.gitignore

@@ -1,5 +1,10 @@
-SOURCES/kernel-abi-stablelists-4.18.0-425.tar.bz2
-SOURCES/kernel-kabi-dw-4.18.0-425.tar.bz2
-SOURCES/linux-4.18.0-425.13.1.el8_7.tar.xz
+SOURCES/kernel-abi-stablelists-5.14.0-362.24.1.el9_3.tar.bz2
+SOURCES/kernel-kabi-dw-5.14.0-362.24.1.el9_3.tar.bz2
+SOURCES/linux-5.14.0-362.24.1.el9_3.tar.xz
 SOURCES/rheldup3.x509
+SOURCES/rhelima.x509
+SOURCES/rhelima_centos.x509
+SOURCES/rhelimaca1.x509
 SOURCES/rhelkpatch1.x509
+SOURCES/uki-sb-cert-x86_64-centos.crt
+SOURCES/uki-sb-cert-x86_64-rhel.crt

.kernel.metadata

@@ -1,5 +1,10 @@
-feac61524ad00b8b03f2985f8ac330c7939ba425 SOURCES/kernel-abi-stablelists-4.18.0-425.tar.bz2
-f2fb49be6e6fe2782bc58e2914d8dcc7b2948764 SOURCES/kernel-kabi-dw-4.18.0-425.tar.bz2
-57cc7ba600df4d74be3a1b8c2324ea69b92699e4 SOURCES/linux-4.18.0-425.13.1.el8_7.tar.xz
+6b3b73a0e5ee8afc75ff184e7579cf193d12e333 SOURCES/kernel-abi-stablelists-5.14.0-362.24.1.el9_3.tar.bz2
+2dbea40d3654901f0bdc4bb48351f07d4590c1c4 SOURCES/kernel-kabi-dw-5.14.0-362.24.1.el9_3.tar.bz2
+aa929675bd46443ba8d0036b9247514be09efc00 SOURCES/linux-5.14.0-362.24.1.el9_3.tar.xz
 95b9b811c7b0a6c98b2eafc4e7d6d24f2cb63289 SOURCES/rheldup3.x509
+99e571f9de4188f3b5fdf1f84ff73f6cc4bb6a0e SOURCES/rhelima.x509
+61d5a223ff0c79189505abae77e0087c4b2d2b47 SOURCES/rhelima_centos.x509
+f882610d2554fef65703e5d3c342f005af0390ad SOURCES/rhelimaca1.x509
 d90885108d225a234a5a9d054fc80893a5bd54d0 SOURCES/rhelkpatch1.x509
+20224d67a583b98009a1c1632bb4b639b0e8be6a SOURCES/uki-sb-cert-x86_64-centos.crt
+1d51d3a037ad287095b0a13c4deeb1252d8ff0cc SOURCES/uki-sb-cert-x86_64-rhel.crt

SOURCES/0001-nvme-pci-add-BOGUS_NID-for-Intel-0a54-device.patch

@@ -0,0 +1,32 @@
+From 5c3f4066462a5f6cac04d3dd81c9f551fabbc6c7 Mon Sep 17 00:00:00 2001
+From: Keith Busch <kbusch@kernel.org>
+Date: Thu, 12 Oct 2023 11:13:51 -0700
+Subject: [PATCH] nvme-pci: add BOGUS_NID for Intel 0a54 device
+
+These ones claim cmic and nmic capable, so need special consideration to ignore
+their duplicate identifiers.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=217981
+Reported-by: welsh@cassens.com
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+---
+ drivers/nvme/host/pci.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 347cb5daebc3..3f0c9ee09a12 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -3329,7 +3329,8 @@ static const struct pci_device_id nvme_id_table[] = {
+ 	{ PCI_VDEVICE(INTEL, 0x0a54),	/* Intel P4500/P4600 */
+ 		.driver_data = NVME_QUIRK_STRIPE_SIZE |
+ 				NVME_QUIRK_DEALLOCATE_ZEROES |
+-				NVME_QUIRK_IGNORE_DEV_SUBNQN, },
++				NVME_QUIRK_IGNORE_DEV_SUBNQN |
++				NVME_QUIRK_BOGUS_NID, },
+ 	{ PCI_VDEVICE(INTEL, 0x0a55),	/* Dell Express Flash P4600 */
+ 		.driver_data = NVME_QUIRK_STRIPE_SIZE |
+ 				NVME_QUIRK_DEALLOCATE_ZEROES, },
+-- 
+2.27.0
+

SOURCES/CVE-2024-1086.patch

@@ -0,0 +1,34 @@
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 38ff119ab..11f4b1aab 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -10442,16 +10442,10 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
+ 	data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
+ 
+ 	switch (data->verdict.code) {
+-	default:
+-		switch (data->verdict.code & NF_VERDICT_MASK) {
+-		case NF_ACCEPT:
+-		case NF_DROP:
+-		case NF_QUEUE:
+-			break;
+-		default:
+-			return -EINVAL;
+-		}
+-		fallthrough;
++	case NF_ACCEPT:
++	case NF_DROP:
++	case NF_QUEUE:
++		break;
+ 	case NFT_CONTINUE:
+ 	case NFT_BREAK:
+ 	case NFT_RETURN:
+@@ -10486,6 +10480,8 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
+ 
+ 		data->verdict.chain = chain;
+ 		break;
++	default:
++		return -EINVAL;
+ 	}
+ 
+ 	desc->len = sizeof(data->verdict);

SOURCES/Makefile.rhelver

@@ -0,0 +1,67 @@
+RHEL_MAJOR = 9
+RHEL_MINOR = 3
+
+#
+# RHEL_RELEASE
+# -------------
+#
+# Represents build number in 'release' part of RPM's name-version-release.
+#   name is <package_name>, e.g. kernel
+#   version is upstream kernel version this kernel is based on, e.g. 4.18.0
+#   release is <RHEL_RELEASE>.<dist_tag>[<buildid>], e.g. 100.el8
+#
+# Use this spot to avoid future merge conflicts.
+# Do not trim this comment.
+RHEL_RELEASE = 362.24.1
+
+#
+# ZSTREAM
+# -------
+#
+#  This variable controls whether we use zstream numbering or not for the
+#  package release. The zstream release keeps the build number of the last
+#  build done for ystream for the Beta milestone, and increments a second
+#  number for each build. The third number is used for branched builds
+#  (eg.: for builds with security fixes or hot fixes done outside of the
+#  batch release process).
+#
+#  For example, with ZSTREAM unset or set to "no", all builds will contain
+#  a release with only the build number, eg.: kernel-<kernel version>-X.el*,
+#  where X is the build number. With ZSTREAM set to "yes", we will have
+#  builds with kernel-<kernel version>-X.Y.Z.el*, where X is the last
+#  RHEL_RELEASE number before ZSTREAM flag was set to yes, Y will now be the
+#  build number and Z will always be 1 except if you're doing a branched build
+#  (when you give RHDISTGIT_BRANCH on the command line, in which case the Z
+#  number will be incremented instead of the Y).
+#
+ZSTREAM ?= yes
+
+#
+# Early y+1 numbering
+# --------------------
+#
+# In early y+1 process, RHEL_RELEASE consists of 2 numbers: x.y
+# First is RHEL_RELEASE inherited/merged from y as-is, second number
+# is incremented with each build starting from 1. After merge from y,
+# it resets back to 1. This way y+1 nvr reflects status of last merge.
+#
+# Example:
+#
+# rhel8.0                        rhel-8.1
+#   kernel-4.18.0-58.el8   -->     kernel-4.18.0-58.1.el8
+#                                  kernel-4.18.0-58.2.el8
+#   kernel-4.18.0-59.el8           kernel-4.18.0-59.1.el8
+#   kernel-4.18.0-60.el8
+#   kernel-4.18.0-61.el8   -->     kernel-4.18.0-61.1.el8
+#
+#
+# Use this spot to avoid future merge conflicts.
+# Do not trim this comment.
+EARLY_YSTREAM ?= no
+EARLY_YBUILD:=
+EARLY_YRELEASE:=
+ifneq ("$(ZSTREAM)", "yes")
+  ifeq ("$(EARLY_YSTREAM)","yes")
+    RHEL_RELEASE:=$(RHEL_RELEASE).$(EARLY_YRELEASE)
+  endif
+endif

