system/xen: Updated for version 4.8.1.

Signed-off-by: Mario Preksavec <mario@slackware.hr>

34 files changed, 27 insertions, 3488 deletions

diff --git a/system/xen/dom0/README.dom0 b/system/xen/dom0/README.dom0
index 4ea14b1674a4a..f23bf14c04641 100644
--- a/system/xen/dom0/README.dom0
+++ b/system/xen/dom0/README.dom0
@@ -46,7 +46,7 @@ Xen EFI binary.
 
 To make things a bit easier, a copy of Xen EFI binary can be found here:
 
-  http://slackware.hr/~mario/xen/xen-4.8.0.efi.gz
+  http://slackware.hr/~mario/xen/xen-4.8.1.efi.gz
 
 If an automatic boot to Xen kernel is desired, the binary should be renamed and
 copied to the following location: /boot/efi/EFI/BOOT/bootx64.efi
diff --git a/system/xen/dom0/kernel-xen.sh b/system/xen/dom0/kernel-xen.sh
index f6ea99ce4863d..27ad9bc836eb0 100644
--- a/system/xen/dom0/kernel-xen.sh
+++ b/system/xen/dom0/kernel-xen.sh
@@ -6,7 +6,7 @@
 # Modified by Mario Preksavec <mario@slackware.hr>
 
 KERNEL=${KERNEL:-4.4.38}
-XEN=${XEN:-4.8.0}
+XEN=${XEN:-4.8.1}
 BOOTLOADER=${BOOTLOADER:-lilo}
 
 ROOTMOD=${ROOTMOD:-ext4}
diff --git a/system/xen/xen.SlackBuild b/system/xen/xen.SlackBuild
index 93a380bbb5375..6caf94f47566a 100644
--- a/system/xen/xen.SlackBuild
+++ b/system/xen/xen.SlackBuild
@@ -23,8 +23,8 @@
 #  ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 PRGNAM=xen
-VERSION=${VERSION:-4.8.0}
-BUILD=${BUILD:-4}
+VERSION=${VERSION:-4.8.1}
+BUILD=${BUILD:-1}
 TAG=${TAG:-_SBo}
 
 SEABIOS=${SEABIOS:-1.10.0}
@@ -44,21 +44,6 @@ TMP=${TMP:-/tmp/SBo}
 PKG=$TMP/package-$PRGNAM
 OUTPUT=${OUTPUT:-/tmp}
 
-if [ "$ARCH" = "x86_64" ] && [ ! -f /usr/include/gnu/stubs-32.h ]; then
-  cat << EOF
-
-  For a 32bit guest support 32bit libs are required to build the
-  stub-domain. This is usualy done by installing multilib, but
-  there is also a chance that you do not need 32bit guest support,
-  so you might want to try symlinking stubs-64.h to stubs-32.h
-  like this:
-
-  # ln -s /usr/include/gnu/stubs-64.h /usr/include/gnu/stubs-32.h
-
-EOF
-  exit
-fi
-
 if [ "$ARCH" = "i586" ]; then
   SLKCFLAGS="-O2 -march=i586 -mtune=i686"
   LIBDIRSUFFIX=""
@@ -68,6 +53,17 @@ elif [ "$ARCH" = "i686" ]; then
 elif [ "$ARCH" = "x86_64" ]; then
   SLKCFLAGS="-O2 -fPIC"
   LIBDIRSUFFIX="64"
+  if [ ! -e /usr/include/gnu/stubs-32.h ]; then
+    cat << EOF
+
+  HVM domain support (hvmloader) requires 32bit libs (multilib),
+  or you can try symlinking stubs-64.h to stubs-32.h like this:
+
+  # ln -s /usr/include/gnu/stubs-64.h /usr/include/gnu/stubs-32.h
+
+EOF
+    exit
+  fi
 else
   SLKCFLAGS="-O2"
   LIBDIRSUFFIX=""
@@ -83,7 +79,15 @@ esac
 
 case "${WITH_OVMF:-yes}" in
   no) CONF_XEN+=" --disable-ovmf" ;;
-   *) CONF_XEN+=" --enable-ovmf" ;;
+   *) case "$ARCH" in
+        i?86) cat << EOF
+
+  Disabling 32bit EFI/UEFI guest support (WITH_OVMF=no)
+
+EOF
+              CONF_XEN+=" --disable-ovmf" ;;
+           *) CONF_XEN+=" --enable-ovmf" ;;
+      esac
 esac
 
 case "${USE_LIBSSH2:-no}" in
diff --git a/system/xen/xen.info b/system/xen/xen.info
index 8cd1fb3a2ca55..fff59055e697c 100644
--- a/system/xen/xen.info
+++ b/system/xen/xen.info
@@ -1,7 +1,7 @@
 PRGNAM="xen"
-VERSION="4.8.0"
+VERSION="4.8.1"
 HOMEPAGE="http://www.xenproject.org/"
-DOWNLOAD="http://mirror.slackware.hr/sources/xen/xen-4.8.0.tar.gz \
+DOWNLOAD="http://mirror.slackware.hr/sources/xen/xen-4.8.1.tar.gz \
           http://mirror.slackware.hr/sources/xen-extfiles/ipxe-git-827dd1bfee67daa683935ce65316f7e0f057fe1c.tar.gz \
           http://mirror.slackware.hr/sources/xen-extfiles/lwip-1.3.0.tar.gz \
           http://mirror.slackware.hr/sources/xen-extfiles/zlib-1.2.3.tar.gz \
@@ -13,7 +13,7 @@ DOWNLOAD="http://mirror.slackware.hr/sources/xen/xen-4.8.0.tar.gz \
           http://mirror.slackware.hr/sources/xen-extfiles/tpm_emulator-0.7.4.tar.gz \
           http://mirror.slackware.hr/sources/xen-seabios/seabios-1.10.0.tar.gz \
           http://mirror.slackware.hr/sources/xen-ovmf/xen-ovmf-20160905_bc54e50.tar.bz2"
-MD5SUM="d738f7c741110342621cb8a4d10b0191 \
+MD5SUM="2ef8a991752bf71614651bf2ab0df390 \
         71c69b5e1db9e01d5f246226eca03c22 \
         36cc57650cffda9a0269493be2a169bb \
         debc62758716a169df9f62e6ab2bc634 \
diff --git a/system/xen/xsa/xsa199-qemut.patch b/system/xen/xsa/xsa199-qemut.patch
deleted file mode 100644
index 50a7eb6c92b68..0000000000000
--- a/system/xen/xsa/xsa199-qemut.patch
+++ /dev/null
@@ -1,89 +0,0 @@
-From b73bd1edc05d1bad5c018228146930d79315a5da Mon Sep 17 00:00:00 2001
-From: Ian Jackson <ian.jackson@eu.citrix.com>
-Date: Mon, 14 Nov 2016 17:19:46 +0000
-Subject: [PATCH] qemu: ioport_read, ioport_write: be defensive about 32-bit
- addresses
-
-On x86, ioport addresses are 16-bit.  That these functions take 32-bit
-arguments is a mistake.  Changing the argument type to 16-bit will
-discard the top bits of any erroneous values from elsewhere in qemu.
-
-Also, check just before use that the value is in range.  (This turns
-an ill-advised change to MAX_IOPORTS into a possible guest crash
-rather than a privilege escalation vulnerability.)
-
-And, in the Xen ioreq processor, clamp incoming ioport addresses to
-16-bit values.  Xen will never write >16-bit values but the guest may
-have access to the ioreq ring.  We want to defend the rest of the qemu
-code from wrong values.
-
-This is XSA-199.
-
-Reported-by: yanghongke <yanghongke@huawei.com>
-Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
----
- i386-dm/helper2.c | 2 ++
- vl.c              | 9 +++++++--
- 2 files changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/i386-dm/helper2.c b/i386-dm/helper2.c
-index 2706f2e..5d276bb 100644
---- a/i386-dm/helper2.c
-+++ b/i386-dm/helper2.c
-@@ -375,6 +375,8 @@ static void cpu_ioreq_pio(CPUState *env, ioreq_t *req)
- {
-     uint32_t i;
- 
-+    req->addr &= 0x0ffffU;
-+
-     if (req->dir == IOREQ_READ) {
-         if (!req->data_is_ptr) {
-             req->data = do_inp(env, req->addr, req->size);
-diff --git a/vl.c b/vl.c
-index f9c4d7e..c3c5d63 100644
---- a/vl.c
-+++ b/vl.c
-@@ -52,6 +52,7 @@
- 
- #include <xen/hvm/hvm_info_table.h>
- 
-+#include <assert.h>
- #include <unistd.h>
- #include <fcntl.h>
- #include <signal.h>
-@@ -290,26 +291,30 @@ PicState2 *isa_pic;
- static IOPortReadFunc default_ioport_readb, default_ioport_readw, default_ioport_readl;
- static IOPortWriteFunc default_ioport_writeb, default_ioport_writew, default_ioport_writel;
- 
--static uint32_t ioport_read(int index, uint32_t address)
-+static uint32_t ioport_read(int index, uint16_t address)
- {
-     static IOPortReadFunc *default_func[3] = {
-         default_ioport_readb,
-         default_ioport_readw,
-         default_ioport_readl
-     };
-+    if (address >= MAX_IOPORTS)
-+        abort();
-     IOPortReadFunc *func = ioport_read_table[index][address];
-     if (!func)
-         func = default_func[index];
-     return func(ioport_opaque[address], address);
- }
- 
--static void ioport_write(int index, uint32_t address, uint32_t data)
-+static void ioport_write(int index, uint16_t address, uint32_t data)
- {
-     static IOPortWriteFunc *default_func[3] = {
-         default_ioport_writeb,
-         default_ioport_writew,
-         default_ioport_writel
-     };
-+    if (address >= MAX_IOPORTS)
-+        abort();
-     IOPortWriteFunc *func = ioport_write_table[index][address];
-     if (!func)
-         func = default_func[index];
--- 
-2.1.4
-
diff --git a/system/xen/xsa/xsa202.patch b/system/xen/xsa/xsa202.patch
deleted file mode 100644
index 51d38dcba50f8..0000000000000
--- a/system/xen/xsa/xsa202.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From: Jan Beulich <jbeulich@suse.com>
-Subject: x86: force EFLAGS.IF on when exiting to PV guests
-
-Guest kernels modifying instructions in the process of being emulated
-for another of their vCPU-s may effect EFLAGS.IF to be cleared upon
-next exiting to guest context, by converting the being emulated
-instruction to CLI (at the right point in time). Prevent any such bad
-effects by always forcing EFLAGS.IF on. And to cover hypothetical other
-similar issues, also force EFLAGS.{IOPL,NT,VM} to zero.
-
-This is XSA-202.
-
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
----
-
---- a/xen/arch/x86/x86_64/compat/entry.S
-+++ b/xen/arch/x86/x86_64/compat/entry.S
-@@ -109,6 +109,8 @@ compat_process_trap:
- /* %rbx: struct vcpu, interrupts disabled */
- ENTRY(compat_restore_all_guest)
-         ASSERT_INTERRUPTS_DISABLED
-+        mov   $~(X86_EFLAGS_IOPL|X86_EFLAGS_NT|X86_EFLAGS_VM),%r11d
-+        and   UREGS_eflags(%rsp),%r11d
- .Lcr4_orig:
-         .skip .Lcr4_alt_end - .Lcr4_alt, 0x90
- .Lcr4_orig_end:
-@@ -144,6 +146,8 @@ ENTRY(compat_restore_all_guest)
-                              (.Lcr4_orig_end - .Lcr4_orig), \
-                              (.Lcr4_alt_end - .Lcr4_alt)
-         .popsection
-+        or    $X86_EFLAGS_IF,%r11
-+        mov   %r11d,UREGS_eflags(%rsp)
-         RESTORE_ALL adj=8 compat=1
- .Lft0:  iretq
-         _ASM_PRE_EXTABLE(.Lft0, handle_exception)
---- a/xen/arch/x86/x86_64/entry.S
-+++ b/xen/arch/x86/x86_64/entry.S
-@@ -40,28 +40,29 @@ restore_all_guest:
-         testw $TRAP_syscall,4(%rsp)
-         jz    iret_exit_to_guest
- 
-+        movq  24(%rsp),%r11           # RFLAGS
-+        andq  $~(X86_EFLAGS_IOPL|X86_EFLAGS_NT|X86_EFLAGS_VM),%r11
-+        orq   $X86_EFLAGS_IF,%r11
-+
-         /* Don't use SYSRET path if the return address is not canonical. */
-         movq  8(%rsp),%rcx
-         sarq  $47,%rcx
-         incl  %ecx
-         cmpl  $1,%ecx
--        ja    .Lforce_iret
-+        movq  8(%rsp),%rcx            # RIP
-+        ja    iret_exit_to_guest
- 
-         cmpw  $FLAT_USER_CS32,16(%rsp)# CS
--        movq  8(%rsp),%rcx            # RIP
--        movq  24(%rsp),%r11           # RFLAGS
-         movq  32(%rsp),%rsp           # RSP
-         je    1f
-         sysretq
- 1:      sysretl
- 
--.Lforce_iret:
--        /* Mimic SYSRET behavior. */
--        movq  8(%rsp),%rcx            # RIP
--        movq  24(%rsp),%r11           # RFLAGS
-         ALIGN
- /* No special register assumptions. */
- iret_exit_to_guest:
-+        andl  $~(X86_EFLAGS_IOPL|X86_EFLAGS_NT|X86_EFLAGS_VM),24(%rsp)
-+        orl   $X86_EFLAGS_IF,24(%rsp)
-         addq  $8,%rsp
- .Lft0:  iretq
-         _ASM_PRE_EXTABLE(.Lft0, handle_exception)
diff --git a/system/xen/xsa/xsa203-4.8.patch b/system/xen/xsa/xsa203-4.8.patch
deleted file mode 100644
index c9661a4c91fe5..0000000000000
--- a/system/xen/xsa/xsa203-4.8.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-From: Jan Beulich <jbeulich@suse.com>
-Subject: x86/HVM: add missing NULL check before using VMFUNC hook
-
-This is XSA-203.
-
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
-
---- a/xen/arch/x86/hvm/emulate.c
-+++ b/xen/arch/x86/hvm/emulate.c
-@@ -1694,6 +1694,8 @@ static int hvmemul_vmfunc(
- {
-     int rc;
- 
-+    if ( !hvm_funcs.altp2m_vcpu_emulate_vmfunc )
-+        return X86EMUL_UNHANDLEABLE;
-     rc = hvm_funcs.altp2m_vcpu_emulate_vmfunc(ctxt->regs);
-     if ( rc != X86EMUL_OKAY )
-         hvmemul_inject_hw_exception(TRAP_invalid_op, HVM_DELIVER_NO_ERROR_CODE,
diff --git a/system/xen/xsa/xsa204-4.8.patch b/system/xen/xsa/xsa204-4.8.patch
deleted file mode 100644
index 360296b2bc249..0000000000000
--- a/system/xen/xsa/xsa204-4.8.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Date: Sun, 18 Dec 2016 15:42:59 +0000
-Subject: [PATCH] x86/emul: Correct the handling of eflags with SYSCALL
-
-A singlestep #DB is determined by the resulting eflags value from the
-execution of SYSCALL, not the original eflags value.
-
-By using the original eflags value, we negate the guest kernels attempt to
-protect itself from a privilege escalation by masking TF.
-
-Have the SYSCALL emulation recalculate tf after the instruction is complete.
-
-This is XSA-204
-
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
----
- xen/arch/x86/x86_emulate/x86_emulate.c | 19 ++++++++++++++++++-
- 1 file changed, 18 insertions(+), 1 deletion(-)
-
-diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c
-index d82e85d..ff952a9 100644
---- a/xen/arch/x86/x86_emulate/x86_emulate.c
-+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
-@@ -4561,6 +4561,23 @@ x86_emulate(
-              (rc = ops->write_segment(x86_seg_ss, &sreg, ctxt)) )
-             goto done;
- 
-+        /*
-+         * SYSCALL (unlike most instructions) evaluates its singlestep action
-+         * based on the resulting EFLG_TF, not the starting EFLG_TF.
-+         *
-+         * As the #DB is raised after the CPL change and before the OS can
-+         * switch stack, it is a large risk for privilege escalation.
-+         *
-+         * 64bit kernels should mask EFLG_TF in MSR_FMASK to avoid any
-+         * vulnerability.  Running the #DB handler on an IST stack is also a
-+         * mitigation.
-+         *
-+         * 32bit kernels have no ability to mask EFLG_TF at all.  Their only
-+         * mitigation is to use a task gate for handling #DB (or to not use
-+         * enable EFER.SCE to start with).
-+         */
-+        tf = _regs.eflags & EFLG_TF;
-+
-         break;
-     }
- 
-@@ -5412,7 +5429,7 @@ x86_emulate(
- 
-     *ctxt->regs = _regs;
- 
--    /* Inject #DB if single-step tracing was enabled at instruction start. */
-+    /* Should a singlestep #DB be raised? */
-     if ( tf && (rc == X86EMUL_OKAY) && ops->inject_hw_exception )
-         rc = ops->inject_hw_exception(EXC_DB, -1, ctxt) ? : X86EMUL_EXCEPTION;
- 
diff --git a/system/xen/xsa/xsa206-4.8-0001-xenstored-apply-a-write-transaction-rate-limit.patch b/system/xen/xsa/xsa206-4.8-0001-xenstored-apply-a-write-transaction-rate-limit.patch
deleted file mode 100644
index ee39918cb7856..0000000000000
--- a/system/xen/xsa/xsa206-4.8-0001-xenstored-apply-a-write-transaction-rate-limit.patch
+++ /dev/null
@@ -1,456 +0,0 @@
-From 8b2d563e6693527e0747fbb22c5f01eeb89a6c53 Mon Sep 17 00:00:00 2001
-From: Ian Jackson <ian.jackson@eu.citrix.com>
-Date: Tue, 7 Mar 2017 16:09:12 +0000
-Subject: [PATCH 01/15] xenstored: apply a write transaction rate limit
-
-This avoids a rogue client being about to stall another client (eg the
-toolstack) indefinitely.
-
-This is XSA-206.
-
-Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
-
-Backported to 4.8 (not entirely trivial).
