commit: 2bfd1dc774e87e20ccd6f77a4847ec7126501e43
Author: Yixun Lan <dlan <AT> gentoo <DOT> org>
AuthorDate: Sun Dec 31 13:34:55 2017 +0000
Commit: Yixun Lan <dlan <AT> gentoo <DOT> org>
CommitDate: Sun Dec 31 13:42:11 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2bfd1dc7
app-emulation/xen: security fix updates
fix XSA-248, 249, 250, 251
Gentoo-Bug: 641566
Package-Manager: Portage-2.3.19, Repoman-2.3.6
Signed-off-by: Yixun Lan <dlan <AT> gentoo.org>
app-emulation/xen-tools/Manifest | 3 +
app-emulation/xen-tools/xen-tools-4.9.1-r1.ebuild | 454 ++++++++++++++++++++++
app-emulation/xen/Manifest | 1 +
app-emulation/xen/xen-4.9.1-r1.ebuild | 171 ++++++++
4 files changed, 629 insertions(+)
diff --git a/app-emulation/xen-tools/Manifest b/app-emulation/xen-tools/Manifest
index 444a38987a7..227c9881981 100644
--- a/app-emulation/xen-tools/Manifest
+++ b/app-emulation/xen-tools/Manifest
@@ -1,9 +1,12 @@
DIST ovmf-20151110.tar.bz2 27518370 BLAKE2B
c4ba51e59ca3f597d75639a792b1f307a70dc6127917306e6ce182a76646435bec8006f7db9ac5c580e0ad79465a2b2902cffa90139d367c89d16e28280a978b
SHA512
dda185af2fc0b9a8d5fc7e1e96db6aa31807782fe77d38491896164d125c30d2277db3d71a7dce7bbd569723b344b97dfebbc78ddddca0a095721f6b1ae3a1d3
+DIST ovmf-20170321.tar.xz 22141096 BLAKE2B
79e991c8f9deb297865c319e88b6e6d46b1d08067d3fd639c83f2a379670779ecc60c74c2671ea4eb4a6659fe08ac2d7d4ff337b010b42a908a50829a2d18eeb
SHA512
f65dabde3df967224e2072817211786ee4fc3994ee31f8f9d6f67fd74e3479e1da459c720169dd81020cdc1777e4600e531bb124b4625c2ded42c6005bdc802a
DIST seabios-1.10.0.tar.gz 588213 BLAKE2B
254eb4572a1dac06020a545820efb53a130a027aaab035cd916009b424475f89bd151f82f1bc5103c01c4657d09da3219d2fbcc7728add473011dcfc7bff7410
SHA512
f1b83ce37b59070b488e19f98c95ca9f413cf4969663331b631c3ccb884c90b2db793d32a779ef05cead538c2fd123be4b73391ad2fa20c900a1f14237178d8c
DIST xen-4.8.2-upstream-patches-2.tar.xz 38852 BLAKE2B
cbc7bad4703fabd05b703c66268df0670e2ae97b77007895dceaf6465b12a2f9fbe3773c7735b307427ad18c61711b20beb7f3ae6b1f1b8b5efda2a847fec0ec
SHA512
536823eabf03e92585a8c5cde90ce502672dd1ec080b28b39411d6a778b899436a57bfb633f11c94d48d2f963848b7771e469f5ea53e84b580976f631f69cc5d
DIST xen-4.8.2.tar.gz 22522336 BLAKE2B
2c9da971622b4e52fe78fa029107bb1c5f945a63605406493df607c410c6f2a8c2cdb38b1eb30c1bc1c8bc6e5620efad977c3ba55e04c579c01d51f0104afcce
SHA512
7805531f73d23ecfff3439770e62d387f4254a444875670d53a0a739323e5d4d8f8fcc478f8936ee1ae8aff3e0229549e47c01c606365a8ce060dd5c503e87da
DIST xen-4.9.0-upstream-patches-0.tar.xz 58780 BLAKE2B
6d12a5a5bb7d2be7ca6bb8636648ee219c9526dd34086c929d8cd32d096d2454d6cb499d459b436f228fa49f42ef3a1f5fbe9b5c84557e4054565a9edc0daad6
SHA512
98c601d791661a306e3dce5befb37b80de8a71cdd1759f3da00b199d48e3b9468efd1332e26ae044ad616b41a02771ad07a1c96972103b7e0aa39b93fb556999
DIST xen-4.9.0.tar.gz 23361741 BLAKE2B
1cfebb791ca5e51eda9b86a5d98e0883fab1554f5ac805fc065916fbbd3695e6b0f11ca75935a8f973735cc8dd83e38fe4a670d8489010be865be49d8fc1a341
SHA512
97f8075c49ef9ec0adbe95106c0cff4f9379578fd568777697565476c3fd948335d72ddcacf8be65fd9db219c0a35dcdc007f355f7e5874dd950fd4c0a0f966f
+DIST xen-4.9.1-upstream-patches-1.tar.xz 24592 BLAKE2B
