# changelog

author: Rik van Riel <riel@redhat.com>
changelog:
- grab new Xen tarball (with wednesday's patch already included)
- transfig is a buildrequire, add it to the spec file


author: Jeremy Katz <katzj@redhat.com> - 2-20050114
changelog:
- update to new snap
- python-twisted is its own package now
- files are in /usr/lib/python now as well, ugh.


author: Rik van Riel <riel@redhat.com> 2-20050218
changelog:
- upgrade to last night's Xen snapshot
- a kernel upgrade is needed to run this Xen, the hypervisor
  interface changed slightly
- comment out unused debugging function in plan9 domain builder
  that was giving compile errors with -Werror


author: Rik van Riel <riel@redhat.com> 2-20050305
changelog:
- the gcc4 compile patches are now upstream
- upgrade to last night's snapshot, drop patches locally


author: Rik van Riel <riel@redhat.com> 2-20050328
changelog:
- do not yet upgrade to new hypervisor ;)
- add barrier to fix SMP boot bug
- add tags target
- add zlib-devel build requires (#150952)


author: Rik van Riel <riel@redhat.com> 2-20050402
changelog:
- move initscripts to /etc/rc.d/init.d (Florian La Roche) (#153188)
- ship only PDF documentation, not the PS or tex duplicates


author: Jeremy Katz <katzj@redhat.com>
changelog:
- patch manpath instead of moving in specfile.  patch sent upstream
- install to native python path instead of /usr/lib/python
- other misc specfile duplication cleanup


author: Rik van Riel <riel@redhat.com> 3.0-0.20050908
changelog:
- explicitly call /usr/sbin/xend from initscript (#167407)
- add xenstored directories to spec file (#167496, #167121)
- misc gcc4 fixes 
- spec file cleanups (#161191)
- upgrade to today's Xen snapshot
- change the version to 3.0-0.<date> (real 3.0 release will be 3.0-1)


author: Rik van Riel <riel@redhat.com> 3.0-0.20050912.fc5
changelog:
- add /var/{lib,run}/xenstored to the %files section (#167496, #167121)
- upgrade to today's Xen snapshot
- some small build fixes for x86_64
- enable x86_64 builds


author: Daniel Veillard <veillard@redhat.com> - 3.0-0.20051109.fc5.4
changelog:
- adding missing headers for libxenctrl and libxenstore
- use libX11-devel build require instead of xorg-x11-devel


author: Jeremy Katz <katzj@redhat.com> - 3.0-0.20060110.fc5.5
changelog:
- buildrequire dev86 so that vmx firmware gets built
- include a copy of libvncserver and build vmx device models against it


author: Bill Nottingham <notting@redhat.com> 3.0-0.20060130.fc5.3
changelog:
- disable iptables/ip6tables/arptables on bridging when bringing up a
  Xen bridge. If complicated filtering is needed that uses this, custom
  firewalls will be needed. (#177794)


author: Jeremy Katz <katzj@redhat.com> - 3.0-0.20060130.fc5.4
changelog:
- patch from David Lutterkort to pass macaddr (-m) to xenguest-install
- rework xenguest-install a bit so that it can be used for creating 
  fully-virtualized guests as well as paravirt.  Run with --help for 
  more details (or follow the prompts)
- add more docs (noticed by Andrew Puch)


author: Jeremy Katz <katzj@redhat.com> - 3.0.1-0.20060208.fc5
changelog:
- update to current hg snapshot for HVM support
- update xenguest-install for hvm changes.  allow hvm on svm hardware
- fix a few little xenguest-install bugs


author: Jeremy Katz <katzj@redhat.com> - 3.0.1-0.20060208.fc5.3
changelog:
- add patch to ensure we get a unique fifo for boot loader (#182328)
- don't try to read the whole disk if we can't find a partition table 
  with pygrub 
- fix restarting of domains (#179677)


author: Jeremy Katz <katzj@redhat.com> - 3.0.1-1
changelog:
- fix xenguest-install so that it uses phy: for block devices instead of 
  forcing them over loopback.  
- change package versioning to be a little more accurate


author: Jeremy Katz <katzj@redhat.com> - 3.0.1-3
changelog:
- set /proc/xen/privcmd and /var/log/xend-debug.log as close on exec to avoid
  SELinux problems
- give better feedback on invalid urls (#184176)


author: Jeremy Katz <katzj@redhat.com> - 3.0.1-4
changelog:
- add udev rule so that /dev/xen/evtchn gets created properly
- make pygrub not use /tmp for SELinux
- make xenguest-install actually unmount its nfs share.  also, don't use /tmp


author: Jeremy Katz <katzj@redhat.com> - 3.0.2-1
changelog:
- update to post 3.0.2 snapshot (changeset:   9744:1ad06bd6832d)
- stop applying patches that are upstreamed
- add patches for bootloader to run on all domain creations
- make xenguest-install create a persistent uuid
- use libvirt for domain creation in xenguest-install, slightly improve 
  error handling


author: Jeremy Katz <katzj@redhat.com> - 3.0.2-11
changelog:
- split into main packages + -libs and -devel subpackages for #198260
- add patch from jfautley to allow specifying other bridge for 
  xenguest-install (#198097)


author: Stephen C. Tweedie <sct@redhat.com> - 3.0.2-13
changelog:
- Update to xen-unstable cset 10675
- Remove internal libvncserver build, new qemu device model has its own one
  now.
- Change default FV NIC model from rtl8139 to ne2k_pci until the former works
  better


