kernel-rt-479.rt7.268.el8

* Thu Mar 30 2023 Luis Claudio R. Goncalves <lgoncalv@redhat.com> [4.18.0-479.rt7.268.el8]
- [rt] build kernel-rt-4.18.0-479.rt7.268.el8 [2180997]
- redhat: add centos signing certs (Denys Vlasenko)
- redhat: fix "make rh-brew" not choosing _scratch_ build (Denys Vlasenko)
- mfd: intel-lpss: Add Intel Meteor Lake-P PCI IDs (Prarit Bhargava) [2156843]
- x86/cpu: Add CPU model numbers for Meteor Lake (Prarit Bhargava) [2153936]
- redhat: require grub2 >= 2.02-99 (Denys Vlasenko) [2179095]
- redhat: delete unused script and file (Denys Vlasenko) [2179095]
- redhat: drop certificates that were deprecated after GRUB's BootHole flaw (Denys Vlasenko) [2179095]
- redhat: align file names with names of signing keys for ppc and s390 (Denys Vlasenko) [2179095]
- net/tunnel: wait until all sk_user_data reader finish before releasing the sock (Hangbin Liu) [2176344]
- powerpc/pseries: unregister VPA when hot unplugging a CPU (Mamatha Inamdar) [2143007]
- net: mana: Fix IRQ name - add PCI and queue number (Mohammed Gamal) [2172474]
- net: mana: Fix return type of mana_start_xmit() (Mohammed Gamal) [2172474]
- net: mana: Define data structures for protection domain and memory registration (Mohammed Gamal) [2172474]
- net: mana: Define and process GDMA response code GDMA_STATUS_MORE_ENTRIES (Mohammed Gamal) [2172474]
- net: mana: Define max values for SGL entries (Mohammed Gamal) [2172474]
- net: mana: Move header files to a common location (Mohammed Gamal) [2172474]
- net: mana: Record port number in netdev (Mohammed Gamal) [2172474]
- net: mana: Export Work Queue functions for use by RDMA driver (Mohammed Gamal) [2172474]
- net: mana: Set the DMA device max segment size (Mohammed Gamal) [2172474]
- net: mana: Handle vport sharing between devices (Mohammed Gamal) [2172474]
- net: mana: Record the physical address for doorbell page region (Mohammed Gamal) [2172474]
- net: mana: Add support for auxiliary device (Mohammed Gamal) [2172474]
- hv_netvsc: Check status in SEND_RNDIS_PKT completion message (Mohammed Gamal) [2172438]
- hv_netvsc: Allocate memory in netvsc_dma_map() with GFP_ATOMIC (Mohammed Gamal) [2172438]
- hv_netvsc: Fix missed pagebuf entries in netvsc_dma_map/unmap() (Mohammed Gamal) [2172438]
- Drivers: hv: Make remove callback of hyperv driver void returned (Mohammed Gamal) [2172438]
- hv: fix comment typo in vmbus_channel/low_latency (Mohammed Gamal) [2172434]
- x86/hyperv: Introduce HV_MAX_SPARSE_VCPU_BANKS/HV_VCPUS_PER_SPARSE_BANK constants (Mohammed Gamal) [2172434]
- x86/hyperv: Fix hv_get/set_register for nested bringup (Mohammed Gamal) [2172434]
- x86/hyperv: Add an interface to do nested hypercalls (Mohammed Gamal) [2172434]
- Drivers: hv: Setup synic registers in case of nested root partition (Mohammed Gamal) [2172434]
- x86/hyperv: Add support for detecting nested hypervisor (Mohammed Gamal) [2172434]
- x86/hyperv: Add HV_EXPOSE_INVARIANT_TSC define (Mohammed Gamal) [2172434]
- x86/hyperv: Expand definition of struct hv_vp_assist_page (Mohammed Gamal) [2172434]
- KVM: x86: hyper-v: Expose support for extended gva ranges for flush hypercalls (Mohammed Gamal) [2172434]
- x86/hyperv: Move VMCB enlightenment definitions to hyperv-tlfs.h (Mohammed Gamal) [2172434]
- iommu/hyper-v: Allow hyperv irq remapping without x2apic (Mohammed Gamal) [2172434]
- smp: Fix offline cpu check in flush_smp_call_function_queue() (Waiman Long) [2169471]
- sched/fair: Trigger the update of blocked load on newly idle cpu (Waiman Long) [2169471]
- redhat: rh-dist-git should depend on rh-srpm (Denys Vlasenko)
- redhat: change kabi tarballs to use the package release (Denys Vlasenko)
- redhat/Makefile: add variables used in rhel9 makefiles (Denys Vlasenko)
- redhat/Makefile: Remove RHPRODUCT variable (Denys Vlasenko)
- redhat/scripts/rh-dist-git.sh: expand sources from srpm (Denys Vlasenko)
- redhat: remove GL_DISTGIT_USER, RHDISTGIT and unify dist-git cloning (Denys Vlasenko)
- redhat/scripts/rh-dist-git.sh: Use Makefile variables (Denys Vlasenko)
- redhat: fix typo and make the output more silent for dist-git sync (Denys Vlasenko)
- redhat: add initial support for centos stream dist-git sync on Makefiles (Denys Vlasenko)
- internal: update RHEL_MINOR for the start of RHEL-8.9 development (Denys Vlasenko)
- watchdog: diag288_wdt: fix __diag288() inline assembly (Tobias Huschle) [2171361]
- watchdog: diag288_wdt: do not use stack buffers for hardware data (Tobias Huschle) [2171361]
- bonding: add documentation for peer_notif_delay (Ryosuke Yasuoka) [2171348]
- net: mana: Fix IRQ name - add PCI and queue number (Mohammed Gamal) [2166787]
- crypto: des - disallow des3 in FIPS mode (Vladis Dronov) [2175234]
- self-tests: more rps self tests (Paolo Abeni) [2168878]
- net: make default_rps_mask a per netns attribute (Paolo Abeni) [2168878]
- self-tests: introduce self-tests for RPS default mask (Paolo Abeni) [2168878]
- net: introduce default_rps_mask netns attribute (Paolo Abeni) [2168878]
- net-sysctl: factor-out rpm mask manipulation helpers (Paolo Abeni) [2168878]
- net-sysctl: factor out cpumask parsing helper (Paolo Abeni) [2168878]
- txhash: Make rethinking txhash behavior configurable via sysctl (Paolo Abeni) [2168878]
- net-sysfs: Call dev_hold always in rx_queue_add_kobject (Paolo Abeni) [2168878]
- net-sysfs: Call dev_hold always in netdev_queue_add_kobject (Paolo Abeni) [2168878]
- net-sysfs: fix netdev_queue_add_kobject() breakage (Paolo Abeni) [2168878]
- net-sysfs: Fix reference count leak in rx|netdev_queue_add_kobject (Paolo Abeni) [2168878]
- ice/ptp: fix the PTP worker retrying indefinitely if the link went down (Petr Oros) [2166392]
- ice: reschedule ice_ptp_wait_for_offset_valid during reset (Petr Oros) [2166392]
- ice: make Tx and Rx vernier offset calibration independent (Petr Oros) [2166392]
- ice: only check set bits in ice_ptp_flush_tx_tracker (Petr Oros) [2166392]
- ice: handle flushing stale Tx timestamps in ice_ptp_tx_tstamp (Petr Oros) [2166392]
- ice: cleanup allocations in ice_ptp_alloc_tx_tracker (Petr Oros) [2166392]
- ice: protect init and calibrating check in ice_ptp_request_ts (Petr Oros) [2166392]
- ice: check Tx timestamp memory register for ready timestamps (Petr Oros) [2166392]
- ice: handle discarding old Tx requests in ice_ptp_tx_tstamp (Petr Oros) [2166392]
- ice: always call ice_ptp_link_change and make it void (Petr Oros) [2166392]
- ice: fix misuse of "link err" with "link status" (Petr Oros) [2166392]
- ice: Reset TS memory for all quads (Petr Oros) [2166392]
- ice: Remove the E822 vernier "bypass" logic (Petr Oros) [2166392]
- ice: Use more generic names for ice_ptp_tx fields (Petr Oros) [2166392]
- ice: Merge pin initialization of E810 and E810T adapters (Petr Oros) [2166392]
- ice: Check if reset in progress while waiting for offsets (Petr Oros) [2166392]
- NFS: Judge the file access cache's timestamp in rcu path (Benjamin Coddington) [2161321]
- redhat: switch to z-stream for 8.8 (Lucas Zampieri)
Resolves: rhbz#2180997

Signed-off-by: Luis Claudio R. Goncalves <lgoncalv@redhat.com>
This commit is contained in:
Luis Claudio R. Goncalves 2023-03-30 17:09:50 -03:00
parent 19111e36af
commit bcbb74002f
8 changed files with 116 additions and 22 deletions

BIN
centossecureboot201.cer Normal file

Binary file not shown.

BIN
centossecurebootca2.cer Normal file

Binary file not shown.

136
kernel.spec Executable file → Normal file
View File

@ -12,7 +12,7 @@
# change below to w4T.xzdio):
%define _binary_payload w3T.xzdio
%global distro_build 478
%global distro_build 479
# Sign the x86_64 kernel for secure boot authentication
%ifarch x86_64 aarch64 s390x ppc64le
@ -38,10 +38,10 @@
# define buildid .local
%define rpmversion 4.18.0
%define pkgrelease 478.rt7.267.el8
%define pkgrelease 479.rt7.268.el8
# allow pkg_release to have configurable %%{?dist} tag
%define specrelease 478.rt7.267%{?dist}
%define specrelease 479.rt7.268%{?dist}
%define pkg_release %{specrelease}%{?buildid}
@ -147,7 +147,7 @@
# The preempt RT patch level
%global rttag .rt7
# realtimeN
%global rtbuild .267
%global rtbuild .268
%define with_doc 0
%define with_headers 0
%define with_cross_headers 0
@ -446,23 +446,31 @@ Source9: x509.genkey
%define signing_key_filename kernel-signing-s390.cer
%endif
%if 0%{?centos}
Source10: centossecurebootca2.cer
Source13: centossecureboot201.cer
%define secureboot_ca_0 %{SOURCE10}
%define secureboot_key_0 %{SOURCE13}
%define pesign_name_0 centossecureboot201
%else
Source10: redhatsecurebootca3.cer
Source11: redhatsecurebootca5.cer
Source12: redhatsecureboot301.cer
#UNUSED, delete file after confirming it works:
#Source11: redhatsecurebootca5.cer
Source13: redhatsecureboot501.cer
Source14: secureboot_s390.cer
Source15: secureboot_ppc.cer
Source14: redhatsecureboot302.cer
Source15: redhatsecureboot303.cer
Source16: redhatsecurebootca7.cer
%define secureboot_ca_0 %{SOURCE10}
%define secureboot_ca_1 %{SOURCE11}
# TODO: secureboot_ca_2 is only for ppc64le on rhel -
# why doesn't it just define secureboot_ca_0 differently
# instead of using this separate _ca_2 variable?
# This would simplify some really nasty "if" blocks
%define secureboot_ca_2 %{SOURCE16}
%ifarch x86_64 aarch64
%define secureboot_key_0 %{SOURCE12}
%define pesign_name_0 redhatsecureboot301
%define secureboot_key_1 %{SOURCE13}
%define pesign_name_1 redhatsecureboot501
%define secureboot_key_0 %{SOURCE13}
%define pesign_name_0 redhatsecureboot501
%endif
%ifarch s390x
@ -474,6 +482,7 @@ Source16: redhatsecurebootca7.cer
%define secureboot_key_0 %{SOURCE15}
%define pesign_name_0 redhatsecureboot701
%endif
%endif
Source17: mod-blacklist.sh
Source18: mod-sign.sh
@ -573,6 +582,7 @@ Provides: %{name}-uname-r = %{KVERREL}%{?variant}%{?1:+%{1}}\
Requires(pre): %{kernel_prereq}\
Requires(pre): %{initrd_prereq}\
Requires(pre): linux-firmware >= 20200619-99.git3890db36\
Requires(pre): grub2 >= 2.02-99\
Requires(preun): systemd >= 200\
Conflicts: xfsprogs < 4.3.0-1\
Conflicts: xorg-x11-drv-vmmouse < 13.0.99\
@ -1161,6 +1171,7 @@ done
%endif
# Add DUP and kpatch certificates to system trusted keys for RHEL
%if 0%{?rhel}
%if %{signkernel}%{signmodules}
openssl x509 -inform der -in %{SOURCE100} -out rheldup3.pem
openssl x509 -inform der -in %{SOURCE101} -out rhelkpatch1.pem
@ -1173,6 +1184,7 @@ for i in *.config; do
sed -i 's@CONFIG_SYSTEM_TRUSTED_KEYS=""@CONFIG_SYSTEM_TRUSTED_KEYS="certs/rhel.pem"@' $i
done
%endif
%endif
cp %{SOURCE42} .
./process_configs.sh -w -c %{name} %{rpmversion} %{?cross_opts}
@ -1317,9 +1329,7 @@ BuildKernel() {
fi
%ifarch x86_64 aarch64
%pesign -s -i $SignImage -o vmlinuz.tmp -a %{secureboot_ca_0} -c %{secureboot_key_0} -n %{pesign_name_0}
%pesign -s -i vmlinuz.tmp -o vmlinuz.signed -a %{secureboot_ca_1} -c %{secureboot_key_1} -n %{pesign_name_1}
rm vmlinuz.tmp
%pesign -s -i $SignImage -o vmlinuz.signed -a %{secureboot_ca_0} -c %{secureboot_key_0} -n %{pesign_name_0}
%endif
%ifarch s390x ppc64le
if [ -x /usr/bin/rpm-sign ]; then
@ -1745,16 +1755,14 @@ BuildKernel() {
# Red Hat UEFI Secure Boot CA cert, which can be used to authenticate the kernel
mkdir -p $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer
%ifarch x86_64 aarch64
install -m 0644 %{secureboot_ca_0} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca-20200609.cer
install -m 0644 %{secureboot_ca_1} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca-20140212.cer
ln -s kernel-signing-ca-20200609.cer $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca.cer
%else
%if 0%{?rhel}
%ifarch ppc64le
install -m 0644 %{secureboot_ca_2} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca.cer
%else
install -m 0644 %{secureboot_ca_0} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca.cer
%endif
%else
install -m 0644 %{secureboot_ca_0} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca.cer
%endif
%ifarch s390x ppc64le
if [ $DoModules -eq 1 ]; then
@ -2701,6 +2709,92 @@ fi
#
#
%changelog
* Thu Mar 30 2023 Luis Claudio R. Goncalves <lgoncalv@redhat.com> [4.18.0-479.rt7.268.el8]
- [rt] build kernel-rt-4.18.0-479.rt7.268.el8 [2180997]
- redhat: add centos signing certs (Denys Vlasenko)
- redhat: fix "make rh-brew" not choosing _scratch_ build (Denys Vlasenko)
- mfd: intel-lpss: Add Intel Meteor Lake-P PCI IDs (Prarit Bhargava) [2156843]
- x86/cpu: Add CPU model numbers for Meteor Lake (Prarit Bhargava) [2153936]
- redhat: require grub2 >= 2.02-99 (Denys Vlasenko) [2179095]
- redhat: delete unused script and file (Denys Vlasenko) [2179095]
- redhat: drop certificates that were deprecated after GRUB's BootHole flaw (Denys Vlasenko) [2179095]
- redhat: align file names with names of signing keys for ppc and s390 (Denys Vlasenko) [2179095]
- net/tunnel: wait until all sk_user_data reader finish before releasing the sock (Hangbin Liu) [2176344]
- powerpc/pseries: unregister VPA when hot unplugging a CPU (Mamatha Inamdar) [2143007]
- net: mana: Fix IRQ name - add PCI and queue number (Mohammed Gamal) [2172474]
- net: mana: Fix return type of mana_start_xmit() (Mohammed Gamal) [2172474]
- net: mana: Define data structures for protection domain and memory registration (Mohammed Gamal) [2172474]
- net: mana: Define and process GDMA response code GDMA_STATUS_MORE_ENTRIES (Mohammed Gamal) [2172474]
- net: mana: Define max values for SGL entries (Mohammed Gamal) [2172474]
- net: mana: Move header files to a common location (Mohammed Gamal) [2172474]
- net: mana: Record port number in netdev (Mohammed Gamal) [2172474]
- net: mana: Export Work Queue functions for use by RDMA driver (Mohammed Gamal) [2172474]
- net: mana: Set the DMA device max segment size (Mohammed Gamal) [2172474]
- net: mana: Handle vport sharing between devices (Mohammed Gamal) [2172474]
- net: mana: Record the physical address for doorbell page region (Mohammed Gamal) [2172474]
- net: mana: Add support for auxiliary device (Mohammed Gamal) [2172474]
- hv_netvsc: Check status in SEND_RNDIS_PKT completion message (Mohammed Gamal) [2172438]
- hv_netvsc: Allocate memory in netvsc_dma_map() with GFP_ATOMIC (Mohammed Gamal) [2172438]
- hv_netvsc: Fix missed pagebuf entries in netvsc_dma_map/unmap() (Mohammed Gamal) [2172438]
- Drivers: hv: Make remove callback of hyperv driver void returned (Mohammed Gamal) [2172438]
- hv: fix comment typo in vmbus_channel/low_latency (Mohammed Gamal) [2172434]
- x86/hyperv: Introduce HV_MAX_SPARSE_VCPU_BANKS/HV_VCPUS_PER_SPARSE_BANK constants (Mohammed Gamal) [2172434]
- x86/hyperv: Fix hv_get/set_register for nested bringup (Mohammed Gamal) [2172434]
- x86/hyperv: Add an interface to do nested hypercalls (Mohammed Gamal) [2172434]
- Drivers: hv: Setup synic registers in case of nested root partition (Mohammed Gamal) [2172434]
- x86/hyperv: Add support for detecting nested hypervisor (Mohammed Gamal) [2172434]
- x86/hyperv: Add HV_EXPOSE_INVARIANT_TSC define (Mohammed Gamal) [2172434]
- x86/hyperv: Expand definition of struct hv_vp_assist_page (Mohammed Gamal) [2172434]
- KVM: x86: hyper-v: Expose support for extended gva ranges for flush hypercalls (Mohammed Gamal) [2172434]
- x86/hyperv: Move VMCB enlightenment definitions to hyperv-tlfs.h (Mohammed Gamal) [2172434]
- iommu/hyper-v: Allow hyperv irq remapping without x2apic (Mohammed Gamal) [2172434]
- smp: Fix offline cpu check in flush_smp_call_function_queue() (Waiman Long) [2169471]
- sched/fair: Trigger the update of blocked load on newly idle cpu (Waiman Long) [2169471]
- redhat: rh-dist-git should depend on rh-srpm (Denys Vlasenko)
- redhat: change kabi tarballs to use the package release (Denys Vlasenko)
- redhat/Makefile: add variables used in rhel9 makefiles (Denys Vlasenko)
- redhat/Makefile: Remove RHPRODUCT variable (Denys Vlasenko)
- redhat/scripts/rh-dist-git.sh: expand sources from srpm (Denys Vlasenko)
- redhat: remove GL_DISTGIT_USER, RHDISTGIT and unify dist-git cloning (Denys Vlasenko)
- redhat/scripts/rh-dist-git.sh: Use Makefile variables (Denys Vlasenko)
- redhat: fix typo and make the output more silent for dist-git sync (Denys Vlasenko)
- redhat: add initial support for centos stream dist-git sync on Makefiles (Denys Vlasenko)
- internal: update RHEL_MINOR for the start of RHEL-8.9 development (Denys Vlasenko)
- watchdog: diag288_wdt: fix __diag288() inline assembly (Tobias Huschle) [2171361]
- watchdog: diag288_wdt: do not use stack buffers for hardware data (Tobias Huschle) [2171361]
- bonding: add documentation for peer_notif_delay (Ryosuke Yasuoka) [2171348]
- net: mana: Fix IRQ name - add PCI and queue number (Mohammed Gamal) [2166787]
- crypto: des - disallow des3 in FIPS mode (Vladis Dronov) [2175234]
- self-tests: more rps self tests (Paolo Abeni) [2168878]
- net: make default_rps_mask a per netns attribute (Paolo Abeni) [2168878]
- self-tests: introduce self-tests for RPS default mask (Paolo Abeni) [2168878]
- net: introduce default_rps_mask netns attribute (Paolo Abeni) [2168878]
- net-sysctl: factor-out rpm mask manipulation helpers (Paolo Abeni) [2168878]
- net-sysctl: factor out cpumask parsing helper (Paolo Abeni) [2168878]
- txhash: Make rethinking txhash behavior configurable via sysctl (Paolo Abeni) [2168878]
- net-sysfs: Call dev_hold always in rx_queue_add_kobject (Paolo Abeni) [2168878]
- net-sysfs: Call dev_hold always in netdev_queue_add_kobject (Paolo Abeni) [2168878]
- net-sysfs: fix netdev_queue_add_kobject() breakage (Paolo Abeni) [2168878]
- net-sysfs: Fix reference count leak in rx|netdev_queue_add_kobject (Paolo Abeni) [2168878]
- ice/ptp: fix the PTP worker retrying indefinitely if the link went down (Petr Oros) [2166392]
- ice: reschedule ice_ptp_wait_for_offset_valid during reset (Petr Oros) [2166392]
- ice: make Tx and Rx vernier offset calibration independent (Petr Oros) [2166392]
- ice: only check set bits in ice_ptp_flush_tx_tracker (Petr Oros) [2166392]
- ice: handle flushing stale Tx timestamps in ice_ptp_tx_tstamp (Petr Oros) [2166392]
- ice: cleanup allocations in ice_ptp_alloc_tx_tracker (Petr Oros) [2166392]
- ice: protect init and calibrating check in ice_ptp_request_ts (Petr Oros) [2166392]
- ice: check Tx timestamp memory register for ready timestamps (Petr Oros) [2166392]
- ice: handle discarding old Tx requests in ice_ptp_tx_tstamp (Petr Oros) [2166392]
- ice: always call ice_ptp_link_change and make it void (Petr Oros) [2166392]
- ice: fix misuse of "link err" with "link status" (Petr Oros) [2166392]
- ice: Reset TS memory for all quads (Petr Oros) [2166392]
- ice: Remove the E822 vernier "bypass" logic (Petr Oros) [2166392]
- ice: Use more generic names for ice_ptp_tx fields (Petr Oros) [2166392]
- ice: Merge pin initialization of E810 and E810T adapters (Petr Oros) [2166392]
- ice: Check if reset in progress while waiting for offsets (Petr Oros) [2166392]
- NFS: Judge the file access cache's timestamp in rcu path (Benjamin Coddington) [2161321]
- redhat: switch to z-stream for 8.8 (Lucas Zampieri)
* Thu Mar 30 2023 Luis Claudio R. Goncalves <lgoncalv@redhat.com> [4.18.0-478.rt7.267.el8]
- [rt] build kernel-rt-4.18.0-478.rt7.267.el8 [2180997]
- net/tunnel: wait until all sk_user_data reader finish before releasing the sock (Hangbin Liu) [2176344]

Binary file not shown.

Binary file not shown.

View File

@ -1 +1 @@
SHA512 (linux-4.18.0-478.rt7.267.el8.tar.xz) = 5d7fce56f84ddba1ea4a7e256a6ed3e964e1716b394958e7b2532955dafa27ff0090c5f503100f190ae92cbafabde382857db595b4a2b6c7290c541596ea943f
SHA512 (linux-4.18.0-479.rt7.268.el8.tar.xz) = 16417987fd4e3113b97f9da43a27e095d4fd152f29742a95039ebfbe8faacd02db038fccfdf18f2e00e277f4a7f4b93ab544d7c284add4521b9bb8dbe2e69433