SOURCES/README.rst

@@ -0,0 +1,25 @@
+===================
+The Kernel dist-git
+===================
+
+The kernel is maintained in a `source tree`_ rather than directly in dist-git.
+The specfile is maintained as a `template`_ in the source tree along with a set
+of build scripts to generate configurations, (S)RPMs, and to populate the
+dist-git repository.
+
+The `documentation`_ for the source tree covers how to contribute and maintain
+the tree.
+
+If you're looking for the downstream patch set it's available in the source
+tree with "git log master..ark-patches" or
+`online`_.
+
+Each release in dist-git is tagged in the source repository so you can easily
+check out the source tree for a build. The tags are in the format
+name-version-release, but note release doesn't contain the dist tag since the
+source can be built in different build roots (Fedora, CentOS, etc.)
+
+.. _source tree: https://gitlab.com/cki-project/kernel-ark.git
+.. _template: https://gitlab.com/cki-project/kernel-ark/-/blob/os-build/redhat/kernel.spec.template
+.. _documentation: https://gitlab.com/cki-project/kernel-ark/-/wikis/home
+.. _online: https://gitlab.com/cki-project/kernel-ark/-/commits/ark-patches

SOURCES/almalinux.pem

@@ -1,46 +0,0 @@
------BEGIN CERTIFICATE-----
-MIID3zCCAsegAwIBAgIQY4iebPtuT3OKR2M/jWZWEzANBgkqhkiG9w0BAQsFADBg
-MSUwIwYJKoZIhvcNAQkBFhZzZWN1cml0eUBhbG1hbGludXgub3JnMRIwEAYDVQQK
-EwlBbG1hTGludXgxIzAhBgNVBAMTGkFsbWFMaW51eCBTZWN1cmUgQm9vdCBDQSAx
-MB4XDTIxMDExNDIxMDcxOVoXDTM2MDExMTIxMDcxOVowaTElMCMGCSqGSIb3DQEJ
-ARYWc2VjdXJpdHlAYWxtYWxpbnV4Lm9yZzESMBAGA1UEChMJQWxtYUxpbnV4MSww
-KgYDVQQDEyNBbG1hTGludXggRHJpdmVyIHVwZGF0ZSBzaWduaW5nIGtleTCCASIw
-DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK7kGZShKo5uegg6T4U/wR9UeyCa
-qTtx+OvzUMKT8l5+R5WfBgQU8sDrIqX3Vv3tD6UeOUyFIQ40iGESdDhWnAFynJX4
-v0k81KxJ+rVFAt5EJBeGw7U2qdpn8hzJG2dVANZ1gXJWGhC95Muif5q8fL7BJdU4
-RufixfKWq6WHAalwHaiTCbA+/Ft6TLyZcA62glKkmBn7uWn83tlMfVqC4EN2NfQb
-//C2MFCbm43BoKmgrMV0J3Pu8un3QZ4ukDDhJJ9eHfSqscq9SHPjqd0RM6TRcFXW
-BzmTpG7MOJRvk4ypQSHxxc4jK5MVOqzel+2UPB2ihkvvnK9hdsvvI/bal/sCAwEA
-AaOBizCBiDAfBgNVHSMEGDAWgBSY0u339QWy5Y/vkiTSvJ6Ffy5GkzAVBglghkgB
-hvhCAQEBAf8EBQMDAPABMB8GA1UdJQQYMBYGCCsGAQUFBwMDBgorBgEEAZIIEAEC
-MA4GA1UdDwEB/wQEAwIEsDAdBgNVHQ4EFgQUe4Y+AkDtIIq2uBuKbyhgwPTox9Yw
-DQYJKoZIhvcNAQELBQADggEBAHoPojMTRdFO050Ihrmr8jkdOweiOSBtlAZkLGd2
-lTybNp2Xi1lQ8SqsqU/NFs/KUPVFykmjmLeqNWC9QoKdrVGzoD9MOHprRxe6gC8k
-sHzBCFqdx3B+qbeSxBUN2QLIydzM6C23qf1TjBCeEDtRrvcvupFTlOBxiOJrIwbp
-dJD1JfjbgxfvLzg7PaJPi5Ev6B3gY4ybCnKQmor029Z3R4zw3miPpZVA04xt3Z9e
-m45Jjv86u10wjLmGRgfMmYT43jiMbOwlG1N8OikvgIHwlZtWxUpL1t/mEYtMMkTv
-R//lA5z5dqXiDCPdTwHhSjEfBFWGLl7ciYt6rYkpdlqnYdk=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIID2DCCAsCgAwIBAgIQHDEXJMuZQ/m5MXRiSmLMljANBgkqhkiG9w0BAQsFADBg
-MSUwIwYJKoZIhvcNAQkBFhZzZWN1cml0eUBhbG1hbGludXgub3JnMRIwEAYDVQQK
-EwlBbG1hTGludXgxIzAhBgNVBAMTGkFsbWFMaW51eCBTZWN1cmUgQm9vdCBDQSAx
-MB4XDTIxMDExNDIxMDgwMFoXDTM2MDExMTIxMDgwMFowYjElMCMGCSqGSIb3DQEJ
-ARYWc2VjdXJpdHlAYWxtYWxpbnV4Lm9yZzESMBAGA1UEChMJQWxtYUxpbnV4MSUw
-IwYDVQQDExxBbG1hTGludXgga3BhdGNoIHNpZ25pbmcga2V5MIIBIjANBgkqhkiG
-9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxncKQ7a49o5IUwqPB1axIzopNdGoSoERVuUd
-hdHAZLB2MGIuU2fGCuZ4iD2Pwk+t2KsgR1y58pmHyRBCLi2tYfEdDB8LUzUY3P+8
-Wxm2+zz8TPJUIcvPE4rHEb0vV4nTzwjpG4BTBwLkYRj+AxGbzWEy5Eetxzq5Ji+V
-TMuTzRKshHEGNs3tFRPbSssc50NH+OuVKpzJAIqBmz7Gca9RqhK9ARK1p3aDEoR+
-pYw4zRjIczc3s57WeuQxRMvFK5j48U0hpEUh+eQn1m40Bus3e7i4YTskwgKN5Vq3
-lGlEdBoK4utuoHPj3JYh97hOii/kulOa9j5xeNe5z/6QByMxpwIDAQABo4GLMIGI
-MB8GA1UdIwQYMBaAFJjS7ff1BbLlj++SJNK8noV/LkaTMBUGCWCGSAGG+EIBAQEB
-/wQFAwMA8AEwHwYDVR0lBBgwFgYIKwYBBQUHAwMGCisGAQQBkggQAQIwDgYDVR0P
-AQH/BAQDAgSwMB0GA1UdDgQWBBRpptnu0/Yg1cLhOh0hHEZRClrZ9TANBgkqhkiG
-9w0BAQsFAAOCAQEAMDiuS0CD31MtO1Sn4HRYvai2LFdKpUKAEXVy9hsN+AfbcMcl
-2sF/w49o43cMNIFoWKhMWZMOjCj/DGQY7ehNH3DRaTl7DNCu6y7mBNJPU+iPcE4r
-92SBWIxUNi7YVbsc1evKBOnrtq6xd5BUJQx1cVGmSBI9dnd4tDBB2+KjpmdhzZK5
-V1KQz1ilz5g2FNyEj6L7hnpkGUeMYnuM49YL7JP8QNtaKUBBA3BR4S7de+Tu070h
-pEhvE539I6B+wmgV/bio20TUpQ5W2eH+5YUHVIZa5pZ30tVkm21iNB7eccbM4NYc
-IRmwIsesuROtaM1e0lHoxKdW0N2xOSkhSY6oyQ==
------END CERTIFICATE-----

SOURCES/check-kabi

@@ -41,7 +41,8 @@ def load_symvers(symvers, filename):
             break
         if in_line == "\n":
             continue
-        checksum, symbol, directory, type = in_line.split()
+        checksum, symbol, directory, type, *ns = in_line.split()
+        ns = ns[0] if ns else None
 
         symvers[symbol] = in_line[0:-1]
 
@@ -57,7 +58,8 @@ def load_kabi(kabi, filename):
             break
         if in_line == "\n":
             continue
-        checksum, symbol, directory, type = in_line.split()
+        checksum, symbol, directory, type, *ns = in_line.split()
+        ns = ns[0] if ns else None
 
         kabi[symbol] = in_line[0:-1]
 
