Commit Graph

923 Commits

Author SHA1 Message Date
Tuomas Tynkkynen
56ecf95468 open-vm-tools: Broken on non-x86
https://hydra.nixos.org/build/65049444
2017-12-03 19:51:58 +02:00
Antoine Eiche
268d3656db qemu: fix CVE-2017-15118
See https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg05045.html
2017-11-29 11:19:50 +01:00
adisbladis
92edbb0a71
virt-manager: 1.4.2 -> 1.4.3 2017-11-26 18:41:41 +08:00
Tuomas Tynkkynen
3b2056536c qemu: Rename x86Only option to hostCpuOnly
And also make it work on ARM and Aarch64.
2017-11-26 11:13:20 +02:00
Tuomas Tynkkynen
eb3925ff62 qemu: Disable numactl on ARM
32-bit ARM doesn't do numa.
2017-11-26 11:13:20 +02:00
aszlig
e5c24abf3b
virtualbox: 5.2.0 -> 5.2.2
Upstream changes without issue IDs:

 * User interface: various improvements for high resolution screens
 * User interface: added functionality to duplicate optical and floppy
                   images
 * User interface: various improvements for the virtual media manager
 * VMM: fixed emulation so that Plan 9 guests can start once more (5.1.0
        regression)
 * Storage: fixed regression breaking iSCSI
 * Audio: added HDA support for more exotic guests (e.g. Haiku)
 * Serial: fixed hanging I/O when using named pipes on Windows (5.2.0
           regression)
 * Serial: fixed broken communication with certain devices on Linux
           hosts
 * USB/OHCI: improved behavior so that the controller state after a VM
             reset is closer to the initial state after VM start
 * EFI: fixed HFS+ driver which in rare cases failed to access most
        files on a volume
 * Shared clipboard: fixed hang with OS X host and Linux guest
 * Linux hosts: fixed kernel module compilation and start failures with
                Linux kernel 4.14
 * X11 hosts: better handle WM_CLASS setting
 * Linux guests: fixed kernel module compilation and other problems with
                 Linux kernel 4.14
 * Linux guests: fixed various 5.2.0 regressions
 * Bridged networking: fixed duplicate EtherType in VLAN/priority tags
                       on Linux (5.2.0 regression)

The full changelog including issue IDs can be found at:

https://www.virtualbox.org/wiki/Changelog

Aside from just bumping the version number I also had to strip 3 levels
of the paths included in the guest-additions patches, because the
version was hardcoded in there and the patches still apply as-is.

I've re-added the stripped path using patchFlags and the -d option of
the patch utility.

Tested this by running all of the tests in the "virtualbox" NixOS VM
test module, here is the URL to the finished evaluation on my Hydra:

