upg gnutls libdns

This commit is contained in:
joborun linux 2022-08-16 09:20:43 +03:00
parent b0375abf8c
commit 67fa1428db
5 changed files with 152 additions and 28 deletions

View file

@ -0,0 +1,93 @@
From b87d46ea52b87daeca2d6e75d79a3e33456b5787 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <ueno@gnu.org>
Date: Mon, 15 Aug 2022 09:39:18 +0900
Subject: [PATCH] accelerated: clear AVX bits if it cannot be queried through
XSAVE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The algorithm to detect AVX is described in 14.3 of "Intel® 64 and IA-32
Architectures Software Developer’s Manual".
GnuTLS previously only followed that algorithm when registering the
crypto backend, while the CRYPTOGAMS derived SHA code assembly expects
that the extension bits are propagated to _gnutls_x86_cpuid_s.
Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
lib/accelerated/x86/x86-common.c | 37 +++++++++++++++++++++++++++-----
1 file changed, 32 insertions(+), 5 deletions(-)
diff --git a/lib/accelerated/x86/x86-common.c b/lib/accelerated/x86/x86-common.c
index 7ddaa594e6..b002dba721 100644
--- a/lib/accelerated/x86/x86-common.c
+++ b/lib/accelerated/x86/x86-common.c
@@ -81,6 +81,26 @@ unsigned int _gnutls_x86_cpuid_s[4];
# define bit_AVX 0x10000000
#endif
+#ifndef bit_AVX2
+# define bit_AVX2 0x00000020
+#endif
+
+#ifndef bit_AVX512F
+# define bit_AVX512F 0x00010000
+#endif
+
+#ifndef bit_AVX512IFMA
+# define bit_AVX512IFMA 0x00200000
+#endif
+
+#ifndef bit_AVX512BW
+# define bit_AVX512BW 0x40000000
+#endif
+
+#ifndef bit_AVX512VL
+# define bit_AVX512VL 0x80000000
+#endif
+
#ifndef bit_OSXSAVE
# define bit_OSXSAVE 0x8000000
#endif
@@ -148,7 +168,7 @@ static unsigned check_4th_gen_intel_features(unsigned ecx)
{
uint32_t xcr0;
- if ((ecx & OSXSAVE_MASK) != OSXSAVE_MASK)
+ if ((ecx & bit_OSXSAVE) != bit_OSXSAVE)
return 0;
#if defined(_MSC_VER) && !defined(__clang__)
@@ -236,10 +256,7 @@ static unsigned check_sha(void)
#ifdef ASM_X86_64
static unsigned check_avx_movbe(void)
{
- if (check_4th_gen_intel_features(_gnutls_x86_cpuid_s[1]) == 0)
- return 0;
-
- return ((_gnutls_x86_cpuid_s[1] & bit_AVX));
+ return (_gnutls_x86_cpuid_s[1] & bit_AVX);
}
static unsigned check_pclmul(void)
@@ -895,6 +912,16 @@ void register_x86_intel_crypto(unsigned capabilities)
_gnutls_x86_cpuid_s[0] &= ~(1 << 30);
}
+ if (!check_4th_gen_intel_features(_gnutls_x86_cpuid_s[1])) {
+ _gnutls_x86_cpuid_s[1] &= ~bit_AVX;
+
+ /* Clear AVX2 bits as well, according to what OpenSSL does.
+ * Should we clear bit_AVX512DQ, bit_AVX512PF, bit_AVX512ER, and
+ * bit_AVX512CD? */
+ _gnutls_x86_cpuid_s[2] &= ~(bit_AVX2|bit_AVX512F|bit_AVX512IFMA|
+ bit_AVX512BW|bit_AVX512BW);
+ }
+
if (check_ssse3()) {
_gnutls_debug_log("Intel SSSE3 was detected\n");
--
GitLab