-
-Reported-by: Juergen Gross <jgross@suse.com>
-Signed-off-by: George Dunlap <george.dunlap@citrix.com>
-Acked-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
----
- tools/xenstore/Makefile                |   3 +-
- tools/xenstore/xenstored_core.c        |   9 ++
- tools/xenstore/xenstored_core.h        |   6 +
- tools/xenstore/xenstored_domain.c      | 215 +++++++++++++++++++++++++++++++++
- tools/xenstore/xenstored_domain.h      |  25 ++++
- tools/xenstore/xenstored_transaction.c |   5 +
- 6 files changed, 262 insertions(+), 1 deletion(-)
-
-diff --git a/tools/xenstore/Makefile b/tools/xenstore/Makefile
-index 36b6fd4..9cb54de 100644
---- a/tools/xenstore/Makefile
-+++ b/tools/xenstore/Makefile
-@@ -32,6 +32,7 @@ XENSTORED_OBJS_$(CONFIG_FreeBSD) = xenstored_posix.o
- XENSTORED_OBJS_$(CONFIG_MiniOS) = xenstored_minios.o
- 
- XENSTORED_OBJS += $(XENSTORED_OBJS_y)
-+LDLIBS_xenstored += -lrt
- 
- ifneq ($(XENSTORE_STATIC_CLIENTS),y)
- LIBXENSTORE := libxenstore.so
-@@ -73,7 +74,7 @@ endif
- $(XENSTORED_OBJS): CFLAGS += $(CFLAGS_libxengnttab)
- 
- xenstored: $(XENSTORED_OBJS)
--	$(CC) $^ $(LDFLAGS) $(LDLIBS_libxenevtchn) $(LDLIBS_libxengnttab) $(LDLIBS_libxenctrl) $(SOCKET_LIBS) -o $@ $(APPEND_LDFLAGS)
-+	$(CC) $^ $(LDFLAGS) $(LDLIBS_libxenevtchn) $(LDLIBS_libxengnttab) $(LDLIBS_libxenctrl) $(LDLIBS_xenstored) $(SOCKET_LIBS) -o $@ $(APPEND_LDFLAGS)
- 
- xenstored.a: $(XENSTORED_OBJS)
- 	$(AR) cr $@ $^
-diff --git a/tools/xenstore/xenstored_core.c b/tools/xenstore/xenstored_core.c
-index 3df977b..d14f096 100644
---- a/tools/xenstore/xenstored_core.c
-+++ b/tools/xenstore/xenstored_core.c
-@@ -358,6 +358,7 @@ static void initialize_fds(int sock, int *p_sock_pollfd_idx,
- 			   int *ptimeout)
- {
- 	struct connection *conn;
-+	struct wrl_timestampt now;
- 
- 	if (fds)
- 		memset(fds, 0, sizeof(struct pollfd) * current_array_size);
-@@ -377,8 +378,11 @@ static void initialize_fds(int sock, int *p_sock_pollfd_idx,
- 		xce_pollfd_idx = set_fd(xenevtchn_fd(xce_handle),
- 					POLLIN|POLLPRI);
- 
-+	wrl_gettime_now(&now);
-+
- 	list_for_each_entry(conn, &connections, list) {
- 		if (conn->domain) {
-+			wrl_check_timeout(conn->domain, now, ptimeout);
- 			if (domain_can_read(conn) ||
- 			    (domain_can_write(conn) &&
- 			     !list_empty(&conn->out_list)))
-@@ -833,6 +837,7 @@ static void delete_node_single(struct connection *conn, struct node *node)
- 		corrupt(conn, "Could not delete '%s'", node->name);
- 		return;
- 	}
-+
- 	domain_entry_dec(conn, node);
- }
- 
-@@ -972,6 +977,7 @@ static void do_write(struct connection *conn, struct buffered_data *in)
- 	}
- 
- 	add_change_node(conn->transaction, name, false);
-+	wrl_apply_debit_direct(conn);
- 	fire_watches(conn, in, name, false);
- 	send_ack(conn, XS_WRITE);
- }
-@@ -1003,6 +1009,7 @@ static void do_mkdir(struct connection *conn, struct buffered_data *in)
- 			return;
- 		}
- 		add_change_node(conn->transaction, name, false);
-+		wrl_apply_debit_direct(conn);
- 		fire_watches(conn, in, name, false);
- 	}
- 	send_ack(conn, XS_MKDIR);
-@@ -1129,6 +1136,7 @@ static void do_rm(struct connection *conn, struct buffered_data *in)
- 
- 	if (_rm(conn, node, name)) {
- 		add_change_node(conn->transaction, name, true);
-+		wrl_apply_debit_direct(conn);
- 		fire_watches(conn, in, name, true);
- 		send_ack(conn, XS_RM);
- 	}
-@@ -1205,6 +1213,7 @@ static void do_set_perms(struct connection *conn, struct buffered_data *in)
- 	}
- 
- 	add_change_node(conn->transaction, name, false);
-+	wrl_apply_debit_direct(conn);
- 	fire_watches(conn, in, name, false);
- 	send_ack(conn, XS_SET_PERMS);
- }
-diff --git a/tools/xenstore/xenstored_core.h b/tools/xenstore/xenstored_core.h
-index ecc614f..9e9d960 100644
---- a/tools/xenstore/xenstored_core.h
-+++ b/tools/xenstore/xenstored_core.h
-@@ -33,6 +33,12 @@
- #include "list.h"
- #include "tdb.h"
- 
-+#define MIN(a, b) (((a) < (b))? (a) : (b))
-+
-+typedef int32_t wrl_creditt;
-+#define WRL_CREDIT_MAX (1000*1000*1000)
-+/* ^ satisfies non-overflow condition for wrl_xfer_credit */
-+
- struct buffered_data
- {
- 	struct list_head list;
-diff --git a/tools/xenstore/xenstored_domain.c b/tools/xenstore/xenstored_domain.c
-index 5de93d4..012dfe6 100644
---- a/tools/xenstore/xenstored_domain.c
-+++ b/tools/xenstore/xenstored_domain.c
-@@ -21,6 +21,7 @@
- #include <unistd.h>
- #include <stdlib.h>
- #include <stdarg.h>
-+#include <time.h>
- 
- #include "utils.h"
- #include "talloc.h"
-@@ -74,6 +75,10 @@ struct domain
- 
- 	/* number of watch for this domain */
- 	int nbwatch;
-+
-+	/* write rate limit */
-+	wrl_creditt wrl_credit; /* [ -wrl_config_writecost, +_dburst ] */
-+	struct wrl_timestampt wrl_timestamp;
- };
- 
- static LIST_HEAD(domains);
-@@ -206,6 +211,8 @@ static int destroy_domain(void *_domain)
- 
- 	fire_watches(NULL, domain, "@releaseDomain", false);
- 
-+	wrl_domain_destroy(domain);
-+
- 	return 0;
- }
- 
-@@ -253,6 +260,9 @@ void handle_event(void)
- bool domain_can_read(struct connection *conn)
- {
- 	struct xenstore_domain_interface *intf = conn->domain->interface;
-+
-+	if (domain_is_unprivileged(conn) && conn->domain->wrl_credit < 0)
-+		return false;
- 	return (intf->req_cons != intf->req_prod);
- }
- 
-@@ -284,6 +294,8 @@ static struct domain *new_domain(void *context, unsigned int domid,
- 	domain->domid = domid;
- 	domain->path = talloc_domain_path(domain, domid);
- 
-+	wrl_domain_new(domain);
-+
- 	list_add(&domain->list, &domains);
- 	talloc_set_destructor(domain, destroy_domain);
- 
-@@ -751,6 +763,209 @@ int domain_watch(struct connection *conn)
- 		: 0;
- }
- 
-+static wrl_creditt wrl_config_writecost      = WRL_FACTOR;
-+static wrl_creditt wrl_config_rate           = WRL_RATE   * WRL_FACTOR;
-+static wrl_creditt wrl_config_dburst         = WRL_DBURST * WRL_FACTOR;
-+static wrl_creditt wrl_config_gburst         = WRL_GBURST * WRL_FACTOR;
-+static wrl_creditt wrl_config_newdoms_dburst =
-+	                         WRL_DBURST * WRL_NEWDOMS * WRL_FACTOR;
-+
-+long wrl_ntransactions;
-+
-+static long wrl_ndomains;
-+static wrl_creditt wrl_reserve; /* [-wrl_config_newdoms_dburst, +_gburst ] */
-+
-+void wrl_gettime_now(struct wrl_timestampt *now_wt)
-+{
-+	struct timespec now_ts;
-+	int r;
-+
-+	r = clock_gettime(CLOCK_MONOTONIC, &now_ts);
-+	if (r)
-+		barf_perror("Could not find time (clock_gettime failed)");
-+
-+	now_wt->sec = now_ts.tv_sec;
-+	now_wt->msec = now_ts.tv_nsec / 1000000;
-+}
-+
-+static void wrl_xfer_credit(wrl_creditt *debit,  wrl_creditt debit_floor,
-+			    wrl_creditt *credit, wrl_creditt credit_ceil)
-+	/*
-+	 * Transfers zero or more credit from "debit" to "credit".
-+	 * Transfers as much as possible while maintaining
-+	 * debit >= debit_floor and credit <= credit_ceil.
-+	 * (If that's violated already, does nothing.)
-+	 *
-+	 * Sufficient conditions to avoid overflow, either of:
-+	 *  |every argument| <= 0x3fffffff
-+	 *  |every argument| <= 1E9
-+	 *  |every argument| <= WRL_CREDIT_MAX
-+	 * (And this condition is preserved.)
-+	 */
-+{
-+	wrl_creditt xfer = MIN( *debit      - debit_floor,
-+			        credit_ceil - *credit      );
-+	if (xfer > 0) {
-+		*debit -= xfer;
-+		*credit += xfer;
-+	}
-+}
-+
-+void wrl_domain_new(struct domain *domain)
-+{
-+	domain->wrl_credit = 0;
-+	wrl_gettime_now(&domain->wrl_timestamp);
-+	wrl_ndomains++;
-+	/* Steal up to DBURST from the reserve */
-+	wrl_xfer_credit(&wrl_reserve, -wrl_config_newdoms_dburst,
-+			&domain->wrl_credit, wrl_config_dburst);
-+}
-+
-+void wrl_domain_destroy(struct domain *domain)
-+{
-+	wrl_ndomains--;
-+	/*
-+	 * Don't bother recalculating domain's credit - this just
-+	 * means we don't give the reserve the ending domain's credit
-+	 * for time elapsed since last update.
-+	 */
-+	wrl_xfer_credit(&domain->wrl_credit, 0,
-+			&wrl_reserve, wrl_config_dburst);
-+}
-+
-+void wrl_credit_update(struct domain *domain, struct wrl_timestampt now)
-+{
-+	/*
-+	 * We want to calculate
-+	 *    credit += (now - timestamp) * RATE / ndoms;
-+	 * But we want it to saturate, and to avoid floating point.
-+	 * To avoid rounding errors from constantly adding small
-+	 * amounts of credit, we only add credit for whole milliseconds.
-+	 */
-+	long seconds      = now.sec -  domain->wrl_timestamp.sec;
-+	long milliseconds = now.msec - domain->wrl_timestamp.msec;
-+	long msec;
-+	int64_t denom, num;
-+	wrl_creditt surplus;
-+
-+	seconds = MIN(seconds, 1000*1000); /* arbitrary, prevents overflow */
-+	msec = seconds * 1000 + milliseconds;
-+
-+	if (msec < 0)
-+                /* shouldn't happen with CLOCK_MONOTONIC */
-+		msec = 0;
-+
-+	/* 32x32 -> 64 cannot overflow */
-+	denom = (int64_t)msec * wrl_config_rate;
-+	num  =  (int64_t)wrl_ndomains * 1000;
-+	/* denom / num <= 1E6 * wrl_config_rate, so with
-+	   reasonable wrl_config_rate, denom / num << 2^64 */
-+
-+	/* at last! */
-+	domain->wrl_credit = MIN( (int64_t)domain->wrl_credit + denom / num,
-+				  WRL_CREDIT_MAX );
-+	/* (maybe briefly violating the DBURST cap on wrl_credit) */
-+
-+	/* maybe take from the reserve to make us nonnegative */
-+	wrl_xfer_credit(&wrl_reserve,        0,
-+			&domain->wrl_credit, 0);
-+
-+	/* return any surplus (over DBURST) to the reserve */
-+	surplus = 0;
-+	wrl_xfer_credit(&domain->wrl_credit, wrl_config_dburst,
-+			&surplus,            WRL_CREDIT_MAX);
-+	wrl_xfer_credit(&surplus,     0,
-+			&wrl_reserve, wrl_config_gburst);
-+	/* surplus is now implicitly discarded */
-+
-+	domain->wrl_timestamp = now;
-+
-+	trace("wrl: dom %4d %6ld  msec  %9ld credit   %9ld reserve"
-+	      "  %9ld discard\n",
-+	      domain->domid,
-+	      msec,
-+	      (long)domain->wrl_credit, (long)wrl_reserve,
-+	      (long)surplus);
-+}
-+
-+void wrl_check_timeout(struct domain *domain,
-+		       struct wrl_timestampt now,
-+		       int *ptimeout)
-+{
-+	uint64_t num, denom;
-+	int wakeup;
-+
-+	wrl_credit_update(domain, now);
-+
-+	if (domain->wrl_credit >= 0)
-+		/* not blocked */
-+		return;
-+
-+	if (!*ptimeout)
-+		/* already decided on immediate wakeup,
-+		   so no need to calculate our timeout */
-+		return;
-+
-+	/* calculate  wakeup = now + -credit / (RATE / ndoms); */
-+
-+	/* credit cannot go more -ve than one transaction,
-+	 * so the first multiplication cannot overflow even 32-bit */
-+	num   = (uint64_t)(-domain->wrl_credit * 1000) * wrl_ndomains;
-+	denom = wrl_config_rate;
-+
-+	wakeup = MIN( num / denom /* uint64_t */, INT_MAX );
-+	if (*ptimeout==-1 || wakeup < *ptimeout)
-+		*ptimeout = wakeup;
-+
-+	trace("wrl: domain %u credit=%ld (reserve=%ld) SLEEPING for %d\n",
-+	      domain->domid,
-+	      (long)domain->wrl_credit, (long)wrl_reserve,
-+	      wakeup);
-+}
-+
-+void wrl_apply_debit_actual(struct domain *domain)
-+{
-+	struct wrl_timestampt now;
-+
-+	if (!domain)
-+		/* sockets escape the write rate limit */
-+		return;
-+
-+	wrl_gettime_now(&now);
-+	wrl_credit_update(domain, now);
-+
-+	domain->wrl_credit -= wrl_config_writecost;
-+	trace("wrl: domain %u credit=%ld (reserve=%ld)\n",
-+	      domain->domid,
-+	      (long)domain->wrl_credit, (long)wrl_reserve);
-+}
-+
-+void wrl_apply_debit_direct(struct connection *conn)
-+{
-+	if (!conn)
-+		/* some writes are generated internally */
-+		return;
-+
-+	if (conn->transaction)
-+		/* these are accounted for when the transaction ends */
-+		return;
-+
-+	if (!wrl_ntransactions)
-+		/* we don't conflict with anyone */
-+		return;
-+
-+	wrl_apply_debit_actual(conn->domain);
-+}
-+
-+void wrl_apply_debit_trans_commit(struct connection *conn)
-+{
-+	if (wrl_ntransactions <= 1)
-+		/* our own transaction appears in the counter */
-+		return;
-+
-+	wrl_apply_debit_actual(conn->domain);
-+}
-+
- /*
-  * Local variables:
-  *  c-file-style: "linux"
-diff --git a/tools/xenstore/xenstored_domain.h b/tools/xenstore/xenstored_domain.h
-index 2554423..cec341e 100644
---- a/tools/xenstore/xenstored_domain.h
-+++ b/tools/xenstore/xenstored_domain.h
-@@ -65,4 +65,29 @@ void domain_watch_inc(struct connection *conn);
- void domain_watch_dec(struct connection *conn);
- int domain_watch(struct connection *conn);
- 
-+/* Write rate limiting */
-+
-+#define WRL_FACTOR   1000 /* for fixed-point arithmetic */
-+#define WRL_RATE      200
-+#define WRL_DBURST     10
-+#define WRL_GBURST   1000
-+#define WRL_NEWDOMS     5
-+
-+struct wrl_timestampt {
-+	time_t sec;
-+	int msec;
-+};
-+
-+extern long wrl_ntransactions;
-+
-+void wrl_gettime_now(struct wrl_timestampt *now_ts);
-+void wrl_domain_new(struct domain *domain);
-+void wrl_domain_destroy(struct domain *domain);
-+void wrl_credit_update(struct domain *domain, struct wrl_timestampt now);
-+void wrl_check_timeout(struct domain *domain,
-+                       struct wrl_timestampt now,
-+                       int *ptimeout);
-+void wrl_apply_debit_direct(struct connection *conn);
-+void wrl_apply_debit_trans_commit(struct connection *conn);
-+
- #endif /* _XENSTORED_DOMAIN_H */
-diff --git a/tools/xenstore/xenstored_transaction.c b/tools/xenstore/xenstored_transaction.c
-index 84cb0bf..5059a11 100644
---- a/tools/xenstore/xenstored_transaction.c
-+++ b/tools/xenstore/xenstored_transaction.c
-@@ -120,6 +120,7 @@ static int destroy_transaction(void *_transaction)
- {
- 	struct transaction *trans = _transaction;
- 
-+	wrl_ntransactions--;
- 	trace_destroy(trans, "transaction");
- 	if (trans->tdb)
- 		tdb_close(trans->tdb);
-@@ -183,6 +184,7 @@ void do_transaction_start(struct connection *conn, struct buffered_data *in)
- 	talloc_steal(conn, trans);
- 	talloc_set_destructor(trans, destroy_transaction);
- 	conn->transaction_started++;
-+	wrl_ntransactions++;
- 
- 	snprintf(id_str, sizeof(id_str), "%u", trans->id);
- 	send_reply(conn, XS_TRANSACTION_START, id_str, strlen(id_str)+1);
-@@ -218,6 +220,9 @@ void do_transaction_end(struct connection *conn, struct buffered_data *in)
- 			send_error(conn, EAGAIN);
- 			return;
- 		}
-+
-+		wrl_apply_debit_trans_commit(conn);
-+
- 		if (!replace_tdb(trans->tdb_name, trans->tdb)) {
- 			send_error(conn, errno);
- 			return;
--- 
-2.1.4
-
diff --git a/system/xen/xsa/xsa206-4.8-0002-xenstored-Log-when-the-write-transaction-rate-limit-.patch b/system/xen/xsa/xsa206-4.8-0002-xenstored-Log-when-the-write-transaction-rate-limit-.patch
deleted file mode 100644
index 57e1e9be9ee2f..0000000000000
--- a/system/xen/xsa/xsa206-4.8-0002-xenstored-Log-when-the-write-transaction-rate-limit-.patch
+++ /dev/null
@@ -1,113 +0,0 @@
-From 6a5b012157c3dbe4bb82f2aa3d950e20cb5bf9d6 Mon Sep 17 00:00:00 2001
-From: Ian Jackson <ian.jackson@eu.citrix.com>
-Date: Tue, 7 Mar 2017 16:09:13 +0000
-Subject: [PATCH 02/15] xenstored: Log when the write transaction rate limit
- bites
-
-Reported-by: Juergen Gross <jgross@suse.com>
-Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
----
- tools/xenstore/xenstored_core.c   |  1 +
- tools/xenstore/xenstored_domain.c | 25 +++++++++++++++++++++++++
- tools/xenstore/xenstored_domain.h |  2 ++
- 3 files changed, 28 insertions(+)
-
-diff --git a/tools/xenstore/xenstored_core.c b/tools/xenstore/xenstored_core.c
-index d14f096..dc9a26f 100644
---- a/tools/xenstore/xenstored_core.c
-+++ b/tools/xenstore/xenstored_core.c
-@@ -379,6 +379,7 @@ static void initialize_fds(int sock, int *p_sock_pollfd_idx,
- 					POLLIN|POLLPRI);
- 
- 	wrl_gettime_now(&now);
-+	wrl_log_periodic(now);
- 
- 	list_for_each_entry(conn, &connections, list) {
- 		if (conn->domain) {
-diff --git a/tools/xenstore/xenstored_domain.c b/tools/xenstore/xenstored_domain.c
-index 012dfe6..fd9ca39 100644
---- a/tools/xenstore/xenstored_domain.c
-+++ b/tools/xenstore/xenstored_domain.c
-@@ -22,6 +22,7 @@
- #include <stdlib.h>
- #include <stdarg.h>
- #include <time.h>
-+#include <syslog.h>
- 
- #include "utils.h"
- #include "talloc.h"
-@@ -79,6 +80,7 @@ struct domain
- 	/* write rate limit */
- 	wrl_creditt wrl_credit; /* [ -wrl_config_writecost, +_dburst ] */
- 	struct wrl_timestampt wrl_timestamp;
-+	bool wrl_delay_logged;
- };
- 
- static LIST_HEAD(domains);
-@@ -774,6 +776,7 @@ long wrl_ntransactions;
- 
- static long wrl_ndomains;
- static wrl_creditt wrl_reserve; /* [-wrl_config_newdoms_dburst, +_gburst ] */
-+static time_t wrl_log_last_warning; /* 0: no previous warning */
- 
- void wrl_gettime_now(struct wrl_timestampt *now_wt)
- {
-@@ -923,6 +926,9 @@ void wrl_check_timeout(struct domain *domain,
- 	      wakeup);
- }
- 
-+#define WRL_LOG(now, ...) \
-+	(syslog(LOG_WARNING, "write rate limit: " __VA_ARGS__))
-+
- void wrl_apply_debit_actual(struct domain *domain)
- {
- 	struct wrl_timestampt now;
-@@ -938,6 +944,25 @@ void wrl_apply_debit_actual(struct domain *domain)
- 	trace("wrl: domain %u credit=%ld (reserve=%ld)\n",
- 	      domain->domid,
- 	      (long)domain->wrl_credit, (long)wrl_reserve);
-+
-+	if (domain->wrl_credit < 0) {
-+		if (!domain->wrl_delay_logged++) {
-+			WRL_LOG(now, "domain %ld is affected",
-+				(long)domain->domid);
-+		} else if (!wrl_log_last_warning) {
-+			WRL_LOG(now, "rate limiting restarts");
-+		}
-+		wrl_log_last_warning = now.sec;
-+	}
-+}
-+
-+void wrl_log_periodic(struct wrl_timestampt now)
-+{
-+	if (wrl_log_last_warning &&
-+	    (now.sec - wrl_log_last_warning) > WRL_LOGEVERY) {
-+		WRL_LOG(now, "not in force recently");
-+		wrl_log_last_warning = 0;
-+	}
- }
- 
- void wrl_apply_debit_direct(struct connection *conn)
-diff --git a/tools/xenstore/xenstored_domain.h b/tools/xenstore/xenstored_domain.h
-index cec341e..561ab5d 100644
---- a/tools/xenstore/xenstored_domain.h
-+++ b/tools/xenstore/xenstored_domain.h
-@@ -72,6 +72,7 @@ int domain_watch(struct connection *conn);
- #define WRL_DBURST     10
- #define WRL_GBURST   1000
- #define WRL_NEWDOMS     5
-+#define WRL_LOGEVERY  120 /* seconds */
- 
- struct wrl_timestampt {
- 	time_t sec;
-@@ -87,6 +88,7 @@ void wrl_credit_update(struct domain *domain, struct wrl_timestampt now);
- void wrl_check_timeout(struct domain *domain,
-                        struct wrl_timestampt now,
-                        int *ptimeout);
-+void wrl_log_periodic(struct wrl_timestampt now);
- void wrl_apply_debit_direct(struct connection *conn);
- void wrl_apply_debit_trans_commit(struct connection *conn);
- 
--- 
-2.1.4
-
diff --git a/system/xen/xsa/xsa206-4.8-0003-oxenstored-comments-explaining-some-variables.patch b/system/xen/xsa/xsa206-4.8-0003-oxenstored-comments-explaining-some-variables.patch
deleted file mode 100644
index e878a385f0ad9..0000000000000
--- a/system/xen/xsa/xsa206-4.8-0003-oxenstored-comments-explaining-some-variables.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From d94645f1eb00e2703aef57cac19df9e86c54d275 Mon Sep 17 00:00:00 2001
-From: Thomas Sanders <thomas.sanders@citrix.com>
-Date: Tue, 14 Mar 2017 12:15:52 +0000
-Subject: [PATCH 03/15] oxenstored: comments explaining some variables
-
-It took a while of reading and reasoning to work out what these are
-for, so here are comments to make life easier for everyone reading
-this code in future.
