# changelog

author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-4
changelog:
  - Release 1.3.5.10-4
  - Resolves: bug 1209128 - [RFE] Add a utility to get the status of Directory Server instances (DS 48144)
  - Resolves: bug 1333184 - (389-ds-base-1.3.5) Fixing coverity issues. (DS 48919)
  - Resolves: bug 1350799 - CVE-2016-4992 389-ds-base: Information disclosure via repeat
  - Resolves: bug 1354660 - flow control in replication also blocks receiving results (DS 48767)
  - Resolves: bug 1356261 - Fixup tombstone task needs to set proper flag when updating (DS 48924)
  - Resolves: bug 1355760 - ns-slapd crashes during the deletion of backend (DS 48922)
  - Resolves: bug 1353629 - DS shuts down automatically if dnaThreshold is set to 0 in a MMR setup (DS 48916)
  - Resolves: bug 1355879 - nunc-stans: ns-slapd crashes during startup with SIGILL on AMD Opteron 280 (DS 48925)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-5
changelog:
  - Release 1.3.5.10-5
  - Resolves: bug 1333184 - (389-ds-base-1.3.5) Fixing coverity issues. (DS 48919)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-6
changelog:
  - Release 1.3.5.10-6
  - Resolves: bug 1326077 - Page result search should return empty cookie if there is no returned entry (DS 48928)
  - Resolves: bug 1360447 - nsslapd-workingdir is empty when ns-slapd is started by systemd (DS 48939)
  - Resolves: bug 1360327 - remove-ds.pl deletes an instance even if wrong prefix was specified (DS 48934)
  - Resolves: bug 1349815 - DS logs have warning:ancestorid not indexed for all CS subsystems (DS 48940)
  - Resolves: bug 1329061 - 389-ds-base-1.3.4.0-29.el7_2 "hang" (DS 48882)
  - Resolves: bug 1360976 - EMBARGOED CVE-2016-5405 389-ds-base: Password verification vulnerable to timing attack
  - Resolves: bug 1361134 - When fine-grained policy is applied, a sub-tree has a priority over a user while changing password (DS 48943) 
  - Resolves: bug 1361321 - Duplicate collation entries (DS 48936)
  - Resolves: bug 1316580 - dirsrv service doesn't ask for pin when pin.txt is missing (DS 48450)
  - Resolves: bug 1350799 - CVE-2016-4992 389-ds-base: Information disclosure via repeat


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-7
changelog:
  - Release 1.3.5.10-7
  - Resolves: bug 1316580 - dirsrv service doesn't ask for pin when pin.txt is missing (DS 48450)
  - Resolves: bug 1360976 - fixing a compiler warning


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-8
changelog:
  - Release 1.3.5.10-8
  - Resolves: bug 1321124 - Replication changelog can incorrectly skip over updates (DS 48954)
  - Resolves: bug 1364190 - Change example in /etc/sysconfig/dirsrv to use tcmalloc (DS 48950)
  - Resolves: bug 1366561 - ns-accountstatus.pl giving error even "No such object (32)" (DS 48956)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-9
changelog:
  - Release 1.3.5.10-9
  - Resolves: bug 1364190 - Change example in /etc/sysconfig/dirsrv to use tcmalloc (DS 48950)
  - Resolves: bug 1366828 - audit on failure doesn't work if attribute nsslapd-auditlog-logging-enabled is NOT enabled (DS 48958)
  - Resolves: bug 1368520 - Crash in import_wait_for_space_in_fifo() (DS 48960)
  - Resolves: bug 1368956 - man page of ns-accountstatus.pl shows redundant entries for -p port option
  - Resolves: bug 1369537 - passwordMinAge attribute doesn't limit the minimum age of the password (DS 48967)
  - Resolves: bug 1369570 - cleanallruv changelog cleaning incorrectly impacts all backends (DS 48964)
  - Resolves: bug 1369425 - ACI behaves erratically (DS 48972)
  - Resolves: bug 1370300 - set proper update status to replication agreement in case of failure (DS 48957)
  - Resolves: bug 1209094 - Allow logging of rejected changes (DS 48969)
  - Resolves: bug 1371283 - Server Side Sorting crashes the server. (DS 48970)
  - Resolves: bug 1371284 - Disabling CLEAR password storage scheme will crash server when setting a password (DS 48975)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-10
changelog:
  - Release 1.3.5.10-10
  - Resolves: bug 1370300 - set proper update status to replication agreement in case of failure (DS 48957)
  - Resolves: bug 1209094 - Allow logging of rejected changes (DS 48969)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-11
changelog:
  - Release 1.3.5.10-11
  - Resolves: bug 1321124 - Replication changelog can incorrectly skip over updates


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-12
changelog:
  - Release 1.3.5.10-12
  - Resolves: bug 1384785 - Replica install fails with old IPA master sometimes during replication process (DS 48992)
  - Resolves: bug 1388501 - 389-ds-base is missing runtime dependency - bind-utils (DS 48328)
  - Resolves: bug 1388581 - Replication stops working only when fips mode is set to true (DS 48909)
  - Resolves: bug 1390342 - ns-accountstatus.pl shows wrong status for accounts inactivated by Account policy plugin (DS 49014)
  - Resolves: bug 1390343 - trace args debug logging must be more restrictive (DS 49009)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-13
changelog:
  - Release 1.3.5.10-13
  - Resolves: bug 1402030 - Non tombstone entry which dn starting with "nsuniqueid=...," cannot be deleted (DS 48133)
  - Resolves: bug 1402325 - do not treat missing csn as fatal (DS 49020)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-15
changelog:
  - Release 1.3.5.10-15
  - Resolves: bug 1402325 - do not treat missing csn as fatal (DS 48964)
  - Resolves: bug 1410080 - incompatible nsEncryptionConfig object definition prevents RHEL 7->6 schema replication (DS 49074)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-16
changelog:
  - Release 1.3.5.10-16
  - Resolves: bug 1414677 - (un)register/migration/remove may fail if there is no suffix (DS 49016)
  - Resolves: bug 1414678 - deadlock on cos cache rebuild (DS 49079)
  - Resolves: bug 1414679 - Release 1.3.5 may allow expired accounts access to systems (DS 49080, DS 49082)
  - Resolves: bug 1416368 - Aborted operation can leave RUV in incorrect state (DS 49008)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.5.10-17
changelog:
  - Release 1.3.5.10-17
  - Resolves: bug 1414677 - (un)register/migration/remove may fail if there is no suffix (DS 49016)


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.5.10-19
changelog:
  - Release 1.3.5.10-19
  - Resolves: bug 1429495 - ns-slapd dies under heavy load 
  - Resolves: bug 1429498 - A filtered nsrole that specifies an empty nsrole in its nsRoleFilter will result in a segfault


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.5.10-20
changelog:
  - Bump version to 1.3.5.10-20
  - Resolves: bug 1437005 - CVE-2017-2668 389-ds-base: Remote crash via crafted LDAP messages


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.5.10-21
changelog:
  - Bump verison to 1.3.5.10-21
  - Resolves: Bug 1440654 - Possible deadlock while installing an ipa replica
  - Resolves: Bug 1445178 - Silent install localhost issue
  - Resolves: Bug 1445177 - retrocl crash at shutdown
  - Resolves: Bug 1445176 - case sensitivity in acl


author: Thomas Haller <thaller@redhat.com> - 1:1.4.0-5
changelog:
  - libnm,nmtui: fix handling empty cloned-mac-address property (rh#1372799)
  - ibft: grant required CAP_SYS_ADMIN capabilities (rh#1371201)


author: Thomas Haller <thaller@redhat.com> - 1:1.4.0-7
changelog:
  - wifi: another fix activation failure due to error changing MAC address (rh#1371623, rh#1374023)
  - dhcp: fix race condition that may cause lost lease events and DHCP timeouts (rh#1373276)


author: Thomas Haller <thaller@redhat.com> - 1:1.4.0-8
changelog:
  - libnm: fix crash in nm_vpn_plugin_info_list_get_service_types() (rh#1374526)
  - device: wait for MAC address change before setting up interface (rh#1371623, rh#1374023)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.4.0-9
changelog:
  - clients: handle secret requests only for current connection (rh#1351272)
  - device: fix crash reapplying connection to slave devices (rh#1376784)
  - cli: fix autocompletion after ifname (rh#1375933)


author: Francesco Giudici <fgiudici@redhat.com> - 1:1.4.0-16
changelog:
  - libnm-core: remove INFERRABLE flag from dhcp-hostname property (rh#1421082)
  - core: honor order of IP addresses from configuration (rh#1394500)


author: Ray Strode <rstrode@redhat.com> - 0.6.35-11
changelog:
  - address minor bug in previous patch
    Related: #1220904

  - fix memory leak in log handler
    Resolves: #1292543


author: Kevin Fenzi <kevin@scrye.com> - 2.2.2.0-3
changelog:
  - Deal with RHEL7 pytest vs python-pytest.
  - Rebase epel6 newer jinja patch.
  - Conditionalize exclude for RHEL6 rpm.


author: Toshio Kuratomi <toshio@fedoraproject.org> - 2.3.0.0-1
changelog:
  - Update to 2.3.0
  - Remove upstreamed patches
  - Remove controlpersist socket path path as a custom solution was included
    upstream
  - Run the unittests from the upstream tarball now instead of having to download
    separately
  - Build a documentation subpackage


author: Pavel Cahyna <pcahyna@redhat.com> - 2.3.1.0-2
changelog:
  - Package for RHEL Extras (inspired by rybrown's work)
  - Disable tests in order to reduce build requirements
  - Disable Python 3 support
  - Do not depend on python-keyczar, it is needed only for the deprecated accelereated mode
  - Default role search path in ansible.cfg including /usr/share/ansible/roles
  - Apply a patch to fix ansible-galaxy regression https://github.com/ansible/ansible/issues/25933 (will be in 2.3.2)


author: Steve Grubb <sgrubb@redhat.com> 2.3.3-2
changelog:
  - New upstream bugfix/enhancement release
  resolves: #1053804 - ausearch issues found by ausearch-test
  resolves: #1030409 - ausearch help typo for "-x" option


author: Steve Grubb <sgrubb@redhat.com> 2.4-1
changelog:
  resolves: #1115196 - Add golang bindings for libaudit
  resolves: #1105150 - audispd config file parser fails on long input
  resolves: #1104973 - auparse truncating selinux context after first category
  resolves: #1088593 - auditctl man page examples use deprecated syscalls
  resolves: #1087849 - support for setting loginuid immutable
  resolves: #1073063 - AUDIT_SECCOMP events syscall field is not interpretted
  resolves: #975796  - confusing aulast records for bad logins


author: Steve Grubb <sgrubb@redhat.com> 2.4.1-1
changelog:
  resolves: #963353 - aarch64 userspace auditing needs to be written
  resolves: #1150202 - perf trace sleep 1 does not list any syscall information
  resolves: #1142989 - Update audit package to 2.4.1
  resolves: #1155221 - adjust fstatat naming to match kernel uapi


author: Steve Grubb <sgrubb@redhat.com> 2.4.1-4
changelog:
  - Remove golang bindings added under the following bz
  resolves: #1115196 - Add golang bindings for libaudit


author: Steve Grubb <sgrubb@redhat.com> 2.6.5-3.1
changelog:
  resolves: #1415724 - write_logs option is not correctly handled
  resolves: #1415726 - Setting log_format to NOLOG make auditd core dump


author: Dominic Cleal <dcleal@redhat.com> - 1.1.0-12
changelog:
  - Add patch for Dovecot, mailbox and quote support (RHBZ#1064387)
  - Add patch for Keepalived, virtual server fixes (RHBZ#1064388)
  - Add patch for Krb5, parse braces in values (RHBZ#1066419)


author: Dominic Cleal <dcleal@redhat.com> - 1.1.0-13
changelog:
  - aug_save: return error when unlink fails (RHBZ#1091143)
  - augtool: add aliases to autocomplete (RHBZ#1100076)
  - augtool: remove unused dump-xml arg (RHBZ#1100106)
  - Automounter: parse hostnames with hyphens (RHBZ#1075162)
  - Cgconfig: parse other valid controllers (RHBZ#1112543)
  - Chrony: add lens (RHBZ#1071947)
  - docs: update man page with new commands (RHBZ#1100077)
  - Exports: permit colons for IPv6 client addresses (RHBZ#1067030)
  - Httpd: parse continued, quoted lines (RHBZ#1100551)
  - Ldso: parse hwcap lines (RHBZ#1102629)
  - NagiosCfg: parse nrpe.cfg with Nrpe (RHBZ#1102623)
  - Rmt: add lens (RHBZ#1100549)
  - Services: permit colons in service name (RHBZ#1121527)
  - Shellvars: support arithmetic expansion (RHBZ#1100550)
  - Syslog: parse TCP loghosts (RHBZ#1129386)
  - Syslog: parse IPv6 loghost addresses (RHBZ#1129388)
  - Systemd: parse /etc/sysconfig/*.systemd (RHBZ#1083022)
  - Systemd: parse quoted environment vars (RHBZ#1100547)


author: Dominic Cleal <dcleal@redhat.com> - 1.1.0-14
changelog:
  - Kdump: parse new options, EOL comments (RHBZ#1139298)
  - Rsyslog: parse property filters and templates (RHBZ#1138402)
  - Systemd: parse semicolons inside entry values (RHBZ#1139498)
  - Systemd: parse environment variables where value is quoted (RHBZ#1138508)


author: Dominic Cleal <dcleal@redhat.com> - 1.1.0-16
changelog:
  - Iptables: parse /etc/sysconfig/iptables.save (RHBZ#1144651)
  - Lvm: parse /etc/lvm/lvm.conf (RHBZ#1145495)
  - Shadow: add lens (RHBZ#1145249)


author: Dominic Cleal <dcleal@redhat.com> - 1.4.0-1
changelog:
  - Rebase to Augeas 1.4.0
  - Revert some changes for better compatibility with 1.1.0-17:
    * Dhcpd: keep 1.1.0 behaviour, add Dhcpd_140 for 1.4.0 features
    * Dnsmasq: revert splitting of address/server options
    * Dovecot: restore quotes within values
    * Jaas: revert semicolon and line break changes
    * Slapd: keep 1.1.0 behaviour, add Slapd_140 for 1.4.0 features
    * Sshd: keep 1.1.0 behaviour, add Sshd_140 for 1.4.0 features
    * Syslog: restore tree without protocol for UDP hosts
    * UpdateDB: keep Simplevars to load config by default


author: David Tardon <dtardon@redhat.com> - 1:4.3.7.2-5
changelog:
  - Related: rhbz#1205091 fix for ppc64
  - Related: rhbz#1205091 fix deps for gdb-debug-support subpackage


author: David Tardon <dtardon@redhat.com> - 1:4.3.7.2-5.1
changelog:
  - Resolves: rhbz#1285820 various flaws
  - CVE-2015-4551 Arbitrary file disclosure in Calc and Writer
  - CVE-2015-5212 Integer underflow in PrinterSetup length
  - CVE-2015-5213 Integer overflow in DOC files
  - CVE-2015-5214 Bookmarks in DOC documents are insufficiently checked
    causing memory corruption


author: David Tardon <dtardon@redhat.com> - 1:5.0.5.2-2
changelog:
  - Related: rhbz#1290148 remove unintentional dependency of libreoffice-core on
    libreoffice-calc
  - Related: rhbz#1290148 restore lost changelog entry
  - Related: rhbz#1290148 add additional 5.0.6 patches


author: Caolán McNamara <caolanm@redhat.com> - 1:5.0.6.2-4
changelog:
  - Resolves: rhbz#1425535 crash in calc on exit after using csv dialog with a11y enabled
  - Resolves: rhbz#1425536 crash in calc on closing dialog with a11y enabled


author: Gu Zhifeng <guzhifeng@cmss.chinamobile.com> 1.1-1
changelog:
  - Adding restore function, help user to restore the settings maked by this tools. 
  - Also change name form BCLinux-SecureH to bclinux-secure-enhancement.


author: Gu Zhifeng <guzhifeng@cmss.chinamobile.com> 1.1-2
changelog:
  - Adding OSdetection function to meet BCLinux 7.3 demand. 
  - Change excute shell script name from start.sh to bse.
  - Add this tool's main call file "bse" to /usr/bin/.
  - Fix the check_result.reslt file bugs, remove this file after fix the system.
  - Fix the os_distro value bug.


author: Gu Zhifeng <guzhifeng@cmss.chinamobile.com> 1.1-3
changelog:
  - update check func, add option: basic & adv
  - modify the help info format and add result info after fix
  - create option_check dir and move relevant file to it
  - modify the check result and use printf to show help info
  - update the s25_addUser func to show passwd to user
  - disable binaries check and fix the s40_syslogProperty vaule bugs
  - update c02 & c03 to ensure just check /etc/pam.d/system-auth file
  - modify the s04 & c04 to use /etc/pam.d/system-auth file
  - add confirm info when do adv fix
  - fix the parameters error, add shift when do -y
  - fix the c26_filterIP bugs, delete ${i} valuable
  - change c21&c24&c25&c26 FINISHED to OK


author: Gu Zhifeng <guzhifeng@cmss.chinamobile.com> 1.1-4
changelog:
  - fix the ${PROFILE} valuable to show the real path of default.prf.
  - modify the output format of fix adv func.


author: Gu Zhifeng <guzhifeng@cmss.chinamobile.com> 1.2-1
changelog:
  - add auto complete to restore basic and adv func
  - add warning info before user do restore
  - change fix adv func output color and format


author: Gu Zhifeng <guzhifeng@cmss.chinamobile.com> 1.4-1
changelog:
  - add man.8 query file for bse.
  - Fix html compatibility for report file.
  - use xml file to show suggestion info for each check items.


author: Gu Zhifeng <guzhifeng@cmss.chinamobile.com> 1.4-1
changelog:
  - enrich the man.8 query file for bse.
  - add httpd\tomcat\mysql\php\wget vulenrabilities database for bse.
  - fix the fliter bugs in secure_check/c30 file.
  - Add CVE details to html report
  - Add update database interface to main file: bse


author: Gu Zhifeng <guzhifeng@cmss.chinamobile.com> 2.1-1
changelog:
  - add default.prf to detailed configuration items.
  - modify include/consts\functions\profiles to support detailed config.
  - change install dir path to /opt/BCLinux/bse
  - release BSE 2.1.1.


author: Gu Zhifeng <guzhifeng@cmss.chinamobile.com> 2.1-2
changelog:
  - use SSH_MACS_VALUE items to set ssh cipher in secure_set/s11_sshCipher
  - use $TEST_PAUSE_TIME value to replace with sleep sec.
  - fix typo 'FINE' in include/profiles, should be 'FIND'
  - use sqlite3 db to replace ascii changelog file to check software vulnerabilities
  - add software vulnerabilities check func module based on sqlite3 db.
  - modify html report style, make html result file more readable.
  - update LOGFILE value format in bse
  - modify shell console report style, make promote output info more readable.
  - add comment info to detailized help info, to help people understand options meaning in default.prf
  - release BSE 2.1.2


author: Gu Zhifeng <guzhifeng@cmss.chinamobile.com> 2.1-3
changelog:
  - add SET_PASS_MIN_LEN=0 in consts file.
  - should disable telnet server.
  - add check and fix guidance in TextInfos.xml
  - add search index in Defines_Warning.xml to supprot c09&s09 checking and setting.
  - add bse running parameters, to avoid user wrong settings in default.prf
  - Read set_pass_min_len in profile stage.
  - add set_pass_min_len configuration in default.prf
  - add CVE bug fix action in bse fix module to inform user to fix software CVEs by themslef.
  - add system upadte action in bse fix module to inform user to update system by themslef.
  - improve output format, to make user easy to understand.
  - change "FINISHED" to "OK" with bse check modle.
  - improve filter options check code, when BSE disable unused software.
  - Get unused sofeware collection for $UNUSED_SOFTWARE_VALUE rather then defined it in modle script.
  - Remove c31_passMinlen and move function code to s09 and c09
  - if current setting isn't match default.prf config settings, than change.
  - minlen is gloable value, so should not use it as local value
  - check log file property
  - ipfilter mode no need to check if default.prf is exist
  - addUser mode no need to check if default.prf is exist
  - BSE does't setting su pam mode with right value
  - BSE become slow when use 'hostname -f' to set FQDN


author: Gu Zhifeng <guzhifeng@cmss.chinamobile.com> 2.1-4
changelog:
  - create /etc/bse.conf, bse will find config file in /etc/ and than to install dir.
  - use rpmdev-sort to determine whether system has common vulunrabilities.
  - search ./default.prf file, in case of run bse in unpack env directely.
  - use yum check-update to make bse automatically found update info.
  - create symbolic links to /usr/bin/bse, make main file unique.


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-33
changelog:
  - Fix excessive queries caused by DS chasing with stub zones when DNSSEC is not used (#1291185)
  - Fix error in internal test suite (#1259514)
  - Fix named-checkconf call in *-chroot.service files (#1278082)
  - Fix incorrect path in BIND sample configuration and added comment to default configuration (#1247502)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-34
changelog:
  - Added support for CAA records (#1306610)
  - Use HTTPS URL instead of FTP for upstream sources (#1319280)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-36
changelog:
  - Added automatic interface scan functionality (#1294506)
  - Removed NetworkManager dispatcher script since it is not needed any more (#1294506)


author: Petr Menšík <pemensik@redhat.com> - 32:9.9.4-38.1
changelog:
  - Fix CVE-2016-9131 (ISC change 4508)
  - Fix CVE-2016-9147 (ISC change 4510)
  - Fix regression introduced by CVE-2016-8864 (ISC change 4530)
  - Fix CVE-2016-9444 (ISC change 4517)


author: Petr Menšík <pemensik@redhat.com> - 32:9.9.4-50.4
changelog:
  - Limit number of queries triggered by a request (CVE-2020-8616)
  - Add CVE tests to codebase
  - Add CVE tests to codebase
  - Fix invalid tsig request (CVE-2020-8617)


author: Nick Clifton <nickc@redhat.com> 2.25.1-14-base
changelog:
  - Extend Release string to include ".base" thus ensuring that it
    will not collide with a DTS release which might otherwise have
    the same name.
    (#1337617)


author: Nick Clifton <nickc@redhat.com> 2.25.1-17-base
changelog:
  - Close memory leak in "ar" archiver program.
    (#1162655)
  - Retire the copy-osabi patch.
    (#1252066)


author: Kai Engert <kaie@redhat.com> - 2014.1.98-71
changelog:
  - Update to CKBI 1.98 from NSS 3.16.1
  - building on RHEL 7 no longer requires java-openjdk
  - added more detailed instructions for release numbers on RHEL branches,
    to avoid problems when rebasing on both z- and y-stream branches.


author: Stef Walter <stefw@redhat.com> - 2014.1.98-72
changelog:
  - The BasicConstraints fix for Entrust Root is no longer necessary.
    In addition it was invalid for p11-kit 0.20.x. rhbz#1130485


author: Kai Engert <kaie@redhat.com> - 2015.2.3-71
changelog:
  - Update to CKBI 2.3 from NSS 3.18 with legacy modifications.
  - Add an alternative version of the "Thawte Premium Server CA" root,
    which carries a SHA1-RSA signature, to allow OpenJDK to verify applets
    which contain that version of the root certificate.
    This change doesn't add trust for another key, because both versions
    of the certificate use the same public key (rhbz#1170982).
  - Add a patch to the source RPM that documents the changes from the
    upstream version.
  - Introduce the ca-legacy utility, a manual page, and the ca-legacy.conf
    configuration file.
  - The new scriptlets require the coreutils package.
  - Remove the obsolete blacklist.txt file.


author: Kai Engert <kaie@redhat.com> - 2017.2.11-70.1
changelog:
  - Update to CKBI 2.11 from NSS 3.28.1 with legacy modifications.
  - Use comments in extracted bundle files.
  - Change packaging script to support empty legacy bundles.


author: Lukáš Nykrýn <lnykryn@redhat.com> - 1.3.62-1
changelog:
  - use systemctl preset, not systemctl enable
  - fix typo in manpage
  - partly support socket activated services


author: Lukáš Nykrýn <lnykryn@redhat.com> - 1.4-1
changelog:
  - ntsysv: show systemd services and sockets
  - fix combination --type xinetd --list service
  - leveldb: restore selinux context for xinetd conf files
  - alternatives: remove unused variable
  - alternatives: warn if the target is not a symlink
  - spec: add link to git
  - lets simplify version


author: Lukáš Nykrýn <lnykryn@redhat.com> - 1.5-1
changelog:
  - add systemd-sysv-install alias
  - don't create symlinks if they already exist
  - fix wrongly behaving LDFLAGS


author: Lukáš Nykrýn <lnykryn@redhat.com> - 1.6-1
changelog:
  - systemd-sysv-install: don't play ping-pong with systemctl
  - ntsysv: add description to systemd services
  - ntsysv: skip templates
  - Makefile: fix typo


author: Lukáš Nykrýn <lnykryn@redhat.com> - 1.7.2-1
changelog:
  - alternatives: introduce --keep-missing
  - alternatives: allow family in --set and display it in --config


author: Miroslav Lichvar <mlichvar@redhat.com> 1.29.1-1
changelog:
  - update to 1.29.1 (#1053022, CVE-2014-0021)
  - fix selecting of sources with prefer option (#1061048)
  - fix potential bug in writing of drift files (#1061106)
  - replace hardening build flags with _hardened_build (#1061036)


author: Miroslav Lichvar <mlichvar@redhat.com> 2.1-1
changelog:
  - update to 2.1 (#1117882 #1169353 #1206504 #1209568 CVE-2015-1821
    CVE-2015-1822 CVE-2015-1853)
  - extend chrony-helper to allow using servers from DNS SRV records (#1211600)
  - add servers from DHCP with iburst option by default (#1219492)
  - execute test suite


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.164-2
changelog:
  - Suppress some unnecessary --stripesize parameter warnings.
  - Fix selection of PVs when allocating raid0_meta.
  - Specify max stripes for raid LV types: raid0:64; 1:10; 4,5:63; 6:62; 10:32.
  - Avoid double suffix when naming _rmeta LV paired with _rimage LV.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.164-3
changelog:
  - Disallow segtype and mirror conversions of raid10 volumes.
  - Fix dmeventd unmonitoring when segment type (and dso) changes.
  - Don't allow lvconvert --repair on raid0 devices or attempt to monitor them.
  - No longer adjust incorrect number of raid stripes supplied to lvcreate.
  - Move lcm and gcd to lib/misc.
  - Suppress some unnecessary --stripesize parameter warnings.
  - Fix 'pvmove -n name ...' to prohibit collocation of RAID SubLVs


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.164-4
changelog:
  - Use lsblk -s and lsblk -O in lvmdump only if these options are supported.
  - Fix typo in report/columns_as_rows config option name recognition (2.02.99).
  - Do not monitor cache-pool metadata when LV is just being cleared.
  - Add allocation/cache_pool_max_chunks to prevent misuse of cache target.
  - Fix number of stripes shown in lvcreate raid10 message when too many.
  - Give error not segfault in lvconvert --splitmirrors when PV lies outside LV.
  - Avoid PV tags when checking allocation against parallel PVs.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.164-5
changelog:
  - Use udev db to check for mpath components before running pvscan for lvmetad.
  - Use devices/allow_changes_with_duplicate_pvs=1 by default.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.165-1
changelog:
  - Support raid scrubbing on cache origin LV.
  - Add lvmraid(7) man page.
  - Use udev db to check for mpath components before running pvscan for lvmetad.
  - Improve explanation of udev fallback in libdevmapper.h.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.165-2
changelog:
  - Fix possible NULL pointer dereference when checking for monitoring.
  - Add lvmreport(7) man page.
  - Report 0% as dirty (copy%) for cache without any used block.
  - Fix lvm2api reporting of cache data and metadata percent.
  - Restore reporting of metadata usage for cache volumes (2.02.155).


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.165-3
changelog:
  - Fix lvchange --discard|--zero for active thin-pool.
  - Fix lvconvert --repair regression for RAID LVs.
  - Always specify snapshot cow LV for monitoring not internal LV. (2.02.165)
  - Ensure memory allocated internally for --filemap histogram bounds are freed.
  - Fix missing display of last created dmstats file map.
  - Use --alloc normal for mirror logs even if the mimages were stricter.
  - Fix reported origin lv field for cache volumes. (2.02.133)
  - Fix lock-holder device for thin pool with inactive thin volumes.
  - Enforce 4MiB or 25% metadata free space for thin pool operations.
  - Fix lvmetad metadata validation when rescanning VG.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.166-1
changelog:
  - Disable lvconvert of thin pool to raid while active.
  - Use dm_config_parse_without_dup_node_check() to speedup metadata reading.
  - Fix lvm2-activation-generator to read all LVM2 config sources. (2.02.155)
  - Fix man entry for dmsetup status.
  - Introduce new dm_config_parse_without_dup_node_check().


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.166-1.el7_3.1
changelog:
  - Fix lvconvert to allow repair for cache raid LVs.
  - Fix time when dmeventd is reloaded on package upgrade to start using new code.
  - Fix libdm versioning for dm_tree_node_size_changed symbol.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.166-1.el7_3.2
changelog:
  - Prevent raid4 creation/conversion on non-supporting kernels
  - Add direct striped -> raid4 conversion
  - Fix raid4 parity image pair position on conversions from striped/raid0*


author: Paul Wouters <pwouters@redhat.com> - 1.4.2-8
changelog:
  - Resolves: rhbz#CVE-2015-6496
  - Fold in upstream patches since 1.4.2 release up to git 900d7e8
  - Fold in upstream patch set of 2015-08-18 for coverity issues


author: Paul Wouters <pwouters@redhat.com> - 1.4.4-3
changelog:
  - Resolves: rhbz#1425552 (explicitely Require: libnetfilter_conntrack >= 1.0.6 as it is same .so version)


author: Robert Relyea <rrelyea@redhat.com> - 1.1.0-34
changelog:
  - recognize up to 32 keys and certs in coolkeys. (can go up to 62 with just #define changes)
  - own our cache file.
  - verify we are using the correct mechanisms


author: Andreas Schneider <asn@redhat.com> - 4.4.4-3
changelog:
  - related: #1260214 - Correctly warn about missing realm for ad domains
                        with 'security=domain'


author: Andreas Schneider <asn@redhat.com> - 4.4.4-4
changelog:
  - resolves: #1351655 - Fix winbind meomory leak with each cached credentials
                         login
  - resolves: #1351961 - Fix CVE-2016-2119


author: Andreas Schneider <asn@redhat.com> - 4.4.4-5
changelog:
  - resolves: #1359091 - Package /usr/lib/samba/ldb in the common-libs package
  - resolves: #1360788 - Fix multilib issue with ctdb-tests package
  - resolves: #1362385 - Fix Samba ignoring supplementary groups
  - resolves: #1364051 - Fix smbd panic with stale ctdb entries


author: Andreas Schneider <asn@redhat.com> - 4.4.4-6
changelog:
  - resolves: #1367316 - Increase required Kerbersion version number
  - resolves: #1366477 - Fix using the right krb5 ccache in libads
  - resolves: #1356501 - Fix high CPU usage with smbclient connection to
                         non-reachable IP


author: Andreas Schneider <asn@redhat.com> - 4.4.4-10
changelog:
  - resolves: #1393050 - Fix linking nss_wins with libreplace
  - resolves: #1393051 - Fix nss_wins function definitions for gethostbyname*
  - resolves: #1393048 - Fix %G substitution in AD case
  - resolves: #1393052 - Fix regression of smbclient unable to connect to
                         Apple and Azure


author: Andreas Schneider <asn@redhat.com> - 4.4.4-13
changelog:
  - resolves: #1437816 - Fix krb5 memory cache in libads sasl code
  - resolves: #1437741 - Fix CVE-2016-2125, CVE-2016-2126 and CVE-2017-2619


author: Jeroen van Meeuwen <vanmeeuwen@kolabsys.com> - 2.4.17-1
changelog:
  - New upstream version, fixes upstream bugs:
  - reconstruct doesn't retain internaldate correctly (#3733)
  - Race condition in maibox rename (#3696)
  - DBERROR db4: Transaction not specified for a transactional database (#3715)
  - performance degradation on huge indexes in 2.4 branch (#3717)
  - typo fix in imapd.conf man page (#3729)
  - quota does not find all quotaroots if quotalegacy, fulldirhash and prefix are used and virtdomains is off (#3735)
  - Mail delivered during XFER was lost (#3737)
  - replication does not work on RENAME (#3742)
  - Failed asserting during APPEND (#3754)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 9.49.31-1
changelog:
  - ipv6: wait for all global IPv6 addresses to leave the "tentative" state
  - source_config: tell NetworkManger to load ifcfg file even for NM_CONTROLLED=no
  - ifup-aliases: inherit ARPCHECK from parent device
  - rhel-dmesg: don't start in containers
  - ifup-eth: fix typo in error message (#1038776)
  - sysctl.conf: steal comments about /usr,/etc,... from fedora's sysctl.conf
  - rwtab: /var/lib/nfs needs to copy the files
  - functions: improve killing loops
  - ipcalc: detect invalid mask
  - ifup: set valid_lft and preferred_lft to forever for static ip
  - service: use systemd mangle for given service
  - ifup-post: check resolve.conf also with DNS2
  - ifdown-post: remove resolv.conf only in specific cases
  - spec: ghost /var/log/dmesg
  - network-functions: is_available_wait should wait even in the case that is_available returns 2
  - autorelabel: turn quota off before relabeling
  - autorelabel: call dracut-initramfs-restore before forced reboot


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-91
changelog:
  - Add 0165-UPBZ-1341748-MSA-2040-conf.patch
    * Add default config for MSA 2040 array
  - Resolves: bz #1341748


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-92
changelog:
  - Add 0166-RHBZ-1323429-dont-allow-new-wwid.patch
    * don't allow path wwid to change while it is in use
  - Add 0167-RHBZ-1335176-fix-show-cmds.patch
    * and new show multipath format wildcard, 'f' to sho number of failures.
      This will hopefully be useful for tracking what happens to multipath
      devices for bz #1335176
  - Resolves: bz #1323429


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-93
changelog:
  - Modify 0135-RHBZ-1299600-path-dev-uevents.patch
    * trigger uevents when adding wwids for existing devices during startup
  - Refresh 0136-RHBZ-1304687-wait-for-map-add.patch
  - Refresh 0150-RHBZ-1253913-fix-startup-msg.patch
  - Add 0168-RHBZ-1347769-shared-lock.patch
    * make multipath lock the path devices with a shared lock
  - Add 0169-UPBZ-1353357-json-output.patch
    * add mulitpathd json output command
  - Resolves: bz #1299600, #1347769, #1353357


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-95
changelog:
  - Add 0170-UPBZ-1352925-fix-typo.patch
  - Add 0171-UPBZ-1356651-allow-zero-size.patch
    * Allow zero-sized paths to be added to a multipath device
  - Add 0172-RHBZ-1350931-no-active-add.patch
    * Allow paths to be added to a new map if no active paths exist. Also
      fixes 1351430
  - Resolves: bz #1350931, #1351430, #1352925, #1356651


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-96
changelog:
  - Modify 0136-RHBZ-1304687-wait-for-map-add.patch
    * change missing_uev_msg_delay to missing_uev_msg_timeout, and make
      multipathd re-enable table loads if the timeout has passed
  - Refresh 0137-RHBZ-1280524-clear-chkr-msg.patch
  - Refresh 0139-RHBZ-1273173-queue-no-daemon-doc.patch
  - Refresh 0150-RHBZ-1253913-fix-startup-msg.patch
  - Refresh 0154-UPBZ-1291406-disable-reinstate.patch
  - Refresh 0155-UPBZ-1300415-PURE-config.patch
  - Refresh 0156-UPBZ-1313324-dont-fail-discovery.patch
  - Refresh 0161-RHBZ-1311659-no-kpartx.patch
  - Refresh 0167-RHBZ-1335176-fix-show-cmds.patch
  - Add 0173-RH-update-man-page.patch
  - Add 0174-RHBZ-1362396-modprobe.patch
    * make starting the multipathd service modprobe dm-multipath in the
      sysvinit scripts
  - Add 0175-RHBZ-1357382-ordering.patch
    * force multipathd.service to start after systemd-udev-trigger.service
  - Add 0176-RHBZ-1363830-fix-rename.patch
    * initialized a variable to make dm_rename not fail randomly
  - Resolves: bz #1304687, #1362396, #1357382, #1363830


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-97
changelog:
  - Add 0177-libmultipath-correctly-initialize-pp-sg_id.patch
    * This and all the following patches add the rbd patch checker
  - Add 0178-libmultipath-add-rbd-discovery.patch
  - Add 0179-multipath-tools-add-checker-callout-to-repair-path.patch
  - Add 0180-multipath-tools-Add-rbd-checker.patch
  - Add 0181-multipath-tools-Add-rbd-to-the-hwtable.patch
  - Add 0182-multipath-tools-check-for-initialized-checker-before.patch
  - Add 0183-multipathd-Don-t-call-repair-on-blacklisted-path.patch
  - Add 0184-rbd-fix-sync-repair-support.patch
  - Add 0185-rbd-check-for-nonshared-clients.patch
  - Add 0186-rbd-check-for-exclusive-lock-enabled.patch
  - Add 0187-rbd-fixup-log-messages.patch
  - Added BuildRequires on librados2-devel
  - Resolves: bz #1348372


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-98
changelog:
  - Modified 0180-multipath-tools-Add-rbd-checker.patch
    * make the rbd path checker only compile if librados2-devel is installed
  - Make librados2-devel only be BuildRequired on x86_64
  - Resolves: bz #1348372


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-99
changelog:
  - Add 0188-RHBZ-1368501-dont-exit.patch
    * make multipathd not exit if it encounters recoverable errors on startup
  - Resolves: bz #1368501


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-99.1
changelog:
  - Add 0189-RHBZ-1395298-rbd-lock-on-read.patch
    * pass lock_on_read when remapping image
  - Resolves: bz #1395298


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-99.2
changelog:
  - Add 0190-RHBZ-1429885-max-sectors-kb.patch
    * add new max_sectors_kb multipath.conf parameter
  - Resolves: bz #1429885


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-99.3
changelog:
  - Modify 0190-RHBZ-1429885-max-sectors-kb.patch
    * make max_sectors_kb only update the device sysfs paramter on creates.
  - Resolves: bz #1429885


author: Zdenek Dohnal <zdohnal@redhat.com> - 12:4.2.5-44
changelog:
  - 1269596 - dhclient-script doesn't keep old nameservers
  - 1193586 - DHCP renewal does not update lifetimes if MTU has changed
  - 1306608 - Add ignore-client-uids option to dhcpd
  - 1267489 - dhclient-script does not respect DEFROUTE/GATEWAYDEV


author: Petr Oros <poros@redhat.com> - 1:2.12-6
changelog:
  - Add preliminary support for SMBIOS 64-bit entry point (Mark Salter)
  - Add support for DDR4 memmory


author: Petr Oros <poros@redhat.com> - 1:2.12-9
changelog:
  - dmioem: Decode Acer-specific DMI type 170
  - dmioem: Decode HP-specific DMI types 212 and 219
  - dmioem: Decode HP-specific DMI type 233, and refactored 209 and 221 to use a common function
  - Resolves: #1232501


author: Panu Matilainen <pmatilai@redhat.com> - 16.07-1
changelog:
  - Update to DPDK 16.07 (#1383195)
  - Disable unstable bnx2x driver (#1330589)
  - Enable librte_vhost NUMA support again (#1279525)
  - Enable librte_cryptodev, its no longer considered experimental
  - Change example prefix to dpdk- for consistency with other utilities
  - Update driverctl to 0.89


author: John W. Linville <linville@redhat.com> - 16.11.2-3
changelog:
  - Enable i40e driver in PowerPC along with its altivec intrinsic support
  - Add PCI probing support for vfio-pci devices in Power8


author: Harald Hoyer <harald@redhat.com> - 033-457
changelog:
  - add --help documentation for --no-hostonly-i18n and --hostonly-i18n options
  Resolves: rhbz#1266448
  - mention rd.shell=0 for rd.emergency
  Resolves: rhbz#1359144
  - put IPv6 IP in brackets for IBFT
  Resolves: rhbz#1322592
  - install symlinked ca-bundle.crt for curl and ssl
  Resolves: rhbz#1341280


author: Harald Hoyer <harald@redhat.com> - 033-461
changelog:
  - be more liberal to multiple ip= lines and ip=dhcp
  Resolves: rhbz#1304069
  - don't display error for hba.conf
  Resolves: rhbz#1369342


author: Chris Leech <cleech@redhat.com> - 1.0.30-4.git91c0c8c
changelog:
  - 1039779 replace README that contained mostly build instructions with
    README.redhat containing better distro-specific information


author: Chris Leech <cleech@redhat.com> - 1.0.31-1.git5dfd3e4
changelog:
  - 1274530 rebase to upstream 1.0.31+
  - no longer requires libhbaapi/libhbalinux
  - no longer attempts to connect to lldpad if DC_REQUIRED is configured off
    for all interfaces


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.0.11-44
changelog:
  - fence_mpath: update info to say unique key per node instead of per
    node/device
    Resolves: rhbz#1280151


author: Thomas Woerner <twoerner@redhat.com> - 0.4.3.2-1
changelog:
  - Rebase to 0.4.3.2
  - Fix regression with unavailable optional commands
  - All missing backend messages should be warnings
  - Individual calls for missing restore commands
  - Only one authenticate call for add and remove options and also sequences
  - RH-Satellite-6 service now upstream
  - Conflict for selinux-policy needed to be updated to newer release
    (RHBZ#1304723)


author: Thomas Woerner <twoerner@redhat.com> - 0.4.3.2-2
changelog:
  - Updated conflict for selinux-policy (RHBZ#1304723)
  - Fixed exit codes in command line clients (RHBZ#1357050)
  - Fixed traceback in firewall-cmd without args (RHBZ#1357063)
  - Fixed source docs in man pages and help output (RHBZ#1357888)
  - Fixed rebuild of changed man pages (RHBZ#1360362)
  - Use stderr for errors and warnings in command line tools (RHBZ#1360894)
  - Fixed lockdown not denying invalid commands (RHBZ#1360871)


author: Thomas Woerner <twoerner@redhat.com> - 0.4.3.2-3
changelog:
  - Fix test suite for command change (RHBZ#1360871)
  - Fix test suite with stderr usage (RHBZ#1360894)
  - Rebuild for wrong docdir without version (RHBZ#1057327#c7)


author: Thomas Woerner <twoerner@redhat.com> - 0.4.3.2-4
changelog:
  - Fixed firewall-config gettext usage (RHBZ#1361612)
  - Fixed ifcfg file reader and writer (RHBZ#1362171)
  - Fixed loading ipset entries from file in commands (RHBZ#1365198)
  - Added conflicts to old main package to sub packages (RHBZ#1361669)
  - Do not show settings of zones etc. without authentication (RHBZ#1357098)
  - Fixed CVE-2016-5410 (RHBZ#1359296)


author: Thomas Woerner <twoerner@redhat.com> - 0.4.3.2-5
changelog:
  - Print errors and warnings to stderr additional patch (RHBZ#1360894)
  - Fixed trace back in firewallctl (RHBZ#1367155)
  - Fix client crash if systembus can not be aquired (RHBZ#1367038)
  - Make ALREADY_ENABLED a warning (RHBZ#1366654)
  - Added conflict to old squid package providing the squid.service file
    (RHBZ#1366308)
  - Fixed firewall-cmd help typo (RHBZ#1367171)


author: Thomas Woerner <twoerner@redhat.com> - 0.4.3.2-6
changelog:
  - Do not use exit code 254 for {ALREADY,NOT}_ENABLED sequences (RHBZ#1366654)
  - Fail with NOT_AUTHORIZED if authorization fails (RHBZ#1368549)
  - firewall-cmd: Fix get and set description for permanent zones (RHBZ#1368949)
  - Fix loading of service helpers in active zones (RHBZ#1371116)


author: Thomas Woerner <twoerner@redhat.com> - 0.4.3.2-7
changelog:
  - Tolerate ipv6_rpfilter fail (RHBZ#1285769)
  - Fix set_rules to copy the rule before extracting the table (RHBZ#1373260)
  - Translation update (RHBZ#1273296)
  - Conflict with NetworkManager < 1:1.4.0-3.el7 (RHBZ#1366288)


author: Thomas Woerner <twoerner@redhat.com> - 0.4.3.2-8.1.el7_3.3
changelog:
  - Add support for sctp and dccp in ports, source-ports and forward-ports
    (RHBZ#1429808) (RHBZ#1442977)


author: Thomas Woerner <twoerner@redhat.com> - 0.4.3.1-1
changelog:
  - Rebase to 0.4.3.1
  - firewall.command: Fix python3 DBusException message not interable error
  - src/Makefile.am: Fix path in firewall-[offline-]cmd_test.sh while installing
  - firewallctl: Do not trace back on list command without further arguments
  - firewallctl (man1): Added remaining sections zone, service, ..
  - firewallctl: Added runtime-to-permanent, interface and source parser,
    IndividualCalls setting
  - firewall.server.config: Allow to set IndividualCalls property in config
    interface
  - Fix missing icmp rules for some zones
  - runProg: Fix issue with running programs
  - firewall-offline-cmd: Fix issues with missing system-config-firewall
  - firewall.core.ipXtables: Split up source and dest addresses for transaction
  - firewall.server.config: Log error in case of loading malformed files in
    watcher
  - Install and package the firewallctl man page


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.1-6
changelog:
  - Fix CVE-2014-2015 "freeradius: stack-based buffer overflow flaw in rlm_pap
    module"
  - resolves: bug#1066984 (fedora 1066763)


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.4-0.1.rc2
changelog:
  - Upgrade to upstream 3.0.4-rc2 release.
    See upstream ChangeLog for details (in freeradius-doc subpackage).
  - Add installation of SNMP MIB files.
  - Resolves: Bug#1036562 Missing doc page for kerberos module
  - Resolves: Bug#1099625 Default message digest defaults to sha1
  - Resolves: Bug#1109159 missing mib files in freeradius package
  - Resolves: Bug#1113010 radiusd doesn't send snmp trap when max_threads value
                          is reached
  - Resolves: Bug#1114669 Missing -P option in radtest manpage
  - Resolves: Bug#1115128 radisud can't start if proto = udp is specified
  - Resolves: Bug#1115134 radiusd aborts after 'Access-Request' when listens on
                          TCP port
  - Resolves: Bug#1115137 radiusd listens on udp port even if proto = tcp is
                          specified
  - Resolves: Bug#1126725 radiusd silently fails when start_servers is higher
                          than max_servers
  - Resolves: Bug#1135446 Radeapclient is not available


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.4-1
changelog:
  - Upgrade to upstream 3.0.4 release.
    See upstream ChangeLog for details (in freeradius-doc subpackage).


