1. GNU ld does not understand -m{32,64}. It must be cooked for it by
the GCC driver program.
2. Where GNU ld is directly called we must use -melf_{i386,x86_64}.
3. We cannot avoid calling GNU ld directly in some cases (e.g., when
specifying GNU-specific linker scripts) as on some host
architectures the GCC driver is configured to call the host
linker.
4. We cannot add -melf_{i386,x86_64} to LDFLAGS as the option is
not recognised by GCC.
Hence we define new LDFLAGS_DIRECT, to be added to the command line
only when invoking GNU ld directly.
Signed-off-by: Keir Fraser <keir@xensource.com>
security is turned on in hypervisor. This is done by implicitly
labeling VMs and resources if they have not been labeled through
explicit calls.
To allow the xm tests suite to label resources automatically, run
./configure --enable-full-labeling
once. To turn it off, the '--enable-full-labeling' parameter should be
omitted.
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
the xm test suite. The tests can be run with ACM turned off (not
compiled into Xen; see user doc for this), but most of them will be
skipped then. They can be run with a command like
make -C tests/security-acm check-TESTS
from the xm-test directory. They are also part of the default tests in
the tests suite and part of a new group test 'security'.
Since some of the tests require resources to be labeled, one must
explicitly enable the resources to be allowed to be labeled by the
test
suite by running
./configure --enable-full-labeling
once. To turn it off, the '--enable-full-labeling' parameter should be
omitted.
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
is shutting down (call to xenbus_frontend_closed()). Also the driver
now waits longer until an outstanding response has been received (to
support a busy system). Moves the 'Unknown' state with the other
states that are not used by the TPM frontend.
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
1. Fix MMIO/PIO cross page boundary copy for MOVS and OUTS/INS
handling.
2. Clean up send_mmio_req/send_pio_req interface.
3. Clean up handle_mmio.
Signed-off-by: Xin Li <xin.b.li@intel.com>
Signed-off-by: Xiaowei Yang <xiaowei.yang@intel.com>
Signed-off-by: Eddie Dong <eddie.dong@intel.com>
Need to be careful with static initialisers:
1. *_LOCK_UNLOCKED, CPU_MASK_* no longer include a cast
2. Dynamic uses of the above are replaced by
appropriate function invocations.
Signed-off-by: Keir Fraser <keir@xensource.com>
only one we appear to have is use of '-q'. Replace it
with redirection to /dev/null.
Also avoid use of 'tail' by replacing with 'head' or
'grep' as appropriate.
Signed-off-by: Keir Fraser <keir@xensource.com>
This adds a heuristic for speeding up revocation of write access to
pagetables for HIGHPTE linux kernels, which previously had to brute-force
search all L1 shadows.
Signed-off-by: Tim Deegan <Tim.Deegan@xensource.com>
Holding pages readonly that have guest PAE l3 tables in them means
a performance hit and potential bug if the guest puts other
datastructures on the same page as an l3 table. Instead of shadowing
them, treat PAE guests as if they had four CR3 registers, and load all
four top-level entries when we handle a CR3 write. This also cuts about
500 lines of special-case refcounting and re-copying code.
Signed-off-by: Tim Deegan <Tim.Deegan@xensource.com>
