drop 4.3.x, bump 4.4.2, prepare security patch setting

(Portage version: 2.2.17/cvs/Linux x86_64, signed Manifest commit with key 0xAABEFD55)

5 files changed, 160 insertions, 86 deletions

diff --git a/app-emulation/xen-tools/ChangeLog b/app-emulation/xen-tools/ChangeLog
index f677e1b402de..340b2e6d51a5 100644
--- a/app-emulation/xen-tools/ChangeLog
+++ b/app-emulation/xen-tools/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for app-emulation/xen-tools
 # Copyright 1999-2015 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-emulation/xen-tools/ChangeLog,v 1.276 2015/03/26 22:10:58 dlan Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-emulation/xen-tools/ChangeLog,v 1.277 2015/03/28 13:27:54 dlan Exp $
+
+*xen-tools-4.4.2 (28 Mar 2015)
+
+  28 Mar 2015; Yixun Lan <dlan@gentoo.org> xen-tools-4.2.5-r3.ebuild,
+  -xen-tools-4.3.3-r5.ebuild, +xen-tools-4.4.2.ebuild,
+  xen-tools-4.5.0-r2.ebuild, files/gentoo-patches.conf:
+  drop 4.3.x, bump 4.4.2, prepare security patch setting
 
   26 Mar 2015; Yixun Lan <dlan@gentoo.org> -xen-tools-4.2.5-r2.ebuild,
   -xen-tools-4.4.1-r6.ebuild:
diff --git a/app-emulation/xen-tools/files/gentoo-patches.conf b/app-emulation/xen-tools/files/gentoo-patches.conf
index 4da8e45fe7e1..7b5d99950d12 100644
--- a/app-emulation/xen-tools/files/gentoo-patches.conf
+++ b/app-emulation/xen-tools/files/gentoo-patches.conf
@@ -83,30 +83,17 @@ ${_gx011} ${_gx012} ${_gx013} ${_gx014} ${_gx015}
 ${_gx016} ${_gx017} ${_gx018} ${_gx019}
 "
 
-# xen-tools-4.3.3 patches set
-_gpv_xen_tools_433_0="
-${_gx020} ${_gx002} ${_gx003}
-${_gx007} ${_gx008} ${_gx009} ${_gx010}
-${_gx021} ${_gx012} ${_gx014} ${_gx022}
-${_gx017} ${_gx023} ${_gx019}
-"
-
 # xen-tools-4.4.1 patches set
-_gpv_xen_tools_441_0="
+_gpv_xen_tools_441_2="
 ${_gx007} ${_gx008} ${_gx009}
 ${_gx024} ${_gx021} ${_gx014}
 ${_gx022} ${_gx017} ${_gx025}
 ${_gx026} ${_gx027} ${_gx019}
+${_gx028} ${_gx029}
 "
 
-_gpv_xen_tools_441_1="
-${_gx007} ${_gx008} ${_gx009}
-${_gx024} ${_gx021} ${_gx014}
-${_gx022} ${_gx017} ${_gx025}
-${_gx026} ${_gx027} ${_gx019}
-${_gx028}
-"
-_gpv_xen_tools_441_2="
+# xen-tools-4.4.2 patches set
+_gpv_xen_tools_442_0="
 ${_gx007} ${_gx008} ${_gx009}
 ${_gx024} ${_gx021} ${_gx014}
 ${_gx022} ${_gx017} ${_gx025}
diff --git a/app-emulation/xen-tools/xen-tools-4.2.5-r3.ebuild b/app-emulation/xen-tools/xen-tools-4.2.5-r3.ebuild
index f1f1d5317cfe..1fe1fc59bc50 100644
--- a/app-emulation/xen-tools/xen-tools-4.2.5-r3.ebuild
+++ b/app-emulation/xen-tools/xen-tools-4.2.5-r3.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2015 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/app-emulation/xen-tools/xen-tools-4.2.5-r3.ebuild,v 1.3 2015/03/16 13:22:08 ago Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-emulation/xen-tools/xen-tools-4.2.5-r3.ebuild,v 1.4 2015/03/28 13:27:54 dlan Exp $
 