author: Jeremy Katz <katzj@redhat.com> - 3.0.2-18
changelog:
- include /var/xen/dump in file list
- load blkbk, netbk and netloop when xend starts
- update to cs 10712
- avoid file conflicts with qemu (#199759)


author: Jeremy Katz <katzj@redhat.com> - 3.0.2-19
changelog:
- fix libblktap symlinks (#199820)
- make libxenstore executable (#197316)
- version libxenstore (markmc)


author: Jeremy Katz <katzj@redhat.com> - 3.0.2-20
changelog:
- don't start blktapctrl for now
- fix HVM guest creation in xenguest-install
- make sure log files have the right SELinux label


author: Jeremy Katz <katzj@redhat.com> - 3.0.2-23
changelog:
- add patch to fix rtl8139 in FV, switch it back to the default nic
- add necessary ia64 patches (#201040)
- build on ia64


author: Jeremy Katz <katzj@redhat.com> - 3.0.2-24
changelog:
- remove copy of xenguest-install from this package, require 
  python-xeninst (the new home of xenguest-install)


author: Jeremy Katz <katzj@redhat.com> - 3.0.2-26
changelog:
- update to xen-unstable cs 11251
- clean up patches some
- disable ia64 as it doesn't currently build


author: Stephen C. Tweedie <sct@redhat.com> - 3.0.2-35
changelog:
- Don't strip qemu-dm early, so that we get proper debuginfo (danpb)
- Fix compile problem with latest glibc


author: Daniel Berrange <berrange@redhat.com> - 3.0.2-39
changelog:
- Disable paravirt framebuffer server side rendered cursor (bz 206313)
- Ignore SIGPIPE in paravirt framebuffer daemon to avoid terminating
  on client disconnects while writing data (bz 208025)


author: Stephen C. Tweedie <sct@redhat.com> - 3.0.2-40
changelog:
- Workaround blktap/xenstore startup race
- Add udev rules for xen blktap devices (srostedt)
- Add support for dynamic blktap device nodes (srostedt)
- Fixes for infinite dom0 cpu usage with blktap
- Fix xm not to die on malformed "tap:" blkif config string
- Enable blktap on kernels without epoll-for-aio support.
- Load the blktap module automatically at startup
- Reenable blktapctrl


author: Daniel P. Berrange <berrange@redhat.com> - 3.0.2-42
changelog:
- Added vnclisten patches to make VNC only listen on localhost
  out of the box, configurable by 'vnclisten' parameter (bz 203196)


author: Daniel P. Berrange <berrange@redhat.com> - 3.0.3-1
changelog:
- Pull in the official 3.0.3 tarball of xen (changeset 11774).
- Add patches for VNC password authentication (bz 203196)
- Switch /etc/xen directory to be mode 0700 because the config files
  can contain plain text passwords (bz 203196)
- Change the package dependency to python-virtinst to reflect the
  package name change.
- Fix str-2-int cast of VNC port for paravirt framebuffer (bz 211193)


author: Daniel P. Berrange <berrange@redhat.com> - 3.0.4-2.fc7
changelog:
- Ensure the arch-x86 header files are included in xen-devel package
- Bring back patch to move /var/xen/dump to /var/lib/xen/dump
- Make /var/log/xen mode 0700


author: Daniel P. Berrange <berrange@redhat.com> - 3.0.4-5.fc7
changelog:
- Don't run the pvfb daemons for HVM guests (bz 225413)
- Fix handling of vnclisten parameter for HVM guests


author: Daniel P. Berrange <berrange@redhat.com> - 3.0.4-6.fc7
changelog:
- Setup readonly loop devices for readonly disks
- Extended error reporting for hotplug scripts
- Pass all 8 mouse buttons from VNC through to kernel


author: Daniel P. Berrange <berrange@redhat.com> - 3.0.4-7.fc7
changelog:
- Fix interaction of bootloader with blktap (bz 230702)
- Ensure PVFB daemon terminates if domain doesn't startup (bz 230634)


author: Daniel P. Berrange <berrange@redhat.com> - 3.0.5-0.rc2.14889.1.fc7
changelog:
- Updated to xen 3.0.5 rc2, changeset 14889
- Remove use of netloop from network-bridge script
- Add backcompat support to vif-bridge script to translate xenbrN to ethN


author: Daniel P. Berrange <berrange@redhat.com> - 3.0.5-0.rc3.14934.1.fc7
changelog:
- Updated to 3.0.5 rc3, changeset 14934
- Fixed networking for service xend restart & minor IPv6 tweak


author: Daniel P. Berrange <berrange@redhat.com> - 3.0.5-0.rc3.14934.2.fc7
changelog:
- Fixed display of bootloader menu with xm create -c
- Added modprobe for both xenblktap & blktap to deal with rename issues
- Hack to pre-balloon 10 MB for HVM guests


author: Daniel P. Berrange <berrange@redhat.com> - 3.0.5-0.rc4.1.fc7
changelog:
- Updated to 3.0.5 rc4, changeset 14993
- Reduce number of xenstore transactions used for listing domains
- Hack to pre-balloon 2 MB for PV guests as well as HVM


author: Daniel P. Berrange <berrange@redhat.com> - 3.1.0-0.rc7.2.fc7
changelog:
- Ensure xen-vncfb processes are cleanedup if guest quits (bz 240406)
- Tear down guest if device hotplug fails


