[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#685221: marked as done (unblock: xen/4.1.3-1)



Your message dated Sat, 18 Aug 2012 16:21:54 +0100
with message-id <1345303314.31960.84.camel@jacala.jungle.funky-badger.org>
and subject line Re: Bug#685221: unblock: xen/4.1.3-1
has caused the Debian Bug report #685221,
regarding unblock: xen/4.1.3-1
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
685221: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=685221
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message ---
Package: release.debian.org
Severity: normal
User: release.debian.org@packages.debian.org
Usertags: unblock

Please unblock xen/4.1.3-1. It updates the package to the release. By
doing this it fixes two security bugs, error handling in exceptional
conditions, missing access control and adds hardware support.

It also includes a build fix (removal of asmlinkage, which is a larger
fraction of the overall patch) for gcc 4.7 that was already fixed for
Debian in a different way.

xen (4.1.3-1) unstable; urgency=medium

  * New upstream release: (closes: #683286)
    - Don't leave the x86 emulation in a bad state. (closes: #683279)
      CVE-2012-3432
    - Only check for shared pages while any exist on teardown.
      CVE-2012-3433
    - Fix error handling for unexpected conditions.
    - Update CPUID masking to latest Intel spec.
    - Allow large ACPI ids.
    - Fix IOMMU support for PCI-to-PCIe bridges.
    - Disallow access to some sensitive IO-ports.
    - Fix wrong address in IOTLB.
    - Fix deadlock on CPUs without working cpufreq driver.
    - Use uncached disk access in qemu.
    - Fix buffer size on emulated e1000 device in qemu.
  * Fixup broken and remove applied patches.

 -- Bastian Blank <waldi@debian.org>  Fri, 17 Aug 2012 11:25:02 +0200

diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/.hg_archival.txt xen-4.1.3/.hg_archival.txt
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/.hg_archival.txt	2012-06-14 10:39:57.000000000 +0000
+++ xen-4.1.3/.hg_archival.txt	2012-08-09 20:08:04.000000000 +0000
@@ -1,5 +1,4 @@
 repo: ab039beb22dc9d53f224a5ef2ef88d534b561898
-node: a9c0a89c08f2a1c92f64f001b653d7c02fbc852c
+node: ce7195d2b80e4df9857e434fa29689fd678a2341
 branch: default
-latesttag: 4.1.3-rc1
-latesttagdistance: 13
+tag: RELEASE-4.1.3
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/.hgsigs xen-4.1.3/.hgsigs
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/.hgsigs	2012-06-14 10:39:57.000000000 +0000
+++ xen-4.1.3/.hgsigs	2012-08-09 20:08:04.000000000 +0000
@@ -16,3 +16,5 @@
 24041ed83728ac6c26d3c32d29d7d08eb8433149 0 iQEcBAABAgAGBQJOjxDqAAoJEIP+FMlX6CvZohIH/2krgh6rTz6hjsv6HOFWQkekqHjZyyQBgdl3tfgSN/vSd3rJPN6mvaYjh8ZltmBbcHcRCmriTr7KK9e6kOChU7hyTCBDmtGxNN5TgMoAf27pSMrFN1HvK0ohQzGXvqKLAepTXW2ew+Abno3OgKRwUMpQJVlq+ZUCuqKODYI9nRE10XV6ORAejgE5mDYNn3BbvcI07Cjmqgm7bJzi5Hv0wzscPuJxQjz4vrJ+5ne65TYOzFPNkIFKeRETP+Shd9Gkw2/w9sbzQ2hzTH/02sUrsxolXD2wexfxgVz07rTe7qgbqKruCBOPtbcnGMAbs3e5NB7V6H3HnkTRtHQ4BosUMnE=
 3eca5bf65e6cca881d599c68f2305f865e0f9fd0 0 iQEcBAABAgAGBQJOoE3xAAoJEIP+FMlX6CvZ0P4IALamOXJi4s9OzfutsjD//V5QYU972Y+NxBo2j7VNKnRaFwZ57RbxLE8dzsAufvxx/886ScyvdehAfWkpqhU+brLfKNftG54Bm3DFd+mDCdcTvHOGkKw768YUPBNjOhQZ8voVSnalrQaOlbibluRTYGK1Y4lcWXwP8SSCCR7bpm8VLrSKQoatiaPtc/OxBO+9UOlHFUR2tWt5YY4a5NczaXJ2xGERMnOssE83GjxSD/07+y9aDLNjnQiYqQfSkF46Gv4s94hPv8KeHEiGDMoZF/YqHr+4YxDCt8y39TXiQfT67O3o9xx6VfynTIHRo9CZ0qGrEqz7o8GK1vWhlfq3T5M=
 da64f68730cf1c42c06919578e70d8bc01041051 0 iQEcBAABAgAGBQJPp8OUAAoJEIP+FMlX6CvZRkEIAKp5iVEADZyijVw0Jwj1vUWKqHJYVONzNjzRcnavWAEzsuwbAxQ6QfMJIai2ThjF79M2w7fPXY03S/vCV4/bXVE9R9s2/IUmS9B6pK+DAhw3ExuNUfsxq9UZd3Iul6hWifjjouYnBmgUtpF7O5z4pfQ+r1+z58FpIYPrv39NARt5YW7tcPeUJh4gOJ0ugORc5CclZqLLiljjIbVY6DN+jJDzjqCAwbWLGbkVw4kEGAeWI6aP3/5ZDpnk9Yytp9GpZ8d3BpmlHaR/kY6xepmZUqBPFGKUGY437+1jKWGgUYPLt2RC0S88W4iLRW6b9HXd7u3bhrn36ERz8XZ10KqjH7A=
+acbd3617691397911f34e4574d03385c08aec900 0 iQEcBAABAgAGBQJP3zbaAAoJEIP+FMlX6CvZoMUH/1TQcdw+e/7BmxtXBnMIrpiTJ7/tffSBYurcoQFq1cTaJJgz5in8iq1JWHgru/ToYQ9PaWY0wVQcb1Yj40rCGNnASlSzQqgRQbYMmZpKd0+TESDtMkl6q1FXECrs8ag/HMHwkVYsgdAEmQ/7IouRK4kBOXXzSWhMRU24YkHdJAnQCcXD9L99Yjmrr5oxF/fgVG7WnhfTGlhpu7FaUeWlDjBRlIuw6HeNnXMwubAn569dGXyPdwJnbU0nCLRrQGjQn7DsmeN25gL4R5Pz+uhp4eeGB7ORYT/mj5+xeS2Cjb3XfptV3qAW2FJVYRLit7lp5cmsKvtBnr8mAO8GS0R+8Pg=
+5cdcfed7b5b129843e1602b5d43c7651de337092 0 iQEcBAABAgAGBQJQDB6TAAoJEIP+FMlX6CvZ+H8IAJbWR4PrKOt3gMpgEYdADts96vtduD3oet5C+l8FSlo0pDPtF32wPQ5tQz+Ll8OtCFckSIzobsw+9IMrZ38nRwP1UM2LgLUuo6WVVwYZ4DKVIntDrC1DV6Us1CmGiHiTHqPNDypBB2NponJ21rlD8zRY4Q661BgdKXVwqq5H6SDtxNRSn7RPDYnsIvavabr0fvcR38YOHVG4TvfXP+uge0UfEvIurGEBnTn25E0vadLG9la9SGKeEm8HuTDnzuxQmSic7tPdodQ0oQYQ5AAj+/mdW2B9uaCDsmOeP4udDNcV4yXxdLxNA2GkeSSJ/+U0hj2HBaHZvd+hvAeHBZGdMAU=
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/.hgtags xen-4.1.3/.hgtags
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/.hgtags	2012-06-14 10:39:57.000000000 +0000
+++ xen-4.1.3/.hgtags	2012-08-09 20:08:04.000000000 +0000
@@ -63,3 +63,5 @@
 24041ed83728ac6c26d3c32d29d7d08eb8433149 4.1.2-rc3
 3eca5bf65e6cca881d599c68f2305f865e0f9fd0 RELEASE-4.1.2
 da64f68730cf1c42c06919578e70d8bc01041051 4.1.3-rc1
+acbd3617691397911f34e4574d03385c08aec900 4.1.3-rc2
+5cdcfed7b5b129843e1602b5d43c7651de337092 4.1.3-rc3
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/Config.mk xen-4.1.3/Config.mk
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/Config.mk	2012-08-18 11:44:33.000000000 +0000
+++ xen-4.1.3/Config.mk	2012-08-18 11:44:27.000000000 +0000
@@ -179,7 +179,7 @@
 # CONFIG_QEMU ?= `pwd`/$(XEN_ROOT)/../qemu-xen.git
 CONFIG_QEMU ?= $(QEMU_REMOTE)
 
-QEMU_TAG ?= xen-4.1.3-rc1
+QEMU_TAG ?= xen-4.1.3
 # Mon Apr 2 17:55:05 2012 +0100
 # qemu-xen-traditional: QDISK fixes
 