 EAPI=5
 
@@ -16,6 +16,7 @@ if [[ $PV == *9999 ]]; then
 else
 	KEYWORDS="amd64 x86"
 	UPSTREAM_VER=6
+	SECURITY_VER=
 	# xen-tools's gentoo patches tarball
 	GENTOO_VER=0
 	# xen-tools's gentoo patches version which apply to this specific ebuild
@@ -24,6 +25,8 @@ else
 
 	[[ -n ${UPSTREAM_VER} ]] && \
 		UPSTREAM_PATCHSET_URI="http://dev.gentoo.org/~dlan/distfiles/${P/-tools/}-upstream-patches-${UPSTREAM_VER}.tar.xz"
+	[[ -n ${SECURITY_VER} ]] && \
+		SECURITY_PATCHSET_URI="http://dev.gentoo.org/~dlan/distfiles/${PN/-tools}-security-patches-${SECURITY_VER}.tar.xz"
 	[[ -n ${GENTOO_VER} ]] && \
 		GENTOO_PATCHSET_URI="http://dev.gentoo.org/~dlan/distfiles/${PN/-tools/}-gentoo-patches-${GENTOO_VER}.tar.xz"
 
@@ -31,6 +34,7 @@ else
 	http://code.coreboot.org/p/seabios/downloads/get/seabios-${SEABIOS_VER}.tar.gz
 	http://dev.gentoo.org/~dlan/distfiles/seabios-${SEABIOS_VER}.tar.gz
 	${UPSTREAM_PATCHSET_URI}
+	${SECURITY_PATCHSET_URI}
 	${GENTOO_PATCHSET_URI}"
 	S="${WORKDIR}/xen-${PV}"
 fi
@@ -135,14 +139,25 @@ pkg_setup() {
 src_prepare() {
 	# Upstream's patchset
 	if [[ -n ${UPSTREAM_VER} ]]; then
+		einfo "Try to apply Xen Upstream patcheset"
 		EPATCH_SUFFIX="patch" \
 		EPATCH_FORCE="yes" \
 		EPATCH_OPTS="-p1" \
 			epatch "${WORKDIR}"/patches-upstream
 	fi
 
+	# Security patchset
+	if [[ -n ${SECURITY_VER} ]]; then
+		einfo "Try to apply Xen Security patcheset"
+		EPATCH_SUFFIX="patch" \
+		EPATCH_FORCE="yes" \
+		EPATCH_OPTS="-p1" \
+			epatch "${WORKDIR}/patches-security/${PV}"
+	fi
+
 	# Gentoo's patchset
 	if [[ -n ${GENTOO_VER} && -n ${GENTOO_GPV} ]]; then
+		einfo "Try to apply Gentoo specific patcheset"
 		source "${FILESDIR}"/gentoo-patches.conf
 		_gpv=_gpv_${PN/-/_}_${PV//./}_${GENTOO_GPV}
 		for i in ${!_gpv}; do
diff --git a/app-emulation/xen-tools/xen-tools-4.3.3-r5.ebuild b/app-emulation/xen-tools/xen-tools-4.4.2.ebuild
index b154f73a169d..8214b1715a88 100644
--- a/app-emulation/xen-tools/xen-tools-4.3.3-r5.ebuild
+++ b/app-emulation/xen-tools/xen-tools-4.4.2.ebuild
@@ -1,10 +1,12 @@
 # Copyright 1999-2015 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/app-emulation/xen-tools/xen-tools-4.3.3-r5.ebuild,v 1.1 2015/03/14 13:15:05 dlan Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-emulation/xen-tools/xen-tools-4.4.2.ebuild,v 1.1 2015/03/28 13:27:54 dlan Exp $
 
