Update gcp patch

SOURCES/almalinux.pem

@@ -0,0 +1,46 @@
+-----BEGIN CERTIFICATE-----
+MIID3zCCAsegAwIBAgIQY4iebPtuT3OKR2M/jWZWEzANBgkqhkiG9w0BAQsFADBg
+MSUwIwYJKoZIhvcNAQkBFhZzZWN1cml0eUBhbG1hbGludXgub3JnMRIwEAYDVQQK
+EwlBbG1hTGludXgxIzAhBgNVBAMTGkFsbWFMaW51eCBTZWN1cmUgQm9vdCBDQSAx
+MB4XDTIxMDExNDIxMDcxOVoXDTM2MDExMTIxMDcxOVowaTElMCMGCSqGSIb3DQEJ
+ARYWc2VjdXJpdHlAYWxtYWxpbnV4Lm9yZzESMBAGA1UEChMJQWxtYUxpbnV4MSww
+KgYDVQQDEyNBbG1hTGludXggRHJpdmVyIHVwZGF0ZSBzaWduaW5nIGtleTCCASIw
+DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK7kGZShKo5uegg6T4U/wR9UeyCa
+qTtx+OvzUMKT8l5+R5WfBgQU8sDrIqX3Vv3tD6UeOUyFIQ40iGESdDhWnAFynJX4
+v0k81KxJ+rVFAt5EJBeGw7U2qdpn8hzJG2dVANZ1gXJWGhC95Muif5q8fL7BJdU4
+RufixfKWq6WHAalwHaiTCbA+/Ft6TLyZcA62glKkmBn7uWn83tlMfVqC4EN2NfQb
+//C2MFCbm43BoKmgrMV0J3Pu8un3QZ4ukDDhJJ9eHfSqscq9SHPjqd0RM6TRcFXW
+BzmTpG7MOJRvk4ypQSHxxc4jK5MVOqzel+2UPB2ihkvvnK9hdsvvI/bal/sCAwEA
+AaOBizCBiDAfBgNVHSMEGDAWgBSY0u339QWy5Y/vkiTSvJ6Ffy5GkzAVBglghkgB
+hvhCAQEBAf8EBQMDAPABMB8GA1UdJQQYMBYGCCsGAQUFBwMDBgorBgEEAZIIEAEC
+MA4GA1UdDwEB/wQEAwIEsDAdBgNVHQ4EFgQUe4Y+AkDtIIq2uBuKbyhgwPTox9Yw
+DQYJKoZIhvcNAQELBQADggEBAHoPojMTRdFO050Ihrmr8jkdOweiOSBtlAZkLGd2
+lTybNp2Xi1lQ8SqsqU/NFs/KUPVFykmjmLeqNWC9QoKdrVGzoD9MOHprRxe6gC8k
+sHzBCFqdx3B+qbeSxBUN2QLIydzM6C23qf1TjBCeEDtRrvcvupFTlOBxiOJrIwbp
+dJD1JfjbgxfvLzg7PaJPi5Ev6B3gY4ybCnKQmor029Z3R4zw3miPpZVA04xt3Z9e
+m45Jjv86u10wjLmGRgfMmYT43jiMbOwlG1N8OikvgIHwlZtWxUpL1t/mEYtMMkTv
+R//lA5z5dqXiDCPdTwHhSjEfBFWGLl7ciYt6rYkpdlqnYdk=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIID2DCCAsCgAwIBAgIQHDEXJMuZQ/m5MXRiSmLMljANBgkqhkiG9w0BAQsFADBg
+MSUwIwYJKoZIhvcNAQkBFhZzZWN1cml0eUBhbG1hbGludXgub3JnMRIwEAYDVQQK
+EwlBbG1hTGludXgxIzAhBgNVBAMTGkFsbWFMaW51eCBTZWN1cmUgQm9vdCBDQSAx
+MB4XDTIxMDExNDIxMDgwMFoXDTM2MDExMTIxMDgwMFowYjElMCMGCSqGSIb3DQEJ
+ARYWc2VjdXJpdHlAYWxtYWxpbnV4Lm9yZzESMBAGA1UEChMJQWxtYUxpbnV4MSUw
+IwYDVQQDExxBbG1hTGludXgga3BhdGNoIHNpZ25pbmcga2V5MIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxncKQ7a49o5IUwqPB1axIzopNdGoSoERVuUd
+hdHAZLB2MGIuU2fGCuZ4iD2Pwk+t2KsgR1y58pmHyRBCLi2tYfEdDB8LUzUY3P+8
+Wxm2+zz8TPJUIcvPE4rHEb0vV4nTzwjpG4BTBwLkYRj+AxGbzWEy5Eetxzq5Ji+V
+TMuTzRKshHEGNs3tFRPbSssc50NH+OuVKpzJAIqBmz7Gca9RqhK9ARK1p3aDEoR+
+pYw4zRjIczc3s57WeuQxRMvFK5j48U0hpEUh+eQn1m40Bus3e7i4YTskwgKN5Vq3
+lGlEdBoK4utuoHPj3JYh97hOii/kulOa9j5xeNe5z/6QByMxpwIDAQABo4GLMIGI
+MB8GA1UdIwQYMBaAFJjS7ff1BbLlj++SJNK8noV/LkaTMBUGCWCGSAGG+EIBAQEB
+/wQFAwMA8AEwHwYDVR0lBBgwFgYIKwYBBQUHAwMGCisGAQQBkggQAQIwDgYDVR0P
+AQH/BAQDAgSwMB0GA1UdDgQWBBRpptnu0/Yg1cLhOh0hHEZRClrZ9TANBgkqhkiG
+9w0BAQsFAAOCAQEAMDiuS0CD31MtO1Sn4HRYvai2LFdKpUKAEXVy9hsN+AfbcMcl
+2sF/w49o43cMNIFoWKhMWZMOjCj/DGQY7ehNH3DRaTl7DNCu6y7mBNJPU+iPcE4r
+92SBWIxUNi7YVbsc1evKBOnrtq6xd5BUJQx1cVGmSBI9dnd4tDBB2+KjpmdhzZK5
+V1KQz1ilz5g2FNyEj6L7hnpkGUeMYnuM49YL7JP8QNtaKUBBA3BR4S7de+Tu070h
+pEhvE539I6B+wmgV/bio20TUpQ5W2eH+5YUHVIZa5pZ30tVkm21iNB7eccbM4NYc
+IRmwIsesuROtaM1e0lHoxKdW0N2xOSkhSY6oyQ==
+-----END CERTIFICATE-----