774c5219d6c14d729358e790d880a1a31fb4cda741e54e71879bff164e79bafbd8492eb8bccb7becdf7a2f9605e71266bb4fc15848deff8f9028ed7f8844f915
SHA512
edbc7cad2f6f8a5c7e8aac8efd5454428aa25e0e13018438f78c7f401cfb9173345267e16c7a5dfa78066a952980b172976409a0c63162094b7f507058e712ed
DIST xen-4.9.1.tar.gz 23368303 BLAKE2B
4cfddb351c9a4aa08227138dc1afa921f3d1880048f897428226da38eff9470cd81ae9896f174583048dad0ba8d5c1426df58b029115ba1623366d1980630c0d
SHA512
9d22f0aa5dcd01a1c105d17c14bce570cc597e884ddb9b4a46b80a72f647625b76ae5213cede423d0458c14e1906983595a9269bb6e6ff2e9e7e4dea840f4274
DIST xen-gentoo-patches-10.tar.xz 27876 BLAKE2B
8efece8548a046b47c04e5b9354ca8bdff55affd6c6bc67315ac7536778fbaa183d346e0ff83e365030df2433bddf845188a1c3fb8feaea2e93d5ba0dd1c779a
SHA512
2033f4cb671971c73841cfaa7eb46623c37778c5746b47302eee252c4af287ccbeb8d1884ffdf32cd97a38cd7785257d56f13ef20d4c03dc0fb1cb196dc04ece
DIST xen-ovmf-patches-2.tar.xz 4344 BLAKE2B
1514c89dcba05c84281e9d46ec5c3e9e946ea777dcbe64d1d7689298e187aac2c9a5febf407d79bdb3ebe47563972ea66e0f5204590c5abc98df9cf24549b92d
SHA512
0bdc83029a01b613f5c1ca029bd45aebe211c332f09db91a0cc7d6b6f85a81dbbfdc20c62f0d20e973ee41b155a6551a4fad518cb792e1d508bf070e23d6a1d3
+DIST xen-ovmf-patches-3.tar.xz 4208 BLAKE2B
0df8f85667a33c91cbfd86c59aec2ae65eca892b45d66eed76f793a52e2748989bc2785861f8bfdf94235ef7a6c0be6572c6e6cce9695469e40f0facd0ce3947
SHA512
abe001053ca702138bbcdd6bea14e2daae5c785f862d6a15001ca894c8ed8617f0c5dc439c6f54a41433b988acf57c71911af1db074aa76732c39d98622a3b5b
diff --git a/app-emulation/xen-tools/xen-tools-4.9.1-r1.ebuild
b/app-emulation/xen-tools/xen-tools-4.9.1-r1.ebuild
new file mode 100644
index 00000000000..4f9eb745833
--- /dev/null
+++ b/app-emulation/xen-tools/xen-tools-4.9.1-r1.ebuild
@@ -0,0 +1,454 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+PYTHON_COMPAT=( python2_7 )
+PYTHON_REQ_USE='ncurses,xml,threads'
+
+inherit bash-completion-r1 eutils flag-o-matic multilib python-single-r1
toolchain-funcs versionator
+
+MY_PV=${PV/_/-}
+MAJOR_V="$(get_version_component_range 1-2)"
+
+if [[ $PV == *9999 ]]; then
+ inherit git-r3
+ KEYWORDS=""
+ REPO="xen.git"
+ EGIT_REPO_URI="git://xenbits.xen.org/${REPO}"
+ S="${WORKDIR}/${REPO}"
+else
+ KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+ UPSTREAM_VER=1
+ SECURITY_VER=
+ # xen-tools's gentoo patches tarball
+ GENTOO_VER=10
+ # xen-tools's gentoo patches version which apply to this specific ebuild
+ GENTOO_GPV=0
+ # xen-tools ovmf's patches
+ OVMF_VER=3
+
+ SEABIOS_VER=1.10.0
+ # OVMF upstream 5920a9d16b1ab887c2858224316a98e961d71b05
+ OVMF_PV=20170321
+
+ [[ -n ${UPSTREAM_VER} ]] && \
+
UPSTREAM_PATCHSET_URI="https://dev.gentoo.org/~dlan/distfiles/${P/-tools/}-upstream-patches-${UPSTREAM_VER}.tar.xz";
+ [[ -n ${SECURITY_VER} ]] && \
+
SECURITY_PATCHSET_URI="https://dev.gentoo.org/~dlan/distfiles/${PN/-tools}-security-patches-${SECURITY_VER}.tar.xz";
+ [[ -n ${GENTOO_VER} ]] && \
+
GENTOO_PATCHSET_URI="https://dev.gentoo.org/~dlan/distfiles/${PN/-tools}-gentoo-patches-${GENTOO_VER}.tar.xz";
+ [[ -n ${OVMF_VER} ]] && \
+
OVMF_PATCHSET_URI="https://dev.gentoo.org/~dlan/distfiles/${PN/-tools}-ovmf-patches-${OVMF_VER}.tar.xz";
+
+
