[rpms/xen] f43: update to xen 4.20.4

[rpms/xen] f43: update to xen 4.20.4

[Michael Young]

            A new commit has been pushed.

            Repo   : rpms/xen
            Branch : f43
            Commit : 03ebe9389dd5f855f24119538c349895a031f678
            Author : Michael Young <m.a.young@durham.ac.uk>
            Date   : 2026-07-30T21:56:12+01:00
            Stats  : +32/-358 in 7 file(s)
            URL    : https://src.fedoraproject.org/rpms/xen/c/03ebe9389dd5f855f24119538c349895a031f678?branch=f43

            Log:
            update to xen 4.20.4

includes security fixes

---
diff --git a/.gitignore b/.gitignore
index b388be6..0581cca 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,4 +7,4 @@ pciutils-2.2.9.tar.bz2
 zlib-1.2.3.tar.gz
 polarssl-1.1.4-gpl.tgz
 /mini-os-4.20.0.tar.xz
-/xen-4.20.3.tar.gz
+/xen-4.20.4.tar.gz

diff --git a/sources b/sources
index da36f91..4e6a885 100644
--- a/sources
+++ b/sources
@@ -5,4 +5,4 @@ SHA512 (zlib-1.2.3.tar.gz) = 021b958fcd0d346c4ba761bcf0cc40f3522de6186cf5a0a6ea3
 SHA512 (polarssl-1.1.4-gpl.tgz) = 88da614e4d3f4409c4fd3bb3e44c7587ba051e3fed4e33d526069a67e8180212e1ea22da984656f50e290049f60ddca65383e5983c0f8884f648d71f698303ad
 SHA512 (pciutils-2.2.9.tar.bz2) = 2b3d98d027e46d8c08037366dde6f0781ca03c610ef2b380984639e4ef39899ed8d8b8e4cd9c9dc54df101279b95879bd66bfd4d04ad07fef41e847ea7ae32b5
 SHA512 (mini-os-4.20.0.tar.xz) = 52d5d0985e1b4c26b761c94a3f7ca543bc388a96f69710524ebf34dd5b01d8f774fd5a3f6a50739c8b7c7edfdf07b594f5d44de8f389ea4138a62f9c5884c4e6
-SHA512 (xen-4.20.3.tar.gz) = 1d805584eab604497178fcbce76bef03d3daf3854bcb432520b9968ff86410dd90fcb43e674a646bc94fcebffa9e45291454861b89b8289cc338c9d7e4c217d1
+SHA512 (xen-4.20.4.tar.gz) = a4d92677f8dff486ae094bf9d74d15606217945012482fd43323c9b86891169be367b80aef2d711d686df478046649fa003ebc038b82ecaffdeff505195179af

diff --git a/xen.spec b/xen.spec
index 6f62c57..eef64c5 100644
--- a/xen.spec
+++ b/xen.spec
@@ -50,8 +50,8 @@
 
 Summary: Xen is a virtual machine monitor
 Name:    xen
-Version: 4.20.3
-Release: 3%{?dist}
+Version: 4.20.4
+Release: 1%{?dist}
 # Automatically converted from old format: GPLv2+ and LGPLv2+ and BSD - review is highly recommended.
 License: GPL-2.0-or-later AND LicenseRef-Callaway-LGPLv2+ AND LicenseRef-Callaway-BSD
 URL:     http://xen.org/
@@ -78,11 +78,6 @@ Patch43: xen.gcc11.fixes.patch
 Patch45: xen.gcc12.fixes.patch
 Patch46: xen.efi.build.patch
 Patch49: xen.python3.12.patch
-Patch50: xsa483.patch
-Patch51: xsa484.patch
-Patch52: xsa486.patch
-Patch53: xen.git-c403cf9e742a20e0aadbe04c1ab0ce9621184037.patch
-Patch54: xsa490-4.21.patch
 
 
 # build using Fedora seabios and ipxe packages for roms
@@ -261,12 +256,6 @@ manage Xen virtual machines.
 %patch 43 -p1
 %patch 45 -p1
 %patch 46 -p1
-%patch 49 -p1
-%patch 50 -p1
-%patch 51 -p1
-%patch 52 -p1
-%patch 53 -p1
-%patch 54 -p1
 