 EAPI=5
 
-PYTHON_COMPAT=( python{2_6,2_7} )
+MY_PV=${PV/_/-}
+
+PYTHON_COMPAT=( python2_7 )
 PYTHON_REQ_USE='xml,threads'
 
 if [[ $PV == *9999 ]]; then
@@ -14,25 +16,37 @@ if [[ $PV == *9999 ]]; then
 	S="${WORKDIR}/${REPO}"
 	live_eclass="mercurial"
 else
-	KEYWORDS="~amd64 -x86"
-	UPSTREAM_VER=7
+	KEYWORDS="~amd64 ~arm -x86"
+	UPSTREAM_VER=
+	SECURITY_VER=
 	# xen-tools's gentoo patches tarball
-	GENTOO_VER=0
+	GENTOO_VER=3
 	# xen-tools's gentoo patches version which apply to this specific ebuild
 	GENTOO_GPV=0
-	SEABIOS_VER=1.7.1-stable-xen
+	# xen-tools ovmf's patches
+	OVMF_VER=0
+
+	SEABIOS_VER=1.7.3.1
+	OVMF_PV=20131208
 
 	[[ -n ${UPSTREAM_VER} ]] && \
 		UPSTREAM_PATCHSET_URI="http://dev.gentoo.org/~dlan/distfiles/${P/-tools/}-upstream-patches-${UPSTREAM_VER}.tar.xz"
+	[[ -n ${SECURITY_VER} ]] && \
+		SECURITY_PATCHSET_URI="http://dev.gentoo.org/~dlan/distfiles/${PN/-tools}-security-patches-${SECURITY_VER}.tar.xz"
 	[[ -n ${GENTOO_VER} ]] && \
-		GENTOO_PATCHSET_URI="http://dev.gentoo.org/~dlan/distfiles/${PN/-tools/}-gentoo-patches-${GENTOO_VER}.tar.xz"
+		GENTOO_PATCHSET_URI="http://dev.gentoo.org/~dlan/distfiles/${PN/-tools}-gentoo-patches-${GENTOO_VER}.tar.xz"
+	[[ -n ${OVMF_VER} ]] && \
+		OVMF_PATCHSET_URI="http://dev.gentoo.org/~dlan/distfiles/${PN/-tools}-ovmf-patches-${OVMF_VER}.tar.xz"
 
-	SRC_URI="http://bits.xensource.com/oss-xen/release/${PV}/xen-${PV}.tar.gz
+	SRC_URI="http://bits.xensource.com/oss-xen/release/${MY_PV}/xen-${MY_PV}.tar.gz
 	http://code.coreboot.org/p/seabios/downloads/get/seabios-${SEABIOS_VER}.tar.gz
 	http://dev.gentoo.org/~dlan/distfiles/seabios-${SEABIOS_VER}.tar.gz
+	http://dev.gentoo.org/~dlan/distfiles/ovmf-${OVMF_PV}.tar.bz2
 	${UPSTREAM_PATCHSET_URI}
-	${GENTOO_PATCHSET_URI}"
-	S="${WORKDIR}/xen-${PV}"
+	${SECURITY_PATCHSET_URI}
+	${GENTOO_PATCHSET_URI}
+	${OVMF_PATCHSET_URI}"
+	S="${WORKDIR}/xen-${MY_PV}"
 fi
 
 inherit bash-completion-r1 eutils flag-o-matic multilib python-single-r1 toolchain-funcs udev ${live_eclass}
@@ -43,32 +57,40 @@ DOCS=( README docs/README.xen-bugtool )
 
 LICENSE="GPL-2"
 SLOT="0"
-# Inclusion of IUSE ocaml on stabalizing requires maintainer of ocaml to (get off his hands and) make 
+# Inclusion of IUSE ocaml on stabalizing requires maintainer of ocaml to (get off his hands and) make
 # >=dev-lang/ocaml-4 stable
 # Masked in profiles/eapi-5-files instead
-IUSE="api custom-cflags debug doc flask hvm qemu ocaml +pam python pygrub screen static-libs system-seabios"
+IUSE="api custom-cflags debug doc flask hvm qemu ocaml ovmf +pam python pygrub screen static-libs system-qemu system-seabios"
 
-REQUIRED_USE="hvm? ( qemu )
+REQUIRED_USE="hvm? ( || ( qemu system-qemu ) )
 	${PYTHON_REQUIRED_USE}
-	pygrub? ( python )"
+	pygrub? ( python )
+	ovmf? ( hvm )
+	qemu? ( !system-qemu )"
 