https://headcounter.org/hydra/eval/380191

Signed-off-by: aszlig <aszlig@nix.build>
Cc: @NeQuissimus, @orivej, @etu, @vcunat
Issue: https://github.com/NixOS/nixpkgs/issues/31640
Issue: https://github.com/NixOS/nixpkgs/pull/31037
2017-11-24 23:10:57 +01:00
Tim Steinbach
44f1d45833
Merge pull request #31899 from NeQuissimus/docker_17_11
docker-edge: 17.10 -> 17.11
2017-11-22 13:05:49 +00:00
Tuomas Tynkkynen
91d2cf9642 lkl: Supports aarch64
ARMv6 and ARMv7 didn't work when I tried.
2017-11-22 00:01:13 +02:00
Tim Steinbach
3901f08f10
docker-edge: 17.10 -> 17.11 2017-11-21 09:23:48 -05:00
Periklis Tsirakidis
1434c5ed9c fixup! docker-cli: enable darwin support 2017-11-20 20:30:46 +01:00
Periklis Tsirakidis
4a2bd8ed14 fixup! docker-cli: enable darwin support 2017-11-20 20:16:08 +01:00
Periklis Tsirakidis
0f0ffa70a0 docker-cli: enable darwin support 2017-11-20 20:07:00 +01:00
Orivej Desh
4cc5d222ce bochs: fix build with glibc 2.26
Tracking issue: #31696
2017-11-16 13:00:28 +00:00
Orivej Desh
41e0d4b68d vpcs: fix build with glibc 2.26
Tracking issue: #31696
2017-11-16 12:30:39 +00:00
Tim Steinbach
dd53d0f1a0
virtualbox: 5.1.26 -> 5.2.0 2017-11-15 10:14:44 -05:00
Orivej Desh
b8cc69b31e lkl: 2017-10-18 -> 2017-11-10 2017-11-11 20:25:18 +00:00
Pascal Wittmann
24e87b49b6
Change many homepage urls from http to https #30636 2017-11-10 22:13:46 +01:00
adisbladis
849dd43891
tini: 0.13.1 -> 0.16.1 2017-11-11 01:54:57 +08:00
Vladimír Čunát
18aada9c4c
virtualbox: fixup build with glibc-2.26
Explanation:
https://www.linuxquestions.org/questions/slackware-14/sbo-scripts-not-building-on-current-read-1st-post-pls-4175561999/page46.html#post5753698
2017-11-08 10:00:32 +01:00
José Romildo Malaquias
62204a59c7
Merge branch 'master' into upd.lxqt 2017-11-02 10:27:39 -02:00
José Romildo Malaquias
82e75a0bac Merge branch 'upd.lxqt' of github.com:romildo/nixpkgs into upd.lxqt 2017-11-02 10:22:22 -02:00
José Romildo Malaquias
d9f9c0d0d1 qtermwidget: keep version 0.7.1, needed by virt-manager-qt 2017-11-02 10:15:48 -02:00
Peter Hoeg
7c83413a7d virtmanager-qt: 0.43.72 -> 0.45.75 2017-11-02 14:03:58 +08:00
Tim Steinbach
69050c7077
Merge pull request #30896 from NeQuissimus/xen_xsa
xen: 4.8.1 -> 4.8.2; apply XSAs
2017-10-31 07:03:23 -04:00
Herwig Hochleitner
2ede55a37b virtualbox: move extensionPack from meta to passthru 2017-10-29 02:03:46 +02:00
Tim Steinbach
54f8dfda53
xen: Create XSA patch directory 2017-10-28 10:19:12 -04:00
Herwig Hochleitner
e05135d80e virtualbox: expose extensionPack in meta
This way it can be added to system.extraDependencies to save it from gc
2017-10-28 15:10:34 +02:00
Franz Pletz
b3dc24c8c8
qemu: 2.9.1 -> 2.10.1 2017-10-25 17:49:35 +02:00
Wout Mertens
7144f88c48 open-vm-tools: Fix rebooting on NixOS 2017-10-23 13:59:37 +02:00
Vincent Laporte
1923cabeb4 ocamlPackages: default to 4.04 2017-10-19 17:57:14 +02:00
Tim Steinbach
606487e19c Merge pull request #30522 from NeQuissimus/docker_17_10
docker: add 17.10.0-ce
2017-10-19 07:39:50 -04:00
Joachim Fasting
a8a38feeeb
lkl: 2017-08-09 -> 2017-10-18
Based on linux 4.13
2017-10-18 22:11:37 +02:00
Tim Steinbach
de3d191b91
docker: add 17.10.0-ce 2017-10-18 08:25:25 -04:00
Tim Steinbach
7fa69c4e8c Merge pull request #30126 from NeQuissimus/rkt_1_29_0
rkt: 1.28.1 -> 1.29.0
2017-10-07 15:45:39 -04:00
Tim Steinbach
f192ce9730
rkt: 1.28.1 -> 1.29.0 2017-10-05 09:47:30 -04:00
Orivej Desh
fda26c8476 Merge branch 'master' into staging