@@ -69,11 +71,14 @@ def check_kabi(symvers, kabi):
     warn = 0
     changed_symbols = []
     moved_symbols = []
+    ns_symbols = []
 
     for symbol in kabi:
-        abi_hash, abi_sym, abi_dir, abi_type = kabi[symbol].split()
+        abi_hash, abi_sym, abi_dir, abi_type, *abi_ns = kabi[symbol].split()
+        abi_ns = abi_ns[0] if abi_ns else None
         if symbol in symvers:
-            sym_hash, sym_sym, sym_dir, sym_type = symvers[symbol].split()
+            sym_hash, sym_sym, sym_dir, sym_type, *sym_ns = symvers[symbol].split()
+            sym_ns = sym_ns[0] if sym_ns else None
             if abi_hash != sym_hash:
                 fail = 1
                 changed_symbols.append(symbol)
@@ -81,6 +86,10 @@ def check_kabi(symvers, kabi):
             if abi_dir != sym_dir:
                 warn = 1
                 moved_symbols.append(symbol)
+
+            if abi_ns != sym_ns:
+                warn = 1
+                ns_symbols.append(symbol)
         else:
             fail = 1
             changed_symbols.append(symbol)
@@ -96,13 +105,21 @@ def check_kabi(symvers, kabi):
 
     if warn:
         print("*** WARNING - ABI SYMBOLS MOVED ***")
-        print("")
-        print("The following symbols moved (typically caused by moving a symbol from being")
-        print("provided by the kernel vmlinux out to a loadable module):")
-        print("")
-        for symbol in moved_symbols:
-            print(symbol)
-        print("")
+        if moved_symbols:
+            print("")
+            print("The following symbols moved (typically caused by moving a symbol from being")
+            print("provided by the kernel vmlinux out to a loadable module):")
+            print("")
+            for symbol in moved_symbols:
+                print(symbol)
+            print("")
+        if ns_symbols:
+            print("")
+            print("The following symbols changed symbol namespaces:")
+            print("")
+            for symbol in ns_symbols:
+                print(symbol)
+            print("")
 
     """Halt the build, if we got errors and/or warnings. In either case,
        double-checkig is required to avoid introducing / concealing

SOURCES/debrand-rh-i686-cpu.patch

@@ -1,11 +0,0 @@
---- a/arch/x86/boot/main.c	2019-03-13 04:04:53.000000000 -0700
-+++ b/arch/x86/boot/main.c	2019-05-25 14:31:21.043272496 -0700
-@@ -147,7 +147,7 @@ void main(void)
- 
- 	/* Make sure we have all the proper CPU support */
- 	if (validate_cpu()) {
--		puts("This processor is not supported in this version of RHEL.\n");
-+		puts("This processor is not supported in this version of AlmaLinux.\n");
- 		die();
- 	}
- 

SOURCES/debrand-rh_taint.patch

@@ -1,81 +0,0 @@
---- a/kernel/rh_taint.c	2020-10-16 10:41:51.000000000 -0500
-+++ b/kernel/rh_taint.c	2020-11-19 10:50:24.853039167 -0600
-@@ -2,12 +2,12 @@
- #include <linux/module.h>
- 
- /*
-- * The following functions are used by Red Hat to indicate to users that
-- * hardware and drivers are unsupported, or have limited support in RHEL major
-+ * The following functions are used by AlmaLinux to indicate to users that
-+ * hardware and drivers are unsupported, or have limited support in AlmaLinux major
-  * and minor releases.  These functions output loud warning messages to the end
-  * user and should be USED WITH CAUTION.
-  *
-- * Any use of these functions _MUST_ be documented in the RHEL Release Notes,
-+ * Any use of these functions _MUST_ be documented in the AlmaLinux Release Notes,
-  * and have approval of management.
-  */
- 
-@@ -16,15 +16,15 @@
-  * @msg: Hardware name, class, or type
-  *
-  * Called to mark a device, class of devices, or types of devices as not having
-- * support in any RHEL minor release.  This does not TAINT the kernel.  Red Hat
-- * will not fix bugs against this hardware in this minor release.  Red Hat may
-+ * support in any AlmaLinux minor release.  This does not TAINT the kernel.  AlmaLinux
-+ * will not fix bugs against this hardware in this minor release.  AlmaLinux may
-  * declare support in a future major or minor update release.  This cannot be
-  * used to mark drivers unsupported.
-  */
- void mark_hardware_unsupported(const char *msg)
- {
- 	/* Print one single message */
--	pr_crit("Warning: %s - this hardware has not undergone testing by Red Hat and might not be certified. Please consult https://catalog.redhat.com for certified hardware.\n", msg);
-+	pr_crit("Warning: %s - this hardware has not undergone testing by AlmaLinux and might not be certified.\n", msg);
- }
- EXPORT_SYMBOL(mark_hardware_unsupported);
- 
-@@ -35,12 +35,12 @@ EXPORT_SYMBOL(mark_hardware_unsupported)
-  * Called to minimize the support status of a previously supported device in
-  * a minor release.  This does not TAINT the kernel.  Marking hardware
-  * deprecated is usually done in conjunction with the hardware vendor.  Future
-- * RHEL major releases may not include this driver.  Driver updates and fixes
-+ * AlmaLinux major releases may not include this driver.  Driver updates and fixes
-  * for this device will be limited to critical issues in future minor releases.
-  */
- void mark_hardware_deprecated(const char *msg)
- {
--	pr_crit("Warning: %s - this hardware is not recommended for new deployments. It continues to be supported in this RHEL release, but it is likely to be removed in the next major release. Driver updates and fixes for this device will be limited to critical issues. Please contact Red Hat Support or your device's hardware vendor for additional information.\n", msg);
-+	pr_crit("Warning: %s - this hardware is not recommended for new deployments. It continues to be supported in this AlmaLinux release, but it is likely to be removed in the next major release. Driver updates and fixes for this device will be limited to critical issues. Please contact AlmaLinux Support or your device's hardware vendor for additional information.\n", msg);
- }
- EXPORT_SYMBOL(mark_hardware_deprecated);
- 
-@@ -50,9 +50,9 @@ EXPORT_SYMBOL(mark_hardware_deprecated);
-  *
-  * Called to minimize the support status of a new driver.  This does TAINT the
-  * kernel.  Calling this function indicates that the driver or subsystem has
-- * had limited testing and is not marked for full support within this RHEL
-- * minor release.  The next RHEL minor release may contain full support for
-- * this driver.  Red Hat does not guarantee that bugs reported against this
-+ * had limited testing and is not marked for full support within this AlmaLinux
-+ * minor release.  The next AlmaLinux minor release may contain full support for
-+ * this driver.  AlmaLinux does not guarantee that bugs reported against this
-  * driver or subsystem will be resolved.
-  */
- void mark_tech_preview(const char *msg, struct module *mod)
-@@ -81,13 +81,13 @@ EXPORT_SYMBOL(mark_tech_preview);
-  * mark_driver_unsupported - drivers that we know we don't want to support
-  * @name: the name of the driver
-  *
-- * In some cases Red Hat has chosen to build a driver for internal QE
-+ * In some cases AlmaLinux has chosen to build a driver for internal QE
-  * use. Use this function to mark those drivers as unsupported for
-  * customers.
-  */
- void mark_driver_unsupported(const char *name)
- {
--	pr_crit("Warning: %s - This driver has not undergone sufficient testing by Red Hat for this release and therefore cannot be used in production systems.\n",
-+	pr_crit("Warning: %s - This driver has not undergone sufficient testing by AlmaLinux for this release and therefore cannot be used in production systems.\n",
- 	        name ? name : "kernel");
- }
- EXPORT_SYMBOL(mark_driver_unsupported);

SOURCES/debrand-single-cpu.patch

@@ -1,11 +0,0 @@
---- a/arch/x86/kernel/setup.c	2019-03-13 04:04:53.000000000 -0700
-+++ b/arch/x86/kernel/setup.c	2019-05-27 08:35:54.580595314 -0700
-@@ -900,7 +900,7 @@ static void rh_check_supported(void)
- 	if (((boot_cpu_data.x86_max_cores * smp_num_siblings) == 1) &&
- 	    !guest && is_kdump_kernel()) {
- 		pr_crit("Detected single cpu native boot.\n");
--		pr_crit("Important:  In Red Hat Enterprise Linux 8, single threaded, single CPU 64-bit physical systems are unsupported by Red Hat. Please contact your Red Hat support representative for a list of certified and supported systems.");
-+		pr_crit("Important:  In AlmaLinux 8, single threaded, single CPU 64-bit physical systems are unsupported. Please see https://www.almalinux.org for more information");
- 	}
- 
- 	/*

SOURCES/dracut-virt.conf

@@ -0,0 +1,38 @@
+# generic + compressed please
+hostonly="no"
+compress="xz"
+
+# VMs can't update microcode anyway
+early_microcode="no"
+
+# modules: basics
+dracutmodules+=" base systemd systemd-initrd dracut-systemd dbus dbus-broker usrmount shutdown "
+
+# modules: storage support
+dracutmodules+=" dm lvm rootfs-block fs-lib "
+
+# modules: tpm and crypto
+dracutmodules+=" crypt crypt-loop tpm2-tss "
+
+# WALinuxagent-cvm with CVM specific udev rules
+dracutmodules+=" walinuxagentcvm "
+
+# drivers: virtual buses, pci
+drivers+=" virtio-pci virtio-mmio "      # qemu-kvm
+drivers+=" hv-vmbus pci-hyperv "         # hyperv
+drivers+=" xen-pcifront "                # xen
+
+# drivers: storage
+drivers+=" ahci nvme sd_mod sr_mod "     # generic
+drivers+=" virtio-blk virtio-scsi "      # qemu-kvm
+drivers+=" hv-storvsc "                  # hyperv
+drivers+=" xen-blkfront "                # xen
+
+# root encryption
+drivers+=" dm_crypt "
+
+# filesystems
+filesystems+=" vfat ext4 xfs overlay "
+
+# systemd-pcrphase
+install_items+=" /lib/systemd/system/systemd-pcrphase-initrd.service /usr/lib/systemd/systemd-pcrphase /usr/lib/systemd/system/initrd.target.wants/systemd-pcrphase-initrd.service "

