update to xen 4.21.2

includes multiple security fixes

.gitignore

@@ -7,4 +7,4 @@ pciutils-2.2.9.tar.bz2
 zlib-1.2.3.tar.gz
 polarssl-1.1.4-gpl.tgz
 /mini-os-4.21.0.tar.xz
-/xen-4.21.1.tar.xz
+/xen-4.21.2.tar.xz

sources

@@ -5,4 +5,4 @@ SHA512 (zlib-1.2.3.tar.gz) = 021b958fcd0d346c4ba761bcf0cc40f3522de6186cf5a0a6ea3
 SHA512 (polarssl-1.1.4-gpl.tgz) = 88da614e4d3f4409c4fd3bb3e44c7587ba051e3fed4e33d526069a67e8180212e1ea22da984656f50e290049f60ddca65383e5983c0f8884f648d71f698303ad
 SHA512 (pciutils-2.2.9.tar.bz2) = 2b3d98d027e46d8c08037366dde6f0781ca03c610ef2b380984639e4ef39899ed8d8b8e4cd9c9dc54df101279b95879bd66bfd4d04ad07fef41e847ea7ae32b5
 SHA512 (mini-os-4.21.0.tar.xz) = 7543774d15da84476d93d04154990923c82209cb3fa125574c0383652c5a310957200f54b63b34502161f9c3afce4907e0060d9036f3eaf3a7cb6b1b3119b546
-SHA512 (xen-4.21.1.tar.xz) = 8dfe65255e202b3dacf9d0d7265636bc1f97627c11b08babc13a5b8e74c7c65e7e2c6a1513e28b3c713fe512edb6702a73b2bf667e2a8f2ce825b196a2cd5aab
+SHA512 (xen-4.21.2.tar.xz) = 78de26ab01f06024890e867c0b4a38d4a590ecffebc18f8dafa842baeb144b0f0463f2cf241eb3b081179b357ddf5ee389d883ca23a12a2be51ba3161fb8c0fd

xen.git-90b20547b756a5cf9b0fec9fb0de5b361e8bf4c3.patch

@@ -1,88 +0,0 @@
-From 90b20547b756a5cf9b0fec9fb0de5b361e8bf4c3 Mon Sep 17 00:00:00 2001
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Date: Fri, 10 Apr 2026 21:55:46 +0100
-Subject: [PATCH] x86/amd: Mitigate AMD-SN-7053 / FP-DSS
-MIME-Version: 1.0
-Content-Type: text/plain; charset=utf8
-Content-Transfer-Encoding: 8bit
-
-This is XSA-488 / CVE-2025-54505
-
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
-(cherry picked from commit 99912d346009fda1e7fb1510c9501fbab17e92a0)
----
- xen/arch/x86/cpu/amd.c               | 37 ++++++++++++++++++++++++++++
- xen/arch/x86/include/asm/msr-index.h |  1 +
- 2 files changed, 38 insertions(+)
-
-diff --git a/xen/arch/x86/cpu/amd.c b/xen/arch/x86/cpu/amd.c
-index 8c55d233f3..1bb0766ebf 100644
---- a/xen/arch/x86/cpu/amd.c
-+++ b/xen/arch/x86/cpu/amd.c
-@@ -1048,6 +1048,42 @@ void amd_init_de_cfg(const struct cpuinfo_x86 *c)
-     wrmsrl(MSR_AMD64_DE_CFG, val | new);
- }
- 
-+static void amd_init_fp_cfg(const struct cpuinfo_x86 *c)
-+{
-+    uint64_t val, new = 0;
-+
-+    /* If virtualised, we won't have mutable access even if we can read it. */
-+    if ( cpu_has_hypervisor )
-+        return;
-+
-+    /*
-+     * On Zen1, mitigate SB-7053 / FP-DSS Floating Point Divider State
-+     * Sampling by setting bit 9 as instructed.
-+     */
-+    if ( c->family == 0x17 && is_zen1_uarch() )
-+        new |= 1 << 9;
-+
-+    /*
-+     * Avoid reading FP_CFG if we don't intend to change anything.  The
-+     * register doesn't exist on all families.
-+     */
-+    if ( !new )
-+        return;
-+
-+    val = rdmsr(MSR_AMD64_FP_CFG);
-+
-+    if ( (val & new) == new )
-+        return;
-+
-+    /*
-+     * FP_CFG is a Core-scoped MSR, and this write is racy.  However, both
-+     * threads calculate the new value from state which expected to be
-+     * consistent across CPUs and unrelated to the old value, so the result
-+     * should be consistent.
-+     */
-+    wrmsr(MSR_AMD64_FP_CFG, val | new);
-+}
-+
- void __init amd_init_lfence_dispatch(void)
- {
-     struct cpuinfo_x86 *c = &boot_cpu_data;
-@@ -1120,6 +1156,7 @@ static void cf_check init_amd(struct cpuinfo_x86 *c)
- 	uint64_t value;
- 
- 	amd_init_de_cfg(c);
-+	amd_init_fp_cfg(c);
- 
- 	if (c == &boot_cpu_data)
- 		amd_init_lfence_dispatch(); /* Needs amd_init_de_cfg() */
-diff --git a/xen/arch/x86/include/asm/msr-index.h b/xen/arch/x86/include/asm/msr-index.h
-index df52587c85..6c5b2569e1 100644
---- a/xen/arch/x86/include/asm/msr-index.h
-+++ b/xen/arch/x86/include/asm/msr-index.h
-@@ -428,6 +428,7 @@
- #define MSR_AMD64_LS_CFG		0xc0011020U
- #define MSR_AMD64_IC_CFG		0xc0011021U
- #define MSR_AMD64_DC_CFG		0xc0011022U
-+#define MSR_AMD64_FP_CFG		0xc0011028U
- #define MSR_AMD64_DE_CFG		0xc0011029U
- #define AMD64_DE_CFG_LFENCE_SERIALISE	(_AC(1, ULL) << 1)
- #define MSR_AMD64_EX_CFG		0xc001102cU
--- 
-2.39.5
-

