update to xen 4.20.4

includes security fixes

.gitignore

@@ -6,5 +6,5 @@ lwip-1.3.0.tar.gz
 pciutils-2.2.9.tar.bz2
 zlib-1.2.3.tar.gz
 polarssl-1.1.4-gpl.tgz
-/xen-4.20.1.tar.gz
 /mini-os-4.20.0.tar.xz
+/xen-4.20.4.tar.gz

sources

@@ -4,5 +4,5 @@ SHA512 (newlib-1.16.0.tar.gz) = 40eb96bbc6736a16b6399e0cdb73e853d0d90b685c967e77
 SHA512 (zlib-1.2.3.tar.gz) = 021b958fcd0d346c4ba761bcf0cc40f3522de6186cf5a0a6ea34a70504ce9622b1c2626fce40675bc8282cf5f5ade18473656abc38050f72f5d6480507a2106e
 SHA512 (polarssl-1.1.4-gpl.tgz) = 88da614e4d3f4409c4fd3bb3e44c7587ba051e3fed4e33d526069a67e8180212e1ea22da984656f50e290049f60ddca65383e5983c0f8884f648d71f698303ad
 SHA512 (pciutils-2.2.9.tar.bz2) = 2b3d98d027e46d8c08037366dde6f0781ca03c610ef2b380984639e4ef39899ed8d8b8e4cd9c9dc54df101279b95879bd66bfd4d04ad07fef41e847ea7ae32b5
-SHA512 (xen-4.20.1.tar.gz) = e4502ddaeb66de4c30d59e90af198586683c28b56bf0eb03ca5508f663fef5e6582c009861ff5b66b7f0df6e5f6bc12337eff0ec775d72e7cb189fd2079dbd9d
 SHA512 (mini-os-4.20.0.tar.xz) = 52d5d0985e1b4c26b761c94a3f7ca543bc388a96f69710524ebf34dd5b01d8f774fd5a3f6a50739c8b7c7edfdf07b594f5d44de8f389ea4138a62f9c5884c4e6
+SHA512 (xen-4.20.4.tar.gz) = a4d92677f8dff486ae094bf9d74d15606217945012482fd43323c9b86891169be367b80aef2d711d686df478046649fa003ebc038b82ecaffdeff505195179af

xen.git-7cda6b65098f790e6573f555c5ef170d3f373c6e.patch

@@ -1,40 +0,0 @@
-From 7cda6b65098f790e6573f555c5ef170d3f373c6e Mon Sep 17 00:00:00 2001
-From: =?utf8?q?Marek=20Marczykowski-G=C3=B3recki?=
- <marmarek@invisiblethingslab.com>
-Date: Mon, 4 Aug 2025 15:22:13 +0200
-Subject: [PATCH] tools/xl: don't crash on NULL command line
-MIME-Version: 1.0
-Content-Type: text/plain; charset=utf8
-Content-Transfer-Encoding: 8bit
-
-When running xl in a domU, it doesn't have access to the Xen command
-line. Before the non-truncating xc_xenver_cmdline(), it was always set
-with strdup, possibly of an empty string. Now it's NULL. Treat it the
-same as empty cmdline, as it was before. Autoballoon isn't relevant for
-xl devd in a domU anyway.
-
-Fixes: 75f91607621c ("tools: Introduce a non-truncating xc_xenver_cmdline()")
-Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
-Acked-by: Anthony PERARD <anthony.perard@vates.tech>
-master commit: a4988c4177be81f225af1516e1bbb9ec14f76388
-master date: 2025-07-31 14:44:02 +0200
----
- tools/xl/xl.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/tools/xl/xl.c b/tools/xl/xl.c
-index ec72ca60c3..b3abc91b60 100644
---- a/tools/xl/xl.c
-+++ b/tools/xl/xl.c
-@@ -79,7 +79,7 @@ static int auto_autoballoon(void)
-     int ret;
- 
-     info = libxl_get_version_info(ctx);
--    if (!info)
-+    if (!info || !info->commandline)
-         return 1; /* default to on */
- 
- #define SIZE_PATTERN "-?[0-9]+[bBkKmMgGtT]?"
--- 
-2.39.5
-

