }
 
+static void send_ext_key_event_ack(VncState *vs)
+{
+    vnc_write_u8(vs, 0);
+    vnc_write_u8(vs, 0);
+    vnc_write_u16(vs, 1);
+    vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds), -258);
+    vnc_flush(vs);
+}
+
 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
 {
     int i;
@@ -1562,6 +1576,9 @@ static void set_encodings(VncState *vs,
 	case -257:
 	    vs->has_pointer_type_change = 1;
 	    break;
+        case -258:
+            send_ext_key_event_ack(vs);
+            break;
         case 0x574D5669:
             vs->has_WMVi = 1;
 	default:
@@ -1774,6 +1791,24 @@ static int protocol_client_msg(VncState
 
 	client_cut_text(vs, read_u32(data, 4), (char *)(data + 8));
 	break;
+    case 255:
+        if (len == 1)
+            return 2;
+
+        switch (read_u8(data, 1)) {
+        case 0:
+            if (len == 2)
+                return 12;
+
+            ext_key_event(vs, read_u16(data, 2),
+                          read_u32(data, 4), read_u32(data, 8));
+            break;
+        default:
+            printf("Msg: %d\n", read_u16(data, 0));
+            vnc_client_error(vs);
+            break;
+        }
+        break;
     default:
 	printf("Msg: %d\n", data[0]);
 	vnc_client_error(vs);
@@ -2445,10 +2480,11 @@ void vnc_display_init(DisplayState *ds)
 
     vs->ds = ds;
 
-    if (!keyboard_layout)
-	keyboard_layout = "en-us";
+    if (keyboard_layout)
+        vs->kbd_layout = init_keyboard_layout(keyboard_layout);
+    else
+        vs->kbd_layout = init_keyboard_layout("en-us");
 
-    vs->kbd_layout = init_keyboard_layout(keyboard_layout);
     if (!vs->kbd_layout)
 	exit(1);
     vs->modifiers_state[0x45] = 1; /* NumLock on - on boot */
++++++ aarch64-rename-PSR_MODE_ELxx-to-match-linux-headers.patch ++++++
...
From 98abe3b337e69371678859c4cfd19df61aebb0d9 Mon Sep 17 00:00:00 2001
From: Olaf Hering 
Date: Sun, 2 Feb 2014 20:42:42 +0100
Subject: aarch64: rename PSR_MODE_ELxx to match linux headers
https://bugs.launchpad.net/linaro-aarch64/+bug/1169164

Signed-off-by: Olaf Hering 
---
 xen/include/public/arch-arm.h | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/xen/include/public/arch-arm.h b/xen/include/public/arch-arm.h
index 7496556..95f2a7c 100644
--- a/xen/include/public/arch-arm.h
+++ b/xen/include/public/arch-arm.h
@@ -342,13 +342,13 @@ typedef uint64_t xen_callback_t;
 
 /* 64 bit modes */
 #define PSR_MODE_BIT  0x10 /* Set iff AArch32 */
-#define PSR_MODE_EL3h 0x0d
-#define PSR_MODE_EL3t 0x0c
-#define PSR_MODE_EL2h 0x09
-#define PSR_MODE_EL2t 0x08
-#define PSR_MODE_EL1h 0x05
-#define PSR_MODE_EL1t 0x04
-#define PSR_MODE_EL0t 0x00
+#define PSR_MODE_EL3h 0x0000000d
+#define PSR_MODE_EL3t 0x0000000c
+#define PSR_MODE_EL2h 0x00000009
+#define PSR_MODE_EL2t 0x00000008
+#define PSR_MODE_EL1h 0x00000005
+#define PSR_MODE_EL1t 0x00000004
+#define PSR_MODE_EL0t 0x00000000
 
 #define PSR_GUEST32_INIT  (PSR_ABT_MASK|PSR_FIQ_MASK|PSR_IRQ_MASK|PSR_MODE_SVC)
 #define PSR_GUEST64_INIT (PSR_ABT_MASK|PSR_FIQ_MASK|PSR_IRQ_MASK|PSR_MODE_EL1h)
++++++ add-qxl-support.patch ++++++
Usage:
  vga="qxl"

Qxl vga support many resolutions that not supported by stdvga,
mainly the 16:9 ones and other high up to 2560x1600.
With QXL you can get improved performance and smooth video also
with high resolutions and high quality.
Require their drivers installed in the domU and spice used
otherwise act as a simple stdvga.

Signed-off-by: Fabio Fantoni 
Signed-off-by: Zhou Peng 
Acked-by: Stefano Stabellini 
Acked-by: Ian Jackson 
Acked-by: George Dunlap 

---

Changes in v16:
- refresh
- improved commit description

Changes in v15:
- refresh
- small code improvements in libxl_dm.c

Changes in v14:
- refresh
- update qemu parameters (from -vga to -device)

NOTES:
Works correctly with windows domUs, tested on windows 7 64 bit
with qxl driver from spice guest tools 0.74.
I tested some resolution not supported by stdvga (1366x768, 1600x900
and 1920x1080) with 32 bit color and all works good equal to kvm.
For now not works on linux domUs when xorg have 100% cpu and black
screen with qxl driver installed.
Seems needed other changes/fixes on xen and/or xorg/qxl driver side
before have it full working with linux domUs.
---
 docs/man/xl.cfg.pod.5       |   10 +++++++++-
 tools/libxl/libxl_create.c  |   13 +++++++++++++
 tools/libxl/libxl_dm.c      |    8 ++++++++
 tools/libxl/libxl_types.idl |    1 +
 tools/libxl/xl_cmdimpl.c    |    2 ++
 5 files changed, 33 insertions(+), 1 deletion(-)

Index: xen-4.4.3-testing/docs/man/xl.cfg.pod.5
===================================================================
--- xen-4.4.3-testing.orig/docs/man/xl.cfg.pod.5
+++ xen-4.4.3-testing/docs/man/xl.cfg.pod.5
@@ -1084,6 +1084,9 @@ qemu-xen-traditional device-model, the a
 which is sufficient for 1024x768 at 32 bpp. For the upstream qemu-xen
 device-model, the default and minimum is 8 MB.
 
+For B<qxl> vga, the default is both default and minimal 128MB.
+If B<videoram> is set less than 128MB, an error will be triggered.
+
 =item B
 
 Select a standard VGA card with VBE (VESA BIOS Extensions) as the
@@ -1095,9 +1098,14 @@ This option is deprecated, use vga="stdv
 
 =item B
 
-Selects the emulated video card (none|stdvga|cirrus).
+Selects the emulated video card (none|stdvga|cirrus|qxl).
 The default is cirrus.
 
+In general, QXL should work with the Spice remote display protocol
+for acceleration, and QXL driver is necessary in guest in this case.
+QXL can also work with the VNC protocol, but it will be like a standard
+VGA without acceleration.
+
 =item B
 
 Allow access to the display via the VNC protocol.  This enables the
Index: xen-4.4.3-testing/tools/libxl/libxl_create.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl_create.c
+++ xen-4.4.3-testing/tools/libxl/libxl_create.c
@@ -230,6 +230,10 @@ int libxl__domain_build_info_setdefault(
                 if (b_info->video_memkb == LIBXL_MEMKB_DEFAULT)
                     b_info->video_memkb = 0;
                 break;
+            case LIBXL_VGA_INTERFACE_TYPE_QXL:
+                LOG(ERROR,"qemu upstream required for qxl vga");
+                return ERROR_INVAL;
+                break;
             case LIBXL_VGA_INTERFACE_TYPE_STD:
                 if (b_info->video_memkb == LIBXL_MEMKB_DEFAULT)
                     b_info->video_memkb = 8 * 1024;
@@ -254,6 +258,15 @@ int libxl__domain_build_info_setdefault(
                 if (b_info->video_memkb == LIBXL_MEMKB_DEFAULT)
                     b_info->video_memkb = 0;
                 break;
+            case LIBXL_VGA_INTERFACE_TYPE_QXL:
+                if (b_info->video_memkb == LIBXL_MEMKB_DEFAULT) {
+                    b_info->video_memkb = (128 * 1024);
+                } else if (b_info->video_memkb < (128 * 1024)) {
+                    LOG(ERROR,
+                        "128 Mib videoram is the minimum for qxl default");
+                    return ERROR_INVAL;
+                }
+                break;
             case LIBXL_VGA_INTERFACE_TYPE_STD:
                 if (b_info->video_memkb == LIBXL_MEMKB_DEFAULT)
                     b_info->video_memkb = 16 * 1024;
Index: xen-4.4.3-testing/tools/libxl/libxl_dm.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl_dm.c
+++ xen-4.4.3-testing/tools/libxl/libxl_dm.c
@@ -235,6 +235,8 @@ static char ** libxl__build_device_model
         case LIBXL_VGA_INTERFACE_TYPE_NONE:
             flexarray_append_pair(dm_args, "-vga", "none");
             break;
+        case LIBXL_VGA_INTERFACE_TYPE_QXL:
+            break;
         }
 
         if (b_info->u.hvm.boot) {
@@ -563,6 +565,12 @@ static char ** libxl__build_device_model
             break;
         case LIBXL_VGA_INTERFACE_TYPE_NONE:
             break;
+        case LIBXL_VGA_INTERFACE_TYPE_QXL:
+            /* QXL have 2 ram regions, ram and vram */
+            flexarray_append_pair(dm_args, "-device",
+                GCSPRINTF("qxl-vga,vram_size_mb=%"PRIu64",ram_size_mb=%"PRIu64,
+                (b_info->video_memkb/2/1024), (b_info->video_memkb/2/1024) ) );
+            break;
         }
 
         if (b_info->u.hvm.boot) {
Index: xen-4.4.3-testing/tools/libxl/libxl_types.idl
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl_types.idl
+++ xen-4.4.3-testing/tools/libxl/libxl_types.idl
@@ -154,6 +154,7 @@ libxl_vga_interface_type = Enumeration("
     (1, "CIRRUS"),
     (2, "STD"),
     (3, "NONE"),
+    (4, "QXL"),
     ], init_val = 1)
 
 libxl_vendor_device = Enumeration("vendor_device", [
Index: xen-4.4.3-testing/tools/libxl/xl_cmdimpl.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/xl_cmdimpl.c
+++ xen-4.4.3-testing/tools/libxl/xl_cmdimpl.c
@@ -1678,6 +1678,8 @@ skip_vfb:
                 b_info->u.hvm.vga.kind = LIBXL_VGA_INTERFACE_TYPE_CIRRUS;
             } else if (!strcmp(buf, "none")) {
                 b_info->u.hvm.vga.kind = LIBXL_VGA_INTERFACE_TYPE_NONE;
+            } else if (!strcmp(buf, "qxl")) {
+                b_info->u.hvm.vga.kind = LIBXL_VGA_INTERFACE_TYPE_QXL;
             } else {
                 fprintf(stderr, "Unknown vga \"%s\" specified\n", buf);
                 exit(1);
++++++ altgr_2.patch ++++++
When access domU from Windows VNC client, spanish keyboard altgr key 
doesn't work. According to log info, we found that the keycodes passed
from vncclient to qemu vncserver have something wrong. When altgr and "2"
pressed, keycodes vncserver receives are:
ALT_R down, 
CTRL_L down, 
CTRL_L up,
ATL_R up, 
"2" down,
"2" up,
...
Since when send "2" down, there is no altgr modifier, the char displayed 
on screen will be "2" but not "@".

To solve this problem, there is another patch applied by upstream which 
sends an additional altgr modifier before "2" down in the above case. 
It works well when domU is windows, but on sles10 sp3 domU, sometimes it
display "@" and sometimes it still displays "2", especially when press 
altgr+2 continuously.

For the sles10 sp3 domU problem, maybe because there are two many alt_r (same 
keycode as altgr on "es") up and down events and the domU OS couldn't handle
it well. 

To furtherly solve this problem, I write this patch, when vncserver
is "es" and receives a alt_r keysym (this is already abnormal since "es" has
no alt_r), then treat the alt_r as alt_l. This can avoid too many altgr 
keycodes up and down events and make sure the intentionally added altgr keycode can take effect.

Signed-off by Chunyan Liu (cyliu@novell.com)

Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/vnc.c
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/vnc.c
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/vnc.c
@@ -1440,6 +1440,9 @@ static void key_event(VncState *vs, int
     int keycode;
     int shift = 0;
 
+    if ( sym == 0xffea && keyboard_layout && !strcmp(keyboard_layout,"es") )
+        sym = 0xffe9;
+
     if (sym >= 'A' && sym <= 'Z' && is_graphic_console()) {
        sym = sym - 'A' + 'a';
        shift = 1;
++++++ baselibs.conf ++++++
xen-libs
++++++ bdrv_default_rwflag.patch ++++++
Subject: modify default read/write flag in bdrv_init.
Signed-off by Chunyan Liu 

Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/vl.c
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/vl.c
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/vl.c
@@ -2627,6 +2627,8 @@ int drive_init(struct drive_opt *arg, in
     strncpy(drives_table[nb_drives].serial, serial, sizeof(serial));
     nb_drives++;
 
+    bdrv_flags = BDRV_O_RDWR;
+
     switch(type) {
     case IF_IDE:
     case IF_XEN:
@@ -2640,6 +2642,7 @@ int drive_init(struct drive_opt *arg, in
 	    break;
 	case MEDIA_CDROM:
             bdrv_set_type_hint(bdrv, BDRV_TYPE_CDROM);
+            bdrv_flags &= ~BDRV_O_RDWR;
 	    break;
 	}
         break;
@@ -2660,7 +2663,6 @@ int drive_init(struct drive_opt *arg, in
     }
     if (!file[0])
         return -2;
-    bdrv_flags = 0;
     if (snapshot) {
         bdrv_flags |= BDRV_O_SNAPSHOT;
         cache = 2; /* always use write-back with snapshot */
++++++ bdrv_open2_fix_flags.patch ++++++
Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/block.c
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/block.c
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/block.c
@@ -350,7 +350,7 @@ int bdrv_file_open(BlockDriverState **pb
 
 int bdrv_open(BlockDriverState *bs, const char *filename, int flags)
 {
-    return bdrv_open2(bs, filename, flags, NULL);
+    return bdrv_open2(bs, filename, flags|BDRV_O_RDWR, NULL);
 }
 
 int bdrv_open2(BlockDriverState *bs, const char *filename, int flags,
@@ -419,12 +419,13 @@ int bdrv_open2(BlockDriverState *bs, con
     }
     bs->drv = drv;
     bs->opaque = qemu_mallocz(drv->instance_size);
-    /* Note: for compatibility, we open disk image files as RDWR, and
-       RDONLY as fallback */
     if (!(flags & BDRV_O_FILE))
-        open_flags = (flags & BDRV_O_ACCESS) | (flags & BDRV_O_CACHE_MASK);
+        open_flags = flags;
     else
         open_flags = flags & ~(BDRV_O_FILE | BDRV_O_SNAPSHOT);
+    if (!(open_flags & BDRV_O_RDWR))
+        bs->read_only = 1;
+
     ret = drv->bdrv_open(bs, filename, open_flags);
     if ((ret == -EACCES || ret == -EPERM) && !(flags & BDRV_O_FILE)) {
         ret = drv->bdrv_open(bs, filename, open_flags & ~BDRV_O_RDWR);
Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/usb-msd.c
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/usb-msd.c
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/usb-msd.c
@@ -551,7 +551,7 @@ USBDevice *usb_msd_init(const char *file
     s = qemu_mallocz(sizeof(MSDState));
 
     bdrv = bdrv_new("usb");
-    if (bdrv_open2(bdrv, filename, 0, drv) < 0)
+    if (bdrv_open2(bdrv, filename, BDRV_O_RDWR, drv) < 0)
         goto fail;
     s->bs = bdrv;
     *pbs = bdrv;
Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/qemu-img.c
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/qemu-img.c
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/qemu-img.c
@@ -32,7 +32,7 @@
 #endif
 
 /* Default to cache=writeback as data integrity is not important for qemu-tcg. */
-#define BRDV_O_FLAGS BDRV_O_CACHE_WB
+#define BDRV_O_FLAGS BDRV_O_CACHE_WB
 
 static void QEMU_NORETURN error(const char *fmt, ...)
 {
@@ -185,7 +185,7 @@ static int read_password(char *buf, int
 #endif
 
 static BlockDriverState *bdrv_new_open(const char *filename,
-                                       const char *fmt)
+                                       const char *fmt, int flags)
 {
     BlockDriverState *bs;
     BlockDriver *drv;
@@ -201,7 +201,7 @@ static BlockDriverState *bdrv_new_open(c
     } else {
         drv = &bdrv_raw;
     }
-    if (bdrv_open2(bs, filename, BRDV_O_FLAGS, drv) < 0) {
+    if (bdrv_open2(bs, filename, flags, drv) < 0) {
         error("Could not open '%s'", filename);
     }
     if (bdrv_is_encrypted(bs)) {
@@ -253,7 +253,7 @@ static int img_create(int argc, char **a
     size = 0;
     if (base_filename) {
         BlockDriverState *bs;
-        bs = bdrv_new_open(base_filename, NULL);
+        bs = bdrv_new_open(base_filename, NULL, BDRV_O_RDWR);
         bdrv_get_geometry(bs, &size);
         size *= 512;
         bdrv_delete(bs);
@@ -332,7 +332,7 @@ static int img_commit(int argc, char **a
     } else {
         drv = NULL;
     }
-    if (bdrv_open2(bs, filename, BRDV_O_FLAGS, drv) < 0) {
+    if (bdrv_open2(bs, filename, BDRV_O_RDWR, drv) < 0) {
         error("Could not open '%s'", filename);
     }
     ret = bdrv_commit(bs);
@@ -455,7 +455,8 @@ static int img_convert(int argc, char **
 
     total_sectors = 0;
     for (bs_i = 0; bs_i < bs_n; bs_i++) {
-        bs[bs_i] = bdrv_new_open(argv[optind + bs_i], fmt);
+        bs[bs_i] = bdrv_new_open(argv[optind + bs_i], fmt,
+					BDRV_O_CACHE_WB|BDRV_O_RDONLY);
         if (!bs[bs_i])
             error("Could not open '%s'", argv[optind + bs_i]);
         bdrv_get_geometry(bs[bs_i], &bs_sectors);
@@ -483,7 +484,7 @@ static int img_convert(int argc, char **
         }
     }
 
-    out_bs = bdrv_new_open(out_filename, out_fmt);
+    out_bs = bdrv_new_open(out_filename, out_fmt, BDRV_O_CACHE_WB|BDRV_O_RDWR);
 
     bs_i = 0;
     bs_offset = 0;
@@ -706,7 +707,7 @@ static int img_info(int argc, char **arg
     } else {
         drv = NULL;
     }
-    if (bdrv_open2(bs, filename, BRDV_O_FLAGS, drv) < 0) {
+    if (bdrv_open2(bs, filename, BDRV_O_FLAGS|BDRV_O_RDWR, drv) < 0) {
         error("Could not open '%s'", filename);
     }
     bdrv_get_format(bs, fmt_name, sizeof(fmt_name));
@@ -810,7 +811,7 @@ static void img_snapshot(int argc, char
     if (!bs)
         error("Not enough memory");
 
-    if (bdrv_open2(bs, filename, 0, NULL) < 0) {
+    if (bdrv_open2(bs, filename, BDRV_O_RDWR, NULL) < 0) {
         error("Could not open '%s'", filename);
     }
 
++++++ bdrv_open2_flags_2.patch ++++++
Index: xen-4.4.0-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_blktap.c
===================================================================
--- xen-4.4.0-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/xen_blktap.c
+++ xen-4.4.0-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_blktap.c
@@ -225,6 +225,7 @@ static int open_disk(struct td_state *s,
 	BlockDriver* drv;
 	char* devname;
 	static int devnumber = 0;
+	int flags = readonly ? BDRV_O_RDONLY : BDRV_O_RDWR;
 	int i;
 
 	DPRINTF("Opening %s as blktap%d\n", path, devnumber);
@@ -247,7 +248,7 @@ static int open_disk(struct td_state *s,
 	DPRINTF("%s driver specified\n", drv ? drv->format_name : "No");
 
 	/* Open the image */
-	if (bdrv_open2(bs, path, 0, drv) != 0) {
+	if (bdrv_open2(bs, path, flags, drv) != 0) {
 		fprintf(stderr, "Could not open image file %s\n", path);
 		return -ENOMEM;
 	}
Index: xen-4.4.0-testing/tools/qemu-xen-traditional-dir-remote/xenstore.c
===================================================================
--- xen-4.4.0-testing.orig/tools/qemu-xen-traditional-dir-remote/xenstore.c
+++ xen-4.4.0-testing/tools/qemu-xen-traditional-dir-remote/xenstore.c
@@ -135,7 +135,8 @@ static void insert_media(void *opaque)
             else 
                 format = &bdrv_raw;
 
-            bdrv_open2(bs, media_filename[i], 0, format);
+            /* Temporary BDRV_O_RDWR */
+            bdrv_open2(bs, media_filename[i], BDRV_O_RDWR, format);
 #ifdef CONFIG_STUBDOM
             {
                 char *buf, *backend, *params_path, *params;
@@ -510,7 +511,8 @@ void xenstore_parse_domain_config(int hv
     }
         
     for (i = 0; i < num; i++) {
-	format = NULL; /* don't know what the format is yet */
+        flags = 0;
+        format = NULL; /* don't know what the format is yet */
         /* read the backend path */
         xenstore_get_backend_path(&bpath, "vbd", danger_path, hvm_domid, e_danger[i]);
         if (bpath == NULL)
@@ -596,6 +598,17 @@ void xenstore_parse_domain_config(int hv
 	    format = &bdrv_raw;
         }
 
+        /* read the mode of the device */
+        if (pasprintf(&buf, "%s/mode", bpath) == -1)
+            continue;
+        free(mode);
+        mode = xs_read(xsh, XBT_NULL, buf, &len);
+
+        if (!strcmp(mode, "r") || !strcmp(mode, "ro"))
+            flags |= BDRV_O_RDONLY;
+        if (!strcmp(mode, "w") || !strcmp(mode, "rw"))
+            flags |= BDRV_O_RDWR;
+
 #if 0
 	/* Phantom VBDs are disabled because the use of paths
 	 * from guest-controlled areas in xenstore is unsafe.
@@ -663,7 +676,7 @@ void xenstore_parse_domain_config(int hv
 #ifdef CONFIG_STUBDOM
         if (pasprintf(&danger_buf, "%s/device/vbd/%s", danger_path, e_danger[i]) == -1)
             continue;
-	if (bdrv_open2(bs, danger_buf, BDRV_O_CACHE_WB /* snapshot and write-back */, &bdrv_raw) == 0) {
+	if (bdrv_open2(bs, danger_buf, flags|BDRV_O_CACHE_WB /* snapshot and write-back */, &bdrv_raw) == 0) {
         if (pasprintf(&buf, "%s/params", bpath) == -1)
                 continue;
         free(params);
++++++ blktap-control-socket-race.patch ++++++
References: bnc#919098

Index: xen-4.4.1-testing/tools/blktap/drivers/blktapctrl.c
===================================================================
--- xen-4.4.1-testing.orig/tools/blktap/drivers/blktapctrl.c
+++ xen-4.4.1-testing/tools/blktap/drivers/blktapctrl.c
@@ -570,13 +570,13 @@ static int connect_qemu(blkif_t *blkif,
 		 * disconnected. Check if it is still running.
 		 */
 		if (tapdisk_ioemu_pid == 0 || kill(tapdisk_ioemu_pid, 0)) {
+			dom0_readfd = open_ctrl_socket(wrctldev);
+			dom0_writefd = open_ctrl_socket(rdctldev);
+
 			/* No device model and tapdisk-ioemu doesn't run yet */
 			DPRINTF("Launching tapdisk-ioemu\n");
 			launch_tapdisk_ioemu();
 			
-			dom0_readfd = open_ctrl_socket(wrctldev);
-			dom0_writefd = open_ctrl_socket(rdctldev);
-
 			refresh_pid = 1;
 		}
 
++++++ blktap-pv-cdrom.patch ++++++
++++ 834 lines (skipped)

++++++ blktap.patch ++++++
bug #239173
bug #242953

Index: xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendDomainInfo.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
@@ -3281,7 +3281,7 @@ class XendDomainInfo:
                          (fn, BOOTLOADER_LOOPBACK_DEVICE))
 
                 vbd = {
-                    'mode': 'RO',
+                    'mode': 'RW',
                     'device': BOOTLOADER_LOOPBACK_DEVICE,
                     }
 
Index: xen-4.4.0-testing/tools/qemu-xen-traditional-dir-remote/xenstore.c
===================================================================
--- xen-4.4.0-testing.orig/tools/qemu-xen-traditional-dir-remote/xenstore.c
+++ xen-4.4.0-testing/tools/qemu-xen-traditional-dir-remote/xenstore.c
@@ -447,9 +447,9 @@ void xenstore_parse_domain_config(int hv
 {
     char **e_danger = NULL;
     char *buf = NULL;
-    char *fpath = NULL, *bpath = NULL,
+    char *fpath = NULL, *bpath = NULL, *btype = NULL,
         *dev = NULL, *params = NULL, *drv = NULL;
-    int i, ret;
+    int i, ret, is_tap;
     unsigned int len, num, hd_index, pci_devid = 0;
     BlockDriverState *bs;
     BlockDriver *format;
@@ -486,6 +486,14 @@ void xenstore_parse_domain_config(int hv
 				  e_danger[i]);
         if (bpath == NULL)
             continue;    
+        /* check to see if type is tap or not */
+        if (pasprintf(&buf, "%s/type", bpath) == -1)
+            continue;
+        free(btype);
+        btype = xs_read(xsh, XBT_NULL, buf, &len);
+        if (btype == NULL)
+            continue;
+        is_tap = !strncmp(btype, "tap", 3);
         /* read the name of the device */
         if (pasprintf(&buf, "%s/dev", bpath) == -1)
             continue;
@@ -762,6 +770,7 @@ void xenstore_parse_domain_config(int hv
     free(mode);
     free(params);
     free(dev);
+    free(btype);
     free(bpath);
     free(buf);
     free(danger_buf);
++++++ blktapctrl-close-fifos.patch ++++++
Index: xen-4.4.0-testing/tools/blktap/drivers/blktapctrl.c
===================================================================
--- xen-4.4.0-testing.orig/tools/blktap/drivers/blktapctrl.c
+++ xen-4.4.0-testing/tools/blktap/drivers/blktapctrl.c
@@ -282,7 +282,7 @@ static int del_disktype(blkif_t *blkif)
 	 * qemu-dm instance. We may close the file handle only if there is
 	 * no other disk left for this domain.
 	 */
-	if (dtypes[type]->use_ioemu)
+	if (dtypes[type]->use_ioemu && dtypes[type]->idnum != DISK_TYPE_AIO)
 		return !qemu_instance_has_disks(blkif->tappid);
 
 	/* Caller should close() if no single controller, or list is empty. */
++++++ blktapctrl-default-to-ioemu.patch ++++++
Index: xen-4.2.0-testing/tools/blktap/drivers/tapdisk.h
===================================================================
--- xen-4.2.0-testing.orig/tools/blktap/drivers/tapdisk.h
+++ xen-4.2.0-testing/tools/blktap/drivers/tapdisk.h
@@ -168,7 +168,7 @@ static disk_info_t aio_disk = {
 	"raw image (aio)",
 	"aio",
 	0,
-	0,
+	1,
 #ifdef TAPDISK
 	&tapdisk_aio,
 #endif
@@ -179,7 +179,7 @@ static disk_info_t sync_disk = {
 	"raw image (sync)",
 	"sync",
 	0,
-	0,
+	1,
 #ifdef TAPDISK
 	&tapdisk_sync,
 #endif
@@ -190,7 +190,7 @@ static disk_info_t vmdk_disk = {
 	"vmware image (vmdk)",
 	"vmdk",
 	1,
-	0,
+	1,
 #ifdef TAPDISK
 	&tapdisk_vmdk,
 #endif
@@ -212,7 +212,7 @@ static disk_info_t qcow_disk = {
 	"qcow disk (qcow)",
 	"qcow",
 	0,
-	0,
+	1,
 #ifdef TAPDISK
 	&tapdisk_qcow,
 #endif
@@ -223,7 +223,7 @@ static disk_info_t qcow2_disk = {
 	"qcow2 disk (qcow2)",
 	"qcow2",
 	0,
-	0,
+	1,
 #ifdef TAPDISK
 	&tapdisk_qcow2,
 #endif
++++++ blktapctrl-disable-debug-printf.patch ++++++
Index: xen-4.2.0-testing/tools/blktap/drivers/blktapctrl.c
===================================================================
--- xen-4.2.0-testing.orig/tools/blktap/drivers/blktapctrl.c
+++ xen-4.2.0-testing/tools/blktap/drivers/blktapctrl.c
@@ -61,6 +61,9 @@
 #include "list.h"
 #include "xs_api.h" /* for xs_fire_next_watch() */
 
+#undef DPRINTF
+#define DPRINTF(_f, _a...) ((void)0)
+
 #define PIDFILE "/var/run/blktapctrl.pid"
 
 #define NUM_POLL_FDS 2
Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_blktap.c
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/xen_blktap.c
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_blktap.c
@@ -46,7 +46,7 @@
 #define BLKTAP_CTRL_DIR "/var/run/tap"
 
 /* If enabled, print debug messages to stderr */
-#if 1
+#if 0
 #define DPRINTF(_f, _a...) fprintf(stderr, __FILE__ ":%d: " _f, __LINE__, ##_a)
 #else
 #define DPRINTF(_f, _a...) ((void)0)
++++++ block-dmmd ++++++
#! /bin/bash

# Usage: block-dmmd [add args | remove args]
#     
#  the dmmd device syntax (in xm commands/configs) is something like:
#   dmmd:md;/dev/md0;md;/dev/md1;lvm;/dev/vg1/lv1
#  or
#   dmmd:lvm;/dev/vg1/lv1;lvm;/dev/vg1/lv2;md;/dev/md0
#  device pairs (type;dev) are processed in order, with the last device
#  assigned to the VM
#
#  md devices can optionally:
#   specify a config file through:
#      md;/dev/md100(/var/xen/config/mdadm.conf)
#   use an array name (mdadm -N option):
#      dmmd:md;My-MD-name;lvm;/dev/vg1/lv1
#
# History:
#  2013-07-03, loic.devulder@mpsa.com:
#	Partial rewrite of the script for supporting MD activation by name
#  2009-06-09, mh@novell.com:
#	Emit debugging messages into a temporary file; if no longer needed,
#	  just comment the exec I/O redirection below
#	Make variables used in functions local to avoid global overridings
#	Use vgscan and vgchange where required
#	Use the C locale to avoid dealing with localized messages
#	Assign output from assembling an MD device to a variable to aid debugging

# We do not want to deal with localized messages:
LANG=C
LC_MESSAGES=C
export LANG LC_MESSAGES

dir=$(dirname "$0")
. "$dir/block-common.sh"

#exec >> /tmp/block-dmmd-`date +%F_%T.%N`.log 2>&1
#echo shell-flags: $-

command=$1

# We check for errors ourselves:
set +e

function run_mdadm()
{
    local mdadm_cmd=$1
    local msg
    local rc

    msg="$(/sbin/mdadm $mdadm_cmd 2>&1)"
    rc=$?
    case "$msg" in
	*"has been started"* | *"already active"* )
	    return 0
	    ;;
	*"is already in use"* )
	    # hmm, might be used by another device in this domU
	    # leave it to upper layers to detect a real error
	    return 2
	    ;;
	* )
	    return $rc
	    ;;
    esac
    return 1
}

function activate_md()
{
    # Make it explicitly local
    local par=$1
    local cfg dev dev_path rc t mdadm_opts

    if [ ${par} = ${par%%(*} ]; then 
        # No configuration file specified
	dev=$par
	cfg=
    else
	dev=${par%%(*}
	t=${par#*(}
	cfg="-c ${t%%)*}"
    fi

    # Looking for device name or aliase
    if [ ${dev:0:1} = / ]; then
	dev_path=${dev%/*}
	mdadm_opts=
    else
	dev_path=/dev/md
	mdadm_opts="-s -N"
    fi

    # Is md device already active?
    # We need to use full path name, aliase is not possible...
    /sbin/mdadm -Q -D $dev_path/${dev##*/} > /dev/null 2>&1 \
      && return 0

    run_mdadm "-A $mdadm_opts $dev $cfg"
    rc=$?
    [ $rc -eq 2 ] && return 0

    return $rc
}

function deactivate_md()
{
    local par=$1
    local dev

    if [ ${par} = ${par%%(*} ]; then 
        # No configuration file specified
	dev=${par}
    else
	dev=${par%%(*}
    fi

    # Looking for device name or aliase
    if [ ${dev:0:1} = / ]; then
	dev_path=${dev%/*}
    else
	dev_path=/dev/md
    fi

    # We need the device name only while deactivating
    /sbin/mdadm -S ${dev_path}/${dev##*/} > /dev/null 2>&1

    return $?
}

function activate_lvm()
{
    local run_timeout=90
    local parsed_timeout
    local end_time

    # Parse device-create-timeout from /etc/xen/xend-config.sxp
    # If not set, use default timeout of 90s
    parsed_timeout=$(grep -v  "^[ \t]*#.*" /etc/xen/xend-config.sxp \
                     | sed -n 's/(device-create-timeout \+\([0-9]\+\))/\1/p')
    [ ! -z $parsed_timeout ] \
      && run_timeout=$((${parsed_timeout}*9/10))

    # First scan for PVs and VGs
    # We need this for using md device as PV
    /sbin/pvscan > /dev/null 2>&1
#   /sbin/vgscan --mknodes > /dev/null 2>&1

    end_time=$(($(date +%s)+${run_timeout}))
    while true; do
	/sbin/lvchange -aey $1 > /dev/null 2>&1

	if [ $? -eq 0 -a -e $1 ]; then
	    return 0
	fi

	sleep 0.1
	if [ $(date +%s) -ge ${end_time} ]; then
	    log err "Failed to activate $1 within ${run_timeout} seconds"
	    return 1
	fi
    done
    return 1
}

function deactivate_lvm()
{
    /sbin/lvchange -aen $1 > /dev/null 2>&1

    if [ $? -eq 0 ]; then
	# We may have to deactivate the VG now, but can ignore errors:
#        /sbin/vgchange -an ${1%/*} || :
        # Maybe we need to cleanup the LVM cache:
#        /sbin/vgscan --mknodes || :
	return 0
    fi
    return 1
}

BP=100
SP=$BP
VBD=

declare -a stack
function push()
{
    if [ -z "$1" ]; then
        return
    fi
    let "SP -= 1"
    stack[$SP]="${1}"
}

function pop()
{
    VBD=

    if [ "$SP" -eq "$BP" ]; then
        return
    fi

    VBD=${stack[$SP]}
    let "SP += 1"
}

function activate_dmmd()
{
    case $1 in
        md)
            activate_md $2
            return
            ;;
        lvm)
            activate_lvm $2
            return
            ;;
    esac
}

function deactivate_dmmd()
{
    case "$1" in
        md)
            deactivate_md $2
            return
            ;;
        lvm)
            deactivate_lvm $2
            return
            ;;
    esac
}

function cleanup_stack()
{
    while [ 1 ]; do
        pop
        if [ -z "$VBD" ]; then
            break
        fi
        deactivate_dmmd $VBD
    done
}

function parse_par()
{
    local ac par rc s t		# Make these explicitly local vars

    ac=$1
    par="$2"

    par="$par;"
    while [ 1 ]; do
        t=${par%%;*}
        if [ -z "$t" ]; then
            return 0
        fi
        par=${par#*;}

        s=${par%%;*}
        if [ -z "$s" ]; then
            return 1
        fi
        par=${par#*;}

        if [ "$ac" = "activate" ]; then
            activate_dmmd $t $s
            rc=$?
            if [ $rc -ne 0 ]; then
               return 1
            fi
        fi
        push "$t $s"
    done
}


case "$command" in
    add)
	p=`xenstore-read $XENBUS_PATH/params` || true
	claim_lock "dmmd"
	dmmd=$p
	parse_par activate "$dmmd"
	rc=$?
	if [ $rc -ne 0 ]; then
	    cleanup_stack
	    release_lock "dmmd"
	    exit 1
	fi
	lastparam=${dmmd##*;}
	usedevice=${lastparam%(*}
	xenstore-write $XENBUS_PATH/node "$usedevice"
	write_dev "$usedevice"
	release_lock "dmmd"
	exit 0
	;;

    remove)
	p=`xenstore-read $XENBUS_PATH/params` || true
	claim_lock "dmmd"
	dmmd=$p
	parse_par noactivate "$dmmd"
	cleanup_stack
	release_lock "dmmd"
	exit 0
	;;
esac
++++++ block-iscsi ++++++
#!/bin/bash

# Usage: block-iscsi [add tgtname | remove dev]
#
# This assumes you're running a correctly configured 
# iscsi target (server) at the other end!
# Note that we assume that the passwords for discovery (if needed)
# are in /etc/iscsid.conf
# and the node session passwords (if required) in the
# open-iscsi database below /var/lib/open-iscsi/node.db
#
# (c) Kurt Garloff , 2006-09-04, GNU GPL
# Contributors: Jim Fehlig 
#               Stefan de Konink 

dir=$(dirname "$0")
. "$dir/block-common.sh"

# echo "DBG:xen/scripts/block-iscsi $1 $2 XENBUS_PATH=$XENBUS_PATH $par $node"

find_sdev()
{
  unset dev
  for session in /sys/class/iscsi_session/session*; do
    if [ "$1" = "`cat $session/targetname 2>/dev/null`" ]; then
      dev=`basename $session/device/target*/*:0:*/block*/*`
      return
    fi
  done
}

find_sdev_rev()
{
  unset tgt
  for session in /sys/class/iscsi_session/session*; do
    dev=`basename $session/device/target*/*:0:*/block*/*`
    if [ "$dev" = "$1" ]; then
      tgt=`cat $session/targetname 2>/dev/null`
      return
    fi
  done
}

case "$command" in
  add)
    # load modules and start iscsid
    /etc/init.d/open-iscsi status >/dev/null 2>&1 ||
      { /etc/init.d/open-iscsi start >/dev/null 2>&1; sleep 1; }
    par=`xenstore-read $XENBUS_PATH/params` || true
    TGTID=`echo $par | sed "s/\/\///g"`
    while read rec uuid; do
      if [ "$uuid" = "$TGTID" ]; then
        find_sdev $TGTID
        if [ -z "$dev" ]; then
          /sbin/iscsiadm -m node -T $uuid -p $rec --login || exit 2
          sleep 4
          find_sdev $TGTID
        fi
        xenstore-write $XENBUS_PATH/node /dev/$dev
        write_dev /dev/$dev
        exit 0
      fi
    done < <(/sbin/iscsiadm -m node)
    exit 1
    ;;

  remove)
    node=`xenstore-read $XENBUS_PATH/node` || true
    dev=$node; dev=${dev#/dev/}
    find_sdev_rev $dev
    if [ -x /sbin/blockdev -a -n "$node" ];  then blockdev --flushbufs "$node"; fi
    test -z "$tgt" && exit 2
    /sbin/iscsiadm -m node -T $tgt --logout
    exit 1
    ;;
esac
++++++ block-nbd ++++++
#!/bin/sh

# Usage: block-nbd [bind server ctl_port |unbind node]
#
# The node argument to unbind is the name of the device node we are to
# unbind.
#
# This assumes you're running a correctly configured server at the other end!

dir=$(dirname "$0")
. "$dir/block-common.sh"

#set -x
par=`xenstore-read $XENBUS_PATH/params` || true
#echo $par

case "$command" in
  add)
    modprobe nbd
    for dev in /dev/nbd*; do
      if nbd-client $par $dev; then
	xenstore-write $XENBUS_PATH/node $dev
        write_dev $dev
        exit 0
      fi
    done
    exit 1
    ;;
  remove)
    node=`xenstore-read $XENBUS_PATH/node` || true
    nbd-client -d $node
    exit 0
    ;;
esac
++++++ block-npiv ++++++
#!/bin/bash

# Usage: block-npiv [add npiv | remove dev]

dir=$(dirname "$0")
. "$dir/block-npiv-common.sh"
. "$dir/block-common.sh"

#set -x
#command=$1

case "$command" in
  add)
    # Params is one big arg, with fields separated by hyphens:
    # single path: 
    #    VPWWPN-TGTWWPN-LUN#
    # multipath: 
    #    {VPWWPN1.VPWWPN2....VPWWPNx}-{TGTWWPN1.TGTWWPN2....TGTWWPNx}-LUN#
    #    arg 1 - VPORT's WWPN
    #    arg 2 - Target's WWPN
    #    arg 3 - LUN # on Target
    # no wwn contains a leading 0x - it is a 16 character hex value
    # You may want to optionally pick a specific adapter ?
    par=`xenstore-read $XENBUS_PATH/params` || true
    NPIVARGS=(${par//-/ })
    wc=${#NPIVARGS[@]}
    if [ $wc -eq 5 ]; then
      # support old syntax
      # FABRIC-VPWWPN-VPWWNN-TGTWWPN-LUN
      VPORTWWPNS=${NPIVARGS[1]}
      VPORTWWNNS=${NPIVARGS[2]}
      TGTWWPNS=${NPIVARGS[3]}
      LUN=${NPIVARGS[4]}
    elif [ $wc -eq 3 ]; then
      # new syntax
      VPORTWWPNS=${NPIVARGS[0]}
      TGTWWPNS=${NPIVARGS[1]}
      LUN=${NPIVARGS[2]}
    else
      # wrong syntax
      exit 1
    fi

    # Ensure we compare everything using lower-case hex characters
    TGTWWPNS=`echo $TGTWWPNS | tr A-Z a-z |sed 's/[{.}]/ /g'`
    VPORTWWPNS=`echo $VPORTWWPNS | tr A-Z a-z |sed 's/[{.}]/ /g'`
    # Only one VPWWNN is supported
    VPORTWWNN=`echo $VPORTWWNNS | tr A-Z a-z | sed -e 's/\..*//g' -e 's/{//'`

    claim_lock "npiv"
    paths=0
    for VPORTWWPN in $VPORTWWPNS; do
      find_vhost $VPORTWWPN
      if test -z "$vhost" ; then
        create_vport $VPORTWWPN $VPORTWWNN
        if [ $? -ne 0 ] ; then exit 2; fi
        sleep 8
        find_vhost $VPORTWWPN
        if test -z "$vhost" ; then exit 3; fi
      fi
      for TGTWWPN in $TGTWWPNS; do
        find_sdev $vhost $TGTWWPN $LUN
        if test -z "$dev"; then
          echo "- - -" > /sys/class/scsi_host/$vhost/scan
          sleep 2
          find_sdev $vhost $TGTWWPN $LUN
        fi
        if test -z "$dev"; then
          exit 4
	fi
        paths=$(($paths+1))
      done
    done
    release_lock "npiv"

    if test $paths -gt 1; then
      xenstore-write $XENBUS_PATH/multipath 1
      /etc/init.d/multipathd start
      if test $? -ne 0 ; then exit 4; fi
      dm=`multipath -l /dev/$dev | grep dm | cut -f2 -d' '`
    else
      xenstore-write $XENBUS_PATH/multipath 0
      dm=$dev
    fi
    
    if test ! -z "$dm"; then
      xenstore-write $XENBUS_PATH/node /dev/$dm
      write_dev /dev/$dm
      exit 0
    fi

    exit 4
    ;;

  remove)
    node=`xenstore-read $XENBUS_PATH/node` || true
    multipath=`xenstore-read $XENBUS_PATH/multipath` || true
    # this is really screwy. the first delete of a lun will
    # terminate the entire vport (all luns)
    if test $multipath = 1; then
      par=`xenstore-read $XENBUS_PATH/params` || true
      NPIVARGS=(${par//-/ })
      wc=${#NPIVARGS[@]}
      if [ $wc -eq 5 ]; then
        # old syntax
        # FABRIC-VPWWPN-VPWWNN-TGTWWPN-LUN
        VPORTWWPNS=${NPIVARGS[1]}
      elif [ $wc -eq 3 ]; then
        # new syntax
        VPORTWWPNS=${NPIVARGS[0]}
      fi
      VPORTWWPNS=`echo $VPORTWWPNS | tr A-Z a-z |sed 's/[{.}]/ /g'`
      for VPORTWWPN in $VPORTWWPNS; do
        find_vhost $VPORTWWPN
        if test -z "$vhost" ; then exit 5; fi
        flush_nodes_on_vhost $vhost
        delete_vhost $vhost
      done
    else
      dev=$node; dev=${dev#/dev/}
      find_vhost_from_dev $dev
      if test -z "$vhost" ; then exit 5; fi
      flush_nodes_on_vhost $vhost
      delete_vhost $vhost
    fi

    exit 0
    ;;
esac
++++++ block-npiv-common.sh ++++++


# Look for the NPIV vport with the WWPN
#  $1 contains the WWPN  (assumes it does not contain a leading "0x")
find_vhost()
{
  unset vhost

  # look in upstream locations
  for fchost in /sys/class/fc_vports/* ; do
    if test -e $fchost/port_name ; then
      wwpn=`cat $fchost/port_name | sed -e s/^0x//`
      if test $wwpn = $1 ; then 
        # Note: makes the assumption the vport will always have an scsi_host child
        vhost=`ls -d $fchost/device/host*`
        vhost=`basename $vhost`
        return
      fi
    fi
  done

  # look in vendor-specific locations

  # Emulex - just looks like another scsi_host - so look at fc_hosts...
  for fchost in /sys/class/fc_host/* ; do
    if test -e $fchost/port_name ; then
      wwpn=`cat $fchost/port_name | sed -e s/^0x//`
      if test $wwpn = $1 ; then 
        # Note: makes the assumption the vport will always have an scsi_host child
        vhost=`basename $fchost`
        return
      fi
    fi
  done
}


# Create a NPIV vport with WWPN
#  $1 contains the VPORT WWPN
#  $2 may contain the VPORT WWNN
# (assumes no name contains a leading "0x")
create_vport()
{
  wwpn=$1
  wwnn=$2
  if [ -z "$wwnn" ]; then
    # auto generate wwnn, follow FluidLabUpdateForEmulex.pdf
    # Novell specific identifier
    # byte 6 = 0 indicates WWNN, = 1 indicates WWPN
    wwnn=${wwpn:0:6}"0"${wwpn:7}
  fi
  # find a base adapter with npiv support that is on the right fabric

  # Look via upstream interfaces
  for fchost in /sys/class/fc_host/* ; do
    if test -e $fchost/vport_create ; then
      # is the link up, w/ NPIV support ?
      pstate=`cat $fchost/port_state`
      ptype=`cat $fchost/port_type | cut -c 1-5`
      if [ $pstate = "Online" -a $ptype = "NPort" ] ; then
        vmax=`cat $fchost/max_npiv_vports`
        vinuse=`cat $fchost/npiv_vports_inuse`
        avail=`expr $vmax - $vinuse`
        if [ $avail -gt 0 ] ; then
          # create the vport
          echo $wwpn":"$wwnn > $fchost/vport_create
          if [ $? -eq 0 ] ; then
            return 0
          fi
          # failed - so we'll just look for the next adapter
        fi
      fi
    fi
  done

  # Look in vendor-specific locations

  # Emulex: interfaces mirror upstream, but are under adapter scsi_host
  for shost in /sys/class/scsi_host/* ; do
    if [ -e $shost/vport_create ] ; then
      fchost=`ls -d $shost/device/fc_host*`
      # is the link up, w/ NPIV support ?
      if [ -e $fchost/port_state ] ; then
        pstate=`cat $fchost/port_state`
        ptype=`cat $fchost/port_type | cut -c 1-5`
        if [ $pstate = "Online" -a $ptype = "NPort" ] ; then
          vmax=`cat $shost/max_npiv_vports`
          vinuse=`cat $shost/npiv_vports_inuse`
          avail=`expr $vmax - $vinuse`
          if [ $avail -gt 0 ] ; then
            # create the vport
            echo $wwpn":"$wwnn > $shost/vport_create
            if [ $? -eq 0 ] ; then
              return 0
            fi
            # failed - so we'll just look for the next adapter
          fi
        fi
      fi
    fi
  done

  # BFA are under adapter scsi_host
  for shost in /sys/class/scsi_host/* ; do
    if [ -e $shost/vport_create ] ; then
      fchost=`ls -d $shost/device/fc_host/*`
      # is the link up, w/ NPIV support ?
      if [ -e $fchost/port_state ] ; then
        pstate=`cat $fchost/port_state`
        ptype=`cat $fchost/port_type | cut -c 1-5`
        if [ $pstate = "Online" -a $ptype = "NPort" ] ; then
          # create the vport
          echo $wwpn":"$wwnn > $shost/vport_create
          if [ $? -eq 0 ] ; then
            return 0
          fi
          # failed - so we'll just look for the next adapter
        fi
      fi
    fi
  done

  return 1
}


# Look for the LUN on the indicated scsi_host (which is an NPIV vport)
#  $1 is the scsi_host name (normalized to simply the hostX name)
#  $2 is the WWPN of the tgt port the lun is on
#       Note: this implies we don't support a multipath'd lun, or we
#         are explicitly identifying a "path"
#  $3 is the LUN number of the scsi device
find_sdev()
{
  unset dev
  hostno=${1/*host/}
  for sdev in /sys/class/scsi_device/${hostno}:*:$3 ; do
    if test -e $sdev/device/../fc_trans*/target${hostno}*/port_name ; then
      tgtwwpn=`cat $sdev/device/../fc_trans*/target${hostno}*/port_name | sed -e s/^0x//`
      if test $tgtwwpn = $2 ; then
        if test -e $sdev/device/block* ; then
          dev=`ls $sdev/device/block*`
          dev=${dev##*/}
          return
        fi
      fi
    fi
  done
}


# Look for the NPIV vhost based on a scsi "sdX" name
#   $1 is the "sdX" name
find_vhost_from_dev()
{
   unset vhost
   hostno=`readlink /sys/block/$1/device`
   hostno=${hostno##*/}
   hostno=${hostno%%:*}
   if test -z "$hostno" ; then return; fi
   vhost="host"$hostno
}


# We're about to terminate a vhost based on a scsi device
# Flush all nodes on that vhost as they are about to go away
#  $1 is the vhost
flush_nodes_on_vhost()
{ 
  if test ! -x /sbin/blockdev ; then  return;  fi
  hostno=${1/*host/}
  for sdev in /sys/class/scsi_device/${hostno}:* ; do
    if test -e $sdev/device/block* ; then
      dev=`ls $sdev/device/block*`
      dev="/dev/"$dev
      if test -n "$dev"; then
        blockdev --flushbufs $dev
      fi
    fi
  done
}


# Terminate a NPIV vhost
#   $1 is vhost
delete_vhost()
{
  # use upstream interface
  for vport in /sys/class/fc_vports/* ; do
    if test -e $vport/device/$1 ; then
      if test -e $vport/vport_delete ; then
        echo "1" > $vport/vport_delete
        if test $? -ne 0 ; then exit 6; fi
        sleep 4
        return
      fi
    fi
  done

  # use vendor specific interface

  # Emulex
  if test -e /sys/class/fc_host/$1/device/../scsi_host*/lpfc_drvr_version ; then
    shost=`ls -1d /sys/class/fc_host/$1/device/../scsi_host* | sed s/.*scsi_host://`
    vportwwpn=`cat /sys/class/fc_host/$1/port_name | sed s/^0x//`
    vportwwnn=`cat /sys/class/fc_host/$1/node_name | sed s/^0x//`
    echo "$vportwwpn:$vportwwnn" > /sys/class/scsi_host/$shost/vport_delete
    if test $? -ne 0 ; then exit 6; fi
    sleep 4
    return
  fi

  # Qlogic
  if test -e /sys/class/fc_host/$1/device/../scsi_host*/driver_version ; then
    shost=`ls -1d /sys/class/fc_host/$1/device/../scsi_host* | sed s/.*scsi_host://`
    vportwwpn=`cat /sys/class/fc_host/$1/port_name | sed s/^0x//`
    vportwwnn=`cat /sys/class/fc_host/$1/node_name | sed s/^0x//`
    echo "$vportwwpn:$vportwwnn" > /sys/class/scsi_host/$shost/vport_delete
    if test $? -ne 0 ; then exit 6; fi
    sleep 4
    return
  fi

  # BFA
  if test -e /sys/class/fc_host/$1/device/../scsi_host/*/driver_name ; then
    shost=`ls -1d /sys/class/fc_host/$1/device/../scsi_host/* | sed s#.*scsi_host/##`
    vportwwpn=`cat /sys/class/fc_host/$1/port_name | sed s/^0x//`
    vportwwnn=`cat /sys/class/fc_host/$1/node_name | sed s/^0x//`
    echo "$vportwwpn:$vportwwnn" > /sys/class/scsi_host/$shost/vport_delete
    if test $? -ne 0 ; then exit 6; fi
    sleep 4
    return
  fi


  exit 6
}


vport_status()
{
  # Look via upstream interfaces
  for fchost in /sys/class/fc_host/* ; do
    if test -e $fchost/vport_create ; then
      vport_status_display $fchost $fchost
    fi
  done

  # Look in vendor-specific locations

  # Emulex: interfaces mirror upstream, but are under adapter scsi_host
  for shost in /sys/class/scsi_host/* ; do
    if [ -e $shost/vport_create ] ; then
      fchost=`ls -d $shost/device/fc_host*`
      vport_status_display $fchost $shost
    fi
  done

  return 0
}


vport_status_display()
{
  echo
  echo "fc_host:            " $2
  echo "port_state:         " `cat $1/port_state`
  echo "port_type:          " `cat $1/port_type`
  echo "fabric_name:        " `cat $1/fabric_name`
  echo "max_npiv_vports:    " `cat $2/max_npiv_vports`
  echo "npiv_vports_inuse:  " `cat $2/npiv_vports_inuse`
  echo "modeldesc:          " `cat $2/modeldesc`
  echo "speed:              " `cat $1/speed`

  return 0
}

++++++ block-npiv-vport ++++++
#!/bin/bash

# Usage: block-npiv-vport [create npivargs | delete vportwwpn | status]

dir=$(dirname "$0")
. "$dir/block-npiv-common.sh"

#set -x
command=$1
params=$2

case "$command" in
  create)
    # Params is one big arg, with fields separated by hyphens:
    #   FABRIC-VPWWPN-VPWWNN-TGTWWPN-LUN#
    #    arg 2 - Fabric Name
    #    arg 3 - VPORT's WWPN
    #    arg 4 - VPORT's WWNN
    #    arg 5 - Target's WWPN
    #    arg 6 - LUN # on Target
    # no wwn contains a leading 0x - it is a 16 character hex value
    # You may want to optionally pick a specific adapter ?
    NPIVARGS=$params;
    LUN=${NPIVARGS##*-*-*-*-}; NPIVARGS=${NPIVARGS%-*}
    if test $LUN = $NPIVARGS ; then exit 1; fi
    TGTWWPN=${NPIVARGS##*-*-*-}; NPIVARGS=${NPIVARGS%-*}
    if test $TGTWWPN = $NPIVARGS ; then exit 1; fi
    VPORTWWNN=${NPIVARGS##*-*-}; NPIVARGS=${NPIVARGS%-*}
    if test $VPORTWWNN = $NPIVARGS ; then exit 1; fi
    VPORTWWPN=${NPIVARGS##*-}; NPIVARGS=${NPIVARGS%-*}
    if test $VPORTWWPN = $NPIVARGS ; then exit 1; fi
    FABRICNM=$NPIVARGS

    # Ensure we compare everything using lower-case hex characters
    TGTWWPN=`echo $TGTWWPN | tr A-Z a-z`
    VPORTWWPN=`echo $VPORTWWPN | tr A-Z a-z`
    VPORTWWNN=`echo $VPORTWWNN | tr A-Z a-z`
    FABRICNM=`echo $FABRICNM | tr A-Z a-z`

    find_vhost $VPORTWWPN $FABRICNM
    if test -z "$vhost" ; then
      create_vport $FABRICNM $VPORTWWPN $VPORTWWNN
      if [ $? -ne 0 ] ; then exit 2; fi
      sleep 8
      find_vhost $VPORTWWPN $FABRICNM
      if test -z "$vhost" ; then exit 3; fi
    fi

    exit 0
    ;;

  delete)
    # Params is VPORT's WWPN
    # no wwn contains a leading 0x - it is a 16 character hex value
    VPORTWWPN=$params

    # Ensure we compare everything using lower-case hex characters
    VPORTWWPN=`echo $VPORTWWPN | tr A-Z a-z`

    find_vhost $VPORTWWPN $FABRICNM
    if test -z "$vhost" ; then exit 4; fi
    delete_vhost $vhost

    exit 0
    ;;

  status)
    vport_status

    exit 0
    ;;

  *)
    echo "Usage: block-npiv-vport [create npivargs | delete vportwwpn | status]"

    exit 1
    ;;
esac

++++++ boot.local.xenU ++++++
#! /bin/sh
#
# Copyright (c) 2014 SUSE GmbH Nuernberg, Germany.  All rights reserved.
#
# Author: Werner Fink , 1996
#         Burchard Steinbild , 1996
#
# /etc/init.d/boot.local
#
# script with local commands to be executed from init on system startup
#
#
# Here you should add things, that should happen directly after booting
# before we're going to the first run level.
#

date

# echo "$MACHINE: running $0 $*"
my_REDIRECT="$(echo $REDIRECT | sed 's#^/dev/##')"
my_DEVICE="$(echo $my_REDIRECT | sed 's#^tty##')"
my_SPEED="$(stty speed)"
# echo REDIRECT $REDIRECT  $my_REDIRECT
# echo my_DEVICE $my_DEVICE
# echo my_SPEED $my_SPEED

# compose a line like that for inittab
# S0:12345:respawn:/sbin/agetty -L 9600 ttyS0 vt102

case $my_REDIRECT in
	ttyS*)
	echo adding this line to inittab
	echo "$my_DEVICE:12345:respawn:/sbin/agetty -L $my_SPEED $my_REDIRECT vt102"
	echo "$my_DEVICE:12345:respawn:/sbin/agetty -L $my_SPEED $my_REDIRECT vt102" >> /etc/inittab
	echo $my_REDIRECT >> /etc/securetty
		;;

	hvc*)
	echo adding this line to inittab
	echo "$my_DEVICE:12345:respawn:/sbin/agetty -L $my_SPEED $my_REDIRECT vt320"
	echo "$my_DEVICE:12345:respawn:/sbin/agetty -L $my_SPEED $my_REDIRECT vt320" >> /etc/inittab
	echo $my_REDIRECT >> /etc/securetty
		;;

	*)
	echo "no modification in inittab needed for: $my_REDIRECT"
		;;
esac

telinit q

# Changes for Xen
test -f /lib/modules/`uname -r`/modules.dep || depmod -ae

CMDLINE=`cat /proc/cmdline | grep 'ip='`
if test ! -z "$CMDLINE"; then
	OLDIFS=$IFS
	IFS=":"
	read ip oth mask gw hostname dev dhcp rest < /proc/cmdline
	IFS=$OLDIFS
	hostname $hostname
	ip=`echo $ip | sed 's/ip= *//'`
	if test ! -z "$ip"; then
		if test -z "$mask"; then
			if [ ${ip%/*} = $ip ]; then
				ip="$ip/27"
			fi
			echo "ip addr add $ip dev $dev"
			ip addr add $ip dev $dev
			ip link set $dev up
		else
			ifconfig add $ip netmask $mask $dev
		fi
	fi
	if test "${dhcp#dhcp}" != "$dhcp"; then
		ifup-dhcp $dev
	fi
fi

++++++ boot.xen ++++++
#! /bin/sh
# Copyright (c) 2005-2006 SUSE Linux AG, Nuernberg, Germany.
# All rights reserved.
#
# /etc/init.d/boot.xen
#
# LSB compatible service control script; see http://www.linuxbase.org/spec/
#
### BEGIN INIT INFO
# Provides:          Xen
# Required-Start:    boot.localfs
# Should-Start:      boot.localnet
# Required-Stop:     boot.localfs
# Should-Stop: 
# Default-Start:     B
# Default-Stop:
# Short-Description: Switch on and off TLS depending on whether Xen is running
# Description:       Xen gets a major performance hit by the way
#	recent glibc (& gcc) set up the TLS offset, as it needs to
#	play segmentation tricks. This can be avoided by moving away
#	the tls libs.
### END INIT INFO

. /etc/rc.status

# Reset status of this service
rc_reset

case "$1" in
    start)
	echo -n "Starting Xen setup "
	if test -d /proc/xen; then
		export LD_ASSUME_KERNEL=2.4.21
		echo -n "Xen running "
	fi
	if test -d /proc/xen -a -d /lib/tls; then
		echo -n "move /lib/tls away "
		mv /lib/tls /lib/tls.save
	elif test ! -d /proc/xen -a -d /lib/tls.save; then
		echo -n "move back /lib/tls "
		mv /lib/tls.save /lib/tls
	fi
	rc_status -v
	;;
    stop)
	# rc_status -v
	;;
    try-restart|condrestart)
	$0 restart
	# Remember status and be quiet
	rc_status
	;;
    restart)
	## Stop the service and regardless of whether it was
	## running or not, start it again.
	$0 start
	# Remember status and be quiet
	rc_status
	;;
    force-reload)
	$0 try-restart
	rc_status
	;;
    reload)
	rc_failed 3
	rc_status -v
	;;
    status)
	echo -n "Checking for Xen "
	# Return value is slightly different for the status command:
	# 0 - service up and running
	# 1 - service dead, but /var/run/  pid  file exists
	# 2 - service dead, but /var/lock/ lock file exists
	# 3 - service not running (unused)
	# 4 - service status unknown :-(
	# 5--199 reserved (5--99 LSB, 100--149 distro, 150--199 appl.)

	if test -d /proc/xen; then
		if test -d /lib/tls; then
			echo -n "Xen running, /lib/tls existing "
			rc_failed 1
		else
			echo -n "Xen running, /lib/tls not existing "	
		fi
	else
		if test -d /lib/tls.save; then
			echo -n "Xen not running, /lib/tls existing "
			rc_failed 2
		else	
			echo -n "Xen not running, /lib/tls not existing "
			rc_failed 3
		fi
	fi
	rc_status -v
	;;
    *)
	echo "Usage: $0 {start|stop|status|try-restart|restart|force-reload|reload}"
	exit 1
	;;
esac
rc_exit
++++++ bridge-bonding.patch ++++++
Index: xen-4.2.0-testing/tools/hotplug/Linux/network-bridge
===================================================================
--- xen-4.2.0-testing.orig/tools/hotplug/Linux/network-bridge
+++ xen-4.2.0-testing/tools/hotplug/Linux/network-bridge
@@ -251,6 +251,9 @@ op_start () {
 
     claim_lock "network-bridge"
 
+    local bonded=""
+    [ -e /sys/class/net/${netdev}/bonding ] && bonded="yes"
+
     vlans=$(find_active_vlans "${netdev}")
     for vlan in $vlans ; do ifdown $vlan ; done
 
@@ -268,18 +271,32 @@ op_start () {
 	ip link set ${netdev} down
 	ip addr flush ${netdev}
     fi
-    ip link set ${netdev} name ${pdev}
-    ip link set ${tdev} name ${bridge}
-
-    setup_physical_bridge_port ${pdev}
 
-    # Restore slaves
-    if [ -n "${slaves}" ]; then
-	ip link set ${pdev} up
-	ifenslave ${pdev} ${slaves}
+    if [ "x${bonded}" = "xyes" ]
+    then
+	ip link set ${tdev} name ${bridge}
+	ln -sf /etc/sysconfig/network/ifcfg-${netdev} /etc/sysconfig/network/ifcfg-${pdev}
+	ifup ${pdev}
+	local gw=`ip route show dev ${pdev} | fgrep default | sed 's/default via //'`
+	ip addr flush ${pdev}
+	rm -f /etc/sysconfig/network/ifcfg-${pdev}
+	brctl addif ${bridge} ${pdev}
+	ip link set ${bridge} up
+	[ -n "$gw" ] && ip route add default via ${gw}
+    else
+	ip link set ${netdev} name ${pdev}
+	ip link set ${tdev} name ${bridge}
+
+        _setup_bridge_port ${pdev}
+
+        # Restore slaves
+        if [ -n "${slaves}" ]; then
+	    ip link set ${pdev} up
+	    ifenslave ${pdev} ${slaves}
+        fi
+        add_to_bridge2 ${bridge} ${pdev}
+	do_ifup ${bridge}
     fi
-    add_to_bridge2 ${bridge} ${pdev}
-    do_ifup ${bridge}
 
     for vlan in $vlans ; do ifup $vlan ; done
 
++++++ bridge-opensuse.patch ++++++
Index: xen-4.2.0-testing/tools/hotplug/Linux/network-bridge
===================================================================
--- xen-4.2.0-testing.orig/tools/hotplug/Linux/network-bridge
+++ xen-4.2.0-testing/tools/hotplug/Linux/network-bridge
@@ -280,19 +280,19 @@ op_stop () {
     transfer_addrs ${bridge} ${pdev}
     if ! ifdown ${bridge}; then
 	get_ip_info ${bridge}
-    fi
-    ip link set ${pdev} down
-    ip addr flush ${bridge}
+	ip link set ${pdev} down
+	ip addr flush ${bridge}
 
-    brctl delif ${bridge} ${pdev}
-    ip link set ${bridge} down
+	brctl delif ${bridge} ${pdev}
+	ip link set ${bridge} down
 
-    ip link set ${bridge} name ${tdev}
+	ip link set ${bridge} name ${tdev}
+	brctl delbr ${tdev}
+    fi
+    ip link set ${pdev} down
     ip link set ${pdev} name ${netdev}
     do_ifup ${netdev}
 
-    brctl delbr ${tdev}
-
     release_lock "network-bridge"
 }
 
++++++ bridge-record-creation.patch ++++++
Index: xen-4.2.0-testing/tools/hotplug/Linux/network-bridge
===================================================================
--- xen-4.2.0-testing.orig/tools/hotplug/Linux/network-bridge
+++ xen-4.2.0-testing/tools/hotplug/Linux/network-bridge
@@ -259,6 +259,11 @@ op_start () {
 
     create_bridge ${tdev}
 
+    # Record creation of bridge in /dev/.sysconfig/network/xenbridges so other
+    # tools, e.g. yast2 lan, know that Xen bridging is active.
+    [ -d /dev/.sysconfig/network/xenbridges ] || mkdir /dev/.sysconfig/network/xenbridges
+    touch /dev/.sysconfig/network/xenbridges/${bridge}
+
     preiftransfer ${netdev}
     transfer_addrs ${netdev} ${tdev}
     # Remember slaves for bonding interface.
@@ -340,6 +345,13 @@ op_stop () {
     ip link set ${pdev} name ${netdev}
     do_ifup ${netdev}
 
+    # Remove record of bridge from /dev/.sysconfig/network/xenbridges ...
+    rm -f /dev/.sysconfig/network/xenbridges/${bridge}
+    # ... and directory itself if empty
+    if [ -z "$(ls -A /dev/.sysconfig/network/xenbridges 2>/dev/null)" ]; then
+	rmdir /dev/.sysconfig/network/xenbridges
+    fi
+
     for vlan in $vlans ; do ifup $vlan ; done
 
     release_lock "network-bridge"
++++++ bridge-vlan.patch ++++++
Index: xen-4.2.0-testing/tools/hotplug/Linux/network-bridge
===================================================================
--- xen-4.2.0-testing.orig/tools/hotplug/Linux/network-bridge
+++ xen-4.2.0-testing/tools/hotplug/Linux/network-bridge
@@ -195,6 +195,28 @@ antispoofing () {
     iptables -A FORWARD -m physdev --physdev-in ${pdev} -j ACCEPT
 }
 
+find_active_vlans() {
+    local netdev=$1
+    local vlan
+    local vlans
+    vlans=""
+    for vifcfg in /etc/sysconfig/network/ifcfg-vlan* ; do
+        vlan=${vifcfg/*\/ifcfg-}
+        if [ "$vlan" = "vlan*" ]; then
+            continue
+        fi
+        . $vifcfg
+        etherdevice="$ETHERDEVICE"
+        if [ -x /sbin/getcfg-interface ]; then
+                etherdevice=$(/sbin/getcfg-interface "$ETHERDEVICE")
+        fi
+        if [ "$ETHERDEVICE" = "$netdev" ] || [ "$etherdevice" = "$netdev" ] ; then
+                link_exists "$vlan" && vlans="$vlans $vlan"
+        fi
+    done
+    echo "$vlans"
+}
+
 # Usage: show_status dev bridge
 # Print ifconfig and routes.
 show_status () {
@@ -229,6 +251,9 @@ op_start () {
 
     claim_lock "network-bridge"
 
+    vlans=$(find_active_vlans "${netdev}")
+    for vlan in $vlans ; do ifdown $vlan ; done
+
     create_bridge ${tdev}
 
     preiftransfer ${netdev}
@@ -256,6 +281,8 @@ op_start () {
     add_to_bridge2 ${bridge} ${pdev}
     do_ifup ${bridge}
 
+    for vlan in $vlans ; do ifup $vlan ; done
+
     if [ ${antispoof} = 'yes' ] ; then
 	antispoofing
     fi
@@ -277,6 +304,9 @@ op_stop () {
 
     claim_lock "network-bridge"
 
+    vlans=$(find_active_vlans "${netdev}")
+    for vlan in $vlans ; do ifdown $vlan ; done
+
     transfer_addrs ${bridge} ${pdev}
     if ! ifdown ${bridge}; then
 	get_ip_info ${bridge}
@@ -293,6 +323,8 @@ op_stop () {
     ip link set ${pdev} name ${netdev}
     do_ifup ${netdev}
 
+    for vlan in $vlans ; do ifup $vlan ; done
+
     release_lock "network-bridge"
 }
 
++++++ build-tapdisk-ioemu.patch ++++++
...
From f1ebeae7802a5775422004f62630c42e46dcf664 Mon Sep 17 00:00:00 2001
From: Kevin Wolf 
Date: Tue, 10 Mar 2009 16:32:40 +0100
Subject: [PATCH 3/6] ioemu: Build tapdisk-ioemu binary
When changing away from the old ioemu, changes in the Makefiles
resulted in tapdisk-ioemu appearing there, but actually not
being built. This patch re-enables the build of tapdisk-ioemu.