 # stubdom sources
 cp -v %{SOURCE10} %{SOURCE11} %{SOURCE12} %{SOURCE13} %{SOURCE14} %{SOURCE15} stubdom
@@ -816,6 +805,34 @@ fi
 %endif
 
 %changelog
+* Thu Jul 30 2026 Michael Young <m.a.young@durham.ac.uk> - 4.20.4-1
+- update to xen 4.20.4
+- includes security fixes
+  x86 shadow paging is deprecated [XSA-495, CVE-2026-42493]
+  vIRQ event channel binding may break Xenstore [XSA-496, CVE-2026-42492]
+  buffer overruns in libfsimage iso9660 handling [XSA-497, CVE-2026-42494,
+	CVE-2026-42495, CVE-2026-62423, CVE-2026-62424, CVE-2026-62425]
+  sysctl and platform-op locks open to abuse [XSA-499, CVE-2026-62426,
+	CVE-2026-62427]
+  grant-table: type confusion in grant-copy [XSA-500, CVE-2026-62428]
+  grant-table: version change racing with other operations [XSA-501,
+	CVE-2026-62435, CVE-2026-62436]
+  vNUMA domain cleanup may race other operations [XSA-502, CVE-2026-62429]
+  x86: Out-of-bounds read in vRTC emulation [XSA-503, CVE-2026-62430]
+  Viridian STIMER division by zero [XSA-504, CVE-2026-62431]
+  evtchn: Race between FIFO expand and reset [XSA-505, CVE-2026-62432]
+  correct buffer checks for DM_OP hypercalls [XSA-506, CVE-2026-62433]
+  PoD: Don't try to reclaim special pages [XSA-507, CVE-2026-62434]
+  pygrub is only supported in de-privileged mode [XSA-508]
+
+* Thu Jun 18 2026 Michael Young <m.a.young@durham.ac.uk> - 4.20.3-4
+  [ never submitted as update ]
+- x86 HVM I/O port list traversal [XSA-491, CVE-2026-42487]
+- domctl lock open to abuse [XSA-492, CVE-2026-42489, CVE-2026-42490]
+- Arm: Completion of memory accesses not guaranteed by completion of a TLBI
+	 [XSA-493, CVE-2025-10263]
+- x86: mismatched mapcache metadata [XSA-494, CVE-2026-42488]
+
 * Tue May 12 2026 Michael Young <m.a.young@durham.ac.uk> - 4.20.3-3
 - x86: CPU Opcode Cache corruption [XSA-490,CVE-2025-54518]
 

diff --git a/xsa483.patch b/xsa483.patch
deleted file mode 100644
index 8ecb2e9..0000000
--- a/xsa483.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From: Andrii Sultanov <andriy.sultanov@vates.tech>
-Subject: tools/oxenstored: Reset quota when resetting permissions
-
-The quota object contains both limits and the current node usage counts.
-
-When a domain is torn down, the node data itself is cleaned up but the node
-usage counts are not.  A later domain reusing the same domid can create fewer
-nodes before being deemed to be over quota.
-
-Reset the count when the node permissions are cleaned up.
-
-This is XSA-483 / CVE-2026-23556.
-
-Signed-off-by: Andrii Sultanov <andriy.sultanov@vates.tech>
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-
-diff --git a/tools/ocaml/xenstored/store.ml b/tools/ocaml/xenstored/store.ml
-index 9b8dd2812df0..aa9204ead3ec 100644
---- a/tools/ocaml/xenstored/store.ml
-+++ b/tools/ocaml/xenstored/store.ml
-@@ -465,7 +465,8 @@ let reset_permissions store domid =
-         if perms <> node.perms then
-           Logging.debug "store|node" "Changed permissions for node %s" (Node.get_name node);
-         Some { node with Node.perms }
--    ) store.root
-+    ) store.root;
-+  store.quota <- Quota.del store.quota domid
- 
- type ops = {
-   store: t;