SRC_URI="https://downloads.xenproject.org/release/xen/${MY_PV}/xen-${MY_PV}.tar.gz
+
http://code.coreboot.org/p/seabios/downloads/get/seabios-${SEABIOS_VER}.tar.gz
+ https://dev.gentoo.org/~dlan/distfiles/seabios-${SEABIOS_VER}.tar.gz
+ ovmf? ( https://dev.gentoo.org/~dlan/distfiles/ovmf-${OVMF_PV}.tar.xz
+ ${OVMF_PATCHSET_URI} )
+ ${UPSTREAM_PATCHSET_URI}
+ ${SECURITY_PATCHSET_URI}
+ ${GENTOO_PATCHSET_URI}"
+
+ S="${WORKDIR}/xen-${MY_PV}"
+fi
+
+DESCRIPTION="Xen tools including QEMU and xl"
+HOMEPAGE="https://www.xenproject.org";
+DOCS=( README docs/README.xen-bugtool )
+
+LICENSE="GPL-2"
+SLOT="0/${MAJOR_V}"
+# Inclusion of IUSE ocaml on stabalizing requires maintainer of ocaml to (get
off his hands and) make
+# >=dev-lang/ocaml-4 stable
+# Masked in profiles/eapi-5-files instead
+IUSE="api custom-cflags debug doc flask hvm ocaml ovmf +pam pygrub python
+qemu +qemu-traditional screen sdl static-libs system-qemu system-seabios"
+
+REQUIRED_USE="
+ ${PYTHON_REQUIRED_USE}
+ pygrub? ( python )
+ ovmf? ( hvm )
+ ^^ ( qemu system-qemu )"
+
+COMMON_DEPEND="
+ sys-apps/pciutils
+ dev-libs/lzo:2
+ dev-libs/glib:2
+ dev-libs/yajl
+ dev-libs/libaio
+ dev-libs/libgcrypt:0
+ sys-libs/zlib
+ ${PYTHON_DEPS}
+"
+
+DEPEND="${COMMON_DEPEND}
+ >=sys-kernel/linux-headers-4.11
+ dev-python/lxml[${PYTHON_USEDEP}]
+ x86? ( sys-devel/dev86
+ sys-power/iasl )
+ pam? ( dev-python/pypam[${PYTHON_USEDEP}] )
+ api? ( dev-libs/libxml2
+ net-misc/curl )
+ ovmf? (
+ !arm? ( !arm64? ( dev-lang/nasm ) )
+ $(python_gen_impl_dep sqlite)
+ )
+ !amd64? ( >=sys-apps/dtc-1.4.0 )
+ amd64? ( sys-devel/bin86
+ system-seabios? ( sys-firmware/seabios )
+ sys-firmware/ipxe
+ sys-devel/dev86
+ sys-power/iasl )
+ dev-lang/perl
+ app-misc/pax-utils
+ doc? (
+ app-text/ghostscript-gpl
+ app-text/pandoc
+ dev-python/markdown[${PYTHON_USEDEP}]
+ dev-texlive/texlive-latexextra
+ media-gfx/transfig
+ )
+ hvm? ( x11-proto/xproto
+ !net-libs/libiscsi )
+ qemu? (
+ app-arch/snappy:=
+ x11-libs/pixman
+ sdl? ( media-libs/libsdl[X] )
+ )
+ system-qemu? ( app-emulation/qemu[xen] )
+ ocaml? ( dev-ml/findlib
+ >=dev-lang/ocaml-4 )"
+
+RDEPEND="${COMMON_DEPEND}
+ sys-apps/iproute2[-minimal]
+ net-misc/bridge-utils
+ screen? (
+ app-misc/screen
+ app-admin/logrotate
+ )"
+
+# hvmloader is used to bootstrap a fully virtualized kernel
+# Approved by QA team in bug #144032
+QA_WX_LOAD="
+ usr/libexec/xen/boot/hvmloader
+ usr/share/qemu-xen/qemu/s390-ccw.img
+ usr/share/qemu-xen/qemu/u-boot.e500
+"
+
+QA_PREBUILT="
+ usr/libexec/xen/bin/ivshmem-client
+ usr/libexec/xen/bin/ivshmem-server
+ usr/libexec/xen/bin/qemu-img
+ usr/libexec/xen/bin/qemu-io
+ usr/libexec/xen/bin/qemu-nbd
+ usr/libexec/xen/bin/qemu-system-i386
+ usr/libexec/xen/bin/virtfs-proxy-helper
+ usr/libexec/xen/libexec/xen-bridge-helper
+ usr/share/qemu-xen/qemu/s390-ccw.img
+ usr/share/qemu-xen/qemu/u-boot.e500
+"
+
+RESTRICT="test"
+
+pkg_setup() {
+ python_setup
+ export "CONFIG_LOMOUNT=y"
+
+ #bug 522642, disable compile tools/tests
+ export "CONFIG_TESTS=n"
+
+ if [[ -z ${XEN_TARGET_ARCH} ]] ; then
+ if use x86 && use amd64; then
+ die "Confusion! Both x86 and amd64 are set in your use
flags!"
