XCP-ng 8.3 updates announcements and testing

[gduperrey]

New security and maintenance update candidate

A new XSA (Xen Security Advisory) was published on the 1st of July, and an update to Xen addresses it. We also publish other non-urgent updates which we had in the pipe for the next release.

---

Security updates

• xen-*:
  • Fix XSA-470 - An unprivileged guest can cause a hypervisor crash, causing a Denial of Service (DoS) of the entire host.

Maintenance updates

• http-nbd-transfer: moved some logs into debug to reduce log spam
• sm:
  • XOSTOR: avoid a rare migration error when the GC would run on our migration snapshot
  • Use GC daemon code for LINSTOR like other drivers (no changes for users)
    This updated package is already included in the refreshed 8.3 installation ISOs.
• xapi:
  • Fix remote syslog configuration being broken on updates
  • Fix several RRD (stats collection) issues and make the plugins more robust:
    • Cap Derive values within a certain range without making them NaN
    • Use a computed delay time for RRD loop to prevent gaps in metrics collection
    • Avoid duplicating datasources on plugin restore
    • Protect against a resource leak in the plugins
    • Avoid running out of mmap-ed pages in xcp-rrdd-cpu for large numbers of domains
    • Prevent exceptions from escaping and introducing gaps into metrics collection
    • Avoid missing metrics from new and destroyed domains
  • Prevent xapi concurrent calls during migration from indirectly make each other fail (already fixed in the refreshed ISOs)
  • Fix a deadlock in xenopsd due to atom nesting (already fixed in the refreshed ISOs)
• xo-lite: update to 0.12.0
  • [VM/system] Display system information in vm/system tab
  • [Host/system] Display system view information in host/system tab
  • [Host/Dashboard] Fix color of tag list (PR #8731)
  • [Table] add pagination on table (PR #8573)
  • [Pool/system] Display pool information in pool/system tab (PR #8660)
  • [VM/Dashboard] Display VM information in dashboard tab (PR #8529)
  • [Tab/Network] Updated side panel in tab network behavior for mobile view (PR #8688)
  • [Stats] Fix graphs that were sometimes not displayed or displayed incorrectly (PR #8722)

Optional packages:

• Alternate Driver: Updated to newer version.
  • broadcom-bnxt-en-alt: Update to version 1.10.3_232.0.155.5

Test on XCP-ng 8.3

yum clean metadata --enablerepo=xcp-ng-testing
yum update --enablerepo=xcp-ng-testing
reboot

The usual update rules apply: pool coordinator first, etc.

Versions:

• http-nbd-transfer: 1.6.0-1.xcpng8.3
• sm: 3.2.12-3.2.xcpng8.3
• xapi: 25.6.0-1.9.xcpng8.3
• xen: 4.17.5-13.2.xcpng8.3
• xo-lite: 0.12.0-1.xcpng8.3

Optional packages:

• Alternate drivers:
  • broadcom-bnxt-en-alt: 1.10.3_232.0.155.5-1.xcpng8.3

What to test

Normal use and anything else you want to test.

Test window before official release of the updates

~2 days.

[flakpyro]

@gduperrey Updated both of my test hosts.

Machine 1:
Intel Xeon E-2336
SuperMicro board.

Machine 2:
Minisforum MS-01
i9-13900H (e-cores disabled)
32 GB Ram
Using Intel X710 onboard NIC

Everything rebooted and came up fine. Ran a backup job which also completed without issue. Using a mix of ext, XFS and NFS SRs

[ph7]

@gduperrey
Ran some test on my old i7 and it seems to work fine

[bufanda]

Did install on my lab pool

2 HP EliteDesk 800 G3 mini

One with i7 6700T, one with i5 6500T
Both 32GB RAM
iSCSI SR, NFS SR and local NVMe SR. VMs from all SR run. Migration during update worked. Migration of VMs after update worked. Backups (exporting VMs) is working
Didn't see any issue so far.

One thing the pool had the qcow2 patches installed since XAPI and sm packages gto updated I guess it won't support qcow2 at the moment right?

[dthenot]

@bufanda Hello,

There is equivalent sm packages in the qcow2 repo for testing, XAPI will be coming soon.
You can update while enabling the QCOW2 repo to get the sm and blktap QCOW2 version and get the XAPI version letter if you want.

[bufanda]

@dthenot No worries, just wanted to make sure I understand the expected behavior when I had the qcow2 patches installed.

[dthenot]

@bufanda You just need to make sure to have a sm and blktap qcow2 version.
Otherwise, having a normal sm version would drop the QCOW2 VDI from the XAPI database and you would lose VBD to VM aswell as name of VDI.
So it could be painful depending on how much you have
But in the case, you would install a non QCOW2 sm version, you would only lose the QCOW2 from DB, those would not be deleted or anything. Reinstalling a QCOW2 version then rescanning the SR would make them re-appear. But then you would have to identify them again (lost name-label) and relink them to VM.
We try to keep our QCOW2 version on top of the testing branch of XCP-ng but we could miss it

[bufanda]

@dthenot Only have 2 Test VMs currently not running with qcow2. Nothing production and nothing crucial. It's a lab pool. As I said just to understand the behavior when I test the new updates. But thanks for the details. Really appreciated

[JeffBerntsen]

Installed and working on my lab test machine, HP ProLiant DL165 G7 with AMD Opteron 6136 CPU and 32 GB of RAM.

[Andrew]

@gduperrey Installed and running on a few hosts. Good so far.

[gduperrey]

Updates published: https://xcp-ng.org/blog/2025/07/03/july-2025-security-and-maintenance-update-for-xcp-ng-8-3-lts/

Thank you for the tests!