diff --git a/xsa484.patch b/xsa484.patch
deleted file mode 100644
index 522549e..0000000
--- a/xsa484.patch
+++ /dev/null
@@ -1,89 +0,0 @@
-From 3d0d19ad17f29c64dde4a7baf392da4fd58f3654 Mon Sep 17 00:00:00 2001
-From: Juergen Gross <jgross@suse.com>
-Date: Mon, 16 Mar 2026 15:06:11 +0100
-Subject: [PATCH] tools/xenstored: make conn_delete_all_transactions()
- idempotent
-
-conn_delete_all_transactions() should be callable in any context,
-resetting ALL transaction related data.
-
-This includes number of active transactions and the transaction
-pointer in struct connection.
-
-So reset conn->trans to NULL in conn_delete_all_transactions() and
-do the cleanup for each transaction in destroy_transaction().
-
-This avoids triggering the assert() in conn_delete_all_transactions()
-in case e.g. ignore_connection() was called while an operation inside
-a transaction was performed, or XS_RESET_WATCHES was called in a
-transaction.
-
-This is XSA-484 / CVE-2026-23557.
-
-Reported-by: Andrii Sultanov <andriy.sultanov@vates.tech>
-Fixes: 1f9d04fb021c ("xenstored: allow guest to shutdown all its watches/transactions")
-Signed-off-by: Juergen Gross <jgross@suse.com>
----
- tools/xenstored/transaction.c | 20 +++++++++-----------
- 1 file changed, 9 insertions(+), 11 deletions(-)
-
-diff --git a/tools/xenstored/transaction.c b/tools/xenstored/transaction.c
-index 167cd597fd..0825c48859 100644
---- a/tools/xenstored/transaction.c
-+++ b/tools/xenstored/transaction.c
-@@ -432,17 +432,23 @@ static int finalize_transaction(struct connection *conn,
- static int destroy_transaction(void *_transaction)
- {
- 	struct transaction *trans = _transaction;
-+	struct connection *conn = trans->conn;
- 	struct accessed_node *i;
- 
- 	wrl_ntransactions--;
- 	trace_destroy(trans, "transaction");
- 	while ((i = list_top(&trans->accessed, struct accessed_node, list))) {
- 		if (i->ta_node)
--			db_delete(trans->conn, i->trans_name, NULL);
-+			db_delete(conn, i->trans_name, NULL);
- 		list_del(&i->list);
- 		talloc_free(i);
- 	}
- 
-+	list_del(&trans->list);
-+	domain_transaction_dec(conn);
-+	if (list_empty(&conn->transaction_list))
-+		conn->ta_start_time = 0;
-+
- 	return 0;
- }
- 
-@@ -523,10 +529,6 @@ int do_transaction_end(const void *ctx, struct connection *conn,
- 		return ENOENT;
- 
- 	conn->transaction = NULL;
--	list_del(&trans->list);
--	domain_transaction_dec(conn);
--	if (list_empty(&conn->transaction_list))
--		conn->ta_start_time = 0;
- 
- 	chk_quota = trans->node_created && domain_is_unprivileged(conn);
- 
-@@ -572,14 +574,10 @@ void conn_delete_all_transactions(struct connection *conn)
- 	struct transaction *trans;
- 
- 	while ((trans = list_top(&conn->transaction_list,
--				 struct transaction, list))) {
--		list_del(&trans->list);
-+				 struct transaction, list)))
- 		talloc_free(trans);
--	}
--
--	assert(conn->transaction == NULL);
- 
--	conn->ta_start_time = 0;
-+	conn->transaction = NULL;
- }
- 
- int check_transactions(struct hashtable *hash)
--- 
-2.53.0
-