xen.json.nocpuid.patch

@@ -1,27 +0,0 @@
---- xen-4.21.0/tools/libs/light/libxl_nocpuid.c.orig	2025-11-18 18:02:13.000000000 +0000
-+++ xen-4.21.0/tools/libs/light/libxl_nocpuid.c	2025-11-20 09:03:56.517804514 +0000
-@@ -40,11 +40,24 @@
-     return 0;
- }
- 
-+#ifdef HAVE_LIBJSONC
-+#ifndef _hidden
-+#define _hidden
-+#endif
-+_hidden int libxl_cpuid_policy_list_gen_jso(json_object **jso_r,
-+                                libxl_cpuid_policy_list *pcpuid)
-+{
-+    return 0;
-+}
-+#endif
-+
-+#if defined(HAVE_LIBYAJL)
- yajl_gen_status libxl_cpuid_policy_list_gen_json(yajl_gen hand,
-                                 libxl_cpuid_policy_list *pcpuid)
- {
-     return 0;
- }
-+#endif
- 
- int libxl__cpuid_policy_list_parse_json(libxl__gc *gc,
-                                         const libxl__json_object *o,

xen.spec

@@ -50,8 +50,8 @@
 
 Summary: Xen is a virtual machine monitor
 Name:    xen
-Version: 4.21.1
-Release: 3%{?dist}
+Version: 4.21.2
+Release: 1%{?dist}
 # Automatically converted from old format: GPLv2+ and LGPLv2+ and BSD - review is highly recommended.
 License: GPL-2.0-or-later AND LicenseRef-Callaway-LGPLv2+ AND LicenseRef-Callaway-BSD
 URL:     http://xen.org/
@@ -78,12 +78,6 @@ Patch6: xen.gcc11.fixes.patch
 Patch7: xen.gcc12.fixes.patch
 Patch8: xen.efi.build.patch
 Patch9: xen.python3.12.patch
-Patch11: xen.json.nocpuid.patch
-Patch12: xsa483.patch
-Patch13: xsa484.patch
-Patch14: xsa486.patch
-Patch15: xen.git-90b20547b756a5cf9b0fec9fb0de5b361e8bf4c3.patch
-Patch16: xsa490-4.21.patch
 