View file

@ -7,7 +7,7 @@
pkgname=gnutls
pkgver=3.7.7
pkgrel=01
pkgrel=02
pkgdesc="A library which provides a secure layer over a reliable transport layer w/o zstd"
arch=('x86_64')
url="https://www.gnutls.org/"
@ -19,13 +19,14 @@ makedepends=('tpm2-tss')
checkdepends=('net-tools' 'tpm2-tools')
optdepends=('guile: for use with Guile bindings'
'tpm2-tss: support for TPM2 wrapped keys')
source=(https://www.gnupg.org/ftp/gcrypt/gnutls/v3.7/${pkgname}-${pkgver}.tar.xz{,.sig})
source=(https://www.gnupg.org/ftp/gcrypt/gnutls/v3.7/${pkgname}-${pkgver}.tar.xz{,.sig}
0001-fix-avx-detection.patch)
#prepare() {
# cd ${pkgname}-${pkgver}
# # FS#74770 / https://gitlab.com/gnutls/gnutls/-/issues/1367
# patch -Np1 -i ../0001_Fix_out-of-bounds_memcpy_in_gnutls_realloc_zero.diff
#}
prepare() {
cd ${pkgname}-${pkgver}
# FS#75613 / https://gitlab.com/gnutls/gnutls/-/merge_requests/1631
patch -Np1 -i ../0001-fix-avx-detection.patch
}
build() {
cd ${pkgname}-${pkgver}
@ -47,12 +48,16 @@ build() {
make
}
check() {
cd ${pkgname}-${pkgver}
# disable parallel tests:
# FAIL: serv-udp.sh
make -j1 check
}
# 3.7.7-02 some tests fail and the third one just gets stuck, no processing, no exit, and this is
# due to the patch, it wasn't happening before. So we issue this temporarily till a better edition
# appears to solve this problem.
#
#check() {
# cd ${pkgname}-${pkgver}
# # disable parallel tests:
# # FAIL: serv-udp.sh
# make -j1 check
#}
package() {
cd ${pkgname}-${pkgver}
@ -72,5 +77,7 @@ license=('GPL3' 'LGPL2.1')
validpgpkeys=('5D46CB0F763405A7053556F47A75A648B3F9220C') # "Zoltan Fridrich <zfridric@redhat.com>"
sha256sums=(be9143d0d58eab64dba9b77114aaafac529b6c0d7e81de6bdf1c9b59027d2106 # gnutls-3.7.7.tar.xz
dd7d0e7ba0b82fbe07088eed3c1e3970ceceb1add01dea8fef93db0710aa5e97) # gnutls-3.7.7.tar.xz.sig
dd7d0e7ba0b82fbe07088eed3c1e3970ceceb1add01dea8fef93db0710aa5e97 # gnutls-3.7.7.tar.xz.sig
250c13305115001cfc52e0a65e5bfb62e53b6697cfb1ee30a8a24da9181c63da) # 0001-fix-avx-detection.patch

View file

@ -3,7 +3,7 @@
pkgname=gnutls
pkgver=3.7.7
pkgrel=1
pkgrel=2
pkgdesc="A library which provides a secure layer over a reliable transport layer"
arch=('x86_64')
license=('GPL3' 'LGPL2.1')
@ -16,12 +16,21 @@ checkdepends=('net-tools' 'tpm2-tools')
optdepends=('guile: for use with Guile bindings'
'tpm2-tss: support for TPM2 wrapped keys'
'zstd: for compression support')
source=(https://www.gnupg.org/ftp/gcrypt/gnutls/v3.7/${pkgname}-${pkgver}.tar.xz{,.sig})
source=(https://www.gnupg.org/ftp/gcrypt/gnutls/v3.7/${pkgname}-${pkgver}.tar.xz{,.sig}
0001-fix-avx-detection.patch)
sha256sums=('be9143d0d58eab64dba9b77114aaafac529b6c0d7e81de6bdf1c9b59027d2106'
'SKIP')
'SKIP'
'250c13305115001cfc52e0a65e5bfb62e53b6697cfb1ee30a8a24da9181c63da')
#validpgpkeys=('462225C3B46F34879FC8496CD605848ED7E69871') # "Daiki Ueno <ueno@unixuser.org>"
validpgpkeys=('5D46CB0F763405A7053556F47A75A648B3F9220C') # "Zoltan Fridrich <zfridric@redhat.com>"
prepare() {
cd ${pkgname}-${pkgver}
# FS#75613 / https://gitlab.com/gnutls/gnutls/-/merge_requests/1631
patch -Np1 -i ../0001-fix-avx-detection.patch
}
build() {
cd ${pkgname}-${pkgver}
./configure --prefix=/usr \

