[Buildroot] [PATCH] package/xen: security bump to v4.20.1

[Titouan Christophe]

Hello Vincent, John and all,

Thank you very much for looking at this patch.

On 8/10/25 12:18, John Ernberg wrote:
> Hi Titouan, Vincent,
>
> On 10/8/25 11:05 AM, Vincent Stehlé wrote:
>   > On Tue, Oct 07, 2025 at 06:47:53PM +0200, Titouan Christophe via
> buildroot wrote:
>   >> Remove patches that are applied upstream, and adapt license hash
> following
>   >> upstream commit 7b068ac89024308862c4f448dd248645d2b8e882
>   >> ("Remove extra copies of licenses and license headers")
>   >>
>   >> Add new patch to fix a compilation issue with gcc15
>   >
>   > Hi Titouan,
>   >
>   > Thank you for working on refreshing the xen package, and for
> preparing this
>   > detailed list of CVEs!
>   >
>   > I fear bumping xen to 4.20 will not compile so easily; in fact this
> patch does
>   > indeed break the following tests:
>   >
>   > - tests.package.test_xen.TestXenAarch64
>   > - tests.package.test_xen.TestXenArmv7
On my side, I had only built Xen itself (and not the tools), with the 
following configuration:

BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_AARCH64_GLIBC_STABLE=y
BR2_PACKAGE_XEN=y

It compiles without any issue.

However, when enabling the tools (BR2_PACKAGE_XEN_TOOLS=y) like the 
tests do, there is indeed a problem with a git repo as you reported
>   >
>   > Bumping Xen is something I have tried on my side as well, and I have
> realized
>   > recently that a substantial change has happened between Xen 4.19 and
> 4.20: the
>   > qemu-xen folder is not shipped in the archive anymore. [1]
>   >
> Xen does support using the system qemu as well, and the qemu package in
> buildroot is new enough. I was dabbling a little bit with it  a year ago
> but didn't get far enough to run any significant tests.
>
> Xen building would need --with-system-qemu=yes, and I forgot what switch
> was needed for qemu.
>
> It could be an avenue to explore as well.
I will look into your suggestions !

Regards,
Titouan

>
> Best regards // John Ernberg