xen (4.20.2+37-g61ff35323e-1ubuntu1) stonking; urgency=medium

  * Cherry-pick upstream fix for glib 2.43
    d/p/44da0e3b4ff7fa15ad28b628f57412a05dae653c.patch

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Mon, 06 Jul 2026 09:46:14 +0200

xen (4.20.2+37-g61ff35323e-1) unstable; urgency=medium

  * Update to new upstream version 4.20.2+37-g61ff35323e, which also contains
    security fixes for the following issues:
    - x86: buffer overrun with shadow paging + tracing
      XSA-477 CVE-2025-58150
    - x86: incomplete IBPB for vCPU isolation
      XSA-479 CVE-2026-23553
  * Note that the following XSA are not listed, because...
    - XSA-478 applies to XAPI which is not included in Debian
  * Pick upstream commit 1ecb5946bd ("xen/arm: Set ThumbEE as not present in
    PFR0") which is an additional fix for the ThumbEE commit picked in
    previous upload.

 -- Hans van Kranenburg <hans@knorrie.org>  Fri, 13 Feb 2026 20:43:00 +0100

xen (4.20.2+7-g1badcf5035-2) unstable; urgency=medium

  * d/rules: simplify for make 4.4
  * d/control: Update Standards-Version to 4.7.2
  * Pick upstream commit 5bbe1fe413 ("ARM: Drop ThumbEE support") to fix a
    FTBFS on arm64. (Closes: #1122070)

 -- Maximilian Engelhardt <maxi@daemonizer.de>  Sun, 07 Dec 2025 13:47:17 +0100

xen (4.20.2+7-g1badcf5035-1) unstable; urgency=medium

  Significant changes:
  * Update to new upstream version 4.20.2+7-g1badcf5035, which also contains
    security fixes for the following issues:
    (Closes: #1105193) (Closes: #1120075)
    - x86: Indirect Target Selection
      XSA-469 CVE-2024-28956
    - x86: Incorrect stubs exception handling for flags recovery
      XSA-470 CVE-2025-27465
    - x86: Transitive Scheduler Attacks
      XSA-471 CVE-2024-36350 CVE-2024-36357
    - Multiple vulnerabilities in the Viridian interface
      XSA-472 CVE-2025-27466 CVE-2025-58142 CVE-2025-58143
    - Arm issues with page refcounting
      XSA-473 CVE-2025-58144 CVE-2025-58145
    - x86: Incorrect input sanitisation in Viridian hypercalls
      XSA-475 CVE-2025-58147 CVE-2025-58148
    - Incorrect removal of permissions on PCI device unplug
      XSA-476 CVE-2025-58149
  * Note that the following XSA are not listed, because...
    - XSA-468 applies to Windows PV drivers
    - XSA-474 applies to XAPI which is not included in Debian

  Packaging minor fixes and improvements:
  * debian/salsa-ci.yml: adjust for new salsa-ci pipeline

 -- Maximilian Engelhardt <maxi@daemonizer.de>  Fri, 28 Nov 2025 00:14:24 +0100

xen (4.20.0+68-g35cb38b222-1) unstable; urgency=medium

  * Update to new upstream version 4.20.0+68-g35cb38b222.

 -- Hans van Kranenburg <hans@knorrie.org>  Mon, 05 May 2025 19:24:56 +0200

xen (4.20.0-1) unstable; urgency=medium

  * Update to new upstream version 4.20.0, which also contains
    security fixes for the following issues:
    - deadlock potential with VT-d and legacy PCI device pass-through
      XSA-467 CVE-2025-1713
  * disable dh_dwz as it's of limited use and breaks our build
  * Upload to unstable

 -- Maximilian Engelhardt <maxi@daemonizer.de>  Thu, 06 Mar 2025 09:10:56 +0100

xen (4.20.0~rc2+1-gfcde5e0de8-1~exp1) experimental; urgency=medium

  Significant changes:
  * Update to new upstream version 4.20.0~rc2+1-gfcde5e0de8.

