Skip to main content


Xen Project 4.8.4

We are pleased to announce the release of Xen 4.8.4. This is available immediately from its git repository;a=shortlog;h=refs/heads/stable-4.8 (tag RELEASE-4.8.4) or from this download page
This release contains the following bug-fixes and improvements in the Xen Project hypervisor:

  • 4801bf528c: update Xen version to 4.8.4 [Jan Beulich]
  • e39ff386f6: x86/HVM: don’t cause #NM to be raised in Xen [Jan Beulich]
  • 321254a107: libxl: restore passing “readonly=” to qemu for SCSI disks [Ian Jackson]
  • 500d567b08: libxl: qemu_disk_scsi_drive_string: Break out common parts of disk config [Ian Jackson]
  • 5fd28d27d3: x86: Refine checks in #DB handler for faulting conditions [Andrew Cooper]
  • d6154125d7: x86/mm: don’t bypass preemption checks [Jan Beulich]
  • 9a7fa685f9: x86/EFI: further correct FPU state handling around runtime calls [Jan Beulich]
  • b736afdea4: x86/EFI: fix FPU state handling around runtime calls [Jan Beulich]
  • b9b9d9ed1d: x86: correct default_xen_spec_ctrl calculation [Jan Beulich]
  • 028656f042: libxc/x86/PV: don’t hand through CPUID leaf 0x80000008 as is [Jan Beulich]
  • c1aaad5627: x86/spec-ctrl: Mitigations for LazyFPU [Andrew Cooper]
  • c5a56920e8: x86: Support fully eager FPU context switching [Andrew Cooper]
  • 1522a81ace: x86: don’t enable XPTI on idle domain [Jan Beulich]
  • 37b3dfdeef: x86: re-enable XPTI/PCID as needed in switch_native() [Jan Beulich]
  • f8a489fca1: xen/x86: use PCID feature [Juergen Gross]
  • 0954b1107d: xen/x86: add some cr3 helpers [Juergen Gross]
  • 266d5118ae: xen/x86: convert pv_guest_cr4_to_real_cr4() to a function [Juergen Gross]
  • 2d97baac10: xen/x86: use flag byte for decision whether xen_cr3 is valid [Juergen Gross]
  • 61fc6a4ec4: xen/x86: disable global pages for domains with XPTI active [Juergen Gross]
  • 73b68d2f50: xen/x86: use invpcid for flushing the TLB [Juergen Gross]
  • 811c1686b4: xen/x86: support per-domain flag for xpti [Juergen Gross]
  • eef72b8c50: xen/x86: add a function for modifying cr3 [Juergen Gross]
  • ae0a87e113: x86/xpti: avoid copying L4 page table contents when possible [Juergen Gross]
  • b494c139a2: x86: invpcid support [Wei Liu]
  • c36aaca821: x86: move invocations of hvm_flush_guest_tlbs() [Jan Beulich]
  • 1afb8947fe: x86/XPTI: fix S3 resume (and CPU offlining in general) [Jan Beulich]
  • 845d2b63e6: x86/msr: Virtualise MSR_SPEC_CTRL.SSBD for guests to use [Andrew Cooper]
  • 9d7358638d: x86/Intel: Mitigations for GPZ SP4 – Speculative Store Bypass [Andrew Cooper]
  • 7f4ae1612a: x86/AMD: Mitigations for GPZ SP4 – Speculative Store Bypass [Andrew Cooper]
  • 05b41f25d0: x86/spec_ctrl: Introduce a new `spec-ctrl=` command line argument to replace `bti=` [Andrew Cooper]
  • 618a96ea32: x86/cpuid: Improvements to guest policies for speculative sidechannel features [Andrew Cooper]
  • 455a429dd4: x86/spec_ctrl: Explicitly set Xen’s default MSR_SPEC_CTRL value [Andrew Cooper]
  • 1fd1973f94: x86/spec_ctrl: Split X86_FEATURE_SC_MSR into PV and HVM variants [Andrew Cooper]
  • ef14d39d4f: x86/spec_ctrl: Elide MSR_SPEC_CTRL handling in idle context when possible [Andrew Cooper]
  • c696ef0f39: x86/spec_ctrl: Rename bits of infrastructure to avoid NATIVE and VMEXIT [Andrew Cooper]
  • 68d02a7628: x86/spec_ctrl: Fold the XEN_IBRS_{SET,CLEAR} ALTERNATIVES together [Andrew Cooper]