Signed-off-by: Kevin Wolf 
---
 Makefile        |   22 +++++++++++++++-------
 configure       |    2 +-
 qemu-tool.c     |    2 +-
 tapdisk-ioemu.c |   17 -----------------
 4 files changed, 17 insertions(+), 26 deletions(-)

Index: xen-4.4.0-testing/tools/qemu-xen-traditional-dir-remote/Makefile
===================================================================
--- xen-4.4.0-testing.orig/tools/qemu-xen-traditional-dir-remote/Makefile
+++ xen-4.4.0-testing/tools/qemu-xen-traditional-dir-remote/Makefile
@@ -46,14 +46,6 @@ $(filter %-user,$(SUBDIR_RULES)): libqem
 
 recurse-all: $(SUBDIR_RULES)
 
-CPPFLAGS += -I$(XEN_ROOT)/tools/libxc
-CPPFLAGS += -I$(XEN_ROOT)/tools/blktap/lib
-CPPFLAGS += -I$(XEN_ROOT)/tools/xenstore
-CPPFLAGS += -I$(XEN_ROOT)/tools/include
-
-tapdisk-ioemu: tapdisk-ioemu.c cutils.c block.c block-raw.c block-cow.c block-qcow.c aes.c block-vmdk.c block-cloop.c block-dmg.c block-bochs.c block-vpc.c block-vvfat.c block-qcow2.c hw/xen_blktap.c osdep.c
-	$(CC) -DQEMU_TOOL $(CFLAGS) $(CPPFLAGS) $(BASE_CFLAGS) $(LDFLAGS) $(BASE_LDFLAGS) -o $@ $^ -lz $(LIBS)
-
 #######################################################################
 # BLOCK_OBJS is code used by both qemu system emulation and qemu-img
 
@@ -72,6 +64,21 @@ endif
 BLOCK_OBJS += block-raw-posix.o
 endif
 
+#######################################################################
+# tapdisk-ioemu
+
+hw/tapdisk-xen_blktap.o: hw/xen_blktap.c
+	$(CC) $(CFLAGS) $(CPPFLAGS) -DQEMU_IMG -DQEMU_TOOL -c -o $@ $<
+tapdisk-ioemu.o: tapdisk-ioemu.c
+	$(CC) $(CFLAGS) $(CPPFLAGS) -DQEMU_IMG -DQEMU_TOOL -c -o $@ $<
+
+tapdisk-ioemu: CPPFLAGS += -I$(XEN_ROOT)/tools/libxc
+tapdisk-ioemu: CPPFLAGS += -I$(XEN_ROOT)/tools/blktap/lib
+tapdisk-ioemu: CPPFLAGS += -I$(XEN_ROOT)/tools/xenstore
+tapdisk-ioemu: CPPFLAGS += -I$(XEN_ROOT)/tools/include
+tapdisk-ioemu: tapdisk-ioemu.o $(BLOCK_OBJS) qemu-tool.o hw/tapdisk-xen_blktap.o
+	$(CC) $(LDFLAGS) -o $@ $^ -lz $(LIBS)
+
 ######################################################################
 # libqemu_common.a: Target independent part of system emulation. The
 # long term path is to suppress *all* target specific code in case of
Index: xen-4.4.0-testing/tools/qemu-xen-traditional-dir-remote/configure
===================================================================
--- xen-4.4.0-testing.orig/tools/qemu-xen-traditional-dir-remote/configure
+++ xen-4.4.0-testing/tools/qemu-xen-traditional-dir-remote/configure
@@ -1512,7 +1512,7 @@ bsd)
 ;;
 esac
 
-tools=
+tools="tapdisk-ioemu"
 if test `expr "$target_list" : ".*softmmu.*"` != 0 ; then
   tools="qemu-img\$(EXESUF) $tools"
   if [ "$linux" = "yes" ] ; then
Index: xen-4.4.0-testing/tools/qemu-xen-traditional-dir-remote/qemu-tool.c
===================================================================
--- xen-4.4.0-testing.orig/tools/qemu-xen-traditional-dir-remote/qemu-tool.c
+++ xen-4.4.0-testing/tools/qemu-xen-traditional-dir-remote/qemu-tool.c
@@ -68,7 +68,7 @@ void qemu_bh_delete(QEMUBH *bh)
     qemu_free(bh);
 }
 
-int qemu_set_fd_handler2(int fd,
+int __attribute__((weak)) qemu_set_fd_handler2(int fd,
                          IOCanRWHandler *fd_read_poll,
                          IOHandler *fd_read,
                          IOHandler *fd_write,
Index: xen-4.4.0-testing/tools/qemu-xen-traditional-dir-remote/tapdisk-ioemu.c
===================================================================
--- xen-4.4.0-testing.orig/tools/qemu-xen-traditional-dir-remote/tapdisk-ioemu.c
+++ xen-4.4.0-testing/tools/qemu-xen-traditional-dir-remote/tapdisk-ioemu.c
@@ -12,34 +12,12 @@
 
 extern void qemu_aio_init(void);
 extern void qemu_aio_poll(void);
-extern void bdrv_init(void);
-
-extern void *qemu_mallocz(size_t size);
-extern void qemu_free(void *ptr);
 
 extern void *fd_start;
 
 int domid = 0;
 FILE* logfile;
 
-void term_printf(const char *fmt, ...)
-{
-    va_list ap;
-    va_start(ap, fmt);
-    vprintf(fmt, ap);
-    va_end(ap);
-}
-
-void term_print_filename(const char *filename)
-{
-    term_printf(filename);
-}
-
-
-typedef void IOReadHandler(void *opaque, const uint8_t *buf, int size);
-typedef int IOCanRWHandler(void *opaque);
-typedef void IOHandler(void *opaque);
-
 typedef struct IOHandlerRecord {
     int fd;
     IOCanRWHandler *fd_read_poll;
@@ -103,7 +81,6 @@ int main(void)
     logfile = stderr;
     
     bdrv_init();
-    qemu_aio_init();
     init_blktap();
 
     /* Daemonize */
@@ -115,8 +92,6 @@ int main(void)
      * completed aio operations.
      */
     while (1) {
-        qemu_aio_poll();
-
         max_fd = -1;
         FD_ZERO(&rfds);
         for(ioh = first_io_handler; ioh != NULL; ioh = ioh->next)
++++++ capslock_enable.patch ++++++
Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/vnc.c
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/vnc.c
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/vnc.c
@@ -1329,6 +1329,11 @@ static void do_key_event(VncState *vs, i
         }
         break;
     case 0x3a:			/* CapsLock */
+         if(!down){
+           vs->modifiers_state[keycode] ^= 1;
+            kbd_put_keycode(keycode | 0x80);
+        }
+        return;
     case 0x45:			/* NumLock */
 	if (down) {
             kbd_put_keycode(keycode & 0x7f);
++++++ cdrom-removable.patch ++++++
Index: xen-4.4.0-testing/tools/python/xen/xend/server/HalDaemon.py
===================================================================
--- /dev/null
+++ xen-4.4.0-testing/tools/python/xen/xend/server/HalDaemon.py
@@ -0,0 +1,243 @@
+#!/usr/bin/env python
+#  -*- mode: python; -*-
+#============================================================================
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of version 2.1 of the GNU Lesser General Public
+# License as published by the Free Software Foundation.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+#============================================================================
+# Copyright (C) 2007 Pat Campbell 
+# Copyright (C) 2007 Novell Inc.
+#============================================================================
+
+"""hald (Hardware Abstraction Layer Daemon) watcher for Xen management
+   of removable block device media.
+
+"""
+
+import gobject
+import dbus
+import dbus.glib
+import os
+import types
+import sys
+import signal
+import traceback
+from xen.xend.xenstore.xstransact import xstransact, complete
+from xen.xend.xenstore.xsutil import xshandle
+from xen.xend import PrettyPrint
+from xen.xend import XendLogging
+from xen.xend.XendLogging import log
+
+DEVICE_TYPES = ['vbd', 'tap']
+
+class HalDaemon:
+    """The Hald block device watcher for XEN
+    """
+
+    """Default path to the log file. """
+    logfile_default = "/var/log/xen/hald.log"
+
+    """Default level of information to be logged."""
+    loglevel_default = 'INFO'
+
+
+    def __init__(self):
+
+        XendLogging.init(self.logfile_default, self.loglevel_default)
+        log.debug( "%s", "__init__")
+
+        self.udi_dict = {}
+        self.debug = 0
+        self.dbpath = "/local/domain/0/backend"
+        self.bus = dbus.SystemBus()
+        self.hal_manager_obj = self.bus.get_object('org.freedesktop.Hal', '/org/freedesktop/Hal/Manager')
+        self.hal_manager = dbus.Interface( self.hal_manager_obj, 'org.freedesktop.Hal.Manager')
+        self.gatherBlockDevices()
+        self.registerDeviceCallbacks()
+
+    def run(self):
+        log.debug( "%s", "In new run" );
+        try:
+            self.mainloop = gobject.MainLoop()
+            self.mainloop.run()
+        except KeyboardInterrupt, ex:
+            log.debug('Keyboard exception handler: %s', ex )
+            self.mainloop.quit()
+        except Exception, ex:
+            log.debug('Generic exception handler: %s', ex )
+            self.mainloop.quit()
+
+    def __del__(self):
+        log.debug( "%s", "In del " );
+        self.unRegisterDeviceCallbacks()
+        self.mainloop.quit()
+
+    def shutdown(self):
+        log.debug( "%s", "In shutdown now " );
+        self.unRegisterDeviceCallbacks()
+        self.mainloop.quit()
+
+    def stop(self):
+        log.debug( "%s", "In stop now " );
+        self.unRegisterDeviceCallbacks()
+        self.mainloop.quit()
+
+    def gatherBlockDevices(self):
+
+        # Get all the current devices from hal and save in a dictionary
+        try:
+            device_names = self.hal_manager.GetAllDevices()
+            i = 0;
+            for name in device_names:
+                #log.debug("device name, device=%s",name)
+               dev_obj = self.bus.get_object ('org.freedesktop.Hal', name)
+               dev = dbus.Interface (dev_obj, 'org.freedesktop.Hal.Device')
+               dev_properties = dev_obj.GetAllProperties(dbus_interface="org.freedesktop.Hal.Device")
+               if dev_properties.has_key('block.device'):
+                   dev_str = dev_properties['block.device']
+                   dev_major = dev_properties['block.major']
+                   dev_minor = dev_properties['block.minor']
+                   udi_info = {}
+                   udi_info['device'] = dev_str
+                   udi_info['major'] = dev_major
+                   udi_info['minor'] = dev_minor
+                   udi_info['udi'] = name
+                   self.udi_dict[i] = udi_info
+                   i = i + 1
+        except Exception, ex:
+            print >>sys.stderr, 'Exception gathering block devices:', ex
+            log.warn("Exception gathering block devices (%s)",ex)
+
+    #
+    def registerDeviceCallbacks(self):
+        # setup the callbacks for when the gdl changes
+        self.hal_manager.connect_to_signal('DeviceAdded', self.device_added_callback)
+        self.hal_manager.connect_to_signal('DeviceRemoved', self.device_removed_callback)
+
+    #
+    def unRegisterDeviceCallbacks(self):
+        # setup the callbacks for when the gdl changes
+        self.hal_manager.remove_signal_receiver(self.device_added_callback,'DeviceAdded')
+        self.hal_manager.remove_signal_receiver(self.device_removed_callback,'DeviceRemoved')
+
+    #
+    def device_removed_callback(self,udi):
+        log.debug('UDI %s was removed',udi)
+        self.show_dict(self.udi_dict)
+        for key in self.udi_dict:
+            udi_info = self.udi_dict[key]
+            if udi_info['udi'] == udi:
+                device = udi_info['device']
+                major = udi_info['major']
+                minor = udi_info['minor']
+                self.change_xenstore( "remove", device, major, minor)
+
+    # Adds device to dictionary if not already there
+    def device_added_callback(self,udi):
+        log.debug('UDI %s was added', udi)
+        self.show_dict(self.udi_dict)
+        dev_obj = self.bus.get_object ('org.freedesktop.Hal', udi)
+        dev = dbus.Interface (dev_obj, 'org.freedesktop.Hal.Device')
+        device = dev.GetProperty ('block.device')
+        major = dev.GetProperty ('block.major')
+        minor = dev.GetProperty ('block.minor')
+        udi_info = {}
+        udi_info['device'] = device
+        udi_info['major'] = major
+        udi_info['minor'] = minor
+        udi_info['udi'] = udi
+        already = 0
+        cnt = 0;
+        for key in self.udi_dict:
+            info = self.udi_dict[key]
+            if info['udi'] == udi:
+                already = 1
+                break
+            cnt = cnt + 1
+        if already == 0:
+           self.udi_dict[cnt] = udi_info;
+           log.debug('UDI %s was added, device:%s major:%s minor:%s index:%d\n', udi, device, major, minor, cnt)
+        self.change_xenstore( "add", device, major, minor)
+
+    # Debug helper, shows dictionary contents
+    def show_dict(self,dict=None):
+        if self.debug == 0 :
+            return
+        if dict == None :
+            dict = self.udi_dict
+        for key in dict:
+            log.debug('udi_info %s udi_info:%s',key,dict[key])
+
+    # Set or clear xenstore media-present depending on the action argument
+    #  for every vbd that has this block device
+    def change_xenstore(self,action, device, major, minor):
+        for type in DEVICE_TYPES:
+            path = self.dbpath + '/' + type
+            domains = xstransact.List(path)
+            log.debug('domains: %s', domains)
+            for domain in domains:   # for each domain
+                devices = xstransact.List( path + '/' + domain)
+                log.debug('devices: %s',devices)
+                for device in devices:  # for each vbd device
+                   str = device.split('/')
+                   vbd_type = None;
+                   vbd_physical_device = None
+                   vbd_media = None
+                   vbd_device_path = path + '/' + domain + '/' + device
+                   listing = xstransact.List(vbd_device_path)
+                   for entry in listing: # for each entry
+                       item = path + '/' + entry
+                       value = xstransact.Read( vbd_device_path + '/' + entry)
+                       log.debug('%s=%s',item,value)
+                       if item.find('media-present') != -1:
+                           vbd_media = item;
+                           vbd_media_path = item
+                       if item.find('physical-device') != -1:
+                           vbd_physical_device = value;
+                       if item.find('type') != -1:
+                           vbd_type = value;
+                   if vbd_type is not None and vbd_physical_device is not None and vbd_media is not None :
+                       inode = vbd_physical_device.split(':')
+                       imajor = parse_hex(inode[0])
+                       iminor = parse_hex(inode[1])
+                       log.debug("action:%s major:%s- minor:%s- imajor:%s- iminor:%s- inode: %s",
+                               action,major,minor, imajor, iminor, inode)
+                       if int(imajor) == int(major) and int(iminor) == int(minor):
+                           if action == "add":
+                               xs_dict = {'media': "1"}
+                               xstransact.Write(vbd_device_path, 'media-present', "1" )
+                               log.debug("wrote xenstore media-present 1 path:%s",vbd_media_path)
+                           else:
+                               xstransact.Write(vbd_device_path, 'media-present', "0" )
+                               log.debug("wrote xenstore media 0 path:%s",vbd_media_path)
+
+def mylog( fmt, *args):
+    f = open('/tmp/haldaemon.log', 'a')
+    print >>f, "HalDaemon ", fmt % args
+    f.close()
+
+
+def parse_hex(val):
+    try:
+        if isinstance(val, types.StringTypes):
+            return int(val, 16)
+        else:
+            return val
+    except ValueError:
+        return None
+
+if __name__ == "__main__":
+    watcher = HalDaemon()
+    watcher.run()
+    print 'Falling off end'
+
+
Index: xen-4.4.0-testing/tools/python/xen/xend/server/Hald.py
===================================================================
--- /dev/null
+++ xen-4.4.0-testing/tools/python/xen/xend/server/Hald.py
@@ -0,0 +1,125 @@
+#============================================================================
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of version 2.1 of the GNU Lesser General Public
+# License as published by the Free Software Foundation.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+#============================================================================
+# Copyright (C) 2007 Pat Campbell 
+# Copyright (C) 2007 Novell Inc.
+#============================================================================
+
+import errno
+import types
+import os
+import sys
+import time
+import signal
+from traceback import print_exc
+
+from xen.xend.XendLogging import log
+
+class Hald:
+    def __init__(self):
+        self.ready = False
+        self.running = True
+
+    def run(self):
+        """Starts the HalDaemon process
+        """
+        self.ready = True
+        try:
+            myfile =  self.find("xen/xend/server/HalDaemon.py")
+            args = (["python", myfile ])
+            self.pid = self.daemonize("python", args )
+            #log.debug( "%s %s pid:%d", "Hald.py starting ", args, self.pid )
+        except:
+            self.pid = -1
+            log.debug("Unable to start HalDaemon process")
+
+    def shutdown(self):
+        """Shutdown the HalDaemon process
+        """
+        log.debug("%s  pid:%d", "Hald.shutdown()", self.pid)
+        self.running = False
+        self.ready = False
+        if self.pid != -1:
+            try:
+                os.kill(self.pid, signal.SIGINT)
+            except:
+                print_exc()
+
+    def daemonize(self,prog, args):
+        """Runs a program as a daemon with the list of arguments.  Returns the PID
+        of the daemonized program, or returns 0 on error.
+        Copied from xm/create.py instead of importing to reduce coupling
+        """
+        r, w = os.pipe()
+        pid = os.fork()
+
+        if pid == 0:
+            os.close(r)
+            w = os.fdopen(w, 'w')
+            os.setsid()
+            try:
+                pid2 = os.fork()
+            except:
+                pid2 = None
+            if pid2 == 0:
+                os.chdir("/")
+                env = os.environ.copy()
+                env['PYTHONPATH'] = self.getpythonpath()
+                for fd in range(0, 256):
+                    try:
+                        os.close(fd)
+                    except:
+                        pass
+                os.open("/dev/null", os.O_RDWR)
+                os.dup2(0, 1)
+                os.dup2(0, 2)
+                os.execvpe(prog, args, env)
+                os._exit(1)
+            else:
+                w.write(str(pid2 or 0))
+                w.close()
+                os._exit(0)
+        os.close(w)
+        r = os.fdopen(r)
+        daemon_pid = int(r.read())
+        r.close()
+        os.waitpid(pid, 0)
+        #log.debug( "daemon_pid: %d", daemon_pid )
+        return daemon_pid
+
+    def getpythonpath(self):
+        str = " "
+        for p in sys.path:
+            if str != " ":
+                str = str + ":" + p
+            else:
+                if str != "":
+                   str = p
+        return str
+
+    def find(self,path, matchFunc=os.path.isfile):
+        """Find a module in the sys.path
+        From web page: http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/52224
+        """
+        for dirname in sys.path:
+            candidate = os.path.join(dirname, path)
+            if matchFunc(candidate):
+                return candidate
+        raise Error("Can't find file %s" % path)
+
+if __name__ == "__main__":
+    watcher = Hald()
+    watcher.run()
+    time.sleep(10)
+    watcher.shutdown()
Index: xen-4.4.0-testing/tools/python/xen/xend/server/SrvServer.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/server/SrvServer.py
+++ xen-4.4.0-testing/tools/python/xen/xend/server/SrvServer.py
@@ -57,6 +57,7 @@ from xen.web.SrvDir import SrvDir
 
 from SrvRoot import SrvRoot
 from XMLRPCServer import XMLRPCServer
+from xen.xend.server.Hald import Hald
 
 xoptions = XendOptions.instance()
 
@@ -252,6 +253,8 @@ def _loadConfig(servers, root, reload):
     if xoptions.get_xend_unix_xmlrpc_server():
         servers.add(XMLRPCServer(XendAPI.AUTH_PAM, False))
 
+    servers.add(Hald())
+
 
 def create():
     root = SrvDir()
Index: xen-4.4.0-testing/tools/qemu-xen-traditional-dir-remote/xenstore.c
===================================================================
--- xen-4.4.0-testing.orig/tools/qemu-xen-traditional-dir-remote/xenstore.c
+++ xen-4.4.0-testing/tools/qemu-xen-traditional-dir-remote/xenstore.c
@@ -18,6 +18,7 @@
 #include "exec-all.h"
 #include "sysemu.h"
 
+#include "console.h"
 #include "hw.h"
 #include "pci.h"
 #include "qemu-timer.h"
@@ -604,6 +605,21 @@ void xenstore_parse_domain_config(int hv
 #endif
 
         bs = bdrv_new(dev);
+
+        /* if cdrom physical put a watch on media-present */
+        if (bdrv_get_type_hint(bs) ==  BDRV_TYPE_CDROM) {
+            if (drv && !strcmp(drv, "phy")) {
+                if (pasprintf(&buf, "%s/media-present", bpath) != -1) {
+                    if (bdrv_is_inserted(bs))
+                        xs_write(xsh, XBT_NULL, buf, "1", strlen("1"));
+                    else {
+                        xs_write(xsh, XBT_NULL, buf, "0", strlen("0"));
+                    }
+                    xs_watch(xsh, buf, "media-present");
+                }
+            }
+        }
+
         /* check if it is a cdrom */
         if (danger_type && !strcmp(danger_type, "cdrom")) {
             bdrv_set_type_hint(bs, BDRV_TYPE_CDROM);
@@ -1095,6 +1111,50 @@ static void xenstore_process_vcpu_set_ev
     return;
 }
 
+static void xenstore_process_media_change_event(char **vec)
+{
+    char *media_present = NULL;
+    unsigned int len;
+
+    media_present = xs_read(xsh, XBT_NULL, vec[XS_WATCH_PATH], &len);
+
+    if (media_present) {
+        BlockDriverState *bs;
+        char *buf = NULL, *cp = NULL, *path = NULL, *dev = NULL;
+
+        path = strdup(vec[XS_WATCH_PATH]);
+        cp = strstr(path, "media-present");
+        if (cp){
+            *(cp-1) = '\0';
+            pasprintf(&buf, "%s/dev", path);
+            dev = xs_read(xsh, XBT_NULL, buf, &len);
+            if (dev) {
+                if ( !strncmp(dev, "xvd", 3)) {
+                    memmove(dev, dev+1, strlen(dev));
+                    dev[0] = 'h';
+                    dev[1] = 'd';
+                }
+                bs = bdrv_find(dev);
+                if (!bs) {
+                    term_printf("device not found\n");
+                    return;
+                }
+                if (strcmp(media_present, "0") == 0 && bs) {
+                    bdrv_close(bs);
+                }
+                else if (strcmp(media_present, "1") == 0 &&
+                        bs != NULL && bs->drv == NULL) {
+                    if (bdrv_open(bs, bs->filename, 0 /* snapshot */) < 0) {
+                        fprintf(logfile, "%s() qemu: could not open cdrom disk '%s'\n",
+                                __func__, bs->filename);
+                    }
+                    bs->media_changed = 1;
+                }
+            }
+        }
+    }
+}
+
 void xenstore_process_event(void *opaque)
 {
     char **vec, *offset, *bpath = NULL, *buf = NULL, *drv = NULL, *image = NULL;
@@ -1130,6 +1190,11 @@ void xenstore_process_event(void *opaque
             xenstore_watch_callbacks[i].cb(vec[XS_WATCH_TOKEN],
                                            xenstore_watch_callbacks[i].opaque);
 
+    if (!strcmp(vec[XS_WATCH_TOKEN], "media-present")) {
+	xenstore_process_media_change_event(vec);
+	goto out;
+    }
+
     hd_index = drive_name_to_index(vec[XS_WATCH_TOKEN]);
     if (hd_index == -1) {
 	fprintf(stderr,"medium change watch on `%s' -"
++++++ change-vnc-passwd.patch ++++++
Add support of change-vnc-password while vm is running.

Signed-off-by: Chunyan Liu 

---
 tools/python/xen/xend/XendDomainInfo.py          |   14 ++++++++++++++
 tools/python/xen/xend/server/XMLRPCServer.py     |    2 +-
 tools/python/xen/xm/main.py                      |   12 ++++++++++++
 tools/qemu-xen-traditional-dir-remote/vl.c       |    2 +-
 tools/qemu-xen-traditional-dir-remote/vnc.c      |    1 +
 tools/qemu-xen-traditional-dir-remote/xenstore.c |   14 ++++++++++++++
 6 files changed, 43 insertions(+), 2 deletions(-)

Index: xen-4.4.3-testing/tools/python/xen/xend/XendDomainInfo.py
===================================================================
--- xen-4.4.3-testing.orig/tools/python/xen/xend/XendDomainInfo.py
+++ xen-4.4.3-testing/tools/python/xen/xend/XendDomainInfo.py
@@ -1665,6 +1665,20 @@ class XendDomainInfo:
                     vfb_ctrl.reconfigureDevice(0, dev_info)
                     break
                 
+    def chgvncpasswd(self, passwd):
+        if self._stateGet() != DOM_STATE_HALTED:
+            path = '/local/domain/0/backend/vfb/%u/0/' % self.getDomid()
+            xstransact.Write(path, 'vncpasswd', passwd)
+            self.image.signalDeviceModel("chgvncpasswd", "vncpasswdchged")
+
+        for dev_uuid, (dev_type, dev_info) in self.info['devices'].items():
+            if dev_type == 'vfb':
+                dev_info['vncpasswd'] = passwd
+                dev_info['other_config']['vncpasswd'] = passwd
+                self.info.device_update(dev_uuid, cfg_xenapi = dev_info)
+                break
+        xen.xend.XendDomain.instance().managed_config_save(self)
+
     #
     # Function to update xenstore /vm/*
     #
Index: xen-4.4.3-testing/tools/python/xen/xend/server/XMLRPCServer.py
===================================================================
--- xen-4.4.3-testing.orig/tools/python/xen/xend/server/XMLRPCServer.py
+++ xen-4.4.3-testing/tools/python/xen/xend/server/XMLRPCServer.py
@@ -95,7 +95,7 @@ methods = ['device_create', 'device_conf
            'destroyDevice','getDeviceSxprs',
            'setMemoryTarget', 'setName', 'setVCpuCount', 'shutdown',
            'send_sysrq', 'getVCPUInfo', 'waitForDevices',
-           'getRestartCount', 'getBlockDeviceClass']
+           'getRestartCount', 'getBlockDeviceClass', 'chgvncpasswd']
 
 exclude = ['domain_create', 'domain_restore']
 
Index: xen-4.4.3-testing/tools/python/xen/xm/main.py
===================================================================
--- xen-4.4.3-testing.orig/tools/python/xen/xm/main.py
+++ xen-4.4.3-testing/tools/python/xen/xm/main.py
@@ -21,6 +21,7 @@
 
 """Grand unified management application for Xen.
 """
+import getpass
 import atexit
 import cmd
 import os
@@ -280,6 +281,9 @@ SUBCOMMAND_HELP = {
     'getenforce'    :  ('', 'Returns the current enforcing mode for the Flask XSM module (Enforcing,Permissive)'),
     'setenforce'    :  ('[ (Enforcing|1) | (Permissive|0) ]',
                         'Modifies the current enforcing mode for the Flask XSM module'),
+    #change vnc password
+    'change-vnc-passwd' : ('<Domain>',\
+                           'Change vnc password'),
 }
 
 SUBCOMMAND_OPTIONS = {
@@ -404,6 +408,7 @@ common_commands = [
     "usb-del",
     "domstate",
     "vcpu-set",
+    "change-vnc-passwd",
     ]
 
 domain_commands = [
@@ -441,6 +446,7 @@ domain_commands = [
     "vcpu-list",
     "vcpu-pin",
     "vcpu-set",
+    "change-vnc-passwd",
     ]
 
 host_commands = [
@@ -3751,6 +3757,10 @@ def xm_cpupool_migrate(args):
     else:
         server.xend.cpu_pool.migrate(domname, poolname)
 
+def xm_chgvncpasswd(args):
+    arg_check(args, "change-vnc-passwd", 1)
+    pwd = getpass.getpass("Enter new password: ")
+    server.xend.domain.chgvncpasswd(args[0], pwd)
 
 commands = {
     "shell": xm_shell,
@@ -3857,6 +3867,8 @@ commands = {
     "usb-del": xm_usb_del,
     #domstate
     "domstate": xm_domstate,
+    #change vnc password:
+    "change-vnc-passwd": xm_chgvncpasswd,
     }
 
 ## The commands supported by a separate argument parser in xend.xm.
Index: xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/vl.c
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-traditional-dir-remote/vl.c
+++ xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/vl.c
@@ -200,7 +200,7 @@ DriveInfo drives_table[MAX_DRIVES+1];
 int nb_drives;
 enum vga_retrace_method vga_retrace_method = VGA_RETRACE_DUMB;
 int vga_ram_size;
-static DisplayState *display_state;
+DisplayState *display_state;
 int nographic;
 static int curses;
 static int sdl;
Index: xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/vnc.c
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-traditional-dir-remote/vnc.c
+++ xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/vnc.c
@@ -2607,6 +2607,7 @@ int vnc_display_password(DisplayState *d
     if (password && password[0]) {
 	if (!(vs->password = qemu_strdup(password)))
 	    return -1;
+	vs->auth = VNC_AUTH_VNC;
     }
 
     return 0;
Index: xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/xenstore.c
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-traditional-dir-remote/xenstore.c
+++ xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/xenstore.c
@@ -25,6 +25,7 @@
 #include "qemu-xen.h"
 #include "xen_backend.h"
 
+extern DisplayState *display_state;
 struct xs_handle *xsh = NULL;
 static char *media_filename[MAX_DRIVES+1];
 static QEMUTimer *insert_timer = NULL;
@@ -897,6 +898,19 @@ static void xenstore_process_dm_command_
     } else if (!strncmp(command, "continue", len)) {
         fprintf(logfile, "dm-command: continue after state save\n");
         xen_pause_requested = 0;
+    } else if (!strncmp(command, "chgvncpasswd", len)) {
+        fprintf(logfile, "dm-command: change vnc passwd\n");
+        if (pasprintf(&path,
+                "/local/domain/0/backend/vfb/%u/0/vncpasswd", domid) == -1) {
+            fprintf(logfile, "out of memory reading dm command parameter\n");
+            goto out;
+        }
+        par = xs_read(xsh, XBT_NULL, path, &len);
+        if (!par)
+            goto out;
+        if (vnc_display_password(display_state, par) == 0)
+            xenstore_record_dm_state("vncpasswdchged");
+        free(par);
     } else if (!strncmp(command, "usb-add", len)) {
         fprintf(logfile, "dm-command: usb-add a usb device\n");
         if (pasprintf(&path,
++++++ disable-wget-check.patch ++++++
Index: xen-4.4.1-testing/tools/configure
===================================================================
--- xen-4.4.1-testing.orig/tools/configure
+++ xen-4.4.1-testing/tools/configure
@@ -633,9 +633,6 @@ libgcrypt
 EXTFS_LIBS
 system_aio
 zlib
-FETCHER
-FTP
-WGET
 glib_LIBS
 glib_CFLAGS
 PKG_CONFIG_LIBDIR
@@ -7375,104 +7372,104 @@ $as_echo "yes" >&6; }
 fi
 
 # Extract the first word of "wget", so it can be a program name with args.
-set dummy wget; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_WGET+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  case $WGET in
-  [\\/]* | ?:[\\/]*)
-  ac_cv_path_WGET="$WGET" # Let the user override the test with a path.
-  ;;
-  *)
-  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
-for as_dir in $PATH
-do
-  IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
-    for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
-    ac_cv_path_WGET="$as_dir/$ac_word$ac_exec_ext"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
-    break 2
-  fi
-done
-  done
-IFS=$as_save_IFS
-
-  test -z "$ac_cv_path_WGET" && ac_cv_path_WGET="no"
-  ;;
-esac
-fi
-WGET=$ac_cv_path_WGET
-if test -n "$WGET"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $WGET" >&5
-$as_echo "$WGET" >&6; }
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-fi
-
-
-if test x"$WGET" != x"no"; then :
-
-    FETCHER="$WGET -c -O"
-
-else
-
-    # Extract the first word of "ftp", so it can be a program name with args.
-set dummy ftp; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_FTP+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  case $FTP in
-  [\\/]* | ?:[\\/]*)
-  ac_cv_path_FTP="$FTP" # Let the user override the test with a path.
-  ;;
-  *)
-  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
-for as_dir in $PATH
-do
-  IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
-    for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
-    ac_cv_path_FTP="$as_dir/$ac_word$ac_exec_ext"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
-    break 2
-  fi
-done
-  done
-IFS=$as_save_IFS
-
-  test -z "$ac_cv_path_FTP" && ac_cv_path_FTP="no"
-  ;;
-esac
-fi
-FTP=$ac_cv_path_FTP
-if test -n "$FTP"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $FTP" >&5
-$as_echo "$FTP" >&6; }
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-fi
-
-
-    if test x"$FTP" != x"no"; then :
-
-        FETCHER="$FTP -o"
-
-else
-
-        as_fn_error $? "cannot find wget or ftp" "$LINENO" 5
-
-fi
-
-fi
+#set dummy wget; ac_word=$2
+#{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+#$as_echo_n "checking for $ac_word... " >&6; }
+#if ${ac_cv_path_WGET+:} false; then :
+#  $as_echo_n "(cached) " >&6
+#else
+#  case $WGET in
+#  [\\/]* | ?:[\\/]*)
+#  ac_cv_path_WGET="$WGET" # Let the user override the test with a path.
+#  ;;
+#  *)
+#  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+#for as_dir in $PATH
+#do
+#  IFS=$as_save_IFS
+#  test -z "$as_dir" && as_dir=.
+#    for ac_exec_ext in '' $ac_executable_extensions; do
+#  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+#    ac_cv_path_WGET="$as_dir/$ac_word$ac_exec_ext"
+#    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+#    break 2
+#  fi
+#done
+#  done
+#IFS=$as_save_IFS
+#
+#  test -z "$ac_cv_path_WGET" && ac_cv_path_WGET="no"
+#  ;;
+#esac
+#fi
+#WGET=$ac_cv_path_WGET
+#if test -n "$WGET"; then
+#  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $WGET" >&5
+#$as_echo "$WGET" >&6; }
+#else
+#  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+#$as_echo "no" >&6; }
+#fi
+#
+#
+#if test x"$WGET" != x"no"; then :
+#
+#    FETCHER="$WGET -c -O"
+#
+#else
+#
+#    # Extract the first word of "ftp", so it can be a program name with args.
+#set dummy ftp; ac_word=$2
+#{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+#$as_echo_n "checking for $ac_word... " >&6; }
+#if ${ac_cv_path_FTP+:} false; then :
+#  $as_echo_n "(cached) " >&6
+#else
+#  case $FTP in
+#  [\\/]* | ?:[\\/]*)
+#  ac_cv_path_FTP="$FTP" # Let the user override the test with a path.
+#  ;;
+#  *)
+#  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+#for as_dir in $PATH
+#do
+#  IFS=$as_save_IFS
+#  test -z "$as_dir" && as_dir=.
+#    for ac_exec_ext in '' $ac_executable_extensions; do
+#  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+#    ac_cv_path_FTP="$as_dir/$ac_word$ac_exec_ext"
+#    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+#    break 2
+#  fi
+#done
+#  done
+#IFS=$as_save_IFS
+#
+#  test -z "$ac_cv_path_FTP" && ac_cv_path_FTP="no"
+#  ;;
+#esac
+#fi
+#FTP=$ac_cv_path_FTP
+#if test -n "$FTP"; then
+#  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $FTP" >&5
+#$as_echo "$FTP" >&6; }
+#else
+#  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+#$as_echo "no" >&6; }
+#fi
+#
+#
+#    if test x"$FTP" != x"no"; then :
+#
+#        FETCHER="$FTP -o"
+#
+#else
+#
+#        as_fn_error $? "cannot find wget or ftp" "$LINENO" 5
+#
+#fi
+#
+#fi
 
 
 
Index: xen-4.4.1-testing/stubdom/configure
===================================================================
--- xen-4.4.1-testing.orig/stubdom/configure
+++ xen-4.4.1-testing/stubdom/configure
@@ -623,8 +623,6 @@ LDFLAGS
 CFLAGS
 CC
 FETCHER
-FTP
-WGET
 CMAKE
 extfiles
 debug
@@ -2300,104 +2298,104 @@ extfiles=$ax_cv_extfiles
 
 
 # Extract the first word of "wget", so it can be a program name with args.
-set dummy wget; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_WGET+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  case $WGET in
-  [\\/]* | ?:[\\/]*)
-  ac_cv_path_WGET="$WGET" # Let the user override the test with a path.
-  ;;
-  *)
-  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
-for as_dir in $PATH
-do
-  IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
-    for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
-    ac_cv_path_WGET="$as_dir/$ac_word$ac_exec_ext"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
-    break 2
-  fi
-done
-  done
-IFS=$as_save_IFS
-
-  test -z "$ac_cv_path_WGET" && ac_cv_path_WGET="no"
-  ;;
-esac
-fi
-WGET=$ac_cv_path_WGET
-if test -n "$WGET"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $WGET" >&5
-$as_echo "$WGET" >&6; }
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-fi
-
-
-if test x"$WGET" != x"no"; then :
-
-    FETCHER="$WGET -c -O"
-
-else
-
-    # Extract the first word of "ftp", so it can be a program name with args.
-set dummy ftp; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_FTP+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  case $FTP in
-  [\\/]* | ?:[\\/]*)
-  ac_cv_path_FTP="$FTP" # Let the user override the test with a path.
-  ;;
-  *)
-  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
-for as_dir in $PATH
-do
-  IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
-    for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
-    ac_cv_path_FTP="$as_dir/$ac_word$ac_exec_ext"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
-    break 2
-  fi
-done
-  done
-IFS=$as_save_IFS
-
-  test -z "$ac_cv_path_FTP" && ac_cv_path_FTP="no"
-  ;;
-esac
-fi
-FTP=$ac_cv_path_FTP
-if test -n "$FTP"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $FTP" >&5
-$as_echo "$FTP" >&6; }
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-fi
-
-
-    if test x"$FTP" != x"no"; then :
-
-        FETCHER="$FTP -o"
-
-else
-
-        as_fn_error $? "cannot find wget or ftp" "$LINENO" 5
-
-fi
-
-fi
+#set dummy wget; ac_word=$2
+#{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+#$as_echo_n "checking for $ac_word... " >&6; }
+#if ${ac_cv_path_WGET+:} false; then :
+#  $as_echo_n "(cached) " >&6
+#else
+#  case $WGET in
+#  [\\/]* | ?:[\\/]*)
+#  ac_cv_path_WGET="$WGET" # Let the user override the test with a path.
+#  ;;
+#  *)
+#  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+#for as_dir in $PATH
+#do
+#  IFS=$as_save_IFS
+#  test -z "$as_dir" && as_dir=.
+#    for ac_exec_ext in '' $ac_executable_extensions; do
+#  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+#    ac_cv_path_WGET="$as_dir/$ac_word$ac_exec_ext"
+#    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+#    break 2
+#  fi
+#done
+#  done
+#IFS=$as_save_IFS
+#
+#  test -z "$ac_cv_path_WGET" && ac_cv_path_WGET="no"
+#  ;;
+#esac
+#fi
+#WGET=$ac_cv_path_WGET
+#if test -n "$WGET"; then
+#  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $WGET" >&5
+#$as_echo "$WGET" >&6; }
+#else
+#  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+#$as_echo "no" >&6; }
+#fi
+#
+#
+#if test x"$WGET" != x"no"; then :
+#
+#    FETCHER="$WGET -c -O"
+#
+#else
+#
+#    # Extract the first word of "ftp", so it can be a program name with args.
+#set dummy ftp; ac_word=$2
+#{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+#$as_echo_n "checking for $ac_word... " >&6; }
+#if ${ac_cv_path_FTP+:} false; then :
+#  $as_echo_n "(cached) " >&6
+#else
+#  case $FTP in
+#  [\\/]* | ?:[\\/]*)
+#  ac_cv_path_FTP="$FTP" # Let the user override the test with a path.
+#  ;;
+#  *)
+#  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+#for as_dir in $PATH
+#do
+#  IFS=$as_save_IFS
+#  test -z "$as_dir" && as_dir=.
+#    for ac_exec_ext in '' $ac_executable_extensions; do
+#  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+#    ac_cv_path_FTP="$as_dir/$ac_word$ac_exec_ext"
+#    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+#    break 2
+#  fi
+#done
+#  done
+#IFS=$as_save_IFS
+#
+#  test -z "$ac_cv_path_FTP" && ac_cv_path_FTP="no"
+#  ;;
+#esac
+#fi
+#FTP=$ac_cv_path_FTP
+#if test -n "$FTP"; then
+#  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $FTP" >&5
+#$as_echo "$FTP" >&6; }
+#else
+#  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+#$as_echo "no" >&6; }
+#fi
+#
+#
+#    if test x"$FTP" != x"no"; then :
+#
+#        FETCHER="$FTP -o"
+#
+#else
+#
+#        as_fn_error $? "cannot find wget or ftp" "$LINENO" 5
+#
+#fi
+#
+#fi
 
 
 
++++++ domUloader.py ++++++
#!/usr/bin/env python
# domUloader.py
"""Loader for kernel and (optional) ramdisk from domU filesystem

Given a physical disk (or disk image) for a domU and the path of a kernel and
optional ramdisk, copies the kernel and ramdisk from the domU disk to a
temporary location in dom0.

The --entry parameter specifies the location of the kernel (and optional
ramdisk) within the domU filesystem.  dev is the disk as seen by domU.
Filenames are relative to that filesystem.

The disk is passed as the last parameter.  It must be a block device or raw
disk image.  More complex disk images (QCOW, VMDK, etc) must already be
configured via blktap and presented as a block device.

The script writes an sxpr specifying the locations of the copied kernel and
ramdisk into the file specified by --output (default is stdout).

Limitations:
 - It is assumed both kernel and ramdisk are on the same filesystem.
 - domUs might use LVM; the script currently does not have support for setting
   up LVM mappings for domUs; it's not trivial and we might risk namespace
   conflicts. If you want to use LVM inside domUs, set up a small non-LVM boot
   partition and specify it in bootentry.
 
The script uses kpartx (multipath-tools) to create mappings for devices that
are exported as whole disk devices that are partitioned.

(c) 01/2006 Novell Inc
License: GNU GPL
Author: Kurt Garloff 
"""

import os, sys, getopt
from stat import *
from xen.xend import sxp
import tempfile
import time
import xnloader

# Global options
quiet = False
verbose = False
dryrun = False
tmpdir = '/var/lib/xen/tmp'
in_args = ''
# kpartx, left to its own devices, does not consistently pick the
# same partition separator.  Explicitly specify it.
kpartx_args = '-p -part'

# Helper functions

def kpartx_has_opt(opt):
    """ Return True if kpartx supports option opt, otherwise False"""
    have_opt = True
    kpartx_cmd = 'kpartx -' + opt + ' 2>&1'
    p = os.popen(kpartx_cmd)
    for line in p.readlines():
        if line.find('invalid option') >= 0:
            have_opt = False
            break
    p.close()
    return have_opt

def error(s):
    print >> sys.stderr, "domUloader error: %s" % s

def verbose_print(s):
    if verbose:
        print >> sys.stderr, "domUloader: %s" % s

def traildigits(strg):
    """Return the trailing digits, used to split the partition number off"""
    idx = len(strg)-1
    while strg[idx].isdigit():
        if len == 0:
            return strg
        idx -= 1
    return strg[idx+1:]    

def getWholedisk(part):
    while len(part) and part[len(part)-1].isdigit():
        part = part[:-1]
    return part

#def isWholedisk(domUname):
#    """Determines whether dev is a wholedisk dev"""
#    return not domUname[-1:].isdigit()

# If available, add '-f' option (bnc#613584)
if kpartx_has_opt('f'):
    kpartx_args += ' -f'

class Wholedisk:
    "Class representing a whole disk that may have partitions"
    def __init__(self, vdev, pdev):
        "c'tor: set up"
        # Initialize object; will not raise:
        self.ldev = None
        self.vdev = vdev
        self.pdev = pdev
        self.mapped = 0
        self.partitions = []
        self.pcount = 0
        self.lvm = False
        # Finish initialization; may raise:
        self.is_blk = (S_ISBLK(os.stat(pdev)[ST_MODE]))
        self.pcount = self.scanpartitions()

    def physdev(self):
        """Gets the physical device used to access the device from dom0"""
        if self.ldev:
            return self.ldev
        return self.pdev

    def findPart(self, vdev):
        "Find device dev in list of partitions"
        if len(vdev) > 5 and vdev[:5] == "/dev/":
            vdev = vdev[5:]
        for part in self.partitions:
            if vdev == part.vdev:
                return part
        if len(self.partitions):
            return self.partitions[0]
        return None

    def loopsetup(self):
        """Sets up the loop mapping for a disk image.

        Will raise if no loopbacks are available.
        """
        if not self.is_blk and not self.ldev:
            # Loops through all loopback devices, attempting to
            # find a free one to set up.  Don't scan for free and
            # then try to set it up as a separate step - too racy!
            i = 0
            while True:
                ldev = '/dev/loop%i' % (i)
                if not os.path.exists(ldev):
                    break
                i += 1
                fd = os.popen("losetup %s '%s' 2> /dev/null" % (ldev, self.pdev))
                if not fd.close():
                    verbose_print("losetup %s '%s'" % (ldev, self.pdev))
                    self.ldev = ldev
                    break
            if not self.ldev:
                raise RuntimeError("No free loop device found")

    def loopclean(self):
        """Delete the loop mapping.

        Will never raise.
        """
        if self.ldev:
            verbose_print("losetup -d %s" % self.ldev)
            # Even seemingly innocent queries like "losetup /dev/loop0"
            # can temporarily block the loopback and cause transient
            # failures deleting the loopback, hence the retry logic.
            retries = 10
            while retries:
                fd = os.popen("losetup -d %s" % self.ldev)
                if not fd.close():
                    self.ldev = None
                    break
                else:
                    # Mappings may not have been deleted due to race
                    # between udev and dm - see bnc#379032.  Causes
                    # loop devices to leak.  Call kpartx -d again
                    os.system("kpartx %s -d '%s'" % (kpartx_args, self.physdev()))
                    time.sleep(0.1)
                    retries -= 1

    def scanlvmpartitions(self):
        pcount = 0
        verbose_print("vgchange -ay '%s'" % (self.vdev))
        ret = os.system("vgchange -ay '%s' > /dev/null 2>&1" % (self.vdev)) >> 8
        if not ret:
            self.lvm = True
            verbose_print("lvscan | grep '/dev/%s'" % (self.vdev))
            fd = os.popen("lvscan | grep '/dev/%s'" % (self.vdev))
            for line in fd.readlines():
                line = line.strip()
                (t1, lvname, t2) = line.split('\'')
                pname = lvname[lvname.rfind('/')+1:]
                pname = pname.strip()
                pname = "/dev/mapper/" + self.vdev + "-" + pname
                verbose_print("Found partition: vdev %s, pdev %s" % (self.vdev, pname))
                self.partitions.append(Partition(self, self.vdev, pname))
                pcount += 1
            fd.close()
            verbose_print("vgchange -an '%s'" % (self.vdev))
            os.system("vgchange -an '%s' > /dev/null 2>&1" % (self.vdev))
        else:
            verbose_print("vgchange -ay %s ... failed: -%d" % (self.vdev, ret))

        return pcount 
    
    def scanpartitions(self):
        """Scan device for partitions (kpartx -l) and set up data structures,
           Returns number of partitions found."""
        self.loopsetup()
        # TODO: We could use fdisk -l instead and look at the type of
        #  partitions; this way we could also detect LVM and support it.
        verbose_print("kpartx %s -l '%s'" % (kpartx_args, self.physdev()))
        fd = os.popen("kpartx %s -l '%s'" % (kpartx_args, self.physdev()))
        pcount = 0
        for line in fd.readlines():
            line = line.strip()
            verbose_print("kpartx -l: %s" % (line,))
            (pname, params) = line.split(' : ')
            pname = pname.strip()
            pno = int(traildigits(pname))
            #if pname.rfind('/') != -1:
            #    pname = pname[pname.rfind('/')+1:]
            #pname = self.pdev[:self.pdev.rfind('/')] + '/' + pname
            pname = "/dev/mapper/" + pname
            verbose_print("Found partition: vdev %s, pdev %s" % ('%s%i' % (self.vdev, pno), pname))
            self.partitions.append(Partition(self, '%s%i' % (self.vdev, pno), pname))
            pcount += 1
        fd.close()

        # Try lvm
        if not pcount:
            pcount = self.scanlvmpartitions()

        # Add self to partition table
        if not pcount:
            if self.ldev:
                ref = self
            else:
                ref = None
            self.partitions.append(Partition(ref, self.vdev, self.pdev))
        return pcount

    def activatepartitions(self):
        "Set up loop mapping and device-mapper mappings"
        verbose_print("activatepartitions")
        if not self.mapped:
            self.loopsetup()
            if self.pcount:
                verbose_print("kpartx %s -a '%s'" % (kpartx_args, self.physdev()))
                fd = os.popen("kpartx %s -a '%s'" % (kpartx_args, self.physdev()))
                fd.close()
            if self.pcount and self.lvm:
                verbose_print("vgchange -ay '%s'" % (self.vdev))
                ret = os.system("vgchange -ay '%s' > /dev/null 2>&1" % (self.vdev)) >> 8
                if not ret:
                    verbose_print("lvchange -ay '%s'" % (self.vdev))
                    os.system("lvchange -ay '%s' > /dev/null 2>&1" % (self.vdev))
        self.mapped += 1
    
    def partitionsdeactivated(self):
        "Return True if partition mappings have been removed, False otherwise"
        for part in self.partitions:
            if os.access(part.pdev, os.F_OK):
                return False
        return True

    def deactivatepartitions(self):
        """Remove device-mapper mappings and loop mapping.

        Will never raise.
        """
        verbose_print("deactivatepartitions")
        if not self.mapped:
            return
        self.mapped -= 1
        if not self.mapped:
            if self.pcount:
                retries = 10
                while retries and not self.partitionsdeactivated():
                    verbose_print("kpartx %s -d '%s'" % (kpartx_args, self.physdev()))
                    os.system("kpartx %s -d '%s'" % (kpartx_args, self.physdev()))
                    time.sleep(0.1)
                    retries -= 1
                if retries == 0:
                    error("unable to remove partition mappings with kpartx -d")
            if self.pcount and self.lvm:
                verbose_print("lvchange -an '%s'" % (self.vdev))
                ret = os.system("lvchange -an '%s' > /dev/null 2>&1" % (self.vdev)) >> 8
                if ret:
                    time.sleep(0.3)
                    os.system("lvchange -an '/dev/%s' > /dev/null 2>&1" % (self.vdev))
                verbose_print("vgchange -an '%s'" % (self.vdev))
                ret = os.system("vgchange -an '%s' > /dev/null 2>&1" % (self.vdev)) >> 8
                if ret:
                    time.sleep(0.3)
                    os.system("vgchange -an '%s' > /dev/null 2>&1" % (self.vdev))
            self.loopclean()

    def __del__(self):
        "d'tor: clean up"
        self.deactivatepartitions()
        self.loopclean()

    def __repr__(self):
        "string representation for debugging"
        strg = "[" + self.vdev + "," + self.pdev + ","
        if self.ldev:
            strg += self.ldev
        strg += "," + str(self.pcount) + ",mapped %ix]" % self.mapped
        return strg

class Partition:
    """Class representing a domU filesystem (partition) that can be
       mounted in dom0"""
    def __init__(self, whole = None, vdev = None, pdev = None):
        "c'tor: setup"
        self.wholedisk = whole
        self.vdev    = vdev
        self.pdev    = pdev
        self.mountpoint = None

    def __del__(self):
        "d'tor: cleanup"
        if self.mountpoint:
            self.umount()
        # Not needed: Refcounting will take care of it.
        #if self.wholedisk:
        #    self.wholedisk.deactivatepartitions()

    def __repr__(self):
        "string representation for debugging"
        strg = "[" + self.vdev + "," + self.pdev + ","
        if self.mountpoint:
            strg += "mounted on " + self.mountpoint + ","
        else:
            strg += "not mounted,"
        if self.wholedisk:
            return strg + self.wholedisk.__repr__() + "]"
        else:
            return strg + "]"

    def mount(self, fstype = None, options = "ro"):
        "mount filesystem, sets self.mountpoint"
        if self.mountpoint:
            return
        if self.wholedisk:
            self.wholedisk.activatepartitions()
        mtpt = tempfile.mkdtemp(prefix = "%s." % self.vdev, dir = tmpdir)
        mopts = ""
        if fstype:
            mopts += " -t %s" % fstype
        if options:
            mopts += " -o %s" % options
        verbose_print("mount %s '%s' %s" % (mopts, self.pdev, mtpt))
        fd = os.popen("mount %s '%s' %s" % (mopts, self.pdev, mtpt))
        err = fd.close()
        if err:
            try:
                os.rmdir(mtpt)
            except:
                pass
            raise RuntimeError("Error %i from mount %s '%s' on %s" % \
                (err, mopts, self.pdev, mtpt))
        self.mountpoint = mtpt
        
    def umount(self):
        """umount filesystem at self.mountpoint"""
        if not self.mountpoint:
            return
        verbose_print("umount %s" % self.mountpoint)
        fd = os.popen("umount %s" % self.mountpoint)
        err = fd.close()
        try:
            os.rmdir(self.mountpoint)
        except:
            pass
        if err:
            error("Error %i from umount %s" % (err, self.mountpoint))
        else:
            self.mountpoint = None
        if self.wholedisk:
            self.wholedisk.deactivatepartitions()

def parseEntry(entry):
    "disects bootentry and returns vdev, kernel, ramdisk"
    def bad():
        raise RuntimeError, "Malformed --entry"
    fsspl = entry.split(':')
    if len(fsspl) != 2:
        bad()
    vdev = fsspl[0]
    entry = fsspl[1]
    enspl = entry.split(',')
    if len(enspl) not in (1, 2):
        bad()
    # Prepend '/' if missing
    kernel = enspl[0]
    if kernel == '':
        bad()
    if kernel[0] != '/':
        kernel = '/' + kernel
    ramdisk = None
    if len(enspl) > 1:
        ramdisk = enspl[1]
        if ramdisk != '' and ramdisk[0] != '/':
            ramdisk = '/' + ramdisk
    return vdev, kernel, ramdisk

def copyFile(src, dst):
    "Wrapper for shutil.filecopy"
    import shutil
    verbose_print("cp %s %s" % (src, dst))
    stat = os.stat(src)
    if stat.st_size > 32*1024*1024:
        raise RuntimeError("Too large file %s (%s larger than 32MB)" \
            % (src, stat.st_size)) 
    try:
        shutil.copyfile(src, dst)
    except:
        os.unlink(dst)
        raise()

def copyKernelAndRamdisk(disk, vdev, kernel, ramdisk):
    """Finds vdev in list of partitions, mounts the partition, copies
       kernel [and ramdisk] off to dom0 files, umounts the parition again,
       and returns sxpr pointing to these copies."""
    verbose_print("copyKernelAndRamdisk(%s, %s, %s, %s)" % (disk, vdev, kernel, ramdisk))
    if dryrun:
        return "linux (kernel kernel.dummy) (ramdisk ramdisk.dummy)"
    part = disk.findPart(vdev)
    if not part:
        raise RuntimeError("Partition '%s' does not exist" % vdev)
    part.mount()
    try:
        (fd, knm) = tempfile.mkstemp(prefix = "kernel.", dir = tmpdir)
        os.close(fd)
        copyFile(part.mountpoint + kernel, knm)
    except: 
        os.unlink(knm)
        part.umount()
        raise
    if not quiet:
        print "Copy kernel %s from %s to %s for booting" % (kernel, vdev, knm)
    sxpr = "linux (kernel %s)" % knm
    if ramdisk:
        try:
            (fd, inm) = tempfile.mkstemp(prefix = "ramdisk.", dir = tmpdir)
            os.close(fd)
            copyFile(part.mountpoint + ramdisk, inm)
        except:
            os.unlink(knm)
            os.unlink(inm)
            part.umount()
            raise
        sxpr += "(ramdisk %s)" % inm
    part.umount()
    xnloader.patch_netware_loader(knm)
    return sxpr

def main(argv):
    "Main routine: Parses options etc."
    global quiet, dryrun, verbose, tmpdir, in_args
    def usage():
        "Help output (usage info)"
        global verbose, quiet, dryrun
        print >> sys.stderr, "domUloader usage: domUloader [--output=fd] [--quiet] [--dryrun] [--verbose]\n" +\
                             "[--args] [--help] --entry=dev:kernel[,ramdisk] physdisk [virtdisk]\n" +\
                             "\n" +\
                             "dev format: hd[a-p][0-9]*, xvd[a-p][0-9]*, LVM-vgname-lvname\n"
        print >> sys.stderr, __doc__

    try:
        (optlist, args) = getopt.gnu_getopt(argv, 'qvh', \
            ('entry=', 'output=', 'tmpdir=', 'args=', 'kernel=', 'ramdisk=', 'help', 'quiet', 'dryrun', 'verbose'))
    except:
        usage()
        sys.exit(1)

    entry = None
    output = None
    pdisk = None
    vdisk = None

    for (opt, oarg) in optlist:
        if opt in ('-h', '--help'):
            usage()
            sys.exit(1)
        elif opt in ('-q', '--quiet'):
            quiet = True
        elif opt in ('-n', '--dryrun'):
            dryrun = True
        elif opt in ('-v', '--verbose'):
            verbose = True
        elif opt == '--output':
            output = oarg
        elif opt == '--entry':
            entry = oarg
        elif opt == '--tmpdir':
            tmpdir = oarg
        elif opt == '--args':
            in_args = oarg

    verbose_print(str(argv))

    if args:
        if len(args) == 2:
            pdisk = args[1]
        elif len(args) == 3:
            pdisk = args[1]
            vdisk = args[2]
    
    if not entry or not pdisk:
        usage()
        sys.exit(1)
    
    if output is None or output == "-":
        fd = sys.stdout.fileno()
    else:
        fd = os.open(output, os.O_WRONLY)
    
    if not os.access(tmpdir, os.X_OK):
        os.mkdir(tmpdir)
        os.chmod(tmpdir, 0750)

    vdev, kernel, ramdisk = parseEntry(entry)
    if vdev[:vdev.find('-')] == "LVM":
        vdev = vdev.split('-')[1]
    if not vdisk:
        vdisk = getWholedisk(vdev)
        verbose_print("vdisk not specified; guessing '%s' based on '%s'" % (vdisk, vdev))
    if not vdev.startswith(vdisk):
        error("Virtual disk '%s' does not match entry '%s'" % (vdisk, entry))
        sys.exit(1)
    disk = Wholedisk(vdisk, pdisk)
    
    r = 0
    try:
        sxpr = copyKernelAndRamdisk(disk, vdev, kernel, ramdisk)
        if in_args:
            sxpr += "(args '%s')" % in_args
        os.write(fd, sxpr)
    except Exception, e:
        error(str(e))
        r = 1

    for part in disk.partitions:
        part.wholedisk = None
    del disk

    return r

# Call main if called (and not imported)
if __name__ == "__main__":
    r = 1
    try:
        r = main(sys.argv)
    except Exception, e:
        error(str(e))
    sys.exit(r)
++++++ etc_pam.d_xen-api ++++++
#%PAM-1.0
auth      required  pam_listfile.so onerr=fail item=user \
                    sense=allow file=/etc/xen/xenapiusers
auth      include   common-auth
account   include   common-account
password  include   common-password
session   include   common-session
++++++ hibernate.patch ++++++
Index: xen-4.2.0-testing/tools/firmware/hvmloader/acpi/ssdt_s3.asl
===================================================================
--- xen-4.2.0-testing.orig/tools/firmware/hvmloader/acpi/ssdt_s3.asl
+++ xen-4.2.0-testing/tools/firmware/hvmloader/acpi/ssdt_s3.asl
@@ -20,13 +20,9 @@
 
 DefinitionBlock ("SSDT_S3.aml", "SSDT", 2, "Xen", "HVM", 0)
 {
-    /* Must match piix emulation */
-    Name (\_S3, Package (0x04)
-    {
-        0x01,  /* PM1a_CNT.SLP_TYP */
-        0x01,  /* PM1b_CNT.SLP_TYP */
-        0x0,   /* reserved */
-        0x0    /* reserved */
-    })
+    /*
+     * Turn off support for s3 sleep state to deal with SVVP tests.
+     * This is what MSFT does on HyperV.
+     */
 }
 
Index: xen-4.2.0-testing/tools/firmware/hvmloader/acpi/ssdt_s4.asl
===================================================================
--- xen-4.2.0-testing.orig/tools/firmware/hvmloader/acpi/ssdt_s4.asl
+++ xen-4.2.0-testing/tools/firmware/hvmloader/acpi/ssdt_s4.asl
@@ -20,13 +20,9 @@
 
 DefinitionBlock ("SSDT_S4.aml", "SSDT", 2, "Xen", "HVM", 0)
 {
-    /* Must match piix emulation */
-    Name (\_S4, Package (0x04)
-    {
-        0x00,  /* PM1a_CNT.SLP_TYP */
-        0x00,  /* PM1b_CNT.SLP_TYP */
-        0x00,  /* reserved */
-        0x00   /* reserved */
-    })
+    /*
+     * Turn off support for s4 sleep state to deal with SVVP tests.
+     * This is what MSFT does on HyperV.
+     */
 }
 
++++++ hotplug-Linux-block-find-free-loop-fix.patch ++++++
--- xen-4.2.5-testing/tools/hotplug/Linux/block.orig	2015-02-18 14:59:01.000000000 -0700
+++ xen-4.2.5-testing/tools/hotplug/Linux/block	2015-02-18 15:00:07.000000000 -0700
@@ -21,7 +21,7 @@ find_free_loopback_helper() {
   local busy_devnum
   while read busy_devnum; do
     if [ "$next_devnum" != "$busy_devnum" ]; then
-      break
+      case "$busy_devnum" in *[0-9]*) break;; esac
     fi
     let next_devnum=$next_devnum+1
   done
++++++ init.pciback ++++++
#!/bin/bash
#
# Copyright (c) 2014 SUSE GmbH Nuernberg, Germany.  All rights reserved.
#
# /etc/init.d/pciback
#
### BEGIN INIT INFO
# Provides:          pciback
# Required-Start:    $syslog $network
# Should-Start:      $null
# Required-Stop:     $syslog $network
# Should-Stop:       $null
# Default-Start:     3 5
# Default-Stop:      0 1 2 6
# Description:       bind PCI devices to pciback
### END INIT INFO

. /etc/rc.status
. /etc/sysconfig/pciback

rc_reset

load_pciback() {
  if ! lsmod | grep -qi "pciback"
  then
    echo "Loading pciback ..."
    modprobe pciback
  fi
}

unload_pciback() {
  if lsmod | grep -qi "pciback"
  then
    echo "Unloading pciback ..."
    modprobe -r pciback
  fi
}

bind_dev_to_pciback() {
  for DEVICE in ${XEN_PCI_HIDE_LIST}
  do
    local DRV=`echo ${DEVICE} | /usr/bin/cut -d "," -f 1`
    local PCIID=`echo ${DEVICE} | /usr/bin/cut -d "," -f 2`

    if ! ls /sys/bus/pci/drivers/pciback/${PCIID} > /dev/null 2>&1
    then
      echo "Binding ${PCIID} ..."
      if ls /sys/bus/pci/drivers/${DRV}/${PCIID} > /dev/null 2>&1
      then
        echo -n ${PCIID} > /sys/bus/pci/drivers/${DRV}/unbind
      fi
      echo -n ${PCIID} > /sys/bus/pci/drivers/pciback/new_slot
      echo -n ${PCIID} > /sys/bus/pci/drivers/pciback/bind
    fi
  done
}

unbind_dev_from_pciback() {
  for DEVICE in ${XEN_PCI_HIDE_LIST}
  do
    local DRV=`echo ${DEVICE} | /usr/bin/cut -d "," -f 1`
    local PCIID=`echo ${DEVICE} | /usr/bin/cut -d "," -f 2`

    if ls /sys/bus/pci/drivers/pciback/${PCIID} > /dev/null
    then
      echo "Unbinding ${PCIID} ..."
      echo -n ${PCIID} > /sys/bus/pci/drivers/pciback/unbind
    fi
  done
}

test "uname -r" | grep xen && exit 0

case $1 in
  start)
    echo "Starting pciback ..."
    echo 
    load_pciback
    bind_dev_to_pciback

    rc_status -v -r
  ;;
  stop)
    echo "Stopping pciback ..."
    echo 
    unbind_dev_from_pciback
    unload_pciback

    rc_status -v
  ;;
  reload|restart)
    echo "Stopping pciback ..."
    echo 
    unbind_dev_from_pciback
    unload_pciback
    echo "Starting pciback ..."
    echo 
    load_pciback
    bind_dev_to_pciback
  ;;
  status)
    if lsmod | grep -qi pciback
    then
      echo
      echo "pciback:  loaded"
      echo
      echo "Currently bound devices ..."
      echo "-----------------------------"
      ls /sys/bus/pci/drivers/pciback | grep ^0000
      echo
    else
      echo "pciback:  not loaded"
    fi
  ;;
  *)
    echo "Usage: $0 [start|stop|restart|reload|status]"
    exit 1
  ;;
esac
++++++ init.xen_loop ++++++
# Increase the number of loopback devices available for vm creation
options loop max_loop=64
++++++ init.xend ++++++
#!/bin/bash
#
# xend		Starts and stops the Xen management daemon
#
# chkconfig: 35 98 01
# description: Starts and stops the Xen management daemon
#
### BEGIN INIT INFO
# Provides:          xend
# Required-Start:    $syslog $network $remote_fs
# Should-Start:      iscsi $time
# Required-Stop:     $syslog $network $remote_fs
# Should-Stop:       iscsi $time
# Default-Start:     3 5
# Default-Stop:      0 1 2 6
# Short-Description: Starts and stops the Xen management daemon
# Description:       Starts and stops the Xen management daemon.  xend is needed
#                    to create and manage VMs on Xen.
### END INIT INFO

. /etc/rc.status
rc_reset

XEND=`pidof -x /usr/sbin/xend`

await_daemons_up()
{
	i=1
	rets=10
	xend status
	while [ $? -ne 0 -a $i -lt $rets ]; do
		sleep 1
		echo -n .
		i=$(($i + 1))
		xend status
	done
}

xend_abort()
{
	echo -n "xend "
	rc_failed $1
	rc_status -v
	rc_exit
}

cleanup()
{
	rm -f /var/lib/xen/tmp/* 2>/dev/null
	rm -f /var/lib/xen/xenbl* 2>/dev/null
}

check()
{
	if [ "$1" == status ]; then
		if [ ! -e /proc/xen/capabilities ]; then
			xend_abort 3
		fi
	else
		if [ `id -u` != 0 ]; then
			xend_abort 4
		fi
		if [ ! -e /proc/xen/capabilities ] ||
		     ! grep control_d /proc/xen/capabilities >/dev/null 2>&1; then
			if [ "$1" == stop ] ||
			   [ "$1" == try-restart ]; then
				xend_abort 0
			else
				xend_abort 6
			fi
		fi
	fi
}

case "$1" in
  start)
	check $1
	echo -n "Starting xend "
	if [ ! -z "$XEND" ]; then
		echo -n "(already running pid $XEND) "
	else
		cleanup
	fi
	xend start
	await_daemons_up
	;;
  stop)
	check $1
	echo -n "Stopping xend "
	if [ -z "$XEND" ]; then
		echo -n "(not running) "
		xend stop
		rc_reset
	else
		echo -n "(pid $XEND) "
		xend stop
		cleanup
		rc_reset
	fi
	;;
  status)
	check $1
	echo -n "Checking status of xend "
	if [ ! -z "$XEND" ]; then
		echo -n "(pid $XEND) "
	fi
	checkproc /usr/sbin/xend
	;;
  restart|reload)
	check $1
	echo -n "Restarting xend "
	if [ -z "$XEND" ]; then
		echo -n "(not running) "
	else
		echo -n "(old pid $XEND) "
	fi
	xend restart
	await_daemons_up
	;;
  try-restart)
	check $1
	$0 status
	if [ $? = 0 ]; then
		$0 restart
	else
		rc_reset
	fi
	;;
  *)
	echo "Usage: $0 {start|stop|restart|try-restart|reload|status}"
	rc_failed 2
	rc_exit
esac

rc_status -v
rc_exit
++++++ init.xendomains ++++++
#!/bin/bash
#
# xendomains	Starts and stops Xen VMs
#
# chkconfig: 35 99 00
# description: Starts and stops Xen VMs
#
### BEGIN INIT INFO
# Provides:          xendomains
# Required-Start:    $syslog $remote_fs xenstored xenconsoled
# Should-Start:      xend iscsi o2cb ocfs2
# Required-Stop:     $syslog $remote_fs xenstored xenconsoled
# Should-Stop:       xend iscsi
# Default-Start:     3 5
# Default-Stop:      0 1 2 6
# Short-Description: Starts and stops Xen VMs
# Description:       Starts and stops Xen VMs automatically when the
#                    host starts and stops.
### END INIT INFO

. /etc/rc.status
rc_reset

RETCODE_FILE=/tmp/xendomains.rc.$$
xm_cmd=echo

# See docs/misc/distro_mapping.txt
if [ -d /var/lock/subsys ]; then
	LOCKFILE=/var/lock/subsys/xendomains
else
	LOCKFILE=/var/lock/xendomains
fi

if [ -d /etc/sysconfig ]; then
	XENDOM_CONFIG=/etc/sysconfig/xendomains
else
	XENDOM_CONFIG=/etc/default/xendomains
fi

test -r $XENDOM_CONFIG || { echo "$XENDOM_CONFIG not existing";
	if [ "$1" = "stop" ]; then exit 0;
	else exit 6; fi; }

. "$XENDOM_CONFIG"

shopt -s dotglob nullglob

smart_term=1
if [ -z "$esc" ]; then
	smart_term=0
	rc_timer_on()
	{
		(trap "exit 0" TERM; sleep $1) & _rc_timer_pid=$!
	}
	rc_timer_off()
	{
		if [ -n "$_rc_timer_pid" ]; then
			kill -TERM $_rc_timer_pid > /dev/null 2>&1
		fi
		unset _rc_timer_pid
	}
fi

xendomains_abort()
{
	echo -n "xendomains "
	rc_failed $1
	rc_status -v
	rc_exit
}

check()
{
	XEND=`pidof -x /usr/sbin/xend`
	if [ -z "$XEND" ]; then
		xm_cmd="xl -f"
		XEND="xl"
	else
		xm_cmd="xm"
	fi
	if [ "$1" = status ]; then
		if [ ! -e /proc/xen/capabilities ] || [ ! -r "$XENDOM_CONFIG" ] || [ -z "$XEND" ]; then
			xendomains_abort 3
		fi
	else
		if [ `id -u` != 0 ]; then
			xendomains_abort 4
		fi
		if [ ! -e /proc/xen/capabilities ] || [ -z "$XEND" ] ||
		     ! grep control_d /proc/xen/capabilities >/dev/null 2>&1; then
			if [ "$1" = stop ] ||
			   [ "$1" = restart ]; then
				xendomains_abort 0
			else
				xendomains_abort 6
			fi
		fi
		if [ ! -r "$XENDOM_CONFIG" ]; then
			xendomains_abort 6
		fi
	fi
}

dir_contains_something()
{
        [ -d "$1" ] || return 1
	local dirfiles=( "$1"/* )
	[ ${#dirfiles[@]} != 0 ]
}

get_name_from_cfg()
{
	if grep -q "^name" "$1";then
		NM=`grep '^name[	 ]*=' "$1" | sed -e 's/^name[	 ]*=[	 ]*['\''"]\([^'\''"]*\)['\''"].*$/\1/'`
	elif grep -q "(name " "$1";then
		NM=`grep '(name ' "$1" | sed -e 's/^ *//' | cut -d " " -f 2 | sed -e 's/)//'`
	fi
}

running_auto_names()
{
	unset AUTONAMES[@]
	if ! dir_contains_something "$XENDOMAINS_AUTO"; then
		return
	fi
	for dom in "$XENDOMAINS_AUTO"/*; do
		get_name_from_cfg "$dom"
		AUTONAMES+=("$NM")
	done
}

parseln()
{
	name=${1:0:$((${#1}-36))}
	name=${name%% *}
	rest="${1: -36}"
	id=${rest:0:4}
	id=`echo $id`
	mem=${rest:4:6}
	mem=`echo $mem`
	vcpu=${rest:10:6}
	vcpu=`echo $vcpu`
	state=${rest:16:11}
	state=`echo $state`
	tm=${rest:27}
	tm=`echo $tm`
}

xm_list()
{
	TERM=vt100 ${xm_cmd} list | grep -v '^Name *ID'
}

is_cfg_running()
{
	get_name_from_cfg "$1"
	while read LN; do
		parseln "$LN"
		[ "$id" = 0 ] && continue
		if [ "$name" = "$NM" ]; then
			[ -z "$state" ] && return 1
			return 0
		fi
	done < <(xm_list)
	return 1
}

start()
{
	if [ -f "$LOCKFILE" ]; then
		echo -n "xendomains already running (lockfile exists)"
		rc_reset
		rc_status -v
		return 0
	fi

	local printed=0

	if [ "$XENDOMAINS_RESTORE" = "true" ] &&
	   dir_contains_something "$XENDOMAINS_SAVE"; then
		mkdir -p $(dirname "$LOCKFILE")
		touch "$LOCKFILE"
		echo "Restoring saved Xen domains"
		printed=1
		for dom in "$XENDOMAINS_SAVE"/*; do
			echo -n "	${dom##*/}: "
			${xm_cmd} restore "$dom" >/dev/null 2>&1
			if [ $? -ne 0 ]; then
				rc_failed
			else
				rc_reset
				rm -f "$dom"
			fi
			rc_status -v
		done
	fi

	if dir_contains_something "$XENDOMAINS_AUTO"; then
		touch "$LOCKFILE"
		echo "Starting auto Xen domains"
		printed=1
		for dom in "$XENDOMAINS_AUTO"/*; do
			echo -n "	${dom##*/}: "
			if is_cfg_running "$dom"; then
				rc_status -s
			else
				if grep -q "^name" "$dom";then
					${xm_cmd} create --quiet --defconfig "$dom"
				elif grep -q "(name .*" "$dom";then
					${xm_cmd} create --quiet --config "$dom"
				fi
				if [ $? -ne 0 ]; then
				    rc_failed
				else
				    usleep $XENDOMAINS_CREATE_USLEEP
				    rc_reset
				fi
				rc_status -v
			fi
		done
	fi

	if [ $printed -eq 0 ]; then
		echo -n "Starting xendomains"
		rc_failed 6  # not configured
		rc_status -v
	fi
}

is_zombie_state()
{
	[ "$1" = "-b---d" ] || [ "$1" = "-----d" ]
}

any_non_zombies()
{
	while read LN; do
		parseln "$LN"
		[ "$id" = 0 ] && continue
		[ -z "$state" ] && continue
		is_zombie_state "$state" || return 0
	done < <(xm_list)
	return 1
}

migrate_with_watchdog()
{
	(${xm_cmd} migrate "$@" ; echo $? > "$RETCODE_FILE") >/dev/null 2>&1 &
	watchdog_xm $!
}

save_with_watchdog()
{
	(${xm_cmd} save "$@" ; echo $? > "$RETCODE_FILE") >/dev/null 2>&1 &
	watchdog_xm $!
}

shutdown_with_watchdog()
{
	(${xm_cmd} shutdown -w "$@" ; echo $? > "$RETCODE_FILE") >/dev/null 2>&1 &
	watchdog_xm $!
}

get_return_code()
{
	local RC=127
	[ -r "$RETCODE_FILE" ] && RC=`head -c10 "$RETCODE_FILE"`
	rm -f "$RETCODE_FILE"
	return $RC
}

#  $1:  The PID to wait on.
watchdog_xm()
{
	local col=$((COLUMNS-11))
	if [ -z "$XENDOMAINS_STOP_MAXWAIT" ] || [ "$XENDOMAINS_STOP_MAXWAIT" = "0" ]; then
		wait $1 >/dev/null 2>&1
		get_return_code
		return
	fi

	rc_timer_on $XENDOMAINS_STOP_MAXWAIT $col
	while true; do
		# Prefer "jobs" over "ps":  faster and no false positives
		pid=`jobs -l | grep " $1 Running"`
		if [ -z "$pid" ]; then
			break
		fi
		pid=`jobs -l | grep " $_rc_timer_pid Running"`
		if [ -z "$pid" ]; then
			disown $1  # To avoid the "Terminated..." message
			kill $1 >/dev/null 2>&1
		fi
		sleep 1
	done
	rc_timer_off
	if [ $smart_term -ne 0 ]; then
		echo -en "\015${esc}[${col}C      "
	fi
	get_return_code
}

stop()
{
	echo "Shutting down Xen domains"
	if [ "$XENDOMAINS_AUTO_ONLY" = "true" ]; then
		running_auto_names
	fi
	local printed=0
	while read LN; do
		parseln "$LN"
		[ "$id" = 0 ] && continue
		[ -z "$state" ] && continue
		printed=1
		if [ "$XENDOMAINS_AUTO_ONLY" = "true" ]; then
			is_auto_domain=0
			for n in "${AUTONAMES[@]}"; do
				if [ "$name" = "$n" ]; then
					is_auto_domain=1
					break
				fi
			done
			if [ $is_auto_domain -eq 0 ]; then
				echo -n "	$name: "
				rc_status -s
				continue
			fi
		fi
		if [ -n "$XENDOMAINS_SYSRQ" ]; then
			for sysrq in $XENDOMAINS_SYSRQ; do
				echo -n "	$name: "
				echo -n "sending sysrq '$sysrq'... "
				${xm_cmd} sysrq $id $sysrq
				if [ $? -ne 0 ]; then
					rc_failed
				else
					rc_reset
				fi
				rc_status -v
				# usleep just ignores empty arg
				usleep $XENDOMAINS_USLEEP
			done
		fi
		if is_zombie_state "$state"; then
			echo -n "	$name: "
			echo -n "destroying zombie... "
			${xm_cmd} destroy $id
			rc_reset
			rc_status -v
			continue
		fi
		if [ -n "$XENDOMAINS_MIGRATE" ]; then
			echo -n "	$name: "
			echo -n "migrating... "
			migrate_with_watchdog $id "$XENDOMAINS_MIGRATE"
			if [ $? -ne 0 ]; then
				rc_failed
				rc_status -v
			else
				rc_reset
				rc_status -v
				continue
			fi
		fi
		if [ -n "$XENDOMAINS_SAVE" ]; then
			echo -n "	$name: "
			echo -n "saving... "
			save_with_watchdog $id "$XENDOMAINS_SAVE/$name"
			if [ $? -ne 0 ]; then
				rm -f "$XENDOMAINS_SAVE/$name"
				rc_failed
				rc_status -v
			else
				rc_reset
				rc_status -v
				continue
			fi
		fi
		if [ -n "$XENDOMAINS_SHUTDOWN" ]; then
			echo -n "	$name: "
			echo -n "shutting down... "
			shutdown_with_watchdog $id $XENDOMAINS_SHUTDOWN
			if [ $? -ne 0 ]; then
				rc_failed
			else
				rc_reset
			fi
			rc_status -v
		fi
	done < <(xm_list)

	if [ -n "$XENDOMAINS_SHUTDOWN_ALL" ] && any_non_zombies ; then
		echo -n "	others: shutting down... "
		shutdown_with_watchdog $XENDOMAINS_SHUTDOWN_ALL
		if [ $? -ne 0 ]; then
			rc_failed
		else
			rc_reset
		fi
		rc_status -v
	fi

	if [ $printed -eq 0 ]; then
		echo -e "${rc_done_up}"
	fi

	# Unconditionally delete lock file
	rm -f "$LOCKFILE"
}

check_domain_up()
{
	while read LN; do
		parseln "$LN"
		[ "$id" = 0 ] && continue
		if [ "$name" = "$1" ]; then
			[ -z "$state" ] && return 1
			return 0
		fi
	done < <(xm_list)
	return 1
}

check_all_domains_up()
{
	any_auto=0
	any_save=0
	dir_contains_something "$XENDOMAINS_AUTO" && any_auto=1
	dir_contains_something "$XENDOMAINS_SAVE" && any_save=1
	if [ $any_auto -eq 0 ] && [ $any_save -eq 0 ]; then
		rc_reset
		rc_status -v
		return
	fi
	echo
	if [ $any_auto -ne 0 ]; then
		for nm in "$XENDOMAINS_AUTO"/*; do
			get_name_from_cfg "$nm"
			echo -n "	$nm: "
			if check_domain_up "$NM"; then
				rc_reset
			else
				rc_failed 2
			fi
			rc_status -v
		done
	fi
	if [ $any_save -ne 0 ]; then
		for nm in "$XENDOMAINS_SAVE"/*; do
			echo -n "	$nm: "
			rc_failed 3
			rc_status -v
		done
	fi
}

# This does NOT necessarily restart all running domains: instead it
# stops all running domains and then boots all the domains specified in
# AUTODIR.  If other domains have been started manually then they will
# not get restarted.
restart()
{
	"$0" stop
	start
}

case "$1" in
 start)
	check $1
	start
	;;

 stop)
	check $1
	stop
	;;

 restart|reload)
	check $1
	restart
	;;

 try-restart)
	check $1
	"$0" status
	if [ $? = 0 ]; then
		"$0" restart
	else
		rc_reset
		rc_status -v
	fi
	;;

 status)
	check $1
	echo -n "Checking status of Xen domains"
	if [ ! -f "$LOCKFILE" ]; then
		rc_failed 3
		rc_status -v
	else
		check_all_domains_up
	fi
	;;

 *)
	echo "Usage: $0 {start|stop|restart|try-restart|reload|status}"
	rc_failed 2
	;;
esac

rc_exit
++++++ ioemu-7615-qcow2-fix-alloc_cluster_link_l2.patch ++++++
qcow2 corruption: Fix alloc_cluster_link_l2 (Kevin Wolf)

This patch fixes a qcow2 corruption bug introduced in SVN Rev 5861. L2 tables
are big endian, so entries must be converted before being passed to functions.