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.4-2
changelog:
  - Fix abort on home server triggers.
    Resolves: Bug#1113509 radiusd aborts when it has no proxy response with active
                          snmp traps
  - Fix segfault upon example.pl read failure.
    Resolves: Bug#1146403 radiusd segfaults when file for perl module has
                          wrong permissions
  - Fix example.pl permissions.
    Resolves: Bug#1146406 /etc/raddb/mods-config/perl/example.pl has wrong
                          permissions and radiusd fails to start
  - Fix integer handling in various cases.
    Resolves: Bug#1146441 upstream test suite fails
  - Fix dhcpclient's dictionary.dhcp loading.
    Resolves: Bug#1146939 dhcpclient lookups dictionary.dhcp file in wrong
                          location


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.4-3
changelog:
  - Fix a number of trigger issues.
    Resolves: Bug#1110407 radiusd doesn't send snmp trap after "radmin -e 'hup
                          files'"
    Resolves: Bug#1110414 radiusd doesn't send snmp trap when sql connection is
                          opened,closed or fail
    Resolves: Bug#1110186 radiusd doesn't send snmp trap when ldap connection
                          fails/opens/closes
    Resolves: Bug#1109164 snmp trap messages send by radiusd are inconsistent
                          and incomplete
  - Fix two omissions from radtest manpage.
    Resolves: Bug#1146898 'eap-md5' value is missing in -t option in SYNOPSIS
                          of radtest man page
    Resolves: Bug#1114669 Missing -P option in radtest manpage
  - Disable OpenSSL version checking to avoid the need to edit radiusd.conf to
    confirm heartbleed is fixed.
    Resolves: Bug#1155070 FreeRADIUS doesn't start after upgrade due to failing
                          OpenSSL version check


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.4-4
changelog:
  - Fix possible group info corruption/segfault in rlm_unix' fr_getgrnam.
  - Fix file configuration item parsing.


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.4-5
changelog:
  - Disable rlm_rest building explicitly to avoid unintended builds on some
    architectures breaking RPM build.
    Resolves: Bug#1162156
  - Add -D option support to dhcpclient.
    Related: Bug#1146939
  - Don't install rbmonkey - a test tool only useful to developers.
    Related: Bug#1146966
  - Update clients(5) man page
    Resolves: Bug#1147464


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.4-6
changelog:
  - Don't remove backslash from unknown escape sequences in LDAP values.
    Resolves: Bug#1173526
  - Improve dhcpclient and rad_counter online help.
    Resolves: Bug#1146966
  - raddb: Move trigger.conf INCLUDE before modules, making it easier to refer
    to trigger variables from module configurations.
    Resolves: Bug#1155961
  - Fix ipaddr option fallback onto ipv6.
    Resolves: Bug#1168868
  - raddb: Comment on ipaddr/ipv4addr/ipv6addr use.
    Resolves: Bug#1168247


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.4-8
changelog:
  - Disable internal OpenSSL cache and fix session cache file permissions.
    Resolves: Bug#1459131 CVE-2017-9148 freeradius: TLS resumption
                          authentication bypass


author: Martin Bříza <mbriza@redhat.com> - 4.0.1-1
changelog:
  - Update to upstream 4.0.1 (#808005)
  - Corrected Source0 link to .tar.gz extension as not all releases are available as .tar.bz2
  - Resolves #724817 - gawk-4.0.0 regression in '\' escape handling in gsub()
  - Resolves #820550 - gawk: getline in BEGIN skips 2 lines


author: Ray Strode <rstrode@redhat.com> - 3.14.2-18
changelog:
  - Fix unlock with XDMCP
    Resolves: #1315342
  - Inform remote display about session exiting when using
    XDMCP
    Resolves: #1313059


author: Andrew Price <anprice@redhat.com> - 3.1.8-1
changelog:
  - Rebase to new upstream version 3.1.8
    Resolves: rhbz#1184482
    Resolves: rhbz#1153316
    Resolves: rhbz#1154726
    Resolves: rhbz#1162216
    Resolves: rhbz#1165285
    Resolves: rhbz#1186515
    Resolves: rhbz#1186847
    Resolves: rhbz#1194446
    Resolves: rhbz#1195394


author: Andrew Price <anprice@redhat.com> - 3.1.8-4
changelog:
  - fsck.gfs2: Change duptree structure to have generic flags
  - fsck.gfs2: Detect, fix and clone duplicate block refs within a dinode
    Resolves: rhbz#1236669


author: Andrew Price <anprice@redhat.com> - 3.1.8-5
changelog:
  - gfs2-utils: Fix hang on withdraw (4 patches)
  - Include new withdraw helper scripts in files section
    Resolves: rhbz#1225634


author: Andrew Price <anprice@redhat.com> - 3.1.9-1
changelog:
  - Rebase to new upstream release 3.1.9
    Resolves: rhbz#1271674
    Resolves: rhbz#1162819
    Resolves: rhbz#1196321
    Resolves: rhbz#1202814
    Resolves: rhbz#1251036
    Resolves: rhbz#1257625
    Resolves: rhbz#1268045
    Resolves: rhbz#1283866
    Resolves: rhbz#1332728


author: Andrew Price <anprice@redhat.com> - 3.1.9-2
changelog:
  - fsck.gfs2: "undo" functions can stop too early on duplicates
    Resolves: rhbz#1348703
  - fsck.gfs2: link count checking wrong inode's formal inode number
    Resolves: rhbz#1350597
  - fsck.gfs2: check formal inode number when links go from 1 to 2
    Resolves: rhbz#1350600


author: Andrew Price <anprice@redhat.com> - 3.1.9-3.1
changelog:
  - mkfs.gfs2: Disable rgrp alignment when dev topology is unsuitable
    Resolves: rhbz#1437009
  - gfs2_grow: Disable rgrp alignment when dev topology is unsuitable
    Resolves: rhbz#1437125


author: Tim Waugh <twaugh@redhat.com> 9.07-18
changelog:
  - Applied patch from upstream to fix memory handling issue that could
    lead to crashes (bug #1105519).


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.07-19
changelog:
  - Import LCMS2 2.6 rebase changes into ghostscript (bug #959351)
  - Fix hanging of ghostscript when converting PDF -> PNG (bug #1302121)
  - Do not SIGSEGV after icc_profile error, report error instead (bug #1243784)
  - Fix the color printing on HP InkJet printers (bug #1225858)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.07-20_1
changelog:
  - Added security fixes for:
    - CVE-2013-5653 (bug #1380327)
    - CVE-2016-7977 (bug #1380415)
    - CVE-2016-7978 (bug #1382300)
    - CVE-2016-7979 (bug #1382305)
    - CVE-2016-8602 (bug #1383940)


author: Carlos O'Donell <carlos@redhat.com> - 2.17-157.1
changelog:
  - Do not set initgroups in default nsswitch.conf (#1388638)
  - nss_db: Request larger buffers for long group entries (#1388637)
  - nss_db: Fix get*ent crash without preceding set*ent (#1388635)
  - nss_db: Fix endless loop in services database processing (#1388639)


author: Milind Changire <mchangir@redhat.com> - 3.8.4-14
changelog:
  - fixes bugs bz#1408576 bz#1408705 bz#1409563 bz#1411270 bz#1413513 
    bz#1414247 bz#1414663 bz#1415583 bz#1417955 bz#1418011


author: Milind Changire <mchangir@redhat.com> - 3.8.4-15
changelog:
  - fixes bugs bz#1205162 bz#1315544 bz#1403180 bz#1409135 bz#1415101 
    bz#1417177 bz#1418901 bz#1420635 bz#1422431


author: Milind Changire <mchangir@redhat.com> - 3.8.4-18.2
changelog:
  - fixes bugs bz#1439731 bz#1439753 bz#1440162 bz#1445591 bz#1445593 
    bz#1447186 bz#1451200 bz#1451673


author: Milind Changire <mchangir@redhat.com> - 3.8.4-9
changelog:
  - fixes bugs bz#1400057 bz#1400068 bz#1400093 bz#1400599 bz#1402774 
    bz#1403120 bz#1403587 bz#1403770 bz#1403840 bz#1404996 bz#1405299


author: Milind Changire <mchangir@redhat.com> - 3.8.4-10
changelog:
  - fixes bugs bz#1393316 bz#1398311 bz#1398798 bz#1403672 bz#1404110 
    bz#1404633 bz#1404982 bz#1405000 bz#1406025 bz#1406401


author: Milind Changire <mchangir@redhat.com> - 3.8.4-11
changelog:
  - fixes bugs bz#1393316 bz#1404989 bz#1405000 bz#1408112 bz#1408413 
    bz#1408426 bz#1408836 bz#1409472 bz#1409782 bz#1409808


author: Till Maas <opensource@till.name> - 1.2.4-4
changelog:
  - Rebuilt for Fedora 23 Change
    https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code


author: Caolán McNamara <caolanm@redhat.com> - 1.3.10-1
changelog:
  - Resolves: rhbz#1472290
    CVE-2017-7771 CVE-2017-7772 CVE-2017-7773 CVE-2017-7774
    CVE-2017-7775 CVE-2017-7776 CVE-2017-7777 CVE-2017-7778


author: Peter Jones <pjones@redhat.com> - 8.28-12
changelog:
  - Do a better job recognizing "title" and "default" position and formatting
    on extlinux
    Resolves: rhbz#1200045
  - Do a better job recognizing stanza names and defaults on grub1 and grub2
    Related: rhbz#1142545
  - (reordered some patches to match the ordering in master)
    Related: rhbz#1200045
    Related: rhbz#1142545
  - Add test suite coverage and minor fixes related to zipl and
    --default-{kernel,index,title}
    Related: rhbz#1184014
  - Use systemd debug options that work on RHEL 7
    Resolves: rhbz#1212128


author: Peter Jones <pjones@redhat.com> - 8.28-14
changelog:
  - Handle "set variable" commands separately from other parsing in grubby's
    GetNextLine()
    Resolves: rhbz#1152550


author: Peter Jones <pjones@redhat.com> - 8.28-17
changelog:
  - Fix the ordering of creating the debug entries, so they don't get picked
    when we're choosing kernel command line defaults on upgrades.
    Related: rhbz#1212128


author: rmarshall@redhat.com - 8.28-18
changelog:
  - Patched new-kernel-pkg so that kernel installations when MAKEDEBUG is
    set would put the debugging entries after the non-debugging entries.
    Resolves: #1285601
  - Re-numbered the last set of patches to go with the flow. No actual
    changes to the patches; just a git mv to rename.
  - Re-organized and updated the grubby man page contents to include some
    features that were not documented as well as correct typos and
    re-write some entries for better clarity.
    Resolves: #1232168


author: rmarshall@redhat.com - 8.28-21
changelog:
  - Fixes --info flag on s390/s390x.
    Related: rhbz#1420749
  - Fixes --set-default-index on s390/s390x.
    Related: rhbz#1420749
  - Allows prune_debug to run on s390/s390x.
    Resolves: rhbz#1420749


author: Colin Walters <walters@verbum.org> 0.10.23-17
changelog:
  - Hack the gtk-doc to remove plugin docs that are not shipped
  - Drop mythtv, opencv sources that are no longer buildable


author: Wim Taymans <wtaymans@redhat.com> - 0.10.23-21
changelog:
  - Remove insecure NSF plugin
  - vmncdec: Sanity-check width/height before using it
  Resolves: rhbz#1400838


author: Wim Taymans <wtaymans@redhat.com> - 0.10.23-22
changelog:
  - h264parse: Ensure codec_data has the required size when reading number of SPS
  Resolves: rhbz#1400838


author: Wim Taymans <wtaymans@redhat.com> - 1.4.5-6
changelog:
  - Fix h264 and h265 buffer size checks
  - Fix mpegts pat parsing and add more size checks
  Resolves: rhbz#1400897


author: Ray Strode <rstrode@redhat.com> 3.14.13-20.1
changelog:
  - Ensure motif and related windows get told to supply resize borders
    for CSD decorated windows
  Resolves: #1416874


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-41
changelog:
  - mod_cache: merge r->err_headers_out into r->headers when the response
    is cached for the first time (#1264989)
  - mod_ssl: Do not send SSL warning when SNI hostname is not found as per
    RFC 6066 (#1298148)
  - mod_proxy_fcgi: Ignore body data from backend for 304 responses (#1263038)
  - fix apache user creation when apache group already exists (#1299889)
  - fix apache user creation when USERGROUPS_ENAB is set to 'no' (#1288757)
  - mod_proxy: fix slow response time for reponses with error status code
    when using ProxyErrorOverride (#1283653)
  - mod_ldap: Respect LDAPConnectionPoolTTL for authn connections (#1300149)
  - mod_ssl: use "localhost" in the dummy SSL cert for long FQDNs (#1240495)
  - rotatelogs: improve support for localtime (#1244545)
  - ab: fix read failure when targeting SSL server (#1255331)
  - mod_log_debug: fix LogMessage example in documentation (#1279465)
  - mod_authz_dbd, mod_authn_dbd, mod_session_dbd, mod_rewrite: Fix lifetime
    of DB lookup entries independently of the selected DB engine (#1287844)
  - mod_ssl: fix hardware crypto support with custom DH parms (#1291865)
  - mod_proxy_fcgi: fix SCRIPT_FILENAME when a balancer is used (#1302797)


author: Joe Orton <jorton@redhat.com> - 2.4.6-45.3
changelog:
  - prefork: fix delay completing graceful restart (#1327624)
  - mod_ldap: fix authz regression, failing to rebind (#1415257)


author: Lubos Uhliarik <luhliari@redhat.com>
changelog:
  - Resolves: #1566317 - CVE-2018-1312 httpd: Weak Digest auth nonce generation
    in mod_auth_digest
  - Resolves: #1696141 - CVE-2019-0217 httpd: mod_auth_digest: access control
    bypass due to race condition
  - Resolves: #1696096 - CVE-2019-0220 httpd: URL normalization inconsistency


author: Martin Gieseking <martin.gieseking@uos.de> 0.30.0-1
changelog:
  - updated to release 0.30.0
  - dropped patch as it has been applied upstream
  - removed old buildroot stuff


author: Richard W.M. Jones <rjones@redhat.com> - 0.31.3-1
changelog:
  - Rebase to upstream version 0.31.3.
  - This version includes multiple security fixes
    CVE-2017-5208, CVE-2017-5333, CVE-2017-5332, CVE-2017-6009,
    CVE-2017-6010, CVE-2017-6011
    resolves: rhbz#1430610


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-8
changelog:
  - Resolves: #1298288 [RFE] Improve performance in large environments.
    - cert: speed up cert-find
  - Resolves: #1317379 [EXPERIMENTAL][RFE] Web UI: allow Smart Card
    authentication
    - service: add flag to allow S4U2Self
    - Add 'trusted to auth as user' checkbox
    - Added new authentication method
  - Resolves: #1353881 ipa-replica-install suggests about
    non-existent --force-ntpd option
    - Don't show --force-ntpd option in replica install
  - Resolves: #1354441 DNS forwarder check is too strict: unable to add
    sub-domain to already-broken domain
    - DNS: allow to add forward zone to already broken sub-domain
  - Resolves: #1356146 performance regression in CLI help
    - schema: Speed up schema cache
    - frontend: Change doc, summary, topic and NO_CLI to class properties
    - schema: Introduce schema cache format
    - schema: Generate bits for help load them on request
    - help: Do not create instances to get information about commands and topics
    - schema cache: Do not reset ServerInfo dirty flag
    - schema cache: Do not read fingerprint and format from cache
    - Access data for help separately
    - frontent: Add summary class property to CommandOverride
    - schema cache: Read server info only once
    - schema cache: Store API schema cache in memory
    - client: Do not create instance just to check isinstance
    - schema cache: Read schema instead of rewriting it when SchemaUpToDate
  - Resolves: #1360769 ipa-server-certinstall couldnt unlock private key file
    - server install: do not prompt for cert file PIN repeatedly
  - Resolves: #1364113 ipa-password: ipa: ERROR: RuntimeError: Unable to create
    cache directory: [Errno 13] Permission denied: '/home/test_user'
    - schema: Speed up schema cache
  - Resolves: #1366604 `cert-find` crashes on invalid certificate data
    - cert: do not crash on invalid data in cert-find
  - Resolves: #1366612 Middle replica uninstallation in line topology works
    without '--ignore-topology-disconnect'
    - Fail on topology disconnect/last role removal
  - Resolves: #1366626 caacl-add-service: incorrect error message when service
    does not exists
    - Fix ipa-caalc-add-service error message
  - Resolves: #1367022 The ipa-server-upgrade command failed when named-pkcs11
    does not happen to run during dnf upgrade
    - DNS server upgrade: do not fail when DNS server did not respond
  - Resolves: #1367759 [RFE] [webui] warn admin if there is only one IPA server
    with CA
    - Add warning about only one existing CA server
    - Set servers list as default facet in topology facet group
  - Resolves: #1367773 thin client ignores locale change
    - schema check: Check current client language against cached one


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-9
changelog:
  - Resolves: #1081561 CA not start during ipa server install in pure IPv6 env
    - Fix ipa-server-install in pure IPv6 environment
  - Resolves: #1318169 Tree-root domains in a trusted AD forest aren't marked as
    reachable via the forest root
    - trust: make sure ID range is created for the child domain even if it exists
    - ipa-kdb: simplify trusted domain parent search
  - Resolves: #1335567 Update Warning in IdM Web UI API browser
    - WebUI: add API browser is tech preview warning
  - Resolves: #1348560 Mulitple domain Active Directory Trust conflict
    - ipaserver/dcerpc: reformat to make the code closer to pep8
    - trust: automatically resolve DNS trust conflicts for triangle trusts
  - Resolves: #1351593 CVE-2016-5404 ipa: Insufficient privileges check in
    certificate revocation
    - cert-revoke: fix permission check bypass (CVE-2016-5404)
  - Resolves: #1353936 custodia.conf and server.keys file is world-readable.
    - Remove Custodia server keys from LDAP
    - Secure permissions of Custodia server.keys
  - Resolves: #1358752 ipa-ca-install fails on replica when IPA server is
    converted from CA-less to CA-full
    - custodia: include known CA certs in the PKCS#12 file for Dogtag
    - custodia: force reconnect before retrieving CA certs from LDAP
  - Resolves: #1362333 ipa vault container owner cannot add vault
    - Fix: container owner should be able to add vault
  - Resolves: #1365546 External trust with root domain is transitive
    - trust: make sure external trust topology is correctly rendered
  - Resolves: #1365572 IPA server broken after upgrade
    - Require pki-core-10.3.3-7
  - Resolves: #1367864 Server assumes latest version of command instead of
    version 1 for old / 3rd party clients
    - rpcserver: assume version 1 for unversioned command calls
    - rpcserver: fix crash in XML-RPC system commands
  - Resolves: #1367773 thin client ignores locale change
    - schema cache: Fallback to 'en_us' when locale is not available
  - Resolves: #1368754 ipa server uninstall fails with Python "Global Name error"
    - Fail on topology disconnect/last role removal
  - Resolves: #1368981 ipa otptoken-add --type=hotp --key creates wrong OTP
    - otptoken, permission: Convert custom type parameters on server
  - Resolves: #1369414 ipa server-del fails with Python stack trace
    - Handled empty hostname in server-del command
  - Resolves: #1369761 ipa-server must depend on a version of httpd that support
    mod_proxy with UDS
    - Require httpd 2.4.6-31 with mod_proxy Unix socket support
  - Resolves: #1370512 Received ACIError instead of DuplicatedError in
    stageuser_tests
    - Raise DuplicatedEnrty error when user exists in delete_container
  - Resolves: #1371479 cert-find --all does not show information about revocation
    - cert: add missing param values to cert-find output
  - Renamed patch 1011 to 0100, as it was merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-10
changelog:
  - Resolves: #1355753 adding two way non transitive(external) trust displays
    internal error on the console
    - Always fetch forest info from root DCs when establishing two-way trust
    - factor out `populate_remote_domain` method into module-level function
    - Always fetch forest info from root DCs when establishing one-way trust
  - Resolves: #1356101 Lightweight sub-CA certs are not tracked by certmonger
    after `ipa-replica-install`
    - Track lightweight CAs on replica installation
  - Resolves: #1357488 ipa command stuck forever on higher versioned client with
    lower versioned server
    - compat: Save server's API version in for pre-schema servers
    - compat: Fix ping command call
    - schema cache: Store and check info for pre-schema servers
  - Resolves: #1363905 man page for ipa-replica-manage has a typo in -c flag
    - Fix man page ipa-replica-manage: remove duplicate -c option
      from --no-lookup
  - Resolves: #1367865 webui: cert_revoke should use --cacn to set correct CA
    when revoking certificate
    - cert: include CA name in cert command output
    - WebUI add support for sub-CAs while revoking certificates
  - Resolves: #1368424 Unable to view certificates issued by Sub CA in Web UI
    - Add support for additional options taken from table facet
    - WebUI: Fix showing certificates issued by sub-CA
  - Resolves: #1368557 dnsrecord-add does not prompt for missing record parts
    internactively
    - dns: normalize record type read interactively in dnsrecord_add
    - dns: prompt for missing record parts in CLI
    - dns: fix crash in interactive mode against old servers
  - Resolves: #1370519 Certificate revocation in service-del and host-del isn't
    aware of Sub CAs
    - cert: fix cert-find --certificate when the cert is not in LDAP
    - Make host/service cert revocation aware of lightweight CAs
  - Resolves: #1371901 Use OAEP padding with custodia
    - Use RSA-OAEP instead of RSA PKCS#1 v1.5
  - Resolves: #1371915 When establishing external two-way trust, forest root
    Administrator account is used to fetch domain info
    - do not use trusted forest name to construct domain admin principal
  - Resolves: #1372597 Incorrect CA ACL evaluation of SAN DNS names in
    certificate request
    - Fix CA ACL Check on SubjectAltNames
  - Resolves: #1373272 CLI always sends default command version
    - cli: use full name when executing a command
  - Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
    - Fix ipa-certupdate for CA-less installation
  - Resolves: #1373540 client-install with IPv6 address fails on link-local
    address (always)
    - Fix parse errors with link-local addresses


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-11
changelog:
  - Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
    - Fix regression introduced in ipa-certupdate


author: Petr Vobornik <pvoborni@redhat.com> - 4.4.0-12
changelog:
  - Resolves: #1373910 IPA server upgrade fails with DNS timed out errors.
  - Resolves: #1375269 ipa trust-fetch-domains throws internal error


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-13
changelog:
  - Resolves: #1318616 CA fails to start after doing ipa-ca-install --external-ca
    - Keep NSS trust flags of existing certificates
  - Resolves: #1360813 ipa-server-certinstall does not update all certificate
    stores and doesn't set proper trust permissions
    - Add cert checks in ipa-server-certinstall
  - Resolves: #1371479 cert-find --all does not show information about revocation
    - cert: add revocation reason back to cert-find output
  - Resolves: #1375133 WinSync users who have First.Last casing creates users who
    can have their password set
    - ipa passwd: use correct normalizer for user principals
  - Resolves: #1377858 Users with 2FA tokens are not able to login to IPA servers
    - Properly handle LDAP socket closures in ipa-otpd
  - Resolves: #1387779 Make httpd publish CA certificate on Domain Level 1
    - Make httpd publish its CA certificate on DL1


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14
changelog:
  - Resolves: #1378353 Replica install fails with old IPA master sometimes during
    replication process
    - spec file: bump minimal required version of 389-ds-base
  - Resolves: #1387779 Make httpd publish CA certificate on Domain Level 1
    - Fix missing file that fails DL1 replica installation
  - Resolves: #1387782 WebUI: Services are not displayed correctly after upgrade
    - WebUI: services without canonical name are shown correctly
  - Resolves: #1389709 Traceback seen in error_log when trustdomain-del is run
    - trustdomain-del: fix the way how subdomain is searched


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.1
changelog:
  - Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
    by abusing password policy
    - password policy: Add explicit default password policy for hosts and
      services
  - Resolves: #1395311 CVE-2016-9575 ipa: Insufficient permission check in
    certprofile-mod
    - certprofile-mod: correctly authorise config update


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.1.1
changelog:
  - Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
    by abusing password policy
    - ipa-kdb: search for password policies globally
  - Renamed patches 1011 and 1012 to 0146 and 0145, as they were merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.2
changelog:
  - Resolves: #1401953 ipa-ca-install on promoted replica hangs on creating a
    temporary CA admin
    - replication: ensure bind DN group check interval is set on replica config
    - add missing attribute to ipaca replica during CA topology update
  - Resolves: #1404169 IPA upgrade of replica without DNS fails during restart of
    named-pkcs11
    - bindinstance: use data in named.conf to determine configuration status
  - Resolves: #1404171 Creation of replica for disconnected environment is
    failing with CA issuance errors; Need good steps.
    - gracefully handle setting replica bind dn group on old masters


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.3
changelog:
  - Resolves: #1404338 Check IdM Topology for broken record caused by replication
    conflict before upgrading it
    - Check for conflict entries before raising domain level


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.4
changelog:
  - Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
    by abusing password policy
    - ipa-kdb: search for password policies globally
  - Renamed patches 1011 and 1012 to 0151 and 0150, as they were merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.5
changelog:
  - Resolves: #1410760 ipa-ca-install fails on replica when IPA Master is
    installed without CA
    - Set up DS TLS on replica in CA-less topology
  - Resolves: #1413137 CVE-2017-2590 ipa: Insufficient permission check for
    ca-del, ca-disable and ca-enable commands
    - ca: correctly authorise ca-del, ca-enable and ca-disable
  - Resolves: #1416481 IPA replica install fails with dirsrv errors.
    - Do not configure PKI ajp redirection to use "::1"


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.6
changelog:
  - Resolves: #1416488 replication race condition prevents IPA to install
    - wait_for_entry: use only DN as parameter
    - Wait until HTTPS principal entry is replicated to replica
    - Use proper logging for error messages


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.7
changelog:
  - Resolves: #1429872 ipa-replica-install fails promotecustodia.create_replica
    with cert errors (untrusted)
    - added ssl verification using IPA trust anchor
  - Resolves: #1430674 batch param compatibility is incorrect
    - compat: fix `Any` params in `batch` and `dnsrecord`
  - Renamed patches 1011 and 1012 to 0159 and 0157, as they were merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-6
changelog:
  - Resolves: #1309700 Process /usr/sbin/winbindd was killed by signal 6
    - Revert "spec: add conflict with bind-chroot to freeipa-server-dns"
  - Resolves: #1341249 Subsequent external CA installation fails
    - install: fix external CA cert validation
  - Resolves: #1353831 ipa-server-install fails in container because of
    hostnamectl set-hostname
    - server-install: Fix --hostname option to always override api.env values
    - install: Call hostnamectl set-hostname only if --hostname option is used
  - Resolves: #1356091 ipa-cacert-manage --help and man differ
    - Improvements for the ipa-cacert-manage man and help
  - Resolves: #1360631 ipa-backup is not keeping the
    /etc/tmpfiles.d/dirsrv-<instance>.conf
    - ipa-backup: backup /etc/tmpfiles.d/dirsrv-<instance>.conf
  - Resolves: #1361047 ipa-replica-install --help usage line suggests the replica
    file is needed
    - Update ipa-replica-install documentation
  - Resolves: #1361545 ipa-client-install starts rhel-domainname.service but does
    not rpm-require it
    - client: RPM require initscripts to get *-domainname.service
  - Resolves: #1364197 caacl: error when instantiating rules with service
    principals
    - caacl: fix regression in rule instantiation
  - Resolves: #1364310 ipa otptoken-add bytes object has no attribute confirm
    - parameters: move the `confirm` kwarg to Param
  - Resolves: #1364464 Topology graph: ca and domain adders shows question marks
    instead of plus icon
    - Fix unicode characters in ca and domain adders
  - Resolves: #1365083 Incomplete output returned for command ipa vault-add
    - client: add missing output params to client-side commands
  - Resolves: #1365526 build fails during "make check"
    - ipa-kdb: Fix unit test after packaging changes in krb5


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-7
changelog:
  - Resolves: #1361119 UPN-based search for AD users does not match an entry in
    slapi-nis map cache
    - support multiple uid values in schema compatibility tree


author: Patrick Uiterwijk <puiterwijk@redhat.com> - 1.0.0-6
changelog:
  - Removed gpg key check during build RHBZ#1248529
  - Fixed the license tag to include external code RHBZ#1248538
  - Use full path url RHBZ#1251149


author: Patrick Uiterwijk <puiterwijk@redhat.com> - 1.0.0-7
changelog:
  - Added dependency on python-requests for client RHBZ#1254644
  - Fixed possible XSS flaws CVE-2015-5215, CVE-2015-5216
  - Fixed permission check CVE-2015-5217


author: Patrick Uiterwijk <puiterwijk@redhat.com> - 1.0.0-8
changelog:
  - Moved ipsilon-client-install man page to client subpackage RHBZ#1255103
  - Backported patch to count IPA as login plugin RHBZ#1256517
  - Backported patch to log error if nameid is invalid RHBZ#1256520
  - Backported patch to add city attribute RHBZ#1257213


author: Patrick Uiterwijk <puiterwijk@redhat.com> - 1.0.0-9
changelog:
  - Backport database keys patch RHBZ#1252392
  - Backport SAML path check patch RHBZ#1253821
  - Backport database cleanup RHBZ#1256518


author: Petr Holasek <pholasek@redhat.com> - 2:1.0.7-2
changelog:
  - fixed unused variable revealed by covscan
  - fixed ignored pid argument (#1155632)
  - warning when irqbalance started under non-root (#1155799)
  - more robust signal handling (#1158937)
  - fixed hostname in manpage (#1162251)


author: Petr Holasek <pholasek@redhat.com> - 2:1.0.6-5
changelog:
  - Fixed irqbalance web adresses in spec (bz1060810)
  - Default hintpolicy adjusted (bz1060814)
  - Missing autogen.sh call fixed


author: Rafael Aquini <aquini@redhat.com> - 20150904-42.git6ebf5d5
changelog:
  - Add Intel Omni-Path Architecture hfi1 Firmware (rhbz 1194910)
  - Update skl firmware for gpu (rhbz 1210012)


author: Jarod Wilson <jarod@redhat.com> - 20150904-43.git6ebf5d5
changelog:
  - Add more old chelsio firmwares, they nuked the one the driver in
    RHEL7.2 is expecting from upstream (rhbz 1262128)
  - Remove amd-ucode again, it simply breaks too many systems (rhbz 1246393)


author: Rafael Aquini <aquini@redhat.com> - 20160223-44.git8d1fd61
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Update Intel Omni-Path Architecture hfi1 Firmware (rhbz 1267015)


author: Rafael Aquini <aquini@redhat.com> - 20160426-45.git986a5a8
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Restore AMD-ucode firmware blob again (rhbz 866700)
  - qat: Update to the latest upstream firmware (rhbz 1173792)
  - WiFi on Windstorm Peak Wireless Adapter 8265 - firmware support (rhbz 1315534)
  - WiFi on Sandy Peak Wireless Adapter 3168 - firmware support (rhbz 1315536)


author: Rafael Aquini <aquini@redhat.com> - 20160615-46.gita4bbc81
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Nuke old cxgb4 firmware blobs tarball (rhbz 1336906)
  - Update to latest Chelsio firmware release version (rhbz 1336906)


author: Rafael Aquini <aquini@redhat.com> - 20160728-47.git0daeaf3
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Core14 firmware release for 7265, 7260, 3160 wireless devices (rhbz 1358566)
  - Core19 firmware release for 7265D, 8260, 8265, 3168 wireless devices (rhbz 1358568)


author: Rafael Aquini <aquini@redhat.com> - 20160830-49.git7534e19
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Update QCA6174/hw3.0/board-2.bin file to support ath10k devices (rhbz 1368159)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-27
changelog:
  - CVE-2014-9029 - incorrect component number check in COC, RGN and QCC
                    marker segment decoders (#1171211)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-28
changelog:
  - CVE-2014-8137 - double-free in in jas_iccattrval_destroy (#1173569)
  - CVE-2014-8138 - heap overflow in jp2_decode (#1173569)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-29
changelog:
  - CVE-2014-8157 - dec->numtiles off-by-one check in jpc_dec_process_sot() (#1183674)
  - CVE-2014-8158 - unrestricted stack memory use in jpc_qmfb.c (#1183682)


author: Josef Ridky <jridky@redhat.com> - 1.900.1-30
changelog:
  - Multiple security fixes (fixed by thoger):
    CVE-2015-5203 CVE-2015-5221 CVE-2016-1577 CVE-2016-1867 CVE-2016-2089
    CVE-2016-2116 CVE-2016-8654 CVE-2016-8690 CVE-2016-8691 CVE-2016-8692
    CVE-2016-8693 CVE-2016-8883 CVE-2016-8884 CVE-2016-8885 CVE-2016-9262
    CVE-2016-9387 CVE-2016-9388 CVE-2016-9389 CVE-2016-9390 CVE-2016-9391
    CVE-2016-9392 CVE-2016-9393 CVE-2016-9394 CVE-2016-9560 CVE-2016-9583
    CVE-2016-9591 CVE-2016-9600 CVE-2016-10248 CVE-2016-10249 CVE-2016-10251
  - Fix implicit declaration warning caused by security fixes above


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.3
changelog:
  - Separate bootstrap option as it should not be tied to the JDK used.
  - Enable bootstrapping on JIT architectures going forward.
  - Temporarily enable bootstrapping on all architectures to work around RH1334465/PR2956.
  - Resolves: rhbz#1350047


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.5
changelog:
  - Non-JIT architectures have not been bootstrapping, due to RPM reading commented macros
  - Resolves: rhbz#1350047


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.8
changelog:
  - Set install directories in configure so that @prefix@ is substituted correctly in tapset
  - Resolves: rhbz#1350047


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.9
changelog:
  - Require a JDK with RH1334465/PR2956 fixed and turn off bootstrapping for Zero architectures.
  - Resolves: rhbz#1350047


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.41-1.13.13.0
changelog:
  - Update to IcedTea 1.13.13 & OpenJDK 6 b41.
  - Fix context for rpath patch following PR3213.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.2
changelog:
  - Reset permissions of resources.jar to avoid it only being readable by root (PR1437).
  - Resolves: rhbz#1350042


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.3
changelog:
  - Add additional changes to 8162344 to fix issues which only show up on a full build.
  - Resolves: rhbz#1350042


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.4
changelog:
  - Require a version of java-1.7.0-openjdk-devel with a working jar uf
  - Use readlink rather than a wildcard to resolve the system JDK directory
  - Resolves: rhbz#1350042


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.5
changelog:
  - Change to disable RC4 did not add MD5 checksum of previous java.security file from 2016/01
  - Resolves: rhbz#1350042


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.111-2.6.7.6
changelog:
  - declared check_sum_presented_in_spec and used in prep and check
  - it is checking that latest packed java.security is mentioned in listing
  - Resolves: rhbz#1350042


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.7
changelog:
  - Rebuild java-1.7.0-openjdk for GCC aarch64 stack epilogue code generation fix (RH1372747)
  - Resolves: rhbz#1350042


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.121-2.6.8.0
changelog:
  - Bump to 2.6.8 and u121b00.
  - Drop patches (S7081817, S8140344, S8145017 and S8162344) applied upstream.
  - Update md5sum list with checksum for the new java.security file.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.131-2.6.9.0
changelog:
  - Bump to 2.6.9 and u131b00.
  - Remove patch application debris in fsg.sh.
  - Re-generate PR2809 and RH1022017 against 2.6.9.
  - Update md5sum list with checksum for the new java.security file.
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.141-2.6.10.0
changelog:
  - Bump to 2.6.10 and u141b00.
  - Adjust RH1022017 following application of 8173783
  - Add more detailed output to fsg.sh and generate_source_tarball.sh.
  - Update md5sum list with checksum for the new java.security file.
  - Bump to u141b01 to include S8043723 fix for s390.
  - Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-5.b15
changelog:
  - Update to aarch64-jdk8u101-b15.
  - Rebase SystemTap tarball on IcedTea 3.1.0 versions so as to avoid patching.
  - Drop additional hunk for 8147771 which is now applied upstream.
  - Resolves: rhbz#1368440


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.102-0.b14
changelog:
  - Update to aarch64-jdk8u102-b14.
  - Drop 8140620, 8148752 and 6961123, all of which appear upstream in u102.
  - Move 8159244 to 8u111 section as it only appears to be in unpublished u102 b31.
  - Move 8158260 to 8u112 section following its backport to 8u.
  - Resolves: rhbz#1368440


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.102-1.b14
changelog:
  - declared check_sum_presented_in_spec and used in prep and check
  - it is checking that latest packed java.security is mentioned in listing
  - Resolves: rhbz#1368440


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-0.b14
changelog:
  - Update to aarch64-jdk8u111-b14.
  - Add latest md5sum for java.security file due to jar signing property addition.
  - Drop S8157306 and the CORBA typo fix, both of which appear upstream in u111.
  - Add LCMS 2 patch to fix Red Hat security issue RH1367357 in the local OpenJDK copy.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-0.b15
changelog:
  - Update to aarch64-jdk8u111-b15, with AArch64 fix for S8160591.
  - Swap java.security md5sum for 7.2.z version with ECC patch.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.102-0.b14
changelog:
  - Update to aarch64-jdk8u102-b14.
  - Drop 8140620, 8148752 and 6961123, all of which appear upstream in u102.
  - Move 8159244 to 8u111 section as it only appears to be in unpublished u102 b31.
  - Move 8158260 to 8u112 section following its backport to 8u.
  - Resolves: rhbz#1359857


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.102-2.b14
changelog:
  - @prefix@ in tapsetfiles substitued by prefix as necessary to work with systemtap3 (rhbz1371005)
  - Resolves: rhbz#1295754


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.102-2.b14
changelog:
  - declared check_sum_presented_in_spec and used in prep and check
  - it is checking that latest packed java.security is mentioned in listing
  - Resolves: rhbz#1295754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.102-3.b14
changelog:
  - Rebuild java-1.8.0-openjdk for GCC aarch64 stack epilogue code generation fix (RH1372750)
  - Resolves: rhbz#1359857


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.102-4.b14
changelog:
  - Runtime native library requirements need to match the architecture of the JDK
  - Resolves: rhbz#1375224


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-0.b14
changelog:
  - Update to aarch64-jdk8u111-b14.
  - Add latest md5sum for java.security file due to jar signing property addition.
  - Drop S8157306 and the CORBA typo fix, both of which appear upstream in u111.
  - Add LCMS 2 patch to fix Red Hat security issue RH1367357 in the local OpenJDK copy.
  - Resolves: rhbz#1350037


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-3.b15
changelog:
  - Add MD5 checksum from RHEL 7.2 security update so the 7.3 one overwrites it.
  - Resolves: rhbz#1382736


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-4.b18
changelog:
  - Update to aarch64-jdk8u111-b18, synced with upstream u111, S8170873 and new AArch64 fixes
  - Replace our correct version of 8159244 with the amendment to the 8u version from 8160122.
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-4.b18
changelog:
  - Use java-1.7.0-openjdk to bootstrap on RHEL to allow us to use main build target
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.112-0.b16
changelog:
  - Update to aarch64-jdk8u112-b16.
  - Drop upstreamed patches for 8044762, 8049226, 8154210, 8158260 and 8160122.
  - Re-generate size_t and key size (RH1163501) patches against u112.
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-0.b13
changelog:
  - Update to aarch64-jdk8u121-b13.
  - Add MD5 checksum for the new java.security file (EC < 224, DSA < 1024 restricted)
  - Update PR1834/RH1022017 fix to reduce curves reported by SSL to apply against u121.
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-1.b13
changelog:
  - Add backports from 8u131 and 8u152 ahead of April CPU.
  - Apply backports before local RPM fixes so they will be the same as when applied upstream
  - Adjust RH1022017 following application of 8173783
  - Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-1.b11
changelog:
  - Update to aarch64-jdk8u131-b11.
  - Drop upstreamed patches for 8147910, 8161993, 8170888 and 8173783.
  - Update generate_source_tarball.sh to remove patch remnants.
  - Cleanup tarball creation documentation to avoid duplication.
  - Add MD5 checksum for the new java.security file (MD5 disabled for JAR signing)
  - Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-2.b13
changelog:
  - Backport "S8153711: [REDO] JDWP: Memory Leak: GlobalRefs never deleted when processing invokeMethod command"
  - Resolves: rhbz#1442162


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-3.b12
changelog:
  - Update to aarch64-jdk8u131-b12 and aarch64-shenandoah-jdk8u131-b12 for AArch64 8168699 fix
  - Resolves: rhbz#1449258


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-4.b12
changelog:
  - Add backports from 8u152 (8179084/RH1455694, 8181419/RH1463144, 8175887) ahead of July CPU.
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.141-0.b15
changelog:
  - Update to aarch64-jdk8u141-b15.
  - Update location of OpenJDK system library source code in remove-intree-libraries.sh
  - Drop upstreamed patches for 6515172, 8144566, 8155049, 8165231, 8174164, 8174729 and 8175097.
  - Update PR1983, PR2899 and PR2934 (SunEC + system NSS) to accomodate 8175110.
  - Add MD5 checksum for the new java.security file (SHA1 disabled for server-side certificates in jdkCA)
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.141-1.b16
changelog:
  - Update to aarch64-jdk8u141-b16.
  - Revert change to remove-intree-libraries.sh following backout of 8173207
  - Resolves: rhbz#1466509


author: Jan Grulich <jgrulich@redhat.com> - 6:4.14.8-6
changelog:
  - KAuth: verify that whoever is calling us is actually who he says he is (CVE-2017-8422)
    Resolves: CVE-2017-8422


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.3.1.el7]
changelog:
  - [net] team: Fixing a bug in team driver due to incorrect 'unsigned int' to 'int' conversion (Hangbin Liu) [1392023 1382098]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.4.1.el7]
changelog:
  - [net] rtnetlink: fix rtnl_vfinfo_size (Sabrina Dubroca) [1395811 1392128]
  - [netdrv] ixgbe: test for trust in macvlan adjustments for vf (Ken Cox) [1395572 1379787]
  - [kernel] timekeeping: Copy the shadow-timekeeper over the real timekeeper last (Prarit Bhargava) [1395577 1344747]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.5.1.el7]
changelog:
  - [fs] Fix regression which breaks DFS mounting (Sachin Prabhu) [1400055 1302329]
  - [fs] Move check for prefix path to within cifs_get_root() (Sachin Prabhu) [1400055 1302329]
  - [fs] Compare prepaths when comparing superblocks (Sachin Prabhu) [1400055 1302329]
  - [fs] Fix memory leaks in cifs_do_mount() (Sachin Prabhu) [1400055 1302329]
  - [fs] cifs: make share unaccessible at root level mountable (Sachin Prabhu) [1400055 1302329]
  - [kernel] sched: Fix possible divide by zero in avg_atom() calculation (Mateusz Guzik) [1398361 1392466]
  - [scsi] megaraid_sas: Do not set MPI2_TYPE_CUDA for JBOD FP path for FW which does not support JBOD sequence map (Tomas Henzl) [1398175 1380441]
  - [x86] smp: Fix __max_logical_packages value setup (Prarit Bhargava) [1398173 1394239]
  - [x86] revert "smp: Fix __max_logical_packages value setup" (Prarit Bhargava) [1398173 1394239]
  - [watchdog] hpwdt: add support for iLO5 (Linda Knippers) [1397747 1382798]
  - [x86] kexec: Fix kexec crash in syscall kexec_file_load() (Pingfan Liu) [1395573 1385109]
  - [powerpc] ppc64: Fix incorrect return value from __copy_tofrom_user (Steve Best) [1395565 1387244]
  - [scsi] megaraid-sas: request irqs later (Tomas Henzl) [1394711 1392978]
  - [netdrv] i40e: Fix errors resulted while turning off TSO (Stefan Assmann) [1394708 1378509]
  - [fs] ext4: pre-zero allocated blocks for DAX IO (Eric Sandeen) [1394707 1367989]
  - [powerpc] pseries: use pci_host_bridge.release_fn() to kfree(phb) (Steve Best) [1393724 1385635]
  - [misc] genwqe: Change default access rights for device node (Steve Best) [1393723 1325797]
  - [misc] hpilo: Changes to support new security states in iLO5 FW (Nigel Croxon) [1393720 1376576]
  - [kernel] sched/core: Fix a race between try_to_wake_up() and a woken up task (Lauro Ramos Venancio) [1393719 1379256]
  - [hid] i2c-hid: exit if the IRQ is not valid (David Arcari) [1393717 1376599]
  - [x86] Add support for missing Kabylake Sunrise Point PCH (David Arcari) [1392033 1379401]
  - [net] sctp: not return ENOMEM err back in sctp_packet_transmit (Xin Long) [1392025 1371362]
  - [net] sctp: make sctp_outq_flush/tail/uncork return void (Xin Long) [1392025 1371362]
  - [net] sctp: save transmit error to sk_err in sctp_outq_flush (Xin Long) [1392025 1371362]
  - [net] sctp: free msg->chunks when sctp_primitive_SEND return err (Xin Long) [1392025 1371362]
  - [net] sctp: do not return the transmit err back to sctp_sendmsg (Xin Long) [1392025 1371362]
  - [net] sctp: remove the unnecessary state check in sctp_outq_tail (Xin Long) [1392025 1371362]
  - [net] netdev, sched/wait: Fix sleeping inside wait event (Paolo Abeni) [1392024 1382175]
  - [net] Separate the close_list and the unreg_list (Paolo Abeni) [1392024 1382175]
  - [vfio] pci: Fix ordering of eventfd vs virqfd shutdown (Alex Williamson) [1391611 1322026]
  - [net] Fix use after free in the recvmmsg exit path (Davide Caratti) [1390806 1390047] {CVE-2016-7117}
  - [fs] nfsd: don't return an unhashed lock stateid after taking mutex ("J. Bruce Fields") [1390672 1368577]
  - [fs] nfsd: Fix race between FREE_STATEID and LOCK ("J. Bruce Fields") [1390672 1368577]
  - [fs] nfsd: Close race between nfsd4_release_lockowner and nfsd4_lock ("J. Bruce Fields") [1390672 1368577]
  - [fs] nfsd: Extend the mutex holding region around in nfsd4_process_open2() ("J. Bruce Fields") [1390672 1368577]
  - [fs] nfsd: Always lock state exclusively ("J. Bruce Fields") [1390672 1368577]
  - [infiniband] ib/ipoib: move back IB LL address into the hard header (Jonathan Toppins) [1390668 1378656]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.6.1.el7]
changelog:
  - [net] sctp: validate chunk len before actually using it (Hangbin Liu) [1399458 1399459] {CVE-2016-9555}
  - [net] sctp: rename WORD_TRUNC/ROUND macros (Hangbin Liu) [1399458 1399459] {CVE-2016-9555}
  - [net] sctp: keep fragmentation point aligned to word size (Hangbin Liu) [1399458 1399459] {CVE-2016-9555}
  - [x86] Mark Intel Purley supported (Steve Best) [1402824 1371748]
  - [acpi] sleep: Do not save NVS for new machines to accelerate S3 (Prarit Bhargava) [1402326 1385527]
  - [scsi] megaraid_sas: Send SYNCHRONIZE_CACHE for VD to firmware (Tomas Henzl) [1398179 1380447]
  - [scsi] megaraid_sas: Fix data integrity failure for JBOD (passthrough) devices (Tomas Henzl) [1398179 1380447]
  - [scsi] megaraid_sas: fix macro MEGASAS_IS_LOGICAL to avoid regression (Tomas Henzl) [1398179 1380447]
  - [netdrv] net/hyperv: avoid uninitialized variable (Vitaly Kuznetsov) [1395578 1392220]
  - [netdrv] netvsc: Remove mistaken udp.h inclusion (Vitaly Kuznetsov) [1395578 1392220]
  - [netdrv] netvsc: fix checksum on UDP IPV6 (Vitaly Kuznetsov) [1395578 1392220]
  - [netdrv] hv_netvsc: add ethtool statistics for tx packet issues (Vitaly Kuznetsov) [1395578 1392220]
  - [netdrv] hv_netvsc: rearrange start_xmit (Vitaly Kuznetsov) [1395578 1392220]
  - [fs] Retry operation on EREMOTEIO on an interrupted slot (Steve Dickson) [1394710 1378981]
  - [fs] rbd: don't retry watch reregistration if header object is gone (Ilya Dryomov) [1393485 1378186]
  - [fs] rbd: don't wait for the lock forever if blacklisted (Ilya Dryomov) [1393485 1378186]
  - [fs] rbd: lock_on_read map option (Ilya Dryomov) [1393485 1378186]
  - [hv] do not lose pending heartbeat vmbus packets (Vitaly Kuznetsov) [1392035 1378615]
  - [netdrv] netvsc: fix incorrect receive checksum offloading (Vitaly Kuznetsov) [1391617 1388702]
  - [x86] kvm: lapic: cap __delay at lapic_timer_advance_ns (Marcelo Tosatti) [1391614 1389431]
  - [x86] kvm: x86: move nsec_to_cycles from x86.c to x86.h (Marcelo Tosatti) [1391614 1389431]
  - [net] tcp: fix use after free in tcp_xmit_retransmit_queue() (Mateusz Guzik) [1379530 1379531] {CVE-2016-6828}