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/debian/changelog xen-4.1.3/debian/changelog
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/debian/changelog	2012-07-28 08:23:49.000000000 +0000
+++ xen-4.1.3/debian/changelog	2012-08-17 09:25:55.000000000 +0000
@@ -1,3 +1,23 @@
+xen (4.1.3-1) unstable; urgency=medium
+
+  * New upstream release: (closes: #683286)
+    - Don't leave the x86 emulation in a bad state. (closes: #683279)
+      CVE-2012-3432
+    - Only check for shared pages while any exist on teardown.
+      CVE-2012-3433
+    - Fix error handling for unexpected conditions.
+    - Update CPUID masking to latest Intel spec.
+    - Allow large ACPI ids.
+    - Fix IOMMU support for PCI-to-PCIe bridges.
+    - Disallow access to some sensitive IO-ports.
+    - Fix wrong address in IOTLB.
+    - Fix deadlock on CPUs without working cpufreq driver.
+    - Use uncached disk access in qemu.
+    - Fix buffer size on emulated e1000 device in qemu.
+  * Fixup broken and remove applied patches.
+
+ -- Bastian Blank <waldi@debian.org>  Fri, 17 Aug 2012 11:25:02 +0200
+
 xen (4.1.3~rc1+hg-20120614.a9c0a89c08f2-5) unstable; urgency=low
 
   [ Ian Campbell ]
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/debian/control.md5sum xen-4.1.3/debian/control.md5sum
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/debian/control.md5sum	2012-07-28 08:24:09.000000000 +0000
+++ xen-4.1.3/debian/control.md5sum	2012-08-17 09:27:06.000000000 +0000
@@ -1,4 +1,4 @@
-478e166c79e05c696584c9ba633c0d7e  debian/changelog
+05bf20e67873f3a3cca030d54cbeb222  debian/changelog
 2cfc80dad0da6ef5789993726da25549  debian/bin/gencontrol.py
 667edd28bcda9cd243bb69c78e452aad  debian/templates/control.hypervisor.in
 4106f2621fc4dad25c0d6569b51cbce3  debian/templates/control.main.in
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/debian/patches/series xen-4.1.3/debian/patches/series
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/debian/patches/series	2012-07-01 14:45:10.000000000 +0000
+++ xen-4.1.3/debian/patches/series	2012-08-16 20:34:51.000000000 +0000
@@ -2,7 +2,6 @@
 upstream-23937:5173834e8476
 upstream-23938:fa04fbd56521-rework
 upstream-23939:51288f69523f-rework
-upstream-23940:187d59e32a58
 upstream-25290:7a6dcecb1781-rework
 
 xen-x86-interrupt-pointer-missmatch.diff
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/debian/patches/tools-pygrub-remove-static-solaris-support.patch xen-4.1.3/debian/patches/tools-pygrub-remove-static-solaris-support.patch
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/debian/patches/tools-pygrub-remove-static-solaris-support.patch	2011-03-16 16:18:07.000000000 +0000
+++ xen-4.1.3/debian/patches/tools-pygrub-remove-static-solaris-support.patch	2012-08-06 15:39:30.000000000 +0000
@@ -8,7 +8,7 @@
  
  import curses, _curses, curses.wrapper, curses.textpad, curses.ascii
  import getopt
-@@ -585,48 +584,6 @@
+@@ -595,51 +594,6 @@
  
      return grubcfg
  
@@ -23,7 +23,8 @@
 -# If nothing has been specified, look for a Solaris domU. If found, perform the
 -# necessary tweaks.
 -def sniff_solaris(fs, cfg):
--    if not fs.file_exists("/platform/i86xpv/kernel/unix"):
+-    if not fs.file_exists("/platform/i86xpv/kernel/unix") and \
+-       not fs.file_exists("/platform/i86xpv/kernel/amd64/unix"):
 -        return cfg
 -
 -    if not cfg["kernel"]:
@@ -31,9 +32,11 @@
 -          fs.file_exists("/platform/i86xpv/kernel/amd64/unix"):
 -            cfg["kernel"] = "/platform/i86xpv/kernel/amd64/unix"
 -            cfg["ramdisk"] = "/platform/i86pc/amd64/boot_archive"
--        else:
+-        elif fs.file_exists("/platform/i86xpv/kernel/unix"):
 -            cfg["kernel"] = "/platform/i86xpv/kernel/unix"
 -            cfg["ramdisk"] = "/platform/i86pc/boot_archive"
+-        else:
+-            return cfg
 -
 -    # Unpleasant. Typically we'll have 'root=foo -k' or 'root=foo /kernel -k',
 -    # and we need to maintain Xen properties (root= and ip=) and the kernel
@@ -57,7 +60,7 @@
  def sniff_netware(fs, cfg):
      if not fs.file_exists("/nwserver/xnloader.sys"):
          return cfg
-@@ -751,10 +708,7 @@
+@@ -764,10 +718,7 @@
          try:
              fs = fsimage.open(file, offset, bootfsoptions)
  
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/debian/patches/upstream-23936:cdb34816a40a-rework xen-4.1.3/debian/patches/upstream-23936:cdb34816a40a-rework
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/debian/patches/upstream-23936:cdb34816a40a-rework	2011-12-06 21:43:59.000000000 +0000
+++ xen-4.1.3/debian/patches/upstream-23936:cdb34816a40a-rework	2012-08-16 20:34:51.000000000 +0000
@@ -2430,7 +2430,7 @@
 -
 -	for (i=0; i<len; i++) {
 -		if (Bool_val(Field(cpumap, i)))
--			c_cpumap[i/8] |= i << (i&7);
+-			c_cpumap[i/8] |= 1 << (i&7);
 -	}
 -	retval = xc_vcpu_setaffinity(_H(xch), _D(domid),
 -	                             Int_val(vcpu), c_cpumap);
@@ -2466,7 +2466,7 @@
 -	ret = caml_alloc(len, 0);
 -
 -	for (i=0; i<len; i++) {
--		if (c_cpumap[i%8] & 1 << (i&7))
+-		if (c_cpumap[i/8] & 1 << (i&7))
 -			Store_field(ret, i, Val_true);
 -		else
 -			Store_field(ret, i, Val_false);
@@ -2523,7 +2523,7 @@
 -
 -CAMLprim value stub_xc_readconsolering(value xch)
 -{
--	unsigned int size = RING_SIZE;
+-	unsigned int size = RING_SIZE - 1;
 -	char *ring_ptr = ring;
 -
 -	CAMLparam1(xch);
@@ -4110,7 +4110,7 @@
 +
 +	for (i=0; i<len; i++) {
 +		if (Bool_val(Field(cpumap, i)))
-+			c_cpumap[i/8] |= i << (i&7);
++			c_cpumap[i/8] |= 1 << (i&7);
 +	}
 +	retval = xc_vcpu_setaffinity(_H(xch), _D(domid),
 +	                             Int_val(vcpu), c_cpumap);
@@ -4146,7 +4146,7 @@
 +	ret = caml_alloc(len, 0);
 +
 +	for (i=0; i<len; i++) {
-+		if (c_cpumap[i%8] & 1 << (i&7))
++		if (c_cpumap[i/8] & 1 << (i&7))
 +			Store_field(ret, i, Val_true);
 +		else
 +			Store_field(ret, i, Val_false);
@@ -4203,7 +4203,7 @@
 +
 +CAMLprim value stub_xc_readconsolering(value xch)
 +{
-+	unsigned int size = RING_SIZE;
++	unsigned int size = RING_SIZE - 1;
 +	char *ring_ptr = ring;
 +
 +	CAMLparam1(xch);
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/debian/patches/upstream-23940:187d59e32a58 xen-4.1.3/debian/patches/upstream-23940:187d59e32a58
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/debian/patches/upstream-23940:187d59e32a58	2011-12-06 21:43:59.000000000 +0000
+++ xen-4.1.3/debian/patches/upstream-23940:187d59e32a58	1970-01-01 00:00:00.000000000 +0000
@@ -1,45 +0,0 @@
-# HG changeset patch
-# User Jon Ludlam <jonathan.ludlam@eu.citrix.com>
-# Date 1318261276 -3600
-# Node ID 187d59e32a586d65697ed46bef106b52e3fb5ab9
-# Parent  51288f69523fcbbefa12cea5a761a6e957410151
-tools/ocaml: Fix 2 bit-twiddling bugs and an off-by-one
-
-The bit bugs are in ocaml vcpu affinity calls, and the off-by-one
-error is in the ocaml console ring code
-
-Signed-off-by: Zheng Li <zheng.li@eu.citrix.com>
-Acked-by: Ian Campbell <ian.campbell.com>
-Committed-by: Ian Jackson <ian.jackson.citrix.com>
-Acked-by: Jon Ludlam <jonathan.ludlam@eu.citrix.com>
-
-diff -r 51288f69523f -r 187d59e32a58 tools/ocaml/libs/xc/xenctrl_stubs.c
---- a/tools/ocaml/libs/xc/xenctrl_stubs.c	Mon Oct 10 16:41:16 2011 +0100
-+++ b/tools/ocaml/libs/xc/xenctrl_stubs.c	Mon Oct 10 16:41:16 2011 +0100
-@@ -430,7 +430,7 @@
- 
- 	for (i=0; i<len; i++) {
- 		if (Bool_val(Field(cpumap, i)))
--			c_cpumap[i/8] |= i << (i&7);
-+			c_cpumap[i/8] |= 1 << (i&7);
- 	}
- 	retval = xc_vcpu_setaffinity(_H(xch), _D(domid),
- 	                             Int_val(vcpu), c_cpumap);
-@@ -466,7 +466,7 @@
- 	ret = caml_alloc(len, 0);
- 
- 	for (i=0; i<len; i++) {
--		if (c_cpumap[i%8] & 1 << (i&7))
-+		if (c_cpumap[i/8] & 1 << (i&7))
- 			Store_field(ret, i, Val_true);
- 		else
- 			Store_field(ret, i, Val_false);
-@@ -523,7 +523,7 @@
- 
- CAMLprim value stub_xc_readconsolering(value xch)
- {
--	unsigned int size = RING_SIZE;
-+	unsigned int size = RING_SIZE - 1;
- 	char *ring_ptr = ring;
- 
- 	CAMLparam1(xch);
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/qemu/hw/e1000.c xen-4.1.3/qemu/hw/e1000.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/qemu/hw/e1000.c	2011-04-28 07:38:36.000000000 +0000
+++ xen-4.1.3/qemu/hw/e1000.c	2012-04-24 17:35:40.000000000 +0000
@@ -444,6 +444,8 @@
             bytes = split_size;
             if (tp->size + bytes > msh)
                 bytes = msh - tp->size;
+
+            bytes = MIN(sizeof(tp->data) - tp->size, bytes);
             cpu_physical_memory_read(addr, tp->data + tp->size, bytes);
             if ((sz = tp->size + bytes) >= hdr && tp->size < hdr)
                 memmove(tp->header, tp->data, hdr);
@@ -459,6 +461,7 @@
         // context descriptor TSE is not set, while data descriptor TSE is set
         DBGOUT(TXERR, "TCP segmentaion Error\n");
     } else {
+        split_size = MIN(sizeof(tp->data) - tp->size, split_size);
         cpu_physical_memory_read(addr, tp->data + tp->size, split_size);
         tp->size += split_size;
     }
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/qemu/hw/pci.h xen-4.1.3/qemu/hw/pci.h
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/qemu/hw/pci.h	2011-04-28 07:38:36.000000000 +0000
+++ xen-4.1.3/qemu/hw/pci.h	2012-04-24 17:35:40.000000000 +0000
@@ -177,9 +177,15 @@
 #define PCI_STATUS_RESERVED1	0x007
 #define PCI_STATUS_INT_STATUS	0x008
 #define PCI_STATUS_CAPABILITIES	0x010
+#ifndef PCI_STATUS_66MHZ
 #define PCI_STATUS_66MHZ	0x020
+#endif
+#ifndef PCI_STATUS_RESERVED2
 #define PCI_STATUS_RESERVED2	0x040
+#endif
+#ifndef PCI_STATUS_FAST_BACK
 #define PCI_STATUS_FAST_BACK	0x080
+#endif
 #define PCI_STATUS_DEVSEL	0x600
 