author: Daniel P. Berrange <berrange@redhat.com> - 3.1.0-2.fc8
changelog:
- Remove patch which kills VNC monitor
- Fix HVM save/restore file path to be /var/lib/xen instead of /tmp
- Don't spawn a bogus xen-vncfb daemon for HVM guests
- Add persistent logging of hypervisor & guest consoles
- Add /etc/sysconfig/xen to allow admin choice of logging options
- Re-write Xen startup to use standard init script functions
- Add logrotate configuration for all xen related logs


author: Markus Armbruster <armbru@redhat.com> - 3.1.0-3.fc8
changelog:
- Put guest's native protocol ABI into xenstore, to provide for older
  kernels running 32-on-64.
- VNC keymap fixes
- Fix race conditions in LibVNCServer on client disconnect


author: Daniel P. Berrange <berrange@redhat.com> - 3.1.0-7.fc8
changelog:
- Re-add support for back-compat FC6 PVFB support
- Fix handling of explicit port numbers (rhbz #279581)


author: Daniel P. Berrange <berrange@redhat.com> - 3.1.0-12.fc8
changelog:
- Pull in QEMU BIOS boot menu patch from KVM package
- Fix QEMU patch for locating x509 certificates based on command line args
- Add XenD config options for TLS x509 certificate setup


author: Daniel P. Berrange <berrange@redhat.com> - 3.1.2-3.fc9
changelog:
- Re-factor to make it easier to test dev trees in RPMs
- Include hypervisor build if doing a dev RPM


author: Daniel P. Berrange <berrange@redhat.com> - 3.2.0-4.fc9
changelog:
- Add a xen-runtime subpackage to allow use of Xen without XenD
- Split init script out to one script per daemon
- Remove unused / broken / obsolete tools


author: Daniel P. Berrange <berrange@redhat.com> - 3.2.0-5.fc9
changelog:
- Fix timer mode parameter handling for HVM
- Temporarily disable all Latex docs due to texlive problems (rhbz #431327)


author: Markus Armbruster <armbru@redhat.com> - 3.2.0-11.fc10
changelog:
- Disable QEMU image format auto-detection (CVE-2008-2004)
- Fix PVFB to validate frame buffer description (CVE-2008-1943)


author: Mark McLoughlin <markmc@redhat.com> - 3.2.0-17.fc10
changelog:
- Enable xen-hypervisor build
- Backport support for booting DomU from bzImage
- Re-diff all patches for zero fuzz


author: Gerd Hoffmann <kraxel@redhat.com> - 3.3.1-9
changelog:
- fix xen.modules init script for pv_ops kernel.
- stick rpm release tag into XEN_VENDORVERSION.
- use i386 i486 i586 i686 pentium3 pentium4 athlon geode macro in ExclusiveArch.
- keep blktapctrl turned off by default.


author: Gerd Hoffmann <kraxel@redhat.com> - 3.4.0-2
changelog:
- rename info files to fix conflict with binutils.
- add install-info calls for the doc subpackage.
- un-parallelize doc build.


author: Gerd Hoffmann <kraxel@redhat.com> - 3.4.0-4
changelog:
- Kill info files.  No xen docs, just standard gnu stuff.
- kill -Werror in tools/libxc to fix build.


author: Gerd Hoffmann <kraxel@redhat.com> - 3.4.1-3
changelog:
- swap bzip2+xz linux kernel compression support patches.
- backport one more bugfix (videoram option).


author: Michael Young <m.a.young@durham.ac.uk> - 3.4.3-1
changelog:
- update to 3.4.3 release including
    support for latest pv_ops kernels (possibly incomplete)
    should fix build problems (#565063) and crashes (#545307)
- replace Prereq: with Requires: in spec file
- drop static libraries (#556101)


author: Michael Young <m.a.young@durham.ac.uk> - 4.0.0-1
changelog:
- update to 4.0.0 release
- rebase xen-initscript.patch and xen-dumpdir.patch patches
- adjust spec file for files added to or removed from the packages
- add new build dependencies libuuid-devel and iasl


author: Michael Young <m.a.young@durham.ac.uk> - 4.0.0-2
changelog:
- add patch to remove some old device creation code that doesn't
  work with the latest pvops kernels


author: Michael Young <m.a.young@durham.ac.uk> - 4.0.0-5
changelog:
- add newer module names and xen-gntdev to xen.modules
- Update dom0-kernel.repo file to use repos.fedorapeople.org location


author: Michael Young <m.a.young@durham.ac.uk> - 4.0.1-1
changelog:
- update to 4.0.1 release - many bug fixes
- xen-dev-create-cleanup.patch no longer needed
- remove part of localgcc45fix.patch no longer needed
- package new files /etc/bash_completion.d/xl.sh
  and /usr/sbin/gdbsx
- add patch to get xm and xend working with python 2.7


author: Michael Young <m.a.young@durham.ac.uk> - 4.0.1-3
changelog:
- create symlink for qemu-dm on x86_64 for compatibility with 3.4
- apply some patches destined for 4.0.2
    add some irq fixes
    disable xsave which causes problems for HVM


author: Michael Young <m.a.young@durham.ac.uk> - 4.0.1-6
changelog:
- add upstream xen patch xen.8259afix.patch to fix boot panic
  "IO-APIC + timer doesn't work!" (#642108)


author: Michael Young <m.a.young@durham.ac.uk> - 4.0.1-7
changelog:
- ghost directories in /var/run (#656724)
- minor fixes to /usr/share/doc/xen-doc-4.?.?/misc/network_setup.txt (#653159)
  /etc/xen/scripts/network-route, /etc/xen/scripts/vif-common.sh (#669747)
  and /etc/sysconfig/modules/xen.modules (#656536)