xen.git-c403cf9e742a20e0aadbe04c1ab0ce9621184037.patch

@@ -0,0 +1,88 @@
+From c403cf9e742a20e0aadbe04c1ab0ce9621184037 Mon Sep 17 00:00:00 2001
+From: Andrew Cooper <andrew.cooper3@citrix.com>
+Date: Fri, 10 Apr 2026 21:55:46 +0100
+Subject: [PATCH] x86/amd: Mitigate AMD-SN-7053 / FP-DSS
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf8
+Content-Transfer-Encoding: 8bit
+
+This is XSA-488 / CVE-2025-54505
+
+Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
+(cherry picked from commit 99912d346009fda1e7fb1510c9501fbab17e92a0)
+---
+ xen/arch/x86/cpu/amd.c               | 37 ++++++++++++++++++++++++++++
+ xen/arch/x86/include/asm/msr-index.h |  1 +
+ 2 files changed, 38 insertions(+)
+
+diff --git a/xen/arch/x86/cpu/amd.c b/xen/arch/x86/cpu/amd.c
+index d5069a7ec1..43883e04db 100644
+--- a/xen/arch/x86/cpu/amd.c
++++ b/xen/arch/x86/cpu/amd.c
+@@ -982,6 +982,42 @@ void amd_init_de_cfg(const struct cpuinfo_x86 *c)
+     wrmsrl(MSR_AMD64_DE_CFG, val | new);
+ }
+ 
++static void amd_init_fp_cfg(const struct cpuinfo_x86 *c)
++{
++    uint64_t val, new = 0;
++
++    /* If virtualised, we won't have mutable access even if we can read it. */
++    if ( cpu_has_hypervisor )
++        return;
++
++    /*
++     * On Zen1, mitigate SB-7053 / FP-DSS Floating Point Divider State
++     * Sampling by setting bit 9 as instructed.
++     */
++    if ( c->x86 == 0x17 && is_zen1_uarch() )
++        new |= 1 << 9;
++
++    /*
++     * Avoid reading FP_CFG if we don't intend to change anything.  The
++     * register doesn't exist on all families.
++     */
++    if ( !new )
++        return;
++
++    rdmsrl(MSR_AMD64_FP_CFG, val);
++
++    if ( (val & new) == new )
++        return;
++
++    /*
++     * FP_CFG is a Core-scoped MSR, and this write is racy.  However, both
++     * threads calculate the new value from state which expected to be
++     * consistent across CPUs and unrelated to the old value, so the result
++     * should be consistent.
++     */
++    wrmsrl(MSR_AMD64_FP_CFG, val | new);
++}
++
+ void __init amd_init_lfence_dispatch(void)
+ {
+     struct cpuinfo_x86 *c = &boot_cpu_data;
+@@ -1055,6 +1091,7 @@ static void cf_check init_amd(struct cpuinfo_x86 *c)
+ 	unsigned long long value;
+ 
+ 	amd_init_de_cfg(c);
++	amd_init_fp_cfg(c);
+ 
+ 	if (c == &boot_cpu_data)
+ 		amd_init_lfence_dispatch(); /* Needs amd_init_de_cfg() */
+diff --git a/xen/arch/x86/include/asm/msr-index.h b/xen/arch/x86/include/asm/msr-index.h
+index 6f2c3147e3..70e5f09a2d 100644
+--- a/xen/arch/x86/include/asm/msr-index.h
++++ b/xen/arch/x86/include/asm/msr-index.h
+@@ -411,6 +411,7 @@
+ #define MSR_AMD64_LS_CFG		0xc0011020U
+ #define MSR_AMD64_IC_CFG		0xc0011021U
+ #define MSR_AMD64_DC_CFG		0xc0011022U
++#define MSR_AMD64_FP_CFG		0xc0011028U
+ #define MSR_AMD64_DE_CFG		0xc0011029U
+ #define AMD64_DE_CFG_LFENCE_SERIALISE	(_AC(1, ULL) << 1)
+ #define MSR_AMD64_EX_CFG		0xc001102cU
+-- 
+2.39.5
+

xen.spec

@@ -50,8 +50,8 @@
 
 Summary: Xen is a virtual machine monitor
 Name:    xen
-Version: 4.20.1
-Release: 6%{?dist}
+Version: 4.20.4
+Release: 1%{?dist}
 # Automatically converted from old format: GPLv2+ and LGPLv2+ and BSD - review is highly recommended.
 License: GPL-2.0-or-later AND LicenseRef-Callaway-LGPLv2+ AND LicenseRef-Callaway-BSD
 URL:     http://xen.org/
@@ -78,12 +78,6 @@ Patch43: xen.gcc11.fixes.patch
 Patch45: xen.gcc12.fixes.patch
 Patch46: xen.efi.build.patch
 Patch49: xen.python3.12.patch
-Patch50: xen.git-7cda6b65098f790e6573f555c5ef170d3f373c6e.patch
-Patch51: xsa472-1.patch
-Patch52: xsa472-2.patch
-Patch53: xsa472-3.patch
-Patch54: xsa473-1.patch
-Patch55: xsa473-2.patch
 
