diff -uNr xen-unstable.hg-pristine/tools/ioemu/target-i386-dm/helper2.c xen-unstable.hg-p/tools/ioemu/target-i386-dm/helper2.c
--- xen-unstable.hg-pristine/tools/ioemu/target-i386-dm/helper2.c	2007-01-19 08:50:51.000000000 +0100
+++ xen-unstable.hg-p/tools/ioemu/target-i386-dm/helper2.c	2007-03-05 13:47:11.000000000 +0100
@@ -439,6 +439,18 @@
     req->data = tmp1;
 }
 
+void cpu_ioreq_xchg(CPUState *env, ioreq_t *req)
+{
+    unsigned long tmp1;
+
+    if (req->data_is_ptr != 0)
+        hw_error("expected scalar value");
+
+    read_physical(req->addr, req->size, &tmp1);
+    write_physical(req->addr, req->size, &req->data);
+    req->data = tmp1;
+}
+
 void __handle_ioreq(CPUState *env, ioreq_t *req)
 {
     if (!req->data_is_ptr && req->dir == IOREQ_WRITE && req->size != 4)
@@ -463,6 +475,9 @@
     case IOREQ_TYPE_XOR:
         cpu_ioreq_xor(env, req);
         break;
+    case IOREQ_TYPE_XCHG:
+        cpu_ioreq_xchg(env, req);
+        break;
     default:
         hw_error("Invalid ioreq type 0x%x\n", req->type);
     }