 
 # build using Fedora seabios and ipxe packages for roms
@@ -269,12 +263,6 @@ This package contains files used in testing the xen builds
 %patch 7 -p1
 %patch 8 -p1
 %patch 9 -p1
-%patch 11 -p1
-%patch 12 -p1
-%patch 13 -p1
-%patch 14 -p1
-%patch 15 -p1
-%patch 16 -p1
 
 # stubdom sources
 cp -v %{SOURCE10} %{SOURCE11} %{SOURCE12} %{SOURCE13} %{SOURCE14} %{SOURCE15} stubdom
@@ -830,6 +818,33 @@ fi
 %{_libexecdir}/xen/tests/*
 
 %changelog
+* Thu Jul 30 2026 Michael Young <m.a.young@durham.ac.uk> - 4.21.2-1
+- update to xen 4.21.2
+- includes security fixes
+  x86 shadow paging is deprecated [XSA-495, CVE-2026-42493]
+  vIRQ event channel binding may break Xenstore [XSA-496, CVE-2026-42492]
+  buffer overruns in libfsimage iso9660 handling [XSA-497, CVE-2026-42494,
+	CVE-2026-42495, CVE-2026-62423, CVE-2026-62424, CVE-2026-62425]
+  sysctl and platform-op locks open to abuse [XSA-499, CVE-2026-62426,
+	CVE-2026-62427]
+  grant-table: type confusion in grant-copy [XSA-500, CVE-2026-62428]
+  grant-table: version change racing with other operations [XSA-501,
+	CVE-2026-62435, CVE-2026-62436]
+  vNUMA domain cleanup may race other operations [XSA-502, CVE-2026-62429]
+  x86: Out-of-bounds read in vRTC emulation [XSA-503, CVE-2026-62430]
+  Viridian STIMER division by zero [XSA-504, CVE-2026-62431]
+  evtchn: Race between FIFO expand and reset [XSA-505, CVE-2026-62432]
+  correct buffer checks for DM_OP hypercalls [XSA-506, CVE-2026-62433]
+  PoD: Don't try to reclaim special pages [XSA-507, CVE-2026-62434]
+  pygrub is only supported in de-privileged mode [XSA-508]
+
+* Fri Jun 12 2026 Michael Young <m.a.young@durham.ac.uk> - 4.21.1-4
+- x86 HVM I/O port list traversal [XSA-491, CVE-2026-42487]
+- domctl lock open to abuse [XSA-492, CVE-2026-42489, CVE-2026-42490]
+- Arm: Completion of memory accesses not guaranteed by completion of a TLBI
+	 [XSA-493, CVE-2025-10263]
+- x86: mismatched mapcache metadata [XSA-494, CVE-2026-42488]
+
 * Tue May 12 2026 Michael Young <m.a.young@durham.ac.uk> - 4.21.1-3
 - x86: CPU Opcode Cache corruption [XSA-490,CVE-2025-54518]
 

xsa483.patch

@@ -1,30 +0,0 @@
-From: Andrii Sultanov <andriy.sultanov@vates.tech>
-Subject: tools/oxenstored: Reset quota when resetting permissions
-
-The quota object contains both limits and the current node usage counts.
-
-When a domain is torn down, the node data itself is cleaned up but the node
-usage counts are not.  A later domain reusing the same domid can create fewer
-nodes before being deemed to be over quota.
-
-Reset the count when the node permissions are cleaned up.
-
-This is XSA-483 / CVE-2026-23556.
-
-Signed-off-by: Andrii Sultanov <andriy.sultanov@vates.tech>
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-
-diff --git a/tools/ocaml/xenstored/store.ml b/tools/ocaml/xenstored/store.ml
-index 9b8dd2812df0..aa9204ead3ec 100644
---- a/tools/ocaml/xenstored/store.ml
-+++ b/tools/ocaml/xenstored/store.ml
-@@ -465,7 +465,8 @@ let reset_permissions store domid =
-         if perms <> node.perms then
-           Logging.debug "store|node" "Changed permissions for node %s" (Node.get_name node);
-         Some { node with Node.perms }
--    ) store.root
-+    ) store.root;
-+  store.quota <- Quota.del store.quota domid
- 
- type ops = {
-   store: t;

