We are pleased to announce the release of Xen 4.12.3. This is available immediately from its git repository

https://xenbits.xenproject.org/gitweb/?p=xen.git;a=shortlog;h=refs/heads/stable-4.12 (tag RELEASE-4.12.3) or from this download page

This release contains the following bug-fixes and improvements in the Xen Project hypervisor:

• 09b61126b4: update Xen version to 4.12.3 [Jan Beulich]
• c26841f0aa: x86/ucode/intel: Writeback and invalidate caches before updating microcode [Ashok Raj]
• 2291b9795e: x86/traps: fix an off-by-one error [Hongyan Xia]
• d461833db8: x86/hvm: simplify hvm_physdev_op allowance control [Roger Pau Monné]
• c85cb312b9: x86emul: extend x86_insn_is_mem_write() coverage [Jan Beulich]
• 0d1c383c8f: x86/pass-through: avoid double IRQ unbind during domain cleanup [Jan Beulich]
• 9756cbede6: xen/grants: fix hypercall continuation for GNTTABOP_cache_flush [Juergen Gross]
• e43fc14ec5: libxc/restore: Fix REC_TYPE_X86_PV_VCPU_XSAVE data auditing (take 2) [Andrew Cooper]
• 288872ad3b: libxc/restore: Fix data auditing in handle_x86_pv_vcpu_blob() [Andrew Cooper]
• 275475f1e8: libxc/restore: Fix data auditing in handle_x86_pv_info() [Andrew Cooper]
• 66998bdd52: libxc/restore: Fix error message for unrecognised stream version [Andrew Cooper]
• a997ffe678: tools/xenstore: fix a use after free problem in xenstored [Juergen Gross]
• d1c9822b88: libxl: Fix comment about dcs.sdss [Anthony PERARD]
• 5c56ea1f22: docs/misc: pvcalls: Verbatim block should be indented with 4 spaces [Julien Grall]
• daf71f0053: docs: document CONTROL command of xenstore protocol [Juergen Gross]
• 5c1b607e8a: docs: add DIRECTORY_PART specification do xenstore protocol doc [Juergen Gross]
• e6a2681148: build,xsm: fix multiple call [Anthony PERARD]
• d32cbbc141: x86: validate VM assist value in arch_set_info_guest() [Jan Beulich]
• 8d2ea0f4c8: x86/HVM: expose VM assist hypercall [Jan Beulich]
• a6366e0f88: x86: Enumeration for Control-flow Enforcement Technology [Andrew Cooper]
• 55d65346d7: x86/vtd: relax EPT page table sharing check [Roger Pau Monné]
• 6bf8bdd5c6: hvmloader: enable MMIO and I/O decode, after all resource allocation [Harsha Shamsundara Havanur]
• e8032787d4: x86/boot: Fix early exception handling with CONFIG_PERF_COUNTERS [Andrew Cooper]
• 499a2944d7: x86/EFI: also fill boot_tsc_stamp on the xen.efi boot path [Jan Beulich]
• 3536f8dc39: gnttab: fix GNTTABOP_copy continuation handling [Jan Beulich]
• 46bde0561b: xen/gnttab: Fix error path in map_grant_ref() [Ross Lagerwall]
• 1541b26e84: xen/rwlock: Add missing memory barrier in the unlock path of rwlock [Julien Grall]
• 45624a7332: xenoprof: limit consumption of shared buffer data [Jan Beulich]
• dc3fb833c6: xenoprof: clear buffer intended to be shared with guests [Jan Beulich]
• e8c8071f4a: xen/arm: Sign extend TimerValue when computing the CompareValue [Jeff Kubascik]
• a46cd06d92: xen/arm: remove physical timer offset [Jeff Kubascik]
• 524e739a49: xen/arm: during efi boot, improve the check for usable memory [Stefano Stabellini]
• 36f810b33f: xen/arm: initialize vpl011 flag register [Jeff Kubascik]
• 752558e68e: xen/arm: Handle unimplemented VGICv3 registers as RAZ/WI [Jeff Kubascik]