+ elif use x86; then
+ export XEN_TARGET_ARCH="x86_32"
+ elif use amd64 ; then
+ export XEN_TARGET_ARCH="x86_64"
+ elif use arm; then
+ export XEN_TARGET_ARCH="arm32"
+ elif use arm64; then
+ export XEN_TARGET_ARCH="arm64"
+ else
+ die "Unsupported architecture!"
+ fi
+ fi
+}
+
+src_prepare() {
+ local i
+
+ # Upstream's patchset
+ if [[ -n ${UPSTREAM_VER} ]]; then
+ einfo "Try to apply Xen Upstream patch set"
+ eapply "${WORKDIR}"/patches-upstream
+ fi
+
+ # Security patchset
+ if [[ -n ${SECURITY_VER} ]]; then
+ einfo "Try to apply Xen Security patch set"
+ # apply main xen patches
+ # Two parallel systems, both work side by side
+ # Over time they may concdense into one. This will suffice for
now
+ EPATCH_SUFFIX="patch"
+ EPATCH_FORCE="yes"
+
+ source "${WORKDIR}"/patches-security/${PV}.conf || die
+
+ for i in ${XEN_SECURITY_MAIN}; do
+ eapply "${WORKDIR}"/patches-security/xen/$i
+ done
+
+ # apply qemu-xen/upstream patches
+ pushd "${S}"/tools/qemu-xen/ > /dev/null
+ for i in ${XEN_SECURITY_QEMUU}; do
+ eapply "${WORKDIR}"/patches-security/qemuu/$i
+ done
+ popd > /dev/null
+
+ # apply qemu-traditional patches
+ pushd "${S}"/tools/qemu-xen-traditional/ > /dev/null
+ for i in ${XEN_SECURITY_QEMUT}; do
+ eapply "${WORKDIR}"/patches-security/qemut/$i
+ done
+ popd > /dev/null
+ fi
+
+ # move before Gentoo patch, one patch should apply to seabios, to fix
gcc-4.5.x build err
+ mv ../seabios-${SEABIOS_VER} tools/firmware/seabios-dir-remote || die
+ pushd tools/firmware/ > /dev/null
+ ln -s seabios-dir-remote seabios-dir || die
+ popd > /dev/null
+
+ # Gentoo's patchset
+ if [[ -n ${GENTOO_VER} && -n ${GENTOO_GPV} ]]; then
+ einfo "Try to apply Gentoo specific patch set"
+ source "${FILESDIR}"/gentoo-patches.conf || die
+ _gpv=_gpv_${PN/-/_}_${PV//./}_${GENTOO_GPV}
+ for i in ${!_gpv}; do
+ eapply "${WORKDIR}"/patches-gentoo/$i
+ done
+ fi
+
+ # Ovmf's patchset
+ if use ovmf; then
+ if [[ -n ${OVMF_VER} ]];then
+ einfo "Try to apply Ovmf patch set"
+ pushd "${WORKDIR}"/ovmf-*/ > /dev/null
+ eapply "${WORKDIR}"/patches-ovmf
+ popd > /dev/null
+ fi
+ mv ../ovmf-${OVMF_PV} tools/firmware/ovmf-dir-remote || die
+ fi
+
+ mv tools/qemu-xen/qemu-bridge-helper.c
tools/qemu-xen/xen-bridge-helper.c || die
+
+ # Fix texi2html build error with new texi2html, qemu.doc.html
+ sed -i -e "/texi2html -monolithic/s/-number//"
tools/qemu-xen-traditional/Makefile || die
+
+ use api || sed -e "/SUBDIRS-\$(LIBXENAPI_BINDINGS) += libxen/d" -i
tools/Makefile || die
+ sed -e 's:$(MAKE) PYTHON=$(PYTHON) subdirs-$@:LC_ALL=C "$(MAKE)"
PYTHON=$(PYTHON) subdirs-$@:' \
+ -i tools/firmware/Makefile || die
+
+ # Drop .config, fixes to gcc-4.6
+ sed -e '/-include $(XEN_ROOT)\/.config/d' -i Config.mk || die "Couldn't
drop"
+
+ # if the user *really* wants to use their own custom-cflags, let them
+ if use custom-cflags; then
+ einfo "User wants their own CFLAGS - removing defaults"
+
+ # try and remove all the default cflags
+ find "${S}" \( -name Makefile -o -name Rules.mk -o -name
Config.mk \) \
+ -exec sed \
+ -e
's/CFLAGS\(.*\)=\(.*\)-O3\(.*\)/CFLAGS\1=\2\3/' \
+ -e
's/CFLAGS\(.*\)=\(.*\)-march=i686\(.*\)/CFLAGS\1=\2\3/' \
+ -e
's/CFLAGS\(.*\)=\(.*\)-fomit-frame-pointer\(.*\)/CFLAGS\1=\2\3/' \
+ -e
's/CFLAGS\(.*\)=\(.*\)-g3*\s\(.*\)/CFLAGS\1=\2 \3/' \
+ -e
's/CFLAGS\(.*\)=\(.*\)-O2\(.*\)/CFLAGS\1=\2\3/' \
+ -i {} + || die "failed to re-set custom-cflags"
+ else