author: Michael Young <m.a.young@durham.ac.uk> - 4.1.0-0.1.rc8
changelog:
- update to 4.1.0-rc8 release candidate
- create xen-4.1.0-rc8.tar.xz file from git/hg repositories
- rebase xen-initscript.patch xen-dumpdir.patch
  xen-net-disable-iptables-on-bridge.patch localgcc45fix.patch
  sysconfig.xenstored init.xenstored
- remove unnecessary or conflicting xen-xenstore-cli.patch localpy27fixes.patch
  xen.irq.fixes.patch xen.xsave.disable.patch xen.8259afix.patch
  localcleanups.patch libpermfixes.patch
- add patch to allow pygrub to work with single partitions with boot sectors
- create ipxe-git-v1.0.0.tar.gz from http://git.ipxe.org/ipxe.git
  to avoid downloading at build time
- no need to move udev rules or init scripts as now created in the right place
- amend list of files shipped - remove fs-backend
  add init.d scripts xen-watchdog xencommons
  add config files xencommons xl.conf cpupool
  add programs kdd tap-ctl xen-hptool xen-hvmcrash xenwatchdogd


author: Michael Young <m.a.young@durham.ac.uk> - 4.1.0-2
changelog:
- Overflows in kernel decompression can allow root on xen PV guest to gain
  privileged access to base domain, or access to xen configuration info.
  Lack of error checking could allow DoS attack from guest [CVE-2011-1583]
- Don't require /usr/bin/qemu-nbd as it isn't used at present.


author: Michael Young <m.a.young@durham.ac.uk> - 4.1.1-1
changelog:
- update to 4.1.1
  includes various bugfixes and fix for [CVE-2011-1898] guest with pci
  passthrough can gain privileged access to base domain
- remove upstream cve-2011-1583-4.1.patch


author: Michael Young <m.a.young@durham.ac.uk> - 4.1.1-4
changelog:
- lsb header fixes - xenconsoled shutdown needs xenstored to be running
- partial migration to systemd to fix shutdown delays
- update grub2 configuration after hypervisor updates


author: Michael Young <m.a.young@durham.ac.uk> - 4.1.2-2
changelog:
- Fix lost interrupts on emulated devices
- stop xend crashing if its state files are empty at start up
- avoid a python backtrace if xend is run on bare metal
- update grub2 configuration after the old hypervisor has gone
- move blktapctrl to systemd
- Drop obsolete dom0-kernel.repo file


author: Michael Young <m.a.young@durham.ac.uk> - 4.1.2-3
changelog:
- Add xend-pci-loop.patch to stop xend crashing with weird PCI cards (#767742)
- avoid a backtrace if xend can't log to the standard file or a 
  temporary directory (part of #741042)


author: Michael Young <m.a.young@durham.ac.uk> - 4.1.2-5
changelog:
- Start building xen's ocaml libraries if appropriate unless --without ocaml
  was specified
- add some backported patches from xen unstable (via Debian) for some
  ocaml tidying and fixes


author: Michael Young <m.a.young@durham.ac.uk> - 4.1.2-12
changelog:
- fix an error in an rpm script from the sysv configuration removal
- migrate xendomains script to systemd


author: Michael Young <m.a.young@durham.ac.uk> - 4.1.2-14
changelog:
- /var/lib/xenstored mount has wrong selinux permissions in latest Fedora
- load xen-acpi-processor module (kernel 3.4 onwards) if present


author: Michael Young <m.a.young@durham.ac.uk> - 4.1.2-15
changelog:
- Make the udev tap rule more specific as it breaks openvpn (#812421)
- don't try setuid in xend if we don't need to so selinux is happier


author: Michael Young <m.a.young@durham.ac.uk> - 4.1.2-16 4.1.2-17
changelog:
- make pygrub cope better with big files from guest (#818412 CVE-2012-2625)
- add patch from 4.1.3-rc2-pre to build on F17/8


author: Michael Young <m.a.young@durham.ac.uk> - 4.1.2-20
changelog:
- Apply three security patches
  64-bit PV guest privilege escalation vulnerability [CVE-2012-0217]
  guest denial of service on syscall/sysenter exception generation
    [CVE-2012-0218]
  PV guest host Denial of Service [CVE-2012-2934]


author: Michael Young <m.a.young@durham.ac.uk> - 4.1.2-22
changelog:
- adjust systemd service files not to report failures when running without
  a hypervisor or when xendomains.service doesn't find anything to start


author: Michael Young <m.a.young@durham.ac.uk> - 4.1.2-24
changelog:
- in rare circumstances an unprivileged user can crash an HVM guest
  [XSA-10,CVE-2012-3432] (#843766)


author: Michael Young <m.a.young@durham.ac.uk> - 4.1.2-25
changelog:
- remove some unnecessary cache flushing that slow things down
- change python options on xend to reduce selinux problems (#845444)


author: Michael Young <m.a.young@durham.ac.uk> - 4.1.3-1 4.1.3-2
changelog:
- update to 4.1.3
  includes fix for untrusted HVM guest can cause the dom0 to hang or
    crash [XSA-11, CVE-2012-3433] (#843582)
- remove patches that are now upstream
- remove some unnecessary compile fixes
- adjust upstream-23936:cdb34816a40a-rework for backported fix for
    upstream-23940:187d59e32a58
- replace pygrub.size.limits.patch with upstreamed version
- fix for (#845444) broke xend under systemd