• c1a1c4e8fb: credit2: fix credit reset happening too few times [Dario Faggioli]
• 4c69d1c2db: credit2: avoid vCPUs to ever reach lower credits than idle [Dario Faggioli]
• 9a082e14c6: x86/ucode/amd: Fix more potential buffer overruns with microcode parsing [Andrew Cooper]
• e282e87f15: x86/HVM: fix AMD ECS handling for Fam10 [Jan Beulich]
• f3264407d0: x86/ucode/amd: Fix potential buffer overrun with equiv table handling [Andrew Cooper]
• 736c67bc46: libx86/CPUID: fix (not just) leaf 7 processing [Jan Beulich]
• 94f0bb7c3f: x86/ucode: Fix error paths in apply_microcode() [Andrew Cooper]
• 4c187457d1: x86/shim: fix ballooning up the guest [Igor Druzhinin]
• 3c37292c84: x86/vPMU: don’t blindly assume IA32_PERF_CAPABILITIES MSR exists [Jan Beulich]
• 813757cf12: AMD/IOMMU: fix off-by-one in amd_iommu_get_paging_mode() callers [Jan Beulich]
• 824bdb432f: x86/msr: Virtualise MSR_PLATFORM_ID properly [Andrew Cooper]
• 30acb65fad: VT-d: check all of an RMRR for being E820-reserved [Jan Beulich]
• 2d86de43b1: x86/time: report correct frequency of Xen PV clocksource [Igor Druzhinin]
• c03afaef8f: x86/shim: suspend and resume platform time correctly [Igor Druzhinin]
• 3d89e04931: x86/smp: reset x2apic_enabled in smp_send_stop() [David Woodhouse]
• 95d956db4c: xen/pvh: Fix segment selector ABI [Andrew Cooper]
• b165d136b4: xmalloc: guard against integer overflow [Jan Beulich]
• 8663b6aa02: EFI: don’t leak heap contents through XEN_EFI_get_next_variable_name [Jan Beulich]
• 636b40dcd5: EFI: re-check {get,set}-variable name strings after copying in [Jan Beulich]
• 16803a643b: xen/x86: domctl: Don’t leak data via XEN_DOMCTL_gethvmcontext [Julien Grall]
• d32c575d91: x86/suspend: disable watchdog before calling console_start_sync() [Igor Druzhinin]
• e4f4127759: x86/apic: fix disabling LVT0 in disconnect_bsp_APIC [Roger Pau Monné]
• b9063ce924: VT-d: don’t pass bridge devices to domain_context_mapping_one() [Jan Beulich]
• 58d3a681b8: x86/sm{e, a}p: do not enable SMEP/SMAP in PV shim by default on AMD [Igor Druzhinin]
• a12589ffc2: x86/time: update TSC stamp on restore from deep C-state [Igor Druzhinin]
• 5454111f28: IRQ: u16 is too narrow for an event channel number [Jan Beulich]
• 7ee6e17a77: x86: clear per cpu stub page information in cpu_smpboot_free() [Juergen Gross]
• 71382e98e1: update Xen version to 4.12.3-pre [Jan Beulich]
• a5fcafbfbe: xen/arm: Place a speculation barrier sequence following an eret instruction [Julien Grall]

In addition, this release also contains the following fixes to qemu-traditional:

This release also contains changes to qemu-upstream, whose changelogs we do not list here as it contains many changes that are not directly releated to the Xen Project Hypervisor and thus this release. However, you can check https://xenbits.xenproject.org/gitweb/?p=qemu-xen.git;a=shortlog (between tags qemu-xen-4.12.2 and qemu-xen-4.12.3).

This release, which includes source code for qemu-traditional and qemu-upstream, contains the following security fixes.

See https://xenbits.xenproject.org/xsa/ for details related to Xen Project security advisories.

We recommend all users of the 4.12 stable series to update to this latest point release.