From 9e6bfbb2f92d8e1995365775bee63809631b132c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C5=82=20Pa=C5=82ka?= Date: Thu, 11 May 2017 10:12:47 +0000 Subject: [PATCH 1/2] xen_4_8: init at 4.8.1 This commit adds the xen_4_8 package to be used instead of xen (currently at 4.5.5): * Add packages xen_4_8, xen_4_8-slim and xen_4_8-light * Add packages qemu_xen_4_8 and qemu_xen_4_8-light to be used with xen_4_8-slim and xen_4_8-light respectively. * Add systemd to buildInputs of xen (it is required by oxenstored) * Adapt xen service to work with the new version of xen * Use xen-init-dom0 to initlilise dom0 in xen-store * Currently, the virtualisation.xen.stored option is ignored if xen 4.8 is used --- nixos/modules/virtualisation/xen-dom0.nix | 55 +++--- pkgs/applications/virtualization/xen/4.8.nix | 165 ++++++++++++++++++ .../virtualization/xen/generic.nix | 23 ++- .../virtualization/xen/packages.nix | 50 ++++++ pkgs/top-level/all-packages.nix | 5 + 5 files changed, 270 insertions(+), 28 deletions(-) create mode 100644 pkgs/applications/virtualization/xen/4.8.nix diff --git a/nixos/modules/virtualisation/xen-dom0.nix b/nixos/modules/virtualisation/xen-dom0.nix index f6f2d5dad01c..5239652d4075 100644 --- a/nixos/modules/virtualisation/xen-dom0.nix +++ b/nixos/modules/virtualisation/xen-dom0.nix @@ -267,26 +267,36 @@ in mkdir -p /var/lib/xen # so we create them here unconditionally. grep -q control_d /proc/xen/capabilities ''; - serviceConfig.ExecStart = '' - ${cfg.stored}${optionalString cfg.trace " -T /var/log/xen/xenstored-trace.log"} --no-fork - ''; + serviceConfig = if cfg.package.version < "4.8" then + { ExecStart = '' + ${cfg.stored}${optionalString cfg.trace " -T /var/log/xen/xenstored-trace.log"} --no-fork + ''; + } else { + ExecStart = '' + ${cfg.package}/etc/xen/scripts/launch-xenstore + ''; + Type = "notify"; + RemainAfterExit = true; + NotifyAccess = "all"; + }; postStart = '' - time=0 - timeout=30 - # Wait for xenstored to actually come up, timing out after 30 seconds - while [ $time -lt $timeout ] && ! `${cfg.package}/bin/xenstore-read -s / >/dev/null 2>&1` ; do - time=$(($time+1)) - sleep 1 - done + ${optionalString (cfg.package.version < "4.8") '' + time=0 + timeout=30 + # Wait for xenstored to actually come up, timing out after 30 seconds + while [ $time -lt $timeout ] && ! `${cfg.package}/bin/xenstore-read -s / >/dev/null 2>&1` ; do + time=$(($time+1)) + sleep 1 + done - # Exit if we timed out - if ! [ $time -lt $timeout ] ; then - echo "Could not start Xenstore Daemon" - exit 1 - fi - - ${cfg.package}/bin/xenstore-write "/local/domain/0/name" "Domain-0" - ${cfg.package}/bin/xenstore-write "/local/domain/0/domid" 0 + # Exit if we timed out + if ! [ $time -lt $timeout ] ; then + echo "Could not start Xenstore Daemon" + exit 1 + fi + ''} + echo "executing xen-init-dom0" + ${cfg.package}/lib/xen/bin/xen-init-dom0 ''; }; @@ -306,6 +316,7 @@ in description = "Xen Console Daemon"; wantedBy = [ "multi-user.target" ]; after = [ "xen-store.service" ]; + requires = [ "xen-store.service" ]; preStart = '' mkdir -p /var/run/xen ${optionalString cfg.trace "mkdir -p /var/log/xen"} @@ -313,7 +324,9 @@ in ''; serviceConfig = { ExecStart = '' - ${cfg.package}/bin/xenconsoled${optionalString cfg.trace " --log=all --log-dir=/var/log/xen"} + ${cfg.package}/bin/xenconsoled\ + ${optionalString ((cfg.package.version >= "4.8")) " -i"}\ + ${optionalString