* master: (271 commits)
  pysmbc: clarify license
  pysmbc: fix license
  bazel: 0.5.4 -> 0.6.0 (#29990)
  googler: init at 3.3
  go: declare support for aarch64
  firefox-beta-bin: 56.0b5 -> 57.0b4
  spotify: 1.0.64.401.g9d720389-21 -> 1.0.64.407.g9bd02c2d-26
  gogs: 0.11.19 -> 0.11.29
  grafana: 4.5.1 -> 4.5.2
  mopidy-iris: 3.4.1 -> 3.4.9
  nextcloud: 12.0.2 -> 12.0.3
  haskell-json-autotype: jailbreak to fix build within LTS 9.x
  kore: fix up
  kore: init at 2.0.0
  glusterfs service: fix issues with useRpcbind
  tig: 2.2.2 -> 2.3.0
  haskell-hspec-core: enable test suite again
  hackage-packages.nix: automatic Haskell package set update
  librsvg: fix thumbnailer path
  awscli: 1.11.108 -> 1.11.162
  ...
2017-10-02 00:22:12 +00:00
Franz Pletz
df86f19968
virt-what: init at 1.18 2017-09-29 00:07:37 +02:00
John Ericson
f037625f87 Merge remote-tracking branch 'upstream/staging' into deps-reorg 2017-09-28 12:32:57 -04:00
Franz Pletz
536ab403d4
qemu: 2.9.0 -> 2.9.1
Security and bugfix release.
2017-09-28 16:59:41 +02:00
Orivej Desh
f1ffca9ac6 docker: fix docker_17_06 build
Broken by #29843
2017-09-28 11:59:53 +02:00
Tim Steinbach
825e417457
docker: add 17.09.0-ce 2017-09-27 08:18:40 -04:00
Peter Hoeg
4f25b7b6b3 open-vm-tools: 10.1.0 -> 10.1.10 2017-09-25 09:41:29 +08:00
John Ericson
ed14223f8c treewide: Manual fix more pkg-config build-inputs 2017-09-21 15:49:54 -04:00
John Ericson
531e4b80c9 misc pkgs: Basic sed to get fix pkgconfig and autoreconfHook buildInputs
Only acts on one-line dependency lists.
2017-09-21 15:49:53 -04:00
Vincent Demeester
19ba982b40
runc: 1.0.0-rc3 -> 1.0.0-rc4
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
2017-09-19 11:55:01 +02:00
Bjørn Forsman
67c70aa581 OVMF: add 'src' attribute
No functional change, but allows getting the source via the standard
attribute: `nix-build -A OVMF.src`.
2017-09-13 17:30:28 +02:00
Tuomas Tynkkynen
84544c5bc2 seabios: Only works on x86
https://hydra.nixos.org/build/60949790
2017-09-13 15:18:15 +03:00
Michael Weiss
6373c9606d vpcs: init at 0.8 2017-09-11 18:54:30 +02:00
Michael Weiss
1011c76598 dynamips: init at 0.2.17 2017-09-11 15:17:56 +02:00
Tim Steinbach
054ed6abc3 Merge pull request #29042 from NeQuissimus/docker_17_06_2
docker: 17.06.1-ce -> 17.06.2-ce
2017-09-06 15:04:22 -04:00
Tim Steinbach
8bd1a220d9
docker: 17.06.1-ce -> 17.06.2-ce 2017-09-05 19:57:29 -04:00
Jaka Hudoklin
3ca311d74d spice-vdagent: systemd-logind integration
This change adds systemd as dependency to enable user session
integration with systemd-logind
2017-09-03 16:14:17 +02:00
Heitham Omar
6dcc77bdb8 docker: add libseccomp to build 2017-08-30 20:28:43 +02:00
Tim Steinbach
693d2403f1 docker-edge: 17.06 -> 17.07 2017-08-30 13:04:45 +02:00
Tim Steinbach
52b56bf02d
containerd: 0.2.5 -> 0.2.9 2017-08-28 20:22:00 -04:00
Robin Gloster
815cffc3f2
docker-distribution: 2.6.0 -> 2.6.2 2017-08-28 12:54:41 +02:00
Jörg Thalheim
0f789e7a0c Merge pull request #28618 from lheckemann/edk2-2017
edk2: 2014-12-10 -> UDK2017
2017-08-28 11:03:47 +01:00
Linus Heckemann
f6afe064a0 edk2: 2014-12-10 -> UDK2017 2017-08-27 19:41:10 +01:00
Tim Steinbach
5b1134cb79
docker: 17.06.0-ce -> 17.06.1-ce 2017-08-18 16:39:43 -04:00
Matthew Bauer
725f7ca2ef coreboot: use https for homepage 2017-08-17 15:04:37 -07:00
Tim Jäger
0c1c3d2b99 qemu: fix HDA recording latency
Very long latency occurs for audio inputs when simulating an Intel HDA device.