 #define PCI_STATUS_RESERVED_MASK_LO (PCI_STATUS_RESERVED1 | \
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/qemu/hw/pt-msi.h xen-4.1.3/qemu/hw/pt-msi.h
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/qemu/hw/pt-msi.h	2011-04-28 07:38:36.000000000 +0000
+++ xen-4.1.3/qemu/hw/pt-msi.h	2012-04-24 17:35:40.000000000 +0000
@@ -26,7 +26,9 @@
 /* MSI-X */
 #define  PCI_MSIX_ENABLE    0x8000
 #define  PCI_MSIX_MASK      0x4000
+#ifndef PCI_MSIX_TABSIZE
 #define  PCI_MSIX_TABSIZE   0x03ff
+#endif
 #define PCI_MSIX_TABLE      4
 #define PCI_MSIX_PBA        8
 #define  PCI_MSIX_BIR       0x7
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/qemu/hw/xen_console.c xen-4.1.3/qemu/hw/xen_console.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/qemu/hw/xen_console.c	2011-04-28 07:38:36.000000000 +0000
+++ xen-4.1.3/qemu/hw/xen_console.c	2012-04-24 17:35:40.000000000 +0000
@@ -253,6 +253,8 @@
 {
     struct XenConsole *con = container_of(xendev, struct XenConsole, xendev);
 
+    if (!xendev->dev)
+        return;
     if (con->chr)
         qemu_chr_add_handlers(con->chr, NULL, NULL, NULL, NULL);
     xen_be_unbind_evtchn(&con->xendev);
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/qemu/hw/xen_disk.c xen-4.1.3/qemu/hw/xen_disk.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/qemu/hw/xen_disk.c	2011-04-28 07:38:36.000000000 +0000
+++ xen-4.1.3/qemu/hw/xen_disk.c	2012-04-24 17:35:40.000000000 +0000
@@ -46,11 +46,11 @@
 
 /* ------------------------------------------------------------- */
 
-static int syncwrite    = 1;
-static int batch_maps   = 0;
+static int syncwrite    = 0;
+static int batch_maps   = 1;
 
 static int max_requests = 32;
-static int use_aio      = 0;
+static int use_aio      = 1;
 
 /* ------------------------------------------------------------- */
 
@@ -382,6 +382,8 @@
     ioreq->aio_inflight--;
     if (ioreq->aio_inflight > 0)
         return;
+    if (ioreq->postsync)
+	bdrv_flush(ioreq->blkdev->bs);
 
     ioreq->status = ioreq->aio_errors ? BLKIF_RSP_ERROR : BLKIF_RSP_OKAY;
     ioreq_unmap(ioreq);
@@ -409,9 +411,9 @@
 	break;
     case BLKIF_OP_WRITE:
     case BLKIF_OP_WRITE_BARRIER:
-        ioreq->aio_inflight++;
         if (!ioreq->req.nr_segments)
             break;
+        ioreq->aio_inflight++;
         bdrv_aio_writev(blkdev->bs, ioreq->start / BLOCK_SIZE,
                         &ioreq->v, ioreq->v.size / BLOCK_SIZE,
                         qemu_aio_complete, ioreq);
@@ -421,8 +423,6 @@
 	goto err;
     }
 
-    if (ioreq->postsync)
-	bdrv_flush(blkdev->bs); /* FIXME: aio_flush() ??? */
     qemu_aio_complete(ioreq, 0);
 
     return 0;
@@ -617,12 +617,13 @@
 	return -1;
 
     /* read-only ? */
+    qflags = BDRV_O_NOCACHE;
     if (strcmp(blkdev->mode, "w") == 0) {
 	mode   = O_RDWR;
-	qflags = BDRV_O_RDWR;
+	qflags |= BDRV_O_RDWR;
     } else {
 	mode   = O_RDONLY;
-	qflags = BDRV_O_RDONLY;
+	qflags |= BDRV_O_RDONLY;
 	info  |= VDISK_READONLY;
     }
 
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/qemu/xenstore.c xen-4.1.3/qemu/xenstore.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/qemu/xenstore.c	2011-04-28 07:38:36.000000000 +0000
+++ xen-4.1.3/qemu/xenstore.c	2012-04-24 17:35:40.000000000 +0000
@@ -643,7 +643,7 @@
 	    }
             pstrcpy(bs->filename, sizeof(bs->filename), params);
 
-            flags = BDRV_O_CACHE_WB; /* snapshot and write-back */
+            flags = BDRV_O_NOCACHE;
             is_readonly = 0;
             if (pasprintf(&buf, "%s/mode", bpath) == -1)
                 continue;
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/Makefile xen-4.1.3/xen/Makefile
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/Makefile	2012-08-18 11:44:33.000000000 +0000
+++ xen-4.1.3/xen/Makefile	2012-08-18 11:44:27.000000000 +0000
@@ -2,7 +2,7 @@
 # All other places this is stored (eg. compile.h) should be autogenerated.
 export XEN_VERSION       = 4
 export XEN_SUBVERSION    = 1
-export XEN_EXTRAVERSION ?= .3-rc2-pre$(XEN_VENDORVERSION)
+export XEN_EXTRAVERSION ?= .3$(XEN_VENDORVERSION)
 export XEN_FULLVERSION   = $(XEN_VERSION).$(XEN_SUBVERSION)$(XEN_EXTRAVERSION)
 -include xen-version
 
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/ia64/linux-xen/acpi.c xen-4.1.3/xen/arch/ia64/linux-xen/acpi.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/ia64/linux-xen/acpi.c	2012-06-14 10:39:59.000000000 +0000
+++ xen-4.1.3/xen/arch/ia64/linux-xen/acpi.c	2012-08-09 20:08:08.000000000 +0000
@@ -223,11 +223,14 @@
 		{[0 ... MAX_LOCAL_SAPIC - 1] = 0xffff };
 
