[gentoo-commits] proj/hardened-dev:master commit in: sys-boot/tboot/, sys-boot/tboot/files/

["Jason Zaman" <perfinion@gentoo.org>]

commit:     3bf93797179b43e8d97a66356a9bddefe44d1ccf
Author:     Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Wed May  6 23:26:58 2015 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Wed May  6 23:27:46 2015 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-dev.git/commit/?id=3bf93797

tboot: add pcid disable patch

 .../tboot/files/tboot-1.8.2-disable-pcid.patch     | 26 ++++++++++++++++++++++
 sys-boot/tboot/tboot-1.8.2.ebuild                  |  9 ++++----
 2 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/sys-boot/tboot/files/tboot-1.8.2-disable-pcid.patch b/sys-boot/tboot/files/tboot-1.8.2-disable-pcid.patch
new file mode 100644
index 0000000..383338e
--- /dev/null
+++ b/sys-boot/tboot/files/tboot-1.8.2-disable-pcid.patch
@@ -0,0 +1,26 @@
+diff -ur tboot-1.8.2.orig/tboot/common/shutdown.S tboot-1.8.2/tboot/common/shutdown.S
+--- tboot-1.8.2.orig/tboot/common/shutdown.S	2014-07-28 12:24:22.000000000 +0400
++++ tboot-1.8.2/tboot/common/shutdown.S	2015-05-07 03:05:47.300985413 +0400
+@@ -34,6 +34,11 @@
+  */
+ 
+ compat_mode_entry:
++	/* Disable PCID */
++        movl %cr4, %eax
++        andl $~CR4_PCIDE, %eax
++        movl %eax, %cr4
++
+ 	/* Disable paging and therefore leave 64 bit mode. */
+         movl %cr0, %eax
+         andl $~CR0_PG, %eax
+diff -ur tboot-1.8.2.orig/tboot/include/processor.h tboot-1.8.2/tboot/include/processor.h
+--- tboot-1.8.2.orig/tboot/include/processor.h	2014-07-28 12:24:22.000000000 +0400
++++ tboot-1.8.2/tboot/include/processor.h	2015-05-07 03:04:58.721244858 +0400
+@@ -92,6 +92,7 @@
+ #define CR4_XMM 0x00000400 /* enable SIMD/MMX2 to use except 16 */
+ #define CR4_VMXE 0x00002000/* enable VMX */
+ #define CR4_SMXE 0x00004000/* enable SMX */
++#define CR4_PCIDE 0x00020000/* enable PCID */
+ 
+ #ifndef __ASSEMBLY__
+ 

diff --git a/sys-boot/tboot/tboot-1.8.2.ebuild b/sys-boot/tboot/tboot-1.8.2.ebuild
index 389c93c..bcfc004 100644
--- a/sys-boot/tboot/tboot-1.8.2.ebuild
+++ b/sys-boot/tboot/tboot-1.8.2.ebuild
@@ -26,10 +26,11 @@ sys-boot/grub:2"
 DOCS=(README COPYING CHANGELOG)
 
 src_prepare() {
-	epatch "${FILESDIR}/${P}-genkernel_arch.patch"
-	epatch "${FILESDIR}/${P}-stack-check-no.patch" # breaks with ssp
-	sed -i 's/ -Werror//g' Config.mk
-	sed -i 's/^INSTALL_STRIP = -s$//' Config.mk # QA Errors
+	epatch "${FILESDIR}/tboot-1.8.2-genkernel_arch.patch"
+	epatch "${FILESDIR}/tboot-1.8.2-stack-check-no.patch" # breaks with ssp
+	epatch "${FILESDIR}/tboot-1.8.2-disable-pcid.patch" # PaX enables pcid
+	sed -i 's/ -Werror//g' Config.mk || die
+	sed -i 's/^INSTALL_STRIP = -s$//' Config.mk || die # QA Errors
 
 	# the version number is wrong in the grub files
 	sed -i 's/tboot_version="1.8.1"/tboot_version="1.8.2"/' tboot/20_linux*tboot