-
-Reported-by: Juergen Gross <jgross@suse.com>
-Signed-off-by: Thomas Sanders <thomas.sanders@citrix.com>
-Reviewed-by: Jonathan Davies <jonathan.davies@citrix.com>
-Reviewed-by: Ian Jackson <ian.jackson@eu.citrix.com>
-Reviewed-by: Christian Lindig <christian.lindig@citrix.com>
----
- tools/ocaml/xenstored/store.ml       |  1 +
- tools/ocaml/xenstored/transaction.ml | 10 +++++++---
- 2 files changed, 8 insertions(+), 3 deletions(-)
-
-diff --git a/tools/ocaml/xenstored/store.ml b/tools/ocaml/xenstored/store.ml
-index 223ee21..9f619b8 100644
---- a/tools/ocaml/xenstored/store.ml
-+++ b/tools/ocaml/xenstored/store.ml
-@@ -211,6 +211,7 @@ let apply rnode path fct =
- 	lookup rnode path fct
- end
- 
-+(* The Store.t type *)
- type t =
- {
- 	mutable stat_transaction_coalesce: int;
-diff --git a/tools/ocaml/xenstored/transaction.ml b/tools/ocaml/xenstored/transaction.ml
-index 6b37fc2..51d5d6a 100644
---- a/tools/ocaml/xenstored/transaction.ml
-+++ b/tools/ocaml/xenstored/transaction.ml
-@@ -69,11 +69,15 @@ let can_coalesce oldroot currentroot path =
- 	else
- 		false
- 
--type ty = No | Full of (int * Store.Node.t * Store.t)
-+type ty = No | Full of (
-+	int *          (* Transaction id *)
-+	Store.Node.t * (* Original root *)
-+	Store.t        (* A pointer to the canonical store: its root changes on each transaction-commit *)
-+)
- 
- type t = {
- 	ty: ty;
--	store: Store.t;
-+	store: Store.t; (* This is the store that we change in write operations. *)
- 	quota: Quota.t;
- 	mutable paths: (Xenbus.Xb.Op.operation * Store.Path.t) list;
- 	mutable operations: (Packet.request * Packet.response) list;
-@@ -155,7 +159,7 @@ let commit ~con t =
- 	let has_commited =
- 	match t.ty with
- 	| No                         -> true
--	| Full (id, oldroot, cstore) ->
-+	| Full (id, oldroot, cstore) ->       (* "cstore" meaning current canonical store *)
- 		let commit_partial oldroot cstore store =
- 			(* get the lowest path of the query and verify that it hasn't
- 			   been modified by others transactions. *)
--- 
-2.1.4
-
diff --git a/system/xen/xsa/xsa206-4.8-0004-oxenstored-handling-of-domain-conflict-credit.patch b/system/xen/xsa/xsa206-4.8-0004-oxenstored-handling-of-domain-conflict-credit.patch
deleted file mode 100644
index 63cfbaee85e22..0000000000000
--- a/system/xen/xsa/xsa206-4.8-0004-oxenstored-handling-of-domain-conflict-credit.patch
+++ /dev/null
@@ -1,299 +0,0 @@
-From 1f12baed15dc7502365afb54161827405ff24732 Mon Sep 17 00:00:00 2001
-From: Thomas Sanders <thomas.sanders@citrix.com>
-Date: Tue, 14 Mar 2017 12:15:52 +0000
-Subject: [PATCH 04/15] oxenstored: handling of domain conflict-credit
-
-This commit gives each domain a conflict-credit variable, which will
-later be used for limiting how often a domain can cause other domain's
-transaction-commits to fail.
-
-This commit also provides functions and data for manipulating domains
-and their conflict-credit, and checking whether they have credit.
-
-Reported-by: Juergen Gross <jgross@suse.com>
-Signed-off-by: Thomas Sanders <thomas.sanders@citrix.com>
-Reviewed-by: Jonathan Davies <jonathan.davies@citrix.com>
-Reviewed-by: Christian Lindig <christian.lindig@citrix.com>
-
----
- tools/ocaml/xenstored/connection.ml      |   5 ++
- tools/ocaml/xenstored/define.ml          |   3 +
- tools/ocaml/xenstored/domain.ml          |  11 +++-
- tools/ocaml/xenstored/domains.ml         | 103 ++++++++++++++++++++++++++++++-
- tools/ocaml/xenstored/oxenstored.conf.in |  32 ++++++++++
- tools/ocaml/xenstored/transaction.ml     |   2 +
- tools/ocaml/xenstored/xenstored.ml       |   2 +
- 7 files changed, 154 insertions(+), 4 deletions(-)
-
-diff --git a/tools/ocaml/xenstored/connection.ml b/tools/ocaml/xenstored/connection.ml
-index 3ffd35b..a66d2f7 100644
---- a/tools/ocaml/xenstored/connection.ml
-+++ b/tools/ocaml/xenstored/connection.ml
-@@ -296,3 +296,8 @@ let debug con =
- 	let domid = get_domstr con in
- 	let watches = List.map (fun (path, token) -> Printf.sprintf "watch %s: %s %s\n" domid path token) (list_watches con) in
- 	String.concat "" watches
-+
-+let decr_conflict_credit doms con =
-+	match con.dom with
-+	| None -> () (* It's a socket connection. We don't know which domain we're in, so treat it as if it's free to conflict *)
-+	| Some dom -> Domains.decr_conflict_credit doms dom
-diff --git a/tools/ocaml/xenstored/define.ml b/tools/ocaml/xenstored/define.ml
-index e9d957f..816b493 100644
---- a/tools/ocaml/xenstored/define.ml
-+++ b/tools/ocaml/xenstored/define.ml
-@@ -29,6 +29,9 @@ let maxwatch = ref (50)
- let maxtransaction = ref (20)
- let maxrequests = ref (-1)   (* maximum requests per transaction *)
- 
-+let conflict_burst_limit = ref 5.0
-+let conflict_rate_limit_is_aggregate = ref true
-+
- let domid_self = 0x7FF0
- 
- exception Not_a_directory of string
-diff --git a/tools/ocaml/xenstored/domain.ml b/tools/ocaml/xenstored/domain.ml
-index ab34314..e677aa3 100644
---- a/tools/ocaml/xenstored/domain.ml
-+++ b/tools/ocaml/xenstored/domain.ml
-@@ -31,8 +31,12 @@ type t =
- 	mutable io_credit: int; (* the rounds of ring process left to do, default is 0,
- 	                           usually set to 1 when there is work detected, could
- 	                           also set to n to give "lazy" clients extra credit *)
-+	mutable conflict_credit: float; (* Must be positive to perform writes; a commit
-+	                                   that later causes conflict with another
-+	                                   domain's transaction costs credit. *)
- }
- 
-+let is_dom0 d = d.id = 0
- let get_path dom = "/local/domain/" ^ (sprintf "%u" dom.id)
- let get_id domain = domain.id
- let get_interface d = d.interface
-@@ -48,6 +52,10 @@ let set_io_credit ?(n=1) domain = domain.io_credit <- max 0 n
- let incr_io_credit domain = domain.io_credit <- domain.io_credit + 1
- let decr_io_credit domain = domain.io_credit <- max 0 (domain.io_credit - 1)
- 
-+let is_paused_for_conflict dom = dom.conflict_credit <= 0.0
-+
-+let is_free_to_conflict = is_dom0
-+
- let string_of_port = function
- | None -> "None"
- | Some x -> string_of_int (Xeneventchn.to_int x)
-@@ -84,6 +92,5 @@ let make id mfn remote_port interface eventchn = {
- 	port = None;
- 	bad_client = false;
- 	io_credit = 0;
-+	conflict_credit = !Define.conflict_burst_limit;
- }
--
--let is_dom0 d = d.id = 0
-diff --git a/tools/ocaml/xenstored/domains.ml b/tools/ocaml/xenstored/domains.ml
-index 395f3a9..3d29cc8 100644
---- a/tools/ocaml/xenstored/domains.ml
-+++ b/tools/ocaml/xenstored/domains.ml
-@@ -15,20 +15,58 @@
-  *)
- 
- let debug fmt = Logging.debug "domains" fmt
-+let error fmt = Logging.error "domains" fmt
-+let warn fmt  = Logging.warn  "domains" fmt
- 
- type domains = {
- 	eventchn: Event.t;
- 	table: (Xenctrl.domid, Domain.t) Hashtbl.t;
-+
-+	(* N.B. the Queue module is not thread-safe but oxenstored is single-threaded. *)
-+	(* Domains queue up to regain conflict-credit; we have a queue for
-+	   domains that are carrying some penalty and so are below the
-+	   maximum credit, and another queue for domains that have run out of
-+	   credit and so have had their access paused. *)
-+	doms_conflict_paused: (Domain.t option ref) Queue.t;
-+	doms_with_conflict_penalty: (Domain.t option ref) Queue.t;
-+
-+	(* A callback function to be called when we go from zero to one paused domain.
-+	   This will be to reset the countdown until the next unit of credit is issued. *)
-+	on_first_conflict_pause: unit -> unit;
-+
-+	(* If config is set to use individual instead of aggregate conflict-rate-limiting,
-+	   we use this instead of the queues. *)
-+	mutable n_paused: int;
- }
- 
--let init eventchn =
--	{ eventchn = eventchn; table = Hashtbl.create 10 }
-+let init eventchn = {
-+	eventchn = eventchn;
-+	table = Hashtbl.create 10;
-+	doms_conflict_paused = Queue.create ();
-+	doms_with_conflict_penalty = Queue.create ();
-+	on_first_conflict_pause = (fun () -> ()); (* Dummy value for now, pending subsequent commit. *)
-+	n_paused = 0;
-+}
- let del doms id = Hashtbl.remove doms.table id
- let exist doms id = Hashtbl.mem doms.table id
- let find doms id = Hashtbl.find doms.table id
- let number doms = Hashtbl.length doms.table
- let iter doms fct = Hashtbl.iter (fun _ b -> fct b) doms.table
- 
-+(* Functions to handle queues of domains given that the domain might be deleted while in a queue. *)
-+let push dom queue =
-+	Queue.push (ref (Some dom)) queue
-+
-+let rec pop queue =
-+	match !(Queue.pop queue) with
-+	| None -> pop queue
-+	| Some x -> x
-+
-+let remove_from_queue dom queue =
-+	Queue.iter (fun d -> match !d with
-+		| None -> ()
-+		| Some x -> if x=dom then d := None) queue
-+
- let cleanup xc doms =
- 	let notify = ref false in
- 	let dead_dom = ref [] in
-@@ -52,6 +90,11 @@ let cleanup xc doms =
- 		let dom = Hashtbl.find doms.table id in
- 		Domain.close dom;
- 		Hashtbl.remove doms.table id;
-+		if dom.Domain.conflict_credit <= !Define.conflict_burst_limit
-+		then (
-+			remove_from_queue dom doms.doms_with_conflict_penalty;
-+			if (dom.Domain.conflict_credit <= 0.) then remove_from_queue dom doms.doms_conflict_paused
-+		)
- 	) !dead_dom;
- 	!notify, !dead_dom
- 
-@@ -82,3 +125,59 @@ let create0 doms =
- 	Domain.bind_interdomain dom;
- 	Domain.notify dom;
- 	dom
-+
-+let decr_conflict_credit doms dom =
-+	let before = dom.Domain.conflict_credit in
-+	let after = max (-1.0) (before -. 1.0) in
-+	dom.Domain.conflict_credit <- after;
-+	if !Define.conflict_rate_limit_is_aggregate then (
-+		if before >= !Define.conflict_burst_limit
-+		&& after < !Define.conflict_burst_limit
-+		&& after > 0.0
-+		then (
-+			push dom doms.doms_with_conflict_penalty
-+		) else if before > 0.0 && after <= 0.0
-+		then (
-+			let first_pause = Queue.is_empty doms.doms_conflict_paused in
-+			push dom doms.doms_conflict_paused;
-+			if first_pause then doms.on_first_conflict_pause ()
-+		) else (
-+			(* The queues are correct already: no further action needed. *)
-+		)
-+	) else if before > 0.0 && after <= 0.0 then (
-+		doms.n_paused <- doms.n_paused + 1;
-+		if doms.n_paused = 1 then doms.on_first_conflict_pause ()
-+	)
-+
-+(* Give one point of credit to one domain, and update the queues appropriately. *)
-+let incr_conflict_credit_from_queue doms =
-+	let process_queue q requeue_test =
-+		let d = pop q in
-+		d.Domain.conflict_credit <- min (d.Domain.conflict_credit +. 1.0) !Define.conflict_burst_limit;
-+		if requeue_test d.Domain.conflict_credit then (
-+			push d q (* Make it queue up again for its next point of credit. *)
-+		)
-+	in
-+	let paused_queue_test cred = cred <= 0.0 in
-+	let penalty_queue_test cred = cred < !Define.conflict_burst_limit in
-+	try process_queue doms.doms_conflict_paused paused_queue_test
-+	with Queue.Empty -> (
-+		try process_queue doms.doms_with_conflict_penalty penalty_queue_test
-+		with Queue.Empty -> () (* Both queues are empty: nothing to do here. *)
-+	)
-+
-+let incr_conflict_credit doms =
-+	if !Define.conflict_rate_limit_is_aggregate
-+	then incr_conflict_credit_from_queue doms
-+	else (
-+		(* Give a point of credit to every domain, subject only to the cap. *)
-+		let inc dom =
-+			let before = dom.Domain.conflict_credit in
-+			let after = min (before +. 1.0) !Define.conflict_burst_limit in
-+			dom.Domain.conflict_credit <- after;
-+			if before <= 0.0 && after > 0.0
-+			then doms.n_paused <- doms.n_paused - 1
-+		in
-+		(* Scope for optimisation (probably tiny): avoid iteration if all domains are at max credit *)
-+		iter doms inc
-+	)
-diff --git a/tools/ocaml/xenstored/oxenstored.conf.in b/tools/ocaml/xenstored/oxenstored.conf.in
-index 82117a9..edd4335 100644
---- a/tools/ocaml/xenstored/oxenstored.conf.in
-+++ b/tools/ocaml/xenstored/oxenstored.conf.in
-@@ -9,6 +9,38 @@ test-eagain = false
- # Activate transaction merge support
- merge-activate = true
- 
-+# Limits applied to domains whose writes cause other domains' transaction
-+# commits to fail. Must include decimal point.
-+
-+# The burst limit is the number of conflicts a domain can cause to
-+# fail in a short period; this value is used for both the initial and
-+# the maximum value of each domain's conflict-credit, which falls by
-+# one point for each conflict caused, and when it reaches zero the
-+# domain's requests are ignored.
-+conflict-burst-limit = 5.0
-+
-+# The conflict-credit is replenished over time:
-+# one point is issued after each conflict-max-history-seconds, so this
-+# is the minimum pause-time during which a domain will be ignored.
-+# conflict-max-history-seconds = 0.05
-+
-+# If the conflict-rate-limit-is-aggregate flag is true then after each
-+# tick one point of conflict-credit is given to just one domain: the
-+# one at the front of the queue. If false, then after each tick each
-+# domain gets a point of conflict-credit.
-+# 
-+# In environments where it is known that every transaction will
-+# involve a set of nodes that is writable by at most one other domain,
-+# then it is safe to set this aggregate-limit flag to false for better
-+# performance. (This can be determined by considering the layout of
-+# the xenstore tree and permissions, together with the content of the
-+# transactions that require protection.)
-+# 
-+# A transaction which involves a set of nodes which can be modified by
-+# multiple other domains can suffer conflicts caused by any of those
-+# domains, so the flag must be set to true.
-+conflict-rate-limit-is-aggregate = true
-+
- # Activate node permission system
- perms-activate = true
- 
-diff --git a/tools/ocaml/xenstored/transaction.ml b/tools/ocaml/xenstored/transaction.ml
-index 51d5d6a..6f758ff 100644
---- a/tools/ocaml/xenstored/transaction.ml
-+++ b/tools/ocaml/xenstored/transaction.ml
-@@ -14,6 +14,8 @@
-  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-  * GNU Lesser General Public License for more details.
-  *)
-+let error fmt = Logging.error "transaction" fmt
-+
- open Stdext
- 
- let none = 0
-diff --git a/tools/ocaml/xenstored/xenstored.ml b/tools/ocaml/xenstored/xenstored.ml
-index 2efcce6..20473d5 100644
---- a/tools/ocaml/xenstored/xenstored.ml
-+++ b/tools/ocaml/xenstored/xenstored.ml
-@@ -89,6 +89,8 @@ let parse_config filename =
- 	let pidfile = ref default_pidfile in
- 	let options = [
- 		("merge-activate", Config.Set_bool Transaction.do_coalesce);
-+		("conflict-burst-limit", Config.Set_float Define.conflict_burst_limit);
-+		("conflict-rate-limit-is-aggregate", Config.Set_bool Define.conflict_rate_limit_is_aggregate);
- 		("perms-activate", Config.Set_bool Perms.activate);
- 		("quota-activate", Config.Set_bool Quota.activate);
- 		("quota-maxwatch", Config.Set_int Define.maxwatch);
--- 
-2.1.4
-
diff --git a/system/xen/xsa/xsa206-4.8-0005-oxenstored-ignore-domains-with-no-conflict-credit.patch b/system/xen/xsa/xsa206-4.8-0005-oxenstored-ignore-domains-with-no-conflict-credit.patch
deleted file mode 100644
index b5f4250cdcb0f..0000000000000
--- a/system/xen/xsa/xsa206-4.8-0005-oxenstored-ignore-domains-with-no-conflict-credit.patch
+++ /dev/null
@@ -1,219 +0,0 @@
-From e0f02f8fb5a5130a37bd7efdc80d7f0dd46db41e Mon Sep 17 00:00:00 2001
-From: Thomas Sanders <thomas.sanders@citrix.com>
-Date: Tue, 14 Mar 2017 12:15:52 +0000
-Subject: [PATCH 05/15] oxenstored: ignore domains with no conflict-credit
-
-When processing connections, skip those from domains with no remaining
-conflict-credit.
-
-Also, issue a point of conflict-credit at regular intervals, the
-period being set by the configuration option "conflict-max-history-
-seconds".  When issuing conflict-credit, we give a point either to
-every domain at once (one each) or only to the single domain at the
-front of the queue, depending on the configuration option
-"conflict-rate-limit-is-aggregate".
-
-Reported-by: Juergen Gross <jgross@suse.com>
-Signed-off-by: Thomas Sanders <thomas.sanders@citrix.com>
-Reviewed-by: Jonathan Davies <jonathan.davies@citrix.com>
-Reviewed-by: Christian Lindig <christian.lindig@citrix.com>
----
- tools/ocaml/xenstored/connections.ml     | 14 ++++---
- tools/ocaml/xenstored/define.ml          |  1 +
- tools/ocaml/xenstored/domains.ml         |  4 +-
- tools/ocaml/xenstored/oxenstored.conf.in |  2 +-
- tools/ocaml/xenstored/xenstored.ml       | 65 +++++++++++++++++++++++---------
- 5 files changed, 60 insertions(+), 26 deletions(-)
-
-diff --git a/tools/ocaml/xenstored/connections.ml b/tools/ocaml/xenstored/connections.ml
-index f9bc225..ae76928 100644
---- a/tools/ocaml/xenstored/connections.ml
-+++ b/tools/ocaml/xenstored/connections.ml
-@@ -44,12 +44,14 @@ let add_domain cons dom =
- 	| Some p -> Hashtbl.add cons.ports p con;
- 	| None -> ()
- 
--let select cons =
--	Hashtbl.fold
--		(fun _ con (ins, outs) ->
--		 let fd = Connection.get_fd con in
--		 (fd :: ins,  if Connection.has_output con then fd :: outs else outs))
--		cons.anonymous ([], [])
-+let select ?(only_if = (fun _ -> true)) cons =
-+	Hashtbl.fold (fun _ con (ins, outs) ->
-+		if (only_if con) then (
-+			let fd = Connection.get_fd con in
-+			(fd :: ins,  if Connection.has_output con then fd :: outs else outs)
-+		) else (ins, outs)
-+	)
-+	cons.anonymous ([], [])
- 
- let find cons =
- 	Hashtbl.find cons.anonymous
-diff --git a/tools/ocaml/xenstored/define.ml b/tools/ocaml/xenstored/define.ml
-index 816b493..5a604d1 100644
---- a/tools/ocaml/xenstored/define.ml
-+++ b/tools/ocaml/xenstored/define.ml
-@@ -30,6 +30,7 @@ let maxtransaction = ref (20)
- let maxrequests = ref (-1)   (* maximum requests per transaction *)
- 
- let conflict_burst_limit = ref 5.0
-+let conflict_max_history_seconds = ref 0.05
- let conflict_rate_limit_is_aggregate = ref true
- 
- let domid_self = 0x7FF0
-diff --git a/tools/ocaml/xenstored/domains.ml b/tools/ocaml/xenstored/domains.ml
-index 3d29cc8..99f68c7 100644
---- a/tools/ocaml/xenstored/domains.ml
-+++ b/tools/ocaml/xenstored/domains.ml
-@@ -39,12 +39,12 @@ type domains = {
- 	mutable n_paused: int;
- }
- 
--let init eventchn = {
-+let init eventchn on_first_conflict_pause = {
- 	eventchn = eventchn;
- 	table = Hashtbl.create 10;
- 	doms_conflict_paused = Queue.create ();
- 	doms_with_conflict_penalty = Queue.create ();
--	on_first_conflict_pause = (fun () -> ()); (* Dummy value for now, pending subsequent commit. *)
-+	on_first_conflict_pause = on_first_conflict_pause;
- 	n_paused = 0;
- }
- let del doms id = Hashtbl.remove doms.table id
-diff --git a/tools/ocaml/xenstored/oxenstored.conf.in b/tools/ocaml/xenstored/oxenstored.conf.in
-index edd4335..536611e 100644
---- a/tools/ocaml/xenstored/oxenstored.conf.in
-+++ b/tools/ocaml/xenstored/oxenstored.conf.in
-@@ -22,7 +22,7 @@ conflict-burst-limit = 5.0
- # The conflict-credit is replenished over time:
- # one point is issued after each conflict-max-history-seconds, so this
- # is the minimum pause-time during which a domain will be ignored.