  • b0ea18ed5b: x86/spec_ctrl: Merge bti_ist_info and use_shadow_spec_ctrl into spec_ctrl_flags [Andrew Cooper]
  • e60a287bf8: x86/spec_ctrl: Express Xen’s choice of MSR_SPEC_CTRL value as a variable [Andrew Cooper]
  • 9419337e44: x86/spec_ctrl: Read MSR_ARCH_CAPABILITIES only once [Andrew Cooper]
  • cc0bb3b484: x86: Fix “x86: further CPUID handling adjustments” [Andrew Cooper]
  • 197e605e03: libacpi: fixes for iasl >= 20180427 [Roger Pau Monné]
  • eaa9d0a9ae: xen/schedule: Fix races in vcpu migration [George Dunlap]
  • d66898a15d: xen: Introduce vcpu_sleep_nosync_locked() [George Dunlap]
  • f2837b5f11: x86/cpuidle: don’t init stats lock more than once [Jan Beulich]
  • 0f475fedfc: x86/SVM: Fix intercepted {RD,WR}MSR for the SYS{CALL,ENTER} MSRs [Andrew Cooper]
  • 210bd51a2e: xpti: fix bug in double fault handling [Juergen Gross]
  • b4ad8a6f15: x86/HVM: never retain emulated insn cache when exiting back to guest [Jan Beulich]
  • 4cdd4cc106: x86/HPET: fix race triggering ASSERT(cpu < nr_cpu_ids) [David Wang]
  • 193130f53f: x86/spec_ctrl: Updates to retpoline-safety decision making [Andrew Cooper]
  • 7f2959f8f6: x86: suppress BTI mitigations around S3 suspend/resume [Jan Beulich]
  • 9cba9aeb4d: x86: correct ordering of operations during S3 resume [Jan Beulich]
  • f99bc153d2: x86/cpuid: fix raw FEATURESET_7d0 reporting [Sergey Dyasli]
  • 44c709e630: x86/emul: Fix emulator test harness build following a backport of 7c508612 [Andrew Cooper]
  • c10ddc1ff9: x86/emul: Fix emulator test harness build following a91b2ec337a [Andrew Cooper]
  • 2bef7bf7f3: x86/HVM: guard against emulator driving ioreq state in weird ways [Jan Beulich]
  • 326d25fcc7: x86/vpt: add support for IO-APIC routed interrupts [Xen Project Security Team]
  • 3f59d0b8bc: x86/traps: Fix handling of #DB exceptions in hypervisor context [Andrew Cooper]
  • a89390bd6a: x86/traps: Use an Interrupt Stack Table for #DB [Andrew Cooper] 40c4ab8a20: x86/pv: Move exception injection into {,compat_}test_all_events() [Andrew Cooper]
  • 90676b7df3: x86/traps: Fix %dr6 handing in #DB handler [Andrew Cooper]
  • 1052a2168e: x86: fix slow int80 path after XPTI additions [Jan Beulich]
  • a2f02dfdcb: libxl: Specify format of inserted cdrom [Anthony PERARD]
  • 501718a68c: x86/msr: Correct the emulation behaviour of MSR_PRED_CMD [Andrew Cooper]
  • 957ff3006e: x86/VT-x: Fix determination of EFER.LMA in vmcs_dump_vcpu() [Andrew Cooper]
  • 1e9ac23c93: x86/HVM: suppress I/O completion for port output [Jan Beulich]
  • 95befc64f1: x86/pv: Fix up erroneous segments for 32bit syscall entry [Andrew Cooper]
  • 372583c2dd: x86/XPTI: reduce .text.entry [Jan Beulich]
  • 202aaf8a58: x86: log XPTI enabled status [Jan Beulich]
  • e4e96320fc: x86: disable XPTI when RDCL_NO [Jan Beulich]
  • a753be1b4c: x86/pv: Fix the handing of writes to %dr7 [Andrew Cooper]
  • 8f9846f791: x86: further CPUID handling adjustments [Jan Beulich]
  • 0864795226: x86/emul: Fix backport of “x86/emul: Fix the decoding of segment overrides in 64bit mode” [Andrew Cooper]
  • 866dedabb3: x86/PV: also cover Dom0 in SPEC_CTRL / PRED_CMD emulation [Jan Beulich]
  • c67e19f030: x86: Move microcode loading earlier [Ross Lagerwall]
  • bc6414f735: x86/vlapic: clear TMR bit upon acceptance of edge-triggered interrupt to IRR [Liran Alon]
  • 883c8db61c: cpufreq/ondemand: fix race while offlining CPU [Jan Beulich]
  • 7db1c43a36: x86: remove CR reads from exit-to-guest path [Jan Beulich]