xsa484.patch

@@ -1,89 +0,0 @@
-From 3d0d19ad17f29c64dde4a7baf392da4fd58f3654 Mon Sep 17 00:00:00 2001
-From: Juergen Gross <jgross@suse.com>
-Date: Mon, 16 Mar 2026 15:06:11 +0100
-Subject: [PATCH] tools/xenstored: make conn_delete_all_transactions()
- idempotent
-
-conn_delete_all_transactions() should be callable in any context,
-resetting ALL transaction related data.
-
-This includes number of active transactions and the transaction
-pointer in struct connection.
-
-So reset conn->trans to NULL in conn_delete_all_transactions() and
-do the cleanup for each transaction in destroy_transaction().
-
-This avoids triggering the assert() in conn_delete_all_transactions()
-in case e.g. ignore_connection() was called while an operation inside
-a transaction was performed, or XS_RESET_WATCHES was called in a
-transaction.
-
-This is XSA-484 / CVE-2026-23557.
-
-Reported-by: Andrii Sultanov <andriy.sultanov@vates.tech>
-Fixes: 1f9d04fb021c ("xenstored: allow guest to shutdown all its watches/transactions")
-Signed-off-by: Juergen Gross <jgross@suse.com>
----
- tools/xenstored/transaction.c | 20 +++++++++-----------
- 1 file changed, 9 insertions(+), 11 deletions(-)
-
-diff --git a/tools/xenstored/transaction.c b/tools/xenstored/transaction.c
-index 167cd597fd..0825c48859 100644
---- a/tools/xenstored/transaction.c
-+++ b/tools/xenstored/transaction.c
-@@ -432,17 +432,23 @@ static int finalize_transaction(struct connection *conn,
- static int destroy_transaction(void *_transaction)
- {
- 	struct transaction *trans = _transaction;
-+	struct connection *conn = trans->conn;
- 	struct accessed_node *i;
- 
- 	wrl_ntransactions--;
- 	trace_destroy(trans, "transaction");
- 	while ((i = list_top(&trans->accessed, struct accessed_node, list))) {
- 		if (i->ta_node)
--			db_delete(trans->conn, i->trans_name, NULL);
-+			db_delete(conn, i->trans_name, NULL);
- 		list_del(&i->list);
- 		talloc_free(i);
- 	}
- 
-+	list_del(&trans->list);
-+	domain_transaction_dec(conn);
-+	if (list_empty(&conn->transaction_list))
-+		conn->ta_start_time = 0;
-+
- 	return 0;
- }
- 
-@@ -523,10 +529,6 @@ int do_transaction_end(const void *ctx, struct connection *conn,
- 		return ENOENT;
- 
- 	conn->transaction = NULL;
--	list_del(&trans->list);
--	domain_transaction_dec(conn);
--	if (list_empty(&conn->transaction_list))
--		conn->ta_start_time = 0;
- 
- 	chk_quota = trans->node_created && domain_is_unprivileged(conn);
- 
-@@ -572,14 +574,10 @@ void conn_delete_all_transactions(struct connection *conn)
- 	struct transaction *trans;
- 
- 	while ((trans = list_top(&conn->transaction_list,
--				 struct transaction, list))) {
--		list_del(&trans->list);
-+				 struct transaction, list)))
- 		talloc_free(trans);
--	}
--
--	assert(conn->transaction == NULL);
- 
--	conn->ta_start_time = 0;
-+	conn->transaction = NULL;
- }
- 
- int check_transactions(struct hashtable *hash)
--- 
-2.53.0
-