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.7.1.el7]
changelog:
  - [kernel] printk: avoid livelock if another CPU printks continuously (Denys Vlasenko) [1402314 1294066]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.9.1.el7]
changelog:
  - [drm] i915/kbl: Remove preliminary_hw_support protection from KBL. (Rob Clark) [1413092 1305702]
  - [netdrv] slip: Fix deadlock in write_wakeup (Steve Best) [1412225 1403497]
  - [netdrv] slip: fix spinlock variant (Steve Best) [1412225 1403497]
  - [kernel] kmod: use system_unbound_wq instead of khelper (Luiz Capitulino) [1411816 1395860]
  - [nvme] switch abort to blk_execute_rq_nowait (David Milburn) [1411669 1392923]
  - [netdrv] ibmveth: calculate gso_segs for large packets (Gustavo Duarte) [1411382 1361958]
  - [netdrv] ibmveth: set correct gso_size and gso_type (Gustavo Duarte) [1411382 1361958]
  - [netdrv] allow macvlans to move to net namespace (Jarod Wilson) [1409829 1368830]
  - [pci] Set Read Completion Boundary to 128 iff Root Port supports it (_HPX) (Myron Stowe) [1406290 1387674]
  - [pci] Export pcie_find_root_port() (Myron Stowe) [1406290 1387674]
  - [rtc] cmos: Initialize hpet timer before irq is registered (Pratyush Anand) [1404184 1299001]
  - [x86] amd: Fix cpu_llc_id for AMD Fam17h systems (Suravee Suthikulpanit) [1402444 1395399]
  - [powerpc] powernv: Fix stale PE primary bus (Steve Best) [1402440 1395275]
  - [misc] cxl: Fix coredump generation when cxl_get_fd() is used (Gustavo Duarte) [1402439 1397943]
  - [pci] cxl: use pcibios_free_controller_deferred() when removing vPHBs (Gustavo Duarte) [1402438 1395323]
  - [scsi] qla2xxx: do not abort all commands in the adapter during EEH recovery (Gustavo Duarte) [1402436 1393254]
  - [scsi] qla2xxx: fix invalid DMA access after command aborts in PCI device remove (Gustavo Duarte) [1402436 1393254]
  - [scsi] qla2xxx: do not queue commands when unloading (Gustavo Duarte) [1402436 1393254]
  - [net] packet: fix race condition in packet_set_ring (Hangbin Liu) [1401852 1401853] {CVE-2016-8655}


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.10.1.el7]
changelog:
  - [block] blk-mq: Fix NULL pointer updating nr_requests (David Milburn) [1416133 1384066]
  - [scsi] cxlflash: Fix crash in cxlflash_restore_luntable() (Gustavo Duarte) [1415146 1400524]
  - [scsi] cxlflash: Improve context_reset() logic (Gustavo Duarte) [1415146 1400524]
  - [scsi] cxlflash: Avoid command room violation (Gustavo Duarte) [1415146 1400524]
  - [x86] Mark Kaby Lake with Kaby Lake PCH as supported (David Arcari) [1415094 1391219]
  - [scsi] be2iscsi: Add checks to validate completions (Maurizio Lombardi) [1414687 1324918]
  - [scsi] be2iscsi: Fix bad WRB index error (Maurizio Lombardi) [1414687 1324918]
  - [scsi] be2iscsi: Add lock to protect WRB alloc and free (Maurizio Lombardi) [1414687 1324918]
  - [mm] meminit: initialise more memory for inode/dentry hash tables in early boot (Yasuaki Ishimatsu) [1413623 1404584]
  - [s390] mem_detect: Revert "add DAT sanity check" (Hendrik Brueckner) [1413600 1391540]
  - [cpufreq] intel_pstate: Fix code ordering in intel_pstate_set_policy() (Prarit Bhargava) [1411818 1398072]
  - [scsi] cxlflash: Improve EEH recovery time (Steve Best) [1402442 1397588]
  - [scsi] cxlflash: Fix to avoid EEH and host reset collisions (Steve Best) [1402442 1397588]
  - [scsi] cxlflash: Remove the device cleanly in the system shutdown path (Steve Best) [1402442 1397588]
  - [scsi] cxlflash: Scan host only after the port is ready for I/O (Steve Best) [1402442 1397588]
  - [x86] kvm: x86: Check memopp before dereference (Mateusz Guzik) [1395805 1395806] {CVE-2016-8630}
  - [vfio] pci: Fix integer overflows, bitmask check (Mateusz Guzik) [1394627 1394991 1394628 1394992] {CVE-2016-9083 CVE-2016-9084}
  - [acpi] acpi / scan: use platform bus type by default for _HID enumeration (Tony Camuso) [1393727 1383505]
  - [acpi] acpi / scan: introduce platform_id device PNP type flag (Tony Camuso) [1393727 1383505]
  - [char] ipmi: Convert the IPMI SI ACPI handling to a platform device (Tony Camuso) [1393727 1383505]
  - [acpi] acpi / ipmi: Cleanup coding styles (David Arcari) [1393725 1373703]
  - [acpi] acpi / ipmi: Cleanup some inclusion codes (David Arcari) [1393725 1373703]
  - [acpi] acpi / ipmi: Cleanup some initialization codes (David Arcari) [1393725 1373703]
  - [acpi] acpi / ipmi: Cleanup several acpi_ipmi_device members (David Arcari) [1393725 1373703]
  - [acpi] acpi / ipmi: Add reference counting for ACPI IPMI transfers (David Arcari) [1393725 1373703]
  - [acpi] acpi / ipmi: Use global IPMI operation region handler (David Arcari) [1393725 1373703]
  - [acpi] acpi / ipmi: Fix race caused by the unprotected ACPI IPMI user (David Arcari) [1393725 1373703]
  - [acpi] acpi / ipmi: Fix race caused by the timed out ACPI IPMI transfers (David Arcari) [1393725 1373703]
  - [acpi] acpi / ipmi: Fix race caused by the unprotected ACPI IPMI transfers (David Arcari) [1393725 1373703]
  - [acpi] acpi / ipmi: Fix potential response buffer overflow (David Arcari) [1393725 1373703]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.10.2.el7]
changelog:
  - [net] dccp: fix freeing skb too early for IPV6_RECVPKTINFO (Hannes Frederic Sowa) [1423462 1423463]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.11.1.el7]
changelog:
  - [scsi] qla2xxx: Get mutex lock before checking optrom_state (Chad Dupuis) [1418317 1408387]
  - [mm] memcontrol: do not recurse in direct reclaim (Rik van Riel) [1417192 1397330]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.13.1.el7]
changelog:
  - [fs] gfs2: Reduce contention on gfs2_log_lock (Robert S Peterson) [1422380 1406850]
  - [fs] gfs2: Inline function meta_lo_add (Robert S Peterson) [1422380 1406850]
  - [fs] gfs2: Switch tr_touched to flag in transaction (Robert S Peterson) [1422380 1406850]
  - [fs] xfs: ioends require logically contiguous file offsets (Brian Foster) [1421203 1398005]
  - [fs] xfs: don't chain ioends during writepage submission (Brian Foster) [1421203 1398005]
  - [fs] xfs: factor mapping out of xfs_do_writepage (Brian Foster) [1421203 1398005]
  - [fs] xfs: xfs_cluster_write is redundant (Brian Foster) [1421203 1398005]
  - [fs] xfs: Introduce writeback context for writepages (Brian Foster) [1421203 1398005]
  - [fs] xfs: remove xfs_cancel_ioend (Brian Foster) [1421203 1398005]
  - [fs] xfs: remove nonblocking mode from xfs_vm_writepage (Brian Foster) [1421203 1398005]
  - [fs] mm/filemap.c: make global sync not clear error status of individual inodes (Brian Foster) [1421203 1398005]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.14.1.el7]
changelog:
  - [net] dccp: fix freeing skb too early for IPV6_RECVPKTINFO (Hannes Frederic Sowa) [1423462 1423463] {CVE-2017-6074}
  - [net] sctp: check af before verify address in sctp_addr_id2transport (Xin Long) [1419837 1414389]
  - [net] sctp: sctp_addr_id2transport should verify the addr before looking up assoc (Xin Long) [1419837 1414389]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.15.1.el7]
changelog:
  - [net] vxlan: fix oops in dev_fill_metadata_dst (Paolo Abeni) [1427847 1423068]
  - [x86] perf/x86/intel/uncore: Fix hardcoded socket 0 assumption in the Haswell init code (Prarit Bhargava) [1426633 1373738]
  - [x86] revert "perf/uncore: Disable uncore on kdump kernel" (Prarit Bhargava) [1426633 1373738]
  - [x86] smpboot: Init apic mapping before usage (Prarit Bhargava) [1426633 1373738]
  - [x86] smp: Don't try to poke disabled/non-existent APIC (Prarit Bhargava) [1426633 1373738]
  - [x86] Handle non enumerated CPU after physical hotplug (Prarit Bhargava) [1426633 1373738]
  - [x86] perf/x86: Fix NMI measurements (Jiri Olsa) [1425804 1405101]
  - [x86] Warn when NMI handlers take large amounts of time (Jiri Olsa) [1425804 1405101]
  - [nvme] apply DELAY_BEFORE_CHK_RDY quirk at probe time too (Gustavo Duarte) [1423439 1409122]
  - [crypto] qat - zero esram only for DH85x devices (Neil Horman) [1422575 1382849]
  - [crypto] qat - fix bar discovery for c62x (Neil Horman) [1422575 1382849]
  - [fs] xfs: remove racy hasattr check from attr ops (Brian Foster) [1421202 1395538]
  - [fs] dlm: free workqueues after the connections (Marcelo Leitner) [1421197 1383710]
  - [netdrv] igb: re-assign hw address pointer on reset after PCI error (Gustavo Duarte) [1419459 1413043]
  - [kernel] timekeeping: Increment clock_was_set_seq in timekeeping_init() (Prarit Bhargava) [1418947 1409214]
  - [kernel] timekeeping: Use timekeeping_update() instead of memcpy() (Prarit Bhargava) [1418947 1409214]
  - [fs] libceph: no need to drop con->mutex for ->get_authorizer() (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: drop len argument of *verify_authorizer_reply() (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: verify authorize reply on connect (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: no need for GFP_NOFS in ceph_monc_init() (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: stop allocating a new cipher on every crypto request (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: uninline ceph_crypto_key_destroy() (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: remove now unused ceph_*{en, de}crypt*() functions (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: switch ceph_x_decrypt() to ceph_crypt() (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: switch ceph_x_encrypt() to ceph_crypt() (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: tweak calcu_signature() a little (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: rename and align ceph_x_authorizer::reply_buf (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: introduce ceph_crypt() for in-place en/decryption (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: introduce ceph_x_encrypt_offset() (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: old_key in process_one_ticket() is redundant (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: ceph_x_encrypt_buflen() takes in_len (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: Remove unnecessary ivsize variables (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: Use skcipher (Ilya Dryomov) [1418316 1408170]
  - [scsi] scsi_lib: correctly retry failed zero length REQ_TYPE_FS commands (Ewan Milne) [1417923 1403849]
  - [netdrv] ibmvnic: Start completion queue negotiation at server-provided optimum values (Steve Best) [1415144 1403396]
  - [netdrv] ibmvnic: Fix missing brackets in init_sub_crq_irqs (Steve Best) [1415144 1403396]
  - [netdrv] ibmvnic: Fix releasing of sub-CRQ IRQs in interrupt context (Steve Best) [1415144 1403396]
  - [netdrv] ibmvnic: Update MTU after device initialization (Steve Best) [1415144 1403396]
  - [netdrv] ibmvnic: Fix GFP_KERNEL allocation in interrupt context (Steve Best) [1415144 1403396]
  - [netdrv] ibmvnic: fix error return code in ibmvnic_probe() (Steve Best) [1415144 1403396]
  - [netdrv] ibmvnic: convert to use simple_open() (Steve Best) [1415144 1403396]
  - [netdrv] ibmvnic: Handle backing device failover and reinitialization (Steve Best) [1418309 1403692]
  - [tools] perf ppc64le: Fix build failure when libelf is not present (Jiri Olsa) [1414710 1376534]
  - [tools] perf probe ppc64le: Fix probe location when using DWARF (Jiri Olsa) [1414710 1376534]
  - [tools] perf probe: Add function to post process kernel trace events (Jiri Olsa) [1414710 1376534]
  - [tools] perf symbols: Fix kallsyms perf test on ppc64le (Jiri Olsa) [1414710 1376534]
  - [tools] perf powerpc: Fix kprobe and kretprobe handling with kallsyms on ppc64le (Jiri Olsa) [1414710 1376534]
  - [netdrv] bnx2x: Use the correct divisor value for PHC clock readings (Michal Schmidt) [1413996 1175585]
  - [fs] seq_file: reset iterator to first record for zero offset (Miklos Szeredi) [1413681 1386642]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.16.1.el7]
changelog:
  - [tty] n_hdlc: get rid of racy n_hdlc.tbuf ("Herton R. Krzesinski") [1429919 1429920] {CVE-2017-2636}
  - [md] dm rq: cope with DM device destruction while in dm_old_request_fn() (Mike Snitzer) [1430334 1412854]
  - [fs] nfs: Fix inode corruption in nfs_prime_dcache() (Benjamin Coddington) [1429514 1416532]
  - [fs] nfs: Don't let readdirplus revalidate an inode that was marked as stale (Benjamin Coddington) [1429514 1416532]
  - [block] Copy a user iovec if it includes gaps (Jeff Moyer) [1429508 1421263]
  - [kernel] percpu-refcount: fix reference leak during percpu-atomic transition (Jeff Moyer) [1429507 1418333]
  - [powerpc] eeh: eeh_pci_enable(): fix checking of post-request state (Steve Best) [1425538 1383670]
  - [s390] mm: handle PTE-mapped tail pages in fast gup (Hendrik Brueckner) [1423438 1391532]
  - [net] skbuff: Fix skb checksum partial check (Lance Richardson) [1422964 1411480]
  - [net] skbuff: Fix skb checksum flag on skb pull (Lance Richardson) [1422964 1411480]
  - [security] selinux: fix off-by-one in setprocattr (Paul Moore) [1422368 1422369] {CVE-2017-2618}
  - [virtio] balloon: check the number of available pages in leak balloon (David Hildenbrand) [1417194 1401615]
  - [infiniband] ib/rdmavt: Only put mmap_info ref if it exists (Jonathan Toppins) [1417191 1391299]
  - [x86] kvm: x86: make lapic hrtimer pinned (Luiz Capitulino) [1416373 1392593]
  - [kernel] sched/nohz: Fix affine unpinned timers mess (Luiz Capitulino) [1416373 1392593]
  - [kernel] nohz: Affine unpinned timers to housekeepers (Luiz Capitulino) [1416373 1392593]
  - [kernel] tick-sched: add housekeeping_mask cpumask (Luiz Capitulino) [1416373 1392593]
  - [x86] platform/uv/bau: Add UV4-specific functions (Frank Ramsay) [1414715 1386692]
  - [x86] platform/uv/bau: Fix payload queue setup on UV4 hardware (Frank Ramsay) [1414715 1386692]
  - [x86] platform/uv/bau: Disable software timeout on UV4 hardware (Frank Ramsay) [1414715 1386692]
  - [x86] platform/uv/bau: Populate ->uvhub_version with UV4 version information (Frank Ramsay) [1414715 1386692]
  - [x86] platform/uv/bau: Use generic function pointers (Frank Ramsay) [1414715 1386692]
  - [x86] platform/uv/bau: Add generic function pointers (Frank Ramsay) [1414715 1386692]
  - [x86] platform/uv/bau: Convert uv_physnodeaddr() use to uv_gpa_to_offset() (Frank Ramsay) [1414715 1386692]
  - [x86] platform/uv/bau: Clean up pq_init() (Frank Ramsay) [1414715 1386692]
  - [x86] platform/uv/bau: Clean up and update printks (Frank Ramsay) [1414715 1386692]
  - [x86] platform/uv/bau: Clean up vertical alignment (Frank Ramsay) [1414715 1386692]
  - [virtio] virtio-pci: alloc only resources actually used (Laurent Vivier) [1413093 1375153]
  - [net] avoid signed overflows for SO_{SND|RCV}BUFFORCE (Sabrina Dubroca) [1412473 1412474] {CVE-2016-9793}
  - [netdrv] sfc: clear napi_hash state when copying channels (Jarod Wilson) [1401461 1394304]
  - [lib] mpi: Fix NULL ptr dereference in mpi_powm() (Mateusz Guzik) [1398457 1398458] {CVE-2016-8650}
  - [scsi] lpfc: Fix eh_deadline setting for sli3 adapters (Ewan Milne) [1430687 1366564]
  - [md] dm round robin: revert "use percpu 'repeat_count' and 'current_path'" (Mike Snitzer) [1430689 1422567]
  - [md] dm round robin: do not use this_cpu_ptr() without having preemption disabled (Mike Snitzer) [1430689 1422567]
  - Revert: [x86] Handle non enumerated CPU after physical hotplug (Prarit Bhargava) [1426633 1373738]
  - Revert: [x86] smp: Don't try to poke disabled/non-existent APIC (Prarit Bhargava) [1426633 1373738]
  - Revert: [x86] smpboot: Init apic mapping before usage (Prarit Bhargava) [1426633 1373738]
  - Revert: [x86] revert "perf/uncore: Disable uncore on kdump kernel" (Prarit Bhargava) [1426633 1373738]
  - Revert: [x86] perf/x86/intel/uncore: Fix hardcoded socket 0 assumption in the Haswell init code (Prarit Bhargava) [1426633 1373738]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-509.el7]
changelog:
  - [mm] sparse: use memblock apis for early memory allocations (Koki Sanagi) [1375453]
  - [mm] memblock: add memblock memory allocation apis (Koki Sanagi) [1375453]
  - [mm] thp: harden the debug kernel with a strict check for thp_mmu_gather (Andrea Arcangeli) [1369365]
  - [mm] thp: initialize thp_mmu_gather for newly allocated migrated pages (Andrea Arcangeli) [1369365]
  - [mm] thp: put_huge_zero_page() with MMU gather #2 (Andrea Arcangeli) [1369365]
  - [fs] nfs: fix BUG() crash in notify_change() with patch to chown_common() ("J. Bruce Fields") [1342695]
  - [net] ipv6: gro: fix forwarding of tunneled packets (Jiri Benc) [1375438]
  - [net] sctp: hold the transport before using it in sctp_hash_cmp (Xin Long) [1368884]
  - [net] sctp: identify chunks that need to be fragmented at IP level (Xin Long) [1371377]
  - [scsi] be2iscsi: revert: _bh for io_sgl_lock and mgmt_sgl_lock (Maurizio Lombardi) [1374223]
  - [block] blk-mq: Allow timeouts to run while queue is freezing (Gustavo Duarte) [1372483]
  - [block] defer timeouts to a workqueue (Gustavo Duarte) [1372483]
  - [netdrv] tg3: Fix for disallow tx coalescing time to be 0 (Ivan Vecera) [1368885]
  - [netdrv] tg3: Fix for diasllow rx coalescing time to be 0 (Ivan Vecera) [1368885]
  - [infiniband] rdma/ocrdma: Support user AH creation for RoCE-v2 (Don Dutile) [1376120]
  - [infiniband] rdma/ocrdma: Support RoCE-v2 in the RC path (Don Dutile) [1376120]
  - [infiniband] rdma/ocrdma: Support RoCE-v2 in the UD path (Don Dutile) [1376120]
  - [infiniband] rdma/ocrdma: Export udp encapsulation capability (Don Dutile) [1376120]
  - [infiniband] ib/mlx5: Fix wrong naming of port_rcv_data counter (Don Dutile) [1374862]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-510.el7]
changelog:
  - [kernel] audit: fix exe_file access in audit_exe_compare (Richard Guy Briggs) [1374478]
  - [kernel] mm: introduce get_task_exe_file (Richard Guy Briggs) [1374478]
  - [kernel] prctl: avoid using mmap_sem for exe_file serialization (Richard Guy Briggs) [1374478]
  - [kernel] mm: rcu-protected get_mm_exe_file() (Richard Guy Briggs) [1374478]
  - [dm] dm-raid: reverse validation of nosync+rebuild flags (Heinz Mauelshagen) [1371717]
  - [x86] kvm: correctly reset dest_map->vector when restoring LAPIC state (Paolo Bonzini) [1367716]
  - [s390] dasd: fix hanging device after clear subchannel (Gustavo Duarte) [1368068]
  - [netdrv] bna: fix crash in bnad_get_strings() (Ivan Vecera) [1376508]
  - [netdrv] bna: add missing per queue ethtool stat (Ivan Vecera) [1376508]
  - [powerpc] kvm: Implement kvm_arch_intc_initialized() for PPC (David Gibson) [1375778]
  - [powerpc] kvm: book3s: Don't crash if irqfd used with no in-kernel XICS emulation (David Gibson) [1375778]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-511.el7]
changelog:
  - [net] add recursion limit to GRO (Sabrina Dubroca) [1374191] {CVE-2016-7039}
  - [mm] cgroup: fix hugetlb_cgroup_read() (Jerome Marchand) [1378236]
  - [fs] nfs: change invalidatepage prototype to accept length (Benjamin Coddington) [1366131]
  - [fs] xfs: quiesce the filesystem after recovery on readonly mount (Eric Sandeen) [1375457]
  - [fs] xfs: rework buffer dispose list tracking (Brian Foster) [1349175]
  - [fs] ext4: pre-zero allocated blocks for DAX IO (Eric Sandeen) [1367989]
  - [fs] gfs2: Initialize atime of I_NEW inodes (Andreas Grunbacher) [1379447]
  - [fs] gfs2: Update file times after grabbing glock (Andreas Grunbacher) [1379447]
  - [x86] topology: Handle CPUID bogosity gracefully (Vitaly Kuznetsov) [1377988]
  - [netdrv] sfc: check async completer is !NULL before calling (Jarod Wilson) [1368201]
  - [infiniband] ib/mlx5: Fix iteration overrun in GSI qps (Don Dutile) [1376941]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-512.el7]
changelog:
  - [fs] revert "ext4: pre-zero allocated blocks for DAX IO" (Eric Sandeen) [1380571]
  - [fs] nfsd: fix corruption in notifier registration ("J. Bruce Fields") [1378363]
  - [fs] xfs: log recovery tracepoints to track current lsn and buffer submission (Brian Foster) [1362730]
  - [fs] xfs: update metadata LSN in buffers during log recovery (Brian Foster) [1362730]
  - [fs] xfs: don't warn on buffers not being recovered due to LSN (Brian Foster) [1362730]
  - [fs] xfs: pass current lsn to log recovery buffer validation (Brian Foster) [1362730]
  - [fs] xfs: rework log recovery to submit buffers on LSN boundaries (Brian Foster) [1362730]
  - [x86] perf/uncore: Disable uncore on kdump kernel (Jiri Olsa) [1379569]
  - [netdrv] mlx4_core: Fix to clean devlink resources (Kamal Heib) [1379504]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-514.el7]
changelog:
  - [mm] remove gup_flags FOLL_WRITE games from __get_user_pages() (Larry Woodman) [1385124] {CVE-2016-5195}


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.1.1.el7]
changelog:
  - [netdrv] xen-netfront: avoid packet loss when ethernet header crosses page boundary (Vitaly Kuznetsov) [1390257 1348581]
  - [infiniband] ib/iser: Fix max_sectors calculation (Jonathan Toppins) [1389012 1380515]
  - [block] blk-mq: improve warning for running a queue on the wrong CPU (Gustavo Duarte) [1389011 1376948]
  - [block] blk-mq: don't overwrite rq->mq_ctx (Gustavo Duarte) [1389011 1376948]
  - [kernel] pm/sleep: Fix request_firmware() error at resume (Don Zickus) [1389009 1375203]
  - [vfio] vfio-pci: Disable INTx after MSI/X teardown (Alex Williamson) [1389004 1371495]
  - [vfio] vfio-pci: Virtualize PCIe & AF FLR (Alex Williamson) [1389004 1371495]
  - [nvme] Don't suspend admin queue that wasn't created (Gustavo Duarte) [1389001 1370507]
  - [nvme] Suspend all queues before deletion (Gustavo Duarte) [1389001 1370507]
  - [powerpc] kvm: ppc: book3s hv: Take out virtual core piggybacking code (Thomas Huth) [1388997 1350719]
  - [powerpc] kvm: ppc: book3s: Treat VTB as a per-subcore register, not per-thread (Thomas Huth) [1388997 1350719]
  - [powerpc] kvm: ppc: book3s hv: Move struct kvmppc_vcore from kvm_host.h to kvm_book3s.h (Thomas Huth) [1388997 1350719]
  - [scsi] cxgb4i: Increased the value of MAX_IMM_TX_PKT_LEN from 128 to 256 bytes (Sai Vemuri) [1388996 1379954]
  - [scsi] cxgb4i: fix credit check for tx_data_wr (Sai Vemuri) [1388996 1379954]
  - [x86] pci: vmd: Request userspace control of PCIe hotplug indicators (Myron Stowe) [1388881 1380181]
  - [pci] pciehp: Allow exclusive userspace control of indicators (Myron Stowe) [1388881 1380181]
  - [fs] sunrpc: move NO_CRKEY_TIMEOUT to the auth->au_flags (Dave Wysochanski) [1388604 1384666]
  - [x86] fix call location of smp_quirk_init_udelay() (Prarit Bhargava) [1388598 1377296]
  - [x86] hpet: Re-enable HPET on Purley 4S (Prarit Bhargava) [1388597 1372853]
  - [x86] hpet: Reduce HPET counter read contention (Prarit Bhargava) [1388597 1372853]
  - [net] openvswitch: avoid deferred execution of recirc actions (Lance Richardson) [1388592 1370643]
  - [net] ipv4: Use math to point per net sysctls into the appropriate struct net (Eric Garver) [1388591 1363661]
  - [md] dm raid: fix activation of existing raid4/10 devices (Mike Snitzer) [1388504 1385149]
  - [md] dm: free io_barrier after blk_cleanup_queue call (Mike Snitzer) [1388503 1385813]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.2.1.el7]
changelog:
  - [firmware] efi: Fix usage of illegal alignment on efi_low_alloc (Lenny Szubowicz) [1392044 1387689]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.2.2.el7]
changelog:
  - [kernel] timekeeping: Copy the shadow-timekeeper over the real timekeeper last (Prarit Bhargava) [1395577 1344747]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.17.1.el7]
changelog:
  - [netdrv] i40e: Be much more verbose about what we can and cannot offload (Stefan Assmann) [1433273 1383521]
  - [kernel] watchdog: prevent false hardlockup on overloaded system (Don Zickus) [1433267 1399881]
  - [net] dccp/tcp: fix routing redirect race (Eric Garver) [1433265 1387485]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.18.1.el7]
changelog:
  - [net] ipv6: don't increase size when refragmenting forwarded ipv6 skbs (Florian Westphal) [1434589 1430571]
  - [net] bridge: drop netfilter fake rtable unconditionally (Florian Westphal) [1434589 1430571]
  - [net] ipv6: avoid write to a possibly cloned skb (Florian Westphal) [1434589 1430571]
  - [net] netfilter: bridge: honor frag_max_size when refragmenting (Florian Westphal) [1434589 1430571]
  - [net] bridge: Add br_netif_receive_skb remove netif_receive_skb_sk (Ivan Vecera) [1434589 1352289]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.19.1.el7]
changelog:
  - [fs] gfs2: Wake up io waiters whenever a flush is done (Robert S Peterson) [1437126 1404301]
  - [fs] gfs2: Made logd daemon take into account log demand (Robert S Peterson) [1437126 1404301]
  - [fs] gfs2: Limit number of transaction blocks requested for truncates (Robert S Peterson) [1437126 1404301]
  - [net] ipv6: addrconf: fix dev refcont leak when DAD failed (Hangbin Liu) [1436588 1416105]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.20.1.el7]
changelog:
  - [powerpc] fadump: Fix the race in crash_fadump() (Steve Best) [1439810 1420077]
  - [kernel] locking/mutex: Explicitly mark task as running after wakeup (Gustavo Duarte) [1439803 1423397]
  - [netdrv] ixgbe: Force VLNCTRL.VFE to be set in all VMDq paths (Ken Cox) [1438421 1383524]
  - [fs] nfsv4.0: always send mode in SETATTR after EXCLUSIVE4 (Benjamin Coddington) [1437967 1415780]
  - [net] fix creation adjacent device symlinks (Adrian Reber) [1436646 1412898]
  - [net] prevent of emerging cross-namespace symlinks (Adrian Reber) [1436646 1412898]
  - [netdrv] macvlan: unregister net device when netdev_upper_dev_link() fails (Adrian Reber) [1436646 1412898]
  - [scsi] vmw_pvscsi: return SUCCESS for successful command aborts (Ewan Milne) [1435764 1394172]
  - [infiniband] ib/uverbs: Fix race between uverbs_close and remove_one (Don Dutile) [1435187 1417284]
  - [fs] gfs2: Prevent BUG from occurring when normal Withdraws occur (Robert S Peterson) [1433882 1404005]
  - [fs] jbd2: fix incorrect unlock on j_list_lock (Lukas Czerner) [1433881 1403346]
  - [fs] xfs: don't wrap ID in xfs_dq_get_next_id (Eric Sandeen) [1433415 1418182]
  - [net] tcp/dccp: avoid starving bh on connect (Paolo Abeni) [1433320 1401419]
  - [fs] xfs: fix up xfs_swap_extent_forks inline extent handling (Eric Sandeen) [1432154 1412945]
  - [x86] kvm: vmx: handle PML full VMEXIT that occurs during event delivery (Radim Krcmar) [1431666 1421296]
  - [virt] kvm: vmx: ensure VMCS is current while enabling PML (Radim Krcmar) [1431666 1421296]
  - [net] ip_tunnel: Create percpu gro_cell (Jiri Benc) [1431197 1424076]
  - [x86] kvm: x86: do not save guest-unsupported XSAVE state (Radim Krcmar) [1431150 1401767]
  - [scsi] mpt3sas: Force request partial completion alignment (Tomas Henzl) [1430809 1418286]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.21.1.el7]
changelog:
  - [kernel] sched/core: Fix an SMP ordering race in try_to_wake_up() vs. schedule() (Gustavo Duarte) [1441547 1423400]
  - [drivers] Set dev->device_rh to NULL after free (Prarit Bhargava) [1441544 1414064]
  - [security] keys: request_key() should reget expired keys rather than give EKEYEXPIRED (David Howells) [1441287 1408330]
  - [security] keys: Simplify KEYRING_SEARCH_{NO, DO}_STATE_CHECK flags (David Howells) [1441287 1408330]
  - [net] packet: fix overflow in check for tp_reserve (Hangbin Liu) [1441171 1441172] {CVE-2017-7308}
  - [net] packet: fix overflow in check for tp_frame_nr (Hangbin Liu) [1441171 1441172] {CVE-2017-7308}
  - [net] packet: fix overflow in check for priv area size (Hangbin Liu) [1441171 1441172] {CVE-2017-7308}
  - [powerpc] pseries: Use H_CLEAR_HPT to clear MMU hash table during kexec (Steve Best) [1439812 1423396]
  - [netdrv] fjes: Fix wrong netdevice feature flags (Yasuaki Ishimatsu) [1439802 1435603]
  - [kernel] mlx5e: Implement Fragmented Work Queue (WQ) (Don Dutile) [1439164 1368400]
  - [netdrv] mlx5e: Copy all L2 headers into inline segment (Don Dutile) [1439161 1383013]
  - [nvdimm] fix PHYS_PFN/PFN_PHYS mixup (Jeff Moyer) [1439160 1428115]
  - [s390] scsi: zfcp: fix rport unblock race with LUN recovery (Hendrik Brueckner) [1433413 1421750]
  - [fs] gfs2: Avoid alignment hole in struct lm_lockname (Robert S Peterson) [1432554 1425450]
  - [fs] gfs2: Add missing rcu locking for glock lookup (Robert S Peterson) [1432554 1425450]
  - [fs] ext4: fix fencepost in s_first_meta_bg validation (Lukas Czerner) [1430969 1332503] {CVE-2016-10208}
  - [fs] ext4: sanity check the block and cluster size at mount time (Lukas Czerner) [1430969 1332503] {CVE-2016-10208}
  - [fs] ext4: validate s_first_meta_bg at mount time (Lukas Czerner) [1430969 1332503] {CVE-2016-10208}
  - [net] sctp: deny peeloff operation on asocs with threads sleeping on it (Hangbin Liu) [1429496 1429497] {CVE-2017-5986 CVE-2017-6353}
  - [net] sctp: avoid BUG_ON on sctp_wait_for_sndbuf (Hangbin Liu) [1429496 1429497] {CVE-2017-5986 CVE-2017-6353}
  - [x86] perf/x86/intel/rapl: Make package handling more robust (Jiri Olsa) [1443902 1418688]
  - [x86] perf/x86/intel/rapl: Convert to hotplug state machine (Jiri Olsa) [1443902 1418688]
  - [x86] perf/x86: Set pmu->module in Intel PMU modules (Jiri Olsa) [1443902 1418688]
  - [kernel] sched/core, x86/topology: Fix NUMA in package topology bug (Jiri Olsa) [1441645 1369832]
  - [kernel] sched: Allow hotplug notifiers to be setup early (Jiri Olsa) [1441645 1369832]
  - [x86] x86/smpboot: Make logical package management more robust (Prarit Bhargava) [1441643 1414054]
  - [x86] x86/cpu: Deal with broken firmware (VMWare/XEN) (Prarit Bhargava) [1441643 1414054]
  - [x86] perf/x86/intel/uncore: Fix hardcoded socket 0 assumption in the Haswell init code (Prarit Bhargava) [1426633 1373738]
  - [x86] revert "perf/uncore: Disable uncore on kdump kernel" (Prarit Bhargava) [1426633 1373738]
  - [x86] smpboot: Init apic mapping before usage (Prarit Bhargava) [1426633 1373738]
  - [x86] smp: Don't try to poke disabled/non-existent APIC (Prarit Bhargava) [1426633 1373738]
  - [x86] Handle non enumerated CPU after physical hotplug (Prarit Bhargava) [1426633 1373738]
  - [block] fix use-after-free in seq file (Denys Vlasenko) [1418550 1418551] {CVE-2016-7910}
  - [crypto] algif_hash - Only export and import on sockets with data (Herbert Xu) [1394101 1387632] {CVE-2016-8646}
  - [char] hwrng: core - sleep interruptible in read (Amit Shah) [1443503 1376397]
  - [char] hwrng: core - correct error check of kthread_run call (Amit Shah) [1443503 1376397]
  - [char] hwrng: core - Move hwrng_init call into set_current_rng (Amit Shah) [1443503 1376397]
  - [char] hwrng: core - Drop current rng in set_current_rng (Amit Shah) [1443503 1376397]
  - [char] hwrng: core - Do not register device opportunistically (Amit Shah) [1443503 1376397]
  - [char] hwrng: core - Fix current_rng init/cleanup race yet again (Amit Shah) [1443503 1376397]
  - [char] hwrng: core - Use struct completion for cleanup_done (Amit Shah) [1443503 1376397]
  - [char] hwrng: don't init list element we're about to add to list (Amit Shah) [1443503 1376397]
  - [char] hwrng: don't double-check old_rng (Amit Shah) [1443503 1376397]
  - [char] hwrng: fix unregister race (Amit Shah) [1443503 1376397]
  - [char] hwrng: use reference counts on each struct hwrng (Amit Shah) [1443503 1376397]
  - [char] hwrng: move some code out mutex_lock for avoiding underlying deadlock (Amit Shah) [1443503 1376397]
  - [char] hwrng: place mutex around read functions and buffers (Amit Shah) [1443503 1376397]
  - [char] virtio-rng: skip reading when we start to remove the device (Amit Shah) [1443503 1376397]
  - [char] virtio-rng: fix stuck of hot-unplugging busy device (Amit Shah) [1443503 1376397]
  - [infiniband] ib/mlx5: Resolve soft lock on massive reg MRs (Don Dutile) [1444347 1417285]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.23.1.el7]
changelog:
  - [scsi] qla2xxx: Defer marking device lost when receiving an RSCN (Himanshu Madhani) [1446246 1436940]
  - [scsi] qla2xxx: Fix typo in driver (Himanshu Madhani) [1446246 1436940]
  - [scsi] qla2xxx: Fix crash in qla2xxx_eh_abort on bad ptr (Himanshu Madhani) [1446246 1436940]
  - [scsi] qla2xxx: Avoid that issuing a LIP triggers a kernel crash (Himanshu Madhani) [1446246 1436940]
  - [scsi] qla2xxx: Add fix to read correct register value for ISP82xx (Himanshu Madhani) [1446246 1436940]
  - [scsi] qla2xxx: Disable the adapter and skip error recovery in case of register disconnect (Himanshu Madhani) [1446246 1436940]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.24.1.el7]
changelog:
  - [scsi] lpfc: Fix panic on BFS configuration (Maurizio Lombardi) [1452044 1443116]
  - [vfio] type1: Reduce repetitive calls in vfio_pin_pages_remote() (Alex Williamson) [1450855 1438403]
  - [vfio] type1: Remove locked page accounting workqueue (Alex Williamson) [1450855 1438403]
  - [fs] nfs: Allow getattr to also report readdirplus cache hits (Dave Wysochanski) [1450851 1442068]
  - [fs] nfs: Be more targeted about readdirplus use when doing lookup/revalidation (Dave Wysochanski) [1450851 1442068]
  - [fs] nfs: Fix a performance regression in readdir (Dave Wysochanski) [1450851 1442068]
  - [x86] xen: do not re-use pirq number cached in pci device msi msg data (Vitaly Kuznetsov) [1450037 1433831]
  - [powerpc] mm: Add missing global TLB invalidate if cxl is active (Steve Best) [1449178 1440776]
  - [powerpc] boot: Fix zImage TOC alignment (Gustavo Duarte) [1444343 1395838]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.25.1.el7]
changelog:
  - [lib] kobject: grab an extra reference on kobject->sd to allow duplicate deletes (Aristeu Rozanski) [1454851 1427252]
  - [kernel] module: When modifying a module's text ignore modules which are going away too (Aaron Tomlin) [1454684 1386313]
  - [kernel] module: Ensure a module's state is set accordingly during module coming cleanup code (Aaron Tomlin) [1454684 1386313]
  - [net] vxlan: do not output confusing error message (Jiri Benc) [1454636 1445054]
  - [net] vxlan: correctly handle ipv6.disable module parameter (Jiri Benc) [1454636 1445054]
  - [iommu] vt-d: fix range computation when making room for large pages (Alex Williamson) [1450856 1435612]
  - [fs] nfsd: stricter decoding of write-like NFSv2/v3 ops ("J. Bruce Fields") [1449282 1443204] {CVE-2017-7895}
  - [fs] nfsd4: minor NFSv2/v3 write decoding cleanup ("J. Bruce Fields") [1449282 1443204] {CVE-2017-7895}
  - [md] dm mirror: use all available legs on multiple failures (Mike Snitzer) [1449176 1383444]
  - [fs] nfsd: check for oversized NFSv2/v3 arguments ("J. Bruce Fields") [1447642 1442407] {CVE-2017-7645}
  - [scsi] ses: don't get power status of SES device slot on probe (Gustavo Duarte) [1446650 1434768]
  - [scsi] ipr: do not set DID_PASSTHROUGH on CHECK CONDITION (Steve Best) [1446649 1441747]
  - [net] macsec: dynamically allocate space for sglist (Sabrina Dubroca) [1445546 1445545] {CVE-2017-7477}
  - [net] macsec: avoid heap overflow in skb_to_sgvec (Sabrina Dubroca) [1445546 1445545] {CVE-2017-7477}
  - [fs] gfs2: Allow glocks to be unlocked after withdraw (Robert S Peterson) [1433882 1404005]
  - [net] tcp: avoid infinite loop in tcp_splice_read() (Davide Caratti) [1430579 1430580] {CVE-2017-6214}
  - [mm] vma_merge: correct false positive from __vma_unlink->validate_mm_rb (Andrea Arcangeli) [1428840 1374548]
  - [mm] vma_merge: fix race vm_page_prot race condition against rmap_walk (Andrea Arcangeli) [1428840 1374548]
  - [mm] fix use-after-free if memory allocation failed in vma_adjust() (Andrea Arcangeli) [1428840 1374548]
  - [x86] kvm: x86: fix emulation of "MOV SS, null selector" (Radim Krcmar) [1414742 1414743] {CVE-2017-2583}
  - [powerpc] prom: Increase minimum RMA size to 512MB (Gustavo Duarte) [1450041 1411321]
  - [pci] pciehp: Prioritize data-link event over presence detect (Myron Stowe) [1450124 1435818]
  - [pci] pciehp: Don't re-read Slot Status when queuing hotplug event (Myron Stowe) [1450124 1435818]
  - [pci] pciehp: Process all hotplug events before looking for new ones (Myron Stowe) [1450124 1435818]
  - [pci] pciehp: Rename pcie_isr() locals for clarity (Myron Stowe) [1450124 1435818]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.26.1.el7]
changelog:
  - [mm] enlarge stack guard gap (Larry Woodman) [1452732 1452733] {CVE-2017-1000364}
  - Revert: [md] dm mirror: use all available legs on multiple failures (Mike Snitzer) [1449176 1383444]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.26.2.el7]
changelog:
  - [mm] fix new crash in unmapped_area_topdown() (Frantisek Hrbata) [1466138 1463241]
  - [mm] larger stack guard gap, between vmas (Frantisek Hrbata) [1466138 1463241]
  - [mm] Revert "enlarge stack guard gap" (Frantisek Hrbata) [1466138 1463241]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.28.1.el7]
changelog:
  - [security] keys: Protect request_key() against a type with no match function (David Howells) [1433217 1433216] {CVE-2017-2647}
  - [fs] nfsd: encoders mustn't use unitialized values in error cases ("J. Bruce Fields") [1466903 1460365]
  - [md] raid1: ignore discard error (Nigel Croxon) [1463359 1435822]
  - [kernel] block: add REQ_OP definitions and helpers (David Milburn) [1463359 1366753]
  - [md] raid1: small cleanup in raid1_end_read/write_request (Jes Sorensen) [1463359 1380016]
  - [x86] platform/uv: Fix calculation of Global Physical Address (Frank Ramsay) [1458347 1434837]
  - [x86] platform/uv: Clean up the NMI code to match current coding style (Frank Ramsay) [1462093 1416460]
  - [x86] platform/uv: Ensure uv_system_init is called when necessary (Frank Ramsay) [1462093 1416460]
  - [x86] platform/uv: Initialize PCH GPP_D_0 NMI Pin to be NMI source (Frank Ramsay) [1462093 1416460]
  - [x86] platform/uv: Verify NMI action is valid, default is standard (Frank Ramsay) [1462093 1416460]
  - [x86] platform/uv: Add basic CPU NMI health check (Frank Ramsay) [1462093 1416460]
  - [x86] platform/uv: Add Support for UV4 Hubless NMIs (Frank Ramsay) [1462093 1416460]
  - [x86] platform/uv: Add Support for UV4 Hubless systems (Frank Ramsay) [1462093 1416460]
  - [x86] platform/uv: Fix 2 socket config problem (Frank Ramsay) [1462093 1416460]
  - [x86] platform/uv: Fix panic with missing UVsystab support (Frank Ramsay) [1462093 1416460]
  - [scsi] ses: Fix SAS device detection in enclosure (Maurizio Lombardi) [1460204 1394089]
  - [scsi] ipr: Driver version 2.6.4 (Gustavo Duarte) [1459658 1406512]
  - [scsi] ipr: Fix SATA EH hang (Gustavo Duarte) [1459658 1406512]
  - [scsi] ipr: Error path locking fixes (Gustavo Duarte) [1459658 1406512]
  - [scsi] ipr: Fix abort path race condition (Gustavo Duarte) [1459658 1406512]
  - [scsi] ipr: Remove redundant initialization (Gustavo Duarte) [1459658 1406512]
  - [scsi] ipr: Fix missed EH wakeup (Gustavo Duarte) [1459658 1406512]
  - [netdrv] mlx5: Increase number of max QPs in default profile (Kamal Heib) [1459655 1436238]
  - [x86] platform/uv/bau: Fix HUB errors by remove initial write to sw-ack register (Frank Ramsay) [1458779 1422564]
  - [x86] platform/uv/bau: Implement uv4_wait_completion with read_status (Frank Ramsay) [1458779 1422564]
  - [x86] platform/uv/bau: Add wait_completion to bau_operations (Frank Ramsay) [1458779 1422564]
  - [x86] platform/uv/bau: Add status mmr location fields to bau_control (Frank Ramsay) [1458779 1422564]
  - [x86] platform/uv/bau: Cleanup bau_operations declaration and instances (Frank Ramsay) [1458779 1422564]
  - [x86] platform/uv/bau: Add payload descriptor qualifier (Frank Ramsay) [1458779 1422564]
  - [x86] platform/uv/bau: Add uv_bau_version enumerated constants (Frank Ramsay) [1458779 1422564]
  - [kernel] workqueue: schedule WORK_CPU_UNBOUND work on wq_unbound_cpumask CPUs (Waiman Long) [1458203 1452675]
  - [kernel] workqueue: handle NUMA_NO_NODE for unbound pool_workqueue (Waiman Long) [1458203 1452675]
  - [pci] Support INTx masking on ConnectX-4 with firmware x.14.1100+ (Myron Stowe) [1447718 1437132]
  - [pci] Convert Mellanox broken INTx quirks to be for listed devices only (Myron Stowe) [1447718 1437132]
  - [pci] Convert broken INTx masking quirks from HEADER to FINAL (Myron Stowe) [1447718 1437132]
  - [kernel] pci: Add Mellanox device IDs (Don Dutile) [1447718 1417286]
  - [net] l2tp: hold tunnel socket when handling control frames in l2tp_ip and l2tp_ip6 (Florian Westphal) [1441553 1441554] {CVE-2016-10200}
  - [net] l2tp: fix address test in __l2tp_ip6_bind_lookup() (Florian Westphal) [1441553 1441554] {CVE-2016-10200}
  - [net] l2tp: fix lookup for sockets not bound to a device in l2tp_ip (Florian Westphal) [1441553 1441554] {CVE-2016-10200}
  - [net] l2tp: fix racy socket lookup in l2tp_ip and l2tp_ip6 bind() (Florian Westphal) [1441553 1441554] {CVE-2016-10200}
  - [net] l2tp: hold socket before dropping lock in l2tp_ip{, 6}_recv() (Florian Westphal) [1441553 1441554] {CVE-2016-10200}
  - [net] ipv6: lock socket in ip6_datagram_connect() (Florian Westphal) [1441553 1441554]
  - [net] l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{, 6}_bind() (Florian Westphal) [1441553 1441554] {CVE-2016-10200}
  - [kernel] sched/fair: Fix nohz.next_balance update (Lauro Ramos Venancio) [1434853 1420450]
  - [kernel] sched: Improve load balancing in the presence of idle CPUs (Lauro Ramos Venancio) [1434853 1420450]
  - [kernel] sched/fair: Fix stale overloaded status in the busiest group finding logic (Lauro Ramos Venancio) [1434853 1420450]
  - [kernel] sched: Improve sysbench performance by fixing spurious active migration (Lauro Ramos Venancio) [1434853 1420450]
  - [kernel] sched: Assign correct scheduling domain to 'sd_llc' (Lauro Ramos Venancio) [1434853 1420450]
  - [kernel] sched: Avoid NULL dereference on sd_busy (Lauro Ramos Venancio) [1434853 1420450]
  - [kernel] sched: Remove unnecessary iteration over sched domains to update nr_busy_cpus (Lauro Ramos Venancio) [1434853 1420450]
  - [kernel] sched: Pass 'struct rq' to rebalance_domains() (Lauro Ramos Venancio) [1434853 1420450]
  - [kernel] sched: Pass 'struct rq' to nohz_idle_balance() (Lauro Ramos Venancio) [1434853 1420450]
  - [kernel] sched: Use this_rq() helper (Lauro Ramos Venancio) [1434853 1420450]
  - [crypto] algif_skcipher - Add key check exception for cipher_null ("Bruno E. O. Meneguele") [1393299 1386234] {CVE-2015-8970}
  - [crypto] algif_hash - Require setkey before accept(2) ("Bruno E. O. Meneguele") [1393299 1386234] {CVE-2015-8970}
  - [crypto] hash - Add crypto_ahash_has_setkey ("Bruno E. O. Meneguele") [1393299 1386234] {CVE-2015-8970}
  - [crypto] algif_skcipher - Add nokey compatibility path ("Bruno E. O. Meneguele") [1393299 1386234] {CVE-2015-8970}
  - [crypto] af_alg - Add nokey compatibility path ("Bruno E. O. Meneguele") [1393299 1386234] {CVE-2015-8970}
  - [crypto] af_alg - Fix socket double-free when accept fails ("Bruno E. O. Meneguele") [1393299 1386234] {CVE-2015-8970}
  - [crypto] af_alg - Disallow bind/setkey/... after accept(2) ("Bruno E. O. Meneguele") [1393299 1386234] {CVE-2015-8970}
  - [crypto] algif_skcipher - Require setkey before accept(2) ("Bruno E. O. Meneguele") [1393299 1386234] {CVE-2015-8970}
  - [powerpc] do not make the entire heap executable (Frantisek Hrbata) [1330063 1330064]
  - [mm] fix new crash in unmapped_area_topdown() (Frantisek Hrbata) [1466138 1463241]
  - [mm] larger stack guard gap, between vmas (Frantisek Hrbata) [1466138 1463241]
  - [mm] Revert "enlarge stack guard gap" (Frantisek Hrbata) [1466138 1463241]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.28.2.el7]
changelog:
  - [net] l2cap: prevent stack overflow on incoming bluetooth packet (Neil Horman) [1489930 1489789] {CVE-2017-1000251}