author: Michael Young <m.a.young@durham.ac.uk> - 4.1.3-3
changelog:
- 5 security fixes
  a malicious 64-bit PV guest can crash the dom0 [XSA-12, CVE-2012-3494]
    (#854585)
  a malicious crash might be able to crash the dom0 or escalate privileges
    [XSA-13, CVE-2012-3495] (#854589)
  a malicious PV guest can crash the dom0 [XSA-14, CVE-2012-3496] (#854590)
  a malicious HVM guest can crash the dom0 and might be able to read
    hypervisor or guest memory [XSA-16, CVE-2012-3498] (#854593)
  an HVM guest could use VT100 escape sequences to escalate privileges to
    that of the qemu process [XSA-17, CVE-2012-3515] (#854599)


author: Michael Young <m.a.young@durham.ac.uk> - 4.1.3-6
changelog:
- add font packages to build requires due to 2012 version of texlive in F19
- use build requires of texlive-latex instead of tetex-latex which it
  obsoletes


author: Michael Young <m.a.young@durham.ac.uk> - 4.2.0-1
changelog:
- update to xen-4.2.0
- rebase xen-net-disable-iptables-on-bridge.patch pygrubfix.patch
- remove patches that are now upstream or with alternatives upstream
- use ipxe and seabios from seabios-bin and ipxe-roms-qemu packages
- xen tools now need ./configure to be run (x86_64 needs libdir set)
- don't build upstream qemu version
- amend list of files in package - relocate xenpaging
  add /etc/xen/xlexample* oxenstored.conf /usr/include/xenstore-compat/*
      xenstore-stubdom.gz xen-lowmemd xen-ringwatch xl.1.gz xl.cfg.5.gz
      xl.conf.5.gz xlcpupool.cfg.5.gz
- use a tmpfiles.d file to create /run/xen on boot
- add BuildRequires for yajl-devel and graphviz
- build an efi boot image where it is supported
- adjust texlive changes so spec file still works on Fedora 17


author: Michael Young <m.a.young@durham.ac.uk> - 4.2.0-2
changelog:
- limit the size of guest kernels and ramdisks to avoid running out
  of memeory on dom0 during guest boot [XSA-25, CVE-2012-4544] (#870414)


author: Michael Young <m.a.young@durham.ac.uk> - 4.2.0-4
changelog:
- 4 security fixes
  A guest can block a cpu by setting a bad VCPU deadline [XSA 20,
    CVE-2012-4535] (#876198)
  HVM guest can exhaust p2m table crashing xen [XSA 22, CVE-2012-4537] (#876203)
  PAE HVM guest can crash hypervisor [XSA-23, CVE-2012-4538] (#876205)
  32-bit PV guest on 64-bit hypervisor can cause an hypervisor infinite
    loop [XSA-24, CVE-2012-4539] (#876207)
- texlive-2012 is now in Fedora 18


author: Michael Young <m.a.young@durham.ac.uk> - 4.2.0-6
changelog:
- 6 security fixes
  A guest can cause xen to crash [XSA-26, CVE-2012-5510] (#883082)
  An HVM guest can cause xen to run slowly or crash [XSA-27, CVE-2012-5511]
    (#883084)
  A PV guest can cause xen to crash and might be able escalate privileges
    [XSA-29, CVE-2012-5513] (#883088)
  An HVM guest can cause xen to hang [XSA-30, CVE-2012-5514] (#883091)
  A guest can cause xen to hang [XSA-31, CVE-2012-5515] (#883092)
  A PV guest can cause xen to crash and might be able escalate privileges
    [XSA-32, CVE-2012-5525] (#883094)


author: Michael Young <m.a.young@durham.ac.uk> - 4.2.1-1
changelog:
- update to xen-4.2.1
- remove patches that are included in 4.2.1
- rebase xen.fedora.efi.build.patch


author: Michael Young <m.a.young@durham.ac.uk> - 4.2.1-2
changelog:
- VT-d interrupt remapping source validation flaw [XSA-33,
    CVE-2012-5634] (#893568)
- pv guests can crash xen when xen built with debug=y (included for
    completeness - Fedora builds have debug=n) [XSA-37, CVE-2013-0154]


author: Michael Young <m.a.young@durham.ac.uk> - 4.2.1-4
changelog:
- Buffer overflow when processing large packets in qemu e1000 device
  driver [XSA-41, CVE-2012-6075] (#910845)


author: Michael Young <m.a.young@durham.ac.uk> - 4.2.1-5
changelog:
- nested virtualization on 32-bit guest can crash host [XSA-34,
  CVE-2013-0151] also nested HVM on guest can cause host to run out
  of memory [XSA-35, CVE-2013-0152] (#902792)
- restore status option to xend which is used by libvirt (#893699)


author: Michael Young <m.a.young@durham.ac.uk> - 4.2.1-6
changelog:
- guest using oxenstored can crash host or exhaust memory [XSA-38,
  CVE-2013-0215] (#907888)
- guest using AMD-Vi for PCI passthrough can cause denial of service
  [XSA-36, CVE-2013-0153] (#910914)
- add some fixes for code which gcc 4.8 complains about
- additional BuildRequires are now needed for pod2text and pod2man
  also texlive-kpathsea-bin for mktexfmt


author: Michael Young <m.a.young@durham.ac.uk> - 4.2.1-7
changelog:
- BuildRequires for texlive-kpathsea-bin wasn't needed
- correct gcc 4.8 fixes and follow suggestions upstream


author: Michael Young <m.a.young@durham.ac.uk> - 4.2.1-10
changelog:
- make xendomains systemd script executable and update it from
  init.d version (#919705)
- Potential use of freed memory in event channel operations [XSA-47,
  CVE-2013-1920]


