On Tue, Jul 21, 2026 at 12:18:19PM +0100, Daniel P. Berrangé wrote: > On Tue, Jul 21, 2026 at 11:09:11AM +0000, Zbigniew Jędrzejewski-Szmek wrote: > > On Tue, Jul 21, 2026 at 12:49:59PM +0200, Arjun Shankar wrote: > > > > > Wiki - https://fedoraproject.org/wiki/Changes/ShadowStack > > > > > == Early Testing (Optional) == > > > > > A COPR repository with the updated glibc (Shadow Stack enabled) is > > > > > available for Fedora 43, 44, and Rawhide for early testing: > > > > > https://copr.fedorainfracloud.org/coprs/submachine/glibc-x86_64-SHSTK-Testing/ > > > > > > > > This repo is not useful for testing of Rawhide now, because it's too > > > > old. > > > > Packages have been rebuilt against newer glibc and installation fails > > > > with: > > > > - installed package sqlite-libs-3.53.3-1.fc45.x86_64 requires > > > > libm.so.6(GLIBC_2.44)(64bit), > > > > but none of the providers can be installed > > > > > > I updated it, and it should now be up-to-date for Fedora 44 and 45 > > > now. I have dropped 43 and updated the change proposal to reflect > > > this. > > > > I saw that, thanks! > > > > Second request: please enable the i686 build too. I have glibc.i686 > > installed > > for various reasons and the lack of the i686 build causes a problem with > > the upgrade. > > > > (Maybe this will help others trying to test this: qemu-10.x in F44 does > > not have support for shadowstacks. After recompiling qemu from rawhide, > > upgrading, and doing 'systemctl restart libvirtd', I get user_shstk > > in /proc/cpuinfo on the guest.) > > I'm surprised you see a difference in QEMU in this respect, as I'm > not aware of changes between QEMU in 10.2.2 (F44) and 11.0.0 (F45) > that would affect availability of shadow stacks in the guest VM. > Do you have any ideas why it might be missing from F44.
I followed advice from Gemini. It said: > Libvirt translates human-readable feature XML names into raw CPUID > flags before sending them to QEMU. Because native KVM/QEMU > hypervisor virtualization support for Intel/AMD CET (Control-flow > Enforcement Technology) was fully integrated into QEMU 11.0, older > versions of libvirt lack cet-ss and cet-ibt in their built-in CPU > mapping definitions. and gave a link to https://www.phoronix.com/news/QEMU-11.0-Released, which says > - QEMU 11.0 on KVM now supports Control-flow Enforcement Technology (CET) > virtualization. >From my side, I noticed that my host CPU has user_shstk, but the libvirt quest doesn't. The CPU was specified as 'host-passthrough'. Zbyszek -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