 
 # build using Fedora seabios and ipxe packages for roms
@@ -262,13 +256,6 @@ manage Xen virtual machines.
 %patch 43 -p1
 %patch 45 -p1
 %patch 46 -p1
-%patch 49 -p1
-%patch 50 -p1
-%patch 51 -p1
-%patch 52 -p1
-%patch 53 -p1
-%patch 54 -p1
-%patch 55 -p1
 
 # stubdom sources
 cp -v %{SOURCE10} %{SOURCE11} %{SOURCE12} %{SOURCE13} %{SOURCE14} %{SOURCE15} stubdom
@@ -818,6 +805,70 @@ fi
 %endif
 
 %changelog
+* Thu Jul 30 2026 Michael Young <m.a.young@durham.ac.uk> - 4.20.4-1
+- update to xen 4.20.4
+- includes security fixes
+  x86 shadow paging is deprecated [XSA-495, CVE-2026-42493]
+  vIRQ event channel binding may break Xenstore [XSA-496, CVE-2026-42492]
+  buffer overruns in libfsimage iso9660 handling [XSA-497, CVE-2026-42494,
+	CVE-2026-42495, CVE-2026-62423, CVE-2026-62424, CVE-2026-62425]
+  sysctl and platform-op locks open to abuse [XSA-499, CVE-2026-62426,
+	CVE-2026-62427]
+  grant-table: type confusion in grant-copy [XSA-500, CVE-2026-62428]
+  grant-table: version change racing with other operations [XSA-501,
+	CVE-2026-62435, CVE-2026-62436]
+  vNUMA domain cleanup may race other operations [XSA-502, CVE-2026-62429]
+  x86: Out-of-bounds read in vRTC emulation [XSA-503, CVE-2026-62430]
+  Viridian STIMER division by zero [XSA-504, CVE-2026-62431]
+  evtchn: Race between FIFO expand and reset [XSA-505, CVE-2026-62432]
+  correct buffer checks for DM_OP hypercalls [XSA-506, CVE-2026-62433]
+  PoD: Don't try to reclaim special pages [XSA-507, CVE-2026-62434]
+  pygrub is only supported in de-privileged mode [XSA-508]
+
+* Thu Jun 18 2026 Michael Young <m.a.young@durham.ac.uk> - 4.20.3-4
+  [ never submitted as update ]
+- x86 HVM I/O port list traversal [XSA-491, CVE-2026-42487]
+- domctl lock open to abuse [XSA-492, CVE-2026-42489, CVE-2026-42490]
+- Arm: Completion of memory accesses not guaranteed by completion of a TLBI
+	 [XSA-493, CVE-2025-10263]
+- x86: mismatched mapcache metadata [XSA-494, CVE-2026-42488]
+
+* Tue May 12 2026 Michael Young <m.a.young@durham.ac.uk> - 4.20.3-3
+- x86: CPU Opcode Cache corruption [XSA-490,CVE-2025-54518]
+
+* Wed Apr 29 2026 Michael Young <m.a.young@durham.ac.uk> - 4.20.3-2
+- oxenstored keeps quota related use counts across domain destruction
+        [XSA-483, CVE-2026-23556]
+- Xenstored DoS via XS_RESET_WATCHES command [XSA-484, CVE-2026-23557]
+- grant table v2 race in status page mapping [XSA-486, CVE-2026-23558]
+- x86: Floating Point Divider State Sampling [XSA-488, CVE-2025-54505]
+
+* Fri Mar 27 2026 Michael Young <m.a.young@durham.ac.uk> - 4.20.3-1
+- update to xen 4.20.3
+  remove patches now included or superceded upstream
+
+* Wed Mar 18 2026 Michael Young <m.a.young@durham.ac.uk> - 4.20.2-4
+- Use after free of paging structures in EPT [XSA-480, CVE-2026-23554]
+- Xenstored DoS by unprivileged domain [XSA-481, CVE-2026-23555]
+
+* Thu Jan 29 2026 Michael Young <m.a.young@durham.ac.uk> - 4.20.2-3
+  x86: buffer overrun with shadow paging + tracing [XSA-477, CVE-2025-58150]
+	(#2434046)
+  x86: incomplete IBPB for vCPU isolation [XSA-479, CVE-2026-23553]
+	(#2434048)
+
+* Fri Nov 14 2025 Michael Young <m.a.young@durham.ac.uk> - 4.20.2-1.fc43
+- update to xen 4.20.2
+  remove patches now included or superceded upstream
+
+* Fri Oct 24 2025 Michael Young <m.a.young@durham.ac.uk> - 4.20.1-8
+- Incorrect removal of permissions on PCI device unplug [XSA-476,
+	CVE-2025-58149]
+
+* Tue Oct 21 2025 Michael Young <m.a.young@durham.ac.uk> - 4.20.1-7
+- x86: Incorrect input sanitisation in Viridian hypercalls [XSA-475,
+	CVE-2025-58147, CVE-2025-58148]
+
 * Fri Sep 19 2025 Python Maint <python-maint@redhat.com> - 4.20.1-6
 - Rebuilt for Python 3.14.0rc3 bytecode
 