xsa486.patch

@@ -1,181 +0,0 @@
-From: Jan Beulich <jbeulich@suse.com>
-Subject: gnttab: split gnttab_map_frame()
-
-If a domain tries to map status frames in parallel to switching grant
-table version from 2 to 1, the mapping operation may put in place P2M
-entries referencing MFNs which gnttab_unpopulate_status_frames() is in the
-process of freeing.
-
-Ideally we would refcount pages when entered into P2M tables, but that's a
-significant change. Extend the grant-table-locked region instead in
-xenmem_add_to_physmap_one() (being the sole caller of gnttab_map_frame()),
-such that a race with gnttab_unpopulate_status_frames() is no longer
-possible.
-
-This is XSA-486 / CVE-2026-23558.
-
-Fixes: 5ce8fafa947c ("Dynamic grant-table sizing")
-Fixes: a98dc13703e0 ("Introduce a grant_entry_v2 structure")
-Reported-by: Rafal Wojtczuk <rafal.wojtczuk@7bulls.com>
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
-
---- a/xen/arch/arm/mm.c
-+++ b/xen/arch/arm/mm.c
-@@ -174,12 +174,10 @@ int xenmem_add_to_physmap_one(
-     switch ( space )
-     {
-     case XENMAPSPACE_grant_table:
--        rc = gnttab_map_frame(d, idx, gfn, &mfn);
-+        rc = gnttab_map_frame_begin(d, idx, gfn, &mfn);
-         if ( rc )
-             return rc;
- 
--        /* Need to take care of the reference obtained in gnttab_map_frame(). */
--        page = mfn_to_page(mfn);
-         t = p2m_ram_rw;
- 
-         break;
-@@ -281,10 +279,23 @@ int xenmem_add_to_physmap_one(
-      * to drop the reference we took earlier. In all other cases we need to
-      * drop any reference we took earlier (perhaps indirectly).
-      */
--    if ( space == XENMAPSPACE_gmfn_foreign ? rc : page != NULL )
-+    switch ( space )
-     {
-+    default:
-+        if ( page )
-+            put_page(page);
-+        break;
-+
-+    case XENMAPSPACE_grant_table:
-+        gnttab_map_frame_end(d, mfn);
-+        break;
-+
-+    case XENMAPSPACE_gmfn_foreign:
-+        if ( !rc )
-+            break;
-         ASSERT(page != NULL);
-         put_page(page);
-+        break;
-     }
- 
-     return rc;
---- a/xen/arch/x86/mm/p2m.c
-+++ b/xen/arch/x86/mm/p2m.c
-@@ -2009,11 +2009,9 @@ int xenmem_add_to_physmap_one(
-         break;
- 
-     case XENMAPSPACE_grant_table:
--        rc = gnttab_map_frame(d, idx, gfn, &mfn);
-+        rc = gnttab_map_frame_begin(d, idx, gfn, &mfn);
-         if ( rc )
-             return rc;
--        /* Need to take care of the reference obtained in gnttab_map_frame(). */
--        page = mfn_to_page(mfn);
-         break;
- 
-     case XENMAPSPACE_gmfn:
-@@ -2095,19 +2093,28 @@ int xenmem_add_to_physmap_one(
-     put_gfn(d, gfn_x(gfn));
- 
-  put_both:
--    /*
--     * In the XENMAPSPACE_gmfn case, we took a ref of the gfn at the top.
--     * We also may need to transfer ownership of the page reference to our
--     * caller.
--     */
--    if ( space == XENMAPSPACE_gmfn )
-+    switch ( space )
-     {
-+    case XENMAPSPACE_gmfn:
-+        /*
-+         * We took a ref of the gfn at the top.  We also may need to transfer
-+         * ownership of the page reference to our caller.
-+         */
-         put_gfn(d, gmfn);
-         if ( !rc && extra.ppage )
-         {
-             *extra.ppage = page;
-             page = NULL;
-         }
-+        break;
-+
-+    case XENMAPSPACE_grant_table:
-+        /*
-+         * We (gnttab_map_frame_begin()) acquired a lock and took a ref of the
-+         * page underlying the MFN at the top.
-+         */
-+        gnttab_map_frame_end(d, mfn);
-+        break;
-     }
- 
-     if ( page )
---- a/xen/common/grant_table.c
-+++ b/xen/common/grant_table.c
-@@ -4250,7 +4250,8 @@ int gnttab_acquire_resource(
-     return rc;
- }
- 
--int gnttab_map_frame(struct domain *d, unsigned long idx, gfn_t gfn, mfn_t *mfn)
-+int gnttab_map_frame_begin(
-+    struct domain *d, unsigned long idx, gfn_t gfn, mfn_t *mfn)
- {
-     int rc = 0;
-     struct grant_table *gt = d->grant_table;
-@@ -4288,11 +4289,19 @@ int gnttab_map_frame(struct domain *d, u
-             put_page(pg);
-     }
- 
--    grant_write_unlock(gt);
-+    if ( rc )
-+        grant_write_unlock(d->grant_table);
- 
-     return rc;
- }
- 
-+void gnttab_map_frame_end(struct domain *d, mfn_t mfn)
-+{
-+    put_page(mfn_to_page(mfn));
-+
-+    grant_write_unlock(d->grant_table);
-+}
-+
- static void gnttab_usage_print(struct domain *rd)
- {
-     int first = 1;
---- a/xen/include/xen/grant_table.h
-+++ b/xen/include/xen/grant_table.h
-@@ -60,8 +60,13 @@ int gnttab_release_mappings(struct domai
- int mem_sharing_gref_to_gfn(struct grant_table *gt, grant_ref_t ref,
-                             gfn_t *gfn, uint16_t *status);
- 
--int gnttab_map_frame(struct domain *d, unsigned long idx, gfn_t gfn,
--                     mfn_t *mfn);
-+/*
-+ * These need to be used as a pair, as the first (in the success case) returns
-+ * with a lock and page reference held which the second needs to drop.
-+ */
-+int gnttab_map_frame_begin(struct domain *d, unsigned long idx, gfn_t gfn,
-+                           mfn_t *mfn);
-+void gnttab_map_frame_end(struct domain *d, mfn_t mfn);
- 
- unsigned int gnttab_resource_max_frames(const struct domain *d, unsigned int id);
- 
-@@ -100,12 +105,14 @@ static inline int mem_sharing_gref_to_gf
-     return -EINVAL;
- }
- 
--static inline int gnttab_map_frame(struct domain *d, unsigned long idx,
--                                   gfn_t gfn, mfn_t *mfn)
-+static inline int gnttab_map_frame_begin(struct domain *d, unsigned long idx,
-+                                         gfn_t gfn, mfn_t *mfn)
- {
-     return -EINVAL;
- }
- 
-+static inline void gnttab_map_frame_end(struct domain *d, mfn_t mfn) {}
-+
- static inline unsigned int gnttab_resource_max_frames(
-     const struct domain *d, unsigned int id)
- {