This bug is easy to trigger. The following script will create and destroy a
qcow2 image (the header is gone after three loop iterations):

    #!/bin/bash
    qemu-img create -f qcow2 test.qcow 1M
    for i in $(seq 1 10); do
    qemu-system-x86_64 -hda test.qcow -monitor stdio > /dev/null 2>&1 <

Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/block-qcow2.c
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/block-qcow2.c
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/block-qcow2.c
@@ -916,7 +916,7 @@ static int alloc_cluster_link_l2(BlockDr
         goto err;
 
     for (i = 0; i < j; i++)
-        free_any_clusters(bs, old_cluster[i], 1);
+        free_any_clusters(bs, be64_to_cpu(old_cluster[i]) & ~QCOW_OFLAG_COPIED, 1);
 
     ret = 0;
 err:
++++++ ioemu-bdrv-open-CACHE_WB.patch ++++++
Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_blktap.c
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/xen_blktap.c
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_blktap.c
@@ -247,8 +247,11 @@ static int open_disk(struct td_state *s,
 	drv = blktap_drivers[i].drv;
 	DPRINTF("%s driver specified\n", drv ? drv->format_name : "No");
 
-	/* Open the image */
-	if (bdrv_open2(bs, path, flags, drv) != 0) {
+	/* Open the image
+         * Use BDRV_O_CACHE_WB for write-through caching,
+         * no flags for write-back caching
+         */
+	if (bdrv_open2(bs, path, flags|BDRV_O_CACHE_WB, drv) != 0) {
 		fprintf(stderr, "Could not open image file %s\n", path);
 		return -ENOMEM;
 	}
++++++ ioemu-blktap-barriers.patch ++++++
Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_blktap.c
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/xen_blktap.c
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_blktap.c
@@ -360,6 +360,15 @@ static void qemu_send_responses(void* op
 }
 
 /**
+ * Callback function for AIO flush
+ */
+static void qemu_flush_response(void* opaque, int ret) {
+	if (ret != 0) {
+		DPRINTF("aio_flush: ret = %d (%s)\n", ret, strerror(-ret));
+	}
+}
+
+/**
  * Callback function for the IO message pipe. Reads requests from the ring
  * and processes them (call qemu read/write functions).
  *
@@ -378,6 +387,7 @@ static void handle_blktap_iomsg(void* pr
 	blkif_t *blkif = s->blkif;
 	tapdev_info_t *info = s->ring_info;
 	int page_size = getpagesize();
+	int sync;
 
 	struct aiocb_info *aiocb_info;
 
@@ -410,7 +420,7 @@ static void handle_blktap_iomsg(void* pr
 
 		/* Don't allow writes on readonly devices */
 		if ((s->flags & TD_RDONLY) && 
-		    (req->operation == BLKIF_OP_WRITE)) {
+		    (req->operation != BLKIF_OP_READ)) {
 			blkif->pending_list[idx].status = BLKIF_RSP_ERROR;
 			goto send_response;
 		}
@@ -431,7 +441,7 @@ static void handle_blktap_iomsg(void* pr
 				DPRINTF("Sector request failed:\n");
 				DPRINTF("%s request, idx [%d,%d] size [%llu], "
 					"sector [%llu,%llu]\n",
-					(req->operation == BLKIF_OP_WRITE ? 
+					(req->operation != BLKIF_OP_READ ?
 					 "WRITE" : "READ"),
 					idx,i,
 					(long long unsigned) 
@@ -444,8 +454,14 @@ static void handle_blktap_iomsg(void* pr
 
 			blkif->pending_list[idx].secs_pending += nsects;
 
-			switch (req->operation) 
+			sync = 0;
+			switch (req->operation)
 			{
+			case BLKIF_OP_WRITE_BARRIER:
+				sync = 1;
+				bdrv_aio_flush(s->bs, qemu_flush_response, NULL);
+				/* fall through */
+
 			case BLKIF_OP_WRITE:
 				aiocb_info = malloc(sizeof(*aiocb_info));
 
@@ -465,6 +481,10 @@ static void handle_blktap_iomsg(void* pr
 					DPRINTF("ERROR: bdrv_write() == NULL\n");
 					goto send_response;
 				}
+
+				if (sync)
+					bdrv_aio_flush(s->bs, qemu_flush_response, NULL);
+
 				break;
 
 			case BLKIF_OP_READ:
++++++ ioemu-blktap-fv-init.patch ++++++
Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_machine_fv.c
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/xen_machine_fv.c
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_machine_fv.c
@@ -270,6 +270,7 @@ void qemu_invalidate_entry(uint8_t *buff
 
 #endif /* defined(MAPCACHE) */
 
+extern void init_blktap(void);
 
 static void xen_init_fv(ram_addr_t ram_size, int vga_ram_size,
 			const char *boot_device,
@@ -295,6 +296,11 @@ static void xen_init_fv(ram_addr_t ram_s
     }
 #endif
 
+#ifndef CONFIG_STUBDOM
+    /* Initialize tapdisk client */
+    init_blktap();
+#endif
+
 #ifdef CONFIG_STUBDOM /* the hvmop is not supported on older hypervisors */
     xc_set_hvm_param(xc_handle, domid, HVM_PARAM_DM_DOMAIN, DOMID_SELF);
 #endif
++++++ ioemu-blktap-image-format.patch ++++++
...
From 5ac882a6d7499e4a36103db071203bf4d1ddfe1f Mon Sep 17 00:00:00 2001
From: Kevin Wolf 
Date: Tue, 10 Mar 2009 16:26:45 +0100
Subject: [PATCH 2/6] ioemu: Use the image format sent by blktapctrl
Currently the blktap backend in ioemu lets qemu guess which format an
image is in. This was a security problem and the blktap backend
doesn't work any more since this was fixed in qemu.

This patch changes ioemu to respect the format it gets from blktapctrl.

Signed-off-by: Kevin Wolf 
---
 hw/xen_blktap.c |   22 +++++++++++++++++++---
 hw/xen_blktap.h |   14 ++++++++++++++
 2 files changed, 33 insertions(+), 3 deletions(-)

Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_blktap.c
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/xen_blktap.c
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_blktap.c
@@ -218,9 +218,10 @@ static int map_new_dev(struct td_state *
 	return -1;
 }
 
-static int open_disk(struct td_state *s, char *path, int readonly)
+static int open_disk(struct td_state *s, char *path, int driver, int readonly)
 {
 	BlockDriverState* bs;
+	BlockDriver* drv;
 	char* devname;
 	static int devnumber = 0;
 	int i;
@@ -230,7 +231,22 @@ static int open_disk(struct td_state *s,
 	bs = bdrv_new(devname);
 	free(devname);
 
-	if (bdrv_open(bs, path, 0) != 0) {
+	/* Search for disk driver */
+	for (i = 0; blktap_drivers[i].idnum >= 0; i++) {
+		if (blktap_drivers[i].idnum == driver)
+			break;
+	}
+
+	if (blktap_drivers[i].idnum < 0) {
+		fprintf(stderr, "Could not find image format id %d\n", driver);
+		return -ENOMEM;
+	}
+
+	drv = blktap_drivers[i].drv;
+	DPRINTF("%s driver specified\n", drv ? drv->format_name : "No");
+
+	/* Open the image */
+	if (bdrv_open2(bs, path, 0, drv) != 0) {
 		fprintf(stderr, "Could not open image file %s\n", path);
 		return -ENOMEM;
 	}
@@ -521,7 +537,7 @@ static void handle_blktap_ctrlmsg(void*
 			s = state_init();
 
 			/*Open file*/
-			if (s == NULL || open_disk(s, path, msg->readonly)) {
+			if (s == NULL || open_disk(s, path, msg->drivertype, msg->readonly)) {
 				msglen = sizeof(msg_hdr_t);
 				msg->type = CTLMSG_IMG_FAIL;
 				msg->len = msglen;
Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_blktap.h
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/xen_blktap.h
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_blktap.h
@@ -52,4 +52,18 @@ typedef struct fd_list_entry {
 
 int init_blktap(void);
 
+typedef struct disk_info {
+	int idnum;
+	struct BlockDriver *drv;
+} disk_info_t;
+
+static disk_info_t blktap_drivers[] = {
+	{ DISK_TYPE_AIO, &bdrv_raw },
+	{ DISK_TYPE_SYNC, &bdrv_raw },
+	{ DISK_TYPE_VMDK, &bdrv_vmdk },
+	{ DISK_TYPE_QCOW, &bdrv_qcow },
+	{ DISK_TYPE_QCOW2, &bdrv_qcow2 },
+	{ -1, NULL }
+};
+
 #endif /*XEN_BLKTAP_H_*/
++++++ ioemu-blktap-zero-size.patch ++++++
...
From cb982fd919a52ff86f01025d0f92225bc7b2a956 Mon Sep 17 00:00:00 2001
From: Kevin Wolf 
Date: Tue, 10 Mar 2009 16:44:31 +0100
Subject: [PATCH 5/6] ioemu: Fail on too small blktap disks
The blktap infrastructure doesn't seems to be able to cope with images
that are smaller than a sector, it produced hangs for me. Such an
image isn't really useful anyway, so just fail gracefully.

Signed-off-by: Kevin Wolf 
---
 hw/xen_blktap.c |    6 ++++++
 1 files changed, 6 insertions(+), 0 deletions(-)

Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_blktap.c
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/xen_blktap.c
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_blktap.c
@@ -256,6 +256,12 @@ static int open_disk(struct td_state *s,
 	s->size = bs->total_sectors;
 	s->sector_size = 512;
 
+	if (s->size == 0) {
+		fprintf(stderr, "Error: Disk image %s is too small\n",
+			path);
+		return -ENOMEM;
+	}
+
 	s->info = ((s->flags & TD_RDONLY) ? VDISK_READONLY : 0);
 
 #ifndef QEMU_TOOL
Index: xen-4.2.0-testing/tools/python/xen/xend/server/DevController.py
===================================================================
--- xen-4.2.0-testing.orig/tools/python/xen/xend/server/DevController.py
+++ xen-4.2.0-testing/tools/python/xen/xend/server/DevController.py
@@ -155,7 +155,7 @@ class DevController:
                           (devid, self.deviceClass))
 
         elif status == Error:
-            self.destroyDevice(devid, False)
+            self.destroyDevice(devid, True)
             if err is None:
                 raise VmError("Device %s (%s) could not be connected. "
                               "Backend device not found." %
++++++ ioemu-disable-emulated-ide-if-pv.patch ++++++
Index: xen-4.2.3-testing/tools/qemu-xen-traditional-dir-remote/qemu-xen.h
===================================================================
--- xen-4.2.3-testing.orig/tools/qemu-xen-traditional-dir-remote/qemu-xen.h
+++ xen-4.2.3-testing/tools/qemu-xen-traditional-dir-remote/qemu-xen.h
@@ -1,6 +1,8 @@
 #ifndef QEMU_XEN_H
 #define QEMU_XEN_H
 
+#include "hw/boards.h"
+
 /* vl.c */
 extern int restore;
 extern int vga_ram_size;
@@ -65,7 +67,7 @@ void handle_buffered_pio(void);
 /* xenstore.c */
 void xenstore_init(void);
 uint32_t xenstore_read_target(void);
-void xenstore_parse_domain_config(int domid);
+void xenstore_parse_domain_config(int domid, QEMUMachine *machine);
 int xenstore_parse_disable_pf_config(void);
 int xenstore_fd(void);
 void xenstore_process_event(void *opaque);
Index: xen-4.2.3-testing/tools/qemu-xen-traditional-dir-remote/vl.c
===================================================================
--- xen-4.2.3-testing.orig/tools/qemu-xen-traditional-dir-remote/vl.c
+++ xen-4.2.3-testing/tools/qemu-xen-traditional-dir-remote/vl.c
@@ -5862,9 +5862,9 @@ int main(int argc, char **argv, char **e
         if ((msg = xenbus_read(XBT_NIL, "domid", &domid_s)))
             fprintf(stderr,"Can not read our own domid: %s\n", msg);
         else
-            xenstore_parse_domain_config(atoi(domid_s));
+            xenstore_parse_domain_config(atoi(domid_s), machine);
 #else
-        xenstore_parse_domain_config(domid);
+        xenstore_parse_domain_config(domid, machine);
 #endif /* CONFIG_STUBDOM */
     }
 
Index: xen-4.2.3-testing/tools/qemu-xen-traditional-dir-remote/xenstore.c
===================================================================
--- xen-4.2.3-testing.orig/tools/qemu-xen-traditional-dir-remote/xenstore.c
+++ xen-4.2.3-testing/tools/qemu-xen-traditional-dir-remote/xenstore.c
@@ -446,7 +446,7 @@ void xenstore_init(void)
     }
 }
 
-void xenstore_parse_domain_config(int hvm_domid)
+void xenstore_parse_domain_config(int hvm_domid, QEMUMachine *machine)
 {
     char **e_danger = NULL;
     char *buf = NULL;
@@ -740,11 +740,19 @@ void xenstore_parse_domain_config(int hv
 
 #endif
 
-	drives_table[nb_drives].bdrv = bs;
-	drives_table[nb_drives].used = 1;
-    media_filename[nb_drives] = strdup(bs->filename);
-	nb_drives++;
-
+        if (machine == &xenfv_machine) {
+            drives_table[nb_drives].bdrv = bs;
+            drives_table[nb_drives].used = 1;
+#ifdef CONFIG_STUBDOM
+            media_filename[nb_drives] = strdup(danger_buf);
+#else
+            media_filename[nb_drives] = strdup(bs->filename);
+#endif
+            nb_drives++;
+        } else {
+            qemu_aio_flush();
+            bdrv_close(bs);
+        }
     }
 
 #ifdef CONFIG_STUBDOM
++++++ ioemu-disable-scsi.patch ++++++
---
 tools/qemu-xen-traditional-dir-remote/hw/pci.c          |   44 ++++++++++++++++
 tools/qemu-xen-traditional-dir-remote/hw/xen_platform.c |    2 
 tools/qemu-xen-traditional-dir-remote/qemu-xen.h        |    1 
 3 files changed, 47 insertions(+)

Index: xen-4.4.0-testing/tools/qemu-xen-traditional-dir-remote/hw/pci.c
===================================================================
--- xen-4.4.0-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/pci.c
+++ xen-4.4.0-testing/tools/qemu-xen-traditional-dir-remote/hw/pci.c
@@ -871,6 +871,50 @@ void pci_unplug_netifs(void)
     }
 }
 
+void pci_unplug_scsi(void)
+{
+    PCIBus *bus;
+    PCIDevice *dev;
+    PCIIORegion *region;
+    int x;
+    int i;
+
+    /* We only support one PCI bus */
+    for (bus = first_bus; bus; bus = NULL) {
+       for (x = 0; x < 256; x++) {
+           dev = bus->devices[x];
+           if (dev &&
+               dev->config[0xa] == 0 &&
+               dev->config[0xb] == 1
+#ifdef CONFIG_PASSTHROUGH
+               && test_pci_devfn(x) != 1
+#endif
+               ) {
+               /* Found a scsi disk.  Remove it from the bus.  Note that
+                  we don't free it here, since there could still be
+                  references to it floating around.  There are only
+                  ever one or two structures leaked, and it's not
+                  worth finding them all. */
+               bus->devices[x] = NULL;
+               for (i = 0; i < PCI_NUM_REGIONS; i++) {
+                   region = &dev->io_regions[i];
+                   if (region->addr == (uint32_t)-1 ||
+                       region->size == 0)
+                       continue;
+                   fprintf(logfile, "region type %d at [%x,%x).\n",
+                           region->type, region->addr,
+                           region->addr+region->size);
+                   if (region->type == PCI_ADDRESS_SPACE_IO) {
+                       isa_unassign_ioport(region->addr, region->size);
+                   } else if (region->type == PCI_ADDRESS_SPACE_MEM) {
+                       unregister_iomem(region->addr);
+                   }
+               }
+           }
+       }
+    }
+}
+
 typedef struct {
     PCIDevice dev;
     PCIBus *bus;
Index: xen-4.4.0-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_platform.c
===================================================================
--- xen-4.4.0-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/xen_platform.c
+++ xen-4.4.0-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_platform.c
@@ -364,6 +364,8 @@ static void suse_platform_ioport_write(v
 	 * If it controlled just disk or just LAN, it would use 8 below. */
         fprintf(logfile, "Disconnect IDE hard disk...\n");
         ide_unplug_harddisks();
+        fprintf(logfile, "Disconnect SCSI hard disk...\n");
+        pci_unplug_scsi();
         fprintf(logfile, "Disconnect netifs...\n");
         pci_unplug_netifs();
         fprintf(logfile, "Shutdown taps...\n");
Index: xen-4.4.0-testing/tools/qemu-xen-traditional-dir-remote/qemu-xen.h
===================================================================
--- xen-4.4.0-testing.orig/tools/qemu-xen-traditional-dir-remote/qemu-xen.h
+++ xen-4.4.0-testing/tools/qemu-xen-traditional-dir-remote/qemu-xen.h
@@ -47,6 +47,7 @@ void unset_vram_mapping(void *opaque);
 #endif
 
 void pci_unplug_netifs(void);
+void pci_unplug_scsi(void);
 void destroy_hvm_domain(void);
 void unregister_iomem(target_phys_addr_t start);
 
++++++ ioemu-hvm-pv-support.patch ++++++
---
 tools/qemu-xen-traditional-dir-remote/hw/xen_platform.c |   46 ++++++++++++++++
 1 file changed, 46 insertions(+)

Index: xen-4.4.0-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_platform.c
===================================================================
--- xen-4.4.0-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/xen_platform.c
+++ xen-4.4.0-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_platform.c
@@ -30,6 +30,8 @@
 #include "qemu-xen.h"
 #include "net.h"
 #include "xen_platform.h"
+#include "sysemu.h"
+#include 
 
 #include 
 #include 
@@ -335,8 +337,52 @@ static void xen_platform_ioport_writeb(v
     }
 }
 
+static uint32_t ioport_base;
+
+static void suse_platform_ioport_write(void *opaque, uint32_t addr, uint32_t val)
+{
+    DECLARE_DOMCTL;
+    int rc;
+
+    if (val == 0)
+        qemu_invalidate_map_cache();
+
+    switch (addr - ioport_base) {
+    case 0:
+	/* FIXME Unknown who makes use of this code! */
+        fprintf(logfile, "Init hypercall page %x, addr %x.\n", val, addr);
+        domctl.domain = (domid_t)domid;
+        domctl.u.hypercall_init.gmfn = val;
+        domctl.cmd = XEN_DOMCTL_hypercall_init;
+        rc = xc_domctl(xc_handle, &domctl);
+        fprintf(logfile, "result -> %d.\n", rc);
+        break;
+    case 4:
+	/* xen-kmp used this since xen-3.0.4, instead the official protocol from xen-3.3+
+	 * pre vmdp 1.7 made use of 4 and 8 depending on how vmdp was configured.
+	 * If vmdp was to control both disk and LAN it would use 4.
+	 * If it controlled just disk or just LAN, it would use 8 below. */
+        fprintf(logfile, "Disconnect IDE hard disk...\n");
+        ide_unplug_harddisks();
+        fprintf(logfile, "Disconnect netifs...\n");
+        pci_unplug_netifs();
+        fprintf(logfile, "Shutdown taps...\n");
+        net_tap_shutdown_all();
+        fprintf(logfile, "Done.\n");
+        break;
+    default:
+        fprintf(logfile, "Write %x to bad port %x (base %x) on evtchn device.\n",
+            val, addr, ioport_base);
+        break;
+    }
+}
+
 static void platform_ioport_map(PCIDevice *pci_dev, int region_num, uint32_t addr, uint32_t size, int type)
 {
+    ioport_base = addr;
+
+    register_ioport_write(addr, 16, 4, suse_platform_ioport_write, NULL);
+
     PCIXenPlatformState *d = (PCIXenPlatformState *)pci_dev;
     register_ioport_write(addr, size, 1, xen_platform_ioport_writeb, d);
     register_ioport_read(addr, size, 1, xen_platform_ioport_readb, d);
++++++ ioemu-vnc-resize.patch ++++++
Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/vnc.c
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/vnc.c
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/vnc.c
@@ -1751,6 +1751,25 @@ static int protocol_client_msg(VncState
 	}
 
 	set_encodings(vs, (int32_t *)(data + 4), limit);
+
+    /*
+     * The initialization of a VNC connection can race with xenfb changing
+     * the resolution. This happens when the VNC connection is already
+     * established, but the client has not yet advertised has_resize, so it
+     * won't get notified of the switch.
+     *
+     * Therefore we resend the resolution as soon as the client has sent its
+     * encodings.
+     */
+     if (vs->has_resize) {
+         /* Resize the VNC window */
+         vnc_write_u8(vs, 0);  /* msg id */
+         vnc_write_u8(vs, 0);
+         vnc_write_u16(vs, 1); /* number of rects */
+         vnc_framebuffer_update(vs, 0, 0, vs->serverds.width, vs->serverds.height, -223);
+
+         vnc_flush(vs);
+     }
 	break;
     case 3:
 	if (len == 1)
++++++ ioemu-watchdog-ib700-timer.patch ++++++

Subject: qdev: convert watchdogs
From: Markus Armbruster armbru@redhat.com Fri Aug 21 10:31:34 2009 +0200
Date: Thu Aug 27 20:35:24 2009 -0500:
Git: 09aaa1602f9381c0e0fb539390b1793e51bdfc7b

* THIS IS ONLY THE BUG FIX PART OF THE UPSTREAM PATCH *

Fixes ib700 not to use vm_clock before it is initialized: in
wdt_ib700_init(), called from register_watchdogs(), which runs before
init_timers().  The bug made ib700_write_enable_reg() crash in
qemu_del_timer().

Signed-off-by: Markus Armbruster 
Signed-off-by: Anthony Liguori 

Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/wdt_ib700.c
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/wdt_ib700.c
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/wdt_ib700.c
@@ -93,6 +93,7 @@ static int ib700_load(QEMUFile *f, void
 /* Create and initialize a virtual IB700 during PC creation. */
 static void ib700_pc_init(PCIBus *unused)
 {
+    timer = qemu_new_timer(vm_clock, ib700_timer_expired, NULL);
     register_savevm("ib700_wdt", -1, 0, ib700_save, ib700_load, NULL);
 
     register_ioport_write(0x441, 2, 1, ib700_write_disable_reg, NULL);
@@ -108,5 +109,4 @@ static WatchdogTimerModel model = {
 void wdt_ib700_init(void)
 {
     watchdog_add_model(&model);
-    timer = qemu_new_timer(vm_clock, ib700_timer_expired, NULL);
 }
++++++ ioemu-watchdog-linkage.patch ++++++

Subject: Move watchdog, watchdog_action, give them internal linkage
From: Markus Armbruster armbru@redhat.com Fri Aug 21 10:31:32 2009 +0200
Date: Thu Aug 27 20:30:23 2009 -0500:
Git: 88b3be201acf64e0bd19782bebd533901c951c87

Signed-off-by: Markus Armbruster 
Signed-off-by: Anthony Liguori 

Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/watchdog.c
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/watchdog.c
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/watchdog.c
@@ -26,6 +26,16 @@
 #include "sysemu.h"
 #include "hw/watchdog.h"
 
+/* Possible values for action parameter. */
+#define WDT_RESET        1	/* Hard reset. */
+#define WDT_SHUTDOWN     2	/* Shutdown. */
+#define WDT_POWEROFF     3	/* Quit. */
+#define WDT_PAUSE        4	/* Pause. */
+#define WDT_DEBUG        5	/* Prints a message and continues running. */
+#define WDT_NONE         6	/* Do nothing. */
+
+static WatchdogTimerModel *watchdog;
+static int watchdog_action = WDT_RESET;
 static LIST_HEAD(watchdog_list, WatchdogTimerModel) watchdog_list;
 
 void watchdog_add_model(WatchdogTimerModel *model)
Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/watchdog.h
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/watchdog.h
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/watchdog.h
@@ -27,13 +27,6 @@
 extern void wdt_i6300esb_init(void);
 extern void wdt_ib700_init(void);
 
-/* Possible values for action parameter. */
-#define WDT_RESET        1	/* Hard reset. */
-#define WDT_SHUTDOWN     2	/* Shutdown. */
-#define WDT_POWEROFF     3	/* Quit. */
-#define WDT_PAUSE        4	/* Pause. */
-#define WDT_DEBUG        5	/* Prints a message and continues running. */
-#define WDT_NONE         6	/* Do nothing. */
 
 struct WatchdogTimerModel {
     LIST_ENTRY(WatchdogTimerModel) entry;
@@ -50,10 +43,6 @@ struct WatchdogTimerModel {
 };
 typedef struct WatchdogTimerModel WatchdogTimerModel;
 
-/* in vl.c */
-extern WatchdogTimerModel *watchdog;
-extern int watchdog_action;
-
 /* in hw/watchdog.c */
 extern int select_watchdog(const char *p);
 extern int select_watchdog_action(const char *action);
Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/vl.c
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/vl.c
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/vl.c
@@ -250,8 +250,6 @@ int no_shutdown = 0;
 int cursor_hide = 1;
 int graphic_rotate = 0;
 int daemonize = 0;
-WatchdogTimerModel *watchdog = NULL;
-int watchdog_action = WDT_RESET;
 const char *option_rom[MAX_OPTION_ROMS];
 int nb_option_roms;
 int semihosting_enabled = 0;
++++++ ioemu-watchdog-support.patch ++++++
++++ 963 lines (skipped)

++++++ ipxe-enable-nics.patch ++++++
Index: xen-4.2.0-testing/tools/firmware/etherboot/Config
===================================================================
--- xen-4.2.0-testing.orig/tools/firmware/etherboot/Config
+++ xen-4.2.0-testing/tools/firmware/etherboot/Config
@@ -1,3 +1,4 @@
+NICS = rtl8139 8086100e eepro100 e1000 pcnet32 10ec8029
 
 CFLAGS += -UPXE_DHCP_STRICT
 CFLAGS += -DPXE_DHCP_STRICT
++++++ kernel-boot-hvm.patch ++++++
Direct kernel boot to HVM guests has regression from xen-3.3 to xen-4.0.
Foreport this feature to latest qemu-xen. Make a fake boot sector with given
kernel and initrd, which could be accessed by hvmloader.

Signed-off-by: Chunyan Liu 

Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/block.c
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/block.c
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/block.c
@@ -596,6 +596,16 @@ int bdrv_read(BlockDriverState *bs, int6
 
     if (bdrv_check_request(bs, sector_num, nb_sectors))
 	return -EIO;
+
+    if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
+            memcpy(buf, bs->boot_sector_data, 512);
+        sector_num++;
+        nb_sectors--;
+        buf += 512;
+        if (nb_sectors == 0)
+            return 0;
+    }
+
     if (drv->bdrv_pread) {
         int ret, len;
         len = nb_sectors * 512;
@@ -631,6 +641,10 @@ int bdrv_write(BlockDriverState *bs, int
     if (bdrv_check_request(bs, sector_num, nb_sectors))
         return -EIO;
 
+    if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
+        memcpy(bs->boot_sector_data, buf, 512);
+    }
+
     if (drv->bdrv_pwrite) {
         int ret, len, count = 0;
         len = nb_sectors * 512;
@@ -934,6 +948,16 @@ void bdrv_guess_geometry(BlockDriverStat
     }
 }
 
+/* force a given boot sector. */
+void bdrv_set_boot_sector(BlockDriverState *bs, const uint8_t *data, int size)
+{
+    bs->boot_sector_enabled = 1;
+    if (size > 512)
+        size = 512;
+    memcpy(bs->boot_sector_data, data, size);
+    memset(bs->boot_sector_data + size, 0, 512 - size);
+}
+
 void bdrv_set_geometry_hint(BlockDriverState *bs,
                             int cyls, int heads, int secs)
 {
@@ -1464,6 +1488,14 @@ BlockDriverAIOCB *bdrv_aio_read(BlockDri
     if (bdrv_check_request(bs, sector_num, nb_sectors))
         return NULL;
 
+    /* XXX: we assume that nb_sectors == 0 is suppored by the async read */
+    if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
+        memcpy(buf, bs->boot_sector_data, 512);
+        sector_num++;
+        nb_sectors--;
+        buf += 512;
+    }
+
     ret = drv->bdrv_aio_read(bs, sector_num, buf, nb_sectors, cb, opaque);
 
     if (ret) {
@@ -1489,6 +1521,10 @@ BlockDriverAIOCB *bdrv_aio_write(BlockDr
     if (bdrv_check_request(bs, sector_num, nb_sectors))
         return NULL;
 
+    if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
+        memcpy(bs->boot_sector_data, buf, 512);
+    }
+
     ret = drv->bdrv_aio_write(bs, sector_num, buf, nb_sectors, cb, opaque);
 
     if (ret) {
Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/block_int.h
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/block_int.h
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/block_int.h
@@ -122,6 +122,9 @@ struct BlockDriverState {
     BlockDriver *drv; /* NULL means no media */
     void *opaque;
 
+    int boot_sector_enabled;
+    uint8_t boot_sector_data[512];
+
     char filename[1024];
     char backing_file[1024]; /* if non zero, the image is a diff of
                                 this file image */
Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/pc.c
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/pc.c
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/pc.c
@@ -474,45 +474,28 @@ static void bochs_bios_init(void)
 
 /* Generate an initial boot sector which sets state and jump to
    a specified vector */
-static void generate_bootsect(uint8_t *option_rom,
-                              uint32_t gpr[8], uint16_t segs[6], uint16_t ip)
+static void generate_bootsect(uint32_t gpr[8], uint16_t segs[6], uint16_t ip)
 {
-    uint8_t rom[512], *p, *reloc;
-    uint8_t sum;
+    uint8_t bootsect[512], *p;
     int i;
+    int hda;
+ 
+    hda = drive_get_index(IF_IDE, 0, 0);
+    if (hda == -1) {
+	fprintf(stderr, "A disk image must be given for 'hda' when booting "
+		"a Linux kernel\n(if you really don't want it, use /dev/zero)\n");
+	exit(1);
+    }
+    memset(bootsect, 0, sizeof(bootsect));
 
-    memset(rom, 0, sizeof(rom));
-
-    p = rom;
-    /* Make sure we have an option rom signature */
-    *p++ = 0x55;
-    *p++ = 0xaa;
-
-    /* ROM size in sectors*/
-    *p++ = 1;
-
-    /* Hook int19 */
-
-    *p++ = 0x50;		/* push ax */
-    *p++ = 0x1e;		/* push ds */
-    *p++ = 0x31; *p++ = 0xc0;	/* xor ax, ax */
-    *p++ = 0x8e; *p++ = 0xd8;	/* mov ax, ds */
-
-    *p++ = 0xc7; *p++ = 0x06;   /* movvw _start,0x64 */
-    *p++ = 0x64; *p++ = 0x00;
-    reloc = p;
-    *p++ = 0x00; *p++ = 0x00;
-
-    *p++ = 0x8c; *p++ = 0x0e;   /* mov cs,0x66 */
-    *p++ = 0x66; *p++ = 0x00;
-
-    *p++ = 0x1f;		/* pop ds */
-    *p++ = 0x58;		/* pop ax */
-    *p++ = 0xcb;		/* lret */
-    
-    /* Actual code */
-    *reloc = (p - rom);
+    /* Copy the MSDOS partition table if possible */
+    bdrv_read(drives_table[hda].bdrv, 0, bootsect, 1);
+    /* Make sure we have a partition signature */
+    bootsect[510] = 0x55;
+    bootsect[511] = 0xaa;
 
+     /* Actual code */
+    p = bootsect;
     *p++ = 0xfa;		/* CLI */
     *p++ = 0xfc;		/* CLD */
 
@@ -542,13 +525,7 @@ static void generate_bootsect(uint8_t *o
     *p++ = segs[1];		/* CS */
     *p++ = segs[1] >> 8;
 
-    /* sign rom */
-    sum = 0;
-    for (i = 0; i < (sizeof(rom) - 1); i++)
-        sum += rom[i];
-    rom[sizeof(rom) - 1] = -sum;
-
-    memcpy(option_rom, rom, sizeof(rom));
+    bdrv_set_boot_sector(drives_table[hda].bdrv, bootsect, sizeof(bootsect));
 }
 
 static long get_file_size(FILE *f)
@@ -565,8 +542,7 @@ static long get_file_size(FILE *f)
     return size;
 }
 
-static void load_linux(uint8_t *option_rom,
-                       const char *kernel_filename,
+static void load_linux(const char *kernel_filename,
 		       const char *initrd_filename,
 		       const char *kernel_cmdline)
 {
@@ -632,7 +608,9 @@ static void load_linux(uint8_t *option_r
 
     /* Special pages are placed at end of low RAM: pick an arbitrary one and
      * subtract a suitably large amount of padding (64kB) to skip BIOS data. */
-    xc_get_hvm_param(xc_handle, domid, HVM_PARAM_BUFIOREQ_PFN, &end_low_ram);
+    //xc_get_hvm_param(xc_handle, domid, HVM_PARAM_BUFIOREQ_PFN, &end_low_ram);
+    /* BUFIO Page beyond last_pfn, use 0x7ffc instead. Fix ME. */
+    end_low_ram = 0x7ffc;
     end_low_ram = (end_low_ram << 12) - (64*1024);
 
     /* highest address for loading the initrd */
@@ -721,7 +699,7 @@ static void load_linux(uint8_t *option_r
     memset(gpr, 0, sizeof gpr);
     gpr[4] = cmdline_addr-real_addr-16;	/* SP (-16 is paranoia) */
 
-    generate_bootsect(option_rom, gpr, seg, 0);
+    generate_bootsect(gpr, seg, 0);
 #endif
 }
 
@@ -932,14 +910,6 @@ vga_bios_error:
         int size, offset;
 
         offset = 0;
-        if (linux_boot) {
-            option_rom_offset = qemu_ram_alloc(TARGET_PAGE_SIZE);
-            load_linux(phys_ram_base + option_rom_offset,
-                       kernel_filename, initrd_filename, kernel_cmdline);
-            cpu_register_physical_memory(0xd0000, TARGET_PAGE_SIZE,
-                                         option_rom_offset | IO_MEM_ROM);
-            offset = TARGET_PAGE_SIZE;
-        }
 
         for (i = 0; i < nb_option_roms; i++) {
             size = get_image_size(option_rom[i]);
@@ -973,6 +943,9 @@ vga_bios_error:
 
     bochs_bios_init();
 
+    if (linux_boot)
+	load_linux(kernel_filename, initrd_filename, kernel_cmdline);
+
     cpu_irq = qemu_allocate_irqs(pic_irq_request, NULL, 1);
     i8259 = i8259_init(cpu_irq[0]);
     ferr_irq = i8259[13];
Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/block.h
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/block.h
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/block.h
@@ -82,6 +82,7 @@ int64_t bdrv_getlength(BlockDriverState
 void bdrv_get_geometry(BlockDriverState *bs, uint64_t *nb_sectors_ptr);
 void bdrv_guess_geometry(BlockDriverState *bs, int *pcyls, int *pheads, int *psecs);
 int bdrv_commit(BlockDriverState *bs);
+void bdrv_set_boot_sector(BlockDriverState *bs, const uint8_t *data, int size);
 /* async block I/O */
 typedef struct BlockDriverAIOCB BlockDriverAIOCB;
 typedef void BlockDriverCompletionFunc(void *opaque, int ret);
++++++ kmp_filelist ++++++
%defattr (-,root,root)
/lib/modules/%2-%1
++++++ libxc-pass-errno-to-callers-of-xc_domain_save.patch ++++++
++++ 647 lines (skipped)

++++++ libxen_permissive.patch ++++++
Index: xen-4.2.0-testing/tools/libxen/src/xen_common.c
===================================================================
--- xen-4.2.0-testing.orig/tools/libxen/src/xen_common.c
+++ xen-4.2.0-testing/tools/libxen/src/xen_common.c
@@ -904,8 +904,15 @@ static void parse_into(xen_session *s, x
             0 != strcmp((char *)value_node->children->name, "struct") ||
             value_node->children->children == NULL)
         {
+#if PERMISSIVE
+            fprintf(stderr,
+                    "Expected Map from the server, but didn't get one\n");
+            ((arbitrary_map **)value)[slot] = NULL;
+#else
+
             server_error(s,
                          "Expected Map from the server, but didn't get it");
+#endif
         }
         else
         {
++++++ libxl-migration-cleanup-remove-backend-domain-field.patch ++++++
References: bnc#903359

Remove the unusual 'domain' field under backend directory. The
affected are backend/console, backend/vfb, backend/vkbd.

Signed-off-by: Chunyan Liu 
---
 tools/libxl/libxl.c | 5 -----
 1 file changed, 5 deletions(-)

Index: xen-4.4.3-testing/tools/libxl/libxl.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl.c
+++ xen-4.4.3-testing/tools/libxl/libxl.c
@@ -3519,8 +3519,6 @@ int libxl__device_console_add(libxl__gc
     flexarray_append(back, "1");
     flexarray_append(back, "state");
     flexarray_append(back, libxl__sprintf(gc, "%d", 1));
-    flexarray_append(back, "domain");
-    flexarray_append(back, libxl__domid_to_name(gc, domid));
     flexarray_append(back, "protocol");
     flexarray_append(back, LIBXL_XENCONSOLE_PROTOCOL);
 
@@ -3630,8 +3628,6 @@ int libxl__device_vkb_add(libxl__gc *gc,
     flexarray_append(back, "1");
     flexarray_append(back, "state");
     flexarray_append(back, libxl__sprintf(gc, "%d", 1));
-    flexarray_append(back, "domain");
-    flexarray_append(back, libxl__domid_to_name(gc, domid));
 
     flexarray_append(front, "backend-id");
     flexarray_append(front, libxl__sprintf(gc, "%d", vkb->backend_domid));
@@ -3728,7 +3724,6 @@ int libxl__device_vfb_add(libxl__gc *gc,
     flexarray_append_pair(back, "frontend-id", libxl__sprintf(gc, "%d", domid));
     flexarray_append_pair(back, "online", "1");
     flexarray_append_pair(back, "state", libxl__sprintf(gc, "%d", 1));
-    flexarray_append_pair(back, "domain", libxl__domid_to_name(gc, domid));
     flexarray_append_pair(back, "vnc",
                           libxl_defbool_val(vfb->vnc.enable) ? "1" : "0");
     flexarray_append_pair(back, "vnclisten", vfb->vnc.listen);
++++++ libxl-migration-cleanup-update-uuid-name.patch ++++++
References: bnc#903359

libxl__domain_rename only updates /local/domain/<domid>/name,
/vm/<uuid>/name in xenstore are not updated. Add code in
libxl__domain_rename to update /vm/<uuid>/name too.

Signed-off-by: Chunyan Liu 
---
 tools/libxl/libxl.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

Index: xen-4.4.3-testing/tools/libxl/libxl.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl.c
+++ xen-4.4.3-testing/tools/libxl/libxl.c
@@ -291,6 +291,9 @@ int libxl__domain_rename(libxl__gc *gc,
     uint32_t stub_dm_domid;
     const char *stub_dm_old_name = NULL, *stub_dm_new_name = NULL;
     int rc;
+    libxl_dominfo info;
+    char *uuid;
+    const char *vm_name_path;
 
     dom_path = libxl__xs_get_dompath(gc, domid);
     if (!dom_path) goto x_nomem;
@@ -361,6 +364,16 @@ int libxl__domain_rename(libxl__gc *gc,
         goto x_fail;
     }
 
+    /* update /vm/<uuid>/name */
+    rc = libxl_domain_info(ctx, &info, domid);
+    if (rc)
+        goto x_fail;
+
+    uuid = GCSPRINTF(LIBXL_UUID_FMT, LIBXL_UUID_BYTES(info.uuid));
+    vm_name_path = GCSPRINTF("/vm/%s/name", uuid);
+    if (libxl__xs_write_checked(gc, trans, vm_name_path, new_name))
+        goto x_fail;
+
     if (stub_dm_domid) {
         rc = libxl__domain_rename(gc, stub_dm_domid,
                                   stub_dm_old_name,
++++++ libxl-restore-cleanup-left-xenstore-entries.patch ++++++
...
From 92f8d0e968f128445cb43569ecef0e131a8c077c Mon Sep 17 00:00:00 2001
From: Chunyan Liu 
Date: Tue, 18 Nov 2014 17:10:58 +0800
Subject: [PATCH] fix restore: xenstore entries left when restore failed
While running libvirt-tck domain/102-broken-save-restore.t
test (save domain, corrupt saved file by truncate the last 512k,
then restore), found that restore domain failed, but domain
related xenstore entries still exist in xenstore.

Add a patch to clear xenstore entries in this case.

Signed-off-by: Chunyan Liu 
---
 tools/libxl/libxl.c | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)

Index: xen-4.4.3-testing/tools/libxl/libxl.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl.c
+++ xen-4.4.3-testing/tools/libxl/libxl.c
@@ -1414,6 +1414,54 @@ static void devices_destroy_cb(libxl__eg
                                libxl__devices_remove_state *drs,
                                int rc);
 
+static void libxl_clear_xs_entry(libxl__gc *gc, uint32_t domid)
+{
+    const char *dom_path, *vm_path;
+    char *path;
+    unsigned int num_kinds, num_dev_xsentries;
+    char **kinds = NULL, **devs = NULL;
+    int i, j;
+
+    /* remove libxl path */
+    libxl__xs_rm_checked(gc, XBT_NULL, libxl__xs_libxl_path(gc, domid));
+
+    dom_path = libxl__xs_get_dompath(gc, domid);
+    if (!dom_path)
+        return;
+
+    /* remove backend entries */
+    path = GCSPRINTF("%s/device", dom_path);
+    kinds = libxl__xs_directory(gc, XBT_NULL, path, &num_kinds);
+    if (kinds && num_kinds) {
+        for (i = 0; i < num_kinds; i++) {
+            path = GCSPRINTF("%s/device/%s", dom_path, kinds[i]);
+            devs = libxl__xs_directory(gc, XBT_NULL, path, &num_dev_xsentries);
+            if (!devs)
+                continue;
+            for (j = 0; j < num_dev_xsentries; j++) {
+                path = GCSPRINTF("%s/device/%s/%s/backend",
+                                 dom_path, kinds[i], devs[j]);
+                path = libxl__xs_read(gc, XBT_NULL, path);
+                if (path)
+                    libxl__xs_rm_checked(gc, XBT_NULL, path);
+            }
+        }
+    }
+
+    path = GCSPRINTF("%s/console/backend", dom_path);
+    path = libxl__xs_read(gc, XBT_NULL, path);
+    if (path)
+        libxl__xs_rm_checked(gc, XBT_NULL, path);
+
+    /* remove vm path */
+    vm_path = libxl__xs_read(gc, XBT_NULL, GCSPRINTF("%s/vm", dom_path));
+    if (vm_path)
+        libxl__xs_rm_checked(gc, XBT_NULL, vm_path);
+
+    /* remove dom path */
+    libxl__xs_rm_checked(gc, XBT_NULL, dom_path);
+}
+
 void libxl__destroy_domid(libxl__egc *egc, libxl__destroy_domid_state *dis)
 {
     STATE_AO_GC(dis->ao);
@@ -1429,6 +1477,10 @@ void libxl__destroy_domid(libxl__egc *eg
         break;
     case ERROR_INVAL:
         LIBXL__LOG(ctx, LIBXL__LOG_ERROR, "non-existant domain %d", domid);
+        /* domain may not started successfully but some xenstore entries
+         * might be created already in earlier stage. We need to clear
+         * those entries. */
+        libxl_clear_xs_entry(gc, domid);
     default:
         goto out;
     }
++++++ libxl.add-option-for-discard-support-to-xl-disk-conf.patch ++++++
References: FATE#316071
Subject: libxl: add option for discard support to xl disk configuration

Handle new boolean option discard/no-discard for disk configuration. It
is supposed to disable discard support if file based backing storage was
intentionally created non-sparse to avoid fragmentation of the file.

The option intended for the backend driver. A new boolean property
"discard-enable" is written to the backend node. An upcoming patch for
qemu will make use of this property. The kernel blkback driver may be
updated as well to disable discard for phy based backing storage.

This change does not break ABI. Instead of adding a new member
discard_enable to struct libxl_device_disk the existing readwrite member
is reused.

Signed-off-by: Olaf Hering 
---
 docs/misc/xl-disk-configuration.txt |   17 +++++++++++++++++
 tools/libxl/libxl.c                 |    2 ++
 tools/libxl/libxl.h                 |   12 ++++++++++++
 tools/libxl/libxlu_disk.c           |    3 +++
 tools/libxl/libxlu_disk_i.h         |    2 +-
 tools/libxl/libxlu_disk_l.l         |    2 ++
 6 files changed, 37 insertions(+), 1 deletion(-)

Index: xen-4.4.3-testing/docs/misc/xl-disk-configuration.txt
===================================================================
--- xen-4.4.3-testing.orig/docs/misc/xl-disk-configuration.txt
+++ xen-4.4.3-testing/docs/misc/xl-disk-configuration.txt
@@ -179,6 +179,23 @@ These scripts are normally called "block
 
 
 
+discard / no-discard
+---------------
+
+Description:           Request backend to advertise discard support to frontend
+Supported values:      discard
+                       no-discard
+Mandatory:             No
+Default value:         discard
+
+An advisory setting for the backend driver, specifying whether, to
+advertise discard support (TRIM, UNMAP) to the frontend.  The real
+benefit of this option is to be able to force it off rather than on.  It
+can be used to disable "hole punching" for file based backends which
+were intentionally created non-sparse to avoid fragmentation of the
+file.
+
+
 ============================================
 DEPRECATED PARAMETERS, PREFIXES AND SYNTAXES
 ============================================
Index: xen-4.4.3-testing/tools/libxl/libxl.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl.c
+++ xen-4.4.3-testing/tools/libxl/libxl.c
@@ -2497,6 +2497,8 @@ static void device_disk_add(libxl__egc *
         flexarray_append(back, disk->readwrite ? "w" : "r");
         flexarray_append(back, "device-type");
         flexarray_append(back, disk->is_cdrom ? "cdrom" : "disk");
+        if ((disk->readwrite & ~LIBXL_HAVE_LIBXL_DEVICE_DISK_DISCARD_DISABLE_MASK) == LIBXL_HAVE_LIBXL_DEVICE_DISK_DISCARD_DISABLE_MAGIC)
+            flexarray_append_pair(back, "discard-enable", "0");
 
         flexarray_append(front, "backend-id");
         flexarray_append(front, libxl__sprintf(gc, "%d", disk->backend_domid));
Index: xen-4.4.3-testing/tools/libxl/libxl.h
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl.h
+++ xen-4.4.3-testing/tools/libxl/libxl.h
@@ -95,6 +95,18 @@
 #define LIBXL_HAVE_BUILDINFO_EVENT_CHANNELS 1
 
 /*
+ * The libxl_device_disk lacks discard_enable field, disabling discard
+ * is supported without breaking the ABI. This is done by overloading
+ * struct libxl_device_disk->readwrite:
+ * readwrite == 0: disk is readonly, no discard
+ * readwrite == 1: disk is readwrite, backend driver may enable discard
+ * readwrite == MAGIC: disk is readwrite, backend driver should not offer
+ * discard to the frontend driver.
+ */
+#define LIBXL_HAVE_LIBXL_DEVICE_DISK_DISCARD_DISABLE_MAGIC 0x00000060U
+#define LIBXL_HAVE_LIBXL_DEVICE_DISK_DISCARD_DISABLE_MASK  0xffffff0fU
+
+/*
  * libxl ABI compatibility
  *
  * The only guarantee which libxl makes regarding ABI compatibility
Index: xen-4.4.3-testing/tools/libxl/libxlu_disk.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxlu_disk.c
+++ xen-4.4.3-testing/tools/libxl/libxlu_disk.c
@@ -80,6 +80,9 @@ int xlu_disk_parse(XLU_Config *cfg,
             disk->format = LIBXL_DISK_FORMAT_EMPTY;
     }
 
+    if (disk->readwrite && dpc.disable_discard)
+        disk->readwrite = (disk->readwrite & LIBXL_HAVE_LIBXL_DEVICE_DISK_DISCARD_DISABLE_MASK) | LIBXL_HAVE_LIBXL_DEVICE_DISK_DISCARD_DISABLE_MAGIC;
+
     if (!disk->vdev) {
         xlu__disk_err(&dpc,0, "no vdev specified");
         goto x_err;
Index: xen-4.4.3-testing/tools/libxl/libxlu_disk_i.h
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxlu_disk_i.h
+++ xen-4.4.3-testing/tools/libxl/libxlu_disk_i.h
@@ -10,7 +10,7 @@ typedef struct {
     void *scanner;
     YY_BUFFER_STATE buf;
     libxl_device_disk *disk;
-    int access_set, had_depr_prefix;
+    int access_set, disable_discard, had_depr_prefix;
     const char *spec;
 } DiskParseContext;
 
Index: xen-4.4.3-testing/tools/libxl/libxlu_disk_l.l
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxlu_disk_l.l
+++ xen-4.4.3-testing/tools/libxl/libxlu_disk_l.l
@@ -173,6 +173,8 @@ backendtype=[^,]*,? { STRIP(','); setbac
 
 vdev=[^,]*,?	{ STRIP(','); SAVESTRING("vdev", vdev, FROMEQUALS); }
 script=[^,]*,?	{ STRIP(','); SAVESTRING("script", script, FROMEQUALS); }
+discard,?	{ DPC->disable_discard = 0; }
+no-discard,?	{ DPC->disable_discard = 1; }
 
  /* the target magic parameter, eats the rest of the string */
 
++++++ libxl.add-option-to-disable-disk-cache-flushes-in-qdisk.patch ++++++
https://bugzilla.novell.com/show_bug.cgi?id=879425
---
 tools/libxl/libxl.c         |    2 ++
 tools/libxl/libxl.h         |   12 ++++++++++++
 tools/libxl/libxlu_disk.c   |    2 ++
 tools/libxl/libxlu_disk_i.h |    2 +-
 tools/libxl/libxlu_disk_l.l |    1 +
 5 files changed, 18 insertions(+), 1 deletion(-)

Index: xen-4.4.3-testing/tools/libxl/libxl.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl.c
+++ xen-4.4.3-testing/tools/libxl/libxl.c
@@ -2501,6 +2501,8 @@ static void device_disk_add(libxl__egc *
             flexarray_append_pair(back, "direct-io-safe", "1");
         if ((disk->readwrite & ~LIBXL_HAVE_LIBXL_DEVICE_DISK_DISCARD_DISABLE_MASK) == LIBXL_HAVE_LIBXL_DEVICE_DISK_DISCARD_DISABLE_MAGIC)
             flexarray_append_pair(back, "discard-enable", "0");
+        if ((disk->readwrite & ~LIBXL_HAVE_LIBXL_DEVICE_DISK_DISABLE_FLUSH_MASK) == LIBXL_HAVE_LIBXL_DEVICE_DISK_DISABLE_FLUSH_MAGIC)
+            flexarray_append_pair(back, "suse-diskcache-disable-flush", "1");
 
         flexarray_append(front, "backend-id");
         flexarray_append(front, libxl__sprintf(gc, "%d", disk->backend_domid));
Index: xen-4.4.3-testing/tools/libxl/libxl.h
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl.h
+++ xen-4.4.3-testing/tools/libxl/libxl.h
@@ -118,6 +118,18 @@
 #define LIBXL_HAVE_LIBXL_DEVICE_DISK_DISCARD_DISABLE_MASK  0xffffff0fU
 
 /*
+ * The libxl_device_disk has no way to indicate that cache=unsafe is
+ * supposed to be used. Provide this knob without breaking the ABI.
+ * This is done by overloading struct libxl_device_disk->readwrite:
+ * readwrite == 0: disk is readonly, no discard
+ * readwrite == 1: disk is readwrite, backend driver may enable discard
+ * readwrite == MAGIC: disk is readwrite, backend driver should ignore
+ * flush requests from the frontend driver.
+ */
+#define LIBXL_HAVE_LIBXL_DEVICE_DISK_DISABLE_FLUSH_MAGIC 0x00006000U
+#define LIBXL_HAVE_LIBXL_DEVICE_DISK_DISABLE_FLUSH_MASK  0xffff0fffU
+
+/*
  * libxl ABI compatibility
  *
  * The only guarantee which libxl makes regarding ABI compatibility
Index: xen-4.4.3-testing/tools/libxl/libxlu_disk.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxlu_disk.c
+++ xen-4.4.3-testing/tools/libxl/libxlu_disk.c
@@ -84,6 +84,8 @@ int xlu_disk_parse(XLU_Config *cfg,
         disk->readwrite = (disk->readwrite & LIBXL_HAVE_LIBXL_DEVICE_DISK_DIRECT_IO_SAFE_MASK) | LIBXL_HAVE_LIBXL_DEVICE_DISK_DIRECT_IO_SAFE_MAGIC;
     if (disk->readwrite && dpc.disable_discard)
         disk->readwrite = (disk->readwrite & LIBXL_HAVE_LIBXL_DEVICE_DISK_DISCARD_DISABLE_MASK) | LIBXL_HAVE_LIBXL_DEVICE_DISK_DISCARD_DISABLE_MAGIC;
+    if (disk->readwrite && dpc.suse_diskcache_disable_flush)
+        disk->readwrite = (disk->readwrite & LIBXL_HAVE_LIBXL_DEVICE_DISK_DISABLE_FLUSH_MASK) | LIBXL_HAVE_LIBXL_DEVICE_DISK_DISABLE_FLUSH_MAGIC;
 
     if (!disk->vdev) {
         xlu__disk_err(&dpc,0, "no vdev specified");
Index: xen-4.4.3-testing/tools/libxl/libxlu_disk_i.h
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxlu_disk_i.h
+++ xen-4.4.3-testing/tools/libxl/libxlu_disk_i.h
@@ -10,7 +10,7 @@ typedef struct {
     void *scanner;
     YY_BUFFER_STATE buf;
     libxl_device_disk *disk;
-    int access_set, direct_io_safe, disable_discard, had_depr_prefix;
+    int access_set, suse_diskcache_disable_flush, direct_io_safe, disable_discard, had_depr_prefix;
     const char *spec;
 } DiskParseContext;
 
Index: xen-4.4.3-testing/tools/libxl/libxlu_disk_l.l
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxlu_disk_l.l
+++ xen-4.4.3-testing/tools/libxl/libxlu_disk_l.l
@@ -176,6 +176,7 @@ script=[^,]*,?	{ STRIP(','); SAVESTRING(
 direct-io-safe,? { DPC->direct_io_safe = 1; }
 discard,?	{ DPC->disable_discard = 0; }
 no-discard,?	{ DPC->disable_discard = 1; }
+suse-diskcache-disable-flush,? { DPC->suse_diskcache_disable_flush = 1; }
 
  /* the target magic parameter, eats the rest of the string */
 
++++++ libxl.honor-more-top-level-vfb-options.patch ++++++
From: Wei Liu 
Date: Tue, 28 Jan 2014 15:38:01 +0000
Subject: xl: honor more top level vfb options

Now that SDL and keymap options for VFB can also be specified in top
level options. Documentation is also updated.

This fixes bug #31 and further possible problems.

Signed-off-by: Wei Liu 
Cc: Olaf Hering 
Cc: Ian Campbell 
Cc: Ian Jackson 
---
 docs/man/xl.cfg.pod.5    |  4 ++--
 tools/libxl/xl_cmdimpl.c | 17 ++++++++++++++---
 2 files changed, 16 insertions(+), 5 deletions(-)

Index: xen-4.4.2-testing/docs/man/xl.cfg.pod.5
===================================================================
--- xen-4.4.2-testing.orig/docs/man/xl.cfg.pod.5
+++ xen-4.4.2-testing/docs/man/xl.cfg.pod.5
@@ -420,8 +420,8 @@ This options does not control the emulat
 an HVM guest. See L<Emulated VGA Graphics Device> below for how to
 configure the emulated device. If L<Emulated VGA Graphics Device> options
 are used in a PV guest configuration, xl will pick up B<vnc>, B<vnclisten>,
-B<vncpasswd>, B<vncdisplay> and B<vncunused> to construct paravirtual
-framebuffer device for the guest.
+B<vncpasswd>, B<vncdisplay>, B<vncunused>, B<sdl>, B<opengl> and
+B<keymap> to construct paravirtual framebuffer device for the guest.
 
 Each B is a comma-separated list of C
 settings, from the following list:
Index: xen-4.4.2-testing/tools/libxl/xl_cmdimpl.c
===================================================================
--- xen-4.4.2-testing.orig/tools/libxl/xl_cmdimpl.c
+++ xen-4.4.2-testing/tools/libxl/xl_cmdimpl.c
@@ -744,6 +744,15 @@ static char *parse_cmdline(XLU_Config *c
     return cmdline;
 }
 
+static void parse_top_level_sdl_options(XLU_Config *config,
+                                        libxl_sdl_info *sdl)
+{
+    xlu_cfg_get_defbool(config, "sdl", &sdl->enable, 0);
+    xlu_cfg_get_defbool(config, "opengl", &sdl->opengl, 0);
+    xlu_cfg_replace_string (config, "display", &sdl->display, 0);
+    xlu_cfg_replace_string (config, "xauthority", &sdl->xauthority, 0);
+}
+
 static void parse_config_data(const char *config_source,
                               const char *config_data,
                               int config_len,
@@ -1666,9 +1675,13 @@ skip_vfb:
                                     libxl_device_vkb_init);
 
             parse_top_level_vnc_options(config, &vfb->vnc);
+            parse_top_level_sdl_options(config, &vfb->sdl);
+            xlu_cfg_replace_string (config, "keymap", &vfb->keymap, 0);
         }
-    } else
+    } else {
         parse_top_level_vnc_options(config, &b_info->u.hvm.vnc);
+        parse_top_level_sdl_options(config, &b_info->u.hvm.sdl);
+    }
 
     if (c_info->type == LIBXL_DOMAIN_TYPE_HVM) {
         if (!xlu_cfg_get_string (config, "vga", &buf, 0)) {
@@ -1689,8 +1702,6 @@ skip_vfb:
                                          LIBXL_VGA_INTERFACE_TYPE_CIRRUS;
 
         xlu_cfg_replace_string (config, "keymap", &b_info->u.hvm.keymap, 0);
-        xlu_cfg_get_defbool(config, "sdl", &b_info->u.hvm.sdl.enable, 0);
-        xlu_cfg_get_defbool(config, "opengl", &b_info->u.hvm.sdl.opengl, 0);
         xlu_cfg_get_defbool (config, "spice", &b_info->u.hvm.spice.enable, 0);
         if (!xlu_cfg_get_long (config, "spiceport", &l, 0))
             b_info->u.hvm.spice.port = l;
++++++ libxl.introduce-an-option-to-disable-the-non-O_DIRECT-workaround.patch ++++++
xen-unstable commit 6ec48cf41b6656c98148380f39010063e62628c5
Frp,: Stefano Stabellini 
Date:   Wed Apr 30 16:06:24 2014 +0100
Subject: libxl: introduce an option for disabling the non-O_DIRECT workaround
    
Document and implement a new option that permits disk backends which
would otherwise have to avoid O_DIRECT (because of the network memory
lifetime bug) to use it anyway.  This is:
 direct-io-safe   in the xl domain disk config specification
 direct_io_safe   in the libxl disk API
 direct-io-safe   in the backend xenstore interface

Add a reference to xen/include/public/io/blkif.h in
docs/misc/vbd-interface.txt.

This change does not break ABI. Instead of adding a new member
direct_io_safe to struct libxl_device_disk the existing readwrite member
is reused.

Signed-off-by: Stefano Stabellini 
Signed-off-by: Ian Jackson 
Acked-by: Ian Campbell 
Tested-by: Felipe Franciosi 
---
 docs/misc/vbd-interface.txt         |    6 +++++
 docs/misc/xl-disk-configuration.txt |   38 ++++++++++++++++++++++++++++++++++++
 tools/libxl/libxl.c                 |    2 +
 tools/libxl/libxl.h                 |   11 ++++++++++
 tools/libxl/libxlu_disk.c           |    2 +
 tools/libxl/libxlu_disk_i.h         |    2 -
 tools/libxl/libxlu_disk_l.l         |    1 
 xen/include/public/io/blkif.h       |   22 ++++++++++++++++++++
 8 files changed, 83 insertions(+), 1 deletion(-)

Index: xen-4.4.3-testing/docs/misc/vbd-interface.txt
===================================================================
--- xen-4.4.3-testing.orig/docs/misc/vbd-interface.txt
+++ xen-4.4.3-testing/docs/misc/vbd-interface.txt
@@ -125,3 +125,9 @@ because they directly map the bottom 8 b
 directly to the Linux guest's device number and throw away the rest;
 they can crash due to minor number clashes.  With these guests, the
 workaround is not to supply problematic combinations of devices.
+
+
+Other frontend and backend options
+----------------------------------
+
+See xen/include/public/io/blkif.h for the full list of options.
Index: xen-4.4.3-testing/docs/misc/xl-disk-configuration.txt
===================================================================
--- xen-4.4.3-testing.orig/docs/misc/xl-disk-configuration.txt
+++ xen-4.4.3-testing/docs/misc/xl-disk-configuration.txt
@@ -178,6 +178,44 @@ information to be interpreted by the exe
 These scripts are normally called "block-<script>".
 