  • 813fe211f2: x86: slightly reduce Meltdown band-aid overhead [Jan Beulich]
  • 3cadc8bb84: x86/xpti: don’t map stack guard pages [Jan Beulich]
  • f7bf4d230a: x86/xpti: Hide almost all of .text and all .data/.rodata/.bss mappings [Andrew Cooper]
  • 14217cba9d: x86/apicv: fix wrong IPI suppression during posted interrupt delivery [Quan Xu]
  • ce185fbce2: x86: ignore guest microcode loading attempts [Jan Beulich]
  • a2700ca14e: libxl/arm: Fix build on arm64 + acpi [Daniel Sabogal]
  • b19b20690d: x86/HVM: don’t give the wrong impression of WRMSR succeeding [Jan Beulich]
  • a442d40e9b: x86/PV: fix off-by-one in I/O bitmap limit check [Jan Beulich]
  • 1901f62539: grant: Release domain lock on ‘map’ path in cache_flush [George Dunlap]
  • 1581910431: x86/pv: Avoid leaking other guests’ MSR_TSC_AUX values into PV context [Andrew Cooper]
  • 15f57b8612: x86/nmi: start NMI watchdog on CPU0 after SMP bootstrap [Igor Druzhinin]
  • 7ef31c0955: x86/srat: fix end calculation in nodes_cover_memory() [Jan Beulich]
  • bc8aa42842: x86/entry: Use 32bit xors rater than 64bit xors for clearing GPRs [Andrew Cooper]
  • 30a153d6db: x86/emul: Fix the decoding of segment overrides in 64bit mode [Andrew Cooper]
  • da9266448c: x86/spec_ctrl: Fix several bugs in SPEC_CTRL_ENTRY_FROM_INTR_IST [Andrew Cooper]
  • 6b08396e0b: x86/srat: fix the end pfn check in valid_numa_range() [Haozhong Zhang]
  • f6ae9c0398: x86: reduce Meltdown band-aid IPI overhead [Jan Beulich]
  • ad9ddc3ad1: x86/NMI: invert condition in nmi_show_execution_state() [Jan Beulich]
  • 22d2146e9b: x86/emul: Fix the emulation of invlpga [Andrew Cooper]
  • f9adc122b6: xen/arm: Flush TLBs before turning on the MMU to avoid stale entries [Julien Grall]
  • e27fd5c081: xen/arm: vgic: Make sure the number of SPIs is a multiple of 32 [Julien Grall]
  • 03f947472f: tools/libxc: Fix restoration of PV MSRs after migrate [Andrew Cooper]
  • c31070f350: tools/libxc: Avoid generating inappropriate zero-content records [Andrew Cooper]
  • 1093876034: x86/hvm: Disallow the creation of HVM domains without Local APIC emulation [Andrew Cooper]
  • 141be845d9: gnttab: don’t blindly free status pages upon version change [Jan Beulich]
  • bb49733646: gnttab/ARM: don’t corrupt shared GFN array [Jan Beulich]
  • 48faa5045d: memory: don’t implicitly unpin for decrease-reservation [Jan Beulich]
  • 5938aa17b4: x86/PV: correctly count MSRs to migrate [Jan Beulich]
  • d11783c992: xen/arm: cpuerrata: Actually check errata on non-boot CPUs [Julien Grall]
  • 8e1e3c7337: tools/kdd: don’t use a pointer to an unaligned field. [Tim Deegan]
  • 99ed7863b2: x86/idle: Clear SPEC_CTRL while idle [Andrew Cooper]
  • 76bdfe894a: x86/cpuid: Offer Indirect Branch Controls to guests [Andrew Cooper]
  • fee4689c5c: x86/ctxt: Issue a speculation barrier between vcpu contexts [Andrew Cooper]
  • c0bfde68cc: x86/boot: Calculate the most appropriate BTI mitigation to use [Andrew Cooper]
  • 64c1742b20: x86/entry: Avoid using alternatives in NMI/#MC paths [Andrew Cooper]
  • 86153856f8: x86/entry: Organise the clobbering of the RSB/RAS on entry to Xen [Andrew Cooper]
  • e09a5c2917: x86/entry: Organise the use of MSR_SPEC_CTRL at each entry/exit point [Andrew Cooper]
  • ff570a3ee0: x86/hvm: Permit guests direct access to MSR_{SPEC_CTRL,PRED_CMD} [Andrew Cooper]
  • e6bcb416a5: x86/migrate: Move MSR_SPEC_CTRL on migrate [Andrew Cooper]