diff --git a/xsa486.patch b/xsa486.patch
deleted file mode 100644
index 654e957..0000000
--- a/xsa486.patch
+++ /dev/null
@@ -1,181 +0,0 @@
-From: Jan Beulich <jbeulich@suse.com>
-Subject: gnttab: split gnttab_map_frame()
-
-If a domain tries to map status frames in parallel to switching grant
-table version from 2 to 1, the mapping operation may put in place P2M
-entries referencing MFNs which gnttab_unpopulate_status_frames() is in the
-process of freeing.
-
-Ideally we would refcount pages when entered into P2M tables, but that's a
-significant change. Extend the grant-table-locked region instead in
-xenmem_add_to_physmap_one() (being the sole caller of gnttab_map_frame()),
-such that a race with gnttab_unpopulate_status_frames() is no longer
-possible.
-
-This is XSA-486 / CVE-2026-23558.
-
-Fixes: 5ce8fafa947c ("Dynamic grant-table sizing")
-Fixes: a98dc13703e0 ("Introduce a grant_entry_v2 structure")
-Reported-by: Rafal Wojtczuk <rafal.wojtczuk@7bulls.com>
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
-
---- a/xen/arch/arm/mm.c
-+++ b/xen/arch/arm/mm.c
-@@ -174,12 +174,10 @@ int xenmem_add_to_physmap_one(
-     switch ( space )
-     {
-     case XENMAPSPACE_grant_table:
--        rc = gnttab_map_frame(d, idx, gfn, &mfn);
-+        rc = gnttab_map_frame_begin(d, idx, gfn, &mfn);
-         if ( rc )
-             return rc;
- 
--        /* Need to take care of the reference obtained in gnttab_map_frame(). */
--        page = mfn_to_page(mfn);
-         t = p2m_ram_rw;
- 
-         break;
-@@ -281,10 +279,23 @@ int xenmem_add_to_physmap_one(
-      * to drop the reference we took earlier. In all other cases we need to
-      * drop any reference we took earlier (perhaps indirectly).
-      */
--    if ( space == XENMAPSPACE_gmfn_foreign ? rc : page != NULL )
-+    switch ( space )
-     {
-+    default:
-+        if ( page )
-+            put_page(page);
-+        break;
-+
-+    case XENMAPSPACE_grant_table:
-+        gnttab_map_frame_end(d, mfn);
-+        break;
-+
-+    case XENMAPSPACE_gmfn_foreign:
-+        if ( !rc )
-+            break;
-         ASSERT(page != NULL);
-         put_page(page);
-+        break;
-     }
- 
-     return rc;
---- a/xen/arch/x86/mm/p2m.c
-+++ b/xen/arch/x86/mm/p2m.c
-@@ -2009,11 +2009,9 @@ int xenmem_add_to_physmap_one(
-         break;
- 
-     case XENMAPSPACE_grant_table:
--        rc = gnttab_map_frame(d, idx, gfn, &mfn);
-+        rc = gnttab_map_frame_begin(d, idx, gfn, &mfn);
-         if ( rc )
-             return rc;
--        /* Need to take care of the reference obtained in gnttab_map_frame(). */
--        page = mfn_to_page(mfn);
-         break;
- 
-     case XENMAPSPACE_gmfn:
-@@ -2095,19 +2093,28 @@ int xenmem_add_to_physmap_one(
-     put_gfn(d, gfn_x(gfn));
- 
-  put_both:
--    /*
--     * In the XENMAPSPACE_gmfn case, we took a ref of the gfn at the top.
--     * We also may need to transfer ownership of the page reference to our
--     * caller.
--     */
--    if ( space == XENMAPSPACE_gmfn )
-+    switch ( space )
-     {
-+    case XENMAPSPACE_gmfn:
-+        /*
-+         * We took a ref of the gfn at the top.  We also may need to transfer
-+         * ownership of the page reference to our caller.
-+         */
-         put_gfn(d, gmfn);
-         if ( !rc && extra.ppage )
-         {
-             *extra.ppage = page;
-             page = NULL;
-         }
-+        break;
-+
-+    case XENMAPSPACE_grant_table:
-+        /*
-+         * We (gnttab_map_frame_begin()) acquired a lock and took a ref of the
-+         * page underlying the MFN at the top.
-+         */
-+        gnttab_map_frame_end(d, mfn);
-+        break;
-     }
- 
-     if ( page )
---- a/xen/common/grant_table.c
-+++ b/xen/common/grant_table.c
-@@ -4250,7 +4250,8 @@ int gnttab_acquire_resource(
-     return rc;
- }
- 
--int gnttab_map_frame(struct domain *d, unsigned long idx, gfn_t gfn, mfn_t *mfn)
-+int gnttab_map_frame_begin(
-+    struct domain *d, unsigned long idx, gfn_t gfn, mfn_t *mfn)
- {
-     int rc = 0;
-     struct grant_table *gt = d->grant_table;
-@@ -4288,11 +4289,19 @@ int gnttab_map_frame(struct domain *d, u
-             put_page(pg);
-     }
- 
--    grant_write_unlock(gt);
-+    if ( rc )
-+        grant_write_unlock(d->grant_table);
- 
-     return rc;
- }
- 
-+void gnttab_map_frame_end(struct domain *d, mfn_t mfn)
-+{
-+    put_page(mfn_to_page(mfn));
-+
-+    grant_write_unlock(d->grant_table);
-+}
-+
- static void gnttab_usage_print(struct domain *rd)
- {
-     int first = 1;
---- a/xen/include/xen/grant_table.h
-+++ b/xen/include/xen/grant_table.h
-@@ -60,8 +60,13 @@ int gnttab_release_mappings(struct domai
- int mem_sharing_gref_to_gfn(struct grant_table *gt, grant_ref_t ref,
-                             gfn_t *gfn, uint16_t *status);
- 
--int gnttab_map_frame(struct domain *d, unsigned long idx, gfn_t gfn,
--                     mfn_t *mfn);
-+/*
-+ * These need to be used as a pair, as the first (in the success case) returns
-+ * with a lock and page reference held which the second needs to drop.
-+ */
-+int gnttab_map_frame_begin(struct domain *d, unsigned long idx, gfn_t gfn,
-+                           mfn_t *mfn);
-+void gnttab_map_frame_end(struct domain *d, mfn_t mfn);
- 
- unsigned int gnttab_resource_max_frames(const struct domain *d, unsigned int id);
- 
-@@ -100,12 +105,14 @@ static inline int mem_sharing_gref_to_gf
-     return -EINVAL;
- }
- 
--static inline int gnttab_map_frame(struct domain *d, unsigned long idx,
--                                   gfn_t gfn, mfn_t *mfn)
-+static inline int gnttab_map_frame_begin(struct domain *d, unsigned long idx,
-+                                         gfn_t gfn, mfn_t *mfn)
- {
-     return -EINVAL;
- }
- 
-+static inline void gnttab_map_frame_end(struct domain *d, mfn_t mfn) {}
-+
- static inline unsigned int gnttab_resource_max_frames(
-     const struct domain *d, unsigned int id)
- {