-DEPEND="dev-libs/lzo:2
+COMMON_DEPEND="
+	dev-libs/lzo:2
 	dev-libs/glib:2
 	dev-libs/yajl
+	dev-libs/libaio
 	dev-libs/libgcrypt:0
+	sys-libs/zlib
+"
+
+DEPEND="${COMMON_DEPEND}
 	dev-python/lxml[${PYTHON_USEDEP}]
 	pam? ( dev-python/pypam[${PYTHON_USEDEP}] )
-	sys-libs/zlib
-	sys-power/iasl
-	system-seabios? ( sys-firmware/seabios )
-	sys-firmware/ipxe
 	hvm? ( media-libs/libsdl )
 	${PYTHON_DEPS}
 	api? ( dev-libs/libxml2
 		net-misc/curl )
 	pygrub? ( ${PYTHON_DEPS//${PYTHON_REQ_USE}/ncurses} )
-	sys-devel/bin86
-	sys-devel/dev86
+	arm? ( >=sys-apps/dtc-1.4.0 )
+	!arm? ( sys-devel/bin86
+		system-seabios? ( sys-firmware/seabios )
+		sys-firmware/ipxe
+		sys-devel/dev86
+		sys-power/iasl )
 	dev-lang/perl
 	app-misc/pax-utils
 	dev-python/markdown[${PYTHON_USEDEP}]
@@ -88,9 +110,12 @@ DEPEND="dev-libs/lzo:2
 	hvm? ( x11-proto/xproto
 		!net-libs/libiscsi )
 	qemu? ( x11-libs/pixman )
+	system-qemu? ( app-emulation/qemu[xen] )
 	ocaml? ( dev-ml/findlib
 		>=dev-lang/ocaml-4 )"
-RDEPEND="sys-apps/iproute2
+
+RDEPEND="${COMMON_DEPEND}
+	sys-apps/iproute2
 	net-misc/bridge-utils
 	screen? (
 		app-misc/screen
@@ -100,7 +125,8 @@ RDEPEND="sys-apps/iproute2
 
 # hvmloader is used to bootstrap a fully virtualized kernel
 # Approved by QA team in bug #144032
-QA_WX_LOAD="usr/lib/xen/boot/hvmloader"
+QA_WX_LOAD="usr/lib/xen/boot/hvmloader
+	usr/share/qemu-xen/qemu/s390-ccw.img"
 
 RESTRICT="test"
 
@@ -115,12 +141,6 @@ pkg_setup() {
 		export "CONFIG_GCRYPT=y"
 	fi
 
-	if use qemu; then
-		export "CONFIG_IOEMU=y"
-	else
-		export "CONFIG_IOEMU=n"
-	fi
-
 	if [[ -z ${XEN_TARGET_ARCH} ]] ; then
 		if use x86 && use amd64; then
 			die "Confusion! Both x86 and amd64 are set in your use flags!"
@@ -128,6 +148,8 @@ pkg_setup() {
 			export XEN_TARGET_ARCH="x86_32"
 		elif use amd64 ; then
 			export XEN_TARGET_ARCH="x86_64"
+		elif use arm; then
+			export XEN_TARGET_ARCH="arm32"
 		else
 			die "Unsupported architecture!"
 		fi
@@ -137,14 +159,25 @@ pkg_setup() {
 src_prepare() {
 	# Upstream's patchset
 	if [[ -n ${UPSTREAM_VER} ]]; then
+		einfo "Try to apply Xen Upstream patcheset"
 		EPATCH_SUFFIX="patch" \
 		EPATCH_FORCE="yes" \
 		EPATCH_OPTS="-p1" \
 			epatch "${WORKDIR}"/patches-upstream
 	fi
 