 
+direct-io-safe
+--------------
+
+Description:           Disables non-O_DIRECT workaround
+Supported values:      absent, present
+Mandatory:             No
+Default value:         absent (workaround may be enabled)
+
+There is a memory lifetime bug in some driver domain (dom0) kernels
+which can cause crashes when using O_DIRECT.  The bug occurs due to a
+mismatch between the backend-visible lifetime of pages used for the
+Xen PV network protocol and that expected by the backend kernel's
+networking subsystem.  This can cause crashes when using certain
+backends with certain underlying storage.
+
+See:
+ http://lists.xen.org/archives/html/xen-devel/2012-12/msg01154.html
+
+For this reason, (this version of) the Xen libxl toolstack disables
+O_DIRECT when using the qemu-based Xen PV backend ("qdisk").
+
+However, this workaround has performance and scaling implications, and
+it is only necessary if the underlying device is a network filesystem.
+If the underlying device is not, then it is good to disable it; that
+is what this option is for.
+
+This option simply requests that the workaround be disabled.  (However,
+not all backends versions which use the workaround understand this
+option, so this is on a best effort basis.)
+
+It's important to note that if you are storing the VM disk on a
+network filesystem or a network block device (NFS or ISCSI) it might
+not be safe to use this option.  Otherwise specifying it is safe and
+can give better performances.
+
+If in the future the bug is fixed properly this option will then be
+silently ignored.
+
 
 discard / no-discard
 ---------------
Index: xen-4.4.3-testing/tools/libxl/libxl.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl.c
+++ xen-4.4.3-testing/tools/libxl/libxl.c
@@ -2497,6 +2497,8 @@ static void device_disk_add(libxl__egc *
         flexarray_append(back, disk->readwrite ? "w" : "r");
         flexarray_append(back, "device-type");
         flexarray_append(back, disk->is_cdrom ? "cdrom" : "disk");
+        if ((disk->readwrite & ~LIBXL_HAVE_LIBXL_DEVICE_DISK_DIRECT_IO_SAFE_MASK) == LIBXL_HAVE_LIBXL_DEVICE_DISK_DIRECT_IO_SAFE_MAGIC)
+            flexarray_append_pair(back, "direct-io-safe", "1");
         if ((disk->readwrite & ~LIBXL_HAVE_LIBXL_DEVICE_DISK_DISCARD_DISABLE_MASK) == LIBXL_HAVE_LIBXL_DEVICE_DISK_DISCARD_DISABLE_MAGIC)
             flexarray_append_pair(back, "discard-enable", "0");
 
Index: xen-4.4.3-testing/tools/libxl/libxl.h
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl.h
+++ xen-4.4.3-testing/tools/libxl/libxl.h
@@ -95,6 +95,17 @@
 #define LIBXL_HAVE_BUILDINFO_EVENT_CHANNELS 1
 
 /*
+ * The libxl_device_disk lacks some "cache" field, enabling directio
+ * is supported without breaking the ABI. This is done by overloading
+ * struct libxl_device_disk->readwrite:
+ * readwrite == 0: disk is readonly, no directio
+ * readwrite == 1: disk is readwrite, backend driver may enable directio
+ * readwrite == MAGIC: disk is readwrite, backend driver should use direct IO
+ */
+#define LIBXL_HAVE_LIBXL_DEVICE_DISK_DIRECT_IO_SAFE_MAGIC 0x00000600U
+#define LIBXL_HAVE_LIBXL_DEVICE_DISK_DIRECT_IO_SAFE_MASK  0xfffff0ffU
+
+/*
  * The libxl_device_disk lacks discard_enable field, disabling discard
  * is supported without breaking the ABI. This is done by overloading
  * struct libxl_device_disk->readwrite:
Index: xen-4.4.3-testing/tools/libxl/libxlu_disk.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxlu_disk.c
+++ xen-4.4.3-testing/tools/libxl/libxlu_disk.c
@@ -80,6 +80,8 @@ int xlu_disk_parse(XLU_Config *cfg,
             disk->format = LIBXL_DISK_FORMAT_EMPTY;
     }
 
+    if (disk->readwrite && dpc.direct_io_safe)
+        disk->readwrite = (disk->readwrite & LIBXL_HAVE_LIBXL_DEVICE_DISK_DIRECT_IO_SAFE_MASK) | LIBXL_HAVE_LIBXL_DEVICE_DISK_DIRECT_IO_SAFE_MAGIC;
     if (disk->readwrite && dpc.disable_discard)
         disk->readwrite = (disk->readwrite & LIBXL_HAVE_LIBXL_DEVICE_DISK_DISCARD_DISABLE_MASK) | LIBXL_HAVE_LIBXL_DEVICE_DISK_DISCARD_DISABLE_MAGIC;
 
Index: xen-4.4.3-testing/tools/libxl/libxlu_disk_i.h
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxlu_disk_i.h
+++ xen-4.4.3-testing/tools/libxl/libxlu_disk_i.h
@@ -10,7 +10,7 @@ typedef struct {
     void *scanner;
     YY_BUFFER_STATE buf;
     libxl_device_disk *disk;
-    int access_set, disable_discard, had_depr_prefix;
+    int access_set, direct_io_safe, disable_discard, had_depr_prefix;
     const char *spec;
 } DiskParseContext;
 
Index: xen-4.4.3-testing/tools/libxl/libxlu_disk_l.l
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxlu_disk_l.l
+++ xen-4.4.3-testing/tools/libxl/libxlu_disk_l.l
@@ -173,6 +173,7 @@ backendtype=[^,]*,? { STRIP(','); setbac
 
 vdev=[^,]*,?	{ STRIP(','); SAVESTRING("vdev", vdev, FROMEQUALS); }
 script=[^,]*,?	{ STRIP(','); SAVESTRING("script", script, FROMEQUALS); }
+direct-io-safe,? { DPC->direct_io_safe = 1; }
 discard,?	{ DPC->disable_discard = 0; }
 no-discard,?	{ DPC->disable_discard = 1; }
 
Index: xen-4.4.3-testing/xen/include/public/io/blkif.h
===================================================================
--- xen-4.4.3-testing.orig/xen/include/public/io/blkif.h
+++ xen-4.4.3-testing/xen/include/public/io/blkif.h
@@ -97,6 +97,28 @@
  *
  *      The type of the backing device/object.
  *
+ *
+ * direct-io-safe
+ *      Values:         0/1 (boolean)
+ *      Default Value:  0
+ *
+ *      The underlying storage is not affected by the direct IO memory
+ *      lifetime bug.  See:
+ *        http://lists.xen.org/archives/html/xen-devel/2012-12/msg01154.html
+ *
+ *      Therefore this option gives the backend permission to use
+ *      O_DIRECT, notwithstanding that bug.
+ *
+ *      That is, if this option is enabled, use of O_DIRECT is safe,
+ *      in circumstances where we would normally have avoided it as a
+ *      workaround for that bug.  This option is not relevant for all
+ *      backends, and even not necessarily supported for those for
+ *      which it is relevant.  A backend which knows that it is not
+ *      affected by the bug can ignore this option.
+ *
+ *      This option doesn't require a backend to use O_DIRECT, so it
+ *      should not be used to try to control the caching behaviour.
+ *
  *--------------------------------- Features ---------------------------------
  *
  * feature-barrier
++++++ libxl.pvscsi.patch ++++++
++++ 1189 lines (skipped)

++++++ libxl.set-migration-constraints-from-cmdline.patch ++++++
...
From 77deb80879859ed279e24a790ec08e9c5d37dd0e Mon Sep 17 00:00:00 2001
From: Olaf Hering 
Date: Wed, 5 Feb 2014 14:37:53 +0100
Subject: libxl: set migration constraints from cmdline
Add new options to xl migrate to control the process of migration.
The intention is to optionally abort the migration if it takes too long
to migrate a busy guest due to the high number of new dirty pages.
Currently the guest is suspended to transfer the remaining dirty pages.
The suspend/resume cycle will cause a time jump. This transfer can take
a long time, which can confuse the guest if the time jump is too far.
The new options allow to override the built-in default values, which are
not changed by this patch.

--max_iters <number>  Number of iterations before final suspend (default: 30)

--max_factor <factor> Max amount of memory to transfer before final suspend (default: 3*RAM)

--min_remaing <pages> Number of dirty pages before stop© (default: 50)

--abort_if_busy       Abort migration instead of doing final suspend.

The changes to libxl change the API, handle LIBXL_API_VERSION == 0x040200.

v8:
  - merge --min_remaing changes
  - tools/libxc: print stats if migration is aborted
  - use special _suse version of lib calls to preserve ABI

v7:
  - remove short options
  - update description of --abort_if_busy in xl.1
  - extend description of --abort_if_busy in xl help
  - add comment to libxl_domain_suspend declaration, props is optional

v6:
 - update the LIBXL_API_VERSION handling for libxl_domain_suspend
   change it to an inline function if LIBXL_API_VERSION is defined to 4.2.0
 - rename libxl_save_properties to libxl_domain_suspend_properties
 - rename ->xlflags to ->flags within that struct

v5:
 - adjust libxl_domain_suspend prototype, move flags, max_iters,
   max_factor into a new, optional struct libxl_save_properties
 - rename XCFLAGS_DOMSAVE_NOSUSPEND to XCFLAGS_DOMSAVE_ABORT_IF_BUSY
 - rename LIBXL_SUSPEND_NO_FINAL_SUSPEND to LIBXL_SUSPEND_ABORT_IF_BUSY
 - rename variables no_suspend to abort_if_busy
 - rename option -N/--no_suspend to -A/--abort_if_busy
 - update xl.1, extend description of -A option

v4:
 - update default for no_suspend from None to 0 in XendCheckpoint.py:save
 - update logoutput in setMigrateConstraints
 - change xm migrate defaults from None to 0
 - add new options to xl.1
 - fix syntax error in XendDomain.py:domain_migrate_constraints_set
 - fix xm migrate -N option name to match xl migrate

v3:
 - move logic errors in libxl__domain_suspend and fixed help text in
   cmd_table to separate patches
 - fix syntax error in XendCheckpoint.py
 - really pass max_iters and max_factor in libxl__xc_domain_save
 - make libxl_domain_suspend_0x040200 declaration globally visible
 - bump libxenlight.so SONAME from 2.0 to 2.1 due to changed
   libxl_domain_suspend

v2:
 - use LIBXL_API_VERSION and define libxl_domain_suspend_0x040200
 - fix logic error in min_reached check in xc_domain_save
 - add longopts
 - update --help text
 - correct description of migrate --help text

Signed-off-by: Olaf Hering 
---
 docs/man/xl.pod.1                |   20 +++++++++++++++++++
 tools/libxc/xc_domain_save.c     |   27 +++++++++++++++++++++++--
 tools/libxc/xc_nomigrate.c       |   10 +++++++++
 tools/libxc/xenguest.h           |    7 ++++++
 tools/libxl/libxl.c              |   27 ++++++++++++++++++++++---
 tools/libxl/libxl.h              |   15 ++++++++++++++
 tools/libxl/libxl_dom.c          |    1 
 tools/libxl/libxl_internal.h     |    4 +++
 tools/libxl/libxl_save_callout.c |    4 ++-
 tools/libxl/libxl_save_helper.c  |    4 ++-
 tools/libxl/xl_cmdimpl.c         |   41 +++++++++++++++++++++++++++++++++------
 tools/libxl/xl_cmdtable.c        |   23 ++++++++++++++-------
 12 files changed, 162 insertions(+), 21 deletions(-)

Index: xen-4.4.3-testing/docs/man/xl.pod.1
===================================================================
--- xen-4.4.3-testing.orig/docs/man/xl.pod.1
+++ xen-4.4.3-testing/docs/man/xl.pod.1
@@ -392,6 +392,26 @@ Send <config> instead of config file fro
 
 Print huge (!) amount of debug during the migration process.
 
+=item B<--max_iters> I<number>
+
+Number of iterations before final suspend (default: 30)
+
+=item B<--max_factor> I<factor>
+
+Max amount of memory to transfer before final suspend (default: 3*RAM)
+
+=item B<--min_remaining>
+
+Number of remaining dirty pages. If the number of dirty pages drops that
+low the guest is suspended and the remaing pages are transfered to <host>.
+
+=item B<--abort_if_busy>
+
+Abort migration instead of doing final suspend/transfer/resume if the
+guest has still dirty pages after the number of iterations and/or the
+amount of RAM transferred. This avoids long periods of time where the
+guest is suspended.
+
 =back
 
 =item B<remus> [I<OPTIONS>] I<domain-id> I<host>
Index: xen-4.4.3-testing/tools/libxc/xc_domain_save.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxc/xc_domain_save.c
+++ xen-4.4.3-testing/tools/libxc/xc_domain_save.c
@@ -43,6 +43,7 @@
 */
 #define DEF_MAX_ITERS   29   /* limit us to 30 times round loop   */
 #define DEF_MAX_FACTOR   3   /* never send more than 3x p2m_size  */
+#define DEF_MIN_REMAINING 50 /* low water mark of dirty pages */
 
 struct save_ctx {
     unsigned long hvirt_start; /* virtual starting address of the hypervisor */
@@ -798,8 +799,9 @@ static int save_tsc_info(xc_interface *x
     return 0;
 }
 
-int xc_domain_save(xc_interface *xch, int io_fd, uint32_t dom, uint32_t max_iters,
+int xc_domain_save_suse(xc_interface *xch, int io_fd, uint32_t dom, uint32_t max_iters,
                    uint32_t max_factor, uint32_t flags,
+                   uint32_t min_remaining,
                    struct save_callbacks* callbacks, int hvm,
                    unsigned long vm_generationid_addr)
 {
@@ -810,6 +812,7 @@ int xc_domain_save(xc_interface *xch, in
     int rc = 1, frc, i, j, last_iter = 0, iter = 0;
     int live  = (flags & XCFLAGS_LIVE);
     int debug = (flags & XCFLAGS_DEBUG);
+    int abort_if_busy = (flags & XCFLAGS_DOMSAVE_ABORT_IF_BUSY);
     int superpages = !!hvm;
     int race = 0, sent_last_iter, skip_this_iter = 0;
     unsigned int sent_this_iter = 0;
@@ -910,6 +913,7 @@ int xc_domain_save(xc_interface *xch, in
     /* If no explicit control parameters given, use defaults */
     max_iters  = max_iters  ? : DEF_MAX_ITERS;
     max_factor = max_factor ? : DEF_MAX_FACTOR;
+    min_remaining = min_remaining ? : DEF_MIN_REMAINING;
 
     if ( !get_platform_info(xch, dom,
                             &ctx->max_mfn, &ctx->hvirt_start, &ctx->pt_levels, &dinfo->guest_width) )
@@ -1563,10 +1567,22 @@ int xc_domain_save(xc_interface *xch, in
 
         if ( live )
         {
+            int min_reached = sent_this_iter + skip_this_iter < min_remaining;
             if ( (iter >= max_iters) ||
-                 (sent_this_iter+skip_this_iter < 50) ||
+                 min_reached ||
                  (total_sent > dinfo->p2m_size*max_factor) )
             {
+                if ( !min_reached && abort_if_busy )
+                {
+                    errnoval = EBUSY;
+                    DPRINTF("Live migration aborted, as requested. (guest too busy?)");
+                    DPRINTF(" total_sent %lu iter %d, max_iters %u max_factor %u",
+                      total_sent, iter, max_iters, max_factor);
+                    print_stats(xch, dom, sent_this_iter, &time_stats, &shadow_stats, 1);
+                    rc = 1;
+                    goto out;
+                }
+
                 DPRINTF("Start last iteration\n");
                 last_iter = 1;
 
@@ -2210,6 +2226,13 @@ exit:
 
     return !!rc;
 }
+int xc_domain_save(xc_interface *xch, int io_fd, uint32_t dom, uint32_t max_iters,
+                   uint32_t max_factor, uint32_t flags,
+                   struct save_callbacks* callbacks, int hvm,
+                   unsigned long vm_generationid_addr)
+{
+    return xc_domain_save_suse(xch, io_fd, dom, max_iters, max_factor, flags, 0, callbacks, hvm, vm_generationid_addr);
+}
 
 /*
  * Local variables:
Index: xen-4.4.3-testing/tools/libxc/xc_nomigrate.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxc/xc_nomigrate.c
+++ xen-4.4.3-testing/tools/libxc/xc_nomigrate.c
@@ -21,6 +21,16 @@
 #include 
 #include 
 
+int xc_domain_save_suse(xc_interface *xch, int io_fd, uint32_t dom, uint32_t max_iters,
+                   uint32_t max_factor, uint32_t flags,
+                   uint32_t min_remaining,
+                   struct save_callbacks* callbacks, int hvm,
+                   unsigned long vm_generationid_addr)
+{
+    errno = ENOSYS;
+    return -1;
+}
+
 int xc_domain_save(xc_interface *xch, int io_fd, uint32_t dom, uint32_t max_iters,
                    uint32_t max_factor, uint32_t flags,
                    struct save_callbacks* callbacks, int hvm,
Index: xen-4.4.3-testing/tools/libxc/xenguest.h
===================================================================
--- xen-4.4.3-testing.orig/tools/libxc/xenguest.h
+++ xen-4.4.3-testing/tools/libxc/xenguest.h
@@ -28,6 +28,7 @@
 #define XCFLAGS_HVM       (1 << 2)
 #define XCFLAGS_STDVGA    (1 << 3)
 #define XCFLAGS_CHECKPOINT_COMPRESS    (1 << 4)
+#define XCFLAGS_DOMSAVE_ABORT_IF_BUSY  (1 << 5)
 
 #define X86_64_B_SIZE   64 
 #define X86_32_B_SIZE   32
@@ -89,6 +90,12 @@ int xc_domain_save(xc_interface *xch, in
                    struct save_callbacks* callbacks, int hvm,
                    unsigned long vm_generationid_addr);
 
+int xc_domain_save_suse(xc_interface *xch, int io_fd, uint32_t dom, uint32_t max_iters,
+                   uint32_t max_factor, uint32_t flags /* XCFLAGS_xxx */,
+                   uint32_t min_remaining,
+                   struct save_callbacks* callbacks, int hvm,
+                   unsigned long vm_generationid_addr);
+
 
 /* callbacks provided by xc_domain_restore */
 struct restore_callbacks {
Index: xen-4.4.3-testing/tools/libxl/libxl.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl.c
+++ xen-4.4.3-testing/tools/libxl/libxl.c
@@ -777,7 +777,8 @@ static void domain_suspend_cb(libxl__egc
 
 }
 
-int libxl_domain_suspend(libxl_ctx *ctx, uint32_t domid, int fd, int flags,
+static int do_libxl_domain_suspend(libxl_ctx *ctx, uint32_t domid, int fd,
+                         const libxl_domain_suspend_suse_properties *props,
                          const libxl_asyncop_how *ao_how)
 {
     AO_CREATE(ctx, domid, ao_how);
@@ -798,8 +799,14 @@ int libxl_domain_suspend(libxl_ctx *ctx,
     dss->domid = domid;
     dss->fd = fd;
     dss->type = type;
-    dss->live = flags & LIBXL_SUSPEND_LIVE;
-    dss->debug = flags & LIBXL_SUSPEND_DEBUG;
+    if (props) {
+        dss->live = props->flags & LIBXL_SUSPEND_LIVE;
+        dss->debug = props->flags & LIBXL_SUSPEND_DEBUG;
+        dss->max_iters = props->max_iters;
+        dss->max_factor = props->max_factor;
+        dss->min_remaining = props->min_remaining;
+        dss->xlflags = props->flags;
+    }
 
     libxl__domain_suspend(egc, dss);
     return AO_INPROGRESS;
@@ -808,6 +815,20 @@ int libxl_domain_suspend(libxl_ctx *ctx,
     return AO_ABORT(rc);
 }
 
+int libxl_domain_suspend_suse(libxl_ctx *ctx, uint32_t domid, int fd,
+                         const libxl_domain_suspend_suse_properties *props,
+                         const libxl_asyncop_how *ao_how)
+{
+    return do_libxl_domain_suspend(ctx, domid, fd, props, ao_how);
+}
+
+int libxl_domain_suspend(libxl_ctx *ctx, uint32_t domid, int fd, int flags,
+                         const libxl_asyncop_how *ao_how)
+{
+    libxl_domain_suspend_suse_properties props = { .flags = flags };
+    return do_libxl_domain_suspend(ctx, domid, fd, &props, ao_how);
+}
+
 int libxl_domain_pause(libxl_ctx *ctx, uint32_t domid)
 {
     int ret;
Index: xen-4.4.3-testing/tools/libxl/libxl.h
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl.h
+++ xen-4.4.3-testing/tools/libxl/libxl.h
@@ -702,8 +702,23 @@ int libxl_domain_suspend(libxl_ctx *ctx,
                          int flags, /* LIBXL_SUSPEND_* */
                          const libxl_asyncop_how *ao_how)
                          LIBXL_EXTERNAL_CALLERS_ONLY;
+
+typedef struct {
+    int flags; /* LIBXL_SUSPEND_* */
+    int max_iters;
+    int max_factor;
+    int min_remaining;
+} libxl_domain_suspend_suse_properties;
+
+#define LIBXL_HAVE_DOMAIN_SUSPEND_SUSE
+int libxl_domain_suspend_suse(libxl_ctx *ctx, uint32_t domid, int fd,
+                         const libxl_domain_suspend_suse_properties *props, /* optional */
+                         const libxl_asyncop_how *ao_how)
+                         LIBXL_EXTERNAL_CALLERS_ONLY;
+
 #define LIBXL_SUSPEND_DEBUG 1
 #define LIBXL_SUSPEND_LIVE 2
+#define LIBXL_SUSPEND_ABORT_IF_BUSY 4
 
 /* @param suspend_cancel [from xenctrl.h:xc_domain_resume( @param fast )]
  *   If this parameter is true, use co-operative resume. The guest
Index: xen-4.4.3-testing/tools/libxl/libxl_dom.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl_dom.c
+++ xen-4.4.3-testing/tools/libxl/libxl_dom.c
@@ -1345,6 +1345,7 @@ void libxl__domain_suspend(libxl__egc *e
 
     dss->xcflags = (live ? XCFLAGS_LIVE : 0)
           | (debug ? XCFLAGS_DEBUG : 0)
+          | (dss->xlflags & LIBXL_SUSPEND_ABORT_IF_BUSY ? XCFLAGS_DOMSAVE_ABORT_IF_BUSY : 0)
           | (dss->hvm ? XCFLAGS_HVM : 0);
 
     dss->suspend_eventchn = -1;
Index: xen-4.4.3-testing/tools/libxl/libxl_internal.h
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl_internal.h
+++ xen-4.4.3-testing/tools/libxl/libxl_internal.h
@@ -2332,6 +2332,10 @@ struct libxl__domain_suspend_state {
     xc_evtchn *xce; /* event channel handle */
     int suspend_eventchn;
     int hvm;
+    int max_iters;
+    int max_factor;
+    int min_remaining;
+    int xlflags;
     int xcflags;
     int guest_responded;
     const char *dm_savefile;
Index: xen-4.4.3-testing/tools/libxl/libxl_save_callout.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl_save_callout.c
+++ xen-4.4.3-testing/tools/libxl/libxl_save_callout.c
@@ -108,7 +108,9 @@ void libxl__xc_domain_save(libxl__egc *e
     }
 
     const unsigned long argnums[] = {
-        dss->domid, 0, 0, dss->xcflags, dss->hvm, vm_generationid_addr,
+        dss->domid,
+        dss->max_iters, dss->max_factor, dss->min_remaining,
+        dss->xcflags, dss->hvm, vm_generationid_addr,
         toolstack_data_fd, toolstack_data_len,
         cbflags,
     };
Index: xen-4.4.3-testing/tools/libxl/libxl_save_helper.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl_save_helper.c
+++ xen-4.4.3-testing/tools/libxl/libxl_save_helper.c
@@ -221,6 +221,7 @@ int main(int argc, char **argv)
         uint32_t dom =             strtoul(NEXTARG,0,10);
         uint32_t max_iters =       strtoul(NEXTARG,0,10);
         uint32_t max_factor =      strtoul(NEXTARG,0,10);
+        uint32_t min_remaining =   strtoul(NEXTARG,0,10);
         uint32_t flags =           strtoul(NEXTARG,0,10);
         int hvm =                  atoi(NEXTARG);
         unsigned long genidad =    strtoul(NEXTARG,0,10);
@@ -235,7 +236,8 @@ int main(int argc, char **argv)
         helper_setcallbacks_save(&helper_save_callbacks, cbflags);
 
         startup("save");
-        r = xc_domain_save(xch, io_fd, dom, max_iters, max_factor, flags,
+        r = xc_domain_save_suse(xch, io_fd, dom, max_iters, max_factor, flags,
+                           min_remaining,
                            &helper_save_callbacks, hvm, genidad);
         complete(r);
 
Index: xen-4.4.3-testing/tools/libxl/xl_cmdimpl.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/xl_cmdimpl.c
+++ xen-4.4.3-testing/tools/libxl/xl_cmdimpl.c
@@ -3660,6 +3660,8 @@ static void migrate_do_preamble(int send
 }
 
 static void migrate_domain(uint32_t domid, const char *rune, int debug,
+                           int max_iters, int max_factor,
+                           int min_remaining, int abort_if_busy,
                            const char *override_config_file)
 {
     pid_t child = -1;
@@ -3668,7 +3670,13 @@ static void migrate_domain(uint32_t domi
     char *away_domname;
     char rc_buf;
     uint8_t *config_data;
-    int config_len, flags = LIBXL_SUSPEND_LIVE;
+    int config_len;
+    libxl_domain_suspend_suse_properties props = {
+        .flags = LIBXL_SUSPEND_LIVE,
+        .max_iters = max_iters,
+        .max_factor = max_factor,
+        .min_remaining = min_remaining,
+    };
 
     save_domain_core_begin(domid, override_config_file,
                            &config_data, &config_len);
@@ -3687,10 +3695,13 @@ static void migrate_domain(uint32_t domi
     xtl_stdiostream_adjust_flags(logger, XTL_STDIOSTREAM_HIDE_PROGRESS, 0);
 
     if (debug)
-        flags |= LIBXL_SUSPEND_DEBUG;
-    rc = libxl_domain_suspend(ctx, domid, send_fd, flags, NULL);
+        props.flags |= LIBXL_SUSPEND_DEBUG;
+    if (abort_if_busy)
+        props.flags |= LIBXL_SUSPEND_ABORT_IF_BUSY;
+
+    rc = libxl_domain_suspend_suse(ctx, domid, send_fd, &props, NULL);
     if (rc) {
-        fprintf(stderr, "migration sender: libxl_domain_suspend failed"
+        fprintf(stderr, "migration sender: libxl_domain_suspend_suse failed"
                 " (rc=%d)\n", rc);
         if (rc == ERROR_GUEST_TIMEDOUT)
             goto failed_suspend;
@@ -4077,13 +4088,18 @@ int main_migrate(int argc, char **argv)
     char *rune = NULL;
     char *host;
     int opt, daemonize = 1, monitor = 1, debug = 0;
+    int max_iters = 0, max_factor = 0, min_remaining = 0, abort_if_busy = 0;
     static struct option opts[] = {
         {"debug", 0, 0, 0x100},
+        {"max_iters", 1, 0, 0x101},
+        {"max_factor", 1, 0, 0x102},
+        {"min_remaining", 1, 0, 0x103},
+        {"abort_if_busy", 0, 0, 0x104},
         COMMON_LONG_OPTS,
         {0, 0, 0, 0}
     };
 
-    SWITCH_FOREACH_OPT(opt, "FC:s:e", opts, "migrate", 2) {
+    SWITCH_FOREACH_OPT(opt, "FC:s:eM:m:A", opts, "migrate", 2) {
     case 'C':
         config_filename = optarg;
         break;
@@ -4100,6 +4116,18 @@ int main_migrate(int argc, char **argv)
     case 0x100:
         debug = 1;
         break;
+    case 0x101:
+        max_iters = atoi(optarg);
+        break;
+    case 0x102:
+        max_factor = atoi(optarg);
+        break;
+    case 0x103:
+        min_remaining = atoi(optarg);
+        break;
+    case 0x104:
+        abort_if_busy = 1;
+        break;
     }
 
     domid = find_domain(argv[optind]);
@@ -4115,7 +4143,8 @@ int main_migrate(int argc, char **argv)
             return 1;
     }
 
-    migrate_domain(domid, rune, debug, config_filename);
+    migrate_domain(domid, rune, debug, max_iters, max_factor, min_remaining,
+                   abort_if_busy, config_filename);
     return 0;
 }
 #endif
Index: xen-4.4.3-testing/tools/libxl/xl_cmdtable.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/xl_cmdtable.c
+++ xen-4.4.3-testing/tools/libxl/xl_cmdtable.c
@@ -150,14 +150,21 @@ struct cmd_spec cmd_table[] = {
       &main_migrate, 0, 1,
       "Migrate a domain to another host",
       "[options] <Domain> <host>",
-      "-h              Print this help.\n"
-      "-C <config>     Send <config> instead of config file from creation.\n"
-      "-s <sshcommand> Use <sshcommand> instead of ssh.  String will be passed\n"
-      "                to sh. If empty, run <host> instead of ssh <host> xl\n"
-      "                migrate-receive [-d -e]\n"
-      "-e              Do not wait in the background (on <host>) for the death\n"
-      "                of the domain.\n"
-      "--debug         Print huge (!) amount of debug during the migration process."
+      "-h                      Print this help.\n"
+      "-C <config>             Send <config> instead of config file from creation.\n"
+      "-s <sshcommand>         Use <sshcommand> instead of ssh.  String will be passed\n"
+      "                        to sh. If empty, run <host> instead of ssh <host> xl\n"
+      "                        migrate-receive [-d -e]\n"
+      "-e                      Do not wait in the background (on <host>) for the death\n"
+      "                        of the domain.\n"
+      "--debug                 Print huge (!) amount of debug during the migration process.\n"
+      "\n"
+      "SUSE Linux specific options:\n"
+      "--max_iters <number>    Number of iterations before final suspend (default: 30)\n"
+      "--max_factor <factor>   Max amount of memory to transfer before final suspend (default: 3*RAM).\n"
+      "--min_remaining <pages> Number of remaining dirty pages before final suspend (default: 50).\n"
+      "--abort_if_busy         Abort migration instead of doing final suspend, if number\n"
+      "                        of iterations or amount of transfered memory is exceeded."
     },
     { "restore",
       &main_restore, 0, 1,
++++++ local_attach_support_for_phy.patch ++++++
commit 3bcf91cbbd9a18db9ae7d594ffde7979774ed512
Author: Roger Pau Monne 
Date:   Wed Feb 12 11:15:17 2014 +0100

    libxl: local attach support for PHY backends using scripts
    
    Allow disks using the PHY backend to locally attach if using a script.
    
    Signed-off-by: Roger Pau MonnÃ 
    Suggested-by: Ian Campbell 


Index: xen-4.4.3-testing/tools/libxl/libxl.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl.c
+++ xen-4.4.3-testing/tools/libxl/libxl.c
@@ -2647,6 +2647,16 @@ void libxl__device_disk_local_initiate_a
 
     switch (disk->backend) {
         case LIBXL_DISK_BACKEND_PHY:
+            if (disk->script != NULL) {
+                LOG(DEBUG, "trying to locally attach PHY device %s with script %s",
+                           disk->pdev_path, disk->script);
+                libxl__prepare_ao_device(ao, &dls->aodev);
+                dls->aodev.callback = local_device_attach_cb;
+                device_disk_add(egc, LIBXL_TOOLSTACK_DOMID, disk,
+                                &dls->aodev, libxl__alloc_vdev,
+                                (void *) blkdev_start);
+                return;
+            }
             LIBXL__LOG(ctx, LIBXL__LOG_DEBUG, "locally attaching PHY disk %s",
                        disk->pdev_path);
             dev = disk->pdev_path;
@@ -2726,7 +2736,7 @@ static void local_device_attach_cb(libxl
     }
 
     dev = GCSPRINTF("/dev/%s", disk->vdev);
-    LOG(DEBUG, "locally attaching qdisk %s", dev);
+    LOG(DEBUG, "locally attached disk %s", dev);
 
     rc = libxl__device_from_disk(gc, LIBXL_TOOLSTACK_DOMID, disk, &device);
     if (rc < 0)
@@ -2766,6 +2776,7 @@ void libxl__device_disk_local_initiate_d
     if (!dls->diskpath) goto out;
 
     switch (disk->backend) {
+        case LIBXL_DISK_BACKEND_PHY:
         case LIBXL_DISK_BACKEND_QDISK:
             if (disk->vdev != NULL) {
                 GCNEW(device);
@@ -2783,7 +2794,6 @@ void libxl__device_disk_local_initiate_d
             /* disk->vdev == NULL; fall through */
         default:
             /*
-             * Nothing to do for PHYSTYPE_PHY.
              * For other device types assume that the blktap2 process is
              * needed by the soon to be started domain and do nothing.
              */
++++++ log-guest-console.patch ++++++
Add code to support logging xen-domU console, as what xenconsoled does. Log info
will be saved in /var/log/xen/console/guest-domUname.log.

Signed-off-by: Chunyan Liu 
---
 hw/xen_console.c |   71 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 files changed, 71 insertions(+), 0 deletions(-)

Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_console.c
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/xen_console.c
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_console.c
@@ -38,6 +38,8 @@
 #include "qemu-char.h"
 #include "xen_backend.h"
 
+static int log_guest = 0;
+
 struct buffer {
     uint8_t *data;
     size_t consumed;
@@ -54,8 +56,24 @@ struct XenConsole {
     void              *sring;
     CharDriverState   *chr;
     int               backlog;
+    int               log_fd;
 };
 
+static int write_all(int fd, const char* buf, size_t len)
+{
+    while (len) {
+        ssize_t ret = write(fd, buf, len);
+        if (ret == -1 && errno == EINTR)
+            continue;
+        if (ret < 0)
+            return -1;
+        len -= ret;
+        buf += ret;
+    }
+
+    return 0;
+}
+
 static void buffer_append(struct XenConsole *con)
 {
     struct buffer *buffer = &con->buffer;
@@ -83,6 +101,15 @@ static void buffer_append(struct XenCons
     intf->out_cons = cons;
     xen_be_send_notify(&con->xendev);
 
+    if (con->log_fd != -1) {
+        int logret;
+        logret = write_all(con->log_fd, buffer->data + buffer->size - size, size);
+        if (logret < 0) {
+            xen_be_printf(&con->xendev, 1, "Write to log failed on domain %d: %d (%s)\n",
+                      con->xendev.dom, errno, strerror(errno));
+        }
+     }
+
     if (buffer->max_capacity &&
 	buffer->size > buffer->max_capacity) {
 	/* Discard the middle of the data. */
@@ -176,6 +203,37 @@ static void xencons_send(struct XenConso
     }
 }
 
+static int create_domain_log(struct XenConsole *con)
+{
+    char *logfile;
+    char *path, *domname;
+    int fd;
+    const char *logdir = "/var/log/xen/console";
+
+    path = xs_get_domain_path(xenstore, con->xendev.dom);
+    domname = xenstore_read_str(path, "name");
+    free(path);
+    if (!domname)
+        return -1;
+
+    if (mkdir(logdir, 0755) && errno != EEXIST)
+    {
+        xen_be_printf(&con->xendev, 1,  "Directory %s does not exist and fail to create it!", logdir);
+        return -1;
+    }
+
+    if (asprintf(&logfile, "%s/guest-%s.log", logdir, domname) < 0)
+        return -1;
+    qemu_free(domname);
+
+    fd = open(logfile, O_WRONLY|O_CREAT|O_APPEND, 0644);
+    free(logfile);
+    if (fd == -1)
+        xen_be_printf(&con->xendev, 1,  "Failed to open log %s: %d (%s)", logfile, errno, strerror(errno));
+
+    return fd;
+}
+
 /* -------------------------------------------------------------------- */
 
 static int con_init(struct XenDevice *xendev)
@@ -183,6 +241,7 @@ static int con_init(struct XenDevice *xe
     struct XenConsole *con = container_of(xendev, struct XenConsole, xendev);
     char *type, *dom, label[32];
     const char *output;
+    char *logenv = NULL;
 
     /* setup */
     dom = xs_get_domain_path(xenstore, con->xendev.dom);
@@ -209,6 +268,10 @@ static int con_init(struct XenDevice *xe
 	con->chr = qemu_chr_open(label, output, NULL);
 	xenstore_store_pv_console_info(con->xendev.dev, con->chr, output);
 
+    logenv = getenv("XENCONSOLED_TRACE");
+    if (logenv != NULL && strlen(logenv) == strlen("guest") && !strcmp(logenv, "guest")) {
+        log_guest = 1;
+    }
     return 0;
 }
 
@@ -246,6 +309,9 @@ static int con_initialise(struct XenDevi
 		  con->xendev.remote_port,
 		  con->xendev.local_port,
 		  con->buffer.max_capacity);
+    con->log_fd = -1;
+    if (log_guest)
+         con->log_fd = create_domain_log(con);
     return 0;
 }
 
@@ -266,6 +332,12 @@ static void con_disconnect(struct XenDev
             xc_gnttab_munmap(xendev->gnttabdev, con->sring, 1);
 	con->sring = NULL;
     }
+
+    if (con->log_fd != -1) {
+        close(con->log_fd);
+        con->log_fd = -1;
+    }
+
 }
 
 static void con_event(struct XenDevice *xendev)
++++++ logrotate.conf ++++++
compress
missingok

/var/log/xen/xend*.log {
	rotate 5
	size 1M
	notifempty
	copytruncate
}

/var/log/xen/domain-builder-ng.log /var/log/xen/xen-hotplug.log {
	rotate 2
	size 100k
	notifempty
	copytruncate
}

/var/log/xen/qemu-dm.*.log {
	rotate 0
	monthly
}
++++++ magic_ioport_compat.patch ++++++
Make our PV drivers work  with older hosts that do not recognize the new PV driver protocol. 

Signed-off-by: K. Y. Srinivasan 

Index: xen-4.4.0-testing/unmodified_drivers/linux-2.6/platform-pci/platform-pci.c
===================================================================
--- xen-4.4.0-testing.orig/unmodified_drivers/linux-2.6/platform-pci/platform-pci.c
+++ xen-4.4.0-testing/unmodified_drivers/linux-2.6/platform-pci/platform-pci.c
@@ -337,7 +337,10 @@ static int check_platform_magic(struct d
 
 	if (magic != XEN_IOPORT_MAGIC_VAL) {
 		err = "unrecognised magic value";
-		goto no_dev;
+		/*
+		 * Older backend; just return 0 to be compatible.
+		 */
+		return 0;
 	}
 
 	protocol = inb(XEN_IOPORT_PROTOVER);
++++++ network-nat-open-SuSEfirewall2-FORWARD.patch ++++++
Open SuSEfirewall2 FORWARD rule when use xen nat

Index: xen-4.2.0-testing/tools/hotplug/Linux/network-nat
===================================================================
--- xen-4.2.0-testing.orig/tools/hotplug/Linux/network-nat
+++ xen-4.2.0-testing/tools/hotplug/Linux/network-nat
@@ -83,6 +83,7 @@ function dhcp_stop()
 op_start() {
 	echo 1 >/proc/sys/net/ipv4/ip_forward
 	iptables -t nat -A POSTROUTING -o ${netdev} -j MASQUERADE
+	iptables -P FORWARD ACCEPT
         [ "$dhcp" != 'no' ] && dhcp_start
 }
 
@@ -90,6 +91,7 @@ op_start() {
 op_stop() {
         [ "$dhcp" != 'no' ] && dhcp_stop
 	iptables -t nat -D POSTROUTING -o ${netdev} -j MASQUERADE
+	iptables -P FORWARD DROP
 }
 
 
++++++ pvdrv_emulation_control.patch ++++++
---
 tools/qemu-xen-traditional-dir-remote/hw/xen_platform.c |   13 +++++++++++++
 1 file changed, 13 insertions(+)

Index: xen-4.4.0-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_platform.c
===================================================================
--- xen-4.4.0-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/xen_platform.c
+++ xen-4.4.0-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_platform.c
@@ -370,6 +370,19 @@ static void suse_platform_ioport_write(v
         net_tap_shutdown_all();
         fprintf(logfile, "Done.\n");
         break;
+    case 8:
+	if (val ==1 ) {
+		fprintf(logfile, "Disconnect IDE hard disk...\n");
+		ide_unplug_harddisks();
+		fprintf(logfile, "Done.\n");
+	} else if (val == 2) {
+		fprintf(logfile, "Disconnect netifs...\n");
+		pci_unplug_netifs();
+		fprintf(logfile, "Shutdown taps...\n");
+		net_tap_shutdown_all();
+		fprintf(logfile, "Done.\n");
+	}
+	break;
     default:
         fprintf(logfile, "Write %x to bad port %x (base %x) on evtchn device.\n",
             val, addr, ioport_base);
++++++ pygrub-boot-legacy-sles.patch ++++++
Index: xen-4.4.2-testing/tools/pygrub/src/pygrub
===================================================================
--- xen-4.4.2-testing.orig/tools/pygrub/src/pygrub
+++ xen-4.4.2-testing/tools/pygrub/src/pygrub
@@ -454,7 +454,7 @@ class Grub:
                 self.cf.filename = f
                 break
         if self.__dict__.get('cf', None) is None:
-            raise RuntimeError, "couldn't find bootloader config file in the image provided."
+            return
         f = fs.open_file(self.cf.filename)
         # limit read size to avoid pathological cases
         buf = f.read(FS_READ_MAX)
@@ -626,6 +626,20 @@ def run_grub(file, entry, fs, cfg_args):
 
     g = Grub(file, fs)
 
+    # If missing config or grub has no menu entries to select, look for
+    # vmlinuz-xen and initrd-xen in /boot
+    if g.__dict__.get('cf', None) is None or len(g.cf.images) == 0 or re.search(r"xen(-pae)?\.gz",g.cf.images[0].kernel[1]):
+        if not list_entries:
+            chosencfg = { "kernel": None, "ramdisk": None, "args": "" }
+            chosencfg = sniff_xen_kernel(fs, incfg)
+            if chosencfg["kernel"] and chosencfg["ramdisk"]:
+                chosencfg["args"] = cfg_args
+                return chosencfg
+        if g.__dict__.get('cf', None) is None:
+            raise RuntimeError, "couldn't find bootloader config file in the image provided."
+        else:
+            return
+
     if list_entries:
         for i in range(len(g.cf.images)):
             img = g.cf.images[i]
@@ -721,6 +735,19 @@ def sniff_netware(fs, cfg):
 
     return cfg
 
+def sniff_xen_kernel(fs, cfg):
+    if not cfg["kernel"]:
+        if fs.file_exists('/boot/vmlinuz-xen'):
+            cfg["kernel"] = '/boot/vmlinuz-xen'
+        elif fs.file_exists('/boot/vmlinuz-xenpae'):
+            cfg["kernel"] = '/boot/vmlinuz-xenpae'
+    if cfg["kernel"] and not cfg["ramdisk"]:
+        if fs.file_exists('/boot/initrd-xen'):
+            cfg["ramdisk"] = '/boot/initrd-xen'
+        elif fs.file_exists('/boot/initrd-xenpae'):
+            cfg["ramdisk"] = '/boot/initrd-xenpae'
+    return cfg
+
 def format_sxp(kernel, ramdisk, args):
     s = "linux (kernel %s)" % kernel
     if ramdisk:
@@ -801,7 +828,7 @@ if __name__ == "__main__":
     debug = False
     not_really = False
     output_format = "sxp"
-    output_directory = "/var/run/xend/boot"
+    output_directory = "/var/run/xen"
 
     # what was passed in
     incfg = { "kernel": None, "ramdisk": None, "args": "" }
++++++ pygrub-netware-xnloader.patch ++++++
Index: xen-4.4.2-testing/tools/pygrub/src/pygrub
===================================================================
--- xen-4.4.2-testing.orig/tools/pygrub/src/pygrub
+++ xen-4.4.2-testing/tools/pygrub/src/pygrub
@@ -26,6 +26,7 @@ import fsimage
 import grub.GrubConf
 import grub.LiloConf
 import grub.ExtLinuxConf
+import xnloader
 
 PYGRUB_VER = 0.6
 FS_READ_MAX = 1024 * 1024
@@ -763,6 +764,8 @@ if __name__ == "__main__":
             if len(data) == 0:
                 os.close(tfd)
                 del datafile
+                if file_to_read == "/nwserver/xnloader.sys":
+                    xnloader.patch_netware_loader(ret)
                 return ret
             try:
                 os.write(tfd, data)
++++++ qemu-dm-segfault.patch ++++++
Index: xen-4.4.2-testing/tools/qemu-xen-traditional-dir-remote/hw/ide.c
===================================================================
--- xen-4.4.2-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/ide.c
+++ xen-4.4.2-testing/tools/qemu-xen-traditional-dir-remote/hw/ide.c
@@ -935,8 +935,9 @@ static inline void ide_dma_submit_check(
 
 static inline void ide_set_irq(IDEState *s)
 {
-    BMDMAState *bm = s->bmdma;
-    if (!s->bs) return; /* ouch! (see ide_flush_cb) */
+    BMDMAState *bm;
+    if (!s || !s->bs) return; /* ouch! (see ide_flush_cb) */
+    bm = s->bmdma;
     if (!(s->cmd & IDE_CMD_DISABLE_IRQ)) {
         if (bm) {
             bm->status |= BM_STATUS_INT;
@@ -1224,14 +1225,14 @@ static void ide_read_dma_cb(void *opaque
     int n;
     int64_t sector_num;
 
+    if (!s || !s->bs) return; /* ouch! (see ide_flush_cb) */
+
     if (ret < 0) {
         dma_buf_commit(s, 1);
 	ide_dma_error(s);
 	return;
     }
 
-    if (!s->bs) return; /* ouch! (see ide_flush_cb) */
-
     n = s->io_buffer_size >> 9;
     sector_num = ide_get_sector(s);
     if (n > 0) {
@@ -1335,6 +1336,8 @@ static void ide_write_flush_cb(void *opa
     BMDMAState *bm = opaque;
     IDEState *s = bm->ide_if;
 
+    if (!s) return; /* yikes */
+
     if (ret != 0) {
 	ide_dma_error(s);
 	return;
@@ -1366,13 +1369,13 @@ static void ide_write_dma_cb(void *opaqu
     int n;
     int64_t sector_num;
 
+    if (!s || !s->bs) return; /* ouch! (see ide_flush_cb) */
+
     if (ret < 0) {
         if (ide_handle_write_error(s, -ret,  BM_STATUS_DMA_RETRY))
             return;
     }
 
-    if (!s->bs) return; /* ouch! (see ide_flush_cb) */
-
     n = s->io_buffer_size >> 9;
     sector_num = ide_get_sector(s);
     if (n > 0) {
@@ -1429,7 +1432,7 @@ static void ide_flush_cb(void *opaque, i
 {
     IDEState *s = opaque;
 
-    if (!s->bs) return; /* ouch! (see below) */
+    if (!s || !s->bs) return; /* ouch! (see below) */
 
     if (ret) {
         /* We are completely doomed.  The IDE spec does not permit us
@@ -1686,7 +1689,7 @@ static void ide_atapi_cmd_read_dma_cb(vo
     IDEState *s = bm->ide_if;
     int data_offset, n;
 
-    if (!s->bs) return; /* ouch! (see ide_flush_cb) */
+    if (!s || !s->bs) return; /* ouch! (see ide_flush_cb) */
 
     if (ret < 0) {
         ide_atapi_io_error(s, ret);
@@ -2372,7 +2375,7 @@ static void cdrom_change_cb(void *opaque
     IDEState *s = opaque;
     uint64_t nb_sectors;
 
-    if (!s->bs) return; /* ouch! (see ide_flush_cb) */
+    if (!s || !s->bs) return; /* ouch! (see ide_flush_cb) */
 
     bdrv_get_geometry(s->bs, &nb_sectors);
     s->nb_sectors = nb_sectors;
++++++ qemu-ifup-set-mtu.patch ++++++
Index: xen-4.2.3-testing/tools/qemu-xen-traditional-dir-remote/i386-dm/qemu-ifup-Linux
===================================================================
--- xen-4.2.3-testing.orig/tools/qemu-xen-traditional-dir-remote/i386-dm/qemu-ifup-Linux
+++ xen-4.2.3-testing/tools/qemu-xen-traditional-dir-remote/i386-dm/qemu-ifup-Linux
@@ -20,4 +20,11 @@ then
 fi
 
 ifconfig $1 0.0.0.0 up
+
+mtu="`ip link show $bridge | awk '/mtu/ { print $5 }'`"
+if [ -n "$mtu" ] && [ "$mtu" -gt 0 ]
+then
+   ip link set $1 mtu $mtu || :
+fi
+
 brctl addif $bridge $1 || true
++++++ qemu-security-etch1.patch ++++++
Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/ne2000.c
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/ne2000.c
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/ne2000.c
@@ -218,7 +218,7 @@ static int ne2000_can_receive(void *opaq
     NE2000State *s = opaque;
 
     if (s->cmd & E8390_STOP)
-        return 1;
+        return 0;
     return !ne2000_buffer_full(s);
 }
 
Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/pc.c
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/pc.c
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/pc.c
@@ -413,7 +413,8 @@ static void bochs_bios_write(void *opaqu
     case 0x400:
     case 0x401:
         fprintf(stderr, "BIOS panic at rombios.c, line %d\n", val);
-        exit(1);
+        /* according to documentation, these can be safely ignored */
+        break;
     case 0x402:
     case 0x403:
 #ifdef DEBUG_BIOS
@@ -436,8 +437,9 @@ static void bochs_bios_write(void *opaqu
         /* LGPL'ed VGA BIOS messages */
     case 0x501:
     case 0x502:
+        /* according to documentation, these can be safely ignored */
         fprintf(stderr, "VGA BIOS panic, line %d\n", val);
-        exit(1);
+        break;
     case 0x500:
     case 0x503:
 #ifdef DEBUG_BIOS
++++++ qemu-support-xen-hvm-direct-kernel-boot.patch ++++++
...
From dd708897cc5b21bc374cd44b6d58c1e74b04bd6e Mon Sep 17 00:00:00 2001
From: Chunyan Liu 
Date: Wed, 28 May 2014 14:31:35 +0800
Subject: [PATCH 2/2] qemu: support xen hvm direct kernel boot
qemu side patch to support xen HVM direct kernel boot:
if -kernel exists, calls xen_load_linux(), which will read kernel/initrd
and add a linuxboot.bin or multiboot.bin option rom. The
linuxboot.bin/multiboot.bin will load kernel/initrd and jump to execute
kernel directly. It's working when xen uses seabios.

Signed-off-by: Chunyan Liu 

Index: xen-4.4.0-testing/tools/qemu-xen-dir-remote/hw/i386/pc.c
===================================================================
--- xen-4.4.0-testing.orig/tools/qemu-xen-dir-remote/hw/i386/pc.c
+++ xen-4.4.0-testing/tools/qemu-xen-dir-remote/hw/i386/pc.c
@@ -1105,6 +1105,35 @@ void pc_acpi_init(const char *default_ds
     }
 }
 
+FWCfgState *xen_load_linux(const char *kernel_filename,
+                           const char *kernel_cmdline,
+                           const char *initrd_filename,
+                           ram_addr_t below_4g_mem_size,
+                           PcGuestInfo *guest_info)
+{
+    int i;
+    FWCfgState *fw_cfg;
+
+    assert(kernel_filename != NULL);
+
+    fw_cfg = fw_cfg_init(BIOS_CFG_IOPORT, BIOS_CFG_IOPORT + 1, 0, 0);
+    rom_set_fw(fw_cfg);
+
+    load_linux(fw_cfg, kernel_filename, initrd_filename, kernel_cmdline, below_4g_mem_size);
+    for (i = 0; i < nb_option_roms; i++) {
+        /* For xen, we only want to add the linuxboot.bin/multiboot.bin option rom.
+         * But in option_rom, there is still kvmvapic.bin. We don't want to add it.
+         */
+        if (strcmp(option_rom[i].name, "linuxboot.bin") &&
+            strcmp(option_rom[i].name, "multiboot.bin")) {
+            continue;
+        }
+        rom_add_option(option_rom[i].name, option_rom[i].bootindex);
+    }
+    guest_info->fw_cfg = fw_cfg;
+    return fw_cfg;
+}
+
 FWCfgState *pc_memory_init(MemoryRegion *system_memory,
                            const char *kernel_filename,
                            const char *kernel_cmdline,
Index: xen-4.4.0-testing/tools/qemu-xen-dir-remote/hw/i386/pc_piix.c
===================================================================
--- xen-4.4.0-testing.orig/tools/qemu-xen-dir-remote/hw/i386/pc_piix.c
+++ xen-4.4.0-testing/tools/qemu-xen-dir-remote/hw/i386/pc_piix.c
@@ -135,6 +135,13 @@ static void pc_init1(MemoryRegion *syste
                        kernel_filename, kernel_cmdline, initrd_filename,
                        below_4g_mem_size, above_4g_mem_size,
                        rom_memory, &ram_memory, guest_info);
+    } else if (kernel_filename != NULL) {
+        /* For xen HVM direct kernel boot, load linux here */
+        fw_cfg = xen_load_linux(kernel_filename,
+                                kernel_cmdline,
+                                initrd_filename,
+                                below_4g_mem_size,
+                                guest_info);
     }
 
     gsi_state = g_malloc0(sizeof(*gsi_state));
Index: xen-4.4.0-testing/tools/qemu-xen-dir-remote/include/hw/i386/pc.h
===================================================================
--- xen-4.4.0-testing.orig/tools/qemu-xen-dir-remote/include/hw/i386/pc.h
+++ xen-4.4.0-testing/tools/qemu-xen-dir-remote/include/hw/i386/pc.h
@@ -120,6 +120,11 @@ static inline uint64_t pci_host_get_hole
 void pc_init_pci64_hole(PcPciInfo *pci_info, uint64_t pci_hole64_start,
                         uint64_t pci_hole64_size);
 
+FWCfgState *xen_load_linux(const char *kernel_filename,
+                           const char *kernel_cmdline,
+                           const char *initrd_filename,
+                           ram_addr_t below_4g_mem_size,
+                           PcGuestInfo *guest_info);
 FWCfgState *pc_memory_init(MemoryRegion *system_memory,
                            const char *kernel_filename,
                            const char *kernel_cmdline,
++++++ qemu-xen-enable-spice-support.patch ++++++
Index: xen-4.4.1-testing/tools/Makefile
===================================================================
--- xen-4.4.1-testing.orig/tools/Makefile
+++ xen-4.4.1-testing/tools/Makefile
@@ -201,6 +201,7 @@ subdir-all-qemu-xen-dir: qemu-xen-dir-fi
 		--datadir=$(SHAREDIR)/qemu-xen \
 		--localstatedir=/var \
 		--disable-kvm \
+		$(QEMU_XEN_ENABLE_SPICE) \
 		--disable-docs \
 		--disable-guest-agent \
 		--python=$(PYTHON) \
++++++ qemu-xen-upstream-blkif-discard.patch ++++++
References: FATE#316071
Subject: qemu-upstream: add discard support for xen_disk
Git-commit: f31352041bdde436c3f6d07e1525a42e48dec215

Implement discard support for xen_disk. It makes use of the existing
discard code in qemu.

The discard support is enabled unconditionally. The tool stack may provide a
property "discard-enable" in the backend node to optionally disable discard
support.  This is helpful in case the backing file was intentionally created
non-sparse to avoid fragmentation.

v2:
rename xenstore property from discard_enable to discard-enable
move discard_req to case BLKIF_OP_DISCARD

Signed-off-by: Olaf Hering 
---
 tools/qemu-xen-dir-remote/hw/block/xen_blkif.h |   12 ++++++++++
 tools/qemu-xen-dir-remote/hw/block/xen_disk.c  |   30 +++++++++++++++++++++++++
 2 files changed, 42 insertions(+)

Index: xen-4.4.3-testing/tools/qemu-xen-dir-remote/hw/block/xen_blkif.h
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-dir-remote/hw/block/xen_blkif.h
+++ xen-4.4.3-testing/tools/qemu-xen-dir-remote/hw/block/xen_blkif.h
@@ -79,6 +79,12 @@ static inline void blkif_get_x86_32_req(
 	dst->handle = src->handle;
 	dst->id = src->id;
 	dst->sector_number = src->sector_number;
+	if (src->operation == BLKIF_OP_DISCARD) {
+		struct blkif_request_discard *s = (void *)src;
+		struct blkif_request_discard *d = (void *)dst;
+		d->nr_sectors = s->nr_sectors;
+		return;
+	}
 	/* prevent the compiler from optimizing the code and using src->nr_segments instead */
 	barrier();
 	if (n > dst->nr_segments)
@@ -96,6 +102,12 @@ static inline void blkif_get_x86_64_req(
 	dst->handle = src->handle;
 	dst->id = src->id;
 	dst->sector_number = src->sector_number;
+	if (src->operation == BLKIF_OP_DISCARD) {
+		struct blkif_request_discard *s = (void *)src;
+		struct blkif_request_discard *d = (void *)dst;
+		d->nr_sectors = s->nr_sectors;
+		return;
+	}
 	/* prevent the compiler from optimizing the code and using src->nr_segments instead */
 	barrier();
 	if (n > dst->nr_segments)
Index: xen-4.4.3-testing/tools/qemu-xen-dir-remote/hw/block/xen_disk.c
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-dir-remote/hw/block/xen_disk.c
+++ xen-4.4.3-testing/tools/qemu-xen-dir-remote/hw/block/xen_disk.c
@@ -121,6 +121,7 @@ struct XenBlkDev {
     int                 requests_finished;
 
     /* Persistent grants extension */
+    gboolean            feature_discard;
     gboolean            feature_persistent;
     GTree               *persistent_gnts;
     GSList              *persistent_regions;
@@ -278,6 +279,8 @@ static int ioreq_parse(struct ioreq *ior
     case BLKIF_OP_WRITE:
         ioreq->prot = PROT_READ; /* from memory */
         break;
+    case BLKIF_OP_DISCARD:
+        return 0;
     default:
         xen_be_printf(&blkdev->xendev, 0, "error: unknown operation (%d)\n",
                       ioreq->req.operation);
@@ -563,6 +566,16 @@ static int ioreq_runio_qemu_aio(struct i
                         &ioreq->v, ioreq->v.size / BLOCK_SIZE,
                         qemu_aio_complete, ioreq);
         break;
+    case BLKIF_OP_DISCARD:
+    {
+        struct blkif_request_discard *discard_req = (void *)&ioreq->req;
+        bdrv_acct_start(blkdev->bs, &ioreq->acct, discard_req->nr_sectors * BLOCK_SIZE, BDRV_ACCT_WRITE);
+        ioreq->aio_inflight++;
+        bdrv_aio_discard(blkdev->bs,
+                        discard_req->sector_number, discard_req->nr_sectors,
+                        qemu_aio_complete, ioreq);
+        break;
+    }
     default:
         /* unknown operation (shouldn't happen -- parse catches this) */
         goto err;
@@ -741,6 +754,19 @@ static void blk_alloc(struct XenDevice *
     }
 }
 
+static void blk_parse_discard(struct XenBlkDev *blkdev)
+{
+    int enable;
+
+    blkdev->feature_discard = true;
+
+    if (xenstore_read_be_int(&blkdev->xendev, "discard-enable", &enable) == 0)
+	    blkdev->feature_discard = !!enable;
+
+    if (blkdev->feature_discard)
+	    xenstore_write_be_int(&blkdev->xendev, "feature-discard", 1);
+}
+
 static int blk_init(struct XenDevice *xendev)
 {
     struct XenBlkDev *blkdev = container_of(xendev, struct XenBlkDev, xendev);
@@ -808,6 +834,8 @@ static int blk_init(struct XenDevice *xe
     xenstore_write_be_int(&blkdev->xendev, "feature-persistent", 1);
     xenstore_write_be_int(&blkdev->xendev, "info", info);
 
+    blk_parse_discard(blkdev);
+
     g_free(directiosafe);
     return 0;
 
@@ -843,6 +871,8 @@ static int blk_connect(struct XenDevice
         qflags |= BDRV_O_RDWR;
         readonly = false;
     }
+    if (blkdev->feature_discard)
+        qflags |= BDRV_O_UNMAP;
 
     /* init qemu block driver */
     index = (blkdev->xendev.dev - 202 * 256) / 16;
++++++ qemu-xen-upstream-megasas-buildtime.patch ++++++
Causes rebuilds.
Says rpmlint.
---
 tools/qemu-xen-dir-remote/hw/scsi/megasas.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Index: xen-4.4.0-testing/tools/qemu-xen-dir-remote/hw/scsi/megasas.c
===================================================================
--- xen-4.4.0-testing.orig/tools/qemu-xen-dir-remote/hw/scsi/megasas.c
+++ xen-4.4.0-testing/tools/qemu-xen-dir-remote/hw/scsi/megasas.c
@@ -712,8 +712,8 @@ static int megasas_ctrl_get_info(Megasas
     snprintf(info.package_version, 0x60, "%s-QEMU", QEMU_VERSION);
     memcpy(info.image_component[0].name, "APP", 3);
     memcpy(info.image_component[0].version, MEGASAS_VERSION "-QEMU", 9);
-    memcpy(info.image_component[0].build_date, __DATE__, 11);
-    memcpy(info.image_component[0].build_time, __TIME__, 8);
+    memcpy(info.image_component[0].build_date, "Apr  1 2014", 11);
+    memcpy(info.image_component[0].build_time, "12:34:56", 8);
     info.image_component_count = 1;
     if (pci_dev->has_rom) {
         uint8_t biosver[32];
++++++ qemu-xen-upstream-qdisk-cache-unsafe.patch ++++++
https://bugzilla.novell.com/show_bug.cgi?id=879425
---
 tools/qemu-xen-dir-remote/hw/block/xen_disk.c |   15 +++++++++++++++
 1 file changed, 15 insertions(+)

Index: xen-4.4.2-testing/tools/qemu-xen-dir-remote/hw/block/xen_disk.c
===================================================================
--- xen-4.4.2-testing.orig/tools/qemu-xen-dir-remote/hw/block/xen_disk.c
+++ xen-4.4.2-testing/tools/qemu-xen-dir-remote/hw/block/xen_disk.c
@@ -120,6 +120,7 @@ struct XenBlkDev {
     int                 requests_inflight;
     int                 requests_finished;
 
+    gboolean            cache_unsafe;
     /* Persistent grants extension */
     gboolean            feature_discard;
     gboolean            feature_persistent;
@@ -767,6 +768,16 @@ static void blk_parse_discard(struct Xen
 	    xenstore_write_be_int(&blkdev->xendev, "feature-discard", 1);
 }
 
+static void blk_parse_cache_unsafe(struct XenBlkDev *blkdev)
+{
+    int enable;
+
+    blkdev->cache_unsafe = false;
+
+    if (xenstore_read_be_int(&blkdev->xendev, "suse-diskcache-disable-flush", &enable) == 0)
+	    blkdev->cache_unsafe = !!enable;
+}
+
 static int blk_init(struct XenDevice *xendev)
 {
     struct XenBlkDev *blkdev = container_of(xendev, struct XenBlkDev, xendev);
@@ -835,6 +846,7 @@ static int blk_init(struct XenDevice *xe
     xenstore_write_be_int(&blkdev->xendev, "info", info);
 
     blk_parse_discard(blkdev);
+    blk_parse_cache_unsafe(blkdev);
 
     g_free(directiosafe);
     return 0;
@@ -874,6 +886,9 @@ static int blk_connect(struct XenDevice
     if (blkdev->feature_discard)
         qflags |= BDRV_O_UNMAP;
 
+    if (blkdev->cache_unsafe)
+        qflags |= BDRV_O_NO_FLUSH;
+
     /* init qemu block driver */
     index = (blkdev->xendev.dev - 202 * 256) / 16;
     blkdev->dinfo = drive_get(IF_XEN, 0, index);
++++++ set-mtu-from-bridge-for-tap-interface.patch ++++++
# HG changeset patch
# User Charles Arnold 
# Date 1379427987 -3600
# Node ID e6da6ffd6749237316d4440799f0a0272bbdae9c
# Parent  5597ce99ec7f2587a29f3b2dee0bde98d59bf327
tools/hotplug: set mtu from bridge for tap interface

With changeset 22885 support was added for setting the MTU in the vif-bridge
script for when a vif interface was set to 'online'.  The was not done for the
'add' operation.  The 'add' operation was added to the script for when tap
devices were specified (c/s 21944). With the setting of the MTU for the
'online' case was there a reason for omitting the 'add'?

This patch sets the MTU for both 'online' and 'add' in the vif-bridge script.

Signed-off-by: Charles Arnold 
Acked-by: Ian Campbell 

Index: xen-4.4.0-testing/tools/hotplug/Linux/vif-bridge
===================================================================
--- xen-4.4.0-testing.orig/tools/hotplug/Linux/vif-bridge
+++ xen-4.4.0-testing/tools/hotplug/Linux/vif-bridge
@@ -88,7 +88,7 @@ fi
 case "$command" in
     online)
         setup_virtual_bridge_port "$dev"
-        set_mtu $bridge $dev
+        set_mtu "$bridge" "$dev"
         add_to_bridge "$bridge" "$dev"
         ;;
 
@@ -99,7 +99,7 @@ case "$command" in
 
     add)
         setup_virtual_bridge_port "$dev"
-        set_mtu $bridge $dev
+        set_mtu "$bridge" "$dev"
         add_to_bridge "$bridge" "$dev"
         ;;
 esac
++++++ stdvga-cache.patch ++++++
Index: xen-4.2.0-testing/xen/arch/x86/hvm/stdvga.c
===================================================================
--- xen-4.2.0-testing.orig/xen/arch/x86/hvm/stdvga.c
+++ xen-4.2.0-testing/xen/arch/x86/hvm/stdvga.c
@@ -135,7 +135,10 @@ static int stdvga_outb(uint64_t addr, ui
 
     /* When in standard vga mode, emulate here all writes to the vram buffer
      * so we can immediately satisfy reads without waiting for qemu. */
-    s->stdvga = (s->sr[7] == 0x00);
+    s->stdvga =
+        (s->sr[7] == 0x00) &&  /* standard vga mode */
+        (s->gr[6] == 0x05);    /* misc graphics register w/ MemoryMapSelect=1
+                                * 0xa0000-0xaffff (64k region), AlphaDis=1 */
 
     if ( !prev_stdvga && s->stdvga )
     {
++++++ supported_module.patch ++++++
Make our PV drivers "Novell supported modules"

Signed-off-by: K. Y. Srinivasan 

Index: xen-4.2.0-testing/unmodified_drivers/linux-2.6/Module.supported
===================================================================
--- /dev/null
+++ xen-4.2.0-testing/unmodified_drivers/linux-2.6/Module.supported
@@ -0,0 +1,7 @@
+xen-vbd
+xen-platform-pci
+xen-vnif
+xenbus
+xen-balloon
+xen-scsi
+xen-usb
++++++ suspend_evtchn_lock.patch ++++++
Fix problems that suspend eventchannel lock file might be obselete for some reason
like segment fault or other abnormal exit, and once obselete lock file exists,
it might affact latter save process.
Have discussed with upstream, for some reason not accepted. 
http://xen.1045712.n5.nabble.com/Re-PATCH-improve-suspend-evtchn-lock-proces...

Signed-off-by: Chunyan Liu 

Index: xen-4.2.0-testing/tools/libxc/xc_suspend.c
===================================================================
--- xen-4.2.0-testing.orig/tools/libxc/xc_suspend.c
+++ xen-4.2.0-testing/tools/libxc/xc_suspend.c
@@ -16,8 +16,43 @@
 
 #include "xc_private.h"
 #include "xenguest.h"
+#include 
+#ifdef __MINIOS__
+extern int kill (__pid_t __pid, int __sig);
+#endif
 
 #define SUSPEND_LOCK_FILE "/var/lib/xen/suspend_evtchn"
+/* cleanup obsolete suspend lock file which is unlinked for any reason,
+so that current process can get lock */
+static void clean_obsolete_lock(int domid)
+{
+    int fd, pid, n;
+    char buf[128];
+    char suspend_file[256];
+
+    snprintf(suspend_file, sizeof(suspend_file), "%s_%d_lock.d",
+        SUSPEND_LOCK_FILE, domid);
+    fd = open(suspend_file, O_RDWR);
+
+    if (fd < 0)
+        return;
+
+    n = read(fd, buf, 127);
+
+    close(fd);
+
+    if (n > 0)
+    {
+        sscanf(buf, "%d", &pid);
+        /* pid does not exist, this lock file is obsolete, just delete it */
+        if ( kill(pid,0) )
+        {
+            unlink(suspend_file);
+            return;
+        }
+    }
+}
+
 static int lock_suspend_event(xc_interface *xch, int domid)
 {
     int fd, rc;
@@ -27,6 +62,7 @@ static int lock_suspend_event(xc_interfa
 
     snprintf(suspend_file, sizeof(suspend_file), "%s_%d_lock.d",
 	    SUSPEND_LOCK_FILE, domid);
+    clean_obsolete_lock(domid);
     mask = umask(022);
     fd = open(suspend_file, O_CREAT | O_EXCL | O_RDWR, 0666);
     if (fd < 0)
@@ -41,6 +77,9 @@ static int lock_suspend_event(xc_interfa
     rc = write_exact(fd, buf, strlen(buf));
     close(fd);
 
+    if(rc)
+    unlink(suspend_file);
+
     return rc;
 }
 
@@ -127,8 +166,7 @@ int xc_suspend_evtchn_init(xc_interface
     return suspend_evtchn;
 
 cleanup:
-    if (suspend_evtchn != -1)
-        xc_suspend_evtchn_release(xch, xce, domid, suspend_evtchn);
+    xc_suspend_evtchn_release(xch, xce, domid, suspend_evtchn);
 
     return -1;
 }
++++++ sysconfig.pciback ++++++
## Path: System/Virtualization
## Type: string
## Default: ""
#
# Space delimited list of PCI devices to late bind to pciback
# Format:  <driver>,<PCI ID>
#
#XEN_PCI_HIDE_LIST="e1000,0000:0b:00.0 e1000,0000:0b:00.1"
XEN_PCI_HIDE_LIST=""
++++++ tapdisk-ioemu-logfile.patch ++++++
...
From 903a145f3eace5e3ae914f0335ab6c4e33635d2f Mon Sep 17 00:00:00 2001
From: Kevin Wolf 
Date: Tue, 10 Mar 2009 16:36:23 +0100
Subject: [PATCH 4/6] tapdisk-ioemu: Write messages to a logfile
Typically, tapdisk-ioemu runs as a daemon and messages to stderr are
simply lost. Write them to a logfile instead.

Signed-off-by: Kevin Wolf 
---
 tapdisk-ioemu.c |   19 +++++++++++++------
 1 files changed, 13 insertions(+), 6 deletions(-)

Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/tapdisk-ioemu.c
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/tapdisk-ioemu.c
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/tapdisk-ioemu.c
@@ -78,15 +78,22 @@ int main(void)
     struct timeval tv;
     void *old_fd_start = NULL;
 
-    logfile = stderr;
-    
+    /* Daemonize */
+    if (fork() != 0)
+        exit(0);
+
     bdrv_init();
     init_blktap();
 
-    /* Daemonize */
-    if (fork() != 0)
-    	exit(0);
-   
+    logfile = fopen("/var/log/xen/tapdisk-ioemu.log", "a");
+    if (logfile) {
+        setbuf(logfile, NULL);
+        fclose(stderr);
+        stderr = logfile;
+    } else {
+        logfile = stderr;
+    }
+
     /* 
      * Main loop: Pass events to the corrsponding handlers and check for
      * completed aio operations.
++++++ tapdisk-ioemu-shutdown-fix.patch ++++++
...
From 9062564d79cb45029403cc998b48410e42ead924 Mon Sep 17 00:00:00 2001
From: Kevin Wolf 
Date: Tue, 10 Mar 2009 16:45:44 +0100
Subject: [PATCH 6/6] tapdisk-ioemu: Fix shutdown condition
Even when opening the only image a tapdisk-ioemu instance is
responsible for fails, it can't immediately shut down. blktapctrl
still wants to communicate with tapdisk-ioemu and close the disk.

This patch changes tapdisk-ioemu to count the connections to
blktapctrl rather than the number of opened disk images.