Patch courtesy of Volker Rümeling.
https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg03336.html
2017-08-16 09:48:49 +02:00
Frederik Rietdijk
13bbaee21d Merge pull request #27881 from mimadrid/fix/http-https
Update homepage attributes: http -> https
2017-08-13 21:53:20 +02:00
Frederik Rietdijk
7ebcd39a0f Merge commit '4c49205' into HEAD 2017-08-13 18:34:59 +02:00
Franz Pletz
9ac5525f87
virtmanager: 1.4.1 -> 1.4.2 2017-08-12 11:05:22 +02:00
Joachim F
9dfc290027 Merge pull request #28045 from roberth/fix-xen-216-qemuu
xen-4.8: update changed patch hash
2017-08-11 20:08:52 +00:00
Domen Kožar
486e1c3c16 Merge pull request #27998 from davidak/macOS
replace "Mac OS X" and "OS X" with "macOS"
2017-08-11 13:01:36 +02:00
Robin Gloster
700f7614cd Partly revert "python.buildEnv: only wrap executables"
This partly reverts commit 4495bfe138.

The xen changes should not have been commited.

(cherry picked from commit 206a4c9aba)
2017-08-10 19:28:07 +02:00
Frederik Rietdijk
9f73f22c64 Merge commit 'b1f5305abd7b1b3d7ed180d9d00301da6e323e41' into HEAD 2017-08-10 19:26:16 +02:00
Robin Gloster
206a4c9aba
Partly revert "python.buildEnv: only wrap executables"
This partly reverts commit 4495bfe138.

The xen changes should not have been commited.
2017-08-10 12:55:46 +02:00
Frederik Rietdijk
b0c30f436e Merge remote-tracking branch 'upstream/master' into HEAD 2017-08-10 10:41:23 +02:00
Dan Peebles
ed55bdb501 lkl: 2017-06-27 -> 2017-08-09
Just bumping the package version to pick up a bugfix.

Fixes #28055
2017-08-09 14:23:27 +00:00
Robin Gloster
4495bfe138
python.buildEnv: only wrap executables 2017-08-09 15:07:03 +02:00
Robert Hensing
57506bbb28 xen-4.8: update changed patch hash 2017-08-08 17:40:50 +00:00
davidak
3270aa896b replace "Mac OS X" and "OS X" with "macOS"
as it is the official name since 2016

https://en.wikipedia.org/wiki/Macintosh_operating_systems#Desktop

exception are parts refering to older versions of macOS like

"GUI support for Mac OS X 10.6 - 10.12. Note that Emacs 23 and later [...]"
2017-08-07 21:41:30 +02:00
Tim Steinbach
d3203c7876 Merge pull request #27938 from NeQuissimus/rkt_1_28_1
rkt: 1.28.0 -> 1.28.1
2017-08-04 22:18:56 -04:00
Benno Fünfstück
268374cafe docker: update runc commit
This updates to the new runc as was also done upstream:

f3ef17e47d

In particular, it fixes an issue where output of interactive docker containers
would not reset correctly to the beginning of a line.
2017-08-04 23:04:08 +02:00
Tim Steinbach
92461b8f9c
rkt: 1.28.0 -> 1.28.1 2017-08-04 12:06:00 -04:00
mimadrid
09e0cc7cc7
Update homepage attributes: http -> https
Homepage link "http://.../" is a permanent redirect to "https://.../" and should be updated
https://repology.org/repository/nix_stable/problems
2017-08-03 11:56:15 +02:00
Silvan Mosberger
f5fa5fa4d6 pkgs: refactor needless quoting of homepage meta attribute (#27809)
* pkgs: refactor needless quoting of homepage meta attribute

A lot of packages are needlessly quoting the homepage meta attribute
(about 1400, 22%), this commit refactors all of those instances.