+	# Security patchset
+	if [[ -n ${SECURITY_VER} ]]; then
+		einfo "Try to apply Xen Security patcheset"
+		EPATCH_SUFFIX="patch" \
+		EPATCH_FORCE="yes" \
+		EPATCH_OPTS="-p1" \
+			epatch "${WORKDIR}/patches-security/${PV}"
+	fi
+
 	# Gentoo's patchset
 	if [[ -n ${GENTOO_VER} && -n ${GENTOO_GPV} ]]; then
+		einfo "Try to apply Gentoo specific patcheset"
 		source "${FILESDIR}"/gentoo-patches.conf
 		_gpv=_gpv_${PN/-/_}_${PV//./}_${GENTOO_GPV}
 		for i in ${!_gpv}; do
@@ -154,17 +187,35 @@ src_prepare() {
 		done
 	fi
 
-	# Bug 496708
-	use system-seabios && epatch "${WORKDIR}"/patches-gentoo/${PN}-4-unbundle-seabios.patch
+	# Ovmf's patchset
+	if [[ -n ${OVMF_VER} ]]; then
+		einfo "Try to apply Ovmf patcheset"
+		pushd "${WORKDIR}"/ovmf-*/ > /dev/null
+		EPATCH_SUFFIX="patch" \
+		EPATCH_FORCE="yes" \
+		EPATCH_OPTS="-p1" \
+			epatch "${WORKDIR}"/patches-ovmf
+		popd > /dev/null
+	fi
 
-	# Bug 478064
 	mv tools/qemu-xen/qemu-bridge-helper.c tools/qemu-xen/xen-bridge-helper.c || die
 
 	mv ../seabios-${SEABIOS_VER} tools/firmware/seabios-dir-remote || die
+	mv ../ovmf-${OVMF_PV} tools/firmware/ovmf-dir-remote || die
 	pushd tools/firmware/ > /dev/null
 	ln -s seabios-dir-remote seabios-dir || die
 	popd > /dev/null
 
+	# Fix texi2html build error with new texi2html, qemu.doc.html
+	sed -i -e "/texi2html -monolithic/s/-number//" tools/qemu-xen-traditional/Makefile || die
+
+	use api   || sed -e "/SUBDIRS-\$(LIBXENAPI_BINDINGS) += libxen/d" -i tools/Makefile || die
+	sed -e 's:$(MAKE) PYTHON=$(PYTHON) subdirs-$@:LC_ALL=C "$(MAKE)" PYTHON=$(PYTHON) subdirs-$@:' \
+		 -i tools/firmware/Makefile || die
+
+	# Drop .config, fixes to gcc-4.6
+	sed -e '/-include $(XEN_ROOT)\/.config/d' -i Config.mk || die "Couldn't	drop"
+
 	# if the user *really* wants to use their own custom-cflags, let them
 	if use custom-cflags; then
 		einfo "User wants their own CFLAGS - removing defaults"
@@ -188,9 +239,7 @@ src_prepare() {
 		sed -e '/^SUBDIRS-y += python$/d' -i tools/Makefile || die
 	fi
 
-	# Disable hvm support on systems that don't support x86_32 binaries.
 	if ! use hvm; then
-		sed -e '/^CONFIG_IOEMU := y$/d' -i config/*.mk || die
 		sed -e '/SUBDIRS-$(CONFIG_X86) += firmware/d' -i tools/Makefile || die
 	# Bug 351648
 	elif ! use x86 && ! has x86 $(get_all_abis); then
@@ -201,8 +250,7 @@ src_prepare() {
 
 	# Don't bother with qemu, only needed for fully virtualised guests
 	if ! use qemu; then
-		sed -e "/^CONFIG_IOEMU := y$/d" -i config/*.mk || die
-		sed -e "s:install-tools\: tools/ioemu-dir:install-tools\: :g" -i Makefile || die
+		sed -e "s:install-tools\: tools/qemu-xen-traditional-dir:install-tools\: :g" -i Makefile || die
 	fi
 
 	# Reset bash completion dir; Bug 472438
@@ -210,18 +258,23 @@ src_prepare() {
 		-i Config.mk || die
 	sed -i -e "/bash-completion/s/xl\.sh/xl/g" tools/libxl/Makefile || die
 