xsa490-4.21.patch

@@ -1,43 +0,0 @@
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Subject: x86/amd: Mitigate AMD-SN-7052
-
-This is XSA-490 / CVE-2025-54518.
-
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
-
-diff --git a/xen/arch/x86/cpu/amd.c b/xen/arch/x86/cpu/amd.c
-index 1bb0766ebf13..b5bf2b732e8f 100644
---- a/xen/arch/x86/cpu/amd.c
-+++ b/xen/arch/x86/cpu/amd.c
-@@ -1116,11 +1116,25 @@ static void amd_check_bp_cfg(void)
- {
- 	uint64_t val, new = 0;
- 
--	/*
--	 * AMD Erratum #1485.  Set bit 5, as instructed.
--	 */
--	if (!cpu_has_hypervisor && boot_cpu_data.x86 == 0x19 && is_zen4_uarch())
--		new |= (1 << 5);
-+	if (!cpu_has_hypervisor) {
-+		/*
-+		 * AMD Erratum #1485.  If SMT is enabled and STIBP disabled,
-+		 * the CPU may fetch incorrect instruction bytes.
-+		 *
-+		 * Set bit 5, as instructed.
-+		 */
-+		if (boot_cpu_data.x86 == 0x19 && is_zen4_uarch())
-+			new |= (1 << 5);
-+
-+		/*
-+		 * AMD SB-7052.  CPU OP Cache corruption, causing instructions
-+		 * to be executed at a higher privilege.
-+		 *
-+		 * Set bit 33, as instructed.
-+		 */
-+		if (boot_cpu_data.x86 == 0x17 && is_zen2_uarch())
-+			new |= (1UL << 33);
-+	}
- 
- 	/*
- 	 * On hardware supporting SRSO_MSR_FIX, activate BP_SPEC_REDUCE by