[libvirt-users] CPU flag masking not working with xen

Hi, Trying to get CPU masking working with xen and it's just stubbornly refusing to work. Spawning a VM with xm directly works fine, but every time I try with libvirt it just ends up having all the flags of the host. Looking at the xen logs, libvirt doesn't appear to be passing any cpu options to xen at all. Running centos 6.5 with the xen 4 packages (4.2.4), but I've also tried building the latest libvirt 1.2.8-r1 from source and still the same thing. I am seeing these errors out of libvirt, but not sure if they're related: 2014-08-28 17:39:02.815+0000: 22674: error : xenHypervisorDoV2Sys:1013 : Unable to issue hypervisor ioctl 3166208: Permission denied If I spawn a VM directly with XM and use libvirt to dumpxml it, or try the domxml-from-native then libvirt just drops all the CPU info. I'm pretty sure I've got the xml correct though as it passes validation with virt-xml-validate: http://pastebin.com/aBUQckhc I've tried everything I can think of and just not getting anywhere at all, can anyone point me into the right direction for what the issue might be? Thanks! - Nathan