cfg.trace " --log=all --log-dir=/var/log/xen"} ''; }; }; @@ -323,6 +336,7 @@ in description = "Xen Qemu Daemon"; wantedBy = [ "multi-user.target" ]; after = [ "xen-console.service" ]; + requires = [ "xen-store.service" ]; serviceConfig.ExecStart = '' ${cfg.qemu} -xen-attach -xen-domid 0 -name dom0 -M xenpv \ -nographic -monitor /dev/null -serial /dev/null -parallel /dev/null @@ -333,7 +347,7 @@ in systemd.services.xen-watchdog = { description = "Xen Watchdog Daemon"; wantedBy = [ "multi-user.target" ]; - after = [ "xen-qemu.service" ]; + after = [ "xen-qemu.service" "xen-domains.service" ]; serviceConfig.ExecStart = "${cfg.package}/bin/xenwatchdogd 30 15"; serviceConfig.Type = "forking"; serviceConfig.RestartSec = "1"; @@ -426,6 +440,7 @@ in description = "Xen domains - automatically starts, saves and restores Xen domains"; wantedBy = [ "multi-user.target" ]; after = [ "xen-bridge.service" "xen-qemu.service" ]; + requires = [ "xen-bridge.service" "xen-qemu.service" ]; ## To prevent a race between dhcpcd and xend's bridge setup script ## (which renames eth* to peth* and recreates eth* as a virtual ## device), start dhcpcd after xend. diff --git a/pkgs/applications/virtualization/xen/4.8.nix b/pkgs/applications/virtualization/xen/4.8.nix new file mode 100644 index 000000000000..487758719e74 --- /dev/null +++ b/pkgs/applications/virtualization/xen/4.8.nix @@ -0,0 +1,165 @@ +{ stdenv, callPackage, fetchurl, fetchpatch, fetchgit +, withInternalQemu ? true +, withInternalTraditionalQemu ? true +, withInternalSeabios ? true +, withSeabios ? !withInternalSeabios, seabios ? null +, withInternalOVMF ? false # FIXME: tricky to build +, withOVMF ? false, OVMF +, withLibHVM ? true + +# qemu +, udev, pciutils, xorg, SDL, pixman, acl, glusterfs, spice_protocol, usbredir +, alsaLib +, ... } @ args: + +assert withInternalSeabios -> !withSeabios; +assert withInternalOVMF -> !withOVMF; + +with stdenv.lib; + +# Patching XEN? Check the XSAs at +# https://xenbits.xen.org/xsa/ +# and try applying all the ones we don't have yet. + +let + xsaPatch = { name , sha256 }: (fetchpatch { + url = "https://xenbits.xen.org/xsa/xsa${name}.patch"; + inherit sha256; + }); + + qemuDeps = [ + udev pciutils xorg.libX11 SDL pixman acl glusterfs spice_protocol usbredir + alsaLib + ]; +in + +callPackage (import ./generic.nix (rec { + version = "4.8.1"; + + src = fetchurl { + url = "http://bits.xensource.com/oss-xen/release/${version}/xen-${version}.tar.gz"; + sha256 = "158kb1w61jmwxi3fc560s4269hhpxrin9xhm60ljj52njhxias8x"; + }; + + # Sources needed to build tools and firmwares. + xenfiles = optionalAttrs withInternalQemu { + "qemu-xen" = { + src = fetchgit { + url = https://xenbits.xen.org/git-http/qemu-xen.git; + rev = "refs/tags/qemu-xen-${version}"; + sha256 = "1v19pp86kcgwvsbkrdrn4rlaj02i4054avw8k70w1m0rnwgcsdbs"; + }; + buildInputs = qemuDeps; + patches = [ + #(xsaPatch { + # name = "197-4.5-qemuu"; + # sha256 = "09gp980qdlfpfmxy0nk7ncyaa024jnrpzx9gpq2kah21xygy5myx"; + #}) + ]; + meta.description = "Xen's fork of upstream Qemu"; + }; + } // optionalAttrs withInternalTraditionalQemu { + "qemu-xen-traditional" = { + src = fetchgit { + url = https://xenbits.xen.org/git-http/qemu-xen-traditional.git; + rev = "refs/tags/xen-${version}"; + sha256 = "0mryap5y53r09m7qc0b821f717ghwm654r8c3ik1w7adzxr0l5qk"; + }; + buildInputs = qemuDeps; + patches = [ + ]; + postPatch = '' + substituteInPlace