diff --git a/xsa490-4.21.patch b/xsa490-4.21.patch
deleted file mode 100644
index 5a560cb..0000000
--- a/xsa490-4.21.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From: Andrew Cooper <andrew.cooper3@citrix.com>
-Subject: x86/amd: Mitigate AMD-SN-7052
-
-This is XSA-490 / CVE-2025-54518.
-
-Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
-Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
-
-diff --git a/xen/arch/x86/cpu/amd.c b/xen/arch/x86/cpu/amd.c
-index 1bb0766ebf13..b5bf2b732e8f 100644
---- a/xen/arch/x86/cpu/amd.c
-+++ b/xen/arch/x86/cpu/amd.c
-@@ -1116,11 +1116,25 @@ static void amd_check_bp_cfg(void)
- {
- 	uint64_t val, new = 0;
- 
--	/*
--	 * AMD Erratum #1485.  Set bit 5, as instructed.
--	 */
--	if (!cpu_has_hypervisor && boot_cpu_data.x86 == 0x19 && is_zen4_uarch())
--		new |= (1 << 5);
-+	if (!cpu_has_hypervisor) {
-+		/*
-+		 * AMD Erratum #1485.  If SMT is enabled and STIBP disabled,
-+		 * the CPU may fetch incorrect instruction bytes.
-+		 *
-+		 * Set bit 5, as instructed.
-+		 */
-+		if (boot_cpu_data.x86 == 0x19 && is_zen4_uarch())
-+			new |= (1 << 5);
-+
-+		/*
-+		 * AMD SB-7052.  CPU OP Cache corruption, causing instructions
-+		 * to be executed at a higher privilege.
-+		 *
-+		 * Set bit 33, as instructed.
-+		 */
-+		if (boot_cpu_data.x86 == 0x17 && is_zen2_uarch())
-+			new |= (1UL << 33);
-+	}
- 
- 	/*
- 	 * On hardware supporting SRSO_MSR_FIX, activate BP_SPEC_REDUCE by