Signed-off-by: Kevin Wolf 
---
 hw/xen_blktap.c |    5 ++++-
 tapdisk-ioemu.c |   13 ++++++++++---
 2 files changed, 14 insertions(+), 4 deletions(-)

Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_blktap.c
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/xen_blktap.c
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_blktap.c
@@ -65,6 +65,7 @@ int read_fd;
 int write_fd;
 
 static pid_t process;
+int connected_disks = 0;
 fd_list_entry_t *fd_start = NULL;
 
 static void handle_blktap_iomsg(void* private);
@@ -541,6 +542,7 @@ static void handle_blktap_ctrlmsg(void*
 
 			/* Allocate the disk structs */
 			s = state_init();
+			connected_disks++;
 
 			/*Open file*/
 			if (s == NULL || open_disk(s, path, msg->drivertype, msg->readonly)) {
@@ -591,7 +593,8 @@ static void handle_blktap_ctrlmsg(void*
 		case CTLMSG_CLOSE:
 			s = get_state(msg->cookie);
 			if (s) unmap_disk(s);
-			break;			
+			connected_disks--;
+			break;
 
 		case CTLMSG_PID:
 			memset(buf, 0x00, MSG_SIZE);
Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/tapdisk-ioemu.c
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/tapdisk-ioemu.c
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/tapdisk-ioemu.c
@@ -14,6 +14,7 @@ extern void qemu_aio_init(void);
 extern void qemu_aio_poll(void);
 
 extern void *fd_start;
+extern int connected_disks;
 
 int domid = 0;
 FILE* logfile;
@@ -76,7 +77,7 @@ int main(void)
     int max_fd;
     fd_set rfds;
     struct timeval tv;
-    void *old_fd_start = NULL;
+    int old_connected_disks = 0;
 
     /* Daemonize */
     if (fork() != 0)
@@ -128,11 +129,17 @@ int main(void)
                 pioh = &ioh->next;
         }
 
+	if (old_connected_disks != connected_disks)
+            fprintf(stderr, "connected disks: %d => %d\n",
+	        old_connected_disks, connected_disks);
+
         /* Exit when the last image has been closed */
-        if (old_fd_start != NULL && fd_start == NULL)
+        if (old_connected_disks != 0 && connected_disks == 0) {
+	    fprintf(stderr, "Last image is closed, exiting.\n");
             exit(0);
+	}
 
-        old_fd_start = fd_start;
+        old_connected_disks = connected_disks;
     }
     return 0;
 }
++++++ tigervnc-long-press.patch ++++++
Index: xen-4.4.1-testing/tools/qemu-xen-dir-remote/ui/vnc.c
===================================================================
--- xen-4.4.1-testing.orig/tools/qemu-xen-dir-remote/ui/vnc.c
+++ xen-4.4.1-testing/tools/qemu-xen-dir-remote/ui/vnc.c
@@ -1651,6 +1651,25 @@ static void do_key_event(VncState *vs, i
         if (down)
             vs->modifiers_state[keycode] ^= 1;
         break;
+    default:
+        if (qemu_console_is_graphic(NULL)) {
+            /* record key 'down' info. Some client like tigervnc
+             * will send key down repeatedly if user pressing a
+             * a key for long time. In this case, we should add
+             * additional key up event before repeated key down,
+             * so that it can display the key multiple times.
+             */
+            if (down) {
+                if (vs->modifiers_state[keycode]) {
+                    /* add a key up event */
+                    do_key_event(vs, 0, keycode, sym);
+                }
+                vs->modifiers_state[keycode] = 1;
+            } else {
+                vs->modifiers_state[keycode] = 0;
+            }
+        }
+        break;
     }
 
     /* Turn off the lock state sync logic if the client support the led
++++++ tmp-initscript-modprobe.patch ++++++
Index: xen-4.3.0-testing/tools/hotplug/Linux/init.d/xencommons
===================================================================
--- xen-4.3.0-testing.orig/tools/hotplug/Linux/init.d/xencommons
+++ xen-4.3.0-testing/tools/hotplug/Linux/init.d/xencommons
@@ -57,21 +57,27 @@ do_start () {
         local time=0
 	local timeout=30
 
-	modprobe xen-evtchn 2>/dev/null
-	modprobe xen-gntdev 2>/dev/null
-	modprobe xen-gntalloc 2>/dev/null
-	modprobe xen-blkback 2>/dev/null
-	modprobe xen-netback 2>/dev/null
-	modprobe xen-pciback 2>/dev/null
-	modprobe evtchn 2>/dev/null
-	modprobe gntdev 2>/dev/null
-	modprobe netbk 2>/dev/null
-	modprobe blkbk 2>/dev/null
-	modprobe xen-scsibk 2>/dev/null
-	modprobe usbbk 2>/dev/null
-	modprobe pciback 2>/dev/null
-	modprobe xen-acpi-processor 2>/dev/null
-	modprobe blktap2 2>/dev/null || modprobe blktap 2>/dev/null
+	#modprobe xen-evtchn 2>/dev/null
+	#modprobe xen-gntdev 2>/dev/null
+	#modprobe xen-gntalloc 2>/dev/null
+	#modprobe xen-blkback 2>/dev/null
+	#modprobe xen-netback 2>/dev/null
+	#modprobe xen-pciback 2>/dev/null
+	modprobe evtchn 2>/dev/null || true
+	modprobe gntdev 2>/dev/null || true
+	modprobe gntalloc 2>/dev/null || true
+	modprobe netbk 2>/dev/null || true
+	modprobe blkbk 2>/dev/null || true
+	modprobe xen-scsibk 2>/dev/null || true
+	modprobe usbbk 2>/dev/null || true
+	modprobe pciback 2>/dev/null || true
+	modprobe xen-acpi-processor 2>/dev/null || true
+	modprobe blktap2 2>/dev/null || true
+	modprobe blktap 2>/dev/null || true
+	# xenblk (frontend module) is needed in dom0, allowing it to use vbds
+	modprobe xenblk 2>/dev/null || true
+	# support xl create pv guest with qcow/qcow2 disk image
+	modprobe nbd max_part=8 2>/dev/null || true
 	mkdir -p /var/run/xen
 
 	if ! `${BINDIR}/xenstore-read -s / >/dev/null 2>&1`
++++++ tmp_build.patch ++++++
Index: xen-4.3.0-testing/tools/xenstore/Makefile
===================================================================
--- xen-4.3.0-testing.orig/tools/xenstore/Makefile
+++ xen-4.3.0-testing/tools/xenstore/Makefile
@@ -75,6 +75,7 @@ $(CLIENTS_DOMU): xenstore
 
 xenstore: xenstore_client.o $(LIBXENSTORE)
 	$(CC) $(LDFLAGS) $< $(LDLIBS_libxenstore) $(SOCKET_LIBS) -o $@ $(APPEND_LDFLAGS)
+	$(CC) $(CFLAGS) $(LDFLAGS) -Wl,--build-id=uuid $< -L. -lxenstore $(SOCKET_LIBS) -o domu-$@
 
 xenstore-control: xenstore_control.o $(LIBXENSTORE)
 	$(CC) $(LDFLAGS) $< $(LDLIBS_libxenstore) $(SOCKET_LIBS) -o $@ $(APPEND_LDFLAGS)
@@ -124,10 +125,11 @@ install: all
 	$(INSTALL_PROG) xenstore-control $(DESTDIR)$(BINDIR)
 	$(INSTALL_PROG) xenstore $(DESTDIR)$(BINDIR)
 	set -e ; for c in $(CLIENTS) ; do \
-		ln -f $(DESTDIR)$(BINDIR)/xenstore $(DESTDIR)$(BINDIR)/$${c} ; \
+		ln -fs /usr/bin/xenstore $(DESTDIR)/usr/bin/$${c} ; \
 	done
+	$(INSTALL_PROG) domu-xenstore $(DESTDIR)/bin
 	for client in $(CLIENTS_DOMU); do \
-	    $(INSTALL_PROG) $$client $(DESTDIR)/bin/$${client/domu-}; \
+	    ln -fs /bin/domu-xenstore $(DESTDIR)/bin/$${client/domu-}; \
 	done
 	$(INSTALL_DIR) $(DESTDIR)$(LIBDIR)
 	$(INSTALL_PROG) libxenstore.so.$(MAJOR).$(MINOR) $(DESTDIR)$(LIBDIR)
++++++ udev-rules.patch ++++++
Index: xen-4.4.1-testing/tools/hotplug/Linux/xen-backend.rules
===================================================================
--- xen-4.4.1-testing.orig/tools/hotplug/Linux/xen-backend.rules
+++ xen-4.4.1-testing/tools/hotplug/Linux/xen-backend.rules
@@ -12,4 +12,5 @@ KERNEL=="blktap-control", NAME="xen/blkt
 KERNEL=="gntdev", NAME="xen/%k", MODE="0600"
 KERNEL=="pci_iomul", NAME="xen/%k", MODE="0600"
 KERNEL=="tapdev[a-z]*", NAME="xen/blktap-2/tapdev%m", MODE="0600"
-SUBSYSTEM=="net", KERNEL=="vif*-emu", ACTION=="add", ENV{UDEV_CALL}="1", RUN+="/etc/xen/scripts/vif-setup $env{ACTION} type_if=tap"
+SUBSYSTEM=="net", KERNEL=="vif*-emu", ACTION=="add", ENV{UDEV_CALL}="1", TEST=="/proc/xen" RUN+="/etc/xen/scripts/vif-setup $env{ACTION} type_if=tap"
+KERNELS=="xen", KERNEL=="xvd*", SUBSYSTEM=="block", OPTIONS+="last_rule"
++++++ vif-bridge-no-iptables.patch ++++++
Index: xen-4.4.0-testing/tools/hotplug/Linux/vif-bridge
===================================================================
--- xen-4.4.0-testing.orig/tools/hotplug/Linux/vif-bridge
+++ xen-4.4.0-testing/tools/hotplug/Linux/vif-bridge
@@ -97,9 +97,9 @@ case "$command" in
         ;;
 esac
 
-if [ "$type_if" = vif ]; then
-    handle_iptable
-fi
+#if [ "$type_if" = vif ]; then
+#    handle_iptable
+#fi
 
 call_hooks vif post
 
++++++ vif-bridge-tap-fix.patch ++++++
# HG changeset patch
# User Jim Fehlig 
# Date 1319581952 21600
# Node ID 74da2a3a1db1476d627f42e4a99e9e720cc6774d
# Parent  6c583d35d76dda2236c81d9437ff9d57ab02c006
Prevent vif-bridge from adding user-created tap interfaces to a bridge

Exit vif-bridge script if there is no device info in xenstore, preventing
it from adding user-created taps to bridges.

    Signed-off-by: Jim Fehlig 

Index: xen-4.2.0-testing/tools/hotplug/Linux/vif-bridge
===================================================================
--- xen-4.2.0-testing.orig/tools/hotplug/Linux/vif-bridge
+++ xen-4.2.0-testing/tools/hotplug/Linux/vif-bridge
@@ -32,6 +32,13 @@
 dir=$(dirname "$0")
 . "$dir/vif-common.sh"
 
+mac=$(xenstore_read_default "$XENBUS_PATH/mac" "")
+if [ -z "$mac" ]
+then
+    log debug "No device details in $XENBUS_PATH, exiting."
+    exit 0
+fi
+
 bridge=${bridge:-}
 bridge=$(xenstore_read_default "$XENBUS_PATH/bridge" "$bridge")
 
++++++ x86-cpufreq-report.patch ++++++
Index: xen-4.4.0-testing/xen/arch/x86/platform_hypercall.c
===================================================================
--- xen-4.4.0-testing.orig/xen/arch/x86/platform_hypercall.c
+++ xen-4.4.0-testing/xen/arch/x86/platform_hypercall.c
@@ -25,7 +25,7 @@
 #include 
 #include 
 #include 
-#include 
+#include 
 #include 
 #include 
 #include 
@@ -601,6 +601,41 @@ ret_t do_platform_op(XEN_GUEST_HANDLE_PA
     }
     break;
 
+    case XENPF_get_cpu_freq:
+    case XENPF_get_cpu_freq_min:
+    case XENPF_get_cpu_freq_max:
+    {
+        struct vcpu *v;
+        const struct cpufreq_policy *policy;
+
+        if ( op->u.get_cpu_freq.vcpu >= current->domain->max_vcpus ||
+             !(v = current->domain->vcpu[op->u.get_cpu_freq.vcpu]) )
+        {
+            ret = -EINVAL;
+            break;
+        }
+
+        policy = per_cpu(cpufreq_cpu_policy, v->processor);
+        switch ( op->cmd & -!!policy )
+        {
+        case XENPF_get_cpu_freq:
+            op->u.get_cpu_freq.freq = policy->cur;
+            break;
+        case XENPF_get_cpu_freq_min:
+            op->u.get_cpu_freq.freq = policy->min;
+            break;
+        case XENPF_get_cpu_freq_max:
+            op->u.get_cpu_freq.freq = policy->max;
+            break;
+        default:
+            op->u.get_cpu_freq.freq = 0;
+            break;
+        }
+        if ( __copy_field_to_guest(u_xenpf_op, op, u.get_cpu_freq.freq) )
+            ret = -EFAULT;
+    }
+    break;
+
     default:
         ret = -ENOSYS;
         break;
Index: xen-4.4.0-testing/xen/include/public/platform.h
===================================================================
--- xen-4.4.0-testing.orig/xen/include/public/platform.h
+++ xen-4.4.0-testing/xen/include/public/platform.h
@@ -527,6 +527,16 @@ struct xenpf_core_parking {
 typedef struct xenpf_core_parking xenpf_core_parking_t;
 DEFINE_XEN_GUEST_HANDLE(xenpf_core_parking_t);
 
+#define XENPF_get_cpu_freq        ('N' << 24)
+#define XENPF_get_cpu_freq_min    (XENPF_get_cpu_freq + 1)
+#define XENPF_get_cpu_freq_max    (XENPF_get_cpu_freq_min + 1)
+struct xenpf_get_cpu_freq {
+    /* IN variables */
+    uint32_t vcpu;
+    /* OUT variables */
+    uint32_t freq; /* in kHz */
+};
+
 /*
  * ` enum neg_errnoval
  * ` HYPERVISOR_platform_op(const struct xen_platform_op*);
@@ -553,6 +563,7 @@ struct xen_platform_op {
         struct xenpf_cpu_hotadd        cpu_add;
         struct xenpf_mem_hotadd        mem_add;
         struct xenpf_core_parking      core_parking;
+        struct xenpf_get_cpu_freq      get_cpu_freq;
         uint8_t                        pad[128];
     } u;
 };
++++++ x86-dom-print.patch ++++++
Index: xen-4.3.0-testing/xen/arch/x86/domain.c
===================================================================
--- xen-4.3.0-testing.orig/xen/arch/x86/domain.c
+++ xen-4.3.0-testing/xen/arch/x86/domain.c
@@ -151,15 +151,30 @@ void dump_pageframe_info(struct domain *
 
     printk("Memory pages belonging to domain %u:\n", d->domain_id);
 
-    if ( d->tot_pages >= 10 )
+    if ( d->tot_pages >= 10 && d->is_dying < DOMDYING_dead )
     {
         printk("    DomPage list too long to display\n");
     }
     else
     {
+        unsigned long total[PGT_type_mask
+                            / (PGT_type_mask & -PGT_type_mask) + 1] = {};
+
         spin_lock(&d->page_alloc_lock);
         page_list_for_each ( page, &d->page_list )
         {
+            unsigned int index = (page->u.inuse.type_info & PGT_type_mask)
+                                 / (PGT_type_mask & -PGT_type_mask);
+
+            if ( ++total[index] > 16 )
+            {
+                switch ( page->u.inuse.type_info & PGT_type_mask )
+                {
+                case PGT_none:
+                case PGT_writable_page:
+                    continue;
+                }
+            }
             printk("    DomPage %p: caf=%08lx, taf=%" PRtype_info "\n",
                    _p(page_to_mfn(page)),
                    page->count_info, page->u.inuse.type_info);
++++++ x86-extra-trap-info.patch ++++++
Index: xen-4.4.0-testing/xen/arch/x86/x86_64/entry.S
===================================================================
--- xen-4.4.0-testing.orig/xen/arch/x86/x86_64/entry.S
+++ xen-4.4.0-testing/xen/arch/x86/x86_64/entry.S
@@ -438,19 +438,30 @@ UNLIKELY_START(z, create_bounce_frame_ba
 __UNLIKELY_END(create_bounce_frame_bad_bounce_ip)
         movq  %rax,UREGS_rip+8(%rsp)
         ret
-        _ASM_EXTABLE(.Lft2,  dom_crash_sync_extable)
-        _ASM_EXTABLE(.Lft3,  dom_crash_sync_extable)
-        _ASM_EXTABLE(.Lft4,  dom_crash_sync_extable)
-        _ASM_EXTABLE(.Lft5,  dom_crash_sync_extable)
-        _ASM_EXTABLE(.Lft6,  dom_crash_sync_extable)
-        _ASM_EXTABLE(.Lft7,  dom_crash_sync_extable)
-        _ASM_EXTABLE(.Lft8,  dom_crash_sync_extable)
-        _ASM_EXTABLE(.Lft9,  dom_crash_sync_extable)
-        _ASM_EXTABLE(.Lft10, dom_crash_sync_extable)
-        _ASM_EXTABLE(.Lft11, dom_crash_sync_extable)
-        _ASM_EXTABLE(.Lft12, dom_crash_sync_extable)
-        _ASM_EXTABLE(.Lft13, dom_crash_sync_extable)
+        _ASM_EXTABLE(.Lft2,  domain_crash_page_fault_32)
+        _ASM_EXTABLE(.Lft3,  domain_crash_page_fault_24)
+        _ASM_EXTABLE(.Lft4,  domain_crash_page_fault_8)
+        _ASM_EXTABLE(.Lft5,  domain_crash_page_fault_16)
+        _ASM_EXTABLE(.Lft6,  domain_crash_page_fault)
+        _ASM_EXTABLE(.Lft7,  domain_crash_page_fault)
+        _ASM_EXTABLE(.Lft8,  domain_crash_page_fault_24)
+        _ASM_EXTABLE(.Lft9,  domain_crash_page_fault_16)
+        _ASM_EXTABLE(.Lft10, domain_crash_page_fault_8)
+        _ASM_EXTABLE(.Lft11, domain_crash_page_fault)
+        _ASM_EXTABLE(.Lft12, domain_crash_page_fault_8)
+        _ASM_EXTABLE(.Lft13, domain_crash_page_fault)
 
+domain_crash_page_fault_32:
+        addq  $8,%rsi
+domain_crash_page_fault_24:
+        addq  $8,%rsi
+domain_crash_page_fault_16:
+        addq  $8,%rsi
+domain_crash_page_fault_8:
+        addq  $8,%rsi
+domain_crash_page_fault:
+        movq  %rsi,%rdi
+        call  show_page_walk
 ENTRY(dom_crash_sync_extable)
         # Get out of the guest-save area of the stack.
         GET_STACK_BASE(%rax)
++++++ x86-ioapic-ack-default.patch ++++++
Change default IO-APIC ack mode for single IO-APIC systems to old-style.

--- a/xen/arch/x86/io_apic.c
+++ b/xen/arch/x86/io_apic.c
@@ -2035,7 +2035,10 @@ void __init setup_IO_APIC(void)
         io_apic_irqs = ~PIC_IRQS;
 
     printk("ENABLING IO-APIC IRQs\n");
-    printk(" -> Using %s ACK method\n", ioapic_ack_new ? "new" : "old");
+    if (!directed_eoi_enabled && !ioapic_ack_forced) {
+        ioapic_ack_new = (nr_ioapics > 1);
+        printk(" -> Using %s ACK method\n", ioapic_ack_new ? "new" : "old");
+    }
 
     if (ioapic_ack_new) {
         ioapic_level_type.ack = irq_complete_move;
++++++ xen-destdir.patch ++++++
Index: xen-4.4.0-testing/tools/xenstore/Makefile
===================================================================
--- xen-4.4.0-testing.orig/tools/xenstore/Makefile
+++ xen-4.4.0-testing/tools/xenstore/Makefile
@@ -10,6 +10,7 @@ CFLAGS += $(CFLAGS_libxenctrl)
 
 CLIENTS := xenstore-exists xenstore-list xenstore-read xenstore-rm xenstore-chmod
 CLIENTS += xenstore-write xenstore-ls xenstore-watch
+CLIENTS_DOMU := $(patsubst xenstore-%,domu-xenstore-%,$(CLIENTS))
 
 XENSTORED_OBJS = xenstored_core.o xenstored_watch.o xenstored_domain.o xenstored_transaction.o xs_lib.o talloc.o utils.o tdb.o hashtable.o
 
@@ -41,7 +42,7 @@ endif
 all: $(ALL_TARGETS)
 
 .PHONY: clients
-clients: xenstore $(CLIENTS) xenstore-control
+clients: xenstore $(CLIENTS) $(CLIENTS_DOMU) xenstore-control
 
 ifeq ($(CONFIG_SunOS),y)
 xenstored_probes.h: xenstored_probes.d
@@ -69,6 +70,9 @@ xenstored.a: $(XENSTORED_OBJS)
 $(CLIENTS): xenstore
 	ln -f xenstore $@
 
+$(CLIENTS_DOMU): xenstore
+	ln -f xenstore $@
+
 xenstore: xenstore_client.o $(LIBXENSTORE)
 	$(CC) $(LDFLAGS) $< $(LDLIBS_libxenstore) $(SOCKET_LIBS) -o $@ $(APPEND_LDFLAGS)
 
@@ -96,7 +100,7 @@ clean:
 	rm -f *.a *.o *.opic *.so* xenstored_probes.h
 	rm -f xenstored xs_random xs_stress xs_crashme
 	rm -f xs_tdb_dump xenstore-control init-xenstore-domain
-	rm -f xenstore $(CLIENTS)
+	rm -f xenstore $(CLIENTS) $(CLIENTS_DOMU)
 	$(RM) $(DEPS)
 
 .PHONY: TAGS
@@ -113,6 +117,7 @@ install: all
 	$(INSTALL_DIR) $(DESTDIR)$(SBINDIR)
 	$(INSTALL_DIR) $(DESTDIR)$(INCLUDEDIR)
 	$(INSTALL_DIR) $(DESTDIR)$(INCLUDEDIR)/xenstore-compat
+	$(INSTALL_DIR) $(DESTDIR)/bin
 	$(INSTALL_DIR) $(DESTDIR)/var/run/xenstored
 	$(INSTALL_DIR) $(DESTDIR)/var/lib/xenstored
 	$(INSTALL_PROG) xenstored $(DESTDIR)$(SBINDIR)
@@ -121,6 +126,9 @@ install: all
 	set -e ; for c in $(CLIENTS) ; do \
 		ln -f $(DESTDIR)$(BINDIR)/xenstore $(DESTDIR)$(BINDIR)/$${c} ; \
 	done
+	for client in $(CLIENTS_DOMU); do \
+	    $(INSTALL_PROG) $$client $(DESTDIR)/bin/$${client/domu-}; \
+	done
 	$(INSTALL_DIR) $(DESTDIR)$(LIBDIR)
 	$(INSTALL_PROG) libxenstore.so.$(MAJOR).$(MINOR) $(DESTDIR)$(LIBDIR)
 	ln -sf libxenstore.so.$(MAJOR).$(MINOR) $(DESTDIR)$(LIBDIR)/libxenstore.so.$(MAJOR)
Index: xen-4.4.0-testing/tools/hotplug/Linux/Makefile
===================================================================
--- xen-4.4.0-testing.orig/tools/hotplug/Linux/Makefile
+++ xen-4.4.0-testing/tools/hotplug/Linux/Makefile
@@ -46,14 +46,14 @@ install: all install-initd install-scrip
 .PHONY: install-initd
 install-initd:
 	[ -d $(DESTDIR)$(INITD_DIR) ] || $(INSTALL_DIR) $(DESTDIR)$(INITD_DIR)
-	[ -d $(DESTDIR)$(SYSCONFIG_DIR) ] || $(INSTALL_DIR) $(DESTDIR)$(SYSCONFIG_DIR)
+	[ -d $(DESTDIR)/var/adm/fillup-templates ] || $(INSTALL_DIR) $(DESTDIR)/var/adm/fillup-templates/
 ifeq ($(CONFIG_XEND),y)
 	$(INSTALL_PROG) $(XEND_INITD) $(DESTDIR)$(INITD_DIR)
 endif
 	$(INSTALL_PROG) $(XENDOMAINS_INITD) $(DESTDIR)$(INITD_DIR)
-	$(INSTALL_DATA) $(XENDOMAINS_SYSCONFIG) $(DESTDIR)$(SYSCONFIG_DIR)/xendomains
+	$(INSTALL_DATA) $(XENDOMAINS_SYSCONFIG) $(DESTDIR)/var/adm/fillup-templates/
 	$(INSTALL_PROG) $(XENCOMMONS_INITD) $(DESTDIR)$(INITD_DIR)
-	$(INSTALL_DATA) $(XENCOMMONS_SYSCONFIG) $(DESTDIR)$(SYSCONFIG_DIR)/xencommons
+	$(INSTALL_DATA) $(XENCOMMONS_SYSCONFIG) $(DESTDIR)/var/adm/fillup-templates/
 	$(INSTALL_PROG) init.d/xen-watchdog $(DESTDIR)$(INITD_DIR)
 
 .PHONY: install-scripts
Index: xen-4.4.0-testing/tools/firmware/etherboot/Makefile
===================================================================
--- xen-4.4.0-testing.orig/tools/firmware/etherboot/Makefile
+++ xen-4.4.0-testing/tools/firmware/etherboot/Makefile
@@ -28,12 +28,12 @@ all: $(ROMS)
 	$(MAKE) -C $D/src bin/$(*F).rom
 
 $T:
-	if ! $(FETCHER) _$T $(IPXE_TARBALL_URL); then \
-		$(GIT) clone $(IPXE_GIT_URL) $D.git; \
-		(cd $D.git && $(GIT) archive --format=tar --prefix=$D/ \
-		$(IPXE_GIT_TAG) | gzip >../_$T); \
-		rm -rf $D.git; \
-	fi
+	#if ! $(FETCHER) _$T $(IPXE_TARBALL_URL); then \
+	#	$(GIT) clone $(IPXE_GIT_URL) $D.git; \
+	#	(cd $D.git && $(GIT) archive --format=tar --prefix=$D/ \
+	#	$(IPXE_GIT_TAG) | gzip >../_$T); \
+	#	rm -rf $D.git; \
+	#fi
 	mv _$T $T
 
 $D/src/arch/i386/Makefile: $T Config
++++++ xen-disable-qemu-monitor.patch ++++++
CVE-2007-0998 - remote compromise of dom0

Rather than completely disabling QEMU's console (which would remove
the "sendkey" command, among other useful things), remove all console
commands that can read/write dom0's state.


Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/monitor.c
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/monitor.c
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/monitor.c
@@ -1497,6 +1497,7 @@ static const term_cmd_t term_cmds[] = {
       "device|all", "commit changes to the disk images (if -snapshot is used) or backing files" },
     { "info", "s?", do_info,
       "subcommand", "show various information about the system state" },
+#ifdef CONFIG_TRUSTED_CLIENT
     { "q|quit", "", do_quit,
       "", "quit the emulator" },
     { "eject", "-fB", do_eject,
@@ -1509,6 +1510,7 @@ static const term_cmd_t term_cmds[] = {
       "filename", "output logs to 'filename'" },
     { "log", "s", do_log,
       "item1[,...]", "activate logging of the specified items to '/tmp/qemu.log'" },
+#endif
     { "savevm", "s?", do_savevm,
       "tag|id", "save a VM snapshot. If no tag or id are provided, a new snapshot is created" },
     { "loadvm", "s", do_loadvm,
@@ -1538,8 +1540,10 @@ static const term_cmd_t term_cmds[] = {
       "", "reset the system" },
     { "system_powerdown", "", do_system_powerdown,
       "", "send system power down event" },
+#ifdef CONFIG_TRUSTED_CLIENT
     { "sum", "ii", do_sum,
       "addr size", "compute the checksum of a memory region" },
+#endif
     { "usb_add", "s", do_usb_add,
       "device", "add USB device (e.g. 'host:bus.addr' or 'host:vendor_id:product_id')" },
     { "usb_del", "s", do_usb_del,
@@ -1558,6 +1562,7 @@ static const term_cmd_t term_cmds[] = {
       "state", "change mouse button state (1=L, 2=M, 4=R)" },
     { "mouse_set", "i", do_mouse_set,
       "index", "set which mouse device receives events" },
+#ifdef CONFIG_TRUSTED_CLIENT
 #ifdef HAS_AUDIO
     { "wavcapture", "si?i?i?", do_wav_capture,
       "path [frequency bits channels]",
@@ -1565,6 +1570,7 @@ static const term_cmd_t term_cmds[] = {
 #endif
     { "stopcapture", "i", do_stop_capture,
       "capture index", "stop capture" },
+#endif
     { "memsave", "lis", do_memory_save,
       "addr size file", "save to disk virtual memory dump starting at 'addr' of size 'size'", },
     { "pmemsave", "lis", do_physical_memory_save,
@@ -1646,6 +1652,7 @@ static const term_cmd_t info_cmds[] = {
       "", "show KVM information", },
     { "usb", "", usb_info,
       "", "show guest USB devices", },
+#ifdef CONFIG_TRUSTED_CLIENT
     { "usbhost", "", usb_host_info,
       "", "show host USB devices", },
     { "profile", "", do_info_profile,
@@ -1677,6 +1684,7 @@ static const term_cmd_t info_cmds[] = {
     { "migrate", "", do_info_migrate, "", "show migration status" },
     { "balloon", "", do_info_balloon,
       "", "show balloon information" },
+#endif
     { NULL, NULL, },
 };
 
++++++ xen-figlet-makefile.patch ++++++
Index: xen-4.4.2-testing/xen/tools/Makefile
===================================================================
--- xen-4.4.2-testing.orig/xen/tools/Makefile
+++ xen-4.4.2-testing/xen/tools/Makefile
@@ -3,10 +3,12 @@ include $(XEN_ROOT)/Config.mk
 
 .PHONY: default
 default:
+	[ -d figlet ] && $(MAKE) -C figlet
 	$(MAKE) symbols
 
 .PHONY: clean
 clean:
+	[ -d figlet ] && $(MAKE) -C figlet clean
 	rm -f *.o symbols
 
 symbols: symbols.c
Index: xen-4.4.2-testing/xen/Makefile
===================================================================
--- xen-4.4.2-testing.orig/xen/Makefile
+++ xen-4.4.2-testing/xen/Makefile
@@ -114,12 +114,10 @@ delete-unfresh-files:
 	fi
 
 .banner: Makefile
-	@if which figlet >/dev/null 2>&1 ; then \
-		echo " Xen $(XEN_FULLVERSION)" | figlet -f tools/xen.flf > $@.tmp; \
-	else \
-		echo " Xen $(XEN_FULLVERSION)" > $@.tmp; \
-	fi
-	@mv -f $@.tmp $@
+	$(MAKE) -C tools
+	@tools/figlet/figlet -d tools/figlet Xen $(XEN_FULLVERSION) 2>$@2 >$@1
+	@cat $@1 $@2 >$@
+	@rm -f $@1 $@2
 
 # compile.h contains dynamic build info. Rebuilt on every 'make' invocation.
 include/xen/compile.h: include/xen/compile.h.in .banner
@@ -134,8 +132,8 @@ include/xen/compile.h: include/xen/compi
 	    -e 's/@@extraversion@@/$(XEN_EXTRAVERSION)/g' \
 	    -e 's!@@changeset@@!$(shell tools/scmversion $(XEN_ROOT) || echo "unavailable")!g' \
 	    < include/xen/compile.h.in > $@.new
-	@cat .banner
-	@$(PYTHON) tools/fig-to-oct.py < .banner >> $@.new
+	@grep \" .banner >> $@.new
+	@grep -v \" .banner
 	@mv -f $@.new $@
 
 include/asm-$(TARGET_ARCH)/asm-offsets.h: arch/$(TARGET_ARCH)/asm-offsets.s
++++++ xen-hvm-default-bridge.patch ++++++
Index: xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/net.h
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-traditional-dir-remote/net.h
+++ xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/net.h
@@ -107,8 +107,8 @@ void net_host_device_add(const char *dev
 void net_host_device_remove(int vlan_id, const char *device);
 
 #ifndef DEFAULT_NETWORK_SCRIPT
-#define DEFAULT_NETWORK_SCRIPT "/etc/qemu-ifup"
-#define DEFAULT_NETWORK_DOWN_SCRIPT "/etc/qemu-ifdown"
+#define DEFAULT_NETWORK_SCRIPT "/etc/xen/qemu-ifup"
+#define DEFAULT_NETWORK_DOWN_SCRIPT "/etc/xen/qemu-ifdown"
 #endif
 #ifdef __sun__
 #define SMBD_COMMAND "/usr/sfw/sbin/smbd"
Index: xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/net.c
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-traditional-dir-remote/net.c
+++ xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/net.c
@@ -1765,9 +1765,10 @@ int net_client_init(const char *device,
             }
             if (get_param_value(script_arg, sizeof(script_arg), "scriptarg", p) == 0 &&
                 get_param_value(script_arg, sizeof(script_arg), "bridge", p) == 0) { /* deprecated; for xend compatibility */
-                pstrcpy(script_arg, sizeof(script_arg), "");
+                ret = net_tap_init(vlan, device, name, ifname, setup_script, NULL, NULL);
+            } else {
+                ret = net_tap_init(vlan, device, name, ifname, setup_script, down_script, script_arg);
             }
-            ret = net_tap_init(vlan, device, name, ifname, setup_script, down_script, script_arg);
         }
     } else
 #endif
Index: xen-4.4.3-testing/tools/python/xen/xend/image.py
===================================================================
--- xen-4.4.3-testing.orig/tools/python/xen/xend/image.py
+++ xen-4.4.3-testing/tools/python/xen/xend/image.py
@@ -912,11 +912,13 @@ class HVMImageHandler(ImageHandler):
             mac = devinfo.get('mac')
             if mac is None:
                 raise VmError("MAC address not specified or generated.")
-            bridge = devinfo.get('bridge', 'xenbr0')
+            bridge = devinfo.get('bridge', None)
             model = devinfo.get('model', 'rtl8139')
             ret.append("-net")
-            ret.append("nic,vlan=%d,macaddr=%s,model=%s" %
-                       (nics, mac, model))
+            net = "nic,vlan=%d,macaddr=%s,model=%s" % (nics, mac, model)
+            if bridge:
+                net += ",bridge=%s" % bridge
+            ret.append(net)
             vifname = "vif%d.%d-emu" % (self.vm.getDomid(), nics-1)
             ret.append("-net")
             if osdep.tapif_script is not None:
Index: xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/i386-dm/qemu-ifup-Linux
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-traditional-dir-remote/i386-dm/qemu-ifup-Linux
+++ xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/i386-dm/qemu-ifup-Linux
@@ -1,36 +1,22 @@
 #!/bin/sh
 
-#. /etc/rc.d/init.d/functions
-#ulimit -c unlimited
-
 echo 'config qemu network with xen bridge for ' $*
 
+# If bridge is not specified, try device with default route.
 bridge=$2
+if [ -z "$bridge" ]; then
+    bridge=$(ip route list | awk '/^default / { print $NF }')
+fi
 
-#
-# Old style bridge setup with netloop, used to have a bridge name
-# of xenbrX, enslaving pethX and vif0.X, and then configuring
-# eth0.
-#
-# New style bridge setup does not use netloop, so the bridge name
-# is ethX and the physical device is enslaved pethX
-#
-# So if...
-#
-#   - User asks for xenbrX
-#   - AND xenbrX doesn't exist
-#   - AND there is a ethX device which is a bridge
-#
-# ..then we translate xenbrX to ethX
-#
-# This lets old config files work without modification
-#
-if [ ! -e "/sys/class/net/$bridge" ] && [ -z "${bridge##xenbr*}" ]
+# Exit if $bridge is not a bridge.  Exit with 0 status
+# so qemu-dm process is not terminated.  No networking in
+# vm is bad but not catastrophic.  The vm could still run
+# cpu and disk IO workloads.
+# Include an useful error message in qemu-dm log file.
+if [ ! -e "/sys/class/net/${bridge}/bridge" ]
 then
-   if [ -e "/sys/class/net/eth${bridge#xenbr}/bridge" ]
-   then
-      bridge="eth${bridge#xenbr}"
-   fi
+   echo "WARNING! ${bridge} is not a bridge.  qemu-ifup exiting.  VM may not have a functioning networking stack."
+   exit 0
 fi
 
 ifconfig $1 0.0.0.0 up
++++++ xen-qemu-iscsi-fix.patch ++++++
Index: xen-4.4.0-testing/tools/qemu-xen-traditional-dir-remote/xenstore.c
===================================================================
--- xen-4.4.0-testing.orig/tools/qemu-xen-traditional-dir-remote/xenstore.c
+++ xen-4.4.0-testing/tools/qemu-xen-traditional-dir-remote/xenstore.c
@@ -451,7 +451,7 @@ void xenstore_parse_domain_config(int hv
     char *buf = NULL;
     char *fpath = NULL, *bpath = NULL, *btype = NULL,
         *dev = NULL, *params = NULL, *drv = NULL;
-    int i, ret, is_tap;
+    int i, j, ret, is_tap;
     unsigned int len, num, hd_index, pci_devid = 0;
     BlockDriverState *bs;
     BlockDriver *format;
@@ -535,12 +535,7 @@ void xenstore_parse_domain_config(int hv
             continue;
         free(danger_type);
         danger_type = xs_read(xsh, XBT_NULL, danger_buf, &len);
-        if (pasprintf(&buf, "%s/params", bpath) == -1)
-            continue;
-        free(params);
-        params = xs_read(xsh, XBT_NULL, buf, &len);
-        if (params == NULL)
-            continue;
+
         /* read the name of the device */
         if (pasprintf(&buf, "%s/type", bpath) == -1)
             continue;
@@ -548,6 +543,35 @@ void xenstore_parse_domain_config(int hv
         drv = xs_read(xsh, XBT_NULL, buf, &len);
         if (drv == NULL)
             continue;
+
+        free(params);
+        if (!strcmp(drv,"iscsi") || !strcmp(drv, "npiv") ||
+            !strcmp(drv,"dmmd")) {
+          if (pasprintf(&buf, "%s/node", bpath) == -1)
+             continue;
+
+          /* wait for block-[iscsi|npiv|dmmd] script to complete and populate the
+           * node entry.  try 30 times (30 secs) */
+          for (j = 0; j < 30; j++) {
+            params = xs_read(xsh, XBT_NULL, buf, &len);
+            if (params != NULL)
+               break;
+	    sleep(1);
+          }
+          if (params == NULL) {
+             fprintf(stderr, "qemu: %s device not found -- timed out \n", drv);
+            continue;
+          }
+        }
+        else
+        {
+          if (pasprintf(&buf, "%s/params", bpath) == -1)
+              continue;
+           params = xs_read(xsh, XBT_NULL, buf, &len);
+           if (params == NULL)
+             continue;
+        }
+
         /* Obtain blktap sub-type prefix */
         if ((!strcmp(drv, "tap") || !strcmp(drv, "qdisk")) && params[0]) {
             char *offset = strchr(params, ':'); 
@@ -665,6 +689,12 @@ void xenstore_parse_domain_config(int hv
                         format = &bdrv_host_device;
                     else
                         format = &bdrv_raw;
+		} else if (!strcmp(drv,"iscsi")) {
+		    format = &bdrv_raw;
+		} else if (!strcmp(drv,"npiv")) {
+		    format = &bdrv_raw;
+		} else if (!strcmp(drv,"dmmd")) {
+		    format = &bdrv_raw;
 		} else {
 		    format = bdrv_find_format(drv);
 		    if (!format) {
++++++ xen-updown.sh ++++++
#!/bin/bash
#
usage () {
	echo $@
	echo "usage: $0 [<config>] <interface> [-o <options>]"
	echo ""
	echo "Options are:"
	echo "    debug    : be verbose"
	echo "    rc       : indicates that we are called from rcnetwork"
	echo ""
	echo "Any another options are ignored"
	exit $R_USAGE
}

xm_cmd="xm"
pidof -x /usr/sbin/xend >/dev/null 2>&1 || xm_cmd="xl"

######################################################################
# change the working direcory and source some common files
#
R_INTERNAL=1      # internal error, e.g. no config or missing scripts
cd /etc/sysconfig/network || exit $R_INTERNAL
test -f ./config && . ./config
test -f scripts/functions && . scripts/functions || exit $R_INTERNAL

######################################################################
# check arguments and how we are called (in case of links)
#
SCRIPTNAME=${0}
debug $*
case $1 in ""|-h|*help*) usage ;; esac
CONFIG="$1"
shift
if [ "x$1" != x -a "x$1" != "x-o" ] ; then
        INTERFACE="$1"
else
        INTERFACE="$CONFIG"
fi
shift
test "x$1" = "x-o" && shift
DEBUG=no
RUN_FROM_RC=no
while [ $# -gt 0 ]; do
	case $1 in
		debug)       DEBUG=yes ;;
		rc)          RUN_FROM_RC=yes ;;
		*)           debug unknown option $1 ;;
	esac
	shift
done

# usage: ifprint  message....
ifprint() {
	func=$1 ; shift
	test "x$func" = x && return 1
	if [ "$RUN_FROM_RC" = yes -a "$INTERFACE" != all ] ; then
		$func "`printf "    %-9s " "$INTERFACE"`$*"
	else
		$func "$*"
	fi
}

#
# xen related code
#

# check if xen is running
is_xend_running() {
	test -x /etc/init.d/xend && \
	/etc/init.d/xend status &>/dev/null && return 0
	return 1
}
exit_if_xend_not_running() {
	is_xend_running || {
		debug "$0: xend is not running - nothing to do"
		exit 0
	}
}	

# (modified) functions from /etc/init.d/xendomains
parseln()
{
	name=${1:0:$((${#1}-36))}
	name=${name%% *}
	rest="${1: -36}"
	id=${rest:0:4}
	id=`echo $id`
	mem=${rest:4:6}
	mem=`echo $mem`
	vcpu=${rest:10:6}
	vcpu=`echo $vcpu`
	state=${rest:16:11}
	state=`echo $state`
	tm=${rest:27}
	tm=`echo $tm`
}

xm_list()
{
	TERM=vt100 ${xm_cmd} list | grep -v '^Name *ID'
}

# For the specified vm, return a list of vifs that are connected to $INTERFACE
list_vifs()
{
	id=$1
	vifs=()
	for vif in $(ls -1 "/sys/class/net/$INTERFACE/brif/" 2>/dev/null) ; do
		eval BRIDGE_PORTS="" `grep "^[[:space:]]*BRIDGE_PORTS=" \
			"/etc/sysconfig/network/ifcfg-$INTERFACE" 2>/dev/null`
		for p in $BRIDGE_PORTS ; do
			test "x$p" = "x$vif" && continue 2
		done
		case $vif in
		(tap${id}\.*|vif${id}\.*)
			vifs=(${vifs[@]} ${vif})
		;;
		esac
	done
	echo "${vifs[@]}"
}

# Write list of concerned vifs to state file
save_sysconfig_state()
{
	[ -d "${RUN_FILES_BASE}/xen/" ] || \
	mkdir -p "${RUN_FILES_BASE}/xen/" || return 1

	rm -f "${RUN_FILES_BASE}/xen/$INTERFACE" && {
		echo "VIFS='${vifs[@]}'"
	} > "${RUN_FILES_BASE}/xen/$INTERFACE"
}

case $SCRIPTNAME in
*if-up.d*)
	exit_if_xend_not_running

	if test -f "${RUN_FILES_BASE}/xen/$INTERFACE" ; then
		. "${RUN_FILES_BASE}/xen/$INTERFACE"

		for vif in ${VIFS}; do
			test -d "/sys/class/net/${vif}" || continue
			test -d "/sys/class/net/${INTERFACE}/brif/${vif}" && \
				continue
			if ! is_iface_up ${vif} ; then
				ip link set dev ${vif} up || continue
			fi
			brctl addif ${INTERFACE} ${vif} &>/dev/null
		done

		# remove sysconfig state
		rm -f "${RUN_FILES_BASE}/xen/$INTERFACE"
	fi
;;
*if-down.d*)
	exit_if_xend_not_running
        test -d "/sys/class/net/$INTERFACE/brif/" || exit 0

	# Remember vifs attached to $INTERFACE
	vifs=()
	num=0
	while read LN; do
		parseln "$LN"
		[ "$id" = 0 ] && continue
		[ -z "$state" ] && continue

		vifs=(${vifs[@]} $(list_vifs $id))
	done < <(xm_list)

	[ -z "${vifs[*]}" ] || save_sysconfig_state

;;
*)
	usage
;;
esac

++++++ xen-watchdog.service ++++++
[Unit]
Description=Xen-watchdog - run xen watchdog daemon
After=xend.service
ConditionPathExists=/proc/xen

[Service]
Type=forking
ExecStart=/usr/sbin/xenwatchdogd 30 15
KillSignal=USR1

[Install]
WantedBy=multi-user.target
++++++ xen-xmexample.patch ++++++
Change various example paths in the config files to match SUSE.

Index: xen-4.3.0-testing/tools/examples/xmexample1
===================================================================
--- xen-4.3.0-testing.orig/tools/examples/xmexample1
+++ xen-4.3.0-testing/tools/examples/xmexample1
@@ -7,11 +7,17 @@
 #============================================================================
 
 #----------------------------------------------------------------------------
-# Kernel image file.
-kernel = "/boot/vmlinuz-2.6.10-xenU"
-
-# Optional ramdisk.
-#ramdisk = "/boot/initrd.gz"
+# Kernel image file and (optional) ramdisk (initrd).
+kernel = "/boot/vmlinuz-xen"
+ramdisk = "/boot/initrd-xen"
+
+# Or use a bootloader instead of kernel/ramdisk to get the kernel from domU FS
+# domUloader bootloader example:
+#bootloader = "/usr/lib/xen/boot/domUloader.py"
+#bootentry = "hda2:/vmlinuz-xen,/initrd-xen"
+# pygrub bootloader example:
+#bootloader="/usr/bin/pygrub"
+#bootargs=""
 
 # The domain build function. Default is 'linux'.
 #builder='linux'
@@ -49,11 +55,11 @@ name = "ExampleDomain"
 #
 # or optionally override backend, bridge, ip, mac, script, type, or vifname:
 #
-# vif = [ 'mac=00:16:3e:00:00:11, bridge=xenbr0' ]
+# vif = [ 'mac=00:16:3e:00:00:11, bridge=br0' ]
 #
 # or more than one interface may be configured:
 #
-# vif = [ '', 'bridge=xenbr1' ]
+# vif = [ '', 'bridge=br1' ]
 
 vif = [ '' ]
 
@@ -117,7 +123,7 @@ disk = [ 'phy:hda1,hda1,w' ]
 #hostname= "vm%d" % vmid
 
 # Set root device.
-root = "/dev/hda1 ro"
+root = "/dev/hda1"
 
 # Root device for nfs.
 #root = "/dev/nfs"
@@ -126,8 +132,8 @@ root = "/dev/hda1 ro"
 # Root directory on the nfs server.
 #nfs_root   = '/full/path/to/root/directory'
 
-# Sets runlevel 4.
-extra = "4"
+# Extra arguments to pass to the kernel.
+extra = ""
 
 #----------------------------------------------------------------------------
 # Configure the behaviour when a domain exits.  There are three 'reasons'
Index: xen-4.3.0-testing/tools/examples/xmexample2
===================================================================
--- xen-4.3.0-testing.orig/tools/examples/xmexample2
+++ xen-4.3.0-testing/tools/examples/xmexample2
@@ -35,11 +35,17 @@ xm_vars.var('vmid',
 xm_vars.check()
 
 #----------------------------------------------------------------------------
-# Kernel image file.
-kernel = "/boot/vmlinuz-2.6.10-xenU"
-
-# Optional ramdisk.
-#ramdisk = "/boot/initrd.gz"
+# Kernel image file and (optional) ramdisk (initrd).
+kernel = "/boot/vmlinuz-xen"
+ramdisk = "/boot/initrd-xen"
+
+# Or use a bootloader instead of kernel/ramdisk to get the kernel from domU FS
+# domUloader bootloader example:
+#bootloader = "/usr/lib/xen/boot/domUloader.py"
+#bootentry = "hda2:/vmlinuz-xen,/initrd-xen"
+# pygrub bootloader example:
+#bootloader="/usr/bin/pygrub"
+#bootargs=""
 
 # The domain build function. Default is 'linux'.
 #builder='linux'
@@ -80,11 +86,11 @@ vcpus = 4 # make your domain a 4-way
 #
 # or optionally override backend, bridge, ip, mac, script, type, or vifname:
 #
-# vif = [ 'mac=00:16:3e:00:00:11, bridge=xenbr0' ]
+# vif = [ 'mac=00:16:3e:00:00:11, bridge=br0' ]
 #
 # or more than one interface may be configured:
 #
-# vif = [ '', 'bridge=xenbr1' ]
+# vif = [ '', 'bridge=br1' ]
 
 vif = [ '' ]
 
@@ -153,7 +159,7 @@ disk = [ 'phy:sda%d,sda1,w' % (7+vmid),
 #hostname= "vm%d" % vmid
 
 # Set root device.
-root = "/dev/sda1 ro"
+root = "/dev/sda1"
 
 # Root device for nfs.
 #root = "/dev/nfs"
@@ -162,8 +168,8 @@ root = "/dev/sda1 ro"
 # Root directory on the nfs server.
 #nfs_root   = '/full/path/to/root/directory'
 
-# Sets runlevel 4 and the device for /usr.
-extra = "4 VMID=%d usr=/dev/sda6" % vmid
+# Sets the device for /usr.
+extra = "VMID=%d usr=/dev/sda6" % vmid
 
 #----------------------------------------------------------------------------
 # Configure the behaviour when a domain exits.  There are three 'reasons'
Index: xen-4.3.0-testing/tools/examples/xmexample3
===================================================================
--- xen-4.3.0-testing.orig/tools/examples/xmexample3
+++ xen-4.3.0-testing/tools/examples/xmexample3
@@ -35,11 +35,17 @@ xm_vars.var('vmid',
 xm_vars.check()
 
 #----------------------------------------------------------------------------
-# Kernel image file.
-kernel = "/path/to/domU/kernel"
+# Kernel image file and (optional) ramdisk (initrd).
+kernel = "/boot/vmlinuz-xen"
+ramdisk = "/boot/initrd-xen"
 
-# Optional ramdisk.
-#ramdisk = "/boot/initrd.gz"
+# Or use a bootloader instead of kernel/ramdisk to get the kernel from domU FS
+# domUloader bootloader example:
+#bootloader = "/usr/lib/xen/boot/domUloader.py"
+#bootentry = "hda2:/vmlinuz-xen,/initrd-xen"
+# pygrub bootloader example:
+#bootloader="/usr/bin/pygrub"
+#bootargs=""
 
 # The domain build function. Default is 'linux'.
 #builder='linux'
Index: xen-4.3.0-testing/tools/examples/xmexample.hvm
===================================================================
--- xen-4.3.0-testing.orig/tools/examples/xmexample.hvm
+++ xen-4.3.0-testing/tools/examples/xmexample.hvm
@@ -64,11 +64,26 @@ name = "ExampleHVMDomain"
 #cpus = "0-3,5,^1" # all vcpus run on cpus 0,2,3,5
 #cpus = ["2", "3"] # VCPU0 runs on CPU2, VCPU1 runs on CPU3
 
-# Optionally define mac and/or bridge for the network interfaces.
-# Random MACs are assigned if not given.
-#vif = [ 'type=ioemu, mac=00:16:3e:00:00:11, bridge=xenbr0, model=ne2k_pci' ]
-# type=ioemu specify the NIC is an ioemu device not netfront
-vif = [ 'type=ioemu, bridge=xenbr0' ]
+#----------------------------------------------------------------------------
+# Define network interfaces.
+
+# By default, no network interfaces are configured.  You may have one created
+# with sensible defaults using an empty vif clause:
+#
+# vif = [ '' ]
+#
+# or optionally override backend, bridge, ip, mac, script, type, model,
+# or vifname.
+#
+# An emulated RealTek 8139 network interface can be configured with:
+#
+# vif = [ 'mac=00:16:3e:00:00:11, type=ioemu, model=rtl8139, bridge=br0' ]
+#
+# A para-virtual network interface can be configured with:
+#
+# vif = [ 'mac=00:16:3e:00:00:11, type=netfront, bridge=br0' ]
+#
+vif = [ '' ]
 
 #----------------------------------------------------------------------------
 # Define the disk devices you want the domain to have access to, and
@@ -78,7 +93,7 @@ vif = [ 'type=ioemu, bridge=xenbr0' ]
 # and MODE is r for read-only, w for read-write.
 
 #disk = [ 'phy:hda1,hda1,r' ]
-disk = [ 'file:/var/images/min-el3-i386.img,hda,w', ',hdc:cdrom,r' ]
+disk = [ 'file:/var/lib/xen/images/disk.img,ioemu:hda,w', ',hdc:cdrom,r' ]
 
 #----------------------------------------------------------------------------
 # Configure the behaviour when a domain exits.  There are three 'reasons'
Index: xen-4.3.0-testing/docs/man/xmdomain.cfg.pod.5
===================================================================
--- xen-4.3.0-testing.orig/docs/man/xmdomain.cfg.pod.5
+++ xen-4.3.0-testing/docs/man/xmdomain.cfg.pod.5
@@ -38,13 +38,13 @@ file.
 
 The kernel image for the domain.  The format of the parameter is the
 fully qualified path to the kernel image file,
-i.e. I.
+i.e. I.
 
 
 =item B<ramdisk>
 
 The initial ramdisk for the domain.  The format of the parameter is
-the fully qualified path to the initrd, i.e. I.  On
+the fully qualified path to the initrd, i.e. I.  On
 many Linux distros you will not need a ramdisk if using the default
 xen kernel.
 
@@ -321,14 +321,14 @@ configured.  They should not be consider
 
 =item I<A Loopback File as Root>
 
-    kernel = "/boot/vmlinuz-2.6-xenU"
+    kernel = "/boot/vmlinuz-xen"
     memory = 128
     name = "MyLinux"      
-    root = "/dev/hda1 ro"
-    disk = [ "file:/var/xen/mylinux.img,hda1,w" ]
+    root = "/dev/hda1"
+    disk = [ "file:/var/lib/xen/images/MyLinux/hda1,hda1,w" ]
 
 This creates a domain called MyLinux with 128 MB of memory using a
-default xen kernel, and the file /var/xen/mylinux.img loopback mounted
+default xen kernel, and the file hda1 loopback mounted
 at hda1, which is the root filesystem.
 
 =item I<NFS Root>
Index: xen-4.3.0-testing/docs/man/xm.pod.1
===================================================================
--- xen-4.3.0-testing.orig/docs/man/xm.pod.1
+++ xen-4.3.0-testing/docs/man/xm.pod.1
@@ -165,8 +165,8 @@ soon as it is run.
 
 =item I<without config file>
  
-  xm create /dev/null ramdisk=initrd.img \
-     kernel=/boot/vmlinuz-2.6.12.6-xenU \
+  xm create /dev/null ramdisk=initrd-xen \
+     kernel=/boot/vmlinuz-xen \
      name=ramdisk vif='' vcpus=1 \
      memory=64 root=/dev/ram0
 
Index: xen-4.3.0-testing/tools/examples/xmexample.hvm-stubdom
===================================================================
--- xen-4.3.0-testing.orig/tools/examples/xmexample.hvm-stubdom
+++ xen-4.3.0-testing/tools/examples/xmexample.hvm-stubdom
@@ -55,11 +55,26 @@ name = "xmexample.hvm"
 #cpus = "0-3,5,^1" # all vcpus run on cpus 0,2,3,5
 #cpus = ["2", "3"] # VCPU0 runs on CPU2, VCPU1 runs on CPU3
 
-# Optionally define mac and/or bridge for the network interfaces.
-# Random MACs are assigned if not given.
-#vif = [ 'type=ioemu, mac=00:16:3e:00:00:11, bridge=xenbr0, model=ne2k_pci' ]
-# type=ioemu specify the NIC is an ioemu device not netfront
-vif = [ 'type=ioemu, bridge=xenbr0' ]
+#----------------------------------------------------------------------------
+# Define network interfaces.
+
+# By default, no network interfaces are configured.  You may have one created
+# with sensible defaults using an empty vif clause:
+#
+# vif = [ '' ]
+#
+# or optionally override backend, bridge, ip, mac, script, type, model,
+# or vifname.
+#
+# An emulated RealTek 8139 network interface can be configured with:
+#
+# vif = [ 'mac=00:16:3e:00:00:11, type=ioemu, model=rtl8139, bridge=br0' ]
+#
+# A para-virtual network interface can be configured with:
+#
+# vif = [ 'mac=00:16:3e:00:00:11, type=netfront, bridge=br0' ]
+#
+vif = [ '' ]
 
 #----------------------------------------------------------------------------
 # Define the disk devices you want the domain to have access to, and
Index: xen-4.3.0-testing/tools/examples/xmexample.pv-grub
===================================================================
--- xen-4.3.0-testing.orig/tools/examples/xmexample.pv-grub
+++ xen-4.3.0-testing/tools/examples/xmexample.pv-grub
@@ -53,11 +53,11 @@ name = "ExampleDomain"
 #
 # or optionally override backend, bridge, ip, mac, script, type, or vifname:
 #
-# vif = [ 'mac=00:16:3e:00:00:11, bridge=xenbr0' ]
+# vif = [ 'mac=00:16:3e:00:00:11, bridge=br0' ]
 #
 # or more than one interface may be configured:
 #
-# vif = [ '', 'bridge=xenbr1' ]
+# vif = [ '', 'bridge=br1' ]
 
 vif = [ '' ]
 
Index: xen-4.3.0-testing/docs/man/xl.pod.1
===================================================================
--- xen-4.3.0-testing.orig/docs/man/xl.pod.1
+++ xen-4.3.0-testing/docs/man/xl.pod.1
@@ -12,7 +12,8 @@ The B<xl> program is the new tool for ma
 domains. The program can be used to create, pause, and shutdown
 domains. It can also be used to list current domains, enable or pin
 VCPUs, and attach or detach virtual block devices.
-The old B<xm> tool is deprecated and should not be used.
+The B<xm> tool continues to be supported on SLE11 platforms
+and should still be used.
 
 The basic structure of every B<xl> command is almost always:
 
++++++ xen.migrate.tools-xend_move_assert_to_exception_block.patch ++++++
user:        Olaf Hering 
date:        Thu Mar 28 15:36:02 2013 +0100
files:       tools/python/xen/xend/XendCheckpoint.py
description:
tools/xend: move assert to exception block

The two assert in restore trigger sometimes after hundreds of
migrations. If they trigger the destination host will not destroy the
newly created, still empty guest. After a second migration attempt to
this host there will be two guets with the same name and uuid. This
situation is poorly handled by the xm tools.
With this change the guest will be destroyed.

Signed-off-by: Olaf Hering 

---
 tools/python/xen/xend/XendCheckpoint.py |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

Index: xen-4.4.0-testing/tools/python/xen/xend/XendCheckpoint.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendCheckpoint.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendCheckpoint.py
@@ -267,9 +267,6 @@ def restore(xd, fd, dominfo = None, paus
     store_port   = dominfo.getStorePort()
     console_port = dominfo.getConsolePort()
 
-    assert store_port
-    assert console_port
-
     # if hvm, pass mem size to calculate the store_mfn
     if is_hvm:
         apic = int(dominfo.info['platform'].get('apic', 0))
@@ -281,6 +278,9 @@ def restore(xd, fd, dominfo = None, paus
         pae  = 0
 
     try:
+        assert store_port
+        assert console_port
+
         restore_image = image.create(dominfo, dominfo.info)
         memory = restore_image.getRequiredAvailableMemory(
             dominfo.info['memory_dynamic_max'] / 1024)
++++++ xen2libvirt.py ++++++
#!/usr/bin/env python
#
# Copyright (C) 2014 SUSE LINUX Products GmbH, Nuernberg, Germany.
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with this library.  If not, see
# .
#
# Authors:
#     Jim Fehlig 
#
# Read native Xen configuration format, convert to libvirt domXML, and
# import (virsh define <xml>) into libvirt.

import sys
import os
import argparse
import re
from xml.etree import ElementTree

try:
    import libvirt
except ImportError:
    print 'Unable to import the libvirt module.  Is libvirt-python installed?'
    sys.exit(1)

parser = argparse.ArgumentParser(description='Import Xen domain configuration into libvirt')
parser.add_argument('-c', '--convert-only', help='Convert Xen domain configuration into libvirt domXML, but do not import into libvirt', action='store_true', dest='convert_only')
parser.add_argument('-r', '--recursive', help='Operate recursivelly on all Xen domain configuration rooted at path', action='store_true')
parser.add_argument('-f', '--format', help='Format of Xen domain configuration.  Supported formats are xm and sexpr', choices=['xm', 'sexpr'], default=None)
parser.add_argument('-v', '--verbose', help='Print information about the import process', action='store_true')
parser.add_argument('path', help='Path to Xen domain configuration')


def print_verbose(msg):
    if args.verbose:
        print msg


def check_config(path, config):
    isbinary = os.system('file -b ' + path + ' | grep text > /dev/null')

    if isbinary:
        print('Skipping %s (not a valid Xen configuration file)' % path)
        return 'unknown'

    for line in config.splitlines():
        if len(line) == 0 or line.startswith('#'):
            continue
        if line.startswith('
 #include 
 #include 
+#ifdef HAVE_XEN_PVONHVM_UNPLUG
+#include 
+#endif
 #ifdef __ia64__
 #include 
 #endif
@@ -290,6 +293,18 @@ static int check_platform_magic(struct d
 	short magic, unplug = 0;
 	char protocol, *p, *q, *err;
 
+#ifdef HAVE_XEN_PVONHVM_UNPLUG
+	if (xen_pvonhvm_unplug) {
+		/* Use kernel cmdline setting */
+		if (dev_unplug)
+			printk(KERN_INFO DRV_NAME ": ignoring option dev_unplug=%s \n", dev_unplug);
+		dev_unplug = NULL;
+		if (xen_pvonhvm_unplugged_disks)
+			unplug |= UNPLUG_ALL_IDE_DISKS | UNPLUG_AUX_IDE_DISKS;
+		if (xen_pvonhvm_unplugged_nics)
+			unplug |= UNPLUG_ALL_NICS;
+	} else
+#endif
 	/* Unconditionally unplug everything */
 	if (!dev_unplug)
 		unplug = UNPLUG_ALL;
++++++ xencommons.service ++++++
[Unit]
Description=Xencommons - Script to start and stop xenstored and xenconsoled
ConditionPathExists=/proc/xen
# Make sure network (for bridge) and remote mounts (for xendomains) are available ...
After=network-online.target
After=remote-fs.target

[Service]
Type=oneshot
RemainAfterExit=true
ExecStartPre=/bin/grep -q control_d /proc/xen/capabilities
ExecStart=-/etc/init.d/xencommons start
ExecStop=/etc/init.d/xencommons stop
KillMode=process

[Install]
WantedBy=multi-user.target
++++++ xenconsole-no-multiple-connections.patch ++++++
Index: xen-4.4.0-testing/tools/console/client/main.c
===================================================================
--- xen-4.4.0-testing.orig/tools/console/client/main.c
+++ xen-4.4.0-testing/tools/console/client/main.c
@@ -96,6 +96,7 @@ static int get_pty_fd(struct xs_handle *
  * Assumes there is already a watch set in the store for this path. */
 {
 	struct timeval tv;
+	struct flock lock;
 	fd_set watch_fdset;
 	int xs_fd = xs_fileno(xs), pty_fd = -1;
 	int start, now;
@@ -119,6 +120,14 @@ static int get_pty_fd(struct xs_handle *
 				pty_fd = open(pty_path, O_RDWR | O_NOCTTY);
 				if (pty_fd == -1)
 					warn("Could not open tty `%s'", pty_path);
+				else {
+					memset(&lock, 0, sizeof(lock));
+					lock.l_type = F_WRLCK;
+					lock.l_whence = SEEK_SET;
+					if (fcntl(pty_fd, F_SETLK, &lock) != 0)
+						err(errno, "Could not lock tty '%s'",
+						    pty_path);
+				}
 			}
 			free(pty_path);
 		}
++++++ xend-32on64-extra-mem.patch ++++++
Index: xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendDomainInfo.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
@@ -3000,7 +3000,7 @@ class XendDomainInfo:
 
             self.guest_bitsize = self.image.getBitSize()
             # Make sure there's enough RAM available for the domain
-            balloon.free(memory + shadow + vtd_mem, self)
+            balloon.free(memory + shadow + vtd_mem + 512, self)
 
             # Set up the shadow memory
             shadow_cur = xc.shadow_mem_control(self.domid, shadow / 1024)
++++++ xend-change_home_server.patch ++++++
Index: xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendDomainInfo.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
@@ -3174,6 +3174,11 @@ class XendDomainInfo:
         self._cleanup_phantom_devs(paths)
         self._cleanupVm()
 
+        if "change_home_server" in self.info:
+            chs = self.info["change_home_server"]
+            if (type(chs) is str and chs == "False") or \
+               (type(chs) is bool and chs is False):
+                self.setChangeHomeServer(None)
         if ("transient" in self.info["other_config"] and \
             bool(self.info["other_config"]["transient"])) or \
            ("change_home_server" in self.info and \
++++++ xend-check_device_status.patch ++++++
Improve check_device_status to handle HA cases

In HA environment, sometimes xenstore status has changed but ev.wait() cannot
get the signal, it will wait until timeout, thus incorrect device status is
returned. To fix this problem, we do not depend on ev.wait() result, but read
xenstore directly to get correct device status.

Index: xen-4.2.0-testing/tools/python/xen/xend/server/DevController.py
===================================================================
--- xen-4.2.0-testing.orig/tools/python/xen/xend/server/DevController.py
+++ xen-4.2.0-testing/tools/python/xen/xend/server/DevController.py
@@ -149,7 +149,10 @@ class DevController:
         (status, err) = self.waitForBackend(devid)
 
         if status == Timeout:
-            self.destroyDevice(devid, False)
+            #Clean timeout backend resource
+            dev = self.convertToDeviceNumber(devid)
+            self.writeBackend(dev, HOTPLUG_STATUS_NODE, HOTPLUG_STATUS_ERROR)
+            self.destroyDevice(devid, True)
             raise VmError("Device %s (%s) could not be connected. "
                           "Hotplug scripts not working." %
                           (devid, self.deviceClass))
@@ -554,7 +557,17 @@ class DevController:
 
             xswatch(statusPath, hotplugStatusCallback, ev, result)
 
-            ev.wait(DEVICE_CREATE_TIMEOUT)
+            for i in range(1, 50):
+                ev.wait(DEVICE_CREATE_TIMEOUT/50)
+                status = xstransact.Read(statusPath)
+                if status is not None:
+                    if status == HOTPLUG_STATUS_ERROR:
+                        result['status'] = Error
+                    elif status == HOTPLUG_STATUS_BUSY:
+                        result['status'] = Busy
+                    else:
+                        result['status'] = Connected
+                    break
 
             err = xstransact.Read(backpath, HOTPLUG_ERROR_NODE)
 
@@ -571,7 +584,12 @@ class DevController:
 
         xswatch(statusPath, deviceDestroyCallback, ev, result)
 
-        ev.wait(DEVICE_DESTROY_TIMEOUT)
+        for i in range(1, 50):
+            ev.wait(DEVICE_DESTROY_TIMEOUT/50)
+            status = xstransact.Read(statusPath)
+            if status is None:
+                result['status'] = Disconnected
+                break 
 
         return result['status']
 
++++++ xend-checkpoint-rename.patch ++++++
Index: xen-4.4.0-testing/tools/python/xen/xend/XendCheckpoint.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendCheckpoint.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendCheckpoint.py
@@ -190,7 +190,7 @@ def save(fd, dominfo, network, live, dst
             dominfo.destroy()
             dominfo.testDeviceComplete()
         try:
-            dominfo.setName(domain_name, False)
+            dominfo.setName(domain_name)
         except VmError:
             # Ignore this.  The name conflict (hopefully) arises because we
             # are doing localhost migration; if we are doing a suspend of a
++++++ xend-config-enable-dump-comment.patch ++++++
bnc#684305

---
 tools/examples/xend-config.sxp |    3 +++
 1 file changed, 3 insertions(+)

Index: xen-4.2.0-testing/tools/examples/xend-config.sxp
===================================================================
--- xen-4.2.0-testing.orig/tools/examples/xend-config.sxp
+++ xen-4.2.0-testing/tools/examples/xend-config.sxp
@@ -250,6 +250,9 @@
 (dom0-cpus 0)
 
 # Whether to enable core-dumps when domains crash.
+# This setting overrides the per-domain dump value 'on_crash' and causes a
+# core dump on all crashed domains. For finer grain control, it is best to
+# disable this setting (which is default) and use the per-domain controls.
 #(enable-dump no)
 
 # The tool used for initiating virtual TPM migration
++++++ xend-config.patch ++++++
Index: xen-4.2.0-testing/tools/hotplug/Linux/init.d/sysconfig.xendomains
===================================================================
--- xen-4.2.0-testing.orig/tools/hotplug/Linux/init.d/sysconfig.xendomains
+++ xen-4.2.0-testing/tools/hotplug/Linux/init.d/sysconfig.xendomains
@@ -98,7 +98,6 @@ XENDOMAINS_RESTORE=true
 # Note that the script tries to be clever if both RESTORE and AUTO are 
 # set: It will first restore saved domains and then only start domains
 # in AUTO which are not running yet. 
-# Note that the name matching is somewhat fuzzy.
 #
 XENDOMAINS_AUTO=/etc/xen/auto
 
Index: xen-4.2.0-testing/tools/examples/xend-config.sxp
===================================================================
--- xen-4.2.0-testing.orig/tools/examples/xend-config.sxp
+++ xen-4.2.0-testing/tools/examples/xend-config.sxp
@@ -58,11 +58,12 @@
 
 
 #(xend-http-server no)
-#(xend-unix-server no)
+(xend-unix-server yes)
 #(xend-tcp-xmlrpc-server no)
 #(xend-unix-xmlrpc-server yes)
+# Only enable xend-relocation-server on trusted networks as it lacks
+# encryption and authentication.
 #(xend-relocation-server no)
-(xend-relocation-server yes)
 #(xend-relocation-ssl-server no)
 #(xend-udev-event-server no)
 
@@ -170,7 +171,12 @@
 # two fake interfaces per guest domain.  To do things like this, write
 # yourself a wrapper script, and call network-bridge from it, as appropriate.
 #
-(network-script network-bridge)
+# SUSE users note:
+# On openSUSE >= 11.1 and SLES >= 11, networks should be configured using
+# native platform tool - YaST.  vif-bridge and qemu-ifup can be used to
+# connect vifs to the YaST-managed networks.
+#(network-script network-bridge)
+(network-script )
 
 # The script used to control virtual interfaces.  This can be overridden on a
 # per-vif basis when creating a domain or a configuring a new vif.  The
@@ -203,7 +209,7 @@
 # dom0-min-mem is the lowest permissible memory level (in MB) for dom0.
 # This is a minimum both for auto-ballooning (as enabled by
 # enable-dom0-ballooning below) and for xm mem-set when applied to dom0.
-(dom0-min-mem 196)
+(dom0-min-mem 512)
 
 # Whether to enable auto-ballooning of dom0 to allow domUs to be created.
 # If enable-dom0-ballooning = no, dom0 will never balloon out.
++++++ xend-console-port-restore.patch ++++++
Pass console_port to completeRestore() so that console/port is written to
xenstore.  See bnc#706574

From: Chunyan Liu 

Index: xen-4.4.0-testing/tools/python/xen/xend/XendCheckpoint.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendCheckpoint.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendCheckpoint.py
@@ -347,8 +347,7 @@ def restore(xd, fd, dominfo = None, paus
         restore_image.setCpuid()
 
         # xc_restore will wait for source to close connection
-        
-        dominfo.completeRestore(handler.store_mfn, handler.console_mfn)
+        dominfo.completeRestore(handler.store_mfn, handler.console_mfn, console_port)
 
         #
         # We shouldn't hold the domains_lock over a waitForDevices
Index: xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendDomainInfo.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
@@ -3083,7 +3083,7 @@ class XendDomainInfo:
     # TODO: recategorise - called from XendCheckpoint
     # 
 
-    def completeRestore(self, store_mfn, console_mfn):
+    def completeRestore(self, store_mfn, console_mfn, console_port):
 
         log.debug("XendDomainInfo.completeRestore")
 
@@ -3094,6 +3094,7 @@ class XendDomainInfo:
         self.image = image.create(self, self.info)
         if self.image:
             self.image.createDeviceModel(True)
+        self.console_port = console_port
         self._storeDomDetails()
         self._registerWatches()
         self.refreshShutdown()
++++++ xend-core-dump-loc.patch ++++++
Index: xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendDomainInfo.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
@@ -2339,7 +2339,7 @@ class XendDomainInfo:
             # To prohibit directory traversal
             based_name = os.path.basename(self.info['name_label'])
             
-            coredir = "/var/xen/dump/%s" % (based_name)
+            coredir = "/var/lib/xen/dump/%s" % (based_name)
             if not os.path.exists(coredir):
                 try:
                     mkdir.parents(coredir, stat.S_IRWXU)
++++++ xend-cpuinfo-model-name.patch ++++++
References: bnc#814709
For cpus that contain additional ':' characters in their name

Index: xen-4.4.0-testing/tools/python/xen/xend/osdep.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/osdep.py
+++ xen-4.4.0-testing/tools/python/xen/xend/osdep.py
@@ -143,10 +143,14 @@ def _linux_get_cpuinfo():
         d = {}  
         for line in f:
             keyvalue = line.split(':')
-            if len(keyvalue) != 2:
+            if len(keyvalue) < 2:
                 continue 
             key = keyvalue[0].strip()
-            val = keyvalue[1].strip()
+            for i in range(1, len(keyvalue)):
+                if i == 1:
+                    val = keyvalue[i].lstrip()
+                else:
+                    val = val + ":" + keyvalue[i]
             if key == 'processor':
                 if p != -1:
                     cpuinfo[p] = d
++++++ xend-del_usb_xend_entry.patch ++++++
Index: xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendDomainInfo.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
@@ -1300,8 +1300,15 @@ class XendDomainInfo:
                 frontpath = self.getDeviceController(deviceClass).frontendPath(dev)
                 backpath = xstransact.Read(frontpath, "backend")
                 thread.start_new_thread(self.getDeviceController(deviceClass).finishDeviceCleanup, (backpath, path))
-
-            rc = self.getDeviceController(deviceClass).destroyDevice(devid, force)
+            if deviceClass =='vusb':
+                dev = self.getDeviceController(deviceClass).convertToDeviceNumber(devid)
+                state = self.getDeviceController(deviceClass).readBackend(dev, 'state')
+                if state == '1':
+                    rc = self.getDeviceController(deviceClass).destroyDevice(devid, True)
+                else:
+                    rc = self.getDeviceController(deviceClass).destroyDevice(devid, force)
+            else:
+                rc = self.getDeviceController(deviceClass).destroyDevice(devid, force)
             if not force and rm_cfg:
                 # The backend path, other than the device itself,
                 # has to be passed because its accompanied frontend
++++++ xend-devid-or-name.patch ++++++
# HG changeset patch
# User Jim Fehlig 
# Date 1284948067 21600
# Node ID 4674ad11feef87a6a57b99313966e0e121588e1c
# Parent  5393151a737b023476f4e571effc547e758cf8c8
xend: Fix device_configure

The semantics of XendDomainInfo.py:device_configure() changed with xen upstream
c/s 19610.  Previously this method would take a devid in actual id *or* name
form, e.g. it would accept '5632' or 'hdc'.  This patch restores that behavior.