SOURCES/filter-aarch64.sh.rhel

@@ -15,4 +15,4 @@ ethdrvs="3com adaptec arc alteon atheros broadcom cadence calxeda chelsio cisco
 
 drmdrvs="amd arm bridge ast exynos hisilicon i2c imx mgag200 meson msm nouveau panel radeon rockchip tegra sun4i tinydrm vc4"
 
-singlemods="ntb_netdev iscsi_ibft iscsi_boot_sysfs megaraid pmcraid qedi qla1280 9pnet_rdma rpcrdma nvmet-rdma nvme-rdma hid-picolcd hid-prodikeys hwa-hc hwpoison-inject target_core_user sbp_target cxgbit iw_cxgb3 iw_cxgb4 cxgb3i cxgb3i cxgb3i_ddp cxgb4i chcr"
+singlemods="ntb_netdev iscsi_ibft iscsi_boot_sysfs megaraid pmcraid qedi qla1280 9pnet_rdma rpcrdma nvmet-rdma nvme-rdma hid-picolcd hid-prodikeys hwa-hc hwpoison-inject target_core_user sbp_target cxgbit iw_cxgb3 iw_cxgb4 cxgb3i cxgb3i cxgb3i_ddp cxgb4i chcr chtls"

SOURCES/filter-modules.sh.rhel

@@ -13,8 +13,11 @@
 # subsys should be in kernel-modules on all arches, please change the defaults
 # listed here.
 
+# Overrides is individual modules which need to remain in kernel-core due to deps.
+overrides="cec"
+
 # Set the default dirs/modules to filter out
-driverdirs="atm auxdisplay bcma bluetooth firewire fmc iio infiniband isdn leds media memstick mfd mmc mtd nfc ntb pcmcia platform power ssb staging tty uio uwb w1 virt"
+driverdirs="atm auxdisplay bcma bluetooth firewire fmc iio infiniband isdn leds media memstick mfd mmc mtd nfc ntb pcmcia platform power ssb staging tty uio uwb w1"
 
 chardrvs="mwave pcmcia"
 
@@ -22,6 +25,8 @@ netdrvs="appletalk can dsa hamradio ieee802154 irda ppp slip usb wireless"
 
 ethdrvs="3com adaptec alteon amd aquantia atheros broadcom cadence calxeda chelsio cisco dec dlink emulex icplus marvell neterion nvidia oki-semi packetengines qlogic rdc renesas sfc silan sis smsc stmicro sun tehuti ti wiznet xircom"
 
+cryptdrvs="bcm caam cavium chelsio hisilicon marvell qat"
+
 inputdrvs="gameport tablet touchscreen"
 
 scsidrvs="aacraid aic7xxx aic94xx be2iscsi bfa bnx2i bnx2fc csiostor cxgbi esas2r fcoe fnic hisi_sas isci libsas lpfc megaraid mpt2sas mpt3sas mvsas pm8001 qla2xxx qla4xxx sym53c8xx_2 ufs qedf"
@@ -34,7 +39,7 @@ netprots="6lowpan appletalk atm ax25 batman-adv bluetooth can dccp dsa ieee80215
 
 drmdrvs="amd ast gma500 i2c i915 mgag200 nouveau radeon via "
 
-singlemods="ntb_netdev iscsi_ibft iscsi_boot_sysfs megaraid pmcraid qedi qla1280 9pnet_rdma rpcrdma nvmet-rdma nvme-rdma hid-picolcd hid-prodikeys hwa-hc hwpoison-inject hid-sensor-hub target_core_user sbp_target cxgbit iw_cxgb3 iw_cxgb4 cxgb3i cxgb3i cxgb3i_ddp cxgb4i chcr parport_serial ism xt_u32 act_ct"
+singlemods="ntb_netdev iscsi_ibft iscsi_boot_sysfs megaraid pmcraid qedi qla1280 9pnet_rdma rpcrdma nvmet-rdma nvme-rdma hid-picolcd hid-prodikeys hwa-hc hwpoison-inject hid-sensor-hub target_core_user sbp_target cxgbit iw_cxgb3 iw_cxgb4 cxgb3i cxgb3i cxgb3i_ddp cxgb4i chcr chtls parport_serial ism regmap-sdw regmap-sdw-mbq arizona-micsupp hid-asus nct6775 ntc_thermistor video"
 
 # Grab the arch-specific filter list overrides
 source ./filter-$2.sh
@@ -88,7 +93,7 @@ done
 # Filter the char drivers
 for char in ${chardrvs}
 do
-	filter_dir $1 drivers/char/${input}
+	filter_dir $1 drivers/char/${char}
 done
 
 # Filter the ethernet drivers
@@ -97,6 +102,12 @@ do
 	filter_dir $1 drivers/net/ethernet/${eth}
 done
 
+# Filter the crypto drivers
+for crypt in ${cryptdrvs}
+do
+	filter_dir $1 drivers/crypto/${crypt}
+done
+
 # SCSI
 for scsi in ${scsidrvs}
 do
@@ -135,9 +146,7 @@ done
 
 # Just kill sound.
 filter_dir $1 kernel/sound
-filter_ko $1 drivers/base/regmap/regmap-sdw
-filter_ko $1 drivers/base/regmap/regmap-sdw-mbq
-filter_dir $1 drivers/soundwire
+filter_dir $1 kernel/drivers/soundwire
 
 # Now go through and filter any single .ko files that might have deps on the
 # things we filtered above
@@ -146,6 +155,20 @@ do
         filter_ko $1 ${mod}
 done
 
+# Now process the override list to bring those modules back into core
+for mod in ${overrides}
+do
+	grep -v -e "/${mod}.ko" k-d.list > k-d.list.tmp
+	if [ $? -ne 0 ]
+        then
+                echo "Couldn't save ${mod}.ko  Skipping."
+        else
+                grep -e "/${mod}.ko" k-d.list >> $filelist
+                mv k-d.list.tmp k-d.list
+        fi
+
+done
+
 # Go through our generated drivers list and remove the .ko files.  We'll
 # restore them later.
 for mod in `cat k-d.list`

SOURCES/filter-ppc64le.sh.rhel

@@ -11,4 +11,4 @@
 
 driverdirs="atm auxdisplay bcma bluetooth firewire fmc infiniband isdn leds media memstick message mmc mtd mwave nfc ntb pcmcia platform power ssb staging tty uio uwb w1"
 
-singlemods="ntb_netdev iscsi_ibft iscsi_boot_sysfs megaraid pmcraid qedi qla1280 9pnet_rdma rpcrdma nvmet-rdma nvme-rdma hid-picolcd hid-prodikeys hwa-hc hwpoison-inject target_core_user sbp_target cxgbit iw_cxgb3 iw_cxgb4 cxgb3i cxgb3i cxgb3i_ddp cxgb4i chcr"
+singlemods="ntb_netdev iscsi_ibft iscsi_boot_sysfs megaraid pmcraid qedi qla1280 9pnet_rdma rpcrdma nvmet-rdma nvme-rdma hid-picolcd hid-prodikeys hwa-hc hwpoison-inject target_core_user sbp_target cxgbit iw_cxgb3 iw_cxgb4 cxgb3i cxgb3i cxgb3i_ddp cxgb4i chcr chtls"

SOURCES/gating.yaml

@@ -1,6 +1,6 @@
 --- !Policy
 product_versions:
-  - rhel-8
+  - rhel-9
 decision_context: osci_compose_gate
 rules:
   - !PassingTestCaseRule {test_case_name: cki.tier1-aarch64.functional}

