Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package xen for openSUSE:Factory checked in at 2026-08-03 17:14:28 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/xen (Old) and /work/SRC/openSUSE:Factory/.xen.new.16738 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "xen" Mon Aug 3 17:14:28 2026 rev:376 rq:1368922 version:4.22.0_02 Changes: -------- --- /work/SRC/openSUSE:Factory/xen/xen.changes 2026-07-12 16:20:39.838990437 +0200 +++ /work/SRC/openSUSE:Factory/.xen.new.16738/xen.changes 2026-08-03 17:14:33.797018175 +0200 @@ -1,0 +2,71 @@ +Wed Jul 29 15:01:12 MDT 2026 - [email protected] + +- Update to Xen 4.22.0 FCS release + New Features + * Support for per-domain Xenstore quota in C xenstored (includes + xenstore-stubdom), libxl and xl. + * Support for Xenstore watch depth feature in C xenstored (includes + xenstore-stubdom). + * On x86: + - Support for Bus Lock Threshold on AMD Zen5 and later CPUs, used by Xen to + mitigate (by rate-limiting) the system wide impact of an HVM guest + misusing atomic instructions. + - Support for CPIO microcode in discrete multiboot modules. + - Introduce get-core-temp command to xenpm to query CPU temperatures on + Intel platforms. + * On Arm: + - Support for guest suspend and resume to/from RAM via vPSCI. + Applies only to non-hardware domain guests. + - Continued Armv8-R MPU enablement. + - Drop ThumbEE support. + - FF-A v1.2 support. + * On RISC-V: + - SSTC extension support for Xen (not for guest yet). + - Introduce domain build helpers (CONFIG_DOMAIN_BUILD_HELPERS) which allows + to load Linux kernel, initrd and allocation related things forfor device + tree-based domains, laying the groundwork for guest boot support. + This release fixes the following security issues. + * bsc#1271528 - VUL-0: CVE-2026-42493: xen: x86 shadow paging is + deprecated (XSA-495) + * bsc#1271529 - VUL-0: CVE-2026-42492: xen: vIRQ event channel + binding may break Xenstore (XSA-496) + * bsc#1271530 - VUL-0: CVE-2026-42494,CVE-2026-42495, + CVE-2026-62423,CVE-2026-62424,CVE-2026-62425: xen: buffer + overruns in libfsimage iso9660 handling (XSA-497) + * bsc#1271531 - VUL-0: CVE-2026-62426,CVE-2026-62427: xen: sysctl + and platform-op locks open to abuse (XSA-499) + * bsc#1271532 - VUL-0: CVE-2026-62428: xen: grant-table: type + confusion in grant-copy (XSA-500) + * bsc#1271533 - VUL-0: xen: grant-table: version change racing with + other operations (XSA-501) + * bsc#1271534 - VUL-0: CVE-2026-62429: xen: vNUMA domain cleanup + may race other operations (XSA-502) + * bsc#1271535 - VUL-0: CVE-2026-62430: xen: x86: Out-of-bounds + read in vRTC emulation (XSA-503) + * bsc#1271536 - VUL-0: CVE-2026-62431: xen: Viridian STIMER + division by zero (XSA-504) + * bsc#1271537 - VUL-0: CVE-2026-62432: xen: evtchn: Race between + FIFO expand and reset (XSA-505) + * bsc#1271538 - VUL-0: CVE-2026-62433: xen: correct buffer checks + for DM_OP hypercalls (XSA-506) + * bsc#1271539 - VUL-0: CVE-2026-62434: xen: PoD: Don't try to + reclaim special pages (XSA-507) + * bsc#1271947 - VUL-0: xen: pygrub is only supported in + de-privileged mode (XSA-508) +- Dropped patches contained in new tarball + 69d4ab43-EFI-avoid-OOB-config-file-reads.patch + 69d8ed8e-x86-time-dont-kill-calibration-timer-on-S3.patch + 69e0e400-x86-use-native-TSC-scaling-factors-when-.patch + 69e0e401-CPU-round-cpu_khz-calculations.patch + 69e26ac9-x86-mkelf32-actually-pad-segment-to-2Mb.patch + 69e26aca-x86-mitigate-AMD-SN-7053-FP-DSS.patch + 69f0ab36-gnttab-split-gnttab_map_frame.patch + 69f0ab36-xenstored-make-conn_delete_all_transactions-idempotent.patch + 6a034fca-x86-mitigate-AMD-SN-7052.patch +- Updated README.SUSE to indicate that pygrub is deprecated and + unsupported. +- Keep shadow paging enabled for those who expect this feature + to remain unchanged for PV guests despite XSA-495. + xen.spec + +------------------------------------------------------------------- @@ -4,0 +76,7 @@ + +------------------------------------------------------------------- +Thu Jun 18 09:52:40 MDT 2026 - [email protected] + +- Drop aarch64 from the ExclusiveArch field. We never shipped Xen + on aarch64 and we don't need to use hardware resources to build + it. Old: ---- 69d4ab43-EFI-avoid-OOB-config-file-reads.patch 69d8ed8e-x86-time-dont-kill-calibration-timer-on-S3.patch 69e0e400-x86-use-native-TSC-scaling-factors-when-.patch 69e0e401-CPU-round-cpu_khz-calculations.patch 69e26ac9-x86-mkelf32-actually-pad-segment-to-2Mb.patch 69e26aca-x86-mitigate-AMD-SN-7053-FP-DSS.patch 69f0ab36-gnttab-split-gnttab_map_frame.patch 69f0ab36-xenstored-make-conn_delete_all_transactions-idempotent.patch 6a034fca-x86-mitigate-AMD-SN-7052.patch xen-4.21.1-testing-src.tar.bz2 New: ---- xen-4.22.0-testing-src.tar.bz2 ----------(Old B)---------- Old:- Dropped patches contained in new tarball 69d4ab43-EFI-avoid-OOB-config-file-reads.patch 69d8ed8e-x86-time-dont-kill-calibration-timer-on-S3.patch Old: 69d4ab43-EFI-avoid-OOB-config-file-reads.patch 69d8ed8e-x86-time-dont-kill-calibration-timer-on-S3.patch 69e0e400-x86-use-native-TSC-scaling-factors-when-.patch Old: 69d8ed8e-x86-time-dont-kill-calibration-timer-on-S3.patch 69e0e400-x86-use-native-TSC-scaling-factors-when-.patch 69e0e401-CPU-round-cpu_khz-calculations.patch Old: 69e0e400-x86-use-native-TSC-scaling-factors-when-.patch 69e0e401-CPU-round-cpu_khz-calculations.patch 69e26ac9-x86-mkelf32-actually-pad-segment-to-2Mb.patch Old: 69e0e401-CPU-round-cpu_khz-calculations.patch 69e26ac9-x86-mkelf32-actually-pad-segment-to-2Mb.patch 69e26aca-x86-mitigate-AMD-SN-7053-FP-DSS.patch Old: 69e26ac9-x86-mkelf32-actually-pad-segment-to-2Mb.patch 69e26aca-x86-mitigate-AMD-SN-7053-FP-DSS.patch 69f0ab36-gnttab-split-gnttab_map_frame.patch Old: 69e26aca-x86-mitigate-AMD-SN-7053-FP-DSS.patch 69f0ab36-gnttab-split-gnttab_map_frame.patch 