 /* acpi id to cpu id */
-int get_cpu_id(u8 acpi_id)
+int get_cpu_id(u32 acpi_id)
 {
 	int i;
 	u16 apic_id;
 
+	if ( acpi_id >= MAX_LOCAL_SAPIC )
+		return -EINVAL;
+
 	apic_id = ia64_acpiid_to_sapicid[acpi_id];
 	if ( apic_id == 0xffff )
 		return -EINVAL;
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/acpi/cpu_idle.c xen-4.1.3/xen/arch/x86/acpi/cpu_idle.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/acpi/cpu_idle.c	2012-06-14 10:39:59.000000000 +0000
+++ xen-4.1.3/xen/arch/x86/acpi/cpu_idle.c	2012-08-09 20:08:08.000000000 +0000
@@ -44,6 +44,7 @@
 #include <xen/sched-if.h>
 #include <asm/cache.h>
 #include <asm/io.h>
+#include <asm/iocap.h>
 #include <asm/hpet.h>
 #include <asm/processor.h>
 #include <xen/pmstat.h>
@@ -111,6 +112,7 @@
     /* Westmere */
     case 0x25:
     case 0x2C:
+    case 0x2F:
         GET_PC3_RES(hw_res->pc3);
         GET_PC6_RES(hw_res->pc6);
         GET_PC7_RES(hw_res->pc7);
@@ -887,6 +889,9 @@
             cx->entry_method = ACPI_CSTATE_EM_HALT;
         break;
     case ACPI_ADR_SPACE_SYSTEM_IO:
+        if ( ioports_deny_access(dom0, cx->address, cx->address) )
+            printk(XENLOG_WARNING "Could not deny access to port %04x\n",
+                   cx->address);
         cx->entry_method = ACPI_CSTATE_EM_SYSIO;
         break;
     default:
@@ -902,11 +907,14 @@
         acpi_power->safe_state = cx;
 }
 
-int get_cpu_id(u8 acpi_id)
+int get_cpu_id(u32 acpi_id)
 {
     int i;
     u32 apic_id;
 
+    if ( acpi_id >= MAX_MADT_ENTRIES )
+        return -1;
+
     apic_id = x86_acpiid_to_apicid[acpi_id];
     if ( apic_id == BAD_APICID )
         return -1;
@@ -983,7 +991,7 @@
     print_cx_pminfo(cpu, power);
 
     /* map from acpi_id to cpu_id */
-    cpu_id = get_cpu_id((u8)cpu);
+    cpu_id = get_cpu_id(cpu);
     if ( cpu_id == -1 )
     {
         printk(XENLOG_ERR "no cpu_id for acpi_id %d\n", cpu);
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/acpi/power.c xen-4.1.3/xen/arch/x86/acpi/power.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/acpi/power.c	2012-06-14 10:39:59.000000000 +0000
+++ xen-4.1.3/xen/arch/x86/acpi/power.c	2012-08-09 20:08:08.000000000 +0000
@@ -321,7 +321,7 @@
 }
 
 /* System is really put into sleep state by this stub */
-acpi_status asmlinkage acpi_enter_sleep_state(u8 sleep_state)
+acpi_status acpi_enter_sleep_state(u8 sleep_state)
 {
     acpi_status status;
 
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/cpu/common.c xen-4.1.3/xen/arch/x86/cpu/common.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/cpu/common.c	2012-06-14 10:39:59.000000000 +0000
+++ xen-4.1.3/xen/arch/x86/cpu/common.c	2012-08-09 20:08:08.000000000 +0000
@@ -27,10 +27,15 @@
 
 static bool_t __cpuinitdata use_xsave;
 boolean_param("xsave", use_xsave);
+
 unsigned int __devinitdata opt_cpuid_mask_ecx = ~0u;
 integer_param("cpuid_mask_ecx", opt_cpuid_mask_ecx);
 unsigned int __devinitdata opt_cpuid_mask_edx = ~0u;
 integer_param("cpuid_mask_edx", opt_cpuid_mask_edx);
+
+unsigned int __devinitdata opt_cpuid_mask_xsave_eax = ~0u;
+integer_param("cpuid_mask_xsave_eax", opt_cpuid_mask_xsave_eax);
+
 unsigned int __devinitdata opt_cpuid_mask_ext_ecx = ~0u;
 integer_param("cpuid_mask_ext_ecx", opt_cpuid_mask_ext_ecx);
 unsigned int __devinitdata opt_cpuid_mask_ext_edx = ~0u;
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/cpu/cpu.h xen-4.1.3/xen/arch/x86/cpu/cpu.h
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/cpu/cpu.h	2012-06-14 10:39:59.000000000 +0000
+++ xen-4.1.3/xen/arch/x86/cpu/cpu.h	2012-08-09 20:08:08.000000000 +0000
@@ -22,6 +22,7 @@
 extern struct cpu_dev * cpu_devs [X86_VENDOR_NUM];
 
 extern unsigned int opt_cpuid_mask_ecx, opt_cpuid_mask_edx;
+extern unsigned int opt_cpuid_mask_xsave_eax;
 extern unsigned int opt_cpuid_mask_ext_ecx, opt_cpuid_mask_ext_edx;
 
 extern int get_model_name(struct cpuinfo_x86 *c);
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/cpu/intel.c xen-4.1.3/xen/arch/x86/cpu/intel.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/cpu/intel.c	2012-06-14 10:39:59.000000000 +0000
+++ xen-4.1.3/xen/arch/x86/cpu/intel.c	2012-08-09 20:08:08.000000000 +0000
@@ -59,10 +59,12 @@
  */
 static void __devinit set_cpuidmask(const struct cpuinfo_x86 *c)
 {
+	u32 eax, edx;
 	const char *extra = "";
 
 	if (!~(opt_cpuid_mask_ecx & opt_cpuid_mask_edx &
-	       opt_cpuid_mask_ext_ecx & opt_cpuid_mask_ext_edx))
+	       opt_cpuid_mask_ext_ecx & opt_cpuid_mask_ext_edx &
+               opt_cpuid_mask_xsave_eax))
 		return;
 
 	/* Only family 6 supports this feature  */
@@ -75,7 +77,11 @@
 		wrmsr(MSR_INTEL_CPUID_FEATURE_MASK,
 		      opt_cpuid_mask_ecx,
 		      opt_cpuid_mask_edx);
-		if (!~(opt_cpuid_mask_ext_ecx & opt_cpuid_mask_ext_edx))
+		if (~(opt_cpuid_mask_ext_ecx & opt_cpuid_mask_ext_edx))
+			extra = "extended ";
+		else if (~opt_cpuid_mask_xsave_eax)
+			extra = "xsave ";
+		else
 			return;
 		extra = "extended ";
 		break;
@@ -97,11 +103,25 @@
 		wrmsr(MSR_INTEL_CPUID80000001_FEATURE_MASK,
 		      opt_cpuid_mask_ext_ecx,
 		      opt_cpuid_mask_ext_edx);
+		if (!~opt_cpuid_mask_xsave_eax)
+			return;
+		extra = "xsave ";
+		break;
+	case 0x2a:
+		wrmsr(MSR_INTEL_CPUID1_FEATURE_MASK_V2,
+		      opt_cpuid_mask_ecx,
+		      opt_cpuid_mask_edx);
+		rdmsr(MSR_INTEL_CPUIDD_01_FEATURE_MASK, eax, edx);
+		wrmsr(MSR_INTEL_CPUIDD_01_FEATURE_MASK,
+		      opt_cpuid_mask_xsave_eax, edx);
+		wrmsr(MSR_INTEL_CPUID80000001_FEATURE_MASK_V2,
+		      opt_cpuid_mask_ext_ecx,
+		      opt_cpuid_mask_ext_edx);
 		return;
 	}
 
-	printk(XENLOG_ERR "Cannot set CPU feature mask on CPU#%d\n",
-	       smp_processor_id());
+	printk(XENLOG_ERR "Cannot set CPU %sfeature mask on CPU#%d\n",
+	       extra, smp_processor_id());
 }
 
 void __devinit early_intel_workaround(struct cpuinfo_x86 *c)
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/domctl.c xen-4.1.3/xen/arch/x86/domctl.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/domctl.c	2012-06-14 10:39:59.000000000 +0000
+++ xen-4.1.3/xen/arch/x86/domctl.c	2012-08-09 20:08:08.000000000 +0000
@@ -873,7 +873,7 @@
             break;
         }
 
-        ret = xsm_assign_device(d, domctl->u.assign_device.machine_bdf);
+        ret = xsm_deassign_device(d, domctl->u.assign_device.machine_bdf);
         if ( ret )
             goto deassign_device_out;
 
