diff options
25 files changed, 1743 insertions, 68 deletions
diff --git a/doc/guix.texi b/doc/guix.texi index 46dccb8e2b..f707b5c58f 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -5475,7 +5475,7 @@ adds or adjust services for a typical ``desktop'' setup. In particular, it adds a graphical login manager (@pxref{X Window, @code{slim-service}}), a network management tool (@pxref{Networking Services, @code{wicd-service}}), energy and color management services, -an NTP client and an SSH server (@pxref{Networking Services}), the Avahi +an NTP client (@pxref{Networking Services}), the Avahi daemon, and has the name service switch service configured to be able to use @code{nss-mdns} (@pxref{Name Service Switch, mDNS}). @end defvr diff --git a/gnu-system.am b/gnu-system.am index 247aff8ac7..9aa4bd1fb6 100644 --- a/gnu-system.am +++ b/gnu-system.am @@ -86,7 +86,6 @@ GNU_SYSTEM_MODULES = \ gnu/packages/dns.scm \ gnu/packages/docbook.scm \ gnu/packages/doxygen.scm \ - gnu/packages/dwm.scm \ gnu/packages/ebook.scm \ gnu/packages/ed.scm \ gnu/packages/elf.scm \ @@ -281,6 +280,7 @@ GNU_SYSTEM_MODULES = \ gnu/packages/ssh.scm \ gnu/packages/stalonetray.scm \ gnu/packages/statistics.scm \ + gnu/packages/suckless.scm \ gnu/packages/swig.scm \ gnu/packages/sxiv.scm \ gnu/packages/synergy.scm \ @@ -538,6 +538,18 @@ dist_patch_DATA = \ gnu/packages/patches/python2-pygobject-2-gi-info-type-error-domain.patch \ gnu/packages/patches/qemu-CVE-2015-3209.patch \ gnu/packages/patches/qemu-CVE-2015-3456.patch \ + gnu/packages/patches/qemu-CVE-2015-4037.patch \ + gnu/packages/patches/qemu-CVE-2015-4103.patch \ + gnu/packages/patches/qemu-CVE-2015-4104.patch \ + gnu/packages/patches/qemu-CVE-2015-4105.patch \ + gnu/packages/patches/qemu-CVE-2015-4106-pt1.patch \ + gnu/packages/patches/qemu-CVE-2015-4106-pt2.patch \ + gnu/packages/patches/qemu-CVE-2015-4106-pt3.patch \ + gnu/packages/patches/qemu-CVE-2015-4106-pt4.patch \ + gnu/packages/patches/qemu-CVE-2015-4106-pt5.patch \ + gnu/packages/patches/qemu-CVE-2015-4106-pt6.patch \ + gnu/packages/patches/qemu-CVE-2015-4106-pt7.patch \ + gnu/packages/patches/qemu-CVE-2015-4106-pt8.patch \ gnu/packages/patches/qt4-ldflags.patch \ gnu/packages/patches/qt4-tests.patch \ gnu/packages/patches/qt5-conflicting-typedefs.patch \ diff --git a/gnu/packages/audio.scm b/gnu/packages/audio.scm index 3b2d4e1022..1d6277c125 100644 --- a/gnu/packages/audio.scm +++ b/gnu/packages/audio.scm @@ -836,7 +836,7 @@ significantly faster and have minimal dependencies.") (define-public lv2 (package (name "lv2") - (version "1.10.0") + (version "1.12.0") (source (origin (method url-fetch) (uri (string-append "http://lv2plug.in/spec/lv2-" @@ -844,11 +844,11 @@ significantly faster and have minimal dependencies.") ".tar.bz2")) (sha256 (base32 - "1md41x9snrp4mcfyli7lyfpvcfa78nfy6xkdy84kppnl8m5qw378")))) + "1saq0vwqy5zjdkgc5ahs8kcabxfmff2mmg68fiqrkv8hiw9m6jks")))) (build-system waf-build-system) (arguments `(#:tests? #f ; no check target - #:configure-flags '("--lv2-system"))) + #:configure-flags '("--no-plugins"))) (inputs ;; Leaving off cairo and gtk+-2.0 which are needed for example plugins `(("libsndfile" ,libsndfile))) diff --git a/gnu/packages/bioinformatics.scm b/gnu/packages/bioinformatics.scm index 7175ecf41d..0d8a6d518c 100644 --- a/gnu/packages/bioinformatics.scm +++ b/gnu/packages/bioinformatics.scm @@ -1104,7 +1104,7 @@ that a read originated from a particular isoform.") (define-public orfm (package (name "orfm") - (version "0.3.2") + (version "0.4.1") (source (origin (method url-fetch) (uri (string-append @@ -1112,7 +1112,7 @@ that a read originated from a particular isoform.") version "/orfm-" version ".tar.gz")) (sha256 (base32 - "00jqvlspj9662ni9r4n1snxfnwkzc02i46g5nk1kwjshi6v3vgg3")))) + "05fmw145snk646ly076zby0fjav0k7ysbclck5d4s9pmgcfpijc2")))) (build-system gnu-build-system) (inputs `(("zlib" ,zlib))) (synopsis "Simple and not slow open reading frame (ORF) caller") diff --git a/gnu/packages/emacs.scm b/gnu/packages/emacs.scm index 0f71c77bf2..2502f2935d 100644 --- a/gnu/packages/emacs.scm +++ b/gnu/packages/emacs.scm @@ -428,6 +428,70 @@ operations.") support for Git-SVN.") (license license:gpl3+))) +(define-public haskell-mode + (package + (name "haskell-mode") + (version "13.14.2") + (source (origin + (method url-fetch) + (file-name (string-append name "-" version ".tar.gz")) + (uri (string-append + "https://github.com/haskell/haskell-mode/archive/v" + version ".tar.gz")) + (sha256 + (base32 "1kxc2yj8vb122dv91r68h7c5ladcryx963fr16plfhg71fv7f9av")))) + (inputs `(("emacs" ,emacs-no-x))) + (native-inputs + `(("texinfo" ,texinfo))) + (build-system gnu-build-system) + (arguments + `(#:make-flags (list (string-append "EMACS=" + (assoc-ref %build-inputs "emacs") + "/bin/emacs")) + #:phases + (modify-phases %standard-phases + (delete 'configure) + (add-before + 'build 'pre-build + (lambda* (#:key inputs #:allow-other-keys) + (let ((sh (string-append (assoc-ref inputs "bash") "/bin/sh"))) + (setenv "SHELL" "sh") + (substitute* (find-files "." "\\.el") (("/bin/sh") sh)) + #t))) + (replace + 'install + (lambda* (#:key outputs #:allow-other-keys) + (let* ((out (assoc-ref outputs "out")) + (el-dir (string-append out "/share/emacs/site-lisp")) + (doc (string-append + out "/share/doc/haskell-mode-" ,version)) + (info (string-append out "/share/info"))) + (define (copy-to-dir dir files) + (mkdir-p dir) + (for-each + (lambda (f) + (copy-file f (string-append dir "/" (basename f)))) + files)) + + (with-directory-excursion "doc" + (unless (zero? (system* "makeinfo" "haskell-mode.texi")) + (error "makeinfo failed")) + (mkdir-p info) + (copy-file "haskell-mode.info" + (string-append info "/haskell-mode.info"))) + (copy-to-dir doc '("CONTRIBUTING.md" "NEWS" "README.md")) + (copy-to-dir el-dir (find-files "." "\\.elc?")) + ;; these are now distributed with emacs + (with-directory-excursion el-dir + (for-each delete-file '("cl-lib.el" "ert.el"))) + #t)))))) + (home-page "https://github.com/haskell/haskell-mode") + (synopsis "Haskell mode for Emacs") + (description + "This is an Emacs mode for editing, debugging and developing Haskell +programs.") + (license license:gpl3+))) + ;;; ;;; Web browsing. diff --git a/gnu/packages/patches/qemu-CVE-2015-4037.patch b/gnu/packages/patches/qemu-CVE-2015-4037.patch new file mode 100644 index 0000000000..305036b9f2 --- /dev/null +++ b/gnu/packages/patches/qemu-CVE-2015-4037.patch @@ -0,0 +1,53 @@ +From 8b8f1c7e9ddb2e88a144638f6527bf70e32343e3 Mon Sep 17 00:00:00 2001 +From: Michael Tokarev <mjt@tls.msk.ru> +Date: Thu, 28 May 2015 14:12:26 +0300 +Subject: [PATCH] slirp: use less predictable directory name in /tmp for smb + config (CVE-2015-4037) + +In this version I used mkdtemp(3) which is: + + _BSD_SOURCE + || /* Since glibc 2.10: */ + (_POSIX_C_SOURCE >= 200809L || _XOPEN_SOURCE >= 700) + +(POSIX.1-2008), so should be available on systems we care about. + +While at it, reset the resulting directory name within smb structure +on error so cleanup function wont try to remove directory which we +failed to create. + +Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> +Reviewed-by: Markus Armbruster <armbru@redhat.com> +--- + net/slirp.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/net/slirp.c b/net/slirp.c +index 0e15cf6..3533837 100644 +--- a/net/slirp.c ++++ b/net/slirp.c +@@ -481,7 +481,6 @@ static void slirp_smb_cleanup(SlirpState *s) + static int slirp_smb(SlirpState* s, const char *exported_dir, + struct in_addr vserver_addr) + { +- static int instance; + char smb_conf[128]; + char smb_cmdline[128]; + struct passwd *passwd; +@@ -505,10 +504,10 @@ static int slirp_smb(SlirpState* s, const char *exported_dir, + return -1; + } + +- snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.%ld-%d", +- (long)getpid(), instance++); +- if (mkdir(s->smb_dir, 0700) < 0) { ++ snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.XXXXXX"); ++ if (!mkdtemp(s->smb_dir)) { + error_report("could not create samba server dir '%s'", s->smb_dir); ++ s->smb_dir[0] = 0; + return -1; + } + snprintf(smb_conf, sizeof(smb_conf), "%s/%s", s->smb_dir, "smb.conf"); +-- +2.2.1 + diff --git a/gnu/packages/patches/qemu-CVE-2015-4103.patch b/gnu/packages/patches/qemu-CVE-2015-4103.patch new file mode 100644 index 0000000000..74333fd672 --- /dev/null +++ b/gnu/packages/patches/qemu-CVE-2015-4103.patch @@ -0,0 +1,135 @@ +From 5c83b2f5b4b956e91dd6e5711f14df7ab800aefb Mon Sep 17 00:00:00 2001 +From: Jan Beulich <jbeulich@suse.com> +Date: Tue, 2 Jun 2015 15:07:00 +0000 +Subject: [PATCH] xen: properly gate host writes of modified PCI CFG contents + +The old logic didn't work as intended when an access spanned multiple +fields (for example a 32-bit access to the location of the MSI Message +Data field with the high 16 bits not being covered by any known field). +Remove it and derive which fields not to write to from the accessed +fields' emulation masks: When they're all ones, there's no point in +doing any host write. + +This fixes a secondary issue at once: We obviously shouldn't make any +host write attempt when already the host read failed. + +This is XSA-128. + +Signed-off-by: Jan Beulich <jbeulich@suse.com> +Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> +--- + hw/xen/xen_pt.c | 25 +++++++++++++++++++++---- + hw/xen/xen_pt.h | 2 -- + hw/xen/xen_pt_config_init.c | 4 ---- + 3 files changed, 21 insertions(+), 10 deletions(-) + +diff --git a/hw/xen/xen_pt.c b/hw/xen/xen_pt.c +index d095c08..8923582 100644 +--- a/hw/xen/xen_pt.c ++++ b/hw/xen/xen_pt.c +@@ -234,7 +234,7 @@ static void xen_pt_pci_write_config(PCIDevice *d, uint32_t addr, + int index = 0; + XenPTRegGroup *reg_grp_entry = NULL; + int rc = 0; +- uint32_t read_val = 0; ++ uint32_t read_val = 0, wb_mask; + int emul_len = 0; + XenPTReg *reg_entry = NULL; + uint32_t find_addr = addr; +@@ -271,6 +271,9 @@ static void xen_pt_pci_write_config(PCIDevice *d, uint32_t addr, + if (rc < 0) { + XEN_PT_ERR(d, "pci_read_block failed. return value: %d.