  • 29e7171e9d: x86/msr: Emulation of MSR_{SPEC_CTRL,PRED_CMD} for guests [Andrew Cooper]
  • c3d195cd91: x86/cpuid: Handling of IBRS/IBPB, STIBP and IBRS for guests [Andrew Cooper]
  • 2cd189eb55: x86: fix GET_STACK_END [Wei Liu]
  • afdad6a958: x86/acpi: process softirqs while printing CPU ACPI data [Roger Pau Monné]
  • 532ccf4fd5: x86/cmdline: Introduce a command line option to disable IBRS/IBPB, STIBP and IBPB [Andrew Cooper]
  • da49e518d7: x86/feature: Definitions for Indirect Branch Controls [Andrew Cooper]
  • ca9583d9e7: x86: Introduce alternative indirect thunks [Andrew Cooper]
  • 479b879a7d: x86/amd: Try to set lfence as being Dispatch Serialising [Andrew Cooper]
  • 2eefd926bb: x86/boot: Report details of speculative mitigations [Andrew Cooper]
  • 60c50f2b0b: x86: Support indirect thunks from assembly code [Andrew Cooper]
  • 1838e21521: x86: Support compiling with indirect branch thunks [Andrew Cooper]
  • 5732a8ef28: common/wait: Clarifications to wait infrastructure [Andrew Cooper]
  • 987b08d56c: x86/entry: Erase guest GPR state on entry to Xen [Andrew Cooper]
  • eadcd8318c: x86/hvm: Use SAVE_ALL to construct the cpu_user_regs frame after VMExit [Andrew Cooper]
  • ef2464c56e: x86/entry: Rearrange RESTORE_ALL to restore register in stack order [Andrew Cooper]
  • 17bfbc8289: x86: Introduce a common cpuid_policy_updated() [Andrew Cooper]
  • 499391b50b: x86/hvm: Rename update_guest_vendor() callback to cpuid_policy_changed() [Andrew Cooper]
  • 87cb0e2090: x86/alt: Introduce ALTERNATIVE{,_2} macros [Andrew Cooper]
  • 393de92181: update Xen version to 4.8.4-pre [Jan Beulich]
  • 3efcd7fb40: x86/alt: Break out alternative-asm into a separate header file [Andrew Cooper]
  • 2aff8d5e73: x86: Avoid corruption on migrate for vcpus using CPUID Faulting [Andrew Cooper]
  • 11875b7d57: xen/arm32: entry: Document the purpose of r11 in the traps handler [Julien Grall]
  • 1105f3a92d: xen/arm32: Invalidate icache on guest exist for Cortex-A15 [Julien Grall]
  • 754345c019: xen/arm32: Invalidate BTB on guest exit for Cortex A17 and 12 [Julien Grall]
  • 7336d0d2a7: xen/arm32: Add skeleton to harden branch predictor aliasing attacks [Julien Grall]
  • cf95bba7b7: xen/arm32: entry: Add missing trap_reset entry [Julien Grall]
  • a586cbd9f0: xen/arm32: Add missing MIDR values for Cortex-A17 and A12 [Julien Grall]
  • 6082e3ba89: xen/arm32: entry: Consolidate DEFINE_TRAP_ENTRY_* macros [Julien Grall]
  • 6f6786ef0d: xen/arm64: Implement branch predictor hardening for affected Cortex-A CPUs [Julien Grall]
  • 44139fed7c: xen/arm64: Add skeleton to harden the branch predictor aliasing attacks [Julien Grall]
  • cf0b584c8c: xen/arm: cpuerrata: Add MIDR_ALL_VERSIONS [Julien Grall]
  • 85990bf53a: xen/arm64: Add missing MIDR values for Cortex-A72, A73 and A75 [Julien Grall]
  • 946dd2eefa: xen/arm: Introduce enable callback to enable a capabilities on each online CPU [Julien Grall]

This release contains no fixes to fixes to qemu-traditional or qemu-upstream.

This release, which includes source code for qemu-traditional and qemu-upstream, contains the following security fixes.

XSA-253Xen 4.8 not affected......
XSA-254Applied (XPTI for Variant 3)N/AN/A
XSA-257Unused XSA number......

See for details related to Xen Project security advisories.
We recommend all users of the 4.8 stable series to update to this latest point release.