SOURCES/debrand-rh-i686-cpu.patch

@@ -0,0 +1,11 @@
+--- a/arch/x86/boot/main.c	2019-03-13 04:04:53.000000000 -0700
++++ b/arch/x86/boot/main.c	2019-05-25 14:31:21.043272496 -0700
+@@ -147,7 +147,7 @@ void main(void)
+ 
+ 	/* Make sure we have all the proper CPU support */
+ 	if (validate_cpu()) {
+-		puts("This processor is not supported in this version of RHEL.\n");
++		puts("This processor is not supported in this version of AlmaLinux.\n");
+ 		die();
+ 	}
+ 

SOURCES/debrand-rh_taint.patch

@@ -0,0 +1,81 @@
+--- a/kernel/rh_taint.c	2020-10-16 10:41:51.000000000 -0500
++++ b/kernel/rh_taint.c	2020-11-19 10:50:24.853039167 -0600
+@@ -2,12 +2,12 @@
+ #include <linux/module.h>
+ 
+ /*
+- * The following functions are used by Red Hat to indicate to users that
+- * hardware and drivers are unsupported, or have limited support in RHEL major
++ * The following functions are used by AlmaLinux to indicate to users that
++ * hardware and drivers are unsupported, or have limited support in AlmaLinux major
+  * and minor releases.  These functions output loud warning messages to the end
+  * user and should be USED WITH CAUTION.
+  *
+- * Any use of these functions _MUST_ be documented in the RHEL Release Notes,
++ * Any use of these functions _MUST_ be documented in the AlmaLinux Release Notes,
+  * and have approval of management.
+  */
+ 
+@@ -16,15 +16,15 @@
+  * @msg: Hardware name, class, or type
+  *
+  * Called to mark a device, class of devices, or types of devices as not having
+- * support in any RHEL minor release.  This does not TAINT the kernel.  Red Hat
+- * will not fix bugs against this hardware in this minor release.  Red Hat may
++ * support in any AlmaLinux minor release.  This does not TAINT the kernel.  AlmaLinux
++ * will not fix bugs against this hardware in this minor release.  AlmaLinux may
+  * declare support in a future major or minor update release.  This cannot be
+  * used to mark drivers unsupported.
+  */
+ void mark_hardware_unsupported(const char *msg)
+ {
+ 	/* Print one single message */
+-	pr_crit("Warning: %s - this hardware has not undergone testing by Red Hat and might not be certified. Please consult https://catalog.redhat.com for certified hardware.\n", msg);
++	pr_crit("Warning: %s - this hardware has not undergone testing by AlmaLinux and might not be certified.\n", msg);
+ }
+ EXPORT_SYMBOL(mark_hardware_unsupported);
+ 
+@@ -35,12 +35,12 @@ EXPORT_SYMBOL(mark_hardware_unsupported)
+  * Called to minimize the support status of a previously supported device in
+  * a minor release.  This does not TAINT the kernel.  Marking hardware
+  * deprecated is usually done in conjunction with the hardware vendor.  Future
+- * RHEL major releases may not include this driver.  Driver updates and fixes
++ * AlmaLinux major releases may not include this driver.  Driver updates and fixes
+  * for this device will be limited to critical issues in future minor releases.
+  */
+ void mark_hardware_deprecated(const char *msg)
+ {