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/hvm/hvm.c xen-4.1.3/xen/arch/x86/hvm/hvm.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/hvm/hvm.c	2012-06-14 10:39:59.000000000 +0000
+++ xen-4.1.3/xen/arch/x86/hvm/hvm.c	2012-08-09 20:08:08.000000000 +0000
@@ -1109,7 +1109,7 @@
     domain_shutdown(v->domain, SHUTDOWN_reboot);
 }
 
-bool_t hvm_hap_nested_page_fault(unsigned long gpa,
+bool_t hvm_hap_nested_page_fault(paddr_t gpa,
                                  bool_t gla_valid,
                                  unsigned long gla,
                                  bool_t access_valid,
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/hvm/io.c xen-4.1.3/xen/arch/x86/hvm/io.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/hvm/io.c	2012-06-14 10:39:59.000000000 +0000
+++ xen-4.1.3/xen/arch/x86/hvm/io.c	2012-08-09 20:08:08.000000000 +0000
@@ -176,6 +176,8 @@
 
     rc = hvm_emulate_one(&ctxt);
 
+    if ( rc != X86EMUL_RETRY )
+        curr->arch.hvm_vcpu.io_state = HVMIO_none;
     if ( curr->arch.hvm_vcpu.io_state == HVMIO_awaiting_completion )
         curr->arch.hvm_vcpu.io_state = HVMIO_handle_mmio_awaiting_completion;
     else
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/hvm/svm/asid.c xen-4.1.3/xen/arch/x86/hvm/svm/asid.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/hvm/svm/asid.c	2012-06-14 10:39:59.000000000 +0000
+++ xen-4.1.3/xen/arch/x86/hvm/svm/asid.c	2012-08-09 20:08:08.000000000 +0000
@@ -38,7 +38,7 @@
  * Called directly before VMRUN.  Checks if the VCPU needs a new ASID,
  * assigns it, and if required, issues required TLB flushes.
  */
-asmlinkage void svm_asid_handle_vmrun(void)
+void svm_asid_handle_vmrun(void)
 {
     struct vcpu *curr = current;
     struct vmcb_struct *vmcb = curr->arch.hvm_svm.vmcb;
@@ -52,7 +52,8 @@
         return;
     }
 
-    vmcb_set_guest_asid(vmcb, curr->arch.hvm_vcpu.asid);
+    if (vmcb_get_guest_asid(vmcb) != curr->arch.hvm_vcpu.asid)
+        vmcb_set_guest_asid(vmcb, curr->arch.hvm_vcpu.asid);
     vmcb->tlb_control = need_flush;
 }
 
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/hvm/svm/intr.c xen-4.1.3/xen/arch/x86/hvm/svm/intr.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/hvm/svm/intr.c	2012-06-14 10:39:59.000000000 +0000
+++ xen-4.1.3/xen/arch/x86/hvm/svm/intr.c	2012-08-09 20:08:08.000000000 +0000
@@ -116,7 +116,7 @@
         vmcb, general1_intercepts | GENERAL1_INTERCEPT_VINTR);
 }
 
-asmlinkage void svm_intr_assist(void) 
+void svm_intr_assist(void) 
 {
     struct vcpu *v = current;
     struct vmcb_struct *vmcb = v->arch.hvm_svm.vmcb;
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/hvm/svm/svm.c xen-4.1.3/xen/arch/x86/hvm/svm/svm.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/hvm/svm/svm.c	2012-06-14 10:39:59.000000000 +0000
+++ xen-4.1.3/xen/arch/x86/hvm/svm/svm.c	2012-08-09 20:08:08.000000000 +0000
@@ -1534,7 +1534,7 @@
     .get_insn_bytes       = svm_get_insn_bytes,
 };
 
-asmlinkage void svm_vmexit_handler(struct cpu_user_regs *regs)
+void svm_vmexit_handler(struct cpu_user_regs *regs)
 {
     unsigned int exit_reason;
     struct vcpu *v = current;
@@ -1851,7 +1851,7 @@
     vmcb_set_vintr(vmcb, intr);
 }
 
-asmlinkage void svm_trace_vmentry(void)
+void svm_trace_vmentry(void)
 {
     HVMTRACE_ND (VMENTRY, 1/*cycles*/, 0, 0, 0, 0, 0, 0, 0);
 }
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/hvm/vmx/intr.c xen-4.1.3/xen/arch/x86/hvm/vmx/intr.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/hvm/vmx/intr.c	2012-06-14 10:39:59.000000000 +0000
+++ xen-4.1.3/xen/arch/x86/hvm/vmx/intr.c	2012-08-09 20:08:08.000000000 +0000
@@ -109,7 +109,7 @@
     }
 }
 
-asmlinkage void vmx_intr_assist(void)
+void vmx_intr_assist(void)
 {
     struct hvm_intack intack;
     struct vcpu *v = current;
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/hvm/vmx/vmx.c xen-4.1.3/xen/arch/x86/hvm/vmx/vmx.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/hvm/vmx/vmx.c	2012-06-14 10:39:59.000000000 +0000
+++ xen-4.1.3/xen/arch/x86/hvm/vmx/vmx.c	2012-08-09 20:08:08.000000000 +0000
@@ -2035,7 +2035,7 @@
     domain_crash(curr->domain);
 }
 
-asmlinkage void vmx_enter_realmode(struct cpu_user_regs *regs)
+void vmx_enter_realmode(struct cpu_user_regs *regs)
 {
     struct vcpu *v = current;
 
@@ -2089,7 +2089,7 @@
     return 0;
 }
 
-asmlinkage void vmx_vmexit_handler(struct cpu_user_regs *regs)
+void vmx_vmexit_handler(struct cpu_user_regs *regs)
 {
     unsigned int exit_reason, idtv_info, intr_info = 0, vector = 0;
     unsigned long exit_qualification, inst_len = 0;
@@ -2518,7 +2518,7 @@
     }
 }
 
-asmlinkage void vmx_vmenter_helper(void)
+void vmx_vmenter_helper(void)
 {
     struct vcpu *curr = current;
     u32 new_asid, old_asid;
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/io_apic.c xen-4.1.3/xen/arch/x86/io_apic.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/io_apic.c	2012-06-14 10:39:59.000000000 +0000
+++ xen-4.1.3/xen/arch/x86/io_apic.c	2012-08-09 20:08:08.000000000 +0000
@@ -2665,7 +2665,7 @@
         }
     }
 
-    nr_irqs_gsi = max(nr_irqs_gsi, highest_gsi());
+    nr_irqs_gsi = max(nr_irqs_gsi, highest_gsi() + 1);
 
     if ( max_gsi_irqs == 0 )
         max_gsi_irqs = nr_irqs ? nr_irqs / 8 : PAGE_SIZE;
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/irq.c xen-4.1.3/xen/arch/x86/irq.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/irq.c	2012-06-14 10:39:59.000000000 +0000
+++ xen-4.1.3/xen/arch/x86/irq.c	2012-08-09 20:08:08.000000000 +0000
@@ -636,7 +636,7 @@
 
 DEFINE_PER_CPU(unsigned int, irq_count);
 
-asmlinkage void do_IRQ(struct cpu_user_regs *regs)
+void do_IRQ(struct cpu_user_regs *regs)
 {
     struct irqaction *action;
     uint32_t          tsc_in;
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/mm/p2m.c xen-4.1.3/xen/arch/x86/mm/p2m.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/mm/p2m.c	2012-06-14 10:39:59.000000000 +0000
+++ xen-4.1.3/xen/arch/x86/mm/p2m.c	2012-08-09 20:08:08.000000000 +0000
@@ -2044,6 +2044,8 @@
 #ifdef __x86_64__
     for ( gfn=0; gfn < p2m->max_mapped_pfn; gfn++ )
     {
+        if ( atomic_read(&d->shr_pages) == 0 )
+            break;
         mfn = p2m->get_entry(p2m, gfn, &t, &a, p2m_query);
         if ( mfn_valid(mfn) && (t == p2m_ram_shared) )
             BUG_ON(mem_sharing_unshare_page(p2m, gfn, MEM_SHARING_DESTROY_GFN));
@@ -3032,7 +3034,7 @@
     mem_event_unpause_vcpus(d);
 }
 
-void p2m_mem_access_check(unsigned long gpa, bool_t gla_valid, unsigned long gla, 
+void p2m_mem_access_check(paddr_t gpa, bool_t gla_valid, unsigned long gla, 
                           bool_t access_r, bool_t access_w, bool_t access_x)
 {
     struct vcpu *v = current;
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/trace.c xen-4.1.3/xen/arch/x86/trace.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/trace.c	2012-06-14 10:39:59.000000000 +0000
+++ xen-4.1.3/xen/arch/x86/trace.c	2012-08-09 20:08:09.000000000 +0000
@@ -11,7 +11,7 @@
 #define TRC_64_FLAG 0
 #endif
 
-asmlinkage void trace_hypercall(void)
+void trace_hypercall(void)
 {
     struct cpu_user_regs *regs = guest_cpu_user_regs();
 