SOURCES/generate_all_configs.sh

@@ -1,6 +1,36 @@
 #!/bin/sh
 
-for i in ${NAME}-*.config; do
-	NEW=${NAME}-${VERSION}-`echo $i | cut -d - -f2-`
-	mv ${i} ${NEW}
+# Adjusts the configuration options to build the variants correctly
+
+test -n "$RHTEST" && exit 0
+
+DEBUGBUILDSENABLED=$1
+if [ -z "$DEBUGBUILDSENABLED" ]; then
+	exit 1
+fi
+
+if [ -z "$FLAVOR" ]; then
+	FLAVOR=rhel
+fi
+
+if [ "$FLAVOR" = "fedora" ]; then
+	SECONDARY=rhel
+else
+	SECONDARY=fedora
+fi
+
+for i in kernel-*-"$FLAVOR".config; do
+	NEW=kernel-"$SPECVERSION"-$(echo "$i" | cut -d - -f2- | sed s/-"$FLAVOR"//)
+	#echo $NEW
+	mv "$i" "$NEW"
 done
+
+rm -f kernel-*-"$SECONDARY".config
+
+if [ "$DEBUGBUILDSENABLED" -eq 0 ]; then
+	for i in kernel-*debug*.config; do
+		base=$(echo "$i" | sed -r s/-?debug//g)
+		NEW=kernel-$(echo "$base" | cut -d - -f2-)
+		mv "$i" "$NEW"
+	done
+fi

SOURCES/generate_bls_conf.sh

@@ -1,31 +0,0 @@
-#!/bin/bash
-set -e
-
-. /etc/os-release
-
-kernelver=$1 && shift
-rootfs=$1 && shift
-variant=$1 && shift
-
-output="${rootfs}/lib/modules/${kernelver}/bls.conf"
-date=$(date -u +%Y%m%d%H%M%S)
-
-if [ "${variant:-5}" = "debug" ]; then
-    debugname=" with debugging"
-    debugid="-debug"
-else
-    debugname=""
-    debugid=""
-fi
-
-cat >${output} <<EOF
-title ${NAME} (${kernelver}) ${VERSION}${debugname}
-version ${kernelver}${debugid}
-linux ${bootprefix}/vmlinuz-${kernelver}
-initrd ${bootprefix}/initramfs-${kernelver}.img
-options \$kernelopts
-id ${ID}-${date}-${kernelver}${debugid}
-grub_users \$grub_users
-grub_arg --unrestricted
-grub_class kernel${variant}
-EOF

SOURCES/kernel-local

@@ -0,0 +1,2 @@
+# This file is intentionally left empty in the stock kernel. Its a nicety
+# added for those wanting to do custom rebuilds with altered config opts.

SOURCES/merge.pl

@@ -0,0 +1,72 @@
+#! /usr/bin/perl
+
+my @args=@ARGV;
+my %configvalues;
+my @configoptions;
+my $configcounter = 0;
+
+# optionally print out the architecture as the first line of our output
+my $arch = $args[2];
+if (defined $arch) {
+	print "# $arch\n";
+}
+
+# first, read the override file
+
+open (FILE,"$args[0]") || die "Could not open $args[0]";
+while (<FILE>) {
+	my $str = $_;
+	my $configname;
+
+	if (/\# ([\w]+) is not set/) {
+		$configname = $1;
+	} elsif (/^\#/) {
+		# fall through on comments like 'avoid CONFIG_FOO=y'
+		;
+	} elsif (/([\w]+)=/) {
+		$configname = $1;
+	}
+
+	if (defined($configname) && !exists($configvalues{$configname})) {
+		$configvalues{$configname} = $str;
+		$configoptions[$configcounter] = $configname;
+		$configcounter ++;
+	}
+};
+
+# now, read and output the entire configfile, except for the overridden
+# parts... for those the new value is printed.
+
+open (FILE2,"$args[1]") || die "Could not open $args[1]";
+while (<FILE2>) {
+	my $configname;
+
+	if (/\# ([\w]+) is not set/) {
+		$configname = $1;
+	} elsif (/^\#/) {
+		# fall through on comments like 'avoid CONFIG_FOO=y'
+		;
+	} elsif (/([\w]+)=/) {
+		$configname  = $1;
+	}
+
+	if (defined($configname) && exists($configvalues{$configname})) {
+		print "$configvalues{$configname}";
+		delete($configvalues{$configname});
+	} else {
+		print "$_";
+	}
+}
+
+# now print the new values from the overridden configfile
+my $counter = 0;
+
+while ($counter < $configcounter) {
+	my $configname = $configoptions[$counter];
+	if (exists($configvalues{$configname})) {
+		print "$configvalues{$configname}";
+	}
+	$counter++;
+}
+
+1;

SOURCES/mod-denylist.sh

@@ -1,4 +1,5 @@
 #! /bin/bash
+# shellcheck disable=SC2164
 
 RpmDir=$1
 ModDir=$2
@@ -24,9 +25,9 @@ __EOF__
 
 check_blacklist()
 {
-	mod=$(find $RpmDir/$ModDir -name "$1")
+	mod=$(find "$RpmDir/$ModDir" -name "$1")
 	[ ! "$mod" ] && return 0
-	if modinfo $mod | grep -q '^alias:\s\+net-'; then
+	if modinfo "$mod" | grep -q '^alias:\s\+net-'; then
 		mod="${1##*/}"
 		mod="${mod%.ko*}"
 		echo "$mod has an alias that allows auto-loading. Blacklisting."
@@ -37,7 +38,7 @@ check_blacklist()
 find_depends()
 {
 	dep=$1
-	depends=`modinfo $dep | sed -n -e "/^depends/ s/^depends:[ \t]*//p"`
+	depends=$(modinfo "$dep" | sed -n -e "/^depends/ s/^depends:[ \t]*//p")
 	[ -z "$depends" ] && exit
 	for mod in ${depends//,/ }
 	do
@@ -45,14 +46,14 @@ find_depends()
 		[ -z "$match" ] && continue
 		# check if the module we are looking at is in mod-* too.
 		# if so we do not need to mark the dep as required.
-		mod2=${dep##*/}  # same as `basename $dep`, but faster
+		mod2=${dep##*/}  # same as $(basename $dep), but faster
 		match2=$(grep "^$mod2" "$ListName")
 		if [ -n "$match2" ]
 		then
 			#echo $mod2 >> notreq.list
 			continue
 		fi
-		echo $mod.ko >> req.list
+		echo "$mod".ko >> req.list
 	done
 }
 
@@ -60,11 +61,11 @@ foreachp()
 {
 	P=$(nproc)
 	bgcount=0
-	while read mod; do
+	while read -r mod; do
 		$1 "$mod" &
 
 		bgcount=$((bgcount + 1))
-		if [ $bgcount -eq $P ]; then
+		if [ $bgcount -eq "$P" ]; then
 			wait -n
 			bgcount=$((bgcount - 1))
 		fi
@@ -76,12 +77,12 @@ foreachp()
 # Destination was specified on the command line
 test -n "$4" && echo "$0: Override Destination $Dest has been specified."
 
-pushd $Dir
+pushd "$Dir"
 
-OverrideDir=$(basename $List)
+OverrideDir=$(basename "$List")
 OverrideDir=${OverrideDir%.*}
 OverrideDir=${OverrideDir#*-}
-mkdir -p $OverrideDir
+mkdir -p "$OverrideDir"
 
 rm -rf modnames
 find . -name "*.ko" -type f > modnames
@@ -94,7 +95,8 @@ cp "$List" .
 
 # This variable needs to be exported because it is used in sub-script
 # executed by xargs
-export ListName=$(basename "$List")
+ListName=$(basename "$List")
+export ListName
 
 foreachp find_depends < modnames
 
@@ -102,25 +104,25 @@ sort -u req.list > req2.list
 sort -u "$ListName" > modules2.list
 join -v 1 modules2.list req2.list > modules3.list
 
-for mod in $(cat modules3.list)
+while IFS= read -r mod
 do
-  # get the path for the module
-  modpath=`grep /$mod modnames`
-  [ -z "$modpath" ] && continue
-  echo $modpath >> dep.list
-done
+    # get the path for the module
+    modpath=$(grep /"$mod" modnames)
+    [ -z "$modpath" ] && continue
+    echo "$modpath" >> dep.list
+done < modules3.list
 
 sort -u dep.list > dep2.list
 
 if [ -n "$Dest" ]; then
-	# now move the modules into the $Dest directory
-	for mod in `cat dep2.list`
-	do
-	  newpath=`dirname $mod | sed -e "s/kernel\\//$Dest\//"`
-	  mkdir -p $newpath
-	  mv $mod $newpath
-	  echo $mod | sed -e "s/kernel\\//$Dest\//" | sed -e "s|^.|${ModDir}|g" >> $RpmDir/$ListName
-	done
+    # now move the modules into the $Dest directory
+    while IFS= read -r mod
+    do
+	newpath=$(dirname "$mod" | sed -e "s/kernel\\//$Dest\//")
+	mkdir -p "$newpath"
+	mv "$mod" "$newpath"
+	echo "$mod" | sed -e "s/kernel\\//$Dest\//" | sed -e "s|^.|${ModDir}|g" >> "$RpmDir"/"$ListName"
+    done < dep2.list
 fi
 
 popd
@@ -130,23 +132,33 @@ popd
 # target doesn't try to sign a non-existent file.  This is kinda ugly, but
 # so are the modules-* packages.
 