+ unset CFLAGS
+ unset LDFLAGS
+ unset ASFLAGS
+ unset CPPFLAGS
+ fi
+
+ if ! use pygrub; then
+ sed -e '/^SUBDIRS-y += pygrub/d' -i tools/Makefile || die
+ fi
+
+ if ! use python; then
+ sed -e '/^SUBDIRS-y += python$/d' -i tools/Makefile || die
+ fi
+
+ if ! use hvm; then
+ sed -e '/SUBDIRS-$(CONFIG_X86) += firmware/d' -i tools/Makefile
|| die
+ # Bug 351648
+ elif ! use x86 && ! has x86 $(get_all_abis); then
+ mkdir -p "${WORKDIR}"/extra-headers/gnu || die
+ touch "${WORKDIR}"/extra-headers/gnu/stubs-32.h || die
+ export CPATH="${WORKDIR}"/extra-headers
+ fi
+
+ if use qemu; then
+ if use sdl; then
+ sed -i -e "s:\$\$source/configure:\0 --enable-sdl:" \
+ tools/Makefile || die
+ else
+ sed -i -e "s:\${QEMU_ROOT\:\-\.}/configure:\0
--disable-sdl:" \
+ tools/qemu-xen-traditional/xen-setup || die
+ sed -i -e "s:\$\$source/configure:\0 --disable-sdl:" \
+ tools/Makefile || die
+ fi
+ else
+ # Don't bother with qemu, only needed for fully virtualised
guests
+ sed -e "s:install-tools\:
tools/qemu-xen-traditional-dir:install-tools\: :g" -i Makefile || die
+ fi
+
+ # Reset bash completion dir; Bug 472438
+ sed -e "s:^BASH_COMPLETION_DIR ?=
\$(CONFIG_DIR)/bash_completion.d:BASH_COMPLETION_DIR ?= $(get_bashcompdir):" \
+ -i Config.mk || die
+ sed -i -e "/bash-completion/s/xl\.sh/xl/g" tools/libxl/Makefile || die
+
+ # xencommons, Bug #492332, sed lighter weight than patching
+ sed -e 's:\$QEMU_XEN -xen-domid:test -e "\$QEMU_XEN" \&\& &:' \
+ -i tools/hotplug/Linux/init.d/xencommons.in || die
+
+ # fix bashishm
+ sed -e '/Usage/s/\$//g' \
+ -i tools/hotplug/Linux/init.d/xendriverdomain.in || die
+
+ # respect multilib, usr/lib/libcacard.so.0.0.0
+ sed -e "/^libdir=/s/\/lib/\/$(get_libdir)/" \
+ -i tools/qemu-xen/configure || die
+
+ #bug 518136, don't build 32bit exactuable for nomultilib profile
+ if [[ "${ARCH}" == 'amd64' ]] && ! has_multilib_profile; then
+ sed -i -e "/x86_emulator/d" tools/tests/Makefile || die
+ fi
+
+ # uncomment lines in xl.conf
+ sed -e 's:^#autoballoon=:autoballoon=:' \
+ -e 's:^#lockfile=:lockfile=:' \
+ -e 's:^#vif.default.script=:vif.default.script=:' \
+ -i tools/examples/xl.conf || die
+
+ default
+}
+
+src_configure() {
+ local myconf="--prefix=${PREFIX}/usr \
+ --libdir=${PREFIX}/usr/$(get_libdir) \
+ --libexecdir=${PREFIX}/usr/libexec \
+ --localstatedir=${EPREFIX}/var \
+ --disable-werror \
+ --disable-xen \
+ --enable-tools \
+ --enable-docs \
+ $(use_enable pam) \
+ $(use_enable api xenapi) \
+ $(use_enable ovmf) \
+ $(use_enable ocaml ocamltools) \
+ --with-xenstored=$(usex ocaml 'oxenstored' 'xenstored') \
+ "
+
+ use system-seabios && myconf+="
--with-system-seabios=/usr/share/seabios/bios.bin"
+ use system-qemu && myconf+="
--with-system-qemu=/usr/bin/qemu-system-x86_64"
+ use amd64 && myconf+=" $(use_enable qemu-traditional)"
+ econf ${myconf}
+}
+
+src_compile() {
+ local myopt
+ use debug && myopt="${myopt} debug=y"
+
+ if test-flag-CC -fno-strict-overflow; then
+ append-flags -fno-strict-overflow
+ fi
+
+ emake CC="$(tc-getCC)" LD="$(tc-getLD)" AR="$(tc-getAR)"
RANLIB="$(tc-getRANLIB)" build-tools ${myopt}
+
+ if use doc; then
+ emake -C docs build
+ else
+ emake -C docs man-pages
+ fi
+}
+
+src_install() {
+ # Override auto-detection in the build system, bug #382573
+ export INITD_DIR=/tmp/init.d
+ export CONFIG_LEAF_DIR=../tmp/default
+
+ # Let the build system compile installed Python modules.