    Signed-off-by: Jim Fehlig 

Index: xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendDomainInfo.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
@@ -1205,6 +1205,9 @@ class XendDomainInfo:
             except ValueError:
                 pass
             devid = dev_control.convertToDeviceNumber(dev)
+        else:
+            # devid could be a name, e.g. hdc
+            devid = dev_control.convertToDeviceNumber(devid)
         dev_info = self._getDeviceInfo_vbd(devid)
         if dev_info is None:
             raise VmError("Device %s not connected" % devid)
++++++ xend-disable-internal-logrotate.patch ++++++
Disable internal logging and enable the logrotate.conf from the xen package.
This allows larger xend.log files

---
 tools/python/xen/xend/XendLogging.py |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Index: xen-4.2.0-testing/tools/python/xen/xend/XendLogging.py
===================================================================
--- xen-4.2.0-testing.orig/tools/python/xen/xend/XendLogging.py
+++ xen-4.2.0-testing/tools/python/xen/xend/XendLogging.py
@@ -76,7 +76,7 @@ if 'TRACE' not in logging.__dict__:
 log = logging.getLogger("xend")
 
 
-MAX_BYTES = 1 << 20  # 1MB
+MAX_BYTES = 0
 BACKUP_COUNT = 5
 
 STDERR_FORMAT = "[%(name)s] %(levelname)s (%(module)s:%(lineno)d) %(message)s"
++++++ xend-domain-lock-sfex.patch ++++++
Index: xen-4.4.0-testing/tools/examples/xend-config.sxp
===================================================================
--- xen-4.4.0-testing.orig/tools/examples/xend-config.sxp
+++ xen-4.4.0-testing/tools/examples/xend-config.sxp
@@ -357,7 +357,7 @@
 # path        /<xend-domain-lock-path>/<vm-uuid>
 # Return 0 on success, non-zero on error.
 #
-# lock-util [-s] path"
+# lock-util [-s] -i <vm uuid> path"
 # -s          Lock status.  If lock is acquired, print any contents
 #             on stdout and return 0.  Return non-zero if lock is
 #             available.
@@ -383,6 +383,11 @@
 #
 #(xend-domain-lock-utility domain-lock)
 
+# Some locking mechanism provide cluster wide locking service like sfex.
+# And that requires a shared locking device.
+#(xend-domain-lock-utility domain-lock-sfex)
+#(xend-domain-lock-device "/dev/iwmvg/hbdevice")
+
 # If we have a very big scsi device configuration, start of xend is slow,
 # because xend scans all the device paths to build its internal PSCSI device
 # list.  If we need only a few devices for assigning to a guest, we can reduce
Index: xen-4.4.0-testing/tools/hotplug/Linux/Makefile
===================================================================
--- xen-4.4.0-testing.orig/tools/hotplug/Linux/Makefile
+++ xen-4.4.0-testing/tools/hotplug/Linux/Makefile
@@ -24,6 +24,7 @@ XEN_SCRIPTS += external-device-migrate
 XEN_SCRIPTS += vscsi
 XEN_SCRIPTS += block-iscsi
 XEN_SCRIPTS += domain-lock vm-monitor
+XEN_SCRIPTS += domain-lock-sfex
 XEN_SCRIPTS += $(XEN_SCRIPTS-y)
 
 XEN_SCRIPT_DATA = xen-script-common.sh locking.sh logging.sh
Index: xen-4.4.0-testing/tools/hotplug/Linux/domain-lock
===================================================================
--- xen-4.4.0-testing.orig/tools/hotplug/Linux/domain-lock
+++ xen-4.4.0-testing/tools/hotplug/Linux/domain-lock
@@ -4,7 +4,7 @@ basedir=$(dirname "$0")
 
 usage() {
     echo "usage: domain-lock [-l|-u] -n <vm name> -i <vm uuid> -p <physical host> path"
-    echo "usage: domain-lock [-s] path"
+    echo "usage: domain-lock [-s] -i <vm uuid> path"
     echo ""
     echo "-l    lock"
     echo "-u    unlock"
Index: xen-4.4.0-testing/tools/hotplug/Linux/domain-lock-sfex
===================================================================
--- /dev/null
+++ xen-4.4.0-testing/tools/hotplug/Linux/domain-lock-sfex
@@ -0,0 +1,166 @@
+#!/bin/bash
+
+# pre-condition
+# 1. device is ready: logical volume activated if used
+# 2. device already initialized
+# 3. index is assigned correctly
+
+#error code:
+# 0: success
+# 1: error
+
+if [ `uname -m` = "x86_64" ]; then
+  SFEX_DAEMON=/usr/lib64/heartbeat/sfex_daemon
+else
+  SFEX_DAEMON=/usr/lib/heartbeat/sfex_daemon
+fi
+SFEX_INIT=/usr/sbin/sfex_init
+COLLISION_TIMEOUT=1
+LOCK_TIMEOUT=3
+MONITOR_INTERVAL=2
+LOCAL_LOCK_FILE=/var/lock/sfex
+
+usage() {
+  echo "usage: domain-lock-sfex [-l|-u|-s] -i <vm uuid> -x <sfex device>"
+  echo ""
+  echo "-l    lock"
+  echo "-u    unlock"
+  echo "-s    status (default)"
+  echo "-i    Virtual Machine Id or UUID"
+  echo "-x    SFEX device which used for sfex lock"
+  exit 1
+}
+
+get_lock_host() {
+  local rscname=$1
+  local device=$2
+  r=`$SFEX_DAEMON -s -u $rscname $device`
+  echo $r
+}
+
+get_status() {
+  local rscname=$1
+  if /usr/bin/pgrep -f "$SFEX_DAEMON .* ${rscname} " > /dev/null 2>&1; then
+	return 0
+  else
+    return 1
+  fi
+}
+
+acquire_lock() {
+  local rscname=$1
+  local device=$2
+  get_status $rscname
+  ## We assume xend will take care to avoid starting same VM twice on the same machine.
+  if [ $? -eq 0 ]; then
+    return 0
+  fi
+  $SFEX_DAEMON -c $COLLISION_TIMEOUT -t $LOCK_TIMEOUT -m $MONITOR_INTERVAL -u $rscname $device
+  rc=$?
+  if [ $rc -ne 0 ]; then
+    return $rc
+  fi
+  sleep 4
+  get_status $rscname
+  if [ $? -eq 0 ]; then
+    return 0
+  fi
+  return 1
+}
+
+# release has to success
+release_lock(){
+  local rscname=$1
+
+  ## If the lock is already released
+  get_status $rscname
+  if [ $? -ne 0 ]; then
+	return 0
+  fi
+
+  pid=`/usr/bin/pgrep -f "$SFEX_DAEMON .* ${rscname} "`
+  /bin/kill $pid
+
+  count=0
+  while [ $count -lt 10 ]
+  do
+    get_status $rscname
+    if [ $? -eq 1 ]; then
+      return 0
+    fi
+    count=`expr $count + 1`
+    sleep 1
+  done
+
+  /bin/kill -9 $pid
+  while :
+  do
+    get_status $rscname
+    if [ $? -eq 1 ]; then
+      break;
+    fi
+    sleep 1
+  done
+
+  return 0
+}
+
+mode="status"
+
+while getopts ":lusn:i:p:x:" opt; do
+case $opt in
+l )
+mode="lock"
+;;
+u )
+mode="unlock"
+;;
+s )
+mode="status"
+;;
+n )
+vm_name=$OPTARG
+;;
+i )
+vm_uuid=$OPTARG
+;;
+p )
+vm_host=$OPTARG
+;;
+x )
+vm_sfex_device=$OPTARG
+;;
+\? )
+usage
+;;
+esac
+done
+
+shift $(($OPTIND - 1))
+[ -z $vm_uuid ] && usage
+[ -z $vm_sfex_device ] && usage
+
+case $mode in
+lock )
+  (
+  flock -x 200
+  acquire_lock $vm_uuid $vm_sfex_device
+  rc=$?
+  flock -u 200
+  exit $rc
+  ) 200>$LOCAL_LOCK_FILE-$vm_uuid
+;;
+unlock )
+  (
+  flock -x 200
+  release_lock $vm_uuid
+  rc=$?
+  flock -u 200
+  exit $rc
+  ) 200>$LOCAL_LOCK_FILE-$vm_uuid
+;;
+status )
+  get_lock_host $vm_uuid $vm_sfex_device
+;;
+esac
+
Index: xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendDomainInfo.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
@@ -4559,8 +4559,14 @@ class XendDomainInfo:
 
     # Return name of host contained in lock file.
     def get_lock_host(self, path):
-        fin = os.popen(xoptions.get_xend_domain_lock_utility() + \
-                       ' -s ' + path, 'r')
+        lock_cmd = '%s -s -i %s ' % \
+                        (xoptions.get_xend_domain_lock_utility(), \
+                        self.info['uuid'])
+        lock_dev = xoptions.get_xend_domain_lock_device()
+        if lock_dev:
+            lock_cmd += '-x %d ' % lock_dev
+        lock_cmd += path
+        fin = os.popen(lock_cmd, 'r')
         hostname = "unknown"
 
         try:
@@ -4582,6 +4588,16 @@ class XendDomainInfo:
         path = xoptions.get_xend_domain_lock_path()
         path = os.path.join(path, self.get_uuid())
 
+        lock_cmd = '%s -l -p %s -n %s -i %s ' % \
+                    (xoptions.get_xend_domain_lock_utility(), \
+                    XendNode.instance().get_name(), \
+                    self.info['name_label'], \
+                    self.info['uuid'])
+        lock_dev = xoptions.get_xend_domain_lock_device()
+        if lock_dev:
+            lock_cmd += '-x %d ' % lock_dev
+        lock_cmd += path
+
         try:
             if not os.path.exists(path):
                 mkdir.parents(path, stat.S_IRWXU)
@@ -4589,12 +4605,7 @@ class XendDomainInfo:
             log.exception("%s could not be created." % path)
             raise XendError("%s could not be created." % path)
 
-        status = os.system('%s -l -p %s -n %s -i %s %s' % \
-                           (xoptions.get_xend_domain_lock_utility(), \
-                            XendNode.instance().get_name(), \
-                            self.info['name_label'], \
-                            self.info['uuid'], \
-                            path))
+        status = os.system(lock_cmd) >> 8
         if status != 0:
             log.debug("Failed to aqcuire lock: status = %d" % status)
             raise XendError("The VM is locked and appears to be running on host %s." % self.get_lock_host(path))
@@ -4611,12 +4622,18 @@ class XendDomainInfo:
 
         path = xoptions.get_xend_domain_lock_path()
         path = os.path.join(path, self.get_uuid())
-        status = os.system('%s -u -p %s -n %s -i %s %s' % \
-                           (xoptions.get_xend_domain_lock_utility(), \
-                            XendNode.instance().get_name(), \
-                            dom_name, \
-                            self.info['uuid'], \
-                            path))
+
+        lock_cmd = '%s -u -p %s -n %s -i %s ' % \
+                    (xoptions.get_xend_domain_lock_utility(), \
+                    XendNode.instance().get_name(), \
+                    dom_name, \
+                    self.info['uuid'])
+        lock_dev = xoptions.get_xend_domain_lock_device()
+        if lock_dev:
+            lock_cmd += '-x %d ' % lock_dev
+        lock_cmd += path
+
+        status = os.system(lock_cmd) >> 8
         if status != 0:
             log.exception("Failed to release lock: status = %s" % status)
         try:
Index: xen-4.4.0-testing/tools/python/xen/xend/XendNode.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendNode.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendNode.py
@@ -162,6 +162,7 @@ class XendNode:
 
         self._init_cpu_pools()
 
+        self._init_lock_devices()
 
     def _init_networks(self):
         # Initialise networks
@@ -382,6 +383,17 @@ class XendNode:
         XendCPUPool.recreate_active_pools()
 
 
+    def _init_lock_devices(self):
+        if xendoptions().get_xend_domain_lock():
+            if xendoptions().get_xend_domain_lock_utility().endswith("domain-lock-sfex"):
+                lock_device = xendoptions().get_xend_domain_lock_device()
+                if not lock_device:
+                    raise XendError("The block device for sfex is not properly configured")
+                status = os.system("lvchange -ay %s" % lock_device) >> 8
+                if status != 0:
+                    raise XendError("The block device for sfex could not be initialized")
+
+
     def add_network(self, interface):
         # TODO
         log.debug("add_network(): Not implemented.")
Index: xen-4.4.0-testing/tools/python/xen/xend/XendOptions.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendOptions.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendOptions.py
@@ -164,6 +164,9 @@ class XendOptions:
     """Default script to acquire/release domain lock"""
     xend_domain_lock_utility = auxbin.scripts_dir() + "/domain-lock"
 
+    """Default block device for lock service"""
+    xend_domain_lock_device = ""
+
 
     def __init__(self):
         self.configure()
@@ -430,6 +433,8 @@ class XendOptions:
         else:
             return self.xend_domain_lock_utility
 
+    def get_xend_domain_lock_device(self):
+        return self.get_config_string('xend-domain-lock-device', self.xend_domain_lock_device)
 
     def get_vnc_tls(self):
         return self.get_config_string('vnc-tls', self.xend_vnc_tls)
++++++ xend-domain-lock.patch ++++++
---
 tools/examples/xend-config.sxp          |   59 ++++++++++++++++++++++
 tools/hotplug/Linux/Makefile            |    1 
 tools/hotplug/Linux/domain-lock         |   83 ++++++++++++++++++++++++++++++++
 tools/hotplug/Linux/vm-monitor          |   41 +++++++++++++++
 tools/python/xen/xend/XendCheckpoint.py |    9 +++
 tools/python/xen/xend/XendDomainInfo.py |   74 ++++++++++++++++++++++++++++
 tools/python/xen/xend/XendOptions.py    |   29 +++++++++++
 7 files changed, 296 insertions(+)

Index: xen-4.4.0-testing/tools/examples/xend-config.sxp
===================================================================
--- xen-4.4.0-testing.orig/tools/examples/xend-config.sxp
+++ xen-4.4.0-testing/tools/examples/xend-config.sxp
@@ -324,6 +324,65 @@
 # device assignment could really work properly even after we do this.
 #(pci-passthrough-strict-check yes)
 
+# Domain Locking
+# In a multihost environment, domain locking provides a simple mechanism that
+# prevents simultaneously running a domain on more than one host.
+#
+# If enabled, xend will execute a external lock utility (defined below)
+# on each domain start and stop event.  Disabled by default.  Set to yes
+# to enable domain locking.
+#
+#(xend-domain-lock no)
+
+# Path where domain lock is stored if xend-domain-lock is enabled.
+# Note:  This path must be accessible to all VM Servers participating
+#        in domain locking, e.g. by specifying a shared mount point.
+#        Lock is placed in /<xend-domain-lock-path>/<domain-uuid>.
+# Default is /var/lib/xen/images/vm_locks/
+#
+#(xend-domain-lock-path /var/lib/images/vm_locks)
+
+# External locking utility called by xend for acquiring/releasing
+# domain lock.  By default /etc/xen/scripts/domain-lock will be used
+# if xend-domain-lock is set to yes.  Set to path of custom locking
+# utility to override the default.
+#
+# Synopsis of lock-util:
+# lock-util [-l|-u] -n <vm name> -i <vm uuid> -p <physical host> path"
+# -l          Acquire (create) lock
+# -u          Remove lock
+# -n vm-name  Name of domain
+# -i vm-id    Id or UUID of domain
+# -p phy-host Name of physical host (dom0)
+# path        /<xend-domain-lock-path>/<vm-uuid>
+# Return 0 on success, non-zero on error.
+#
+# lock-util [-s] path"
+# -s          Lock status.  If lock is acquired, print any contents
+#             on stdout and return 0.  Return non-zero if lock is
+#             available.
+# path        /<xend-domain-lock-path>/<vm-uuid>
+# If lock is acquired, print any contents on stdout and return 0.
+# Return non-zero if lock is available.
+#
+# Default lock-util behavior:
+# On domain start event, domain-lock will create and flock(1)
+# /<xend-domain-lock-path>/<vm-uuid>/lock.  Every two seconds it
+# will write <vm-name>, <vm-id>, <vm-host>, and <tick> to the lock.
+# <tick> is running counter.
+# On domain stop event, domain-lock will unlock and remove
+# /<xend-domain-lock-path>/<vm-uuid>/lock.
+#
+# Note: If xend-domain-lock-path is a cluster-unaware file system,
+#       administrator intervention may be required to remove stale
+#       locks.  Consider two hosts using NFS for xend-domain-lock-path
+#       when HostA, running vm1, crashes.  HostB could not acquire a
+#       lock for vm1 since the NFS server holds an exclusive lock
+#       acquired by HostA.  The lock file must be manually removed
+#       before starting vm1 on HostB.
+#
+#(xend-domain-lock-utility domain-lock)
+
 # If we have a very big scsi device configuration, start of xend is slow,
 # because xend scans all the device paths to build its internal PSCSI device
 # list.  If we need only a few devices for assigning to a guest, we can reduce
Index: xen-4.4.0-testing/tools/hotplug/Linux/Makefile
===================================================================
--- xen-4.4.0-testing.orig/tools/hotplug/Linux/Makefile
+++ xen-4.4.0-testing/tools/hotplug/Linux/Makefile
@@ -23,6 +23,7 @@ XEN_SCRIPTS += xen-hotplug-cleanup
 XEN_SCRIPTS += external-device-migrate
 XEN_SCRIPTS += vscsi
 XEN_SCRIPTS += block-iscsi
+XEN_SCRIPTS += domain-lock vm-monitor
 XEN_SCRIPTS += $(XEN_SCRIPTS-y)
 
 XEN_SCRIPT_DATA = xen-script-common.sh locking.sh logging.sh
Index: xen-4.4.0-testing/tools/hotplug/Linux/domain-lock
===================================================================
--- /dev/null
+++ xen-4.4.0-testing/tools/hotplug/Linux/domain-lock
@@ -0,0 +1,83 @@
+#!/bin/bash
+
+basedir=$(dirname "$0")
+
+usage() {
+    echo "usage: domain-lock [-l|-u] -n <vm name> -i <vm uuid> -p <physical host> path"
+    echo "usage: domain-lock [-s] path"
+    echo ""
+    echo "-l    lock"
+    echo "-u    unlock"
+    echo "-s    status (default)"
+    echo "-n    Virtual Machine name"
+    echo "-i    Virtual Machine Id or UUID"
+    echo "-p    Virtual Machine Server (physical host) name"
+    echo "path  A per-VM, unique location where external lock will be managed"
+    exit 1
+}
+
+remove_lock(){
+	local path=$1/lock
+	local name=$2
+
+	pid=`ps -efwww | grep vm-monitor | grep $name | awk '{print $2}'`
+	if [ -n "$pid" ]; then
+		kill $pid
+		rm -f $path
+	fi
+}
+
+get_status(){
+    local path=$1/lock
+    [ -f $path ] || exit 1
+
+    rc=`flock -xn $path /bin/true`
+    cat $path
+    exit $rc
+}
+
+mode="status"
+
+while getopts ":lusn:i:p:" opt; do
+    case $opt in
+        l )
+            mode="lock"
+            ;;
+	u )
+	    mode="unlock"
+	    ;;
+	s )
+            mode="status"
+            ;;
+	p )
+            vm_host=$OPTARG
+            ;;
+	n )
+            vm_name=$OPTARG
+            ;;
+	i )
+            vm_uuid=$OPTARG
+            ;;
+	\? )
+	    usage
+            ;;
+    esac
+done
+
+shift $(($OPTIND - 1))
+vm_path=$1
+
+case $mode in
+    lock )
+	[ -z "$vm_path" ] || [ -z "$vm_name" ] || [ -z "$vm_uuid" ] || [ -z "$vm_host" ] && usage
+	$basedir/set-lock $vm_path $vm_name $vm_uuid $vm_host
+        ;;
+    unlock )
+	[ -z "$vm_path" ] || [ -z "$vm_name" ] || [ -z "$vm_uuid" ] || [ -z "$vm_host" ] && usage
+        remove_lock $vm_path $vm_name $vm_uuid $vm_host
+        ;;
+    status )
+	[ -z "$vm_path" ] && usage
+        get_status $vm_path
+	;;
+esac
Index: xen-4.4.0-testing/tools/hotplug/Linux/vm-monitor
===================================================================
--- /dev/null
+++ xen-4.4.0-testing/tools/hotplug/Linux/vm-monitor
@@ -0,0 +1,41 @@
+#!/bin/bash
+
+basedir=$(dirname "$0")
+HA_TICK=2
+
+monitor() {
+	local path=$1
+	local name=$2
+	local uuid=$3
+	local host=$4
+	local count=0
+	path=$path/lock
+
+    while :
+    do
+		echo "name=$name uuid=$uuid host=$host count=$count" > $path
+		count=$(($count+1))
+		sleep $HA_TICK
+    done&
+}
+
+create_lock() {
+	local path=$1/lock
+	local rc=0
+
+        [ -f $path ] || touch $path
+        flock -x -w $HA_TICK $path $basedir/vm-monitor $*
+	rc=$?
+	if [ $rc -eq 1 ]; then
+    		echo `cat $path`
+		exit 1
+	else
+		exit $rc
+	fi
+}
+
+if [ $0 = "$basedir/set-lock" ]; then
+	create_lock $*
+elif [ $0 = "$basedir/vm-monitor" ]; then
+	monitor $*
+fi
Index: xen-4.4.0-testing/tools/python/xen/xend/XendCheckpoint.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendCheckpoint.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendCheckpoint.py
@@ -141,6 +141,11 @@ def save(fd, dominfo, network, live, dst
                ]
         log.debug("[xc_save]: %s", string.join(cmd))
 
+        # It is safe to release the domain lock at this point if not
+        # checkpointing
+        if checkpoint == False:
+            dominfo.release_running_lock(domain_name)
+
         def saveInputHandler(line, tochild):
             log.debug("In saveInputHandler %s", line)
             if line == "suspend":
@@ -205,6 +210,9 @@ def save(fd, dominfo, network, live, dst
         log.exception("Save failed on domain %s (%s) - resuming.", domain_name,
                       dominfo.getDomid())
         dominfo.resumeDomain()
+        # Reacquire the domain lock
+        if checkpoint == False:
+            dominfo.acquire_running_lock()
  
         try:
             dominfo.setName(domain_name)
@@ -371,6 +379,7 @@ def restore(xd, fd, dominfo = None, paus
         if not paused:
             dominfo.unpause()
 
+        dominfo.acquire_running_lock()
         return dominfo
     except Exception, exn:
         dominfo.destroy()
Index: xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendDomainInfo.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
@@ -498,6 +498,7 @@ class XendDomainInfo:
         if self._stateGet() in (XEN_API_VM_POWER_STATE_HALTED, XEN_API_VM_POWER_STATE_SUSPENDED, XEN_API_VM_POWER_STATE_CRASHED):
             try:
                 prepare_domain_pci_devices(self.info);
+                self.acquire_running_lock();
                 XendTask.log_progress(0, 30, self._constructDomain)
                 XendTask.log_progress(31, 60, self._initDomain)
                 
@@ -3071,6 +3072,11 @@ class XendDomainInfo:
 
             self._stateSet(DOM_STATE_HALTED)
             self.domid = None  # Do not push into _stateSet()!
+
+            try:
+                self.release_running_lock()
+            except:
+                log.exception("Failed to release domain lock.")
         finally:
             self.refresh_shutdown_lock.release()
 
@@ -4551,6 +4557,74 @@ class XendDomainInfo:
     def has_device(self, dev_class, dev_uuid):
         return (dev_uuid in self.info['%s_refs' % dev_class.lower()])
 
+    # Return name of host contained in lock file.
+    def get_lock_host(self, path):
+        fin = os.popen(xoptions.get_xend_domain_lock_utility() + \
+                       ' -s ' + path, 'r')
+        hostname = "unknown"
+
+        try:
+            tokens = fin.readline().split()
+            for token in tokens:
+                item = token.split('=')
+                if item[0] == 'host':
+                    hostname = item[1]
+            return hostname
+        finally:
+            fin.close()
+
+     # Acquire a lock for the domain.  No-op if domain locking is turned off.
+    def acquire_running_lock(self):
+        if not xoptions.get_xend_domain_lock():
+            return
+
+        log.debug("Acquiring lock for domain %s" % self.info['name_label'])
+        path = xoptions.get_xend_domain_lock_path()
+        path = os.path.join(path, self.get_uuid())
+
+        try:
+            if not os.path.exists(path):
+                mkdir.parents(path, stat.S_IRWXU)
+        except:
+            log.exception("%s could not be created." % path)
+            raise XendError("%s could not be created." % path)
+
+        status = os.system('%s -l -p %s -n %s -i %s %s' % \
+                           (xoptions.get_xend_domain_lock_utility(), \
+                            XendNode.instance().get_name(), \
+                            self.info['name_label'], \
+                            self.info['uuid'], \
+                            path))
+        if status != 0:
+            log.debug("Failed to aqcuire lock: status = %d" % status)
+            raise XendError("The VM is locked and appears to be running on host %s." % self.get_lock_host(path))
+
+    # Release lock for domain.  No-op if domain locking is turned off.
+    def release_running_lock(self, name = None):
+        if not xoptions.get_xend_domain_lock():
+            return
+
+        dom_name = self.info['name_label']
+        if name:
+            dom_name = name
+        log.debug("Releasing lock for domain %s" % dom_name)
+
+        path = xoptions.get_xend_domain_lock_path()
+        path = os.path.join(path, self.get_uuid())
+        status = os.system('%s -u -p %s -n %s -i %s %s' % \
+                           (xoptions.get_xend_domain_lock_utility(), \
+                            XendNode.instance().get_name(), \
+                            dom_name, \
+                            self.info['uuid'], \
+                            path))
+        if status != 0:
+            log.exception("Failed to release lock: status = %s" % status)
+        try:
+            if len(os.listdir(path)) == 0:
+                shutil.rmtree(path)
+        except:
+            log.exception("Failed to remove unmanaged directory %s." % path)
+
     def __str__(self):
         return '<domain id=%s name=%s memory=%s state=%s>' % \
                (str(self.domid), self.info['name_label'],
Index: xen-4.4.0-testing/tools/python/xen/xend/XendOptions.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendOptions.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendOptions.py
@@ -154,6 +154,17 @@ class XendOptions:
     use loose check automatically if necessary."""
     pci_dev_assign_strict_check_default = True
 
+    """Default for the flag indicating whether xend should create
+    a lock file for domains when they are started."""
+    xend_domain_lock = 'no'
+
+    """Default domain lock storage path."""
+    xend_domain_lock_path_default = '/var/lib/xen/images/vm_locks'
+
+    """Default script to acquire/release domain lock"""
+    xend_domain_lock_utility = auxbin.scripts_dir() + "/domain-lock"
+
+
     def __init__(self):
         self.configure()
 
@@ -401,6 +412,24 @@ class XendOptions:
         else:
             return None
 
+    def get_xend_domain_lock(self):
+        """Get the flag indicating whether xend should create a lock file
+        for domains when they are started."""
+        return self.get_config_bool("xend-domain-lock", self.xend_domain_lock)
+
+    def get_xend_domain_lock_path(self):
+        """ Get the path for domain lock storage
+        """
+        return self.get_config_string("xend-domain-lock-path", self.xend_domain_lock_path_default)
+
+    def get_xend_domain_lock_utility(self):
+        s = self.get_config_string('xend-domain-lock-utility')
+
+        if s:
+            return os.path.join(auxbin.scripts_dir(), s)
+        else:
+            return self.xend_domain_lock_utility
+
 
     def get_vnc_tls(self):
         return self.get_config_string('vnc-tls', self.xend_vnc_tls)
++++++ xend-domu-usb-controller.patch ++++++
Index: xen-4.4.0-testing/tools/python/xen/xend/XendConfig.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendConfig.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendConfig.py
@@ -1865,7 +1865,14 @@ class XendConfig(dict):
         ports = sxp.child(dev_sxp, 'port')
         for port in ports[1:]:
             try:
-                num, bus = port
+                # When ['port' ['1','']] is saved into sxp file, it will become (port (1 ))
+                # If using this sxp file, here variable "port" will be port=1,
+                # we should process it, otherwise, it will report error.
+                if len(port) == 1:
+                    num = port[0]
+                    bus = ""
+                else:
+                    num, bus = port
                 dev_config['port-%i' % int(num)] = str(bus)
             except TypeError:
                 pass
++++++ xend-fix-sendkey.patch ++++++
Index: xen-4.4.1-testing/tools/python/xen/xend/server/SrvDomain.py
===================================================================
--- xen-4.4.1-testing.orig/tools/python/xen/xend/server/SrvDomain.py
+++ xen-4.4.1-testing/tools/python/xen/xend/server/SrvDomain.py
@@ -78,7 +78,7 @@ class SrvDomain(SrvDir):
 
     def op_sysrq(self, _, req):
         self.acceptCommand(req)
-        return self.dom.send_sysrq(int(req.args['key'][0]))
+        return self.dom.send_sysrq(req.args['key'][0])
 
     def op_wait_for_devices(self, _, req):
         self.acceptCommand(req)
++++++ xend-hv_extid_compatibility.patch ++++++
Index: xen-4.4.0-testing/tools/python/xen/xend/XendConfig.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendConfig.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendConfig.py
@@ -161,6 +161,7 @@ XENAPI_PLATFORM_CFG_TYPES = {
     'nographic': int,
     'nomigrate': int,
     'pae' : int,
+    'extid': int,
     'rtc_timeoffset': int,
     'parallel': str,
     'serial': str,
@@ -522,6 +523,8 @@ class XendConfig(dict):
                 self['platform']['acpi_firmware'] = ""
             if 'timer_mode' not in self['platform']:
                 self['platform']['timer_mode'] = 1
+            if 'extid' in self['platform'] and int(self['platform']['extid']) == 1:
+                self['platform']['viridian'] = 1
             if 'viridian' not in self['platform']:
                 self['platform']['viridian'] = 0
             if 'rtc_timeoffset' not in self['platform']:
Index: xen-4.4.0-testing/tools/python/xen/xend/image.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/image.py
+++ xen-4.4.0-testing/tools/python/xen/xend/image.py
@@ -830,6 +830,7 @@ class HVMImageHandler(ImageHandler):
 
         self.apic = int(vmConfig['platform'].get('apic', 0))
         self.acpi = int(vmConfig['platform'].get('acpi', 0))
+        self.extid = int(vmConfig['platform'].get('extid', 0))
         self.guest_os_type = vmConfig['platform'].get('guest_os_type')
         self.memory_sharing = int(vmConfig['memory_sharing'])
         try:
Index: xen-4.4.0-testing/tools/python/xen/xm/create.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xm/create.py
+++ xen-4.4.0-testing/tools/python/xen/xm/create.py
@@ -242,6 +242,10 @@ gopts.var('viridian', val='VIRIDIAN',
           use="""Expose Viridian interface to x86 HVM guest?
           (Default is 0).""")
 
+gopts.var('extid', val='EXTID',
+          fn=set_int, default=0,
+          use="Specify extention ID for a HVM domain.")
+
 gopts.var('acpi', val='ACPI',
           fn=set_int, default=1,
           use="Disable or enable ACPI of HVM domain.")
@@ -1071,7 +1075,7 @@ def configure_hvm(config_image, vals):
              'timer_mode',
              'usb', 'usbdevice',
              'vcpus', 'vnc', 'vncconsole', 'vncdisplay', 'vnclisten',
-             'vncunused', 'viridian', 'vpt_align',
+             'vncunused', 'vpt_align',
              'watchdog', 'watchdog_action',
              'xauthority', 'xen_extended_power_mgmt', 'xen_platform_pci',
              'memory_sharing' ]
@@ -1081,6 +1085,10 @@ def configure_hvm(config_image, vals):
             config_image.append([a, vals.__dict__[a]])
     if vals.vncpasswd is not None:
         config_image.append(['vncpasswd', vals.vncpasswd])
+    if vals.extid and vals.extid == 1:
+        config_image.append(['viridian', vals.extid])
+    elif vals.viridian:
+        config_image.append(['viridian', vals.viridian])
 
 
 def make_config(vals):
++++++ xend-hvm-default-pae.patch ++++++
PAE must be on for 64-on-64 to work at all.

Index: xen-4.2.0-testing/tools/python/xen/xend/image.py
===================================================================
--- xen-4.2.0-testing.orig/tools/python/xen/xend/image.py
+++ xen-4.2.0-testing/tools/python/xen/xend/image.py
@@ -1038,7 +1038,7 @@ class X86_HVM_ImageHandler(HVMImageHandl
 
     def configure(self, vmConfig):
         HVMImageHandler.configure(self, vmConfig)
-        self.pae = int(vmConfig['platform'].get('pae',  0))
+        self.pae = int(vmConfig['platform'].get('pae',  1))
         self.vramsize = int(vmConfig['platform'].get('videoram',4)) * 1024
 
     def buildDomain(self):
++++++ xend-hvm-firmware-passthrough.patch ++++++
fate#313584: pass bios information to XEN HVM guest

Index: xen-4.4.0-testing/tools/python/xen/xm/create.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xm/create.py
+++ xen-4.4.0-testing/tools/python/xen/xm/create.py
@@ -473,6 +473,14 @@ gopts.var('nfs_root', val="PATH",
           fn=set_value, default=None,
           use="Set the path of the root NFS directory.")
 
+gopts.var('smbios_firmware', val='FILE',
+          fn=set_value, default=None,
+          use="Path to a file that contains extra SMBIOS firmware structures.")
+
+gopts.var('acpi_firmware', val='FILE',
+          fn=set_value, default=None,
+          use="Path to a file that contains extra ACPI firmware tables.")
+
 gopts.var('device_model', val='FILE',
           fn=set_value, default=None,
           use="Path to device model program.")
@@ -1048,6 +1056,7 @@ def configure_hvm(config_image, vals):
              'boot',
              'cpuid', 'cpuid_check',
              'device_model', 'display',
+             'smbios_firmware', 'acpi_firmware',
              'fda', 'fdb',
              'gfx_passthru', 'guest_os_type',
              'hap', 'hpet',
Index: xen-4.4.0-testing/tools/python/xen/xm/xenapi_create.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xm/xenapi_create.py
+++ xen-4.4.0-testing/tools/python/xen/xm/xenapi_create.py
@@ -1047,6 +1047,8 @@ class sxp2xml:
             'apic',
             'boot',
             'device_model',
+            'smbios_firmware',
+            'acpi_firmware',
             'loader',
             'fda',
             'fdb',
Index: xen-4.4.0-testing/tools/python/xen/xend/image.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/image.py
+++ xen-4.4.0-testing/tools/python/xen/xend/image.py
@@ -17,7 +17,7 @@
 #============================================================================
 
 
-import os, os.path, string
+import os, os.path, string, struct, stat
 import re
 import math
 import time
@@ -123,6 +123,8 @@ class ImageHandler:
 
         self.device_model = vmConfig['platform'].get('device_model')
 
+        self.smbios_firmware =(str(vmConfig['platform'].get('smbios_firmware')))
+        self.acpi_firmware =(str(vmConfig['platform'].get('acpi_firmware')))
         self.display = vmConfig['platform'].get('display')
         self.xauthority = vmConfig['platform'].get('xauthority')
         self.vncconsole = int(vmConfig['platform'].get('vncconsole', 0))
@@ -945,6 +947,38 @@ class HVMImageHandler(ImageHandler):
                              self.vm.getDomid() ])
         return args
 
+    def _readFirmwareFile(self, filename):
+        # Sanity check
+        if filename is None or filename.strip() == "":
+            size = struct.pack('i', int(0))
+            return size + ""
+
+        log.debug("Reading firmware file %s", filename)
+        # Open
+        try:
+            fd = os.open(filename, os.O_RDONLY)
+        except Exception, e:
+            raise VmError('Unable to open firmware file %s' % filename)
+
+        # Validate file size
+        statinfo = os.fstat(fd)
+        if statinfo.st_size == 0 or statinfo.st_size > sys.maxint:
+            os.close(fd)
+            raise VmError('Firmware file %s is an invalid size' % filename)
+        if not stat.S_ISREG(statinfo.st_mode):
+            os.close(fd)
+            raise VmError('Firmware file %s is an invalid file type' % filename)
+        size = struct.pack('i', statinfo.st_size)
+
+        # Read entire file
+        try:
+            buf = os.read(fd, statinfo.st_size)
+        except Exception, e:
+            os.close(fd)
+            raise VmError('Failed reading firmware file %s' % filename)
+        os.close(fd)
+        return size+buf
+
     def buildDomain(self):
         store_evtchn = self.vm.getStorePort()
 
@@ -960,6 +994,8 @@ class HVMImageHandler(ImageHandler):
         log.debug("vcpu_avail     = %li", self.vm.getVCpuAvail())
         log.debug("acpi           = %d", self.acpi)
         log.debug("apic           = %d", self.apic)
+        log.debug("smbios_firmware= %s", self.smbios_firmware)
+        log.debug("acpi_firmware  = %s", self.acpi_firmware)
 
         rc = xc.hvm_build(domid          = self.vm.getDomid(),
                           image          = self.loader,
@@ -968,7 +1004,9 @@ class HVMImageHandler(ImageHandler):
                           vcpus          = self.vm.getVCpuCount(),
                           vcpu_avail     = self.vm.getVCpuAvail(),
                           acpi           = self.acpi,
-                          apic           = self.apic)
+                          apic           = self.apic,
+                          smbios_firmware= self._readFirmwareFile(self.smbios_firmware),
+                          acpi_firmware  = self._readFirmwareFile(self.acpi_firmware))
         rc['notes'] = { 'SUSPEND_CANCEL': 1 }
 
         rc['store_mfn'] = xc.hvm_get_param(self.vm.getDomid(),
Index: xen-4.4.0-testing/tools/python/xen/xend/XendConfig.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendConfig.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendConfig.py
@@ -147,6 +147,8 @@ XENAPI_PLATFORM_CFG_TYPES = {
     'apic': int,
     'boot': str,
     'device_model': str,
+    'smbios_firmware': str,
+    'acpi_firmware': str,
     'loader': str,
     'display' : str,
     'fda': str,
@@ -514,6 +516,10 @@ class XendConfig(dict):
             self['platform']['nomigrate'] = 0
 
         if self.is_hvm():
+            if 'smbios_firmware' not in self['platform']:
+                self['platform']['smbios_firmware'] = ""
+            if 'acpi_firmware' not in self['platform']:
+                self['platform']['acpi_firmware'] = ""
             if 'timer_mode' not in self['platform']:
                 self['platform']['timer_mode'] = 1
             if 'viridian' not in self['platform']:
Index: xen-4.4.0-testing/tools/python/xen/lowlevel/xc/xc.c
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/lowlevel/xc/xc.c
+++ xen-4.4.0-testing/tools/python/xen/lowlevel/xc/xc.c
@@ -915,18 +915,23 @@ static PyObject *pyxc_hvm_build(XcObject
     uint32_t dom;
     struct hvm_info_table *va_hvm;
     uint8_t *va_map, sum;
-    int i;
-    char *image;
+    int i, datalen;
+    char *image, *smbios_str, *acpi_str;
     int memsize, target=-1, vcpus = 1, acpi = 0, apic = 1;
+    PyObject *acpi_firmware = NULL;
+    PyObject *smbios_firmware = NULL;
     PyObject *vcpu_avail_handle = NULL;
     uint8_t vcpu_avail[(HVM_MAX_VCPUS + 7)/8];
+    struct xc_hvm_build_args hvm_args = {};
 
     static char *kwd_list[] = { "domid",
                                 "memsize", "image", "target", "vcpus", 
-                                "vcpu_avail", "acpi", "apic", NULL };
-    if ( !PyArg_ParseTupleAndKeywords(args, kwds, "iis|iiOii", kwd_list,
+                                "vcpu_avail", "acpi", "apic",
+                                "smbios_firmware", "acpi_firmware", NULL };
+    if ( !PyArg_ParseTupleAndKeywords(args, kwds, "iis|iiOiiOO", kwd_list,
                                       &dom, &memsize, &image, &target, &vcpus,
-                                      &vcpu_avail_handle, &acpi, &apic) )
+                                      &vcpu_avail_handle, &acpi,
+                                      &apic, &smbios_firmware, &acpi_firmware) )
         return NULL;
 
     memset(vcpu_avail, 0, sizeof(vcpu_avail));
@@ -957,8 +962,38 @@ static PyObject *pyxc_hvm_build(XcObject
     if ( target == -1 )
         target = memsize;
 
-    if ( xc_hvm_build_target_mem(self->xc_handle, dom, memsize,
-                                 target, image) != 0 )
+    memset(&hvm_args, 0, sizeof(struct xc_hvm_build_args));
+    hvm_args.mem_size = (uint64_t)memsize << 20;
+    hvm_args.mem_target = (uint64_t)target << 20;
+    hvm_args.image_file_name = image;
+
+    if ( PyString_Check(smbios_firmware ) )
+    {
+        smbios_str = PyString_AsString(smbios_firmware);
+        if ( smbios_str )
+        {
+            datalen = *(int *)smbios_str;
+            if ( datalen ) {
+                hvm_args.smbios_module.data = &((uint8_t *)smbios_str)[4];
+                hvm_args.smbios_module.length = (uint32_t)datalen;
+            }
+        }
+    }
+
+    if ( PyString_Check(acpi_firmware ) )
+    {
+        acpi_str = PyString_AsString(acpi_firmware);
+        if (acpi_str)
+        {
+            datalen = *(int *)acpi_str;
+            if ( datalen ) {
+                hvm_args.acpi_module.data = &((uint8_t *)acpi_str)[4];
+                hvm_args.acpi_module.length = (uint32_t)datalen;
+            }
+        }
+    }
+
+    if ( xc_hvm_build(self->xc_handle, dom, &hvm_args) != 0 )
         return pyxc_error_to_exception(self->xc_handle);
 
     /* Fix up the HVM info table. */
Index: xen-4.4.0-testing/docs/man/xmdomain.cfg.pod.5
===================================================================
--- xen-4.4.0-testing.orig/docs/man/xmdomain.cfg.pod.5
+++ xen-4.4.0-testing/docs/man/xmdomain.cfg.pod.5
@@ -243,6 +243,25 @@ this the xen kernel must be compiled wit
 
 This defaults to 1, meaning running the domain as a UP.
 
+=item B
+
+Specify a path to a file that contains extra ACPI firmware tables to pass in to
+a guest. The file can contain several tables in their binary AML form
+concatenated together. Each table self describes its length so no additional
+information is needed. These tables will be added to the ACPI table set in the
+guest. Note that existing tables cannot be overridden by this feature. For
+example this cannot be used to override tables like DSDT, FADT, etc.
+
+=item B
+
+Specify a path to a file that contains extra SMBIOS firmware structures to pass
+in to a guest. The file can contain a set DMTF predefined structures which will
+override the internal defaults. Not all predefined structures can be overridden,
+only the following types: 0, 1, 2, 3, 11, 22, 39. The file can also contain any
+number of vendor defined SMBIOS structures (type 128 - 255). Since SMBIOS
+structures do not present their overall size, each entry in the file must be
+preceded by a 32b integer indicating the size of the next structure.
+
 =back
 
 =head1 DOMAIN SHUTDOWN OPTIONS
Index: xen-4.4.0-testing/tools/python/README.sxpcfg
===================================================================
--- xen-4.4.0-testing.orig/tools/python/README.sxpcfg
+++ xen-4.4.0-testing/tools/python/README.sxpcfg
@@ -51,6 +51,8 @@ image
   - vncunused
   (HVM)
   - device_model
+  - smbios_firmware
+  - acpi_firmware
   - display
   - xauthority
   - vncconsole
Index: xen-4.4.0-testing/tools/python/README.XendConfig
===================================================================
--- xen-4.4.0-testing.orig/tools/python/README.XendConfig
+++ xen-4.4.0-testing/tools/python/README.XendConfig
@@ -118,6 +118,8 @@ otherConfig
                                 image.vncdisplay
                                 image.vncunused
                                 image.hvm.device_model
+                                image.hvm.smbios_firmware
+                                image.hvm.apci_firmware
                                 image.hvm.display
                                 image.hvm.xauthority
                                 image.hvm.vncconsole
++++++ xend-managed-pci-device.patch ++++++
pci passthrough: handle managed pci devices

Handle managed pci devices for libvirt usage. If a pci device is set
"managed=1", it will be made assignable (unbound from original driver and bind
to pcistub driver) before vm start and reattach to original driver after vm
shut off.

FATE#313570

Note: This patch was rejected upstream since xend is deprecated.  See the
following thread for details

http://lists.xen.org/archives/html/xen-devel/2013-01/msg01145.html

Signed-off-by: Chunyan Liu 

Index: xen-4.4.0-testing/tools/python/xen/util/pci.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/util/pci.py
+++ xen-4.4.0-testing/tools/python/xen/util/pci.py
@@ -20,6 +20,8 @@ from xen.xend import sxp
 from xen.xend.XendConstants import AUTO_PHP_SLOT
 from xen.xend.XendSXPDev import dev_dict_to_sxp
 from xen.xend.XendLogging import log
+from xen.xend.xenstore.xstransact import xstransact
+from xen.xend.XendError import XendError
 
 # for 2.3 compatibility
 try:
@@ -27,9 +29,11 @@ try:
 except NameError:
     from sets import Set as set
 
+XS_PCIBACK_PATH = '/xm/pciback'
 PROC_PCI_PATH = '/proc/bus/pci/devices'
 PROC_PCI_NUM_RESOURCES = 7
 
+SYSFS_PCI_DRVS_PATH = 'bus/pci/drivers'
 SYSFS_PCI_DEVS_PATH = '/bus/pci/devices'
 SYSFS_PCI_DEV_RESOURCE_PATH = '/resource'
 SYSFS_PCI_DEV_CONFIG_PATH = '/config'
@@ -161,7 +165,7 @@ def PCI_BDF(domain, bus, slot, func):
 
 def check_pci_opts(opts):
     def f((k, v)):
-        if k not in ['msitranslate', 'power_mgmt'] or \
+        if k not in ['msitranslate', 'power_mgmt', 'managed'] or \
            not v.lower() in ['0', '1', 'yes', 'no']:
             raise PciDeviceParseError('Invalid pci option %s=%s: ' % (k, v))
 
@@ -427,6 +431,9 @@ def __pci_dict_to_fmt_str(fmt, dev):
 def pci_dict_to_bdf_str(dev):
     return __pci_dict_to_fmt_str('%04x:%02x:%02x.%01x', dev)
 
+def pci_dict_to_xs_bdf_str(dev):
+    return __pci_dict_to_fmt_str('%04x-%02x-%02x-%01x', dev)
+
 def pci_dict_to_xc_str(dev):
     return __pci_dict_to_fmt_str('0x%x, 0x%x, 0x%x, 0x%x', dev)
 
@@ -561,6 +568,115 @@ def find_all_assignable_devices():
         dev_list = dev_list + [dev]
     return dev_list
 
+def pci_assignable_add(dev):
+    '''detach pci device from driver that we need to unbind from and rebind
+       to pciback driver, then it can be assigned to guest.
+    '''
+    sysfs_mnt = find_sysfs_mnt()
+    pcidev_path = sysfs_mnt + SYSFS_PCI_DEVS_PATH
+    pciback_path = sysfs_mnt + SYSFS_PCIBACK_PATH
+
+    # See if the device exists
+    pci_bdf = pci_dict_to_bdf_str(dev)
+    path = pcidev_path + '/' + pci_bdf
+    if not os.path.exists(path):
+        log.debug("Pci device %s doesn't exist" % pci_bdf)
+        return -1
+
+    # Check to see if it's already assigned to pciback
+    path = pciback_path + '/' + pci_bdf
+    if os.path.exists(path):
+        log.debug("Pci device %s is already assigned to pciback" % pci_bdf)
+        return 0
+
+    # Check to see if there's already a driver that we need to unbind from
+    path = pcidev_path + '/' + pci_bdf + '/driver'
+    drv_path = None
+    if os.path.exists(path):
+        drv_path = os.path.realpath(path).replace(" ", "\ ")
+        cmd = 'echo %s > %s/unbind' % (pci_bdf, drv_path)
+        if os.system(cmd):
+            log.debug("Couldn't unbind device")
+            return -1;
+
+    # Store driver_path for rebinding to dom0
+    if drv_path is not None:
+        xs_pci_bdf = pci_dict_to_xs_bdf_str(dev)
+        path = XS_PCIBACK_PATH + '/' + xs_pci_bdf
+        xstransact.Mkdir(path)
+        xstransact.Write(path, 'driver_path', drv_path)
+    else:
+        log.debug("Not bound to a driver, will not be rebound")
+
+    # Bind to pciback
+    try:
+        # Scan through /sys/.../pciback/slots looking for pcidev's BDF
+        slots = os.popen('cat %s/slots' % pciback_path).read()
+        if re.search(pci_bdf, slots) is None:
+            # write bdf to new_slot
+            cmd = 'echo %s > %s/new_slot' % (pci_bdf, pciback_path)
+            if os.system(cmd):
+                raise XendError("Couldn't add device to pciback new_slot")
+
+        # Bind to pciback
+        cmd = 'echo %s > %s/bind' % (pci_bdf, pciback_path)
+        if os.system(cmd):
+            raise XendError("Couldn't bind device to pciback")
+    except XendError:
+        # rebind to original driver
+        if drv_path is not None:
+            log.debug("Rebind to original driver")
+            cmd = 'echo %s > %s/bind' % (pci_bdf, drv_path)
+            if os.system(cmd):
+                log.debug("Failed to rebind")
+        return -1
+
+    return 0
+
+def pci_assignable_remove(dev):
+    '''unbind pci device from pciback, and rebind to host pci driver where it
+       was detached from in pci-assignable-add.
+    '''
+    sysfs_mnt = find_sysfs_mnt()
+    pcidrv_path = sysfs_mnt + SYSFS_PCI_DRVS_PATH
+    pciback_path = sysfs_mnt + SYSFS_PCIBACK_PATH
+    pci_bdf = pci_dict_to_bdf_str(dev)
+
+    # Unbind from pciback
+    path = pciback_path + '/' + pci_bdf
+    if os.path.exists(path):
+        # unbind
+        cmd = 'echo %s > %s/unbind' % (pci_bdf, pciback_path)
+        if os.system(cmd):
+            log.debug("Couldn't unbind device to pciback")
+            return -1
+
+        # remove slots if necessary
+        slots = os.popen('cat %s/slots' % pciback_path).read()
+        if re.search(pci_bdf, slots):
+            # write bdf to remove_slot
+            cmd = 'echo %s > %s/remove_slot' % (pci_bdf, pciback_path)
+            if os.system(cmd):
+                log.debug("Couldn't remove pciback slot")
+                return -1
+    else:
+        log.debug("Not bound to pciback")
+
+    # Rebind if necessary
+    xs_pci_bdf = pci_dict_to_xs_bdf_str(dev)
+    path = XS_PCIBACK_PATH + '/' + xs_pci_bdf
+    drv_path = xstransact.Read(path, 'driver_path')
+    if drv_path:
+        cmd = 'echo %s > %s/bind' % (pci_bdf, drv_path)
+        if os.system(cmd):
+           log.debug("Couldn't rebind to driver %s" % drv_path)
+           return -1
+        xstransact.Remove(path)
+    else:
+        log.debug("Counldn't find path for original driver. Not rebinding")
+
+    return 0
+
 def transform_list(target, src):
     ''' src: its element is pci string (Format: xxxx:xx:xx.x).
         target: its element is pci string, or a list of pci string.
Index: xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendDomainInfo.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
@@ -305,7 +305,8 @@ def dom_get(dom):
     return None
 
 from xen.xend.server.pciif import parse_pci_name, PciDevice,\
-    get_assigned_pci_devices, get_all_assigned_pci_devices
+    get_assigned_pci_devices, get_all_assigned_pci_devices,\
+    prepare_host_pci_devices, reattach_host_pci_devices
 
 
 def do_FLR(domid, is_hvm):
@@ -319,6 +320,20 @@ def do_FLR(domid, is_hvm):
                     "parse it's resources - "+str(e))
         dev.do_FLR(is_hvm, xoptions.get_pci_dev_assign_strict_check())
 
+def prepare_domain_pci_devices(domconfig):
+    ordered_refs = domconfig.ordered_device_refs()
+    for dev_uuid in ordered_refs:
+        devclass, devconfig = domconfig['devices'][dev_uuid]
+        if devclass == 'pci':
+            prepare_host_pci_devices(devconfig)
+
+def reattach_domain_pci_devices(domconfig):
+    ordered_refs = domconfig.ordered_device_refs()
+    for dev_uuid in ordered_refs:
+        devclass, devconfig = domconfig['devices'][dev_uuid]
+        if devclass == 'pci':
+            reattach_host_pci_devices(devconfig)
+
 class XendDomainInfo:
     """An object represents a domain.
 
@@ -472,6 +487,7 @@ class XendDomainInfo:
 
         if self._stateGet() in (XEN_API_VM_POWER_STATE_HALTED, XEN_API_VM_POWER_STATE_SUSPENDED, XEN_API_VM_POWER_STATE_CRASHED):
             try:
+                prepare_domain_pci_devices(self.info);
                 XendTask.log_progress(0, 30, self._constructDomain)
                 XendTask.log_progress(31, 60, self._initDomain)
                 
@@ -498,6 +514,7 @@ class XendDomainInfo:
         state = self._stateGet()
         if state in (DOM_STATE_SUSPENDED, DOM_STATE_HALTED):
             try:
+                prepare_domain_pci_devices(self.info)
                 self._constructDomain()
 
                 try:
@@ -714,6 +731,8 @@ class XendDomainInfo:
         the device.
         """
 
+        if self.domid is None:
+            return
         self.iommu_check_pod_mode()
 
         # Test whether the devices can be assigned
@@ -853,6 +872,9 @@ class XendDomainInfo:
 
         if self.domid is not None:
             try:
+                if dev_type == 'pci':
+                    prepare_host_pci_devices(dev_config_dict)
+
                 dev_config_dict['devid'] = devid = \
                     self._createDevice(dev_type, dev_config_dict)
                 if dev_type == 'tap2':
@@ -866,6 +888,7 @@ class XendDomainInfo:
                 if dev_type == 'pci':
                     for dev in dev_config_dict['devs']:
                         XendAPIStore.deregister(dev['uuid'], 'DPCI')
+                    reattach_host_pci_devices(dev_config_dict)
                 elif dev_type == 'vscsi':
                     for dev in dev_config_dict['devs']:
                         XendAPIStore.deregister(dev['uuid'], 'DSCSI')
@@ -910,6 +933,10 @@ class XendDomainInfo:
         dev_config = pci_convert_sxp_to_dict(dev_sxp)
         dev = dev_config['devs'][0]
 
+        # For attach only. For boot, prepare work has been done already in earlier stage.
+        if self.domid is not None and pci_state == 'Initialising' and pci_sub_state != 'Booting':
+            prepare_host_pci_devices(dev_config)
+
         stubdomid = self.getStubdomDomid()
         # Do HVM specific processing
         if self.info.is_hvm():
@@ -986,6 +1013,9 @@ class XendDomainInfo:
                 new_dev_sxp = dev_control.configuration(devid)
                 self.info.device_update(dev_uuid, new_dev_sxp)
 
+            if pci_state == 'Closing':
+                reattach_host_pci_devices(dev_config)
+
             # If there is no device left, destroy pci and remove config.
             if num_devs == 0:
                 if self.info.is_hvm():
@@ -3175,6 +3205,7 @@ class XendDomainInfo:
                 log.debug("%s KiB need to add to Memory pool" %self.alloc_mem)
                 MemoryPool.instance().increase_memory(self.alloc_mem)
 
+        reattach_domain_pci_devices(self.info)
         self._cleanup_phantom_devs(paths)
         self._cleanupVm()
 
Index: xen-4.4.0-testing/tools/python/xen/xend/server/pciif.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/server/pciif.py
+++ xen-4.4.0-testing/tools/python/xen/xend/server/pciif.py
@@ -86,6 +86,48 @@ def get_all_assigned_pci_devices(domid =
             pci_str_list = pci_str_list + get_assigned_pci_devices(int(d))
     return pci_str_list
 
+def reattach_host_pci_devices(devconfig):
+    pci_dev_list = devconfig.get('devs', [])
+    for pci_dev in pci_dev_list:
+        managed = 0
+        pci_opts_config = pci_dev.get('opts', [])
+        for opt in pci_opts_config:
+            if opt[0] == 'managed':
+                managed = opt[1]
+        if managed:
+            if pci_assignable_remove(pci_dev) != 0:
+               raise VmError('pci_assignable_remove failed')
+
+def detach_host_pci_devices(devconfig):
+    pci_dev_list = devconfig.get('devs', [])
+    reattach = 0
+    for pci_dev in pci_dev_list:
+        managed = 0
+        pci_opts_config = pci_dev.get('opts', [])
+        for opt in pci_opts_config:
+            if opt[0] == 'managed':
+                managed = opt[1]
+        if managed:
+            if pci_assignable_add(pci_dev) != 0:
+                log.debug('pci_assignable_add failed')
+                reattach = 1
+                break
+
+    if reattach:
+        reattach_host_pci_devices(devconfig)
+        raise VmError('detach_host_pci_devices failed')
+
+def prepare_host_pci_devices(devconfig):
+    # Test whether the device used by other domain
+    pci_dev_list = devconfig.get('devs', [])
+    for pci_dev in pci_dev_list:
+        pci_name = pci_dict_to_bdf_str(pci_dev)
+        if pci_name in get_all_assigned_pci_devices():
+            raise VmError("failed to assign device %s that has"
+                          " already been assigned to other domain." % pci_name)
+    # Detach 'managed' devices
+    detach_host_pci_devices(devconfig)
+
 class PciController(DevController):
 
     def __init__(self, vm):
++++++ xend-max-free-mem.patch ++++++
Index: xen-4.4.1-testing/tools/python/xen/xend/XendNode.py
===================================================================
--- xen-4.4.1-testing.orig/tools/python/xen/xend/XendNode.py
+++ xen-4.4.1-testing/tools/python/xen/xend/XendNode.py
@@ -949,11 +949,35 @@ class XendNode:
 
         info['cpu_mhz'] = info['cpu_khz'] / 1000
         
-        # physinfo is in KiB, need it in MiB
-        info['total_memory'] = info['total_memory'] / 1024
-        info['free_memory']  = info['free_memory'] / 1024
+        configured_floor = xendoptions().get_dom0_min_mem() * 1024
+        from xen.xend import balloon
+        try:
+            kernel_floor = balloon.get_dom0_min_target()
+        except:
+            kernel_floor = 0
+        dom0_min_mem = max(configured_floor, kernel_floor)
+        dom0_mem = balloon.get_dom0_current_alloc()
+        extra_mem = 0
+        if dom0_min_mem > 0 and dom0_mem > dom0_min_mem:
+            extra_mem = dom0_mem - dom0_min_mem
+        info['free_memory']     = info['free_memory'] + info['scrub_memory']
+        info['max_free_memory'] = info['free_memory'] + extra_mem
         info['free_cpus'] = len(XendCPUPool.unbound_cpus())
 
+        # Convert KiB to MiB, rounding down to be conservative
+        info['total_memory']    = info['total_memory'] / 1024
+        info['free_memory']     = info['free_memory'] / 1024
+        info['max_free_memory'] = info['max_free_memory'] / 1024
+
+        # FIXME:  These are hard-coded to be the inverse of the getXenMemory
+        #         functions in image.py.  Find a cleaner way.
+        info['max_para_memory'] = info['max_free_memory'] - 4
+        if info['max_para_memory'] < 0:
+            info['max_para_memory'] = 0
+        info['max_hvm_memory'] = int((info['max_free_memory']-12) * (1-2.4/1024))
+        if info['max_hvm_memory'] < 0:
+            info['max_hvm_memory'] = 0
+
         ITEM_ORDER = ['nr_cpus',
                       'nr_nodes',
                       'cores_per_socket',
@@ -964,6 +988,9 @@ class XendNode:
                       'total_memory',
                       'free_memory',
                       'free_cpus',
+                      'max_free_memory',
+                      'max_para_memory',
+                      'max_hvm_memory',
                       ]
 
         if show_numa != 0:
Index: xen-4.4.1-testing/tools/python/xen/xend/balloon.py
===================================================================
--- xen-4.4.1-testing.orig/tools/python/xen/xend/balloon.py
+++ xen-4.4.1-testing/tools/python/xen/xend/balloon.py
@@ -43,6 +43,8 @@ SLEEP_TIME_GROWTH = 0.1
 # label actually shown in the PROC_XEN_BALLOON file.
 #labels = { 'current'      : 'Current allocation',
 #           'target'       : 'Requested target',
+#           'min-target'   : 'Minimum target',
+#           'max-target'   : 'Maximum target',
 #           'low-balloon'  : 'Low-mem balloon',
 #           'high-balloon' : 'High-mem balloon',
 #           'limit'        : 'Xen hard limit' }
@@ -69,6 +71,23 @@ def get_dom0_target_alloc():
         raise VmError('Failed to query target memory allocation of dom0.')
     return kb
 
+def get_dom0_min_target():
+    """Returns the minimum amount of memory (in KiB) that dom0 will accept."""
+
+    kb = _get_proc_balloon('min-target')
+    if kb == None:
+        raise VmError('Failed to query minimum target memory allocation of dom0.')
+    return kb
+
+def get_dom0_max_target():
+    """Returns the maximum amount of memory (in KiB) that is potentially
+    visible to dom0."""
+
+    kb = _get_proc_balloon('max-target')
+    if kb == None:
+        raise VmError('Failed to query maximum target memory allocation of dom0.')
+    return kb
+
 def free(need_mem, dominfo):
     """Balloon out memory from the privileged domain so that there is the
     specified required amount (in KiB) free.
Index: xen-4.4.1-testing/tools/python/xen/xend/XendDomainInfo.py
===================================================================
--- xen-4.4.1-testing.orig/tools/python/xen/xend/XendDomainInfo.py
+++ xen-4.4.1-testing/tools/python/xen/xend/XendDomainInfo.py
@@ -1477,6 +1477,27 @@ class XendDomainInfo:
         self.info['abort_if_busy'] = str(abort_if_busy)
         self.info['log_save_progress'] = str(log_save_progress)
 
+    def capAndSetMemoryTarget(self, target):
+        """Potentially lowers the requested target to the largest possible
+        value (i.e., caps it), and then sets the memory target of this domain
+        to that value.
+        @param target in MiB.
+        """
+        max_target = 0
+        if self.domid == 0:
+            try:
+                from balloon import get_dom0_max_target
+                max_target = get_dom0_max_target() / 1024
+            except:
+                # It's nice to cap the max at sane values, but harmless to set
+                # them high.  Carry on.
+                pass
+            if max_target and target > max_target:
+                log.debug("Requested memory target %d MiB; maximum reasonable is %d MiB.",
+                          target, max_target)
+                target = max_target
+        self.setMemoryTarget(target)
+
     def setMemoryTarget(self, target):
         """Set the memory target of this domain.
         @param target: In MiB.
Index: xen-4.4.1-testing/tools/python/xen/xend/server/SrvDomain.py
===================================================================
--- xen-4.4.1-testing.orig/tools/python/xen/xend/server/SrvDomain.py
+++ xen-4.4.1-testing/tools/python/xen/xend/server/SrvDomain.py
@@ -198,7 +198,7 @@ class SrvDomain(SrvDir):
 
 
     def op_mem_target_set(self, _, req):
-        return self.call(self.dom.setMemoryTarget,
+        return self.call(self.dom.capAndSetMemoryTarget,
                          [['target', 'int']],
                          req)
 
Index: xen-4.4.1-testing/tools/python/xen/xend/osdep.py
===================================================================
--- xen-4.4.1-testing.orig/tools/python/xen/xend/osdep.py
+++ xen-4.4.1-testing/tools/python/xen/xend/osdep.py
@@ -42,6 +42,8 @@ def _linux_balloon_stat_proc(label):
 
     xend2linux_labels = { 'current'      : 'Current allocation',
                           'target'       : 'Requested target',
+                          'min-target'   : 'Minimum target',
+                          'max-target'   : 'Maximum target',
                           'low-balloon'  : 'Low-mem balloon',
                           'high-balloon' : 'High-mem balloon',
                           'limit'        : 'Xen hard limit' }
++++++ xend-migration-bridge-check.patch ++++++
bnc#757525

Index: xen-4.2.0-testing/tools/python/xen/xend/server/netif.py
===================================================================
--- xen-4.2.0-testing.orig/tools/python/xen/xend/server/netif.py
+++ xen-4.2.0-testing/tools/python/xen/xend/server/netif.py
@@ -23,6 +23,7 @@
 import os
 import random
 import re
+import commands
 
 from xen.xend import XendOptions, sxp
 from xen.xend.server.DevController import DevController
@@ -101,6 +102,14 @@ class NetifController(DevController):
     def __init__(self, vm):
         DevController.__init__(self, vm)
 
+    def createDevice(self, config):
+        bridge = config.get('bridge')
+        if bridge is not None:
+            bridge_result = commands.getstatusoutput("/sbin/ifconfig %s" % bridge)
+            if bridge_result[0] != 0:
+                raise VmError('Network bridge does not exist: %s' % bridge)
+        DevController.createDevice(self, config)
+
     def getDeviceDetails(self, config):
         """@see DevController.getDeviceDetails"""
 
++++++ xend-migration-domname-fix.patch ++++++
setName() writes the new name to xenstore/Dompath too, so that those read
domname from xenstore (like 'virsh list') could get correct value.
2nd hunk prevents writing xenstore if not "checkpoint", otherwise, vm
destroyed but there is still VM entry in xenstore.

Signed-off-by: Chunyan Liu 
Index: xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendDomainInfo.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
@@ -1982,6 +1982,8 @@ class XendDomainInfo:
         self.info['name_label'] = name
         if to_store:
             self.storeVm("name", name)
+            if self.dompath:
+                self.storeDom("name", name)
 
     def getName(self):
         return self.info['name_label']
Index: xen-4.4.0-testing/tools/python/xen/xend/XendCheckpoint.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendCheckpoint.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendCheckpoint.py
@@ -190,7 +190,10 @@ def save(fd, dominfo, network, live, dst
             dominfo.destroy()
             dominfo.testDeviceComplete()
         try:
-            dominfo.setName(domain_name)
+            if checkpoint:
+                dominfo.setName(domain_name)
+            else:
+                dominfo.setName(domain_name, False)
         except VmError:
             # Ignore this.  The name conflict (hopefully) arises because we
             # are doing localhost migration; if we are doing a suspend of a
++++++ xend-minimum-restart-time.patch ++++++
References: bnc#661298

Index: xen-4.2.0-testing/tools/python/xen/xend/XendConstants.py
===================================================================
--- xen-4.2.0-testing.orig/tools/python/xen/xend/XendConstants.py
+++ xen-4.2.0-testing/tools/python/xen/xend/XendConstants.py
@@ -94,7 +94,7 @@ DOM_STATES_OLD = [
 SHUTDOWN_TIMEOUT = (60.0 * 5)
 
 """Minimum time between domain restarts in seconds."""
-MINIMUM_RESTART_TIME = 60
+MINIMUM_RESTART_TIME = 10
 
 RESTART_IN_PROGRESS = 'xend/restart_in_progress'
 DUMPCORE_IN_PROGRESS = 'xend/dumpcore_in_progress'
++++++ xend-multi-xvdp.patch ++++++
Allow multiple bootloader loopback devices

Starting several domains concurrently can fail due to using a single
bootloader loopback device.  This patch creates a list of bootloader
loopback devices so more than one instance of bootloader can be run
concurrently.

