The Xen 4.0 release contains a number of important new features and updates including:

• Blktap2 - High performance VHD implementation supporting snaphots and clonces including live snapshots
• Netchannel2 - Support for new Smart NICs with multi-queue and SR-IOV functionality
• Fault Tolerance - Live transactional synchronization of VM state between physical servers
• Libxenlight - New library providing higher-level control of Xen between various toolstacks
• PV-USB and VGA Pass-through
• Xen 4.0.x Release Notes
• Xen 4.0 Datasheet

Xen 4.0.4 is a maintenance release in the 4.0 series and contains:

• Fixes for the following critical vulnerabilities: We recommend all users of the 4.0 and 4.1 stable series to update to these latest point releases.
  • CVE-2012-0217 / XSA-7: PV guest privilege escalation vulnerability
  • CVE-2012-0218 / XSA-8: guest denial of service on syscall/sysenter exception generation
  • CVE-2012-2934 / XSA-9: PV guest host Denial of Service
  • CVE-2012-3432 / XSA-10: HVM guest user mode MMIO emulation DoS vulnerability
  • CVE-2012-3433 / XSA-11: HVM guest destroy p2m teardown host DoS vulnerabilit
• Among many bug fixes and improvements (over 100 since Xen 4.1.2). Highlights are:
  • Updates for the latest Intel/AMD CPU revisions
  • Bug fixes and improvements to the libxl tool stack
  • Bug fixes for IOMMU handling (device passthrough to HVM guests)
  • Bug fixes for host kexec/kdump

It also contains the following fixes from earlier maintenance releases:

• Security fixes including CVE-2011-1583 and CVE-2011-1898
• Enhancements to guest introspection (VM single stepping support for very fine-grained access control)
• Many stability improvements, such as:
  • PV-on-HVM stability fixes (fixing some IRQ issues)
  • XSAVE cpu feature support for PV guests (allows safe use of latest multimedia instructions)
  • RAS fixes for high availability
  • fixes for offlining bad pages
  • changes to libxc, mainly of benefit to libvirt
  • New XL toolstack
  • Debug support: kexec/kdump
  • Remus (High Availability)
  • Device passthrough to HVM guests
  • Interrupt handling
  • Support for Supervisor Mode Execution Protection (SMEP)
• Compatibility fixes for newer Linux guests, newer compilers, some old guest savefiles, newer Python, grub2, some hardware/BIOS bugs.