xsa472-1.patch

@@ -1,43 +0,0 @@
-From 262114a440bf7c32fd6d215e243b3eaebdd6d7cd Mon Sep 17 00:00:00 2001
-From: Roger Pau Monne <roger.pau@citrix.com>
-Date: Thu, 10 Jul 2025 15:51:40 +0200
-Subject: [PATCH 1/3] x86/viridian: avoid NULL pointer dereference in
- update_reference_tsc()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The function is only called when the MSR has the enabled bit set, but even
-then the page might not be mapped because the guest provided gfn is not
-suitable.
-
-Prevent a NULL pointer dereference in update_reference_tsc() by checking
-whether the page is mapped.
-
-This is CVE-2025-27466 / part of XSA-472.
-
-Fixes: 386b3365221d ('viridian: use viridian_map/unmap_guest_page() for reference tsc page')
-Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
----
- xen/arch/x86/hvm/viridian/time.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/xen/arch/x86/hvm/viridian/time.c b/xen/arch/x86/hvm/viridian/time.c
-index 137577384f1e..ca6d526f46b7 100644
---- a/xen/arch/x86/hvm/viridian/time.c
-+++ b/xen/arch/x86/hvm/viridian/time.c
-@@ -26,6 +26,10 @@ static void update_reference_tsc(const struct domain *d, bool initialize)
-     HV_REFERENCE_TSC_PAGE *p = rt->ptr;
-     uint32_t seq;
- 
-+    /* Reference TSC page might not be mapped even if the MSR is enabled. */
-+    if ( !p )
-+        return;
-+
-     if ( initialize )
-         clear_page(p);
- 
--- 
-2.49.0
-

xsa472-2.patch

@@ -1,41 +0,0 @@
-From 71c9568e290b51dfd7ab091ac98b272fd0aa0b90 Mon Sep 17 00:00:00 2001
-From: Roger Pau Monne <roger.pau@citrix.com>
-Date: Thu, 10 Jul 2025 15:58:51 +0200
-Subject: [PATCH 2/3] x86/viridian: avoid NULL pointer dereference in
- viridian_synic_deliver_timer_msg()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The function is called unconditionally, regardless of whether the SIM page
-is mapped.  Avoid a NULL pointer dereference in
-viridian_synic_deliver_timer_msg() by checking whether the SIM page is
-mapped.
-
-This is CVE-2025-58142 / part of XSA-472.
-
-Fixes: 26fba3c85571 ('viridian: add implementation of synthetic timers')
-Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
----
- xen/arch/x86/hvm/viridian/synic.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/xen/arch/x86/hvm/viridian/synic.c b/xen/arch/x86/hvm/viridian/synic.c
-index c3dc573b003d..e6cba7548f1b 100644
---- a/xen/arch/x86/hvm/viridian/synic.c
-+++ b/xen/arch/x86/hvm/viridian/synic.c
-@@ -338,6 +338,10 @@ bool viridian_synic_deliver_timer_msg(struct vcpu *v, unsigned int sintx,
-         .DeliveryTime = delivery,
-     };
- 
-+    /* Don't assume SIM page to be mapped. */
-+    if ( !msg )
-+        return false;
-+
-     /*
-      * To avoid using an atomic test-and-set, and barrier before calling
-      * vlapic_set_irq(), this function must be called in context of the
--- 
-2.49.0
-