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.29.1.el7]
changelog:
  - [net] geneve: fix hlist corruption (Jiri Benc) [1474263 1464292]
  - [net] vxlan: fix hlist corruption (Jiri Benc) [1474263 1464292]
  - [net] vxlan: fix use-after-free on deletion (Jiri Benc) [1474263 1464292]
  - [kernel] sched: Transform resched_task() into resched_curr() (Waiman Long) [1473742 1418778]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.30.1.el7]
changelog:
  - [block] fix bio_will_gap() for first bvec with offset (Ming Lei) [1472675 1443807]
  - [block] relax check on sg gap (Cathy Avery) [1472674 1413656]
  - [block] check virt boundary in bio_will_gap() (Cathy Avery) [1472674 1413656]
  - [block] Check for gaps on front and back merges (Cathy Avery) [1472674 1413656]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.32.1.el7]
changelog:
  - [fs] dentry name snapshots (Miklos Szeredi) [1471132 1470403] {CVE-2017-7533}
  - [char] ipmi: use rcu lock around call to intf->handlers->sender() (Tony Camuso) [1479760 1419765]
  - [fs] xfs: use ->b_state to fix buffer I/O accounting release race (Brian Foster) [1478253 1452228]
  - [x86] crypto: sha1-ssse3 - Disable avx2 (Benjamin Coddington) [1446230 1346106]
  - [fs] sunrpc: don't pass on-stack memory to sg_set_buf (Benjamin Coddington) [1446230 1346106]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.32.3.el7]
changelog:
  - [fs] binfmt_elf.c:load_elf_binary(): return -EINVAL on zero-length mappings (Bhupesh Sharma) [1492958 1415893] {CVE-2017-1000253}
  - [fs] binfmt_elf.c: fix bug in loading of PIE binaries (Bhupesh Sharma) [1492958 1415893] {CVE-2017-1000253}


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.33.1.el7]
changelog:
  - [fs] nfsv4: Add missing nfs_put_lock_context() (Benjamin Coddington) [1487270 1476826]
  - [fs] nfs: discard nfs_lockowner structure (Benjamin Coddington) [1487270 1476826]
  - [fs] nfsv4: enhance nfs4_copy_lock_stateid to use a flock stateid if there is one (Benjamin Coddington) [1487270 1476826]
  - [fs] nfsv4: change nfs4_select_rw_stateid to take a lock_context inplace of lock_owner (Benjamin Coddington) [1487270 1476826]
  - [fs] nfsv4: change nfs4_do_setattr to take an open_context instead of a nfs4_state (Benjamin Coddington) [1487270 1476826]
  - [fs] nfsv4: add flock_owner to open context (Benjamin Coddington) [1487270 1476826]
  - [fs] nfs: remove l_pid field from nfs_lockowner (Benjamin Coddington) [1487270 1476826]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.35.1.el7]
changelog:
  - [fs] nfs: Don't disconnect open-owner on NFS4ERR_BAD_SEQID (Steve Dickson) [1490863 1431755]
  - [fs] sunrpc: Handle EADDRNOTAVAIL on connection failures (Dave Wysochanski) [1484268 1479043]
  - [fs] include/linux/printk.h: include pr_fmt in pr_debug_ratelimited (Sachin Prabhu) [1484266 1472823]
  - [fs] printk: pr_debug_ratelimited: check state first to reduce "callbacks suppressed" messages (Sachin Prabhu) [1484266 1472823]
  - [fs] proc: revert /proc/<pid>/maps [stack:TID] annotation (Waiman Long) [1481723 1448534]
  - [netdrv] bonding: Restore old symlink names in sysfs to preserve ABI (Neil Horman) [1471679 1461892]
  - [fs] binfmt_elf.c:load_elf_binary(): return -EINVAL on zero-length mappings (Bhupesh Sharma) [1492958 1415893] {CVE-2017-1000253}
  - [fs] binfmt_elf.c: fix bug in loading of PIE binaries (Bhupesh Sharma) [1492958 1415893] {CVE-2017-1000253}
  - [net] l2cap: prevent stack overflow on incoming bluetooth packet (Neil Horman) [1489930 1489789] {CVE-2017-1000251}


