kernel-6.17.0-0.rc4.36

* Mon Sep 01 2025 Fedora Kernel Team <kernel-team@fedoraproject.org> [6.17.0-0.rc4.36] - soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson) - arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: add Bluetooth support (Jens Glathe) - ALSA HDA driver configuration split for 6.17 upstream (Jaroslav Kysela) - redhat/configs: clang_lto: disable CONFIG_FORTIFY_KUNIT_TEST (Scott Weaver) Resolves: Signed-off-by: Justin M. Forbes <jforbes@fedoraproject.org>
2025-09-01 08:45:19 -06:00 · 2025-09-01 08:45:19 -06:00 · b8397be1bd
commit b8397be1bd
parent 8b5fd9c126
25 changed files with 193 additions and 132 deletions
--- a/Makefile.rhelver
+++ b/Makefile.rhelver
@ -12,7 +12,7 @@ RHEL_MINOR = 99
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 32
+RHEL_RELEASE = 36

 #
 # RHEL_REBASE_NUM
--- a/Patchlist.changelog
+++ b/Patchlist.changelog
@ -1,8 +1,8 @@
-https://gitlab.com/cki-project/kernel-ark/-/commit/12a0a1aa75131b5b8c698499edd7d42b8047f431
- 12a0a1aa75131b5b8c698499edd7d42b8047f431 soc: qcom: mdt_loader: Deal with zero e_shentsize
+https://gitlab.com/cki-project/kernel-ark/-/commit/7dd892092a085d040d2f2106dbbbac797f3b39c1
+ 7dd892092a085d040d2f2106dbbbac797f3b39c1 soc: qcom: mdt_loader: Deal with zero e_shentsize

-https://gitlab.com/cki-project/kernel-ark/-/commit/b7b8850954e3ee6b35e89767ecfd5b0637c39bb6
- b7b8850954e3ee6b35e89767ecfd5b0637c39bb6 arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: add Bluetooth support
+https://gitlab.com/cki-project/kernel-ark/-/commit/c19e7b67c48d99f47c167faaa9c4b221233128b3
+ c19e7b67c48d99f47c167faaa9c4b221233128b3 arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: add Bluetooth support

 https://gitlab.com/cki-project/kernel-ark/-/commit/b9bf2d814fccb1676c09d2d85d965321be542783
 b9bf2d814fccb1676c09d2d85d965321be542783 arm64: add early lockdown for secure boot
--- a/kernel-aarch64-16k-debug-fedora.config
+++ b/kernel-aarch64-16k-debug-fedora.config
@ -4447,7 +4447,7 @@ CONFIG_LOCKDEP_CIRCULAR_QUEUE_BITS=12
 CONFIG_LOCKDEP_STACK_TRACE_BITS=19
 CONFIG_LOCKDEP_STACK_TRACE_HASH_BITS=14
 CONFIG_LOCKD=m
-# CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT is not set
+CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
 CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
--- a/kernel-aarch64-16k-fedora.config
+++ b/kernel-aarch64-16k-fedora.config
@ -4422,7 +4422,7 @@ CONFIG_LOCKDEP_CIRCULAR_QUEUE_BITS=12
 CONFIG_LOCKDEP_STACK_TRACE_BITS=19
 CONFIG_LOCKDEP_STACK_TRACE_HASH_BITS=14
 CONFIG_LOCKD=m
-# CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT is not set
+CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
 CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
--- a/kernel-aarch64-64k-debug-rhel.config
+++ b/kernel-aarch64-64k-debug-rhel.config
@ -3611,7 +3611,7 @@ CONFIG_LOCKDEP_CIRCULAR_QUEUE_BITS=12
 CONFIG_LOCKDEP_STACK_TRACE_BITS=20
 CONFIG_LOCKDEP_STACK_TRACE_HASH_BITS=14
 CONFIG_LOCKD=m
-# CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT is not set
+CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
 CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
--- a/kernel-aarch64-64k-rhel.config
+++ b/kernel-aarch64-64k-rhel.config
@ -3590,7 +3590,7 @@ CONFIG_LOCKDEP_CIRCULAR_QUEUE_BITS=12
 CONFIG_LOCKDEP_STACK_TRACE_BITS=19
 CONFIG_LOCKDEP_STACK_TRACE_HASH_BITS=14
 CONFIG_LOCKD=m
-# CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT is not set
+CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
 CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
--- a/kernel-aarch64-debug-fedora.config
+++ b/kernel-aarch64-debug-fedora.config
@ -4447,7 +4447,7 @@ CONFIG_LOCKDEP_CIRCULAR_QUEUE_BITS=12
 CONFIG_LOCKDEP_STACK_TRACE_BITS=19
 CONFIG_LOCKDEP_STACK_TRACE_HASH_BITS=14
 CONFIG_LOCKD=m
-# CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT is not set
+CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
 CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
--- a/kernel-aarch64-debug-rhel.config
+++ b/kernel-aarch64-debug-rhel.config
@ -3609,7 +3609,7 @@ CONFIG_LOCKDEP_CIRCULAR_QUEUE_BITS=12
 CONFIG_LOCKDEP_STACK_TRACE_BITS=20
 CONFIG_LOCKDEP_STACK_TRACE_HASH_BITS=14
 CONFIG_LOCKD=m
-# CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT is not set
+CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
 CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
--- a/kernel-aarch64-fedora.config
+++ b/kernel-aarch64-fedora.config
@ -4422,7 +4422,7 @@ CONFIG_LOCKDEP_CIRCULAR_QUEUE_BITS=12
 CONFIG_LOCKDEP_STACK_TRACE_BITS=19
 CONFIG_LOCKDEP_STACK_TRACE_HASH_BITS=14
 CONFIG_LOCKD=m
-# CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT is not set
+CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
 CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
--- a/kernel-aarch64-rhel.config
+++ b/kernel-aarch64-rhel.config
@ -3588,7 +3588,7 @@ CONFIG_LOCKDEP_CIRCULAR_QUEUE_BITS=12
 CONFIG_LOCKDEP_STACK_TRACE_BITS=19
 CONFIG_LOCKDEP_STACK_TRACE_HASH_BITS=14
 CONFIG_LOCKD=m
-# CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT is not set
+CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
 CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
--- a/kernel-aarch64-rt-64k-debug-fedora.config
+++ b/kernel-aarch64-rt-64k-debug-fedora.config
@ -4455,7 +4455,7 @@ CONFIG_LOCKDEP_CIRCULAR_QUEUE_BITS=13
 CONFIG_LOCKDEP_STACK_TRACE_BITS=19
 CONFIG_LOCKDEP_STACK_TRACE_HASH_BITS=14
 CONFIG_LOCKD=m
-# CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT is not set
+CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
 CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
--- a/kernel-aarch64-rt-64k-debug-rhel.config
+++ b/kernel-aarch64-rt-64k-debug-rhel.config
@ -3653,7 +3653,7 @@ CONFIG_LOCKDEP_CIRCULAR_QUEUE_BITS=13
 CONFIG_LOCKDEP_STACK_TRACE_BITS=20
 CONFIG_LOCKDEP_STACK_TRACE_HASH_BITS=14
 CONFIG_LOCKD=m
-# CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT is not set
+CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
 CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
--- a/kernel-aarch64-rt-64k-fedora.config
+++ b/kernel-aarch64-rt-64k-fedora.config
@ -4430,7 +4430,7 @@ CONFIG_LOCKDEP_CIRCULAR_QUEUE_BITS=12
 CONFIG_LOCKDEP_STACK_TRACE_BITS=19
 CONFIG_LOCKDEP_STACK_TRACE_HASH_BITS=14
 CONFIG_LOCKD=m
-# CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT is not set
+CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
 CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
--- a/kernel-aarch64-rt-64k-rhel.config
+++ b/kernel-aarch64-rt-64k-rhel.config
@ -3632,7 +3632,7 @@ CONFIG_LOCKDEP_CIRCULAR_QUEUE_BITS=12
 CONFIG_LOCKDEP_STACK_TRACE_BITS=19
 CONFIG_LOCKDEP_STACK_TRACE_HASH_BITS=14
 CONFIG_LOCKD=m
-# CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT is not set
+CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
 CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
--- a/kernel-aarch64-rt-debug-fedora.config
+++ b/kernel-aarch64-rt-debug-fedora.config
@ -4452,7 +4452,7 @@ CONFIG_LOCKDEP_CIRCULAR_QUEUE_BITS=13
 CONFIG_LOCKDEP_STACK_TRACE_BITS=19
 CONFIG_LOCKDEP_STACK_TRACE_HASH_BITS=14
 CONFIG_LOCKD=m
-# CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT is not set
+CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
 CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
--- a/kernel-aarch64-rt-debug-rhel.config
+++ b/kernel-aarch64-rt-debug-rhel.config
@ -3650,7 +3650,7 @@ CONFIG_LOCKDEP_CIRCULAR_QUEUE_BITS=13
 CONFIG_LOCKDEP_STACK_TRACE_BITS=20
 CONFIG_LOCKDEP_STACK_TRACE_HASH_BITS=14
 CONFIG_LOCKD=m
-# CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT is not set
+CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
 CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
--- a/kernel-aarch64-rt-fedora.config
+++ b/kernel-aarch64-rt-fedora.config
@ -4427,7 +4427,7 @@ CONFIG_LOCKDEP_CIRCULAR_QUEUE_BITS=12
 CONFIG_LOCKDEP_STACK_TRACE_BITS=19
 CONFIG_LOCKDEP_STACK_TRACE_HASH_BITS=14
 CONFIG_LOCKD=m
-# CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT is not set
+CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
 CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
--- a/kernel-aarch64-rt-rhel.config
+++ b/kernel-aarch64-rt-rhel.config
@ -3629,7 +3629,7 @@ CONFIG_LOCKDEP_CIRCULAR_QUEUE_BITS=12
 CONFIG_LOCKDEP_STACK_TRACE_BITS=19
 CONFIG_LOCKDEP_STACK_TRACE_HASH_BITS=14
 CONFIG_LOCKD=m
-# CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT is not set
+CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
 # CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
 CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
--- a/kernel.changelog
+++ b/kernel.changelog
@ -1,10 +1,35 @@
-* Tue Aug 26 2025 Fedora Kernel Team <kernel-team@fedoraproject.org> [6.17.0-0.rc3.fab1beda7597.32]
+* Mon Sep 01 2025 Fedora Kernel Team <kernel-team@fedoraproject.org> [6.17.0-0.rc4.36]
 - soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
 - arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: add Bluetooth support (Jens Glathe)
 - ALSA HDA driver configuration split for 6.17 upstream (Jaroslav Kysela)
 - redhat/configs: clang_lto: disable CONFIG_FORTIFY_KUNIT_TEST (Scott Weaver)
 Resolves: 