author: Michael Young <m.a.young@durham.ac.uk> - 4.2.2-1
changelog:
- update to xen-4.2.2
  includes fixes for
  [XSA-48, CVE-2013-1922] (Fedora doesn't use the affected code)
  passed through IRQs or PCI devices might allow denial of service attack
    [XSA-46, CVE-2013-1919] (#953568)
  SYSENTER in 32-bit PV guests on 64-bit xen can crash hypervisor
    [XSA-44, CVE-2013-1917] (#953569)
- remove patches that are included in 4.2.2
- look for libxl-save-helper in the right place
- fix xl list -l output when built with yajl2
- allow xendomains to work with xl saved images


author: Michael Young <m.a.young@durham.ac.uk> - 4.2.2-3
changelog:
- PV guests can use non-preemptible long latency operations to
  mount a denial of service attack on the whole system
  [XSA-45, CVE-2013-1918] (#958918)
- malicious guests can inject interrupts through bridge devices to
  mount a denial of service attack on the whole system
  [XSA-49, CVE-2013-1952] (#958919)


author: Michael Young <m.a.young@durham.ac.uk> - 4.2.2-4
changelog:
- xen-devel should require libuuid-devel (#962833)
- pygrub menu items can include too much text (#958524)


author: Michael Young <m.a.young@durham.ac.uk> - 4.2.2-6
changelog:
- Information leak on XSAVE/XRSTOR capable AMD CPUs
  [XSA-52, CVE-2013-2076] (#970206)
- Hypervisor crash due to missing exception recovery on XRSTOR
  [XSA-53, CVE-2013-2077] (#970204)
- Hypervisor crash due to missing exception recovery on XSETBV
  [XSA-54, CVE-2013-2078] (#970202)
- Multiple vulnerabilities in libelf PV kernel handling
  [XSA-55] (#970640)


author: Michael Young <m.a.young@durham.ac.uk> - 4.2.2-10
changelog:
- XSA-45/CVE-2013-1918 breaks page reference counting [XSA-58,
  CVE-2013-1432] (#978383)
- let pygrub handle set default="${next_entry}" line in F19 (#978036)
- libxl: Set vfb and vkb devid if not done so by the caller (#977987)


author: Michael Young <m.a.young@durham.ac.uk> - 4.3.0-1
changelog:
- update to xen-4.3.0
- rebase xen.use.fedora.ipxe.patch
- remove patches that are now included or no longer needed
- add polarssl source needed for stubdom build
- remove references to ia64 in spec file (dropped upstream)
- don't build hypervisor on ix86 (dropped upstream)
- tools want wget (or ftp) to build
- build XSM FLASK support into hypervisor with policy file
- add xencov_split and xencov to files packaged, remove pdf docs
- tidy up rpm scripts and stop enabling systemctl services on upgrade
  now sysv is gone from Fedora
- re-number patches


author: Michael Young <m.a.young@durham.ac.uk> - 4.3.0-7
changelog:
- Set "Domain-0" label in xenstored.service systemd file to match
  xencommons init.d script.
- security fixes (#1013748)
  Information leaks to HVM guests through I/O instruction emulation
    [XSA-63, CVE-2013-4355]
  Memory accessible by 64-bit PV guests under live migration
    [XSA-64, CVE-2013-4356]
  Information leak to HVM guests through fbld instruction emulation
    [XSA-66, CVE-2013-4361]


author: Michael Young <m.a.young@durham.ac.uk> - 4.3.0-8
changelog:
- security fixes (#1017843)
  Information leak through outs instruction emulation in 64-bit PV guests
    [XSA-67, CVE-2013-4368]
  possible null dereference when parsing vif ratelimiting info
    [XSA-68, CVE-2013-4369]
  misplaced free in ocaml xc_vcpu_getaffinity stub
    [XSA-69, CVE-2013-4370]
  use-after-free in libxl_list_cpupool under memory pressure
    [XSA-70, CVE-2013-4371]
  qemu disk backend (qdisk) resource leak (Fedora doesn't build this qemu)
    [XSA-71, CVE-2013-4375]


author: Michael Young <m.a.young@durham.ac.uk> - 4.3.1-1
changelog:
- update to xen-4.3.1
- Lock order reversal between page allocation and grant table locks
    [XSA-73, CVE-2013-4494] (#1026248)


author: Michael Young <m.a.young@durham.ac.uk> - 4.3.1-4
changelog:
- Lock order reversal between page_alloc_lock and mm_rwlock
    [XSA-74, CVE-2013-4553] (#1034925)
- Hypercalls exposed to privilege rings 1 and 2 of HVM guests
    [XSA-76, CVE-2013-4554] (#1034923)


author: Michael Young <m.a.young@durham.ac.uk> - 4.3.1-6
changelog:
- Disaggregated domain management security status update [XSA-77]
- IOMMU TLB flushing may be inadvertently suppressed [XSA-80, CVE-2013-6400]
    (#1040024)


author: Michael Young <m.a.young@durham.ac.uk> - 4.3.1-7
changelog:
- Out-of-memory condition yielding memory corruption during IRQ setup
    [XSA-83, CVE-2014-1642] (#1057142)


author: Michael Young <m.a.young@durham.ac.uk> - 4.3.1-8
changelog:
- PHYSDEVOP_{prepare,release}_msix exposed to unprivileged pv guests
    [XSA-87, CVE-2014-1666] (#1058398)