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/traps.c xen-4.1.3/xen/arch/x86/traps.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/traps.c	2012-06-14 10:39:59.000000000 +0000
+++ xen-4.1.3/xen/arch/x86/traps.c	2012-08-09 20:08:09.000000000 +0000
@@ -420,7 +420,7 @@
  * are disabled). In such situations we can't do much that is safe. We try to
  * print out some tracing and then we just spin.
  */
-asmlinkage void fatal_trap(int trapnr, struct cpu_user_regs *regs)
+void fatal_trap(int trapnr, struct cpu_user_regs *regs)
 {
     static DEFINE_PER_CPU(char, depth);
 
@@ -534,7 +534,7 @@
  * Called from asm to set up the MCE trapbounce info.
  * Returns 0 if no callback is set up, else 1.
  */
-asmlinkage int set_guest_machinecheck_trapbounce(void)
+int set_guest_machinecheck_trapbounce(void)
 {
     struct vcpu *v = current;
     struct trap_bounce *tb = &v->arch.trap_bounce;
@@ -548,7 +548,7 @@
  * Called from asm to set up the NMI trapbounce info.
  * Returns 0 if no callback is set up, else 1.
  */
-asmlinkage int set_guest_nmi_trapbounce(void)
+int set_guest_nmi_trapbounce(void)
 {
     struct vcpu *v = current;
     struct trap_bounce *tb = &v->arch.trap_bounce;
@@ -596,13 +596,13 @@
 }
 
 #define DO_ERROR_NOCODE(trapnr, name)                   \
-asmlinkage void do_##name(struct cpu_user_regs *regs)   \
+void do_##name(struct cpu_user_regs *regs)   \
 {                                                       \
     do_trap(trapnr, regs, 0);                           \
 }
 
 #define DO_ERROR(trapnr, name)                          \
-asmlinkage void do_##name(struct cpu_user_regs *regs)   \
+void do_##name(struct cpu_user_regs *regs)   \
 {                                                       \
     do_trap(trapnr, regs, 1);                           \
 }
@@ -959,7 +959,7 @@
     return EXCRET_fault_fixed;
 }
 
-asmlinkage void do_invalid_op(struct cpu_user_regs *regs)
+void do_invalid_op(struct cpu_user_regs *regs)
 {
     struct bug_frame bug;
     struct bug_frame_str bug_str;
@@ -1053,7 +1053,7 @@
     panic("FATAL TRAP: vector = %d (invalid opcode)\n", TRAP_invalid_op);
 }
 
-asmlinkage void do_int3(struct cpu_user_regs *regs)
+void do_int3(struct cpu_user_regs *regs)
 {
     DEBUGGER_trap_entry(TRAP_int3, regs);
 
@@ -1066,7 +1066,7 @@
     do_guest_trap(TRAP_int3, regs, 0);
 }
 
-asmlinkage void do_machine_check(struct cpu_user_regs *regs)
+void do_machine_check(struct cpu_user_regs *regs)
 {
     machine_check_vector(regs, regs->error_code);
 }
@@ -1367,7 +1367,7 @@
  *  Bit 3: Reserved bit violation
  *  Bit 4: Instruction fetch
  */
-asmlinkage void do_page_fault(struct cpu_user_regs *regs)
+void do_page_fault(struct cpu_user_regs *regs)
 {
     unsigned long addr, fixup;
     unsigned int error_code;
@@ -1433,7 +1433,7 @@
  * during early boot (an issue was seen once, but was most likely a hardware 
  * problem).
  */
-asmlinkage void __init do_early_page_fault(struct cpu_user_regs *regs)
+void __init do_early_page_fault(struct cpu_user_regs *regs)
 {
     static int stuck;
     static unsigned long prev_eip, prev_cr2;
@@ -1678,7 +1678,7 @@
     while ( bytes != 0 )
     {
         unsigned int size = 1;
-        uint32_t sub_data = 0xff;
+        uint32_t sub_data = ~0;
 
         if ( (port == 0x42) || (port == 0x43) || (port == 0x61) )
         {
@@ -2978,7 +2978,7 @@
 #endif
 }
 
-asmlinkage void do_general_protection(struct cpu_user_regs *regs)
+void do_general_protection(struct cpu_user_regs *regs)
 {
     struct vcpu *v = current;
     unsigned long fixup;
@@ -3225,7 +3225,7 @@
     outb((inb(0x61) & 0x07) | 0x00, 0x61); /* enable IOCK */
 }
 
-static void unknown_nmi_error(unsigned char reason)
+static void unknown_nmi_error(struct cpu_user_regs *regs, unsigned char reason)
 {
     switch ( opt_nmi[0] )
     {
@@ -3234,10 +3234,10 @@
     case 'i': /* 'ignore' */
         break;
     default:  /* 'fatal' */
+        console_force_unlock();
         printk("Uhhuh. NMI received for unknown reason %02x.\n", reason);
-        printk("Dazed and confused, but trying to continue\n");
         printk("Do you have a strange power saving mode enabled?\n");
-        kexec_crash();
+        fatal_trap(TRAP_nmi, regs);
     }
 }
 
@@ -3248,7 +3248,7 @@
  
 static nmi_callback_t nmi_callback = dummy_nmi_callback;
 
-asmlinkage void do_nmi(struct cpu_user_regs *regs)
+void do_nmi(struct cpu_user_regs *regs)
 {
     unsigned int cpu = smp_processor_id();
     unsigned char reason;
@@ -3270,7 +3270,7 @@
         else if ( reason & 0x40 )
             io_check_error(regs);
         else if ( !nmi_watchdog )
-            unknown_nmi_error((unsigned char)(reason&0xff));
+            unknown_nmi_error(regs, (unsigned char)(reason&0xff));
     }
 }
 
@@ -3284,7 +3284,7 @@
     nmi_callback = dummy_nmi_callback;
 }
 
-asmlinkage void do_device_not_available(struct cpu_user_regs *regs)
+void do_device_not_available(struct cpu_user_regs *regs)
 {
     struct vcpu *curr = current;
 
@@ -3325,7 +3325,7 @@
     wrmsrl(MSR_IA32_DEBUGCTLMSR, debugctl | 1);
 }
 
-asmlinkage void do_debug(struct cpu_user_regs *regs)
+void do_debug(struct cpu_user_regs *regs)
 {
     struct vcpu *v = current;
 
@@ -3378,7 +3378,7 @@
     return;
 }
 
-asmlinkage void do_spurious_interrupt_bug(struct cpu_user_regs *regs)
+void do_spurious_interrupt_bug(struct cpu_user_regs *regs)
 {
 }
 
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/x86_32/traps.c xen-4.1.3/xen/arch/x86/x86_32/traps.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/x86_32/traps.c	2012-06-14 10:39:59.000000000 +0000
+++ xen-4.1.3/xen/arch/x86/x86_32/traps.c	2012-08-09 20:08:09.000000000 +0000
@@ -20,7 +20,7 @@
 
 #include <public/callback.h>
 
-extern asmlinkage int hypercall(void);
+extern int hypercall(void);
 
 static void print_xen_info(void)
 {
@@ -229,7 +229,7 @@
     .notifier_call = cpu_doublefault_tss_callback
 };
 
-asmlinkage void do_double_fault(void)
+void do_double_fault(void)
 {
     struct tss_struct *tss;
     unsigned int cpu;
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/x86_64/traps.c xen-4.1.3/xen/arch/x86/x86_64/traps.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/arch/x86/x86_64/traps.c	2012-06-14 10:39:59.000000000 +0000
+++ xen-4.1.3/xen/arch/x86/x86_64/traps.c	2012-08-09 20:08:09.000000000 +0000
@@ -23,10 +23,10 @@
 #include <asm/hvm/support.h>
 #include <public/callback.h>
 
-asmlinkage void syscall_enter(void);
-asmlinkage void sysenter_entry(void);
-asmlinkage void compat_hypercall(void);
-asmlinkage void int80_direct_trap(void);
+void syscall_enter(void);
+void sysenter_entry(void);
+void compat_hypercall(void);
+void int80_direct_trap(void);
 
 static void print_xen_info(void)
 {
@@ -215,8 +215,8 @@
            l1_table_offset(addr), l1e_get_intpte(l1e), pfn);
 }
 
-asmlinkage void double_fault(void);
-asmlinkage void do_double_fault(struct cpu_user_regs *regs)
+void double_fault(void);
+void do_double_fault(struct cpu_user_regs *regs)
 {
     unsigned int cpu;
 
@@ -385,13 +385,13 @@
     BUILD_BUG_ON((IST_MAX + 2) * PAGE_SIZE + PRIMARY_STACK_SIZE > STACK_SIZE);
 
     /* Machine Check handler has its own per-CPU 4kB stack. */
-    this_cpu(init_tss).ist[IST_MCE] = (unsigned long)&stack[IST_MCE * PAGE_SIZE];
+    this_cpu(init_tss).ist[IST_MCE-1] = (unsigned long)&stack[IST_MCE * PAGE_SIZE];
 