\n", rc); + memset(&read_val, 0xff, len); ++ wb_mask = 0; ++ } else { ++ wb_mask = 0xFFFFFFFF >> ((4 - len) << 3); + } + + /* pass directly to the real device for passthrough type register group */ +@@ -298,6 +301,11 @@ static void xen_pt_pci_write_config(PCIDevice *d, uint32_t addr, + + valid_mask <<= (find_addr - real_offset) << 3; + ptr_val = (uint8_t *)&val + (real_offset & 3); ++ if (reg->emu_mask == (0xFFFFFFFF >> ((4 - reg->size) << 3))) { ++ wb_mask &= ~((reg->emu_mask ++ >> ((find_addr - real_offset) << 3)) ++ << ((len - emul_len) << 3)); ++ } + + /* do emulation based on register size */ + switch (reg->size) { +@@ -350,10 +358,19 @@ static void xen_pt_pci_write_config(PCIDevice *d, uint32_t addr, + memory_region_transaction_commit(); + + out: +- if (!(reg && reg->no_wb)) { ++ for (index = 0; wb_mask; index += len) { + /* unknown regs are passed through */ +- rc = xen_host_pci_set_block(&s->real_device, addr, +- (uint8_t *)&val, len); ++ while (!(wb_mask & 0xff)) { ++ index++; ++ wb_mask >>= 8; ++ } ++ len = 0; ++ do { ++ len++; ++ wb_mask >>= 8; ++ } while (wb_mask & 0xff); ++ rc = xen_host_pci_set_block(&s->real_device, addr + index, ++ (uint8_t *)&val + index, len); + + if (rc < 0) { + XEN_PT_ERR(d, "pci_write_block failed. return value: %d.\n", rc); +diff --git a/hw/xen/xen_pt.h b/hw/xen/xen_pt.h +index 942dc60..52ceb85 100644 +--- a/hw/xen/xen_pt.h ++++ b/hw/xen/xen_pt.h +@@ -105,8 +105,6 @@ struct XenPTRegInfo { + uint32_t ro_mask; + /* reg emulate field mask (ON:emu, OFF:passthrough) */ + uint32_t emu_mask; +- /* no write back allowed */ +- uint32_t no_wb; + xen_pt_conf_reg_init init; + /* read/write function pointer + * for double_word/word/byte size */ +diff --git a/hw/xen/xen_pt_config_init.c b/hw/xen/xen_pt_config_init.c +index 95a51db..dae0519 100644 +--- a/hw/xen/xen_pt_config_init.c ++++ b/hw/xen/xen_pt_config_init.c +@@ -1279,7 +1279,6 @@ static XenPTRegInfo xen_pt_emu_reg_msi[] = { + .init_val = 0x00000000, + .ro_mask = 0x00000003, + .emu_mask = 0xFFFFFFFF, +- .no_wb = 1, + .init = xen_pt_common_reg_init, + .u.dw.read = xen_pt_long_reg_read, + .u.dw.write = xen_pt_msgaddr32_reg_write, +@@ -1291,7 +1290,6 @@ static XenPTRegInfo xen_pt_emu_reg_msi[] = { + .init_val = 0x00000000, + .ro_mask = 0x00000000, + .emu_mask = 0xFFFFFFFF, +- .no_wb = 1, + .init = xen_pt_msgaddr64_reg_init, + .u.dw.read = xen_pt_long_reg_read, + .u.dw.write = xen_pt_msgaddr64_reg_write, +@@ -1303,7 +1301,6 @@ static XenPTRegInfo xen_pt_emu_reg_msi[] = { + .init_val = 0x0000, + .ro_mask = 0x0000, + .emu_mask = 0xFFFF, +- .no_wb = 1, + .init = xen_pt_msgdata_reg_init, + .u.w.read = xen_pt_word_reg_read, + .u.w.write = xen_pt_msgdata_reg_write, +@@ -1315,7 +1312,6 @@ static XenPTRegInfo xen_pt_emu_reg_msi[] = { + .init_val = 0x0000, + .ro_mask = 0x0000, + .emu_mask = 0xFFFF, +- .no_wb = 1, + .init = xen_pt_msgdata_reg_init, + .u.w.read = xen_pt_word_reg_read, + .u.w.write = xen_pt_msgdata_reg_write, +-- +2.2.1 + diff --git a/gnu/packages/patches/qemu-CVE-2015-4104.patch b/gnu/packages/patches/qemu-CVE-2015-4104.patch new file mode 100644 index 0000000000..811b0419a9 --- /dev/null +++ b/gnu/packages/patches/qemu-CVE-2015-4104.patch @@ -0,0 +1,189 @@ +From 7611dae8a69f0f1775ba1a9a942961c2aa10d88e Mon Sep 17 00:00:00 2001 +From: Jan Beulich <jbeulich@suse.com> +Date: Tue, 2 Jun 2015 15:07:00 +0000 +Subject: [PATCH] xen: don't allow guest to control MSI mask register + +It's being used by the hypervisor. For now simply mimic a device not +capable of masking, and fully emulate any accesses a guest may issue +nevertheless as simple reads/writes without side effects. + +This is XSA-129. + +Signed-off-by: Jan Beulich <jbeulich@suse.com> +Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> +--- + hw/pci/msi.c | 4 -- + hw/xen/xen_pt_config_init.c | 98 ++++++++++++++++++++++++++++++++++++++++----- + include/hw/pci/pci_regs.h | 2 + + 3 files changed, 90 insertions(+), 14 deletions(-) + +diff --git a/hw/pci/msi.c b/hw/pci/msi.c +index c111dba..f9c0484 100644 +--- a/hw/pci/msi.c ++++ b/hw/pci/msi.c +@@ -21,10 +21,6 @@ + #include "hw/pci/msi.h" + #include "qemu/range.h" + +-/* Eventually those constants should go to Linux pci_regs.h */ +-#define PCI_MSI_PENDING_32 0x10 +-#define PCI_MSI_PENDING_64 0x14 +- + /* PCI_MSI_ADDRESS_LO */ + #define PCI_MSI_ADDRESS_LO_MASK (~0x3) + +diff --git a/hw/xen/xen_pt_config_init.c b/hw/xen/xen_pt_config_init.c +index dae0519..68b8f22 100644 +--- a/hw/xen/xen_pt_config_init.c ++++ b/hw/xen/xen_pt_config_init.c +@@ -1016,13 +1016,9 @@ static XenPTRegInfo xen_pt_emu_reg_pm[] = { + */ + + /* Helper */ +-static bool xen_pt_msgdata_check_type(uint32_t offset, uint16_t flags) +-{ +- /* check the offset whether matches the type or not */ +- bool is_32 = (offset == PCI_MSI_DATA_32) && !(flags & PCI_MSI_FLAGS_64BIT); +- bool is_64 = (offset == PCI_MSI_DATA_64) && (flags & PCI_MSI_FLAGS_64BIT); +- return is_32 || is_64; +-} ++#define xen_pt_msi_check_type(offset, flags, what) \ ++ ((offset) == ((flags) & PCI_MSI_FLAGS_64BIT ? \ ++ PCI_MSI_##what##_64 : PCI_MSI_##what##_32)) + + /* Message Control register */ + static int xen_pt_msgctrl_reg_init(XenPCIPassthroughState *s, +@@ -1134,7 +1130,45 @@ static int xen_pt_msgdata_reg_init(XenPCIPassthroughState *s, + uint32_t offset = reg->offset; + + /* check the offset whether matches the type or not */ +- if (xen_pt_msgdata_check_type(offset, flags)) { ++ if (xen_pt_msi_check_type(offset, flags, DATA)) { ++ *data = reg->init_val; ++ } else { ++ *data = XEN_PT_INVALID_REG; ++ } ++ return 0; ++} ++ ++/* this function will be called twice (for 32 bit and 64 bit type) */ ++/* initialize Mask register */ ++static int xen_pt_mask_reg_init(XenPCIPassthroughState *s, ++ XenPTRegInfo *reg, uint32_t real_offset, ++ uint32_t *data) ++{ ++ uint32_t flags = s->msi->flags; ++ ++ /* check the offset whether matches the type or not */ ++ if (!(flags & PCI_MSI_FLAGS_MASKBIT)) { ++ *data = XEN_PT_INVALID_REG; ++ } else if (xen_pt_msi_check_type(reg->offset, flags, MASK)) { ++ *data = reg->init_val; ++ } else { ++ *data = XEN_PT_INVALID_REG; ++ } ++ return 0; ++} ++ ++/* this function will be called twice (for 32 bit and 64 bit type) */ ++/* initialize Pending register */ ++static int xen_pt_pending_reg_init(XenPCIPassthroughState *s, ++ XenPTRegInfo *reg, uint32_t real_offset, ++ uint32_t *data) ++{ ++ uint32_t flags = s->msi->flags; ++ ++ /* check the offset whether matches the type or not */ ++ if (!(flags & PCI_MSI_FLAGS_MASKBIT)) { ++ *data = XEN_PT_INVALID_REG; ++ } else if (xen_pt_msi_check_type(reg->offset, flags, PENDING)) { + *data = reg->init_val; + } else { + *data = XEN_PT_INVALID_REG; +@@ -1222,7 +1256,7 @@ static int xen_pt_msgdata_reg_write(XenPCIPassthroughState *s, + uint32_t offset = reg->offset; + + /* check the offset whether matches the type or not */ +- if (!xen_pt_msgdata_check_type(offset, msi->flags)) { ++ if (!xen_pt_msi_check_type(offset, msi->flags, DATA)) { + /* exit I/O emulator */ + XEN_PT_ERR(&s->dev, "the offset does not match the 32/64 bit type!