-	use flask || sed -e "/SUBDIRS-y += flask/d" -i tools/Makefile || die
-	use api   || sed -e "/SUBDIRS-\$(LIBXENAPI_BINDINGS) += libxen/d" -i tools/Makefile || die
-	sed -e 's:$(MAKE) PYTHON=$(PYTHON) subdirs-$@:LC_ALL=C "$(MAKE)" PYTHON=$(PYTHON) subdirs-$@:' \
-		 -i tools/firmware/Makefile || die
-
 	# xencommons, Bug #492332, sed lighter weight than patching
 	sed -e 's:\$QEMU_XEN -xen-domid:test -e "\$QEMU_XEN" \&\& &:' \
 		-i tools/hotplug/Linux/init.d/xencommons || die
 
-	# Bug 493232 fix from http://bugzilla.xensource.com/bugzilla/show_bug.cgi?id=1844
-	sed -e 's:bl->argsspace = 7 + :bl->argsspace = 9 + :' \
-		-i tools/libxl/libxl_bootloader.c || die
+	# respect multilib, usr/lib/libcacard.so.0.0.0
+	sed -e "/^libdir=/s/\/lib/\/$(get_libdir)/" \
+		-i tools/qemu-xen/configure || die
+
+	#bug 518136, don't build 32bit exactuable for nomultilib profile
+	if [[ "${ARCH}" == 'amd64' ]] && ! has_multilib_profile; then
+		sed -i -e "/x86_emulator/d" tools/tests/Makefile || die
+	fi
+
+	# Bug 477884, 518136
+	if [[ "${ARCH}" == 'amd64' ]]; then
+		sed -i -e "/LIBEXEC =/s|/lib/xen/bin|/$(get_libdir)/xen/bin|" config/StdGNU.mk || die
+	fi
 
 	# fix QA warning, create /var/run/, /var/lock dynamically
 	sed -i -e "/\$(INSTALL_DIR) \$(DESTDIR)\$(XEN_RUN_DIR)/d" \
@@ -238,20 +291,22 @@ src_prepare() {
 }
 
 src_configure() {
-	local myconf="--prefix=/usr --disable-werror"
-
-	if use ocaml
-	then
-		myconf="${myconf} $(use_enable ocaml ocamltools)"
-	else
-		myconf="${myconf} --disable-ocamltools"
-	fi
-
-	if ! use pam
-	then
-		myconf="${myconf} --disable-pam"
-	fi
-
+	local myconf="--prefix=/usr \
+		--libdir=/usr/$(get_libdir) \
+		--disable-werror \
+		--disable-xen \
+		--enable-tools \
+		--enable-docs \
+		$(use_with system-qemu) \
+		$(use_enable pam) \
+		$(use_enable api xenapi) \
+		$(use_enable ovmf) \
+		$(use_enable ocaml ocamltools) \
+		"
+	# disable qemu-traditional for arm, fail to build
+	use arm || myconf+=" --enable-qemu-traditional"
+	use system-seabios && myconf+=" --with-system-seabios=/usr/share/seabios/bios.bin"
+	use qemu || myconf+=" --with-system-qemu"
 	econf ${myconf}
 }
 
@@ -326,12 +381,6 @@ src_install() {
 		keepdir /var/log/xen-consoles
 	fi
 
-	# Move files built with use qemu, Bug #477884
-	if [[ "${ARCH}" == 'amd64' ]] && use qemu; then
-		mkdir -p "${D}"usr/$(get_libdir)/xen/bin || die
-		mv "${D}"usr/lib/xen/bin/* "${D}"usr/$(get_libdir)/xen/bin/ || die
-	fi
-
 	# For -static-libs wrt Bug 384355
 	if ! use static-libs; then
 		rm -f "${D}"usr/$(get_libdir)/*.a "${D}"usr/$(get_libdir)/ocaml/*/*.a
diff --git a/app-emulation/xen-tools/xen-tools-4.5.0-r2.ebuild b/app-emulation/xen-tools/xen-tools-4.5.0-r2.ebuild
index 49dd91a443f4..e7ca60433ae7 100644
--- a/app-emulation/xen-tools/xen-tools-4.5.0-r2.ebuild
+++ b/app-emulation/xen-tools/xen-tools-4.5.0-r2.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2015 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/app-emulation/xen-tools/xen-tools-4.5.0-r2.ebuild,v 1.1 2015/03/14 13:15:05 dlan Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-emulation/xen-tools/xen-tools-4.5.0-r2.ebuild,v 1.2 2015/03/28 13:27:54 dlan Exp $
 