author: Michael Young <m.a.young@durham.ac.uk> - 4.3.1-9
changelog:
- integer overflow in several XSM/Flask hypercalls [XSA-84, CVE-2014-1891,
    CVE-2014-1892, CVE-2014-1893, CVE-2014-1894]
  Off-by-one error in FLASK_AVC_CACHESTAT hypercall [XSA-85, CVE-2014-1895]
  libvchan failure handling malicious ring indexes [XSA-86, CVE-2014-1896]
    (#1062335)


author: Michael Young <m.a.young@durham.ac.uk> - 4.3.1-10
changelog:
- use-after-free in xc_cpupool_getinfo() under memory pressure [XSA-88,
    CVE-2014-1950] (#1064491)


author: Michael Young <m.a.young@durham.ac.uk> - 4.3.2-1
changelog:
- update to xen-4.3.2
  includes fix for "Excessive time to disable caching with HVM guests with
    PCI passthrough" [XSA-60, CVE-2013-2212] (#987914)
- remove patches that are now included


author: Michael Young <m.a.young@durham.ac.uk> - 4.4.0-1
changelog:
- update to xen-4.4.0
- adjust xend.selinux.fixes.patch and xen-initscript.patch as xend has moved
- don't build xend unless --with xend is specified
- use --with-system-seabios option instead of xen.use.fedora.seabios.patch
- update xen.use.fedora.ipxe.patch patch
- replace qemu-xen.tradonly.patch with --with-system-qemu= option pointing
  to Fedora's qemu-system-i386
- adjust xen.xsm.enable.patch and remove bits that are are no longer needed
- blktapctrl is no longer built, remove related files
- adjust files to be packaged; xsview has gone, add xen-mfndump and
  xenstore man pages
- add another xenstore-write to xenstored.service and oxenstored.service
- Add xen.console.fix.patch to fix issues running pygrub


author: Michael Young <m.a.young@durham.ac.uk> - 4.4.0-3
changelog:
- HVMOP_set_mem_type allows invalid P2M entries to be created
	[XSA-92, CVE-2014-3124] (#1093315)
- change -Wmaybe-uninitialized errors into warnings for gcc 4.9.0
- fix a couple of -Wmaybe-uninitialized cases


author: Michael Young <m.a.young@durham.ac.uk> - 4.4.0-6
changelog:
- Fix two %if line typos in the spec file
- Vulnerabilities in HVM MSI injection [XSA-96, CVE-2014-3967,CVE-2014-3968]
	(#1104583)


author: Michael Young <m.a.young@durham.ac.uk> - 4.4.0-7
changelog:
- Hypervisor heap contents leaked to guest [XSA-100, CVE-2014-4021]
	(#1110316) with extra patch to avoid regression


author: Michael Young <m.a.young@durham.ac.uk> - 4.4.1-1
changelog:
- update to xen-4.4.1
  remove patches for fixes that are now included
- replace uint32 with uint32_t in ocaml file for ocaml-4.02.0


author: Michael Young <m.a.young@durham.ac.uk> - 4.4.1-2
changelog:
- Mishandling of uninitialised FIFO-based event channel control blocks
	[XSA-107, CVE-2014-6268] (#1140287)
- delete a patch file that was dropped in the last update


author: Michael Young <m.a.young@durham.ac.uk> - 4.4.1-4
changelog:
- Race condition in HVMOP_track_dirty_vram [XSA-104, CVE-2014-7154] (#1145736)
- Missing privilege level checks in x86 HLT, LGDT, LIDT, and LMSW emulation
	[XSA-105, CVE-2014-7155] (#1145737)
- Missing privilege level checks in x86 emulation of software interrupts
	[XSA-106, CVE-2014-7156] (#1145738)


author: Michael Young <m.a.young@durham.ac.uk> - 4.4.1-7
changelog:
- Insufficient restrictions on certain MMU update hypercalls [XSA-109,
	CVE-2014-8594] (#1165205)
- Missing privilege level checks in x86 emulation of far branches [XSA-110,
	CVE-2014-8595] (#1165204)
- Add fix for CVE-2014-0150 to qemu-dm, though it probably isn't
	exploitable from xen (#1086776)


author: Michael Young <m.a.young@durham.ac.uk> - 4.4.1-8
changelog:
- Guest effectable page reference leak in MMU_MACHPHYS_UPDATE handling
	[XSA-113, CVE-2014-9030] (#1166914)


author: Michael Young <m.a.young@durham.ac.uk> - 4.4.1-9
changelog:
- Excessive checking in compatibility mode hypercall argument translation
	[XSA-111, CVE-2014-8866]
- Insufficient bounding of "REP MOVS" to MMIO emulated inside the hypervisor
	[XSA-112, CVE-2014-8867]
- fix segfaults and failures in xl migrate --debug (#1166461)


author: Michael Young <m.a.young@durham.ac.uk> - 4.5.0-1
changelog:
- update to 4.5.0
  xend has gone, so remove references to xend in spec file, sources and patches
  remove patches for issues now fixed upstream
  adjust some patches due to other code changes
  adjust spec file for renamed xenpolicy files
  set prefix back to /usr (default is now /usr/local)
  use upstream systemd files with patches for Fedora and selinux
	sysconfig for systemd is now in xencommons file
  for x86_64, files in /usr/lib64/xen/bin have moved to /usr/lib/xen/bin
  remus isn't built
  upstream systemd support needs systemd-devel to build
  replace new uint32 with uint32_t in ocaml file for ocaml-4.02.0
  stop oxenstored failing when selinux is enforcing
  re-number patches
- enable building pngs from fig files which is working again
- fix oxenstored.service preset preuninstall script
- arm: vgic: incorrect rate limiting of guest triggered logging [XSA-118,
	CVE-2015-1563] (#1187153)


