* adds a C-based security policy translation tool to Xen (secpol_xml2bin)
and removes the current Java
security policy translator (Java dependencies). The C-based tool
integrates into the Xen source tree build
and install (using gnome libxml2 for XML parsing). See install.txt.
* introduces security labels and related tools. Users can now use
semantic-rich label names to put security-tags
on domains. See example.txt, policy.txt.
* moves the security configuration (currently ACM_USE_SECURITY_POLICY)
from xen/Rules.mk
into a separate top-level Security.mk file (it is needed by the
tools/security and xen/acm).
Both xen/acm and tools/security are built during the Xen build process
only if ACM_USE_SECURITY_POLICY
is not ACM_NULL_POLICY (which is the default setting).
Signed-off-by Reiner Sailer <sailer@us.ibm.com>
Signed-off by Stefan Berger <stefanb@us.ibm.com>
Signed-off by Ray Valdez <rvaldez@us.ibm.com>
explicitly specifies a 'com1=' or 'com2=' configuration
string. This prevents users from being surprised when Xen
stops domain0 from accessing serial port registers.
On ia64 we still allow serial ports to get automatically
configured and locked down even if no 'com1' is specified
on the command line. This maintains the default preferred
by the IA64 developers.
Also, the method for specifying 'use existing baud rate'
has changed. Instead of specifying com1=0, you must now
specify e.g., com1=auto
Signed-off-by: Keir Fraser <keir@xensource.com>
active at startup; this works by adding a module line into the grub
configuration file and placing the binary policy generated by the
policy tool into the boot directory; This assumes that a maximum of
one module line is used for the initrd in the grub configuration
file - Question: do users pass more than one module to the kernel?
- enables the policy hypervisor call on x86/64
- some function prototypes moved to include files
- moves the version number in the java tool up to the current
version (a better way of doing this will be submitted soon)
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
Signed-off-by: Reiner Sailer <sailer@us.ibm.com>
Add a manual 'sync_console' boot parameter that forces synchronous
console output. May be useful for systems that crash unexpectedly
and lose the last chunk of console output.
Signed-off-by: Keir Fraser <keir@xensource.com>
vnet-xend.txt, user.tex, README:
Update the Linux kernel version number from 2.6.9 to 2.6 or 2.6.11
in several places in documentation.
Original patch provided by Andrew Thompson <andrewkt@aktzero.com>
Signed-off-by: Christian Limpach <Christian.Limpach@cl.cam.ac.uk>
By default do not enable local APIC if disabled by the BIOS. This
matches Linux behaviour and ought to improve stability on buggy
hardware/firmware (laptops in particular). As in Linux, you can
forcibly enable the APIC with 'lapic' command-line option, or
forcibly ignore it with 'nolapic'.
Signed-off-by: Keir Fraser <keir@xensource.com>
Remove generic 'fast trap' from the Xen public interfaces. Internally
within Xen, we automatically set up direct trap for int 0x80, which is
the only 'fast trap' vector that we ever supported anyway.
Signed-off-by: Keir Fraser <keir@xensource.com>
Add 'apic={verbose,debug}' option to Xen. Same meaning as on Linux
command line, and automatically propagated to domain0 command line.
Signed-off-by: Keir Fraser <keir@xensource.com>
Change the Xen command-line parameter syntax. 'noacpi' and
'ignorebiostables' are gone. 'dom0_mem' can optionally take a k/m/g
suffix to specify units (default units are still kilobytes).
Also added:
1. 'mem=xxx' to specify maximum physical RAM address (supports
k/m/g suffix)
2. acpi=xxx/acpi_skip_timer_override/noapic: These all have same
semantics as in Linux. They are *automatically* propagated to
the domain0 command line, as dom0 shares resposibility for
platform initialisation.
Signed-off-by: Keir Fraser <keir@xensource.com>
grant-tables.txt:
fix to error check condition after map
blkback.c:
bug fix to grant table code in block backend
Kconfig:
amend config entry for XEN_BLKDEV_GRANT
[PATCH] add-build.patch
Add build targets to all makefiles. Debian does builds as non-root, so
it's better to do as much as possible before requiring root privs.
Signed-off-by: Adam Heath <doogie@brainfood.com>
No longer require latex2html (bizarrely considered 'non-free' by Debian
maintainers) to build docs. Instead we still build PS/PDF docs, but skip
HTML docs.
Signed-off-by: Keir Fraser <keir.fraser@cl.cam.ac.uk>
Description: use DESTDIR correctly
Standard makefiles always attempt to install to the root(/). Setting
DESTDIR is the normal way to install to an alternative location.
Setting prefix has the possibility of breaking programs, as the prefix
may have been embedded inside a compiled binary.
From: Adam Heath <doogie@brainfood.com>
Signed-off-by: ian.pratt@cl.cam.ac.uk