--# conflict-max-history-seconds = 0.05
-+conflict-max-history-seconds = 0.05
- 
- # If the conflict-rate-limit-is-aggregate flag is true then after each
- # tick one point of conflict-credit is given to just one domain: the
-diff --git a/tools/ocaml/xenstored/xenstored.ml b/tools/ocaml/xenstored/xenstored.ml
-index 20473d5..f562f59 100644
---- a/tools/ocaml/xenstored/xenstored.ml
-+++ b/tools/ocaml/xenstored/xenstored.ml
-@@ -53,14 +53,16 @@ let process_connection_fds store cons domains rset wset =
- 
- let process_domains store cons domains =
- 	let do_io_domain domain =
--		if not (Domain.is_bad_domain domain) then
--			let io_credit = Domain.get_io_credit domain in
--			if io_credit > 0 then (
--				let con = Connections.find_domain cons (Domain.get_id domain) in
--				Process.do_input store cons domains con;
--				Process.do_output store cons domains con;
--				Domain.decr_io_credit domain;
--			) in
-+		if Domain.is_bad_domain domain
-+		|| Domain.get_io_credit domain <= 0
-+		|| Domain.is_paused_for_conflict domain
-+		then () (* nothing to do *)
-+		else (
-+			let con = Connections.find_domain cons (Domain.get_id domain) in
-+			Process.do_input store cons domains con;
-+			Process.do_output store cons domains con;
-+			Domain.decr_io_credit domain
-+		) in
- 	Domains.iter domains do_io_domain
- 
- let sigusr1_handler store =
-@@ -90,6 +92,7 @@ let parse_config filename =
- 	let options = [
- 		("merge-activate", Config.Set_bool Transaction.do_coalesce);
- 		("conflict-burst-limit", Config.Set_float Define.conflict_burst_limit);
-+		("conflict-max-history-seconds", Config.Set_float Define.conflict_max_history_seconds);
- 		("conflict-rate-limit-is-aggregate", Config.Set_bool Define.conflict_rate_limit_is_aggregate);
- 		("perms-activate", Config.Set_bool Perms.activate);
- 		("quota-activate", Config.Set_bool Quota.activate);
-@@ -262,7 +265,22 @@ let _ =
- 
- 	let store = Store.create () in
- 	let eventchn = Event.init () in
--	let domains = Domains.init eventchn in
-+	let next_frequent_ops = ref 0. in
-+	let advance_next_frequent_ops () =
-+		next_frequent_ops := (Unix.gettimeofday () +. !Define.conflict_max_history_seconds)
-+	in
-+	let delay_next_frequent_ops_by duration =
-+		next_frequent_ops := !next_frequent_ops +. duration
-+	in
-+	let domains = Domains.init eventchn advance_next_frequent_ops in
-+
-+	(* For things that need to be done periodically but more often
-+	 * than the periodic_ops function *)
-+	let frequent_ops () =
-+		if Unix.gettimeofday () > !next_frequent_ops then (
-+			Domains.incr_conflict_credit domains;
-+			advance_next_frequent_ops ()
-+		) in
- 	let cons = Connections.create () in
- 
- 	let quit = ref false in
-@@ -394,23 +412,34 @@ let _ =
- 			     gc.Gc.heap_words gc.Gc.heap_chunks
- 			     gc.Gc.live_words gc.Gc.live_blocks
- 			     gc.Gc.free_words gc.Gc.free_blocks
--		)
--		in
-+		);
-+		let elapsed = Unix.gettimeofday () -. now in
-+		delay_next_frequent_ops_by elapsed
-+	in
- 
--		let period_ops_interval = 15. in
--		let period_start = ref 0. in
-+	let period_ops_interval = 15. in
-+	let period_start = ref 0. in
- 
- 	let main_loop () =
--
-+		let is_peaceful c =
-+			match Connection.get_domain c with
-+			| None -> true (* Treat socket-connections as exempt, and free to conflict. *)
-+			| Some dom -> not (Domain.is_paused_for_conflict dom)
-+		in
-+		frequent_ops ();
- 		let mw = Connections.has_more_work cons in
-+		let peaceful_mw = List.filter is_peaceful mw in
- 		List.iter
- 			(fun c ->
- 			 match Connection.get_domain c with
- 			 | None -> () | Some d -> Domain.incr_io_credit d)
--			mw;
-+			peaceful_mw;
-+		let start_time = Unix.gettimeofday () in
- 		let timeout =
--			if List.length mw > 0 then 0. else period_ops_interval in
--		let inset, outset = Connections.select cons in
-+			let until_next_activity = min (max 0. (!next_frequent_ops -. start_time)) period_ops_interval in
-+			if peaceful_mw <> [] then 0. else until_next_activity
-+		in
-+		let inset, outset = Connections.select ~only_if:is_peaceful cons in
- 		let rset, wset, _ =
- 		try
- 			Select.select (spec_fds @ inset) outset [] timeout
-@@ -420,6 +449,7 @@ let _ =
- 			List.partition (fun fd -> List.mem fd spec_fds) rset in
- 		if List.length sfds > 0 then
- 			process_special_fds sfds;
-+
- 		if List.length cfds > 0 || List.length wset > 0 then
- 			process_connection_fds store cons domains cfds wset;
- 		if timeout <> 0. then (
-@@ -427,6 +457,7 @@ let _ =
- 			if now > !period_start +. period_ops_interval then
- 				(period_start := now; periodic_ops now)
- 		);
-+
- 		process_domains store cons domains
- 		in
- 
--- 
-2.1.4
-
diff --git a/system/xen/xsa/xsa206-4.8-0006-oxenstored-add-transaction-info-relevant-to-history-.patch b/system/xen/xsa/xsa206-4.8-0006-oxenstored-add-transaction-info-relevant-to-history-.patch
deleted file mode 100644
index e9f23d62c1112..0000000000000
--- a/system/xen/xsa/xsa206-4.8-0006-oxenstored-add-transaction-info-relevant-to-history-.patch
+++ /dev/null
@@ -1,88 +0,0 @@
-From eedcaba31d907b889f571113e7d9739e5ce1e9e5 Mon Sep 17 00:00:00 2001
-From: Jonathan Davies <jonathan.davies@citrix.com>
-Date: Tue, 14 Mar 2017 12:17:38 +0000
-Subject: [PATCH 06/15] oxenstored: add transaction info relevant to
- history-tracking
-
-Specifically:
- * retain the original store (not just the root) in full transactions
- * store commit count at the time of the start of the transaction
-
-Reported-by: Juergen Gross <jgross@suse.com>
-Signed-off-by: Jonathan Davies <jonathan.davies@citrix.com>
-Reviewed-by: Thomas Sanders <thomas.sanders@citrix.com>
-Reviewed-by: Ian Jackson <ian.jackson@eu.citrix.com>
-Reviewed-by: Christian Lindig <christian.lindig@citrix.com>
----
- tools/ocaml/xenstored/process.ml     |  2 +-
- tools/ocaml/xenstored/transaction.ml | 12 ++++++++----
- 2 files changed, 9 insertions(+), 5 deletions(-)
-
-diff --git a/tools/ocaml/xenstored/process.ml b/tools/ocaml/xenstored/process.ml
-index 7b60376..5f92044 100644
---- a/tools/ocaml/xenstored/process.ml
-+++ b/tools/ocaml/xenstored/process.ml
-@@ -301,7 +301,7 @@ let transaction_replay c t doms cons =
- 	| Transaction.No ->
- 		error "attempted to replay a non-full transaction";
- 		false
--	| Transaction.Full(id, oldroot, cstore) ->
-+	| Transaction.Full(id, oldstore, cstore) ->
- 		let tid = Connection.start_transaction c cstore in
- 		let new_t = Transaction.make tid cstore in
- 		let con = sprintf "r(%d):%s" id (Connection.get_domstr c) in
-diff --git a/tools/ocaml/xenstored/transaction.ml b/tools/ocaml/xenstored/transaction.ml
-index 6f758ff..b1791b3 100644
---- a/tools/ocaml/xenstored/transaction.ml
-+++ b/tools/ocaml/xenstored/transaction.ml
-@@ -73,12 +73,13 @@ let can_coalesce oldroot currentroot path =
- 
- type ty = No | Full of (
- 	int *          (* Transaction id *)
--	Store.Node.t * (* Original root *)
-+	Store.t *      (* Original store *)
- 	Store.t        (* A pointer to the canonical store: its root changes on each transaction-commit *)
- )
- 
- type t = {
- 	ty: ty;
-+	start_count: int64;
- 	store: Store.t; (* This is the store that we change in write operations. *)
- 	quota: Quota.t;
- 	mutable paths: (Xenbus.Xb.Op.operation * Store.Path.t) list;
-@@ -87,10 +88,13 @@ type t = {
- 	mutable write_lowpath: Store.Path.t option;
- }
- 
-+let counter = ref 0L
-+
- let make id store =
--	let ty = if id = none then No else Full(id, Store.get_root store, store) in
-+	let ty = if id = none then No else Full(id, Store.copy store, store) in
- 	{
- 		ty = ty;
-+		start_count = !counter;
- 		store = if id = none then store else Store.copy store;
- 		quota = Quota.copy store.Store.quota;
- 		paths = [];
-@@ -161,7 +165,7 @@ let commit ~con t =
- 	let has_commited =
- 	match t.ty with
- 	| No                         -> true
--	| Full (id, oldroot, cstore) ->       (* "cstore" meaning current canonical store *)
-+	| Full (id, oldstore, cstore) ->       (* "cstore" meaning current canonical store *)
- 		let commit_partial oldroot cstore store =
- 			(* get the lowest path of the query and verify that it hasn't
- 			   been modified by others transactions. *)
-@@ -204,7 +208,7 @@ let commit ~con t =
- 		if !test_eagain && Random.int 3 = 0 then
- 			false
- 		else
--			try_commit oldroot cstore t.store
-+			try_commit (Store.get_root oldstore) cstore t.store
- 		in
- 	if has_commited && has_write_ops then
- 		Disk.write t.store;
--- 
-2.1.4
-
diff --git a/system/xen/xsa/xsa206-4.8-0007-oxenstored-support-commit-history-tracking.patch b/system/xen/xsa/xsa206-4.8-0007-oxenstored-support-commit-history-tracking.patch
deleted file mode 100644
index d8fadaa7496c4..0000000000000
--- a/system/xen/xsa/xsa206-4.8-0007-oxenstored-support-commit-history-tracking.patch
+++ /dev/null
@@ -1,153 +0,0 @@
-From 5df600ee06458eebf037f6bff663b0a9273e3a3f Mon Sep 17 00:00:00 2001
-From: Jonathan Davies <jonathan.davies@citrix.com>
-Date: Tue, 14 Mar 2017 13:20:07 +0000
-Subject: [PATCH 07/15] oxenstored: support commit history tracking
-
-Add ability to track xenstore tree operations -- either non-transactional
-operations or committed transactions.
-
-For now, the call to actually retain commits is commented out because history
-can grow without bound.
-
-For now, we call record_commit for all non-transactional operations. A
-subsequent patch will make it retain only the ones with side-effects.
-
-Reported-by: Juergen Gross <jgross@suse.com>
-Signed-off-by: Jonathan Davies <jonathan.davies@citrix.com>
-Signed-off-by: Thomas Sanders <thomas.sanders@citrix.com>
-Reviewed-by: Christian Lindig <christian.lindig@citrix.com>
-
----
- tools/ocaml/xenstored/Makefile     |  1 +
- tools/ocaml/xenstored/history.ml   | 43 ++++++++++++++++++++++++++++++++++++++
- tools/ocaml/xenstored/process.ml   | 24 +++++++++++++++++++--
- tools/ocaml/xenstored/xenstored.ml |  1 +
- 4 files changed, 67 insertions(+), 2 deletions(-)
- create mode 100644 tools/ocaml/xenstored/history.ml
-
-diff --git a/tools/ocaml/xenstored/Makefile b/tools/ocaml/xenstored/Makefile
-index 1769e55..d238836 100644
---- a/tools/ocaml/xenstored/Makefile
-+++ b/tools/ocaml/xenstored/Makefile
-@@ -53,6 +53,7 @@ OBJS = paths \
- 	domains \
- 	connection \
- 	connections \
-+	history \
- 	parse_arg \
- 	process \
- 	xenstored
-diff --git a/tools/ocaml/xenstored/history.ml b/tools/ocaml/xenstored/history.ml
-new file mode 100644
-index 0000000..e4b4d70
---- /dev/null
-+++ b/tools/ocaml/xenstored/history.ml
-@@ -0,0 +1,43 @@
-+(*
-+ * Copyright (c) 2017 Citrix Systems Ltd.
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU Lesser General Public License as published
-+ * by the Free Software Foundation; version 2.1 only. with the special
-+ * exception on linking described in file LICENSE.
-+ *
-+ * This program is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+ * GNU Lesser General Public License for more details.
-+ *)
-+
-+type history_record = {
-+	con: Connection.t;   (* connection that made a change *)
-+	tid: int;            (* transaction id of the change (may be Transaction.none) *)
-+	before: Store.t;     (* the store before the change *)
-+	after: Store.t;      (* the store after the change *)
-+	finish_count: int64; (* the commit-count at which the transaction finished *)
-+}
-+
-+let history : history_record list ref = ref []
-+
-+(* Called from periodic_ops to ensure we don't discard symbols that are still needed. *)
-+(* There is scope for optimisation here, since in consecutive commits one commit's `after`
-+ * is the same thing as the next commit's `before`, but not all commits in history are
-+ * consecutive. *)
-+let mark_symbols () =
-+	(* There are gaps where dom0's commits are missing. Otherwise we could assume that
-+	 * each element's `before` is the same thing as the next element's `after`
-+	 * since the next element is the previous commit *)
-+	List.iter (fun hist_rec ->
-+			Store.mark_symbols hist_rec.before;
-+			Store.mark_symbols hist_rec.after;
-+		)
-+		!history
-+
-+let push (x: history_record) =
-+	let dom = x.con.Connection.dom in
-+	match dom with
-+	| None -> () (* treat socket connections as always free to conflict *)
-+	| Some d -> if not (Domain.is_free_to_conflict d) then history := x :: !history
-diff --git a/tools/ocaml/xenstored/process.ml b/tools/ocaml/xenstored/process.ml
-index 5f92044..964c044 100644
---- a/tools/ocaml/xenstored/process.ml
-+++ b/tools/ocaml/xenstored/process.ml
-@@ -293,6 +293,16 @@ let write_response_log ~ty ~tid ~con ~response =
- 	| Packet.Reply x -> write_answer_log ~ty ~tid ~con ~data:x
- 	| Packet.Error e -> write_answer_log ~ty:(Xenbus.Xb.Op.Error) ~tid ~con ~data:e
- 
-+let record_commit ~con ~tid ~before ~after =
-+	let inc r = r := Int64.add 1L !r in
-+	let finish_count = inc Transaction.counter; !Transaction.counter in
-+	(* This call would leak memory if historic activity is retained forever
-+	   so can only be uncommented if history is guaranteed not to grow
-+	   unboundedly.
-+	History.push {History.con=con; tid=tid; before=before; after=after; finish_count=finish_count}
-+	*)
-+	()
-+
- (* Replay a stored transaction against a fresh store, check the responses are
-    all equivalent: if so, commit the transaction. Otherwise send the abort to
-    the client. *)
-@@ -363,8 +373,14 @@ let do_transaction_end con t domains cons data =
- 		Connection.end_transaction con (Transaction.get_id t) commit in
- 	if not success then
- 		raise Transaction_again;
--	if commit then
--		process_watch (List.rev (Transaction.get_paths t)) cons
-+	if commit then begin
-+		process_watch (List.rev (Transaction.get_paths t)) cons;
-+		match t.Transaction.ty with
-+		| Transaction.No ->
-+			() (* no need to record anything *)
-+		| Transaction.Full(id, oldstore, cstore) ->
-+			record_commit ~con ~tid:id ~before:oldstore ~after:cstore
-+	end
- 
- let do_introduce con t domains cons data =
- 	if not (Connection.is_dom0 con)
-@@ -448,7 +464,11 @@ let process_packet ~store ~cons ~doms ~con ~req =
- 			else
- 				Connection.get_transaction con tid
- 			in
-+
-+		let before = Store.copy store in
- 		let response = input_handle_error ~cons ~doms ~fct ~con ~t ~req in
-+		let after = Store.copy store in
-+		if tid = Transaction.none then record_commit ~con ~tid ~before ~after;
- 
- 		let response = try
- 			if tid <> Transaction.none then
-diff --git a/tools/ocaml/xenstored/xenstored.ml b/tools/ocaml/xenstored/xenstored.ml
-index f562f59..d5c50fd 100644
---- a/tools/ocaml/xenstored/xenstored.ml
-+++ b/tools/ocaml/xenstored/xenstored.ml
-@@ -385,6 +385,7 @@ let _ =
- 			Symbol.mark_all_as_unused ();
- 			Store.mark_symbols store;
- 			Connections.iter cons Connection.mark_symbols;
-+			History.mark_symbols ();
- 			Symbol.garbage ()
- 		end;
- 
--- 
-2.1.4
-
diff --git a/system/xen/xsa/xsa206-4.8-0008-oxenstored-only-record-operations-with-side-effects-.patch b/system/xen/xsa/xsa206-4.8-0008-oxenstored-only-record-operations-with-side-effects-.patch
deleted file mode 100644
index e3de404298019..0000000000000
--- a/system/xen/xsa/xsa206-4.8-0008-oxenstored-only-record-operations-with-side-effects-.patch
+++ /dev/null
@@ -1,85 +0,0 @@
-From f8083d52b6314f92718316f160eea47fef47988e Mon Sep 17 00:00:00 2001
-From: Jonathan Davies <jonathan.davies@citrix.com>
-Date: Thu, 23 Mar 2017 14:20:33 +0000
-Subject: [PATCH 08/15] oxenstored: only record operations with side-effects in
- history
-
-There is no need to record "read" operations as they will never cause another
-transaction to fail.
-
-Reported-by: Juergen Gross <jgross@suse.com>
-Signed-off-by: Jonathan Davies <jonathan.davies@citrix.com>
-Reviewed-by: Thomas Sanders <thomas.sanders@citrix.com>
-
----
- tools/ocaml/xenstored/process.ml | 47 ++++++++++++++++++++++++++++++++++++----
- 1 file changed, 43 insertions(+), 4 deletions(-)
-
-diff --git a/tools/ocaml/xenstored/process.ml b/tools/ocaml/xenstored/process.ml
-index 964c044..b435a4a 100644
---- a/tools/ocaml/xenstored/process.ml
-+++ b/tools/ocaml/xenstored/process.ml
-@@ -450,6 +450,37 @@ let function_of_type ty =
- 	| _                              -> function_of_type_simple_op ty
- 
- (**
-+ * Determines which individual (non-transactional) operations we want to retain.
-+ * We only want to retain operations that have side-effects in the store since
-+ * these can be the cause of transactions failing.
-+ *)
-+let retain_op_in_history ty =
-+	match ty with
-+	| Xenbus.Xb.Op.Write
-+	| Xenbus.Xb.Op.Mkdir
-+	| Xenbus.Xb.Op.Rm
-+	| Xenbus.Xb.Op.Setperms          -> true
-+	| Xenbus.Xb.Op.Debug
-+	| Xenbus.Xb.Op.Directory
-+	| Xenbus.Xb.Op.Read
-+	| Xenbus.Xb.Op.Getperms
-+	| Xenbus.Xb.Op.Watch
-+	| Xenbus.Xb.Op.Unwatch
-+	| Xenbus.Xb.Op.Transaction_start
-+	| Xenbus.Xb.Op.Transaction_end
-+	| Xenbus.Xb.Op.Introduce
-+	| Xenbus.Xb.Op.Release
-+	| Xenbus.Xb.Op.Getdomainpath
-+	| Xenbus.Xb.Op.Watchevent
-+	| Xenbus.Xb.Op.Error
-+	| Xenbus.Xb.Op.Isintroduced
-+	| Xenbus.Xb.Op.Resume
-+	| Xenbus.Xb.Op.Set_target
-+	| Xenbus.Xb.Op.Restrict
-+	| Xenbus.Xb.Op.Reset_watches
-+	| Xenbus.Xb.Op.Invalid           -> false
-+
-+(**
-  * Nothrow guarantee.