\n"); + return -1; +@@ -1267,7 +1301,7 @@ static XenPTRegInfo xen_pt_emu_reg_msi[] = { + .size = 2, + .init_val = 0x0000, + .ro_mask = 0xFF8E, +- .emu_mask = 0x007F, ++ .emu_mask = 0x017F, + .init = xen_pt_msgctrl_reg_init, + .u.w.read = xen_pt_word_reg_read, + .u.w.write = xen_pt_msgctrl_reg_write, +@@ -1316,6 +1350,50 @@ static XenPTRegInfo xen_pt_emu_reg_msi[] = { + .u.w.read = xen_pt_word_reg_read, + .u.w.write = xen_pt_msgdata_reg_write, + }, ++ /* Mask reg (if PCI_MSI_FLAGS_MASKBIT set, for 32-bit devices) */ ++ { ++ .offset = PCI_MSI_MASK_32, ++ .size = 4, ++ .init_val = 0x00000000, ++ .ro_mask = 0xFFFFFFFF, ++ .emu_mask = 0xFFFFFFFF, ++ .init = xen_pt_mask_reg_init, ++ .u.dw.read = xen_pt_long_reg_read, ++ .u.dw.write = xen_pt_long_reg_write, ++ }, ++ /* Mask reg (if PCI_MSI_FLAGS_MASKBIT set, for 64-bit devices) */ ++ { ++ .offset = PCI_MSI_MASK_64, ++ .size = 4, ++ .init_val = 0x00000000, ++ .ro_mask = 0xFFFFFFFF, ++ .emu_mask = 0xFFFFFFFF, ++ .init = xen_pt_mask_reg_init, ++ .u.dw.read = xen_pt_long_reg_read, ++ .u.dw.write = xen_pt_long_reg_write, ++ }, ++ /* Pending reg (if PCI_MSI_FLAGS_MASKBIT set, for 32-bit devices) */ ++ { ++ .offset = PCI_MSI_MASK_32 + 4, ++ .size = 4, ++ .init_val = 0x00000000, ++ .ro_mask = 0xFFFFFFFF, ++ .emu_mask = 0x00000000, ++ .init = xen_pt_pending_reg_init, ++ .u.dw.read = xen_pt_long_reg_read, ++ .u.dw.write = xen_pt_long_reg_write, ++ }, ++ /* Pending reg (if PCI_MSI_FLAGS_MASKBIT set, for 64-bit devices) */ ++ { ++ .offset = PCI_MSI_MASK_64 + 4, ++ .size = 4, ++ .init_val = 0x00000000, ++ .ro_mask = 0xFFFFFFFF, ++ .emu_mask = 0x00000000, ++ .init = xen_pt_pending_reg_init, ++ .u.dw.read = xen_pt_long_reg_read, ++ .u.dw.write = xen_pt_long_reg_write, ++ }, + { + .size = 0, + }, +diff --git a/include/hw/pci/pci_regs.h b/include/hw/pci/pci_regs.h +index 56a404b..57e8c80 100644 +--- a/include/hw/pci/pci_regs.h ++++ b/include/hw/pci/pci_regs.h +@@ -298,8 +298,10 @@ + #define PCI_MSI_ADDRESS_HI 8 /* Upper 32 bits (if PCI_MSI_FLAGS_64BIT set) */ + #define PCI_MSI_DATA_32 8 /* 16 bits of data for 32-bit devices */ + #define PCI_MSI_MASK_32 12 /* Mask bits register for 32-bit devices */ ++#define PCI_MSI_PENDING_32 16 /* Pending bits register for 32-bit devices */ + #define PCI_MSI_DATA_64 12 /* 16 bits of data for 64-bit devices */ + #define PCI_MSI_MASK_64 16 /* Mask bits register for 64-bit devices */ ++#define PCI_MSI_PENDING_64 20 /* Pending bits register for 32-bit devices */ + + /* MSI-X registers */ + #define PCI_MSIX_FLAGS 2 +-- +2.2.1 + diff --git a/gnu/packages/patches/qemu-CVE-2015-4105.patch b/gnu/packages/patches/qemu-CVE-2015-4105.patch new file mode 100644 index 0000000000..f1b349f1e5 --- /dev/null +++ b/gnu/packages/patches/qemu-CVE-2015-4105.patch @@ -0,0 +1,85 @@ +From b38ec5ee7a581776bbce0bdaecb397632c3c4791 Mon Sep 17 00:00:00 2001 +From: Jan Beulich <jbeulich@suse.com> +Date: Tue, 2 Jun 2015 15:07:00 +0000 +Subject: [PATCH] xen/MSI-X: limit error messages + +Limit error messages resulting from bad guest behavior to avoid allowing +the guest to cause the control domain's disk to fill. + +The first message in pci_msix_write() can simply be deleted, as this +is indeed bad guest behavior, but such out of bounds writes don't +really need to be logged. + +The second one is more problematic, as there guest behavior may only +appear to be wrong: For one, the old logic didn't take the mask-all bit +into account. And then this shouldn't depend on host device state (i.e. +the host may have masked the entry without the guest having done so). +Plus these writes shouldn't be dropped even when an entry is unmasked. +Instead, if they can't be made take effect right away, they should take +effect on the next unmasking or enabling operation - the specification +explicitly describes such caching behavior. Until we can validly drop +the message (implementing such caching/latching behavior), issue the +message just once per MSI-X table entry. + +Note that the log message in pci_msix_read() similar to the one being +removed here is not an issue: "addr" being of unsigned type, and the +maximum size of the MSI-X table being 32k, entry_nr simply can't be +negative and hence the conditonal guarding issuing of the message will +never be true. + +This is XSA-130. + +Signed-off-by: Jan Beulich <jbeulich@suse.com> +Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> +--- + hw/xen/xen_pt.h | 1 + + hw/xen/xen_pt_msi.c | 12 +++++++----- + 2 files changed, 8 insertions(+), 5 deletions(-) + +diff --git a/hw/xen/xen_pt.h b/hw/xen/xen_pt.h +index 52ceb85..8c9b6c2 100644 +--- a/hw/xen/xen_pt.h ++++ b/hw/xen/xen_pt.h +@@ -175,6 +175,7 @@ typedef struct XenPTMSIXEntry { + uint32_t data; + uint32_t vector_ctrl; + bool updated; /* indicate whether MSI ADDR or DATA is updated */ ++ bool warned; /* avoid issuing (bogus) warning more than once */ + } XenPTMSIXEntry; + typedef struct XenPTMSIX { + uint32_t ctrl_offset; +diff --git a/hw/xen/xen_pt_msi.c b/hw/xen/xen_pt_msi.c +index 9ed9321..68db623 100644 +--- a/hw/xen/xen_pt_msi.c ++++ b/hw/xen/xen_pt_msi.c +@@ -434,11 +434,10 @@ static void pci_msix_write(void *opaque, hwaddr addr, + XenPCIPassthroughState *s = opaque; + XenPTMSIX *msix = s->msix; + XenPTMSIXEntry *entry; +- int entry_nr, offset; ++ unsigned int entry_nr, offset; + + entry_nr = addr / PCI_MSIX_ENTRY_SIZE; +- if (entry_nr < 0 || entry_nr >= msix->total_entries) { +- XEN_PT_ERR(&s->dev, "asked MSI-X entry '%i' invalid!\n", entry_nr); ++ if (entry_nr >= msix->total_entries) { + return; + } + entry = &msix->msix_entry[entry_nr]; +@@ -460,8 +459,11 @@ static void pci_msix_write(void *opaque, hwaddr addr, + + PCI_MSIX_ENTRY_VECTOR_CTRL; + + if (msix->enabled && !(*vec_ctrl & PCI_MSIX_ENTRY_CTRL_MASKBIT)) { +- XEN_PT_ERR(&s->dev, "Can't update msix entry %d since MSI-X is" +- " already enabled.\n", entry_nr); ++ if (!entry->warned) { ++ entry->warned = true; ++ XEN_PT_ERR(&s->dev, "Can't update msix entry %d since MSI-X is" ++ " already enabled.\n", entry_nr); ++ } + return; + } + +-- +2.2.1 + diff --git a/gnu/packages/patches/qemu-CVE-2015-4106-pt1.patch b/gnu/packages/patches/qemu-CVE-2015-4106-pt1.patch new file mode 100644 index 0000000000..1a2db950da --- /dev/null +++ b/gnu/packages/patches/qemu-CVE-2015-4106-pt1.patch @@ -0,0 +1,72 @@ +From d1d35cf4ffb6a60a356193397919e83306d0bb74 Mon Sep 17 00:00:00 2001 +From: Jan Beulich <jbeulich@suse.com> +Date: Tue, 2 Jun 2015 15:07:01 +0000 +Subject: [PATCH] xen/MSI: don't open-code pass-through of enable bit + modifications + +Without this the actual XSA-131 fix would cause the enable bit to not +get set anymore (due to the write back getting suppressed there based +on the OR of emu_mask, ro_mask, and res_mask). + +Note that the fiddling with the enable bit shouldn't really be done by +qemu, but making this work right (via libxc and the hypervisor) will +require more extensive changes, which can be postponed until after the +security issue got addressed. + +This is a preparatory patch for XSA-131. + +Signed-off-by: Jan Beulich <jbeulich@suse.com> +Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> +--- + hw/xen/xen_pt_config_init.c | 10 ++-------- + 1 file changed, 2 insertions(+), 8 deletions(-) + +diff --git a/hw/xen/xen_pt_config_init.c b/hw/xen/xen_pt_config_init.c +index 68b8f22..436d0fd 100644 +--- a/hw/xen/xen_pt_config_init.c ++++ b/hw/xen/xen_pt_config_init.c +@@ -1053,7 +1053,6 @@ static int xen_pt_msgctrl_reg_write(XenPCIPassthroughState *s, + XenPTMSI *msi = s->msi; + uint16_t writable_mask = 0; + uint16_t throughable_mask = 0; +- uint16_t raw_val; + + /* Currently no support for multi-vector */ + if (*val & PCI_MSI_FLAGS_QSIZE) { +@@ -1066,12 +1065,11 @@ static int xen_pt_msgctrl_reg_write(XenPCIPassthroughState *s, + msi->flags |= cfg_entry->data & ~PCI_MSI_FLAGS_ENABLE; + + /* create value for writing to I/O device register */ +- raw_val = *val; + throughable_mask = ~reg->emu_mask & valid_mask; + *val = XEN_PT_MERGE_VALUE(*val, dev_value, throughable_mask); + + /* update MSI */ +- if (raw_val & PCI_MSI_FLAGS_ENABLE) { ++ if (*val & PCI_MSI_FLAGS_ENABLE) { + /* setup MSI pirq for the first time */ + if (!msi->initialized) { + /* Init physical one */ +@@ -1099,10 +1097,6 @@ static int xen_pt_msgctrl_reg_write(XenPCIPassthroughState *s, + xen_pt_msi_disable(s); + } + +- /* pass through MSI_ENABLE bit */ +- *val &= ~PCI_MSI_FLAGS_ENABLE; +- *val |= raw_val & PCI_MSI_FLAGS_ENABLE; +- + return 0; + } + +@@ -1301,7 +1295,7 @@ static XenPTRegInfo xen_pt_emu_reg_msi[] = { + .size = 2, + .init_val = 0x0000, + .ro_mask = 0xFF8E, +- .emu_mask = 0x017F, ++ .emu_mask = 0x017E, + .init = xen_pt_msgctrl_reg_init, + .u.w.read = xen_pt_word_reg_read, + .u.w.write = xen_pt_msgctrl_reg_write, +-- +2.2.1 + diff --git a/gnu/packages/patches/qemu-CVE-2015-4106-pt2.patch b/gnu/packages/patches/qemu-CVE-2015-4106-pt2.patch new file mode 100644 index 0000000000..2eeb7ef0af --- /dev/null +++ b/gnu/packages/patches/qemu-CVE-2015-4106-pt2.patch @@ -0,0 +1,81 @@ +From d61bb2482dc0c7426f451f23ba7e2748ae2cc06d Mon Sep 17 00:00:00 2001 +From: Jan Beulich <jbeulich@suse.com> +Date: Tue, 2 Jun 2015 15:07:01 +0000 +Subject: [PATCH] xen/pt: consolidate PM capability emu_mask + +There's no point in xen_pt_pmcsr_reg_{read,write}() each ORing +PCI_PM_CTRL_STATE_MASK and PCI_PM_CTRL_NO_SOFT_RESET into a local +emu_mask variable - we can have the same effect by setting the field +descriptor's emu_mask member suitably right away. Note that +xen_pt_pmcsr_reg_write() is being retained in order to allow later +patches to be less intrusive. + +This is a preparatory patch for XSA-131. + +Signed-off-by: Jan Beulich <jbeulich@suse.com> +Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> +Acked-by: Ian Campbell <ian.campbell@citrix.com> +--- + hw/xen/xen_pt_config_init.c | 25 ++++--------------------- + 1 file changed, 4 insertions(+), 21 deletions(-) + +diff --git a/hw/xen/xen_pt_config_init.c b/hw/xen/xen_pt_config_init.c +index 436d0fd..516236a 100644 +--- a/hw/xen/xen_pt_config_init.c ++++ b/hw/xen/xen_pt_config_init.c +@@ -933,38 +933,21 @@ static XenPTRegInfo xen_pt_emu_reg_pcie[] = { + * Power Management Capability + */ + +-/* read Power Management Control/Status register */ +-static int xen_pt_pmcsr_reg_read(XenPCIPassthroughState *s, XenPTReg *cfg_entry, +- uint16_t *value, uint16_t valid_mask) +-{ +- XenPTRegInfo *reg = cfg_entry->reg; +- uint16_t valid_emu_mask = reg->emu_mask; +- +- valid_emu_mask |= PCI_PM_CTRL_STATE_MASK | PCI_PM_CTRL_NO_SOFT_RESET; +- +- valid_emu_mask = valid_emu_mask & valid_mask; +- *value = XEN_PT_MERGE_VALUE(*value, cfg_entry->data, ~valid_emu_mask); +- +- return 0; +-} + /* write Power Management Control/Status register */ + static int xen_pt_pmcsr_reg_write(XenPCIPassthroughState *s, + XenPTReg *cfg_entry, uint16_t *val, + uint16_t dev_value, uint16_t valid_mask) + { + XenPTRegInfo *reg = cfg_entry->reg; +- uint16_t emu_mask = reg->emu_mask; + uint16_t writable_mask = 0; + uint16_t throughable_mask = 0; + +- emu_mask |= PCI_PM_CTRL_STATE_MASK | PCI_PM_CTRL_NO_SOFT_RESET; +- + /* modify emulate register */ +- writable_mask = emu_mask & ~reg->ro_mask & valid_mask; ++ writable_mask = reg->emu_mask & ~reg->ro_mask & valid_mask; + cfg_entry->data = XEN_PT_MERGE_VALUE(*val, cfg_entry->data, writable_mask); + + /* create value for writing to I/O device register */ +- throughable_mask = ~emu_mask & valid_mask; ++ throughable_mask = ~reg->emu_mask & valid_mask; + *val = XEN_PT_MERGE_VALUE(*val, dev_value, throughable_mask); + + return 0; +@@ -1000,9 +983,9 @@ static XenPTRegInfo xen_pt_emu_reg_pm[] = { + .size = 2, + .init_val = 0x0008, + .ro_mask = 0xE1FC, +- .emu_mask = 0x8100, ++ .emu_mask = 0x810B, + .init = xen_pt_common_reg_init, +- .u.w.read = xen_pt_pmcsr_reg_read, ++ .u.w.read = xen_pt_word_reg_read, + .u.w.write = xen_pt_pmcsr_reg_write, + }, + { +-- +2.2.1 + diff --git a/gnu/packages/patches/qemu-CVE-2015-4106-pt3.patch b/gnu/packages/patches/qemu-CVE-2015-4106-pt3.patch new file mode 100644 index 0000000000..8d12d7ac5b --- /dev/null +++ b/gnu/packages/patches/qemu-CVE-2015-4106-pt3.patch @@ -0,0 +1,33 @@ +From c4ff1e68c621928abc680266cad0a451686c403b Mon Sep 17 00:00:00 2001 +From: Jan Beulich <jbeulich@suse.com> +Date: Tue, 2 Jun 2015 15:07:01 +0000 +Subject: [PATCH] xen/pt: correctly handle PM status bit + +xen_pt_pmcsr_reg_write() needs an adjustment to deal with the RW1C +nature of the not passed through bit 15 (PCI_PM_CTRL_PME_STATUS). + +This is a preparatory patch for XSA-131. + +Signed-off-by: Jan Beulich <jbeulich@suse.com> +Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> +--- + hw/xen/xen_pt_config_init.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/hw/xen/xen_pt_config_init.c b/hw/xen/xen_pt_config_init.c +index 516236a..027ac32 100644 +--- a/hw/xen/xen_pt_config_init.c ++++ b/hw/xen/xen_pt_config_init.c +@@ -948,7 +948,8 @@ static int xen_pt_pmcsr_reg_write(XenPCIPassthroughState *s, + + /* create value for writing to I/O device register */ + throughable_mask = ~reg->emu_mask & valid_mask; +- *val = XEN_PT_MERGE_VALUE(*val, dev_value, throughable_mask); ++ *val = XEN_PT_MERGE_VALUE(*val, dev_value & ~PCI_PM_CTRL_PME_STATUS, ++ throughable_mask); + + return 0; + } +-- +2.2.1 + diff --git a/gnu/packages/patches/qemu-CVE-2015-4106-pt4.patch b/gnu/packages/patches/qemu-CVE-2015-4106-pt4.patch new file mode 100644 index 0000000000..068f560e35 --- /dev/null +++ b/gnu/packages/patches/qemu-CVE-2015-4106-pt4.patch @@ -0,0 +1,260 @@ +From 0e7ef22136955169a0fd03c4e41af95662352733 Mon Sep 17 00:00:00 2001 +From: Jan Beulich <jbeulich@suse.com> +Date: Tue, 2 Jun 2015 15:07:01 +0000 +Subject: [PATCH] xen/pt: split out calculation of throughable mask in PCI + config space handling + +This is just to avoid having to adjust that calculation later in +multiple places. + +Note that including ->ro_mask in get_throughable_mask()'s calculation +is only an apparent (i.e. benign) behavioral change: For r/o fields it +doesn't matter > whether they get passed through - either the same flag +is also set in emu_mask (then there's no change at all) or the field is +r/o in hardware (and hence a write won't change it anyway). + +This is a preparatory patch for XSA-131. + +Signed-off-by: Jan Beulich <jbeulich@suse.com> +Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> +Reviewed-by: Anthony PERARD <anthony.perard@citrix.com> +--- + hw/xen/xen_pt_config_init.c | 51 ++++++++++++++++++--------------------------- + 1 file changed, 20 insertions(+), 31 deletions(-) + +diff --git a/hw/xen/xen_pt_config_init.c b/hw/xen/xen_pt_config_init.c +index 027ac32..3833b9e 100644 +--- a/hw/xen/xen_pt_config_init.c ++++ b/hw/xen/xen_pt_config_init.c +@@ -95,6 +95,14 @@ XenPTReg *xen_pt_find_reg(XenPTRegGroup *reg_grp, uint32_t address) + return NULL; + } + ++static uint32_t get_throughable_mask(const XenPCIPassthroughState *s, ++ const XenPTRegInfo *reg, ++ uint32_t valid_mask) ++{ ++ uint32_t throughable_mask = ~(reg->emu_mask | reg->ro_mask); ++ ++ return throughable_mask & valid_mask; ++} + + /**************** + * general register functions +@@ -157,14 +165,13 @@ static int xen_pt_byte_reg_write(XenPCIPassthroughState *s, XenPTReg *cfg_entry, + { + XenPTRegInfo *reg = cfg_entry->reg; + uint8_t writable_mask = 0; +- uint8_t throughable_mask = 0; ++ uint8_t throughable_mask = get_throughable_mask(s, reg, valid_mask); + + /* modify emulate register */ + writable_mask = reg->emu_mask & ~reg->ro_mask & valid_mask; + cfg_entry->data = XEN_PT_MERGE_VALUE(*val, cfg_entry->data, writable_mask); + + /* create value for writing to I/O device register */ +- throughable_mask = ~reg->emu_mask & valid_mask; + *val = XEN_PT_MERGE_VALUE(*val, dev_value, throughable_mask); + + return 0; +@@ -175,14 +182,13 @@ static int xen_pt_word_reg_write(XenPCIPassthroughState *s, XenPTReg *cfg_entry, + { + XenPTRegInfo *reg = cfg_entry->reg; + uint16_t writable_mask = 0; +- uint16_t throughable_mask = 0; ++ uint16_t throughable_mask = get_throughable_mask(s, reg, valid_mask); + + /* modify emulate register */ + writable_mask = reg->emu_mask & ~reg->ro_mask & valid_mask; + cfg_entry->data = XEN_PT_MERGE_VALUE(*val, cfg_entry->data, writable_mask); + + /* create value for writing to I/O device register */ +- throughable_mask = ~reg->emu_mask & valid_mask; + *val = XEN_PT_MERGE_VALUE(*val, dev_value, throughable_mask); + + return 0; +@@ -193,14 +199,13 @@ static int xen_pt_long_reg_write(XenPCIPassthroughState *s, XenPTReg *cfg_entry, + { + XenPTRegInfo *reg = cfg_entry->reg; + uint32_t writable_mask = 0; +- uint32_t throughable_mask = 0; ++ uint32_t throughable_mask = get_throughable_mask(s, reg, valid_mask); + + /* modify emulate register */ + writable_mask = reg->emu_mask & ~reg->ro_mask & valid_mask; + cfg_entry->data = XEN_PT_MERGE_VALUE(*val, cfg_entry->data, writable_mask); + + /* create value for writing to I/O device register */ +- throughable_mask = ~reg->emu_mask & valid_mask; + *val = XEN_PT_MERGE_VALUE(*val, dev_value, throughable_mask); + + return 0; +@@ -292,15 +297,13 @@ static int xen_pt_cmd_reg_write(XenPCIPassthroughState *s, XenPTReg *cfg_entry, + { + XenPTRegInfo *reg = cfg_entry->reg; + uint16_t writable_mask = 0; +- uint16_t throughable_mask = 0; ++ uint16_t throughable_mask = get_throughable_mask(s, reg, valid_mask); + + /* modify emulate register */ + writable_mask = ~reg->ro_mask & valid_mask; + cfg_entry->data = XEN_PT_MERGE_VALUE(*val, cfg_entry->data, writable_mask); + + /* create value for writing to I/O device register */ +- throughable_mask = ~reg->emu_mask & valid_mask; +- + if (*val & PCI_COMMAND_INTX_DISABLE) { + throughable_mask |= PCI_COMMAND_INTX_DISABLE; + } else { +@@ -454,7 +457,6 @@ static int xen_pt_bar_reg_write(XenPCIPassthroughState *s, XenPTReg *cfg_entry, + PCIDevice *d = &s->dev; + const PCIIORegion *r; + uint32_t writable_mask = 0; +- uint32_t throughable_mask = 0; + uint32_t bar_emu_mask = 0; + uint32_t bar_ro_mask = 0; + uint32_t r_size = 0; +@@ -511,8 +513,7 @@ static int xen_pt_bar_reg_write(XenPCIPassthroughState *s, XenPTReg *cfg_entry, + } + + /* create value for writing to I/O device register */ +- throughable_mask = ~bar_emu_mask & valid_mask; +- *val = XEN_PT_MERGE_VALUE(*val, dev_value, throughable_mask); ++ *val = XEN_PT_MERGE_VALUE(*val, dev_value, 0); + + return 0; + } +@@ -526,9 +527,8 @@ static int xen_pt_exp_rom_bar_reg_write(XenPCIPassthroughState *s, + XenPTRegion *base = NULL; + PCIDevice *d = (PCIDevice *)&s->dev; + uint32_t writable_mask = 0; +- uint32_t throughable_mask = 0; ++ uint32_t throughable_mask = get_throughable_mask(s, reg, valid_mask); + pcibus_t r_size = 0; +- uint32_t bar_emu_mask = 0; + uint32_t bar_ro_mask = 0; + + r_size = d->io_regions[PCI_ROM_SLOT].size; +@@ -537,7 +537,6 @@ static int xen_pt_exp_rom_bar_reg_write(XenPCIPassthroughState *s, + r_size = xen_pt_get_emul_size(base->bar_flag, r_size); + + /* set emulate mask and read-only mask */ +- bar_emu_mask = reg->emu_mask; + bar_ro_mask = (reg->ro_mask | (r_size - 1)) & ~PCI_ROM_ADDRESS_ENABLE; + + /* modify emulate register */ +@@ -545,7 +544,6 @@ static int xen_pt_exp_rom_bar_reg_write(XenPCIPassthroughState *s, + cfg_entry->data = XEN_PT_MERGE_VALUE(*val, cfg_entry->data, writable_mask); + + /* create value for writing to I/O device register */ +- throughable_mask = ~bar_emu_mask & valid_mask; + *val = XEN_PT_MERGE_VALUE(*val, dev_value, throughable_mask); + + return 0; +@@ -940,14 +938,13 @@ static int xen_pt_pmcsr_reg_write(XenPCIPassthroughState *s, + { + XenPTRegInfo *reg = cfg_entry->reg; + uint16_t writable_mask = 0; +- uint16_t throughable_mask = 0; ++ uint16_t throughable_mask = get_throughable_mask(s, reg, valid_mask); + + /* modify emulate register */ + writable_mask = reg->emu_mask & ~reg->ro_mask & valid_mask; + cfg_entry->data = XEN_PT_MERGE_VALUE(*val, cfg_entry->data, writable_mask); + + /* create value for writing to I/O device register */ +- throughable_mask = ~reg->emu_mask & valid_mask; + *val = XEN_PT_MERGE_VALUE(*val, dev_value & ~PCI_PM_CTRL_PME_STATUS, + throughable_mask); + +@@ -1036,7 +1033,7 @@ static int xen_pt_msgctrl_reg_write(XenPCIPassthroughState *s, + XenPTRegInfo *reg = cfg_entry->reg; + XenPTMSI *msi = s->msi; + uint16_t writable_mask = 0; +- uint16_t throughable_mask = 0; ++ uint16_t throughable_mask = get_throughable_mask(s, reg, valid_mask); + + /* Currently no support for multi-vector */ + if (*val & PCI_MSI_FLAGS_QSIZE) { +@@ -1049,7 +1046,6 @@ static int xen_pt_msgctrl_reg_write(XenPCIPassthroughState *s, + msi->flags |= cfg_entry->data & ~PCI_MSI_FLAGS_ENABLE; + + /* create value for writing to I/O device register */ +- throughable_mask = ~reg->emu_mask & valid_mask; + *val = XEN_PT_MERGE_VALUE(*val, dev_value, throughable_mask); + + /* update MSI */ +@@ -1161,7 +1157,6 @@ static int xen_pt_msgaddr32_reg_write(XenPCIPassthroughState *s, + { + XenPTRegInfo *reg = cfg_entry->reg; + uint32_t writable_mask = 0; +- uint32_t throughable_mask = 0; + uint32_t old_addr = cfg_entry->data; + + /* modify emulate register */ +@@ -1170,8 +1165,7 @@ static int xen_pt_msgaddr32_reg_write(XenPCIPassthroughState *s, + s->msi->addr_lo = cfg_entry->data; + + /* create value for writing to I/O device register */ +- throughable_mask = ~reg->emu_mask & valid_mask; +- *val = XEN_PT_MERGE_VALUE(*val, dev_value, throughable_mask); ++ *val = XEN_PT_MERGE_VALUE(*val, dev_value, 0); + + /* update MSI */ + if (cfg_entry->data != old_addr) { +@@ -1189,7 +1183,6 @@ static int xen_pt_msgaddr64_reg_write(XenPCIPassthroughState *s, + { + XenPTRegInfo *reg = cfg_entry->reg; + uint32_t writable_mask = 0; +- uint32_t throughable_mask = 0; + uint32_t old_addr = cfg_entry->data; + + /* check whether the type is 64 bit or not */ +@@ -1206,8 +1199,7 @@ static int xen_pt_msgaddr64_reg_write(XenPCIPassthroughState *s, + s->msi->addr_hi = cfg_entry->data; + + /* create value for writing to I/O device register */ +- throughable_mask = ~reg->emu_mask & valid_mask; +- *val = XEN_PT_MERGE_VALUE(*val, dev_value, throughable_mask); ++ *val = XEN_PT_MERGE_VALUE(*val, dev_value, 0); + + /* update MSI */ + if (cfg_entry->data != old_addr) { +@@ -1229,7 +1221,6 @@ static int xen_pt_msgdata_reg_write(XenPCIPassthroughState *s, + XenPTRegInfo *reg = cfg_entry->reg; + XenPTMSI *msi = s->msi; + uint16_t writable_mask = 0; +- uint16_t throughable_mask = 0; + uint16_t old_data = cfg_entry->data; + uint32_t offset = reg->offset; + +@@ -1247,8 +1238,7 @@ static int xen_pt_msgdata_reg_write(XenPCIPassthroughState *s, + msi->data = cfg_entry->data; + + /* create value for writing to I/O device register */ +- throughable_mask = ~reg->emu_mask & valid_mask; +- *val = XEN_PT_MERGE_VALUE(*val, dev_value, throughable_mask); ++ *val = XEN_PT_MERGE_VALUE(*val, dev_value, 0); + + /* update MSI */ + if (cfg_entry->data != old_data) { +@@ -1410,7 +1400,7 @@ static int xen_pt_msixctrl_reg_write(XenPCIPassthroughState *s, + { + XenPTRegInfo *reg = cfg_entry->reg; + uint16_t writable_mask = 0; +- uint16_t throughable_mask = 0; ++ uint16_t throughable_mask = get_throughable_mask(s, reg, valid_mask); + int debug_msix_enabled_old; + + /* modify emulate register */ +@@ -1418,7 +1408,6 @@ static int xen_pt_msixctrl_reg_write(XenPCIPassthroughState *s, + cfg_entry->data = XEN_PT_MERGE_VALUE(*val, cfg_entry->data, writable_mask); + + /* create value for writing to I/O device register */ +- throughable_mask = ~reg->emu_mask & valid_mask; + *val = XEN_PT_MERGE_VALUE(*val, dev_value, throughable_mask); + + /* update MSI-X */ +-- +2.2.1 + diff --git a/gnu/packages/patches/qemu-CVE-2015-4106-pt5.patch b/gnu/packages/patches/qemu-CVE-2015-4106-pt5.patch new file mode 100644 index 0000000000..e28a491689 --- /dev/null +++ b/gnu/packages/patches/qemu-CVE-2015-4106-pt5.patch @@ -0,0 +1,33 @@ +From 45ebe3916ab16f859ed930e92fbd52d84d5dcdaf Mon Sep 17 00:00:00 2001 +From: Jan Beulich <jbeulich@suse.com> +Date: Tue, 2 Jun 2015 15:07:01 +0000 +Subject: [PATCH] xen/pt: mark all PCIe capability bits read-only + +xen_pt_emu_reg_pcie[]'s PCI_EXP_DEVCAP needs to cover all bits as read- +only to avoid unintended write-back (just a precaution, the field ought +to be read-only in hardware). + +This is a preparatory patch for XSA-131. + +Signed-off-by: Jan Beulich <jbeulich@suse.com> +Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> +--- + hw/xen/xen_pt_config_init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/hw/xen/xen_pt_config_init.c b/hw/xen/xen_pt_config_init.c +index 3833b9e..9f6c00e 100644 +--- a/hw/xen/xen_pt_config_init.c ++++ b/hw/xen/xen_pt_config_init.c +@@ -871,7 +871,7 @@ static XenPTRegInfo xen_pt_emu_reg_pcie[] = { + .offset = PCI_EXP_DEVCAP, + .size = 4, + .init_val = 0x00000000, +- .ro_mask = 0x1FFCFFFF, ++ .ro_mask = 0xFFFFFFFF, + .emu_mask = 0x10000000, + .init = xen_pt_common_reg_init, + .u.dw.read = xen_pt_long_reg_read, +-- +2.2.1 + diff --git a/gnu/packages/patches/qemu-CVE-2015-4106-pt6.patch b/gnu/packages/patches/qemu-CVE-2015-4106-pt6.patch new file mode 100644 index 0000000000..8fff71e1c3 --- /dev/null +++ b/gnu/packages/patches/qemu-CVE-2015-4106-pt6.patch @@ -0,0 +1,89 @@ +From 0ad3393ad032f76e88b4dbd04d36ad84dff75dd6 Mon Sep 17 00:00:00 2001 +From: Jan Beulich <jbeulich@suse.com> +Date: Tue, 2 Jun 2015 15:07:01 +0000 +Subject: [PATCH] xen/pt: mark reserved bits in PCI config space fields + +The adjustments are solely to make the subsequent patches work right +(and hence make the patch set consistent), namely if permissive mode +(introduced by the last patch) gets used (as both reserved registers +and reserved fields must be similarly protected from guest access in +default mode, but the guest should be allowed access to them in +permissive mode). + +This is a preparatory patch for XSA-131. + +Signed-off-by: Jan Beulich <jbeulich@suse.com> +--- + hw/xen/xen_pt.h | 2 ++ + hw/xen/xen_pt_config_init.c | 14 +++++++++----- + 2 files changed, 11 insertions(+), 5 deletions(-) + +diff --git a/hw/xen/xen_pt.h b/hw/xen/xen_pt.h +index 8c9b6c2..f9795eb 100644 +--- a/hw/xen/xen_pt.h ++++ b/hw/xen/xen_pt.h +@@ -101,6 +101,8 @@ struct XenPTRegInfo { + uint32_t offset; + uint32_t size; + uint32_t init_val; ++ /* reg reserved field mask (ON:reserved, OFF:defined) */ ++ uint32_t res_mask; + /* reg read only field mask (ON:RO/ROS, OFF:other) */ + uint32_t ro_mask; + /* reg emulate field mask (ON:emu, OFF:passthrough) */ +diff --git a/hw/xen/xen_pt_config_init.c b/hw/xen/xen_pt_config_init.c +index 9f6c00e..efd8bac 100644 +--- a/hw/xen/xen_pt_config_init.c ++++ b/hw/xen/xen_pt_config_init.c +@@ -578,7 +578,7 @@ static XenPTRegInfo xen_pt_emu_reg_header0[] = { + .offset = PCI_COMMAND, + .size = 2, + .init_val = 0x0000, +- .ro_mask = 0xF880, ++ .res_mask = 0xF880, + .emu_mask = 0x0743, + .init = xen_pt_common_reg_init, + .u.w.read = xen_pt_word_reg_read, +@@ -603,7 +603,8 @@ static XenPTRegInfo xen_pt_emu_reg_header0[] = { + .offset = PCI_STATUS, + .size = 2, + .init_val = 0x0000, +- .ro_mask = 0x06FF, ++ .res_mask = 0x0007, ++ .ro_mask = 0x06F8, + .emu_mask = 0x0010, + .init = xen_pt_status_reg_init, + .u.w.read = xen_pt_word_reg_read, +@@ -980,7 +981,8 @@ static XenPTRegInfo xen_pt_emu_reg_pm[] = { + .offset = PCI_PM_CTRL, + .size = 2, + .init_val = 0x0008, +- .ro_mask = 0xE1FC, ++ .res_mask = 0x00F0, ++ .ro_mask = 0xE10C, + .emu_mask = 0x810B, + .init = xen_pt_common_reg_init, + .u.w.read = xen_pt_word_reg_read, +@@ -1268,7 +1270,8 @@ static XenPTRegInfo xen_pt_emu_reg_msi[] = { + .offset = PCI_MSI_FLAGS, + .size = 2, + .init_val = 0x0000, +- .ro_mask = 0xFF8E, ++ .res_mask = 0xFE00, ++ .ro_mask = 0x018E, + .emu_mask = 0x017E, + .init = xen_pt_msgctrl_reg_init, + .u.w.read = xen_pt_word_reg_read, +@@ -1446,7 +1449,8 @@ static XenPTRegInfo xen_pt_emu_reg_msix[] = { + .offset = PCI_MSI_FLAGS, + .size = 2, + .init_val = 0x0000, +- .ro_mask = 0x3FFF, ++ .res_mask = 0x3800, ++ .ro_mask = 0x07FF, + .emu_mask = 0x0000, + .init = xen_pt_msixctrl_reg_init, + .u.w.read = xen_pt_word_reg_read, +-- +2.2.1 + diff --git a/gnu/packages/patches/qemu-CVE-2015-4106-pt7.patch b/gnu/packages/patches/qemu-CVE-2015-4106-pt7.patch new file mode 100644 index 0000000000..a51a438f0d --- /dev/null +++ b/gnu/packages/patches/qemu-CVE-2015-4106-pt7.patch @@ -0,0 +1,72 @@ +From a88a3f887181605f4487a22bdfb7d87ffafde5d9 Mon Sep 17 00:00:00 2001 +From: Jan Beulich <jbeulich@suse.com> +Date: Tue, 2 Jun 2015 15:07:01 +0000 +Subject: [PATCH] xen/pt: add a few PCI config space field descriptions + +Since the next patch will turn all not explicitly described fields +read-only by default, those fields that have guest writable bits need +to be given explicit descriptors. + +This is a preparatory patch for XSA-131. + +Signed-off-by: Jan Beulich <jbeulich@suse.com> +--- + hw/xen/xen_pt_config_init.c | 28 ++++++++++++++++++++++++++++ + 1 file changed, 28 insertions(+) + +diff --git a/hw/xen/xen_pt_config_init.c b/hw/xen/xen_pt_config_init.c +index efd8bac..19f926b 100644 +--- a/hw/xen/xen_pt_config_init.c ++++ b/hw/xen/xen_pt_config_init.c +@@ -754,6 +754,15 @@ static XenPTRegInfo xen_pt_emu_reg_vpd[] = { + .u.b.write = xen_pt_byte_reg_write, + }, + { ++ .offset = PCI_VPD_ADDR, ++ .size = 2, ++ .ro_mask = 0x0003, ++ .emu_mask = 0x0003, ++ .init = xen_pt_common_reg_init, ++ .u.w.read = xen_pt_word_reg_read, ++ .u.w.write = xen_pt_word_reg_write, ++ }, ++ { + .size = 0, + }, + }; +@@ -889,6 +898,16 @@ static XenPTRegInfo xen_pt_emu_reg_pcie[] = { + .u.w.read = xen_pt_word_reg_read, + .u.w.write = xen_pt_word_reg_write, + }, ++ /* Device Status reg */ ++ { ++ .offset = PCI_EXP_DEVSTA, ++ .size = 2, ++ .res_mask = 0xFFC0, ++ .ro_mask = 0x0030, ++ .init = xen_pt_common_reg_init, ++ .u.w.read = xen_pt_word_reg_read, ++ .u.w.write = xen_pt_word_reg_write, ++ }, + /* Link Control reg */ + { + .offset = PCI_EXP_LNKCTL, +@@ -900,6 +919,15 @@ static XenPTRegInfo xen_pt_emu_reg_pcie[] = { + .u.w.read = xen_pt_word_reg_read, + .u.w.write = xen_pt_word_reg_write, + }, ++ /* Link Status reg */ ++ { ++ .offset = PCI_EXP_LNKSTA, ++ .size = 2, ++ .ro_mask = 0x3FFF, ++ .init = xen_pt_common_reg_init, ++ .u.w.read = xen_pt_word_reg_read, ++ .u.w.write = xen_pt_word_reg_write, ++ }, + /* Device Control 2 reg */ + { + .offset = 0x28, +-- +2.2.1 + diff --git a/gnu/packages/patches/qemu-CVE-2015-4106-pt8.patch b/gnu/packages/patches/qemu-CVE-2015-4106-pt8.patch new file mode 100644 index 0000000000..bc3e03217f --- /dev/null +++ b/gnu/packages/patches/qemu-CVE-2015-4106-pt8.patch @@ -0,0 +1,132 @@ +From c25bbf1545a53ac051f9e51d4140e397660c10ae Mon Sep 17 00:00:00 2001 +From: Jan Beulich <jbeulich@suse.com> +Date: Tue, 2 Jun 2015 15:07:01 +0000 +Subject: [PATCH] xen/pt: unknown PCI config space fields should be read-only + +... by default. Add a per-device "permissive" mode similar to pciback's +to allow restoring previous behavior (and hence break security again, +i.e. should be used only for trusted guests). + +This is part of XSA-131. + +Signed-off-by: Jan Beulich <jbeulich@suse.com> +Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> +Reviewed-by: Anthony PERARD <anthony.perard@citrix.com>) +--- + hw/xen/xen_pt.c | 32 +++++++++++++++++++++++++++++--- + hw/xen/xen_pt.h | 2 ++ + hw/xen/xen_pt_config_init.c | 4 ++++ + 3 files changed, 35 insertions(+), 3 deletions(-) + +diff --git a/hw/xen/xen_pt.c b/hw/xen/xen_pt.c +index 8923582..9afcda8 100644 +--- a/hw/xen/xen_pt.c ++++ b/hw/xen/xen_pt.c +@@ -239,6 +239,7 @@ static void xen_pt_pci_write_config(PCIDevice *d, uint32_t addr, + XenPTReg *reg_entry = NULL; + uint32_t find_addr = addr; + XenPTRegInfo *reg = NULL; ++ bool wp_flag = false; + + if (xen_pt_pci_config_access_check(d, addr, len)) { + return; +@@ -278,6 +279,10 @@ static void xen_pt_pci_write_config(PCIDevice *d, uint32_t addr, + + /* pass directly to the real device for passthrough type register group */ + if (reg_grp_entry == NULL) { ++ if (!s->permissive) { ++ wb_mask = 0; ++ wp_flag = true; ++ } + goto out; + } + +@@ -298,12 +303,15 @@ static void xen_pt_pci_write_config(PCIDevice *d, uint32_t addr, + uint32_t real_offset = reg_grp_entry->base_offset + reg->offset; + uint32_t valid_mask = 0xFFFFFFFF >> ((4 - emul_len) << 3); + uint8_t *ptr_val = NULL; ++ uint32_t wp_mask = reg->emu_mask | reg->ro_mask; + + valid_mask <<= (find_addr - real_offset) << 3; + ptr_val = (uint8_t *)&val + (real_offset & 3); +- if (reg->emu_mask == (0xFFFFFFFF >> ((4 - reg->size) << 3))) { +- wb_mask &= ~((reg->emu_mask +- >> ((find_addr - real_offset) << 3)) ++ if (!s->permissive) { ++ wp_mask |= reg->res_mask; ++ } ++ if (wp_mask == (0xFFFFFFFF >> ((4 - reg->size) << 3))) { ++ wb_mask &= ~((wp_mask >> ((find_addr - real_offset) << 3)) + << ((len - emul_len) << 3)); + } + +@@ -347,6 +355,16 @@ static void xen_pt_pci_write_config(PCIDevice *d, uint32_t addr, + } else { + /* nothing to do with passthrough type register, + * continue to find next byte */ ++ if (!s->permissive) { ++ wb_mask &= ~(0xff << ((len - emul_len) << 3)); ++ /* Unused BARs will make it here, but we don't want to issue ++ * warnings for writes to them (bogus writes get dealt with ++ * above). ++ */ ++ if (index < 0) { ++ wp_flag = true; ++ } ++ } + emul_len--; + find_addr++; + } +@@ -358,6 +376,13 @@ static void xen_pt_pci_write_config(PCIDevice *d, uint32_t addr, + memory_region_transaction_commit(); + + out: ++ if (wp_flag && !s->permissive_warned) { ++ s->permissive_warned = true; ++ xen_pt_log(d, "Write-back to unknown field 0x%02x (partially) inhibited (0x%0*x)\n", ++ addr, len * 2, wb_mask); ++ xen_pt_log(d, "If the device doesn't work, try enabling permissive mode\n"); ++ xen_pt_log(d, "(unsafe) and if it helps report the problem to xen-devel\n"); ++ } + for (index = 0; wb_mask; index += len) { + /* unknown regs are passed through */ + while (!(wb_mask & 0xff)) { +@@ -824,6 +849,7 @@ static void xen_pt_unregister_device(PCIDevice *d) + + static Property xen_pci_passthrough_properties[] = { + DEFINE_PROP_PCI_HOST_DEVADDR("hostaddr", XenPCIPassthroughState, hostaddr), ++ DEFINE_PROP_BOOL("permissive", XenPCIPassthroughState, permissive, false), + DEFINE_PROP_END_OF_LIST(), + }; + +diff --git a/hw/xen/xen_pt.h b/hw/xen/xen_pt.h +index f9795eb..4bba559 100644 +--- a/hw/xen/xen_pt.h ++++ b/hw/xen/xen_pt.h +@@ -197,6 +197,8 @@ struct XenPCIPassthroughState { + + PCIHostDeviceAddress hostaddr; + bool is_virtfn; ++ bool permissive; ++ bool permissive_warned; + XenHostPCIDevice real_device; + XenPTRegion bases[PCI_NUM_REGIONS]; /* Access regions */ + QLIST_HEAD(, XenPTRegGroup) reg_grps; +diff --git a/hw/xen/xen_pt_config_init.c b/hw/xen/xen_pt_config_init.c +index 19f926b..f3cf069 100644 +--- a/hw/xen/xen_pt_config_init.c ++++ b/hw/xen/xen_pt_config_init.c +@@ -101,6 +101,10 @@ static uint32_t get_throughable_mask(const XenPCIPassthroughState *s, + { + uint32_t throughable_mask = ~(reg->emu_mask | reg->ro_mask); + ++ if (!s->permissive) { ++ throughable_mask &= ~reg->res_mask; ++ } ++ + return throughable_mask & valid_mask; + } + +-- +2.2.1 + diff --git a/gnu/packages/python.scm b/gnu/packages/python.scm index 232a785778..d503c787b1 100644 --- a/gnu/packages/python.scm +++ b/gnu/packages/python.scm @@ -2068,7 +2068,7 @@ sources.") (define-public python-scikit-learn (package (name "python-scikit-learn") - (version "0.15.2") + (version "0.16.1") (source (origin (method url-fetch) @@ -2077,40 +2077,27 @@ sources.") version ".tar.gz")) (sha256 (base32 - "1rb93h2q15f219sz60sczjb65rg70xjmnp0q4pkkaairx5s05q55")))) + "140skabifgc7lvvj873pnzlwx0ni6q8qkrsyad2ccjb3h8rxzkih")))) (build-system python-build-system) (arguments `(#:phases (alist-cons-before - 'build 'set-environment-variables - (lambda* (#:key inputs #:allow-other-keys) - (let* ((atlas-threaded - (string-append (assoc-ref inputs "atlas") - "/lib/libtatlas.so")) - ;; On single core CPUs only the serial library is created. - (atlas-lib - (if (file-exists? atlas-threaded) - atlas-threaded - (string-append (assoc-ref inputs "atlas") - "/lib/libsatlas.so")))) - (setenv "ATLAS" atlas-lib))) - (alist-cons-before - 'check 'set-HOME - ;; some tests require access to "$HOME" - (lambda _ (setenv "HOME" "/tmp")) - ;; Tests can only be run after the library has been installed and not - ;; within the source directory. - (alist-cons-after - 'install 'check - (lambda _ - (with-directory-excursion "/tmp" - ;; With Python 3 one test of 3334 fails - ;; (sklearn.tests.test_common.test_transformers); see - ;; https://github.com/scikit-learn/scikit-learn/issues/3693 - (system* "nosetests" "-v" "sklearn"))) - (alist-delete 'check %standard-phases)))))) + 'check 'set-HOME + ;; some tests require access to "$HOME" + (lambda _ (setenv "HOME" "/tmp")) + ;; Tests can only be run after the library has been installed and not + ;; within the source directory. + (alist-cons-after + 'install 'check + (lambda _ + (with-directory-excursion "/tmp" + ;; With Python 3 one test of 3334 fails + ;; (sklearn.tests.test_common.test_transformers); see + ;; https://github.com/scikit-learn/scikit-learn/issues/3693 + (system* "nosetests" "-v" "sklearn"))) + (alist-delete 'check %standard-phases))))) (inputs - `(("atlas" ,atlas) + `(("openblas" ,openblas) ("python-nose" ,python-nose))) (propagated-inputs `(("python-numpy" ,python-numpy) @@ -2285,7 +2272,8 @@ writing C extensions for Python as easy as Python itself.") (build-system python-build-system) (inputs `(("python-nose" ,python-nose) - ("openblas" ,openblas))) + ("openblas" ,openblas) + ("lapack" ,lapack))) (native-inputs `(("gfortran" ,gfortran-4.8))) (arguments @@ -2295,11 +2283,21 @@ writing C extensions for Python as easy as Python itself.") (lambda* (#:key inputs #:allow-other-keys) (call-with-output-file "site.cfg" (lambda (port) - (format port "[openblas] + (format port + "[openblas] libraries = openblas library_dirs = ~a/lib include_dirs = ~a/include -" (assoc-ref inputs "openblas") (assoc-ref inputs "openblas")))) + +[lapack] +lapack_libs = lapack +library_dirs = ~a/lib +include_dirs = ~a/include +" + (assoc-ref inputs "openblas") + (assoc-ref inputs "openblas") + (assoc-ref inputs "lapack") + (assoc-ref inputs "lapack")))) ;; Use "gcc" executable, not "cc". (substitute* "numpy/distutils/system_info.py" (("c = distutils\\.ccompiler\\.new_compiler\\(\\)") @@ -2619,7 +2617,8 @@ toolkits.") ("python-pyparsing" ,python-pyparsing) ("python-nose" ,python-nose) ("python-sphinx" ,python-sphinx) - ("atlas" ,atlas))) + ("lapack" ,lapack) + ("openblas" ,openblas))) (native-inputs `(("gfortran" ,gfortran-4.8) ("texlive" ,texlive) @@ -2628,18 +2627,23 @@ toolkits.") (arguments `(#:phases (alist-cons-before - 'build 'set-environment-variables + 'build 'configure-openblas (lambda* (#:key inputs #:allow-other-keys) - (let* ((atlas-threaded - (string-append (assoc-ref inputs "atlas") - "/lib/libtatlas.so")) - ;; On single core CPUs only the serial library is created. - (atlas-lib - (if (file-exists? atlas-threaded) - atlas-threaded - (string-append (assoc-ref inputs "atlas") - "/lib/libsatlas.so")))) - (setenv "ATLAS" atlas-lib))) + (call-with-output-file "site.cfg" + (lambda (port) + (format port + "[blas] +libraries = openblas +library_dirs = ~a/lib +include_dirs = ~a/include +[atlas] +library_dirs = ~a/lib +atlas_libs = openblas +" + (assoc-ref inputs "openblas") + (assoc-ref inputs "openblas") + (assoc-ref inputs "openblas")))) + #t) (alist-cons-after 'install 'install-doc (lambda* (#:key outputs #:allow-other-keys) diff --git a/gnu/packages/qemu.scm b/gnu/packages/qemu.scm index 27a2d2e8ba..9213007452 100644 --- a/gnu/packages/qemu.scm +++ b/gnu/packages/qemu.scm @@ -53,7 +53,19 @@ (base32 "120m53c3p28qxmfzllicjzr8syjv6v4d9rsyrgkp7gnmcgvvgfmn")) (patches (map search-patch '("qemu-CVE-2015-3209.patch" - "qemu-CVE-2015-3456.patch"))))) + "qemu-CVE-2015-3456.patch" + "qemu-CVE-2015-4037.patch" + "qemu-CVE-2015-4103.patch" + "qemu-CVE-2015-4104.patch" + "qemu-CVE-2015-4105.patch" + "qemu-CVE-2015-4106-pt1.patch" + "qemu-CVE-2015-4106-pt2.patch" + "qemu-CVE-2015-4106-pt3.patch" + "qemu-CVE-2015-4106-pt4.patch" + "qemu-CVE-2015-4106-pt5.patch" + "qemu-CVE-2015-4106-pt6.patch" + "qemu-CVE-2015-4106-pt7.patch" + "qemu-CVE-2015-4106-pt8.patch"))))) (build-system gnu-build-system) (arguments '(#:phases (alist-replace diff --git a/gnu/packages/ruby.scm b/gnu/packages/ruby.scm index 9943de7e0b..ff30c4988a 100644 --- a/gnu/packages/ruby.scm +++ b/gnu/packages/ruby.scm @@ -28,6 +28,7 @@ #:use-module (gnu packages autotools) #:use-module (gnu packages libffi) #:use-module (gnu packages gdbm) + #:use-module (gnu packages version-control) #:use-module (guix packages) #:use-module (guix download) #:use-module (guix git-download) @@ -364,3 +365,302 @@ specified in a \"Gemfile\", as well as their dependencies.") User Agents.") (home-page "https://github.com/gshutler/useragent") (license license:expat))) + +(define-public ruby-bacon + (package + (name "ruby-bacon") + (version "1.2") + (source (origin + (method url-fetch) + (uri (string-append + "https://github.com/chneukirchen/bacon/archive/" + version ".tar.gz")) + (file-name (string-append name "-" version ".tar.gz")) + (sha256 + (base32 + "0g03fxilrrx17dijww68n1lq5d8s69hrxgpga8c1i2k35bzcw5jc")))) + (build-system ruby-build-system) + (arguments + `(#:phases (modify-phases %standard-phases + (add-before 'build 'generate-docs + (lambda _ + ;; This rake task also tries to generate a ChangeLog + ;; file from the Git log, which we don't have. It fails + ;; but creates an empty file, allowing the rest of the + ;; build to succeed. + (zero? (system* "rake" "predist"))))))) + (synopsis "Small RSpec clone") + (description "Bacon is a small RSpec clone providing all essential +features.") + (home-page "https://github.com/chneukirchen/bacon") + (license license:expat))) + +(define-public ruby-arel + (package + (name "ruby-arel") + (version "6.0.0") + (source (origin + (method url-fetch) + (uri (string-append + "https://github.com/rails/arel/archive/v" + version ".tar.gz")) + (file-name (string-append name "-" version ".tar.gz")) + (sha256 + (base32 + "0fldwp2hmrmddx22xf7hdmybngzv97qnv5rvz3qw61m94ddd6w4n")))) + (build-system ruby-build-system) + (native-inputs + `(("bundler" ,bundler))) + (synopsis "SQL AST manager for Ruby") + (description "Arel is a SQL AST manager for Ruby. It simplifies the +generation of complex SQL queries and adapts to various relational database +implementations.") + (home-page "https://github.com/rails/arel") + (license license:expat))) + +(define-public ruby-connection-pool + (package + (name "ruby-connection-pool") + (version "2.2.0") + (source (origin + (method url-fetch) + (uri (string-append + "https://github.com/mperham/connection_pool/archive/v" + version ".tar.gz")) + (file-name (string-append name "-" version ".tar.gz")) + (sha256 + (base32 + "02s5rwhmgy8qqns7a5y1daa0yaw38x6lzpwyvmy46h1yrj9mc6zf")))) + (build-system ruby-build-system) + (native-inputs + `(("bundler" ,bundler))) + (synopsis "Generic connection pool for Ruby") + (description "Connection_pool provides a generic connection pooling +interface for Ruby programs.") + (home-page "https://github.com/mperham/connection_pool") + (license license:expat))) + +(define-public ruby-net-http-persistent + (package + (name "ruby-net-http-persistent") + (version "2.9.4") + (source (origin + (method url-fetch) + (uri (string-append + "https://github.com/drbrain/net-http-persistent/archive/v" + version ".tar.gz")) + (file-name (string-append name "-" version ".tar.gz")) + (sha256 + (base32 + "1q18vji31w8gfr6ajziqkqs8n5lzkw0bl00dm2a8s05zhavzw9j9")))) + (build-system ruby-build-system) + (arguments + '(#:phases (modify-phases %standard-phases + (replace 'build ; no gemspec + (lambda _ (zero? (system* "rake" "gem"))))))) + (native-inputs + `(("ruby-connection-pool" ,ruby-connection-pool) + ("ruby-hoe" ,ruby-hoe))) + (synopsis "Persistent HTTP connection manager") + (description "Net::HTTP::Persistent manages persistent HTTP connections +using Net::HTTP, supporting reconnection and retry according to RFC 2616.") + (home-page "https://github.com/drbrain/net-http-persistent") + (license license:expat))) + +(define-public ruby-minitest + (package + (name "ruby-minitest") + (version "5.7.0") + (source (origin + (method git-fetch) + ;; No release tarballs nor git tags. This is the commit + ;; corresponding to the addition of the release notes to + ;; History.rdoc. + (uri (git-reference + (url "https://github.com/seattlerb/minitest.git") + (commit "e975248"))) + (sha256 + (base32 + "09xjiahk7q8hid1i39ahrmghaslpj9n36zna72i3ah7kf1bh2l01")))) + (build-system ruby-build-system) + (arguments + '(#:phases (modify-phases %standard-phases + (replace 'build ; no gemspec + (lambda _ (zero? (system* "rake" "gem"))))))) + (native-inputs + `(("ruby-hoe" ,ruby-hoe))) + (synopsis "Small test suite library for Ruby") + (description "Minitest provides a complete suite of Ruby testing +facilities supporting TDD, BDD, mocking, and benchmarking.") + (home-page "https://github.com/seattlerb/minitest") + (license license:expat))) + +(define-public ruby-minitest-sprint + (package + (name "ruby-minitest-sprint") + (version "1.1.0") + (source (origin + (method git-fetch) + ;; Same story as ruby-minitest. + (uri (git-reference + (url "https://github.com/seattlerb/minitest-sprint.git") + (commit "49c02bc"))) + (sha256 + (base32 + "0rbmxz94lqg5vjz60p8v2bzq8adwvmx501amvk0l124sfwmw94ms")))) + (build-system ruby-build-system) + (arguments + '(#:phases (modify-phases %standard-phases + (replace 'build ; no gemspec + (lambda _ (zero? (system* "rake" "gem"))))))) + (native-inputs + `(("ruby-hoe" ,ruby-hoe) + ("ruby-minitest" ,ruby-minitest))) + (synopsis "Fast test suite runner for minitest") + (description "Minitest-sprint is a test runner for minitest that makes it +easier to re-run individual failing tests.") + (home-page "https://github.com/seattlerb/minitest-sprint") + (license license:expat))) + +(define-public ruby-minitest-bacon + (package + (name "ruby-minitest-bacon") + (version "1.0.2") + (source (origin + (method git-fetch) + ;; Same story as ruby-minitest. + (uri (git-reference + (url "https://github.com/seattlerb/minitest-bacon.git") + (commit "38551d5"))) + (sha256 + (base32 + "19r9fm41i0mm1xncqls8frbj1i9nr3sq1cx2mh878r6kdl02d70h")))) + (build-system ruby-build-system) + (arguments + '(#:phases (modify-phases %standard-phases + (replace 'build ; no gemspec + (lambda _ (zero? (system* "rake" "gem"))))))) + (native-inputs + `(("ruby-hoe" ,ruby-hoe))) + (inputs + `(("ruby-minitest" ,ruby-minitest))) + (synopsis "Bacon compatibility library for minitest") + (description "Minitest-bacon extends minitest with bacon-like +functionality, making it easier to migrate test suites from bacon to minitest.") + (home-page "https://github.com/seattlerb/minitest-bacon") + (license license:expat))) + +(define-public ruby-daemons + (package + (name "ruby-daemons") + (version "1.2.2") + (source (origin + (method url-fetch) + (uri (string-append + "https://github.com/thuehlinger/daemons/archive/v" + version ".tar.gz")) + (file-name (string-append name "-" version ".tar.gz")) + (sha256 + (base32 + "1v5bpdvpvhk240pc7fkn44vfclppl44pp6wd42ipi5sd5lkk7zfd")))) + (build-system ruby-build-system) + (arguments + `(#:tests? #f)) ; no test suite + (synopsis "Daemonize Ruby programs") + (description "Daemons provides a way to wrap existing Ruby scripts to be +run as a daemon and