-for mod in `cat ${Dir}/dep2.list`
+while IFS= read -r mod
 do
-  modfile=`basename $mod | sed -e 's/.ko/.mod/'`
-  rm .tmp_versions/$modfile
-done
+  modfile=$(basename "$mod" | sed -e 's/.ko/.mod/')
+  rm .tmp_versions/"$modfile"
+done < "$Dir"/dep2.list
 
-if [ ! -n "$Dest" ]; then
-	sed -e "s|^.|${ModDir}|g" ${Dir}/dep2.list > $RpmDir/$ListName
+if [ -z "$Dest" ]; then
+	sed -e "s|^.|${ModDir}|g" "$Dir"/dep2.list > "$RpmDir/$ListName"
 	echo "./$RpmDir/$ListName created."
 	[ -d "$RpmDir/etc/modprobe.d/" ] || mkdir -p "$RpmDir/etc/modprobe.d/"
-	foreachp check_blacklist < $List
+	foreachp check_blacklist < "$List"
+fi
+
+# Many BIOS-es export a PNP-id which causes the floppy driver to autoload
+# even though most modern systems don't have a 3.5" floppy driver anymore
+# this replaces the old die_floppy_die.patch which removed the PNP-id from
+# the module
+
+floppylist=("$RpmDir"/"$ModDir"/kernel/drivers/block/floppy.ko*)
+if [[ -n ${floppylist[0]} && -f ${floppylist[0]} ]]; then
+     blacklist "floppy"
 fi
 
 # avoid an empty kernel-extra package
-echo "$ModDir/$OverrideDir" >> $RpmDir/$ListName
+echo "$ModDir/$OverrideDir" >> "$RpmDir/$ListName"
 
-pushd $Dir
+pushd "$Dir"
 rm modnames dep.list dep2.list req.list req2.list
 rm "$ListName" modules2.list modules3.list
 popd

SOURCES/mod-extra.list.rhel

@@ -2,8 +2,6 @@
 a3d.ko
 act200l-sir.ko
 actisys-sir.ko
-act_mpls.ko
-act_ct.ko
 adi.ko
 aer_inject.ko
 af_802154.ko
@@ -17,7 +15,6 @@ avm_cs.ko
 avmfritz.ko
 ax25.ko
 b1.ko
-bareudp.ko
 bas_gigaset.ko
 batman-adv.ko
 baycom_par.ko
@@ -72,7 +69,6 @@ iforce.ko
 interact.ko
 ipddp.ko
 ipx.ko
-ip_vs_mh.ko
 isdn.ko
 joydump.ko
 kingsun-sir.ko
@@ -83,6 +79,7 @@ l2tp_core.ko
 l2tp_debugfs.ko
 l2tp_eth.ko
 l2tp_ip.ko
+l2tp_ip6.ko
 l2tp_netlink.ko
 l2tp_ppp.ko
 lec.ko
@@ -124,11 +121,9 @@ rds_tcp.ko
 rose.ko
 sch_atm.ko
 sch_cbq.ko
-sch_cbs.ko
 sch_choke.ko
 sch_drr.ko
 sch_dsmark.ko
-sch_ets.ko
 sch_gred.ko
 sch_mqprio.ko
 sch_multiq.ko
@@ -139,6 +134,7 @@ sch_sfb.ko
 sch_teql.ko
 sctp.ko
 sctp_diag.ko
+sctp_probe.ko
 sidewinder.ko
 sja1000.ko
 sja1000_platform.ko
@@ -192,7 +188,6 @@ wanrouter.ko
 warrior.ko
 whci.ko
 wire.ko
-xpad.ko
-xt_u32.ko
+wwan_hwsim.ko
 yam.ko
 zhenhua.ko

SOURCES/mod-internal.list

@@ -12,14 +12,19 @@ property-entry-test
 qos-test
 resource_kunit
 soc-topology-test
+soc-utils-test
 string-stream-test
 test_linear_ranges
 test_bits
 test_kasan
+time_test
 fat_test
+lib_test
+rational-test
 test_list_sort
 slub_kunit
-memcpy_kunit
+kfence_test
+test_hash
 locktorture
 mac80211_hwsim
 netdevsim
@@ -27,8 +32,6 @@ pktgen
 rcutorture
 rocker
 scftorture
-torture
-test_bpf
 test_klp_atomic_replace
 test_klp_callbacks_demo
 test_klp_callbacks_demo2
@@ -39,6 +42,38 @@ test_klp_shadow_vars
 test_klp_state
 test_klp_state2
 test_klp_state3
+torture
+refscale
+rcuscale
+memcpy_kunit
+dev_addr_lists_test
+test_bpf
+stackinit_kunit
+overflow_kunit
+clk-gate_test
+clk_test
+mtty
 test_hmm
 test_vmalloc
-mtty
+test_sort
+cpumask_kunit
+iio-test-format
+iio-test-rescale
+cros_kunit
+cpumask_kunit
+drm_buddy_test
+drm_cmdline_parser_test
+drm_damage_helper_test
+drm_dp_mst_helper_test
+drm_format_helper_test
+drm_format_test
+drm_framebuffer_test
+drm_kunit_helpers
+drm_mm_test
+drm_plane_helper_test
+drm_rect_test
+gss_krb5_test
+drm_connector_test
+drm_managed_test
+drm_modes_test
+drm_probe_helper_test

SOURCES/mod-kvm.list

@@ -0,0 +1,5 @@
+kvm-amd
+kvm-intel
+kvm
+kvmgt
+ptp_kvm

SOURCES/mod-partner.list

@@ -0,0 +1,3 @@
+afs
+rxperf
+rxrpc

SOURCES/mod-sign.sh

@@ -2,7 +2,7 @@
 
 # The modules_sign target checks for corresponding .o files for every .ko that
 # is signed. This doesn't work for package builds which re-use the same build
-# directory for every flavour, and the .config may change between flavours.
+# directory for every variant, and the .config may change between variants.
 # So instead of using this script to just sign lib/modules/$KernelVer/extra,
 # sign all .ko in the buildroot.
 
@@ -13,9 +13,9 @@ MODSECKEY=$1
 MODPUBKEY=$2
 moddir=$3
 
-modules=`find $moddir -type f -name '*.ko'`
+modules=$(find "$moddir" -type f -name '*.ko')
 
-NPROC=`nproc`
+NPROC=$(nproc)
 [ -z "$NPROC" ] && NPROC=1
 
 # NB: this loop runs 2000+ iterations. Try to be fast.
@@ -27,7 +27,7 @@ done
 " DUMMYARG0   # xargs appends ARG1 ARG2..., which go into $mod in for loop.
 
 RANDOMMOD=$(echo "$modules" | sort -R | head -n 1)
-if [ "~Module signature appended~" != "$(tail -c 28 $RANDOMMOD)" ]; then
+if [ "~Module signature appended~" != "$(tail -c 28 "$RANDOMMOD")" ]; then
     echo "*****************************"
     echo "*** Modules are unsigned! ***"
     echo "*****************************"

SOURCES/parallel_xz.sh

@@ -23,4 +23,4 @@ test "$procgroup" = 1 && exec xargs -r xz
 # xz has some startup cost. If files are really small,
 # this cost might be significant. To combat this,
 # process several files (in sequence) by each xz process via -n 16:
-exec xargs -r -n 16 -P $procgroup xz
+exec xargs -r -n 16 -P "$procgroup" xz

SOURCES/partial-kgcov-snip.config

@@ -0,0 +1,5 @@
+# kgcov
+CONFIG_GCOV_KERNEL=y
+CONFIG_GCOV_PROFILE_ALL=y
+# CONFIG_GCOV_PROFILE_FTRACE is not set
+# CONFIG_OPEN_DICE is not set

SOURCES/process_configs.sh

@@ -3,14 +3,27 @@
 # This script takes the merged config files and processes them through oldconfig
 # and listnewconfig
 #
+# Globally disable suggestion of appending '|| exit' or '|| return' to cd/pushd/popd commands
+# shellcheck disable=SC2164
+
+test -n "$RHTEST" && exit 0
 
 usage()
 {
-	echo "process_configs.sh [ -n|-c|-t ] package_name kernel_version [cross_opts]"
-	echo "     -n: error on unset config options"
+	# alphabetical order please
+	echo "process_configs.sh [ options ] package_name kernel_version"
+	echo "     -a: report all errors, equivalent to [-c -n -w -i]"
 	echo "     -c: error on mismatched config options"
+	echo "     -i: continue on error"
+	echo "     -n: error on unset config options"
 	echo "     -t: test run, do not overwrite original config"
 	echo "     -w: error on misconfigured config options"
+	echo "     -z: commit new configs to pending directory"
+	echo ""
+	echo "     A special CONFIG file tag, process_configs_known_broken can be added as a"
+	echo "     comment to any CONFIG file.  This tag indicates that there is no way to "
+	echo "     fix a CONFIG's entry.  This tag should only be used in extreme cases"
+	echo "     and is not to be used as a workaround to solve CONFIG problems."
 	exit 1
 }
 