+* Mon Sep 01 2025 Fedora Kernel Team <kernel-team@fedoraproject.org> [6.17.0-0.rc4.35]
+- redhat: export only selected variables (Jan Stancek)
+- Linux v6.17.0-0.rc4
+Resolves: 
+
+* Sun Aug 31 2025 Fedora Kernel Team <kernel-team@fedoraproject.org> [6.17.0-0.rc3.c8bc81a52d5a.34]
+- Linux v6.17.0-0.rc3.c8bc81a52d5a
+Resolves: 
+
+* Sat Aug 30 2025 Fedora Kernel Team <kernel-team@fedoraproject.org> [6.17.0-0.rc3.11e7861d680c.33]
+- Linux v6.17.0-0.rc3.11e7861d680c
+Resolves: 
+
+* Fri Aug 29 2025 Fedora Kernel Team <kernel-team@fedoraproject.org> [6.17.0-0.rc3.07d9df80082b.32]
+- gitlab-ci: set HOME in maintenance jobs (Tales da Aparecida)
+- gitlab-ci: remove fetch of linux-rt-devel (Scott Weaver)
+- redhat/Makefile: auto select -z-test-pesign target for z-stream (Jan Stancek)
+- redhat/configs: Move RHEL/Fedora lockdown configs to common (Jeremy Cline)
+- Enable building libcpupower bindings for ELN/Rawhide (John B. Wyatt IV)
+- redhat: Explicitly disable 'hostonly' mode on the dracut cmdline (Vitaly Kuznetsov)
+- redhat: Directly use 'ukify' for building the UKI (Vitaly Kuznetsov)
+- redhat: Temporary stop adding 'kernel' component to SBAT (Vitaly Kuznetsov)
+- Linux v6.17.0-0.rc3.07d9df80082b
+Resolves: 
+
 * Tue Aug 26 2025 Fedora Kernel Team <kernel-team@fedoraproject.org> [6.17.0-0.rc3.fab1beda7597.31]
 - Linux v6.17.0-0.rc3.fab1beda7597
 Resolves: 
--- a/kernel.sbat.template
+++ b/kernel.sbat.template
@ -1,3 +1,2 @@
 sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
-kernel,1,Red Hat,kernel-core,@KVER,mailto:secalert@redhat.com
 kernel.@SBAT_SUFFIX,1,Red Hat,kernel-core,@KVER,mailto:secalert@redhat.com
--- a/kernel.spec
+++ b/kernel.spec
@ -176,13 +176,13 @@ Summary: The Linux kernel
 %define specrpmversion 6.17.0
 %define specversion 6.17.0
 %define patchversion 6.17
-%define pkgrelease 0.rc3.250826gfab1beda7597.32
+%define pkgrelease 0.rc4.36
 %define kversion 6
-%define tarfile_release 6.17-rc3-11-gfab1beda7597
+%define tarfile_release 6.17-rc4
 # This is needed to do merge window version magic
 %define patchlevel 17
 # This allows pkg_release to have configurable %%{?dist} tag
-%define specrelease 0.rc3.250826gfab1beda7597.32%{?buildid}%{?dist}
+%define specrelease 0.rc4.36%{?buildid}%{?dist}
 # This defines the kabi tarball version
 %define kabiversion 6.17.0

@ -808,6 +808,11 @@ BuildRequires: libbpf-devel
 BuildRequires: bpftool
 BuildRequires: clang

+%ifarch %{cpupowerarchs}
+# For libcpupower bindings
+BuildRequires: swig
+%endif
+
 %ifnarch s390x
 BuildRequires: pciutils-devel
 %endif
@ -1050,6 +1055,8 @@ Source77: partial-clang_lto-aarch64-debug-snip.config
 Source80: generate_all_configs.sh
 Source81: process_configs.sh

+Source83: uki.sbat.template
+Source84: uki-addons.sbat.template
 Source85: kernel.sbat.template

 Source86: dracut-virt.conf
@ -2042,6 +2049,8 @@ rm -f localversion-next localversion-rt
 	scripts/clang-tools 2> /dev/null

 # SBAT data
+sed -e s,@KVER,%{KVERREL}, -e s,@SBAT_SUFFIX,%{sbat_suffix}, %{SOURCE83} > uki.sbat
+sed -e s,@KVER,%{KVERREL}, -e s,@SBAT_SUFFIX,%{sbat_suffix}, %{SOURCE84} > uki-addons.sbat
 sed -e s,@KVER,%{KVERREL}, -e s,@SBAT_SUFFIX,%{sbat_suffix}, %{SOURCE85} > kernel.sbat

 # only deal with configs if we are going to build for the arch
@ -2794,38 +2803,30 @@ BuildKernel() {
    else
 %if %{with_efiuki}
        %{log_msg "Setup the EFI UKI kernel"}
-
-        SBAT=$(cat <<- EOF
-	kernel-uki-virt.%{sbat_suffix},1,Red Hat,kernel-uki-virt,$KernelVer,mailto:secalert@redhat.com
-	EOF
-	)
-
-        ADDONS_SBAT=$(cat <<- EOF
-	sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
-	kernel-uki-virt-addons.$SBATsuffix,1,Red Hat,kernel-uki-virt-addons,$KernelVer,mailto:secalert@redhat.com
-	EOF
-	)
-
 	KernelUnifiedImageDir="$RPM_BUILD_ROOT/lib/modules/$KernelVer"
    	KernelUnifiedImage="$KernelUnifiedImageDir/$InstallName-virt.efi"
+	KernelUnifiedInitrd="$KernelUnifiedImageDir/$InstallName-virt.img"

    	mkdir -p $KernelUnifiedImageDir

    	dracut --conf=%{SOURCE86} \
           --confdir=$(mktemp -d) \
+           --no-hostonly \
           --verbose \
           --kver "$KernelVer" \
           --kmoddir "$RPM_BUILD_ROOT/lib/modules/$KernelVer/" \
           --logfile=$(mktemp) \
-           --uefi \
-           --sbat "$SBAT" \
-           --kernel-image $(realpath $KernelImage) \
-           --kernel-cmdline 'console=tty0 console=ttyS0' \
-	   $KernelUnifiedImage
+	   $KernelUnifiedInitrd
+
+	ukify build --linux $(realpath $KernelImage) --initrd $KernelUnifiedInitrd \
+	   --sbat @uki.sbat --os-release @/etc/os-release --uname $KernelVer \
+	   --cmdline 'console=tty0 console=ttyS0' --output $KernelUnifiedImage
+
+	rm -f $KernelUnifiedInitrd