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.36.1.el7]
changelog:
  - [net] team: call netdev_change_features out of team lock (Xin Long) [1511797 1429679]
  - [s390] s390/3270: fix allocation of tty3270_screen structure (Daniel Vacek) [1508354 1495587]
  - [s390] s390/3270: fix use after free of tty3270_screen structure (Daniel Vacek) [1508354 1495587]
  - [s390] s390/3270: fix return value check in tty3270_resize_work() (Daniel Vacek) [1508354 1495587]
  - [mm] mm, hugetlb: use pte_present() instead of pmd_present() in follow_huge_pmd() (Rafael Aquini) [1505162 1472460]
  - [mm] fix invalid node in alloc_migrate_target() (Rafael Aquini) [1505162 1472460]
  - [mm] add !pte_present() check on existing hugetlb_entry callbacks (Rafael Aquini) [1505162 1472460]
  - [nvme] Test unit Ready broken for nvme drvices (David Milburn) [1502732 1478457]
  - [hv] vmbus: Increase the time between retries in vmbus_post_msg() (Mohammed Gamal) [1495759 1491843]
  - [hv] vmbus: Fix error code returned by vmbus_post_msg() (Mohammed Gamal) [1495759 1467258]
  - [hv] vmbus: Raise retry/wait limits in vmbus_post_msg() (Vitaly Kuznetsov) [1495755 1452009]
  - [hv] vmbus: Reduce the delay between retries in vmbus_post_msg() (Vitaly Kuznetsov) [1495755 1418889]
  - [netdrv] hv: vmbus: define a new VMBus message type for hvsock (Vitaly Kuznetsov) [1495755 1395600]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.36.2.el7]
changelog:
  - [x86] spec_ctrl: allow use_ibp_disable only if both SPEC_CTRL and IBPB_SUPPORT are missing (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: Documentation spec_ctrl.txt (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: remove irqs_disabled() check from intel_idle() (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: use enum when setting ibrs/ibpb_enabled (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: undo speculation barrier for ibrs_enabled and noibrs_cmdline (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: introduce ibpb_enabled = 2 for IBPB instead of IBRS (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: introduce SPEC_CTRL_PCP_ONLY_IBPB (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: cleanup s/flush/sync/ naming when sending IPIs (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: set IBRS during CPU init if in ibrs_enabled == 2 (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: use IBRS_ENABLED instead of 1 (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: allow the IBP disable feature to be toggled at runtime (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: always initialize save_reg in ENABLE_IBRS_SAVE_AND_CLOBBER (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: ibrs_enabled() is expected to return > 1 (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: issue a __spec_ctrl_ibpb if a credential check isn't possible (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] ibpb: don't optimize spec_cntrl_ibpb on PREEMPT_RCU (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: clear registers after 32bit syscall stackframe is setup (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: reload spec_ctrl cpuid in all microcode load paths (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] kaiser/mm: fix pgd freeing in error path (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: disable global pages by default with KAISER (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] revert "mm/kaiser: Disable global pages by default with KAISER" (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] spec_ctrl: Prevent unwanted speculation without IBRS (Josh Poimboeuf) [1526975 1526965 1519798 1519801] {CVE-2017-5715 CVE-2017-5754}
  - [x86] entry: Remove trampoline check from paranoid entry path (Josh Poimboeuf) [1526975 1526965 1519798 1519801] {CVE-2017-5715 CVE-2017-5754}
  - [x86] entry: Fix paranoid_exit() trampoline clobber (Josh Poimboeuf) [1526975 1526965 1519798 1519801] {CVE-2017-5715 CVE-2017-5754}
  - [x86] entry: Simplify trampoline stack restore code (Josh Poimboeuf) [1526975 1526965 1519798 1519801] {CVE-2017-5715 CVE-2017-5754}
  - [x86] dumpstack: Remove raw stack dump (Josh Poimboeuf) [1526975 1479560] {CVE-2017-5715}
  - [x86] spec_ctrl: remove SPEC_CTRL_DEBUG code (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: add noibrs noibpb boot options (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] entry: Use retpoline for syscall's indirect calls (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] syscall: Clear unused extra registers on 32-bit compatible syscall entrance (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: cleanup unnecessary ptregscall_common function (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: CLEAR_EXTRA_REGS and extra regs save/restore (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] syscall: Clear unused extra registers on syscall entrance (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: rescan cpuid after a late microcode update (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: add debugfs ibrs_enabled ibpb_enabled (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: consolidate the spec control boot detection (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] kvm/spec_ctrl: allow IBRS to stay enabled in host userland (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: add debug aid to test the entry code without microcode (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: move stuff_RSB in spec_ctrl.h (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] entry: Stuff RSB for entry to kernel for non-SMEP platform (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] mm: Only set IBPB when the new thread cannot ptrace current thread (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] mm: Set IBPB upon context switch (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] idle: Disable IBRS when offlining cpu and re-enable on wakeup (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] idle: Disable IBRS entering idle and enable it on wakeup (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: implement spec ctrl C methods (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: save IBRS MSR value in save_paranoid for NMI (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] enter: Use IBRS on syscall and interrupts (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: swap rdx with rsi for nmi nesting detection (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: spec_ctrl_pcp and kaiser_enabled_pcp in same cachline (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: use per-cpu knob instead of ALTERNATIVES for ibpb and ibrs (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] enter: MACROS to set/clear IBRS and set IBPB (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [kvm] x86: add SPEC_CTRL to MSR and CPUID lists (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] cpuid: Provide get_scattered_cpuid_leaf() (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] cpuid: Cleanup cpuid_regs definitions (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [kvm] svm: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] svm: Set IBPB when running a different VCPU (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [kvm] vmx: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [kvm] vmx: Set IBPB when running a different VCPU (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [kvm] x86: clear registers on VM exit (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] kvm: Pad RSB on VM transition (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] cpu/AMD: Control indirect branch predictor when SPEC_CTRL not available (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] feature: Report presence of IBPB and IBRS control (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] feature: Enable the x86 feature to control Speculation (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [tools] objtool: Don't print 'call dest' warnings for ignored functions (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [misc] locking/barriers: prevent speculative execution based on Coverity scan results (Josh Poimboeuf) [1526961 1519786] {CVE-2017-5753}
  - [fs] udf: prevent speculative execution (Josh Poimboeuf) [1526961 1519786] {CVE-2017-5753}
  - [fs] prevent speculative execution (Josh Poimboeuf) [1526961 1519786] {CVE-2017-5753}
  - [kernel] userns: prevent speculative execution (Josh Poimboeuf) [1526961 1519786] {CVE-2017-5753}
  - [scsi] qla2xxx: prevent speculative execution (Josh Poimboeuf) [1526961 1519786] {CVE-2017-5753}
  - [netdrv] p54: prevent speculative execution (Josh Poimboeuf) [1526961 1519786] {CVE-2017-5753}
  - [netdrv] carl9170: prevent speculative execution (Josh Poimboeuf) [1526961 1519786] {CVE-2017-5753}
  - [media] uvcvideo: prevent speculative execution (Josh Poimboeuf) [1526961 1519786] {CVE-2017-5753}
  - [x86] cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature (Josh Poimboeuf) [1526961 1519786] {CVE-2017-5753}
  - [x86] cpu/AMD: Make the LFENCE instruction serialized (Josh Poimboeuf) [1526961 1519786] {CVE-2017-5753}
  - [kernel] locking/barriers: introduce new memory barrier gmb() (Josh Poimboeuf) [1526961 1519786] {CVE-2017-5753}
  - [x86] mm/kaiser: Replace kaiser with kpti to sync with upstream (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add "kaiser" and "nokaiser" boot options (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map the trace idt tables in userland shadow pgd (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: fix RESTORE_CR3 crash in kaiser_stop_machine (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use stop_machine for enable/disable knob (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use atomic ops to poison/unpoison user pagetables (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use invpcid to flush the two kaiser PCID AISD (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use two PCID ASIDs optimize the TLB during enter/exit kernel (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: stop patching flush_tlb_single (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use PCID feature to make user and kernel switches faster (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm: If INVPCID is available, use it to flush global mappings (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/64: Fix reboot interaction with CR4.PCIDE (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/64: Initialize CR4.PCIDE early (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm: Add a 'noinvpcid' boot option to turn off INVPCID (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm: Add the 'nopcid' boot option to turn off PCID (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: validate trampoline stack (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] entry: Move SYSENTER_stack to the beginning of struct tss_struct (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: isolate the user mapped per cpu areas (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: enable kaiser in build (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: selective boot time defaults (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: handle call to xen_pv_domain() on PREEMPT_RT (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser/xen: Dynamically disable KAISER when running under Xen PV (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add Kconfig (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: avoid false positives during non-kaiser pgd updates (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: Respect disabled CPU features (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: trampoline stack comments (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: stack trampoline (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: remove paravirt clock warning (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [kvm] kvmclock: export kvmclock clocksource pointer (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: re-enable vsyscalls (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: allow to build KAISER with KASRL (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: allow KAISER to be enabled/disabled at runtime (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: un-poison PGDs at runtime (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add a function to check for KAISER being enabled (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add debugfs file to turn KAISER on/off at runtime (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: disable native VSYSCALL (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map virtually-addressed performance monitoring buffers (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map debug IDT tables (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add kprobes text section (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map trace interrupt entry (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map entry stack per-cpu areas (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map dynamically-allocated LDTs (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: make sure static PGDs are 8k in size (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: allow NX poison to be set in p4d/pgd (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: unmap kernel from userspace page tables (core patch) (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: mark per-cpu data structures required for entry/exit (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: introduce user-mapped per-cpu areas (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add cr3 switches to entry code (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: remove scratch registers (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: prepare assembly for entry/exit CR3 switching (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: Disable global pages by default with KAISER (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm: Document X86_CR4_PGE toggling behavior (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/tlb: Make CR4-based TLB flushes more robust (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm: Do not set _PAGE_USER for init_mm page tables (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] increase robusteness of bad_iret fixup handler (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [perf] x86: intel/uncore: Fix memory leaks on allocation failures (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [mm] fix bad rss-counter if remap_file_pages raced migration (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.36.3.el7]
changelog:
  - [x86] kaiser/mm: convert userland visible "kpti" name to "pti" (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] revert "entry: Use retpoline for syscall's indirect calls" (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: set IBRS during resume from RAM if ibrs_enabled is 2 (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] kaiser/mm: __load_cr3 in resume from RAM after kernel gs has been restored (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.36.4.el7]
changelog:
  - [x86] kaiser/mm: skip IBRS/CR3 restore when paranoid exception returns to userland (Andrea Arcangeli) [1526975 1519798] {CVE-2017-5715}
  - [x86] kaiser/mm: consider the init_mm.pgd a kaiser pgd (Andrea Arcangeli) [1526975 1519798] {CVE-2017-5715}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.36.5.el7]
changelog:
  - [x86] spec_ctrl: svm: spec_ctrl at vmexit needs per-cpu areas functional (Andrea Arcangeli) [1526975 1519798] {CVE-2017-5715}
  - [x86] mm/kaiser: init_tss is supposed to go in the PAGE_ALIGNED per-cpu section (Andrea Arcangeli) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: Eliminate redundant FEATURE Not Present messages (Andrea Arcangeli) [1526975 1519798] {CVE-2017-5715}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.38.1.el7]
changelog:
  - [net] netfilter: x_tables: don't use seqlock when fetching old counters (Florian Westphal) [1514040 1503702]
  - [net] netfilter: x_tables: make xt_replace_table wait until old rules are not used anymore (Florian Westphal) [1514040 1503702]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.39.1.el7]
changelog:
  - [s390] mm: fix write access check in gup_huge_pmd() (Hendrik Brueckner) [1513315 1506126]
  - [scsi] avoid a permanent stop of the scsi device's request queue (Ewan Milne) [1515288 1400044]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.40.1.el7]
changelog:
  - [s390] add ppa to system call and program check path (Jon Masters) [1526975 1519798] {CVE-2017-5715}
  - [s390] spinlock: add gmb memory barrier (Jon Masters) [1526961 1519786] {CVE-2017-5753}
  - [s390] introduce CPU alternatives (Jon Masters) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: move vmexit rmb in the last branch before IBRS (Andrea Arcangeli) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: satisfy the barrier like semantics of IBRS (Andrea Arcangeli) [1526975 1519798] {CVE-2017-5715}
  - [x86] kaiser/efi: unbreak tboot (Andrea Arcangeli) [1526965 1519801] {CVE-2017-5754}
  - [x86] spec_ctrl: don't call ptrace_has_cap in the IBPB ctx switch optimization (Andrea Arcangeli) [1526975 1519798] {CVE-2017-5715}
  - [x86] kaiser/efi: unbreak EFI old_memmap (Andrea Arcangeli) [1526965 1519801] {CVE-2017-5754}
  - [x86] cpuidle_idle_call: fix double local_irq_enable() (Andrea Arcangeli) [1526965 1519801] {CVE-2017-5754}
  - [x86] entry: Invoke TRACE_IRQS_IRETQ in paranoid_userspace_restore_all (Andrea Arcangeli) [1526965 1519801] {CVE-2017-5754}
  - [x86] cpu: fix get_scattered_cpu_leaf for IBPB feature (Andrea Arcangeli) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: show added cpuid flags in /proc/cpuinfo after late microcode update (Andrea Arcangeli) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: svm: spec_ctrl at vmexit needs per-cpu areas functional (Andrea Arcangeli) [1526975 1519798] {CVE-2017-5715}
  - [x86] mm/kaiser: init_tss is supposed to go in the PAGE_ALIGNED per-cpu section (Andrea Arcangeli) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: Eliminate redundant FEATURE Not Present messages (Andrea Arcangeli) [1526975 1519798] {CVE-2017-5715}
  - [x86] kaiser/mm: skip IBRS/CR3 restore when paranoid exception returns to userland (Andrea Arcangeli) [1526975 1519798] {CVE-2017-5715}
  - [x86] kaiser/mm: consider the init_mm.pgd a kaiser pgd (Andrea Arcangeli) [1526975 1519798] {CVE-2017-5715}
  - [x86] kaiser/mm: convert userland visible "kpti" name to "pti" (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] revert "entry: Use retpoline for syscall's indirect calls" (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: set IBRS during resume from RAM if ibrs_enabled is 2 (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] kaiser/mm: __load_cr3 in resume from RAM after kernel gs has been restored (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] spec_ctrl: allow use_ibp_disable only if both SPEC_CTRL and IBPB_SUPPORT are missing (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: Documentation spec_ctrl.txt (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: remove irqs_disabled() check from intel_idle() (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: use enum when setting ibrs/ibpb_enabled (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: undo speculation barrier for ibrs_enabled and noibrs_cmdline (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: introduce ibpb_enabled = 2 for IBPB instead of IBRS (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: introduce SPEC_CTRL_PCP_ONLY_IBPB (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: cleanup s/flush/sync/ naming when sending IPIs (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: set IBRS during CPU init if in ibrs_enabled == 2 (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: use IBRS_ENABLED instead of 1 (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: allow the IBP disable feature to be toggled at runtime (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: always initialize save_reg in ENABLE_IBRS_SAVE_AND_CLOBBER (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: ibrs_enabled() is expected to return > 1 (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: issue a __spec_ctrl_ibpb if a credential check isn't possible (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] ibpb: don't optimize spec_cntrl_ibpb on PREEMPT_RCU (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: clear registers after 32bit syscall stackframe is setup (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: reload spec_ctrl cpuid in all microcode load paths (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] kaiser/mm: fix pgd freeing in error path (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: disable global pages by default with KAISER (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] revert "mm/kaiser: Disable global pages by default with KAISER" (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] spec_ctrl: Prevent unwanted speculation without IBRS (Josh Poimboeuf) [1526975 1526965 1519798 1519801] {CVE-2017-5715 CVE-2017-5754}
  - [x86] entry: Remove trampoline check from paranoid entry path (Josh Poimboeuf) [1526975 1526965 1519798 1519801] {CVE-2017-5715 CVE-2017-5754}
  - [x86] entry: Fix paranoid_exit() trampoline clobber (Josh Poimboeuf) [1526975 1526965 1519798 1519801] {CVE-2017-5715 CVE-2017-5754}
  - [x86] entry: Simplify trampoline stack restore code (Josh Poimboeuf) [1526975 1526965 1519798 1519801] {CVE-2017-5715 CVE-2017-5754}
  - [x86] dumpstack: Remove raw stack dump (Josh Poimboeuf) [1526975 1479560] {CVE-2017-5715}
  - [x86] spec_ctrl: remove SPEC_CTRL_DEBUG code (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: add noibrs noibpb boot options (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] entry: Use retpoline for syscall's indirect calls (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] syscall: Clear unused extra registers on 32-bit compatible syscall entrance (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: cleanup unnecessary ptregscall_common function (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: CLEAR_EXTRA_REGS and extra regs save/restore (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] syscall: Clear unused extra registers on syscall entrance (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: rescan cpuid after a late microcode update (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: add debugfs ibrs_enabled ibpb_enabled (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: consolidate the spec control boot detection (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] kvm/spec_ctrl: allow IBRS to stay enabled in host userland (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: add debug aid to test the entry code without microcode (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: move stuff_RSB in spec_ctrl.h (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] entry: Stuff RSB for entry to kernel for non-SMEP platform (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] mm: Only set IBPB when the new thread cannot ptrace current thread (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] mm: Set IBPB upon context switch (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] idle: Disable IBRS when offlining cpu and re-enable on wakeup (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] idle: Disable IBRS entering idle and enable it on wakeup (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: implement spec ctrl C methods (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: save IBRS MSR value in save_paranoid for NMI (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] enter: Use IBRS on syscall and interrupts (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: swap rdx with rsi for nmi nesting detection (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: spec_ctrl_pcp and kaiser_enabled_pcp in same cachline (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: use per-cpu knob instead of ALTERNATIVES for ibpb and ibrs (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] enter: MACROS to set/clear IBRS and set IBPB (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [kvm] x86: add SPEC_CTRL to MSR and CPUID lists (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] cpuid: Provide get_scattered_cpuid_leaf() (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] cpuid: Cleanup cpuid_regs definitions (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [kvm] svm: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] svm: Set IBPB when running a different VCPU (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [kvm] vmx: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [kvm] vmx: Set IBPB when running a different VCPU (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [kvm] x86: clear registers on VM exit (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] kvm: Pad RSB on VM transition (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] cpu/AMD: Control indirect branch predictor when SPEC_CTRL not available (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] feature: Report presence of IBPB and IBRS control (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [x86] feature: Enable the x86 feature to control Speculation (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [tools] objtool: Don't print 'call dest' warnings for ignored functions (Josh Poimboeuf) [1526975 1519798] {CVE-2017-5715}
  - [misc] locking/barriers: prevent speculative execution based on Coverity scan results (Josh Poimboeuf) [1526961 1519786] {CVE-2017-5753}
  - [fs] udf: prevent speculative execution (Josh Poimboeuf) [1526961 1519786] {CVE-2017-5753}
  - [fs] prevent speculative execution (Josh Poimboeuf) [1526961 1519786] {CVE-2017-5753}
  - [kernel] userns: prevent speculative execution (Josh Poimboeuf) [1526961 1519786] {CVE-2017-5753}
  - [scsi] qla2xxx: prevent speculative execution (Josh Poimboeuf) [1526961 1519786] {CVE-2017-5753}
  - [netdrv] p54: prevent speculative execution (Josh Poimboeuf) [1526961 1519786] {CVE-2017-5753}
  - [netdrv] carl9170: prevent speculative execution (Josh Poimboeuf) [1526961 1519786] {CVE-2017-5753}
  - [media] uvcvideo: prevent speculative execution (Josh Poimboeuf) [1526961 1519786] {CVE-2017-5753}
  - [x86] cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature (Josh Poimboeuf) [1526961 1519786] {CVE-2017-5753}
  - [x86] cpu/AMD: Make the LFENCE instruction serialized (Josh Poimboeuf) [1526961 1519786] {CVE-2017-5753}
  - [kernel] locking/barriers: introduce new memory barrier gmb() (Josh Poimboeuf) [1526961 1519786] {CVE-2017-5753}
  - [x86] mm/kaiser: Replace kaiser with kpti to sync with upstream (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add "kaiser" and "nokaiser" boot options (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map the trace idt tables in userland shadow pgd (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: fix RESTORE_CR3 crash in kaiser_stop_machine (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use stop_machine for enable/disable knob (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use atomic ops to poison/unpoison user pagetables (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use invpcid to flush the two kaiser PCID AISD (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use two PCID ASIDs optimize the TLB during enter/exit kernel (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: stop patching flush_tlb_single (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use PCID feature to make user and kernel switches faster (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm: If INVPCID is available, use it to flush global mappings (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/64: Fix reboot interaction with CR4.PCIDE (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/64: Initialize CR4.PCIDE early (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm: Add a 'noinvpcid' boot option to turn off INVPCID (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm: Add the 'nopcid' boot option to turn off PCID (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: validate trampoline stack (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] entry: Move SYSENTER_stack to the beginning of struct tss_struct (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: isolate the user mapped per cpu areas (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: enable kaiser in build (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: selective boot time defaults (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: handle call to xen_pv_domain() on PREEMPT_RT (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser/xen: Dynamically disable KAISER when running under Xen PV (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add Kconfig (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: avoid false positives during non-kaiser pgd updates (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: Respect disabled CPU features (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: trampoline stack comments (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: stack trampoline (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: remove paravirt clock warning (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [kvm] kvmclock: export kvmclock clocksource pointer (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: re-enable vsyscalls (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: allow to build KAISER with KASRL (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: allow KAISER to be enabled/disabled at runtime (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: un-poison PGDs at runtime (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add a function to check for KAISER being enabled (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add debugfs file to turn KAISER on/off at runtime (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: disable native VSYSCALL (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map virtually-addressed performance monitoring buffers (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map debug IDT tables (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add kprobes text section (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map trace interrupt entry (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map entry stack per-cpu areas (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map dynamically-allocated LDTs (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: make sure static PGDs are 8k in size (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: allow NX poison to be set in p4d/pgd (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: unmap kernel from userspace page tables (core patch) (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: mark per-cpu data structures required for entry/exit (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: introduce user-mapped per-cpu areas (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add cr3 switches to entry code (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: remove scratch registers (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: prepare assembly for entry/exit CR3 switching (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: Disable global pages by default with KAISER (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm: Document X86_CR4_PGE toggling behavior (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm/tlb: Make CR4-based TLB flushes more robust (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] mm: Do not set _PAGE_USER for init_mm page tables (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [x86] increase robusteness of bad_iret fixup handler (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [perf] x86: intel/uncore: Fix memory leaks on allocation failures (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}
  - [mm] fix bad rss-counter if remap_file_pages raced migration (Josh Poimboeuf) [1526965 1519801] {CVE-2017-5754}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.41.1.el7]
changelog:
  - [powerpc] spinlock: add gmb memory barrier (Mauricio Oliveira) [1526961 1519786] {CVE-2017-5753}
  - [powerpc] Prevent Meltdown attack with L1-D$ flush (Mauricio Oliveira) [1526965 1519801] {CVE-2017-5754}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.43.1.el7]
changelog:
  - [watchdog] hpwdt: remove indirect call in drivers/watchdog/hpwdt.c (Josh Poimboeuf) [1539648 1535644]
  - [kernel] x86/spec_ctrl: cleanup __ptrace_may_access (Josh Poimboeuf) [1539648 1535644]
  - [x86] bugs: Drop one "mitigation" from dmesg (Josh Poimboeuf) [1539648 1535644]
  - [x86] kvm: vmx: Make indirect call speculation safe (Josh Poimboeuf) [1539648 1535644]
  - [x86] kvm: Make indirect calls in emulator speculation safe (Josh Poimboeuf) [1539648 1535644]
  - [x86] retpoline: Optimize inline assembler for vmexit_fill_RSB (Josh Poimboeuf) [1539648 1535644]
  - [x86] mce: Make machine check speculation protected (Josh Poimboeuf) [1539648 1535644]
  - [x86] spec_ctrl: fix ptrace IBPB optimization (Josh Poimboeuf) [1539648 1535644]
  - [x86] spec_ctrl: Avoid returns in IBRS-disabled regions (Josh Poimboeuf) [1539648 1535644]
  - [x86] spectre/meltdown: avoid the vulnerability directory to weaken kernel security (Josh Poimboeuf) [1539648 1535644]
  - [x86] spec_ctrl: Document retpolines and ibrs_enabled=3 (Josh Poimboeuf) [1539648 1535644]
  - [x86] spec_ctrl: upgrade GCC retpoline warning to an error (Josh Poimboeuf) [1539648 1535644]
  - [x86] Use IBRS for firmware update path (Josh Poimboeuf) [1539648 1535644]
  - [x86] spec_ctrl: stuff RSB on context switch with SMEP enabled (Josh Poimboeuf) [1539648 1535644]
  - [x86] spec_ctrl: enforce sane combinations of IBRS and retpoline (Josh Poimboeuf) [1539648 1535644]
  - [x86] spec_ctrl: use upstream RSB stuffing function (Josh Poimboeuf) [1539648 1535644]
  - [x86] spec_ctrl: add ibrs_enabled=3 (ibrs_user) (Josh Poimboeuf) [1539648 1535644]
  - [kernel] x86/jump_label: warn on failed jump label patch (Josh Poimboeuf) [1539648 1535644]
  - [x86] spec_ctrl: detect unretpolined modules (Josh Poimboeuf) [1539648 1535644]
  - [x86] retpoline: Add LFENCE to the retpoline/RSB filling RSB macros (Josh Poimboeuf) [1539648 1535644]
  - [x86] retpoline: Fill return stack buffer on vmexit (Josh Poimboeuf) [1539648 1535644]
  - [x86] retpoline/xen: Convert Xen hypercall indirect jumps (Josh Poimboeuf) [1539648 1535644]
  - [x86] retpoline/hyperv: Convert assembler indirect jumps (Josh Poimboeuf) [1539648 1535644]
  - [x86] retpoline/ftrace: Convert ftrace assembler indirect jumps (Josh Poimboeuf) [1539648 1535644]
  - [x86] retpoline/entry: Convert entry assembler indirect jumps (Josh Poimboeuf) [1539648 1535644]
  - [x86] retpoline/crypto: Convert crypto assembler indirect jumps (Josh Poimboeuf) [1539648 1535644]
  - [x86] retpoline: Add initial retpoline support (Josh Poimboeuf) [1539648 1535644]
  - [x86] jump_label: add asm support for static keys (Josh Poimboeuf) [1539648 1535644]
  - [x86] asm: Make asm/alternative.h safe from assembly (Josh Poimboeuf) [1539648 1535644]
  - [tools] objtool: Support new GCC 6 switch jump table pattern (Josh Poimboeuf) [1539648 1535644]
  - [tools] objtool: Detect jumps to retpoline thunks (Josh Poimboeuf) [1539648 1535644]
  - [x86] spectre: Add boot time option to select Spectre v2 mitigation (Josh Poimboeuf) [1539648 1535644]
  - [x86] spec_ctrl: print features changed by microcode loading (Josh Poimboeuf) [1539648 1535644]
  - [x86] spec_ctrl: refactor the init and microcode loading paths (Josh Poimboeuf) [1539648 1535644]
  - [x86] spec_ctrl: move initialization of X86_FEATURE_IBPB_SUPPORT (Josh Poimboeuf) [1539648 1535644]
  - [x86] spec_ctrl: remove SPEC_CTRL_PCP_IBPB bit (Josh Poimboeuf) [1539648 1535644]
  - [x86] spec_ctrl: remove ibrs_enabled variable (Josh Poimboeuf) [1539648 1535644]
  - [x86] spec_ctrl: add ibp_disabled variable (Josh Poimboeuf) [1539648 1535644]
  - [x86] spec_ctrl: add X86_FEATURE_IBP_DISABLE (Josh Poimboeuf) [1539648 1535644]
  - [x86] spec_ctrl: remove IBP disable for AMD model 0x16 (Josh Poimboeuf) [1539648 1535644]
  - [x86] spec_ctrl: remove performance measurements from documentation (Josh Poimboeuf) [1539648 1535644]
  - [x86] spec_ctrl: make ipbp_enabled read-only (Josh Poimboeuf) [1539648 1535644]
  - [x86] spec_ctrl: remove ibpb_enabled=2 mode (Josh Poimboeuf) [1539648 1535644]
  - [x86] cpu: Implement CPU vulnerabilites sysfs functions (Josh Poimboeuf) [1539648 1535644]
  - [base] sysfs/cpu: Add vulnerability folder (Josh Poimboeuf) [1539648 1535644]
  - [x86] cpu: Merge bugs.c and bugs_64.c (Josh Poimboeuf) [1539648 1535644]
  - [x86] syscall: int80 must not clobber r12-15 (Josh Poimboeuf) [1539648 1535644]
  - [x86] syscall: change ia32_syscall() to create the full register frame in ia32_do_call() (Josh Poimboeuf) [1539648 1535644]
  - [x86] boot: Add early cmdline parsing for options with arguments (Josh Poimboeuf) [1539648 1535644]
  - [x86] boot: Pass in size to early cmdline parsing (Josh Poimboeuf) [1539648 1535644]
  - [x86] boot: Simplify early command line parsing (Josh Poimboeuf) [1539648 1535644]
  - [x86] boot: Fix early command-line parsing when partial word matches (Josh Poimboeuf) [1539648 1535644]
  - [x86] boot: Fix early command-line parsing when matching at end (Josh Poimboeuf) [1539648 1535644]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.44.1.el7]
changelog:
  - [s390] cpuinfo: show facilities as reported by stfle (Hendrik Brueckner) [1540088 1535082]
  - [x86] kvm: x86: fix RSM when PCID is non-zero (Paolo Bonzini) [1531661 1530711]
  - [net] dccp: use-after-free in DCCP code (Stefano Brivio) [1530746 1519591] {CVE-2017-8824}
  - [net] ethtool: page allocation failure (David Arcari) [1530128 1362219]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.45.1.el7]
changelog:
  - [net] neigh: do not modify unlinked entries (Jakub Sitnicki) [1553607 1389292]
  - [mm] memcg, slab: do not destroy children caches if parent has aliases (Aristeu Rozanski) [1546733 1502818]
  - [mm] memcg, slab: fix races in per-memcg cache creation/destruction (Aristeu Rozanski) [1546733 1502818]
  - [mm] memcg, slab: clean up memcg cache initialization/destruction (Aristeu Rozanski) [1546733 1502818]
  - [mm] memcg, slab: kmem_cache_create_memcg(): fix memleak on fail path (Aristeu Rozanski) [1546733 1502818]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.46.1.el7]
changelog:
  - [powerpc] kvm: book3s: Provide information about hardware/firmware CVE workarounds (Serhii Popovych) [1550420 1532077] {CVE-2017-5754}
  - [powerpc] 64s: Allow control of RFI flush via debugfs (Mauricio Oliveira) [1554728 1543067]
  - [powerpc] 64s: Improve RFI L1-D cache flush fallback (Mauricio Oliveira) [1554728 1543067]
  - [powerpc] 64s: Wire up cpu_show_meltdown() (Mauricio Oliveira) [1554728 1543067]
  - [mm] ksm: add cond_resched() to the rmap_walks (Rafael Aquini) [1541897 1519517]
  - [mm] mprotect: add a cond_resched() inside change_pmd_range() (Rafael Aquini) [1541897 1519517]
  - [fs] gfs2: stuffed directories not setting nfs cookies (Robert S Peterson) [1541292 1397414]
  - [fs] xfs: use dedicated log worker wq to avoid deadlock with cil wq (Brian Foster) [1543304 1422225]
  - [scsi] lpfc: Null pointer dereference when log_verbose is set to 0xffffffff (Maurizio Lombardi) [1542898 1459443]
  - [s390] qdio: avoid reschedule of outbound tasklet once killed (Hendrik Brueckner) [1544925 1499699]
  - [x86] mce: Look in genpool instead of mcelog for pending error records (Oleksandr Natalenko) [1552623 1468257]
  - [x86] Avoid using object after free in genpool (Oleksandr Natalenko) [1552623 1468257]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.47.1.el7]
changelog:
  - [x86] smpboot: Do not use smp_num_siblings in __max_logical_packages calculation (Prarit Bhargava) [1533020 1519503]
  - [x86] topology: Add topology_max_smt_threads() (Prarit Bhargava) [1533020 1519503]
  - [x86] x86/smpboot: Fix __max_logical_packages estimate (Prarit Bhargava) [1517801 1474709]
  - [x86] x86/topology: Avoid wasting 128k for package id array (Prarit Bhargava) [1517801 1474709]
  - [x86] perf/x86/intel/uncore: Cache logical pkg id in uncore driver (Prarit Bhargava) [1517801 1474709]
  - [x86] xen: don't crash under Xen hypervisors which present bogus topology (Vitaly Kuznetsov) [1559403 1443627]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.48.1.el7]
changelog:
  - [mm] temporary workaround for non-whitelisted symbol checksum changes in 3.10.0-693.11.6 (Aristeu Rozanski) [1546733 1502818]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.48.2.el7]
changelog:
  - [kernel] perf/hwbp: Simplify the perf-hwbp code, fix documentation (Eugene Syromiatnikov) [1569935 1569874] {CVE-2018-1000199}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.48.3.el7]
changelog:
  - [x86] entry/64: Don't use IST entry for #BP stack (Paolo Bonzini) [1569382 1567083] {CVE-2018-8897}
  - [x86] kvm: fix icebp instruction handling (Paolo Bonzini) [1566842 1566845] {CVE-2018-1087}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.48.4.el7]
changelog:
  - [x86] spec_ctrl: Fix late microcode problem with AMD (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Clean up entry code & remove unused APIs (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Mask off SPEC_CTRL MSR bits that are managed by kernel (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: add support for SSBD to RHEL IBRS entry/exit macros (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [fs] proc: Use CamelCase for SSBD (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] bugs: Rename _RDS to _SSBD (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [kernel] seccomp: Enable speculation flaw mitigations (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [fs] proc: Provide details on speculation flaw mitigations (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] nospec: Allow getting/setting on non-current task (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] speculation: Add prctl for Speculative Store Bypass mitigation (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] process: Allow runtime control of Speculative Store Bypass (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [uapi] prctl: Add speculation control prctls (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] KVM/VMX: Expose SPEC_CTRL Bit(2) to the guest (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] bugs/AMD: Add support to disable RDS on Fam[15, 16, 17]h if requested (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up RDS setting with IBRS code (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] bugs: Provide boot parameters for the spec_store_bypass_disable mitigation (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] bugs: Expose /sys/../spec_store_bypass (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] bugs: Read SPEC_CTRL MSR during boot and re-use (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Use separate PCP variables for IBRS entry and exit (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] cpu/intel: Add Knights Mill to Intel family (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] cpufeatures: Make CPU bugs sticky (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] cpu: Rename Merrifield2 to Moorefield (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] cpuid: Fix up "virtual" IBRS/IBPB/STIBP feature bits on Intel (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] cpufeatures: Clean up Spectre v2 related CPUID flags (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] cpufeatures: Add Intel feature bits for Speculation (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] cpufeatures: Add AMD feature bits for Speculation Control (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] cpufeatures: Add CPUID_7_EDX CPUID leaf (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] cpu: Fill in feature word 13, CPUID_8000_0008_EBX (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.49.1.el7]
changelog:
  - [net] netfilter: xt_TCPMSS: add more sanity tests on tcph->doff (Florian Westphal) [1568854 1543088] {CVE-2017-18017}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.50.1.el7]
changelog:
  - [kernel] perf/hwbp: Simplify the perf-hwbp code, fix documentation (Eugene Syromiatnikov) [1569935 1569874] {CVE-2018-1000199}
  - [x86] entry/64: Don't use IST entry for #BP stack (Paolo Bonzini) [1569382 1567083] {CVE-2018-8897}
  - [x86] kvm: fix icebp instruction handling (Paolo Bonzini) [1566842 1566845] {CVE-2018-1087}
  - [scsi] sd: Do not override max_sectors_kb sysfs setting (Phillip Lougher) [1573262 1507941]
  - [x86] spec_ctrl: disable IBRS in idle, part 2 (Phillip Lougher) [1570530 1558668]
  - [netdrv] vmxnet3: avoid xmit reset due to a race in vmxnet3 (Phillip Lougher) [1567766 1558685]
  - [x86] kpti/kexec: fix wrong page address in clear_page (Dave Young) [1573169 1571162]
  - [x86] kexec/64: Clear control page after PGD init (Waiman Long) [1567892 1540061]
  - [x86] pti: Fix conflict between UEFI PGD and PTI (Waiman Long) [1567892 1540061]
  - [x86] efi: Setup separate EFI page tables in kexec paths (Waiman Long) [1567892 1540061]
  - [x86] efi: Build our own page table structures (Waiman Long) [1567892 1540061]
  - [net] sctp: use right member as the param of list_for_each_entry (Xin Long) [1565981 1483445]
  - [net] sctp: reset owner sk for data chunks on out queues when migrating a sock (Xin Long) [1565981 1483445]
  - [powerpc] powernv: Support firmware disable of RFI flush (Mauricio Oliveira) [1563094 1553927]
  - [powerpc] pseries: Support firmware disable of RFI flush (Mauricio Oliveira) [1563094 1553927]
  - [powerpc] pseries: Add H_GET_CPU_CHARACTERISTICS flags & wrapper (Mauricio Oliveira) [1563094 1553927]
  - [x86] smpboot: Fix uncore_pci_remove() indexing bug when hot-removing a physical CPU (Prarit Bhargava) [1563089 1527731]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.51.1.el7]
changelog:
  - [powerpc] 64s: powernv, pseries: split setup_stf_barrier() enable option (Mauricio Oliveira) [1581050 1581036] {CVE-2018-3639}
  - [powerpc] 64s: Add support for a store forwarding barrier at kernel entry/exit (Mauricio Oliveira) [1581050 1581036] {CVE-2018-3639}
  - [powerpc] 64s: Move the data access exception out-of-line (Mauricio Oliveira) [1581050 1581036] {CVE-2018-3639}
  - [x86] kvm: fix CPUID_7_EDX (word 18) mask (Jan Stancek) [1566900 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Fix late microcode problem with AMD (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Clean up entry code & remove unused APIs (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Mask off SPEC_CTRL MSR bits that are managed by kernel (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: add support for SSBD to RHEL IBRS entry/exit macros (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [fs] proc: Use CamelCase for SSBD (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] bugs: Rename _RDS to _SSBD (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [kernel] seccomp: Enable speculation flaw mitigations (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [fs] proc: Provide details on speculation flaw mitigations (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] nospec: Allow getting/setting on non-current task (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] speculation: Add prctl for Speculative Store Bypass mitigation (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] process: Allow runtime control of Speculative Store Bypass (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [uapi] prctl: Add speculation control prctls (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] KVM/VMX: Expose SPEC_CTRL Bit(2) to the guest (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] bugs/AMD: Add support to disable RDS on Fam[15, 16, 17]h if requested (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up RDS setting with IBRS code (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] bugs: Provide boot parameters for the spec_store_bypass_disable mitigation (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] bugs: Expose /sys/../spec_store_bypass (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] bugs: Read SPEC_CTRL MSR during boot and re-use (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Use separate PCP variables for IBRS entry and exit (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] cpu/intel: Add Knights Mill to Intel family (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] cpufeatures: Make CPU bugs sticky (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] cpu: Rename Merrifield2 to Moorefield (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] cpuid: Fix up "virtual" IBRS/IBPB/STIBP feature bits on Intel (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] cpufeatures: Clean up Spectre v2 related CPUID flags (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] cpufeatures: Add Intel feature bits for Speculation (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] cpufeatures: Add AMD feature bits for Speculation Control (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] cpufeatures: Add CPUID_7_EDX CPUID leaf (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}
  - [x86] cpu: Fill in feature word 13, CPUID_8000_0008_EBX (Phillip Lougher) [1566900 1566905] {CVE-2018-3639}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.52.1.el7]
changelog:
  - [x86] microcode: Fix CPU synchronization routine (Prarit Bhargava) [1578044 1568249]
  - [x86] microcode: Synchronize late microcode loading (Prarit Bhargava) [1578044 1568249]
  - [x86] microcode: Move microcode request to reload_store() (Prarit Bhargava) [1578044 1568249]
  - [x86] microcode: Get rid of struct apply_microcode_ctx (Prarit Bhargava) [1578044 1568249]
  - [x86] microcode: Propagate return value from updating functions (Prarit Bhargava) [1578044 1568249]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.53.1.el7]
changelog:
  - [nvme] Remove RCU namespace protection (David Milburn) [1566886 1384066]
  - [nvme] fix nvme_ns_remove() deadlock (David Milburn) [1566886 1384066]
  - [nvme] switch to RCU freeing the namespace (David Milburn) [1566886 1384066]
  - [x86] spec_ctrl: Always clear SPEC_CTRL MSRs when disabling IBRS (Waiman Long) [1586146 1574730]
  - [powerpc] pseries: Restore default security feature flags on setup (Mauricio Oliveira) [1570515 1561787]
  - [powerpc] Move default security feature flags (Mauricio Oliveira) [1570515 1561787]
  - [powerpc] pseries: Fix clearing of security feature flags (Mauricio Oliveira) [1570515 1561787]
  - [powerpc] 64s: Wire up cpu_show_spectre_v2() (Mauricio Oliveira) [1570515 1561787]
  - [powerpc] 64s: Wire up cpu_show_spectre_v1() (Mauricio Oliveira) [1570515 1561787]
  - [powerpc] pseries: Use the security flags in pseries_setup_rfi_flush() (Mauricio Oliveira) [1570515 1561787]
  - [powerpc] powernv: Use the security flags in pnv_setup_rfi_flush() (Mauricio Oliveira) [1570515 1561787]
  - [powerpc] 64s: Enhance the information in cpu_show_meltdown() (Mauricio Oliveira) [1570515 1561787]
  - [powerpc] 64s: Move cpu_show_meltdown() (Mauricio Oliveira) [1570515 1561787]
  - [powerpc] powernv: Set or clear security feature flags (Mauricio Oliveira) [1570515 1561787]
  - [powerpc] pseries: Set or clear security feature flags (Mauricio Oliveira) [1570515 1561787]
  - [powerpc] Add security feature flags for Spectre/Meltdown (Mauricio Oliveira) [1570515 1561787]
  - [powerpc] pseries: Add new H_GET_CPU_CHARACTERISTICS flags (Mauricio Oliveira) [1570515 1561787]
  - [powerpc] lib: seq: Add seq_buf_printf() (Mauricio Oliveira) [1570515 1561787]
  - [powerpc] rfi-flush: Call setup_rfi_flush() after LPM migration (Mauricio Oliveira) [1570507 1561785]
  - [powerpc] rfi-flush: Differentiate enabled and patched flush types (Mauricio Oliveira) [1570507 1561785]
  - [powerpc] rfi-flush: Always enable fallback flush on pseries (Mauricio Oliveira) [1570507 1561785]
  - [powerpc] rfi-flush: Make it possible to call setup_rfi_flush() again (Mauricio Oliveira) [1570507 1561785]
  - [powerpc] rfi-flush: Move the logic to avoid a redo into the debugfs code (Mauricio Oliveira) [1570507 1561785]
  - [x86] cpufeature: Correctly read out EBX of CPUID leaf 0x80000008 (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Fix VM guest SSBD problems (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Eliminate TIF_SSBD checks in IBRS on/off functions (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Disable SSBD update from scheduler if not user settable (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Make ssbd_enabled writtable (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Remove thread_info check in __wrmsr_on_cpu() (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Write per-thread SSBD state to spec_ctrl_pcp (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Add a read-only ssbd_enabled debugfs file (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] bugs: Switch the selection of mitigation from CPU vendor to CPU features (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] bugs: Add AMD's SPEC_CTRL MSR usage (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] bugs: Add AMD's variant of SSB_NO (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] bugs/intel: Set proper CPU features and setup RDS (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] KVM/VMX: Emulate MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] KVM: SVM: Implement VIRT_SPEC_CTRL support for SSBD (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] speculation, KVM: Implement support for VIRT_SPEC_CTRL/LS_CFG (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] bugs: Rework spec_ctrl base and mask logic (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Rework SPEC_CTRL update after late microcode loading (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Make sync_all_cpus_ibrs() write spec_ctrl_pcp value (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] bugs: Unify x86_spec_ctrl_{set_guest, restore_host} (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] speculation: Rework speculative_store_bypass_update() (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] speculation: Add virtualized speculative store bypass disable support (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] KVM: Rename KVM SPEC_CTRL MSR functions to match upstream (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] speculation: Handle HT correctly on AMD (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] cpufeatures: Add FEATURE_ZEN (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] cpufeatures: Disentangle SSBD enumeration (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] cpufeatures: Disentangle MSR_SPEC_CTRL enumeration from IBRS (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] speculation: Use synthetic bits for IBRS/IBPB/STIBP (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [documentation] spec_ctrl: Do some minor cleanups (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] speculation: Make "seccomp" the default mode for Speculative Store Bypass (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [kernel] seccomp: Move speculation migitation control to arch code (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [kernel] seccomp: Use PR_SPEC_FORCE_DISABLE (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [uapi] prctl: Add force disable speculation (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] spectre_v2: No mitigation if CPU not affected and no command override (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] bug: Add X86_BUG_CPU_MELTDOWN and X86_BUG_SPECTRE_V[12] (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] pti: Rename CONFIG_KAISER to CONFIG_PAGE_TABLE_ISOLATION (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up naming of SPEC_CTRL MSR bits with upstream (Waiman Long) [1584338 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up SSBD changes with upstream (Waiman Long) [1584338 1584569] {CVE-2018-3639}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.54.1.el7]
changelog:
  - [mm] compaction: release zone irqlock in isolate_freepages_block (Andrea Arcangeli) [1596281 1582793]
  - [mm] compaction: change the timing to check to drop the spinlock (Andrea Arcangeli) [1596281 1582793]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.55.1.el7]
changelog:
  - [s390] configs: enable auto expoline support (Hendrik Brueckner) [1577761 1558325]
  - [s390] correct nospec auto detection init order (Hendrik Brueckner) [1577761 1558325]
  - [s390] add sysfs attributes for spectre (Hendrik Brueckner) [1577761 1558325]
  - [s390] report spectre mitigation via syslog (Hendrik Brueckner) [1577761 1558325]
  - [s390] add automatic detection of the spectre defense (Hendrik Brueckner) [1577761 1558325]
  - [s390] move nobp parameter functions to nospec-branch.c (Hendrik Brueckner) [1577761 1558325]
  - [s390] do not bypass BPENTER for interrupt system calls (Hendrik Brueckner) [1577761 1558325]
  - [s390] Replace IS_ENABLED(EXPOLINE_*) with IS_ENABLED(CONFIG_EXPOLINE_*) (Hendrik Brueckner) [1577761 1558325]
  - [s390] introduce execute-trampolines for branches (Hendrik Brueckner) [1577761 1558325]
  - [s390] run user space and KVM guests with modified branch prediction (Hendrik Brueckner) [1577761 1558325]
  - [s390] add optimized array_index_mask_nospec (Hendrik Brueckner) [1577761 1558325]
  - [s390] entry.S: fix spurious zeroing of r0 (Hendrik Brueckner) [1577761 1558325]
  - [s390] scrub registers on kernel entry and KVM exit (Hendrik Brueckner) [1577761 1558325]
  - [s390] align and prepare spectre mitigation for upstream commits (Hendrik Brueckner) [1577761 1558325]
  - [s390] alternative: use a copy of the facility bit mask (Hendrik Brueckner) [1577761 1558325]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.55.2.el7]
changelog:
  - [kernel] cpu/hotplug: detect SMT disabled by BIOS (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [documentation] l1tf: Fix typos (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] kvm: Remove extra newline in 'vmentry_l1d_flush' sysfs file (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] KVM/VMX: Initialize the vmx_l1d_flush_pages' content (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] speculation/l1tf: Unbreak !__HAVE_ARCH_PFN_MODIFY_ALLOWED architectures (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [documentation] Add section about CPU vulnerabilities (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] bugs, kvm: introduce boot-time control of L1TF mitigations (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Expose SMT control init function (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] kvm: Allow runtime control of L1D flush (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] kvm: Serialize L1D flush parameter setter (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] kvm: Add static key for flush always (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] kvm: Move l1tf setup function (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] l1tf: Handle EPT disabled state proper (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] kvm: Drop L1TF MSR list approach (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] litf: Introduce vmx status variable (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] bugs: Make cpu_show_common() static (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] bugs: Concentrate bug reporting into a separate function (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Online siblings when SMT control is turned on (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] KVM/VMX: Add find_msr() helper function (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest numbers (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] kvm: x86: mitigation for L1 cache terminal fault vulnerabilities, part 3 (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] kvm: Warn user if KVM is loaded SMT and L1TF CPU bug being present (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Boot HT siblings at least once, part 2 (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] speculation/l1tf: fix typo in l1tf mitigation string (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_FILE PTEs against speculation (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] kvm: x86: mitigation for L1 cache terminal fault vulnerabilities, part 2 (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Boot HT siblings at least once (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - Revert "[x86] apic: Ignore secondary threads if nosmt=force" (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] speculation/l1tf: Fix up pte->pfn conversion for PAE (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect PAE swap entries against L1TF (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] cpu/AMD: Move TOPOEXT reenablement before reading smp_num_siblings (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] speculation/l1tf: Extend 64bit swap file size limit (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] cpu/AMD: Remove the pointless detect_ht() call (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] bugs: Move the l1tf function and define pr_fmt properly (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Provide knobs to control SMT, part 2 (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] topology: Provide topology_smt_supported() (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] smp: Provide topology_is_primary_thread(), part 2 (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] apic: Ignore secondary threads if nosmt=force (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] cpu/AMD: Evaluate smp_num_siblings early (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] cpu/AMD: Do not check CPUID max ext level before parsing SMP info (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] cpu/intel: Evaluate smp_num_siblings early (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] cpu/topology: Provide detect_extended_topology_early() (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] cpu/common: Provide detect_ht_early() (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] cpu: Remove the pointless CPU printout (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Provide knobs to control SMT (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Split do_cpu_down() (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] smp: Provide topology_is_primary_thread() (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] cpu: Modify detect_extended_topology() to return result (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] l1tf: fix build for CONFIG_NUMA_BALANCING=n (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] l1tf: sync with latest L1TF patches (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_NUMA PTEs and PMDs against speculation (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [mm] l1tf: Disallow non privileged high MMIO PROT_NONE mappings (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] l1tf: Report if too much memory for L1TF workaround (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] l1tf: Limit swap file size to MAX_PA/2 (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] l1tf: Add sysfs reporting for l1tf (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] l1tf: Make sure the first page is always reserved (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] l1tf: Protect PROT_NONE PTEs against speculation (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] l1tf: Protect swap entries against L1TF (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] l1tf: Increase 32bit PAE __PHYSICAL_PAGE_MASK (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] mm: Fix swap entry comment and macro (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] spec_ctrl: sync with upstream cpu_set_bug_bits() (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] add support for L1D flush MSR (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] kvm: x86: mitigation for L1 cache terminal fault vulnerabilities (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] kvm: x86: Introducing kvm_x86_ops VM init/destroy hooks (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] intel-family.h: Add GEMINI_LAKE SOC (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] mm: Simplify p[g4um]d_page() macros (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] mm: Fix regression with huge pages on PAE (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] asm: Move PUD_PAGE macros to page_types.h (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] asm: Fix pud/pmd interfaces to handle large PAT bit (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] asm: Add pud/pmd mask interfaces to handle large PAT bit (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.55.3.el7]
changelog:
  - [kernel] cpu/hotplug: Enable 'nosmt' as late as possible (Josh Poimboeuf) [1593375 1593384] {CVE-2018-3620}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.55.4.el7]
changelog:
  - [kernel] cpu/hotplug: Fix 'online' sysfs entry with 'nosmt' (Josh Poimboeuf) [1593375 1593384] {CVE-2018-3620}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.56.1.el7]
changelog:
  - [kernel] cpu/hotplug: Fix 'online' sysfs entry with 'nosmt' (Josh Poimboeuf) [1593375 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Enable 'nosmt' as late as possible (Josh Poimboeuf) [1593375 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: detect SMT disabled by BIOS (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [documentation] l1tf: Fix typos (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] kvm: Remove extra newline in 'vmentry_l1d_flush' sysfs file (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] KVM/VMX: Initialize the vmx_l1d_flush_pages' content (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] speculation/l1tf: Unbreak !__HAVE_ARCH_PFN_MODIFY_ALLOWED architectures (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [documentation] Add section about CPU vulnerabilities (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] bugs, kvm: introduce boot-time control of L1TF mitigations (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Expose SMT control init function (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] kvm: Allow runtime control of L1D flush (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] kvm: Serialize L1D flush parameter setter (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] kvm: Add static key for flush always (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] kvm: Move l1tf setup function (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] l1tf: Handle EPT disabled state proper (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] kvm: Drop L1TF MSR list approach (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] litf: Introduce vmx status variable (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] bugs: Make cpu_show_common() static (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] bugs: Concentrate bug reporting into a separate function (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Online siblings when SMT control is turned on (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] KVM/VMX: Add find_msr() helper function (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest numbers (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] kvm: x86: mitigation for L1 cache terminal fault vulnerabilities, part 3 (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] kvm: Warn user if KVM is loaded SMT and L1TF CPU bug being present (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Boot HT siblings at least once, part 2 (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] speculation/l1tf: fix typo in l1tf mitigation string (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_FILE PTEs against speculation (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] kvm: x86: mitigation for L1 cache terminal fault vulnerabilities, part 2 (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Boot HT siblings at least once (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - Revert "[x86] apic: Ignore secondary threads if nosmt=force" (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] speculation/l1tf: Fix up pte->pfn conversion for PAE (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect PAE swap entries against L1TF (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] cpu/AMD: Move TOPOEXT reenablement before reading smp_num_siblings (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] speculation/l1tf: Extend 64bit swap file size limit (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] cpu/AMD: Remove the pointless detect_ht() call (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] bugs: Move the l1tf function and define pr_fmt properly (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Provide knobs to control SMT, part 2 (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] topology: Provide topology_smt_supported() (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] smp: Provide topology_is_primary_thread(), part 2 (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] apic: Ignore secondary threads if nosmt=force (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] cpu/AMD: Evaluate smp_num_siblings early (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] cpu/AMD: Do not check CPUID max ext level before parsing SMP info (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] cpu/intel: Evaluate smp_num_siblings early (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] cpu/topology: Provide detect_extended_topology_early() (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] cpu/common: Provide detect_ht_early() (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] cpu: Remove the pointless CPU printout (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Provide knobs to control SMT (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Split do_cpu_down() (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] smp: Provide topology_is_primary_thread() (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] cpu: Modify detect_extended_topology() to return result (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] l1tf: fix build for CONFIG_NUMA_BALANCING=n (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] l1tf: sync with latest L1TF patches (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_NUMA PTEs and PMDs against speculation (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [mm] l1tf: Disallow non privileged high MMIO PROT_NONE mappings (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] l1tf: Report if too much memory for L1TF workaround (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] l1tf: Limit swap file size to MAX_PA/2 (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] l1tf: Add sysfs reporting for l1tf (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] l1tf: Make sure the first page is always reserved (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] l1tf: Protect PROT_NONE PTEs against speculation (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] l1tf: Protect swap entries against L1TF (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] l1tf: Increase 32bit PAE __PHYSICAL_PAGE_MASK (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] mm: Fix swap entry comment and macro (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] spec_ctrl: sync with upstream cpu_set_bug_bits() (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] add support for L1D flush MSR (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] kvm: x86: mitigation for L1 cache terminal fault vulnerabilities (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] kvm: x86: Introducing kvm_x86_ops VM init/destroy hooks (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] intel-family.h: Add GEMINI_LAKE SOC (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] mm: Simplify p[g4um]d_page() macros (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] mm: Fix regression with huge pages on PAE (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] asm: Move PUD_PAGE macros to page_types.h (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] asm: Fix pud/pmd interfaces to handle large PAT bit (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}
  - [x86] asm: Add pud/pmd mask interfaces to handle large PAT bit (Phillip Lougher) [1593375 1593384] {CVE-2018-3620}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.57.1.el7]
changelog:
  - [x86] microcode/amd: Do not load when running on a hypervisor (Vitaly Kuznetsov) [1618388 1607899]
  - [mm] mempolicy: fix use after free when calling get_mempolicy (Augusto Caringi) [1622572 1576755] {CVE-2018-10675}
  - [net] tcp: add tcp_ooo_try_coalesce() helper (Paolo Abeni) [1611365 1611369] {CVE-2018-5390}
  - [net] tcp: call tcp_drop() from tcp_data_queue_ofo() (Paolo Abeni) [1611365 1611369] {CVE-2018-5390}
  - [net] tcp: detect malicious patterns in tcp_collapse_ofo_queue() (Paolo Abeni) [1611365 1611369] {CVE-2018-5390}
  - [net] tcp: avoid collapses in tcp_prune_queue() if possible (Paolo Abeni) [1611365 1611369] {CVE-2018-5390}
  - [net] tcp: free batches of packets in tcp_prune_ofo_queue() (Paolo Abeni) [1611365 1611369] {CVE-2018-5390}
  - [net] add rb_to_skb() and other rb tree helpers (Paolo Abeni) [1611365 1611369] {CVE-2018-5390}
  - [net] tcp: fix a stale ooo_last_skb after a replace (Paolo Abeni) [1611365 1611369] {CVE-2018-5390}
  - [net] tcp: use an RB tree for ooo receive queue (Paolo Abeni) [1611365 1611369] {CVE-2018-5390}
  - [net] tcp: refine tcp_prune_ofo_queue() to not drop all packets (Paolo Abeni) [1611365 1611369] {CVE-2018-5390}
  - [net] tcp_memcontrol: sanitize tcp memory accounting callbacks (Stefano Brivio) [1611365 1611369] {CVE-2018-5390}
  - [net] tcp: increment sk_drops for dropped rx packets (Paolo Abeni) [1611365 1611369] {CVE-2018-5390}
  - [net] add rbnode to struct sk_buff (Paolo Abeni) [1611365 1611369] {CVE-2018-5390}
  - [powerpc] stf-barrier: update (rfi_)enabled_flush_types as in upstream (Gustavo Duarte) [1612351 1585297]
  - [powerpc] stf-barrier: update debugfs as in upstream (Gustavo Duarte) [1612351 1585297]
  - [powerpc] stf-barrier: update handle_ssbd() as in upstream (Gustavo Duarte) [1612351 1585297]
  - [powerpc] stf-barrier: update stf_barrier_enable() as in upstream (Gustavo Duarte) [1612351 1585297]
  - [powerpc] stf-barrier: add cpu_show_spec_store_bypass() as in upstream (Gustavo Duarte) [1612351 1585297]
  - [powerpc] stf-barrier: add comment as in upstream (Gustavo Duarte) [1612351 1585297]
  - [powerpc] stf-barrier: move code from setup_64.c to security.c as in upstream (Gustavo Duarte) [1612351 1585297]
  - [powerpc] stf-barrier: move code from setup.h to security_features.h as in upstream (Gustavo Duarte) [1612351 1585297]
  - [powerpc] stf-barrier: update fallback routine as in upstream (Gustavo Duarte) [1612351 1585297]
  - [powerpc] stf-barrier: update entry barrier slot as in upstream (Gustavo Duarte) [1612351 1585297]
  - [powerpc] 64s, powernv, pseries: merge back setup_stf_barrier() enable option (Gustavo Duarte) [1612351 1585297]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.58.1.el7]
changelog:
  - [net] ip: process in-order fragments efficiently (Sabrina Dubroca) [1615774 1613924] {CVE-2018-5391}
  - [net] ipv6: defrag: drop non-last frags smaller than min mtu (Sabrina Dubroca) [1615774 1613924] {CVE-2018-5391}
  - [net] ip: use rb trees for IP frag queue (Sabrina Dubroca) [1615774 1613924] {CVE-2018-5391}
  - [net] revert ipv4: use skb coalescing in defragmentation (Sabrina Dubroca) [1615774 1613924] {CVE-2018-5391}
  - [net] modify skb_rbtree_purge to return the truesize of all purged skbs (Sabrina Dubroca) [1615774 1613924] {CVE-2018-5391}
  - [net] ip: discard IPv4 datagrams with overlapping segments (Sabrina Dubroca) [1615774 1613924] {CVE-2018-5391}
  - [net] speed up skb_rbtree_purge() (Sabrina Dubroca) [1615774 1613924] {CVE-2018-5391}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.59.1.el7]
changelog:
  - [fs] exec: Limit arg stack to at most 75 of _STK_LIM (Yauheni Kaliuta) [1625978 1625991] {CVE-2018-14634}
  - [fs] exec: account for argv/envp pointers (Yauheni Kaliuta) [1625978 1625991] {CVE-2018-14634}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.60.1.el7]
changelog:
  - [net] udpv6: Fix the checksum computation when HW checksum does not apply (Xin Long) [1635794 1619793]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.61.1.el7]
changelog:
  - [mm] inode: avoid softlockup in prune_icache_sb (Andrea Arcangeli) [1625866 1610560]
  - [mm] compaction: reschedule immediately if need_resched() is set (Andrea Arcangeli) [1625866 1610560]
  - [mm] compaction: properly signal and act upon lock and need_sched() contention (Andrea Arcangeli) [1625866 1610560]
  - [mm] compaction: cleanup isolate_freepages() (Andrea Arcangeli) [1625866 1610560]
  - [mm] compaction: encapsulate defer reset logic (Andrea Arcangeli) [1625866 1610560]
  - [mm] compaction.c: periodically schedule when freeing pages (Andrea Arcangeli) [1625866 1610560]
  - [x86] kvm: vmx: fixes for vmentry_l1d_flush module parameter (Marcelo Tosatti) [1629566 1619602]
  - [x86] speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry (Marcelo Tosatti) [1629566 1619602]
  - [kernel] posix-timer: Properly check sigevent->sigev_notify (Phil Auld) [1613708 1613711] {CVE-2017-18344}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.62.1.el7]
changelog:
  - [kernel] stop_machine: Atomically queue and wake stopper threads (Phil Auld) [1667325 1557061]
  - [kernel] stop_machine: Disable preemption after queueing stopper threads (Phil Auld) [1667325 1557061]
  - [kernel] stop_machine: Disable preemption when waking two stopper threads (Phil Auld) [1667325 1557061]
  - [kernel] stop_machine, sched: Fix migrate_swap() vs. active_balance() deadlock (Phil Auld) [1667325 1557061]
  - [kernel] stop_machine: Make cpu_stop_queue_work() and stop_one_cpu_nowait() return bool (Phil Auld) [1667325 1557061]
  - [kernel] sched/core: Reset task's lockless wake-queues on fork() (Lauro Ramos Venancio) [1667325 1403356]
  - [kernel] sched: Implement lockless wake-queues (Lauro Ramos Venancio) [1667325 1403356]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.64.1.el7]
changelog:
  - [scsi] libiscsi: Allow sd_shutdown on bad transport (Chris Leech) [1693340 1630979]
  - [fs] ovl: fix return value from ovl_posix_acl_create() (Miklos Szeredi) [1696289 1677705]
  - [kernel] sched/wake_q: Fix wakeup ordering for wake_q (Waiman Long) [1690320 1547078]
  - [kernel] sched/wake_q: Document wake_q_add() (Waiman Long) [1690320 1547078]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.65.1.el7]
changelog:
  - [x86] speculation/mds: Properly set/clear mds_idle_clear static key (Waiman Long) [1713001 1707292]
  - [x86] x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/speculation/mds: Fix comment (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add SMT warning message (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/speculation: Move arch_smt_update() call to after mitigation decisions (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [documentation] x86/speculation/mds: Add mds=full,nosmt cmdline option (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [kernel] x86/speculation: Remove redundant arch_smt_update() invocation (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] spec_ctrl: Update MDS mitigation status after late microcode load (Waiman Long) [1698998 1698889 1698769 1705812 1712990 1712995 1690348 1690358 1690335 1709296 1710498 1710501] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/spec_ctrl: Add debugfs x86/smt_present file (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/spec_ctrl: Disable automatic enabling of STIBP with SMT on (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [documentation] Documentation: Add MDS vulnerability documentation (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [documentation] Documentation: Move L1TF to separate directory (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mitigation mode VMWERV (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add sysfs reporting for MDS (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mitigation control for MDS (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [kvm] x86/kvm/vmx: Add MDS protection when L1D Flush is not active (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/speculation/mds: Clear CPU buffers on exit to user (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mds_clear_cpu_buffers() (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [kvm] x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add BUG_MSBDS_ONLY (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add basic bug infrastructure for MDS (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/speculation: Consolidate CPU whitelists (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/msr-index: Cleanup bit defines (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/l1tf: Show actual SMT state (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/speculation: Simplify sysfs report of VMX L1TF vulnerability (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/speculation: Rework SMT state change (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [kernel] sched/smt: Expose sched_smt_present static key (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [kernel] sched/smt: Make sched_smt_present track topology (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/speculation: Move STIPB/IBPB string conditionals out of cpu_show_common() (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/spectre_v2: Make spectre_v2_mitigation mode available (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/spec_ctrl: Add X86_FEATURE_USE_IBPB (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/spec_ctrl: Add casting to fix compilation error (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/cpu: Sanitize FAM6_ATOM naming (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/cpufeatures: Add Intel PCONFIG cpufeature (Waiman Long) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [kernel] jump_label: remove bug.h, atomic.h dependencies for HAVE_JUMP_LABEL (Jeff Moyer) [1698998 1698889 1698769 1705812 1690348 1690358 1690335 1709296]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-514.66.1.el7]
changelog:
  - [mm] thp: relocate flush_cache_range() in migrate_misplaced_transhuge_page() (Andrea Arcangeli) [1698104 1636066]
  - [mm] thp: fix mmu_notifier in migrate_misplaced_transhuge_page() (Andrea Arcangeli) [1698104 1636066]
  - [mm] thp: fix MADV_DONTNEED vs migrate_misplaced_transhuge_page race condition (Andrea Arcangeli) [1698104 1636066]
  - [mm] revert "mm: numa: defer TLB flush for THP migration as long as possible" (Andrea Arcangeli) [1698104 1636066]
  - [mm] thp/migration: switch from flush_tlb_range to flush_pmd_tlb_range (Andrea Arcangeli) [1698104 1636066]
  - [mm] migrate.c: stabilise page count when migrating transparent hugepages (Andrea Arcangeli) [1698104 1636066]
  - [mm] numa: add migrated transhuge pages to LRU the same way as base pages (Andrea Arcangeli) [1698104 1636066]
  - [mm] page migration fix PageMlocked on migrated pages (Rafael Aquini) [1698104 1636066]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.67.1.el7]
changelog:
  - [net] tcp: be more careful in tcp_fragment() (Marcelo Leitner) [1739126 1732106]
  - [net] tcp: refine memory limit test in tcp_fragment() (Florian Westphal) [1729410 1723032]
  - [net] tcp: provide TCP_FRAG_IN_WRITE/RTX_QUEUE for tcp_fragment use (Florian Westphal) [1729410 1723032]
  - [net] tcp: avoid fragmenting peculiar skbs in SACK (Hangbin Liu) [1729410 1723032]
  - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719911 1719915] {CVE-2019-11479}
  - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719911 1719915] {CVE-2019-11479}
  - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719846 1719850] {CVE-2019-11478}
  - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1720458 1719595] {CVE-2019-11477}
  - [net] tcp: pass previous skb to tcp_shifted_skb() (Florian Westphal) [1720458 1719595] {CVE-2019-11477}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-514.68.1.el7]
changelog:
  - [mm] shm_mnt is as longterm as it gets (Aaron Tomlin) [1737375 1597314]
  - [mm] vmscan: Do not wait for page writeback for GFP_NOFS allocations (Rafael Aquini) [1729105 1433103]
  - [mm] vmscan: disable memcg direct reclaim stalling if cgroup writeback support is in use (Rafael Aquini) [1729105 1433103]
  - [documentation] Documentation: Add swapgs description to the Spectre v1 documentation (Waiman Long) [1724506 1724510] {CVE-2019-1125}
  - [documentation] Documentation: Add section about CPU vulnerabilities for Spectre (Waiman Long) [1724506 1724510] {CVE-2019-1125}
  - [x86] x86/speculation/swapgs: Exclude ATOMs from speculation through SWAPGS (Waiman Long) [1724506 1724510] {CVE-2019-1125}
  - [x86] x86/speculation: Enable Spectre v1 swapgs mitigations (Waiman Long) [1724506 1724510] {CVE-2019-1125}
  - [x86] x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations (Waiman Long) [1724506 1724510] {CVE-2019-1125}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-514.70.1.el7]
changelog:
  - [net] Bluetooth: Fix faulty expression for minimum encryption key size check (Gopal Tiwari) [1743081 1743085] {CVE-2019-9506}
  - [net] Bluetooth: Fix regression with minimum encryption key size alignment (Gopal Tiwari) [1743081 1743085] {CVE-2019-9506}
  - [net] Bluetooth: Align minimum encryption key size for LE and BR/EDR connections (Gopal Tiwari) [1743081 1743085] {CVE-2019-9506}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-514.70.2.el7]
changelog:
  - [x86] redhat/configs: Enable CONFIG_X86_INTEL_TSX_MODE_ON (Waiman Long) [1766535 1766540] {CVE-2019-11135}
  - [x86] tsx: Add config options to set tsx=on|off|auto (Waiman Long) [1766535 1766540] {CVE-2019-11135}
  - [x86] speculation/taa: Add documentation for TSX Async Abort (Waiman Long) [1766535 1766540] {CVE-2019-11135}
  - [x86] tsx: Add "auto" option to the tsx= cmdline parameter (Waiman Long) [1766535 1766540] {CVE-2019-11135}
  - [x86] speculation/taa: Add sysfs reporting for TSX Async Abort (Waiman Long) [1766535 1766540] {CVE-2019-11135}
  - [x86] speculation/taa: Add mitigation for TSX Async Abort (Waiman Long) [1766535 1766540] {CVE-2019-11135}
  - [x86] cpu: Add a "tsx=" cmdline option with TSX disabled by default (Waiman Long) [1766535 1766540] {CVE-2019-11135}
  - [x86] cpu: Add a helper function x86_read_arch_cap_msr() (Waiman Long) [1766535 1766540] {CVE-2019-11135}
  - [x86] msr: Add the IA32_TSX_CTRL MSR (Waiman Long) [1766535 1766540] {CVE-2019-11135}
  - [documentation] Add ITLB_MULTIHIT documentation (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Recovery of shattered NX large pages (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm: Add helper function for creating VM worker threads (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm: mmu: ITLB_MULTIHIT mitigation (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] Add ITLB_MULTIHIT bug infrastructure (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm: vmx, svm: always run with EFER.NXE=1 when shadow paging is active (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm: add tracepoints around __direct_map and FNAME(fetch) (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm: remove now unneeded hugepage gfn adjustment (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm: make FNAME(fetch) and __direct_map more similar (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Do not release the page inside mmu_set_spte() (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Remove unused parameter of __direct_map() (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm: Convert kvm_lock to a mutex (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: drop vcpu param in gpte_access (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm: extend usage of RET_MMIO_PF_* constants (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm: simplify ept_misconfig (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Remove unused parameter parent_pte from kvm_mmu_get_page() (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Move parent_pte handling from kvm_mmu_get_page() to link_shadow_page() (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Move initialization of parent_ptes out from kvm_mmu_alloc_page() (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Make mmu_set_spte() return emulate value (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm: Take out __exit annotation in vmx_exit() (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: always terminate page walks at level 1 (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: introduce kvm_mmu_gfn_{allow, disallow}_lpage (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: rename has_wrprotected_page to mmu_gfn_lpage_is_disallowed (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Move handle_mmio_page_fault() call to kvm_mmu_page_fault() (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Consolidate quickly_check_mmio_pf() and is_mmio_page_fault() (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Encapsulate the type of rmap-chain head in a new struct (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Eliminate an extra memory slot search in mapping_level() (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Remove mapping_level_dirty_bitmap() (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Move mapping_level_dirty_bitmap() call in mapping_level() (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Simplify force_pt_level calculation code in FNAME(page_fault)() (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Make force_pt_level bool (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [kernel] kthread: export kthread functions (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [gpu] drm/i915/gen8+: Add RC6 CTX corruption WA (Dave Airlie) [1756811 1756816] {CVE-2019-0154}
  - [gpu] drm/i915: Lower RM timeout to avoid DSI hard hangs (Dave Airlie) [1756811 1756816] {CVE-2019-0154}
  - [gpu] drm/i915/cmdparser: Ignore Length operands during command matching (Dave Airlie) [1756878 1756883] {CVE-2019-0155}
  - [gpu] drm/i915/cmdparser: Add support for backward jumps (Dave Airlie) [1756878 1756883] {CVE-2019-0155}
  - [gpu] drm/i915: Add gen9 BCS cmdparsing (Dave Airlie) [1756878 1756883] {CVE-2019-0155}
  - [gpu] drm/i915: Allow parsing of unsized batches (Dave Airlie) [1756878 1756883] {CVE-2019-0155}
  - [gpu] drm/i915: Support ro ppgtt mapped cmdparser shadow buffers (Dave Airlie) [1756878 1756883] {CVE-2019-0155}
  - [gpu] drm/i915: Add support for mandatory cmdparsing (Dave Airlie) [1756878 1756883] {CVE-2019-0155}
  - [gpu] drm/i915: Remove Master tables from cmdparser (Dave Airlie) [1756878 1756883] {CVE-2019-0155}
  - [gpu] drm/i915: Disable Secure Batches for gen6+ (Dave Airlie) [1756878 1756883] {CVE-2019-0155}
  - [gpu] drm/i915: Rename gen7 cmdparser tables (Dave Airlie) [1756878 1756883] {CVE-2019-0155}
  - [gpu] drm/i915/gtt: Disable read-only support under GVT (Dave Airlie) [1756878 1756883] {CVE-2019-0155}
  - [gpu] drm/i915/gtt: Read-only pages for insert_entries on bdw+ (Dave Airlie) [1756878 1756883] {CVE-2019-0155}
  - [gpu] drm/i915/gtt: Add read only pages to gen8_pte_encode (Dave Airlie) [1756878 1756883] {CVE-2019-0155}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-514.70.3.el7]
changelog:
  - [drm] drm/i915/cmdparser: Fix jump whitelist clearing (Dave Airlie) [1756878 1756883] {CVE-2019-0155}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-514.71.1.el7]
changelog:
  - [mm] mincore.c: make mincore() more conservative (Vladis Dronov) [1749334 1664199] {CVE-2019-5489}
  - [net] udp: consistently apply ufo or fragmentation (Davide Caratti) [1725185 1481535] {CVE-2017-1000112}
  - [net] udp: account for current skb length when deciding about UFO (Davide Caratti) [1725185 1481535] {CVE-2017-1000112}
  - [net] ipv4: Should use consistent conditional judgement for ip fragment in __ip_append_data and ip_finish_output (Davide Caratti) [1725185 1481535] {CVE-2017-1000112}
  - [net] udp: avoid ufo handling on IP payload compression packets (Stefano Brivio) [1725185 1464161]
  - [net] netfilter: ebtables: fix erroneous reject of last rule (Florian Westphal) [1725182 1552370] {CVE-2018-1068}
  - [net] netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets (Florian Westphal) [1725182 1552370] {CVE-2018-1068}
  - [net] netfilter: bridge: ebt_among: add more missing match size checks (Florian Westphal) [1725182 1552370] {CVE-2018-1068}
  - [net] netfilter: bridge: ebt_among: add missing match size checks (Florian Westphal) [1725182 1552370] {CVE-2018-1068}
  - [fs] Fix up non-directory creation in SGID directories (Miklos Szeredi) [1725179 1600953] {CVE-2018-13405}
  - [net] packet: fix a race in packet_bind() and packet_notifier() (Andrea Claudi) [1725173 1643681] {CVE-2018-18559}
  - [net] Set sk_prot_creator when cloning sockets to the right proto (Andrea Claudi) [1725170 1657352] {CVE-2018-9568}
  - [net] ipv6: Paritially checksum full MTU frames (Vlad Yasevich) [1773816 1420109]
  - [net] ipv6: Should use consistent conditional judgement for ip6 fragment between __ip6_append_data and ip6_finish_output (Vlad Yasevich) [1773816 1420109]
  - [net] udp: disallow UFO for sockets with SO_NO_CHECK option (Vlad Yasevich) [1773816 1420109]
  - [net] udp: only allow UFO for packets from SOCK_DGRAM sockets (Vlad Yasevich) [1773816 1420109]
  - [net] ipv6: Don't use ufo handling on later transformed packets (Jakub Sitnicki) [1774503 1388846]
  - [drm] drm/i915/cmdparser: Fix jump whitelist clearing (Dave Airlie) [1756878 1756883] {CVE-2019-0155}
  - [gpu] drm/i915/gen8+: Add RC6 CTX corruption WA (Dave Airlie) [1756811 1756816] {CVE-2019-0154}
  - [gpu] drm/i915: Lower RM timeout to avoid DSI hard hangs (Dave Airlie) [1756811 1756816] {CVE-2019-0154}
  - [gpu] drm/i915/cmdparser: Ignore Length operands during command matching (Dave Airlie) [1756878 1756883] {CVE-2019-0155}
  - [gpu] drm/i915/cmdparser: Add support for backward jumps (Dave Airlie) [1756878 1756883] {CVE-2019-0155}
  - [gpu] drm/i915: Add gen9 BCS cmdparsing (Dave Airlie) [1756878 1756883] {CVE-2019-0155}
  - [gpu] drm/i915: Allow parsing of unsized batches (Dave Airlie) [1756878 1756883] {CVE-2019-0155}
  - [gpu] drm/i915: Support ro ppgtt mapped cmdparser shadow buffers (Dave Airlie) [1756878 1756883] {CVE-2019-0155}
  - [gpu] drm/i915: Add support for mandatory cmdparsing (Dave Airlie) [1756878 1756883] {CVE-2019-0155}
  - [gpu] drm/i915: Remove Master tables from cmdparser (Dave Airlie) [1756878 1756883] {CVE-2019-0155}
  - [gpu] drm/i915: Disable Secure Batches for gen6+ (Dave Airlie) [1756878 1756883] {CVE-2019-0155}
  - [gpu] drm/i915: Rename gen7 cmdparser tables (Dave Airlie) [1756878 1756883] {CVE-2019-0155}
  - [gpu] drm/i915/gtt: Disable read-only support under GVT (Dave Airlie) [1756878 1756883] {CVE-2019-0155}
  - [gpu] drm/i915/gtt: Read-only pages for insert_entries on bdw+ (Dave Airlie) [1756878 1756883] {CVE-2019-0155}
  - [gpu] drm/i915/gtt: Add read only pages to gen8_pte_encode (Dave Airlie) [1756878 1756883] {CVE-2019-0155}
  - [x86] redhat/configs: Enable CONFIG_X86_INTEL_TSX_MODE_ON (Waiman Long) [1766535 1766540] {CVE-2019-11135}
  - [x86] tsx: Add config options to set tsx=on|off|auto (Waiman Long) [1766535 1766540] {CVE-2019-11135}
  - [x86] speculation/taa: Add documentation for TSX Async Abort (Waiman Long) [1766535 1766540] {CVE-2019-11135}
  - [x86] tsx: Add "auto" option to the tsx= cmdline parameter (Waiman Long) [1766535 1766540] {CVE-2019-11135}
  - [x86] speculation/taa: Add sysfs reporting for TSX Async Abort (Waiman Long) [1766535 1766540] {CVE-2019-11135}
  - [x86] speculation/taa: Add mitigation for TSX Async Abort (Waiman Long) [1766535 1766540] {CVE-2019-11135}
  - [x86] cpu: Add a "tsx=" cmdline option with TSX disabled by default (Waiman Long) [1766535 1766540] {CVE-2019-11135}
  - [x86] cpu: Add a helper function x86_read_arch_cap_msr() (Waiman Long) [1766535 1766540] {CVE-2019-11135}
  - [x86] msr: Add the IA32_TSX_CTRL MSR (Waiman Long) [1766535 1766540] {CVE-2019-11135}
  - [documentation] Add ITLB_MULTIHIT documentation (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Recovery of shattered NX large pages (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm: Add helper function for creating VM worker threads (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm: mmu: ITLB_MULTIHIT mitigation (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] Add ITLB_MULTIHIT bug infrastructure (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm: vmx, svm: always run with EFER.NXE=1 when shadow paging is active (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm: add tracepoints around __direct_map and FNAME(fetch) (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm: remove now unneeded hugepage gfn adjustment (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm: make FNAME(fetch) and __direct_map more similar (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Do not release the page inside mmu_set_spte() (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Remove unused parameter of __direct_map() (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm: Convert kvm_lock to a mutex (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: drop vcpu param in gpte_access (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm: extend usage of RET_MMIO_PF_* constants (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm: simplify ept_misconfig (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Remove unused parameter parent_pte from kvm_mmu_get_page() (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Move parent_pte handling from kvm_mmu_get_page() to link_shadow_page() (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Move initialization of parent_ptes out from kvm_mmu_alloc_page() (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Make mmu_set_spte() return emulate value (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm: Take out __exit annotation in vmx_exit() (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: always terminate page walks at level 1 (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: introduce kvm_mmu_gfn_{allow, disallow}_lpage (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: rename has_wrprotected_page to mmu_gfn_lpage_is_disallowed (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Move handle_mmio_page_fault() call to kvm_mmu_page_fault() (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Consolidate quickly_check_mmio_pf() and is_mmio_page_fault() (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Encapsulate the type of rmap-chain head in a new struct (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Eliminate an extra memory slot search in mapping_level() (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Remove mapping_level_dirty_bitmap() (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Move mapping_level_dirty_bitmap() call in mapping_level() (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Simplify force_pt_level calculation code in FNAME(page_fault)() (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [x86] kvm/mmu: Make force_pt_level bool (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [kernel] kthread: export kthread functions (Paolo Bonzini) [1698412 1690343] {CVE-2018-12207}
  - [net] xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder (Hannes Frederic Sowa) [1725184 1435670] {CVE-2017-7184}
  - [net] xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window (Hannes Frederic Sowa) [1725184 1435670] {CVE-2017-7184}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-514.72.1.el7]
changelog:
  - [fs] xfs: clear sb->s_fs_info on mount failure (Bill O'Donnell) [1783128 1591800] {CVE-2018-20976}
  - [tools] perf tools: Fix copyfile_offset update of output offset (Jiri Olsa) [1782749 1641373]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-514.73.1.el7]
changelog:
  - [fs] fs: don't scan the inode cache before SB_BORN is set (Bill O'Donnell) [1795578 1591800]
  - [fs] xfs: add mount delay debug option (Bill O'Donnell) [1795578 1591800]
  - [net] cfg80211: wext: avoid copying malformed SSIDs (Stanislaw Gruszka) [1778627 1778632] {CVE-2019-17133}
  - [netdrv] mwifiex: Fix three heap overflow at parsing element in cfg80211_ap_settings (Augusto Caringi) [1776611 1776616] {CVE-2019-14816}
  - [netdrv] mwifiex: vendor_ie length check for parse WMM IEs (Augusto Caringi) [1776611 1776616] {CVE-2019-14816}
  - [wireless] mwifiex: fix possible heap overflow in mwifiex_process_country_ie() (Stanislaw Gruszka) [1776201 1776206] {CVE-2019-14895}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-514.74.1.el7]
changelog:
  - [wireless] rtlwifi: Fix potential overflow on P2P code (Josef Oskera) [1775230 1775236] {CVE-2019-17666}


author: Patrick Talbert <ptalbert@redhat.com> [3.10.0-514.75.1.el7]
changelog:
  - [kernel] tracing: Fix possible double free on failure of allocating trace buffer (Jerome Marchand) [1802951 1802957] {CVE-2017-18595}
  - [kernel] tracing: Fix crash when it fails to alloc ring buffer (Jerome Marchand) [1802951 1802957] {CVE-2017-18595}
  - [kernel] blktrace: fix dereference after null check (Ming Lei) [1798312 1798318] {CVE-2019-19768}
  - [kernel] blktrace: Protect q->blk_trace with RCU (Ming Lei) [1798312 1798318] {CVE-2019-19768}
  - [kernel] blktrace: fix trace mutex deadlock (Ming Lei) [1798312 1798318] {CVE-2019-19768}
  - [kernel] blktrace: fix unlocked registration of tracepoints (Ming Lei) [1798312 1798318] {CVE-2019-19768}
  - [kernel] blktrace: fix unlocked access to init/start-stop/teardown (Ming Lei) [1798312 1798318] {CVE-2019-19768}
  - [kernel] blktrace: Fix potential deadlock between delete & sysfs ops (Brian Masney) [1798312 1798318] {CVE-2019-19768}


author: Patrick Talbert <ptalbert@redhat.com> [3.10.0-514.77.1.el7]
changelog:
  - [x86] x86/speculation: Support old struct x86_cpu_id & x86_match_cpu() kABI (Waiman Long) [1840675 1827188] {CVE-2020-0543}
  - [documentation] x86/speculation: Add Ivy Bridge to affected list (Waiman Long) [1840675 1827188] {CVE-2020-0543}
  - [documentation] x86/speculation: Add SRBDS vulnerability and mitigation documentation (Waiman Long) [1840675 1827188] {CVE-2020-0543}
  - [x86] x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation (Waiman Long) [1840675 1827188] {CVE-2020-0543}
  - [x86] x86/cpu: Add 'table' argument to cpu_matches() (Waiman Long) [1840675 1827188] {CVE-2020-0543}
  - [x86] x86/cpu: Add a steppings field to struct x86_cpu_id (Waiman Long) [1840675 1827188] {CVE-2020-0543}
  - [x86] x86/cpu/bugs: Convert to new matching macros (Waiman Long) [1840675 1827188] {CVE-2020-0543}
  - [x86] x86/cpu: Add consistent CPU match macros (Waiman Long) [1840675 1827188] {CVE-2020-0543}
  - [cpufreq] x86/devicetable: Move x86 specific macro out of generic code (Waiman Long) [1840675 1827188] {CVE-2020-0543}
  - [x86] x86/cpufeature: Fix various quality problems in the <asm/cpu_device_hd.h> header (Waiman Long) [1840675 1827188] {CVE-2020-0543}
  - [x86] cpufeature: Add facility to check for min microcode revisions (Jiri Olsa) [1840675 1482406]


author: Patrick Talbert <ptalbert@redhat.com> [3.10.0-514.78.1.el7]
changelog:
  - [wireless] mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status() (Jarod Wilson) [1844065 1844070] {CVE-2020-12654}
  - [wireless] mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv() (Jarod Wilson) [1844020 1844026] {CVE-2020-12653}
  - [vfio] vfio-pci: Invalidate mmaps and block MMIO access on disabled memory (Patrick Talbert) [1837292 1820632] {CVE-2020-12888}
  - [vfio] vfio-pci: Fault mmaps to enable vma tracking (Patrick Talbert) [1837292 1820632] {CVE-2020-12888}
  - [vfio] vfio/type1: Support faulting PFNMAP vmas (Patrick Talbert) [1837292 1820632] {CVE-2020-12888}
  - [vfio] vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn() (Patrick Talbert) [1837292 1820632] {CVE-2020-12888}
  - [vfio] vfio/pci: call irq_bypass_unregister_producer() before freeing irq (Patrick Talbert) [1837292 1820632] {CVE-2020-12888}
  - [vfio] vfio_pci: Enable memory accesses before calling pci_map_rom (Patrick Talbert) [1837292 1820632] {CVE-2020-12888}


author: Eugene Syromiatnikov <esyr@redhat.com> 4.4.0_k_rh7.4_z-1
changelog:
  - 6591372b59cec0e59cd144bed3e51ba8ceb2dd88
  - ixgbe module for Driver Update Program
  - Resolves: #bz1439814


author: Eugene Syromiatnikov <esyr@redhat.com> 4.4.0_k_rh7.4_z-2
changelog:
  - Remove testing desclaimer from the package description
  - 6591372b59cec0e59cd144bed3e51ba8ceb2dd88
  - ixgbe module for Driver Update Program
  - Resolves: #bz1439814


author: zhoushoujian <zhoushoujianwork@163.com> 4.4.0_k_rh7.4_z-2
changelog:
  - 6591372b59cec0e59cd144bed3e51ba8ceb2dd88
  - ixgbe module for Driver Update Program
  - for kernel-rt
  - Resolves: #bz1439814


author: zhoushoujian CMSS <zhoushoujianwork@163.com> 3.2.2_k_rh7.4_z-1
changelog:
  - Resolves: #bz1441298
  - 5e0df6596e78194c6dc5dd0a038302b7fbdfb4c3
  - ixgbevf module for Driver Update Program


author: zhoushoujian <zhoushoujianwork@163.com> 3.2.2_k_rh7.4_z-1
changelog:
  - Resolves: #bz1441298
  - 5e0df6596e78194c6dc5dd0a038302b7fbdfb4c3
  - ixgbevf module for Driver Update Program
  - for kernel-rt


author: Eugene Syromiatnikov <esyr@redhat.com> 07.700.00.00
changelog:
  - 5c36dd7d22747abb333b0c2541bac9544c358e3b
  - Resolves: #bz1427425
  - megaraid_sas module for Driver Update Program.