@@ -20,18 +33,27 @@ die()
 	exit 1
 }
 
+get_cross_compile()
+{
+	arch=$1
+	if [[ "$CC_IS_CLANG" -eq 1 ]]; then
+		echo "$arch"
+	else
+		echo "scripts/dummy-tools/"
+	fi
+}
+
 # stupid function to find top of tree to do kernel make configs
 switch_to_toplevel()
 {
 	path="$(pwd)"
 	while test -n "$path"
 	do
-		test -d $path/firmware && \
-			test -e $path/MAINTAINERS && \
-			test -d $path/drivers && \
+		test -e "$path"/MAINTAINERS && \
+			test -d "$path"/drivers && \
 			break
 
-		path="$(dirname $path)"
+		path=$(dirname "$path")
 	done
 
 	test -n "$path"  || die "Can't find toplevel"
@@ -40,6 +62,9 @@ switch_to_toplevel()
 
 checkoptions()
 {
+	count=$3
+	variant=$4
+
 	/usr/bin/awk '
 
 		/is not set/ {
@@ -62,114 +87,318 @@ checkoptions()
 					 print "Found "a[1]"="a[2]" after generation, had " a[1]"="configs[a[1]]" in Source tree";
 			}
 		}
-	' $1 $2 > .mismatches
+	' "$1" "$2" > .mismatches"${count}"
 
-	if test -s .mismatches
+	checkoptions_error=false
+	if test -s .mismatches"${count}"
 	then
-		echo "Error: Mismatches found in configuration files"
-		cat .mismatches
-		exit 1
+		while read -r LINE
+		do
+			if find "${REDHAT}"/configs -name "$(echo "$LINE" | awk -F "=" ' { print $1 } ' | awk ' { print $2 }')" -print0 | xargs -0 grep ^ | grep -q "process_configs_known_broken"; then
+				# This is a known broken config.
+				# See script help warning.
+				checkoptions_error=false
+			else
+				checkoptions_error=true
+				break
+			fi
+		done < .mismatches"${count}"
+
+		! $checkoptions_error && return
+
+		sed -i "1s/^/Error: Mismatches found in configuration files for ${arch} ${variant}\n/" .mismatches"${count}"
+	else
+		rm -f .mismatches"${count}"
 	fi
 }
 
+parsenewconfigs()
+{
+	tmpdir=$(mktemp -d)
+
+	# This awk script reads the output of make listnewconfig
+	# and puts it into CONFIG_FOO files. Using the output of
+	# listnewconfig is much easier to ensure we get the default
+	# output.
+        /usr/bin/awk -v BASE="$tmpdir" '
+                /is not set/ {
+                        split ($0, a, "#");
+                        split(a[2], b);
+                        OUT_FILE=BASE"/"b[1];
+                        print $0 >> OUT_FILE;
+                }
+
+                /=/     {
+                        split ($0, a, "=");
+                        OUT_FILE=BASE"/"a[1];
+                        if (a[2] == "n")
+                                print "# " a[1] " is not set" >> OUT_FILE;
+                        else
+                                print $0 >> OUT_FILE;
+                }
+
+        ' .newoptions
+
+	# This awk script parses the output of helpnewconfig.
+	# Each option is separated between ----- markers
+	# The goal is to put all the help text as a comment in
+	# each CONFIG_FOO file. Because of how awk works
+	# there's a lot of moving files around and catting to
+	# get what we need.
+        /usr/bin/awk -v BASE="$tmpdir" '
+                BEGIN { inpatch=0;
+			outfile="none";
+                        symbol="none"; }
+                /^Symbol: .*$/ {
+                        split($0, a, " ");
+                        symbol="CONFIG_"a[2];
+                        outfile=BASE "/fake_"symbol
+                }
+                /-----/ {
+			if (inpatch == 0) {
+				inpatch = 1;
+			}
+                        else {
+                                if (symbol != "none") {
+                                    system("cat " outfile " " BASE "/" symbol " > " BASE "/tmpf");
+                                    system("mv " BASE "/tmpf " BASE "/" symbol);
+                                    symbol="none"
+				}
+                                outfile="none"
+				inpatch = 0;
+                        }
+                }
+                !/-----/ {
+                        if (inpatch == 1 && outfile != "none") {
+                                print "# "$0 >> outfile;
+                        }
+                }
+
+
+        ' .helpnewconfig
+
+	pushd "$tmpdir" &> /dev/null
+	rm fake_*
+	popd &> /dev/null
+	for f in "$tmpdir"/*; do
+		[[ -e "$f" ]] || break
+		cp "$f" "$SCRIPT_DIR/pending$FLAVOR/generic/"
+	done
+
+	rm -rf "$tmpdir"
+}
+
+function commit_new_configs()
+{
+	# assume we are in $source_tree/configs, need to get to top level
+	pushd "$(switch_to_toplevel)" &>/dev/null
+
+	for cfg in "$SCRIPT_DIR/${PACKAGE_NAME}${KVERREL}"*.config
+	do
+		arch=$(head -1 "$cfg" | cut -b 3-)
+		cfgtmp="${cfg}.tmp"
+		cfgorig="${cfg}.orig"
+		cat "$cfg" > "$cfgorig"
+
+		if [ "$arch" = "EMPTY" ]
+		then
+			# This arch is intentionally left blank
+			continue
+		fi
+		echo -n "Checking for new configs in $cfg ... "
+
+		# shellcheck disable=SC2086
+		make ${MAKEOPTS} ARCH="$arch" CROSS_COMPILE="$(get_cross_compile "$arch")" KCONFIG_CONFIG="$cfgorig" listnewconfig >& .listnewconfig
+		grep -E 'CONFIG_' .listnewconfig > .newoptions
+		if test -s .newoptions
+		then
+		# shellcheck disable=SC2086
+			make ${MAKEOPTS} ARCH="$arch" CROSS_COMPILE="$(get_cross_compile "$arch")" KCONFIG_CONFIG="$cfgorig" helpnewconfig >& .helpnewconfig
+			parsenewconfigs
+		fi
+		rm .newoptions
+		echo "done"
+	done
+
+	git add "$SCRIPT_DIR/pending$FLAVOR"
+	git commit -m "[redhat] AUTOMATIC: New configs"
+}
+
+function process_config()
+{
+	local cfg
+	local arch
+	local cfgtmp
+	local cfgorig
+	local count
+	local variant
+
+	cfg=$1
+	count=$2
+
+	arch=$(head -1 "$cfg" | cut -b 3-)
+
+	if [ "$arch" = "EMPTY" ]
+	then
+		# This arch is intentionally left blank
+		return
+	fi
+
+	variant=$(basename "$cfg" | cut -d"-" -f3- | cut -d"." -f1)
+
+	cfgtmp="${cfg}.tmp"
+	cfgorig="${cfg}.orig"
+	cat "$cfg" > "$cfgorig"
+
+	echo "Processing $cfg ... "
+
+	# shellcheck disable=SC2086
+	make ${MAKEOPTS} ARCH="$arch" CROSS_COMPILE="$(get_cross_compile "$arch")" KCONFIG_CONFIG="$cfgorig" listnewconfig >& .listnewconfig"${count}"
+	grep -E 'CONFIG_' .listnewconfig"${count}" > .newoptions"${count}"
+	if test -n "$NEWOPTIONS" && test -s .newoptions"${count}"
+	then
+		echo "Found unset config items in ${arch} ${variant}, please set them to an appropriate value" >> .errors"${count}"
+		cat .newoptions"${count}" >> .errors"${count}"
+		rm .newoptions"${count}"
+		RETURNCODE=1
+	fi
+	rm -f .newoptions"${count}"
+
+	grep -E 'config.*warning' .listnewconfig"${count}" > .warnings"${count}"
+	if test -n "$CHECKWARNINGS" && test -s .warnings"${count}"
+	then
+		echo "Found misconfigured config items in ${arch} ${variant}, please set them to an appropriate value" >> .errors"${count}"
+		cat .warnings"${count}" >> .errors"${count}"
+	fi
+	rm .warnings"${count}"
+
+	rm .listnewconfig"${count}"
+
+	# shellcheck disable=SC2086
+	make ${MAKEOPTS} ARCH="$arch" CROSS_COMPILE="$(get_cross_compile "$arch")" KCONFIG_CONFIG="$cfgorig" olddefconfig > /dev/null || exit 1
+	echo "# $arch" > "$cfgtmp"
+	cat "$cfgorig" >> "$cfgtmp"
+	if test -n "$CHECKOPTIONS"
+	then
+		checkoptions "$cfg" "$cfgtmp" "$count" "$variant"
+	fi
+	# if test run, don't overwrite original
+	if test -n "$TESTRUN"
+	then
+		rm -f "$cfgtmp"
+	else
+		mv "$cfgtmp" "$cfg"
+	fi
+	rm -f "$cfgorig"
+	echo "Processing $cfg complete"
+}
+
 function process_configs()
 {
 	# assume we are in $source_tree/configs, need to get to top level
-	pushd $(switch_to_toplevel) &>/dev/null
+	pushd "$(switch_to_toplevel)" &>/dev/null
 