+-	pr_crit("Warning: %s - this hardware is not recommended for new deployments. It continues to be supported in this RHEL release, but it is likely to be removed in the next major release. Driver updates and fixes for this device will be limited to critical issues. Please contact Red Hat Support or your device's hardware vendor for additional information.\n", msg);
++	pr_crit("Warning: %s - this hardware is not recommended for new deployments. It continues to be supported in this AlmaLinux release, but it is likely to be removed in the next major release. Driver updates and fixes for this device will be limited to critical issues. Please contact AlmaLinux Support or your device's hardware vendor for additional information.\n", msg);
+ }
+ EXPORT_SYMBOL(mark_hardware_deprecated);
+ 
+@@ -50,9 +50,9 @@ EXPORT_SYMBOL(mark_hardware_deprecated);
+  *
+  * Called to minimize the support status of a new driver.  This does TAINT the
+  * kernel.  Calling this function indicates that the driver or subsystem has
+- * had limited testing and is not marked for full support within this RHEL
+- * minor release.  The next RHEL minor release may contain full support for
+- * this driver.  Red Hat does not guarantee that bugs reported against this
++ * had limited testing and is not marked for full support within this AlmaLinux
++ * minor release.  The next AlmaLinux minor release may contain full support for
++ * this driver.  AlmaLinux does not guarantee that bugs reported against this
+  * driver or subsystem will be resolved.
+  */
+ void mark_tech_preview(const char *msg, struct module *mod)
+@@ -81,13 +81,13 @@ EXPORT_SYMBOL(mark_tech_preview);
+  * mark_driver_unsupported - drivers that we know we don't want to support
+  * @name: the name of the driver
+  *
+- * In some cases Red Hat has chosen to build a driver for internal QE
++ * In some cases AlmaLinux has chosen to build a driver for internal QE
+  * use. Use this function to mark those drivers as unsupported for
+  * customers.
+  */
+ void mark_driver_unsupported(const char *name)
+ {
+-	pr_crit("Warning: %s - This driver has not undergone sufficient testing by Red Hat for this release and therefore cannot be used in production systems.\n",
++	pr_crit("Warning: %s - This driver has not undergone sufficient testing by AlmaLinux for this release and therefore cannot be used in production systems.\n",
+ 	        name ? name : "kernel");
+ }
+ EXPORT_SYMBOL(mark_driver_unsupported);

SOURCES/debrand-single-cpu.patch

@@ -0,0 +1,11 @@
+--- a/arch/x86/kernel/setup.c	2019-03-13 04:04:53.000000000 -0700
++++ b/arch/x86/kernel/setup.c	2019-05-27 08:35:54.580595314 -0700
+@@ -900,7 +900,7 @@ static void rh_check_supported(void)
+ 	if (((boot_cpu_data.x86_max_cores * smp_num_siblings) == 1) &&
+ 	    !guest && is_kdump_kernel()) {
+ 		pr_crit("Detected single cpu native boot.\n");
+-		pr_crit("Important:  In Red Hat Enterprise Linux 8, single threaded, single CPU 64-bit physical systems are unsupported by Red Hat. Please contact your Red Hat support representative for a list of certified and supported systems.");
++		pr_crit("Important:  In AlmaLinux 8, single threaded, single CPU 64-bit physical systems are unsupported. Please see https://www.almalinux.org for more information");
+ 	}
+ 
+ 	/*