xsa472-3.patch

@@ -1,94 +0,0 @@
-From aed4cfd64d178aee677a8790440addda03678cd6 Mon Sep 17 00:00:00 2001
-From: Roger Pau Monne <roger.pau@citrix.com>
-Date: Thu, 3 Jul 2025 13:09:03 +0200
-Subject: [PATCH 3/3] x86/viridian: protect concurrent modification of the
- reference TSC page
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The reference TSC page is shared between all vCPUs, and the data stored in
-the domain struct.  However the handlers to set and clear it are not safe
-against concurrent accesses.  It's possible for two (or more) vCPUs to call
-HV_X64_MSR_REFERENCE_TSC at the same time and cause the in-use reference
-TSC page to be freed, while still being on the p2m.  This creates an
-information leak, where the page can end up mapped in another domain while
-still being part of the original domain p2m.
-
-It's also possible to underflow the reference counter, as multiple
-concurrent writes to HV_X64_MSR_REFERENCE_TSC can create an imbalance on
-the number of put_page_and_type() calls.
-
-Introduce a lock to protect the reference TSC domain field, thus
-serializing concurrent vCPU accesses.
-
-This is CVE-2025-58143 / part of XSA-472.
-
-Fixes: 386b3365221d ('viridian: use viridian_map/unmap_guest_page() for reference tsc page')
-Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
-Reviewed-by: Jan Beulich <jbeulich@suse.com>
----
- xen/arch/x86/hvm/viridian/time.c        | 4 ++++
- xen/arch/x86/hvm/viridian/viridian.c    | 2 ++
- xen/arch/x86/include/asm/hvm/viridian.h | 1 +
- 3 files changed, 7 insertions(+)
-
-diff --git a/xen/arch/x86/hvm/viridian/time.c b/xen/arch/x86/hvm/viridian/time.c
-index ca6d526f46b7..9311858d63c0 100644
---- a/xen/arch/x86/hvm/viridian/time.c
-+++ b/xen/arch/x86/hvm/viridian/time.c
-@@ -108,8 +108,10 @@ static void time_ref_count_thaw(const struct domain *d)
- 
-     trc->off = (int64_t)trc->val - trc_val(d, 0);
- 
-+    spin_lock(&vd->lock);
-     if ( vd->reference_tsc.msr.enabled )
-         update_reference_tsc(d, false);
-+    spin_unlock(&vd->lock);
- }
- 
- static uint64_t time_ref_count(const struct domain *d)
-@@ -331,6 +333,7 @@ int viridian_time_wrmsr(struct vcpu *v, uint32_t idx, uint64_t val)
-         if ( !(viridian_feature_mask(d) & HVMPV_reference_tsc) )
-             return X86EMUL_EXCEPTION;
- 
-+        spin_lock(&vd->lock);
-         viridian_unmap_guest_page(&vd->reference_tsc);
-         vd->reference_tsc.msr.raw = val;
-         viridian_dump_guest_page(v, "REFERENCE_TSC", &vd->reference_tsc);
-@@ -339,6 +342,7 @@ int viridian_time_wrmsr(struct vcpu *v, uint32_t idx, uint64_t val)
-             viridian_map_guest_page(d, &vd->reference_tsc);
-             update_reference_tsc(d, true);
-         }
-+        spin_unlock(&vd->lock);
-         break;
- 
-     case HV_X64_MSR_TIME_REF_COUNT:
-diff --git a/xen/arch/x86/hvm/viridian/viridian.c b/xen/arch/x86/hvm/viridian/viridian.c
-index 7ea6c9016894..c0be24bd2210 100644
---- a/xen/arch/x86/hvm/viridian/viridian.c
-+++ b/xen/arch/x86/hvm/viridian/viridian.c
-@@ -494,6 +494,8 @@ int viridian_domain_init(struct domain *d)
-     if ( !d->arch.hvm.viridian )
-         return -ENOMEM;
- 
-+    spin_lock_init(&d->arch.hvm.viridian->lock);
-+
-     rc = viridian_synic_domain_init(d);
-     if ( rc )
-         goto fail;
-diff --git a/xen/arch/x86/include/asm/hvm/viridian.h b/xen/arch/x86/include/asm/hvm/viridian.h
-index 4c8ff6e80b6f..47c9d13841ac 100644
---- a/xen/arch/x86/include/asm/hvm/viridian.h
-+++ b/xen/arch/x86/include/asm/hvm/viridian.h
-@@ -71,6 +71,7 @@ struct viridian_domain
-     DECLARE_BITMAP(hypercall_flags, _HCALL_nr);
-     struct viridian_time_ref_count time_ref_count;
-     struct viridian_page reference_tsc;
-+    spinlock_t lock;
- };
- 
- void cpuid_viridian_leaves(const struct vcpu *v, uint32_t leaf,
--- 
-2.49.0
-