+ local PYTHONDONTWRITEBYTECODE
+ export PYTHONDONTWRITEBYTECODE
+
+ emake DESTDIR="${ED}" DOCDIR="/usr/share/doc/${PF}" \
+ XEN_PYTHON_NATIVE_INSTALL=y install-tools
+
+ # Created at runtime
+ rm -rv "${ED%/}/var/run" || die
+
+ # Fix the remaining Python shebangs.
+ python_fix_shebang "${D}"
+
+ # Remove RedHat-specific stuff
+ rm -rf "${D}"tmp || die
+
+ emake DESTDIR="${D}" DOCDIR="/usr/share/doc/${PF}" install-docs
+ use doc && dodoc -r docs/{pdf,txt}
+ dodoc ${DOCS[@]}
+
+ newconfd "${FILESDIR}"/xendomains.confd xendomains
+ newconfd "${FILESDIR}"/xenstored.confd xenstored
+ newconfd "${FILESDIR}"/xenconsoled.confd xenconsoled
+ newinitd "${FILESDIR}"/xendomains.initd-r2 xendomains
+ newinitd "${FILESDIR}"/xenstored.initd-r1 xenstored
+ newinitd "${FILESDIR}"/xenconsoled.initd xenconsoled
+ newinitd "${FILESDIR}"/xencommons.initd xencommons
+ newconfd "${FILESDIR}"/xencommons.confd xencommons
+ newinitd "${FILESDIR}"/xenqemudev.initd xenqemudev
+ newconfd "${FILESDIR}"/xenqemudev.confd xenqemudev
+ newinitd "${FILESDIR}"/xen-watchdog.initd xen-watchdog
+
+ if use screen; then
+ cat "${FILESDIR}"/xendomains-screen.confd >>
"${D}"/etc/conf.d/xendomains || die
+ cp "${FILESDIR}"/xen-consoles.logrotate "${D}"/etc/xen/ || die
+ keepdir /var/log/xen-consoles
+ fi
+
+ # For -static-libs wrt Bug 384355
+ if ! use static-libs; then
+ rm -f "${D}"usr/$(get_libdir)/*.a
"${D}"usr/$(get_libdir)/ocaml/*/*.a
+ fi
+
+ # for xendomains
+ keepdir /etc/xen/auto
+
+ # Remove files failing QA AFTER emake installs them, avoiding seeking
absent files
+ find "${D}" \( -name openbios-sparc32 -o -name openbios-sparc64 \
+ -o -name openbios-ppc -o -name palcode-clipper \) -delete || die
+}
+
+pkg_postinst() {
+ elog "Official Xen Guide and the offical wiki page:"
+ elog "https://wiki.gentoo.org/wiki/Xen";
+ elog "https://wiki.xen.org/wiki/Main_Page";
+ elog ""
+ elog "Recommended to utilise the xencommons script to config sytem At
boot"
+ elog "Add by use of rc-update on completion of the install"
+
+ if ! use hvm; then
+ echo
+ elog "HVM (VT-x and AMD-V) support has been disabled. If you
need hvm"
+ elog "support enable the hvm use flag."
+ elog "An x86 or amd64 system is required to build HVM support."