View file

@ -7,17 +7,24 @@
pkgname=ldns
pkgver=1.8.2
pkgrel=01
pkgrel=02
pkgdesc='Fast DNS library supporting recent RFCs'
url='https://www.nlnetlabs.nl/projects/ldns/'
arch=('x86_64')
depends=('openssl' 'dnssec-anchors')
optdepends=('libpcap: ldns-dpa tool')
makedepends=('libpcap')
source=("https://www.nlnetlabs.nl/downloads/${pkgname}/${pkgname}-${pkgver}.tar.gz")
source=("https://www.nlnetlabs.nl/downloads/${pkgname}/${pkgname}-${pkgver}.tar.gz"
https://github.com/NLnetLabs/ldns/commit/1acee0c5d35f4a04df07e5d5f4490e6318513997.patch)
prepare() {
cd $pkgname-$pkgver
# https://github.com/NLnetLabs/ldns/issues/183
patch -p1 -i ../1acee0c5d35f4a04df07e5d5f4490e6318513997.patch
}
build() {
cd "${srcdir}/${pkgname}-${pkgver}"
cd $pkgname-$pkgver
./configure \
--prefix=/usr \
--sysconfdir=/etc \
@ -31,7 +38,7 @@ build() {
}
package() {
cd "${srcdir}/${pkgname}-${pkgver}"
cd $pkgname-$pkgver
make DESTDIR="${pkgdir}" install
install -D -m644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
}
@ -40,6 +47,6 @@ package() {
license=('custom:BSD')
sha256sums=(b92b001cdd382de653620a05445e42e17a827eec93d64ee587ad291a533cc1e9) # ldns-1.8.2.tar.gz
sha256sums=(b92b001cdd382de653620a05445e42e17a827eec93d64ee587ad291a533cc1e9 # ldns-1.8.2.tar.gz
03084dcee80fc1b6de47117bc9e0106e541fdda3600dbe0f6d9a8fb44d21d14e) # 1acee0c5d35f4a04df07e5d5f4490e6318513997.patch

View file

@ -4,7 +4,7 @@
pkgname=ldns
pkgver=1.8.2
pkgrel=1
pkgrel=2
pkgdesc='Fast DNS library supporting recent RFCs'
url='https://www.nlnetlabs.nl/projects/ldns/'
license=('custom:BSD')
@ -12,11 +12,19 @@ arch=('x86_64')
depends=('openssl' 'dnssec-anchors')
optdepends=('libpcap: ldns-dpa tool')
makedepends=('libpcap')
source=("https://www.nlnetlabs.nl/downloads/${pkgname}/${pkgname}-${pkgver}.tar.gz")
sha256sums=('b92b001cdd382de653620a05445e42e17a827eec93d64ee587ad291a533cc1e9')
source=("https://www.nlnetlabs.nl/downloads/${pkgname}/${pkgname}-${pkgver}.tar.gz"
https://github.com/NLnetLabs/ldns/commit/1acee0c5d35f4a04df07e5d5f4490e6318513997.patch)
sha256sums=('b92b001cdd382de653620a05445e42e17a827eec93d64ee587ad291a533cc1e9'
'03084dcee80fc1b6de47117bc9e0106e541fdda3600dbe0f6d9a8fb44d21d14e')
prepare() {
cd $pkgname-$pkgver
# https://github.com/NLnetLabs/ldns/issues/183
patch -p1 -i ../1acee0c5d35f4a04df07e5d5f4490e6318513997.patch
}
build() {
cd "${srcdir}/${pkgname}-${pkgver}"
cd $pkgname-$pkgver
./configure \
--prefix=/usr \
--sysconfdir=/etc \
@ -30,7 +38,7 @@ build() {
}
package() {
cd "${srcdir}/${pkgname}-${pkgver}"
cd $pkgname-$pkgver
make DESTDIR="${pkgdir}" install
install -D -m644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
}