Index: xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendDomainInfo.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
@@ -76,7 +76,7 @@ from xen.xend.XendPSCSI import XendPSCSI
 from xen.xend.XendDSCSI import XendDSCSI, XendDSCSI_HBA
 
 MIGRATE_TIMEOUT = 30.0
-BOOTLOADER_LOOPBACK_DEVICE = '/dev/xvdp'
+BOOTLOADER_LOOPBACK_DEVICES = ['/dev/xvd' + chr(x) for x in range(ord('z'), ord('d'), -1)]
 
 xc = xen.lowlevel.xc.xc()
 xoptions = XendOptions.instance()
@@ -3343,33 +3343,38 @@ class XendDomainInfo:
                 # This is a file, not a device.  pygrub can cope with a
                 # file if it's raw, but if it's QCOW or other such formats
                 # used through blktap, then we need to mount it first.
-
-                log.info("Mounting %s on %s." %
-                         (fn, BOOTLOADER_LOOPBACK_DEVICE))
-
-                vbd = {
-                    'mode': 'RW',
-                    'device': BOOTLOADER_LOOPBACK_DEVICE,
-                    }
-
-                from xen.xend import XendDomain
-                dom0 = XendDomain.instance().privilegedDomain()
-                mounted_vbd_uuid = dom0.create_vbd(vbd, disk);
-                vbd_uuid = dom0.create_vbd(vbd, disk)
-                dom0._waitForDeviceFrontUUID(vbd_uuid)
-                fn = BOOTLOADER_LOOPBACK_DEVICE
-
+                # Try all possible loopback_devices
+                for loopback_device in BOOTLOADER_LOOPBACK_DEVICES:
+                    log.info("Mounting %s on %s." % (fn, loopback_device))
+                    vbd = { 'mode' : 'RW', 'device' : loopback_device, }
+                    try:
+                        from xen.xend import XendDomain
+                        dom0 = XendDomain.instance().privilegedDomain()
+                        mounted_vbd_uuid = dom0.create_vbd(vbd, disk)
+                        dom0._waitForDeviceFrontUUID(mounted_vbd_uuid)
+                        fn = loopback_device
+                        break
+                    except VmError, e:
+                        if str(e).find('already connected.') != -1:
+                            continue
+                        elif str(e).find('isn\'t accessible') != -1:
+                            dom0.destroyDevice('vbd', loopback_device, force = True, rm_cfg = True)
+                            continue
+                        else:
+                            raise
+                else:
+                    raise
             try:
                 blcfg = bootloader(blexec, fn, self, False,
                                    bootloader_args, kernel, ramdisk, args)
             finally:
                 if mounted:
                     log.info("Unmounting %s from %s." %
-                             (fn, BOOTLOADER_LOOPBACK_DEVICE))
+                             (fn, loopback_device))
                     if devtype in ['tap', 'tap2']:
-                        dom0.destroyDevice('tap', BOOTLOADER_LOOPBACK_DEVICE, rm_cfg = True)
+                        dom0.destroyDevice('tap', loopback_device, rm_cfg = True)
                     else:
-                        dom0.destroyDevice('vbd', BOOTLOADER_LOOPBACK_DEVICE, rm_cfg = True)
+                        dom0.destroyDevice('vbd', loopback_device, rm_cfg = True)
             if blcfg is None:
                 msg = "Had a bootloader specified, but can't find disk"
                 log.error(msg)
++++++ xend-pvscsi-recognize-also-SCSI-CDROM-devices.patch ++++++
From: Olaf Hering 
Date: Tue, 11 Feb 2014 15:21:01 +0100
Subject: xend/pvscsi: recognize also SCSI CDROM devices

Attaching a CDROM device with 'xm scsi-attach domU /dev/sr0 0:0:0:0'
fails because for some reason the sr driver was not handled at all in
the match list. With the change the above command succeeds and the
device is attached.

Signed-off-by: Olaf Hering 
---
 tools/python/xen/util/vscsi_util.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tools/python/xen/util/vscsi_util.py b/tools/python/xen/util/vscsi_util.py
--- a/tools/python/xen/util/vscsi_util.py
+++ b/tools/python/xen/util/vscsi_util.py
@@ -66,6 +66,9 @@ def _vscsi_get_hctl_by(phyname, scsi_devices):
     if re.match('/dev/sd[a-z]+([1-9]|1[0-5])?$', phyname):
         # sd driver
         name = re.sub('(^/dev/)|([1-9]|1[0-5])?$', '', phyname)
+    elif re.match('/dev/sr[0-9]+$', phyname):
+        # sr driver
+        name = re.sub('^/dev/', '', phyname)
     elif re.match('/dev/sg[0-9]+$', phyname):
         # sg driver
         name = re.sub('^/dev/', '', phyname)
++++++ xend-relocation-server.fw ++++++
## Name: Xend Relocation Server
## Description: Enables xend relocation service

TCP="8002 8003"
++++++ xend-relocation.sh ++++++
#!/bin/bash
#============================================================================
# xend-relocation
#
# Version = 1.0.3
# Date = 2007-09-14
#
# Maintainer(s) = Ron Terry - ron (at) pronetworkconsulting (dot) com
#
# The latest version can be found at:
#
#    http://pronetworkconsulting.com/linux/scripts/xend-relocation.html
#
# Description:
#
# This script is used to enable or disable the VM relocation (migration)
#  feature of xend.  It can be used to manage the local instance of xend
#  or both the local instance and instances of xend on the other machines
#  to/from which VMs can be relocated.
# To manage the instances of xend on other machines this script communicates
#  using ssh so it is recomended that if you use this feature you 
#  pre-distribute ssh keys between the servers.
#
# Depends on:
#
# Can use:           /etc/sysconfig/xend
#
# Usage:             xend-relocation (start|stop|status)
#                 or
#                    xend-relocation (on|off|status)
#
# Vars:
#
#  XEN_CONFIG_FILE
#
#  RELOCATION_NODELIST
#
#  MANAGE_ALL_RELOCATION_NODES
#
#  XEN_RELOCATION_PORT
#
#============================================================================

####  Read config files and set variables  ##################################

# If you source the /etc/sysconfig/xend file comment out the variables
#  being set in this script.

. /etc/sysconfig/xend

XEN_CONFIG_FILE="/etc/xen/xend-config.sxp"

####  Script Functions  #####################################################

usage(){
  echo ""
  echo "Usage:      xend-relocation {start|stop|status}" 
  echo "         or"
  echo "            xend-relocation {on|off|status}"
  echo ""
}

relocate_on() {
  for NODE in $RELOCATION_NODELIST
  do
    case $NODE in
      any)
        SSHCMD=""
        RELOCATION_NODELIST=""
      ;;
      *)
        if [ "$MANAGE_ALL_RELOCATION_NODES" = "true" ]
        then
          SSHCMD="ssh root@$NODE "
        else
          SSHCMD=""
        fi
      ;;
    esac

    $SSHCMD sed -i "s/^#(xend-relocation-server yes)/(xend-relocation-server yes)/g" $XEN_CONFIG_FILE
    $SSHCMD sed -i "s/^#(xend-relocation-server no)/(xend-relocation-server yes)/g" $XEN_CONFIG_FILE
    $SSHCMD sed -i "s/^#(xend-relocation-port [^)]*)/(xend-relocation-port $XEN_RELOCATION_PORT)/g" $XEN_CONFIG_FILE
    $SSHCMD sed -i "s/^(xend-relocation-hosts-allow \(.*\)/###(xend-relocation-hosts-allow \1/g" $XEN_CONFIG_FILE
    $SSHCMD sed -i "s/^#(xend-relocation-hosts-allow .*/(xend-relocation-hosts-allow \'$RELOCATION_NODELIST')/g" $XEN_CONFIG_FILE
    $SSHCMD rcxend restart

    if [ "$NODE" = "any" ] || [ "$MANAGE_ALL_RELOCATION_NODES" = "false" ]
    then
      exit 0
    fi
  done
}

relocate_off() {
  for NODE in $RELOCATION_NODELIST
  do
    case $NODE in
      any)
        SSHCMD=""
        RELOCATION_NODELIST=""
      ;;
      *)
        SSHCMD="ssh root@$NODE "
      ;;
    esac

    $SSHCMD sed -i "s/^(xend-relocation-server yes)/#(xend-relocation-server yes)/g" $XEN_CONFIG_FILE
    $SSHCMD sed -i "s/^(xend-relocation-port [^)]*)/#(xend-relocation-port $XEN_RELOCATION_PORT)/g" $XEN_CONFIG_FILE
    $SSHCMD sed -i "s/^(xend-relocation-hosts-allow .*/#(xend-relocation-hosts-allow \'$RELOCATION_NODELIST')/g" $XEN_CONFIG_FILE
    $SSHCMD rcxend restart

    if [ "$NODE" = "any" ] || [ "$MANAGE_ALL_RELOCATION_NODES" = "false" ]
    then
      exit 0
    fi
  done
}

relocate_status() {
  if grep -q "^(xend-relocation-server .*yes)" $XEN_CONFIG_FILE
  then
     ENABLED="yes"
  elif egrep -q "(^\(xend-relocation-server .*no\)|^#\(xend-relocation-server .*no\)|^#\(xend-relocation-server .*yes\))" $XEN_CONFIG_FILE
  then
    ENABLED="no"
  fi

  echo ""
  echo "Xend Relocation Server Enabled:                $ENABLED"
  echo ""
}

####  Script Body  ##########################################################

case $1 in
  on|ON|On|start)
    case $ENABLE_RELOCATION in
      true)
        relocate_on
      ;;
      false)
      ;;
    esac
    exit 0
  ;;
  off|OFF|Off|stop)
    relocate_off
    exit 0
  ;;
  status|STATUS|Status)
    relocate_status
    exit 0
  ;;
  *)
    usage
    exit 1
  ;;
esac
++++++ xend-remove-xm-deprecation-warning.patch ++++++
Index: xen-4.4.0-testing/tools/python/xen/xm/xm
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xm/xm
+++ xen-4.4.0-testing/tools/python/xen/xm/xm
@@ -4,17 +4,17 @@ import sys, os.path
 
 from xen.xm import main
 
-print >>sys.stderr, ("WARNING: xend/xm is deprecated.")
-
-if not os.path.exists("/var/run/xm-deprecation-long-warning"):
-    print >>sys.stderr, ("""
-xend is deprecated and scheduled for removal. Please migrate to another
-toolstack ASAP.
-
-See http://wiki.xen.org/wiki/Choice_of_Toolstacks for information on
-other alternatives, including xl which is designed to be a drop in
-replacement for xm (http://wiki.xen.org/wiki/XL).
-""")
-    open("/var/run/xm-deprecation-long-warning", "w").close()
+#print >>sys.stderr, ("WARNING: xend/xm is deprecated.")
+#
+#if not os.path.exists("/var/run/xm-deprecation-long-warning"):
+#    print >>sys.stderr, ("""
+#xend is deprecated and scheduled for removal. Please migrate to another
+#toolstack ASAP.
+#
+#See http://wiki.xen.org/wiki/Choice_of_Toolstacks for information on
+#other alternatives, including xl which is designed to be a drop in
+#replacement for xm (http://wiki.xen.org/wiki/XL).
+#""")
+#    open("/var/run/xm-deprecation-long-warning", "w").close()
 
 main.main(sys.argv)
++++++ xend-set-migration-constraints-from-cmdline.patch ++++++
...
From aa0cecb067ca6077c67cfc13f0ce31af7a3b72bb Mon Sep 17 00:00:00 2001
From: Olaf Hering 
Date: Mon, 10 Feb 2014 09:43:40 +0100
Subject: xend: set migration constraints from cmdline
xend part of required libxl change to tweak parameters of xc_domain_save

Add xm migrate --log_progress option. xc_domain_save does print progress
messages. These verbose messages are disabled per default to avoid flood
in xend.log. Sometimes it is helpful to see progress when migrating
large and busy guests. So add a new option to xm migrate to actually
enable the printing of progress messsages.

Print messages from xc_save with xc_report. Make use of xc_report in
xc_save to log also pid if some error occoured.

Signed-off-by: Olaf Hering 
---
 tools/libxc/xc_private.h                |  1 +
 tools/libxc/xenguest.h                  |  1 +
 tools/python/xen/xend/XendCheckpoint.py | 22 +++++++++-
 tools/python/xen/xend/XendDomain.py     | 14 ++++++
 tools/python/xen/xend/XendDomainInfo.py | 16 +++++++
 tools/python/xen/xm/migrate.py          | 26 +++++++++++
 tools/xcutils/xc_save.c                 | 76 +++++++++++++++++++++------------
 7 files changed, 127 insertions(+), 29 deletions(-)

Index: xen-4.4.1-testing/tools/libxc/xc_private.h
===================================================================
--- xen-4.4.1-testing.orig/tools/libxc/xc_private.h
+++ xen-4.4.1-testing/tools/libxc/xc_private.h
@@ -119,6 +119,7 @@ void xc_report_progress_step(xc_interfac
 
 /* anamorphic macros:  struct xc_interface *xch  must be in scope */
 
+#define WPRINTF(_f, _a...) xc_report(xch, xch->error_handler, XTL_WARN,0, _f , ## _a)
 #define IPRINTF(_f, _a...) xc_report(xch, xch->error_handler, XTL_INFO,0, _f , ## _a)
 #define DPRINTF(_f, _a...) xc_report(xch, xch->error_handler, XTL_DETAIL,0, _f , ## _a)
 #define DBGPRINTF(_f, _a...) xc_report(xch, xch->error_handler, XTL_DEBUG,0, _f , ## _a)
Index: xen-4.4.1-testing/tools/libxc/xenguest.h
===================================================================
--- xen-4.4.1-testing.orig/tools/libxc/xenguest.h
+++ xen-4.4.1-testing/tools/libxc/xenguest.h
@@ -29,6 +29,7 @@
 #define XCFLAGS_STDVGA    (1 << 3)
 #define XCFLAGS_CHECKPOINT_COMPRESS    (1 << 4)
 #define XCFLAGS_DOMSAVE_ABORT_IF_BUSY  (1 << 5)
+#define XCFLAGS_PROGRESS  (1 << 6)
 
 #define X86_64_B_SIZE   64 
 #define X86_32_B_SIZE   32
Index: xen-4.4.1-testing/tools/python/xen/xend/XendCheckpoint.py
===================================================================
--- xen-4.4.1-testing.orig/tools/python/xen/xend/XendCheckpoint.py
+++ xen-4.4.1-testing/tools/python/xen/xend/XendCheckpoint.py
@@ -118,9 +118,27 @@ def save(fd, dominfo, network, live, dst
         # enabled. Passing "0" simply uses the defaults compiled into
         # libxenguest; see the comments and/or code in xc_linux_save() for
         # more information.
+        max_iters = dominfo.info.get('max_iters', "0")
+        max_factor = dominfo.info.get('max_factor', "0")
+        min_remaining = dominfo.info.get('min_remaining', "0")
+        abort_if_busy = dominfo.info.get('abort_if_busy', "0")
+        log_save_progress = dominfo.info.get('log_save_progress', "0")
+        if max_iters == "None":
+            max_iters = "0"
+        if max_factor == "None":
+            max_factor = "0"
+        if min_remaining == "None":
+            min_remaining = "0"
+        if abort_if_busy == "None":
+            abort_if_busy = "0"
+        if log_save_progress == "None":
+            log_save_progress = "0"
         cmd = [xen.util.auxbin.pathTo(XC_SAVE), str(fd),
-               str(dominfo.getDomid()), "0", "0", 
-               str(int(live) | (int(hvm) << 2)) ]
+               str(dominfo.getDomid()),
+               max_iters, max_factor,
+               str( int(live) | (int(hvm) << 2) | (int(abort_if_busy) << 5) | (int(log_save_progress) << 6) ),
+               min_remaining
+               ]
         log.debug("[xc_save]: %s", string.join(cmd))
 
         def saveInputHandler(line, tochild):
Index: xen-4.4.1-testing/tools/python/xen/xend/XendDomain.py
===================================================================
--- xen-4.4.1-testing.orig/tools/python/xen/xend/XendDomain.py
+++ xen-4.4.1-testing/tools/python/xen/xend/XendDomain.py
@@ -1832,6 +1832,20 @@ class XendDomain:
             log.exception(ex)
             raise XendError(str(ex))
 
+    def domain_migrate_constraints_set(self, domid, max_iters, max_factor, min_remaining, abort_if_busy, log_save_progress):
+        """Set the Migrate Constraints of this domain.
+        @param domid: Domain ID or Name
+        @param max_iters: Number of iterations before final suspend
+        @param max_factor: Max amount of memory to transfer before final suspend
+        @param min_remaining: Number of dirty pages before final suspend
+        @param abort_if_busy: Abort migration instead of doing final suspend
+        @param log_save_progress: Log progress of migrate to xend.log
+        """
+        dominfo = self.domain_lookup_nr(domid)
+        if not dominfo:
+            raise XendInvalidDomain(str(domid))
+        dominfo.setMigrateConstraints(max_iters, max_factor, min_remaining, abort_if_busy, log_save_progress)
+
     def domain_maxmem_set(self, domid, mem):
         """Set the memory limit for a domain.
 
Index: xen-4.4.1-testing/tools/python/xen/xend/XendDomainInfo.py
===================================================================
--- xen-4.4.1-testing.orig/tools/python/xen/xend/XendDomainInfo.py
+++ xen-4.4.1-testing/tools/python/xen/xend/XendDomainInfo.py
@@ -1461,6 +1461,22 @@ class XendDomainInfo:
         pci_conf = self.info['devices'][dev_uuid][1]
         return map(pci_dict_to_bdf_str, pci_conf['devs'])
 
+    def setMigrateConstraints(self, max_iters, max_factor, min_remaining, abort_if_busy, log_save_progress):
+        """Set the Migrate Constraints of this domain.
+        @param max_iters: Number of iterations before final suspend
+        @param max_factor: Max amount of memory to transfer before final suspend
+        @param min_remaining: Number of dirty pages before final suspend
+        @param abort_if_busy: Abort migration instead of doing final suspend
+        @param log_save_progress: Log progress of migrate to xend.log
+        """
+        log.debug("Setting migration constraints of domain %s (%s) to '%s' '%s' '%s' '%s'.",
+                  self.info['name_label'], str(self.domid), max_iters, max_factor, min_remaining, abort_if_busy)
+        self.info['max_iters'] = str(max_iters)
+        self.info['max_factor'] = str(max_factor)
+        self.info['min_remaining'] = str(min_remaining)
+        self.info['abort_if_busy'] = str(abort_if_busy)
+        self.info['log_save_progress'] = str(log_save_progress)
+
     def setMemoryTarget(self, target):
         """Set the memory target of this domain.
         @param target: In MiB.
Index: xen-4.4.1-testing/tools/python/xen/xm/migrate.py
===================================================================
--- xen-4.4.1-testing.orig/tools/python/xen/xm/migrate.py
+++ xen-4.4.1-testing/tools/python/xen/xm/migrate.py
@@ -55,6 +55,26 @@ gopts.opt('change_home_server', short='c
           fn=set_true, default=0,
           use="Change home server for managed domains.")
 
+gopts.opt('max_iters', val='max_iters',
+          fn=set_int, default=0,
+          use="Number of iterations before final suspend (default: 30).")
+
+gopts.opt('max_factor', val='max_factor',
+          fn=set_int, default=0,
+          use="Max amount of memory to transfer before final suspend (default: 3*RAM).")
+
+gopts.opt('min_remaining', val='min_remaining',
+          fn=set_int, default=0,
+          use="Number of dirty pages before final suspend (default: 50).")
+
+gopts.opt('abort_if_busy',
+          fn=set_true, default=0,
+          use="Abort migration instead of doing final suspend.")
+
+gopts.opt('log_progress',
+          fn=set_true, default=0,
+          use="Log progress of migration to xend.log")
+
 def help():
     return str(gopts)
     
@@ -80,6 +100,12 @@ def main(argv):
         server.xenapi.VM.migrate(vm_ref, dst, bool(opts.vals.live),
                                  other_config)
     else:
+        server.xend.domain.migrate_constraints_set(dom,
+                                                   opts.vals.max_iters,
+                                                   opts.vals.max_factor,
+                                                   opts.vals.min_remaining,
+                                                   opts.vals.abort_if_busy,
+                                                   opts.vals.log_progress)
         server.xend.domain.migrate(dom, dst, opts.vals.live,
                                    opts.vals.port,
                                    opts.vals.node,
Index: xen-4.4.1-testing/tools/xcutils/xc_save.c
===================================================================
--- xen-4.4.1-testing.orig/tools/xcutils/xc_save.c
+++ xen-4.4.1-testing/tools/xcutils/xc_save.c
@@ -7,6 +7,7 @@
  *
  */
 
+#include 
 #include 
 #include 
 #include 
@@ -19,6 +20,7 @@
 #include 
 #include 
 
+#include 
 #include 
 #include 
 #include 
@@ -51,16 +53,17 @@ static int compat_suspend(void)
  * receive the acknowledgement from the subscribe event channel. */
 static int evtchn_suspend(void)
 {
+    xc_interface *xch = si.xch;
     int rc;
 
     rc = xc_evtchn_notify(si.xce, si.suspend_evtchn);
     if (rc < 0) {
-        warnx("failed to notify suspend request channel: %d", rc);
+        WPRINTF("failed to notify suspend request channel: %d", rc);
         return 0;
     }
 
-    if (xc_await_suspend(si.xch, si.xce, si.suspend_evtchn) < 0) {
-        warnx("suspend failed");
+    if (xc_await_suspend(xch, si.xce, si.suspend_evtchn) < 0) {
+        WPRINTF("suspend failed");
         return 0;
     }
 
@@ -104,20 +107,27 @@ static int suspend(void* data)
 
 static int switch_qemu_logdirty(int domid, unsigned int enable, void *data)
 {
+    xc_interface *xch = si.xch;
     struct xs_handle *xs;
     char *path, *p, *ret_str, *cmd_str, **watch;
     unsigned int len;
     struct timeval tv;
     fd_set fdset;
 
-    if ((xs = xs_daemon_open()) == NULL)
-        errx(1, "Couldn't contact xenstore");
-    if (!(path = strdup("/local/domain/0/device-model/")))
-        errx(1, "can't get domain path in store");
+    if ((xs = xs_daemon_open()) == NULL) {
+        PERROR("Couldn't contact xenstore");
+        exit(1);
+    }
+    if (!(path = strdup("/local/domain/0/device-model/"))) {
+        PERROR("can't get domain path in store");
+        exit(1);
+    }
     if (!(path = realloc(path, strlen(path) 
                          + 10 
-                         + strlen("/logdirty/cmd") + 1)))
-        errx(1, "no memory for constructing xenstore path");
+                         + strlen("/logdirty/cmd") + 1))) {
+        PERROR("no memory for constructing xenstore path");
+        exit(1);
+    }
     snprintf(path + strlen(path), 11, "%i", domid);
     strcat(path, "/logdirty/");
     p = path + strlen(path);
@@ -126,16 +136,22 @@ static int switch_qemu_logdirty(int domi
     /* Watch for qemu's return value */
     strcpy(p, "ret");
     if (!xs_watch(xs, path, "qemu-logdirty-ret"))
-        errx(1, "can't set watch in store (%s)\n", path);
+    {
+        ERROR("can't set watch in store (%s)\n", path);
+        exit(1);
+    }
 
-    if (!(cmd_str = strdup( enable == 0 ? "disable" : "enable")))
-        errx(1, "can't get logdirty cmd path in store");
+    if (!(cmd_str = strdup( enable == 0 ? "disable" : "enable"))) {
+        PERROR("can't get logdirty cmd path in store");
+        exit(1);
+    }
 
     /* Tell qemu that we want it to start logging dirty page to Xen */
     strcpy(p, "cmd");
-    if (!xs_write(xs, XBT_NULL, path, cmd_str, strlen(cmd_str)))
-        errx(1, "can't write  to store path (%s)\n",
-             path);
+    if (!xs_write(xs, XBT_NULL, path, cmd_str, strlen(cmd_str))) {
+        PERROR("can't write  to store path (%s)\n", path);
+        exit(1);
+    }
 
     /* Wait a while for qemu to signal that it has service logdirty command */
  read_again:
@@ -144,8 +160,10 @@ static int switch_qemu_logdirty(int domi
     FD_ZERO(&fdset);
     FD_SET(xs_fileno(xs), &fdset);
 
-    if ((select(xs_fileno(xs) + 1, &fdset, NULL, NULL, &tv)) != 1)
-        errx(1, "timed out waiting for qemu logdirty response.\n");
+    if ((select(xs_fileno(xs) + 1, &fdset, NULL, NULL, &tv)) != 1) {
+        PERROR("timed out waiting for qemu logdirty response.\n");
+        exit(1);
+    }
 
     watch = xs_read_watch(xs, &len);
     free(watch);
@@ -166,53 +184,57 @@ static int switch_qemu_logdirty(int domi
 int
 main(int argc, char **argv)
 {
-    unsigned int maxit, max_f, lflags;
+    xc_interface *xch;
+    unsigned int maxit, max_f, lflags, min_r;
     int io_fd, ret, port;
     struct save_callbacks callbacks;
     xentoollog_level lvl;
     xentoollog_logger *l;
 
-    if (argc != 6)
-        errx(1, "usage: %s iofd domid maxit maxf flags", argv[0]);
+    if (argc != 7)
+        errx(1, "usage: %s iofd domid maxit maxf flags minr", argv[0]);
 
     io_fd = atoi(argv[1]);
     si.domid = atoi(argv[2]);
     maxit = atoi(argv[3]);
     max_f = atoi(argv[4]);
     si.flags = atoi(argv[5]);
+    min_r = atoi(argv[6]);
 
     si.suspend_evtchn = -1;
 
     lvl = si.flags & XCFLAGS_DEBUG ? XTL_DEBUG: XTL_DETAIL;
-    lflags = XTL_STDIOSTREAM_SHOW_PID | XTL_STDIOSTREAM_HIDE_PROGRESS;
+    lflags = XTL_STDIOSTREAM_SHOW_PID;
+    if (si.flags & XCFLAGS_PROGRESS)
+        lflags |= XTL_STDIOSTREAM_HIDE_PROGRESS;
     l = (xentoollog_logger *)xtl_createlogger_stdiostream(stderr, lvl, lflags);
-    si.xch = xc_interface_open(l, 0, 0);
+    xch = si.xch = xc_interface_open(l, 0, 0);
     if (!si.xch)
-        errx(1, "failed to open control interface");
+        errx(1, "[%lu] failed to open control interface", (unsigned long)getpid());
 
     si.xce = xc_evtchn_open(NULL, 0);
     if (si.xce == NULL)
-        warnx("failed to open event channel handle");
+        WPRINTF("failed to open event channel handle");
     else
     {
         port = xs_suspend_evtchn_port(si.domid);
 
         if (port < 0)
-            warnx("failed to get the suspend evtchn port\n");
+            WPRINTF("failed to get the suspend evtchn port\n");
         else
         {
             si.suspend_evtchn =
               xc_suspend_evtchn_init(si.xch, si.xce, si.domid, port);
 
             if (si.suspend_evtchn < 0)
-                warnx("suspend event channel initialization failed, "
+                WPRINTF("suspend event channel initialization failed, "
                        "using slow path");
         }
     }
     memset(&callbacks, 0, sizeof(callbacks));
     callbacks.suspend = suspend;
     callbacks.switch_qemu_logdirty = switch_qemu_logdirty;
-    ret = xc_domain_save(si.xch, io_fd, si.domid, maxit, max_f, si.flags, 
+    ret = xc_domain_save_suse(si.xch, io_fd, si.domid, maxit, max_f, min_r, si.flags,
                          &callbacks, !!(si.flags & XCFLAGS_HVM), 0);
 
     if (si.suspend_evtchn > 0)
Index: xen-4.4.1-testing/tools/python/xen/xend/server/SrvDomain.py
===================================================================
--- xen-4.4.1-testing.orig/tools/python/xen/xend/server/SrvDomain.py
+++ xen-4.4.1-testing/tools/python/xen/xend/server/SrvDomain.py
@@ -108,6 +108,17 @@ class SrvDomain(SrvDir):
                      ['reset',       'int']])
         return fn(req.args, {'dom': self.dom.domid})
 
+    def op_migrate_constraints_set(self, _, req):
+        self.acceptCommand(req)
+        fn = FormFn(self.xd.domain_migrate_constraints_set,
+                    [['dom',           'int'],
+                     ['max_iters',     'int'],
+                     ['max_factor',    'int'],
+                     ['min_remaining', 'int'],
+                     ['abort_if_busy', 'int'],
+                     ['log_progress',  'int']])
+        return fn(req.args, {'dom': self.dom.domid})
+
     def op_migrate(self, op, req):
         return req.threadRequest(self.do_migrate, op, req)
     
++++++ xend-tools-watchdog-support.patch ++++++
Index: xen-4.4.3-testing/tools/python/xen/xm/create.py
===================================================================
--- xen-4.4.3-testing.orig/tools/python/xen/xm/create.py
+++ xen-4.4.3-testing/tools/python/xen/xm/create.py
@@ -517,6 +517,21 @@ gopts.var('usbdevice', val='NAME',
           fn=set_value, default='',
           use="Name of USB device to add?")
 
+gopts.var('watchdog', val='NAME',
+          fn=set_value, default='',
+          use="Watchdog device to use. May be ib700 or i6300esb")
+
+gopts.var('watchdog_action', val='reset|shutdown|poweroff|pause|none|dump',
+          fn=set_value, default="reset",
+          use="""Action when watchdog timer expires:
+          - reset:     Default, forcefully reset the guest;
+          - shutdown:  Gracefully shutdown the guest (not recommended);
+          - poweroff:  Forcefully power off the guest;
+          - pause:     Pause the guest;
+          - none:      Do nothing;
+          - dump:      Automatically dump the guest;
+          """)
+
 gopts.var('description', val='NAME',
           fn=set_value, default='',
           use="Description of a domain")
@@ -1048,6 +1063,7 @@ def configure_hvm(config_image, vals):
              'usb', 'usbdevice',
              'vcpus', 'vnc', 'vncconsole', 'vncdisplay', 'vnclisten',
              'vncunused', 'viridian', 'vpt_align',
+             'watchdog', 'watchdog_action',
              'xauthority', 'xen_extended_power_mgmt', 'xen_platform_pci',
              'memory_sharing' ]
 
Index: xen-4.4.3-testing/tools/python/xen/xm/xenapi_create.py
===================================================================
--- xen-4.4.3-testing.orig/tools/python/xen/xm/xenapi_create.py
+++ xen-4.4.3-testing/tools/python/xen/xm/xenapi_create.py
@@ -1074,7 +1074,9 @@ class sxp2xml:
             'xen_platform_pci',
             'tsc_mode'
             'description',
-            'nomigrate'
+            'nomigrate',
+            'watchdog',
+            'watchdog_action'
         ]
 
         platform_configs = []
Index: xen-4.4.3-testing/tools/python/xen/xend/image.py
===================================================================
--- xen-4.4.3-testing.orig/tools/python/xen/xend/image.py
+++ xen-4.4.3-testing/tools/python/xen/xend/image.py
@@ -855,7 +855,8 @@ class HVMImageHandler(ImageHandler):
 
         dmargs = [ 'boot', 'fda', 'fdb', 'soundhw',
                    'localtime', 'serial', 'stdvga', 'isa',
-                   'acpi', 'usb', 'usbdevice', 'gfx_passthru' ]
+                   'acpi', 'usb', 'usbdevice', 'gfx_passthru',
+                   'watchdog', 'watchdog_action' ]
 
         for a in dmargs:
             v = vmConfig['platform'].get(a)
@@ -863,6 +864,7 @@ class HVMImageHandler(ImageHandler):
             # python doesn't allow '-' in variable names
             if a == 'stdvga': a = 'std-vga'
             if a == 'keymap': a = 'k'
+            if a == 'watchdog_action': a = 'watchdog-action'
 
             # Handle booleans gracefully
             if a in ['localtime', 'std-vga', 'isa', 'usb', 'acpi']:
Index: xen-4.4.3-testing/tools/python/xen/xend/XendConfig.py
===================================================================
--- xen-4.4.3-testing.orig/tools/python/xen/xend/XendConfig.py
+++ xen-4.4.3-testing/tools/python/xen/xend/XendConfig.py
@@ -192,6 +192,8 @@ XENAPI_PLATFORM_CFG_TYPES = {
     'xen_platform_pci': int,
     "gfx_passthru": int,
     'oos' : int,
+    'watchdog': str,
+    'watchdog_action': str,
 }
 
 # Xen API console 'other_config' keys.
Index: xen-4.4.3-testing/tools/libxl/libxl_dm.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl_dm.c
+++ xen-4.4.3-testing/tools/libxl/libxl_dm.c
@@ -266,6 +266,12 @@ static char ** libxl__build_device_model
                 }
             }
         }
+        if (b_info->u.hvm.watchdog || b_info->u.hvm.watchdog_action) {
+            flexarray_append(dm_args, "-watchdog");
+            if (b_info->u.hvm.watchdog_action) {
+                flexarray_vappend(dm_args, "-watchdog-action", b_info->u.hvm.watchdog_action, NULL);
+            }
+        }
         if (b_info->u.hvm.soundhw) {
             flexarray_vappend(dm_args, "-soundhw", b_info->u.hvm.soundhw, NULL);
         }
@@ -637,6 +643,12 @@ static char ** libxl__build_device_model
                 return NULL;
             }
         }
+        if (b_info->u.hvm.watchdog || b_info->u.hvm.watchdog_action) {
+            flexarray_append(dm_args, "-watchdog");
+            if (b_info->u.hvm.watchdog_action) {
+                flexarray_vappend(dm_args, "-watchdog-action", b_info->u.hvm.watchdog_action, NULL);
+            }
+        }
         if (b_info->u.hvm.soundhw) {
             flexarray_vappend(dm_args, "-soundhw", b_info->u.hvm.soundhw, NULL);
         }
Index: xen-4.4.3-testing/tools/libxl/libxl_types.idl
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl_types.idl
+++ xen-4.4.3-testing/tools/libxl/libxl_types.idl
@@ -377,6 +377,8 @@ libxl_domain_build_info = Struct("domain
                                        ("xen_platform_pci", libxl_defbool),
                                        ("usbdevice_list",   libxl_string_list),
                                        ("vendor_device",    libxl_vendor_device),
+                                       ("watchdog",         string),
+                                       ("watchdog_action",  string),
                                        ])),
                  ("pv", Struct(None, [("kernel", string),
                                       ("slack_memkb", MemKB),
Index: xen-4.4.3-testing/tools/libxl/xl_cmdimpl.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/xl_cmdimpl.c
+++ xen-4.4.3-testing/tools/libxl/xl_cmdimpl.c
@@ -1928,6 +1928,8 @@ skip_vfb:
         xlu_cfg_replace_string (config, "soundhw", &b_info->u.hvm.soundhw, 0);
         xlu_cfg_get_defbool(config, "xen_platform_pci",
                             &b_info->u.hvm.xen_platform_pci, 0);
+        xlu_cfg_replace_string (config, "watchdog", &b_info->u.hvm.watchdog, 0);
+        xlu_cfg_replace_string (config, "watchdog_action", &b_info->u.hvm.watchdog_action, 0);
 
         if(b_info->u.hvm.vnc.listen
            && b_info->u.hvm.vnc.display
++++++ xend-vcpu-affinity-fix.patch ++++++
Index: xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendDomainInfo.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
@@ -2806,7 +2806,10 @@ class XendDomainInfo:
                 from xen.xend import XendDomain
                 doms = XendDomain.instance().list('all')
                 for dom in filter (lambda d: d.domid != self.domid, doms):
-                    cpuinfo = dom.getVCPUInfo()
+                    try:
+                        cpuinfo = dom.getVCPUInfo()
+                    except:
+                        continue
                     for vcpu in sxp.children(cpuinfo, 'vcpu'):
                         if sxp.child_value(vcpu, 'online') == 0: continue
                         cpumap = list(sxp.child_value(vcpu,'cpumap'))
++++++ xend-vif-route-ifup.patch ++++++
---
 tools/examples/xend-config.sxp     |   20 ++++++++++++++++++++
 tools/hotplug/Linux/Makefile       |    2 +-
 tools/hotplug/Linux/vif-route-ifup |   34 ++++++++++++++++++++++++++++++++++
 3 files changed, 55 insertions(+), 1 deletion(-)

Index: xen-4.4.0-testing/tools/examples/xend-config.sxp
===================================================================
--- xen-4.4.0-testing.orig/tools/examples/xend-config.sxp
+++ xen-4.4.0-testing/tools/examples/xend-config.sxp
@@ -200,6 +200,26 @@
 #(network-script network-route)
 #(vif-script     vif-route)
 
+# SUSE users note:
+# If using a routed network configuration it is advised to NOT use
+# network-route and vif-route scripts but instead use sysconfig scripts
+# in dom0 and vif-route-ifup script to "connect" the domU vif to dom0.
+# Since this configuration requires a vif sysconfig script in dom0, a static
+# vif name must be used.  E.g. in dom0 the vif sysconfig script
+# (/etc/sysconfig/network/ifcfg-xen1.0) may contain
+#
+#    NAME='XEN vm 1 virtual interface 0'
+#    BOOTPROTO='static'
+#    STARTMODE='hotplug'
+#    ...
+#
+# The corresponding domain vif configuration would contain e.g.
+# vif=[ 'mac=00:16:3e:aa:bb:cc,script=vif-route-ifup,vifname=xen1.0', ]
+#
+# If the vif-route-ifup script will be used for all domains, it can be
+# set here as the default vif script, alleviating the need for
+# 'script=' in domain vif configuration.
+#(vif-script     vif-route-ifup)
 
 ## Use the following if network traffic is routed with NAT, as an alternative
 # to the settings for bridged networking given above.
Index: xen-4.4.0-testing/tools/hotplug/Linux/Makefile
===================================================================
--- xen-4.4.0-testing.orig/tools/hotplug/Linux/Makefile
+++ xen-4.4.0-testing/tools/hotplug/Linux/Makefile
@@ -11,7 +11,7 @@ XENCOMMONS_SYSCONFIG = init.d/sysconfig.
 
 # Xen script dir and scripts to go there.
 XEN_SCRIPTS = network-bridge vif-bridge
-XEN_SCRIPTS += network-route vif-route
+XEN_SCRIPTS += network-route vif-route vif-route-ifup
 XEN_SCRIPTS += network-nat vif-nat
 XEN_SCRIPTS += vif-openvswitch
 XEN_SCRIPTS += vif2
Index: xen-4.4.0-testing/tools/hotplug/Linux/vif-route-ifup
===================================================================
--- /dev/null
+++ xen-4.4.0-testing/tools/hotplug/Linux/vif-route-ifup
@@ -0,0 +1,34 @@
+#!/bin/bash
+#============================================================================
+# /etc/xen/vif-route-ifup
+#
+# Script for configuring a vif in routed mode.
+# The hotplugging system will call this script if it is specified either in
+# the device configuration given to Xend, or the default Xend configuration
+# in /etc/xen/xend-config.sxp.  If the script is specified in neither of those
+# places, then vif-bridge is the default.
+#
+# Usage:
+# vif-route-ifup (add|remove|online|offline)
+#
+# Environment vars:
+# dev         vif interface name (required).
+#============================================================================
+
+dir=$(dirname "$0")
+. "$dir/vif-common.sh"
+
+case "$command" in
+    online)
+        ifup ${dev}
+        ;;
+    offline)
+        do_without_error ifdown ${dev}
+        ;;
+esac
+
+log debug "Successful vif-route-ifup $command for ${dev}."
+if [ "$command" = "online" ]
+then
+  success
+fi
++++++ xend-xen-api-auth.patch ++++++
Index: xen-4.2.0-testing/tools/python/xen/xend/XendAuthSessions.py
===================================================================
--- xen-4.2.0-testing.orig/tools/python/xen/xend/XendAuthSessions.py
+++ xen-4.2.0-testing/tools/python/xen/xend/XendAuthSessions.py
@@ -84,7 +84,7 @@ class XendAuthSessions:
             # if PAM doesn't exist, let's ignore it
             return False
         
-        pam_auth.start("login")
+        pam_auth.start("xen-api")
         pam_auth.set_item(PAM.PAM_USER, username)
 
         def _pam_conv(auth, query_list, user_data = None):
++++++ xend-xen-domUloader.patch ++++++
Index: xen-4.4.0-testing/tools/python/xen/xend/server/DevController.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/server/DevController.py
+++ xen-4.4.0-testing/tools/python/xen/xend/server/DevController.py
@@ -592,6 +592,31 @@ class DevController:
             return (Missing, None)
 
 
+    def waitForFrontend(self, devid):
+        def frontendStatusCallback(statusPath, ev, result):
+            status = xstransact.Read(statusPath)
+            log.debug("frontendStatusCallback %s = %s" % (statusPath, status))
+            try:
+                status = int(status)
+                if status == xenbusState['Connected']:
+                    result['status'] = Connected
+                elif status == xenbusState['Closed']:
+                    result['status'] = Error
+                else:
+                    raise
+            except:
+                return 1
+            ev.set()
+            return 0
+        frontpath = self.frontendPath(devid)
+        statusPath = frontpath + '/state'
+        ev = Event()
+        result = { 'status': Timeout }
+        xswatch(statusPath, frontendStatusCallback, ev, result)
+        ev.wait(5)
+        return result['status']
+
+
     def backendPath(self, backdom, devid):
         """Construct backend path given the backend domain and device id.
 
Index: xen-4.4.0-testing/tools/python/xen/xend/XendBootloader.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendBootloader.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendBootloader.py
@@ -12,7 +12,7 @@
 # Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 #
 
-import os, select, errno, stat, signal, tty
+import os, select, errno, stat, signal, tty, time
 import random
 import shlex
 from xen.xend import sxp
@@ -38,8 +38,25 @@ def bootloader(blexec, disk, dom, quiet
         msg = "Bootloader isn't executable"
         log.error(msg)
         raise VmError(msg)
-    if not os.access(disk, os.R_OK):
-        msg = "Disk isn't accessible"
+
+    # domUloader requires '--entry=foo' in blargs, which is derived from
+    # 'bootargs' entry in domain configuration file.  Ensure it exists
+    # here so a reasonable error message can be returned.
+    if blexec.find('domUloader.py') != -1:
+        if blargs.find('entry') == -1:
+            msg = "domUloader requires specification of bootargs"
+            log.error(msg)
+            raise VmError(msg)
+
+    avail = False
+    for i in xrange(1, 500):
+        avail = os.access(disk, os.R_OK)
+        if avail:
+            break
+        time.sleep(.1)
+
+    if not avail:
+        msg = "Disk '%s' isn't accessible" % disk
         log.error(msg)
         raise VmError(msg)
 
Index: xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendDomainInfo.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
@@ -2401,6 +2401,10 @@ class XendDomainInfo:
         deviceClass, config = self.info['devices'].get(dev_uuid)
         self._waitForDevice(deviceClass, config['devid'])
 
+    def _waitForDeviceFrontUUID(self, dev_uuid):
+        deviceClass, config = self.info['devices'].get(dev_uuid)
+        self.getDeviceController(deviceClass).waitForFrontend(config['devid'])
+
     def _waitForDevice_destroy(self, deviceClass, devid, backpath):
         return self.getDeviceController(deviceClass).waitForDevice_destroy(
             devid, backpath)
@@ -3351,7 +3355,8 @@ class XendDomainInfo:
                 from xen.xend import XendDomain
                 dom0 = XendDomain.instance().privilegedDomain()
                 mounted_vbd_uuid = dom0.create_vbd(vbd, disk);
-                dom0._waitForDeviceUUID(mounted_vbd_uuid)
+                vbd_uuid = dom0.create_vbd(vbd, disk)
+                dom0._waitForDeviceFrontUUID(vbd_uuid)
                 fn = BOOTLOADER_LOOPBACK_DEVICE
 
             try:
@@ -3361,10 +3366,10 @@ class XendDomainInfo:
                 if mounted:
                     log.info("Unmounting %s from %s." %
                              (fn, BOOTLOADER_LOOPBACK_DEVICE))
-                    _, vbd_info = dom0.info['devices'][mounted_vbd_uuid]
-                    dom0.destroyDevice(dom0.getBlockDeviceClass(vbd_info['devid']), 
-                                       BOOTLOADER_LOOPBACK_DEVICE, force = True)
-
+                    if devtype in ['tap', 'tap2']:
+                        dom0.destroyDevice('tap', BOOTLOADER_LOOPBACK_DEVICE, rm_cfg = True)
+                    else:
+                        dom0.destroyDevice('vbd', BOOTLOADER_LOOPBACK_DEVICE, rm_cfg = True)
             if blcfg is None:
                 msg = "Had a bootloader specified, but can't find disk"
                 log.error(msg)
++++++ xend-xenapi-console-protocol.patch ++++++
Index: xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendDomainInfo.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
@@ -3964,6 +3964,14 @@ class XendDomainInfo:
             else:
                 config['mode'] = 'RW'
 
+        if dev_class == 'console':
+            if not config.has_key('protocol'):
+                con_type = config.get('type', '')
+                if con_type == 'vnc':
+                    config['protocol'] = 'rfb'
+                elif con_type == 'sdl':
+                    config['protocol'] = 'rdp'
+
         return config
 
     def get_dev_property(self, dev_class, dev_uuid, field):
++++++ xend-xenpaging.autostart.patch ++++++
# HG changeset patch
# Parent 659ee31faec91ac543578db7c9b2849fb7367419

xenpaging: xend: start xenpaging via config option

Start xenpaging via config option.

TODO: add libxl support
TODO: parse config values like 42K, 42M, 42G, 42%

Signed-off-by: Olaf Hering 

---
v5:
  use actmem=, xenpaging_file=, xenpaging_extra=
  add xm mem-swap-target

v4:
  add config option for pagefile directory
  add config option to enable debug
  add config option to set policy mru_size
  fail if chdir fails
  force self.xenpaging* variables to be strings because a xm new may turn some
  of them into type int and later os.execve fails with a TypeError

v3:
  decouple create/destroycreateXenPaging from _create/_removeDevices
  init xenpaging variable to 0 if xenpaging is not in config file to
  avoid string None coming from sxp file

v2:
  unlink logfile instead of truncating it.
  allows hardlinking for further inspection

---
 tools/examples/xmexample.hvm            |    9 +++
 tools/python/README.XendConfig          |    3 +
 tools/python/README.sxpcfg              |    3 +
 tools/python/xen/xend/XendConfig.py     |    9 +++
 tools/python/xen/xend/XendDomain.py     |   15 +++++
 tools/python/xen/xend/XendDomainInfo.py |   23 ++++++++
 tools/python/xen/xend/image.py          |   85 ++++++++++++++++++++++++++++++++
 tools/python/xen/xm/create.py           |   15 +++++
 tools/python/xen/xm/main.py             |   14 +++++
 tools/python/xen/xm/xenapi_create.py    |    3 +
 10 files changed, 179 insertions(+)

Index: xen-4.4.0-testing/tools/examples/xmexample.hvm
===================================================================
--- xen-4.4.0-testing.orig/tools/examples/xmexample.hvm
+++ xen-4.4.0-testing/tools/examples/xmexample.hvm
@@ -142,6 +142,15 @@ disk = [ 'file:/var/lib/xen/images/disk.
 # Device Model to be used
 device_model = 'qemu-dm'
 
+# the amount of memory in MiB for the guest
+#actmem=42
+
+# Optional: guest page file
+#xenpaging_file="/var/lib/xen/xenpaging/..paging"
+
+# Optional: extra cmdline options for xenpaging
+#xenpaging_extra=[ 'string', 'string' ]
+
 #-----------------------------------------------------------------------------
 # boot on floppy (a), hard disk (c), Network (n) or CD-ROM (d) 
 # default: hard disk, cd-rom, floppy
Index: xen-4.4.0-testing/tools/python/README.XendConfig
===================================================================
--- xen-4.4.0-testing.orig/tools/python/README.XendConfig
+++ xen-4.4.0-testing/tools/python/README.XendConfig
@@ -118,6 +118,9 @@ otherConfig
                                 image.vncdisplay
                                 image.vncunused
                                 image.hvm.device_model
+                                image.hvm.actmem
+                                image.hvm.xenpaging_file
+                                image.hvm.xenpaging_extra
                                 image.hvm.smbios_firmware
                                 image.hvm.apci_firmware
                                 image.hvm.display
Index: xen-4.4.0-testing/tools/python/README.sxpcfg
===================================================================
--- xen-4.4.0-testing.orig/tools/python/README.sxpcfg
+++ xen-4.4.0-testing/tools/python/README.sxpcfg
@@ -51,6 +51,9 @@ image
   - vncunused
   (HVM)
   - device_model
+  - actmem
+  - xenpaging_file
+  - xenpaging_extra
   - smbios_firmware
   - acpi_firmware
   - display
Index: xen-4.4.0-testing/tools/python/xen/xend/XendConfig.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendConfig.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendConfig.py
@@ -147,6 +147,9 @@ XENAPI_PLATFORM_CFG_TYPES = {
     'apic': int,
     'boot': str,
     'device_model': str,
+    'actmem': str,
+    'xenpaging_file': str,
+    'xenpaging_extra': str,
     'smbios_firmware': str,
     'acpi_firmware': str,
     'loader': str,
@@ -517,6 +520,12 @@ class XendConfig(dict):
             self['platform']['nomigrate'] = 0
 
         if self.is_hvm():
+            if 'actmem' not in self['platform']:
+                self['platform']['actmem'] = "0"
+            if 'xenpaging_file' not in self['platform']:
+                self['platform']['xenpaging_file'] = ""
+            if 'xenpaging_extra' not in self['platform']:
+                self['platform']['xenpaging_extra'] = []
             if 'smbios_firmware' not in self['platform']:
                 self['platform']['smbios_firmware'] = ""
             if 'acpi_firmware' not in self['platform']:
Index: xen-4.4.0-testing/tools/python/xen/xend/XendDomain.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendDomain.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendDomain.py
@@ -1849,6 +1849,21 @@ class XendDomain:
             raise XendInvalidDomain(str(domid))
         dominfo.setMigrateConstraints(max_iters, max_factor, min_remaining, abort_if_busy, log_save_progress)
 
+    def domain_swaptarget_set(self, domid, mem):
+        """Set the memory limit for a domain.
+
+        @param domid: Domain ID or Name
+        @type domid: int or string.
+        @param mem: memory limit (in MiB)
+        @type mem: int
+        @raise XendError: fail to set memory
+        @rtype: 0
+        """
+        dominfo = self.domain_lookup_nr(domid)
+        if not dominfo:
+            raise XendInvalidDomain(str(domid))
+        dominfo.setSwapTarget(mem)
+
     def domain_maxmem_set(self, domid, mem):
         """Set the memory limit for a domain.
 
Index: xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendDomainInfo.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
@@ -1549,6 +1549,17 @@ class XendDomainInfo:
                 target = max_target
         self.setMemoryTarget(target)
 
+    def setSwapTarget(self, target):
+        """Set the swap target of this domain.
+        @param target: In MiB.
+        """
+        log.debug("Setting swap target of domain %s (%s) to %d MiB.",
+                  self.info['name_label'], str(self.domid), target)
+
+        if self.domid > 0:
+            self.storeDom("memory/target-tot_pages", target * 1024)
+            self.info['platform']['actmem'] = str(target)
+
     def setMemoryTarget(self, target):
         """Set the memory target of this domain.
         @param target: In MiB.
@@ -2356,6 +2367,8 @@ class XendDomainInfo:
                  self.info['name_label'], self.domid, self.info['uuid'],
                  new_name, new_uuid)
         self._unwatchVm()
+        if self.image:
+            self.image.destroyXenPaging()
         self._releaseDevices()
         # Remove existing vm node in xenstore
         self._removeVm()
@@ -3035,6 +3048,9 @@ class XendDomainInfo:
 
             self._createDevices()
 
+            if self.image:
+                self.image.createXenPaging()
+
             self.image.cleanupTmpImages()
 
             self.info['start_time'] = time.time()
@@ -3059,6 +3075,8 @@ class XendDomainInfo:
         self.refresh_shutdown_lock.acquire()
         try:
             self.unwatchShutdown()
+            if self.image:
+                self.image.destroyXenPaging()
             self._releaseDevices()
             bootloader_tidy(self)
 
@@ -3143,6 +3161,7 @@ class XendDomainInfo:
         self.image = image.create(self, self.info)
         if self.image:
             self.image.createDeviceModel(True)
+            self.image.createXenPaging()
         self.console_port = console_port
         self._storeDomDetails()
         self._registerWatches()
@@ -3285,6 +3304,8 @@ class XendDomainInfo:
             # could also fetch a parsed note from xenstore
             fast = self.info.get_notes().get('SUSPEND_CANCEL') and 1 or 0
             if not fast:
+                if self.image:
+                    self.image.destroyXenPaging()
                 self._releaseDevices()
                 self.testDeviceComplete()
                 self.testvifsComplete()
@@ -3300,6 +3321,8 @@ class XendDomainInfo:
                 self._storeDomDetails()
 
                 self._createDevices()
+                if self.image:
+                    self.image.createXenPaging()
                 log.debug("XendDomainInfo.resumeDomain: devices created")
 
             xc.domain_resume(self.domid, fast)
Index: xen-4.4.0-testing/tools/python/xen/xend/image.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/image.py
+++ xen-4.4.0-testing/tools/python/xen/xend/image.py
@@ -122,6 +122,10 @@ class ImageHandler:
         self.vm.permissionsVm("image/cmdline", { 'dom': self.vm.getDomid(), 'read': True } )
 
         self.device_model = vmConfig['platform'].get('device_model')
+        self.actmem = str(vmConfig['platform'].get('actmem'))
+        self.xenpaging_file = str(vmConfig['platform'].get('xenpaging_file'))
+        self.xenpaging_extra = vmConfig['platform'].get('xenpaging_extra')
+        self.xenpaging_pid = None
 
         self.smbios_firmware =(str(vmConfig['platform'].get('smbios_firmware')))
         self.acpi_firmware =(str(vmConfig['platform'].get('acpi_firmware')))
@@ -394,6 +398,87 @@ class ImageHandler:
         sentinel_fifos_inuse[sentinel_path_fifo] = 1
         self.sentinel_path_fifo = sentinel_path_fifo
 
+    def createXenPaging(self):
+        if not self.vm.info.is_hvm():
+            return
+        if self.actmem == "0":
+            return
+        if self.xenpaging_pid:
+            return
+        xenpaging_bin = auxbin.pathTo("xenpaging")
+        args = [xenpaging_bin]
+        args = args + ([ "-f", "/var/lib/xen/xenpaging/%s.%d.paging" % (str(self.vm.info['name_label']), self.vm.getDomid())])
+        if self.xenpaging_extra:
+            args = args + (self.xenpaging_extra)
+        args = args + ([ "-d", "%d" % self.vm.getDomid()])
+        self.xenpaging_logfile = "/var/log/xen/xenpaging-%s.log" %  str(self.vm.info['name_label'])
+        logfile_mode = os.O_WRONLY|os.O_CREAT|os.O_APPEND|os.O_TRUNC
+        null = os.open("/dev/null", os.O_RDONLY)
+        try:
+            os.unlink(self.xenpaging_logfile)
+        except:
+            pass
+        logfd = os.open(self.xenpaging_logfile, logfile_mode, 0644)
+        sys.stderr.flush()
+        contract = osdep.prefork("%s:%d" % (self.vm.getName(), self.vm.getDomid()))
+        xenpaging_pid = os.fork()
+        if xenpaging_pid == 0: #child
+            try:
+                osdep.postfork(contract)
+                os.dup2(null, 0)
+                os.dup2(logfd, 1)
+                os.dup2(logfd, 2)
+                try:
+                    env = dict(os.environ)
+                    log.info("starting %s" % args)
+                    os.execve(xenpaging_bin, args, env)
+                except Exception, e:
+                    log.warn('failed to execute xenpaging: %s' % utils.exception_string(e))
+                    os._exit(126)
+            except:
+                log.warn("starting xenpaging failed")
+                os._exit(127)
+        else:
+            osdep.postfork(contract, abandon=True)
+            self.xenpaging_pid = xenpaging_pid
+            os.close(null)
+            os.close(logfd)
+        self.vm.storeDom("xenpaging/xenpaging-pid", self.xenpaging_pid)
+        self.vm.storeDom("memory/target-tot_pages", int(self.actmem) * 1024)
+
+    def destroyXenPaging(self):
+        if self.actmem == "0":
+            return
+        if self.xenpaging_pid:
+            try:
+                os.kill(self.xenpaging_pid, signal.SIGHUP)
+            except OSError, exn:
+                log.exception(exn)
+            for i in xrange(100):
+                try:
+                    (p, rv) = os.waitpid(self.xenpaging_pid, os.WNOHANG)
+                    if p == self.xenpaging_pid:
+                        break
+                except OSError:
+                    # This is expected if Xend has been restarted within
+                    # the life of this domain.  In this case, we can kill
+                    # the process, but we can't wait for it because it's
+                    # not our child. We continue this loop, and after it is
+                    # terminated make really sure the process is going away
+                    # (SIGKILL).
+                    pass
+                time.sleep(0.1)
+            else:
+                log.warning("xenpaging %d took more than 10s "
+                            "to terminate: sending SIGKILL" % self.xenpaging_pid)
+                try:
+                    os.kill(self.xenpaging_pid, signal.SIGKILL)
+                    os.waitpid(self.xenpaging_pid, 0)
+                except OSError:
+                    # This happens if the process doesn't exist.
+                    pass
+        self.xenpaging_pid = None
+
     def createDeviceModel(self, restore = False):
         if self.device_model is None:
             return
Index: xen-4.4.0-testing/tools/python/xen/xm/create.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xm/create.py
+++ xen-4.4.0-testing/tools/python/xen/xm/create.py
@@ -485,6 +485,18 @@ gopts.var('acpi_firmware', val='FILE',
           fn=set_value, default=None,
           use="Path to a file that contains extra ACPI firmware tables.")
 
+gopts.var('actmem', val='NUM',
+          fn=set_value, default='0',
+          use="Number of pages to swap.")
+
+gopts.var('xenpaging_file', val='PATH',
+          fn=set_value, default=None,
+          use="pagefile to use (optional)")
+
+gopts.var('xenpaging_extra', val='string1,string2',
+          fn=append_value, default=[],
+          use="additional args for xenpaging (optional)")
+
 gopts.var('device_model', val='FILE',
           fn=set_value, default=None,
           use="Path to device model program.")
@@ -1059,6 +1071,9 @@ def configure_hvm(config_image, vals):
     args = [ 'acpi', 'apic',
              'boot',
              'cpuid', 'cpuid_check',
+             'actmem',
+             'xenpaging_file',
+             'xenpaging_extra',
              'device_model', 'display',
              'smbios_firmware', 'acpi_firmware',
              'fda', 'fdb',
Index: xen-4.4.0-testing/tools/python/xen/xm/main.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xm/main.py
+++ xen-4.4.0-testing/tools/python/xen/xm/main.py
@@ -115,6 +115,8 @@ SUBCOMMAND_HELP = {
                      'Set the maximum amount reservation for a domain.'),
     'mem-set'     : ('<Domain> <Mem>',
                      'Set the current memory usage for a domain.'),
+    'mem-swap-target' : ('<Domain> <Mem>',
+                     'Set the memory usage for a domain.'),
     'migrate'     : ('<Domain> <Host>',
                      'Migrate a domain to another machine.'),
     'pause'       : ('<Domain>', 'Pause execution of a domain.'),
@@ -1590,6 +1592,17 @@ def xm_mem_set(args):
         mem_target = int_unit(args[1], 'm')
         server.xend.domain.setMemoryTarget(dom, mem_target)
 
+def xm_mem_swap_target(args):
+    arg_check(args, "mem-swap-target", 2)
+
+    dom = args[0]
+
+    if serverType == SERVER_XEN_API:
+        err("xenapi not supported")
+    else:
+        swap_target = int_unit(args[1], 'm')
+        server.xend.domain.swaptarget_set(dom, swap_target)
+
 def xm_usb_add(args):
     arg_check(args, "usb-add", 2)
     server.xend.domain.usb_add(args[0],args[1])
@@ -3796,6 +3809,7 @@ commands = {
     # memory commands
     "mem-max": xm_mem_max,
     "mem-set": xm_mem_set,
+    "mem-swap-target": xm_mem_swap_target,
     # cpu commands
     "vcpu-pin": xm_vcpu_pin,
     "vcpu-list": xm_vcpu_list,
Index: xen-4.4.0-testing/tools/python/xen/xm/xenapi_create.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xm/xenapi_create.py
+++ xen-4.4.0-testing/tools/python/xen/xm/xenapi_create.py
@@ -1046,6 +1046,9 @@ class sxp2xml:
             'acpi',
             'apic',
             'boot',
+            'actmem',
+            'xenpaging_file',
+            'xenpaging_extra',
             'device_model',
             'smbios_firmware',
             'acpi_firmware',
++++++ xend-xm-create-xflag.patch ++++++
Index: xen-4.4.0-testing/tools/python/xen/xm/create.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xm/create.py
+++ xen-4.4.0-testing/tools/python/xen/xm/create.py
@@ -36,7 +36,7 @@ from xen.xend.server.DevConstants import
 from xen.util import blkif
 from xen.util import vscsi_util
 import xen.util.xsm.xsm as security
-from xen.xm.main import serverType, SERVER_XEN_API, get_single_vm
+from xen.xm.main import serverType, SERVER_XEN_API, SERVER_LEGACY_XMLRPC, get_single_vm
 from xen.util import utils, auxbin
 from xen.util.pci import dev_dict_to_sxp, \
                          parse_pci_name_extended, PciDeviceParseError
@@ -1465,7 +1465,7 @@ def main(argv):
             except IOError, exn:
                 raise OptionError("Cannot read file %s: %s" % (config, exn[1]))
         
-        if serverType == SERVER_XEN_API:
+        if serverType == SERVER_XEN_API or serverType == SERVER_LEGACY_XMLRPC:
             from xen.xm.xenapi_create import sxp2xml
             sxp2xml_inst = sxp2xml()
             doc = sxp2xml_inst.convert_sxp_to_xml(config, transient=True)
@@ -1473,7 +1473,7 @@ def main(argv):
         if opts.vals.dryrun and not opts.is_xml:
             SXPPrettyPrint.prettyprint(config)
 
-        if opts.vals.xmldryrun and serverType == SERVER_XEN_API:
+        if opts.vals.xmldryrun:
             print doc.toprettyxml()
 
     if opts.vals.dryrun or opts.vals.xmldryrun:
Index: xen-4.4.0-testing/tools/python/xen/xend/XendAPIConstants.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendAPIConstants.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendAPIConstants.py
@@ -45,8 +45,10 @@ XEN_API_ON_NORMAL_EXIT = [
 XEN_API_ON_CRASH_BEHAVIOUR = [
     'destroy',
     'coredump_and_destroy',
+    'coredump_destroy',
     'restart',
     'coredump_and_restart',
+    'coredump_restart',
     'preserve',
     'rename_restart'
 ]
++++++ xend-xm-reboot-fix.patch ++++++
References: bnc#840997

Index: xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendDomainInfo.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendDomainInfo.py
@@ -435,7 +435,17 @@ class XendDomainInfo:
             if i != 0:
                 self.vmpath = self.vmpath + '-' + str(i)
             try:
-                if self._readVm("uuid"):
+                # On reboot, the old VM may not be completely gone causing
+                # duplicate VMs to appear one of which has '-1' appended to
+                # the uuid. This can lead to VM corruption.
+                timeout = 0
+                while timeout < 5:
+                    if self._readVm("uuid"):
+                        time.sleep(0.1)
+                        timeout += 1
+                    else:
+                        break
+                if timeout >= 5:
                     self.vmpath = None
                     i = i + 1
             except:
++++++ xend-xm-save-check-file.patch ++++++
Index: xen-4.4.0-testing/tools/python/xen/xend/XendAPI.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendAPI.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendAPI.py
@@ -1941,10 +1941,10 @@ class XendAPI(object):
                               bool(live), port, node, ssl, bool(chs))
         return xen_api_success_void()
 
-    def VM_save(self, _, vm_ref, dest, checkpoint):
+    def VM_save(self, _, vm_ref, dest, checkpoint, force):
         xendom = XendDomain.instance()
         xeninfo = xendom.get_vm_by_uuid(vm_ref)
-        xendom.domain_save(xeninfo.getDomid(), dest, checkpoint)
+        xendom.domain_save(xeninfo.getDomid(), dest, checkpoint, force)
         return xen_api_success_void()
 
     def VM_restore(self, _, src, paused):
Index: xen-4.4.0-testing/tools/python/xen/xend/XendDomain.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xend/XendDomain.py
+++ xen-4.4.0-testing/tools/python/xen/xend/XendDomain.py
@@ -1505,7 +1505,7 @@ class XendDomain:
                     pass
                 sock.close()
 
-    def domain_save(self, domid, dst, checkpoint=False):
+    def domain_save(self, domid, dst, checkpoint=False, force=False):
         """Start saving a domain to file.
 
         @param domid: Domain ID or Name
@@ -1521,6 +1521,9 @@ class XendDomain:
             if not dominfo:
                 raise XendInvalidDomain(str(domid))
 
+            if os.access(dst, os.F_OK) and not force:
+                raise XendError("Save file:%s exist!\n" % dst)
+
             if dominfo.getDomid() == DOM0_ID:
                 raise XendError("Cannot save privileged domain %s" % str(domid))
             if dominfo._stateGet() != DOM_STATE_RUNNING:
Index: xen-4.4.0-testing/tools/python/xen/xm/main.py
===================================================================
--- xen-4.4.0-testing.orig/tools/python/xen/xm/main.py
+++ xen-4.4.0-testing/tools/python/xen/xm/main.py
@@ -122,7 +122,7 @@ SUBCOMMAND_HELP = {
     'reset'       : ('<Domain>', 'Reset a domain.'),
     'restore'     : ('<CheckpointFile> [-p]',
                      'Restore a domain from a saved state.'),
-    'save'        : ('[-c] <Domain> <CheckpointFile>',
+    'save'        : ('[-c|-f] <Domain> <CheckpointFile>',
                      'Save a domain state to restore later.'),
     'shutdown'    : ('<Domain> [-waRH]', 'Shutdown a domain.'),
     'top'         : ('', 'Monitor a host and the domains in real time.'),
@@ -345,6 +345,7 @@ SUBCOMMAND_OPTIONS = {
     ),
     'save': (
        ('-c', '--checkpoint', 'Leave domain running after creating snapshot'),
+       ('-f', '--force', 'Force to overwrite exist file'),
     ),
     'restore': (
        ('-p', '--paused', 'Do not unpause domain after restoring it'),
@@ -868,18 +869,21 @@ def xm_event_monitor(args):
 
 def xm_save(args):
 
-    arg_check(args, "save", 2, 3)
+    arg_check(args, "save", 2, 4)
     
     try:
-        (options, params) = getopt.gnu_getopt(args, 'c', ['checkpoint'])
+        (options, params) = getopt.gnu_getopt(args, 'cf', ['checkpoint', 'force'])
     except getopt.GetoptError, opterr:
         err(opterr)
         usage('save')
 
     checkpoint = False
+    force = False
     for (k, v) in options:
         if k in ['-c', '--checkpoint']:
             checkpoint = True
+        if k in ['-f', '--force']:
+            force = True
 
     if len(params) != 2:
         err("Wrong number of parameters")
@@ -893,9 +897,9 @@ def xm_save(args):
         sys.exit(1)
         
     if serverType == SERVER_XEN_API:       
-        server.xenapi.VM.save(get_single_vm(dom), savefile, checkpoint)
+        server.xenapi.VM.save(get_single_vm(dom), savefile, checkpoint, force)
     else:
-        server.xend.domain.save(dom, savefile, checkpoint)
+        server.xend.domain.save(dom, savefile, checkpoint, force)
     
 def xm_restore(args):
     arg_check(args, "restore", 1, 2)
++++++ xend-xsa153.patch ++++++
References: bsc#951845 XSA-153 - This is the xend version
...
From 27593ec62bdad8621df910931349d964a6dbaa8c Mon Sep 17 00:00:00 2001
From: Ian Jackson 
Date: Wed, 21 Oct 2015 16:18:30 +0100
Subject: [PATCH XSA-153 v3] libxl: adjust PoD target by memory fudge, too
PoD guests need to balloon at least as far as required by PoD, or risk
crashing.  Currently they don't necessarily know what the right value
is, because our memory accounting is (at the very least) confusing.

Apply the memory limit fudge factor to the in-hypervisor PoD memory
target, too.  This will increase the size of the guest's PoD cache by
the fudge factor LIBXL_MAXMEM_CONSTANT (currently 1Mby).  This ensures
that even with a slightly-off balloon driver, the guest will be
stable even under memory pressure.

There are two call sites of xc_domain_set_pod_target that need fixing:

The one in libxl_set_memory_target is straightforward.

The one in xc_hvm_build_x86.c:setup_guest is more awkward.  Simply
setting the PoD target differently does not work because the various
amounts of memory during domain construction no longer match up.
Instead, we adjust the guest memory target in xenstore (but only for
PoD guests).

This introduces a 1Mby discrepancy between the balloon target of a PoD
guest at boot, and the target set by an apparently-equivalent `xl
mem-set' (or similar) later.  This approach is low-risk for a security
fix but we need to fix this up properly in xen.git#staging and
probably also in stable trees.

This is XSA-153.

Index: xen-4.4.3-testing/tools/python/xen/lowlevel/xc/xc.c
===================================================================
--- xen-4.4.3-testing.orig/tools/python/xen/lowlevel/xc/xc.c
+++ xen-4.4.3-testing/tools/python/xen/lowlevel/xc/xc.c
@@ -1678,7 +1678,8 @@ static PyObject *pyxc_domain_set_target_
     if (!PyArg_ParseTuple(args, "ii", &dom, &mem_kb))
         return NULL;
 
-    mem_pages = mem_kb / 4; 
+    /* bsc#951845 - CVE-2015-7972 XSA-153 */
+    mem_pages = (mem_kb + 1024) / 4;
 
     if (xc_domain_set_pod_target(self->xc_handle, dom, mem_pages,
 				 NULL, NULL, NULL) != 0)
Index: xen-4.4.3-testing/tools/python/xen/xend/XendDomainInfo.py
===================================================================
--- xen-4.4.3-testing.orig/tools/python/xen/xend/XendDomainInfo.py
+++ xen-4.4.3-testing/tools/python/xen/xend/XendDomainInfo.py
@@ -3056,6 +3056,10 @@ class XendDomainInfo:
             self.info['start_time'] = time.time()
 
             self._stateSet(DOM_STATE_RUNNING)
+
+            if self.pod_enabled:
+                # bsc#951845 - CVE-2015-7972 XSA-153
+                self.info['memory_dynamic_max'] = self.info['memory_dynamic_max'] - 1024
         except VmError, exn:
             log.exception("XendDomainInfo.initDomain: exception occurred")
             if self.image:
++++++ xend.service ++++++
[Unit]
Description=Xend - Starts and stops the Xen management daemon
Before=libvirtd.service libvirt-guests.service
ConditionPathExists=/proc/xen

[Service]
Type=forking
PIDFile=/var/run/xend.pid
Environment=HOME=/root
ExecStartPre=/bin/grep -q control_d /proc/xen/capabilities
ExecStart=/usr/sbin/xend start

[Install]
WantedBy=multi-user.target
++++++ xendomains.service ++++++
[Unit]
Description=Xendomains - start and stop Xen VMs on boot and shutdown
After=xencommons.service network.target
ConditionPathExists=/proc/xen

[Service]
Type=oneshot
RemainAfterExit=true
ExecStartPre=/bin/grep -q control_d /proc/xen/capabilities
ExecStart=-/etc/init.d/xendomains start
ExecStop=/etc/init.d/xendomains stop

[Install]
WantedBy=multi-user.target
++++++ xenpaging.doc.patch ++++++
---
 docs/misc/xenpaging.txt |   49 +++++++++++++++++++++++++++++++++---------------
 1 file changed, 34 insertions(+), 15 deletions(-)

Index: xen-4.2.0-testing/docs/misc/xenpaging.txt
===================================================================
--- xen-4.2.0-testing.orig/docs/misc/xenpaging.txt
+++ xen-4.2.0-testing/docs/misc/xenpaging.txt
@@ -22,22 +22,41 @@ functionality.
 