 EAPI=5
 
@@ -18,6 +18,7 @@ if [[ $PV == *9999 ]]; then
 else
 	KEYWORDS="~arm ~arm64 ~amd64 -x86"
 	UPSTREAM_VER=3
+	SECURITY_VER=
 	# xen-tools's gentoo patches tarball
 	GENTOO_VER=3
 	# xen-tools's gentoo patches version which apply to this specific ebuild
@@ -29,7 +30,9 @@ else
 	OVMF_PV=20131208
 
 	[[ -n ${UPSTREAM_VER} ]] && \
-		UPSTRAM_PATCHSET_URI="http://dev.gentoo.org/~dlan/distfiles/${P/-tools/}-upstream-patches-${UPSTREAM_VER}.tar.xz"
+		UPSTREAM_PATCHSET_URI="http://dev.gentoo.org/~dlan/distfiles/${P/-tools/}-upstream-patches-${UPSTREAM_VER}.tar.xz"
+	[[ -n ${SECURITY_VER} ]] && \
+		SECURITY_PATCHSET_URI="http://dev.gentoo.org/~dlan/distfiles/${PN/-tools}-security-patches-${SECURITY_VER}.tar.xz"
 	[[ -n ${GENTOO_VER} ]] && \
 		GENTOO_PATCHSET_URI="http://dev.gentoo.org/~dlan/distfiles/${PN/-tools}-gentoo-patches-${GENTOO_VER}.tar.xz"
 	[[ -n ${OVMF_VER} ]] && \
@@ -39,7 +42,8 @@ else
 	http://code.coreboot.org/p/seabios/downloads/get/seabios-${SEABIOS_VER}.tar.gz
 	http://dev.gentoo.org/~dlan/distfiles/seabios-${SEABIOS_VER}.tar.gz
 	http://dev.gentoo.org/~dlan/distfiles/ovmf-${OVMF_PV}.tar.bz2
-	${UPSTRAM_PATCHSET_URI}
+	${UPSTREAM_PATCHSET_URI}
+	${SECURITY_PATCHSET_URI}
 	${GENTOO_PATCHSET_URI}
 	${OVMF_PATCHSET_URI}"
 	S="${WORKDIR}/xen-${MY_PV}"
@@ -157,14 +161,25 @@ pkg_setup() {
 src_prepare() {
 	# Upstream's patchset
 	if [[ -n ${UPSTREAM_VER} ]]; then
+		einfo "Try to apply Xen Upstream patcheset"
 		EPATCH_SUFFIX="patch" \
 		EPATCH_FORCE="yes" \
 		EPATCH_OPTS="-p1" \
 			epatch "${WORKDIR}"/patches-upstream
 	fi
 
+	# Security patchset
+	if [[ -n ${SECURITY_VER} ]]; then
+		einfo "Try to apply Xen Security patcheset"
+		EPATCH_SUFFIX="patch" \
+		EPATCH_FORCE="yes" \
+		EPATCH_OPTS="-p1" \
+			epatch "${WORKDIR}/patches-security/${PV}"
+	fi
+
 	# Gentoo's patchset
 	if [[ -n ${GENTOO_VER} && -n ${GENTOO_GPV} ]]; then
+		einfo "Try to apply Gentoo specific patcheset"
 		source "${FILESDIR}"/gentoo-patches.conf
 		_gpv=_gpv_${PN/-/_}_${PV//./}_${GENTOO_GPV}
 		for i in ${!_gpv}; do
@@ -176,6 +191,7 @@ src_prepare() {
 
 	# Ovmf's patchset
 	if [[ -n ${OVMF_VER} ]]; then
+		einfo "Try to apply Ovmf patcheset"
 		pushd "${WORKDIR}"/ovmf-*/ > /dev/null
 		EPATCH_SUFFIX="patch" \
 		EPATCH_FORCE="yes" \