-  *)
- let process_packet ~store ~cons ~doms ~con ~req =
-@@ -465,10 +496,18 @@ let process_packet ~store ~cons ~doms ~con ~req =
- 				Connection.get_transaction con tid
- 			in
- 
--		let before = Store.copy store in
--		let response = input_handle_error ~cons ~doms ~fct ~con ~t ~req in
--		let after = Store.copy store in
--		if tid = Transaction.none then record_commit ~con ~tid ~before ~after;
-+		let execute () = input_handle_error ~cons ~doms ~fct ~con ~t ~req in
-+
-+		let response =
-+			(* Note that transactions are recorded in history separately. *)
-+			if tid = Transaction.none && retain_op_in_history ty then begin
-+				let before = Store.copy store in
-+				let response = execute () in
-+				let after = Store.copy store in
-+				record_commit ~con ~tid ~before ~after;
-+				response
-+			end else execute ()
-+		in
- 
- 		let response = try
- 			if tid <> Transaction.none then
--- 
-2.1.4
-
diff --git a/system/xen/xsa/xsa206-4.8-0009-oxenstored-discard-old-commit-history-on-txn-end.patch b/system/xen/xsa/xsa206-4.8-0009-oxenstored-discard-old-commit-history-on-txn-end.patch
deleted file mode 100644
index f1734c8375cd4..0000000000000
--- a/system/xen/xsa/xsa206-4.8-0009-oxenstored-discard-old-commit-history-on-txn-end.patch
+++ /dev/null
@@ -1,141 +0,0 @@
-From 66bdbbc41a45d2bf59ddb4ff26c52c1cc546f720 Mon Sep 17 00:00:00 2001
-From: Thomas Sanders <thomas.sanders@citrix.com>
-Date: Thu, 23 Mar 2017 14:25:16 +0000
-Subject: [PATCH 09/15] oxenstored: discard old commit-history on txn end
-
-The history of commits is to be used for working out which historical
-commit(s) (including atomic writes) caused conflicts with a
-currently-failing commit of a transaction. Any commit that was made
-before the current transaction started cannot be relevant. Therefore
-we never need to keep history from before the start of the
-longest-running transaction that is open at any given time: whenever a
-transaction ends (with or without a commit) then if it was the
-longest-running open transaction we can delete history up until start
-of the the next-longest-running open transaction.
-
-Some transactions might stay open for a very long time, so if any
-transaction exceeds conflict_max_history_seconds then we remove it
-from consideration in this context, and will not guarantee to keep
-remembering about historical commits made during such a transaction.
-
-We implement this by keeping a list of all open transactions that have
-not been open too long. When a transaction ends, we remove it from the
-list, along with any that have been open longer than the maximum; then
-we delete any history from before the start of the longest-running
-transaction remaining in the list.
-
-Reported-by: Juergen Gross <jgross@suse.com>
-Signed-off-by: Thomas Sanders <thomas.sanders@citrix.com>
-Reviewed-by: Jonathan Davies <jonathan.davies@citrix.com>
-Reviewed-by: Christian Lindig <christian.lindig@citrix.com>
----
- tools/ocaml/xenstored/history.ml     | 17 +++++++++++++++++
- tools/ocaml/xenstored/process.ml     |  4 ++--
- tools/ocaml/xenstored/transaction.ml | 29 +++++++++++++++++++++++++----
- 3 files changed, 44 insertions(+), 6 deletions(-)
-
-diff --git a/tools/ocaml/xenstored/history.ml b/tools/ocaml/xenstored/history.ml
-index e4b4d70..6f7a282 100644
---- a/tools/ocaml/xenstored/history.ml
-+++ b/tools/ocaml/xenstored/history.ml
-@@ -36,6 +36,23 @@ let mark_symbols () =
- 		)
- 		!history
- 
-+(* Keep only enough commit-history to protect the running transactions that we are still tracking *)
-+(* There is scope for optimisation here, replacing List.filter with something more efficient,
-+ * probably on a different list-like structure. *)
-+let trim () =
-+	history := match Transaction.oldest_short_running_transaction () with
-+	| None -> [] (* We have no open transaction, so no history is needed *)
-+	| Some (_, txn) -> (
-+		(* keep records with finish_count recent enough to be relevant *)
-+		List.filter (fun r -> r.finish_count > txn.Transaction.start_count) !history
-+	)
-+
-+let end_transaction txn con tid commit =
-+	let success = Connection.end_transaction con tid commit in
-+	Transaction.end_transaction txn;
-+	trim ();
-+	success
-+
- let push (x: history_record) =
- 	let dom = x.con.Connection.dom in
- 	match dom with
-diff --git a/tools/ocaml/xenstored/process.ml b/tools/ocaml/xenstored/process.ml
-index b435a4a..6f4d118 100644
---- a/tools/ocaml/xenstored/process.ml
-+++ b/tools/ocaml/xenstored/process.ml
-@@ -313,7 +313,7 @@ let transaction_replay c t doms cons =
- 		false
- 	| Transaction.Full(id, oldstore, cstore) ->
- 		let tid = Connection.start_transaction c cstore in
--		let new_t = Transaction.make tid cstore in
-+		let new_t = Transaction.make ~internal:true tid cstore in
- 		let con = sprintf "r(%d):%s" id (Connection.get_domstr c) in
- 		let perform_exn (request, response) =
- 			write_access_log ~ty:request.Packet.ty ~tid ~con ~data:request.Packet.data;
-@@ -370,7 +370,7 @@ let do_transaction_end con t domains cons data =
- 		in
- 	let success =
- 		let commit = if commit then Some (fun con trans -> transaction_replay con trans domains cons) else None in
--		Connection.end_transaction con (Transaction.get_id t) commit in
-+		History.end_transaction t con (Transaction.get_id t) commit in
- 	if not success then
- 		raise Transaction_again;
- 	if commit then begin
-diff --git a/tools/ocaml/xenstored/transaction.ml b/tools/ocaml/xenstored/transaction.ml
-index b1791b3..edd1178 100644
---- a/tools/ocaml/xenstored/transaction.ml
-+++ b/tools/ocaml/xenstored/transaction.ml
-@@ -87,12 +87,29 @@ type t = {
- 	mutable read_lowpath: Store.Path.t option;
- 	mutable write_lowpath: Store.Path.t option;
- }
-+let get_id t = match t.ty with No -> none | Full (id, _, _) -> id
- 
- let counter = ref 0L
- 
--let make id store =
-+(* Scope for optimisation: different data-structure and functions to search/filter it *)
-+let short_running_txns = ref []
-+
-+let oldest_short_running_transaction () =
-+	let rec last = function
-+		| [] -> None
-+		| [x] -> Some x
-+		| x :: xs -> last xs
-+	in last !short_running_txns
-+
-+let end_transaction txn =
-+	let cutoff = Unix.gettimeofday () -. !Define.conflict_max_history_seconds in
-+	short_running_txns := List.filter
-+		(function (start_time, tx) -> start_time >= cutoff && tx != txn)
-+		!short_running_txns
-+
-+let make ?(internal=false) id store =
- 	let ty = if id = none then No else Full(id, Store.copy store, store) in
--	{
-+	let txn = {
- 		ty = ty;
- 		start_count = !counter;
- 		store = if id = none then store else Store.copy store;
-@@ -101,9 +118,13 @@ let make id store =
- 		operations = [];
- 		read_lowpath = None;
- 		write_lowpath = None;
--	}
-+	} in
-+	if id <> none && not internal then (
-+		let now = Unix.gettimeofday () in
-+		short_running_txns := (now, txn) :: !short_running_txns
-+	);
-+	txn
- 
--let get_id t = match t.ty with No -> none | Full (id, _, _) -> id
- let get_store t = t.store
- let get_paths t = t.paths
- 
--- 
-2.1.4
-
diff --git a/system/xen/xsa/xsa206-4.8-0010-oxenstored-track-commit-history.patch b/system/xen/xsa/xsa206-4.8-0010-oxenstored-track-commit-history.patch
deleted file mode 100644
index f5d85367eb167..0000000000000
--- a/system/xen/xsa/xsa206-4.8-0010-oxenstored-track-commit-history.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From 2e94c635a652a575cb1f25f7dc5bc0ebcdbedcc4 Mon Sep 17 00:00:00 2001
-From: Jonathan Davies <jonathan.davies@citrix.com>
-Date: Mon, 27 Mar 2017 08:58:29 +0000
-Subject: [PATCH 10/15] oxenstored: track commit history
-
-Since the list of historic activity cannot grow without bound, it is safe to use
-this to track commits.
-
-Reported-by: Juergen Gross <jgross@suse.com>
-Signed-off-by: Jonathan Davies <jonathan.davies@citrix.com>
-Reviewed-by: Thomas Sanders <thomas.sanders@citrix.com>
----
- tools/ocaml/xenstored/process.ml | 5 -----
- 1 file changed, 5 deletions(-)
-
-diff --git a/tools/ocaml/xenstored/process.ml b/tools/ocaml/xenstored/process.ml
-index 6f4d118..1ed1a8f 100644
---- a/tools/ocaml/xenstored/process.ml
-+++ b/tools/ocaml/xenstored/process.ml
-@@ -296,12 +296,7 @@ let write_response_log ~ty ~tid ~con ~response =
- let record_commit ~con ~tid ~before ~after =
- 	let inc r = r := Int64.add 1L !r in
- 	let finish_count = inc Transaction.counter; !Transaction.counter in
--	(* This call would leak memory if historic activity is retained forever
--	   so can only be uncommented if history is guaranteed not to grow
--	   unboundedly.
- 	History.push {History.con=con; tid=tid; before=before; after=after; finish_count=finish_count}
--	*)
--	()
- 
- (* Replay a stored transaction against a fresh store, check the responses are
-    all equivalent: if so, commit the transaction. Otherwise send the abort to
--- 
-2.1.4
-
diff --git a/system/xen/xsa/xsa206-4.8-0011-oxenstored-blame-the-connection-that-caused-a-transa.patch b/system/xen/xsa/xsa206-4.8-0011-oxenstored-blame-the-connection-that-caused-a-transa.patch
deleted file mode 100644
index b0a8e011ee7da..0000000000000
--- a/system/xen/xsa/xsa206-4.8-0011-oxenstored-blame-the-connection-that-caused-a-transa.patch
+++ /dev/null
@@ -1,137 +0,0 @@
-From 0972f3e46001e9b3192786033663ef4ee423f8be Mon Sep 17 00:00:00 2001
-From: Jonathan Davies <jonathan.davies@citrix.com>
-Date: Thu, 23 Mar 2017 14:28:16 +0000
-Subject: [PATCH 11/15] oxenstored: blame the connection that caused a
- transaction conflict
-
-Blame each connection found to have made a commit that would cause this
-transaction to fail. Each blamed connection is penalised by having its
-conflict-credit decremented.
-
-Note the change in semantics for the replay function: we no longer stop after
-finding the first operation that can't be replayed. This allows us to identify
-all operations that conflicted with this transaction, not just the one that
-conflicted first.
-
-Signed-off-by: Jonathan Davies <jonathan.davies@citrix.com>
-Signed-off-by: Thomas Sanders <thomas.sanders@citrix.com>
-v1 Reviewed-by: Christian Lindig <christian.lindig@citrix.com>
-
-Changes since v1:
- * use correct log levels for informational messages
-Changes since v2:
- * fix the blame algorithm and improve logging
-   (fix was reviewed by Jonathan Davies)
-
-Reported-by: Juergen Gross <jgross@suse.com>
-Signed-off-by: Thomas Sanders <thomas.sanders@citrix.com>
----
- tools/ocaml/xenstored/history.ml | 12 ++++++++++
- tools/ocaml/xenstored/process.ml | 50 ++++++++++++++++++++++++++++++++--------
- 2 files changed, 52 insertions(+), 10 deletions(-)
-
-diff --git a/tools/ocaml/xenstored/history.ml b/tools/ocaml/xenstored/history.ml
-index 6f7a282..e941e2b 100644
---- a/tools/ocaml/xenstored/history.ml
-+++ b/tools/ocaml/xenstored/history.ml
-@@ -58,3 +58,15 @@ let push (x: history_record) =
- 	match dom with
- 	| None -> () (* treat socket connections as always free to conflict *)
- 	| Some d -> if not (Domain.is_free_to_conflict d) then history := x :: !history
-+
-+(* Find the connections from records since commit-count [since] for which [f record] returns [true] *)
-+let filter_connections ~since ~f =
-+	(* The "mem" call is an optimisation, to avoid calling f if we have picked con already. *)
-+	(* Using a hash table rather than a list is to optimise the "mem" call. *)
-+	List.fold_left (fun acc hist_rec ->
-+		if hist_rec.finish_count > since
-+		&& not (Hashtbl.mem acc hist_rec.con)
-+		&& f hist_rec
-+		then Hashtbl.replace acc hist_rec.con ();
-+		acc
-+	) (Hashtbl.create 1023) !history
-diff --git a/tools/ocaml/xenstored/process.ml b/tools/ocaml/xenstored/process.ml
-index 1ed1a8f..5e5a1ab 100644
---- a/tools/ocaml/xenstored/process.ml
-+++ b/tools/ocaml/xenstored/process.ml
-@@ -16,6 +16,7 @@
- 
- let error fmt = Logging.error "process" fmt
- let info fmt = Logging.info "process" fmt
-+let debug fmt = Logging.debug "process" fmt
- 
- open Printf
- open Stdext
-@@ -25,6 +26,7 @@ exception Transaction_nested
- exception Domain_not_match
- exception Invalid_Cmd_Args
- 
-+(* This controls the do_debug fn in this module, not the debug logging-function. *)
- let allow_debug = ref false
- 
- let c_int_of_string s =
-@@ -308,23 +310,51 @@ let transaction_replay c t doms cons =
- 		false
- 	| Transaction.Full(id, oldstore, cstore) ->
- 		let tid = Connection.start_transaction c cstore in
--		let new_t = Transaction.make ~internal:true tid cstore in
-+		let replay_t = Transaction.make ~internal:true tid cstore in
- 		let con = sprintf "r(%d):%s" id (Connection.get_domstr c) in
--		let perform_exn (request, response) =
--			write_access_log ~ty:request.Packet.ty ~tid ~con ~data:request.Packet.data;
-+
-+		let perform_exn ~wlog txn (request, response) =
-+			if wlog then write_access_log ~ty:request.Packet.ty ~tid ~con ~data:request.Packet.data;
- 			let fct = function_of_type_simple_op request.Packet.ty in
--			let response' = input_handle_error ~cons ~doms ~fct ~con:c ~t:new_t ~req:request in
--			write_response_log ~ty:request.Packet.ty ~tid ~con ~response:response';
--			if not(Packet.response_equal response response') then raise Transaction_again in
-+			let response' = input_handle_error ~cons ~doms ~fct ~con:c ~t:txn ~req:request in
-+			if wlog then write_response_log ~ty:request.Packet.ty ~tid ~con ~response:response';
-+			if not(Packet.response_equal response response') then raise Transaction_again
-+		in
- 		finally
- 		(fun () ->
- 			try
- 				Logging.start_transaction ~con ~tid;
--				List.iter perform_exn (Transaction.get_operations t);
--				Logging.end_transaction ~con ~tid;
-+				List.iter (perform_exn ~wlog:true replay_t) (Transaction.get_operations t); (* May throw EAGAIN *)
- 
--				Transaction.commit ~con new_t
--			with e ->
-+				Logging.end_transaction ~con ~tid;
-+				Transaction.commit ~con replay_t
-+			with
-+			| Transaction_again -> (
-+				let victim_domstr = Connection.get_domstr c in
-+				debug "Apportioning blame for EAGAIN in txn %d, domain=%s" id victim_domstr;
-+				let punish guilty_con =
-+					debug "Blaming domain %s for conflict with domain %s txn %d"
-+						(Connection.get_domstr guilty_con) victim_domstr id;
-+					Connection.decr_conflict_credit doms guilty_con
-+				in
-+				let judge_and_sentence hist_rec = (
-+					let can_apply_on store = (
-+						let store = Store.copy store in
-+						let trial_t = Transaction.make ~internal:true Transaction.none store in
-+						try List.iter (perform_exn ~wlog:false trial_t) (Transaction.get_operations t);
-+							true
-+						with Transaction_again -> false
-+					) in
-+					if can_apply_on hist_rec.History.before
-+					&& not (can_apply_on hist_rec.History.after)
-+					then (punish hist_rec.History.con; true)
-+					else false
-+				) in
-+				let guilty_cons = History.filter_connections ~since:t.Transaction.start_count ~f:judge_and_sentence in
-+				if Hashtbl.length guilty_cons = 0 then debug "Found no culprit for conflict in %s: must be self or not in history." con;
-+				false
-+			)
-+			| e ->
- 				info "transaction_replay %d caught: %s" tid (Printexc.to_string e);
- 				false
- 			)
--- 
-2.1.4
-
diff --git a/system/xen/xsa/xsa206-4.8-0012-oxenstored-allow-self-conflicts.patch b/system/xen/xsa/xsa206-4.8-0012-oxenstored-allow-self-conflicts.patch
deleted file mode 100644
index 4a46db4c1448c..0000000000000
--- a/system/xen/xsa/xsa206-4.8-0012-oxenstored-allow-self-conflicts.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From d3a8b4ffde38f01aa7f497d07404478b6f90041c Mon Sep 17 00:00:00 2001
-From: Thomas Sanders <thomas.sanders@citrix.com>
-Date: Thu, 23 Mar 2017 19:06:54 +0000
-Subject: [PATCH 12/15] oxenstored: allow self-conflicts
-
-We already avoid inter-domain conflicts but now allow intra-domain
-conflicts.  Although there are no known practical examples of a domain
-that might perform operations that conflict with its own transactions,
-this is conceivable, so here we avoid changing those semantics
-unnecessarily.
-
-When a transaction commit fails with a conflict and we look through
-the history of commits to see which connection(s) to blame, ignore
-historical commits that were made by the same connection as the
-failing commit.
-
-Reported-by: Juergen Gross <jgross@suse.com>
-Signed-off-by: Thomas Sanders <thomas.sanders@citrix.com>
-Reviewed-by: Jonathan Davies <jonathan.davies@citrix.com>
----
- tools/ocaml/xenstored/history.ml | 3 ++-
- tools/ocaml/xenstored/process.ml | 2 +-
- 2 files changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/tools/ocaml/xenstored/history.ml b/tools/ocaml/xenstored/history.ml
-index e941e2b..4079588 100644
---- a/tools/ocaml/xenstored/history.ml
-+++ b/tools/ocaml/xenstored/history.ml
-@@ -60,11 +60,12 @@ let push (x: history_record) =
- 	| Some d -> if not (Domain.is_free_to_conflict d) then history := x :: !history
- 
- (* Find the connections from records since commit-count [since] for which [f record] returns [true] *)
--let filter_connections ~since ~f =
-+let filter_connections ~ignore ~since ~f =
- 	(* The "mem" call is an optimisation, to avoid calling f if we have picked con already. *)
- 	(* Using a hash table rather than a list is to optimise the "mem" call. *)
- 	List.fold_left (fun acc hist_rec ->
- 		if hist_rec.finish_count > since
-+		&& not (hist_rec.con == ignore)
- 		&& not (Hashtbl.mem acc hist_rec.con)
- 		&& f hist_rec
- 		then Hashtbl.replace acc hist_rec.con ();
-diff --git a/tools/ocaml/xenstored/process.ml b/tools/ocaml/xenstored/process.ml
-index 5e5a1ab..b56e3fc 100644
---- a/tools/ocaml/xenstored/process.ml
-+++ b/tools/ocaml/xenstored/process.ml
-@@ -350,7 +350,7 @@ let transaction_replay c t doms cons =
- 					then (punish hist_rec.History.con; true)
- 					else false
- 				) in
--				let guilty_cons = History.filter_connections ~since:t.Transaction.start_count ~f:judge_and_sentence in
-+				let guilty_cons = History.filter_connections ~ignore:c ~since:t.Transaction.start_count ~f:judge_and_sentence in
- 				if Hashtbl.length guilty_cons = 0 then debug "Found no culprit for conflict in %s: must be self or not in history." con;
- 				false
- 			)
--- 
-2.1.4
-
diff --git a/system/xen/xsa/xsa206-4.8-0013-oxenstored-do-not-commit-read-only-transactions.patch b/system/xen/xsa/xsa206-4.8-0013-oxenstored-do-not-commit-read-only-transactions.patch
deleted file mode 100644
index e6b066e40a342..0000000000000
--- a/system/xen/xsa/xsa206-4.8-0013-oxenstored-do-not-commit-read-only-transactions.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From f45ce51771c7e96c8ac8179c44476f8fc6168636 Mon Sep 17 00:00:00 2001
-From: Thomas Sanders <thomas.sanders@citrix.com>
-Date: Fri, 24 Mar 2017 16:16:10 +0000
-Subject: [PATCH 13/15] oxenstored: do not commit read-only transactions
-
-The packet telling us to end the transaction has always carried an
-argument telling us whether to commit.