     /* Double-fault handler has its own per-CPU 4kB stack. */
-    this_cpu(init_tss).ist[IST_DF] = (unsigned long)&stack[IST_DF * PAGE_SIZE];
+    this_cpu(init_tss).ist[IST_DF-1] = (unsigned long)&stack[IST_DF * PAGE_SIZE];
 
     /* NMI handler has its own per-CPU 4kB stack. */
-    this_cpu(init_tss).ist[IST_NMI] = (unsigned long)&stack[IST_NMI * PAGE_SIZE];
+    this_cpu(init_tss).ist[IST_NMI-1] = (unsigned long)&stack[IST_NMI * PAGE_SIZE];
 
     /* Trampoline for SYSCALL entry from long mode. */
     stack = &stack[IST_MAX * PAGE_SIZE]; /* Skip the IST stacks. */
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/common/kernel.c xen-4.1.3/xen/common/kernel.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/common/kernel.c	2012-08-18 11:44:33.000000000 +0000
+++ xen-4.1.3/xen/common/kernel.c	2012-08-18 11:44:27.000000000 +0000
@@ -92,7 +92,7 @@
         if ( !bool_assert )
             optkey += 3;
 
-        for ( param = &__setup_start; param <= &__setup_end; param++ )
+        for ( param = &__setup_start; param < &__setup_end; param++ )
         {
             if ( strcmp(param->name, optkey) )
                 continue;
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/common/schedule.c xen-4.1.3/xen/common/schedule.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/common/schedule.c	2012-06-14 10:39:59.000000000 +0000
+++ xen-4.1.3/xen/common/schedule.c	2012-08-09 20:08:09.000000000 +0000
@@ -1122,6 +1122,7 @@
     bool_t                tasklet_work_scheduled = 0;
     struct schedule_data *sd;
     struct task_slice     next_slice;
+    int cpu = smp_processor_id();
 
     ASSERT(!in_atomic());
 
@@ -1146,7 +1147,7 @@
         BUG();
     }
 
-    spin_lock_irq(sd->schedule_lock);
+    pcpu_schedule_lock_irq(cpu);
 
     stop_timer(&sd->s_timer);
     
@@ -1163,7 +1164,7 @@
 
     if ( unlikely(prev == next) )
     {
-        spin_unlock_irq(sd->schedule_lock);
+        pcpu_schedule_unlock_irq(cpu);
         trace_continue_running(next);
         return continue_running(prev);
     }
@@ -1201,7 +1202,7 @@
     ASSERT(!next->is_running);
     next->is_running = 1;
 
-    spin_unlock_irq(sd->schedule_lock);
+    pcpu_schedule_unlock_irq(cpu);
 
     perfc_incr(sched_ctx);
 
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/drivers/acpi/pmstat.c xen-4.1.3/xen/drivers/acpi/pmstat.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/drivers/acpi/pmstat.c	2012-06-14 10:39:59.000000000 +0000
+++ xen-4.1.3/xen/drivers/acpi/pmstat.c	2012-08-09 20:08:09.000000000 +0000
@@ -68,6 +68,8 @@
     case PMSTAT_PX:
         if ( !(xen_processor_pmbits & XEN_PROCESSOR_PM_PX) )
             return -ENODEV;
+        if ( !cpufreq_driver )
+            return -ENODEV;
         if ( !pmpt || !(pmpt->perf.init & XEN_PX_INIT) )
             return -EINVAL;
         break;
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/drivers/passthrough/vtd/iommu.c xen-4.1.3/xen/drivers/passthrough/vtd/iommu.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/drivers/passthrough/vtd/iommu.c	2012-06-14 10:39:59.000000000 +0000
+++ xen-4.1.3/xen/drivers/passthrough/vtd/iommu.c	2012-08-09 20:08:09.000000000 +0000
@@ -118,6 +118,27 @@
     return 0;
 }
 
+static int context_get_domain_id(struct context_entry *context,
+                                 struct iommu *iommu)
+{
+    unsigned long dom_index, nr_dom;
+    int domid = -1;
+
+    if (iommu && context)
+    {
+        nr_dom = cap_ndoms(iommu->cap);
+
+        dom_index = context_domain_id(*context);
+
+        if ( dom_index < nr_dom && iommu->domid_map)
+            domid = iommu->domid_map[dom_index];
+        else
+            dprintk(XENLOG_DEBUG VTDPREFIX, "%s: dom_index %lu exceeds nr_dom %lu or iommu has no domid_map\n",
+                    __func__, dom_index, nr_dom);
+    }
+    return domid;
+}
+
 static struct intel_iommu *__init alloc_intel_iommu(void)
 {
     struct intel_iommu *intel;
@@ -1278,7 +1299,6 @@
     struct hvm_iommu *hd = domain_hvm_iommu(domain);
     struct context_entry *context, *context_entries;
     u64 maddr, pgd_maddr;
-    struct pci_dev *pdev = NULL;
     int agaw;
 
     ASSERT(spin_is_locked(&pcidevs_lock));
@@ -1290,12 +1310,45 @@
     if ( context_present(*context) )
     {
         int res = 0;
+        struct pci_dev *pdev = NULL;
 
+        /* First try to get domain ownership from device structure.  If that's
+         * not available, try to read it from the context itself. */
         pdev = pci_get_pdev(bus, devfn);
-        if (!pdev)
-            res = -ENODEV;
-        else if (pdev->domain != domain)
-            res = -EINVAL;
+        if ( pdev )
+        {
+            if ( pdev->domain != domain )
+            {
+                dprintk(XENLOG_INFO VTDPREFIX, "d%d: bdf = %x:%x.%x owned by d%d!",
+                        domain->domain_id, 
+                        bus, PCI_SLOT(devfn), PCI_FUNC(devfn),
+                        (pdev->domain)
+                        ? pdev->domain->domain_id : -1);
+                res = -EINVAL;
+            }
+        }
+        else
+        {
+            int cdomain;
+            cdomain = context_get_domain_id(context, iommu);
+            
+            if ( cdomain < 0 )
+            {
+                dprintk(VTDPREFIX, "d%d: bdf = %x:%x.%x mapped, but can't find owner!\n",
+                        domain->domain_id, 
+                        bus, PCI_SLOT(devfn), PCI_FUNC(devfn));
+                res = -EINVAL;
+            }
+            else if ( cdomain != domain->domain_id )
+            {
+                dprintk(XENLOG_INFO VTDPREFIX, "d%d: bdf = %x:%x.%x already mapped to d%d!",
+                        domain->domain_id, 
+                        bus, PCI_SLOT(devfn), PCI_FUNC(devfn),
+                        cdomain);
+                res = -EINVAL;
+            }
+        }
+
         unmap_vtd_domain_page(context_entries);
         spin_unlock(&iommu->lock);
         return res;
@@ -2105,6 +2158,15 @@
     {
         iommu = drhd->iommu;
 
+        printk("Intel VT-d supported page sizes: 4kB");
+        if (cap_sps_2mb(iommu->cap))
+            printk(", 2MB");
+
+        if (cap_sps_1gb(iommu->cap))
+            printk(", 1GB");
+
+        printk(".\n");
+
         if ( iommu_snoop && !ecap_snp_ctl(iommu->ecap) )
             iommu_snoop = 0;
 
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/drivers/passthrough/vtd/qinval.c xen-4.1.3/xen/drivers/passthrough/vtd/qinval.c
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/drivers/passthrough/vtd/qinval.c	2012-06-14 10:39:59.000000000 +0000
+++ xen-4.1.3/xen/drivers/passthrough/vtd/qinval.c	2012-08-09 20:08:09.000000000 +0000
@@ -140,7 +140,7 @@
     qinval_entry->q.iotlb_inv_dsc.hi.am = am;
     qinval_entry->q.iotlb_inv_dsc.hi.ih = ih;
     qinval_entry->q.iotlb_inv_dsc.hi.res_1 = 0;
-    qinval_entry->q.iotlb_inv_dsc.hi.addr = addr;
+    qinval_entry->q.iotlb_inv_dsc.hi.addr = addr >> PAGE_SHIFT_4K;
 
     unmap_vtd_domain_page(qinval_entries);
     spin_unlock_irqrestore(&qi_ctrl->qinval_lock, flags);
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/include/acpi/cpufreq/processor_perf.h xen-4.1.3/xen/include/acpi/cpufreq/processor_perf.h
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/include/acpi/cpufreq/processor_perf.h	2012-06-14 10:39:59.000000000 +0000
+++ xen-4.1.3/xen/include/acpi/cpufreq/processor_perf.h	2012-08-09 20:08:09.000000000 +0000
@@ -6,7 +6,7 @@
 