* pkgs: Fixing some links that were wrongfully unquoted in the previous
commit

* Fixed some instances
2017-08-01 22:03:30 +02:00
Frederik Rietdijk
740d76371e Merge commit 'ba68231273bea4cba01413fd2a0e56d68db9234c' into HEAD 2017-07-31 09:12:15 +02:00
Robin Gloster
88ca4724b2
virtualboxGuestAdditions: fix hash 2017-07-30 13:29:57 +02:00
Frederik Rietdijk
b2608b8910 Merge remote-tracking branch 'upstream/master' into HEAD 2017-07-29 13:08:11 +02:00
Tim Steinbach
321438d786
rkt: 1.27.0 -> 1.28.0 2017-07-29 00:16:44 -04:00
Franz Pletz
b116fa5ff2
Merge branch 'master' into staging 2017-07-28 16:08:30 +02:00
Tim Steinbach
147477b048
virtualbox: 5.1.24 -> 5.1.26
Fix #27666
2017-07-27 22:14:17 -04:00
John Ericson
9be40841ea Merge remote-tracking branch 'upstream/master' into staging-base
Conflicts:
	pkgs/build-support/cc-wrapper/default.nix
	pkgs/build-support/gcc-wrapper-old/builder.sh
	pkgs/build-support/trivial-builders.nix
	pkgs/desktops/kde-4.14/kde-package/default.nix
	pkgs/development/compilers/openjdk-darwin/8.nix
	pkgs/development/compilers/openjdk-darwin/default.nix
	pkgs/development/compilers/openjdk/7.nix
	pkgs/development/compilers/openjdk/8.nix
	pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
	pkgs/development/compilers/zulu/default.nix
	pkgs/development/haskell-modules/generic-builder.nix
	pkgs/misc/misc.nix
	pkgs/stdenv/generic/builder.sh
	pkgs/stdenv/generic/setup.sh
2017-07-26 13:46:04 -04:00
Tim Steinbach
ee6edb8af5
virtualbox: 5.1.22 -> 5.1.24 2017-07-23 22:22:33 -04:00
Frederik Rietdijk
29f91c107f Merge remote-tracking branch 'upstream/master' into HEAD 2017-07-23 11:23:43 +02:00
Thomas Tuegel
fe800447c2
qemu: unset CPP
Commit 093cc00cdd sets the environment variable
`CPP' by default, but this interferes with dependency calculation.
2017-07-21 16:49:24 -05:00
Vincent Demeester
19325558f1 Fix docker packaging without sandbox
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
2017-07-21 10:00:47 +02:00
AndersonTorres
a3aa0ba18b bochs: 2.6.8 -> 2.6.9 2017-07-15 08:53:15 -03:00
Vincent Demeester
ec570448a0
docker-ce: 17.03.02-ce -> 17.06.0-ce
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
2017-07-10 09:58:32 +02:00
aszlig
12ee0fbd88
virtualbox: Add patch for Linux 4.12
Compiling the kernel modules on Linux 4.12 fails, so I've included an
upstream patch from:

https://www.virtualbox.org/changeset/66927/vbox

The patch is applied against the guest additions as well, where we need
to transform the patch a bit so that we get CR LF line endings (DOS
format), which is what is the case for the guest additions ISO.

I've tested this with all the subtests of the "virtualbox" NixOS VM
tests and they all succeed on x86_64-linux.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2017-07-04 20:08:42 +02:00
Joachim F
a8ba50db3e Merge pull request #26492 from michalpalka/new-xen
xen_4_8: init at 4.8.1
2017-06-30 20:27:04 +01:00
Tim Steinbach
4cc729644e Merge pull request #26867 from michalpalka/xen-security-2017.06-new
xen: patch for XSAs: 216, 217, 218, 219, 220, 221, 222, and 224
2017-06-28 22:43:46 -04:00
Tim Steinbach
fb8a66dcc9 Merge pull request #26945 from NeQuissimus/virtualbox_32bit
virtualbox: Add ability to disable 32-bit guest support
2017-06-28 22:32:12 -04:00
Tim Steinbach
312c2f7961
virtualbox: Add ability to disable 32-bit guest support 2017-06-28 22:24:19 -04:00
Joachim Fasting
0bc3429e77
lkl: 2017-03-24 -> 2017-06-27
Now based on Linux 4.11
2017-06-28 20:14:00 +02:00
Tim Steinbach
add90948bc
docker: 17.03.1-ce -> 17.03.2-ce 2017-06-28 12:49:59 -04:00
Michał Pałka
7b5d72ce04 xen: patch for XSAs: 216, 217, 218, 219, 220, 221, 222, and 224 (xen 4.8)
This commit contains security patches for xen 4.8. The patches
for XSA-216 applied to the kernel are omitted, as they are part of
80e0cda7ff.

XSA-216 Issue Description:

> The block interface response structure has some discontiguous fields.
> Certain backends populate the structure fields of an otherwise
> uninitialized instance of this structure on their stacks, leaking
> data through the (internal or trailing) padding field.

More: https://xenbits.xen.org/xsa/advisory-216.html

XSA-217 Issue Description:

> Domains controlling other domains are permitted to map pages owned by
> the domain being controlled.  If the controlling domain unmaps such a
> page without flushing the TLB, and if soon after the domain being
> controlled transfers this page to another PV domain (via
> GNTTABOP_transfer or, indirectly, XENMEM_exchange), and that third
> domain uses the page as a page table, the controlling domain will have
> write access to a live page table until the applicable TLB entry is
> flushed or evicted.  Note that the domain being controlled is
> necessarily HVM, while the controlling domain is PV.