-
-If the transaction made no modifications to the tree, now we ignore
-that argument and do not commit: it is just a waste of effort.
-
-This makes read-only transactions immune to conflicts, and means that
-we do not need to store any of their details in the history that is
-used for assigning blame for conflicts.
-
-We count a transaction as a read-only transaction only if it contains
-no operations that modified the tree.
-
-This means that (for example) a transaction that creates a new node
-then deletes it would NOT count as read-only, even though it makes no
-change overall. A more sophisticated algorithm could judge the
-transaction based on comparison of its initial and final states, but
-this would add complexity and computational cost.
-
-Reported-by: Juergen Gross <jgross@suse.com>
-Signed-off-by: Thomas Sanders <thomas.sanders@citrix.com>
-Reviewed-by: Jonathan Davies <jonathan.davies@citrix.com>
----
- tools/ocaml/xenstored/process.ml     | 1 +
- tools/ocaml/xenstored/transaction.ml | 1 +
- 2 files changed, 2 insertions(+)
-
-diff --git a/tools/ocaml/xenstored/process.ml b/tools/ocaml/xenstored/process.ml
-index b56e3fc..adfc7a4 100644
---- a/tools/ocaml/xenstored/process.ml
-+++ b/tools/ocaml/xenstored/process.ml
-@@ -393,6 +393,7 @@ let do_transaction_end con t domains cons data =
- 		| x :: _   -> raise (Invalid_argument x)
- 		| _        -> raise Invalid_Cmd_Args
- 		in
-+	let commit = commit && not (Transaction.is_read_only t) in
- 	let success =
- 		let commit = if commit then Some (fun con trans -> transaction_replay con trans domains cons) else None in
- 		History.end_transaction t con (Transaction.get_id t) commit in
-diff --git a/tools/ocaml/xenstored/transaction.ml b/tools/ocaml/xenstored/transaction.ml
-index edd1178..8f95301 100644
---- a/tools/ocaml/xenstored/transaction.ml
-+++ b/tools/ocaml/xenstored/transaction.ml
-@@ -128,6 +128,7 @@ let make ?(internal=false) id store =
- let get_store t = t.store
- let get_paths t = t.paths
- 
-+let is_read_only t = t.paths = []
- let add_wop t ty path = t.paths <- (ty, path) :: t.paths
- let add_operation ~perm t request response =
- 	if !Define.maxrequests >= 0
--- 
-2.1.4
-
diff --git a/system/xen/xsa/xsa206-4.8-0014-oxenstored-don-t-wake-to-issue-no-conflict-credit.patch b/system/xen/xsa/xsa206-4.8-0014-oxenstored-don-t-wake-to-issue-no-conflict-credit.patch
deleted file mode 100644
index 8aae2814066d9..0000000000000
--- a/system/xen/xsa/xsa206-4.8-0014-oxenstored-don-t-wake-to-issue-no-conflict-credit.patch
+++ /dev/null
@@ -1,141 +0,0 @@
-From 374c6a67e3d139a04ecde127a63ce70d24ed7b45 Mon Sep 17 00:00:00 2001
-From: Thomas Sanders <thomas.sanders@citrix.com>
-Date: Fri, 24 Mar 2017 19:55:03 +0000
-Subject: [PATCH 14/15] oxenstored: don't wake to issue no conflict-credit
-
-In the main loop, when choosing the timeout for the select function
-call, we were setting it so as to wake up to issue conflict-credit to
-any domains that could accept it. When xenstore is idle, this would
-mean waking up every 50ms (by default) to do no work. With this
-commit, we check whether any domain is below its cap, and if not then
-we set the timeout for longer (the same timeout as before the
-conflict-protection feature was added).
-
-Reported-by: Juergen Gross <jgross@suse.com>
-Signed-off-by: Thomas Sanders <thomas.sanders@citrix.com>
-Reviewed-by: Jonathan Davies <jonathan.davies@citrix.com>
----
- tools/ocaml/xenstored/domains.ml   | 51 ++++++++++++++++++++++++++++++--------
- tools/ocaml/xenstored/xenstored.ml |  5 +++-
- 2 files changed, 44 insertions(+), 12 deletions(-)
-
-diff --git a/tools/ocaml/xenstored/domains.ml b/tools/ocaml/xenstored/domains.ml
-index 99f68c7..61d1e2e 100644
---- a/tools/ocaml/xenstored/domains.ml
-+++ b/tools/ocaml/xenstored/domains.ml
-@@ -35,8 +35,9 @@ type domains = {
- 	on_first_conflict_pause: unit -> unit;
- 
- 	(* If config is set to use individual instead of aggregate conflict-rate-limiting,
--	   we use this instead of the queues. *)
--	mutable n_paused: int;
-+	   we use these counts instead of the queues. The second one includes the first. *)
-+	mutable n_paused: int;    (* Number of domains with zero or negative credit *)
-+	mutable n_penalised: int; (* Number of domains with less than maximum credit *)
- }
- 
- let init eventchn on_first_conflict_pause = {
-@@ -46,6 +47,7 @@ let init eventchn on_first_conflict_pause = {
- 	doms_with_conflict_penalty = Queue.create ();
- 	on_first_conflict_pause = on_first_conflict_pause;
- 	n_paused = 0;
-+	n_penalised = 0;
- }
- let del doms id = Hashtbl.remove doms.table id
- let exist doms id = Hashtbl.mem doms.table id
-@@ -53,6 +55,23 @@ let find doms id = Hashtbl.find doms.table id
- let number doms = Hashtbl.length doms.table
- let iter doms fct = Hashtbl.iter (fun _ b -> fct b) doms.table
- 
-+let rec is_empty_queue q =
-+	Queue.is_empty q ||
-+		if !(Queue.peek q) = None
-+		then (
-+			ignore (Queue.pop q);
-+			is_empty_queue q
-+		) else false
-+
-+let all_at_max_credit doms =
-+	if !Define.conflict_rate_limit_is_aggregate
-+	then
-+		(* Check both becuase if burst limit is 1.0 then a domain can go straight
-+		 * from max-credit to paused without getting into the penalty queue. *)
-+		is_empty_queue doms.doms_with_conflict_penalty
-+		&& is_empty_queue doms.doms_conflict_paused
-+	else doms.n_penalised = 0
-+
- (* Functions to handle queues of domains given that the domain might be deleted while in a queue. *)
- let push dom queue =
- 	Queue.push (ref (Some dom)) queue
-@@ -130,13 +149,16 @@ let decr_conflict_credit doms dom =
- 	let before = dom.Domain.conflict_credit in
- 	let after = max (-1.0) (before -. 1.0) in
- 	dom.Domain.conflict_credit <- after;
-+	let newly_penalised =
-+		before >= !Define.conflict_burst_limit
-+		&& after < !Define.conflict_burst_limit in
-+	let newly_paused = before > 0.0 && after <= 0.0 in
- 	if !Define.conflict_rate_limit_is_aggregate then (
--		if before >= !Define.conflict_burst_limit
--		&& after < !Define.conflict_burst_limit
-+		if newly_penalised
- 		&& after > 0.0
- 		then (
- 			push dom doms.doms_with_conflict_penalty
--		) else if before > 0.0 && after <= 0.0
-+		) else if newly_paused
- 		then (
- 			let first_pause = Queue.is_empty doms.doms_conflict_paused in
- 			push dom doms.doms_conflict_paused;
-@@ -144,9 +166,12 @@ let decr_conflict_credit doms dom =
- 		) else (
- 			(* The queues are correct already: no further action needed. *)
- 		)
--	) else if before > 0.0 && after <= 0.0 then (
--		doms.n_paused <- doms.n_paused + 1;
--		if doms.n_paused = 1 then doms.on_first_conflict_pause ()
-+	) else (
-+		if newly_penalised then doms.n_penalised <- doms.n_penalised + 1;
-+		if newly_paused then (
-+			doms.n_paused <- doms.n_paused + 1;
-+			if doms.n_paused = 1 then doms.on_first_conflict_pause ()
-+		)
- 	)
- 
- (* Give one point of credit to one domain, and update the queues appropriately. *)
-@@ -175,9 +200,13 @@ let incr_conflict_credit doms =
- 			let before = dom.Domain.conflict_credit in
- 			let after = min (before +. 1.0) !Define.conflict_burst_limit in
- 			dom.Domain.conflict_credit <- after;
-+
- 			if before <= 0.0 && after > 0.0
--			then doms.n_paused <- doms.n_paused - 1
-+			then doms.n_paused <- doms.n_paused - 1;
-+
-+			if before < !Define.conflict_burst_limit
-+			&& after >= !Define.conflict_burst_limit
-+			then doms.n_penalised <- doms.n_penalised - 1
- 		in
--		(* Scope for optimisation (probably tiny): avoid iteration if all domains are at max credit *)
--		iter doms inc
-+		if doms.n_penalised > 0 then iter doms inc
- 	)
-diff --git a/tools/ocaml/xenstored/xenstored.ml b/tools/ocaml/xenstored/xenstored.ml
-index d5c50fd..06387a8 100644
---- a/tools/ocaml/xenstored/xenstored.ml
-+++ b/tools/ocaml/xenstored/xenstored.ml
-@@ -437,7 +437,10 @@ let _ =
- 			peaceful_mw;
- 		let start_time = Unix.gettimeofday () in
- 		let timeout =
--			let until_next_activity = min (max 0. (!next_frequent_ops -. start_time)) period_ops_interval in
-+			let until_next_activity =
-+				if Domains.all_at_max_credit domains
-+				then period_ops_interval
-+				else min (max 0. (!next_frequent_ops -. start_time)) period_ops_interval in
- 			if peaceful_mw <> [] then 0. else until_next_activity
- 		in
- 		let inset, outset = Connections.select ~only_if:is_peaceful cons in
--- 
-2.1.4
-
diff --git a/system/xen/xsa/xsa206-4.8-0015-oxenstored-transaction-conflicts-improve-logging.patch b/system/xen/xsa/xsa206-4.8-0015-oxenstored-transaction-conflicts-improve-logging.patch
deleted file mode 100644
index bc46ed1ac5ee3..0000000000000
--- a/system/xen/xsa/xsa206-4.8-0015-oxenstored-transaction-conflicts-improve-logging.patch
+++ /dev/null
@@ -1,153 +0,0 @@
-From d7d0c021115d40177035a0626ed47681b034b584 Mon Sep 17 00:00:00 2001
-From: Thomas Sanders <thomas.sanders@citrix.com>
-Date: Mon, 27 Mar 2017 14:36:34 +0100
-Subject: [PATCH 15/15] oxenstored transaction conflicts: improve logging
-
-For information related to transaction conflicts, potentially frequent
-logging at "info" priority has been changed to "debug" priority, and
-once per two minutes there is an "info" priority summary.
-
-Additional detailed logging has been added at "debug" priority.
-
-Reported-by: Juergen Gross <jgross@suse.com>
-Signed-off-by: Thomas Sanders <thomas.sanders@citrix.com>
----
- tools/ocaml/xenstored/domain.ml      | 8 ++++++++
- tools/ocaml/xenstored/domains.ml     | 5 +++++
- tools/ocaml/xenstored/process.ml     | 6 +++++-
- tools/ocaml/xenstored/transaction.ml | 5 +++++
- tools/ocaml/xenstored/xenstored.ml   | 6 ++++++
- 5 files changed, 29 insertions(+), 1 deletion(-)
-
-diff --git a/tools/ocaml/xenstored/domain.ml b/tools/ocaml/xenstored/domain.ml
-index e677aa3..4515650 100644
---- a/tools/ocaml/xenstored/domain.ml
-+++ b/tools/ocaml/xenstored/domain.ml
-@@ -34,6 +34,7 @@ type t =
- 	mutable conflict_credit: float; (* Must be positive to perform writes; a commit
- 	                                   that later causes conflict with another
- 	                                   domain's transaction costs credit. *)
-+	mutable caused_conflicts: int64;
- }
- 
- let is_dom0 d = d.id = 0
-@@ -93,4 +94,11 @@ let make id mfn remote_port interface eventchn = {
- 	bad_client = false;
- 	io_credit = 0;
- 	conflict_credit = !Define.conflict_burst_limit;
-+	caused_conflicts = 0L;
- }
-+
-+let log_and_reset_conflict_stats logfn dom =
-+	if dom.caused_conflicts > 0L then (
-+		logfn dom.id dom.caused_conflicts;
-+		dom.caused_conflicts <- 0L
-+	)
-diff --git a/tools/ocaml/xenstored/domains.ml b/tools/ocaml/xenstored/domains.ml
-index 61d1e2e..fdae298 100644
---- a/tools/ocaml/xenstored/domains.ml
-+++ b/tools/ocaml/xenstored/domains.ml
-@@ -146,8 +146,10 @@ let create0 doms =
- 	dom
- 
- let decr_conflict_credit doms dom =
-+	dom.Domain.caused_conflicts <- Int64.add 1L dom.Domain.caused_conflicts;
- 	let before = dom.Domain.conflict_credit in
- 	let after = max (-1.0) (before -. 1.0) in
-+	debug "decr_conflict_credit dom%d %F -> %F" (Domain.get_id dom) before after;
- 	dom.Domain.conflict_credit <- after;
- 	let newly_penalised =
- 		before >= !Define.conflict_burst_limit
-@@ -178,7 +180,9 @@ let decr_conflict_credit doms dom =
- let incr_conflict_credit_from_queue doms =
- 	let process_queue q requeue_test =
- 		let d = pop q in
-+		let before = d.Domain.conflict_credit in (* just for debug-logging *)
- 		d.Domain.conflict_credit <- min (d.Domain.conflict_credit +. 1.0) !Define.conflict_burst_limit;
-+		debug "incr_conflict_credit_from_queue: dom%d: %F -> %F" (Domain.get_id d) before d.Domain.conflict_credit;
- 		if requeue_test d.Domain.conflict_credit then (
- 			push d q (* Make it queue up again for its next point of credit. *)
- 		)
-@@ -200,6 +204,7 @@ let incr_conflict_credit doms =
- 			let before = dom.Domain.conflict_credit in
- 			let after = min (before +. 1.0) !Define.conflict_burst_limit in
- 			dom.Domain.conflict_credit <- after;
-+			debug "incr_conflict_credit dom%d: %F -> %F" (Domain.get_id dom) before after;
- 
- 			if before <= 0.0 && after > 0.0
- 			then doms.n_paused <- doms.n_paused - 1;
-diff --git a/tools/ocaml/xenstored/process.ml b/tools/ocaml/xenstored/process.ml
-index adfc7a4..8a688c4 100644
---- a/tools/ocaml/xenstored/process.ml
-+++ b/tools/ocaml/xenstored/process.ml
-@@ -330,6 +330,7 @@ let transaction_replay c t doms cons =
- 				Transaction.commit ~con replay_t
- 			with
- 			| Transaction_again -> (
-+				Transaction.failed_commits := Int64.add !Transaction.failed_commits 1L;
- 				let victim_domstr = Connection.get_domstr c in
- 				debug "Apportioning blame for EAGAIN in txn %d, domain=%s" id victim_domstr;
- 				let punish guilty_con =
-@@ -351,7 +352,10 @@ let transaction_replay c t doms cons =
- 					else false
- 				) in
- 				let guilty_cons = History.filter_connections ~ignore:c ~since:t.Transaction.start_count ~f:judge_and_sentence in
--				if Hashtbl.length guilty_cons = 0 then debug "Found no culprit for conflict in %s: must be self or not in history." con;
-+				if Hashtbl.length guilty_cons = 0 then (
-+					debug "Found no culprit for conflict in %s: must be self or not in history." con;
-+					Transaction.failed_commits_no_culprit := Int64.add !Transaction.failed_commits_no_culprit 1L
-+				);
- 				false
- 			)
- 			| e ->
-diff --git a/tools/ocaml/xenstored/transaction.ml b/tools/ocaml/xenstored/transaction.ml
-index 8f95301..da4a3e3 100644
---- a/tools/ocaml/xenstored/transaction.ml
-+++ b/tools/ocaml/xenstored/transaction.ml
-@@ -90,6 +90,11 @@ type t = {
- let get_id t = match t.ty with No -> none | Full (id, _, _) -> id
- 
- let counter = ref 0L
-+let failed_commits = ref 0L
-+let failed_commits_no_culprit = ref 0L
-+let reset_conflict_stats () =
-+	failed_commits := 0L;
-+	failed_commits_no_culprit := 0L
- 
- (* Scope for optimisation: different data-structure and functions to search/filter it *)
- let short_running_txns = ref []
-diff --git a/tools/ocaml/xenstored/xenstored.ml b/tools/ocaml/xenstored/xenstored.ml
-index 06387a8..05ace4d 100644
---- a/tools/ocaml/xenstored/xenstored.ml
-+++ b/tools/ocaml/xenstored/xenstored.ml
-@@ -376,6 +376,7 @@ let _ =
- 	let last_scan_time = ref 0. in
- 
- 	let periodic_ops now =
-+		debug "periodic_ops starting";
- 		(* we garbage collect the string->int dictionary after a sizeable amount of operations,
- 		 * there's no need to be really fast even if we got loose
- 		 * objects since names are often reuse.
-@@ -395,7 +396,11 @@ let _ =
- 
- 		(* make sure we don't print general stats faster than 2 min *)
- 		if now > (!last_stat_time +. 120.) then (
-+			info "Transaction conflict statistics for last %F seconds:" (now -. !last_stat_time);
- 			last_stat_time := now;
-+			Domains.iter domains (Domain.log_and_reset_conflict_stats (info "Dom%d caused %Ld conflicts"));
-+			info "%Ld failed transactions; of these no culprit was found for %Ld" !Transaction.failed_commits !Transaction.failed_commits_no_culprit;
-+			Transaction.reset_conflict_stats ();
- 
- 			let gc = Gc.stat () in
- 			let (lanon, lanon_ops, lanon_watchs,
-@@ -415,6 +420,7 @@ let _ =
- 			     gc.Gc.free_words gc.Gc.free_blocks
- 		);
- 		let elapsed = Unix.gettimeofday () -. now in
-+		debug "periodic_ops took %F seconds." elapsed;
- 		delay_next_frequent_ops_by elapsed
- 	in
- 
--- 
-2.1.4
-
diff --git a/system/xen/xsa/xsa206-4.8-0016-oxenstored-trim-history-in-the-frequent_ops-function.patch b/system/xen/xsa/xsa206-4.8-0016-oxenstored-trim-history-in-the-frequent_ops-function.patch
deleted file mode 100644
index 40102efceb700..0000000000000
--- a/system/xen/xsa/xsa206-4.8-0016-oxenstored-trim-history-in-the-frequent_ops-function.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From 26b15d4eb7ac71fcab28a7fca664afa0549c135c Mon Sep 17 00:00:00 2001
-From: Thomas Sanders <thomas.sanders@citrix.com>
-Date: Tue, 28 Mar 2017 18:57:52 +0100
-Subject: [PATCH 16/15] oxenstored: trim history in the frequent_ops function
-
-We were trimming the history of commits only at the end of each
-transaction (regardless of how it ended).
-
-Therefore if non-transactional writes were being made but no
-transactions were being ended, the history would grow
-indefinitely. Now we trim the history at regular intervals.
-
-Signed-off-by: Thomas Sanders <thomas.sanders@citrix.com>
----
- tools/ocaml/xenstored/history.ml     |    6 +++---
- tools/ocaml/xenstored/transaction.ml |    8 ++++++--
- tools/ocaml/xenstored/xenstored.ml   |    1 +
- 3 files changed, 10 insertions(+), 5 deletions(-)
-
-diff --git a/tools/ocaml/xenstored/history.ml b/tools/ocaml/xenstored/history.ml
-index 4079588..f39565b 100644
---- a/tools/ocaml/xenstored/history.ml
-+++ b/tools/ocaml/xenstored/history.ml
-@@ -39,7 +39,8 @@ let mark_symbols () =
- (* Keep only enough commit-history to protect the running transactions that we are still tracking *)
- (* There is scope for optimisation here, replacing List.filter with something more efficient,
-  * probably on a different list-like structure. *)
--let trim () =
-+let trim ?txn () =
-+	Transaction.trim_short_running_transactions txn;
- 	history := match Transaction.oldest_short_running_transaction () with
- 	| None -> [] (* We have no open transaction, so no history is needed *)
- 	| Some (_, txn) -> (
-@@ -49,8 +50,7 @@ let trim () =
- 
- let end_transaction txn con tid commit =
- 	let success = Connection.end_transaction con tid commit in
--	Transaction.end_transaction txn;
--	trim ();
-+	trim ~txn ();
- 	success
- 
- let push (x: history_record) =
-diff --git a/tools/ocaml/xenstored/transaction.ml b/tools/ocaml/xenstored/transaction.ml
-index da4a3e3..23e7ccf 100644
---- a/tools/ocaml/xenstored/transaction.ml
-+++ b/tools/ocaml/xenstored/transaction.ml
-@@ -106,10 +106,14 @@ let oldest_short_running_transaction () =
- 		| x :: xs -> last xs
- 	in last !short_running_txns
- 
--let end_transaction txn =
-+let trim_short_running_transactions txn =
- 	let cutoff = Unix.gettimeofday () -. !Define.conflict_max_history_seconds in
-+	let keep = match txn with
-+		| None -> (function (start_time, _) -> start_time >= cutoff)
-+		| Some t -> (function (start_time, tx) -> start_time >= cutoff && tx != t)
-+	in
- 	short_running_txns := List.filter
--		(function (start_time, tx) -> start_time >= cutoff && tx != txn)
-+		keep
- 		!short_running_txns
- 
- let make ?(internal=false) id store =
-diff --git a/tools/ocaml/xenstored/xenstored.ml b/tools/ocaml/xenstored/xenstored.ml
-index 92ea99e..c45146d 100644
---- a/tools/ocaml/xenstored/xenstored.ml
-+++ b/tools/ocaml/xenstored/xenstored.ml
-@@ -280,6 +280,7 @@ let _ =
- 	 * than the periodic_ops function *)
- 	let frequent_ops () =
- 		if Unix.gettimeofday () > !next_frequent_ops then (
-+			History.trim ();
- 			Domains.incr_conflict_credit domains;
- 			advance_next_frequent_ops ()
- 		) in
--- 
-1.7.9.5
-
diff --git a/system/xen/xsa/xsa207.patch b/system/xen/xsa/xsa207.patch
deleted file mode 100644
index 6fb86fc9d584b..0000000000000
--- a/system/xen/xsa/xsa207.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From: Oleksandr Tyshchenko <olekstysh@gmail.com>
-Subject: IOMMU: always call teardown callback
-
-There is a possible scenario when (d)->need_iommu remains unset
-during guest domain execution. For example, when no devices
-were assigned to it. Taking into account that teardown callback
-is not called when (d)->need_iommu is unset we might have unreleased
-resourses after destroying domain.
