diff --git a/patch-x86-correct-ordering-of-operations-during-S3-resume.patch b/patch-x86-correct-ordering-of-operations-during-S3-resume.patch
new file mode 100644
index 00000000..9ec6a90d
--- /dev/null
+++ b/patch-x86-correct-ordering-of-operations-during-S3-resume.patch
@@ -0,0 +1,67 @@
+From a30068b333ede865e2c0cba8fabbd7fc89f1e5ce Mon Sep 17 00:00:00 2001
+From: Jan Beulich <JBeulich@suse.com>
+Date: Wed, 11 Apr 2018 21:08:45 +0200
+Subject: [PATCH v2 2/2] x86: correct ordering of operations during S3 resume
+
+Microcode loading needs to happen before re-enabling interrupts, in case
+only updated microcode allows the use of e.g. the SPEC_{CTRL,CMD} MSRs.
+Otoh it doesn't need to happen at all when we didn't suspend in the
+first place. It needs to happen before spin_debug_enable() though, as it
+acquires a lock and hence would otherwise make
+common/spinlock.c:check_lock() unhappy. As micrcode loading can be
+pretty verbose, also make sure it only runs after console_end_sync().
+
+cpufreq_add_cpu() doesn't need calling on the only "goto enable_cpu"
+path, which sits ahead of cpufreq_del_cpu().
+
+Reported-by: Simon Gaiser <simon@invisiblethingslab.com>
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+[Simon: Panic if microcode restore fails]
+Signed-off-by: Simon Gaiser <simon@invisiblethingslab.com>
+---
+
+Sorry didn't want to rewrite the author. No other change in v2.
+
+ xen/arch/x86/acpi/power.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/xen/arch/x86/acpi/power.c b/xen/arch/x86/acpi/power.c
+index 1e4e5680a7..0e00c198db 100644
+--- a/xen/arch/x86/acpi/power.c
++++ b/xen/arch/x86/acpi/power.c
+@@ -203,6 +203,7 @@ static int enter_state(u32 state)
+         printk(XENLOG_ERR "Some devices failed to power down.");
+         system_state = SYS_STATE_resume;
+         device_power_up(error);
++        console_end_sync();
+         error = -EIO;
+         goto done;
+     }
+@@ -243,17 +244,21 @@ static int enter_state(u32 state)
+     if ( (state == ACPI_STATE_S3) && error )
+         tboot_s3_error(error);
+ 
++    console_end_sync();
++
++    error = microcode_resume_cpu(0);
++    if (error && error != -ENOENT)
++        panic("Could not restore microcode on boot cpu (%d)", error);
++
+  done:
+     spin_debug_enable();
+     local_irq_restore(flags);
+-    console_end_sync();
+     acpi_sleep_post(state);
+     if ( hvm_cpu_up() )
+         BUG();
++    cpufreq_add_cpu(0);
+ 
+  enable_cpu:
+-    cpufreq_add_cpu(0);
+-    microcode_resume_cpu(0);
+     rcu_barrier();
+     mtrr_aps_sync_begin();
+     enable_nonboot_cpus();
+-- 
+2.16.2
+
diff --git a/patch-x86-microcode-Indicate-not-found-in-rc-of-microcode_.patch b/patch-x86-microcode-Indicate-not-found-in-rc-of-microcode_.patch
new file mode 100644
index 00000000..7f4a1900
--- /dev/null
+++ b/patch-x86-microcode-Indicate-not-found-in-rc-of-microcode_.patch
@@ -0,0 +1,31 @@
+From af11a3a2c0e764de2d551362d02109428ab79ca8 Mon Sep 17 00:00:00 2001
+From: Simon Gaiser <simon@invisiblethingslab.com>
+Date: Wed, 11 Apr 2018 22:02:08 +0200
+Subject: [PATCH v2 1/2] x86/microcode: Indicate "not found" in rc of
+ microcode_resume_cpu()
+
+Make it possible to distinguish between a failure to load a microcode
+update and a failure to find any matching microcode update by returning
+-ENOENT (instead of -EIO) in the later case.
+
+Signed-off-by: Simon Gaiser <simon@invisiblethingslab.com>
+---
+ xen/arch/x86/microcode.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/xen/arch/x86/microcode.c b/xen/arch/x86/microcode.c
+index 77c1efc97f..e9fafb1d14 100644
+--- a/xen/arch/x86/microcode.c
++++ b/xen/arch/x86/microcode.c
+@@ -248,7 +248,7 @@ int microcode_resume_cpu(unsigned int cpu)
+     __microcode_fini_cpu(cpu);
+     uci->cpu_sig = nsig;
+ 
+-    err = -EIO;
++    err = -ENOENT;
+     for_each_online_cpu ( cpu2 )
+     {
+         uci = &per_cpu(ucode_cpu_info, cpu2);
+-- 
+2.16.2
+
diff --git a/xen.spec.in b/xen.spec.in
index ec3299e3..a22cd335 100644
--- a/xen.spec.in
+++ b/xen.spec.in
@@ -176,6 +176,8 @@ Patch542: patch-866dedab-x86-PV-also-cover-Dom0-in-SPEC_CTRL-PRED_CMD-emulati.pa
 # Backport improved early microcode loading to allow usage of BTI related
 # microcode updates without updating the BIOS.
 Patch543: patch-f97838bb-x86-Move-microcode-loading-earlier.patch
+Patch544: patch-x86-microcode-Indicate-not-found-in-rc-of-microcode_.patch
+Patch545: patch-x86-correct-ordering-of-operations-during-S3-resume.patch
 
 # Upstreamable patches
 Patch601: patch-xen-libxl-error-write-perm.patch