author: Eugene Syromiatnikov <esyr@redhat.com> 4.11.0_dup7.3-1
changelog:
  - Resolves: #bz1462099
  - 8d4022de88b02a390621a2bf9614b25b094951f8
  - mgag200 module for Driver Update Program


author: Eugene Syromiatnikov <esyr@redhat.com> 4.11.0_dup7.3-5
changelog:
  - 8d4022de88b02a390621a2bf9614b25b094951f8
  - Provide fix for the #bz1463535 as a separate patch in order to preserve
    the integrity of sources.


author: zhoushoujian CMSS <zhoushoujianwork@163.com> 4.11.0_dup7.3-5
changelog:
  - Provide fix for the #bz1463535 as a separate patch in order to preserve
    the integrity of sources.


author: zhoushoujian <zhoushoujianwork@163.com> 4.11.0_dup7.3-5
changelog:
  - Provide fix for the #bz1463535 as a separate patch in order to preserve
    the integrity of sources.
  - for kernel-rt


author: Eugene Syromiatnikov <esyr@redhat.com> 14.101.00.00-1
changelog:
  - a2d3cbe3e7f414a5d0c8a9d931ddaf4dbc40c12d
  - Resolves: #rhbz1421748
  - mpt3sas module for Driver Update Program.


author: Eugene Syromiatnikov <esyr@redhat.com> 8.10.10.21_dup7.3-1
changelog:
  - d44f90c087a53365ef671c1a6414d07fd8bf4af0
  - Resolves: #bz1448409, #bz1448411
  - qed module for Driver Update Program


author: zhoushoujian CMSS <zhoushoujianwork@163.com> 8.10.10.21_dup7.3-1
changelog:
  - Resolves: #bz1448411
  - 4fba2334c2fb174d98a4fabafd078f7b283b5622
  - qede module for Driver Update Program


author: zhoushoujian CMSS <zhoushoujianwork@163.com> 8.10.7.0_dup7.3-1
changelog:
  - Resolves: #bz1448408
  - e22c53a31fd2776bd02b4be1d9f93db5b5f8d678
  - qedf module for Driver Update Program


author: Eugene Syromiatnikov <esyr@redhat.com> 1.6.27_k_dup7.3-1
changelog:
  - Resolves: #bz1448412
  - af7d3667969d1dedc990b0aa47458756796961c6
  - i40e module for Driver Update Program


author: Eugene Syromiatnikov <esyr@redhat.com> 1.6.27_k_dup7.3-1
changelog:
  - Resolves: #bz1448413
  - 3545087798c48e481b8ae8aebcca6bfb199b470b
  - i40evf module for Driver Update Program


author: Rich Megginson <rmeggins@redhat.com> 0:4.18-8
changelog:
  - Resolves: bug 684012 - LDAPSchemaElement.getOptionalValues() mangles values
  - upstream bug https://bugzilla.mozilla.org/show_bug.cgi?id=640750


author: Luboš Uhliarik <luhliari@redhat.com> - 4.4.8-6
changelog:
  - Fix lftp does not follow http redirect (302) in mirror mode (#1181580)
  - Fix lftp exists randomly when "cmd:fail-exit" is set (#1193984)
  - Added RFE - lftp configurations for restricting each SSL/TLS 
    version (#1182987)
  - Fixed bogus dates of this SPEC


author: Michal Ruprich - 4.4.8-9
changelog:
  - Resolves: #1392944 - File size decreases when synchronizing folders with a sftp account using lftp


author: Karel Zak <kzak@redhat.com> 2.23.2-29
changelog:
  - fix #1029385 - lack of non-ascii support
  - fix #1092520 - util-linux - PIE and RELRO check
  - fix #1153770 - backport lsipc
  - fix #1248003 - mount only parses <param>=<value> lines from fstab fs_spec field available from blkid block device
  - fix #1271850 - mount -a doesn't catch a typo in /etc/fstab and a typo in /etc/fstab can make a system not reboot properly
  - fix #1281839 - [RFE]Bind mounts should be handled gracefully by the operating system
  - fix #1290689 - util-linux: /bin/login does not retry getpwnam_r with larger buffers, leading to login failure
  - fix #1296366 - Bash completion for more(1) handles file names with spaces incorrectly
  - fix #1296521 - RHEL7: update audit event in hwclock
  - fix #1298384 - RFE: add SCHED_DEADLINE support to chrt
  - fix #1304246 - fdisk 'f' subcommand updates partition ranges wrongly
  - fix #1304426 - [rfe] /bin/su should be improved to reduce stack use
  - fix #1326615 - util-linux/lscpu: Fix model and model name on Power Systems
  - fix #1327886 - Backport blkdiscard's "-z" flag to RHEL
  - fix #1332084 - [RFE] Inclusion of lsns command in util-linux Package
  - fix #1335671 - extra quotes around UUID confuses findfs in RHEL (but not in Fedora)
  - fix #1344222 - logger port option in help is misleading
  - fix #1344482 - util-linux fails valid_pmbr() size checks if device is > 2.14TB, Device label type: dos instead of gpt
  - fix #587393 - [RFE] Make sure util-linux is ready for writable overlays


author: Karel Zak <kzak@redhat.com> 2.23.2-32
changelog:
  - improve patch for chrt(1) deadline support #1298384
  - fix #1007734 - blkid shows devices as /dev/block/$MAJOR:$MINOR
  - fix #1349536 - Extended partition loop in MBR partition table leads to DOS


author: Tomáš Mráz <tmraz@redhat.com> 1.5.3-5
changelog:
  - add FIPS DRBG implementation
  - run the FIPS POST tests in shared library constructor
  - make it possible to run the test suite in the FIPS mode


author: Tomáš Mráz <tmraz@redhat.com> 1.5.3-13
changelog:
  - touch only urandom in the selftest and when /dev/random is
    unavailable for example by SELinux confinement
  - fix the RSA selftest key (p q swap)


author: Michal Sekletar <msekleta@redhat.com> - 219-30.5
changelog:
  - on update from systemd version 219-21 and older generate udev rules that preserve old network interface names on VMware VMs (#1391944)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-30.7
changelog:
  - load-fragment: fix parsing values in bytes and prevent returning -ERANGE incorrectly (#1396277)
  - core: fix assertion check (#1396312)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-30.8
changelog:
  - tmp.mount.hm4: After swap.target (#3087) (#1298355)
  - make sure all swap units are ordered before the swap target (#1298355)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-30.9
changelog:
  - core: reinstate propagation of stop/restart jobs via RequsiteOf dependencies (#1436021)
  - core: when propagating restart requests due to deps, downgrade restart to try-restart (#1436021)
  - core: properly handle jobs that are suppressed to JOB_NOPs when propagating restarts (#1436021)


author: Michal Sekletár <msekleta@redhat.com> - 219-30.11
changelog:
  - add Obsoletes deps to networkd, resolved and journal-gateway subpackages to force remove older versions (#1703945)


author: Michal Sekletár <msekleta@redhat.com> - 219-30.12
changelog:
  - revert previous change, i.e. additional Obsoletes from the main package on Optional subpackages (#1703945)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-30.13
changelog:
  - journald: do not store the iovec entry for process commandline on stack (#1724850)
  - journald: set a limit on the number of fields (1k) (#1724851)
  - journal-remote: set a limit on the number of fields in a message (#1724851)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-30.14
changelog:
  - Refuse dbus message paths longer than BUS_PATH_SIZE_MAX limit. (#1724848)
  - Allocate temporary strings to hold dbus paths on the heap (#1724848)
  - sd-bus: if we receive an invalid dbus message, ignore and proceeed (#1724848)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-23
changelog:
  - udevadm: explicitly relabel /etc/udev/hwdb.bin after rename (#1350756)
  - systemctl: return diffrent error code if service exist or not (#3385) (#1047466)
  - systemctl: Replace init script error codes with enum (#3400) (#1047466)
  - systemctl: rework "systemctl status" a bit (#1047466)
  - journal-verify: don't hit SIGFPE when determining progress (#1350232)
  - journal: avoid mapping empty data and field hash tables (#1350232)
  - journal: when verifying journal files, handle empty ones nicely (#1350232)
  - journal: explain the error when we find a non-DATA object that is compressed (#1350232)
  - journalctl: properly detect empty journal files (#1350232)
  - journal: uppercase first character in verify error messages (#1350232)
  - journalctl: make sure 'journalctl -f -t unmatched' blocks (#1350232)
  - journalctl: don't print -- No entries -- in quiet mode (#1350232)
  - sd-event: expose the event loop iteration counter via sd_event_get_iteration() (#1342173)
  - manager: Only invoke a single sigchld per unit within a cleanup cycle (#1342173)
  - manager: Fixing a debug printf formatting mistake (#1342173)
  - core: support IEC suffixes for RLIMIT stuff (#1351415)
  - core: accept time units for time-based resource limits (#1351415)
  - time-util: add parse_time(), which is like parse_sec() but allows specification of default time unit if none is specified (#1351415)
  - core: support <soft:hard> ranges for RLIMIT options (#1351415)
  - core: fix rlimit parsing (#1351415)
  - core: dump rlim_cur too (#1351415)
  - install: fix disable via unit file path (#1348208)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-25
changelog:
  - units: increase watchdog timeout to 3min for all our services (#1267707)
  - core: bump net.unix.max_dgram_qlen really early during boot (#1267707)
  - core: fix priority ordering in notify-handling (#1267707)
  - tests: fix personality tests on ppc64 and aarch64 (#1361049)
  - systemctl: consider service running only when it is in active or reloading state (#3874) (#1362461)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-26
changelog:
  - install: do not crash when processing empty (masked) unit file (#1159308)
  - Revert "install: fix disable via unit file path" (#1348208)
  - systemctl: allow disable on the unit file path, but warn about it (#3806) (#1348208)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-27
changelog:
  - tmpfiles: enforce ordering when executing lines (#1365870)
  - Introduce bus_unit_check_load_state() helper (#1256858)
  - core: use bus_unit_check_load_state() in transaction_add_job_and_dependencies() (#1256858)
  - udev/path_id: correct segmentation fault due to missing NULL check (#1365556)
  - rules: load sg driver also when scsi_target appears (#45) (#1322773)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-29
changelog:
  - fix gcc warnings about uninitialized variables (#1318994)
  - journalctl: rework code that checks whether we have access to /var/log/journal (#1318994)
  - journalctl: Improve boot ID lookup (#1318994)
  - journalctl: only have a single exit path from main() (#1318994)
  - journalctl: free all command line argument objects (#1318994)
  - journalctl: rename boot_id_t to BootId (#1318994)
  - util: introduce CMSG_FOREACH() macro and make use of it everywhere (#1318994)
  - journald: don't employ inner loop for reading from incoming sockets (#1318994)
  - journald: fix count of object meta fields (#1318994)
  - journal-cat: return a correct error, not -1 (#1318994)
  - journalctl: introduce short options for --since and --until (#1318994)
  - journal: s/Envalid/Invalid/ (#1318994)
  - journald: dispatch SIGTERM/SIGINT with a low priority (#1318994)
  - lz4: fix size check which had no chance of working on big-endian (#1318994)
  - journal: normalize priority of logging sources (#1318994)
  - Fix miscalculated buffer size and uses of size-unlimited sprintf() function. (#1318994)
  - journal: Drop monotonicity check when appending to journal file (#1318994)
  - journalctl: unify how we free boot id lists a bit (#1318994)
  - journalctl: don't trust the per-field entry tables when looking for boot IDs (#1318994)
  - units: remove udev control socket when systemd stops the socket unit (#49) (#1370133)
  - logind: don't assert if the slice is missing (#1371437)
  - core: enable transient unit support for slice units (#1370299)
  - sd-bus: bump message queue size (#1371205)
  - install: fix disable when /etc/systemd/system is a symlink (#1285996)
  - rules: add NVMe rules (#3136) (#1274651)
  - rules: introduce disk/by-id (model_serial) symlinks for NVMe drives (#3974) (#1274651)
  - rules: fix for possible whitespace in the "model" attribute (#1274651)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-30
changelog:
  - systemctl,pid1: do not warn about missing install info with "preset" (#1373950)
  - systemctl/core: ignore masked units in preset-all (#1375097)
  - shared/install: handle dangling aliases as an explicit case, report nicely (#1375097)
  - shared/install: ignore unit symlinks when doing preset-all (#1375097)
  - 40-redhat.rules: don't hoplug memory on s390x (#1370161)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-30.1
changelog:
  - If the notification message length is 0, ignore the message (#4237) (#1381573)
  - systemctl: suppress errors with "show" for nonexistent units and properties (#1380686)
  - 40-redhat.rules: disable auto-online of hot-plugged memory on IBM z Systems (#1381123)
  - pid1: don't return any error in manager_dispatch_notify_fd() (#4240) (#1381573)
  - pid1: process zero-length notification messages again (#1381573)
  - pid1: more informative error message for ignored notifications (#1381573)


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.28.1-1.50
changelog:
  - v2v:
    * When debugging, dump OVF to stderr.
    * Ignore missing kernels from grub
      resolves: rhbz#1230412
    * Calculate VMware dcPath correctly (1256823)
    * Map empty VMware network or bridge name to default (1257895)
  - p2v:
    * Wait for network to come online before testing connection
      resolves: rhbz#1256222
  - Fix tests to run correctly with libguestfs-winsupport 7.2.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.28.1-1.51
changelog:
  - v2v: Fix handling of extra slashes in dcPath calculation
    resolves: rhbz#1258342 rhbz#1256823
  - v2v: Fix -oa preallocation option
    resolves: rhbz#1251909


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.28.1-1.52
changelog:
  - v2v: Warn if Group Policy or AV software may result in 7B boot failure
    (1260689)
  - v2v: Fix OVF XML to enable qxl display
    resolves: rhbz#1260590


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.28.1-1.53
changelog:
  - v2v: Error if certain options appear twice on the command line (1261242)
  - v2v: Add --dcpath parameter to allow dcPath to be overridden (1256823)
  - v2v: Partially revert: Fix OVF XML to enable qxl display (1260590)
  - v2v: Detect AVG Technologies as AV software (1261436)
    resolves: rhbz#1261281


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.32.7-3
changelog:
  - Rebase to libguestfs 1.32 in RHEL 7.3
    resolves: rhbz#1218766
  - The full tests are now run after the package has been built.
  - New tool and subpackage: virt-dib (safe diskimage-builder replacement).
  - New subpackage libguestfs-inspect-icons to reduce dependencies of main pkg
    (see https://bugzilla.redhat.com/1194158).
  - New tool: virt-get-kernel.
  - Depend on java-headless instead of full java.
  - New tool: virt-v2v-copy-to-local.
  - Disable virt-v2v subpackage on ppc64 etc
    resolves: rhbz#1287826
  - v2v: Remove VirtualBox Additions correctly
    resolves: rhbz#1296606
  - Add clearer warnings sections to all man pages
    resolves: rhbz#1293527
  - v2v: Disable the --in-place option.
  - v2v: Support conversion of Windows > 7
    resolves: rhbz#1190669
  - Add code to verify tarball signatures.
  - General performance improvements.
  - v2v: Prevent duplicate -b, -n, -oa options
    resolves: rhbz#1326266
    resolves: rhbz#1325825
  - v2v: Unquote UUID and LABEL in fstab (util-linux 1335671)
  - v2v: Fix alignment issues in treeviews in conversion dialog
    resolves: rhbz#1340407
  - p2v: spinner should be hidden when it stops spinning
    resolves: rhbz#1341564
  - p2v: ethtool command is not supported on p2v client
    resolves: rhbz#1341608
  - p2v: Add ifconfig command to ISO
    resolves: rhbz#1342447
  - p2v: Warn if virt-p2v-make-disk used on a partition
    resolves: rhbz#1342337
  - Build using OCaml with fix for CVE-2015-8869.
    resolves: rhbz#1343101
  - customize: Add --uninstall option (upstream 1343375)
  - p2v: Document permissions on id_rsa file
    resolves: rhbz#1343414
  - p2v: Print full curl error message
    resolves: rhbz#1343423
  - get-kernel: Fix --format auto
    resolves: rhbz#1341984
  - v2v: Provide better <Origin/> information to RHEV-M
    resolves: rhbz#1342398
  - customize: Give an error if --truncate-recursive path does not exist
    resolves: rhbz#1345809
  - sysprep: Add --network option so that --install option can be used
    resolves: rhbz#1345813
  - p2v: Print proper error if incorrect password is given
    resolves: rhbz#1227599
  - p2v: Print ssh error if incorrect hostname is given
    resolves: rhbz#1167916
  - p2v: Display progress of operation in non-GUI mode
    resolves: rhbz#1229386
  - p2v: Add a dialog confirming the user really means to cancel
    resolves: rhbz#1340464
  - p2v: log window should process colour escapes and backspaces
    resolves: rhbz#1314244
  - v2v: Fix installation of virtio drivers with *.dll files
    resolves: rhbz#1311373
  - p2v: Improve error message when ssh login to conversion server fails
    resolves: rhbz#1348900
  - v2v: Remove --dcpath parameter from manual
    resolves: rhbz#1315237
  - v2v: Fix conversion of guests with floppy drives
    resolves: rhbz#1309706
  - p2v: Better error when sudo requires a password
    resolves: rhbz#1340809
  - v2v: Refuse to convert if there is < 1GB free in temporary directory
    resolves: rhbz#1316479
  - inspection: Get Windows drive letters for GPT disks
    resolves: rhbz#1349237
  - p2v: Add disk utils and display serial number of disks
    resolves: rhbz#855058
  - p2v: Fix timeout error when connecting to unresponsive ssh server
    resolves: rhbz#1350363
  - Remove external dependency generator.  Use supermin RPM deps instead.
    related: rhbz#1309796
  - p2v: Flush messages to the journal immediately
    resolves: rhbz#1229386
  - customize: Fix --install on ppc64le
    resolves: rhbz#1264835
  - lib: Fix finding icons in Windows 7 64 bit guests
    resolevs: rhbz#1352761
  - v2v: Add virsh --quiet flag when running virt-v2v --quiet
    resolves: rhbz#1358142
  - lib: Fix inspection of ISOs with latest libosinfo
    resolves: rhbz#1359652
  - dib: Fix run_command exit handlers on failure
    resolves: rhbz#1362357
  - dib: Rework run of extra-data.d hooks
    resolves: rhbz#1362354
  - Miscellaneous fixes to man pages and --help output
    resolves: rhbz#1362668
  - lib: Specify backing format for read-only files
    resolves: rhbz#1354335
  - Fix --selinux-relabel option
    resolves: rhbz#1362669
  - sparsify: Fix --in-place option with UEFI guest
    resolves: rhbz#1364347
  - p2v: Use latest linux-firmware in ISO
    resolves: rhbz#1364419
  - v2v: Fix guest name when using -i disk
    resolves: rhbz#1365005
  - p2v: Fix GUI message.
  - v2v: Make fstrim message clearer
    resolves: rhbz#1366456
  - v2v: Fix conversion of UEFI guests when Secure Boot OVMF installed
    resolves: rhbz#1367615
  - lib: Fix assert-fail if port is missing in libvirt XML
    resolves: rhbz#1370424


author: Pino Toscano <ptoscano@redhat.com> - 1:1.32.7-3.el7_3.1
changelog:
  - Fix inspection with UsrMove and /usr in a separate partition
    resolves: rhbz#1406289
  - Disable EDD when launching the appliance
    resolves: rhbz#1406393
  - v2v: add --vdsm-compat=1.1 flag for VDSM
    resolves: rhbz#1406854


author: Pino Toscano <ptoscano@redhat.com> - 1:1.32.7-3.el7_3.2
changelog:
  - v2v: improve import compatibility with OVAs produced by AWS
    resolves: rhbz#1408124
  - Avoid spurious dependency on kernel-rt.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-43.4
changelog:
  - Revert the fix for ignoring sudoUser case as it breaks processing
    of rules that completely lack a sudoUser attribute
  - Related: rhbz#1392946 - sudo: ignore case on case insensitive domains


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-43.6
changelog:
  - Related: rhbz#1396486 - bz - ldap group names don't resolve after
                            upgrading sssd to 1.14.0 if ldap_nesting_level
                            is set to 0


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-43.7
changelog:
  - Resolves: rhbz#1393730 - No supplementary groups are resolved for users
                             in nested OUs when domain stanza differs from AD
                             domain


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-43.11
changelog:
  - Resolves: rhbz#1404340 - Use-after free in resolver in case the fd is
                             writeable and readable at the same time


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-43.12
changelog:
  - Resolves: rhbz#1405584 - SSH: default_domain_suffix is not being used
                             for users' authorized keys


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-43.13
changelog:
  - Resolves: rhbz#1418943 - If a long-running task (e.g. enumeration) blocks the
                             sssd_be process, sssd_be can deadlock
  - Also Require a new-enough version of selinux-policy so that setpgid() by sssd
    is allowed


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-43.14
changelog:
  - Resolves: rhbz#1422183 - Fails to accept any sudo rules if there are
                             two user entries in an ldap role with the same
                             sudo user.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-43.15
changelog:
  - Resolves: rhbz#1445821 - sssd does not evaluate AD UPN suffixes which
                             results in failed user logins


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-43.16
changelog:
  - Resolves: rhbz#1446085 - D-Bus interface of sssd is giving inappropriate
                             group information for trusted AD users


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-43.17
changelog:
  - Resolves: rhbz#1450125 - Wrong pam return code for user from subdomain
                             with ad_access_filter


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-43.18
changelog:
  - Resolves: rhbz#1456013 - sssd intermittently failing to resolve groups
                             for an AD user in IPA-AD trust environment.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-38
changelog:
  - Resolves: rhbz#1372753 - Access denied for user when access_provider =
                             krb5 is set in sssd.conf


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-39
changelog:
  - Resolves: rhbz#1375182 - SSSD goes offline when the LDAP server returns
                             sizelimit exceeded


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-40
changelog:
  - Resolves: rhbz#1375299 - sss_groupshow <user> fails with error "No such
                             group in local domain. Printing groups only
                             allowed in local domain"


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-42
changelog:
  - Resolves: rhbz#1371631 - login using gdm calls for gdm-smartcard when
                             smartcard authentication is not enabled


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-43.1
changelog:
  - Resolves: rhbz#1392896 - AD provider: SSSD does not retrieve a domain-local
                             group with the AD provider when following AGGUDLP
                             group structure across domains


author: Thomas Haller <thaller@redhat.com> - 3.2.21-6
changelog:
  - fix rtnl_link_get_stat() for IPSTATS_MIB_* after kernel API breakage
  - fix parsing IFLA_PROTINFO which broke on older kernels (rh #1062533)
  - fix printing in nl_msec2str for whole seconds
  - don't reset route scope in rtnl_route_build_msg if set to RT_SCOPE_NOWHERE
  - backport nl_has_capability function


author: Thomas Haller <thaller@redhat.com> - 3.2.21-9
changelog:
  - improve local port handling for netlink socket with EADDRINUSE (rh #1249158)
  - rtnl: backport support for link-netnsid attribute (rh #1255050)


author: David Vossel <dvossel@redhat.com> - 0.16.0-4
changelog:
  - Require log filtering to match function and file exactly.
    No substring matching.

  - Fixes complile time issue with 'make check' unit tests.

    Resolves: rhbz#1018091


author: David Vossel <dvossel@redhat.com> - 0.17.1-1
changelog:
  Fix: ipcs: Correctly allocate receive buffer size
    Fix: ipc_socket: Signalhandler must be resetted to Default, use only cleanup_sigpipe to return from qb_ipc_dgram_sock_setup.
    Fix: trie: allow modifying the trie map during the notify callback
    Fix: fix invalid option when run 'ipcclient -h'
    Fix: epoll: don't miss poll events under high load
    Fix: ipc_shm: fix error handling in qb_ipcs_shm_connect()
    Fix: ringbuffer: fix size in qb_rb_create_from_file()
    Fix: ringbuffer: fix qb_rb_open_2() debug format string
    Fix: trie: fixes regression caused by ref count refactoring
    Fix: ipcc: Properly timeout during recv when timeout value is provided

    Resolves: rhbz#1110043
    Resolves: rhbz#975903


author: David Vossel <dvossel@redhat.com> - 0.17.1-1.1
changelog:
  Fix bug that prevents ipc server from working in pid with realtime priority.

    Resolves: rhbz#1198718


author: Christine Caulfield <ccaulfie@redhat.com> - 0.17.1-2.1
changelog:
  Increase size of the buffer where we make the socket name to allow for longer PIDs
    Resolves bz#1114852


author: Dan Walsh <dwalsh@redhat.com> - 2.1.10-14
changelog:
  - Cleanup handling of missing mls_range to fix problems with useradd -Z
  - Fix auditing of login record changes, roles were not working correctly.
  Resolves: #1018840


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-3
changelog:
  - Sort object files for deterministic linking order
  - Support overriding Makefile RANLIB
  - Respect CC and PKG_CONFIG environment variable
  - Fix multiple spelling errors
  - genhomedircon: %{USERID} and %{USERNAME} support and code cleanups


author: Petr Lautrbach <plautrba@redhat.com> 2.5-4
changelog:
  - genhomedircon: add support for Development/Debug syntax
  - genhomedircon: generate contexts for logins mapped to the default user
  - Validate and compile file contexts before installing
  - Swap tcp and udp protocol numbers


author: - Andreas Schneider <asn@redhat.com> - 0.6.1-1
changelog:
  - Update to version 0.6.1.
  - resolves: #1056757 - Fix scp mode.
  - resolves: #1053305 - Fix known_hosts heuristic.


author: Kamil Dudka <kdudka@redhat.com> 1.4.3-9
changelog:
  - curl consumes too much memory during scp download (#1080459)
  - prevent a not-connected agent from closing STDIN (#1147717)


author: Kamil Dudka <kdudka@redhat.com> 1.4.3-11.el7_4.1
changelog:
  - fix integer overflow in keyboard interactive handling that allows out-of-bounds writes (CVE-2019-3863)
  - fix integer overflow in SSH packet processing channel resulting in out of bounds write (CVE-2019-3857)
  - fix integer overflow in keyboard interactive handling resulting in out of bounds write (CVE-2019-3856)
  - fix integer overflow in transport read resulting in out of bounds write (CVE-2019-3855)


author: Peter Hatina <phatina@redhat.com> - 2.1.0-3
changelog:
  - Changes for EPEL-7
    - Lower systemd required version to 208
    - Rewrite BuildRequires for systemd-devel


author: Nikola Forró <nforro@redhat.com> - 4.0.3-21
changelog:
  - Remove patches for CVEs:
    CVE-2014-8127, CVE-2014-8129, CVE-2014-8130,
    CVE-2014-9330, CVE-2015-7554, CVE-2015-8665,
    CVE-2015-8683, CVE-2015-8781, CVE-2015-8784
  - Add patches for CVEs:
    CVE-2016-3632, CVE-2016-3945, CVE-2016-3990,
    CVE-2016-3991, CVE-2016-5320
  - Update patches for CVEs:
    CVE-2014-9655, CVE-2015-1547, CVE-2015-8668
  - Related: #1299921


author: Nikola Forró <nforro@redhat.com> - 4.0.3-25
changelog:
  - Add patches for CVEs:
    CVE-2015-7554, CVE-2015-8683, CVE-2015-8665,
    CVE-2015-8781, CVE-2015-8782, CVE-2015-8783,
    CVE-2015-8784
  - Related: #1299921


author: Nikola Forró <nforro@redhat.com> - 4.0.3-26
changelog:
  - Add patches for CVEs:
    CVE-2016-9533, CVE-2016-9534, CVE-2016-9535,
    CVE-2016-9536, CVE-2016-9537, CVE-2016-9540,
    CVE-2016-5652, CVE-2015-8870
  - Resolves: #1412080


author: Steve Dickson <steved@redhat.com> 0.2.4-0.7
changelog:
  - Backported upstream debugging (bz 1273159)
  - Fixed memory leak in svc_vc_create (bz 1276685)
  - Fixed memory leaks in server-side GSS authenticator (bz 1282488)


author: Pavel Raiskup <praiskup@redhat.com> - 2.4.2-14
changelog:
  - allow root to copy files into NFS in libtoolize (#740079)
  - pre-filter sed's input by dd (#636045)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-10.el7_3.3
changelog:
  - virDomainNetDefParseXML: Realign (rhbz#1392032)
  - virDomainNetGetActualType: Return type is virDomainNetType (rhbz#1392032)
  - qemuBuildInterfaceCommandLine: Move hostdev handling a bit further (rhbz#1392032)
  - qemuBuildInterfaceCommandLine: Move vhostuser handling a bit further (rhbz#1392032)
  - qemuBuildInterfaceCommandLine: Move from if-else forest to switch (rhbz#1392032)
  - qemuDomainAttachNetDevice: Move hostdev handling a bit further (rhbz#1392032)
  - qemuDomainAttachNetDevice: Explicitly list allowed types for hotplug (rhbz#1392032)
  - qemuBuildHostNetStr: Explicitly enumerate net types (rhbz#1392032)
  - qemuBuildChrChardevStr: Introduce @nowait argument (rhbz#1392032)
  - qemuBuildVhostuserCommandLine: Reuse qemuBuildChrChardevStr (rhbz#1392032)
  - qemuBuildVhostuserCommandLine: Unify -netdev creation (rhbz#1392032)
  - qemuBuildHostNetStr: Support VIR_DOMAIN_NET_TYPE_VHOSTUSER (rhbz#1392032)
  - qemu_hotplug: Support interface type of vhost-user hotplug (rhbz#1392032)
  - qemu: snapshot: Don't attempt to resume cpus if they were not paused (rhbz#1406765)
  - qemuDomainAttachNetDevice: Don't overwrite error on rollback (rhbz#1404186)
  - qemuDomainAttachNetDevice: Enable multiqueue for vhost-user (rhbz#1404186)
  - qemuDomainAttachNetDevice: pass mq and vectors for vhost-user with multiqueue (rhbz#1404186)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-10.el7_3.4
changelog:
  - qemuDomainAttachNetDevice: Avoid @originalError leak (rhbz#1404186)
  - qemu: snapshot: Resume VM after live snapshot (rhbz#1406765)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-10.el7_3.5
changelog:
  - qemu: Add support for using AES secret for SCSI hotplug (rhbz#1411398)
  - qemu: Don't assume secret provided for LUKS encryption (rhbz#1411394)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-10.el7_3.7
changelog:
  - Increase default file handle limits for daemons (rhbz#1442043)
  - util: permit querying a VF MAC address or VLAN tag by itself (rhbz#1442040)
  - util: remove unused args from virNetDevSetVfConfig() (rhbz#1442040)
  - util: use cleanup label consistently in virHostdevNetConfigReplace() (rhbz#1442040)
  - util: eliminate useless local variable (rhbz#1442040)
  - util: make virMacAddrParse more versatile (rhbz#1442040)
  - util: change virPCIGetNetName() to not return error if device has no net name (rhbz#1442040)
  - util: make virPCIGetDeviceAddressFromSysfsLink() public (rhbz#1442040)
  - util: new function virPCIDeviceRebind() (rhbz#1442040)
  - util: new internal function to permit silent failure of virNetDevSetMAC() (rhbz#1442040)
  - util: new function virNetDevPFGetVF() (rhbz#1442040)
  - util: new functions virNetDev(Save|Read|Set)NetConfig() (rhbz#1442040)
  - util: use new virNetDev*NetConfig() functions for macvtap setup/teardown (rhbz#1442040)
  - util: use new virNetDev*NetConfig() functions for hostdev setup/teardown (rhbz#1442040)
  - util: replace virHostdevNetConfigReplace with ...(Save|Set)NetConfig() (rhbz#1442040)
  - util: save hostdev network device config before unbinding from host driver (rhbz#1442040)
  - util: after hostdev assignment, restore VF MAC address via setting admin MAC (rhbz#1442040)
  - util: remove unused functions from virnetdev.c (rhbz#1442040)
  - util: if setting admin MAC to 00:00:00:00:00:00 fails, try 02:00:00:00:00:00 (rhbz#1442040)
  - util: try *really* hard to set the MAC address of an SRIOV VF (rhbz#1442040)
  - util: log all setting of MAC addresses and vlan tags (rhbz#1442040)
  - util: rename virHostdevNetConfigRestore() to virHostdevRestoreNetConfig() (rhbz#1442040)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-10.el7_3.9
changelog:
  - qemuDomainAttachNetDevice: Support attach of type="user" (rhbz#1445231)
  - conf: Rename mode parameter in virCPUDefParseXML (rhbz#1447612)
  - Add support for CPU cache specification (rhbz#1447612)
  - RHEL: qemuxml2argvtest: Properly reset host CPU arch (rhbz#1447612)
  - qemu: Add support for guest CPU cache (rhbz#1447612)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-10.el7_3.10
changelog:
  - util: add virFileReadHeaderQuiet wrapper around virFileReadHeaderFD (CVE-2017-5715)
  - util: new function virFileLength() (CVE-2017-5715)
  - util: introduce virHostCPUGetMicrocodeVersion (CVE-2017-5715)
  - conf: include x86 microcode version in virsh capabiltiies (CVE-2017-5715)
  - qemu: capabilities: force update if the microcode version does not match (CVE-2017-5715)
  - cpu: add CPU features and model for indirect branch prediction protection (CVE-2017-5715)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-3
changelog:
  - qemu: getAutoDumpPath() return value should be dumpfile not domname. (rhbz#1354238)
  - qemu: Copy complete domain def in qemuDomainDefFormatBuf (rhbz#1320470)
  - qemu: Drop default channel path during migration (rhbz#1320470)
  - qemu: Fix migration from old libvirt (rhbz#1320500)
  - Add USB addresses to qemuhotplug test cases (rhbz#1215968)
  - Introduce virDomainUSBDeviceDefForeach (rhbz#1215968)
  - Allow omitting USB port (rhbz#1215968)
  - Store USB port path as an array of integers (rhbz#1215968)
  - Introduce virDomainUSBAddressSet (rhbz#1215968)
  - Add functions for adding USB controllers to addrs (rhbz#1215968)
  - Add functions for adding USB hubs to addrs (rhbz#1215968)
  - Reserve existing USB addresses (rhbz#1215968)
  - Add tests for USB address assignment (rhbz#1215968)
  - Assign addresses to USB devices (rhbz#1215968)
  - Assign addresses on USB device hotplug (rhbz#1215968)
  - Auto-add one hub if there are too many USB devices (rhbz#1215968)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-4
changelog:
  - qemu: hotplug: fix changeable media ejection (rhbz#1359071)
  - lxc: Don't crash by forgetting to ref transient domains (rhbz#1351057)
  - Introduce <iommu> device (rhbz#1235581)
  - Add QEMU_CAPS_DEVICE_INTEL_IOMMU (rhbz#1235581)
  - qemu: format intel-iommu on the command line (rhbz#1235581)
  - qemu_monitor_json: add support to search QOM device path by device alias (rhbz#1358728)
  - hvsupport: Introduce parseSymsFile (rhbz#1286679)
  - hvsupport: use a regex instead of XML::XPath (rhbz#1286679)
  - hvsupport: construct the group regex upfront (rhbz#1286679)
  - hvsupport: skip non-matching lines early (rhbz#1286679)
  - virconf: Fix config file path construction (rhbz#1357364)
  - virDomainHostdevDefFree: Don't leak privateData (rhbz#1357346)
  - virt-admin: Output srv-threadpool-info data as unsigned int rather than signed (rhbz#1356769)
  - util: Introduce virISCSINodeNew (rhbz#1356436)
  - iscsi: Establish connection to target via static target login (rhbz#1356436)
  - storage: Document wiping formatted volume types (rhbz#868771)
  - admin: Retrieve the SASL context for both local and remote connection (rhbz#1361948)
  - daemon: sasl: Don't forget to save SASL username to client's identity (rhbz#1361948)
  - vsh: Make vshInitDebug return int instead of void (rhbz#1357363)
  - tools: Make use of the correct environment variables (rhbz#1357363)
  - util: Add 'usage' for encryption (rhbz#1301021)
  - virStorageEncryptionSecretFree: Don't leak secret lookup definition (rhbz#1301021)
  - encryption: Add luks parsing for storageencryption (rhbz#1301021)
  - encryption: Add <cipher> and <ivgen> to encryption (rhbz#1301021)
  - qemu: Introduce helper qemuDomainSecretDiskCapable (rhbz#1301021)
  - tests: Adjust LUKS tests to use 'volume' secret type (rhbz#1301021)
  - docs: Update docs to reflect LUKS secret changes (rhbz#1301021)
  - qemu: Alter error path cleanup for qemuDomainAttachHostSCSIDevice (rhbz#1301021)
  - qemu: Alter error path cleanup for qemuDomainAttachVirtioDiskDevice (rhbz#1301021)
  - qemu: Alter error path cleanup for qemuDomainAttachSCSIDisk (rhbz#1301021)
  - qemu: Move and rename qemuBufferEscapeComma (rhbz#1301021)
  - storage: Add support to create a luks volume (rhbz#1301021)
  - qemu: Add secinfo for hotplug virtio disk (rhbz#1301021)
  - qemu: Alter the qemuDomainGetSecretAESAlias to add new arg (rhbz#1301021)
  - qemu: Add luks support for domain disk (rhbz#1301021)
  - qemu: Move setting of obj bools for qemuDomainAttachVirtioDiskDevice (rhbz#1301021)
  - qemu: Move setting of encobjAdded for qemuDomainAttachSCSIDisk (rhbz#1301021)
  - storage: Fix error path (rhbz#1301021)
  - qemu: Disallow usage of luks encryption if aes secret not possible (rhbz#1301021)
  - storage: Add extra failure condition for luks volume creation (rhbz#1301021)
  - virstoragefile: refactor virStorageFileMatchesNNN methods (rhbz#1301021)
  - qemu: Make qemuDomainCheckDiskStartupPolicy self-contained (rhbz#1168453)
  - qemu: Remove unnecessary label and its only reference (rhbz#1168453)
  - qemu: Fix support for startupPolicy with volume/pool disks (rhbz#1168453)
  - virsh: Report error when explicit connection fails (rhbz#1356461)
  - tests: Add testing of backing store string parser (rhbz#1134878)
  - util: json: Make first argument of virJSONValueObjectForeachKeyValue const (rhbz#1134878)
  - util: qemu: Add wrapper for JSON -> commandline conversion (rhbz#1134878)
  - util: qemu: Add support for user-passed strings in JSON->commandline (rhbz#1134878)
  - util: qemu: Allow nested objects in JSON -> commandline generator (rhbz#1134878)
  - util: qemu: Allow for different approaches to format JSON arrays (rhbz#1134878)
  - util: qemu: Don't generate any extra commas in virQEMUBuildCommandLineJSON (rhbz#1134878)
  - util: json: Make first argument of virJSONValueCopy const (rhbz#1134878)
  - util: storage: Add parser for qemu's json backing pseudo-protocol (rhbz#1134878)
  - util: storage: Add support for host device backing specified via JSON (rhbz#1134878)
  - util: storage: Add support for URI based backing volumes in qemu's JSON pseudo-protocol (rhbz#1134878)
  - util: storage: Add json pseudo protocol support for gluster volumes (rhbz#1134878)
  - util: storage: Add json pseudo protocol support for iSCSI volumes (rhbz#1134878)
  - util: storage: Add JSON backing volume parser for 'nbd' protocol (rhbz#1134878)
  - util: storage: Add JSON backing store parser for 'sheepdog' protocol (rhbz#1134878)
  - util: storage: Add 'ssh' network storage protocol (rhbz#1134878)
  - util: storage: Add JSON backing volume parser for 'ssh' protocol (rhbz#1134878)
  - qemu: command: Rename qemuBuildNetworkDriveURI to qemuBuildNetworkDriveStr (rhbz#1247521)
  - qemu: command: Split out network disk URI building (rhbz#1247521)
  - qemu: command: Extract drive source command line formatter (rhbz#1247521)
  - qemu: command: Refactor code extracted to qemuBuildDriveSourceStr (rhbz#1247521)
  - storage: gluster: Support multiple hosts in backend functions (rhbz#1247521)
  - util: qemu: Add support for numbered array members (rhbz#1247521)
  - qemu: command: Add infrastructure for object specified disk sources (rhbz#1247521)
  - qemu: command: Add support for multi-host gluster disks (rhbz#1247521)
  - qemu: Need to free fileprops in error path (rhbz#1247521)
  - storage: remove "luks" storage volume type (rhbz#1301021)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-5
changelog:
  - qemu: Fix domain state after reset (rhbz#1269575)
  - rpc: virnetserver: Rename ClientSetProcessingControls to ClientSetLimits (rhbz#1357776)
  - rpc: virnetserver: Move virNetServerCheckLimits which is static up in the file (rhbz#1357776)
  - rpc: virnetserver: Add code to CheckLimits to handle suspending of services (rhbz#1357776)
  - admin: rpc: virnetserver: Fix updating of the client limits (rhbz#1357776)
  - rpc: virnetserver: Remove dead code checking the client limits (rhbz#1357776)
  - storage: Fix a NULL ptr dereference in virStorageBackendCreateQemuImg (rhbz#1363636)
  - qemu: Introduce qemuAliasFromHostdev (rhbz#1289391)
  - qemu: Use the hostdev alias in qemuDomainAttachHostSCSIDevice error path (rhbz#1289391)
  - storage: Don't remove the pool for buildPool failure in storagePoolCreate (rhbz#1362349)
  - lxcDomainCreateXMLWithFiles: Avoid crash (rhbz#1363773)
  - admin: Fix the default uri for session daemon to libvirtd:///session (rhbz#1356858)
  - docs: Distribute subsite.xsl (rhbz#1365004)
  - qemuBuildMachineCommandLine: Follow our pattern (rhbz#1304483)
  - Introduce SMM feature (rhbz#1304483)
  - Introduce @secure attribute to os loader element (rhbz#1304483)
  - qemu: Enable secure boot (rhbz#1304483)
  - qemu: Advertise OVMF_CODE.secboot.fd (rhbz#1304483)
  - tests: Fix broken build (rhbz#1304483)
  - cpu_x86: Introduce x86FeatureIsMigratable (rhbz#1365500)
  - cpu_x86: Properly drop non-migratable features (rhbz#1365500)
  - tests: Add a test for host-model CPU with CMT feature (rhbz#1365500)
  - cpu_x86: Fix host-model CPUs on hosts with CMT (rhbz#1365500)
  - virt-admin: Fix the error when an invalid URI has been provided (rhbz#1365903)
  - conf: improve error log when PCI devices don't match requested controller (rhbz#1363627)
  - conf: don't allow connecting upstream-port directly to pce-expander-bus (rhbz#1361172)
  - conf: restrict where dmi-to-pci-bridge can be connected (rhbz#1363648)
  - conf: restrict expander buses to connect only to a root bus (rhbz#1358712)
  - virNetDevMacVLanCreateWithVPortProfile: Don't mask virNetDevMacVLanTapOpen error (rhbz#1240439)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-6
changelog:
  - qemu_command: don't modify heads for graphics device (rhbz#1366119)
  - virsh: Fix core for cmdSecretGetValue (rhbz#1366611)
  - conf: report an error message for non-existing USB hubs (rhbz#1367130)
  - conf: free the ports array of a USB hub (rhbz#1366097)
  - utils: storage: Fix JSON field name for uri based storage (rhbz#1367260)
  - qemu: Adjust the cur_ballon on coldplug/unplug of dimms (rhbz#1220702)
  - conf: Provide error on undefined iothreadsched entry (rhbz#1366484)
  - qemu: Fix the command line generation for rbd auth using aes secrets (rhbz#1182074)
  - qemu: Fix crash hot plugging luks volume (rhbz#1367259)
  - Revert "admin: Fix the default uri for session daemon to libvirtd:///session" (rhbz#1367269)
  - libvirt: convert to typesafe virConf accessors (rhbz#1367269)
  - admin: Fix default uri config option name s/admin_uri_default/uri_default (rhbz#1367269)
  - virt-admin: Properly fix the default session daemon URI to admin server (rhbz#1367269)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-7
changelog:
  - qemu: caps: Always assume QEMU_CAPS_SMP_TOPOLOGY (rhbz#1097930)
  - conf: Extract code formatting vCPU info (rhbz#1097930)
  - conf: Rename virDomainVcpuInfoPtr to virDomainVcpuDefPtr (rhbz#1097930)
  - conf: Don't report errors from virDomainDefGetVcpu (rhbz#1097930)
  - tests: qemuxml2xml: Format status XML header dynamically (rhbz#1097930)
  - conf: convert def->vcpus to a array of pointers (rhbz#1097930)
  - conf: Add private data for virDomainVcpuDef (rhbz#1097930)
  - qemu: domain: Add vcpu private data structure (rhbz#1097930)
  - qemu: domain: Extract formating and parsing of vCPU thread ids (rhbz#1097930)
  - qemu: Add cpu ID to the vCPU pid list in the status XML (rhbz#1097930)
  - qemu: Store vCPU thread ids in vcpu private data objects (rhbz#1097930)
  - Fix logic in qemuDomainObjPrivateXMLParseVcpu (rhbz#1097930)
  - qemu: Add qemuProcessSetupPid() and use it in qemuProcessSetupIOThread() (rhbz#1097930)
  - qemu: Use qemuProcessSetupPid() in qemuProcessSetupEmulator() (rhbz#1097930)
  - qemu: Use qemuProcessSetupPid() in qemuProcessSetupVcpu() (rhbz#1097930)
  - qemuBuildCpuCommandLine: Don't leak @buf (rhbz#1097930)
  - conf: Make really sure we don't access non-existing vCPUs (rhbz#1097930)
  - conf: Make really sure we don't access non-existing vCPUs again (rhbz#1097930)
  - qemu: capabilities: Drop unused function virQEMUCapsGetMachineTypes (rhbz#1097930)
  - qemu: caps: Sanitize storage of machine type related data (rhbz#1097930)
  - qemu: cap: Refactor access to array in virQEMUCapsProbeQMPMachineTypes (rhbz#1097930)
  - qemu: monitor: Add monitor API for device_add supporting JSON objects (rhbz#1097930)
  - qemu: monitor: Add do-while block to QEMU_CHECK_MONITOR_FULL (rhbz#1097930)
  - qemu: Improve error message in virDomainGetVcpus (rhbz#1097930)
  - qemu: domain: Rename qemuDomainDetectVcpuPids to qemuDomainRefreshVcpuInfo (rhbz#1097930)
  - qemu: monitor: Rename qemuMonitor(JSON|Text)GetCPUInfo (rhbz#1097930)
  - qemu: domain: Improve vCPU data checking in qemuDomainRefreshVcpu (rhbz#1097930)
  - qemu: domain: Simplify return values of qemuDomainRefreshVcpuInfo (rhbz#1097930)
  - internal: Introduce macro for stealing pointers (rhbz#1097930)
  - tests: qemucapabilities: Add data for qemu 2.7.0 (rhbz#1097930)
  - qemu: setcpus: Report better errors (rhbz#1097930)
  - qemu: setvcpus: Extract setting of maximum vcpu count (rhbz#1097930)
  - qemu: driver: Extract setting of live vcpu count (rhbz#1097930)
  - qemu: driver: Split out regular vcpu hotplug code into a function (rhbz#1097930)
  - conf: Provide error on undefined vcpusched entry (rhbz#1097930)
  - qemu: monitor: Return structures from qemuMonitorGetCPUInfo (rhbz#1097930)
  - qemu: monitor: Return struct from qemuMonitor(Text|Json)QueryCPUs (rhbz#1097930)
  - qemu: Add capability for query-hotpluggable-cpus command (rhbz#1097930)
  - qemu: Forbid config when topology based cpu count doesn't match the config (rhbz#1097930)
  - qemu: capabilities: Extract availability of new cpu hotplug for machine types (rhbz#1097930)
  - qemu: monitor: Extract QOM path from query-cpus reply (rhbz#1097930)
  - qemu: monitor: Add support for calling query-hotpluggable-cpus (rhbz#1097930)
  - qemu: monitor: Add algorithm for combining query-(hotpluggable-)-cpus data (rhbz#1097930)
  - tests: Add test infrastructure for qemuMonitorGetCPUInfo (rhbz#1097930)
  - tests: cpu-hotplug: Add data for x86 hotplug with 11+ vcpus (rhbz#1097930)
  - tests: cpu-hotplug: Add data for ppc64 platform including hotplug (rhbz#1097930)
  - tests: cpu-hotplug: Add data for ppc64 out-of-order hotplug (rhbz#1097930)
  - tests: cpu-hotplug: Add data for ppc64 without threads enabled (rhbz#1097930)
  - qemu: domain: Extract cpu-hotplug related data (rhbz#1097930)
  - qemu: domain: Prepare for VCPUs vanishing while libvirt is not running (rhbz#1097930)
  - util: Extract and rename qemuDomainDelCgroupForThread to virCgroupDelThread (rhbz#1097930)
  - conf: Add XML for individual vCPU hotplug (rhbz#1097930)
  - qemu: migration: Prepare for non-contiguous vcpu configurations (rhbz#1097930)
  - qemu: command: Add helper to convert vcpu definition to JSON props (rhbz#1097930)
  - qemu: process: Copy final vcpu order information into the vcpu definition (rhbz#1097930)
  - qemu: command: Add support for sparse vcpu topologies (rhbz#1097930)
  - qemu: Use modern vcpu hotplug approach if possible (rhbz#1097930)
  - qemu: hotplug: Allow marking unplugged devices by alias (rhbz#1097930)
  - qemu: hotplug: Add support for VCPU unplug (rhbz#1224341)
  - virsh: vcpuinfo: Report vcpu number from the structure rather than it's position (rhbz#1097930)
  - qemu: driver: Fix qemuDomainHelperGetVcpus for sparse vcpu topologies (rhbz#1097930)
  - doc: clarify documentation for vcpu order (rhbz#1097930)
  - conf: Don't validate vcpu count in XML parser (rhbz#1097930)
  - qemu: driver: Validate configuration when setting maximum vcpu count (rhbz#1370066)
  - conf: Fix build with picky GCC (rhbz#1097930)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-8
changelog:
  - util: storage: Properly set protocol type when parsing gluster json string (rhbz#1372251)
  - conf: Add IOThread quota and period scheduler/cputune defs (rhbz#1356937)
  - qemu: Add support to get/set IOThread period and quota cgroup values (rhbz#1356937)
  - network: new network forward mode 'open' (rhbz#846810)
  - virtlogd.socket: Tie lifecycle to libvirtd.service (rhbz#1372576)
  - cpu_x86: Fix minimum match custom CPUs on hosts with CMT (rhbz#1365500)
  - qemu: cgroup: Extract temporary relaxing of cgroup setting for vcpu hotplug (rhbz#1097930)
  - qemu: process: Fix start with unpluggable vcpus with NUMA pinning (rhbz#1097930)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-9
changelog:
  - Add helper for removing transient definition (rhbz#1368774)
  - qemu: Remove stale transient def when migration fails (rhbz#1368774)
  - qemu: Don't use query-migrate on destination (rhbz#1374613)
  - conf: allow hotplugging "legacy PCI" device to manually addressed PCIe slot (rhbz#1337490)
  - conf: Add support for virtio-net.rx_queue_size (rhbz#1366989)
  - qemu_capabilities: Introduce virtio-net-*.rx_queue_size (rhbz#1366989)
  - qemu: Implement virtio-net rx_queue_size (rhbz#1366989)
  - audit: Audit information about shmem devices (rhbz#1218603)
  - qemu: monitor: Use a more obvious iterator name (rhbz#1375783)
  - qemu: monitor: qemuMonitorGetCPUInfoHotplug: Add iterator 'anycpu' (rhbz#1375783)
  - qemu: monitor: Add vcpu state information to monitor data (rhbz#1375783)
  - qemu: domain: Don't infer vcpu state (rhbz#1375783)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-10.el7_3.1
changelog:
  - qemu: allow 32 slots on pcie-expander-bus, not just 1 (rhbz#1389369)
  - qemu: Reset post-copy capability after migration (rhbz#1392030)
  - qemuhotplugtest: Only read result_filename if used (rhbz#1392031)
  - schema: Allow shmem to have alias (rhbz#1392031)
  - conf: Allow copying of shmem defs (rhbz#1392031)
  - qemu: Make qemuBuildShmemDevStr static (rhbz#1392031)
  - qemu: Rename qemuBuildShmemDevStr to qemuBuildShmemDevLegacyStr (rhbz#1392031)
  - qemu: Move common checks outside qemuBuildShmemDevLegacyStr (rhbz#1392031)
  - qemu: Reorder shmem params nicely (rhbz#1392031)
  - qemu: Abstract shmem socket path preparation (rhbz#1392031)
  - qemu: Rename qemuBuildShmemBackendStr to qemuBuildShmemBackendChrStr (rhbz#1392031)
  - qemu: Add qemuAssignDeviceShmemAlias and use it (rhbz#1392031)
  - conf: Add some shmem helpers for future use (rhbz#1392031)
  - conf: Remove incorrect check when encoding shmem audit message (rhbz#1389013)
  - conf: Fix virDomainShmemDefFind (rhbz#1392031)
  - conf: Don't complicate find loop (rhbz#1392031)
  - qemu: Disable migration with ivshmem (rhbz#1392031)
  - conf, qemu: Add support for shmem model (rhbz#1392031)
  - conf, qemu: Add newer shmem models (rhbz#1392031)
  - qemu: Add capabilities for ivshmem-{plain, doorbell} (rhbz#1392031)
  - qemu: Save various defaults for shmem (rhbz#1392031)
  - qemu: Support newer ivshmem device variants (rhbz#1392031)
  - qemu: Add support for hot/cold-(un)plug of shmem devices (rhbz#1392031)