-
-So, always call teardown callback to roll back actions
-that were performed in init callback.
-
-This is XSA-207.
-
-Signed-off-by: Oleksandr Tyshchenko <olekstysh@gmail.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
-Tested-by: Jan Beulich <jbeulich@suse.com>
-Tested-by: Julien Grall <julien.grall@arm.com>
-
---- a/xen/drivers/passthrough/iommu.c
-+++ b/xen/drivers/passthrough/iommu.c
-@@ -244,8 +244,7 @@ void iommu_domain_destroy(struct domain
-     if ( !iommu_enabled || !dom_iommu(d)->platform_ops )
-         return;
- 
--    if ( need_iommu(d) )
--        iommu_teardown(d);
-+    iommu_teardown(d);
- 
-     arch_iommu_domain_destroy(d);
- }
diff --git a/system/xen/xsa/xsa208-qemut.patch b/system/xen/xsa/xsa208-qemut.patch
deleted file mode 100644
index c86db0f47efc6..0000000000000
--- a/system/xen/xsa/xsa208-qemut.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From 8f63265efeb6f92e63f7e749cb26131b68b20df7 Mon Sep 17 00:00:00 2001
-From: Li Qiang <liqiang6-s@360.cn>
-Date: Mon, 13 Feb 2017 15:22:15 +0000
-Subject: [PATCH] cirrus: fix oob access issue (CVE-2017-2615)
-
-When doing bitblt copy in backward mode, we should minus the
-blt width first just like the adding in the forward mode. This
-can avoid the oob access of the front of vga's vram.
-
-This is XSA-208.
-
-upstream-commit-id: 62d4c6bd5263bb8413a06c80144fc678df6dfb64
-
-Signed-off-by: Li Qiang <liqiang6-s@360.cn>
-
-{ kraxel: with backward blits (negative pitch) addr is the topmost
-          address, so check it as-is against vram size ]
-
-[ This is CVE-2017-2615 / XSA-208  - Ian Jackson ]
-
-Cc: qemu-stable@nongnu.org
-Cc: P J P <ppandit@redhat.com>
-Cc: Laszlo Ersek <lersek@redhat.com>
-Cc: Paolo Bonzini <pbonzini@redhat.com>
-Cc: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Fixes: d3532a0db02296e687711b8cdc7791924efccea0 (CVE-2014-8106)
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-Message-id: 1485938101-26602-1-git-send-email-kraxel@redhat.com
-Reviewed-by: Laszlo Ersek <lersek@redhat.com>
-Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
-Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
----
- hw/cirrus_vga.c | 7 +++----
- 1 file changed, 3 insertions(+), 4 deletions(-)
-
-diff --git a/hw/cirrus_vga.c b/hw/cirrus_vga.c
-index e6c3893..364e22d 100644
---- a/hw/cirrus_vga.c
-+++ b/hw/cirrus_vga.c
-@@ -308,10 +308,9 @@ static bool blit_region_is_unsafe(struct CirrusVGAState *s,
- {
-     if (pitch < 0) {
-         int64_t min = addr
--            + ((int64_t)s->cirrus_blt_height-1) * pitch;
--        int32_t max = addr
--            + s->cirrus_blt_width;
--        if (min < 0 || max >= s->vram_size) {
-+            + ((int64_t)s->cirrus_blt_height - 1) * pitch
-+            - s->cirrus_blt_width;
-+        if (min < -1 || addr >= s->vram_size) {
-             return true;
-         }
-     } else {
--- 
-2.1.4
-
diff --git a/system/xen/xsa/xsa208-qemuu.patch b/system/xen/xsa/xsa208-qemuu.patch
deleted file mode 100644
index 8c8ad2d451e81..0000000000000
--- a/system/xen/xsa/xsa208-qemuu.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From 8f63265efeb6f92e63f7e749cb26131b68b20df7 Mon Sep 17 00:00:00 2001
-From: Li Qiang <liqiang6-s@360.cn>
-Date: Mon, 13 Feb 2017 15:22:15 +0000
-Subject: [PATCH] cirrus: fix oob access issue (CVE-2017-2615)
-
-When doing bitblt copy in backward mode, we should minus the
-blt width first just like the adding in the forward mode. This
-can avoid the oob access of the front of vga's vram.
-
-This is XSA-208.
-
-upstream-commit-id: 62d4c6bd5263bb8413a06c80144fc678df6dfb64
-
-Signed-off-by: Li Qiang <liqiang6-s@360.cn>
-
-{ kraxel: with backward blits (negative pitch) addr is the topmost
-          address, so check it as-is against vram size ]
-
-[ This is CVE-2017-2615 / XSA-208  - Ian Jackson ]
-
-Cc: qemu-stable@nongnu.org
-Cc: P J P <ppandit@redhat.com>
-Cc: Laszlo Ersek <lersek@redhat.com>
-Cc: Paolo Bonzini <pbonzini@redhat.com>
-Cc: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Fixes: d3532a0db02296e687711b8cdc7791924efccea0 (CVE-2014-8106)
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-Message-id: 1485938101-26602-1-git-send-email-kraxel@redhat.com
-Reviewed-by: Laszlo Ersek <lersek@redhat.com>
-Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
----
- hw/display/cirrus_vga.c | 7 +++----
- 1 file changed, 3 insertions(+), 4 deletions(-)
-
-diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
-index bdb092e..3bbe3d5 100644
---- a/hw/display/cirrus_vga.c
-+++ b/hw/display/cirrus_vga.c
-@@ -277,10 +277,9 @@ static bool blit_region_is_unsafe(struct CirrusVGAState *s,
-     }
-     if (pitch < 0) {
-         int64_t min = addr
--            + ((int64_t)s->cirrus_blt_height-1) * pitch;
--        int32_t max = addr
--            + s->cirrus_blt_width;
--        if (min < 0 || max > s->vga.vram_size) {
-+            + ((int64_t)s->cirrus_blt_height - 1) * pitch
-+            - s->cirrus_blt_width;
-+        if (min < -1 || addr >= s->vga.vram_size) {
-             return true;
-         }
-     } else {
--- 
-1.8.3.1
diff --git a/system/xen/xsa/xsa209-qemut.patch b/system/xen/xsa/xsa209-qemut.patch
deleted file mode 100644
index 444beeb2e1148..0000000000000
--- a/system/xen/xsa/xsa209-qemut.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From: Gerd Hoffmann <kraxel@redhat.com>
-Subject: [PATCH 3/3] cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo
-
-CIRRUS_BLTMODE_MEMSYSSRC blits do NOT check blit destination
-and blit width, at all.  Oops.  Fix it.
-
-Security impact: high.
-
-The missing blit destination check allows to write to host memory.
-Basically same as CVE-2014-8106 for the other blit variants.
-
-The missing blit width check allows to overflow cirrus_bltbuf,
-with the attractive target cirrus_srcptr (current cirrus_bltbuf write
-position) being located right after cirrus_bltbuf in CirrusVGAState.
-
-Due to cirrus emulation writing cirrus_bltbuf bytewise the attacker
-hasn't full control over cirrus_srcptr though, only one byte can be
-changed.  Once the first byte has been modified further writes land
-elsewhere.
-
-[ This is CVE-2017-2620 / XSA-209  - Ian Jackson ]
-
-Fixed compilation by removing extra parameter to blit_is_unsafe. -iwj
-
-Reported-by: Gerd Hoffmann <ghoffman@redhat.com>
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
----
-diff --git a/hw/cirrus_vga.c b/hw/cirrus_vga.c
-index e6c3893..45facb6 100644
---- a/hw/cirrus_vga.c
-+++ b/hw/cirrus_vga.c
-@@ -900,6 +900,10 @@ static int cirrus_bitblt_cputovideo(CirrusVGAState * s)
- {
-     int w;
- 
-+    if (blit_is_unsafe(s)) {
-+        return 0;
-+    }
-+
-     s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_MEMSYSSRC;
-     s->cirrus_srcptr = &s->cirrus_bltbuf[0];
-     s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];
-@@ -925,6 +929,10 @@ static int cirrus_bitblt_cputovideo(CirrusVGAState * s)
- 	}
-         s->cirrus_srccounter = s->cirrus_blt_srcpitch * s->cirrus_blt_height;
-     }
-+
-+    /* the blit_is_unsafe call above should catch this */
-+    assert(s->cirrus_blt_srcpitch <= CIRRUS_BLTBUFSIZE);
-+
-     s->cirrus_srcptr = s->cirrus_bltbuf;
-     s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
-     cirrus_update_memory_access(s);
diff --git a/system/xen/xsa/xsa209-qemuu-0001-display-cirrus-ignore-source-pitch-value-as-needed-i.patch b/system/xen/xsa/xsa209-qemuu-0001-display-cirrus-ignore-source-pitch-value-as-needed-i.patch
deleted file mode 100644
index 95f1ace5b1a45..0000000000000
--- a/system/xen/xsa/xsa209-qemuu-0001-display-cirrus-ignore-source-pitch-value-as-needed-i.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-From 52b7f43c8fa185ab856bcaacda7abc9a6fc07f84 Mon Sep 17 00:00:00 2001
-From: Bruce Rogers <brogers@suse.com>
-Date: Tue, 21 Feb 2017 10:54:38 -0800
-Subject: [PATCH 1/2] display: cirrus: ignore source pitch value as needed in
- blit_is_unsafe
-
-Commit 4299b90 added a check which is too broad, given that the source
-pitch value is not required to be initialized for solid fill operations.
-This patch refines the blit_is_unsafe() check to ignore source pitch in
-that case. After applying the above commit as a security patch, we
-noticed the SLES 11 SP4 guest gui failed to initialize properly.
-
-Signed-off-by: Bruce Rogers <brogers@suse.com>
-Message-id: 20170109203520.5619-1-brogers@suse.com
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
----
- hw/display/cirrus_vga.c | 11 +++++++----
- 1 file changed, 7 insertions(+), 4 deletions(-)
-
-diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
-index 7bf3707..34a6900 100644
---- a/hw/display/cirrus_vga.c
-+++ b/hw/display/cirrus_vga.c
-@@ -288,7 +288,7 @@ static bool blit_region_is_unsafe(struct CirrusVGAState *s,
-     return false;
- }
- 
--static bool blit_is_unsafe(struct CirrusVGAState *s)
-+static bool blit_is_unsafe(struct CirrusVGAState *s, bool dst_only)
- {
-     /* should be the case, see cirrus_bitblt_start */
-     assert(s->cirrus_blt_width > 0);
-@@ -302,6 +302,9 @@ static bool blit_is_unsafe(struct CirrusVGAState *s)
-                               s->cirrus_blt_dstaddr & s->cirrus_addr_mask)) {
-         return true;
-     }
-+    if (dst_only) {
-+        return false;
-+    }
-     if (blit_region_is_unsafe(s, s->cirrus_blt_srcpitch,
-                               s->cirrus_blt_srcaddr & s->cirrus_addr_mask)) {
-         return true;
-@@ -667,7 +670,7 @@ static int cirrus_bitblt_common_patterncopy(CirrusVGAState * s,
- 
-     dst = s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask);
- 
--    if (blit_is_unsafe(s))
-+    if (blit_is_unsafe(s, false))
-         return 0;
- 
-     (*s->cirrus_rop) (s, dst, src,
-@@ -685,7 +688,7 @@ static int cirrus_bitblt_solidfill(CirrusVGAState *s, int blt_rop)
- {
-     cirrus_fill_t rop_func;
- 
--    if (blit_is_unsafe(s)) {
-+    if (blit_is_unsafe(s, true)) {
-         return 0;
-     }
-     rop_func = cirrus_fill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
-@@ -784,7 +787,7 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
- 
- static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s)
- {
--    if (blit_is_unsafe(s))
-+    if (blit_is_unsafe(s, false))
-         return 0;
- 
-     cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->vga.start_addr,
--- 
-2.1.4
-
diff --git a/system/xen/xsa/xsa209-qemuu-0002-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput.patch b/system/xen/xsa/xsa209-qemuu-0002-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput.patch
deleted file mode 100644
index ed549f917da69..0000000000000
--- a/system/xen/xsa/xsa209-qemuu-0002-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 15268f91fbe75b38a851c458aef74e693d646ea5 Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Tue, 21 Feb 2017 10:54:59 -0800
-Subject: [PATCH 2/2] cirrus: add blit_is_unsafe call to
- cirrus_bitblt_cputovideo
-
-CIRRUS_BLTMODE_MEMSYSSRC blits do NOT check blit destination
-and blit width, at all.  Oops.  Fix it.
-
-Security impact: high.
-
-The missing blit destination check allows to write to host memory.
-Basically same as CVE-2014-8106 for the other blit variants.
-
-The missing blit width check allows to overflow cirrus_bltbuf,
-with the attractive target cirrus_srcptr (current cirrus_bltbuf write
-position) being located right after cirrus_bltbuf in CirrusVGAState.
-
-Due to cirrus emulation writing cirrus_bltbuf bytewise the attacker
-hasn't full control over cirrus_srcptr though, only one byte can be
-changed.  Once the first byte has been modified further writes land
-elsewhere.
-
-[ This is CVE-2017-2620 / XSA-209  - Ian Jackson ]
-
-Reported-by: Gerd Hoffmann <ghoffman@redhat.com>
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
----
- hw/display/cirrus_vga.c | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
-diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
-index 34a6900..5901250 100644
---- a/hw/display/cirrus_vga.c
-+++ b/hw/display/cirrus_vga.c
-@@ -865,6 +865,10 @@ static int cirrus_bitblt_cputovideo(CirrusVGAState * s)
- {
-     int w;
- 
-+    if (blit_is_unsafe(s, true)) {
-+        return 0;
-+    }
-+
-     s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_MEMSYSSRC;
-     s->cirrus_srcptr = &s->cirrus_bltbuf[0];
-     s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];
-@@ -890,6 +894,10 @@ static int cirrus_bitblt_cputovideo(CirrusVGAState * s)
- 	}
-         s->cirrus_srccounter = s->cirrus_blt_srcpitch * s->cirrus_blt_height;
-     }
-+
-+    /* the blit_is_unsafe call above should catch this */
-+    assert(s->cirrus_blt_srcpitch <= CIRRUS_BLTBUFSIZE);
-+
-     s->cirrus_srcptr = s->cirrus_bltbuf;
-     s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
-     cirrus_update_memory_access(s);
--- 
-2.1.4
-
diff --git a/system/xen/xsa/xsa210.patch b/system/xen/xsa/xsa210.patch
deleted file mode 100644
index 0696570c085b9..0000000000000
--- a/system/xen/xsa/xsa210.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From: Julien Grall <julien.grall@arm.com>
-Subject: arm/p2m: remove the page from p2m->pages list before freeing it
-
-The p2m code is using the page list field to link all the pages used
-for the stage-2 page tables. The page is added into the p2m->pages
-list just after the allocation but never removed from the list.
-
-The page list field is also used by the allocator, not removing may
-result a later Xen crash due to inconsistency (see [1]).
-
-This bug was introduced by the reworking of p2m code in commit 2ef3e36ec7
-"xen/arm: p2m: Introduce p2m_set_entry and __p2m_set_entry".
-
-[1] https://lists.xenproject.org/archives/html/xen-devel/2017-02/msg00524.html
-
-Reported-by: Vijaya Kumar K <Vijaya.Kumar@cavium.com>
-Signed-off-by: Julien Grall <julien.grall@arm.com>
-Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
-
---- a/xen/arch/arm/p2m.c
-+++ b/xen/arch/arm/p2m.c
-@@ -660,6 +660,7 @@ static void p2m_free_entry(struct p2m_domain *p2m,
-     unsigned int i;
-     lpae_t *table;
-     mfn_t mfn;
-+    struct page_info *pg;
- 
-     /* Nothing to do if the entry is invalid. */
-     if ( !p2m_valid(entry) )
-@@ -697,7 +698,10 @@ static void p2m_free_entry(struct p2m_domain *p2m,
-     mfn = _mfn(entry.p2m.base);
-     ASSERT(mfn_valid(mfn_x(mfn)));
- 
--    free_domheap_page(mfn_to_page(mfn_x(mfn)));
-+    pg = mfn_to_page(mfn_x(mfn));
-+
-+    page_list_del(pg, &p2m->pages);
-+    free_domheap_page(pg);
- }
- 
- static bool p2m_split_superpage(struct p2m_domain *p2m, lpae_t *entry,
diff --git a/system/xen/xsa/xsa211-qemut.patch b/system/xen/xsa/xsa211-qemut.patch
deleted file mode 100644
index 59e12fb31e253..0000000000000
--- a/system/xen/xsa/xsa211-qemut.patch
+++ /dev/null
@@ -1,225 +0,0 @@
-From 29e67cfd46b4d06ca1bb75558e227ec34a6af35f Mon Sep 17 00:00:00 2001
-From: Ian Jackson <ian.jackson@eu.citrix.com>
-Date: Thu, 9 Mar 2017 11:14:55 +0000
-Subject: [PATCH] cirrus/vnc: zap drop bitblit support from console code.
-
-From: Gerd Hoffmann <kraxel@redhat.com>
-
-There is a special code path (dpy_gfx_copy) to allow graphic emulation
-notify user interface code about bitblit operations carryed out by
-guests.  It is supported by cirrus and vnc server.  The intended purpose
-is to optimize display scrolls and just send over the scroll op instead
-of a full display update.
-
-This is rarely used these days though because modern guests simply don't
-use the cirrus blitter any more.  Any linux guest using the cirrus drm
-driver doesn't.  Any windows guest newer than winxp doesn't ship with a
-cirrus driver any more and thus uses the cirrus as simple framebuffer.
-
-So this code tends to bitrot and bugs can go unnoticed for a long time.
-See for example commit "3e10c3e vnc: fix qemu crash because of SIGSEGV"
-which fixes a bug lingering in the code for almost a year, added by
-commit "c7628bf vnc: only alloc server surface with clients connected".
-
-Also the vnc server will throttle the frame rate in case it figures the
-network can't keep up (send buffers are full).  This doesn't work with
-dpy_gfx_copy, for any copy operation sent to the vnc client we have to
-send all outstanding updates beforehand, otherwise the vnc client might
-run the client side blit on outdated data and thereby corrupt the
-display.  So this dpy_gfx_copy "optimization" might even make things
-worse on slow network links.
-
-Lets kill it once for all.
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-
-These changes (dropping dpy_copy and all its references and
-implementations) reimplemented for qemu-xen-traditional.
-
-This is XSA-211.
-
-Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
----
- console.c       |  8 --------
- console.h       | 16 ----------------
- hw/cirrus_vga.c | 15 +++++----------
- hw/vmware_vga.c |  1 +
- vnc.c           | 35 -----------------------------------
- 5 files changed, 6 insertions(+), 69 deletions(-)
-
-diff --git a/console.c b/console.c
-index d4f1ad0..e61b53b 100644
---- a/console.c
-+++ b/console.c
-@@ -1399,14 +1399,6 @@ void qemu_console_resize(DisplayState *ds, int width, int height)
-     }
- }
- 
--void qemu_console_copy(DisplayState *ds, int src_x, int src_y,
--                int dst_x, int dst_y, int w, int h)
--{
--    if (is_graphic_console()) {
--        dpy_copy(ds, src_x, src_y, dst_x, dst_y, w, h);
--    }
--}
--
- PixelFormat qemu_different_endianness_pixelformat(int bpp)
- {
-     PixelFormat pf;
-diff --git a/console.h b/console.h
-index 14b42f3..8306cc4 100644
---- a/console.h
-+++ b/console.h
-@@ -98,8 +98,6 @@ struct DisplayChangeListener {
-     void (*dpy_resize)(struct DisplayState *s);
-     void (*dpy_setdata)(struct DisplayState *s);
-     void (*dpy_refresh)(struct DisplayState *s);
--    void (*dpy_copy)(struct DisplayState *s, int src_x, int src_y,
--                     int dst_x, int dst_y, int w, int h);
-     void (*dpy_fill)(struct DisplayState *s, int x, int y,
-                      int w, int h, uint32_t c);
-     void (*dpy_text_cursor)(struct DisplayState *s, int x, int y);
-@@ -211,18 +209,6 @@ static inline void dpy_refresh(DisplayState *s)
-     }
- }
- 
--static inline void dpy_copy(struct DisplayState *s, int src_x, int src_y,
--                             int dst_x, int dst_y, int w, int h) {
--    struct DisplayChangeListener *dcl = s->listeners;
--    while (dcl != NULL) {
--        if (dcl->dpy_copy)
--            dcl->dpy_copy(s, src_x, src_y, dst_x, dst_y, w, h);
--        else /* TODO */
--            dcl->dpy_update(s, dst_x, dst_y, w, h);
--        dcl = dcl->next;
--    }
--}
--
- static inline void dpy_fill(struct DisplayState *s, int x, int y,
-                              int w, int h, uint32_t c) {
-     struct DisplayChangeListener *dcl = s->listeners;
-@@ -297,8 +283,6 @@ void text_consoles_set_display(DisplayState *ds);
- void console_select(unsigned int index);
- void console_color_init(DisplayState *ds);
- void qemu_console_resize(DisplayState *ds, int width, int height);
--void qemu_console_copy(DisplayState *ds, int src_x, int src_y,
--                int dst_x, int dst_y, int w, int h);
- 
- /* sdl.c */
- void sdl_display_init(DisplayState *ds, int full_screen, int no_frame, int opengl_enabled);
-diff --git a/hw/cirrus_vga.c b/hw/cirrus_vga.c
-index 06b4a3b..4e85b90 100644
---- a/hw/cirrus_vga.c
-+++ b/hw/cirrus_vga.c
-@@ -793,11 +793,6 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
-         }
-     }
- 
--    /* we have to flush all pending changes so that the copy
--       is generated at the appropriate moment in time */
--    if (notify)
--	vga_hw_update();
--
-     (*s->cirrus_rop) (s, s->vram_ptr +
- 		      (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
- 		      s->vram_ptr +
-@@ -806,13 +801,13 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
- 		      s->cirrus_blt_width, s->cirrus_blt_height);
- 
-     if (notify)
--	qemu_console_copy(s->ds,
--			  sx, sy, dx, dy,
--			  s->cirrus_blt_width / depth,
--			  s->cirrus_blt_height);
-+	dpy_update(s->ds,
-+                   dx, dy,
-+                   s->cirrus_blt_width / depth,
-+                   s->cirrus_blt_height);
- 
-     /* we don't have to notify the display that this portion has
--       changed since qemu_console_copy implies this */
-+       changed since dpy_update implies this */
- 
-     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
- 				s->cirrus_blt_dstpitch, s->cirrus_blt_width,
-diff --git a/hw/vmware_vga.c b/hw/vmware_vga.c
-index d1cba28..c38e43c 100644
---- a/hw/vmware_vga.c
-+++ b/hw/vmware_vga.c
-@@ -383,6 +383,7 @@ static inline void vmsvga_copy_rect(struct vmsvga_state_s *s,
- 
- # ifdef DIRECT_VRAM
-     if (s->ds->dpy_copy)
-+#  error This configuration is not supported.  See XSA-211.
-         qemu_console_copy(s->ds, x0, y0, x1, y1, w, h);
-     else
- # endif
-diff --git a/vnc.c b/vnc.c
-index 61d1555..0e61197 100644
---- a/vnc.c
-+++ b/vnc.c
-@@ -572,36 +572,6 @@ static void send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
- 	    send_framebuffer_update_raw(vs, x, y, w, h);
- }
- 
--static void vnc_copy(DisplayState *ds, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
--{
--    VncState *vs = ds->opaque;
--    int updating_client = 1;
--
--    if (!vs->update_requested ||
--        src_x < vs->visible_x || src_y < vs->visible_y ||
--	dst_x < vs->visible_x || dst_y < vs->visible_y ||
--	(src_x + w) > (vs->visible_x + vs->visible_w) ||
--	(src_y + h) > (vs->visible_y + vs->visible_h) ||
--	(dst_x + w) > (vs->visible_x + vs->visible_w) ||
--	(dst_y + h) > (vs->visible_y + vs->visible_h))
--	updating_client = 0;
--
--    if (updating_client)
--        _vnc_update_client(vs);
--
--    if (updating_client && vs->csock != -1 && !vs->has_update) {
--	vnc_write_u8(vs, 0);  /* msg id */
--	vnc_write_u8(vs, 0);
--	vnc_write_u16(vs, 1); /* number of rects */
--	vnc_framebuffer_update(vs, dst_x, dst_y, w, h, 1);
--	vnc_write_u16(vs, src_x);
--	vnc_write_u16(vs, src_y);
--	vnc_flush(vs);
--        vs->update_requested--;
--    } else
--	framebuffer_set_updated(vs, dst_x, dst_y, w, h);
--}
--
- static int find_update_height(VncState *vs, int y, int maxy, int last_x, int x)
- {
-     int h;
-@@ -1543,16 +1513,12 @@ static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
-     vs->has_pointer_type_change = 0;
-     vs->has_WMVi = 0;
-     vs->absolute = -1;
--    dcl->dpy_copy = NULL;
- 
-     for (i = n_encodings - 1; i >= 0; i--) {
- 	switch (encodings[i]) {
- 	case 0: /* Raw */
- 	    vs->has_hextile = 0;
- 	    break;
--	case 1: /* CopyRect */
--	    dcl->dpy_copy = vnc_copy;
--	    break;
- 	case 5: /* Hextile */
- 	    vs->has_hextile = 1;
- 	    break;
-@@ -2459,7 +2425,6 @@ static void vnc_listen_read(void *opaque)
- 	vs->has_resize = 0;
- 	vs->has_hextile = 0;
-         vs->update_requested = 0;
--	dcl->dpy_copy = NULL;
- 	vnc_timer_init(vs);
-     }
- }
--- 
-2.1.4
-
diff --git a/system/xen/xsa/xsa211-qemuu-4.8.patch b/system/xen/xsa/xsa211-qemuu-4.8.patch
deleted file mode 100644
index aabdd11ae372d..0000000000000
--- a/system/xen/xsa/xsa211-qemuu-4.8.patch
+++ /dev/null
@@ -1,264 +0,0 @@
-From 7563ddb0bd67e7e54568e017cb7d4f7f556587fc Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Tue, 14 Feb 2017 19:09:59 +0100
-Subject: [PATCH] cirrus/vnc: zap bitblit support from console code.
-
-There is a special code path (dpy_gfx_copy) to allow graphic emulation
-notify user interface code about bitblit operations carryed out by
-guests.  It is supported by cirrus and vnc server.  The intended purpose
-is to optimize display scrolls and just send over the scroll op instead
-of a full display update.
-
-This is rarely used these days though because modern guests simply don't
-use the cirrus blitter any more.  Any linux guest using the cirrus drm
-driver doesn't.  Any windows guest newer than winxp doesn't ship with a
-cirrus driver any more and thus uses the cirrus as simple framebuffer.
-
-So this code tends to bitrot and bugs can go unnoticed for a long time.
-See for example commit "3e10c3e vnc: fix qemu crash because of SIGSEGV"
-which fixes a bug lingering in the code for almost a year, added by
-commit "c7628bf vnc: only alloc server surface with clients connected".
-
-Also the vnc server will throttle the frame rate in case it figures the
-network can't keep up (send buffers are full).  This doesn't work with
-dpy_gfx_copy, for any copy operation sent to the vnc client we have to
-send all outstanding updates beforehand, otherwise the vnc client might
-run the client side blit on outdated data and thereby corrupt the
-display.  So this dpy_gfx_copy "optimization" might even make things
-worse on slow network links.
-
-Lets kill it once for all.
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
----
- hw/display/cirrus_vga.c | 12 ++-----
- include/ui/console.h    |  7 ----
- ui/console.c            | 28 ---------------
- ui/vnc.c                | 96 -------------------------------------------------
- 4 files changed, 3 insertions(+), 140 deletions(-)
-
-diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
-index 9a4e90a..2966125 100644
---- a/hw/display/cirrus_vga.c
-+++ b/hw/display/cirrus_vga.c
-@@ -760,11 +760,6 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
-         }
-     }
- 
--    /* we have to flush all pending changes so that the copy
--       is generated at the appropriate moment in time */
--    if (notify)
--        graphic_hw_update(s->vga.con);
--
-     (*s->cirrus_rop) (s, s->vga.vram_ptr +
- 		      (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
- 		      s->vga.vram_ptr +
-@@ -773,10 +768,9 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
- 		      s->cirrus_blt_width, s->cirrus_blt_height);
- 
-     if (notify) {
--        qemu_console_copy(s->vga.con,
--			  sx, sy, dx, dy,
--			  s->cirrus_blt_width / depth,
--			  s->cirrus_blt_height);
-+        dpy_gfx_update(s->vga.con, dx, dy,
-+                       s->cirrus_blt_width / depth,
-+                       s->cirrus_blt_height);
-     }
- 
-     /* we don't have to notify the display that this portion has
-diff --git a/include/ui/console.h b/include/ui/console.h
-index 2703a3a..67927ed 100644
---- a/include/ui/console.h
-+++ b/include/ui/console.h
-@@ -189,9 +189,6 @@ typedef struct DisplayChangeListenerOps {
-                            int x, int y, int w, int h);
-     void (*dpy_gfx_switch)(DisplayChangeListener *dcl,
-                            struct DisplaySurface *new_surface);
--    void (*dpy_gfx_copy)(DisplayChangeListener *dcl,
--                         int src_x, int src_y,
--                         int dst_x, int dst_y, int w, int h);
-     bool (*dpy_gfx_check_format)(DisplayChangeListener *dcl,
-                                  pixman_format_code_t format);
- 
-@@ -273,8 +270,6 @@ int dpy_set_ui_info(QemuConsole *con, QemuUIInfo *info);
- void dpy_gfx_update(QemuConsole *con, int x, int y, int w, int h);
- void dpy_gfx_replace_surface(QemuConsole *con,
-                              DisplaySurface *surface);
--void dpy_gfx_copy(QemuConsole *con, int src_x, int src_y,
--                  int dst_x, int dst_y, int w, int h);
- void dpy_text_cursor(QemuConsole *con, int x, int y);
- void dpy_text_update(QemuConsole *con, int x, int y, int w, int h);
- void dpy_text_resize(QemuConsole *con, int w, int h);
-@@ -398,8 +393,6 @@ void text_consoles_set_display(DisplayState *ds);
- void console_select(unsigned int index);
- void console_color_init(DisplayState *ds);
- void qemu_console_resize(QemuConsole *con, int width, int height);
--void qemu_console_copy(QemuConsole *con, int src_x, int src_y,
--                       int dst_x, int dst_y, int w, int h);
- DisplaySurface *qemu_console_surface(QemuConsole *con);
- 
- /* console-gl.c */
-diff --git a/ui/console.c b/ui/console.c
-index c24bfe4..ece0c04 100644
---- a/ui/console.c
-+++ b/ui/console.c
-@@ -1558,27 +1558,6 @@ static void dpy_refresh(DisplayState *s)
-     }
- }
- 
--void dpy_gfx_copy(QemuConsole *con, int src_x, int src_y,
--                  int dst_x, int dst_y, int w, int h)
--{
--    DisplayState *s = con->ds;
--    DisplayChangeListener *dcl;
--
--    if (!qemu_console_is_visible(con)) {
--        return;
--    }
--    QLIST_FOREACH(dcl, &s->listeners, next) {
--        if (con != (dcl->con ? dcl->con : active_console)) {
--            continue;
--        }
--        if (dcl->ops->dpy_gfx_copy) {
--            dcl->ops->dpy_gfx_copy(dcl, src_x, src_y, dst_x, dst_y, w, h);
--        } else { /* TODO */
--            dcl->ops->dpy_gfx_update(dcl, dst_x, dst_y, w, h);
--        }
--    }
--}
--
- void dpy_text_cursor(QemuConsole *con, int x, int y)
- {
-     DisplayState *s = con->ds;
-@@ -2104,13 +2083,6 @@ void qemu_console_resize(QemuConsole *s, int width, int height)
-     dpy_gfx_replace_surface(s, surface);
- }
- 
--void qemu_console_copy(QemuConsole *con, int src_x, int src_y,
--                       int dst_x, int dst_y, int w, int h)
--{
--    assert(con->console_type == GRAPHIC_CONSOLE);
--    dpy_gfx_copy(con, src_x, src_y, dst_x, dst_y, w, h);
--}
--
- DisplaySurface *qemu_console_surface(QemuConsole *console)
- {
-     return console->surface;
-diff --git a/ui/vnc.c b/ui/vnc.c
-index d1087c9..b45bb2c 100644
---- a/ui/vnc.c
-+++ b/ui/vnc.c
-@@ -872,101 +872,6 @@ int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
-     return n;
- }
- 
--static void vnc_copy(VncState *vs, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
--{
--    /* send bitblit op to the vnc client */
--    vnc_lock_output(vs);
--    vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
--    vnc_write_u8(vs, 0);
--    vnc_write_u16(vs, 1); /* number of rects */
--    vnc_framebuffer_update(vs, dst_x, dst_y, w, h, VNC_ENCODING_COPYRECT);
--    vnc_write_u16(vs, src_x);
--    vnc_write_u16(vs, src_y);
--    vnc_unlock_output(vs);
--    vnc_flush(vs);
--}
--
--static void vnc_dpy_copy(DisplayChangeListener *dcl,
--                         int src_x, int src_y,
--                         int dst_x, int dst_y, int w, int h)
--{
--    VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
--    VncState *vs, *vn;
--    uint8_t *src_row;
--    uint8_t *dst_row;
--    int i, x, y, pitch, inc, w_lim, s;
--    int cmp_bytes;
--
--    if (!vd->server) {
--        /* no client connected */
--        return;
--    }
--
--    vnc_refresh_server_surface(vd);
--    QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
--        if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
--            vs->force_update = 1;
--            vnc_update_client(vs, 1, true);
--            /* vs might be free()ed here */
--        }
--    }
--
--    /* do bitblit op on the local surface too */
--    pitch = vnc_server_fb_stride(vd);
--    src_row = vnc_server_fb_ptr(vd, src_x, src_y);
--    dst_row = vnc_server_fb_ptr(vd, dst_x, dst_y);
--    y = dst_y;
--    inc = 1;
--    if (dst_y > src_y) {
--        /* copy backwards */
--        src_row += pitch * (h-1);
--        dst_row += pitch * (h-1);
--        pitch = -pitch;
--        y = dst_y + h - 1;
--        inc = -1;
--    }
--    w_lim = w - (VNC_DIRTY_PIXELS_PER_BIT - (dst_x % VNC_DIRTY_PIXELS_PER_BIT));
--    if (w_lim < 0) {
--        w_lim = w;
--    } else {
--        w_lim = w - (w_lim % VNC_DIRTY_PIXELS_PER_BIT);
--    }
--    for (i = 0; i < h; i++) {
--        for (x = 0; x <= w_lim;
--                x += s, src_row += cmp_bytes, dst_row += cmp_bytes) {
--            if (x == w_lim) {
--                if ((s = w - w_lim) == 0)
--                    break;
--            } else if (!x) {
--                s = (VNC_DIRTY_PIXELS_PER_BIT -
--                    (dst_x % VNC_DIRTY_PIXELS_PER_BIT));
--                s = MIN(s, w_lim);
--            } else {
--                s = VNC_DIRTY_PIXELS_PER_BIT;
--            }
--            cmp_bytes = s * VNC_SERVER_FB_BYTES;
--            if (memcmp(src_row, dst_row, cmp_bytes) == 0)
--                continue;
--            memmove(dst_row, src_row, cmp_bytes);
--            QTAILQ_FOREACH(vs, &vd->clients, next) {
--                if (!vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
--                    set_bit(((x + dst_x) / VNC_DIRTY_PIXELS_PER_BIT),
--                            vs->dirty[y]);
--                }
--            }
--        }
--        src_row += pitch - w * VNC_SERVER_FB_BYTES;
--        dst_row += pitch - w * VNC_SERVER_FB_BYTES;
--        y += inc;
--    }
--
--    QTAILQ_FOREACH(vs, &vd->clients, next) {
--        if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
--            vnc_copy(vs, src_x, src_y, dst_x, dst_y, w, h);
--        }
--    }
--}
--
- static void vnc_mouse_set(DisplayChangeListener *dcl,
-                           int x, int y, int visible)
- {
-@@ -3119,7 +3024,6 @@ static gboolean vnc_listen_io(QIOChannel *ioc,
- static const DisplayChangeListenerOps dcl_ops = {
-     .dpy_name             = "vnc",
-     .dpy_refresh          = vnc_refresh,
--    .dpy_gfx_copy         = vnc_dpy_copy,
-     .dpy_gfx_update       = vnc_dpy_update,
-     .dpy_gfx_switch       = vnc_dpy_switch,
-     .dpy_gfx_check_format = qemu_pixman_check_format,
--- 
-2.1.4
-
diff --git a/system/xen/xsa/xsa212.patch b/system/xen/xsa/xsa212.patch
deleted file mode 100644
index 2c435c413644a..0000000000000
--- a/system/xen/xsa/xsa212.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-memory: properly check guest memory ranges in XENMEM_exchange handling
-
-The use of guest_handle_okay() here (as introduced by the XSA-29 fix)
-is insufficient here, guest_handle_subrange_okay() needs to be used
-instead.
-
-Note that the uses are okay in
-- XENMEM_add_to_physmap_batch handling due to the size field being only
-  16 bits wide,
-- livepatch_list() due to the limit of 1024 enforced on the
-  number-of-entries input (leaving aside the fact that this can be
-  called by a privileged domain only anyway),
-- compat mode handling due to counts there being limited to 32 bits,
-- everywhere else due to guest arrays being accessed sequentially from
-  index zero.
-
-This is XSA-212.
-
-Reported-by: Jann Horn <jannh@google.com>
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
-
---- a/xen/common/memory.c
-+++ b/xen/common/memory.c
-@@ -436,8 +436,8 @@ static long memory_exchange(XEN_GUEST_HA
-         goto fail_early;
-     }
- 
--    if ( !guest_handle_okay(exch.in.extent_start, exch.in.nr_extents) ||
--         !guest_handle_okay(exch.out.extent_start, exch.out.nr_extents) )
-+    if ( !guest_handle_subrange_okay(exch.in.extent_start, exch.nr_exchanged,
-+                                     exch.in.nr_extents - 1) )
-     {
-         rc = -EFAULT;
-         goto fail_early;
-@@ -447,11 +447,27 @@ static long memory_exchange(XEN_GUEST_HA
-     {
-         in_chunk_order  = exch.out.extent_order - exch.in.extent_order;
-         out_chunk_order = 0;
-+
-+        if ( !guest_handle_subrange_okay(exch.out.extent_start,
-+                                         exch.nr_exchanged >> in_chunk_order,
-+                                         exch.out.nr_extents - 1) )
-+        {
-+            rc = -EFAULT;
-+            goto fail_early;
-+        }
-     }
-     else
-     {
-         in_chunk_order  = 0;
-         out_chunk_order = exch.in.extent_order - exch.out.extent_order;
-+
-+        if ( !guest_handle_subrange_okay(exch.out.extent_start,
-+                                         exch.nr_exchanged << out_chunk_order,
-+                                         exch.out.nr_extents - 1) )
-+        {
-+            rc = -EFAULT;
-+            goto fail_early;
-+        }
-     }
- 
-     d = rcu_lock_domain_by_any_id(exch.in.domid);
---- a/xen/include/asm-x86/x86_64/uaccess.h
-+++ b/xen/include/asm-x86/x86_64/uaccess.h
-@@ -29,8 +29,9 @@ extern void *xlat_malloc(unsigned long *
- /*
-  * Valid if in +ve half of 48-bit address space, or above Xen-reserved area.
-  * This is also valid for range checks (addr, addr+size). As long as the
-- * start address is outside the Xen-reserved area then we will access a
-- * non-canonical address (and thus fault) before ever reaching VIRT_START.
-+ * start address is outside the Xen-reserved area, sequential accesses
-+ * (starting at addr) will hit a non-canonical address (and thus fault)
-+ * before ever reaching VIRT_START.
-  */
- #define __addr_ok(addr) \
-     (((unsigned long)(addr) < (1UL<<47)) || \
-@@ -40,7 +41,8 @@ extern void *xlat_malloc(unsigned long *
-     (__addr_ok(addr) || is_compat_arg_xlat_range(addr, size))
- 
- #define array_access_ok(addr, count, size) \
--    (access_ok(addr, (count)*(size)))
-+    (likely(((count) ?: 0UL) < (~0UL / (size))) && \
-+     access_ok(addr, (count) * (size)))
- 
- #define __compat_addr_ok(d, addr) \
-     ((unsigned long)(addr) < HYPERVISOR_COMPAT_VIRT_START(d))