+ fi
+
+ if use qemu; then
+ elog "The qemu-bridge-helper is renamed to the
xen-bridge-helper in the in source"
+ elog "build of qemu. This allows for app-emulation/qemu to be
emerged concurrently"
+ elog "with the qemu capable xen. It is up to the user to
distinguish between and utilise"
+ elog "the qemu-bridge-helper and the xen-bridge-helper. File
bugs of any issues that arise"
+ fi
+}
diff --git a/app-emulation/xen/Manifest b/app-emulation/xen/Manifest
index ffbe53c1187..04bb8fc006c 100644
--- a/app-emulation/xen/Manifest
+++ b/app-emulation/xen/Manifest
@@ -4,4 +4,5 @@ DIST xen-4.8.2.tar.gz 22522336 BLAKE2B
2c9da971622b4e52fe78fa029107bb1c5f945a636
DIST xen-4.9.0-upstream-patches-0.tar.xz 58780 BLAKE2B
6d12a5a5bb7d2be7ca6bb8636648ee219c9526dd34086c929d8cd32d096d2454d6cb499d459b436f228fa49f42ef3a1f5fbe9b5c84557e4054565a9edc0daad6
SHA512
98c601d791661a306e3dce5befb37b80de8a71cdd1759f3da00b199d48e3b9468efd1332e26ae044ad616b41a02771ad07a1c96972103b7e0aa39b93fb556999
DIST xen-4.9.0.tar.gz 23361741 BLAKE2B
1cfebb791ca5e51eda9b86a5d98e0883fab1554f5ac805fc065916fbbd3695e6b0f11ca75935a8f973735cc8dd83e38fe4a670d8489010be865be49d8fc1a341
SHA512
97f8075c49ef9ec0adbe95106c0cff4f9379578fd568777697565476c3fd948335d72ddcacf8be65fd9db219c0a35dcdc007f355f7e5874dd950fd4c0a0f966f
DIST xen-4.9.1-upstream-patches-0.tar.xz 6856 BLAKE2B
52a7e3b456d330444166c36ce68b008150831b7bb5b64b4a3dbebfbbe8cd024311f3d7aadd1313b194bd5ce7a20cd2ca5a424754e59589b986490eda97bf5d06
SHA512
9af8861443a708c60df52c21512099a55a6018238350ece962a715b07ade9141cab2d46540b5d5e8e20347980f786f7d28ec130f7e8e03c46ff4808d3b36a913
+DIST xen-4.9.1-upstream-patches-1.tar.xz 24592 BLAKE2B
774c5219d6c14d729358e790d880a1a31fb4cda741e54e71879bff164e79bafbd8492eb8bccb7becdf7a2f9605e71266bb4fc15848deff8f9028ed7f8844f915
SHA512
edbc7cad2f6f8a5c7e8aac8efd5454428aa25e0e13018438f78c7f401cfb9173345267e16c7a5dfa78066a952980b172976409a0c63162094b7f507058e712ed
DIST xen-4.9.1.tar.gz 23368303 BLAKE2B
4cfddb351c9a4aa08227138dc1afa921f3d1880048f897428226da38eff9470cd81ae9896f174583048dad0ba8d5c1426df58b029115ba1623366d1980630c0d
SHA512
9d22f0aa5dcd01a1c105d17c14bce570cc597e884ddb9b4a46b80a72f647625b76ae5213cede423d0458c14e1906983595a9269bb6e6ff2e9e7e4dea840f4274
diff --git a/app-emulation/xen/xen-4.9.1-r1.ebuild
b/app-emulation/xen/xen-4.9.1-r1.ebuild
new file mode 100644
index 00000000000..6b7b46c13e6
--- /dev/null
+++ b/app-emulation/xen/xen-4.9.1-r1.ebuild
@@ -0,0 +1,171 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+PYTHON_COMPAT=( python2_7 )
+
+inherit eutils flag-o-matic mount-boot multilib python-any-r1 toolchain-funcs
+
+MY_PV=${PV/_/-}
+MY_P=${PN}-${MY_PV}
+
+if [[ $PV == *9999 ]]; then
+ inherit git-r3
+ KEYWORDS=""
+ EGIT_REPO_URI="git://xenbits.xen.org/xen.git"
+ SRC_URI=""
+else
+ KEYWORDS="~amd64 ~arm -x86"
+ UPSTREAM_VER=1
+ SECURITY_VER=
+ GENTOO_VER=
+
+ [[ -n ${UPSTREAM_VER} ]] && \
+
UPSTREAM_PATCHSET_URI="https://dev.gentoo.org/~dlan/distfiles/${P}-upstream-patches-${UPSTREAM_VER}.tar.xz";
+ [[ -n ${SECURITY_VER} ]] && \
+
SECURITY_PATCHSET_URI="https://dev.gentoo.org/~dlan/distfiles/${PN}-security-patches-${SECURITY_VER}.tar.xz";
+ [[ -n ${GENTOO_VER} ]] && \
+
GENTOO_PATCHSET_URI="https://dev.gentoo.org/~dlan/distfiles/${PN}-gentoo-patches-${GENTOO_VER}.tar.xz";
+
SRC_URI="https://downloads.xenproject.org/release/xen/${MY_PV}/${MY_P}.tar.gz
+ ${UPSTREAM_PATCHSET_URI}
+ ${SECURITY_PATCHSET_URI}
+ ${GENTOO_PATCHSET_URI}"
+fi
+
+DESCRIPTION="The Xen virtual machine monitor"
+HOMEPAGE="https://www.xenproject.org";
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="custom-cflags debug efi flask"
+
+DEPEND="${PYTHON_DEPS}
+ efi? ( >=sys-devel/binutils-2.22[multitarget] )
+ !efi? ( >=sys-devel/binutils-2.22 )"
+RDEPEND=""
+PDEPEND="~app-emulation/xen-tools-${PV}"
+
+# no tests are available for the hypervisor
+# prevent the silliness of /usr/lib/debug/usr/lib/debug files
+# prevent stripping of the debug info from the /usr/lib/debug/xen-syms
+RESTRICT="test splitdebug strip"
+
+# Approved by QA team in bug #144032
+QA_WX_LOAD="boot/xen-syms-${PV}"
+
+REQUIRED_USE="arm? ( debug )"
+
+S="${WORKDIR}/${MY_P}"
+
+pkg_setup() {
+ python-any-r1_pkg_setup
+ if [[ -z ${XEN_TARGET_ARCH} ]]; then
+ if use amd64; then
+ export XEN_TARGET_ARCH="x86_64"
+ elif use arm; then
+ export XEN_TARGET_ARCH="arm32"
+ elif use arm64; then
+ export XEN_TARGET_ARCH="arm64"
+ else
+ die "Unsupported architecture!"