author: Michael Young <m.a.young@durham.ac.uk> - 4.5.0-2
changelog:
- arm: vgic-v2: GICD_SGIR is not properly emulated [XSA-117, CVE-2015-0268]
- allow certain warnings with gcc5 that would otherwise be treated as errors


author: Michael Young <m.a.young@durham.ac.uk> - 4.5.0-3
changelog:
- Information leak via internal x86 system device emulation [XSA-121,
	CVE-2015-2044]
- Information leak through version information hypercall [XSA-122,
	CVE-2015-2045]
- fix a typo in xen.fedora.systemd.patch


author: Michael Young <m.a.young@durham.ac.uk> - 4.5.0-5
changelog:
- HVM qemu unexpectedly enabling emulated VGA graphics backends [XSA-119,
	CVE-2015-2152] (#1201365)


author: Michael Young <m.a.young@durham.ac.uk> - 4.5.0-7
changelog:
- Long latency MMIO mapping operations are not preemptible [XSA-125,
	CVE-2015-2752] (#1207741)
- Unmediated PCI command register access in qemu [XSA-126,
	CVE-2015-2756] (#1307738)
- Certain domctl operations may be abused to lock up the host [XSA-127,
	CVE-2015-2751] (#1207739)


author: Michael Young <m.a.young@durham.ac.uk> - 4.5.0-10
changelog:
- replace deprecated gnutls use in qemu-xen-traditional based on
	qemu-xen patches
- work around a gcc 5 bug
- Potential unintended writes to host MSI message data field via qemu
	[XSA-128, CVE-2015-4103] (#1227627)
- PCI MSI mask bits inadvertently exposed to guests [XSA-129, CVE-2015-4104]
	(#1227628)
- Guest triggerable qemu MSI-X pass-through error messages [XSA-130,
	CVE-2015-4105] (#1227629)
- Unmediated PCI register access in qemu [XSA-131, CVE-2015-4106] (#1227631)


author: Michael Young <m.a.young@durham.ac.uk> - 4.5.0-11
changelog:
- stubs-32.h is back, so revert to previous behaviour
- Heap overflow in QEMU PCNET controller, allowing guest->host escape
	[XSA-135, CVE-2015-3209] (#1230537)
- GNTTABOP_swap_grant_ref operation misbehavior [XSA-134, CVE-2015-4163]
- vulnerability in the iret hypercall handler [XSA-136, CVE-2015-4164]


author: Michael Young <m.a.young@durham.ac.uk> - 4.5.1-1
changelog:
- update to 4.5.1
  adjust xen.use.fedora.ipxe.patch and xen.fedora.systemd.patch
  remove patches for issues now fixed upstream
  renumber patches


author: Michael Young <m.a.young@durham.ac.uk> - 4.5.1-3
changelog:
- correct qemu location in xen-qemu-dom0-disk-backend.service (#1242246)
- rebuild efi grub.cfg if it is present (#1239309)
- re-enable remus by building with libnl3
- modify gnutls use in line with Fedora's crypto policies (#1179352)


author: Michael Young <m.a.young@durham.ac.uk> - 4.5.1-5
changelog:
- QEMU heap overflow flaw while processing certain ATAPI commands.
	[XSA-138, CVE-2015-5154] (#1247142)
- try again to fix xen-qemu-dom0-disk-backend.service (#1242246)


author: Michael Young <m.a.young@durham.ac.uk> - 4.5.1-6
changelog:
- Use after free in QEMU/Xen block unplug protocol [XSA-139, CVE-2015-5166]
	(#1249757)
- QEMU leak of uninitialized heap memory in rtl8139 device model
	[XSA-140, CVE-2015-5165] (#1249756)


author: Michael Young <m.a.young@durham.ac.uk> - 4.5.1-8
changelog:
- libxl fails to honour readonly flag on disks with qemu-xen
	[XSA-142, CVE-2015-7311] (#1257893) (final patch version)


author: Michael Young <m.a.young@durham.ac.uk> - 4.5.1-9
changelog:
- ui/vnc: limit client_cut_text msg payload size [CVE-2015-5239] (#1259504)
- e1000: Avoid infinite loop in processing transmit descriptor
	[CVE-2015-6815] (#1260224)
- net: add checks to validate ring buffer pointers [CVE-2015-5279] (#1263278)
- net: avoid infinite loop when receiving packets [CVE-2015-5278] (#1263281)
- qemu buffer overflow in virtio-serial [CVE-2015-5745] (#1251354)


author: Michael Young <m.a.young@durham.ac.uk> - 4.5.1-11
changelog:
- create a symbolic link so libvirt VMs from xen 4.0 to 4.4 can still
	find qemu-dm (#1268176), (#1248843)


author: Michael Young <m.a.young@durham.ac.uk> - 4.6.0-1
changelog:
- update to xen-4.6.0
  xen-dumpdir.patch no longer needed
  adjust xen.use.fedora.ipxe.patch and xen.fedora.systemd.patch
  remove upstream patches
  add build fix for blktap2 to gcc5 fixes
  udev rules have now gone as have xen-syms in /boot
  package extra files 
    /etc/rc.d/init.d/xendriverdomain
    /usr/bin/xenalyze
    /usr/sbin/xentrace
    /usr/sbin/xentrace_setsize
    /usr/share/pkgconfig/*.pc
- renumber patches
- add build-requires for pandoc and discount to improve docs