  Changes related to upgrading to Xen 4.20:
  * debian/control: adjust to 4.20
  * Refresh remaining patches if needed
  * debian: ship the new xsd_glue ocaml plugin in xen-utils-V

  Packaging minor fixes and improvements:
  * d/copyright: update year to 2025
  * debian: convert xen-doc to architecture all
  * d/control: mark libxen-dev as Multi-Arch: same
  * d/control: remove versioned dpkg-dev from Build-Depends
  * d/rules: remove environment variables no longer needed for reproducible
    builds
  * d/rules: disable debug build for xen tools
  * update lintian overrides

 -- Maximilian Engelhardt <maxi@daemonizer.de>  Sat, 08 Feb 2025 22:55:56 +0100

xen (4.19.1-1) unstable; urgency=medium

  * Upload to unstable (Closes: #1089033)
  * Pick upstream commit e6472d46680c ("tools/xg: increase LZMA_BLOCK_SIZE for
    uncompressing the kernel") to fix decompressing Linux 6.12 when starting
    in PV mode.
  * Note that the following XSA were not listed, because...
    - XSA-465 has patches for the Linux kernel.
    - XSA-466 contains a documentation update that was only applied to the
      current development version of Xen

 -- Hans van Kranenburg <hans@knorrie.org>  Sat, 21 Dec 2024 11:33:16 +0100

xen (4.19.1-1~exp4) experimental; urgency=medium

  * Upload again, with binaries this time.

 -- Sean Whitton <spwhitton@spwhitton.name>  Sat, 21 Dec 2024 11:43:57 +0800

xen (4.19.1-1~exp3) experimental; urgency=medium

  * d/copyright: Fix invalid "-present" copyright years. (Closes: #1089621)

 -- Hans van Kranenburg <hans@knorrie.org>  Fri, 20 Dec 2024 17:00:44 +0100

xen (4.19.1-1~exp2) experimental; urgency=medium

  * Drop support for armhf (Closes: #989560)
    - src:xen now FTBFS on armhf because OCaml 5.x has no support for native
      compilation on 32-bit systems any more.
    - As seen in #989560, Xen on armhf was already dysfunctional for years
    - The team does not have resources or knowledge to support the armhf build

  [ Maximilian Engelhardt ]

  * d/control: Add Maximilian Engelhardt to Uploaders
  * d/copyright: Specify correct years for authors of debian/*
  * debian: undo ABI-stable t64 package renaming

 -- Hans van Kranenburg <hans@knorrie.org>  Mon, 16 Dec 2024 22:01:57 +0100

xen (4.19.1-1~exp1) experimental; urgency=medium

  * Update to new upstream version 4.19.1, which also contains
    security fixes for the following issues:
    - x86: Deadlock in vlapic_error()
      XSA-462 CVE-2024-45817
    - Deadlock in x86 HVM standard VGA handling
      XSA-463 CVE-2024-45818
    - libxl leaks data to PVH guests via ACPI tables
      XSA-464 CVE-2024-45819
  * Fix compilation on arm64 and armhf with upstream commit ee826bc490
    ("Arm64: adjust __irq_to_desc() to fix build with gcc14")

 -- Maximilian Engelhardt <maxi@daemonizer.de>  Sun, 15 Dec 2024 13:52:56 +0100

xen (4.19.0+14-g0918434e0f-1~exp1) experimental; urgency=medium

  Significant changes:
  * Update to new upstream version 4.19.0+14-g0918434e0f, which also contains
    security fixes for the following issues:
    - x86: Register File Data Sampling
      XSA-452 CVE-2023-28746
    - GhostRace: Speculative Race Conditions
      XSA-453 CVE-2024-2193
    - x86 HVM hypercalls may trigger Xen bug check
      XSA-454 CVE-2023-46842
    - x86: Incorrect logic for BTC/SRSO mitigations
      XSA-455 CVE-2024-31142
    - x86: Native Branch History Injection
      XSA-456 CVE-2024-2201
    - double unlock in x86 guest IRQ handling
      XSA-458 CVE-2024-31143
    - error handling in x86 IOMMU identity mapping
      XSA-460 CVE-2024-31145
    - PCI device pass-through with shared resources
      XSA-461 CVE-2024-31146
  * Note that the following XSA are not listed, because...
    - XSA-457 has patches for the Linux kernel.
    - XSA-459 is within Xapi which is not shipped by this package.
  * Fix compilation with OCaml 5.2.0 (Closes: #1073913)

  Changes related to upgrading to Xen 4.19:
  * debian/control: adjust to 4.19
  * debian/copyright: update for xen 4.19
  * Refresh remaining patches if needed

  Packaging minor fixes and improvements:
  * debian/control: remove old version constraints and cleanup
  * debian/control: update Standards-Version to 4.7.0
  * debian/control: add python3-setuptools dependency
  * debian/rules: cleanup and improved comments
  * debian/rules: enable parallel build
  * debian/rules: move xenstore-control to xen-utils-common (Closes: #1036601)
  * debian: ship systemd service files for xen and xendomains
    (Closes: #1029998)
  * docs/Makefile: Work around a reproducibility issue by generating
    documentation for ppc and riscv architectures.