More: https://xenbits.xen.org/xsa/advisory-217.html

XSA-218 Issue Description:

> We have discovered two bugs in the code unmapping grant references.
>
> * When a grant had been mapped twice by a backend domain, and then
> unmapped by two concurrent unmap calls, the frontend may be informed
> that the page had no further mappings when the first call completed rather
> than when the second call completed.
>
> * A race triggerable by an unprivileged guest could cause a grant
> maptrack entry for grants to be "freed" twice.  The ultimate effect of
> this would be for maptrack entries for a single domain to be re-used.

More: https://xenbits.xen.org/xsa/advisory-218.html

XSA-219 Issue Description:

> When using shadow paging, writes to guest pagetables must be trapped and
> emulated, so the shadows can be suitably adjusted as well.
>
> When emulating the write, Xen maps the guests pagetable(s) to make the final
> adjustment and leave the guest's view of its state consistent.
>
> However, when mapping the frame, Xen drops the page reference before
> performing the write.  This is a race window where the underlying frame can
> change ownership.
>
> One possible attack scenario is for the frame to change ownership and to be
> inserted into a PV guest's pagetables.  At that point, the emulated write will
> be an unaudited modification to the PV pagetables whose value is under guest
> control.

More: https://xenbits.xen.org/xsa/advisory-219.html

XSA-220 Issue Description:

> Memory Protection Extensions (MPX) and Protection Key (PKU) are features in
> newer processors, whose state is intended to be per-thread and context
> switched along with all other XSAVE state.
>
> Xen's vCPU context switch code would save and restore the state only
> if the guest had set the relevant XSTATE enable bits.  However,
> surprisingly, the use of these features is not dependent (PKU) or may
> not be dependent (MPX) on having the relevant XSTATE bits enabled.
>
> VMs which use MPX or PKU, and context switch the state manually rather
> than via XSAVE, will have the state leak between vCPUs (possibly,
> between vCPUs in different guests).  This in turn corrupts state in
> the destination vCPU, and hence may lead to weakened protections
>
> Experimentally, MPX appears not to make any interaction with BND*
> state if BNDCFGS.EN is set but XCR0.BND{CSR,REGS} are clear.  However,
> the SDM is not clear in this case; therefore MPX is included in this
> advisory as a precaution.

More: https://xenbits.xen.org/xsa/advisory-220.html

XSA-221 Issue Description:

> When polling event channels, in general arbitrary port numbers can be
> specified.  Specifically, there is no requirement that a polled event
> channel ports has ever been created.  When the code was generalised
> from an earlier implementation, introducing some intermediate
> pointers, a check should have been made that these intermediate
> pointers are non-NULL.  However, that check was omitted.

More: https://xenbits.xen.org/xsa/advisory-221.html

XSA-222 Issue Description:

> Certain actions require removing pages from a guest's P2M
> (Physical-to-Machine) mapping.  When large pages are in use to map
> guest pages in the 2nd-stage page tables, such a removal operation may
> incur a memory allocation (to replace a large mapping with individual
> smaller ones).  If this allocation fails, these errors are ignored by
> the callers, which would then continue and (for example) free the
> referenced page for reuse.  This leaves the guest with a mapping to a
> page it shouldn't have access to.
>
> The allocation involved comes from a separate pool of memory created
> when the domain is created; under normal operating conditions it never
> fails, but a malicious guest may be able to engineer situations where
> this pool is exhausted.

More: https://xenbits.xen.org/xsa/advisory-222.html

XSA-224 Issue Description:

> We have discovered a number of bugs in the code mapping and unmapping
> grant references.
>
> * If a grant is mapped with both the GNTMAP_device_map and
> GNTMAP_host_map flags, but unmapped only with host_map, the device_map
> portion remains but the page reference counts are lowered as though it
> had been removed. This bug can be leveraged cause a page's reference
> counts and type counts to fall to zero while retaining writeable
> mappings to the page.
>
> * Under some specific conditions, if a grant is mapped with both the
> GNTMAP_device_map and GNTMAP_host_map flags, the operation may not
> grab sufficient type counts.  When the grant is then unmapped, the
> type count will be erroneously reduced.  This bug can be leveraged
> cause a page's reference counts and type counts to fall to zero while
> retaining writeable mappings to the page.
>
> * When a grant reference is given to an MMIO region (as opposed to a
> normal guest page), if the grant is mapped with only the
> GNTMAP_device_map flag set, a mapping is created at host_addr anyway.
> This does *not* cause reference counts to change, but there will be no
> record of this mapping, so it will not be considered when reporting
> whether the grant is still in use.

More: https://xenbits.xen.org/xsa/advisory-224.html
2017-06-27 12:02:59 +00:00