xen-hooks.mak \ + --replace /usr/include/pci ${pciutils}/include/pci + ''; + meta.description = "Xen's fork of upstream Qemu that uses old device model"; + }; + } // optionalAttrs withInternalSeabios { + "firmware/seabios-dir-remote" = { + src = fetchgit { + url = https://xenbits.xen.org/git-http/seabios.git; + rev = "f0cdc36d2f2424f6b40438f7ee7cc502c0eff4df"; + sha256 = "1wq5pjkjrfzqnq3wyr15mcn1l4c563m65gdyf8jm97kgb13pwwfm"; + }; + patches = [ ./0000-qemu-seabios-enable-ATA_DMA.patch ]; + meta.description = "Xen's fork of Seabios"; + }; + } // optionalAttrs withInternalOVMF { + "firmware/ovmf-dir-remote" = { + src = fetchgit { + url = https://xenbits.xen.org/git-http/ovmf.git; + rev = "173bf5c847e3ca8b42c11796ce048d8e2e916ff8"; + sha256 = "07zmdj90zjrzip74fvd4ss8n8njk6cim85s58mc6snxmqqv7gmcr"; + }; + meta.description = "Xen's fork of OVMF"; + }; + } // { + # TODO: patch Xen to make this optional? + "firmware/etherboot/ipxe.git" = { + src = fetchgit { + url = https://git.ipxe.org/ipxe.git; + rev = "356f6c1b64d7a97746d1816cef8ca22bdd8d0b5d"; + sha256 = "15n400vm3id5r8y3k6lrp9ab2911a9vh9856f5gvphkazfnmns09"; + }; + meta.description = "Xen's fork of iPXE"; + }; + } // optionalAttrs withLibHVM { + "xen-libhvm-dir-remote" = { + src = fetchgit { + name = "xen-libhvm"; + url = https://github.com/michalpalka/xen-libhvm; + rev = "83065d36b36d6d527c2a4e0f5aaf0a09ee83122c"; + sha256 = "1jzv479wvgjkazprqdzcdjy199azmx2xl3pnxli39kc5mvjz3lzd"; + }; + buildPhase = '' + make + cd biospt + cc -Wall -g -D_LINUX -Wstrict-prototypes biospt.c -o biospt -I../libhvm -L../libhvm -lxenhvm + ''; + installPhase = '' + make install + cp biospt/biospt $out/bin/ + ''; + meta = { + description = '' + Helper library for reading ACPI and SMBIOS firmware values + from the host system for use with the HVM guest firmware + pass-through feature in Xen''; + license = licenses.bsd2; + }; + }; + }; + + configureFlags = [] + ++ optional (!withInternalQemu) "--with-system-qemu" # use qemu from PATH + ++ optional (withInternalTraditionalQemu) "--enable-qemu-traditional" + ++ optional (!withInternalTraditionalQemu) "--disable-qemu-traditional" + + ++ optional (withSeabios) "--with-system-seabios=${seabios}" + ++ optional (!withInternalSeabios && !withSeabios) "--disable-seabios" + + ++ optional (withOVMF) "--with-system-ovmf=${OVMF.fd}/FV/OVMF.fd" + ++ optional (withInternalOVMF) "--enable-ovmf"; + + patches = + [ (xsaPatch { + name = "213-4.8"; + sha256 = "0ia3zr6r3bqy2h48fdy7p0iz423lniy3i0qkdvzgv5a8m80darr2"; + }) + (xsaPatch { + name = "214"; + sha256 = "0qapzx63z0yl84phnpnglpkxp6b9sy1y7cilhwjhxyigpfnm2rrk"; + }) + ]; + + # Fix build on Glibc 2.24. + NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations"; + + postPatch = '' + # Avoid a glibc >= 2.25 deprecation warnings that get fatal via -Werror. + sed 1i'#include ' \ + -i tools/blktap2/control/tap-ctl-allocate.c \ + -i tools/libxl/libxl_device.c + ''; + +})) args diff --git a/pkgs/applications/virtualization/xen/generic.nix b/pkgs/applications/virtualization/xen/generic.nix index b0b353c5fa28..434853b7cc12 100644 --- a/pkgs/applications/virtualization/xen/generic.nix +++ b/pkgs/applications/virtualization/xen/generic.nix @@ -14,7 +14,7 @@ config: # Scripts , coreutils, gawk, gnused, gnugrep, diffutils, multipath-tools , iproute, inetutils, iptables, bridge-utils, openvswitch, nbd, drbd -, lvm2, utillinux, procps +, lvm2, utillinux, procps, systemd # Documentation # python2Packages.markdown @@ -61,7 +61,7 @@ stdenv.mkDerivation (rec { libiconv libuuid ncurses openssl perl python2Packages.python xz yajl zlib # oxenstored - ocamlPackages.findlib ocamlPackages.ocaml + ocamlPackages.findlib ocamlPackages.ocaml systemd # Python fixes python2Packages.wrapPython @@ -153,12 +153,19 @@ stdenv.mkDerivation (rec { substituteInPlace tools/xenstat/Makefile \ --replace /usr/include/curses.h ${ncurses.dev}/include/curses.h - # TODO: use this as a template and support our own if-up scripts instead? - substituteInPlace tools/hotplug/Linux/xen-backend.rules.in \ - --replace "@XEN_SCRIPT_DIR@" $out/etc/xen/scripts + ${optionalString (config.version >= "4.8") '' + substituteInPlace tools/hotplug/Linux/launch-xenstore.in \ + --replace /bin/mkdir mkdir + ''} - # blktap is not provided by xen, but by xapi - sed -i '/blktap/d' tools/hotplug/Linux/xen-backend.rules.in + ${optionalString (config.version < "4.6") '' + # TODO: use this as a template and support our own if-up scripts instead? + substituteInPlace tools/hotplug/Linux/xen-backend.rules.in \ + --replace "@XEN_SCRIPT_DIR@" $out/etc/xen/scripts + + # blktap is not provided by xen, but by xapi + sed -i '/blktap/d' tools/hotplug/Linux/xen-backend.rules.in + ''} ${withTools "patches" (name: x: '' ${concatMapStringsSep "\n" (p: '' @@ -191,7 +198,7 @@ stdenv.mkDerivation (rec { ''; installPhase = '' - mkdir -p $out $out/share + mkdir -p $out $out/share $out/share/man cp -prvd dist/install/nix/store/*/* $out/ cp -prvd dist/install/boot $out/boot cp -prvd dist/install/etc $out diff --git a/pkgs/applications/virtualization/xen/packages.nix b/pkgs/applications/virtualization/xen/packages.nix index 633ec4f3d124..8f5262acb024 100644 --- a/pkgs/applications/virtualization/xen/packages.nix +++ b/pkgs/applications/virtualization/xen/packages.nix @@ -57,6 +57,56 @@ rec { }; }; + xen_4_8-vanilla = callPackage ./4.8.nix { + # At the very least included seabios and etherboot need gcc49, + # so we have to build all of it with gcc49. + stdenv = overrideCC stdenv gcc49; + + meta = { + description = "vanilla"; + longDescription = '' + Vanilla version of Xen. Uses forks of Qemu and Seabios bundled + with Xen. This gives vanilla experince, but wastes space and + build time: typical NixOS setup that runs lots of VMs will + build three different versions of Qemu when using this (two + forks and upstream). + ''; + }; + }; + + xen_4_8-slim = xen_4_8-vanilla.override { + withInternalQemu = false; + withInternalTraditionalQemu = true; + withInternalSeabios = false; + withSeabios = true; + + meta = { + description = "slim"; + longDescription = '' + Slimmed-down version of Xen that reuses nixpkgs packages as + much as possible. Different parts may get out of sync, but + this builds faster and uses less space than vanilla. Use with + `qemu_xen` from nixpkgs. + ''; + }; + }; + + xen_4_8-light = xen_4_8-vanilla.override { + withInternalQemu = false; + withInternalTraditionalQemu = false; + withInternalSeabios = false; + withSeabios = true; + + meta = { + description = "light"; + longDescription = '' + Slimmed-down version of Xen without `qemu-traditional` (you + don't need it if you don't know what it is). Use with + `qemu_xen-light` from nixpkgs. + ''; + }; + }; + xen-vanilla = xen_4_5-vanilla; xen-slim = xen_4_5-slim; xen-light = xen_4_5-light; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 5bb3750340da..67bada8dce4c 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -12352,6 +12352,8 @@ with pkgs; # Building with `xen` instead of `xen-slim` is possible, but makes no sense. qemu_xen = lowPrio (qemu.override { x86Only = true; xenSupport = true; xen = xen-slim; }); qemu_xen-light = lowPrio (qemu.override { x86Only = true; xenSupport = true; xen = xen-light; }); + qemu_xen_4_8 = lowPrio (qemu.override { x86Only = true; xenSupport = true; xen = xen_4_8-slim; }); + qemu_xen_4_8-light = lowPrio (qemu.override { x86Only = true; xenSupport = true; xen = xen_4_8-light; }); qemu_test = lowPrio (qemu.override { x86Only = true; nixosTestRunner = true; }); @@ -16631,6 +16633,9 @@ with pkgs; xen = xenPackages.xen_4_5-vanilla; xen-slim = xenPackages.xen_4_5-slim; xen-light = xenPackages.xen_4_5-light; + xen_4_8 = xenPackages.xen_4_8-vanilla; + xen_4_8-slim = xenPackages.xen_4_8-slim; + xen_4_8-light = xenPackages.xen_4_8-light; xkbset = callPackage ../tools/X11/xkbset { }; From 7b5d72ce048ffc48ba437560247bf069a87b1c73 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C5=82=20Pa=C5=82ka?= Date: Mon, 26 Jun 2017 12:12:33 +0000 Subject: [PATCH 2/2] xen: patch for XSAs: 216, 217, 218, 219, 220, 221, 222, and 224 (xen 4.8) This commit contains security patches for xen 4.8. The patches for XSA-216 applied to the kernel are omitted, as they are part of 80e0cda7ff92233edc94161eae5838a1c423e5e4. XSA-216 Issue Description: > The block interface response structure has some discontiguous fields. > Certain backends populate the structure fields of an otherwise > uninitialized instance of this structure on their stacks, leaking > data through the (internal or trailing) padding field. More: https://xenbits.xen.org/xsa/advisory-216.html XSA-217 Issue Description: > Domains controlling other domains are permitted to map pages owned by > the domain being controlled. If the controlling domain unmaps such a > page without flushing the TLB, and if soon after the domain being > controlled transfers this page to another PV domain (via > GNTTABOP_transfer or, indirectly, XENMEM_exchange), and that third > domain uses the page as a page table, the controlling domain will have > write access to a live page table until the applicable TLB entry is > flushed or evicted. Note that the domain being controlled is > necessarily HVM, while the controlling domain is PV. More: https://xenbits.xen.org/xsa/advisory-217.html XSA-218 Issue Description: > We have discovered two bugs in the code unmapping grant references. > > * When a grant had been mapped twice by a backend domain, and then > unmapped by two concurrent unmap calls, the frontend may be informed > that the page had no further mappings when the first call completed rather > than when the second call completed. > > * A race triggerable by an unprivileged guest could cause a grant > maptrack entry for grants to be "freed" twice. The ultimate effect of > this would be for maptrack entries for a single domain to be re-used. More: https://xenbits.xen.org/xsa/advisory-218.html XSA-219 Issue Description: > When using shadow paging, writes to guest pagetables must be trapped and > emulated, so the shadows can be suitably adjusted as well. > > When emulating the write, Xen maps the guests pagetable(s) to make the final > adjustment and leave the guest's view of its state consistent. > > However, when mapping the frame, Xen drops the page reference before > performing the write. This is a race window where the underlying frame can > change ownership. > > One possible attack scenario is for the frame to change ownership and to be > inserted into a PV guest's pagetables. At that point, the emulated write will > be an unaudited modification to the PV pagetables whose value is under guest > control. More: https://xenbits.xen.org/xsa/advisory-219.html XSA-220 Issue Description: > Memory Protection Extensions (MPX) and Protection Key (PKU) are features in > newer processors, whose state is intended to be per-thread and context > switched along with all other XSAVE state. > > Xen's vCPU context switch code would save and restore the state only > if the guest had set the relevant XSTATE enable bits. However, > surprisingly, the use of these features is not dependent (PKU) or may > not be dependent (MPX) on having the relevant XSTATE bits enabled. > > VMs which use MPX or PKU, and context switch the state manually rather > than via XSAVE, will have the state leak between vCPUs (possibly, > between vCPUs in different guests). This in turn corrupts state in > the destination vCPU, and hence may lead to weakened protections > > Experimentally, MPX appears not to make any interaction with BND* > state if BNDCFGS.EN is set but XCR0.BND{CSR,REGS} are clear. However, > the SDM is not clear in this case; therefore MPX is included in this > advisory as a precaution. More: https://xenbits.xen.org/xsa/advisory-220.html XSA-221 Issue Description: > When polling event channels, in general arbitrary port numbers can be > specified. Specifically, there is no requirement that a polled event > channel ports has ever been created. When the code was generalised > from an earlier implementation, introducing some intermediate > pointers, a check should have been made that these intermediate > pointers are non-NULL. However, that check was omitted. More: https://xenbits.xen.org/xsa/advisory-221.html XSA-222 Issue Description: > Certain actions require removing pages from a guest's P2M > (Physical-to-Machine) mapping. When large pages are in use to map > guest pages in the 2nd-stage page tables, such a removal operation may > incur a memory allocation (to replace a large mapping with individual > smaller ones). If this allocation fails, these errors are ignored by > the callers, which would then continue and (for example) free the > referenced page for reuse. This leaves the guest with a mapping to a > page it shouldn't have access to. > > The allocation involved comes from a separate pool of memory created > when the domain is created; under normal operating conditions it never > fails, but a malicious guest may be able to engineer situations where > this pool is exhausted. More: https://xenbits.xen.org/xsa/advisory-222.html XSA-224 Issue Description: > We have discovered a number of bugs in the code mapping and unmapping > grant references. > > * If a grant is mapped with both the GNTMAP_device_map and > GNTMAP_host_map flags, but unmapped only with host_map, the device_map > portion remains but the page reference counts are lowered as though it > had been removed. This bug can be leveraged cause a page's reference > counts and type counts to fall to zero while retaining writeable > mappings to the page. > > * Under some specific conditions, if a grant is mapped with both the > GNTMAP_device_map and GNTMAP_host_map flags, the operation may not > grab sufficient type counts. When the grant is then unmapped, the > type count will be erroneously reduced. This bug can be leveraged > cause a page's reference counts and type counts to fall to zero while > retaining writeable mappings to the page. > > * When a grant reference is given to an MMIO region (as opposed to a > normal guest page), if the grant is mapped with only the > GNTMAP_device_map flag set, a mapping is created at host_addr anyway. > This does *not* cause reference counts to change, but there will be no > record of this mapping, so it will not be considered when reporting > whether the grant is still in use. More: https://xenbits.xen.org/xsa/advisory-224.html --- pkgs/applications/virtualization/xen/4.8.nix | 60 ++++++++++++++++++-- 1 file changed, 56 insertions(+), 4 deletions(-) diff --git a/pkgs/applications/virtualization/xen/4.8.nix b/pkgs/applications/virtualization/xen/4.8.nix index 487758719e74..f6205f5c467a 100644 --- a/pkgs/applications/virtualization/xen/4.8.nix +++ b/pkgs/applications/virtualization/xen/4.8.nix @@ -51,10 +51,10 @@ callPackage (import ./generic.nix (rec { }; buildInputs = qemuDeps; patches = [ - #(xsaPatch { - # name = "197-4.5-qemuu"; - # sha256 = "09gp980qdlfpfmxy0nk7ncyaa024jnrpzx9gpq2kah21xygy5myx"; - #}) + (xsaPatch { + name = "216-qemuu"; + sha256 = "09gp980qdlfpfmxy0nk7ncyaa024jnrpzx9gpq2kah21xygy5ma1"; + }) ]; meta.description = "Xen's fork of upstream Qemu"; }; @@ -150,6 +150,58 @@ callPackage (import ./generic.nix (rec { name = "214"; sha256 = "0qapzx63z0yl84phnpnglpkxp6b9sy1y7cilhwjhxyigpfnm2rrk"; }) + (xsaPatch { + name = "217"; + sha256 = "1khs5ilif14dzcm7lmikjzkwsrfzlmir1rgrgzkc411gf18ylzmj"; + }) + (xsaPatch { + name = "218-4.8/0001-gnttab-fix-unmap-pin-accounting-race"; + sha256 = "0r363frai239r2wmwxi48kcr50gbk5l64nja0h9lppi3z2y3dkdd"; + }) + (xsaPatch { + name = "218-4.8/0002-gnttab-Avoid-potential-double-put-of-maptrack-entry"; + sha256 = "07wm06i7frv7bsaykakx3g9h0hfqv96zcadvwf6wv194dggq1plc"; + }) + (xsaPatch { + name = "218-4.8/0003-gnttab-correct-maptrack-table-accesses"; + sha256 = "0ad0irc3p4dmla8sp3frxbh2qciji1dipkslh0xqvy2hyf9p80y9"; + }) + (xsaPatch { + name = "219-4.8"; + sha256 = "16q7kiamy86x8qdvls74wmq5j72kgzgdilryig4q1b21mp0ij1jq"; + }) + (xsaPatch { + name = "220-4.8"; + sha256 = "0214qyqx7qap5y1pdi9fm0vz4y2fbyg71gaq36fisknj35dv2mh5"; + }) + (xsaPatch { + name = "221"; + sha256 = "1mcr1nqgxyjrkywdg7qhlfwgz7vj2if1dhic425vgd41p9cdgl26"; + }) + (xsaPatch { + name = "222-1"; + sha256 = "0x02x4kqwfw255638fh2zcxwig1dy6kadlmqim1jgnjgmrvvqas2"; + }) + (xsaPatch { + name = "222-2-4.8"; + sha256 = "1xhyp6q3c5l8djh965g1i8201m2wvhms8k886h4sn30hks38giin"; + }) + (xsaPatch { + name = "224-4.8/0001-gnttab-Fix-handling-of-dev_bus_addr-during-unmap"; + sha256 = "1k326yan5811qzyvpdfkv801a19nyd09nsqayi8gyh58xx9c21m4"; + }) + (xsaPatch { + name = "224-4.8/0002-gnttab-never-create-host-mapping-unless-asked-to"; + sha256 = "06nj1x59bbx9hrj26xmvbw8z805lfqhld9hm0ld0fs6dmcpqzcck"; + }) + (xsaPatch { + name = "224-4.8/0003-gnttab-correct-logic-to-get-page-references-during-m"; + sha256 = "0kmag6fdsskgplcvzqp341yfi6pgc14wvjj58bp7ydb9hdk53qx2"; + }) + (xsaPatch { + name = "224-4.8/0004-gnttab-__gnttab_unmap_common_complete-is-all-or-noth"; + sha256 = "1ww80pi7jr4gjpymkcw8qxmr5as18b2asdqv35527nqprylsff9f"; + }) ]; # Fix build on Glibc 2.24.