 Usage:
 
-Up to now xenpaging is not integrated into libxl/xend, so it has to be
-started manually for each guest.
+Up to now xenpaging is only integrated into xm/xend.
 
-Once the guest is running, run xenpaging with the guest_id and the path
-to the pagefile:
- 
- /usr/lib/xen/bin/xenpaging -f /path/to/page_file -d dom_id &
-
-Once xenpaging runs it needs a memory target, which is the memory
-footprint of the guest. This value (in KiB) must be written manually to
-xenstore. The following example sets the target to 512MB:
-
- xenstore-write /local/domain//memory/target-tot_pages $((1024*512))
-
-Now xenpaging tries to page-out as many pages to keep the overall memory
-footprint of the guest at 512MB.
+To enable xenpaging for a guest add the option 'actmem=' to the guests
+config file and run 'xm new ' to make the changes
+active. actmem= takes the amount of memory in MB which a guest is
+allowed to use at a given time. Everything above this limit will be
+paged out. This paging is transparent to the guest.
+
+Example:
+ memory=4096
+ actmem=1024
+In this example a guest gets the impression it has 4GB of memory and
+the guest OS has to configure itself for this amount of memory. But
+xenpaging will page-out 3072MB, leaving only 1024MB active at a time.
+
+At runtime the configured value of actmem= can be changed with the "xm
+mem-swap-target" command.
+ xm mem-swap-target  512
+
+Additional cmdline options for the xenpaging binary can be specified
+with the xenpaging_extra= config file option:
+
+ xenpaging_extra=[ '-f', '/dev/shm/pagefile-guest_name', '-v' ]
+
+To get a list of available options, run /usr/lib/xen/bin/xenpaging -h:
+
+  xenpaging [options] -f <pagefile> -d 
+
+options:
+ -d <domid>     --domain=<domid>         numerical domain_id of guest. This option is required.
+ -f <file>      --pagefile=<file>        pagefile to use. This option is required.
+ -m  --max_memkb=  maximum amount of memory to handle.
+ -r <num>       --mru_size=<num>         number of paged-in pages to keep in memory.
+ -v             --verbose                enable debug output.
+ -h             --help                   this output.
 
 Todo:
 - integrate xenpaging into libxl
++++++ xenpaging.qemu.flush-cache.patch ++++++
Subject: xenpaging/qemu-dm: add command to flush buffer cache.

Add support for a xenstore dm command to flush qemu's buffer cache.

qemu will just keep mapping pages and not release them, which causes problems
for the memory pager (since the page is mapped, it won't get paged out). When
the pager has trouble finding a page to page out, it asks qemu to flush its
buffer, which releases all the page mappings. This makes it possible to find
pages to swap out agian.

Already-Signed-off-by: Patrick Colp 
Signed-off-by: Olaf Hering 

---
 tools/qemu-xen-traditional-dir-remote/xenstore.c |    3 +++
 1 file changed, 3 insertions(+)

Index: xen-4.2.3-testing/tools/qemu-xen-traditional-dir-remote/xenstore.c
===================================================================
--- xen-4.2.3-testing.orig/tools/qemu-xen-traditional-dir-remote/xenstore.c
+++ xen-4.2.3-testing/tools/qemu-xen-traditional-dir-remote/xenstore.c
@@ -1020,6 +1020,9 @@ static void xenstore_process_dm_command_
         do_pci_add(par);
         free(par);
 #endif
+    } else if (!strncmp(command, "flush-cache", len)) {
+        fprintf(logfile, "dm-command: flush caches\n");
+        qemu_invalidate_map_cache();
     } else {
         fprintf(logfile, "dm-command: unknown command\"%*s\"\n", len, command);
     }
++++++ xl-check-for-libvirt-managed-domain.patch ++++++
Index: xen-4.4.0-testing/tools/libxl/xl.c
===================================================================
--- xen-4.4.0-testing.orig/tools/libxl/xl.c
+++ xen-4.4.0-testing/tools/libxl/xl.c
@@ -282,6 +282,32 @@ static void xl_ctx_free(void)
     }
 }
 
+/*
+  Return 0 if domain is managed by libvirt
+*/
+static int xl_lookup_libvirt_managed_domain(int argc, char **argv)
+{
+    uint32_t domid;
+    uint8_t *t_data;
+    char *domname;
+    int i, rc, t_len;
+
+    for (i=0; imodifies && !dryrun_only) {
+            if (!force_execution) {
+                if (!xl_lookup_libvirt_managed_domain(argc, argv)) {
+                    fprintf(stderr,
+"Warning: This domain is managed by libvirt. Using xl commands to modify this\n"
+"domain will result in errors when virsh or virt-manager is used.\n"
+"Please use only virsh or virt-manager to manage this domain.\n\n"
+"(This check can be overridden with the -f option.)\n"
+                            );
+                    ret = 1;
+                    goto xit;
+                }
+            }
             for (int i = 0; i < sizeof(locks)/sizeof(locks[0]); i++) {
                 if (!access(locks[i], F_OK) && !force_execution) {
                     fprintf(stderr,
++++++ xl-conf-default-bridge.patch ++++++
Index: xen-4.4.0-testing/tools/examples/xl.conf
===================================================================
--- xen-4.4.0-testing.orig/tools/examples/xl.conf
+++ xen-4.4.0-testing/tools/examples/xl.conf
@@ -30,7 +30,7 @@
 #vif.default.script="vif-bridge"
 
 # default bridge device to use with vif-bridge hotplug scripts
-#vif.default.bridge="xenbr0"
+vif.default.bridge="br0"
 
 # Reserve a claim of memory when launching a guest. This guarantees immediate
 # feedback whether the guest can be launched due to memory exhaustion
++++++ xl-coredump-file-location.patch ++++++
xl: change default dump directory

Upstream xl uses /var/xen/dump/ as the default directory for
domain core dumps.  This patch changes the path to the more
FHS-friendly location of /var/lib/xen/dump/, which was also
the path used in SLE11.

See bsc#900292
Index: xen-4.4.2-testing/tools/libxl/xl_cmdimpl.c
===================================================================
--- xen-4.4.2-testing.orig/tools/libxl/xl_cmdimpl.c
+++ xen-4.4.2-testing/tools/libxl/xl_cmdimpl.c
@@ -1826,7 +1826,7 @@ static int handle_domain_death(uint32_t
         char *corefile;
         int rc;
 
-        if (asprintf(&corefile, "/var/xen/dump/%s", d_config->c_info.name) < 0) {
+        if (asprintf(&corefile, "/var/lib/xen/dump/%s", d_config->c_info.name) < 0) {
             LOG("failed to construct core dump path");
         } else {
             LOG("dumping core to %s", corefile);
++++++ xmclone.sh ++++++
++++ 795 lines (skipped)

++++++ xmexample.disks ++++++
# A VM's disks can be stored in a variety of ways.
# Here are some examples:
disk = [
    # Block device
    'phy:/dev/hdb,xvda,w',
    # Raw format, accessed via loopback
    'file:/var/lib/xen/images/disk-example/disk0,xvdb,w',
    # Raw format, accessed via blocktap
    'tap:aio:/var/lib/xen/images/disk-example/disk0,xvdc,w',
    # QCOW format, accessed via blocktap
    'tap:qcow:/var/lib/xen/images/disk-example/disk0.qcow,xvdd,w',
    # NBD (network block device):  IP and port are separated by space
    'nbd:192.168.0.1 20004,xvde,w',
    # iSCSI:  The usual colon is replaced with '@'
    'iscsi:iqn.2006-09.de.suse@0ac47ee2-216e-452a-a341-a12624cd0225,xvdf,w',
    # Fibre Channel N_Port ID Virtualization
    'npiv:210400e08b80c40f,xvdg,w' ]


# Remaining settings for the example VM:
name="disk-example"
memory=512
vcpus=1
on_crash="destroy"
on_poweroff="destroy"
on_reboot="restart"
localtime=0
builder="linux"
bootloader="/usr/lib/xen/boot/domUloader.py"
bootargs="--entry=xvda2:/boot/vmlinuz-xen,/boot/initrd-xen"
vif=[ 'mac=00:16:3e:00:01:02,bridge=xenbr0' ]
vfb=['type=vnc,vncunused=1']
++++++ xmexample.domUloader ++++++
# This is a bootloader used to boot paravirtualized domains.  You can optionally
# plug in a different boot loader here, e.g., pygrub.  There is usually no
# reason to change this.  Don't explicitly specify kernel and ramdisk if you use
# a bootloader.
bootloader="/usr/lib/xen/boot/domUloader.py"

# The domUloader will pull the specified kernel and initrd out of the domU's
# disk, and use that to boot.  This is easier to manage, compared to manually
# keeping a copy of the kernel and initrd in sync in dom0's filesystem and
# pointing to them with the "kernel" and "ramdisk" parameters.  Syntax is
# "VDEV:KERNEL,INITRD", where VDEV is the block device (from domU's point of
# view) within which KERNEL and INITRD can be found.
bootentry = "hda1:/boot/vmlinuz-xen,/boot/initrd-xen"


# Remaining settings for the example VM:
name="domUloader-example"
memory=512
vcpus=1
on_crash="destroy"
on_poweroff="destroy"
on_reboot="restart"
localtime=0
builder="linux"
bootargs="--entry=xvda2:/boot/vmlinuz-xen,/boot/initrd-xen"
disk=[ 'file:/var/lib/xen/images/domUloader-example/disk0,xvda,w' ]
vif=[ 'mac=00:16:3e:00:01:02,bridge=xenbr0' ]
vfb=['type=vnc,vncunused=1']
++++++ xnloader.py ++++++
# NetWare-specific operations
#
# Copyright (c) 2013 Suse Linux Products.
# Author: Charles Arnold 
#
# This software may be freely redistributed under the terms of the GNU
# general public license.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.

# Binary patching of xnloader.sys
# For launching NetWare on Xen 4.2 and newer

import os, sys, base64

CODE_OFFSET=0x49F5
NUMBER_OF_CODE_BYTES=17
ORIGINAL_CODE="BA00080000C786FC1F0000FFFFFFFF31C9"
PATCHED_CODE="BAF8070000834C961CFFB9080000009090"
XNLOADER_SYS_MD5SUM="eb76cce2a2d45928ea2bf26e01430af2"

def patch_netware_loader(loader):
    """Open the given xnloader.sys file and patch the relevant code hunk."""

    # domUloader calls this with all kernels so perhaps this is not the NetWare loader
    md5sum_cmd = 'md5sum ' + loader
    p = os.popen(md5sum_cmd)
    sum = p.read().split()[0]
    p.close()
    if sum != XNLOADER_SYS_MD5SUM:
        return

    try:
        fd = os.open(loader, os.O_RDWR)
    except Exception, e:
        print >>sys.stderr, e
        raise

    # Validate minimum size for I/O
    stat = os.fstat(fd)
    if stat.st_size < CODE_OFFSET+NUMBER_OF_CODE_BYTES:
        os.close(fd)
        return

    # Seek to location of code hunk
    os.lseek(fd, CODE_OFFSET, os.SEEK_SET)

    # Read code bytes at offset
    buf = os.read(fd, NUMBER_OF_CODE_BYTES)

    code_as_hex = base64.b16encode(buf)
    if code_as_hex == ORIGINAL_CODE:
        # Seek back to start location of the code hunk
        os.lseek(fd, CODE_OFFSET, os.SEEK_SET)
        # Convert the PATCHED_CODE string to raw binary
        code_as_bin = base64.b16decode(PATCHED_CODE)
        # Write the patched code
        os.write(fd, code_as_bin)
    os.close(fd)

++++++ xsa140-qemut-1.patch ++++++
References: bsc#939712 XSA-140
...
From 5e0c290415b9d57077a86e70c8e6a058868334d3 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi 
Date: Wed, 15 Jul 2015 18:16:58 +0100
Subject: [PATCH 1/7] rtl8139: avoid nested ifs in IP header parsing
Transmit offload needs to parse packet headers.  If header fields have
unexpected values the offload processing is skipped.

The code currently uses nested ifs because there is relatively little
input validation.  The next patches will add missing input validation
and a goto label is more appropriate to avoid deep if statement nesting.

Signed-off-by: Stefan Hajnoczi 
---
 hw/rtl8139.c | 41 ++++++++++++++++++++++-------------------
 1 file changed, 22 insertions(+), 19 deletions(-)

Index: xen-4.4.2-testing/tools/qemu-xen-traditional-dir-remote/hw/rtl8139.c
===================================================================
--- xen-4.4.2-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/rtl8139.c
+++ xen-4.4.2-testing/tools/qemu-xen-traditional-dir-remote/hw/rtl8139.c
@@ -2113,26 +2113,30 @@ static int rtl8139_cplus_transmit_one(RT
             size_t   eth_payload_len  = 0;
 
             int proto = be16_to_cpu(*(uint16_t *)(saved_buffer + 12));
-            if (proto == ETH_P_IP)
+            if (proto != ETH_P_IP)
             {
-                DEBUG_PRINT(("RTL8139: +++ C+ mode has IP packet\n"));
+                goto skip_offload;
+            }
 
-                /* not aligned */
-                eth_payload_data = saved_buffer + ETH_HLEN;
-                eth_payload_len  = saved_size   - ETH_HLEN;
-
-                ip = (ip_header*)eth_payload_data;
-
-                if (IP_HEADER_VERSION(ip) != IP_HEADER_VERSION_4) {
-                    DEBUG_PRINT(("RTL8139: +++ C+ mode packet has bad IP version %d expected %d\n", IP_HEADER_VERSION(ip), IP_HEADER_VERSION_4));
-                    ip = NULL;
-                } else {
-                    hlen = IP_HEADER_LENGTH(ip);
-                    ip_protocol = ip->ip_p;
-                    ip_data_len = be16_to_cpu(ip->ip_len) - hlen;
-                }
+            DEBUG_PRINT(("RTL8139: +++ C+ mode has IP packet\n"));
+
+            /* not aligned */
+            eth_payload_data = saved_buffer + ETH_HLEN;
+            eth_payload_len  = saved_size   - ETH_HLEN;
+
+            ip = (ip_header*)eth_payload_data;
+
+            if (IP_HEADER_VERSION(ip) != IP_HEADER_VERSION_4) {
+                DEBUG_PRINT(("RTL8139: +++ C+ mode packet has bad IP version %d "
+                    "expected %d\n", IP_HEADER_VERSION(ip),
+                    IP_HEADER_VERSION_4));
+                goto skip_offload;
             }
 
+            hlen = IP_HEADER_LENGTH(ip);
+            ip_protocol = ip->ip_p;
+            ip_data_len = be16_to_cpu(ip->ip_len) - hlen;
+
             if (ip)
             {
                 if (txdw0 & CP_TX_IPCS)
@@ -2315,6 +2319,7 @@ static int rtl8139_cplus_transmit_one(RT
             }
         }
 
+skip_offload:
         /* update tally counter */
         ++s->tally_counters.TxOk;
 
++++++ xsa140-qemut-2.patch ++++++
References: bsc#939712 XSA-140
...
From 2d7d80e8dc160904fa7276cc05da26c062a50066 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi 
Date: Wed, 15 Jul 2015 18:16:59 +0100
Subject: [PATCH 2/7] rtl8139: drop tautologous if (ip) {...} statement
The previous patch stopped using the ip pointer as an indicator that the
IP header is present.  When we reach the if (ip) {...} statement we know
ip is always non-NULL.

Remove the if statement to reduce nesting.

Signed-off-by: Stefan Hajnoczi 
---
 hw/rtl8139.c | 305 +++++++++++++++++++++++++++----------------------------
 1 file changed, 151 insertions(+), 154 deletions(-)

Index: xen-4.4.2-testing/tools/qemu-xen-traditional-dir-remote/hw/rtl8139.c
===================================================================
--- xen-4.4.2-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/rtl8139.c
+++ xen-4.4.2-testing/tools/qemu-xen-traditional-dir-remote/hw/rtl8139.c
@@ -2137,187 +2137,184 @@ static int rtl8139_cplus_transmit_one(RT
             ip_protocol = ip->ip_p;
             ip_data_len = be16_to_cpu(ip->ip_len) - hlen;
 
-            if (ip)
+            if (txdw0 & CP_TX_IPCS)
             {
-                if (txdw0 & CP_TX_IPCS)
-                {
-                    DEBUG_PRINT(("RTL8139: +++ C+ mode need IP checksum\n"));
+                DEBUG_PRINT(("RTL8139: +++ C+ mode need IP checksum\n"));
 
-                    if (hleneth_payload_len) {/* min header length */
-                        /* bad packet header len */
-                        /* or packet too short */
-                    }
-                    else
-                    {
-                        ip->ip_sum = 0;
-                        ip->ip_sum = ip_checksum(ip, hlen);
-                        DEBUG_PRINT(("RTL8139: +++ C+ mode IP header len=%d checksum=%04x\n", hlen, ip->ip_sum));
-                    }
+                if (hleneth_payload_len) {/* min header length */
+                    /* bad packet header len */
+                    /* or packet too short */
                 }
-
-                if ((txdw0 & CP_TX_LGSEN) && ip_protocol == IP_PROTO_TCP)
+                else
                 {
-#if defined (DEBUG_RTL8139)
-                    int large_send_mss = (txdw0 >> 16) & CP_TC_LGSEN_MSS_MASK;
-#endif
-                    DEBUG_PRINT(("RTL8139: +++ C+ mode offloaded task TSO MTU=%d IP data %d frame data %d specified MSS=%d\n",
-                                 ETH_MTU, ip_data_len, saved_size - ETH_HLEN, large_send_mss));
-
-                    int tcp_send_offset = 0;
-                    int send_count = 0;
+                    ip->ip_sum = 0;
+                    ip->ip_sum = ip_checksum(ip, hlen);
+                    DEBUG_PRINT(("RTL8139: +++ C+ mode IP header len=%d checksum=%04x\n", hlen, ip->ip_sum));
+                }
+            }
 
-                    /* maximum IP header length is 60 bytes */
-                    uint8_t saved_ip_header[60];
+            if ((txdw0 & CP_TX_LGSEN) && ip_protocol == IP_PROTO_TCP)
+            {
+                int large_send_mss = (txdw0 >> 16) & CP_TC_LGSEN_MSS_MASK;
 
-                    /* save IP header template; data area is used in tcp checksum calculation */
-                    memcpy(saved_ip_header, eth_payload_data, hlen);
+                DEBUG_PRINT(("RTL8139: +++ C+ mode offloaded task TSO MTU=%d IP data %d frame data %d specified MSS=%d\n",
+                    ETH_MTU, ip_data_len, saved_size - ETH_HLEN, large_send_mss));
 
-                    /* a placeholder for checksum calculation routine in tcp case */
-                    uint8_t *data_to_checksum     = eth_payload_data + hlen - 12;
-                    //                    size_t   data_to_checksum_len = eth_payload_len  - hlen + 12;
+                int tcp_send_offset = 0;
+                int send_count = 0;
 
-                    /* pointer to TCP header */
-                    tcp_header *p_tcp_hdr = (tcp_header*)(eth_payload_data + hlen);
+                /* maximum IP header length is 60 bytes */
+                uint8_t saved_ip_header[60];
 
-                    int tcp_hlen = TCP_HEADER_DATA_OFFSET(p_tcp_hdr);
+                /* save IP header template; data area is used in tcp checksum calculation */
+                memcpy(saved_ip_header, eth_payload_data, hlen);
 
-                    /* ETH_MTU = ip header len + tcp header len + payload */
-                    int tcp_data_len = ip_data_len - tcp_hlen;
-                    int tcp_chunk_size = ETH_MTU - hlen - tcp_hlen;
+                /* a placeholder for checksum calculation routine in tcp case */
+                uint8_t *data_to_checksum     = eth_payload_data + hlen - 12;
+                //                    size_t   data_to_checksum_len = eth_payload_len  - hlen + 12;
 
-                    DEBUG_PRINT(("RTL8139: +++ C+ mode TSO IP data len %d TCP hlen %d TCP data len %d TCP chunk size %d\n",
-                                 ip_data_len, tcp_hlen, tcp_data_len, tcp_chunk_size));
+                /* pointer to TCP header */
+                tcp_header *p_tcp_hdr = (tcp_header*)(eth_payload_data + hlen);
 
-                    /* note the cycle below overwrites IP header data,
-                       but restores it from saved_ip_header before sending packet */
+                int tcp_hlen = TCP_HEADER_DATA_OFFSET(p_tcp_hdr);
 
-                    int is_last_frame = 0;
+                /* ETH_MTU = ip header len + tcp header len + payload */
+                int tcp_data_len = ip_data_len - tcp_hlen;
+                int tcp_chunk_size = ETH_MTU - hlen - tcp_hlen;
 
-                    for (tcp_send_offset = 0; tcp_send_offset < tcp_data_len; tcp_send_offset += tcp_chunk_size)
-                    {
-                        uint16_t chunk_size = tcp_chunk_size;
+                DEBUG_PRINT(("RTL8139: +++ C+ mode TSO IP data len %d TCP hlen %d TCP data len %d TCP chunk size %d\n",
+                             ip_data_len, tcp_hlen, tcp_data_len, tcp_chunk_size));
 
-                        /* check if this is the last frame */
-                        if (tcp_send_offset + tcp_chunk_size >= tcp_data_len)
-                        {
-                            is_last_frame = 1;
-                            chunk_size = tcp_data_len - tcp_send_offset;
-                        }
+                /* note the cycle below overwrites IP header data,
+                   but restores it from saved_ip_header before sending packet */
 
-                        DEBUG_PRINT(("RTL8139: +++ C+ mode TSO TCP seqno %08x\n", be32_to_cpu(p_tcp_hdr->th_seq)));
+                int is_last_frame = 0;
 
-                        /* add 4 TCP pseudoheader fields */
-                        /* copy IP source and destination fields */
-                        memcpy(data_to_checksum, saved_ip_header + 12, 8);
+                for (tcp_send_offset = 0; tcp_send_offset < tcp_data_len; tcp_send_offset += tcp_chunk_size)
+                {
+                    uint16_t chunk_size = tcp_chunk_size;
 
-                        DEBUG_PRINT(("RTL8139: +++ C+ mode TSO calculating TCP checksum for packet with %d bytes data\n", tcp_hlen + chunk_size));
+                    /* check if this is the last frame */
+                    if (tcp_send_offset + tcp_chunk_size >= tcp_data_len)
+                    {
+                        is_last_frame = 1;
+                        chunk_size = tcp_data_len - tcp_send_offset;
+                    }
 
-                        if (tcp_send_offset)
-                        {
-                            memcpy((uint8_t*)p_tcp_hdr + tcp_hlen, (uint8_t*)p_tcp_hdr + tcp_hlen + tcp_send_offset, chunk_size);
-                        }
+                    DEBUG_PRINT(("RTL8139: +++ C+ mode TSO TCP seqno %08x\n", be32_to_cpu(p_tcp_hdr->th_seq)));
 
-                        /* keep PUSH and FIN flags only for the last frame */
-                        if (!is_last_frame)
-                        {
-                            TCP_HEADER_CLEAR_FLAGS(p_tcp_hdr, TCP_FLAG_PUSH|TCP_FLAG_FIN);
-                        }
+                    /* add 4 TCP pseudoheader fields */
+                    /* copy IP source and destination fields */
+                    memcpy(data_to_checksum, saved_ip_header + 12, 8);
 
-                        /* recalculate TCP checksum */
-                        ip_pseudo_header *p_tcpip_hdr = (ip_pseudo_header *)data_to_checksum;
-                        p_tcpip_hdr->zeros      = 0;
-                        p_tcpip_hdr->ip_proto   = IP_PROTO_TCP;
-                        p_tcpip_hdr->ip_payload = cpu_to_be16(tcp_hlen + chunk_size);
+                    DEBUG_PRINT(("RTL8139: +++ C+ mode TSO calculating TCP checksum for packet with %d bytes data\n", tcp_hlen + chunk_size));
 
-                        p_tcp_hdr->th_sum = 0;
+                    if (tcp_send_offset)
+                    {
+                        DEBUG_PRINT(("RTL8139: +++ C+ mode calculating TCP checksum for packet with %d bytes data\n", ip_data_len));
+                        memcpy((uint8_t*)p_tcp_hdr + tcp_hlen, (uint8_t*)p_tcp_hdr + tcp_hlen + tcp_send_offset, chunk_size);
+                    }
 
-                        int tcp_checksum = ip_checksum(data_to_checksum, tcp_hlen + chunk_size + 12);
-                        DEBUG_PRINT(("RTL8139: +++ C+ mode TSO TCP checksum %04x\n", tcp_checksum));
+                    /* keep PUSH and FIN flags only for the last frame */
+                    if (!is_last_frame)
+                    {
+                        TCP_HEADER_CLEAR_FLAGS(p_tcp_hdr, TCP_FLAG_PUSH|TCP_FLAG_FIN);
+                    }
 
-                        p_tcp_hdr->th_sum = tcp_checksum;
+                    /* recalculate TCP checksum */
+                    ip_pseudo_header *p_tcpip_hdr = (ip_pseudo_header *)data_to_checksum;
+                    p_tcpip_hdr->zeros      = 0;
+                    p_tcpip_hdr->ip_proto   = IP_PROTO_TCP;
+                    p_tcpip_hdr->ip_payload = cpu_to_be16(tcp_hlen + chunk_size);
 
-                        /* restore IP header */
-                        memcpy(eth_payload_data, saved_ip_header, hlen);
+                    p_tcp_hdr->th_sum = 0;
 
-                        /* set IP data length and recalculate IP checksum */
-                        ip->ip_len = cpu_to_be16(hlen + tcp_hlen + chunk_size);
+                    int tcp_checksum = ip_checksum(data_to_checksum, tcp_hlen + chunk_size + 12);
+                    DEBUG_PRINT(("RTL8139: +++ C+ mode TSO TCP checksum %04x\n", tcp_checksum));
 
-                        /* increment IP id for subsequent frames */
-                        ip->ip_id = cpu_to_be16(tcp_send_offset/tcp_chunk_size + be16_to_cpu(ip->ip_id));
+                    p_tcp_hdr->th_sum = tcp_checksum;
 
-                        ip->ip_sum = 0;
-                        ip->ip_sum = ip_checksum(eth_payload_data, hlen);
-                        DEBUG_PRINT(("RTL8139: +++ C+ mode TSO IP header len=%d checksum=%04x\n", hlen, ip->ip_sum));
+                    /* restore IP header */
+                    memcpy(eth_payload_data, saved_ip_header, hlen);
 
-                        int tso_send_size = ETH_HLEN + hlen + tcp_hlen + chunk_size;
-                        DEBUG_PRINT(("RTL8139: +++ C+ mode TSO transferring packet size %d\n", tso_send_size));
-                        rtl8139_transfer_frame(s, saved_buffer, tso_send_size, 0);
+                    /* set IP data length and recalculate IP checksum */
+                    ip->ip_len = cpu_to_be16(hlen + tcp_hlen + chunk_size);
 
-                        /* add transferred count to TCP sequence number */
-                        p_tcp_hdr->th_seq = cpu_to_be32(chunk_size + be32_to_cpu(p_tcp_hdr->th_seq));
-                        ++send_count;
-                    }
+                    /* increment IP id for subsequent frames */
+                    ip->ip_id = cpu_to_be16(tcp_send_offset/tcp_chunk_size + be16_to_cpu(ip->ip_id));
 
-                    /* Stop sending this frame */
-                    saved_size = 0;
+                    ip->ip_sum = 0;
+                    ip->ip_sum = ip_checksum(eth_payload_data, hlen);
+                    DEBUG_PRINT(("RTL8139: +++ C+ mode TSO IP header len=%d checksum=%04x\n", hlen, ip->ip_sum));
+
+                    int tso_send_size = ETH_HLEN + hlen + tcp_hlen + chunk_size;
+                    DEBUG_PRINT(("RTL8139: +++ C+ mode TSO transferring packet size %d\n", tso_send_size));
+                    rtl8139_transfer_frame(s, saved_buffer, tso_send_size, 0);
+
+                    /* add transferred count to TCP sequence number */
+                    p_tcp_hdr->th_seq = cpu_to_be32(chunk_size + be32_to_cpu(p_tcp_hdr->th_seq));
+                    ++send_count;
                 }
-                else if (txdw0 & (CP_TX_TCPCS|CP_TX_UDPCS))
-                {
-                    DEBUG_PRINT(("RTL8139: +++ C+ mode need TCP or UDP checksum\n"));
 
-                    /* maximum IP header length is 60 bytes */
-                    uint8_t saved_ip_header[60];
-                    memcpy(saved_ip_header, eth_payload_data, hlen);
+                /* Stop sending this frame */
+                saved_size = 0;
+            }
+            else if (txdw0 & (CP_TX_TCPCS|CP_TX_UDPCS))
+            {
+                DEBUG_PRINT(("RTL8139: +++ C+ mode need TCP or UDP checksum\n"));
 
-                    uint8_t *data_to_checksum     = eth_payload_data + hlen - 12;
-                    //                    size_t   data_to_checksum_len = eth_payload_len  - hlen + 12;
+                /* maximum IP header length is 60 bytes */
+                uint8_t saved_ip_header[60];
+                memcpy(saved_ip_header, eth_payload_data, hlen);
 
-                    /* add 4 TCP pseudoheader fields */
-                    /* copy IP source and destination fields */
-                    memcpy(data_to_checksum, saved_ip_header + 12, 8);
+                uint8_t *data_to_checksum     = eth_payload_data + hlen - 12;
+                //                    size_t   data_to_checksum_len = eth_payload_len  - hlen + 12;
 
-                    if ((txdw0 & CP_TX_TCPCS) && ip_protocol == IP_PROTO_TCP)
-                    {
-                        DEBUG_PRINT(("RTL8139: +++ C+ mode calculating TCP checksum for packet with %d bytes data\n", ip_data_len));
+                /* add 4 TCP pseudoheader fields */
+                /* copy IP source and destination fields */
+                memcpy(data_to_checksum, saved_ip_header + 12, 8);
 
-                        ip_pseudo_header *p_tcpip_hdr = (ip_pseudo_header *)data_to_checksum;
-                        p_tcpip_hdr->zeros      = 0;
-                        p_tcpip_hdr->ip_proto   = IP_PROTO_TCP;
-                        p_tcpip_hdr->ip_payload = cpu_to_be16(ip_data_len);
+                if ((txdw0 & CP_TX_TCPCS) && ip_protocol == IP_PROTO_TCP)
+                {
+                    DEBUG_PRINT(("RTL8139: +++ C+ mode calculating TCP checksum for packet with %d bytes data\n", ip_data_len));
 
-                        tcp_header* p_tcp_hdr = (tcp_header *) (data_to_checksum+12);
+                    ip_pseudo_header *p_tcpip_hdr = (ip_pseudo_header *)data_to_checksum;
+                    p_tcpip_hdr->zeros      = 0;
+                    p_tcpip_hdr->ip_proto   = IP_PROTO_TCP;
+                    p_tcpip_hdr->ip_payload = cpu_to_be16(ip_data_len);
 
-                        p_tcp_hdr->th_sum = 0;
+                    tcp_header* p_tcp_hdr = (tcp_header *) (data_to_checksum+12);
 
-                        int tcp_checksum = ip_checksum(data_to_checksum, ip_data_len + 12);
-                        DEBUG_PRINT(("RTL8139: +++ C+ mode TCP checksum %04x\n", tcp_checksum));
+                    p_tcp_hdr->th_sum = 0;
 
-                        p_tcp_hdr->th_sum = tcp_checksum;
-                    }
-                    else if ((txdw0 & CP_TX_UDPCS) && ip_protocol == IP_PROTO_UDP)
-                    {
-                        DEBUG_PRINT(("RTL8139: +++ C+ mode calculating UDP checksum for packet with %d bytes data\n", ip_data_len));
+                    int tcp_checksum = ip_checksum(data_to_checksum, ip_data_len + 12);
+                    DEBUG_PRINT(("RTL8139: +++ C+ mode TCP checksum %04x\n", tcp_checksum));
 
-                        ip_pseudo_header *p_udpip_hdr = (ip_pseudo_header *)data_to_checksum;
-                        p_udpip_hdr->zeros      = 0;
-                        p_udpip_hdr->ip_proto   = IP_PROTO_UDP;
-                        p_udpip_hdr->ip_payload = cpu_to_be16(ip_data_len);
+                    p_tcp_hdr->th_sum = tcp_checksum;
+                }
+                else if ((txdw0 & CP_TX_UDPCS) && ip_protocol == IP_PROTO_UDP)
+                {
+                    DEBUG_PRINT(("RTL8139: +++ C+ mode calculating UDP checksum for packet with %d bytes data\n", ip_data_len));
 
-                        udp_header *p_udp_hdr = (udp_header *) (data_to_checksum+12);
+                    ip_pseudo_header *p_udpip_hdr = (ip_pseudo_header *)data_to_checksum;
+                    p_udpip_hdr->zeros      = 0;
+                    p_udpip_hdr->ip_proto   = IP_PROTO_UDP;
+                    p_udpip_hdr->ip_payload = cpu_to_be16(ip_data_len);
 
-                        p_udp_hdr->uh_sum = 0;
+                    udp_header *p_udp_hdr = (udp_header *) (data_to_checksum+12);
 
-                        int udp_checksum = ip_checksum(data_to_checksum, ip_data_len + 12);
-                        DEBUG_PRINT(("RTL8139: +++ C+ mode UDP checksum %04x\n", udp_checksum));
+                    p_udp_hdr->uh_sum = 0;
 
-                        p_udp_hdr->uh_sum = udp_checksum;
-                    }
+                    int udp_checksum = ip_checksum(data_to_checksum, ip_data_len + 12);
+                    DEBUG_PRINT(("RTL8139: +++ C+ mode UDP checksum %04x\n", udp_checksum));
 
-                    /* restore IP header */
-                    memcpy(eth_payload_data, saved_ip_header, hlen);
+                    p_udp_hdr->uh_sum = udp_checksum;
                 }
+
+                /* restore IP header */
+                memcpy(eth_payload_data, saved_ip_header, hlen);
             }
-        }
+       }
 
 skip_offload:
         /* update tally counter */
++++++ xsa140-qemut-3.patch ++++++
References: bsc#939712 XSA-140
...
From 043d28507ef7c5fdc34866f5e3b27a72bd0cd072 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi 
Date: Wed, 15 Jul 2015 18:17:00 +0100
Subject: [PATCH 3/7] rtl8139: skip offload on short Ethernet/IP header
Transmit offload features access Ethernet and IP headers the packet.  If
the packet is too short we must not attempt to access header fields:

  int proto = be16_to_cpu(*(uint16_t *)(saved_buffer + 12));
  ...
  eth_payload_data = saved_buffer + ETH_HLEN;
  ...
  ip = (ip_header*)eth_payload_data;
  if (IP_HEADER_VERSION(ip) != IP_HEADER_VERSION_4) {

Signed-off-by: Stefan Hajnoczi 
---
 hw/rtl8139.c | 5 +++++
 1 file changed, 5 insertions(+)

Index: xen-4.4.2-testing/tools/qemu-xen-traditional-dir-remote/hw/rtl8139.c
===================================================================
--- xen-4.4.2-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/rtl8139.c
+++ xen-4.4.2-testing/tools/qemu-xen-traditional-dir-remote/hw/rtl8139.c
@@ -2103,6 +2103,11 @@ static int rtl8139_cplus_transmit_one(RT
             #define ETH_HLEN    14
             #define ETH_MTU     1500
 
+            /* Large enough for Ethernet and IP headers? */
+            if (saved_size < ETH_HLEN + sizeof(ip_header)) {
+                goto skip_offload;
+            }
+
             /* ip packet header */
             ip_header *ip = 0;
             int hlen = 0;
++++++ xsa140-qemut-4.patch ++++++
References: bsc#939712 XSA-140
...
From 5a75d242fe019d05b46ef9bc330a6892525c84a7 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi 
Date: Wed, 15 Jul 2015 18:17:01 +0100
Subject: [PATCH 4/7] rtl8139: check IP Header Length field
The IP Header Length field was only checked in the IP checksum case, but
is used in other cases too.

Signed-off-by: Stefan Hajnoczi 
---
 hw/rtl8139.c | 19 ++++++++-----------
 1 file changed, 8 insertions(+), 11 deletions(-)

Index: xen-4.4.2-testing/tools/qemu-xen-traditional-dir-remote/hw/rtl8139.c
===================================================================
--- xen-4.4.2-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/rtl8139.c
+++ xen-4.4.2-testing/tools/qemu-xen-traditional-dir-remote/hw/rtl8139.c
@@ -2139,6 +2139,10 @@ static int rtl8139_cplus_transmit_one(RT
             }
 
             hlen = IP_HEADER_LENGTH(ip);
+            if (hlen < sizeof(ip_header) || hlen > eth_payload_len) {
+                goto skip_offload;
+            }
+
             ip_protocol = ip->ip_p;
             ip_data_len = be16_to_cpu(ip->ip_len) - hlen;
 
@@ -2146,16 +2150,9 @@ static int rtl8139_cplus_transmit_one(RT
             {
                 DEBUG_PRINT(("RTL8139: +++ C+ mode need IP checksum\n"));
 
-                if (hleneth_payload_len) {/* min header length */
-                    /* bad packet header len */
-                    /* or packet too short */
-                }
-                else
-                {
-                    ip->ip_sum = 0;
-                    ip->ip_sum = ip_checksum(ip, hlen);
-                    DEBUG_PRINT(("RTL8139: +++ C+ mode IP header len=%d checksum=%04x\n", hlen, ip->ip_sum));
-                }
+                ip->ip_sum = 0;
+                ip->ip_sum = ip_checksum(ip, hlen);
+                DEBUG_PRINT(("RTL8139: +++ C+ mode IP header len=%d checksum=%04x\n", hlen, ip->ip_sum));
             }
 
             if ((txdw0 & CP_TX_LGSEN) && ip_protocol == IP_PROTO_TCP)
++++++ xsa140-qemut-5.patch ++++++
References: bsc#939712 XSA-140
...
From 6c79ea275d72bc1fd88bdcf1e7d231b2c9c865de Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi 
Date: Wed, 15 Jul 2015 18:17:02 +0100
Subject: [PATCH 5/7] rtl8139: check IP Total Length field
The IP Total Length field includes the IP header and data.  Make sure it
is valid and does not exceed the Ethernet payload size.

Signed-off-by: Stefan Hajnoczi 
---
 hw/rtl8139.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

Index: xen-4.4.2-testing/tools/qemu-xen-traditional-dir-remote/hw/rtl8139.c
===================================================================
--- xen-4.4.2-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/rtl8139.c
+++ xen-4.4.2-testing/tools/qemu-xen-traditional-dir-remote/hw/rtl8139.c
@@ -2144,7 +2144,12 @@ static int rtl8139_cplus_transmit_one(RT
             }
 
             ip_protocol = ip->ip_p;
-            ip_data_len = be16_to_cpu(ip->ip_len) - hlen;
+
+            ip_data_len = be16_to_cpu(ip->ip_len);
+            if (ip_data_len < hlen || ip_data_len > eth_payload_len) {
+                goto skip_offload;
+            }
+            ip_data_len -= hlen;
 
             if (txdw0 & CP_TX_IPCS)
             {
++++++ xsa140-qemut-6.patch ++++++
References: bsc#939712 XSA-140
...
From 30aa7be430e7c982e9163f3bcc745d3aa57b6aa4 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi 
Date: Wed, 15 Jul 2015 18:17:03 +0100
Subject: [PATCH 6/7] rtl8139: skip offload on short TCP header
TCP Large Segment Offload accesses the TCP header in the packet.  If the
packet is too short we must not attempt to access header fields:

  tcp_header *p_tcp_hdr = (tcp_header*)(eth_payload_data + hlen);
  int tcp_hlen = TCP_HEADER_DATA_OFFSET(p_tcp_hdr);

Signed-off-by: Stefan Hajnoczi 
---
 hw/rtl8139.c | 5 +++++
 1 file changed, 5 insertions(+)

Index: xen-4.4.2-testing/tools/qemu-xen-traditional-dir-remote/hw/rtl8139.c
===================================================================
--- xen-4.4.2-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/rtl8139.c
+++ xen-4.4.2-testing/tools/qemu-xen-traditional-dir-remote/hw/rtl8139.c
@@ -2162,6 +2162,11 @@ static int rtl8139_cplus_transmit_one(RT
 
             if ((txdw0 & CP_TX_LGSEN) && ip_protocol == IP_PROTO_TCP)
             {
+                /* Large enough for the TCP header? */
+                if (ip_data_len < sizeof(tcp_header)) {
+                    goto skip_offload;
+                }
+
                 int large_send_mss = (txdw0 >> 16) & CP_TC_LGSEN_MSS_MASK;
 
                 DEBUG_PRINT(("RTL8139: +++ C+ mode offloaded task TSO MTU=%d IP data %d frame data %d specified MSS=%d\n",
++++++ xsa140-qemut-7.patch ++++++
References: bsc#939712 XSA-140
...
From 9a084807bf6ca7c16d997a236d304111894a6539 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi 
Date: Wed, 15 Jul 2015 18:17:04 +0100
Subject: [PATCH 7/7] rtl8139: check TCP Data Offset field
The TCP Data Offset field contains the length of the header.  Make sure
it is valid and does not exceed the IP data length.

Signed-off-by: Stefan Hajnoczi 
---
 hw/rtl8139.c | 5 +++++
 1 file changed, 5 insertions(+)

Index: xen-4.4.2-testing/tools/qemu-xen-traditional-dir-remote/hw/rtl8139.c
===================================================================
--- xen-4.4.2-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/rtl8139.c
+++ xen-4.4.2-testing/tools/qemu-xen-traditional-dir-remote/hw/rtl8139.c
@@ -2190,6 +2190,11 @@ static int rtl8139_cplus_transmit_one(RT
 
                 int tcp_hlen = TCP_HEADER_DATA_OFFSET(p_tcp_hdr);
 
+                /* Invalid TCP data offset? */
+                if (tcp_hlen < sizeof(tcp_header) || tcp_hlen > ip_data_len) {
+                    goto skip_offload;
+                }
+
                 /* ETH_MTU = ip header len + tcp header len + payload */
                 int tcp_data_len = ip_data_len - tcp_hlen;
                 int tcp_chunk_size = ETH_MTU - hlen - tcp_hlen;
++++++ xsa153-libxl.patch ++++++
...
From 27593ec62bdad8621df910931349d964a6dbaa8c Mon Sep 17 00:00:00 2001
From: Ian Jackson 
Date: Wed, 21 Oct 2015 16:18:30 +0100
Subject: [PATCH XSA-153 v3] libxl: adjust PoD target by memory fudge, too
PoD guests need to balloon at least as far as required by PoD, or risk
crashing.  Currently they don't necessarily know what the right value
is, because our memory accounting is (at the very least) confusing.

Apply the memory limit fudge factor to the in-hypervisor PoD memory
target, too.  This will increase the size of the guest's PoD cache by
the fudge factor LIBXL_MAXMEM_CONSTANT (currently 1Mby).  This ensures
that even with a slightly-off balloon driver, the guest will be
stable even under memory pressure.

There are two call sites of xc_domain_set_pod_target that need fixing:

The one in libxl_set_memory_target is straightforward.

The one in xc_hvm_build_x86.c:setup_guest is more awkward.  Simply
setting the PoD target differently does not work because the various
amounts of memory during domain construction no longer match up.
Instead, we adjust the guest memory target in xenstore (but only for
PoD guests).

This introduces a 1Mby discrepancy between the balloon target of a PoD
guest at boot, and the target set by an apparently-equivalent `xl
mem-set' (or similar) later.  This approach is low-risk for a security
fix but we need to fix this up properly in xen.git#staging and
probably also in stable trees.

This is XSA-153.

Signed-off-by: Ian Jackson 
---
 tools/libxl/libxl.c     |    2 +-
 tools/libxl/libxl_dom.c |    9 ++++++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

Index: xen-4.4.3-testing/tools/libxl/libxl.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl.c
+++ xen-4.4.3-testing/tools/libxl/libxl.c
@@ -4143,7 +4143,7 @@ retry_transaction:
 
     new_target_memkb -= videoram;
     rc = xc_domain_set_pod_target(ctx->xch, domid,
-            new_target_memkb / 4, NULL, NULL, NULL);
+            (new_target_memkb + LIBXL_MAXMEM_CONSTANT) / 4, NULL, NULL, NULL);
     if (rc != 0) {
         LIBXL__LOG_ERRNO(ctx, LIBXL__LOG_ERROR,
                 "xc_domain_set_pod_target domid=%d, memkb=%d "
Index: xen-4.4.3-testing/tools/libxl/libxl_dom.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl_dom.c
+++ xen-4.4.3-testing/tools/libxl/libxl_dom.c
@@ -270,6 +270,7 @@ int libxl__build_post(libxl__gc *gc, uin
     xs_transaction_t t;
     char **ents, **hvm_ents;
     int i, rc;
+    int64_t mem_target_fudge;
 
     rc = libxl_domain_sched_params_set(CTX, domid, &info->sched_params);
     if (rc)
@@ -286,11 +287,17 @@ int libxl__build_post(libxl__gc *gc, uin
     if (info->cpuid != NULL)
         libxl_cpuid_set(ctx, domid, info->cpuid);
 
+    mem_target_fudge =
+        (info->type == LIBXL_DOMAIN_TYPE_HVM &&
+         info->max_memkb > info->target_memkb)
+        ? LIBXL_MAXMEM_CONSTANT : 0;
+
     ents = libxl__calloc(gc, 12 + (info->max_vcpus * 2) + 2, sizeof(char *));
     ents[0] = "memory/static-max";
     ents[1] = GCSPRINTF("%"PRId64, info->max_memkb);
     ents[2] = "memory/target";
-    ents[3] = GCSPRINTF("%"PRId64, info->target_memkb - info->video_memkb);
+    ents[3] = GCSPRINTF("%"PRId64, info->target_memkb - info->video_memkb
+                        - mem_target_fudge);
     ents[4] = "memory/videoram";
     ents[5] = GCSPRINTF("%"PRId64, info->video_memkb);
     ents[6] = "domid";
++++++ xsa155-qemut-qdisk-double-access.patch ++++++
References: bsc#957988
...
From 27942b0cb2327e93deb12326bbe7b36c81f9fa7b Mon Sep 17 00:00:00 2001
From: Stefano Stabellini 
Date: Fri, 20 Nov 2015 10:56:00 -0500
Subject: [PATCH] blkif: Avoid double access to src->nr_segments
src is stored in shared memory and src->nr_segments is dereferenced
twice at the end of the function.  If a compiler decides to compile this
into two separate memory accesses then the size limitation could be
bypassed.

Fix it by removing the double access to src->nr_segments.

This is part of XSA-155.

Signed-off-by: Stefano Stabellini 
Signed-off-by: Konrad Rzeszutek Wilk 
---
 hw/xen_blkif.h | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

Index: xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_blkif.h
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/xen_blkif.h
+++ xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_blkif.h
@@ -79,8 +79,10 @@ static inline void blkif_get_x86_32_req(
 	dst->handle = src->handle;
 	dst->id = src->id;
 	dst->sector_number = src->sector_number;
-	if (n > src->nr_segments)
-		n = src->nr_segments;
+	/* prevent the compiler from optimizing the code and using src->nr_segments instead */
+	xen_mb();
+	if (n > dst->nr_segments)
+		n = dst->nr_segments;
 	for (i = 0; i < n; i++)
 		dst->seg[i] = src->seg[i];
 }
@@ -94,8 +96,10 @@ static inline void blkif_get_x86_64_req(
 	dst->handle = src->handle;
 	dst->id = src->id;
 	dst->sector_number = src->sector_number;
-	if (n > src->nr_segments)
-		n = src->nr_segments;
+	/* prevent the compiler from optimizing the code and using src->nr_segments instead */
+	xen_mb();
+	if (n > dst->nr_segments)
+		n = dst->nr_segments;
 	for (i = 0; i < n; i++)
 		dst->seg[i] = src->seg[i];
 }
++++++ xsa155-qemut-xenfb.patch ++++++
References: bsc#957988
...
From 0ffd4547665d2fec648ab2c9ff856c5d9db9b07c Mon Sep 17 00:00:00 2001
From: Stefano Stabellini 
Date: Fri, 20 Nov 2015 10:37:08 -0500
Subject: [PATCH 2/2] xenfb: avoid reading twice the same fields from the
 shared page
Reading twice the same field could give the guest an attack of
opportunity. In the case of event->type, gcc could compile the switch
statement into a jump table, effectively ending up reading the type
field multiple times.

This is part of XSA-155.

Signed-off-by: Stefano Stabellini 
---
 hw/xenfb.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

Index: xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/hw/xenfb.c
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/xenfb.c
+++ xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/hw/xenfb.c
@@ -827,18 +827,20 @@ static void xenfb_invalidate(void *opaqu
 
 static void xenfb_handle_events(struct XenFB *xenfb)
 {
-    uint32_t prod, cons;
+    uint32_t prod, cons, out_cons;
     struct xenfb_page *page = xenfb->c.page;
 
     prod = page->out_prod;
-    if (prod == page->out_cons)
+    out_cons = page->out_cons;
+    if (prod == out_cons)
 	return;
     xen_rmb();		/* ensure we see ring contents up to prod */
-    for (cons = page->out_cons; cons != prod; cons++) {
+    for (cons = out_cons; cons != prod; cons++) {
 	union xenfb_out_event *event = &XENFB_OUT_RING_REF(page, cons);
+        uint8_t type = event->type;
 	int x, y, w, h;
 
-	switch (event->type) {
+	switch (type) {
 	case XENFB_TYPE_UPDATE:
 	    if (xenfb->up_count == UP_QUEUE)
 		xenfb->up_fullscreen = 1;
++++++ xsa155-qemuu-qdisk-double-access.patch ++++++
References: bsc#957988

xen/blkif: Avoid double access to src->nr_segments

src is stored in shared memory and src->nr_segments is dereferenced
twice at the end of the function.  If a compiler decides to compile this
into two separate memory accesses then the size limitation could be
bypassed.

Fix it by removing the double access to src->nr_segments.

This is part of XSA-155.

Signed-off-by: Stefano Stabellini 

Index: xen-4.4.3-testing/tools/qemu-xen-dir-remote/hw/block/xen_blkif.h
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-dir-remote/hw/block/xen_blkif.h
+++ xen-4.4.3-testing/tools/qemu-xen-dir-remote/hw/block/xen_blkif.h
@@ -79,8 +79,10 @@ static inline void blkif_get_x86_32_req(
 	dst->handle = src->handle;
 	dst->id = src->id;
 	dst->sector_number = src->sector_number;
-	if (n > src->nr_segments)
-		n = src->nr_segments;
+	/* prevent the compiler from optimizing the code and using src->nr_segments instead */
+	barrier();
+	if (n > dst->nr_segments)
+		n = dst->nr_segments;
 	for (i = 0; i < n; i++)
 		dst->seg[i] = src->seg[i];
 }
@@ -94,8 +96,10 @@ static inline void blkif_get_x86_64_req(
 	dst->handle = src->handle;
 	dst->id = src->id;
 	dst->sector_number = src->sector_number;
-	if (n > src->nr_segments)
-		n = src->nr_segments;
+	/* prevent the compiler from optimizing the code and using src->nr_segments instead */
+	barrier();
+	if (n > dst->nr_segments)
+		n = dst->nr_segments;
 	for (i = 0; i < n; i++)
 		dst->seg[i] = src->seg[i];
 }
++++++ xsa155-qemuu-xenfb.patch ++++++
References: bsc#957988

xenfb: avoid reading twice the same fields from the shared page

Reading twice the same field could give the guest an attack of
opportunity. In the case of event->type, gcc could compile the switch
statement into a jump table, effectively ending up reading the type
field multiple times.

This is part of XSA-155.

Signed-off-by: Stefano Stabellini 


Index: xen-4.4.3-testing/tools/qemu-xen-dir-remote/hw/display/xenfb.c
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-dir-remote/hw/display/xenfb.c
+++ xen-4.4.3-testing/tools/qemu-xen-dir-remote/hw/display/xenfb.c
@@ -775,18 +775,20 @@ static void xenfb_invalidate(void *opaqu
 
 static void xenfb_handle_events(struct XenFB *xenfb)
 {
-    uint32_t prod, cons;
+    uint32_t prod, cons, out_cons;
     struct xenfb_page *page = xenfb->c.page;
 
     prod = page->out_prod;
-    if (prod == page->out_cons)
+    out_cons = page->out_cons;
+    if (prod == out_cons)
 	return;
     xen_rmb();		/* ensure we see ring contents up to prod */
-    for (cons = page->out_cons; cons != prod; cons++) {
+    for (cons = out_cons; cons != prod; cons++) {
 	union xenfb_out_event *event = &XENFB_OUT_RING_REF(page, cons);
+        uint8_t type = event->type;
 	int x, y, w, h;
 
-	switch (event->type) {
+	switch (type) {
 	case XENFB_TYPE_UPDATE:
 	    if (xenfb->up_count == UP_QUEUE)
 		xenfb->up_fullscreen = 1;
++++++ xsa155-xen-0001-xen-Add-RING_COPY_REQUEST.patch ++++++
References: bsc#957988
...
From 12b11658a9d6a654a1e7acbf2f2d56ce9a396c86 Mon Sep 17 00:00:00 2001
From: David Vrabel 
Date: Fri, 20 Nov 2015 11:59:05 -0500
Subject: [PATCH 1/3] xen: Add RING_COPY_REQUEST()
Using RING_GET_REQUEST() on a shared ring is easy to use incorrectly
(i.e., by not considering that the other end may alter the data in the
shared ring while it is being inspected).  Safe usage of a request
generally requires taking a local copy.

Provide a RING_COPY_REQUEST() macro to use instead of
RING_GET_REQUEST() and an open-coded memcpy().  This takes care of
ensuring that the copy is done correctly regardless of any possible
compiler optimizations.

Use a volatile source to prevent the compiler from reordering or
omitting the copy.

This is part of XSA155.

Signed-off-by: David Vrabel 
Signed-off-by: Konrad Rzeszutek Wilk 
---
v2: Add comment about GCC bug.
---
 xen/include/public/io/ring.h | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

Index: xen-4.4.3-testing/xen/include/public/io/ring.h
===================================================================
--- xen-4.4.3-testing.orig/xen/include/public/io/ring.h
+++ xen-4.4.3-testing/xen/include/public/io/ring.h
@@ -212,6 +212,20 @@ typedef struct __name##_back_ring __name
 #define RING_GET_REQUEST(_r, _idx)                                      \
     (&((_r)->sring->ring[((_idx) & (RING_SIZE(_r) - 1))].req))
 
+/*
+ * Get a local copy of a request.
+ *
+ * Use this in preference to RING_GET_REQUEST() so all processing is
+ * done on a local copy that cannot be modified by the other end.
+ *
+ * Note that https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58145 may cause this
+ * to be ineffective where _req is a struct which consists of only bitfields.
+ */
+#define RING_COPY_REQUEST(_r, _idx, _req) do {				\
+	/* Use volatile to force the copy into _req. */			\
+	*(_req) = *(volatile typeof(_req))RING_GET_REQUEST(_r, _idx);	\
+} while (0)
+
 #define RING_GET_RESPONSE(_r, _idx)                                     \
     (&((_r)->sring->ring[((_idx) & (RING_SIZE(_r) - 1))].rsp))
 
++++++ xsa155-xen-0002-blktap2-Use-RING_COPY_REQUEST.patch ++++++
References: bsc#957988
...
From 851ffb4eea917e2708c912291dea4d133026c0ac Mon Sep 17 00:00:00 2001
From: Konrad Rzeszutek Wilk 
Date: Fri, 20 Nov 2015 12:16:02 -0500
Subject: [PATCH 2/3] blktap2: Use RING_COPY_REQUEST
Instead of RING_GET_REQUEST. Using a local copy of the
ring (and also with proper memory barriers) will mean
we can do not have to worry about the compiler optimizing
the code and doing a double-fetch in the shared memory space.

This is part of XSA155.

Signed-off-by: Konrad Rzeszutek Wilk 

---
v2: Fix compile issues with tapdisk-vbd
---
 tools/blktap2/drivers/block-log.c   | 3 ++-
 tools/blktap2/drivers/tapdisk-vbd.c | 8 ++++----
 2 files changed, 6 insertions(+), 5 deletions(-)

Index: xen-4.4.3-testing/tools/blktap2/drivers/block-log.c
===================================================================
--- xen-4.4.3-testing.orig/tools/blktap2/drivers/block-log.c
+++ xen-4.4.3-testing/tools/blktap2/drivers/block-log.c
@@ -494,11 +494,12 @@ static int ctl_kick(struct tdlog_state*
   reqstart = s->bring.req_cons;
   reqend = s->sring->req_prod;
 
+  xen_mb();
   BDPRINTF("ctl: ring kicked (start = %u, end = %u)", reqstart, reqend);
 
   while (reqstart != reqend) {
     /* XXX actually submit these! */
-    memcpy(&req, RING_GET_REQUEST(&s->bring, reqstart), sizeof(req));
+    RING_COPY_REQUEST(&s->bring, reqstart, &req);
     BDPRINTF("ctl: read request %"PRIu64":%u", req.sector, req.count);
     s->bring.req_cons = ++reqstart;
 
Index: xen-4.4.3-testing/tools/blktap2/drivers/tapdisk-vbd.c
===================================================================
--- xen-4.4.3-testing.orig/tools/blktap2/drivers/tapdisk-vbd.c
+++ xen-4.4.3-testing/tools/blktap2/drivers/tapdisk-vbd.c
@@ -1555,7 +1555,7 @@ tapdisk_vbd_pull_ring_requests(td_vbd_t
 	int idx;
 	RING_IDX rp, rc;
 	td_ring_t *ring;
-	blkif_request_t *req;
+	blkif_request_t req;
 	td_vbd_request_t *vreq;
 
 	ring = &vbd->ring;
@@ -1566,16 +1566,16 @@ tapdisk_vbd_pull_ring_requests(td_vbd_t
 	xen_rmb();
 
 	for (rc = ring->fe_ring.req_cons; rc != rp; rc++) {
-		req = RING_GET_REQUEST(&ring->fe_ring, rc);
+		RING_COPY_REQUEST(&ring->fe_ring, rc, &req);
 		++ring->fe_ring.req_cons;
 
-		idx  = req->id;
+		idx  = req.id;
 		vreq = &vbd->request_list[idx];
 
 		ASSERT(list_empty(&vreq->next));
 		ASSERT(vreq->secs_pending == 0);
 
-		memcpy(&vreq->req, req, sizeof(blkif_request_t));
+		memcpy(&vreq->req, &req, sizeof(blkif_request_t));
 		vbd->received++;
 		vreq->vbd = vbd;
 
++++++ xsa155-xen-0003-libvchan-Read-prod-cons-only-once.patch ++++++
References: bsc#957988
...
From ef86ad0b60fe179b1a6fa390e05c339fb44b9cc9 Mon Sep 17 00:00:00 2001
From: Konrad Rzeszutek Wilk 
Date: Fri, 20 Nov 2015 12:22:14 -0500
Subject: [PATCH] libvchan: Read prod/cons only once.
We must ensure that the prod/cons are only read once and that
the compiler won't try to optimize the reads. That is split
the read of these in multiple instructions influencing later
branch code. As such insert barriers when fetching the cons
and prod index.

This is part of XSA155.

Signed-off-by: Konrad Rzeszutek Wilk 
---
 tools/libvchan/io.c | 2 ++
 1 file changed, 2 insertions(+)

Index: xen-4.4.3-testing/tools/libvchan/io.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libvchan/io.c
+++ xen-4.4.3-testing/tools/libvchan/io.c
@@ -118,6 +118,7 @@ static inline int send_notify(struct lib
 static inline int raw_get_data_ready(struct libxenvchan *ctrl)
 {
 	uint32_t ready = rd_prod(ctrl) - rd_cons(ctrl);
+	xen_mb(); /* Ensure 'ready' is read only once. */
 	if (ready >= rd_ring_size(ctrl))
 		/* We have no way to return errors.  Locking up the ring is
 		 * better than the alternatives. */
@@ -159,6 +160,7 @@ int libxenvchan_data_ready(struct libxen
 static inline int raw_get_buffer_space(struct libxenvchan *ctrl)
 {
 	uint32_t ready = wr_ring_size(ctrl) - (wr_prod(ctrl) - wr_cons(ctrl));
+	xen_mb(); /* Ensure 'ready' is read only once. */
 	if (ready > wr_ring_size(ctrl))
 		/* We have no way to return errors.  Locking up the ring is
 		 * better than the alternatives. */
++++++ xsa162-qemut.patch ++++++
net: pcnet: add check to validate receive data size(CVE-2015-7504)

In loopback mode, pcnet_receive routine appends CRC code to the
receive buffer. If the data size given is same as the buffer size,
the appended CRC code overwrites 4 bytes after s->buffer. Added a
check to avoid that.

---
 hw/net/pcnet.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

Index: xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/hw/pcnet.c
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/pcnet.c
+++ xen-4.4.3-testing/tools/qemu-xen-traditional-dir-remote/hw/pcnet.c
@@ -1153,7 +1153,7 @@ static void pcnet_receive(void *opaque,
                 uint32_t fcs = ~0;
                 uint8_t *p = src;
 
-                while (p != &src[size-4])
+                while (p != &src[size])
                     CRC(fcs, *p++);
                 crc_err = (*(uint32_t *)p != htonl(fcs));
             }
@@ -1284,12 +1284,13 @@ static void pcnet_transmit(PCNetState *s
         bcnt = 4096 - GET_FIELD(tmd.length, TMDL, BCNT);
 
         /* if multi-tmd packet outsizes s->buffer then skip it silently.
-           Note: this is not what real hw does */
-        if (s->xmit_pos + bcnt > sizeof(s->buffer)) {
-           s->xmit_pos = -1;
-           goto txdone;
+         * Note: this is not what real hw does.
+         * Last four bytes of s->buffer are used to store CRC FCS code.
+         */
+        if (s->xmit_pos + bcnt > sizeof(s->buffer) - 4) {
+            s->xmit_pos = -1;
+            goto txdone;
         }
-
         s->phys_mem_read(s->dma_opaque, PHYSADDR(s, tmd.tbadr),
                          s->buffer + s->xmit_pos, bcnt, CSR_BSWP(s));
         s->xmit_pos += bcnt;
++++++ xsa162-qemuu.patch ++++++
net: pcnet: add check to validate receive data size(CVE-2015-7504)

In loopback mode, pcnet_receive routine appends CRC code to the
receive buffer. If the data size given is same as the buffer size,
the appended CRC code overwrites 4 bytes after s->buffer. Added a
check to avoid that.

---
 hw/net/pcnet.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

Index: xen-4.4.3-testing/tools/qemu-xen-dir-remote/hw/net/pcnet.c
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-dir-remote/hw/net/pcnet.c
+++ xen-4.4.3-testing/tools/qemu-xen-dir-remote/hw/net/pcnet.c
@@ -1107,7 +1107,7 @@ ssize_t pcnet_receive(NetClientState *nc
                 uint32_t fcs = ~0;
                 uint8_t *p = src;
 
-                while (p != &src[size-4])
+                while (p != &src[size])
                     CRC(fcs, *p++);
                 crc_err = (*(uint32_t *)p != htonl(fcs));
             }
@@ -1256,8 +1256,10 @@ static void pcnet_transmit(PCNetState *s
         bcnt = 4096 - GET_FIELD(tmd.length, TMDL, BCNT);
 
         /* if multi-tmd packet outsizes s->buffer then skip it silently.
-           Note: this is not what real hw does */
-        if (s->xmit_pos + bcnt > sizeof(s->buffer)) {
+         * Note: this is not what real hw does.
+         * Last four bytes of s->buffer are used to store CRC FCS code.
+         */
+        if (s->xmit_pos + bcnt > sizeof(s->buffer) - 4) {
             s->xmit_pos = -1;
             goto txdone;
         }
++++++ xsa164.patch ++++++
References: bsc#958007 XSA-164

MSI-X: avoid array overrun upon MSI-X table writes

pt_msix_init() allocates msix->msix_entry[] to just cover
msix->total_entries entries. While pci_msix_readl() resorts to reading
physical memory for out of bounds reads, pci_msix_writel() so far
simply accessed/corrupted unrelated memory.

pt_iomem_map()'s call to cpu_register_physical_memory() registers a
page granular region, which is necessary as the Pending Bit Array may
share space with the MSI-X table (but nothing else is allowed to). This
also explains why pci_msix_readl() actually honors out of bounds reads,
but pci_msi_writel() doesn't need to.

This is XSA-164.

Signed-off-by: Jan Beulich 

--- a/tools/qemu-xen-traditional-dir-remote/hw/pt-msi.c
+++ b/tools/qemu-xen-traditional-dir-remote/hw/pt-msi.c
@@ -440,6 +440,13 @@ static void pci_msix_writel(void *opaque
         return;
     }
 
+    if ( addr - msix->mmio_base_addr >= msix->total_entries * 16 )
+    {
+        PT_LOG("Error: Out of bounds write to MSI-X table,"
+               " addr %016"PRIx64"\n", addr);
+        return;
+    }
+
     entry_nr = (addr - msix->mmio_base_addr) / 16;
     entry = &msix->msix_entry[entry_nr];
     offset = ((addr - msix->mmio_base_addr) % 16) / 4;
++++++ xsa165.patch ++++++
References: bsc#958009 XSA-165

x86: don't leak ST(n)/XMMn values to domains first using them

FNINIT doesn't alter these registers, and hence using it is
insufficient to initialize a guest's initial state.

This is XSA-165.

Signed-off-by: Jan Beulich 

--- a/xen/arch/x86/domain.c
+++ b/xen/arch/x86/domain.c
@@ -751,6 +751,17 @@ int arch_set_info_guest(
         if ( v->arch.xsave_area )
              v->arch.xsave_area->xsave_hdr.xstate_bv = XSTATE_FP_SSE;
     }
+    else if ( v->arch.xsave_area )
+        memset(&v->arch.xsave_area->xsave_hdr, 0,
+               sizeof(v->arch.xsave_area->xsave_hdr));
+    else
+    {
+        typeof(v->arch.xsave_area->fpu_sse) *fpu_sse = v->arch.fpu_ctxt;
+
+        memset(fpu_sse, 0, sizeof(*fpu_sse));
+        fpu_sse->fcw = FCW_DEFAULT;
+        fpu_sse->mxcsr = MXCSR_DEFAULT;
+    }
 
     if ( !compat )
     {
--- a/xen/arch/x86/i387.c
+++ b/xen/arch/x86/i387.c
@@ -17,19 +17,6 @@
 #include 
 #include 
 
-static void fpu_init(void)
-{
-    unsigned long val;
-    
-    asm volatile ( "fninit" );
-    if ( cpu_has_xmm )
-    {
-        /* load default value into MXCSR control/status register */
-        val = MXCSR_DEFAULT;
-        asm volatile ( "ldmxcsr %0" : : "m" (val) );
-    }
-}
-
 /*******************************/
 /*     FPU Restore Functions   */
 /*******************************/
@@ -248,15 +235,8 @@ void vcpu_restore_fpu_lazy(struct vcpu *
 
     if ( cpu_has_xsave )
         fpu_xrstor(v, XSTATE_LAZY);
-    else if ( v->fpu_initialised )
-    {
-        if ( cpu_has_fxsr )
-            fpu_fxrstor(v);
-        else
-            fpu_frstor(v);
-    }
     else
-        fpu_init();
+        fpu_fxrstor(v);
 
     v->fpu_initialised = 1;
     v->fpu_dirtied = 1;
@@ -317,7 +297,14 @@ int vcpu_init_fpu(struct vcpu *v)
     else
     {
         v->arch.fpu_ctxt = _xzalloc(sizeof(v->arch.xsave_area->fpu_sse), 16);
-        if ( !v->arch.fpu_ctxt )
+        if ( v->arch.fpu_ctxt )
+        {
+            typeof(v->arch.xsave_area->fpu_sse) *fpu_sse = v->arch.fpu_ctxt;
+
+            fpu_sse->fcw = FCW_DEFAULT;
+            fpu_sse->mxcsr = MXCSR_DEFAULT;
+        }
+        else
         {
             rc = -ENOMEM;
             goto done;
++++++ xsa166.patch ++++++
References: bsc#958523 XSA-166

x86/HVM: avoid reading ioreq state more than once

Otherwise, especially when the compiler chooses to translate the
switch() to a jump table, unpredictable behavior (and in the jump table
case arbitrary code execution) can result.

This is XSA-166.

Signed-off-by: Jan Beulich 

--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -348,6 +348,7 @@ void hvm_migrate_pirqs(struct vcpu *v)
 void hvm_do_resume(struct vcpu *v)
 {
     ioreq_t *p;
+    unsigned int state;
 
     check_wakeup_from_wait();
 
@@ -358,9 +359,10 @@ void hvm_do_resume(struct vcpu *v)
     if ( !(p = get_ioreq(v)) )
         goto check_inject_trap;
 
-    while ( p->state != STATE_IOREQ_NONE )
+    while ( (state = p->state) != STATE_IOREQ_NONE )
     {
-        switch ( p->state )
+        rmb();
+        switch ( state )
         {
         case STATE_IORESP_READY: /* IORESP_READY -> NONE */
             hvm_io_assist(p);
@@ -368,11 +370,10 @@ void hvm_do_resume(struct vcpu *v)
         case STATE_IOREQ_READY:  /* IOREQ_{READY,INPROCESS} -> IORESP_READY */
         case STATE_IOREQ_INPROCESS:
             wait_on_xen_event_channel(v->arch.hvm_vcpu.xen_port,
-                                      (p->state != STATE_IOREQ_READY) &&
-                                      (p->state != STATE_IOREQ_INPROCESS));
+                                      p->state != state);
             break;
         default:
-            gdprintk(XENLOG_ERR, "Weird HVM iorequest state %d.\n", p->state);
+            gdprintk(XENLOG_ERR, "Weird HVM iorequest state %u\n", state);
             domain_crash(v->domain);
             return; /* bail */
         }

    

commit xen.4554 for openSUSE:13.2:Update

root＠hilbert.suse.de