 -- Maximilian Engelhardt <maxi@daemonizer.de>  Mon, 09 Sep 2024 12:05:47 +0200

xen (4.17.3+36-g54dacb5c02-1) unstable; urgency=medium

  * Update to new upstream version 4.17.3+36-g54dacb5c02, which also contains
    security fixes for the following issues:
    - x86: shadow stack vs exceptions from emulation stubs
      XSA-451 CVE-2023-46841
  * Properly incorporate NMU changes.
  * Pick upstream commit b33a5c5929 ("tools/xenstore/xenstored_control.c:
    correctly print time_t") to fix a FTBFS on armhf with 64 bits time_t.
    (Closes: #1065794)

 -- Hans van Kranenburg <hans@knorrie.org>  Sat, 09 Mar 2024 22:03:11 +0100

xen (4.17.3+10-g091466ba55-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Rename libraries for 64-bit time_t transition.  Closes: #1063270

 -- Steve Langasek <vorlon@debian.org>  Thu, 29 Feb 2024 07:08:41 +0000

xen (4.17.3+10-g091466ba55-1) unstable; urgency=medium

  * Update to new upstream version 4.17.3+10-g091466ba55, which also contains
    security fixes for the following issues:
    - arm32: The cache may not be properly cleaned/invalidated (take two)
      XSA-447 CVE-2023-46837
    - pci: phantom functions assigned to incorrect contexts
      XSA-449 CVE-2023-46839
    - VT-d: Failure to quarantine devices in !HVM builds
      XSA-450 CVE-2023-46840
  * Note that the following XSA are not listed, because...
    - XSA-448 has patches for the Linux kernel.
  * Compilation with Python 3.12 has been fixed in upstream commit 4000522008
    ("Only compile the hypervisor with -Wdeclaration-after-statement")
    (Closes: #1062048)

 -- Hans van Kranenburg <hans@knorrie.org>  Sun, 04 Feb 2024 13:45:17 +0100

xen (4.17.2+76-ge1f9cb16e2-1) unstable; urgency=medium

  * Update to new upstream version 4.17.2-76-ge1f9cb16e2, which also contains
    security fixes for the following issues: (Closes: #1056928)
    - x86/AMD: mismatch in IOMMU quarantine page table levels
      XSA-445 CVE-2023-46835
    - x86: BTC/SRSO fixes not fully effective
      XSA-446 CVE-2023-46836

 -- Maximilian Engelhardt <maxi@daemonizer.de>  Wed, 29 Nov 2023 20:17:30 +0100

xen (4.17.2+55-g0b56bed864-1) unstable; urgency=medium

  * Update to new upstream version 4.17.2+55-g0b56bed864, which also contains
    security fixes for the following issues:
    - arm32: The cache may not be properly cleaned/invalidated
      XSA-437 CVE-2023-34321
    - top-level shadow reference dropped too early for 64-bit PV guests
      XSA-438 CVE-2023-34322
    - x86/AMD: Divide speculative information leak
      XSA-439 CVE-2023-20588
    - xenstored: A transaction conflict can crash C Xenstored
      XSA-440 CVE-2023-34323
    - x86/AMD: missing IOMMU TLB flushing
      XSA-442 CVE-2023-34326
    - Multiple vulnerabilities in libfsimage disk handling
      XSA-443 CVE-2023-34325
    - x86/AMD: Debug Mask handling
      XSA-444 CVE-2023-34327 CVE-2023-34328
  * Note that the following XSA are not listed, because...
    - XSA-441 has patches for the Linux kernel.

 -- Hans van Kranenburg <hans@knorrie.org>  Thu, 12 Oct 2023 19:25:55 +0200

xen (4.17.2-1) unstable; urgency=medium

  * Update to new upstream version 4.17.2, which also contains
    security fixes for the following issues: (Closes: #1042102)
    - x86/AMD: Zenbleed
      XSA-433 CVE-2023-20593
    - x86/AMD: Speculative Return Stack Overflow
      XSA-434 CVE-2023-20569
    - x86/Intel: Gather Data Sampling
      XSA-435 CVE-2022-40982
    - arm: Guests can trigger a deadlock on Cortex-A77
      XSA-436 CVE-2023-34320
  * Note that the following XSA are not listed, because...
    - XSA-432 has patches for the Linux kernel.

 -- Maximilian Engelhardt <maxi@daemonizer.de>  Sun, 20 Aug 2023 16:08:59 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libxentoollog1`.
