Dear Jan, I want to underline that this issue is a critical security problem affecting system availability and that it has direct consequences for XEN users:
* Systems running Xen 4.17.0 – 4.17.3 will fail to boot when upgraded to 4.17.4 or 4.17.5 under Intel Nested Virtualization. * Diagnosing and fixing this requires advanced skills and time, and in some cases may be impossible for standard users, leaving their systems unusable or unmaintained. * The problem has been known to Xen maintainers since 2024-01-20, but no official communication has been made. * Root cause: commit 6bdb9651<https://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=6bdb965178bbb3fc50cd4418d4770a7789956e2c> (2024-01-17) * Fix: commit dd05d265<https://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=dd05d265b8abda4cc7206b29cd71b77fb46658bf> (2025-01-21), applied in Xen 4.18.5, 4.19.2, 4.20.0-rc3 * Xen 4.17 remains security-supported until 2025-12-12, but this fix was not included in 4.17.5 Suggestion: I would suggest creating an XSA to notify the community and/or include this fix in Xen 4.17.6. This would help prevent affected users from encountering unbootable systems and protect the availability of their environments. Thank you for your attention. Best regards, Julie ________________________________ De : Jan Beulich <jbeul...@suse.com> Envoyé : lundi 12 mai 2025 10:54 À : Ngamia Djabiri Julie <julie.ngamiadjab...@student.uliege.be> Cc : xen-devel@lists.xenproject.org <xen-devel@lists.xenproject.org> Objet : Re: Request for patch to fix boot loop issue in Xen 4.17.6 On 03.05.2025 16:02, Ngamia Djabiri Julie wrote: > Dear Xen developers, > > I would like to ask if the following fix can also be included in Xen 4.17.6 > (and eventually in the Xen versions after 4.17.6 that don't have the fix) : > > https://xenbits.xen.org/gitweb/?p=xen.git;a=commitdiff;h=dd05d265b8abda4cc7206b29cd71b77fb46658bf > > This bug causes a boot loop in nested virtualization environments (for > instance nested environments that use VMware Workstation), making Xen unable > to start. It was introduced in version 4.17.3 and the fix has already be > included in 4.19(.2) and 4.20(.0) and woud be planned to be included in Xen > 4.18.6 in the coming weeks. > > Even though Xen 4.17 is in security-only support, this is an issue that > blocks testing and usage for users and projects such as Alpine Linux. I fear I don't view this severe enough an issue to break the security-only status of that branch. People concerned ought to simply update to a branch where the bug was fixed. Or the distro could include a backport. The underlying consideration being that once we start making exceptions, more exceptions will be asked for, along the lines of ... > I am a student using Xen in a nested setup for Virtal Machine Introspection > (VMI), and including this fix in 4.17.6 would really help avoid these > problems for others in a similar case. ... what you say here. Jan
