Posts made by stormi

@maxcuttins Ok. Then let's discuss this in another thread and leave the current one for testing update candidates.

@maxcuttins Is the question related to the testing of update candidates?

Looks like some of the testers who used to test the update candidates moved their test hosts to the 8.3 alpha release. Thanks @Andrew for staying true to the job

@lawrencesystems said in XCP-ng 8.3 public alpha :

I did not find any issues and nothing broke using it so I need to try harder.

Maybe we should incentivize with a bounty: find bugs in XCP-ng 8.3, get a T-shirt

@ajpri1998 said in XCP-ng 8.3 public alpha :

I have a minor feature request…
Can we get the xen-cmdline (/opt/xensource/libexec/xen-cmdline) added to the default PATH? I don’t use it too often but having it would save me a google remembering? I’ve also added to my bashrc with the name xcl.

I would rather have it symlinked from /usr/sbin or such rather than altering the default PATH. However, it's minor enough for now for me not to want to diverge from XenServer on this, so ideally we should try to push this change upstream. Unfortunately, this is a packaging matter and it's not the most open part of XenServer, so contributing there is hard. Not impossible, but requiring efforts that may be above the gain, here.

If you want, you could still open an enhancement request on XCP-ng's bugtracker. Maybe others will join you and at some point maybe the gain will be bigger than the effort

Sorry, sometimes we must be lazy to keep time for bigger topics.

@gskger No, only future ones

@gskger Thanks! For shorter logs, could you run ./xtf-runner -aqq --host rather than ./xtf-runner -aq --host in the future? We don't need the full list of successful tests. Only skipped and failed ones.

@rRobbie Yes, it meant from 8.2

I don't see any obvious settting, and XCP-ng won't interfere with a guest OS installation, so the root cause for this missing GRUB_ENABLE_BLSCFG=true must be somewhere in the installation process, triggered by I-don't-know-what when being installed in an XCP-ng guest.

The update was published earlier today: https://xcp-ng.org/blog/2023/02/20/february-2023-security-update/

Thanks for your feedback. I'm not aware of an update which could impact the guest drivers, and it's not easy to debug. It's hard to know whether there's an actual issue related to the alpha or not.

The best would be to be able to check if the same course of events leads to the same outcome, and to check the VM at each stage, to see if there really is a change when updating, say, from the initial alpha release to the current updates.

You don't happen to have snapshots, or an export, of the VM from when the drivers were working, do you?

What's the exact chain of events?

New Security Update Candidates (Xen, microcode, ...)

Components are updated to fix vulnerabilities:

• Xen is updated to fix XSA-426. It also includes the previous change which had not been released yet: Enable AVX-512 by default for EPYC Zen4 (Genoa)
• Intel and AMD microcode is updated for various devices:
  • Intel update (which in turn links to the advisories)
  • AMD advisory

We will also release at the same time:

• xcp-ng-release-*: fixes benign but annoying fcoe-related error messages at boot

And an update candidate which has been tested previously:

• Guest templates: added RHEL 9, AlmaLinux 9, Rocky Linux 9, CentOS Stream 8 & 9, Oracle Linux 9.

Test on XCP-ng 8.2

From an up to date host:

yum clean metadata --enablerepo=xcp-ng-testing
yum update "guest-templates-*" "xen-*" microcode_ctl linux-firmware "xcp-ng-release-*" --enablerepo=xcp-ng-testing
reboot

Versions:

• xen-*: 4.13.4-9.29.2.xcpng8.2
• microcode_ctl: 2.1-26.xs23.1.xcpng8.2
• linux-firmware: 20190314-5.1.xcpng8.2
• guest-templates-json-*: 1.9.6-1.2.xcpng8.2
• xcp-ng-release-*: 8.2.1-6

What to test

Normal use and anything else you want to test. The closer to your actual use of XCP-ng, the better.

Test window before official release of the updates

48h

@Niko1 @rRobbie could you both open separate topics so that we can discuss your issues separately?

@Strebor Thanks! You likely have the same crash as what was discussed earlier in the thread (same test failing), with instructions to install a patched Xen to see if it fixes it for you.

It's not the same error. Your VM is missing a required package : ncat, as the error message says.

What's the exact error message?

Well, I tried it myself on a freshly installed pool, and this worked. Can you elaborate on what doesn't work?

@NielsH We'll wait for the next security update, to ship them together. When exactly security updates are released can't always be predicted or disclosed.

A test was recently pushed to XTF's repository which may crash a host whose hardware is vulnerable to XSA-304 (hardware vulnerability related to EPT superpages).

There are two modes in Xen regarding EPT superpages, fast vs secure, and XCP-ng defaults to fast due to the big performance hit secure would have by default on affected hardware. The vulnerability may allow an HVM guest to crash the host, and this is what the test demonstrates.

I've updated the small Xen testing guide above with instructions to switch to secure mode before running the tests, if you want to avoid the crash in case your host is vulnerable.