+ fi
+ fi
+
+ if use flask ; then
+ export "XSM_ENABLE=y"
+ export "FLASK_ENABLE=y"
+ fi
+}
+
+src_prepare() {
+ # Upstream's patchset
+ [[ -n ${UPSTREAM_VER} ]] && eapply "${WORKDIR}"/patches-upstream
+
+ # Security patchset
+ if [[ -n ${SECURITY_VER} ]]; then
+ einfo "Try to apply Xen Security patch set"
+ # apply main xen patches
+ # Two parallel systems, both work side by side
+ # Over time they may concdense into one. This will suffice for
now
+ source "${WORKDIR}"/patches-security/${PV}.conf
+
+ local i
+ for i in ${XEN_SECURITY_MAIN}; do
+ eapply "${WORKDIR}"/patches-security/xen/$i
+ done
+ fi
+
+ # Gentoo's patchset
+ [[ -n ${GENTOO_VER} ]] && eapply "${WORKDIR}"/patches-gentoo
+
+ eapply "${FILESDIR}"/${PN}-4.6-efi.patch
+
+ # Drop .config
+ sed -e '/-include $(XEN_ROOT)\/.config/d' -i Config.mk || die "Couldn't
drop"
+
+ if use efi; then
+ export EFI_VENDOR="gentoo"
+ export EFI_MOUNTPOINT="boot"
+ fi
+
+ # if the user *really* wants to use their own custom-cflags, let them
+ if use custom-cflags; then
+ einfo "User wants their own CFLAGS - removing defaults"
+ # try and remove all the default custom-cflags
+ find "${S}" -name Makefile -o -name Rules.mk -o -name Config.mk
-exec sed \
+ -e 's/CFLAGS\(.*\)=\(.*\)-O3\(.*\)/CFLAGS\1=\2\3/' \
+ -e
's/CFLAGS\(.*\)=\(.*\)-march=i686\(.*\)/CFLAGS\1=\2\3/' \
+ -e
's/CFLAGS\(.*\)=\(.*\)-fomit-frame-pointer\(.*\)/CFLAGS\1=\2\3/' \
+ -e 's/CFLAGS\(.*\)=\(.*\)-g3*\s\(.*\)/CFLAGS\1=\2 \3/' \
+ -e 's/CFLAGS\(.*\)=\(.*\)-O2\(.*\)/CFLAGS\1=\2\3/' \
+ -i {} \; || die "failed to re-set custom-cflags"
+ fi
+
+ default
+}
+
+src_configure() {
+ use arm && myopt="${myopt} CONFIG_EARLY_PRINTK=sun7i"
+
+ use debug && myopt="${myopt} debug=y"
+
+ if use custom-cflags; then
+ filter-flags -fPIE -fstack-protector
+ replace-flags -O3 -O2
+ else
+ unset CFLAGS
+ unset LDFLAGS
+ unset ASFLAGS
+ fi
+}
+
+src_compile() {
+ # Send raw LDFLAGS so that --as-needed works
+ emake V=1 CC="$(tc-getCC)" LDFLAGS="$(raw-ldflags)" LD="$(tc-getLD)" -C
xen ${myopt}
+}
+
+src_install() {
+ local myopt
+ use debug && myopt="${myopt} debug=y"
+
+ # The 'make install' doesn't 'mkdir -p' the subdirs
+ if use efi; then
+ mkdir -p "${D}"${EFI_MOUNTPOINT}/efi/${EFI_VENDOR} || die
+ fi
+
+ emake LDFLAGS="$(raw-ldflags)" DESTDIR="${D}" -C xen ${myopt} install
+
+ # make install likes to throw in some extra EFI bits if it built
+ use efi || rm -rf "${D}/usr/$(get_libdir)/efi"
+}
+
+pkg_postinst() {
+ elog "Official Xen Guide:"
+ elog " https://wiki.gentoo.org/wiki/Xen";
+
+ use efi && einfo "The efi executable is installed in boot/efi/gentoo"
+
+ elog "You can optionally block the installation of /boot/xen-syms by an
entry"
+ elog "in folder /etc/portage/env using the portage's feature
INSTALL_MASK"
+ elog "e.g. echo ${msg} > /etc/portage/env/xen.conf"
+}