author: Jiri Denemark <jdenemar@redhat.com> - 2.0.0-10.el7_3.2
changelog:
  - qemu: Fix double free when live-attaching shmem (rhbz#1392031)
  - qemu: Make sure shmem memory is shared (rhbz#1392031)


author: Prarit Bhargava <prarit@redhat.com> - 2:1.0-0.13.f30da3d
changelog:
  - Update to upstream commit f30da3d, minor fixes, no features [1085134]
  - Add /var/log/mcelog file [1098864]
  - remove .src.rpm file [1038755]


author: Prarit Bhargava <prarit@redhat.com> - 3:120-1.e7e0ac1
changelog:
  - Add Broadwell-U, Broadwell-DE, and Knights Landing/Xeon Phi Support
  - additional general fixes
  - add mcelog.conf and mcelog.triggers man pages
  - update NVR to 120 to match upstream


author: Prarit Bhargava <prarit@redhat.com> - 3:136-1.e4aca63
changelog:
  - update NVR to 136 to match upstream [1336431]
  - additional general fixes [1336431]
  - Skylake Client support (6,94) (6,78) [1255571]
  - Broadwell SoC/DE, EP & EX support (6,79) [1255572]


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.4-6
changelog:
  - Fix problem with reshaping IMSM arrays, where a new reshape could be
    launched before the first reshape had fully completed, leading to
    unpected results.
  - Resolves rhbz#1347762


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.4-12
changelog:
  - Apply additional required patch to fix buffer overrun using long device
    names
  - Resolves rhbz#1369891


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.4-13
changelog:
  - Make udev-md-array-arrays.rules more resilient to races if arrays are
    assembled and stopped and reassembled quick after each other.
  - Resolves rhbz#1331709


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.4-14
changelog:
  - The fix for 1331709 caused a problem with container arrays (IMSM) as
    these can show up with a valid size of 0. Work around this to only
    exit for non container arrays.
  - Resolves rhbz#1379194


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.4-14.1
changelog:
  - Resolve case where a reshape could hang if started right after the
    completion of a resync. z-stream fix
  - Resolves rhbz#1402434


author: Miroslav Lichvar <mlichvar@redhat.com> - 0:1.4.15-10
changelog:
  - fix binding to IPv6 address (#1298603)
  - enable SASL support (#1263696)
  - don't allow authentication with bad SASL credentials (CVE-2013-7239)


author: Miroslav Lichvar <mlichvar@redhat.com> - 0:1.4.15-10.el7_3.1
changelog:
  - fix vulnerabilities allowing remote code execution (CVE-2016-8704,
    CVE-2016-8705, CVE-2016-8706)


author: Petr Oros <poros@redhat.com> - 2.1-16.1
changelog:
  - Fix issue with hot microcode cpu reload.
  - Move dracut call into posttrans phase.
  - Resolves: #1402512


author: Petr Oros <poros@redhat.com> - 2.1-16.8
changelog:
  - Fix: Operation not permitted when installing microcode_ctl
  - CVE-2018-3639 hw: cpu: speculative store bypass
  - Resolves: #1573453


author: Eugene Syromiatnikov <esyr@redhat.com> - 2.1-16.10
changelog:
  - Intel CPU microcode update to 20180703.
  - Add infrastructure for handling kernel-version-dependant microcode.
  - Resolves: #1576332


author: Eugene Syromiatnikov <esyr@redhat.com> - 2.1-16.11
changelog:
  - Add model name blacklist infrastructure.
  - Store Intel ucode files in /usr/share/microcode_ctl; do not populate them
    in a virtualised environment.
  - Resolves: #1576332


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-16.14
changelog:
  - Add an ability to disable "hypervisor" /proc/cpuinfo flag check.
  - Intel CPU microcode update to 20180807.
  - Resolves: #1614845.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-16.15
changelog:
  - Drop "hypervisor" /proc/cpuinfo flag check.
  - Intel CPU microcode update to 20180807a.
  - Add README.caveats documentation file.
  - Add intel-microcode2ucode manual page.
  - Add check for early microcode load, use it in microcode_ctl dracut module.
  - Check that the currently running kernel is installed before
    running dracut -f.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-16.20
changelog:
  - Intel CPU microcode update to 20190312.
  - Add "Provides:" tags generation.
  - Fix %postun script.
  - Resolves: #1704361.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-16.23
changelog:
  - Remove disclaimer, as it is not as important now to justify kmsg/log
    pollution; its contents are partially adopted in README.caveats.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-16.25
changelog:
  - Intel CPU microcode update to 20190918.
  - Add new disclaimer, generated based on relevant caveats.
  - Resolves: #1758568.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-16.27
changelog:
  - Intel CPU microcode update to 20191112, addresses CVE-2017-5715,
    CVE-2019-0117, CVE-2019-11135, CVE-2019-11139 (#1764053, #1764066, #1764945,
      - Addition of 06-a6-00/0x80 (CML-U 6+2 A0) microcode at revision 0xc6;
    - Addition of 06-66-03/0x80 (CNL-U D0) microcode at revision 0x2a;
    - Addition of 06-55-03/0x97 (SKL-SP B1) microcode at revision 0x1000150;
    - Addition of 06-7e-05/0x80 (ICL-U/Y D1) microcode at revision 0x46;
    - Update of 06-4e-03/0xc0 (SKL-U/Y D0) microcode from revision 0xcc to 0xd4;
    - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 R0/N0) microcode from revision 0xcc
      to 0xd4
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode from revision 0xb4 to 0xc6;
    - Update of 06-8e-09/0xc0 (KBL-U/Y H0) microcode from revision 0xb4 to 0xc6;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0) microcode from revision 0xb4
      to 0xc6;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xb8 to 0xc6;
    - Update of 06-8e-0c/0x94 (AML-Y V0) microcode from revision 0xb8 to 0xc6;
    - Update of 06-8e-0c/0x94 (CML-U 4+2 V0) microcode from revision 0xb8 to 0xc6;
    - Update of 06-8e-0c/0x94 (WHL-U V0) microcode from revision 0xb8 to 0xc6;
    - Update of 06-9e-09/0x2a (KBL-G/X H0) microcode from revision 0xb4 to 0xc6;
    - Update of 06-9e-09/0x2a (KBL-H/S/Xeon E3 B0) microcode from revision 0xb4
      to 0xc6;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode from revision 0xb4
      to 0xc6;
    - Update of 06-9e-0b/0x02 (CFL-S B0) microcode from revision 0xb4 to 0xc6;
    - Update of 06-9e-0d/0x22 (CFL-H R0) microcode from revision 0xb8 to 0xc6.
  - Rework dracut hook to address dracut's early initramfs generation
    behaviour.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-16.28
changelog:
  - Package the publicy available microcode-20191112 release (#1773956):
    - Addition of 06-4d-08/0x1 (AVN B0/C0) microcode at revision 0x12d;
    - Addition of 06-55-06/0xbf (CSL-SP B0) microcode at revision 0x400002c;
    - Addition of 06-7a-08/0x1 (GLK R0) microcode at revision 0x16;
    - Update of 06-55-03/0x97 (SKL-SP B1) microcode from revision 0x1000150
      up to 0x1000151;
    - Update of 06-55-04/0xb7 (SKL-SP H0/M0/U0, SKL-D M1) microcode from revision
      0x2000064 up to 0x2000065;
    - Update of 06-55-07/0xbf (CSL-SP B1) microcode from revision 0x500002b
      up to 0x500002c;
    - Update of 06-7a-01/0x1 (GLK B0) microcode from revision 0x2e up to 0x32;
  - Include 06-9e-0c (CFL-H/S P0) microcode from the microcode-20190918 release.
  - Correct the releasenote file (0001-releasenote-changes-summary-fixes.patch).
  - Update README.caveats with the link to the new Knowledge Base article.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-16.29
changelog:
  - Update Intel CPU microcode to microcode-20191113 release:
    - Update of 06-9e-0c (CFL-H/S P0) microcode from revision 0xae up to 0xc6.
  - Drop 0001-releasenote-changes-summary-fixes.patch.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-16.30
changelog:
  - Update Intel CPU microcode to microcode-20191115 release:
    - Update of 06-4e-03/0xc0 (SKL-U/Y D0) from revision 0xd4 up to 0xd6;
    - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 R0/N0) from revision 0xd4
      up to 0xd6;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) from revision 0xc6 up to 0xca;
    - Update of 06-8e-09/0xc0 (KBL-U/Y H0) from revision 0xc6 up to 0xca;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0) from revision 0xc6 up to 0xca;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) from revision 0xc6 up to 0xca;
    - Update of 06-8e-0c/0x94 (AML-Y V0, CML-U 4+2 V0, WHL-U V0) from revision
      0xc6 up to 0xca;
    - Update of 06-9e-09/0x2a (KBL-G/X H0, KBL-H/S/Xeon E3 B0) from revision 0xc6
      up to 0xca;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) from revision 0xc6 up to 0xca;
    - Update of 06-9e-0b/0x02 (CFL-S B0) from revision 0xc6 up to 0xca;
    - Update of 06-9e-0c/0x22 (CFL-S/Xeon E P0) from revision 0xc6 up to 0xca;
    - Update of 06-9e-0d/0x22 (CFL-H/S R0) from revision 0xc6 up to 0xca;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) from revision 0xc6 up to 0xca.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-16.32
changelog:
  - Update stale posttrans dependency, add triggers for proper handling
    of the debug kernel flavour along with kernel-rt.
  - Avoid find being SIGPIPE'd on early "grep -q" exit in the dracut script.
  - Re-generate initramfs not only for the currently running kernel,
    but for several recently installed kernels as well.
  - Narrow down SKL-SP/W/X blacklist to exclude Server/FPGA/Fabric segment
    models.
  - Change the URL in the intel-microcode2ucode.8 to point to the GitHub
    repository since the microcode download section at Intel Download Center
    does not exist anymore.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-16.33
changelog:
  - Update Intel CPU microcode to microcode-20200609 release, addresses
    CVE-2020-0543, CVE-2020-0548, CVE-2020-0549 (#1840680, #1849054):
    - Update of 06-2d-06/0x6d (SNB-E/EN/EP C1/M0) microcode from revision 0x61f
      up to 0x621;
    - Update of 06-2d-07/0x6d (SNB-E/EN/EP C2/M1) microcode from revision 0x718
      up to 0x71a;
    - Update of 06-3c-03/0x32 (HSW C0) microcode from revision 0x27 up to 0x28;
    - Update of 06-3d-04/0xc0 (BDW-U/Y E0/F0) microcode from revision 0x2e
      up to 0x2f;
    - Update of 06-45-01/0x72 (HSW-U C0/D0) microcode from revision 0x25
      up to 0x26;
    - Update of 06-46-01/0x32 (HSW-H C0) microcode from revision 0x1b up to 0x1c;
    - Update of 06-47-01/0x22 (BDW-H/Xeon E3 E0/G0) microcode from revision 0x21
      up to 0x22;
    - Update of 06-4e-03/0xc0 (SKL-U/Y D0) microcode from revision 0xd6
      up to 0xdc;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000151
      up to 0x1000157;
    - Update of 06-55-04/0xb7 (SKX-SP H0/M0/U0, SKX-D M1) microcode
      (in intel-06-55-04/intel-ucode/06-55-04) from revision 0x2000065
      up to 0x2006906;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x400002c
      up to 0x4002f01;
    - Update of 06-55-07/0xbf (CLX-SP B1) microcode from revision 0x500002c
      up to 0x5002f01;
    - Update of 06-5e-03/0x36 (SKL-H/S R0/N0) microcode from revision 0xd6
      up to 0xdc;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0x46
      up to 0x78;
    - Update of 06-8e-09/0x10 (AML-Y22 H0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-09/0xc0 (KBL-U/Y H0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-0a/0xc0 (CFL-U43e D0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-0c/0x94 (AML-Y42 V0, CML-Y42 V0, WHL-U V0) microcode
      from revision 0xca up to 0xd6;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode from revision
      0xca up to 0xd6;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E3 U0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-9e-0b/0x02 (CFL-S B0) microcode from revision 0xca up to 0xd6;
    - Update of 06-9e-0c/0x22 (CFL-H/S P0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-9e-0d/0x22 (CFL-H R0) microcode from revision 0xca up to 0xd6.
  - Do not update 06-4e-03 (SKL-U/Y) and 06-5e-03 (SKL-H/S/Xeon E3 v5) to revision
    0xdc, use 0xd6 by default.
  - Enable 06-2d-07 (SNB-E/EN/EP) caveat by default (#1849060).
  - Enable 06-55-04 (SKL-X/W) caveat by default.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-16.34
changelog:
  - Add README file to the documentation directory.
  - Add publicly-sourced codenames list to supply to gen_provides.sh; update
    the latter to handle the somewhat different format.
  - Add SUMMARY.intel-ucode file containing metadata information from
    the microcode file headers.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-16.35
changelog:
  - Update Intel CPU microcode to microcode-20201027 release, addresses
    CVE-2020-8694, CVE-2020-8695, CVE-2020-8696, CVE-2020-8698
    (#1893257, #1893245, #1893225):
    - Addition of 06-55-0b/0xbf (CPX-SP A1) microcode at revision 0x700001e;
    - Addition of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode at revision 0x68;
    - Addition of 06-a5-02/0x20 (CML-H R1) microcode at revision 0xe0;
    - Addition of 06-a5-03/0x22 (CML-S 6+2 G1) microcode at revision 0xe0;
    - Addition of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode at revision 0xe0;
    - Addition of 06-a6-01/0x80 (CML-U 6+2 v2 K0) microcode at revision
      0xe0;
    - Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in
      intel-06-4e-03/intel-ucode/06-4e-03) from revision 0xdc up to 0xe2;
    - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006906 up
      to 0x2006a08;
    - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in
      intel-06-5e-03/intel-ucode/06-5e-03) from revision 0xdc up to 0xe2;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xd6 up
      to 0xde;
    - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xd6 up
      to 0xde;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xd6 up
      to 0xe0;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xd6 up
      to 0xde;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
      revision 0xd6 up to 0xde;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-09) from revision 0xd6 up
      to 0xde;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xd6 up
      to 0xde;
    - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xd6 up
      to 0xde;
    - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xd6 up
      to 0xde;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xd6 up
      to 0xde;
    - Update of 06-3f-02/0x6f (HSX-E/EN/EP/EP 4S C0/C1/M1/R2) microcode
      from revision 0x43 up to 0x44;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000157
      up to 0x1000159;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4002f01
      up to 0x4003003;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5002f01 up to 0x5003003;
    - Update of 06-5c-09/0x03 (APL D0) microcode from revision 0x38 up
      to 0x40;
    - Update of 06-5c-0a/0x03 (APL B1/F1) microcode from revision 0x16 up
      to 0x1e;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x16 up
      to 0x18;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0x78
      up to 0xa0;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xca
      up to 0xe0.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-16.37
changelog:
  - Update Intel CPU microcode to microcode-20201112 release:
    - Addition of 06-8a-01/0x10 (LKF B2/B3) microcode at revision 0x28;
    - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x32 up
      to 0x34;
    - Updated releasenote file.


author: Thomas Woerner <twoerner@redhat.com> 2.3.3-5
changelog:
  - dropped file requires for /usr/share/X11/XKeysymDB, not needed and not 
    available anymore
  - added flex-static build requirement, because of flex package split


author: Thomas Woerner <twoerner@redhat.com> 2.3.4-1
changelog:
  - new version 2.3.4 with LGPL license
  - fixed some rpmlint warnings
  - new sub package for static libraries
  - added /etc/X11/mwm directory
  - removed defattrs


author: Thomas Woerner <twoerner@redhat.com> 2.3.4-2
changelog:
  - fixed requirements according to review (RHBZ#870049)
  - flex-static has been renamed to flex-devel with Fedora-18 and RHEL-7


author: Thomas Woerner <twoerner@redhat.com> - 2.3.4-8
changelog:
  - mwm: do not see outline of window when moving (RHBZ#1080548)
    Clone of RHBZ#997241
  - Fixed rendering issues seen while scrolling window (RHBZ#1134365)
    (MotifZone bug #1654)


author: Thomas Woerner <twoerner@redhat.com> - 2.3.4-8.1
changelog:
  - Fixed motif issue while navigating drop down menus with arrow keys
    (RHBZ#1415153) (RHBZ#1396514) (MotifZone bug #1564)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-17
changelog:
  - fixed various error codes in Python module (#1064338)
  - fixed net-snmp-config.h header file (#1064437)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-19
changelog:
  - Fixed not-increasing OIDs in IP-FORWARD-MIB::ipCidrRouteTable (#1172013)
  - Fixed HOST-RESOURCES-MIB::hrProcessorTable on machines with >100 CPUs
    (#1070076)
  - skip 'mvfs' (ClearCase) when skipNFSInHostResources is enabled (#1086606)
  - Added clear error message when port specified in 'clientaddrr' config
    option cannot be bound (#1086925)
  - fixed proxying of out-of-tree GETNEXT requests (#1087801)
  - use python/README to net-snmp-python subpackage (#1158391)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-21
changelog:
  - Fixed crash on reloading 'exec' configuration options (#1228893)
  - Fixed CVE-2014-3565, snmptrapd died when parsing certain traps (#1209361)
  - Fixed storageUseNFS functionality in hrStorageTable (#1193006)
  - Fixed forwarding of traps with RequestID=0 in snmptrapd (#1192511)
  - Fixed hrStorageTable to contain 31 bits integers (#1192221)
  - Fixed 'clientaddr' option for UDPv6 client messages (#1190679)
  - Fixed log level of SMUX messages (#1189393)
  - Fixed UDP-MIB::udpTable index on big-endian platforms (#1184433)
  - Fixed client utilities reporting 'read_config_store open failure on
    /var/lib/net-snmp/snmpapp.conf' (#1151310)
  - Fixed snmpd crash when failed to parse SMUX message headers (#1140236)
  - Added 'diskio' option to snmpd.conf, it's possible to monitor only
    selected devices in diskIOTable (#1092308)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-23
changelog:
  - Fixed parsing of invalid variables in incoming packets (#1248414)
  - Fixed HOST-RESOURCES-MIB::hrFSAccess flag when read-only filesystem
    becomes writable (#1241897)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-24
changelog:
  - Fixed lmSensorsTable not reporting sensors with duplicate names
    (#1252053)
  - Fixed close() overhead of extend commands (#1252048)
  - Fixed out-of-bounds write in python code (#1252034)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.25
changelog:
  - mountstats.man:  Remove a few bogus .R macros (bz 1266013)
  - systemd: ensure nfs-config service is re-run as needed (bz 1331460)
  - exportfs: Deal with path's trailing "/"  (bz 1276534)
  - exportfs: replace one xlog(D_GENERAL) in host_canonname() (bz 1331801)
  - exportfs: Fix buf size in test_export() dump() (bz 1243234)
  - blkmapd: Added a usage routine (bz 1001431)
  - rpc.idmapd: Added a usage routine (bz 1001438)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.26
changelog:
  - gssd: use pthreads to handle upcalls (bz 1331540)
  - gssd: Fix inner-loop variable reuse (bz 1334848)
  - mount: run START_STATD fully as root (bz 1275082)
  - lockd: added lockd.conf to set module parameters (bz 1264387)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.27
changelog:
  - nfsd: use correct byte order on rdma port (bz 1310691)
  - blkmapd: Add the -h flag on the man page (bz 1001431)
  - nfsd: Remove some warnings nfsd.c (bz 1336419)
  - mountd.man: Update to change -P option as an alias for -p (bz 1037924)
  - mountd: cleaned up usage message (bz 1003716)
  - mountstats.man: fixed typo in man page (bz 1263966)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.29
changelog:
  - mountd: fix netgroup lookup for resolvable IP addresses (bz 1341908)
  - umount: fixed typo in usage message (bz 1246329)
  - mount.nfs: added usage output when no arguemnts are given (bz 1001443)
  - nfsidmap: added the -h option (bz 1339877)
  - exportfs: Do not fail on empty exports file (bz 1340788)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.30
changelog:
  - statd: suppress a benign log message in nsm_delete_host() (bz 1347030)
  - start-statd: Use flock to serialize the running of this script (bz 1300007)
  - spec: update requires version of libtirpc-devel (bz 1346711)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.2-2
changelog:
  - Restore previously used s390x patch as it isn't upstream yet
  - Related: rhbz#1031465 - CVE-2013-5607


author: Elio Maldonado <emaldona@redhat.com> 4.10.6-2
changelog:
  - Generic 32/64 bit platform detection (fix ppc64le build)
  - Resolves: Bug 1126243 - Ensure nspr is built for 64 bit on ppc64le


author: Elio Maldonado <emaldona@redhat.com> - 4.10.6-3
changelog:
  - Restore s390x related patch as it hasn't been applied upstream yet
  - Resolves: Bug 1103250 - Rebase RHEL 7.1 to NSPR 4.10.6 (for FF 31)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-2
changelog:
  - Resolves: Bug 1269363 - CVE-2015-7183
  - nspr: heap-buffer overflow in PL_ARENA_ALLOCATE can lead to crash (under ASAN), potential memory corruption


author: Elio Maldonado <emaldona@redhat.com> - 4.11.0-1
changelog:
  - Rebase to NSPR 4.11
  - Resolves: Bug 1297941 - Rebase RHEL 7.3 to NSS 3.21 in preparation for Firefox 45


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-13
changelog:
  - Fix reuse of session cache entry
  - Resolves: Bug 1241172 - Certificate verification fails with multiple https urls


author: Kai Engert <kaie@redhat.com> - 3.21.0-14
changelog:
  - Support TLS 1.2 certificate_verify hashes other than PRF,
    backported fix from NSS 3.25 (upstream bug 1179338).


author: Kai Engert <kaie@redhat.com> - 3.21.0-16
changelog:
  - enable ssl_gtests (without extended master secret tests), Bug 1298692
  - call SECMOD_RestartModules in nss_Init, Bug 1317691


author: Daiki Ueno <dueno@redhat.com> - 3.28.2-1.0
changelog:
  - Rebase to NSS 3.28.2
  - Remove NSS_ENABLE_ECC and NSS_ECC_MORE_THAN_SUITE_B setting, which
    is no-op now
  - Enable gtests when requested
  - Remove nss-646045.patch and fix-nss-test-filtering.patch, which are
    not necessary
  - Remove sslauth-no-v2.patch and
    nss-sslstress-txt-ssl3-lower-value-in-range.patch, as SSLv2 is
    already disabled in upstream
  - Remove ssl-server-min-key-sizes.patch, as we decided to support DH
    key size greater than 1023 bits
  - Remove local patches for SHA384 cipher suites (now supported in
    upstream): dhe-sha384-dss-support.patch,
    client_auth_for_sha384_prf_support.patch,
    nss-fix-client-auth-init-hashes.patch, nss-map-oid-to-hashalg.patch,
    nss-enable-384-cipher-tests.patch, nss-fix-signature-and-hash.patch,
    fix-allowed-sig-alg.patch, tests-extra.patch
  - Remove upstreamed patches: rh1238290.patch,
    fix-reuse-of-session-cache-entry.patch, flexible-certverify.patch,
    call-restartmodules-in-nssinit.patch


author: Daiki Ueno <dueno@redhat.com> - 3.28.2-1.2
changelog:
  - Reorder cipher suites for compatibility
  - Re-enable BUILD_OPT, mistakenly disabled in the previous build


author: Daiki Ueno <dueno@redhat.com> - 3.28.2-1.4
changelog:
  - Add patch to fix bash syntax error in tests/ssl.sh
  - Build with support for SSLKEYLOGFILE
  - Disable the use of RSA-PSS with SSL/TLS


author: Daiki Ueno <dueno@redhat.com> - 3.28.2-1.6
changelog:
  - Restore ssl-server-min-key-sizes.patch
  - Disable TLS_ECDHE_{RSA,ECDSA}_WITH_AES_128_CBC_SHA256 by default
  - Enable 4 AES_256_GCM_SHA384 ciphersuites, enabled by the downstream
    patch in the previous release
  - Fix crash with tstclnt -W


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-1
changelog:
  - Rebase to nss-util from nss 3.21
  - Resolves: Bug 1297940 - Rebase RHEL 7.3 to NSS-util 3.21 in preparation for Firefox 45


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-4
changelog:
  - Manual merge from the rhel-7.2 branch
  - Fix one alias for naming compatibility with prior release
  - Remove an unused patch


author: Daiki Ueno <dueno@redhat.com> - 3.21.3-1
changelog:
  - Rebase to nss-3.21.3
  - Remove patch for CVE-2016-1950, which is included in the release
  - Related: Bug 1347908


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-16
changelog:
  - refresh peers on routing updates (#1048132)
  - fix calculation of root dispersion (#1045377)
  - remove unnecessary IPv6 restrict line from default ntp.conf (#1048255)
  - remove kod from default restrict in ntp.conf (#1048255)
  - update logconfig documentation for patched default (#1048252)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-19
changelog:
  - don't generate weak control key for resolver (CVE-2014-9293)
  - don't generate weak MD5 keys in ntp-keygen (CVE-2014-9294)
  - fix buffer overflows via specially-crafted packets (CVE-2014-9295)
  - don't mobilize passive association when authentication fails (CVE-2014-9296)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-20
changelog:
  - validate lengths of values in extension fields (CVE-2014-9297)
  - drop packets with spoofed source address ::1 (CVE-2014-9298)
  - reject packets without MAC when authentication is enabled (CVE-2015-1798)
  - protect symmetric associations with symmetric key against DoS attack (CVE-2015-1799)
  - fix generation of MD5 keys with ntp-keygen on big-endian systems (CVE-2015-3405)
  - add option to set Differentiated Services Code Point (DSCP) (#1202828)
  - add nanosecond support to SHM refclock (#1117702)
  - allow creating all SHM segments with owner-only access (#1122012)
  - allow different thresholds for forward and backward step (#1193154)
  - allow symmetric keys up to 32 bytes again (#1191111)
  - don't step clock for leap second with -x option (#1191122)
  - don't drop packets with source port below 123 (#1171640)
  - retry joining multicast groups (#1207014)
  - increase memlock limit again (#1053569)
  - warn when monitor can't be disabled due to limited restrict (#1191108)
  - use larger RSA exponent in ntp-keygen (#1191116)
  - fix crash in ntpq mreadvar command (#1180721)
  - move sntp kod database to allow SELinux labeling (#1082934)
  - fix typos in ntpd man page (#1195211)
  - improve documentation of restrict command (#1213953)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-22
changelog:
  - check origin timestamp before accepting KoD RATE packet (CVE-2015-7704)
  - allow only one step larger than panic threshold with -g (CVE-2015-5300)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-24
changelog:
  - fix crash with invalid logconfig command (CVE-2015-5194)
  - fix crash when referencing disabled statistic type (CVE-2015-5195)
  - don't hang in sntp with crafted reply (CVE-2015-5219)
  - don't crash with crafted autokey packet (CVE-2015-7691, CVE-2015-7692,
    CVE-2015-7702)
  - fix memory leak with autokey (CVE-2015-7701)
  - don't allow setting driftfile and pidfile remotely (CVE-2015-7703)
  - don't crash in ntpq with crafted packet (CVE-2015-7852)
  - check key ID in packets authenticated with symmetric key (CVE-2015-7974)
  - fix crash with reslist command (CVE-2015-7977, CVE-2015-7978)
  - don't allow spoofed packets to demobilize associations (CVE-2015-7979,
    CVE-2016-1547)
  - don't accept server/peer packets with zero origin timestamp (CVE-2015-8138)
  - fix infinite loop in ntpq/ntpdc (CVE-2015-8158)
  - fix resetting of leap status (#1242553)
  - extend rawstats log (#1242877)
  - report clock state changes related to leap seconds (#1242935)
  - allow -4/-6 on restrict lines with mask (#1304492)
  - explain synchronised state in ntpstat man page (#1309594)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-25
changelog:
  - don't allow spoofed packet to enable symmetric interleaved mode
    (CVE-2016-1548)
  - check mode of new source in config command (CVE-2016-2518)
  - make MAC check resilient against timing attack (CVE-2016-1550)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-25.el7_3.1
changelog:
  - don't limit rate of packets from sources (CVE-2016-7426)
  - don't change interface from received packets (CVE-2016-7429)
  - fix calculation of root distance again (CVE-2016-7433)
  - require authentication for trap commands (CVE-2016-9310)
  - fix crash when reporting peer event to trappers (CVE-2016-9311)


author: Ravindra Kumar <ravindrakumar@vmware.com> - 9.10.2-1
changelog:
  - Package new upstream version open-vm-tools-9.10.2-2822639
  - Removed the patches that are no longer needed
    resolves: rhbz#1172833


author: Richard W.M. Jones <rjones@redhat.com> - 10.0.5-2
changelog:
  - Rebase to open-vm-tools 10.0.5 (from Fedora Rawhide)
    resolves: rhbz#1268537
  - Remove PAM calls to pam_unix2.so module
    resolves: rhbz#1313071


author: Richard W.M. Jones <rjones@redhat.com> - 10.0.5-4
changelog:
  - Fix failure to quiesce filesystem when Docker containers are running
    resolves: rhbz#1406483
  - Fix for deadlock when taking a snapshot
    resolves: rhbz#1398802


author: Nikola Forró <nforro@redhat.com> - 1.5.1-11
changelog:
  - Fix decoding of chroma-subsampled images
  - Add patches for CVE-2016-9573 and CVE-2016-9675
  - Fix Coverity issues
    Resolves: #1419772


author: Raphael Sanchez Prudencio <rsprudencio@redhat.com> - 1.2.10-3
changelog:
  - fix oscap-docker bug that incorrectly informs about incompliance of the assessed system (#1410409)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-26 + 0.9.3-9
changelog:
  - Drop glob patch for sftp client preventing listing many files (#1310303)
  - Fix race condition between audit messages from different processes (#1310684)
  - Make systemd service forking to properly report state (#1291172)
  - Get rid of rpm triggers for openssh-5.x (#1312013)
  - Generate the host keys when the key files are empty (#1266043)
  - pam_ssh_agent_auth: authorized_keys_command option (#1317858)
  - Don't use MD5 digest from pam_ssh_agent_auth in FIPS mode (#1317952)


author: Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-27 + 0.9.3-9
changelog:
  - Coverity and RPMDiff build issues (#1334326)
  - CVE-2015-8325: privilege escalation via user's PAM environment and UseLogin=yes (#1329191)
  - Check for real location of .k5login file (#1328243)
  - close ControlPersist background process stderr (#1335540)


author: Jakub Jelen <jjelen@redhat.com> - 6.6.1p1-28 + 0.9.3-9
changelog:
  - SFTP force permission collision with umask (#1344614)
  - Make closefrom() ignore FD's to /dev/ devices on s390 (#1318760)
  - Create a default value for AuthenticationMethods any (#1237129)
  - Fix ssh-copy-id with LogLevel=quiet (#1349556)
  - Expose more information to PAM (#1312304)
  - Move MAX_DISPLAYS to a configuration option (#1341302)
  - Add a wildcard option to PermitOpen directive (host) (#1344106)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-52
changelog:
  - fix CVE-2015-3194 - certificate verify crash with missing PSS parameter
  - fix CVE-2015-3195 - X509_ATTRIBUTE memory leak
  - fix CVE-2015-3196 - race condition when handling PSK identity hint


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-55
changelog:
  - fix CVE-2016-0702 - side channel attack on modular exponentiation
  - fix CVE-2016-0705 - double-free in DSA private key parsing
  - fix CVE-2016-0797 - heap corruption in BN_hex2bn and BN_dec2bn


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-56
changelog:
  - fix 1-byte memory leak in pkcs12 parse (#1312112)
  - document some options of the speed command (#1312110)
  - fix high-precision timestamps in timestamping authority
  - enable SCTP support in DTLS 
  - use correct digest when exporting keying material in TLS1.2 (#1289620)
  - fix CVE-2016-0799 - memory issues in BIO_printf
  - add support for setting Kerberos service and keytab in
    s_server and s_client


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-57
changelog:
  - fix CVE-2016-2105 - possible overflow in base64 encoding
  - fix CVE-2016-2106 - possible overflow in EVP_EncryptUpdate()
  - fix CVE-2016-2107 - padding oracle in stitched AES-NI CBC-MAC
  - fix CVE-2016-2108 - memory corruption in ASN.1 encoder
  - fix CVE-2016-2109 - possible DoS when reading ASN.1 data from BIO


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-60
changelog:
  - fix CVE-2016-2177 - possible integer overflow
  - fix CVE-2016-2178 - non-constant time DSA operations
  - fix CVE-2016-2179 - further DoS issues in DTLS
  - fix CVE-2016-2180 - OOB read in TS_OBJ_print_bio()
  - fix CVE-2016-2181 - DTLS1 replay protection and unprocessed records issue
  - fix CVE-2016-2182 - possible buffer overflow in BN_bn2dec()
  - fix CVE-2016-6302 - insufficient TLS session ticket HMAC length check
  - fix CVE-2016-6304 - unbound memory growth with OCSP status request
  - fix CVE-2016-6306 - certificate message OOB reads
  - mitigate CVE-2016-2183 - degrade all 64bit block ciphers and RC4 to
    112 bit effective strength


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-60.1
changelog:
  - fix CVE-2017-3731 - DoS via truncated packets with RC4-MD5 cipher
  - fix CVE-2016-8610 - DoS of single-threaded servers via excessive alerts


author: William Cohen <wcohen@redhat.com> - 0.9.9-17
changelog:
  - Define some  Intel broadwell default unit masks by names
  - Add support for Harrisonville (Denverton SoC)
  - Add support for Skylake-SP server
  - Add support for Kabylake-U/Y
  - Add support for Kabylake-H/S
  - Make Nehalem, Westmere, and Haswell event names unique.