to be controlled by simple start/stop/restart commands.") + (home-page "https://github.com/thuehlinger/daemons") + (license license:expat))) + +(define-public ruby-git + (package + (name "ruby-git") + (version "1.2.9.1") + (source (origin + (method url-fetch) + (uri (string-append + "https://github.com/schacon/ruby-git/archive/v" + version ".tar.gz")) + (file-name (string-append name "-" version ".tar.gz")) + (sha256 + (base32 + "08zg20zc7f7yy34ix2qdd8jbiz7xhjc8alk370869sq3h75hs9jc")))) + (build-system ruby-build-system) + (arguments + '(#:phases (modify-phases %standard-phases + (add-before 'build 'patch-git-binary + (lambda* (#:key inputs #:allow-other-keys) + ;; Make the default git binary an absolute path to the + ;; store. + (let ((git (string-append (assoc-ref inputs "git") + "/bin/git"))) + (substitute* '("lib/git/config.rb") + (("'git'") + (string-append "'" git "'"))) + ;; Fix a test that expects the binary to be simply + ;; 'git'. + (substitute* '("tests/units/test_logger.rb") + (("def test_logger") + (string-append + "def test_logger\n" + "Git::Base.config.binary_path = 'git'"))) + #t))) + (add-before 'check 'create-fake-home + (lambda _ + ;; The test suite runs 'git config --global' commands, + ;; so a fake home directory is needed for them to + ;; succeed. + (let ((fake-home (string-append (getcwd) "/fake-home"))) + (mkdir fake-home) + (setenv "HOME" fake-home))))))) + (inputs + `(("git" ,git))) + (synopsis "Ruby wrappers for Git") + (description "Ruby/Git is a Ruby library that can be used to create, read +and manipulate Git repositories by wrapping system calls to the git binary.") + (home-page "https://github.com/schacon/ruby-git") + (license license:expat))) + +(define-public ruby-slop + (package + (name "ruby-slop") + (version "4.1.0") + (source (origin + (method url-fetch) + (uri (string-append + "https://github.com/leejarvis/slop/archive/v" + version ".tar.gz")) + (file-name (string-append name "-" version ".tar.gz")) + (sha256 + (base32 + "0cqs50a0b99kjd19xpln8jpnki07cjyp3l7wxbfr44ycasr6nznh")))) + (build-system ruby-build-system) + (native-inputs + `(("ruby-minitest" ,ruby-minitest))) + (synopsis "Ruby command line option parser") + (description "Slop provides a Ruby domain specific language for gathering +options and parsing command line flags.") + (home-page "https://github.com/leejarvis/slop") + (license license:expat))) + +(define-public ruby-multipart-post + (package + (name "ruby-multipart-post") + (version "2.0.0") + (source (origin + (method url-fetch) + (uri (string-append + "https://github.com/nicksieger/multipart-post/archive/v" + version ".tar.gz")) + (file-name (string-append name "-" version ".tar.gz")) + (sha256 + (base32 + "03n271i3knfx4j9aingxzz2bajd379dw9nswsllviqc177lq1anm")))) + (build-system ruby-build-system) + (native-inputs + `(("bundler" ,bundler))) + (synopsis "Multipart POST library for Ruby") + (description "Multipart-Post Adds multipart POST capability to Ruby's +net/http library.") + (home-page "https://github.com/nicksieger/multipart-post") + (license license:expat))) diff --git a/gnu/packages/screen.scm b/gnu/packages/screen.scm index 8fc17e18b0..2de355a519 100644 --- a/gnu/packages/screen.scm +++ b/gnu/packages/screen.scm @@ -29,13 +29,13 @@ (define-public screen (package (name "screen") - (version "4.2.1") + (version "4.3.0") (source (origin (method url-fetch) (uri (string-append "mirror://gnu/screen/screen-" version ".tar.gz")) (sha256 - (base32 "105hp6qdd8rl71p81klmxiz4mlb60kh9r7czayrx40g38x858s2l")))) + (base32 "0ilccnwszaxr9wbrx0swh4fisha2rj2jiq76fwqikmv0rjdyhr2i")))) (build-system gnu-build-system) (inputs `(("ncurses", ncurses) diff --git a/gnu/packages/dwm.scm b/gnu/packages/suckless.scm index 98fa122850..c921f8e767 100644 --- a/gnu/packages/dwm.scm +++ b/gnu/packages/suckless.scm @@ -1,5 +1,6 @@ ;;; GNU Guix --- Functional package management for GNU ;;; Copyright © 2013 Cyril Roelandt <tipecaml@gmail.com> +;;; Copyright © 2015 Amirouche Boubekki <amirouche@hypermove.net> ;;; ;;; This file is part of GNU Guix. ;;; @@ -16,13 +17,16 @@ ;;; You should have received a copy of the GNU General Public License ;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>. -(define-module (gnu packages dwm) - #:use-module (guix licenses) +(define-module (gnu packages suckless) + #:use-module ((guix licenses) #:prefix license:) #:use-module (guix packages) #:use-module (guix download) #:use-module (guix build-system gnu) #:use-module (gnu packages) - #:use-module (gnu packages xorg)) + #:use-module (gnu packages xorg) + #:use-module (gnu packages fonts) + #:use-module (gnu packages pkg-config) + #:use-module (gnu packages fontutils)) (define-public dwm (package @@ -83,7 +87,7 @@ left corner. dwm draws a small customizable border around windows to indicate the focus state.") - (license x11))) + (license license:x11))) (define-public dmenu (package @@ -111,7 +115,7 @@ state.") (description "A dynamic menu for X, originally designed for dwm. It manages large numbers of user-defined menu items efficiently.") - (license x11))) + (license license:x11))) (define-public slock (package @@ -138,4 +142,50 @@ numbers of user-defined menu items efficiently.") (synopsis "Simple X session lock") (description "Simple X session lock with trivial feedback on password entry.") - (license x11))) + (license license:x11))) + +(define-public st + (package + (name "st") + (version "0.5") + (source + (origin + (method url-fetch) + (uri (string-append "http://dl.suckless.org/st/st-" + version ".tar.gz")) + (sha256 + (base32 + "0knxpzaa86pprng6hak8hx8bw22yw22rpz1ffxjpcvqlz3xdv05f")))) + (build-system gnu-build-system) + (arguments + '(#:tests? #f ; no tests + #:make-flags (list "CC=gcc" + (string-append "PREFIX=" %output)) + #:phases + (modify-phases %standard-phases + (delete 'configure) + (add-after 'unpack 'inhibit-terminfo-install + (lambda _ + (substitute* "Makefile" + (("\t@tic -s st.info") "")) + #t))))) + (inputs + `(("libx11" ,libx11) + ("libxft" ,libxft) + ("libxcomposite" ,libxcomposite) + ("compositeproto" ,compositeproto) + ("libxext" ,libxext) + ("xextproto" ,xextproto) + ("libxrender" ,libxrender) + ("fontconfig" ,fontconfig) + ("freetype" ,freetype) + ("font-liberation" ,font-liberation))) + (native-inputs `(("pkg-config" ,pkg-config))) + (home-page "http://st.suckless.org/") + (synopsis "Simple terminal emulator") + (description + "St implements a simple and lightweight terminal emulator. It +implements 256 colors, most VT10X escape sequences, utf8, X11 copy/paste, +antialiased fonts (using fontconfig), fallback fonts, resizing, and line +drawing.") + (license license:x11))) diff --git a/gnu/packages/version-control.scm b/gnu/packages/version-control.scm index 0d153fa92d..71171e6931 100644 --- a/gnu/packages/version-control.scm +++ b/gnu/packages/version-control.scm @@ -101,14 +101,14 @@ as well as the classic centralized workflow.") ;; Keep in sync with 'git-manpages'! (package (name "git") - (version "2.2.1") + (version "2.4.3") (source (origin (method url-fetch) (uri (string-append "mirror://kernel.org/software/scm/git/git-" version ".tar.xz")) (sha256 (base32 - "0l7l9rv1ww474rm4whj7dhjjacgdw5qlqqxqsnyzdpdxl34jshh9")))) + "056qh112f2afnbc4sjzkf8idzhi9bp7ggpci83cc6a7gs6lhfl7h")))) (build-system gnu-build-system) (native-inputs `(("native-perl" ,perl) @@ -250,7 +250,7 @@ everything from small to very large projects with speed and efficiency.") version ".tar.xz")) (sha256 (base32 - "0f75n5yfrzb55qbg5wq4bmv43lay806v51yhglwkp7mbv1zkby00")))) + "1k24p33v9hvmpkx4l818x1vbdv090kfgwqshhyyl3h9m9b5skqci")))) (build-system trivial-build-system) (arguments '(#:modules ((guix build utils)) diff --git a/gnu/packages/video.scm b/gnu/packages/video.scm index 3955c383d7..b923e47444 100644 --- a/gnu/packages/video.scm +++ b/gnu/packages/video.scm @@ -296,14 +296,14 @@ standards (MPEG-2, MPEG-4 ASP/H.263, MPEG-4 AVC/H.264, and VC-1/VMW3).") (define-public ffmpeg (package (name "ffmpeg") - (version "2.6.2") + (version "2.7") (source (origin (method url-fetch) (uri (string-append "http://www.ffmpeg.org/releases/ffmpeg-" version ".tar.bz2")) (sha256 (base32 - "1fi93zy98wmls7x3jpr2yvckk2ia6a1yyygwrfaxq95pd6h3m7l8")))) + "0jl43b63b20db3yia5xxp0hh8zwdbirk5k9p1d7416nq1b5ckfx8")))) (build-system gnu-build-system) (inputs `(("fontconfig" ,fontconfig) @@ -331,6 +331,7 @@ standards (MPEG-2, MPEG-4 ASP/H.263, MPEG-4 AVC/H.264, and VC-1/VMW3).") ("bzip2" ,bzip2) ("perl" ,perl) ("pkg-config" ,pkg-config) + ("texinfo" ,texinfo) ("python" ,python-2) ; scripts use interpreter python2 ("speex" ,speex) ("yasm" ,yasm))) diff --git a/gnu/services/desktop.scm b/gnu/services/desktop.scm index 910dc1f9e0..7ed62d07b5 100644 --- a/gnu/services/desktop.scm +++ b/gnu/services/desktop.scm @@ -23,7 +23,6 @@ #:use-module (gnu services avahi) #:use-module (gnu services xorg) #:use-module (gnu services networking) - #:use-module (gnu services ssh) #:use-module (gnu system shadow) #:use-module (gnu packages glib) #:use-module (gnu packages admin) @@ -286,7 +285,6 @@ site} for more information." (dbus-service (list avahi wicd upower colord)) (ntp-service) - (lsh-service) (map (lambda (mservice) ;; Provide an nscd ready to use nss-mdns. |