SOURCES/kernel-aarch64-debug.config

@@ -133,9 +133,9 @@
 # CONFIG_ARCH_ZYNQMP is not set
 # CONFIG_ARCNET is not set
 # CONFIG_ARM64_16K_PAGES is not set
-# CONFIG_ARM64_4K_PAGES is not set
+CONFIG_ARM64_4K_PAGES=y
 # CONFIG_ARM64_DEBUG_PRIORITY_MASKING is not set
-# CONFIG_ARM64_PA_BITS_48 is not set
+CONFIG_ARM64_PA_BITS_48=y
 # CONFIG_ARM64_PSEUDO_NMI is not set
 # CONFIG_ARM64_PTDUMP_DEBUGFS is not set
 # CONFIG_ARM64_PTR_AUTH is not set
@@ -2500,7 +2500,7 @@ CONFIG_ARCH_THUNDER=y
 CONFIG_ARCH_VEXPRESS=y
 CONFIG_ARCH_XGENE=y
 CONFIG_ARM64=y
-CONFIG_ARM64_64K_PAGES=y
+# CONFIG_ARM64_64K_PAGES is not set
 CONFIG_ARM64_ACPI_PARKING_PROTOCOL=y
 CONFIG_ARM64_CNP=y
 CONFIG_ARM64_CRYPTO=y
@@ -2518,13 +2518,14 @@ CONFIG_ARM64_ERRATUM_858921=y
 CONFIG_ARM64_HW_AFDBM=y
 CONFIG_ARM64_LSE_ATOMICS=y
 CONFIG_ARM64_PAN=y
-CONFIG_ARM64_PA_BITS_52=y
+# CONFIG_ARM64_PA_BITS_52 is not set
 CONFIG_ARM64_PMEM=y
 CONFIG_ARM64_RAS_EXTN=y
 CONFIG_ARM64_SVE=y
 CONFIG_ARM64_UAO=y
-CONFIG_ARM64_USER_VA_BITS_52=y
-CONFIG_ARM64_VA_BITS_48=y
+# CONFIG_ARM64_USER_VA_BITS_52 is not set
+# CONFIG_ARM64_VA_BITS_48 is not set
+CONFIG_ARM64_VA_BITS_32=y
 CONFIG_ARM64_VHE=y
 CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
 CONFIG_ARM_CCN=y
@@ -2919,7 +2920,7 @@ CONFIG_CRYPTO_ECHAINIV=m
 CONFIG_CRYPTO_ESSIV=y
 CONFIG_CRYPTO_FCRYPT=m
 CONFIG_CRYPTO_FIPS=y
-CONFIG_CRYPTO_FIPS_NAME="Red Hat Enterprise Linux 8 - Kernel Cryptographic API"
+CONFIG_CRYPTO_FIPS_NAME="AlmaLinux 8 - Kernel Cryptographic API"
 CONFIG_CRYPTO_GCM=y
 CONFIG_CRYPTO_GF128MUL=y
 CONFIG_CRYPTO_GHASH=y

SOURCES/kernel-aarch64.config

@@ -139,8 +139,8 @@
 # CONFIG_ARCH_ZYNQMP is not set
 # CONFIG_ARCNET is not set
 # CONFIG_ARM64_16K_PAGES is not set
-# CONFIG_ARM64_4K_PAGES is not set
-# CONFIG_ARM64_PA_BITS_48 is not set
+CONFIG_ARM64_4K_PAGES=y
+CONFIG_ARM64_PA_BITS_48=y
 # CONFIG_ARM64_PSEUDO_NMI is not set
 # CONFIG_ARM64_PTDUMP_DEBUGFS is not set
 # CONFIG_ARM64_PTR_AUTH is not set
@@ -2571,7 +2571,7 @@ CONFIG_ARCH_THUNDER=y
 CONFIG_ARCH_VEXPRESS=y
 CONFIG_ARCH_XGENE=y
 CONFIG_ARM64=y
-CONFIG_ARM64_64K_PAGES=y
+# CONFIG_ARM64_64K_PAGES is not set
 CONFIG_ARM64_ACPI_PARKING_PROTOCOL=y
 CONFIG_ARM64_CNP=y
 CONFIG_ARM64_CRYPTO=y
@@ -2589,13 +2589,14 @@ CONFIG_ARM64_ERRATUM_858921=y
 CONFIG_ARM64_HW_AFDBM=y
 CONFIG_ARM64_LSE_ATOMICS=y
 CONFIG_ARM64_PAN=y
-CONFIG_ARM64_PA_BITS_52=y
+# CONFIG_ARM64_PA_BITS_52 is not set
 CONFIG_ARM64_PMEM=y
 CONFIG_ARM64_RAS_EXTN=y
 CONFIG_ARM64_SVE=y
 CONFIG_ARM64_UAO=y
-CONFIG_ARM64_USER_VA_BITS_52=y
-CONFIG_ARM64_VA_BITS_48=y
+# CONFIG_ARM64_USER_VA_BITS_52 is not set
+# CONFIG_ARM64_VA_BITS_48 is not set
+CONFIG_ARM64_VA_BITS_32=y
 CONFIG_ARM64_VHE=y
 CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
 CONFIG_ARM_CCN=y
@@ -2982,7 +2983,7 @@ CONFIG_CRYPTO_ECHAINIV=m
 CONFIG_CRYPTO_ESSIV=y
 CONFIG_CRYPTO_FCRYPT=m
 CONFIG_CRYPTO_FIPS=y
-CONFIG_CRYPTO_FIPS_NAME="Red Hat Enterprise Linux 8 - Kernel Cryptographic API"
+CONFIG_CRYPTO_FIPS_NAME="AlmaLinux 8 - Kernel Cryptographic API"
 CONFIG_CRYPTO_GCM=y
 CONFIG_CRYPTO_GF128MUL=y
 CONFIG_CRYPTO_GHASH=y

SOURCES/kernel-ppc64le-debug.config

@@ -2593,7 +2593,7 @@ CONFIG_CRYPTO_ECHAINIV=m
 CONFIG_CRYPTO_ESSIV=y
 CONFIG_CRYPTO_FCRYPT=m
 CONFIG_CRYPTO_FIPS=y
-CONFIG_CRYPTO_FIPS_NAME="Red Hat Enterprise Linux 8 - Kernel Cryptographic API"
+CONFIG_CRYPTO_FIPS_NAME="AlmaLinux 8 - Kernel Cryptographic API"
 CONFIG_CRYPTO_GCM=y
 CONFIG_CRYPTO_GF128MUL=y
 CONFIG_CRYPTO_GHASH=y

SOURCES/kernel-ppc64le.config

@@ -2653,7 +2653,7 @@ CONFIG_CRYPTO_ECHAINIV=m
 CONFIG_CRYPTO_ESSIV=y
 CONFIG_CRYPTO_FCRYPT=m
 CONFIG_CRYPTO_FIPS=y
-CONFIG_CRYPTO_FIPS_NAME="Red Hat Enterprise Linux 8 - Kernel Cryptographic API"
+CONFIG_CRYPTO_FIPS_NAME="AlmaLinux 8 - Kernel Cryptographic API"
 CONFIG_CRYPTO_GCM=y
 CONFIG_CRYPTO_GF128MUL=y
 CONFIG_CRYPTO_GHASH=y

SOURCES/kernel-s390x-debug.config

@@ -2714,7 +2714,7 @@ CONFIG_CRYPTO_ECHAINIV=m
 CONFIG_CRYPTO_ESSIV=y
 CONFIG_CRYPTO_FCRYPT=m
 CONFIG_CRYPTO_FIPS=y
-CONFIG_CRYPTO_FIPS_NAME="Red Hat Enterprise Linux 8 - Kernel Cryptographic API"
+CONFIG_CRYPTO_FIPS_NAME="AlmaLinux 8 - Kernel Cryptographic API"
 CONFIG_CRYPTO_GCM=y
 CONFIG_CRYPTO_GF128MUL=y
 CONFIG_CRYPTO_GHASH=y

SOURCES/kernel-s390x-zfcpdump.config

@@ -2925,7 +2925,7 @@ CONFIG_CRYPTO_ECHAINIV=y
 CONFIG_CRYPTO_ESSIV=y
 CONFIG_CRYPTO_FCRYPT=y
 CONFIG_CRYPTO_FIPS=y
-CONFIG_CRYPTO_FIPS_NAME="Red Hat Enterprise Linux 8 - Kernel Cryptographic API"
+CONFIG_CRYPTO_FIPS_NAME="AlmaLinux 8 - Kernel Cryptographic API"
 CONFIG_CRYPTO_GCM=y
 CONFIG_CRYPTO_GF128MUL=y
 CONFIG_CRYPTO_GHASH=y

SOURCES/kernel-s390x.config

@@ -2776,7 +2776,7 @@ CONFIG_CRYPTO_ECHAINIV=m
 CONFIG_CRYPTO_ESSIV=y
 CONFIG_CRYPTO_FCRYPT=m
 CONFIG_CRYPTO_FIPS=y
-CONFIG_CRYPTO_FIPS_NAME="Red Hat Enterprise Linux 8 - Kernel Cryptographic API"
+CONFIG_CRYPTO_FIPS_NAME="AlmaLinux 8 - Kernel Cryptographic API"
 CONFIG_CRYPTO_GCM=y
 CONFIG_CRYPTO_GF128MUL=y
 CONFIG_CRYPTO_GHASH=y

SOURCES/kernel-x86_64-debug.config

@@ -2654,7 +2654,7 @@ CONFIG_CRYPTO_ECHAINIV=m
 CONFIG_CRYPTO_ESSIV=y
 CONFIG_CRYPTO_FCRYPT=m
 CONFIG_CRYPTO_FIPS=y
-CONFIG_CRYPTO_FIPS_NAME="Red Hat Enterprise Linux 8 - Kernel Cryptographic API"
+CONFIG_CRYPTO_FIPS_NAME="AlmaLinux 8 - Kernel Cryptographic API"
 CONFIG_CRYPTO_GCM=y
 CONFIG_CRYPTO_GF128MUL=y
 CONFIG_CRYPTO_GHASH=y

SOURCES/kernel-x86_64.config

@@ -2716,7 +2716,7 @@ CONFIG_CRYPTO_ECHAINIV=m
 CONFIG_CRYPTO_ESSIV=y
 CONFIG_CRYPTO_FCRYPT=m
 CONFIG_CRYPTO_FIPS=y
-CONFIG_CRYPTO_FIPS_NAME="Red Hat Enterprise Linux 8 - Kernel Cryptographic API"
+CONFIG_CRYPTO_FIPS_NAME="AlmaLinux 8 - Kernel Cryptographic API"
 CONFIG_CRYPTO_GCM=y
 CONFIG_CRYPTO_GF128MUL=y
 CONFIG_CRYPTO_GHASH=y

SOURCES/x509.genkey

@@ -5,9 +5,9 @@ prompt = no
 x509_extensions = myexts
 
 [ req_distinguished_name ]
-O = Red Hat
-CN = Red Hat Enterprise Linux kernel signing key
-emailAddress = secalert@redhat.com
+O = AlmaLinux
+CN = AlmaLinux kernel signing key
+emailAddress = security@almalinux.org
 
 [ myexts ]
 basicConstraints=critical,CA:FALSE

SPECS/kernel.spec

@@ -15,7 +15,7 @@
 %global distro_build 477
 
 # Sign the x86_64 kernel for secure boot authentication
-%ifarch x86_64 aarch64 s390x ppc64le
+%ifarch x86_64 aarch64
 %global signkernel 1
 %else
 %global signkernel 0
@@ -218,14 +218,14 @@
 %define with_bpftool 1
 %endif
 
-%ifnarch noarch
+%ifnarch x86_64
 %define with_kernel_abi_stablelists 0
 %endif
 
 # Overrides for generic default options
 
 # only package docs noarch
-%ifnarch noarch
+%ifnarch x86_64
 %define with_doc 0
 %define doc_build_fail true
 %endif
@@ -290,6 +290,10 @@
 %define hdrarch arm64
 %define make_target Image.gz
 %define kernel_image arch/arm64/boot/Image.gz
+# Disable kABI check because of changed page size for GCP
+%define with_kabichk 0
+%define with_kabidupchk 0
+%define with_kabidwchk 0
 %endif
 
 # To temporarily exclude an architecture from being built, add it to
@@ -329,7 +333,7 @@ Group: System Environment/Kernel
 License: GPLv2 and Redistributable, no modification permitted
 URL: http://www.kernel.org/
 Version: %{rpmversion}
-Release: %{pkg_release}
+Release: %{pkg_release}.gcp
 Summary: The Linux kernel, based on version %{version}, heavily modified with backports
 %if %{with_realtime}
 ExclusiveArch: x86_64
@@ -447,34 +451,11 @@ Source9: x509.genkey
 %define signing_key_filename kernel-signing-s390.cer
 %endif
 
-Source10: redhatsecurebootca3.cer
-Source11: redhatsecurebootca5.cer
-Source12: redhatsecureboot301.cer
-Source13: redhatsecureboot501.cer
-Source14: secureboot_s390.cer
-Source15: secureboot_ppc.cer
-Source16: redhatsecurebootca7.cer
+Source11: almalinuxsecurebootca0.cer
 
-%define secureboot_ca_0 %{SOURCE10}
-%define secureboot_ca_1 %{SOURCE11}
-%define secureboot_ca_2 %{SOURCE16}
-
-%ifarch x86_64 aarch64
-%define secureboot_key_0 %{SOURCE12}
-%define pesign_name_0 redhatsecureboot301
-%define secureboot_key_1 %{SOURCE13}
-%define pesign_name_1 redhatsecureboot501
-%endif
-
-%ifarch s390x
-%define secureboot_key_0 %{SOURCE14}
-%define pesign_name_0 redhatsecureboot302
-%endif
-
-%ifarch ppc64le
-%define secureboot_key_0 %{SOURCE15}
-%define pesign_name_0 redhatsecureboot701
-%endif
+%define secureboot_ca_0 %{SOURCE11}
+%define secureboot_key_0 %{SOURCE11}
+%define pesign_name_0 almalinuxsecurebootca0
 
 Source17: mod-blacklist.sh
 Source18: mod-sign.sh
@@ -503,8 +484,8 @@ Source43: generate_bls_conf.sh
 
 Source44: mod-internal.list
 
-Source100: rheldup3.x509
-Source101: rhelkpatch1.x509
+# Source100: rheldup3.x509
+# Source101: rhelkpatch1.x509
 
 %if %{with_kabichk}
 Source200: check-kabi
@@ -532,23 +513,32 @@ Source2000: cpupower.service
 Source2001: cpupower.config
 Source2002: kvm_stat.logrotate
 
+
+Source9000: almalinux.pem
 # CI gating config
 Source4000: gating.yaml
 # rpminspect config
 Source4001: rpminspect.yaml
 
+
 ## Patches needed for building this package
 
 # empty final patch to facilitate testing of kernel patches
 Patch999999: linux-kernel-test.patch
 
+Patch1000: debrand-single-cpu.patch
+# Patch1001: debrand-rh_taint.patch
+Patch1002: debrand-rh-i686-cpu.patch
+
+Patch1003: 0001-Apply-GCP-related-changes.patch
+
 # END OF PATCH DEFINITIONS
 
 BuildRoot: %{_tmppath}/%{name}-%{KVERREL}-root
 
 %description
-This is the package which provides the Linux %{name} for Red Hat Enterprise
-Linux. It is based on upstream Linux at version %{version} and maintains kABI
+This is the package which provides the Linux %{name} for AlmaLinux.
+It is based on upstream Linux at version %{version} and maintains kABI
 compatibility of a set of approved symbols, however it is heavily modified with
 backports and fixes pulled from newer upstream Linux %{name} releases. This means
 this is not a %{version} kernel anymore: it includes several components which come
@@ -556,7 +546,7 @@ from newer upstream linux versions, while maintaining a well tested and stable
 core. Some of the components/backports that may be pulled in are: changes like
 updates to the core kernel (eg.: scheduler, cgroups, memory management, security
 fixes and features), updates to block layer, supported filesystems, major driver
-updates for supported hardware in Red Hat Enterprise Linux, enhancements for
+updates for supported hardware in AlmaLinux, enhancements for
 enterprise customers, etc.
 
 #
@@ -591,6 +581,7 @@ AutoProv: yes\
 %package doc
 Summary: Various documentation bits found in the kernel source
 Group: Documentation
+BuildArch: noarch
 %description doc
 This package contains documentation files from the kernel
 source. Various bits of information about the Linux kernel and the
@@ -800,14 +791,15 @@ kernel-gcov includes the gcov graph and source files for gcov coverage collectio
 %endif
 
 %package -n %{name}-abi-stablelists
-Summary: The Red Hat Enterprise Linux kernel ABI symbol stablelists
+Summary: The AlmaLinux kernel ABI symbol stablelists
 Group: System Environment/Kernel
 AutoReqProv: no
+BuildArch: noarch
 Obsoletes: %{name}-abi-whitelists < %{rpmversion}-%{pkg_release}
 Provides: %{name}-abi-whitelists
 %description -n %{name}-abi-stablelists
-The kABI package contains information pertaining to the Red Hat Enterprise
-Linux kernel ABI, including lists of kernel symbols that are needed by
+The kABI package contains information pertaining to the AlmaLinux
+kernel ABI, including lists of kernel symbols that are needed by
 external Linux kernel modules, and a yum plugin to aid enforcement.
 
 %if %{with_kabidw_base}
@@ -816,8 +808,8 @@ Summary: The baseline dataset for kABI verification using DWARF data
 Group: System Environment/Kernel
 AutoReqProv: no
 %description kernel-kabidw-base-internal
-The package contains data describing the current ABI of the Red Hat Enterprise
-Linux kernel, suitable for the kabi-dw tool.
+The package contains data describing the current ABI of the AlmaLinux
+kernel, suitable for the kabi-dw tool.
 %endif
 
 #
@@ -891,7 +883,7 @@ Requires: %{name}%{?1:-%{1}}-modules-uname-r = %{KVERREL}%{?variant}%{?1:+%{1}}\
 AutoReq: no\
 AutoProv: yes\
 %description %{?1:%{1}-}modules-internal\
-This package provides kernel modules for the %{?2:%{2} }kernel package for Red Hat internal usage.\
+This package provides kernel modules for the %{?2:%{2} }kernel package for AlmaLinux internal usage.\
 %{nil}
 
 #
@@ -982,6 +974,11 @@ Summary: %{variant_summary}\
 Group: System Environment/Kernel\
 Provides: %{name}-%{?1:%{1}-}core-uname-r = %{KVERREL}%{?variant}%{?1:+%{1}}\
 Provides: installonlypkg(kernel)\
+%if "%{?1}" == ""\
+Provides: almalinux(kernel-sig-key) = 202303\
+Conflicts: shim-ia32 <= 15.6-1.el8.alma\
+Conflicts: shim-x64 <= 15.6-1.el8.alma\
+%endif\
 %{expand:%%kernel_reqprovconf}\
 %if %{?1:1} %{!?1:0} \
 %{expand:%%kernel_meta_package %{?1:%{1}}}\
@@ -1089,10 +1086,15 @@ ApplyOptionalPatch()
 }
 
 %setup -q -n %{name}-%{rpmversion}-%{pkgrelease} -c
+cp -v %{SOURCE9000} linux-%{rpmversion}-%{pkgrelease}/certs/rhel.pem
 mv linux-%{rpmversion}-%{pkgrelease} linux-%{KVERREL}
 
 cd linux-%{KVERREL}
 
+ApplyOptionalPatch debrand-single-cpu.patch
+# ApplyOptionalPatch debrand-rh_taint.patch
+ApplyOptionalPatch debrand-rh-i686-cpu.patch
+ApplyOptionalPatch 0001-Apply-GCP-related-changes.patch
 ApplyOptionalPatch linux-kernel-test.patch
 
 # END OF PATCH APPLICATIONS
@@ -1162,11 +1164,11 @@ done
 
 # Add DUP and kpatch certificates to system trusted keys for RHEL
 %if %{signkernel}%{signmodules}
-openssl x509 -inform der -in %{SOURCE100} -out rheldup3.pem
-openssl x509 -inform der -in %{SOURCE101} -out rhelkpatch1.pem
-cat rheldup3.pem rhelkpatch1.pem > ../certs/rhel.pem
+# openssl x509 -inform der -in %{SOURCE100} -out rheldup3.pem
+# openssl x509 -inform der -in %{SOURCE101} -out rhelkpatch1.pem
+# cat rheldup3.pem rhelkpatch1.pem > ../certs/rhel.pem
 %ifarch ppc64le
-openssl x509 -inform der -in %{secureboot_ca_2} -out secureboot.pem
+openssl x509 -inform der -in %{secureboot_ca_0} -out secureboot.pem
 cat secureboot.pem >> ../certs/rhel.pem
 %endif
 for i in *.config; do
@@ -1317,9 +1319,7 @@ BuildKernel() {
     fi
 
     %ifarch x86_64 aarch64
-    %pesign -s -i $SignImage -o vmlinuz.tmp -a %{secureboot_ca_0} -c %{secureboot_key_0} -n %{pesign_name_0}
-    %pesign -s -i vmlinuz.tmp -o vmlinuz.signed -a %{secureboot_ca_1} -c %{secureboot_key_1} -n %{pesign_name_1}
-    rm vmlinuz.tmp
+    %pesign -s -i $SignImage -o vmlinuz.signed -a %{secureboot_ca_0} -c %{secureboot_key_0} -n %{pesign_name_0}
     %endif
     %ifarch s390x ppc64le
     if [ -x /usr/bin/rpm-sign ]; then
@@ -1746,12 +1746,11 @@ BuildKernel() {
     # Red Hat UEFI Secure Boot CA cert, which can be used to authenticate the kernel
     mkdir -p $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer
     %ifarch x86_64 aarch64
-        install -m 0644 %{secureboot_ca_0} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca-20200609.cer
-        install -m 0644 %{secureboot_ca_1} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca-20140212.cer
-        ln -s kernel-signing-ca-20200609.cer $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca.cer
+        install -m 0644 %{secureboot_ca_0} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca-20210114.cer
+        ln -s kernel-signing-ca-20210114.cer $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca.cer
     %else
         %ifarch ppc64le
-            install -m 0644 %{secureboot_ca_2} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca.cer
+            install -m 0644 %{secureboot_ca_0} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca.cer
         %else
             install -m 0644 %{secureboot_ca_0} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca.cer
         %endif
@@ -2699,6 +2698,9 @@ fi
 #
 #
 %changelog
+* Tue May 30 2023 Andrew Lukoshko - [4.18.0-477.13.1.el8_8].gcp
+- Apply GCP related changes
+
 * Thu May 18 2023 Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.13.1.el8_8]
 - netfilter: nf_tables: deactivate anonymous set from preparation phase (Florian Westphal) [2196147 2196146] {CVE-2023-32233}