  KernelAddonsDirOut="$KernelUnifiedImage.extra.d"
  mkdir -p $KernelAddonsDirOut
-  python3 %{SOURCE151} %{SOURCE152} $KernelAddonsDirOut virt %{primary_target} %{_target_cpu} "$ADDONS_SBAT"
+  python3 %{SOURCE151} %{SOURCE152} $KernelAddonsDirOut virt %{primary_target} %{_target_cpu} @uki-addons.sbat

 %if %{signkernel}
 	%{log_msg "Sign the EFI UKI kernel"}
@ -3163,6 +3164,8 @@ chmod +x tools/perf/check-headers.sh
 %ifarch %{cpupowerarchs}
    # link against in-tree libcpupower for idle state support
    %global rtla_make %{tools_make} LDFLAGS="%{__global_ldflags} -L../../power/cpupower" INCLUDES="-I../../power/cpupower/lib"
+    # Build libcpupower Python bindings
+    %global libcpupower_python_bindings_make %{tools_make} LDFLAGS="-L%{buildroot}%{_libdir} -lcpupower"
 %else
    %global rtla_make %{tools_make}
 %endif
@ -3538,6 +3541,12 @@ mv cpupower.lang ../
    popd
 %endif
 chmod 0755 %{buildroot}%{_libdir}/libcpupower.so*
+%{log_msg "Build libcpupower Python bindings"}
+pushd tools/power/cpupower/bindings/python
+%{libcpupower_python_bindings_make}
+%{log_msg "Install libcpupower Python bindings"}
+%{make} INSTALL_DIR=$RPM_BUILD_ROOT%{python3_sitearch} install
+popd
 %endif
 %ifarch x86_64
   mkdir -p %{buildroot}%{_mandir}/man8
@ -4175,6 +4184,9 @@ fi\
 %{_includedir}/cpufreq.h
 %{_includedir}/cpuidle.h
 %{_includedir}/powercap.h
+# libcpupower Python bindings
+%{python3_sitearch}/_raw_pylibcpupower.so
+%{python3_sitearch}/raw_pylibcpupower.py
 %endif
 %if %{with_ynl}
 %{_libdir}/libynl*
@ -4383,12 +4395,33 @@ fi\
 #
 #
 %changelog
-* Tue Aug 26 2025 Fedora Kernel Team <kernel-team@fedoraproject.org> [6.17.0-0.rc3.fab1beda7597.32]
+* Mon Sep 01 2025 Fedora Kernel Team <kernel-team@fedoraproject.org> [6.17.0-0.rc4.36]
 - soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
 - arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: add Bluetooth support (Jens Glathe)
 - ALSA HDA driver configuration split for 6.17 upstream (Jaroslav Kysela)
 - redhat/configs: clang_lto: disable CONFIG_FORTIFY_KUNIT_TEST (Scott Weaver)

+* Mon Sep 01 2025 Fedora Kernel Team <kernel-team@fedoraproject.org> [6.17.0-0.rc4.35]
+- redhat: export only selected variables (Jan Stancek)
+- Linux v6.17.0-0.rc4
+
+* Sun Aug 31 2025 Fedora Kernel Team <kernel-team@fedoraproject.org> [6.17.0-0.rc3.c8bc81a52d5a.34]
+- Linux v6.17.0-0.rc3.c8bc81a52d5a
+
+* Sat Aug 30 2025 Fedora Kernel Team <kernel-team@fedoraproject.org> [6.17.0-0.rc3.11e7861d680c.33]
+- Linux v6.17.0-0.rc3.11e7861d680c
+
+* Fri Aug 29 2025 Fedora Kernel Team <kernel-team@fedoraproject.org> [6.17.0-0.rc3.07d9df80082b.32]
+- gitlab-ci: set HOME in maintenance jobs (Tales da Aparecida)
+- gitlab-ci: remove fetch of linux-rt-devel (Scott Weaver)
+- redhat/Makefile: auto select -z-test-pesign target for z-stream (Jan Stancek)
+- redhat/configs: Move RHEL/Fedora lockdown configs to common (Jeremy Cline)
+- Enable building libcpupower bindings for ELN/Rawhide (John B. Wyatt IV)
+- redhat: Explicitly disable 'hostonly' mode on the dracut cmdline (Vitaly Kuznetsov)
+- redhat: Directly use 'ukify' for building the UKI (Vitaly Kuznetsov)
+- redhat: Temporary stop adding 'kernel' component to SBAT (Vitaly Kuznetsov)
+- Linux v6.17.0-0.rc3.07d9df80082b
+
 * Tue Aug 26 2025 Fedora Kernel Team <kernel-team@fedoraproject.org> [6.17.0-0.rc3.fab1beda7597.31]
 - Linux v6.17.0-0.rc3.fab1beda7597

--- a/patch-6.17-redhat.patch
+++ b/patch-6.17-redhat.patch
@ -85,7 +85,7 @@
 84 files changed, 2913 insertions(+), 248 deletions(-)

 diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
-index 747a55abf494..75f583e28d1d 100644
+index 747a55abf4946..75f583e28d1d5 100644
 --- a/Documentation/admin-guide/kernel-parameters.txt
 +++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -6389,6 +6389,17 @@
@ -124,7 +124,7 @@ index 747a55abf494..75f583e28d1d 100644
 			useful for debugging certain unwinder error
 diff --git a/Documentation/admin-guide/rh-waived-features.rst b/Documentation/admin-guide/rh-waived-features.rst
 new file mode 100644
-index 000000000000..45caec7fbae6
+index 0000000000000..45caec7fbae64
 --- /dev/null
 +++ b/Documentation/admin-guide/rh-waived-features.rst
@@ -0,0 +1,21 @@
@ -150,7 +150,7 @@ index 000000000000..45caec7fbae6
 +===============================
 +
 diff --git a/Kconfig b/Kconfig
-index 307e581144de..11e93e479ce4 100644
+index 307e581144de3..11e93e479ce4f 100644
 --- a/Kconfig
 +++ b/Kconfig
@@ -32,3 +32,5 @@ source "lib/Kconfig.debug"
@ -161,7 +161,7 @@ index 307e581144de..11e93e479ce4 100644
 +source "Kconfig.redhat"
 diff --git a/Kconfig.redhat b/Kconfig.redhat
 new file mode 100644
-index 000000000000..85771d74c34f
+index 0000000000000..85771d74c34f9
 --- /dev/null
 +++ b/Kconfig.redhat
@@ -0,0 +1,31 @@
@ -197,7 +197,7 @@ index 000000000000..85771d74c34f
 +
 +endmenu
 diff --git a/Makefile b/Makefile
-index 06c28b1d7e67..904627c3726b 100644
+index b9c6619132504..d7f4280cd12a3 100644
 --- a/Makefile
 +++ b/Makefile
@@ -355,6 +355,17 @@ ifneq ($(filter install,$(MAKECMDGOALS)),)
@ -267,7 +267,7 @@ index 06c28b1d7e67..904627c3726b 100644
 	@:
 
 diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
-index b1f3df39ed40..5e1c1169e27e 100644
+index b1f3df39ed406..5e1c1169e27e5 100644
 --- a/arch/arm/Kconfig
 +++ b/arch/arm/Kconfig
@@ -1230,9 +1230,9 @@ config HIGHMEM
@ -283,7 +283,7 @@ index b1f3df39ed40..5e1c1169e27e 100644
 	  The VM uses one page of physical memory for each page table.
 	  For systems with a lot of processes, this can use a lot of
 diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
-index e9bbfacc35a6..59f8e55f3ec0 100644
+index e9bbfacc35a64..59f8e55f3ec0e 100644
 --- a/arch/arm64/Kconfig
 +++ b/arch/arm64/Kconfig
@@ -1429,7 +1429,7 @@ endchoice
@ -296,7 +296,7 @@ index e9bbfacc35a6..59f8e55f3ec0 100644
 	  For systems with 52-bit userspace VAs enabled, the kernel will attempt
 	  to maintain compatibility with older software by providing 48-bit VAs
 diff --git a/arch/arm64/boot/dts/qcom/x1e80100-lenovo-yoga-slim7x.dts b/arch/arm64/boot/dts/qcom/x1e80100-lenovo-yoga-slim7x.dts
-index dad0f11e8e85..d02f8d4f7baf 100644
+index dad0f11e8e858..d02f8d4f7baf0 100644
 --- a/arch/arm64/boot/dts/qcom/x1e80100-lenovo-yoga-slim7x.dts
 +++ b/arch/arm64/boot/dts/qcom/x1e80100-lenovo-yoga-slim7x.dts
@@ -18,6 +18,7 @@ / {
@ -471,7 +471,7 @@ index dad0f11e8e85..d02f8d4f7baf 100644
 