-	for cfg in $SCRIPT_DIR/${PACKAGE_NAME}${KVERREL}*.config
+	# The next line is throwaway code for transition to parallel
+	# processing.  Leaving this line in place is harmless, but it can be
+	# removed the next time anyone updates this function.
+	[ -f .mismatches ] && rm -f .mismatches
+
+	count=0
+	for cfg in "$SCRIPT_DIR/${PACKAGE_NAME}${KVERREL}"*.config
 	do
-		arch=$(head -1 $cfg | cut -b 3-)
-		cfgtmp="${cfg}.tmp"
-		cfgorig="${cfg}.orig"
-		cat $cfg > $cfgorig
-
-		echo -n "Processing $cfg ... "
-
-		make ARCH=$arch ${CROSSOPTS} KCONFIG_CONFIG=$cfgorig listnewconfig >& .listnewconfig
-		grep -E 'CONFIG_' .listnewconfig > .newoptions
-		if test -n "$NEWOPTIONS" && test -s .newoptions
-		then
-			echo "Found unset config items, please set them to an appropriate value"
-			cat .newoptions
-			rm .newoptions
-			exit 1
+		if [ "$count" -eq 0 ]; then
+			# do the first one by itself so that tools are built
+			process_config "$cfg" "$count"
 		fi
-		rm .newoptions
-
-		grep -E 'config.*warning' .listnewconfig > .warnings
-		if test -n "$CHECKWARNINGS" && test -s .warnings
-		then
-			echo "Found misconfigured config items, please set them to an appropriate value"
-			cat .warnings
-			rm .warnings
-			exit 1
-		fi
-		rm .warnings
-
-		rm .listnewconfig
-
-		make ARCH=$arch ${CROSSOPTS} KCONFIG_CONFIG=$cfgorig oldnoconfig > /dev/null || exit 1
-		echo "# $arch" > ${cfgtmp}
-		cat "${cfgorig}" >> ${cfgtmp}
-		if test -n "$CHECKOPTIONS"
-		then
-			checkoptions $cfg $cfgtmp
-		fi
-		# if test run, don't overwrite original
-		if test -n "$TESTRUN"
-		then
-			rm ${cfgtmp}
-		else
-			mv ${cfgtmp} ${cfg}
-		fi
-		rm ${cfgorig}
-		echo "done"
+		process_config "$cfg" "$count" &
+		waitpids[${count}]=$!
+		((count++))
+		while [ "$(jobs | grep -c Running)" -ge "$RHJOBS" ]; do :; done
 	done
+	for pid in ${waitpids[*]}; do
+		wait ${pid}
+	done
+
 	rm "$SCRIPT_DIR"/*.config*.old
+
+	if ls .errors* 1> /dev/null 2>&1; then
+		RETURNCODE=1
+		cat .errors*
+		rm .errors* -f
+	fi
+	if ls .mismatches* 1> /dev/null 2>&1; then
+		RETURNCODE=1
+		cat .mismatches*
+		rm .mismatches* -f
+	fi
+
 	popd > /dev/null
 
-	echo "Processed config files are in $SCRIPT_DIR"
+	[ $RETURNCODE -eq 0 ] && echo "Processed config files are in $SCRIPT_DIR"
 }
 
-NEWOPTIONS=""
 CHECKOPTIONS=""
-CHECKWARNINGS=""
+NEWOPTIONS=""
 TESTRUN=""
+CHECKWARNINGS=""
+MAKEOPTS=""
+CC_IS_CLANG=0
+
+RETURNCODE=0
 
 while [[ $# -gt 0 ]]
 do
 	key="$1"
 	case $key in
+		-a)
+			CHECKOPTIONS="x"
+			NEWOPTIONS="x"
+			CHECKWARNINGS="x"
+			;;
+		-c)
+			CHECKOPTIONS="x"
+			;;
 		-h)
 			usage
 			;;
 		-n)
 			NEWOPTIONS="x"
 			;;
-		-c)
-			CHECKOPTIONS="x"
-			;;
 		-t)
 			TESTRUN="x"
 			;;
 		-w)
 			CHECKWARNINGS="x"
 			;;
+		-z)
+			COMMITNEWCONFIGS="x"
+			;;
+		-m)
+			shift
+			if [ "$1" = "CC=clang" ] || [ "$1" = "LLVM=1" ]; then
+				CC_IS_CLANG=1
+			fi
+			MAKEOPTS="$MAKEOPTS $1"
+			;;
 		*)
 			break;;
 	esac
 	shift
 done
 
-PACKAGE_NAME="${1:-kernel}" # defines the package name used
-KVERREL="$(test -n "$2" && echo "-$2" || echo "")"
-CROSSOPTS="$3"
-SCRIPT="$(readlink -f $0)"
-OUTPUT_DIR="$PWD"
-SCRIPT_DIR="$(dirname $SCRIPT)"
+KVERREL="$(test -n "$1" && echo "-$1" || echo "")"
+FLAVOR="$(test -n "$2" && echo "-$2" || echo "-rhel")"
+# shellcheck disable=SC2015
+SCRIPT=$(readlink -f "$0")
+SCRIPT_DIR=$(dirname "$SCRIPT")
 
 # to handle this script being a symlink
-cd $SCRIPT_DIR
+cd "$SCRIPT_DIR"
 
-process_configs
+if test -n "$COMMITNEWCONFIGS"; then
+	commit_new_configs
+else
+	process_configs
+fi
+
+exit $RETURNCODE

SOURCES/rpminspect.yaml

@@ -3,19 +3,11 @@
 ---
 inspections:
     abidiff: off
-    addedfiles: off
-    badfuncs: off
-    changedfiles: off
     kmidiff: off
-    kmod: off
-    manpage: off
-    movedfiles: off
-    permissions: off
-    removedfiles: off
-    rpmdeps: off
     upstream: off
+    subpackages: off
 
-elf:
+badfuncs:
     ignore:
         - /usr/libexec/ksamples/*
         - /usr/libexec/kselftests/*
@@ -24,13 +16,30 @@ emptyrpm:
     expected_empty:
         - kernel
         - kernel-debug
+        - kernel-debug-devel-matched
+        - kernel-devel-matched
+        - kernel-lpae
         - kernel-zfcpdump
+        - kernel-zfcpdump-devel-matched
         - kernel-zfcpdump-modules
 
 patches:
     ignore_list:
         - linux-kernel-test.patch
+        - patch-5.14-redhat.patch
+        - patch-%{patchversion}-redhat.patch
 
-types:
+runpath:
     ignore:
-        - /usr/src/kernel/*
+        - /usr/libexec/kselftests/bpf/urandom_read
+        - /usr/libexec/kselftests/bpf/no_alu32/urandom_read
+
+debuginfo:
+    ignore:
+        - /usr/libexec/kselftests/bpf/*
+        - /usr/lib/debug/usr/libexec/perf-core/tests/shell/coresight/*
+
+elf:
+    ignore:
+        - /usr/libexec/perf-core/tests/shell/coresight/*
+        - /usr/lib/debug/usr/libexec/perf-core/tests/shell/coresight/*

SOURCES/update_scripts.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+
+if [ -z "$1" ]; then
+	exit 1
+fi
+
+TARGET="$1"
+
+for i in "$RPM_SOURCE_DIR"/*."$TARGET"; do
+	NEW=${i%.$TARGET}
+	cp "$i" "$(basename "$NEW")"
+done

SOURCES/x509.genkey.rhel

@@ -0,0 +1,16 @@
+[ req ]
+default_bits = 3072
+distinguished_name = req_distinguished_name
+prompt = no
+x509_extensions = myexts
+
+[ req_distinguished_name ]
+O = AlmaLinux
+CN = AlmaLinux kernel signing key
+emailAddress = security@almalinux.org
+
+[ myexts ]
+basicConstraints=critical,CA:FALSE
+keyUsage=digitalSignature
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid