From cf648c09cc2029aba1599816386f02456b212cb3 Mon Sep 17 00:00:00 2001 From: Fernando Rodrigues Date: Thu, 10 Oct 2024 21:47:32 +0000 Subject: [PATCH 1/2] xen: make the EFI build mandatory As binutils-efi no longer exists, there's no longer any reason to have the withEFI flag. All supported builds should also build xen.efi. Signed-off-by: Fernando Rodrigues --- pkgs/build-support/xen/default.nix | 23 ++++++----------------- 1 file changed, 6 insertions(+), 17 deletions(-) diff --git a/pkgs/build-support/xen/default.nix b/pkgs/build-support/xen/default.nix index 9b57c335c8dd..6dc8e38d9295 100644 --- a/pkgs/build-support/xen/default.nix +++ b/pkgs/build-support/xen/default.nix @@ -60,7 +60,6 @@ branch ? lib.versions.majorMinor version, version, vendor ? "nixos", - withEFI ? true, withFlask ? false, withSeaBIOS ? true, withOVMF ? true, @@ -280,8 +279,6 @@ stdenv.mkDerivation (finalAttrs: { "GIT=${coreutils}/bin/false" "WGET=${coreutils}/bin/false" - ] - ++ optionals withEFI [ "EFI_VENDOR=${vendor}" "INSTALL_EFI_STRIP=1" "LD=${getExe' binutils-unwrapped-all-targets "ld"}" @@ -386,8 +383,7 @@ stdenv.mkDerivation (finalAttrs: { ''; passthru = { - efi = - if withEFI then "boot/xen-${version}.efi" else throw "This Xen was compiled without an EFI binary."; + efi = "boot/xen-${version}.efi"; flaskPolicy = if withFlask then "boot/xenpolicy-${version}" @@ -434,18 +430,11 @@ stdenv.mkDerivation (finalAttrs: { Use with the `qemu_xen` package. '' - # Then, if any of the optional with* components are being built, add the "Includes:" string. - + optionalString (withEFI || withFlask) ( - "\nIncludes:" - # Originally, this was a call for the complicated withPrefetchedSources. Since there aren't - # that many optional components, we just use lib.strings.optionalString, because it's simpler. - # Optional components that aren't being built are automatically hidden. - + optionalString withEFI "\n* `xen.efi`: The Xen Project's [EFI binary](https://xenbits.xenproject.org/docs/${branch}-testing/misc/efi.html), available on the `boot` output of this package." - + optionalString withFlask "\n* `xsm-flask`: The [FLASK Xen Security Module](https://wiki.xenproject.org/wiki/Xen_Security_Modules_:_XSM-FLASK). The `xenpolicy-${version}` file is available on the `boot` output of this package." - + optionalString withSeaBIOS "\n* `seabios`: Support for the SeaBIOS boot firmware on HVM domains." - + optionalString withOVMF "\n* `ovmf`: Support for the OVMF UEFI boot firmware on HVM domains." - + optionalString withIPXE "\n* `ipxe`: Support for the iPXE boot firmware on HVM domains." - ) + + "\nIncludes:\n* `xen.efi`: The Xen Project's [EFI binary](https://xenbits.xenproject.org/docs/${branch}-testing/misc/efi.html), available on the `boot` output of this package." + + optionalString withFlask "\n* `xsm-flask`: The [FLASK Xen Security Module](https://wiki.xenproject.org/wiki/Xen_Security_Modules_:_XSM-FLASK). The `xenpolicy-${version}` file is available on the `boot` output of this package." + + optionalString withSeaBIOS "\n* `seabios`: Support for the SeaBIOS boot firmware on HVM domains." + + optionalString withOVMF "\n* `ovmf`: Support for the OVMF UEFI boot firmware on HVM domains." + + optionalString withIPXE "\n* `ipxe`: Support for the iPXE boot firmware on HVM domains." # Finally, we write a notice explaining which vulnerabilities this Xen is NOT vulnerable to. # This will hopefully give users the peace of mind that their Xen is secure, without needing # to search the source code for the XSA patches. From aaa4953b20f41352a18e602cfb6270076452db79 Mon Sep 17 00:00:00 2001 From: Fernando Rodrigues Date: Fri, 11 Oct 2024 16:47:23 +0000 Subject: [PATCH 2/2] xen: fix XSA 462 description formatting The newlines break the markdown quote in the longDescription. Signed-off-by: Fernando Rodrigues --- pkgs/build-support/xen/patches.nix | 3 --- 1 file changed, 3 deletions(-) diff --git a/pkgs/build-support/xen/patches.nix b/pkgs/build-support/xen/patches.nix index 66ca02e52dd9..7b8395154f28 100644 --- a/pkgs/build-support/xen/patches.nix +++ b/pkgs/build-support/xen/patches.nix @@ -142,14 +142,11 @@ in In x86's APIC (Advanced Programmable Interrupt Controller) architecture, error conditions are reported in a status register. Furthermore, the OS can opt to receive an interrupt when a new error occurs. - It is possible to configure the error interrupt with an illegal vector, which generates an error when an error interrupt is raised. - This case causes Xen to recurse through vlapic_error(). The recursion itself is bounded; errors accumulate in the the status register and only generate an interrupt when a new status bit becomes set. - However, the lock protecting this state in Xen will try to be taken recursively, and deadlock. '';