69f0ab36-xenstored-make-conn_delete_all_transactions-idempotent.patch Old: 69f0ab36-gnttab-split-gnttab_map_frame.patch 69f0ab36-xenstored-make-conn_delete_all_transactions-idempotent.patch 6a034fca-x86-mitigate-AMD-SN-7052.patch Old: 69f0ab36-xenstored-make-conn_delete_all_transactions-idempotent.patch 6a034fca-x86-mitigate-AMD-SN-7052.patch - Updated README.SUSE to indicate that pygrub is deprecated and ----------(Old E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ xen.spec ++++++ --- /var/tmp/diff_new_pack.P7M2d0/_old 2026-08-03 17:14:36.861124770 +0200 +++ /var/tmp/diff_new_pack.P7M2d0/_new 2026-08-03 17:14:36.861124770 +0200 @@ -29,8 +29,8 @@ %{?!primary_python:%define primary_python python3} Name: xen -ExclusiveArch: %ix86 x86_64 aarch64 -%define xen_build_dir xen-4.21.1-testing +ExclusiveArch: %ix86 x86_64 +%define xen_build_dir xen-4.22.0-testing # %define with_gdbsx 0 %define with_dom0_support 0 @@ -126,12 +126,12 @@ BuildRequires: python-rpm-macros Provides: installhint(reboot-needed) -Version: 4.21.1_06 +Version: 4.22.0_02 Release: 0 Summary: Xen Virtualization: Hypervisor (aka VMM aka Microkernel) License: GPL-2.0-only Group: System/Kernel -Source0: xen-4.21.1-testing-src.tar.bz2 +Source0: xen-4.22.0-testing-src.tar.bz2 Source1: stubdom.tar.bz2 Source2: mini-os.tar.bz2 Source9: xen.changes @@ -161,15 +161,6 @@ # For xen-libs Source99: baselibs.conf # Upstream patches -Patch1: 69d4ab43-EFI-avoid-OOB-config-file-reads.patch -Patch2: 69d8ed8e-x86-time-dont-kill-calibration-timer-on-S3.patch -Patch3: 69e0e400-x86-use-native-TSC-scaling-factors-when-.patch -Patch4: 69e0e401-CPU-round-cpu_khz-calculations.patch -Patch5: 69e26ac9-x86-mkelf32-actually-pad-segment-to-2Mb.patch -Patch6: 69e26aca-x86-mitigate-AMD-SN-7053-FP-DSS.patch -Patch7: 69f0ab36-gnttab-split-gnttab_map_frame.patch -Patch8: 69f0ab36-xenstored-make-conn_delete_all_transactions-idempotent.patch -Patch9: 6a034fca-x86-mitigate-AMD-SN-7052.patch # Our platform specific patches Patch400: xen-destdir.patch Patch401: vif-bridge-no-iptables.patch @@ -710,6 +701,7 @@ rm -fv xen/.config echo CONFIG_REQUIRE_NX=y > xen/.config echo CONFIG_DIT_DEFAULT=y >> xen/.config +echo CONFIG_SHADOW_PAGING=y >> xen/.config %if %{with xen_debug} echo CONFIG_DEBUG=y >> xen/.config echo "CONFIG_DOM0_MEM=\"1G+10%%,max:64G\"" >> xen/.config ++++++ README.SUSE ++++++ --- /var/tmp/diff_new_pack.P7M2d0/_old 2026-08-03 17:14:36.965128388 +0200 +++ /var/tmp/diff_new_pack.P7M2d0/_new 2026-08-03 17:14:36.973128666 +0200 @@ -197,6 +197,15 @@ parameters. See /etc/xen/examples/ for example configuration files. +Booting a paravirtual VM +------------------------ +In older versions of SLES, a bootloader tool called pygrub was used to select +the kernel and ramdisk of a paravirtual VM to start the boot process. This +tool is now deprecated and is security unsupported and should not be used. +Tools such as virt-install use grub.xen which is the recommended bootloader +tool for bootstrapping paravirtual VMs. + + Managing Virtual Machines ------------------------- VMs can be managed from the command line using 'virsh' or from virt-manager. ++++++ ignore-ip-command-script-errors.patch ++++++ --- /var/tmp/diff_new_pack.P7M2d0/_old 2026-08-03 17:14:37.109133398 +0200 +++ /var/tmp/diff_new_pack.P7M2d0/_new 2026-08-03 17:14:37.113133536 +0200 @@ -17,25 +17,25 @@ --- a/tools/hotplug/Linux/xen-network-common.sh +++ b/tools/hotplug/Linux/xen-network-common.sh -@@ -84,7 +84,7 @@ - local virtual="$2" +@@ -83,7 +83,7 @@ setup_bridge_port() { + local dev="$1" # take interface down ... - ip link set dev ${dev} down + ip link set dev ${dev} down || true - if [ $virtual -ne 0 ] ; then - # Initialise a dummy MAC address. We choose the numerically -@@ -95,7 +95,7 @@ - fi + # Initialise a dummy MAC address. We choose the numerically + # largest non-broadcast address to prevent the address getting +@@ -92,7 +92,7 @@ setup_bridge_port() { + ip link set dev ${dev} address fe:ff:ff:ff:ff:ff || true # ... and configure it - ip address flush dev ${dev} + ip address flush dev ${dev} || true } - setup_physical_bridge_port() { -@@ -123,12 +123,12 @@ + # Usage: create_bridge bridge +@@ -113,12 +113,12 @@ add_to_bridge () { # Don't add $dev to $bridge if it's already on the bridge. if [ ! -e "/sys/class/net/${bridge}/brif/${dev}" ]; then log debug "adding $dev to bridge $bridge" ++++++ libxl.LIBXL_HOTPLUG_TIMEOUT.patch ++++++ --- /var/tmp/diff_new_pack.P7M2d0/_old 2026-08-03 17:14:37.141134510 +0200 +++ /var/tmp/diff_new_pack.P7M2d0/_new 2026-08-03 17:14:37.145134650 +0200 @@ -85,7 +85,7 @@ --- a/tools/libs/light/libxl_create.c +++ b/tools/libs/light/libxl_create.c -@@ -1321,6 +1321,7 @@ static void initiate_domain_create(libxl +@@ -1323,6 +1323,7 @@ static void initiate_domain_create(libxl * build info around just to know if the domain has a device model or not. */ store_libxl_entry(gc, domid, &d_config->b_info); ++++++ mini-os.tar.bz2 ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/extras/mini-os-remote/arch/x86/minios-x86.lds.S new/extras/mini-os-remote/arch/x86/minios-x86.lds.S --- old/extras/mini-os-remote/arch/x86/minios-x86.lds.S 2025-11-18 23:16:02.000000000 +0100 +++ new/extras/mini-os-remote/arch/x86/minios-x86.lds.S 2026-07-29 22:58:48.000000000 +0200 @@ -33,6 +33,7 @@ .note : { *(.note) + *(.note.Xen) *(.note.*) } ++++++ replace-obsolete-network-configuration-commands-in-s.patch ++++++ --- /var/tmp/diff_new_pack.P7M2d0/_old 2026-08-03 17:14:37.689153575 +0200 +++ /var/tmp/diff_new_pack.P7M2d0/_new 2026-08-03 17:14:37.705154132 +0200 @@ -16,7 +16,7 @@ --- a/tools/hotplug/Linux/colo-proxy-setup +++ b/tools/hotplug/Linux/colo-proxy-setup -@@ -76,17 +76,10 @@ +@@ -76,17 +76,10 @@ function teardown_primary() function setup_secondary() { @@ -34,7 +34,7 @@ do_without_error ip link set dev $forwardbr up do_without_error modprobe xt_SECCOLO -@@ -98,17 +91,10 @@ +@@ -98,17 +91,10 @@ function setup_secondary() function teardown_secondary() { @@ -54,7 +54,7 @@ $vifname -j SECCOLO --index $index --- a/tools/hotplug/Linux/remus-netbuf-setup +++ b/tools/hotplug/Linux/remus-netbuf-setup -@@ -139,7 +139,7 @@ +@@ -139,7 +139,7 @@ check_ifb() { setup_ifb() { @@ -65,7 +65,7 @@ REMUS_IFB="$ifb" --- a/tools/hotplug/Linux/vif-bridge +++ b/tools/hotplug/Linux/vif-bridge -@@ -39,11 +39,7 @@ +@@ -39,11 +39,7 @@ bridge=${bridge:-} bridge=$(xenstore_read_default "$XENBUS_PATH/bridge" "$bridge") if [ -z "$bridge" ]; then @@ -80,7 +80,7 @@ fatal "Could not find bridge, and none was specified" --- a/tools/hotplug/Linux/vif-nat +++ b/tools/hotplug/Linux/vif-nat -@@ -172,7 +172,7 @@ +@@ -172,7 +172,7 @@ case "$command" in ;; offline) [ "$dhcp" != 'no' ] && dhcp_down @@ -91,7 +91,7 @@ --- a/tools/hotplug/Linux/vif-route +++ b/tools/hotplug/Linux/vif-route -@@ -23,13 +23,15 @@ +@@ -23,13 +23,15 @@ main_ip=$(dom0_ip) case "${command}" in add|online) @@ -111,7 +111,7 @@ ;; --- a/tools/hotplug/Linux/xen-network-common.sh +++ b/tools/hotplug/Linux/xen-network-common.sh -@@ -111,13 +111,7 @@ +@@ -101,13 +101,7 @@ create_bridge () { # Don't create the bridge if it already exists. if [ ! -e "/sys/class/net/${bridge}/bridge" ]; then @@ -125,7 +125,7 @@ fi } -@@ -129,11 +123,7 @@ +@@ -119,11 +113,7 @@ add_to_bridge () { # Don't add $dev to $bridge if it's already on the bridge. if [ ! -e "/sys/class/net/${bridge}/brif/${dev}" ]; then log debug "adding $dev to bridge $bridge" @@ -137,7 +137,7 @@ else log debug "$dev already on bridge $bridge" fi -@@ -150,11 +140,8 @@ +@@ -140,11 +130,8 @@ remove_from_bridge () { # Don't remove $dev from $bridge if it's not on the bridge. if [ -e "/sys/class/net/${bridge}/brif/${dev}" ]; then log debug "removing $dev from bridge $bridge" ++++++ stubdom.tar.bz2 ++++++ /work/SRC/openSUSE:Factory/xen/stubdom.tar.bz2 /work/SRC/openSUSE:Factory/.xen.new.16738/stubdom.tar.bz2 differ: char 11, line 1 ++++++ xen-4.21.1-testing-src.tar.bz2 -> xen-4.22.0-testing-src.tar.bz2 ++++++ ++++ 70997 lines of diff (skipped) ++++++ xen-arch-kconfig-nr_cpus.patch ++++++ --- /var/tmp/diff_new_pack.P7M2d0/_old 2026-08-03 17:14:42.433318616 +0200 +++ /var/tmp/diff_new_pack.P7M2d0/_new 2026-08-03 17:14:42.453319311 +0200 @@ -1,14 +1,14 @@ -Index: xen-4.20.0-testing/xen/arch/Kconfig +Index: xen-4.22.0-testing/xen/arch/Kconfig =================================================================== ---- xen-4.20.0-testing.orig/xen/arch/Kconfig -+++ xen-4.20.0-testing/xen/arch/Kconfig +--- xen-4.22.0-testing.orig/xen/arch/Kconfig ++++ xen-4.22.0-testing/xen/arch/Kconfig @@ -8,7 +8,7 @@ config NR_CPUS int "Maximum number of CPUs" range 1 1 if ARM && MPU range 1 16383 - default "256" if X86 + default "1024" if X86 - default "1" if ARM && MPU - default "8" if ARM && RCAR3 - default "4" if ARM && QEMU + default "1" if !ARM || MPU + default "8" if RCAR3 + default "4" if QEMU ++++++ xen.bug1026236.suse_vtsc_tolerance.patch ++++++ --- /var/tmp/diff_new_pack.P7M2d0/_old 2026-08-03 17:14:42.497320842 +0200 +++ /var/tmp/diff_new_pack.P7M2d0/_new 2026-08-03 17:14:42.501320981 +0200 @@ -10,7 +10,7 @@ --- a/xen/arch/x86/time.c +++ b/xen/arch/x86/time.c -@@ -47,6 +47,9 @@ +@@ -49,6 +49,9 @@ static char __initdata opt_clocksource[10]; string_param("clocksource", opt_clocksource); @@ -20,7 +20,7 @@ unsigned long __read_mostly cpu_khz; /* CPU clock frequency in kHz. */ DEFINE_SPINLOCK(rtc_lock); unsigned long pit0_ticks; -@@ -2941,6 +2944,8 @@ int tsc_set_info(struct domain *d, +@@ -2951,6 +2954,8 @@ int tsc_set_info(struct domain *d, switch ( tsc_mode ) { @@ -29,7 +29,7 @@ case XEN_CPUID_TSC_MODE_DEFAULT: case XEN_CPUID_TSC_MODE_ALWAYS_EMULATE: d->arch.vtsc_offset = get_s_time() - elapsed_nsec; -@@ -2954,8 +2959,25 @@ int tsc_set_info(struct domain *d, +@@ -2964,8 +2969,25 @@ int tsc_set_info(struct domain *d, * When a guest is created, gtsc_khz is passed in as zero, making * d->arch.tsc_khz == cpu_khz. Thus no need to check incarnation. */ ++++++ xen.build-compare.doc_html.patch ++++++ --- /var/tmp/diff_new_pack.P7M2d0/_old 2026-08-03 17:14:42.521321677 +0200 +++ /var/tmp/diff_new_pack.P7M2d0/_new 2026-08-03 17:14:42.541322372 +0200 @@ -5,11 +5,11 @@ docs/Makefile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) -Index: xen-4.18.0-testing/docs/Makefile +Index: xen-4.22.0-testing/docs/Makefile =================================================================== ---- xen-4.18.0-testing.orig/docs/Makefile -+++ xen-4.18.0-testing/docs/Makefile -@@ -192,7 +192,7 @@ uninstall: uninstall-man-pages uninstall +--- xen-4.22.0-testing.orig/docs/Makefile ++++ xen-4.22.0-testing/docs/Makefile +@@ -201,7 +201,7 @@ uninstall: uninstall-man-pages uninstall # Individual file build targets html/index.html: $(DOC_HTML) $(CURDIR)/gen-html-index INDEX @@ -18,7 +18,7 @@ html/%.txt: %.txt @$(INSTALL_DIR) $(@D) -@@ -207,8 +207,8 @@ html/hypercall/%/index.html: $(CURDIR)/x +@@ -216,8 +216,8 @@ html/hypercall/%/index.html: $(CURDIR)/x $(INSTALL_DIR) $(@D) $(PERL) -w $(CURDIR)/xen-headers -O $(@D) \ -T 'arch-$* - Xen public headers' \ ++++++ xl-save-pc.patch ++++++ --- /var/tmp/diff_new_pack.P7M2d0/_old 2026-08-03 17:14:42.725328773 +0200 +++ /var/tmp/diff_new_pack.P7M2d0/_new 2026-08-03 17:14:42.737329191 +0200 @@ -21,8 +21,8 @@ --- a/tools/xl/Makefile +++ b/tools/xl/Makefile -@@ -26,6 +26,7 @@ XL_OBJS += xl_vmcontrol.o xl_saverestore - XL_OBJS += xl_vdispl.o xl_vsnd.o xl_vkb.o +@@ -27,6 +27,7 @@ XL_OBJS += xl_vdispl.o xl_vsnd.o xl_vkb. + XL_OBJS += xl_xsquota.o $(XL_OBJS): CFLAGS += $(CFLAGS_libxentoollog) +$(XL_OBJS): CFLAGS += $(CFLAGS_libxenstore) @@ -31,7 +31,7 @@ --- a/tools/xl/xl.h +++ b/tools/xl/xl.h -@@ -306,6 +306,7 @@ typedef enum { +@@ -308,6 +308,7 @@ typedef enum { DOMAIN_RESTART_SUSPENDED, /* Domain suspended - keep looping */ } domain_restart_type;