xsa473-1.patch

@@ -1,43 +0,0 @@
-From: Jan Beulich <jbeulich@suse.com>
-Subject: Arm: foreign page handling in p2m_get_page_from_gfn()
-
-I can't see what would make the 1st of the assertions safe: For example,
-the P2M lock not being held, the foreign page may disappear before we
-get to call page_get_owner_and_reference(), which hence may return NULL.
-
-Even the 2nd, which appears to be safe safe, is lacking proper release
-build fallbacks.
-
-Drop the former in favor of an if(), and convert the latter to the
-equivalent of what x86 uses: ASSERT_UNREACHABLE() plus putting of the
-obtained page.
-
-This is CVE-2025-58144 / part of XSA-473.
-
-Fixes: 9486a8d07ba8 ("xen/arm: Handle remove foreign mapping")
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: Julien Grall <jgrall@amazon.com>
-
---- a/xen/arch/arm/p2m.c
-+++ b/xen/arch/arm/p2m.c
-@@ -74,10 +74,16 @@ struct page_info *p2m_get_page_from_gfn(
-      */
-     if ( p2m_is_foreign(p2mt) )
-     {
--        struct domain *fdom = page_get_owner_and_reference(page);
--        ASSERT(fdom != NULL);
--        ASSERT(fdom != d);
--        return page;
-+        const struct domain *fdom = page_get_owner_and_reference(page);
-+
-+        if ( fdom )
-+        {
-+            if ( fdom != d )
-+                return page;
-+            ASSERT_UNREACHABLE();
-+            put_page(page);
-+        }
-+        return NULL;
-     }
- 
-     return get_page(page, d) ? page : NULL;

xsa473-2.patch

@@ -1,62 +0,0 @@
-From: Jan Beulich <jbeulich@suse.com>
-Subject: Arm: adjust locking in p2m_get_page_from_gfn()
-
-In order to safely acquire a reference for a foreign page mapping, the
-P2M lock needs to be held until we have the reference in hand (or
-getting one failed). Otherwise the page can change P2M type and
-ownership in between.
-
-This is CVE-2025-58145 / part of XSA-473.
-
-Fixes: 9486a8d07ba8 ("xen/arm: Handle remove foreign mapping")
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: Julien Grall <jgrall@amazon.com>
-
---- a/xen/arch/arm/p2m.c
-+++ b/xen/arch/arm/p2m.c
-@@ -53,18 +53,22 @@ mfn_t p2m_lookup(struct domain *d, gfn_t
- struct page_info *p2m_get_page_from_gfn(struct domain *d, gfn_t gfn,
-                                         p2m_type_t *t)
- {
-+    struct p2m_domain *p2m = p2m_get_hostp2m(d);
-     struct page_info *page;
-     p2m_type_t p2mt;
--    mfn_t mfn = p2m_lookup(d, gfn, &p2mt);
-+    mfn_t mfn;
-+
-+    p2m_read_lock(p2m);
-+    mfn = p2m_get_entry(p2m, gfn, &p2mt, NULL, NULL, NULL);
- 
-     if ( t )
-         *t = p2mt;
- 
--    if ( !p2m_is_any_ram(p2mt) )
--        return NULL;
--
--    if ( !mfn_valid(mfn) )
-+    if ( !p2m_is_any_ram(p2mt) || !mfn_valid(mfn) )
-+    {
-+        p2m_read_unlock(p2m);
-         return NULL;
-+    }
- 
-     page = mfn_to_page(mfn);
- 
-@@ -76,6 +80,8 @@ struct page_info *p2m_get_page_from_gfn(
-     {
-         const struct domain *fdom = page_get_owner_and_reference(page);
- 
-+        p2m_read_unlock(p2m);
-+
-         if ( fdom )
-         {
-             if ( fdom != d )
-@@ -86,6 +92,8 @@ struct page_info *p2m_get_page_from_gfn(
-         return NULL;
-     }
- 
-+    p2m_read_unlock(p2m);
-+
-     return get_page(page, d) ? page : NULL;
- }
-