 &uart21 {
 diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c
-index 77c7926a4df6..1727fc3f6a77 100644
+index 77c7926a4df66..1727fc3f6a778 100644
 --- a/arch/arm64/kernel/setup.c
 +++ b/arch/arm64/kernel/setup.c
@@ -32,6 +32,8 @@
@ -523,7 +523,7 @@ index 77c7926a4df6..1727fc3f6a77 100644
 
 	arm64_memblock_init();
 diff --git a/arch/s390/include/asm/ipl.h b/arch/s390/include/asm/ipl.h
-index b0d00032479d..afb9544fb007 100644
+index b0d00032479d6..afb9544fb0074 100644
 --- a/arch/s390/include/asm/ipl.h
 +++ b/arch/s390/include/asm/ipl.h
@@ -139,6 +139,7 @@ int ipl_report_add_component(struct ipl_report *report, struct kexec_buf *kbuf,
@ -535,7 +535,7 @@ index b0d00032479d..afb9544fb007 100644
 /*
  * DIAG 308 support
 diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
-index 961a3d60a4dd..927ba8a7b3ac 100644
+index 961a3d60a4ddd..927ba8a7b3ac0 100644
 --- a/arch/s390/kernel/ipl.c
 +++ b/arch/s390/kernel/ipl.c
@@ -2497,3 +2497,8 @@ int ipl_report_free(struct ipl_report *report)
@ -548,7 +548,7 @@ index 961a3d60a4dd..927ba8a7b3ac 100644
 +	return !!ipl_secure_flag;
 +}
 diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
-index 7b529868789f..c054a407afa6 100644
+index 7b529868789f9..c054a407afa68 100644
 --- a/arch/s390/kernel/setup.c
 +++ b/arch/s390/kernel/setup.c
@@ -49,6 +49,7 @@
@ -570,7 +570,7 @@ index 7b529868789f..c054a407afa6 100644
 	/* boot_command_line has been already set up in early.c */
 	*cmdline_p = boot_command_line;
 diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
-index 34a054181c4d..d9aa9b84ff52 100644
+index 34a054181c4dc..d9aa9b84ff52a 100644
 --- a/arch/x86/kernel/cpu/common.c
 +++ b/arch/x86/kernel/cpu/common.c
@@ -1733,6 +1733,7 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c)
@ -582,7 +582,7 @@ index 34a054181c4d..d9aa9b84ff52 100644
 		get_cpu_address_sizes(c);
 		cpu_parse_early_param();
 diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
-index 1b2edd07a3e1..201705bc317a 100644
+index 1b2edd07a3e17..201705bc317a3 100644
 --- a/arch/x86/kernel/setup.c
 +++ b/arch/x86/kernel/setup.c
@@ -21,6 +21,7 @@
@ -729,7 +729,7 @@ index 1b2edd07a3e1..201705bc317a 100644
 }
 
 diff --git a/crypto/akcipher.c b/crypto/akcipher.c
-index a36f50c83827..f4f421e6cff2 100644
+index a36f50c838278..f4f421e6cff20 100644
 --- a/crypto/akcipher.c
 +++ b/crypto/akcipher.c
@@ -142,8 +142,7 @@ int crypto_register_akcipher(struct akcipher_alg *alg)
@ -743,7 +743,7 @@ index a36f50c83827..f4f421e6cff2 100644
 		alg->set_priv_key = akcipher_default_set_key;
 
 diff --git a/crypto/dh.c b/crypto/dh.c
-index 8250eeeebd0f..01f0f3963a74 100644
+index 8250eeeebd0fe..01f0f3963a740 100644
 --- a/crypto/dh.c
 +++ b/crypto/dh.c
@@ -227,10 +227,35 @@ static int dh_compute_value(struct kpp_request *req)
@ -783,7 +783,7 @@ index 8250eeeebd0f..01f0f3963a74 100644
 	}
 
 diff --git a/crypto/drbg.c b/crypto/drbg.c
-index dbe4c8bb5ceb..02d7b74a4bd0 100644
+index dbe4c8bb5ceb7..02d7b74a4bd0a 100644
 --- a/crypto/drbg.c
 +++ b/crypto/drbg.c
@@ -1495,13 +1495,14 @@ static int drbg_generate(struct drbg_state *drbg,
@ -838,7 +838,7 @@ index dbe4c8bb5ceb..02d7b74a4bd0 100644
 
 /*
 diff --git a/crypto/rng.c b/crypto/rng.c
-index b8ae6ebc091d..466be8403948 100644
+index b8ae6ebc091dd..466be84039489 100644
 --- a/crypto/rng.c
 +++ b/crypto/rng.c
@@ -12,10 +12,13 @@
@ -1063,7 +1063,7 @@ index b8ae6ebc091d..466be8403948 100644
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Random Number Generator");
 diff --git a/crypto/seqiv.c b/crypto/seqiv.c
-index 2bae99e33526..a6dca30b28f2 100644
+index 2bae99e335268..a6dca30b28f23 100644
 --- a/crypto/seqiv.c
 +++ b/crypto/seqiv.c
@@ -121,6 +121,19 @@ static int seqiv_aead_decrypt(struct aead_request *req)
@ -1096,7 +1096,7 @@ index 2bae99e33526..a6dca30b28f2 100644
 
 	inst->alg.base.cra_ctxsize = sizeof(struct aead_geniv_ctx);
 diff --git a/crypto/sig.c b/crypto/sig.c
-index beba745b6405..fd41f6d3abf9 100644
+index beba745b64057..fd41f6d3abf9a 100644
 --- a/crypto/sig.c
 +++ b/crypto/sig.c
@@ -112,8 +112,7 @@ static int sig_prepare_alg(struct sig_alg *alg)
@ -1110,7 +1110,7 @@ index beba745b6405..fd41f6d3abf9 100644
 		alg->verify = sig_default_verify;
 	if (!alg->set_priv_key)
 diff --git a/crypto/testmgr.c b/crypto/testmgr.c
-index ee33ba21ae2b..ace3c3309bea 100644
+index ee33ba21ae2bc..ace3c3309bea8 100644
 --- a/crypto/testmgr.c
 +++ b/crypto/testmgr.c
@@ -3934,7 +3934,7 @@ static int test_akcipher_one(struct crypto_akcipher *tfm,
@ -1147,7 +1147,7 @@ index ee33ba21ae2b..ace3c3309bea 100644
 			.kpp = __VECS(ecdh_p384_tv_template)
 		}
 diff --git a/drivers/acpi/apei/hest.c b/drivers/acpi/apei/hest.c
-index 20d757687e3d..90a13f20f052 100644
+index 20d757687e3d9..90a13f20f052b 100644
 --- a/drivers/acpi/apei/hest.c
 +++ b/drivers/acpi/apei/hest.c
@@ -142,6 +142,14 @@ static int apei_hest_parse(apei_hest_func_t func, void *data)
@ -1166,7 +1166,7 @@ index 20d757687e3d..90a13f20f052 100644
 	for (i = 0; i < hest_tab->error_source_count; i++) {
 		len = hest_esrc_len(hest_hdr);
 diff --git a/drivers/acpi/irq.c b/drivers/acpi/irq.c
-index 76a856c32c4d..f2d25d95811c 100644
+index 76a856c32c4d0..f2d25d95811c9 100644
 --- a/drivers/acpi/irq.c
 +++ b/drivers/acpi/irq.c
@@ -143,6 +143,7 @@ struct acpi_irq_parse_one_ctx {
@ -1209,7 +1209,7 @@ index 76a856c32c4d..f2d25d95811c 100644
 	return ctx.rc;
 }
 diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
-index fb1fe9f3b1a3..5a3312fc0ea0 100644
+index fb1fe9f3b1a36..5a3312fc0ea01 100644
 --- a/drivers/acpi/scan.c
 +++ b/drivers/acpi/scan.c
@@ -1794,6 +1794,15 @@ static bool acpi_device_enumeration_by_parent(struct acpi_device *device)
@ -1229,7 +1229,7 @@ index fb1fe9f3b1a3..5a3312fc0ea0 100644
 	acpi_dev_get_resources(device, &resource_list,
 			       acpi_check_serial_bus_slave,
 diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
-index c79abdfcd7a9..e23bfb7f94c7 100644
+index c79abdfcd7a9b..e23bfb7f94c72 100644
 --- a/drivers/ata/libahci.c
 +++ b/drivers/ata/libahci.c
@@ -731,6 +731,24 @@ int ahci_stop_engine(struct ata_port *ap)
@ -1258,7 +1258,7 @@ index c79abdfcd7a9..e23bfb7f94c7 100644
 	tmp = ata_wait_register(ap, port_mmio + PORT_CMD,
 				PORT_CMD_LIST_ON, PORT_CMD_LIST_ON, 1, 500);
 diff --git a/drivers/char/ipmi/ipmi_dmi.c b/drivers/char/ipmi/ipmi_dmi.c
-index bbf7029e224b..cf7faa970dd6 100644
+index bbf7029e224be..cf7faa970dd65 100644
 --- a/drivers/char/ipmi/ipmi_dmi.c
 +++ b/drivers/char/ipmi/ipmi_dmi.c
@@ -215,6 +215,21 @@ static int __init scan_for_dmi_ipmi(void)
@ -1284,7 +1284,7 @@ index bbf7029e224b..cf7faa970dd6 100644
 		dmi_decode_ipmi((const struct dmi_header *) dev->device_data);
 
 diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
-index 8e9050f99e9e..f80ff2c42132 100644
+index 8e9050f99e9ef..f80ff2c421324 100644
 --- a/drivers/char/ipmi/ipmi_msghandler.c
 +++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -34,6 +34,7 @@
@ -1319,7 +1319,7 @@ index 8e9050f99e9e..f80ff2c42132 100644
 	rv = ipmi_register_driver();
 	mutex_unlock(&ipmi_interfaces_mutex);
 diff --git a/drivers/char/random.c b/drivers/char/random.c
-index b8b24b6ed3fe..a38d31cb520d 100644
+index b8b24b6ed3fe4..a38d31cb520d9 100644
 --- a/drivers/char/random.c
 +++ b/drivers/char/random.c
@@ -51,9 +51,11 @@
@ -1530,7 +1530,7 @@ index b8b24b6ed3fe..a38d31cb520d 100644
 /********************************************************************
  *
 diff --git a/drivers/firmware/efi/Makefile b/drivers/firmware/efi/Makefile
-index 8efbcf699e4f..96d5a1ca981d 100644
+index 8efbcf699e4ff..96d5a1ca981df 100644
 --- a/drivers/firmware/efi/Makefile
 +++ b/drivers/firmware/efi/Makefile
@@ -25,6 +25,7 @@ subdir-$(CONFIG_EFI_STUB)		+= libstub
@ -1542,7 +1542,7 @@ index 8efbcf699e4f..96d5a1ca981d 100644
 obj-$(CONFIG_EFI_RCI2_TABLE)		+= rci2-table.o
 obj-$(CONFIG_EFI_EMBEDDED_FIRMWARE)	+= embedded-firmware.o
 diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
-index 1ce428e2ac8a..12a79ddc2543 100644
+index 1ce428e2ac8a0..12a79ddc25432 100644
 --- a/drivers/firmware/efi/efi.c
 +++ b/drivers/firmware/efi/efi.c
@@ -33,6 +33,7 @@
@ -1687,7 +1687,7 @@ index 1ce428e2ac8a..12a79ddc2543 100644
 EXPORT_SYMBOL_GPL(efi_status_to_err);
 
 diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c
-index 6a337f1f8787..89244e0d9fa8 100644
+index 6a337f1f8787b..89244e0d9fa86 100644
 --- a/drivers/firmware/efi/libstub/fdt.c
 +++ b/drivers/firmware/efi/libstub/fdt.c
@@ -132,6 +132,11 @@ static efi_status_t update_fdt(void *orig_fdt, unsigned long orig_fdt_size,
@ -1703,7 +1703,7 @@ index 6a337f1f8787..89244e0d9fa8 100644
 	fdt_pack(fdt);
 
 diff --git a/drivers/firmware/efi/libstub/secureboot.c b/drivers/firmware/efi/libstub/secureboot.c
-index 516f4f0069bd..380354755108 100644
+index 516f4f0069bd2..380354755108b 100644
 --- a/drivers/firmware/efi/libstub/secureboot.c
 +++ b/drivers/firmware/efi/libstub/secureboot.c
@@ -29,10 +29,13 @@ enum efi_secureboot_mode efi_get_secureboot(void)
@ -1740,7 +1740,7 @@ index 516f4f0069bd..380354755108 100644
 }
 diff --git a/drivers/firmware/efi/secureboot.c b/drivers/firmware/efi/secureboot.c
 new file mode 100644
-index 000000000000..de0a3714a5d4
+index 0000000000000..de0a3714a5d44
 --- /dev/null
 +++ b/drivers/firmware/efi/secureboot.c
@@ -0,0 +1,38 @@
@ -1783,7 +1783,7 @@ index 000000000000..de0a3714a5d4
 +	}
 +}
 diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c
-index d4af17fdba46..154f0403cbf4 100644
+index d4af17fdba467..154f0403cbf4c 100644
 --- a/drivers/hid/hid-rmi.c
 +++ b/drivers/hid/hid-rmi.c
@@ -321,21 +321,12 @@ static int rmi_input_event(struct hid_device *hdev, u8 *data, int size)
@ -1885,7 +1885,7 @@ index d4af17fdba46..154f0403cbf4 100644
 	data->xport.ops = &hid_rmi_ops;
 
 diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
-index 42e5d37403ad..87b0c6c936b1 100644
+index 42e5d37403add..87b0c6c936b18 100644
 --- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
 +++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
@@ -11,6 +11,7 @@
@ -1936,7 +1936,7 @@ index 42e5d37403ad..87b0c6c936b1 100644
 	platform_driver_unregister(&etm4_platform_driver);
 	etm4_pm_clear();
 diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
-index 2168b6cd7167..5d7cda175a0c 100644
+index 2168b6cd71673..5d7cda175a0ce 100644
 --- a/drivers/input/rmi4/rmi_driver.c
 +++ b/drivers/input/rmi4/rmi_driver.c
@@ -182,34 +182,47 @@ void rmi_set_attn_data(struct rmi_device *rmi_dev, unsigned long irq_status,
@ -2128,7 +2128,7 @@ index 2168b6cd7167..5d7cda175a0c 100644
 	if (data->f01_container->dev.driver) {
 		/* Driver already bound, so enable ATTN now. */
 diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
-index 060ebe330ee1..2dfed8d43967 100644
+index 060ebe330ee16..2dfed8d439670 100644
 --- a/drivers/iommu/iommu.c
 +++ b/drivers/iommu/iommu.c
@@ -8,6 +8,7 @@
@ -2168,7 +2168,7 @@ index 060ebe330ee1..2dfed8d43967 100644
  * iommu_setup_default_domain - Set the default_domain for the group
  * @group: Group to change
 diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
-index 185c08eab4ca..215a68b1d863 100644
+index 185c08eab4ca1..215a68b1d863f 100644
 --- a/drivers/message/fusion/mptsas.c
 +++ b/drivers/message/fusion/mptsas.c
@@ -5378,6 +5378,10 @@ static void mptsas_remove(struct pci_dev *pdev)
@ -2191,7 +2191,7 @@ index 185c08eab4ca..215a68b1d863 100644
 };
 MODULE_DEVICE_TABLE(pci, mptsas_pci_table);
 diff --git a/drivers/message/fusion/mptspi.c b/drivers/message/fusion/mptspi.c
-index a3901fbfac4f..83add1994d2c 100644
+index a3901fbfac4f7..83add1994d2c2 100644
 --- a/drivers/message/fusion/mptspi.c
 +++ b/drivers/message/fusion/mptspi.c
@@ -1240,12 +1240,17 @@ static struct spi_function_template mptspi_transport_functions = {
@ -2213,7 +2213,7 @@ index a3901fbfac4f..83add1994d2c 100644
 };
 MODULE_DEVICE_TABLE(pci, mptspi_pci_table);
 diff --git a/drivers/net/wireguard/main.c b/drivers/net/wireguard/main.c
-index a00671b58701..eeef2766b8b3 100644
+index a00671b58701f..eeef2766b8b3d 100644
 --- a/drivers/net/wireguard/main.c
 +++ b/drivers/net/wireguard/main.c
@@ -12,6 +12,7 @@
@ -2237,7 +2237,7 @@ index a00671b58701..eeef2766b8b3 100644
 	if (ret < 0)
 		goto err_allowedips;
 diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
-index 63665240ae87..f3c6a2c74ad0 100644
+index 63665240ae87f..f3c6a2c74ad03 100644
 --- a/drivers/pci/pci-driver.c
 +++ b/drivers/pci/pci-driver.c
@@ -19,6 +19,7 @@
@ -2265,7 +2265,7 @@ index 63665240ae87..f3c6a2c74ad0 100644
 		return rc;
 	if (rc < 0) {
 diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
-index d97335a40193..3b0c24a0bf32 100644
+index d97335a401930..3b0c24a0bf325 100644
 --- a/drivers/pci/quirks.c
 +++ b/drivers/pci/quirks.c
@@ -4450,6 +4450,30 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_BROADCOM, 0x9000,
@ -2300,7 +2300,7 @@ index d97335a40193..3b0c24a0bf32 100644
  * Intersil/Techwell TW686[4589]-based video capture cards have an empty (zero)
  * class code.  Fix it.
 diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
-index 4b12e6dd8f07..d017f54e3294 100644
+index 4b12e6dd8f07f..d017f54e32943 100644
 --- a/drivers/scsi/aacraid/linit.c
 +++ b/drivers/scsi/aacraid/linit.c
@@ -77,6 +77,7 @@ char aac_driver_version[] = AAC_DRIVER_FULL_VERSION;
@ -2320,7 +2320,7 @@ index 4b12e6dd8f07..d017f54e3294 100644
 	{ 0x9005, 0x028c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 63 }, /* Adaptec PMC Series 7 (Denali) */
 	{ 0x9005, 0x028d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 64 }, /* Adaptec PMC Series 8 */
 diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
-index c73a71ac3c29..9e7e41288a7a 100644
+index c73a71ac3c290..9e7e41288a7a5 100644
 --- a/drivers/scsi/hpsa.c
 +++ b/drivers/scsi/hpsa.c
@@ -82,7 +82,9 @@ MODULE_DESCRIPTION("Driver for HP Smart Array Controller version " \
@ -2347,7 +2347,7 @@ index c73a71ac3c29..9e7e41288a7a 100644
 };
 
 diff --git a/drivers/scsi/lpfc/lpfc_ids.h b/drivers/scsi/lpfc/lpfc_ids.h
-index 0b1616e93cf4..85fc52038a82 100644
+index 0b1616e93cf47..85fc52038a825 100644
 --- a/drivers/scsi/lpfc/lpfc_ids.h
 +++ b/drivers/scsi/lpfc/lpfc_ids.h
@@ -24,6 +24,7 @@
@ -2421,7 +2421,7 @@ index 0b1616e93cf4..85fc52038a82 100644
 		PCI_ANY_ID, PCI_ANY_ID, },
 	{PCI_VENDOR_ID_EMULEX, PCI_DEVICE_ID_LANCER_G7_FC,
 diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
-index d4b484c0fd9d..4e5bb4cce484 100644
+index d4b484c0fd9d7..4e5bb4cce4844 100644
 --- a/drivers/scsi/qla2xxx/qla_os.c
 +++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -8105,6 +8105,7 @@ static const struct pci_error_handlers qla2xxx_err_handler = {
@ -2452,7 +2452,7 @@ index d4b484c0fd9d..4e5bb4cce484 100644
 	{ PCI_DEVICE(PCI_VENDOR_ID_QLOGIC, PCI_DEVICE_ID_QLOGIC_ISP2271) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_QLOGIC, PCI_DEVICE_ID_QLOGIC_ISP2261) },
 diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
-index 5b8668accf8e..35351d7efc86 100644
+index 5b8668accf8e8..35351d7efc864 100644
 --- a/drivers/scsi/sd.c
 +++ b/drivers/scsi/sd.c
@@ -121,6 +121,14 @@ static const char *sd_cache_types[] = {
@ -2483,7 +2483,7 @@ index 5b8668accf8e..35351d7efc86 100644
 	if (err)
 		goto err_out_driver;
 diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c
-index 0ca268bdf1f8..5710ac0c07a8 100644
+index 0ca268bdf1f8c..5710ac0c07a8c 100644
 --- a/drivers/soc/qcom/mdt_loader.c
 +++ b/drivers/soc/qcom/mdt_loader.c
@@ -39,12 +39,14 @@ static bool mdt_header_valid(const struct firmware *fw)
@ -2507,7 +2507,7 @@ index 0ca268bdf1f8..5710ac0c07a8 100644
 	return true;
 }
 diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
-index 256fe8c86828..2e4a09948df8 100644
+index 256fe8c86828d..2e4a09948df8f 100644
 --- a/drivers/usb/core/hub.c
 +++ b/drivers/usb/core/hub.c
@@ -5893,6 +5893,13 @@ static void hub_event(struct work_struct *work)
@ -2525,7 +2525,7 @@ index 256fe8c86828..2e4a09948df8 100644
 	 * disconnected while waiting for the lock to succeed. */
 	usb_lock_device(hdev);
 diff --git a/fs/afs/main.c b/fs/afs/main.c
-index 02475d415d88..f96c698324ae 100644
+index 02475d415d885..f96c698324ae4 100644
 --- a/fs/afs/main.c
 +++ b/fs/afs/main.c
@@ -194,6 +194,9 @@ static int __init afs_init(void)
@ -2539,7 +2539,7 @@ index 02475d415d88..f96c698324ae 100644
 
 error_proc:
 diff --git a/fs/erofs/super.c b/fs/erofs/super.c
-index 1b529ace4db0..30c2e0186463 100644
+index 1b529ace4db0e..30c2e01864636 100644
 --- a/fs/erofs/super.c
 +++ b/fs/erofs/super.c
@@ -623,6 +623,9 @@ static int erofs_fc_fill_super(struct super_block *sb, struct fs_context *fc)
@ -2566,7 +2566,7 @@ index 1b529ace4db0..30c2e0186463 100644
 }
 
 diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index 699c15db28a8..50a5e317ddea 100644
+index 699c15db28a82..50a5e317ddea8 100644
 --- a/fs/ext4/super.c
 +++ b/fs/ext4/super.c
@@ -5639,6 +5639,17 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)
@ -2588,7 +2588,7 @@ index 699c15db28a8..50a5e317ddea 100644
 	err = ext4_register_sysfs(sb);
 	if (err)
 diff --git a/include/linux/crypto.h b/include/linux/crypto.h
-index a2137e19be7d..df268ca70170 100644
+index a2137e19be7d8..df268ca70170e 100644
 --- a/include/linux/crypto.h
 +++ b/include/linux/crypto.h
@@ -151,6 +151,9 @@
@ -2602,7 +2602,7 @@ index a2137e19be7d..df268ca70170 100644
 /*
  * Miscellaneous stuff.
 diff --git a/include/linux/efi.h b/include/linux/efi.h
-index a98cc39e7aaa..00f31eefd0c5 100644
+index a98cc39e7aaa8..00f31eefd0c5a 100644
 --- a/include/linux/efi.h
 +++ b/include/linux/efi.h
@@ -45,6 +45,8 @@ struct screen_info;
@ -2670,7 +2670,7 @@ index a98cc39e7aaa..00f31eefd0c5 100644
 enum efi_secureboot_mode efi_get_secureboot_mode(efi_get_variable_t *get_var)
 {
 diff --git a/include/linux/kernel.h b/include/linux/kernel.h
-index 989315dabb86..db38a0b1f379 100644
+index 989315dabb869..db38a0b1f3796 100644
 --- a/include/linux/kernel.h
 +++ b/include/linux/kernel.h
@@ -390,4 +390,20 @@ static inline void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) { }
@ -2695,7 +2695,7 @@ index 989315dabb86..db38a0b1f379 100644
 +
 #endif
 diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
-index fd11fffdd3c3..af87dc6e56dd 100644
+index fd11fffdd3c38..af87dc6e56dd6 100644
 --- a/include/linux/lsm_hook_defs.h
 +++ b/include/linux/lsm_hook_defs.h
@@ -446,6 +446,7 @@ LSM_HOOK(int, 0, bpf_token_capable, const struct bpf_token *token, int cap)
@ -2707,7 +2707,7 @@ index fd11fffdd3c3..af87dc6e56dd 100644
 LSM_HOOK(int, 0, perf_event_open, int type)
 LSM_HOOK(int, 0, perf_event_alloc, struct perf_event *event)
 diff --git a/include/linux/module.h b/include/linux/module.h
-index 3319a5269d28..73329fb4711b 100644
+index 3319a5269d286..73329fb4711bf 100644
 --- a/include/linux/module.h
 +++ b/include/linux/module.h
@@ -410,6 +410,7 @@ struct module {
@ -2730,7 +2730,7 @@ index 3319a5269d28..73329fb4711b 100644
 DEFINE_FREE(module_put, struct module *, if (_T) module_put(_T))
 
 diff --git a/include/linux/panic.h b/include/linux/panic.h
-index 7be742628c25..83e62c186409 100644
+index 7be742628c252..83e62c1864092 100644
 --- a/include/linux/panic.h
 +++ b/include/linux/panic.h
@@ -74,7 +74,22 @@ static inline void set_arch_panic_timeout(int timeout, int arch_default_timeout)
@ -2758,7 +2758,7 @@ index 7be742628c25..83e62c186409 100644
 
 struct taint_flag {
 diff --git a/include/linux/pci.h b/include/linux/pci.h
-index 59876de13860..bc48eef0bfef 100644
+index 59876de13860d..bc48eef0bfefa 100644
 --- a/include/linux/pci.h
 +++ b/include/linux/pci.h
@@ -1648,6 +1648,7 @@ int pci_add_dynid(struct pci_driver *drv,
@ -2781,7 +2781,7 @@ index 59876de13860..bc48eef0bfef 100644
 void pci_uevent_ers(struct pci_dev *pdev, enum  pci_ers_result err_type);
 #endif
 diff --git a/include/linux/random.h b/include/linux/random.h
-index 333cecfca93f..6421bf2415a5 100644
+index 333cecfca93fd..6421bf2415a53 100644
 --- a/include/linux/random.h
 +++ b/include/linux/random.h
@@ -9,6 +9,13 @@
@ -2810,7 +2810,7 @@ index 333cecfca93f..6421bf2415a5 100644
 #endif
 diff --git a/include/linux/rh_flags.h b/include/linux/rh_flags.h
 new file mode 100644
-index 000000000000..d498d319ace3
+index 0000000000000..d498d319ace3a
 --- /dev/null
 +++ b/include/linux/rh_flags.h
@@ -0,0 +1,34 @@
@ -2850,7 +2850,7 @@ index 000000000000..d498d319ace3
 +#endif
 diff --git a/include/linux/rh_kabi.h b/include/linux/rh_kabi.h
 new file mode 100644
-index 000000000000..5139cb2cabdc
+index 0000000000000..5139cb2cabdc0
 --- /dev/null
 +++ b/include/linux/rh_kabi.h
@@ -0,0 +1,541 @@
@ -3397,7 +3397,7 @@ index 000000000000..5139cb2cabdc
 +#endif /* _LINUX_RH_KABI_H */
 diff --git a/include/linux/rh_waived.h b/include/linux/rh_waived.h
 new file mode 100644
-index 000000000000..945dd71cc082
+index 0000000000000..945dd71cc0827
 --- /dev/null
 +++ b/include/linux/rh_waived.h
@@ -0,0 +1,19 @@
@ -3421,7 +3421,7 @@ index 000000000000..945dd71cc082
 +
 +#endif /* _RH_WAIVED_H */
 diff --git a/include/linux/rmi.h b/include/linux/rmi.h
-index ab7eea01ab42..fff7c5f737fc 100644
+index ab7eea01ab427..fff7c5f737fc8 100644
 --- a/include/linux/rmi.h
 +++ b/include/linux/rmi.h
@@ -364,6 +364,7 @@ struct rmi_driver_data {
@ -3433,7 +3433,7 @@ index ab7eea01ab42..fff7c5f737fc 100644
 
 int rmi_register_transport_device(struct rmi_transport_dev *xport);
 diff --git a/include/linux/security.h b/include/linux/security.h
-index 521bcb5b9717..537e928730e9 100644
+index 521bcb5b97170..537e928730e98 100644
 --- a/include/linux/security.h
 +++ b/include/linux/security.h
@@ -2405,4 +2405,13 @@ static inline void security_initramfs_populated(void)
@ -3451,7 +3451,7 @@ index 521bcb5b9717..537e928730e9 100644
 +
 #endif /* ! __LINUX_SECURITY_H */
 diff --git a/init/main.c b/init/main.c
-index 0ee0ee7b7c2c..3f21a57c5c0e 100644
+index 0ee0ee7b7c2c0..3f21a57c5c0e9 100644
 --- a/init/main.c
 +++ b/init/main.c
@@ -1158,8 +1158,10 @@ static bool __init_or_module initcall_blacklisted(initcall_t fn)
@ -3476,7 +3476,7 @@ index 0ee0ee7b7c2c..3f21a57c5c0e 100644
 		if (!strcmp(fn_name, entry->buf)) {
 			pr_debug("initcall %s blacklisted\n", fn_name);
 diff --git a/kernel/Makefile b/kernel/Makefile
-index c60623448235..b0e7910e2e68 100644
+index c60623448235f..b0e7910e2e68d 100644
 --- a/kernel/Makefile
 +++ b/kernel/Makefile
@@ -12,6 +12,7 @@ obj-y     = fork.o exec_domain.o panic.o \
@ -3488,7 +3488,7 @@ index c60623448235..b0e7910e2e68 100644
 obj-$(CONFIG_VHOST_TASK) += vhost_task.o
 
 diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
-index 5d1650af899d..dde59a1ea6b3 100644
+index 5d1650af899d0..dde59a1ea6b3e 100644
 --- a/kernel/bpf/core.c
 +++ b/kernel/bpf/core.c
@@ -575,7 +575,12 @@ void bpf_prog_kallsyms_del_all(struct bpf_prog *fp)
@ -3505,7 +3505,7 @@ index 5d1650af899d..dde59a1ea6b3 100644
 long bpf_jit_limit_max __read_mostly;
 
 diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
-index 0fbfa8532c39..c0e8792756fa 100644
+index 0fbfa8532c392..c0e8792756fa8 100644
 --- a/kernel/bpf/syscall.c
 +++ b/kernel/bpf/syscall.c
@@ -26,6 +26,7 @@
@ -3553,7 +3553,7 @@ index 0fbfa8532c39..c0e8792756fa 100644
 	}
 
 diff --git a/kernel/module/main.c b/kernel/module/main.c
-index c66b26184936..0eb08102db5b 100644
+index c66b261849362..0eb08102db5bc 100644
 --- a/kernel/module/main.c
 +++ b/kernel/module/main.c
@@ -65,6 +65,8 @@
@ -3605,7 +3605,7 @@ index c66b26184936..0eb08102db5b 100644
 
 #ifdef CONFIG_MODULE_DEBUGFS
 diff --git a/kernel/module/signing.c b/kernel/module/signing.c
-index a2ff4242e623..f0d2be1ee4f1 100644
+index a2ff4242e623d..f0d2be1ee4f1c 100644
 --- a/kernel/module/signing.c
 +++ b/kernel/module/signing.c
@@ -61,10 +61,17 @@ int mod_verify_sig(const void *mod, struct load_info *info)
@ -3628,7 +3628,7 @@ index a2ff4242e623..f0d2be1ee4f1 100644
 
 int module_sig_check(struct load_info *info, int flags)
 diff --git a/kernel/panic.c b/kernel/panic.c
-index 72fcbb5a071b..5e26af68e42c 100644
+index 72fcbb5a071ba..5e26af68e42cd 100644
 --- a/kernel/panic.c
 +++ b/kernel/panic.c
@@ -600,6 +600,18 @@ const struct taint_flag taint_flags[TAINT_FLAGS_COUNT] = {
@ -3652,7 +3652,7 @@ index 72fcbb5a071b..5e26af68e42c 100644
 #undef TAINT_FLAG
 diff --git a/kernel/rh_flags.c b/kernel/rh_flags.c
 new file mode 100644
-index 000000000000..10d26958f840
+index 0000000000000..10d26958f840c
 --- /dev/null
 +++ b/kernel/rh_flags.c
@@ -0,0 +1,115 @@
@ -3773,7 +3773,7 @@ index 000000000000..10d26958f840
 +subsys_initcall(rh_flags_init);
 diff --git a/kernel/rh_messages.c b/kernel/rh_messages.c
 new file mode 100644
-index 000000000000..bb69e8965748
+index 0000000000000..bb69e8965748b
 --- /dev/null
 +++ b/kernel/rh_messages.c
@@ -0,0 +1,414 @@
@ -4193,7 +4193,7 @@ index 000000000000..bb69e8965748
 +}
 diff --git a/kernel/rh_messages.h b/kernel/rh_messages.h
 new file mode 100644
-index 000000000000..647d7b9a4fe9
+index 0000000000000..647d7b9a4fe94
 --- /dev/null
 +++ b/kernel/rh_messages.h
@@ -0,0 +1,326 @@
@ -4525,7 +4525,7 @@ index 000000000000..647d7b9a4fe9
 +#endif /* __RH_MESSAGES_H */
 diff --git a/kernel/rh_waived.c b/kernel/rh_waived.c
 new file mode 100644
-index 000000000000..84e22b1730cc
+index 0000000000000..84e22b1730cc4
 --- /dev/null
 +++ b/kernel/rh_waived.c
@@ -0,0 +1,104 @@
@ -4634,7 +4634,7 @@ index 000000000000..84e22b1730cc
 +}
 +late_initcall(__add_rh_flag);
 diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
-index 1d581ba5df66..7826803444df 100644
+index 1d581ba5df66f..7826803444df9 100644
 --- a/scripts/Makefile.lib
 +++ b/scripts/Makefile.lib
@@ -191,7 +191,10 @@ objtool-args-$(CONFIG_HAVE_STATIC_CALL_INLINE)		+= --static-call
@ -4649,7 +4649,7 @@ index 1d581ba5df66..7826803444df 100644
 objtool-args = $(objtool-args-y)					\
 	$(if $(delay-objtool), --link)					\
 diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
-index 5ca7c268294e..c7e3c64bc803 100644
+index 5ca7c268294eb..c7e3c64bc8034 100644
 --- a/scripts/mod/modpost.c
 +++ b/scripts/mod/modpost.c
@@ -27,6 +27,7 @@
@ -4682,7 +4682,7 @@ index 5ca7c268294e..c7e3c64bc803 100644
 	ret = snprintf(fname, sizeof(fname), "%s.mod.c", mod->name);
 	if (ret >= sizeof(fname)) {
 diff --git a/scripts/tags.sh b/scripts/tags.sh
-index 99ce427d9a69..f191cd9d7ee6 100755
+index 99ce427d9a69d..f191cd9d7ee6e 100755
 --- a/scripts/tags.sh
 +++ b/scripts/tags.sh
@@ -16,6 +16,8 @@ fi
@ -4695,7 +4695,7 @@ index 99ce427d9a69..f191cd9d7ee6 100755
 # ignore arbitrary directories
 if [ -n "${IGNORE_DIRS}" ]; then
 diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c
-index d1fdd113450a..182e8090cfe8 100644
+index d1fdd113450a6..182e8090cfe85 100644
 --- a/security/integrity/platform_certs/load_uefi.c
 +++ b/security/integrity/platform_certs/load_uefi.c
@@ -74,7 +74,8 @@ static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid,
@ -4719,7 +4719,7 @@ index d1fdd113450a..182e8090cfe8 100644
 	}
 
 diff --git a/security/lockdown/Kconfig b/security/lockdown/Kconfig
-index e84ddf484010..d0501353a4b9 100644
+index e84ddf4840101..d0501353a4b95 100644
 --- a/security/lockdown/Kconfig
 +++ b/security/lockdown/Kconfig
@@ -16,6 +16,19 @@ config SECURITY_LOCKDOWN_LSM_EARLY
@ -4743,7 +4743,7 @@ index e84ddf484010..d0501353a4b9 100644
 	prompt "Kernel default lockdown mode"
 	default LOCK_DOWN_KERNEL_FORCE_NONE
 diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c
-index cf83afa1d879..aba751e7abff 100644
+index cf83afa1d879a..aba751e7abffe 100644
 --- a/security/lockdown/lockdown.c
 +++ b/security/lockdown/lockdown.c
@@ -72,6 +72,17 @@ static int lockdown_is_locked_down(enum lockdown_reason what)
@ -4765,7 +4765,7 @@ index cf83afa1d879..aba751e7abff 100644
 	LSM_HOOK_INIT(locked_down, lockdown_is_locked_down),
 };
 diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
-index 4863106034df..c787506dcfb3 100644
+index 4863106034dfb..c787506dcfb30 100644
 --- a/tools/testing/selftests/bpf/Makefile
 +++ b/tools/testing/selftests/bpf/Makefile
@@ -502,7 +502,7 @@ LSKELS := fentry_test.c fexit_test.c fexit_sleep.c atomics.c 		\
@ -4778,7 +4778,7 @@ index 4863106034df..c787506dcfb3 100644
 SKEL_BLACKLIST += $$(LSKELS)
 
 diff --git a/tools/testing/selftests/bpf/prog_tests/ksyms_btf.c b/tools/testing/selftests/bpf/prog_tests/ksyms_btf.c
-index 1d7a2f1e0731..b22f3a9cb8b8 100644
+index 1d7a2f1e07317..b22f3a9cb8b80 100644
 --- a/tools/testing/selftests/bpf/prog_tests/ksyms_btf.c
 +++ b/tools/testing/selftests/bpf/prog_tests/ksyms_btf.c
@@ -7,7 +7,6 @@
--- a/6
+++ b/6
@ -1,3 +1,3 @@
-SHA512 (linux-6.17-rc3-11-gfab1beda7597.tar.xz) = 209620f4f7926021c6b6c336a218a7661cb61c05e40b520a3dc12150cd04dfdc549012702ea62d8a58a614f5c65b8f5c74f2fa3a9ff158d7ad7a8ced47309ec3
-SHA512 (kernel-abi-stablelists-6.17.0.tar.xz) = 4c25c60032b97a2ebb9e967abaaf3359cc9d29e70d4d11221eb4dbeba39c40b32041b3a38f9f5a23acf08d2c24e37fe00160a4e586fceef5a98148309c20ddda
-SHA512 (kernel-kabi-dw-6.17.0.tar.xz) = 7221bbdb72bb3dd3773e26a497ae470da8f6fc435aad60d874beb7a878daeb1b8a921fc71e7061b059fde8bca03a2907beae3b4cefea86596fbdf797d365a6f4
+SHA512 (linux-6.17-rc4.tar.xz) = 5e1b05f806686d6f3e29b759fb37afc88aff9bf4c3a6645bc95a3bb2186a5c126f745ac853d33f90d6d39c5d52b9d6ea9d776569223dc70acaaea8b08ca67104
+SHA512 (kernel-abi-stablelists-6.17.0.tar.xz) = 6777695c872b0680ae6f48c47aa9d99ea531aad023aac319809ef544c989867115616756ac0422d9d191ee562478993e63b8219eedc44df689dfc8b6e0a9acb4
+SHA512 (kernel-kabi-dw-6.17.0.tar.xz) = a9b2987fdc75b0632463e7624a51801772250f3e373edb8aa2778a380d478bbd655db470b059db34657e178e0cefb557cd267369e502ce7d1c49dd92cea62cdc
--- a/uki-addons.sbat.template
+++ b/uki-addons.sbat.template
@ -0,0 +1,2 @@
+sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
+kernel-uki-virt-addons.@SBAT_SUFFIX,1,Red Hat,kernel-uki-virt-addons,@KVER,mailto:secalert@redhat.com
--- a/uki.sbat.template
+++ b/uki.sbat.template
@ -0,0 +1,2 @@
+sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
+kernel-uki-virt.@SBAT_SUFFIX,1,Red Hat,kernel-uki-virt,@KVER,mailto:secalert@redhat.com