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.15-8
changelog:
  - Quote timestamp-format correctly in alert_snmp.sh.sample
  - Unregister CIB callbacks correctly
  - Print resources section heading consistently in crm_mon output
  - Resolves: rhbz#773656
  - Resolves: rhbz#1361533


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.15-10
changelog:
  - Only clear remote node operation history on startup
  - Resend a lost shutdown request
  - Correctly detect and report invalid configurations
  - Don't include manual page for resource agent that isn't included
  - Resolves: rhbz#1288929
  - Resolves: rhbz#1310486
  - Resolves: rhbz#1352039


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.15-11
changelog:
  - Sanitize readable CIB output collected by crm_report
  - Document crm_report --sos-mode option
  - Speed up crm_report on Pacemaker Remote nodes
  - Avoid sbd fencing when upgrading pacemaker_remote package
  - Resolves: rhbz#1219188
  - Resolves: rhbz#1235434
  - Resolves: rhbz#1323544
  - Resolves: rhbz#1372009


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.15-11.5
changelog:
  - Avoid lrmd segmentation fault when cancelling in-flight systemd operation
  - Resolves: rhbz#1452196


author: Ivan Devat <idevat@redhat.com> - 0.9.152-3
changelog:
  - Added support for pacemaker alerts
  - Added support for qdevice/qnetd provided by corosync
  - Fixed sbd calls on python3
  - Fixed bad request when resource removal takes longer than pcs expects
  - Added support for set expected votes on a live cluster
  - Added a wrapper for holding SELinux context when pcsd is started by systemd
  - Resolves: rhbz#1315371 rhbz#1158805 rhbz#1164402 rhbz#1346852 rhbz#1327739 rhbz#1348579 rhbz#1349465


author: Ivan Devat <idevat@redhat.com> - 0.9.152-4
changelog:
  - Added colocation constraint support in web UI
  - Fixed displaying cluster config when cib is provided as a file
  - Removed side effect on /etc/hosts during build
  - Recipient id is used as identifier in alarms
  - Improved quorum device commands syntax
  - Fixed pcs client for running on a remote node
  - Resolves: rhbz#1281364 rhbz#1269242 rhbz#1353607 rhbz#1315371 rhbz#1158805 rhbz#1289418


author: Ivan Devat <idevat@redhat.com> - 0.9.152-5
changelog:
  - Fixed traceback when stopping pcsd shortly after start
  - Fixed removing a dead node from a cluster
  - Added support for clufter's 'dist' parameter
  - Fixed filtering by property name in "pcs property show"
  - Fixed an error in web UI when removing resources takes a long time
  - Fixed occasional missing optional arguments of resources in web UI
  - Improved help for alerts
  - Fixed recreating a remote node resource
  - Fixed exceptions when authenticating cluster nodes
  - Fixed permissions for bash completion file
  - Resolves: rhbz#1348579 rhbz#1225423 rhbz#1357945 rhbz#1302010 rhbz#1301993 rhbz#1346852 rhbz#1231858 rhbz#1315371 rhbz#1303136 rhbz#1329472 rhbz#1359154 rhbz#1349465


author: Ivan Devat <idevat@redhat.com> - 0.9.152-6
changelog:
  - Fixed documentation regarding clufter
  - Added possibility to change order of resources in a group in web UI
  - Added support for unmanaged resources in web UI
  - Added support for booth (cluster ticket manager)
  - Resolves: rhbz#1357945 rhbz#1281391 rhbz#1264360 rhbz#1308514


author: Ivan Devat <idevat@redhat.com> - 0.9.152-7
changelog:
  - Added possibility to hide inactive resources in "pcs resource show" command
  - Fixed exceptions handling when waiting for response from user in command line
  - Fixed nonexisting resource detection in pcsd
  - Fixed SBD_WATCHDOG_TIMEOUT option value validation
  - Removed possibility to change SBD_PACEMAKER
  - Fixed exception when disabling service on systemd systems
  - Added automatic auto_tie_breaker quorum option set whenever it is needed for SBD to work
  - Fixed setting sbd watchdog in config
  - Fixed error handling when upgrading cib schema
  - Improved consistency of syntax 'pcs alert recipient add' command
  - Resolves: rhbz#1298585 rhbz#1354498 rhbz#1346852 rhbz#1164402 rhbz#1315371 rhbz#1366307


author: Ivan Devat <idevat@redhat.com> - 0.9.152-8
changelog:
  - Fixed error message in node maintenance/unmaintenance commands
  - Fixed missing line at the end of booth config 
  - Fixed documentation regarding booth
  - Fixed remove multiple booth resources with "--force" flag
  - Fixed cleanup of ip resource if it fails to create booth resource
  - Added bash completion for booth
  - Fixed display full booth configuration
  - Added ability to display booth config from remote node
  - Added support for ticket options during adding booth ticket
  - Fixed adding node to cluster when booth is not installed
  - Added restart command for booth
  - Fixed check if auto_tie_breaker is required when enabling sbd
  - Improved way of displaying status of unmanaged primitive resources in web UI
  - Resolves: rhbz#1247088 rhbz#1308514 rhbz#1164402 rhbz#1264360


author: Ivan Devat <idevat@redhat.com> - 0.9.152-9
changelog:
  - Added warning when stopping/destroying qdevice instance which is being used 
  - Fiexed removing qdevice from a cluster which uses sbd
  - Fixed re-running "pcs cluster node add" if it failed due to qdevice
  - Fixed documentation regarding booth
  - Added warning when using unknown booth ticket option
  - Added constraint ticket remove command
  - Fixed return code and message when displaying node utilization for nonexistent node
  - Fixed setting utilization attributes in web UI
  - Fixed support for node utilization on remote node
  - Fixed updating of selected group when displaying new resource dialog
  - Fixed group list when managing cluster running older pcs in web UI 
  - Fixed displaying unmanaged status for resources for older pcs in web UI
  - Fixed clone/master/unclone group/ungroup buttons for older pcs in web UI
  - Fixed node standby/unstandby for older pcs in web UI
  - Resolves: rhbz#1158805 rhbz#1308514 rhbz#1305049 rhbz#1158500 rhbz#1231858


author: Ivan Devat <idevat@redhat.com> - 0.9.152-10
changelog:
  - Fixed error when stopping qdevice if is not running
  - Fixed removing qdevice from a cluster
  - Fixed documentation regarding booth
  - Fixed return code when no matching ticket constraint found during remove
  - Resolves: rhbz#1158805 rhbz#1305049


author: Ivan Devat <idevat@redhat.com> - 0.9.152-10.el7_3.1
changelog:
  - Fixed resolving resource agent name containing systemd service instance
  - Added posibility to push only diff of cib in 'cluster cib push'
  - Resolves: rhbz#1408476 rhbz#1404233


author: Ivan Devat <idevat@redhat.com> - 0.9.152-10.el7_3.3
changelog:
  - Provide a better error message in `pcs cluster cib-push` when the diff of the old and the new CIB is empty
  - Resolves: rhbz#1420757


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-284
changelog:
  - Use a macro to cover all 64-bit PowerPC architectures (bug #1061792)
  - Declare dependencies for cpan tool (bug #1122368)
  - Use stronger algorithm needed for FIPS in t/op/crypt.t (bug #1084796)
  - Make *DBM_File desctructors thread-safe (bug #1107542)


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-286
changelog:
  - Remove CPU-speed-sensitive test in Benchmark test (bug #1238567)
  - Rebuild with corrected binutils to fix systemtap support (bug #1238472)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.16.3-288
changelog:
  - Fix CRLF conversion in ASCII FTP upload (bug #1263734)
  - Don't leak the temp utf8 copy of namepv (bug #1063330)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.16.3-291
changelog:
  - Backported and sub-packaged libraries historically supplied with Perl 4
    into perl-Perl4-CoreLibs


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-5
changelog:
  - PKI TRAC Ticket #978  - TPS connector man page: add revocation routing
    info (cfu)
  - PKI TRAC Ticket #1285 - [MAN] Apply 'generateCRMFRequest() removed from
    Firefox' workarounds to appropriate 'pki' man page (jmagne)
  - PKI TRAC Ticket #2246 - [MAN] Man Page: AuditVerify (cfu)
  - PKI TRAC Ticket #2381 - Throws exception while providing invalid module.
    (edewata)
  - PKI TRAC Ticket #2383 - CLI :: pki client-cert-request --extractable
    should accept only boolean value (edewata)
  - PKI TRAC Ticket #2389 - Installation: subsystem certs could have notAfter
    beyond CA signing cert in case of external or existing CA (cfu)
  - PKI TRAC Ticket #2399 - Dogtag 10.3.5: Miscellaneous Enhancements
    (akasurde, alee, cheimes, edewata, jmagne, mharmsen)
  - PKI TRAC Ticket #2401 - pkispawn calls dnsdomainname even if it does not
    rpm-require hostname (mharmsen)
  - PKI TRAC Ticket #2402 - Conflict in file ownership in pki-base and
    pki-server (cheimes)
  - PKI TRAC Ticket #2403 - Deployment problem with RESTEasy 3.0.17 (edewata)
  - PKI TRAC Ticket #2406 - Make starting CRL Number configurable (jmagne)
  - PKI TRAC Ticket #2412 - pki client-cert-import --trust option does not
    apply the specified trust bits (alee)
  - PKI TRAC Ticket #2418 - [TPS] Some template substitution didn't happen
    during installation (alee)
  - PKI TRAC Ticket #2420 - CA subsystem OSCP responder fails when LWCAs are
    not used (ftweedal)
  - PKI TRAC Ticket #2421 - Incorrect SELinux contexts
    Installation/Configuration (edewata)
  - PKI TRAC Ticket #2424 - ipa-ca-install fails on replica when IPA server
    is converted from CA-less to CA-full (edewata)
  - PKI TRAC Ticket #2428 - broken request links for CA's system certs in
    agent request viewing (cfu)
  - PKI TRAC Ticket #2430 - CA Agent certificate list is not sorted by serial
    number in migration case (jmagne)
  - PKI TRAC Ticket #2431 - Errors noticed during ipa server upgrade.
    (mharmsen)
  - PKI TRAC Ticket #2433 - Lightweight CA GET <id>/chain returns bogus PEM
    data (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-7
changelog:
  - PKI TRAC Ticket #690 - [MAN] pki-tools man pages (mharmsen)
    - CMCEnroll
  - PKI TRAC Ticket #833 - pki user-mod fullName="" gives an error message
    "PKIException: LDAP error (21): error result" (edewata)
  - PKI TRAC Ticket #2431 - Errors noticed during ipa server upgrade.
    (cheimes, edewata, mharmsen)
  - PKI TRAC Ticket #2432 - Kra-selftest behavior is not as expected (edewata)
  - PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements
    (edewata, mharmsen)
  - PKI TRAC Ticket #2437 - TPS UI: while adding certs for users from TPSUI pem
    format with/without header works while pkcs7 with header is not allowed
    (edewata)
  - PKI TRAC Ticket #2440 - Optional CA signing CSR for migration (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-8
changelog:
  - PKI TRAC Ticket #1578 - Authentication Instance Id PinDirEnrollment with authType value as SslclientAuth is not working (jmagne)
  - PKI TRAC TIcket #2414 - pki pkcs12-cert-del shows a successfully deleted message when a wrong nickname is provided (gkapoor)
  - PKI TRAC Ticket #2423 - pki_ca_signing_token when not specified does not fallback to pki_token_name value (edewata)
  - PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements (akasurde) - ticket remains open
  - PKI TRAC Ticket #2439 - Outdated deployment descriptors in upgraded server(edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-9
changelog:
  - PKI TRAC Ticket #1638 - Lightweight CAs: revoke certificate on CA deletion
    (ftweedal)
  - PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements
    (edewata)
  - PKI TRAC Ticket #2443 - Prevent deletion of host CA's keys if LWCA entry
    deleted (ftweedal)
  - PKI TRAC Ticket #2444 - Authority entry without entryUSN is skipped even if
    USN plugin enabled (ftweedal)
  - PKI TRAC Ticket #2446 - pkispawn: make subject_dn defaults unique per
    instance name (for shared HSM) (cfu)
  - PKI TRAC Ticket #2447 - CertRequestInfo has incorrect URLs (vakwetu)
  - PKI TRAC Ticket #2449 - Unable to create system certificates in different
    tokens (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-10
changelog:
  - Revert Patch:  PKI TRAC Ticket #2449 - Unable to create system certificates
    in different tokens (edewata)
  - Resolves:  rhbz #1374054 - ipa-replica-install fails setting up certificate
  - Restores:  rhbz #1319557 - pkispawn KRA instance is failing server
  - Removes from Errata:  rhbz #1372041 - Unable to create system certificates
    in different tokens


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-11
changelog:
  - PKI TRAC Ticket #1527 - TPS Enrollment always goes to "ca1" (cfu)
  - PKI TRAC Ticket #1664 - [BUG] Add ability to disallow TPS to enroll a single
    user on multiple tokens. (jmagne)
  - PKI TRAC Ticket #2478 - pkispawn fails as it is not able to find openssl as a
    dependency package (mharmsen)
  - PKI TRAC Ticket #2483 - Unable to read an encrypted email using renewed
    tokens (jmagne)
  - PKI TRAC Ticket #2496 - Cert/Key recovery is successful when the cert serial
    number and key id on the ldap user mismatches (cfu)
  - PKI TRAC Ticket #2505 - Fix packaging duplicates of classes in multiple jar
    files (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-12
changelog:
  - ## RHEL 7.3.z Batch Update 1
  - Bugzilla Bug #1390318 - CA EE: Submit caUserCert request without uid does
    not show proper error message (alee)
  - Bugzilla Bug #1390319 - Failed to start pki-tomcatd Service
    ("ipa-cacert-manage renew" failed?) (edewata)
  - Bugzilla Bug #1390320 - pkispawn fails as it is not able to find openssl as
    a dependency package (mharmsen)
  - Bugzilla Bug #1390321 - two-step externally-signed CA installation fails due
    to missing AuthorityID (ftweedal)
  - Bugzilla Bug #1390322 - Spurious host authority entries created (ftweedal)
  - Bugzilla Bug #1390324 - KRA installation failed against externally-signed CA
    with partial certificate chain (edewata)
  - Bugzilla Bug #1389757 - Problems with FIPS mode (edewata)
  - Bugzilla Bug #1390311 - Fix packaging duplicates of classes in multiple jar
    files (edewata)
  - Bugzilla Bug #1390325 - Typo in comment line of UserPwdDirAuthentication.java
    (edewata)
  - ## RHCS 9.1.z Batch Update 1
  - Bugzilla Bug #1248553 - TPS Enrollment always goes to "ca1" (cfu)
  - Bugzilla Bug #1274096 -  [BUG] Add ability to disallow TPS to enroll a
    single user on multiple tokens. (jmagne)
  - Bugzilla Bug #1379379 - Unable to read an encrypted email using renewed
    tokens (jmagne)
  - Bugzilla Bug #1379749 - Automatic recovery of encryption cert is not working
    when a token is physically damaged and a temporary token is issued (jmagne)
  - Bugzilla Bug #1381375 - Cert/Key recovery is successful when the cert serial
    number and key id on the ldap user mismatches
  - Bugzilla Bug #1381635 - Token format with external reg fails when
    op.format.externalRegAddToToken.revokeCert=true (cfu)
  - Bugzilla Bug #1382762 - PIN_RESET policy is not giving expected results when
    set on a token (jmagne)
  - Bugzilla Bug #1382862 - TPS token enrollment fails to setupSecureChannel
    when TPS and TKS security db is on fips mode. (jmagne)
  - Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is
    not reflected in the TPS Web UI (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-13
changelog:
  - ## RHEL 7.3.z Batch Update 1
  - Bugzilla Bug #1389757 - Problems with FIPS mode (edewata)
    (added KRA key recovery via CLI in FIPS mode)
  - ## RHCS 9.1.z Batch Update 1
  - Reverted patches associated with
    Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is
    not reflected in the TPS Web UI (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-14
changelog:
  - Marked the following RHCS 9.1.z bug:
    Bugzilla Bug #1382862 - TPS token enrollment fails to setupSecureChannel
    when TPS and TKS security db is on fips mode. (jmagne)
    as a duplicate of RHEL 7.3.z bug:
    Bugzilla Bug #1389757 - Problems with FIPS mode (edewata)
    and moved the patch from the RHCS 9.1.z bug to the RHEL 7.3.z bug.


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-15
changelog:
  - ## RHEL 7.3.z Batch Update 2
  - Bugzilla Bug #1404173 - user-cert-add --serial CLI request to secure port
    with remote CA shows authentication failure (edewata)
  - Bugzilla Bug #1404175 -  pki ca-cert-request-submit fails presumably because
    of missing authentication even if it should not require any (edewata)
  - Bugzilla Bug #1404178 - Changes to target.agent.approve.list parameter is
    not reflected in the TPS Web UI [pki-base] (edewata)
  - Bugzilla Bug #1404172 - Unable to install subordinate CA with HSM in FIPS
    mode (edewata)
  - Bugzilla Bug #1403689 - pkispawn does not change default ecc key size from
    nistp256 when nistp384 is specified in spawn config (jmagne)
  - Bugzilla Bug #1404176 - logging properties and man pages (edewata)
  - ## RHCS 9.1.z Batch Update 2
  - Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is
    not reflected in the TPS Web UI [pki-tps] (edewata)
  - Bugzilla Bug #1391207 - Automatic recovery of encryption cert - CA and TPS
    tokendb shows different certificate status (cfu)
  - Bugzilla Bug #1395479 -  TPS throws "err=6" when attempting to format and
    enroll G&D Cards (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-16
changelog:
  - Separate original patches into RHEL and RHCS portions
  - ## RHEL 7.3.z Batch Update 2
  - Bugzilla Bug #1404176 - logging properties and man pages (edewata)
  - Bugzilla Bug #1405328 - TPS throws "err=6" when attempting to format and
    enroll G&D Cards (jmagne)
  - ## RHCS 9.1.z Batch Update 2
  - Bugzilla Bug #1395479 - TPS throws "err=6" when attempting to format and
    enroll G&D Cards (jmagne)
  - Bugzilla Bug #1404900 - RHCS logging properties (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-17
changelog:
  - ## RHCS 9.1.z Batch Update 3
  - Bugzilla Bug #1391207 - Automatic recovery of encryption cert - CA and TPS
    tokendb shows different certificate status (cfu)
  - ## RHEL 7.3.z Batch Update 3
  - Bugzilla Bug #1417063 - ECDSA Certificates Generated by Certificate System
    8.1 fail NIST validation test with parameter field. (cfu)
  - Bugzilla Bug #1417064 - Unable to search certificate requests using the
    latest request ID (edewata)
  - Bugzilla Bug #1417065 - CA Certificate Issuance Date displayed on CA website
    incorrect (alee)
  - Bugzilla Bug #1417066 - update to 7.3 IPA with otpd bugfixes, tomcat will
    not finish start, hangs (ftweedal)
  - Bugzilla Bug #1417067 - pki-tomcat for 10+ minutes before generating cert
    (edewata)
  - Bugzilla Bug #1417190 - Problem with default AJP hostname in IPv6
    environment. (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-18
changelog:
  - ## RHEL 7.3.z Batch Update 4
  - Bugzilla Bug #1429492 - Add profile component that copies CN to SAN
    (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-19
changelog:
  - ## RHEL 7.3.z Batch Update 6
  - Bugzilla Bug #1447095 - RHCS 9.1 RC5 CA in the certificate profiles the
    startTime parameter is not working as expected. (jmagne)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-2
changelog:
  - sepolgen: Add support for TYPEBOUNDS statement in INTERFACE policy
    files (#1319338)
  - Add documentation for MCS separated domains
  - Move svirt man page out of libvirt into its own


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-3
changelog:
  - Update sandbox types in sandbox manual
  - Fix typos in semanage manpages
  - Fix the documentation of -l,--list for semodule
  - Minor fix in a French translation
  - Fix the extract example in semodule.8
  - Update sandbox.8 man page
  - Remove typos from chcat --help
  - Fix multiple spelling errors
  - hll/pp: Warn if module name different than output filename


author: Petr Lautrbach <plautrba@redhat.com> 2.5-6.2
changelog:
  - open_init_pty: Do not error on EINTR
  - Fix [-s STORE] typos in semanage
  - Don't use subprocess.getstatusoutput() in Python 2 code


author: Petr Lautrbach <plautrba@redhat.com> 2.5-7
changelog:
  - fixfiles: Pass -n to restorecon for fixfiles check
  - sepolicy: Check get_rpm_nvr_list() return value
  - Don't use subprocess.getstatusoutput() in Python 2 code
  - semanage: Add auditing of changes in records
  - Remove unused 'q' from semodule getopt string


author: Petr Lautrbach <plautrba@redhat.com> 2.5-8
changelog:
  - audit2allow: tests should use local copy not system
  - audit2allow: remove audit2why so that it gets symlinked
  - semanage: fix man page and help message for import option
  - semanage: fix error message for fcontext -m
  - semanage: Fix semanage fcontext -D
  - semanage: Correct fcontext auditing
  - semanage: Default serange to "s0" for port modify
  - semanage: Use socket.getprotobyname for protocol
  - semanage: fix modify action in node and interface


author: Petr Lautrbach <plautrba@redhat.com> 2.5-9
changelog:
  - sandbox: create a new session for sandboxed processes - CVE-2016-7545
  - sandbox: do not try to setup directories without -X or -M


author: Miloslav Trmač <mitr@redhat.com> - 0.112-2
changelog:
  - Workaround pam_systemd setting broken XDG_RUNTIME_DIR
    Resolves: #1033774
  - Always use mozjs-17.0 even if js-devel is installed


author: Miloslav Trmač <mitr@redhat.com> - 0.112-12
changelog:
  - Fix a memory leak in PolkitPermission.
    Patch by Rui Matos <tiagomatos@gmail.com>
    Resolves: #1433915


author: Jaromir Capik <jcapik@redhat.com> - 3.3.10-2
changelog:
  - Replacing RC tarball with final 3.3.10 release
  - Related: rhbz#1119263 rhbz#1119260 rhbz#1060715 rhbz#1113206
  - Related: rhbz#1112734 rhbz#1078310 rhbz#1116309 rhbz#1070736


author: Jaromir Capik <jcapik@redhat.com> - 3.3.10-3
changelog:
  - Disabling translated man pages due to conflicts with man-pages-*
  - Removing /etc/sysctl.d (quietly stolen by systemd)
  - Related: rhbz#1119263 rhbz#1119260 rhbz#1060715 rhbz#1113206
  - Related: rhbz#1112734 rhbz#1078310 rhbz#1116309 rhbz#1070736


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-7
changelog:
  - Fixing sysinfo - devices with length exceeding 15 chars are not displayed in vmstat -d
  - Resolves: #1169349


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-9
changelog:
  - Fixes showing same cgroups for threads under process by adding format option
  - Resolves: rhbz#1284087


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-10
changelog:
  - Fixes sysinfo - devices with name longer than 20 chars are mistaken for partitions
  - Resolves: rhbz#1169349


author: Wim Taymans <wtaymans@redhat.com> - 6.0-4
changelog:
  - Add more Requires to avoid testing multiple versions
  - enable hardened build
  - Fix missing %endif
  - Resolves: #1174548


author: Rex Dieter <rdieter@fedoraproject.org> - 6.0-7
changelog:
  - better autostart.patch, handle case were autospawn is disabled
    (or otherwise doesn't work, like for root user)
  - Resolves: #1269104


author: d.marlin <dmarlin@redhat.com>
changelog:
  - Add support for ppc64 in LE mode running ABIv2
    Signed-off-by: Ulrich Weigand <uweigand@de.ibm.com>
    Signed-off-by: Tony Breeds <tony@bakeyournoodle.com>
    rhbz#1252900
  - Remove s390x from skip check list.
  - Bump release and build of all archs.


author: Vritant Jain <vrjain@redhat.com> 1.17.2-1
changelog:
  - Added 7.3 releaser (vrjain@redhat.com)
  - Updated UEPConnection.getProduct to explicitly reference product UUID
    (crog@redhat.com)


author: Vritant Jain <vrjain@redhat.com> 1.17.4-1
changelog:
  - 1346417: Allow users to set socket timeout. (awood@redhat.com)
  - Fix Flake8 Errors (bcourt@redhat.com)
  - Add Fedora 24 to the branch list. (awood@redhat.com)
  - Added basic SLES compatibilty. Tested against SLES 11 SP3
    (darinlively@gmail.com)


author: Vritant Jain <vrjain@redhat.com> 1.17.6-1
changelog:
  - 1315901: Exception handling for PEM cert read (wpoteat@redhat.com)
  - 1334916: Add rhsm.conf logging section defaults (csnyder@redhat.com)
  - 1360909: Added functionality for regenerating entitlement certificates
    (crog@redhat.com)


author: Vritant Jain <vrjain@redhat.com> 1.17.7-1
changelog:
  - 1366301: Entitlement regeneration no longer propagates server errors
    (crog@redhat.com)
  - 1365280: Update default_log_level to INFO (csnyder@redhat.com)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.1.0-2.el7
changelog:
  - Create separate qemu-guest-agent package based on qemu-kvm-rhev-2.1.0-1.el7 [bz#1117096]
  - Resolves: #bz1117096


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.1.0-3.el7
changelog:
  - Allow building qemu-guest-agent on ppc64le
  - Synchronize with qemu-kvm-rhev-2.1.0-3.el7
  - Resolves: bz#1132718
    (qemu-guest-agent fails to build for ppc64le)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.1.0-4.el7
changelog:
  - kvm-Mark-etc-sysconfig-qemu-ga-as-config-noreplace.patch [bz#1150924]
  - Resolves: bz#1150924
    (/etc/sysconfig/qemu-ga is replaced when updated)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.3.0-2.el7
changelog:
  - synchronized with qemu-kvm-rhev-2.3.0-9.el7
  - qemuga-Change-fsreeze-hook-default-location.patch [bz#1210707]
  - qemuga-qga-commands-posix-Fix-bug-in-guest-fstrim.patch [bz#1211973]
  - Resolves: bz#1210707
    (The default path '/etc/qemu/fsfreeze-hook' for 'fsfreeze-hook' script doesn't exist)
  - Resolves: bz#1211973
    ('guest-fstrim' failed for guest with os on spapr-vscsi disk)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.3.0-3.el7
changelog:
  - qemuga-Do-not-stop-qemu-guest-agent-service-on-target-switc.patch [bz#1160930]
  - Resolves: bz#1160930
    (The guest agent service in rhel7 guest will be stopped after run the init command)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.5.0-2.el7
changelog:
  - qemuga-redhat-blacklist-guest-exec-commands.patch [bz#1340346]
  - Resolves: bz#1340346
    (blacklist guest-exec in newer version of qemu-guest-agent)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.5.0-3.el7
changelog:
  - qemuga-spec-add-qemu-ga-man-page.patch [bz#1101556]
  - Resolves: bz#1101556
    ([RFE] qemu-ga should have a config file)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.1
changelog:
  - kvm-ide-fix-halted-IO-segfault-at-reset.patch [bz#1393042]
  - kvm-hw-i386-regenerate-checked-in-AML-payload-RHEL-only.patch [bz#1392027]
  - kvm-SPEC-file-flip-the-build-from-IASL-to-checked-in-AML.patch [bz#1392027]
  - Resolves: bz#1392027
    (shutdown rhel 5.11 guest failed and stop at "system halted")
  - Resolves: bz#1393042
    (system_reset should clear pending request for error (IDE))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.2
changelog:
  - kvm-virtio-introduce-virtqueue_unmap_sg.patch [bz#1393484]
  - kvm-virtio-introduce-virtqueue_discard.patch [bz#1393484]
  - kvm-virtio-decrement-vq-inuse-in-virtqueue_discard.patch [bz#1393484]
  - kvm-balloon-fix-segfault-and-harden-the-stats-queue.patch [bz#1393484]
  - kvm-virtio-balloon-discard-virtqueue-element-on-reset.patch [bz#1393484]
  - kvm-virtio-zero-vq-inuse-in-virtio_reset.patch [bz#1393484]
  - kvm-virtio-add-virtqueue_rewind.patch [bz#1393484]
  - kvm-virtio-balloon-fix-stats-vq-migration.patch [bz#1393484]
  - Resolves: bz#1393484
    ([RHEL7.3] KVM guest shuts itself down after 128th reboot)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.3
changelog:
  - kvm-net-check-packet-payload-length.patch [bz#1398217]
  - Resolves: bz#1398217
    (CVE-2016-2857 qemu-kvm: Qemu: net: out of bounds read in net_checksum_calculate() [rhel-7.3.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.4
changelog:
  - kvm-virtio-blk-Release-s-rq-queue-at-system_reset.patch [bz#1420049]
  - kvm-cirrus_vga-fix-off-by-one-in-blit_region_is_unsafe.patch [bz#1418232]
  - kvm-display-cirrus-check-vga-bits-per-pixel-bpp-value.patch [bz#1418232]
  - kvm-display-cirrus-ignore-source-pitch-value-as-needed-i.patch [bz#1418232]
  - kvm-cirrus-handle-negative-pitch-in-cirrus_invalidate_re.patch [bz#1418232]
  - kvm-cirrus-allow-zero-source-pitch-in-pattern-fill-rops.patch [bz#1418232]
  - kvm-cirrus-fix-blit-address-mask-handling.patch [bz#1418232]
  - kvm-cirrus-fix-oob-access-issue-CVE-2017-2615.patch [bz#1418232]
  - Resolves: bz#1418232
    (CVE-2017-2615 qemu-kvm: Qemu: display: cirrus: oob access while doing bitblt copy backward mode [rhel-7.3.z])
  - Resolves: bz#1420049
    (system_reset should clear pending request for error (virtio-blk))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.5
changelog:
  - kvm-cirrus-fix-patterncopy-checks.patch [bz#1420490]
  - kvm-Revert-cirrus-allow-zero-source-pitch-in-pattern-fil.patch [bz#1420490]
  - kvm-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput.patch [bz#1420490]
  - Resolves: bz#1420490
    (EMBARGOED CVE-2017-2620 qemu-kvm: Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo [rhel-7.3.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.6
changelog:
  - kvm-fix-cirrus_vga-fix-OOB-read-case-qemu-Segmentation-f.patch [bz#1430059]
  - kvm-cirrus-vnc-zap-bitblit-support-from-console-code.patch [bz#1430059]
  - kvm-cirrus-add-option-to-disable-blitter.patch [bz#1430059]
  - kvm-cirrus-fix-cirrus_invalidate_region.patch [bz#1430059]
  - kvm-cirrus-stop-passing-around-dst-pointers-in-the-blitt.patch [bz#1430059]
  - kvm-cirrus-stop-passing-around-src-pointers-in-the-blitt.patch [bz#1430059]
  - kvm-cirrus-fix-off-by-one-in-cirrus_bitblt_rop_bkwd_tran.patch [bz#1430059]
  - Resolves: bz#1430059
    (CVE-2016-9603 qemu-kvm: Qemu: cirrus: heap buffer overflow via vnc connection [rhel-7.3.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.7
changelog:
  - kvm-char-serial-cosmetic-fixes.patch [bz#1452332]
  - kvm-char-serial-Use-generic-Fifo8.patch [bz#1452332]
  - kvm-char-serial-serial_ioport_write-Factor-out-common-co.patch [bz#1452332]
  - kvm-char-serial-fix-copy-paste-error-fifo8_is_full-vs-em.patch [bz#1452332]
  - kvm-char-serial-Fix-emptyness-check.patch [bz#1452332]
  - kvm-char-serial-Fix-emptyness-handling.patch [bz#1452332]
  - kvm-serial-poll-the-serial-console-with-G_IO_HUP.patch [bz#1452332]
  - kvm-serial-change-retry-logic-to-avoid-concurrency.patch [bz#1452332]
  - kvm-qemu-char-ignore-flow-control-if-a-PTY-s-slave-is-no.patch [bz#1452332]
  - kvm-serial-check-if-backed-by-a-physical-serial-port-at-.patch [bz#1452332]
  - kvm-serial-reset-thri_pending-on-IER-writes-with-THRI-0.patch [bz#1452332]
  - kvm-serial-clean-up-THRE-TEMT-handling.patch [bz#1452332]
  - kvm-serial-update-LSR-on-enabling-disabling-FIFOs.patch [bz#1452332]
  - kvm-serial-only-resample-THR-interrupt-on-rising-edge-of.patch [bz#1452332]
  - kvm-serial-make-tsr_retry-unsigned.patch [bz#1452332]
  - kvm-serial-simplify-tsr_retry-reset.patch [bz#1452332]
  - kvm-serial-separate-serial_xmit-and-serial_watch_cb.patch [bz#1452332]
  - kvm-serial-remove-watch-on-reset.patch [bz#1452332]
  - Resolves: bz#1452332
    (RHEL 7.2 based VM (Virtual Machine) hung for several hours apparently waiting for lock held by main_loop)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.8
changelog:
  - kvm-char-change-qemu_chr_fe_add_watch-to-return-unsigned.patch [bz#1452332]
  - Resolves: bz#1452332
    (RHEL 7.2 based VM (Virtual Machine) hung for several hours apparently waiting for lock held by main_loop)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.9
changelog:
  - kvm-spice-fix-spice_chr_add_watch-pre-condition.patch [bz#1452332]
  - Resolves: bz#1452332
    (RHEL 7.2 based VM (Virtual Machine) hung for several hours apparently waiting for lock held by main_loop)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.10
changelog:
  - kvm-nbd-Fully-initialize-client-in-case-of-failed-negoti.patch [bz#1460179]
  - kvm-nbd-Fix-regression-on-resiliency-to-port-scan.patch [bz#1460179]
  - Resolves: bz#1460179
    (CVE-2017-9524 qemu-kvm: Qemu: nbd: segmentation fault due to client non-negotiation [rhel-7.3.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.11
changelog:
  - kvm-virtio-net-dynamic-network-offloads-configuration.patch [bz#1482467]
  - kvm-Workaround-rhel6-ctrl_guest_offloads-machine-type-mi.patch [bz#1482467]
  - Resolves: bz#1482467
    (KVM: windows guest migration from EL6 to EL7 fails. [rhel-7.3.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.12
changelog:
  - kvm-Fix-memory-slot-page-alignment-logic.patch [bz#1468577]
  - Resolves: bz#1468577
    (Backport fix for broken logic that's supposed to ensure memory slots are page aligned)


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 1.5.3-126.el7_3.13
changelog:
  - kvm-target-i386-cpu-add-new-CPUID-bits-for-indirect-bran.patch [bz#1526981]
  - kvm-target-i386-add-support-for-SPEC_CTRL-MSR.patch [bz#1526981]
  - kvm-target-i386-cpu-add-new-CPU-models-for-indirect-bran.patch [bz#1526981]
  - Resolves: bz#1526981
    (EMBARGOED CVE-2017-5715 qemu-kvm: kernel: variant 2 [rhel-7.3.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.14
changelog:
  - kvm-i386-define-the-ssbd-CPUID-feature-bit-CVE-2018-3639.patch [bz#1574073]
  - Resolves: bz#1574073
    (EMBARGOED CVE-2018-3639 qemu-kvm: Kernel: omega-4 [rhel-7.3.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-120.el7
changelog:
  - kvm-Add-install-dependency-to-newer-libusbx-version.patch [bz#1351106]
  - kvm-virtio-error-out-if-guest-exceeds-virtqueue-size.patch [bz#1359729]
  - Resolves: bz#1351106
    (symbol lookup error: /usr/libexec/qemu-kvm: undefined symbol: libusb_get_port_numbers)
  - Resolves: bz#1359729
    (CVE-2016-5403 qemu-kvm: Qemu: virtio: unbounded memory allocation on host via guest leading to DoS [rhel-7.3])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-121.el7
changelog:
  - kvm-json-parser-drop-superfluous-assignment-for-token-va.patch [bz#1276036]
  - kvm-qjson-Apply-nesting-limit-more-sanely.patch [bz#1276036]
  - kvm-qjson-Don-t-crash-when-input-exceeds-nesting-limit.patch [bz#1276036]
  - kvm-check-qjson-Add-test-for-JSON-nesting-depth-limit.patch [bz#1276036]
  - kvm-qjson-Spell-out-some-silent-assumptions.patch [bz#1276036]
  - kvm-qjson-Give-each-of-the-six-structural-chars-its-own-.patch [bz#1276036]
  - kvm-qjson-Inline-token_is_keyword-and-simplify.patch [bz#1276036]
  - kvm-qjson-Inline-token_is_escape-and-simplify.patch [bz#1276036]
  - kvm-qjson-replace-QString-in-JSONLexer-with-GString.patch [bz#1276036]
  - kvm-qjson-Convert-to-parser-to-recursive-descent.patch [bz#1276036]
  - kvm-qjson-store-tokens-in-a-GQueue.patch [bz#1276036]
  - kvm-qjson-surprise-allocating-6-QObjects-per-token-is-ex.patch [bz#1276036]
  - kvm-qjson-Limit-number-of-tokens-in-addition-to-total-si.patch [bz#1276036]
  - kvm-json-streamer-Don-t-leak-tokens-on-incomplete-parse.patch [bz#1276036]
  - kvm-json-streamer-fix-double-free-on-exiting-during-a-pa.patch [bz#1276036]
  - kvm-trace-remove-malloc-tracing.patch [bz#1360137]
  - Resolves: bz#1276036
    (Crash on QMP input exceeding limits)
  - Resolves: bz#1360137
    (GLib-WARNING **: gmem.c:482: custom memory allocation vtable not supported)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-122.el7
changelog:
  - kvm-virtio-validate-the-existence-of-handle_output-befor.patch [bz#1367040]
  - Resolves: bz#1367040
    (QEMU crash when guest notifies non-existent virtqueue)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-123.el7
changelog:
  - kvm-Fix-backport-of-target-i386-add-feature-flags-for-CP.patch [bz#1371619]
  - kvm-Add-skip_dump-flag-to-ignore-memory-region-during-du.patch [bz#1373088]
  - Resolves: bz#1371619
    (Flags xsaveopt xsavec xgetbv1 are missing on qemu-kvm)
  - Resolves: bz#1373088
    ([FJ7.3 Bug]: virsh dump with both --memory-only and --format option fails)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-124.el7
changelog:
  - kvm-target-i386-Add-support-for-FEAT_7_0_ECX.patch [bz#1372459]
  - kvm-target-i386-Add-more-Intel-AVX-512-instructions-supp.patch [bz#1372459]
  - Resolves: bz#1372459
    ([Intel 7.3 Bug] SKL-SP Guest cpu doesn't support avx512 instruction sets(avx512bw, avx512dq and avx512vl) (qemu-kvm))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-125.el7
changelog:
  - kvm-nbd-server-Set-O_NONBLOCK-on-client-fd.patch [bz#1285453]
  - Resolves: bz#1285453
    (An NBD client can cause QEMU main loop to block when connecting to built-in NBD server)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7
changelog:
  - kvm-virtio-recalculate-vq-inuse-after-migration.patch [bz#1376542]
  - Resolves: bz#1376542
    (RHSA-2016-1756 breaks migration of instances)


author: Michal Schmidt <mschmidt@redhat.com> - 7.2_3.17-2
changelog:
  - udev rules: Defer setting of node description to rdma-ndd if it is
    installed.
  - Related: bz1169968


author: Jarod Wilson <jarod@redhat.com> - 7.3_4.7-rc2-1
changelog:
  - Bump version to reflect rdma stack backport target level in 7.3
  - Verify fix to ensure all rdma drivers get into initrd
  - Related: bz1303589


author: Jarod Wilson <jarod@redhat.com> - 7.3_4.7-rc2-3
changelog:
  - Add target modules to initrd module include list for rdma service start in initrd
  - Add iscsi modules to allow iser/iscsi network install/boot
  - Resolves: bz1347548, bz1093972


author: Jarod Wilson <jarod@redhat.com> - 7.3_4.7-rc2-5
changelog:
  - Add a knob for loading on tech preview (i40iw) hardware
  - Make "is module loaded" function name more accurate
  - Related: bz1263936


author: Petr Hracek <phracek@redhat.com> - 1.17.2-2
changelog:
  - rear does not require syslinux
  - changing to arch package so that syslinux is installed
  - Resolves: #1283927


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-73
changelog:
  - portblock: fix tickle_tcp bug
  - nfsserver: use rpcpipefs_dir variable
  - mysql: use replication_port variable
  - oracle: inform user that monprofile must start with C## for
    container databases

    Resolves: rhbz#1337109
    Resolves: rhbz#1337615
    Resolves: rhbz#1337124
    Resolves: rhbz#1328386


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-78
changelog:
  - nfsserver: fix monitor issues causing NFS to start on
    "debug-monitor" and "resource cleanup"
  - nfsserver: remove "up to 10 tries" on start to avoid issues with
    some services taking longer to start
  - nfsserver: stop rpc-gssd to allow unmounting of "rpcpipefs_dir"

    Resolves: rhbz#1356866
    Resolves: rhbz#1126073
    Resolves: rhbz#1346733


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-81
changelog:
  - oracle: fix issue with C## in monprofile and inform user that
    monuser must start with C## as well for container databases

    Resolves: rhbz#1328386


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-82
changelog:
  - portblock: create tickle_dir if it doesn't exist
  - tomcat: use systemd if available

    Resolves: rhbz#1303037
    Resolves: rhbz#1249430


author: Steve Dickson <steved@redhat.com> - 0.2.0-35
changelog:
  - Restart rpcbind.socket on restarts (bz 1303751)
  - Added localhost:111 to rpcbind socket activation (bz 1293430)
  - Soft static allocate rpc uid/gid (bz 1321279)


author: Lokesh Mandvekar <lsm5@redhat.com> - 1.0.0-1.rc2
changelog:
  - Resolves: #1412239 - *CVE-2016-9962* - set init processes as non-dumpable,
  runc patch from Michael Crosby <crosbymichael@gmail.com>


author: Lokesh Mandvekar <lsm5@redhat.com> - 1.0.0-9.1.gitf8ce01d
changelog:
  - Resolves: #1447078 - change default root path
  - add commit e800860 from runc @projectatomic/change-root-path


author: Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.25-3
changelog:
  - Drop "Verify and Correct File Permissions with RPM" rule from the PCI-DSS
    profile for Red Hat Enterprise Linux 7 (RH BZ#1267861)


author: Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.30-1
changelog:
  - Update to upstream's 0.1.30 release:
    https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.30
    (RH BZ#1289533)
  - Drop remediation functions library since starting from 0.1.30 release
    remediation scripts are part of the benchmarks directly
  - Drop three patches that have been accepted upstream in the meantime
  - Update drop-rpm-verify-permissions-rule patch to work properly against
    0.1.30 release


author: Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.30-2
changelog:
  - Fix issue of two STIG profiles for Red Hat Enterprise Linux 6 benchmark
    having the identical title (RH BZ#1351541)
  - Enhance the shared OVAL check for 'Set Deny For Failed Password Attempts'
    rule and also Red Hat Enterprise Linux 7 OVAL check for 'Configure the root
    Account for Failed Password Attempts' rule to report correct system status
    WRT to these requirements also in the case the SSSD daemon is used
    (RH BZ#1344581)
  - Include currently available kickstart files and produced HTML tables for
    Red Hat Enterprise Linux 6 and 7 products into the produced RPM package
    (RH BZ#1351751)


author: Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.30-3
changelog:
  - Correct the remediation script for 'Enable Smart Card Login' rule
    for Red Hat Enterprise Linux 7 (RH BZ#1357019)


author: Watson Sato <wsato@redhat.com> 0.1.30-5
changelog:
  - Fix template remediation function used by SSHD remediation
  - Reduce scope of patch that fixes SSHD remediation (RH BZ#1415152)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.7.5-8.el7
changelog:
  - seabios-turn-off-stack-switching-for-vgabios.patch [bz#1182634]
  - Resolves: bz#1182634
    (Remove CONFIG_VGA_ALLOCATE_EXTRA_STACK)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.7.5-9.el7_1
changelog:
  - seabios-boot.c-delay-exiting-boot-if-menu-key-is-ESC.patch [bz#841638]
  - seabios-boot-switch-default-menu-key-to-ESC.patch [bz#841638]
  - Resolves: bz#841638
    (Provide a platform agnostic approach to invoking the BIOS, boot menu, or other BIOS functions)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.7.5-10.el7
changelog:
  - seabios-fw-pci-scan-all-buses-if-extraroots-romfile-is-prese.patch [bz#1235381]
  - seabios-fw-pci-map-memory-and-IO-regions-for-multiple-pci-ro.patch [bz#1235381]
  - Resolves: bz#1235381
    (RFE: configure guest NUMA node locality for guest PCI devices)


author: Yash Mankad <ymankad@redhat.com> - 1.7.5-11.el7
changelog:
  - seabios-bootorder-Update-extra-pci-root-buses-bootorder-form.patch [bz#1242968]
  - Resolves: bz#1242968
    (pci: support booting of devices behind PXB)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.1-2.el7
changelog:
  - seabios-fw-pci-add-Q35-S3-support.patch [bz#1185721]
  - Resolves: bz#1185721
    (win7 guest (boot with q35) show dark screen after do S3)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.1-3.el7
changelog:
  - seabios-redhat-reserve-more-memory-on-fseg.patch [bz#1327060]
  - seabios-redhat-turn-off-some-config-options.patch [bz#1327060]
  - Resolves: bz#1327060
    ([Seabios]Limited boot number supported for SCSI/SATA)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.1-4.el7
changelog:
  - seabios-Build-vgabios-virtio.bin.patch [bz#1327001]
  - Resolves: bz#1327001
    (vgabios-virtio.bin should be included  in seavgabios-bin package)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.1-5.el7
changelog:
  - seabios-pci-don-t-map-virtio-1.0-storage-devices-above-4G.patch [bz#1373154]
  - Resolves: bz#1373154
    (Guest fails boot up with ivshmem-plain and virtio-pci device)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.1-5.el7_3.1
changelog:
  - seabios-vgabios-Reorder-video-modes-to-work-around-a-Windows.patch [bz#1392028]
  - Resolves: bz#1392028
    ([virtio-win][svvp][ws2016] cannot generate dump file when using nmi on ws2016 and win10-32/64)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.1-5.el7_3.2
changelog:
  - seabios-acpi_extract-Move-main-code-to-new-function-main.patch [bz#1400102]
  - seabios-acpi_extract-Make-the-generated-.hex-files-more-huma.patch [bz#1400102]
  - seabios-acpi_extract-Don-t-generate-unused-and-empty-q35-acp.patch [bz#1400102]
  - seabios-acpi-Don-t-build-SSDT-files-on-every-build-store-the.patch [bz#1400102]
  - Resolves: bz#1400102
    (decouple the SeaBIOS build from iasl)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.1-5.el7_3.3
changelog:
  - seabios-resume-Make-KVM-soft-reboot-loop-detection-more-flex.patch [bz#1440706]
  - seabios-resume-Don-t-attempt-to-use-generic-reboot-mechanism.patch [bz#1440706]
  - Resolves: bz#1440706
    (reboot hangs on rhel6 machine types (~1/20 times))


author: Miroslav Grepl <mgrepl@redhat.com> - 3.13.1-102.4
changelog:
  - Allow GlusterFS with RDMA transport to be started correctly. It requires ipc_lock capability together with rw permission on rdma_cm device.
  Resolves:#1386620
  - Allow glusterd to get attributes on /sys/kernel/config directory.
  Resolves:#1386621


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-102.5
changelog:
  - Fix error message during update from RHEL-7.2 to RHEL-7.3, when /usr/sbin/semanage command is not installed and selinux-policy-migrate-local-changes.sh script is executed in %post install phase of selinux-policy package
  Resolves: rhbz#1393045


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-102.7
changelog:
  - Update systemd on RHEL-7.2 box to version from RHEL-7.3 and then as a separate yum command update the selinux policy systemd will start generating USER_AVC denials and will start returning "Access Denied" errors to DBus clients.
  Resolves: rhbz#1394715


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-102.8
changelog:
  - Allow puppetagent_t to access timedated dbus. Use the systemd_dbus_chat_timedated interface to allow puppetagent_t the access.
  Resolves: rhbz#1400505


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-102.12
changelog:
  - Allow glusterd_t to bind on glusterd_port_t udp ports.
  Resolves: rhbz#1408128
  - Allow glusterd_t send signals to userdomain. Label new glusterd binaries as glusterd_exec_t
  Resolves: rhbz#1408128
  - Fixes for containers
  - Allow containers to attempt to write to unix_sysctls.
  - Allow cotainers to use the FD's leaked to them from parent processes.
  Resolves: rhbz#1408126
  - Allow systemd to stop glusterd_t domains.
  Resolves: rhbz#1408125


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-102.13
changelog:
  - Allow systemd container to read/write usermodehelperstate
  Resolves: rhbz#1408126
  - Allow glusterd_t to bind on glusterd_port_t udp ports.
  Resolves: rhbz#1408128


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-102.16
changelog:
  - Allow openvswitch read script state.
  - Allow openvswitch exec hostname and readinitrc_t files
  Resolves: rhbz#1430751


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-96
changelog:
  - Allow arpwatch to create netlink netfilter sockets. Resolves: rhbz#1358261
  - Fix file context for /etc/pki/pki-tomcat/ca/
  - new interface oddjob_mkhomedir_entrypoint()
  - Move label for /var/lib/docker/vfs/ to proper SELinux module
  - Allow mdadm to get attributes from all devices.
  - Label /etc/puppetlabs as puppet_etc_t.
  - Allow systemd-machined to communicate to lxc container using dbus
  - Allow systemd_resolved to send dbus msgs to userdomains Resolves: rhbz#1236579
  - Allow systemd-resolved to read network sysctls Resolves: rhbz#1236579
  - Allow systemd_resolved to connect on system bus. Resolves: rhbz#1236579
  - Make entrypoint oddjob_mkhomedir_exec_t for unconfined_t
  - Label all files in /dev/oracleasmfs/ as oracleasmfs_t Resolves: rhbz#1331383


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-97
changelog:
  - Add oracleasm_conf_t type and allow oracleasm_t to create /dev/oracleasm
  Resolves: rhbz#1331383
  - Label /usr/share/pcp/lib/pmie as pmie_exec_t and /usr/share/pcp/lib/pmlogger as pmlogger_exec_t
  Resolves: rhbz#1206525
  - Allow mdadm_t to getattr all device nodes
  Resolves: rhbz#1365171
  - Add interface dbus_dontaudit_stream_connect_system_dbusd()
  Resolves:rhbz#1052880
  - Add virt_stub_* interfaces for docker policy which is no longer a part of our base policy.
  Resolves: rhbz#1372705
  - Allow guest-set-user-passwd to set users password.
  Resolves: rhbz#1369693
  - Allow samdbox domains to use msg class
  Resolves: rhbz#1372677
  - Allow domains using kerberos to read also kerberos config dirs
  Resolves: rhbz#1368492
  - Allow svirt_sandbox_domains to r/w onload sockets
  Resolves: rhbz#1342930
  - Add interface fs_manage_oracleasm()
  Resolves: rhbz#1331383
  - Label /dev/kfd as hsa_device_t
  Resolves: rhbz#1373488
  - Update seutil_manage_file_contexts() interface that caller domain can also manage file_context_t dirs
  Resolves: rhbz#1368097
  - Add interface to write to nsfs inodes
  Resolves: rhbz#1372705
  - Allow systemd services to use PrivateNetwork feature
  Resolves: rhbz#1372705
  - Add a type and genfscon for nsfs.
  Resolves: rhbz#1372705
  - Allow run sulogin_t in range mls_systemlow-mls_systemhigh.
  Resolves: rhbz#1290400


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-98
changelog:
  - Update oracleasm SELinux module that can manage oracleasmfs_t blk files. Add dac_override cap to oracleasm_t domain.
  Resolves: rhbz#1331383
  - Add few rules to pcp SELinux module to make ti able to start pcp_pmlogger service
  Resolves: rhbz#1206525


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-99
changelog:
  - Allow iscsid create netlink iscsid sockets.
  Resolves: rhbz#1358266
  - Improve regexp for power_unit_file_t files. To catch just systemd power unit files.
  Resolves: rhbz#1375462


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-100
changelog:
  - Allow ftp daemon to manage apache_user_content
  Resolves: rhbz#1097775
  - Label /etc/sysconfig/oracleasm as oracleasm_conf_t
  Resolves: rhbz#1331383
  - Allow oracleasm to rw inherited fixed disk device
  Resolves: rhbz#1331383
  - Allow collectd to connect on unix_stream_socket
  Resolves: rhbz#1377259


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-101
changelog:
  - Allow pcp_pmcd_t domain transition to lvm_t Add capability kill and sys_ptrace to pcp_pmlogger_t
  Resolves: rhbz#1309883


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-102.1
changelog:
  - Allow sssd_selinux_manager_t to manage also dir class.
  Resolves: rhbz#1380687
  - Add interface seutil_manage_default_contexts_dirs()
  Resolves: rhbz#1380687


author: Petr Lautrbach <plautrba@redhat.com> - 3.13.1-102.3
changelog:
  - Use selinux-policy-migrate-local-changes.sh instead of migrateStore* macros
  Resolves: rhbz#1383450
  - Add selinux-policy-migrate-local-changes service
  Resolves: rhbz#1383450


author: Peter Jones <pjones@redhat.com> - 11-1
changelog:
  - Update to 11-1
    Related: rhbz#1310766
  - Fix regression in PE loader
    Related: rhbz#1310766
  - Fix case where BDS invokes us wrong and we exec shim again as a result
    Related: rhbz#1310766


author: Peter Jones <pjones@redhat.com> - 15-3
changelog:
  - Fight with binutils to try to get a binary without timestamps in it.  Again.
    Related: rhbz#1649270


author: Peter Jones <pjones@redhat.com> - 15-4
changelog:
  - Fight with binutils to try to get a binary without timestamps in it.
    Again, but without breaking aarch64 this time.
    Related: rhbz#1649270


author: Peter Jones <pjones@redhat.com> - 15-5
changelog:
  - Fix a couple more things that are breaking reproducability, and thus
    breaking external review.
    Related: rhbz#1649270


author: Peter Jones <pjones@redhat.com> - 15-6
changelog:
  - Rebuild for bug fixes and new signing keys
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 15-7
changelog:
  - Implement Lenny's workaround.
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 15-8.el7
changelog:
  - Fix a load-address-dependent forever loop.
    Resolves: rhbz#1862045
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311
    Related: CVE-2020-15705
    Related: CVE-2020-15706
    Related: CVE-2020-15707


author: Pavel Moravec <pmoravec@redhat.com> = 3.2-36
changelog:
  - [ceph] collect /var/lib/ceph and /var/run/ceph
    Resolves: bz1260607
  - [sosreport] prepare report in a private subdirectory
    Resolves: bz1290955