 #define XEN_PX_INIT 0x80000000
 
-int get_cpu_id(u8);
+int get_cpu_id(u32);
 int powernow_cpufreq_init(void);
 unsigned int powernow_register_driver(void);
 unsigned int get_measured_perf(unsigned int cpu, unsigned int flag);
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/include/asm-x86/config.h xen-4.1.3/xen/include/asm-x86/config.h
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/include/asm-x86/config.h	2012-06-14 10:39:59.000000000 +0000
+++ xen-4.1.3/xen/include/asm-x86/config.h	2012-08-09 20:08:09.000000000 +0000
@@ -110,13 +110,13 @@
 extern unsigned int video_mode, video_flags;
 #endif
 
+#define asmlinkage
+
 #if defined(__x86_64__)
 
 #define CONFIG_X86_64 1
 #define CONFIG_COMPAT 1
 
-#define asmlinkage
-
 #define PML4_ENTRY_BITS  39
 #ifndef __ASSEMBLY__
 #define PML4_ENTRY_BYTES (1UL << PML4_ENTRY_BITS)
@@ -280,8 +280,6 @@
 #define CONFIG_X86_32      1
 #define CONFIG_DOMAIN_PAGE 1
 
-#define asmlinkage __attribute__((regparm(0)))
-
 /*
  * Memory layout (high to low):                          PAE-SIZE
  *                                                       ------
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/include/asm-x86/hvm/hvm.h xen-4.1.3/xen/include/asm-x86/hvm/hvm.h
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/include/asm-x86/hvm/hvm.h	2012-06-14 10:39:59.000000000 +0000
+++ xen-4.1.3/xen/include/asm-x86/hvm/hvm.h	2012-08-09 20:08:10.000000000 +0000
@@ -368,7 +368,7 @@
 
 int hvm_debug_op(struct vcpu *v, int32_t op);
 
-bool_t hvm_hap_nested_page_fault(unsigned long gpa,
+bool_t hvm_hap_nested_page_fault(paddr_t gpa,
                                  bool_t gla_valid, unsigned long gla,
                                  bool_t access_valid, 
                                  bool_t access_r,
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/include/asm-x86/irq.h xen-4.1.3/xen/include/asm-x86/irq.h
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/include/asm-x86/irq.h	2012-06-14 10:40:00.000000000 +0000
+++ xen-4.1.3/xen/include/asm-x86/irq.h	2012-08-09 20:08:10.000000000 +0000
@@ -97,7 +97,7 @@
 fastcall void smp_cmci_interrupt(struct cpu_user_regs *regs);
 fastcall void smp_irq_move_cleanup_interrupt(struct cpu_user_regs *regs);
 
-asmlinkage void do_IRQ(struct cpu_user_regs *regs);
+void do_IRQ(struct cpu_user_regs *regs);
 
 void disable_8259A_irq(unsigned int irq);
 void enable_8259A_irq(unsigned int irq);
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/include/asm-x86/msr-index.h xen-4.1.3/xen/include/asm-x86/msr-index.h
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/include/asm-x86/msr-index.h	2012-06-14 10:40:00.000000000 +0000
+++ xen-4.1.3/xen/include/asm-x86/msr-index.h	2012-08-09 20:08:10.000000000 +0000
@@ -495,6 +495,10 @@
 #define MSR_INTEL_CPUID1_FEATURE_MASK	0x00000130
 #define MSR_INTEL_CPUID80000001_FEATURE_MASK 0x00000131
 
+#define MSR_INTEL_CPUID1_FEATURE_MASK_V2        0x00000132
+#define MSR_INTEL_CPUID80000001_FEATURE_MASK_V2 0x00000133
+#define MSR_INTEL_CPUIDD_01_FEATURE_MASK        0x00000134
+
 /* Intel cpuid faulting MSRs */
 #define MSR_INTEL_PLATFORM_INFO		0x000000ce
 #define MSR_INTEL_MISC_FEATURES_ENABLES	0x00000140
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/include/asm-x86/p2m.h xen-4.1.3/xen/include/asm-x86/p2m.h
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/include/asm-x86/p2m.h	2012-06-14 10:40:00.000000000 +0000
+++ xen-4.1.3/xen/include/asm-x86/p2m.h	2012-08-09 20:08:10.000000000 +0000
@@ -539,12 +539,12 @@
 #ifdef __x86_64__
 /* Send mem event based on the access (gla is -1ull if not available).  Handles
  * the rw2rx conversion */
-void p2m_mem_access_check(unsigned long gpa, bool_t gla_valid, unsigned long gla, 
+void p2m_mem_access_check(paddr_t gpa, bool_t gla_valid, unsigned long gla, 
                           bool_t access_r, bool_t access_w, bool_t access_x);
 /* Resumes the running of the VCPU, restarting the last instruction */
 void p2m_mem_access_resume(struct p2m_domain *p2m);
 #else
-static inline void p2m_mem_access_check(unsigned long gpa, bool_t gla_valid, 
+static inline void p2m_mem_access_check(paddr_t gpa, bool_t gla_valid, 
                                         unsigned long gla, bool_t access_r, 
                                         bool_t access_w, bool_t access_x)
 { }
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/include/asm-x86/processor.h xen-4.1.3/xen/include/asm-x86/processor.h
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/include/asm-x86/processor.h	2012-06-14 10:40:00.000000000 +0000
+++ xen-4.1.3/xen/include/asm-x86/processor.h	2012-08-09 20:08:10.000000000 +0000
@@ -427,7 +427,9 @@
     union { u64 rsp1, esp1; };
     union { u64 rsp2, esp2; };
     u64 reserved1;
-    u64 ist[7];
+    u64 ist[7]; /* Interrupt Stack Table is 1-based so tss->ist[0]
+                 * corresponds to an IST value of 1 in an Interrupt
+                 * Descriptor */
     u64 reserved2;
     u16 reserved3;
 #else
@@ -548,7 +550,7 @@
 void show_execution_state(struct cpu_user_regs *regs);
 #define dump_execution_state() run_in_exception_handler(show_execution_state)
 void show_page_walk(unsigned long addr);
-asmlinkage void fatal_trap(int trapnr, struct cpu_user_regs *regs);
+void fatal_trap(int trapnr, struct cpu_user_regs *regs);
 
 #ifdef CONFIG_COMPAT
 void compat_show_guest_stack(struct vcpu *, struct cpu_user_regs *, int lines);
@@ -562,8 +564,8 @@
 void mcheck_init(struct cpuinfo_x86 *c, bool_t bsp);
 
 #define DECLARE_TRAP_HANDLER(_name)                     \
-asmlinkage void _name(void);                            \
-asmlinkage void do_ ## _name(struct cpu_user_regs *regs)
+void _name(void);                            \
+void do_ ## _name(struct cpu_user_regs *regs)
 DECLARE_TRAP_HANDLER(divide_error);
 DECLARE_TRAP_HANDLER(debug);
 DECLARE_TRAP_HANDLER(nmi);
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/include/asm-x86/x86_32/asm_defns.h xen-4.1.3/xen/include/asm-x86/x86_32/asm_defns.h
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/include/asm-x86/x86_32/asm_defns.h	2012-06-14 10:40:00.000000000 +0000
+++ xen-4.1.3/xen/include/asm-x86/x86_32/asm_defns.h	2012-08-09 20:08:10.000000000 +0000
@@ -138,7 +138,7 @@
 #define IRQ_NAME(nr) IRQ_NAME2(IRQ##nr)
 
 #define BUILD_IRQ(nr)                           \
-asmlinkage void IRQ_NAME(nr);                   \
+void IRQ_NAME(nr);                   \
 __asm__(                                        \
 "\n"__ALIGN_STR"\n"                             \
 STR(IRQ) #nr "_interrupt:\n\t"                  \
diff -x .pc -urN xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/include/asm-x86/x86_64/asm_defns.h xen-4.1.3/xen/include/asm-x86/x86_64/asm_defns.h
--- xen-4.1.3~rc1+hg-20120614.a9c0a89c08f2/xen/include/asm-x86/x86_64/asm_defns.h	2012-06-14 10:40:00.000000000 +0000
+++ xen-4.1.3/xen/include/asm-x86/x86_64/asm_defns.h	2012-08-09 20:08:10.000000000 +0000
@@ -114,7 +114,7 @@
 #define IRQ_NAME(nr) IRQ_NAME2(IRQ##nr)
 
 #define BUILD_IRQ(nr)                           \
-asmlinkage void IRQ_NAME(nr);                   \
+void IRQ_NAME(nr);                   \
 __asm__(                                        \
 "\n"__ALIGN_STR"\n"                             \
 STR(IRQ) #nr "_interrupt:\n\t"                  \

--- End Message ---
--- Begin Message ---
On Sat, 2012-08-18 at 14:07 +0200, Bastian Blank wrote:
> Please unblock xen/4.1.3-1. It updates the package to the release. By
> doing this it fixes two security bugs, error handling in exceptional
> conditions, missing access control and adds hardware support.
> 
> It also includes a build fix (removal of asmlinkage, which is a larger
> fraction of the overall patch) for gcc 4.7 that was already fixed for
> Debian in a different way.

Unblocked; thanks.

Regards,

Adam

--- End Message ---

Reply to: